{
  "schema": "hello://bridge-patterns/v1",
  "statusMeaning": "design-pattern means guidance only; not an implemented adapter or guarantee.",
  "patterns": [
    {
      "id": 1,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "MCP Wrapper Pattern",
      "description": "Expose a narrow, typed MCP facade over approved REST or SOAP operations. Start read-only and validate every argument.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 2,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "Reverse Proxy Intent Interceptor",
      "description": "Put a typed, allowlisted API facade in front of legacy services. Do not translate arbitrary natural-language text directly into requests that mutate state.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 3,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "Database Change Data Capture (CDC) Bridge",
      "description": "Use CDC with schema validation, data minimization, source permission checks, retention, and deletion propagation before forwarding events into a memory service.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 4,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "Agent Card Metadata Injection",
      "description": "Publish an accurate static capability manifest at /.well-known/agent.json. Treat discovery metadata as untrusted input, not as authorization.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 5,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "Async Event Bus Adapter",
      "description": "Bridge legacy message queues (RabbitMQ, Kafka, ActiveMQ) into the `hello.mesh` A2A protocol using event schema adapters.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 6,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "OAuth-to-DID Token Exchanger",
      "description": "Use a token-exchange gateway to issue a short-lived, scoped credential after validating the OAuth session. A DID is a separate identifier and does not inherit proof of identity automatically.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 7,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "GraphQL Federation Layer",
      "description": "Federate only the fields and operations each caller is allowed to access; query batching and round-trip counts depend on the schema and implementation.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 8,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "JSON-RPC Schema Reflector",
      "description": "Generate candidate tool schemas from reviewed OpenAPI documents; manually review authorization, side effects, and input constraints before exposing them.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 9,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "Webhook-to-Intent Transpiler",
      "description": "Parse signed or authenticated webhooks into typed event records. Validate source, timestamp, replay protection, and payload schema before any downstream action.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 10,
      "category": "Architecture & Protocol Wrappers (1–10)",
      "name": "Headless Browser DOM Wrapper",
      "description": "Use browser automation only against explicitly allowlisted pages and accounts, with scoped sessions and human approval for state-changing actions.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 11,
      "category": "Data & Memory Integration (11–20)",
      "name": "Vector Embedding Backfill",
      "description": "Backfill embeddings only for data with an approved purpose and retention policy; preserve source permissions and deletion requests.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 12,
      "category": "Data & Memory Integration (11–20)",
      "name": "Causal Dead-End Log Extractor",
      "description": "Seed a failure registry only from authorized, redacted incident history, with provenance, retention, and correction/deletion handling.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 13,
      "category": "Data & Memory Integration (11–20)",
      "name": "Shadow Database Cloning",
      "description": "Use database-native snapshots or isolated replicas when supported. Copy-on-write behavior and creation time depend on the provider and workload; no fixed latency is promised.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 14,
      "category": "Data & Memory Integration (11–20)",
      "name": "Document Chunking & Semantic Indexing",
      "description": "Chunk authorized documents while preserving source access controls and citations. Do not treat model confidence scores as verified facts.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 15,
      "category": "Data & Memory Integration (11–20)",
      "name": "Incremental Cache Invalidation",
      "description": "Map cache keys from legacy Redis clusters to agent memory pointers to prevent stale context retrieval.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 16,
      "category": "Data & Memory Integration (11–20)",
      "name": "Log-to-Episodic Memory Parser",
      "description": "Ingest unstructured log files (JSON/Syslog) and parse them into structured episodic memory records.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 17,
      "category": "Data & Memory Integration (11–20)",
      "name": "Schema Version Fingerprinting",
      "description": "Compute SHA-256 hashes of database schemas to detect silent breaking changes before agents run queries.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 18,
      "category": "Data & Memory Integration (11–20)",
      "name": "Dead-Letter Queue (DLQ) Introspection",
      "description": "Expose dead-letter messages read-only first. Retrying or replaying a message requires idempotency checks and explicit approval.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 19,
      "category": "Data & Memory Integration (11–20)",
      "name": "Audit Trail Normalizer",
      "description": "Normalize audit events into a documented receipt format. A hash alone is not a digital signature or proof of execution.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 20,
      "category": "Data & Memory Integration (11–20)",
      "name": "State snapshot serialization",
      "description": "Serialize only approved, minimized state with schema versions, retention rules, and encryption; do not copy session secrets into memory blobs.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 21,
      "category": "Security, Identity & Governance (21–35)",
      "name": "API Key Vault Mapping",
      "description": "Keep API keys in a secret manager and expose narrow operations through a server-side capability proxy. Never return raw keys to prompts or model output.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 22,
      "category": "Security, Identity & Governance (21–35)",
      "name": "RBAC-to-Guardian Tier Mapper",
      "description": "Map roles conservatively to a documented permission matrix with explicit deny rules and owner review; Guardian tiers are not automatically equivalent to an external RBAC system.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 23,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Circuit Breaker Cost Governor",
      "description": "Set hard request, rate, and spend limits, then stop calls on policy thresholds. P99 monitoring is a signal, not a spending-control substitute.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 24,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Untrusted Content Isolation and Policy Checks",
      "description": "Keep external content explicitly marked as untrusted and apply context-specific validation. No sanitizer can reliably remove prompt injection from arbitrary text.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 25,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Cryptographic Receipt Stamping",
      "description": "Use a digital signature over a canonical receipt with a protected signing key. A SHA-256 digest is an identifier, not a signature.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 26,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Automated Least-Privilege Scoping",
      "description": "Use observed usage to recommend permission reductions; require an owner to review before changing grants because rare capabilities may still be necessary.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 27,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Human-in-the-Loop Webhook Gate",
      "description": "Require explicit human authorization for high-impact changes, bound to the exact action, target, amount, and expiry. A chat notification alone is not an approval.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 28,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Session Continuity Tokenizer",
      "description": "Store session continuity only in a dedicated encrypted secret store, with short expiry and explicit account scope. Prefer server-issued OAuth over browser-cookie portability.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 29,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Ephemeral Sandbox Isolation",
      "description": "Run untrusted code in a properly configured isolation boundary with resource limits and deny-by-default network egress. Containers alone are not a security boundary equivalent to a VM.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 30,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Deterministic Replay Recording",
      "description": "Record deterministic inputs and stubbed external responses for repeatable tests. Replay must not repeat real-world side effects.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 31,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Multi-Model Consensus Firewall",
      "description": "Use independent policy checks and human approval for high-impact actions. Multiple model outputs are not a security boundary or authorization mechanism.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 32,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Compliance Guardrail Injector",
      "description": "Apply compliance controls in data access, retention, and audit systems. Adding policy text to a prompt does not establish regulatory compliance.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 33,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Self-Revoking Capability Passports",
      "description": "Use signed, scoped, expiring capabilities with revocation. Do not base authorization on a model confidence score.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 34,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Audit Log Merkle Tree Anchoring",
      "description": "Merkle-root anchoring can make later tampering detectable only when roots are published to a trusted independent system and verification is retained.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 35,
      "category": "Security, Identity & Governance (21–35)",
      "name": "Zero-Trust Egress Filtering",
      "description": "Apply deny-by-default egress at the network boundary, with DNS/IP controls, logging, and a reviewed allowlist.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 36,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "AST Symbol Reflector",
      "description": "Parse source files into AST symbol nodes using a project-specific parser and validated repository scope; `src/engine/ast.ts` is an example location, not a shipped path.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 37,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Pre-Commit TypeScript Compiler Gate",
      "description": "Run the project’s configured TypeScript compiler as a pre-commit or CI gate. A pre-commit hook is optional and can be bypassed; CI remains authoritative.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 38,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Automated Test Runner Wrapper",
      "description": "Wrap legacy test suites (Jest, PyTest, JUnit) in MCP tools so agents receive clean JSON test receipts.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 39,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Dependency Graph Visualizer",
      "description": "Map imports and exports across legacy codebases to guide multi-agent refactoring tasks.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 40,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "AML Transpilation Pipeline",
      "description": "Use a model or parser to draft AML from a specification, then validate and review it. AML v1 is static and this pipeline must never execute generated source.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 41,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "N+1 Query Detector",
      "description": "Detect likely N+1 query patterns and propose measured alternatives; do not automatically rewrite locking or transaction semantics.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 42,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Dead Code Pruner",
      "description": "Identify likely unreferenced code and submit a reviewed patch with build and test evidence. Never delete code automatically based only on static heuristics.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 43,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Automated Patch Reverter",
      "description": "Automate rollback only when side effects are known to be reversible and reconciliation is tested; database backups and external actions need separate recovery plans.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 44,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Cross-Language Fuzzing Bridge",
      "description": "Fuzz documented API boundaries with bounded, isolated test inputs and explicit authorization. Keep fuzz traffic out of production unless approved.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 45,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Model Arbitrage Optimizer",
      "description": "Route work using measured task quality, latency, privacy, and cost. Cheap/local models still require validation and policy controls.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 46,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Token-Budgeted Context Packer",
      "description": "Pack context to a measured model/tokenizer budget and preserve source references; approximate counts can differ from the provider tokenizer.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 47,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Sleep-Cycle Code Refinement",
      "description": "Schedule maintenance only with a bounded change scope, tests, review, and rollback path; background agents must not silently rewrite production code.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 48,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Multi-Agent Git Merge Arbiter",
      "description": "Use tools to propose conflict resolutions, then require normal tests and human review before merging. Model votes do not prove a merge is correct.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 49,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Documentation-to-Spec Generator",
      "description": "Parse markdown READMEs and API docs into structured JSON contract schemas.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    },
    {
      "id": 50,
      "category": "Code, CI/CD & Compilation (36–50)",
      "name": "Zero-Downtime Blue/Green DNS Swap",
      "description": "Use staged, health-checked traffic switching with explicit rollback. A DNS update is not inherently atomic and DNS caches may delay propagation.",
      "status": "design-pattern",
      "shipped": false,
      "implementation_note": "Concept only; not implemented by this catalog. Requires a concrete integration, authorization policy, operational owner, and tests before use."
    }
  ]
}