Add CTO navigation index

INDEX.md

@@ -0,0 +1,30 @@
+# CTO Index
+
+Route: `cto`.
+Path: `/home/svrnty/workspaces/cortex-os/cto`.
+Category: child-local CTO planning workspace for governed execution routing.
+Validator: `python3 tools/validate_cto_child.py`.
+
+## Read Order
+
+1. `AGENTS.md` for the universal and repo-custom agent contract.
+2. `README.md` for route posture, boundaries, and current stage.
+3. `docs/LEGACY-INGEST.md` for old-work intention distillation.
+4. `.sot/03-PROTOCOLS/` only for the specific planning or evidence packet needed.
+5. `WORKBOARD.yaml` for child-local work state.
+
+## Local Authority
+
+CTO owns child-local execution-routing planning, adapter design, transportability briefs, staged proof gates, target-repo admission templates, approval packets, evidence interface contracts, and validation scaffolds.
+
+CTO is not Core authority, Runtime authority, Host Runtime authority, backend ownership, vendor-source authority, external developer repo authority, execution-backend authority, provider authority, target-repo mutation authority, Profile Exposure authority, release authority, production-readiness authority, or product-readiness authority.
+
+## Legacy Relation
+
+Old CTO planning, Case/Hermes/Pi/Codex/backend, provider, retention, and target-sandbox work is admitted by intention only. Do not activate Case as default backend, mutate target repositories, mutate vendor source, call providers, read secrets, rerun Harness/Case, mutate Core/Seed/sibling/OpenDesign, archive/delete, publish, deploy, release, or import implementation mass because it exists.
+
+## Completion State
+
+Stage: CLEAN.
+Clean score: 100.
+Current next pass: keep CTO navigable as planning-only; new execution requires explicit governed admission, approval, and fresh evidence.

WORKBOARD.yaml

@@ -511,3 +511,8 @@ items:
     status: validated
     source: AGENTS.md
     owner: ""
+  - id: CTO-WORK-103
+    title: CTO Navigation Index
+    status: validated
+    source: INDEX.md
+    owner: ""

tools/validate_cto_child.py

@@ -13,6 +13,7 @@ ROOT = Path(__file__).resolve().parents[1]
 REQUIRED_FILES = [
     "AGENTS.md",
     "README.md",
+    "INDEX.md",
     "WORKBOARD.yaml",
     "CONTEXT.md",
     "docs/LEGACY-INGEST.md",
@@ -139,6 +140,16 @@ README_CONTRACT_SNIPPETS = [
     "permission to activate Case, mutate target repos, call providers, read secrets, publish, deploy, or release",
 ]
 
+INDEX_CONTRACT_SNIPPETS = [
+    "Route: `cto`.",
+    "Category: child-local CTO planning workspace for governed execution routing.",
+    "CTO owns child-local execution-routing planning",
+    "CTO is not Core authority, Runtime authority, Host Runtime authority",
+    "Do not activate Case as default backend, mutate target repositories",
+    "Stage: CLEAN.",
+    "Clean score: 100.",
+]
+
 REQUIRED_BRIEF_PHRASES = [
     "Cortex governs.",
     "Hermes controls.",
@@ -1902,6 +1913,14 @@ def main() -> int:
             if snippet not in text:
                 errors.append(f"missing_readme_contract_snippet:{snippet}")
 
+    index = ROOT / "INDEX.md"
+    if index.is_file():
+        text = index.read_text(encoding="utf-8")
+        for snippet in INDEX_CONTRACT_SNIPPETS:
+            checked.append(f"index_contract_snippet:{snippet}")
+            if snippet not in text:
+                errors.append(f"missing_index_contract_snippet:{snippet}")
+
     legacy_ingest = ROOT / "docs/LEGACY-INGEST.md"
     if legacy_ingest.is_file():
         text = legacy_ingest.read_text(encoding="utf-8")
@@ -3121,7 +3140,7 @@ def main() -> int:
             checked.append(f"workboard_id:{issue_id}")
             if issue_id not in text:
                 errors.append(f"missing_workboard_id:{issue_id}")
-        for issue_id in ["CTO-WORK-098", "CTO-WORK-099", "CTO-WORK-100", "CTO-WORK-101", "CTO-WORK-102"]:
+        for issue_id in ["CTO-WORK-098", "CTO-WORK-099", "CTO-WORK-100", "CTO-WORK-101", "CTO-WORK-102", "CTO-WORK-103"]:
             checked.append(f"workboard_id:{issue_id}")
             if issue_id not in text:
                 errors.append(f"missing_workboard_id:{issue_id}")
@@ -3225,6 +3244,7 @@ def main() -> int:
             "CTO-WORK-100": "validated",
             "CTO-WORK-101": "validated",
             "CTO-WORK-102": "validated",
+            "CTO-WORK-103": "validated",
         }
         for issue_id, expected in expected_statuses.items():
             checked.append(f"workboard_status:{issue_id}:{expected}")
@@ -3335,6 +3355,10 @@ def main() -> int:
             errors.append("workboard_missing_agent_contract_title")
         if "source: AGENTS.md" not in text:
             errors.append("workboard_missing_agent_contract_source")
+        if "CTO Navigation Index" not in text:
+            errors.append("workboard_missing_navigation_index_title")
+        if "source: INDEX.md" not in text:
+            errors.append("workboard_missing_navigation_index_source")
 
     payload = {
         "ok": not errors,