Agency Registry — Live Reference

Owner: Cowork (strategic). Last refresh: 2026-05-27 (S145; corpus-scan + sizing-tier estimates added). Refresh cadence: monthly, OR whenever a new Sentinel spider lands, OR whenever an at-cost-tier outreach begins/closes, OR whenever an active-user count is confirmed from real engagement.

Sizing-tier reference (XS / S / M / L / XL)

Per the pricing page (Cowork source: unit-economics.md §Mapping known agencies to size tiers), regulator-tier customers are priced against agency size (active-user count), not flat per-seat. Active users ≠ total agency headcount — heuristic is ~5-15% of relevant-division employees. Estimates below are calibration baselines; refined as real engagement produces actual numbers.

Per-agency sizing estimates added to the Tier 1 and Tier 2 tables below where defensible. Where uncertain, flagged as ? and to be confirmed at first contact.

This is the working source of truth for every regulatory / oversight / standards body referenced anywhere in the MK codebase, plus the conspicuous absences worth knowing. It exists to (a) ground the regulator-tier-strategy work in real coverage rather than wishful thinking, (b) seed the at-cost-tier outreach list, (c) track engagement state once outreach begins.

Three tiers + a notable-findings section. Tier definitions are about data path, not relationship state — a Tier-1 agency means we consume their public outputs, NOT that we have a relationship with them. Engagement state is tracked separately in §Engagement Log (initially empty).

Methodology (initial scan)

Searched the full MK monorepo using ripgrep across *.md, *.py, *.html, *.tsx, *.ts, *.jsx, *.json, *.jsonl for ~60 acronyms/expansions covering US federal, US state, international, standards, accreditation, and privacy regulators. Tier-1 evidence derived from OLYMPUS/zeus-platform/packages/genesis/sentinel/SPIDER_INVENTORY.md (9-section authoritative spider catalog) cross-referenced against dionysus/STAGE-4-REPLACEMENT-PLAN.md:202 (THEMIS Layer-1: Federal Register / OPM / Treasury) and D-016's smoke output (reports/scrape/ = 252,210 records across 42 active feeds). Tier-2 came from NOMOS corpus READMEs, FTP site copy, and HEXAD research docs. 156 .docx files in HEXAD/research-docs/ were not inline-searchable — small file sizes suggest real binary docx not LFS pointers, but no inline grep possible; flagged for a targeted pandoc/python-docx pass if outreach prep needs them.

Tier 1 — Used data from (consumption path active)

Source of truth: OLYMPUS/zeus-platform/packages/genesis/sentinel/SPIDER_INVENTORY.md — 81 spider files, 80 implemented, 23 Celery-beat-scheduled, 252,210 records persisted as of D-016 smoke.

US Federal — actively scheduled (Celery beat)

International — actively scheduled (international-regulators-daily task)

Adversarial (geo-blocked from cloud, scheduled hourly anyway)

• Chinese MOD (eng.mod.gov.cn) — expected 0% success from US cloud
• Russian MOD (eng.mil.ru) — same
• Xinhua, NATO News — passive monitoring

Tier 2 — Mentioned but no data path

Heavily cited in NOMOS strategy and FTP/Aletheia copy, no active consumer

Privacy / cross-cutting (referenced in copy + governance, not as data feeds)

• GDPR — 1,000 FTP hits + 282 cognitivesovereignty + 67 olympus-research-eco. Structural in CSL/CSI legal-architecture content.
• CCPA — 93 FTP hits. Companion to GDPR in privacy copy.
• HIPAA, SOC2, ISO 27001, ISO 9001 — referenced in NOMOS security-perspective.md and quality-perspective.md as practice-but-don't-claim certifications.
• EU AI Act, DSA, DMA — 113 / 69 / 26 hits in olympus-research-eco; structural for AI-research-eco THEMIS mappings.
• CNIL, UK ICO — 24, 5 hits in cognitivesovereignty.institute. Cited but not consumed.
• FCC — 192 FTP hits, mostly cognitivesovereignty. Incidental.
• CFPB, NHTSA in copy — referenced in cognitivesovereignty.institute legal-architecture essays.

Standards bodies (governance-relevant, not consumed)

• ISO — 1,664 FTP hits + 36 NOMOS; mostly ISO 9001 / ISO 27001 framing.
• NIST AI RMF — 3 hits in olympus-research-eco THEMIS mappings.

THEMIS Layer 1 planned but not yet wired

• PACER (THEMIS-architecture.md:85) — judicial feed, planned
• State-gov aggregator (:88) — planned
• GAO / CRS — THEMIS-architecture.md:521 positions THEMIS as synthesizing GAO/CBO/CRS outputs (130 GAO mentions); no scraper exists

⚠️ Notable findings

1. NOMOS has an explicit anti-endorsement-claim posture (docs/perspectives/regulatory-perspective.md "What NOMOS refuses"): "No claim of agency endorsement without an explicit written agreement … No selling regulator names for legitimacy." Every piece of at-cost-tier outreach copy must align with this commitment. Listing agencies as "users" requires written consent. Listing them as "data sources" is fine and accurate.

2. NOMOS already names first-engagement targets on the record: "IARC for methodology consultation … or EPA IRIS for evidence-standards consultation. Operator decision." (regulatory-perspective.md:46). This is a load-bearing reference for the outreach list — don't override it without re-reading the regulatory-perspective doc.

3. A "public engagement registry" is committed in the doc (regulatory-perspective.md) but no such registry file exists yet anywhere in the repo. This file should become that registry once outreach begins; until then it documents the precondition (the codebase footprint).

4. No file in the repo lists any agency currently in correspondence with Holisticquality / NOMOS / any product. Zero "reached out to / engaged with / submitted to {agency}" string matches. We're at engagement-state = pre-zero across the board.

5. HEXAD/research-docs has 156 .docx files (small size, likely real binary docx not LFS pointers) which were not inline-searchable. If significant agency-engagement content lives there it is invisible to this scan — flag for a targeted pandoc pass before any outreach commits.

Synthesis

Tier counts: Tier-1 (active data path) = ~55 distinct agencies/bodies across Sentinel spiders + THEMIS Layer 1. Tier-2 (mentioned, no path) = ~25, dominated by chemistry/health regulators (IARC, EFSA, ECHA, OEHHA, EPA IRIS, OECD, JECFA, JMPR, IPCS) plus privacy frameworks (GDPR, CCPA, EU AI Act). Tier-3 (absent) = ~20+ across energy, IP, state, accounting, ex-EU privacy, and most standards bodies.

Strongest existing relationships (= lowest-friction at-cost-tier targets):

1. FDA — 12 spiders, the deepest single-agency footprint, NOMOS tier-4 "gold mine"
2. EPA — both Sentinel feeds and NOMOS strategic positioning; ECHO is already actively consumed
3. CISA / NIST NVD — high-cadence security feeds, natural fit for at-cost framing given infosec public-good norms
4. CDC + WHO + ECDC — health-emergency feeds, public-good positioning is uncontroversial
5. OPM + Federal Register + Treasury/CBO — the THEMIS Layer 1 trio, already a "we are interpreting your output operationally" relationship

Biggest gaps: State regulators (Prop 65 only — 47+ federal-US references vs ~3 state-level); accreditation bodies; energy regulators (FERC/NRC); financial-crime regulators (FinCEN/OFAC); IP regulators (USPTO/Copyright). The state-regulator absence stands out. If "regulator-tier-with-precommitment-to-free" positioning is the move, state regulators (CARB, NY DEC, CalEPA, state AGs) are a structurally underserved market.

Engagement Log (initially empty)

Schema for entries when outreach begins:

### [Agency name] — [engagement state: contacted | discovery-call-scheduled | trial | active | declined]

**First contact:** YYYY-MM-DD via [channel]
**Counterpart:** [name, title] (or "TBD" if cold)
**Status:** [free-form]
**Next action:** [specific, dated]
**Notes:** [free-form, anything operationally relevant — including any explicit no-public-citation requests]

No entries yet. The first entry triggers a kit-side change: this file moves from "Cowork-owned planning" to "Cowork+CC-readable, Cowork-only-writes, with audit-trail commits per entry."

Cross-references

• NOMOS regulatory perspective: OLYMPUS/nomos/docs/perspectives/regulatory-perspective.md (especially :46 for first-engagement names + the "What NOMOS refuses" section)
• Sentinel spider inventory: OLYMPUS/zeus-platform/packages/genesis/sentinel/SPIDER_INVENTORY.md
• THEMIS architecture: OLYMPUS/themis/docs/THEMIS-architecture.md (esp. Layer 1 adapter list)
• Dionysus Stage-4 plan: OLYMPUS/zeus-platform/packages/genesis/dionysus/STAGE-4-REPLACEMENT-PLAN.md:202
• NOMOS corpus READMEs: OLYMPUS/nomos/corpus/tier-{2-provenance,3-interpretation,4-reasoning}/README.md

Refresh trigger: when ANY of these change, run a fresh corpus scan and update this file.