aedneth · aedneth · Jun 7, 2026 · Jun 6, 2026 · Jun 7, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
       - name: Check for accidentally committed secrets
         run: |
           # Basic check for common secret patterns
-          if grep -rE "(ANTHROPIC_API_KEY|sk-ant-|sk-proj-|ghp_|gho_)" \
+          if grep -rE "(sk-ant-[A-Za-z0-9_-]{16,}|sk-proj-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,})" \
                --include="*.md" --include="*.json" --include="*.sh" \
                --exclude-dir=".git" . 2>/dev/null | grep -v "example\|placeholder\|YOUR_KEY"; then
             echo "Potential secret found in committed files. Review above matches."

diff --git a/00-inbox/CONVENTION.md b/00-inbox/CONVENTION.md
@@ -1,3 +1,13 @@
+---
+type: system
+subtype: convention
+folder: 00-inbox
+created: 2026-05-29
+modified: 2026-06-06
+status: active
+tags: [convention, systems, ckis]
+---
+
 # 00-inbox — Capture Zone
 
 **Purpose:** Everything enters the vault here first. Never organize in the moment — capture now, process later.

diff --git a/00-systems/_convention.md b/00-systems/_convention.md
@@ -0,0 +1,46 @@
+---
+type: system
+subtype: convention
+folder: 00-systems
+created: 2026-05-24
+modified: 2026-06-06
+status: active
+tags: [convention, systems, ckis]
+related:
+  - "[[00-systems/ckis/02-obsidian-vault-architecture]]"
+canonical: true
+---
+
+# Convention — 00-systems/
+
+## Purpose
+Vault infrastructure — the systems that make the Second Brain function. This is not knowledge content; it is the architecture and operational protocols of CKIS. Only [OWNER] and their agents need to read this; it is not oriented toward day-to-day consultable content.
+
+## Internal Structure
+
+```
+00-systems/
+├── ckis/          → CKIS architecture: rules, templates, protocols, memory
+├── workflows/     → Reusable CKIS workflows (with _index.md)
+├── tools/         → Reusable tools: prompts, scripts, configs
+└── sops/          → SOPs: executable, repeatable procedures (_index.md + _convention.md)
+```
+
+## What Goes Here
+- System architecture and rules files (CKIS)
+- Reusable operational workflows
+- Support tools (production prompts, maintenance scripts)
+- Cross-cutting SOPs — executable, repeatable procedures that span multiple projects or govern CKIS itself
+
+## What Does NOT Go Here
+- Knowledge notes → `03-knowledge/`
+- Active projects → `02-projects/`
+- Agent skills → `~/.claude/skills/` (outside the vault) or `.claude/ckis-skills/` (vault-local)
+
+## Modification Rule
+Files in `00-systems/ckis/` are high-consequence — read the CHANGELOG before editing. For non-trivial changes, make a backup in `.claude/backups/` and log the change in `00-systems/ckis/CHANGELOG.md`.
+
+## Related Folders
+- [[00-systems/ckis/_CONVENTION]] — CKIS folder convention
+- [[00-systems/tools/_convention]] — reusable tools
+- [[00-systems/workflows/_index.md]] — workflows index (companion _convention at root folder)
diff --git a/00-systems/ckis/00-ckis-master-context.md b/00-systems/ckis/00-ckis-master-context.md
@@ -1,7 +1,7 @@
 ---
 type: system
 created: 2026-05-02
-modified: 2026-05-04
+modified: 2026-06-06
 tags: [ckis, system, master-context]
 status: active
 related: ["[[01-ckis-user-profile-and-operating-context]]", "[[02-obsidian-vault-architecture]]"]
@@ -123,6 +123,7 @@ The CKIS vault is the **canonical source of truth** for strategic knowledge. Eve
 - **Decision mode** — decision logs (see `06-decision-execution-and-review-protocol.md`).
 - **Review mode** — daily brief, weekly review, monthly consolidation.
 - **Maintenance mode** — `sync overviews`, archive, template updates (see `13-maintenance-and-update-protocol.md`).
+- **SOP mode** — capture executable, repeatable procedures as first-class `type: sop` SOPs under `00-systems/sops/` (cross-cutting) or a project's `processes/` (project-specific). Registry: [[00-systems/sops/_index]]; convention: [[00-systems/sops/_convention]].
 
 ## 8. Confirmed Facts
 

diff --git a/00-systems/ckis/02-obsidian-vault-architecture.md b/00-systems/ckis/02-obsidian-vault-architecture.md
@@ -1,7 +1,7 @@
 ---
 type: system
 created: 2026-05-02
-modified: 2026-05-13
+modified: 2026-06-06
 tags: [ckis, vault, architecture]
 status: active
 related: ["[[00-ckis-master-context]]", "[[07-projects-areas-resources-archives-map]]", "[[08-note-templates-and-frontmatter]]"]
@@ -74,10 +74,11 @@ related: ["[[00-ckis-master-context]]", "[[07-projects-areas-resources-archives-
 │   └── client-note.md
 ├── 09-archive/                  # Completed or inactive
 ├── 00-system/                   # CKIS system files (this folder)
-│   └── CKIS/
-│       ├── 00-ckis-master-context.md
-│       ├── 01-ckis-user-profile-and-operating-context.md
-│       └── ...
+│   ├── CKIS/
+│   │   ├── 00-ckis-master-context.md
+│   │   ├── 01-ckis-user-profile-and-operating-context.md
+│   │   └── ...
+│   └── sops/                    # SOPs — executable, repeatable procedures (_index.md + _convention.md)
 ├── .claude/
 │   ├── CLAUDE.md                # Master instructions + command shortcuts
 │   ├── ckis-skills/             # Vault-specific CKIS workflow skills (25 skills)
@@ -120,7 +121,7 @@ Every note has YAML frontmatter:
 
 ```yaml
 ---
-type: [permanent-note | literature-note | project | daily | resource | capture | area | goal | person | system]
+type: [permanent-note | literature-note | project | daily | resource | capture | area | goal | person | system | sop]
 created: YYYY-MM-DD
 modified: YYYY-MM-DD
 tags: []
@@ -164,6 +165,7 @@ Notes:
 | `goal` | `06-goals/` | Annual / monthly / weekly goal notes |
 | `person` | `07-people/<sub>/` | Relationship notes |
 | `system` | `00-system/ckis/` | CKIS architecture and operating rules |
+| `sop` | `00-systems/sops/` or `<project>/processes/` | Executable, repeatable step-by-step procedure (SOP) |
 
 ## 9. Dashboards & Indexes
 

diff --git a/00-systems/ckis/08-note-templates-and-frontmatter.md b/00-systems/ckis/08-note-templates-and-frontmatter.md
@@ -1,7 +1,7 @@
 ---
 type: system
 created: 2026-05-02
-modified: 2026-05-28
+modified: 2026-06-06
 tags: [ckis, templates, frontmatter]
 status: active
 related: ["[[02-obsidian-vault-architecture]]", "[[04-claude-code-obsidian-agent]]"]
@@ -17,7 +17,7 @@ related: ["[[02-obsidian-vault-architecture]]", "[[04-claude-code-obsidian-agent
 
 ```yaml
 ---
-type: [permanent-note | literature-note | project | archive-note | daily | resource | capture | area | goal | person | system]
+type: [permanent-note | literature-note | project | archive-note | daily | resource | capture | area | goal | person | system | sop]
 created: YYYY-MM-DD
 modified: YYYY-MM-DD
 tags: []
@@ -29,7 +29,7 @@ related: []
 
 Field rules:
 
-- `type` — required; one of the enum.
+- `type` — required; one of the enum. `sop` for Standard Operating Procedures (see §14).
 - `created` — required; never overwrite.
 - `modified` — required; should equal the latest git commit date (`git log` is authoritative, not filesystem `mtime`).
 - `tags` — kebab-case strings without leading `#`.
@@ -367,3 +367,36 @@ related: []
 ```
 
 Used for files in `00-system/ckis/`. Keeps tone and structure consistent across the system folder.
+
+## 14. SOP Template
+
+For Standard Operating Procedures in `00-systems/sops/` or `<project>/processes/`. Canonical convention: [[00-systems/sops/_convention]].
+
+```yaml
+---
+type: sop
+created: YYYY-MM-DD
+modified: YYYY-MM-DD
+tags: [sop, <domain>, ...]
+status: active            # active | draft | deprecated
+sop_domain: <domain>      # ckis | dev | os-hardware | [your-project] | content ...
+trigger: ""               # invocation phrase if agent-invokable, else empty
+related: []
+---
+```
+
+```markdown
+# SOP — <Process Name>
+> One-line purpose · who runs this · when.
+
+## 1. Purpose & Scope
+## 2. When to Execute
+## 3. Prerequisites
+## 4. Steps
+## 5. Verification / Expected Output
+## 6. Troubleshooting        (optional — symptom | cause | fix table)
+## 7. Notes & Exceptions / Lessons Learned   (optional)
+## 8. Agent-Delegatable Summary   (optional — paste block to hand an agent)
+
+*SOP v<x> — <author> — <date>*
+```
diff --git a/00-systems/ckis/13-maintenance-and-update-protocol.md b/00-systems/ckis/13-maintenance-and-update-protocol.md
@@ -1,7 +1,7 @@
 ---
 type: system
 created: 2026-05-02
-modified: 2026-05-02
+modified: 2026-06-06
 tags: [ckis, maintenance, updates]
 status: active
 related: ["[[00-ckis-master-context]]", "[[09-cross-model-shared-context-protocol]]"]
@@ -25,6 +25,7 @@ related: ["[[00-ckis-master-context]]", "[[09-cross-model-shared-context-protoco
 | CKIS architecture change | the relevant `00-system/ckis/<file>.md`, `CHANGELOG.md`, ChatGPT upload package |
 | New decision protocol | `[[06-decision-execution-and-review-protocol]]` |
 | Frontmatter / template change | `[[02-obsidian-vault-architecture]]` §5, `[[08-note-templates-and-frontmatter]]` |
+| New SOP | create in correct tier, fill from `[[08-templates/sop]]`, register in `[[00-systems/sops/_index]]`, CHANGELOG if cross-cutting |
 
 ## 2. Adding a New Project
 
@@ -35,6 +36,15 @@ related: ["[[00-ckis-master-context]]", "[[09-cross-model-shared-context-protoco
 5. If a project repository exists at `~/<slug>/`, plan the project-level `CLAUDE.md` bridge (open question — see `[[00-ckis-master-context]]` §9 #3).
 6. First commit: `feat: add <slug> project`.
 
+## 2b. Adding a New SOP
+
+1. Decide tier — project-specific → `02-projects/<project>/processes/`; cross-cutting/system/personal → `00-systems/sops/<domain>/`.
+2. Copy `[[08-templates/sop]]`.
+3. Fill §1–5 (required).
+4. Add a row to `[[00-systems/sops/_index]]`.
+5. CHANGELOG entry if cross-cutting/system-level.
+6. First commit: `feat(sop): add <name> SOP`.
+
 ## 3. Updating Context Files
 
 System files in `00-inbox/` (`_PROFILE.md`, `_INTERESTS.md`, `_ACTIVE-PROJECTS.md`, `_MEMORY.md`):

diff --git a/00-systems/sops/_convention.md b/00-systems/sops/_convention.md
@@ -0,0 +1,144 @@
+---
+type: system
+subtype: convention
+folder: 00-systems/sops
+created: 2026-06-06
+modified: 2026-06-06
+status: active
+tags: [convention, systems, ckis, sop]
+related:
+  - "[[00-systems/ckis/02-obsidian-vault-architecture]]"
+  - "[[00-systems/ckis/08-note-templates-and-frontmatter]]"
+  - "[[00-systems/_convention]]"
+canonical: true
+---
+
+# Convention — 00-systems/sops/
+
+## Purpose
+
+An **SOP (Standard Operating Procedure)** is an executable, repeatable, step-by-step procedure for accomplishing a specific operational task. You run an SOP; you do not just read it.
+
+**SOP vs permanent note vs workflow:**
+
+| Artifact | Lives in | What it is | How you use it |
+|----------|----------|------------|----------------|
+| **SOP** | `00-systems/sops/<domain>/` or `<project>/processes/` | Executable step-by-step procedure | You run it start-to-finish |
+| **Permanent note** | `03-knowledge/` | Compounding knowledge — insight, concept, framework | You read, reference, and build on it |
+| **Workflow** | `00-systems/workflows/` | Large multi-file operating system for a work domain | You activate and maintain it long-term |
+
+This file is the convention companion to `_index.md`. The `_index.md` is the registry of every active SOP; this `_convention.md` defines what can live here and how.
+
+━━━
+
+## What Goes Here
+
+- Cross-cutting SOPs that apply to CKIS, development, OS/hardware, or content — not specific to one project
+- Subdomain folders: `ckis/`, `dev/`, `os-and-hardware/`, `content/`
+- The root `_index.md` that registers every SOP (both tiers)
+
+## What Does NOT Go Here
+
+- Project-specific SOPs → stay in `02-projects/<project>/processes/`
+- Conceptual frameworks → `03-knowledge/frameworks/`
+- Generic knowledge guides → `03-knowledge/guides/`
+- Agent skills (Claude Code) → `~/.claude/skills/` or `.claude/ckis-skills/`
+- Source code or scripts → external code repository
+
+━━━
+
+## Two-Tier Home Rule
+
+```
+Tier 1 — Project-local:   02-projects/<project>/processes/
+          For SOPs tightly coupled to one project's operations.
+          Owned by that project's team/context.
+
+Tier 2 — Cross-cutting:   00-systems/sops/<domain>/
+          For SOPs that span projects, apply to CKIS itself,
+          or govern [OWNER]'s personal operating system.
+
+BOTH tiers are registered in [[00-systems/sops/_index]].
+```
+
+━━━
+
+## File Naming Convention
+
+- `-sop.md` suffix for all SOP files
+- Descriptive kebab-case prefix for the process name
+- Examples:
+  - `inbox-processing-sop.md`
+  - `weekly-review-sop.md`
+  - `client-site-deploy-sop.md`
+  - `api-key-rotation-sop.md`
+  - `pop-os-fresh-install-sop.md`
+
+━━━
+
+## Required Frontmatter
+
+```yaml
+---
+type: sop
+created: YYYY-MM-DD
+modified: YYYY-MM-DD
+tags: [sop, <domain>, ...]
+status: active            # active | draft | deprecated
+sop_domain: <domain>      # ckis | dev | os-hardware | [your-project] | content ...
+trigger: ""               # invocation phrase if agent-invokable, else empty
+related: []
+---
+```
+
+━━━
+
+## Body Template
+
+```markdown
+# SOP — <Process Name>
+> One-line purpose · who runs this · when.
+
+## 1. Purpose & Scope
+## 2. When to Execute
+## 3. Prerequisites
+## 4. Steps
+## 5. Verification / Expected Output
+## 6. Troubleshooting        (optional — symptom | cause | fix table)
+## 7. Notes & Exceptions / Lessons Learned   (optional)
+## 8. Agent-Delegatable Summary   (optional — paste block to hand an agent)
+
+*SOP v<x> — <author> — <date>*
+```
+
+Sections §1–5 are **required**. Sections §6–8 are optional but encouraged for complex or agent-invokable SOPs.
+
+━━━
+
+## Domains
+
+| Domain | Lives in | Examples |
+|--------|----------|---------|
+| `ckis` | `00-systems/sops/ckis/` | Inbox processing, weekly review, CKIS maintenance |
+| `dev` | `00-systems/sops/dev/` | Repo bootstrap, deployment runbooks, API key rotation |
+| `os-hardware` | `00-systems/sops/os-and-hardware/` | Pop!_OS install, USB boot, hardware setup |
+| `content` | `00-systems/sops/content/` | YouTube upload, social post, newsletter send |
+| `project-local` | `<project>/processes/` | [YOUR_PROJECT] client onboarding, [YOUR_CLIENT] deploy |
+
+━━━
+
+## How to Add a New SOP
+
+1. **Pick tier** — project-local (`<project>/processes/`) or cross-cutting (`00-systems/sops/<domain>/`).
+2. **Copy template** — duplicate `[[08-templates/sop]]` into the target folder.
+3. **Fill §1–5** — at minimum, complete Purpose, When to Execute, Prerequisites, Steps, and Verification.
+4. **Register** — add a row to `[[00-systems/sops/_index]]` under the correct domain subheading.
+5. **CHANGELOG** — if the SOP is cross-cutting or modifies CKIS, add an entry to `[[00-systems/ckis/CHANGELOG]]`.
+
+━━━
+
+## Related Folders
+
+- [[00-systems/workflows/_convention]] — workflows (large multi-file operating systems)
+- `<project>/processes/_convention.md` — project-local SOP convention (generalised by this file)
+- [[08-templates/_convention]] — Obsidian templates (includes `sop.md` template)