{
  "$schema": "https://hermes-codex.org/schemas/feature-registry-v4.json",
  "version": "4.0",
  "name": "Hermes Codex Unified Feature Registry",
  "specification": "Section 54 - Canonical Capability Registry",
  "description": "Comprehensive catalog of all Hermes Cyber Risk Intelligence capabilities mapped to the 7-step intelligence lifecycle (Observe, Understand, Track, Predict, Decide, Verify, Remember).",
  "last_updated": "2026-09-22T14:15:00Z",
  "total_features": 22,
  "metrics": {
    "total": 22,
    "public_tier": 22,
    "commercial_tier": 16,
    "by_category": {
      "observe": 3,
      "understand": 4,
      "track": 3,
      "predict": 2,
      "decide": 6,
      "verify": 2,
      "remember": 2
    },
    "by_audience": {
      "security-leaders": 17,
      "analysts": 15,
      "engineering": 13,
      "ai-security": 5
    }
  },
  "categories": {
    "observe": {
      "name_en": "Observe",
      "name_fr": "Observer",
      "question_en": "What changed?",
      "question_fr": "Qu'est-ce qui a changé ?"
    },
    "understand": {
      "name_en": "Understand",
      "name_fr": "Comprendre",
      "question_en": "Why does it matter?",
      "question_fr": "Pourquoi est-ce important ?"
    },
    "track": {
      "name_en": "Track",
      "name_fr": "Suivre",
      "question_en": "How is the risk evolving?",
      "question_fr": "Comment le risque évolue-t-il ?"
    },
    "predict": {
      "name_en": "Predict",
      "name_fr": "Prédire",
      "question_en": "What could happen next?",
      "question_fr": "Que pourrait-il se passer ensuite ?"
    },
    "decide": {
      "name_en": "Decide",
      "name_fr": "Décider",
      "question_en": "What should we examine or do?",
      "question_fr": "Que devrions-nous examiner ou faire ?"
    },
    "verify": {
      "name_en": "Verify",
      "name_fr": "Vérifier",
      "question_en": "What happened?",
      "question_fr": "Que s'est-il réellement passé ?"
    },
    "remember": {
      "name_en": "Remember",
      "name_fr": "Mémoriser",
      "question_en": "What did we learn?",
      "question_fr": "Qu'avons-nous appris ?"
    }
  },
  "features": [
    {
      "id": "today-intelligence",
      "name": "Today's Intelligence",
      "name_fr": "Intelligence du Jour",
      "category": "observe",
      "audiences": [
        "security-leaders",
        "analysts",
        "engineering"
      ],
      "public": true,
      "commercial": false,
      "route": "/what-changed/",
      "route_fr": "/fr/what-changed/",
      "description": "Continuous 24-hour synthesized delta of observed threat landscape shifts, active weaponization, and CISA KEV additions.",
      "description_en": "Continuous 24-hour synthesized delta of observed threat landscape shifts, active weaponization, and CISA KEV additions.",
      "description_fr": "Synthèse continue sur 24h des bascules de menaces observées, des armements d'exploits et des inclusions CISA KEV.",
      "technical": {
        "api": "/api/daily-brief/latest.json",
        "methodology": "/methodology/#observation-model"
      }
    },
    {
      "id": "threat-observatory",
      "name": "Threat Observatory",
      "name_fr": "Observatoire des Menaces",
      "category": "observe",
      "audiences": [
        "analysts",
        "security-leaders"
      ],
      "public": true,
      "commercial": false,
      "route": "/observatory/",
      "route_fr": "/fr/observatory/",
      "description": "Global macro-telemetry dashboard across CVEs, threat actors, campaigns, and exploit maturity.",
      "description_en": "Global macro-telemetry dashboard across CVEs, threat actors, campaigns, and exploit maturity.",
      "description_fr": "Tableau de bord macro-analytique global couvrant les CVEs, acteurs de menace, campagnes et maturité des exploits.",
      "technical": {
        "api": "/api/stats.json",
        "methodology": "/methodology/#threat-model"
      }
    },
    {
      "id": "knowledge-graph",
      "name": "Knowledge Graph",
      "name_fr": "Graphe de Connaissances",
      "category": "understand",
      "audiences": [
        "analysts",
        "engineering"
      ],
      "public": true,
      "commercial": true,
      "route": "/knowledge-graph/",
      "route_fr": "/fr/knowledge-graph/",
      "description": "Multi-dimensional ontology connecting 556+ entities and 575+ relationships across vulnerabilities, actors, and TTPs.",
      "description_en": "Multi-dimensional ontology connecting 556+ entities and 575+ relationships across vulnerabilities, actors, and TTPs.",
      "description_fr": "Ontologie multidimensionnelle reliant 556+ entités et 575+ relations entre vulnérabilités, acteurs et TTPs.",
      "technical": {
        "api": "/api/graph.json",
        "methodology": "/platform/"
      }
    },
    {
      "id": "vulnerability-genome",
      "name": "Vulnerability Genome",
      "name_fr": "Génome de Vulnérabilité",
      "category": "understand",
      "audiences": [
        "analysts",
        "engineering"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/vulnerability-genome/",
      "route_fr": "/fr/tools/vulnerability-genome/",
      "description": "Structural taxonomic dissection of vulnerabilities across 8 orthogonal chromosomes to identify underlying root causes.",
      "description_en": "Structural taxonomic dissection of vulnerabilities across 8 orthogonal chromosomes to identify underlying root causes.",
      "description_fr": "Dissection taxonomique structurelle des vulnérabilités sur 8 chromosomes pour isoler la cause racine réelle.",
      "technical": {
        "api": "/api/genome/index.json",
        "methodology": "/methodology/#genome-model"
      }
    },
    {
      "id": "risk-trajectories",
      "name": "Risk Trajectories",
      "name_fr": "Trajectoires de Risque",
      "category": "track",
      "audiences": [
        "security-leaders",
        "analysts"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/trajectories/",
      "route_fr": "/fr/tools/trajectories/",
      "description": "Continuous risk curves R(t), velocity delta R / delta t, and inflection point detection categorized into 8 trajectory archetypes.",
      "description_en": "Continuous risk curves R(t), velocity delta R / delta t, and inflection point detection categorized into 8 trajectory archetypes.",
      "description_fr": "Courbes continues de risque R(t), vélocité delta R / delta t, et détection de points d'inflexion parmi 8 archétypes.",
      "technical": {
        "api": "/api/trajectories/index.json",
        "methodology": "/methodology/#trajectory-model"
      }
    },
    {
      "id": "security-delta",
      "name": "Security Delta",
      "name_fr": "Security Delta",
      "category": "track",
      "audiences": [
        "security-leaders",
        "engineering"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/security-delta/",
      "route_fr": "/fr/tools/security-delta/",
      "description": "Transversal comparator computing net risk differentials, exposure reduction, and blast radius containment across architecture states.",
      "description_en": "Transversal comparator computing net risk differentials, exposure reduction, and blast radius containment across architecture states.",
      "description_fr": "Comparateur transversal calculant le delta net de risque, la réduction d'exposition et le confinement d'impact.",
      "technical": {
        "api": "/api/security-delta/index.json",
        "methodology": "/methodology/#delta-model"
      }
    },
    {
      "id": "time-machine",
      "name": "Cyber Risk Time Machine",
      "name_fr": "Machine à Remonter le Risque",
      "category": "track",
      "audiences": [
        "analysts",
        "security-leaders"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/time-machine/",
      "route_fr": "/fr/tools/time-machine/",
      "description": "Discrete temporal snapshot diff engine navigating historical threat states and environmental posture shifts.",
      "description_en": "Discrete temporal snapshot diff engine navigating historical threat states and environmental posture shifts.",
      "description_fr": "Moteur de comparaison de snapshots temporels discrets reconstituant les états passés de la menace.",
      "technical": {
        "api": "/api/snapshots/index.json",
        "methodology": "/platform/data/"
      }
    },
    {
      "id": "forward-forecasts",
      "name": "Forward Forecasts",
      "name_fr": "Prédictions Falsifiables",
      "category": "predict",
      "audiences": [
        "security-leaders",
        "analysts"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/forecast/",
      "route_fr": "/fr/tools/forecast/",
      "description": "Falsifiable probabilistic predictions with strict time horizons, empirical confidence intervals, and explicit evidence chains.",
      "description_en": "Falsifiable probabilistic predictions with strict time horizons, empirical confidence intervals, and explicit evidence chains.",
      "description_fr": "Prédictions probabilistes falsifiables avec horizons stricts, intervalles de confiance et chaînes de preuves.",
      "technical": {
        "api": "/api/forecast/index.json",
        "methodology": "/methodology/#forecast-model"
      }
    },
    {
      "id": "forecast-benchmark",
      "name": "Prediction Benchmark & Brier Score",
      "name_fr": "Banc d'Étalonnage Prédictif",
      "category": "predict",
      "audiences": [
        "analysts",
        "security-leaders"
      ],
      "public": true,
      "commercial": false,
      "route": "/tools/benchmark/",
      "route_fr": "/fr/tools/benchmark/",
      "description": "Empirical self-calibration comparing historical predictions against real-world ground truth using the strict Brier score metric.",
      "description_en": "Empirical self-calibration comparing historical predictions against real-world ground truth using the strict Brier score metric.",
      "description_fr": "Auto-calibration empirique confrontant les prédictions passées à la réalité observée via le score de Brier.",
      "technical": {
        "api": "/api/benchmark/index.json",
        "methodology": "/methodology/#brier-score"
      }
    },
    {
      "id": "my-stack",
      "name": "My Stack Sovereign Analyzer",
      "name_fr": "Analyseur Souverain My Stack",
      "category": "decide",
      "audiences": [
        "engineering",
        "security-leaders",
        "analysts"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/my-stack/",
      "route_fr": "/fr/tools/my-stack/",
      "description": "100% in-browser private software stack and SBOM risk evaluator. Zero inventory data ever leaves the user device.",
      "description_en": "100% in-browser private software stack and SBOM risk evaluator. Zero inventory data ever leaves the user device.",
      "description_fr": "Évaluateur de stack logicielle et SBOM 100% exécuté dans le navigateur. Zéro donnée d'inventaire ne quitte votre machine.",
      "technical": {
        "storage": "localStorage:hermes_my_stack",
        "methodology": "/security/"
      }
    },
    {
      "id": "decision-engine",
      "name": "Hermes Decision Engine",
      "name_fr": "Moteur Décisionnel Hermes",
      "category": "decide",
      "audiences": [
        "security-leaders",
        "engineering"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/decision-engine/",
      "route_fr": "/fr/tools/decision-engine/",
      "description": "Prescriptive remediation directives (T0 Immediate, T1 Tactical, T2 Strategic) binding intelligence directly to decisive mitigation.",
      "description_en": "Prescriptive remediation directives (T0 Immediate, T1 Tactical, T2 Strategic) binding intelligence directly to decisive mitigation.",
      "description_fr": "Directives de remédiation prescriptives (T0 Immédiat, T1 Tactique, T2 Stratégique) liant l'analyse aux actions concrètes.",
      "technical": {
        "api": "/api/decision-engine/index.json",
        "methodology": "/methodology/#decision-model"
      }
    },
    {
      "id": "agent-blast-radius",
      "name": "Agent Blast Radius",
      "name_fr": "Rayon d'Impact Agentique",
      "category": "decide",
      "audiences": [
        "ai-security",
        "engineering"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/agent-blast-radius/",
      "route_fr": "/fr/tools/agent-blast-radius/",
      "description": "Simulates lateral propagation, tool hijacking, and credential exfiltration when autonomous AI agent boundaries fail.",
      "description_en": "Simulates lateral propagation, tool hijacking, and credential exfiltration when autonomous AI agent boundaries fail.",
      "description_fr": "Simulateur de propagation latérale, détournement d'outils et fuite de secrets en cas de rupture de périmètre d'agent IA.",
      "technical": {
        "api": "/api/blast-radius/index.json",
        "methodology": "/for/ai-security/"
      }
    },
    {
      "id": "agent-death-simulator",
      "name": "Agent Death Simulator",
      "name_fr": "Simulateur de Mort d'Agent",
      "category": "decide",
      "audiences": [
        "ai-security",
        "engineering"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/agent-death-simulator/",
      "route_fr": "/fr/tools/agent-death-simulator/",
      "description": "Stress-tests out-of-band kill-switch readiness and containment procedures for rogue autonomous AI agents.",
      "description_en": "Stress-tests out-of-band kill-switch readiness and containment procedures for rogue autonomous AI agents.",
      "description_fr": "Évalue l'efficacité des coupe-circuits d'urgence hors-bande face à des agents IA autonomes compromis.",
      "technical": {
        "api": "/api/death-simulator/index.json",
        "methodology": "/for/ai-security/"
      }
    },
    {
      "id": "agentic-observatory",
      "name": "AI & Agentic Risk Observatory",
      "name_fr": "Observatoire des Risques IA & Agents",
      "category": "understand",
      "audiences": [
        "ai-security",
        "security-leaders"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/agentic-observatory/",
      "route_fr": "/fr/tools/agentic-observatory/",
      "description": "Empirical tracking of agentic attack patterns, MCP bridge vulnerabilities, and prompt injection primitives.",
      "description_en": "Empirical tracking of agentic attack patterns, MCP bridge vulnerabilities, and prompt injection primitives.",
      "description_fr": "Suivi empirique des modèles d'attaque agentiques, des failles de ponts MCP et des primitives d'injections de prompt.",
      "technical": {
        "api": "/api/agentic-observatory/index.json",
        "methodology": "/for/ai-security/"
      }
    },
    {
      "id": "forensic-autopsies",
      "name": "Forensic Autopsies",
      "name_fr": "Autopsies Forensiques",
      "category": "verify",
      "audiences": [
        "analysts",
        "security-leaders"
      ],
      "public": true,
      "commercial": false,
      "route": "/tools/autopsy/",
      "route_fr": "/fr/tools/autopsy/",
      "description": "Exhaustive post-mortem investigations of landmark security failures dissecting root causes, warning signals, and decision breakdowns.",
      "description_en": "Exhaustive post-mortem investigations of landmark security failures dissecting root causes, warning signals, and decision breakdowns.",
      "description_fr": "Analyses post-mortem approfondies des faillites de sécurité historiques disséquant causes racines et signaux manqués.",
      "technical": {
        "api": "/api/autopsy/index.json",
        "methodology": "/research/"
      }
    },
    {
      "id": "historical-replay",
      "name": "Historical Replay",
      "name_fr": "Rejouabilité Historique",
      "category": "remember",
      "audiences": [
        "analysts",
        "security-leaders"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/replay/",
      "route_fr": "/fr/tools/replay/",
      "description": "Reconstructs discrete threat observability at Day 0, Day 1, Day 3, Day 7, Day 14, Day 30, and Day 90 intervals.",
      "description_en": "Reconstructs discrete threat observability at Day 0, Day 1, Day 3, Day 7, Day 14, Day 30, and Day 90 intervals.",
      "description_fr": "Reconstitue les signaux observables à J+0, J+1, J+3, J+7, J+14, J+30 et J+90 lors des incidents majeurs.",
      "technical": {
        "api": "/api/replays/index.json",
        "methodology": "/methodology/#historical-reconstruction"
      }
    },
    {
      "id": "stix-taxii",
      "name": "STIX 2.1 & TAXII 2.1 Feeds",
      "name_fr": "Flux STIX 2.1 & TAXII 2.1",
      "category": "remember",
      "audiences": [
        "analysts",
        "engineering"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/stix-taxii/",
      "route_fr": "/fr/tools/stix-taxii/",
      "description": "Standardized OASIS STIX 2.1 JSON feeds and TAXII 2.1 discovery server for OpenCTI, MISP, and Microsoft Sentinel integration.",
      "description_en": "Standardized OASIS STIX 2.1 JSON feeds and TAXII 2.1 discovery server for OpenCTI, MISP, and Microsoft Sentinel integration.",
      "description_fr": "Flux standardisés OASIS STIX 2.1 et serveur TAXII 2.1 pour ingestion dans OpenCTI, MISP et Microsoft Sentinel.",
      "technical": {
        "api": "/api/stix2/bundle.json",
        "methodology": "/platform/data/"
      }
    },
    {
      "id": "webhooks-alerting",
      "name": "Webhooks & Alerting Dispatcher",
      "name_fr": "Webhooks & Dispatcher d'Alerte",
      "category": "decide",
      "audiences": [
        "engineering",
        "analysts",
        "security-leaders"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/webhooks/",
      "route_fr": "/fr/tools/webhooks/",
      "description": "Automated notification engine pushing high-priority alerts to Slack, Teams, Discord, or SIEM endpoints when sovereign stack risks accelerate.",
      "description_en": "Automated notification engine pushing high-priority alerts to Slack, Teams, Discord, or SIEM endpoints when sovereign stack risks accelerate.",
      "description_fr": "Moteur d'alerte automatisé vers Slack, Teams, Discord ou SIEM dès qu'une accélération touche votre stack souveraine.",
      "technical": {
        "cli": "scripts/hermes-alert-dispatcher.js",
        "methodology": "/tools/webhooks/"
      }
    },
    {
      "id": "agent-threat-studio",
      "name": "AgentThreat Studio",
      "name_fr": "AgentThreat Studio",
      "category": "understand",
      "audiences": [
        "ai-security",
        "engineering",
        "security-leaders"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/agent-threat-studio/",
      "route_fr": "/fr/tools/agent-threat-studio/",
      "description": "Interactive visual threat modeling workbench and blast-radius canvas evaluating autonomous AI architectures against Agentic Attack Patterns (AAP-001..AAP-007).",
      "description_en": "Interactive visual threat modeling workbench and blast-radius canvas evaluating autonomous AI architectures against Agentic Attack Patterns (AAP-001..AAP-007).",
      "description_fr": "Établi interactif visuel de modélisation des menaces et simulateur de propagation latérale testant les architectures IA face aux modèles d'attaque agentiques (AAP-001..AAP-007).",
      "technical": {
        "methodology": "/agentic-attack-patterns/",
        "storage": "localStorage:hermes_threat_studio"
      }
    },
    {
      "id": "nis2-assessment",
      "name": "NIS2 Readiness Assessment",
      "name_fr": "Évaluation de Conformité NIS2",
      "category": "decide",
      "audiences": [
        "security-leaders",
        "analysts"
      ],
      "public": true,
      "commercial": true,
      "route": "/tools/nis2-assessment/",
      "route_fr": "/fr/tools/nis2-assessment/",
      "description": "Autonomous diagnostic self-assessment determining European NIS2 Directive qualification (EE vs EI), evaluating 10 operational domains, and generating a 90-day remediation roadmap.",
      "description_en": "Autonomous diagnostic self-assessment determining European NIS2 Directive qualification (EE vs EI), evaluating 10 operational domains, and generating a 90-day remediation roadmap.",
      "description_fr": "Moteur de diagnostic autonome déterminant la qualification NIS2 (EE vs EI), évaluant 10 domaines opérationnels et générant une feuille de route à 90 jours.",
      "technical": {
        "methodology": "/tools/nis2-assessment/",
        "storage": "localStorage:hermes_nis2_state"
      }
    },
    {
      "id": "product-demo-30s",
      "name": "30-Second Guided Product Tour",
      "name_fr": "Démo Produit Guidée en 30s",
      "category": "observe",
      "audiences": [
        "security-leaders",
        "analysts",
        "engineering",
        "ai-security"
      ],
      "public": true,
      "commercial": false,
      "route": "/#hermes-30s-demo",
      "route_fr": "/fr/#hermes-30s-demo",
      "description": "High-impact simulated walkthrough demonstrating the 4 core stages of Hermes Cyber Risk Intelligence: What Changed, What Matters, What May Happen, and What To Do.",
      "description_en": "High-impact simulated walkthrough demonstrating the 4 core stages of Hermes Cyber Risk Intelligence: What Changed, What Matters, What May Happen, and What To Do.",
      "description_fr": "Visite guidée interactive simulée en 30 secondes parcourant les 4 étapes fondamentales d'Hermes : Ce qui change, Ce qui compte, Ce qui va arriver et Quoi décider.",
      "technical": {
        "component": "src/components/demo/ProductDemo30s.astro",
        "methodology": "/methodology/"
      }
    },
    {
      "id": "funnel-telemetry",
      "name": "Sovereign Funnel Telemetry",
      "name_fr": "Télémétrie d'Entonnoir Souveraine",
      "category": "verify",
      "audiences": [
        "security-leaders",
        "engineering"
      ],
      "public": true,
      "commercial": false,
      "route": "/security/",
      "route_fr": "/fr/security/",
      "description": "Zero-PII commercial conversion funnel tracking strictly honoring DNT and GPC browser signals with zero third-party cookies and sovereign client-side opt-out.",
      "description_en": "Zero-PII commercial conversion funnel tracking strictly honoring DNT and GPC browser signals with zero third-party cookies and sovereign client-side opt-out.",
      "description_fr": "Télémétrie éthique de conversion commerciale respectant strictement DNT et GPC sans aucun cookie tiers ni fingerprinting, avec opt-out côté client.",
      "technical": {
        "module": "src/lib/telemetry.ts",
        "methodology": "/security/#telemetry"
      }
    }
  ]
}