A-02 — Jijibora Compliance Operations (Administrator)

Scope: Compliance as an operations function — what logs and audit trails you keep; how the audit export runs step-by-step; retention and sweep behavior; personal-data minimization at the operator level; billing operation in Soft posture; and SOS/escalation semantics in operator language.

Status: as of 2026-11-09

Blueprint sources: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md; 03 Deploy Topology; A-02 — Runbooks (step-by-step recovery); Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc); docs/truth-graph/DEPLOYMENT_TOPOLOGY_AND_FEDERATION.md; docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md

What this means for you

You keep the flight recorder, the delivery anchor, and the money trail separately — PoCE receipts for governed paths, nats_outbox rows for every publish, and money-subject events for billing — and you export evidence at runtime, not reconstructed (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). You minimize personal data at the operator level (no raw PII in events or receipts, no federation of PHI/PII) and you refuse on doubt rather than letting a sweep, a federation, or a break-glass grant paper over a gap (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Details

1. What logs and audits you keep — PoCE, lifecycle, subscription/metering

PoCE sessions (the flight recorder). Hash-chained governance_path_receipt carrying path_spec_id, path_spec_version, chain_head, gpr_root, result_hash (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). It covers governed paths that start a PoCE session — escrow release, milestone approval, break-glass, compliance gate evaluation — not every login/payment/sensor (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). The audit storage is the lifecycle + PoCE strata (s150, s131–s140, s267) with entity lifecycle events, sessions/receipts, and hash chain (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Gateway rule: every successful transaction writes a PoCE receipt (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).

Lifecycle and delivery anchors. Every event goes through the canonical envelope { correlation_id, trace_id, voyage_id, envelope_subject, payload, headers?, signature?, proof? } on criteria-style subjects platform.criteria.v1.* (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). The durable anchor is one nats_outbox row — { subject, payload, headers, status, created_at, correlation_id, trace_id, envelope_subject } — indexed on (subject, status), flowing pending → sent → delivered → failed → dead-letter with bounded retries (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). The consumer records each event once and records refusals as failed outbox rows; it never re-emits (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). Cohort broadcast audit (cohort_definition_broadcast + ack receipts) and security audit (audit_log, login attempts, rate limit in s146) are kept alongside (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).

Subscription / metering trails (money spine). Money events live on their own families — platform.criteria.v1.money.billing, .entitlement, .settlement, .refund — carrying subscription/wallet/invoice identifiers and amount/rate only; money events never carry claim payloads and the money spine never advances a claim (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). Community financials run over dues/levies (Kill Bill + FIN ledger), M-Pesa/Stripe/Airtel, receivables, period close, transparent escrow, and audit export (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Keep the three trails separate in every report — do not merge a PoCE receipt with a money event to make a balance look settled (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)).

2. How the audit export works — operator steps

Evidence packs are PoCE receipts plus the ISO export, Gotenberg PDFs, and Superset BI (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). The ISO endpoint is GET /v1/iso/evidence/export returning JSON with export_sha256 and signed: false — it is not a certificate (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). What a third party can verify today: (1) fragment digest (SHA-256 over canonicalized fragment.yaml + meta/), (2) ceiling behavior (wider child → HTTP 422 ceiling_pep_denied), (3) receipt chain recompute from step records, (4) federation allow/deny log, (5) break-glass audit_entry + nats_outbox break_glass.* + APF expires_at (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Operator steps (step-by-step, reject-first):

Name the governed path. Confirm it starts a PoCE session (escrow release, milestone approval, break-glass, compliance gate evaluation) — if it is only a login/payment/sensor, refuse to call it governed (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).
Read the receipt. Fetch the governance_path_receipt and record path_spec_id, path_spec_version, chain_head, gpr_root, result_hash (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). If any field is missing, refuse the export (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Recompute the chain. Recompute from step records; matching head = step sequence not edited. This does not show which ceiling was in force (in flight) — say so in the pack (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Pull the ISO export. GET /v1/iso/evidence/export — expected output contains export_sha256 and signed: false (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Record both values verbatim in the pack.
Check the digest and ceiling. Compare the fragment digest to the operator-published digest; compose a wider child and confirm HTTP 422 ceiling_pep_denied (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). On any mismatch, refuse the pack (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Package without claiming certification. Label the pack "auditor-verifiable evidence of an authorized action" — never "ISO/SOC 2 compliant product," never "tamper-proof," never "dispositive in litigation" (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Never accept "compliant because they bought software," "receipt is dispositive," or "vendor is system of record for regulatory filing" (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

3. Retention behavior — what sweeps exist

Outbox retention is bounded by retry, not by purge. Every outbox row has a bounded retry count; after max retries it becomes status='dead-letter' and an audit row is created (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). The relay reads per-subject bounded prefixes and never blocks the durable write on publish failure (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)).
Background work uses events, not polling; sweep endpoints are recovery only (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). If you run a sweep to drain depth, that is recovery — log it as an incident action, not as routine retention (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)).
Retention mode is fragment-configured (hash | value | both); a child may retain more, never less (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Crypto-shredding is the only erasure path (see §4); history remains as undecipherable noise and chain validity is preserved (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Refuse rule: never delete or bulk-purge receipts, outbox rows, or money trails to "clean up" a pack. On doubt, refuse the purge and escalate (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

4. Personal-data minimization at the operator level — vault and leases

Non-negotiable invariants:

No raw PII in NATS events or PoCE receipts. Names/phones/addresses never serialize into nats_outbox payloads (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Per-user DEK in OpenBao :8200. All attributes encrypted under the DEK; erasure = fn::vault::shred_key(user_id) destroys the DEK (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Federation carries no redaction. fn::federation::can_federate_record + log_event give allow/deny + event log; deny_patterns is stored but not applied (GOV-08) — "Do not promise auto-PII stripping" and "Do not federate PHI/PII until shipped" (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).
Erasure is unavailable until FIT-02 passes (GOV-03/04 + FIT-02/03 in flight) — state this plainly to any requester (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Operator steps:

Before publishing: inspect the envelope — if it contains names/phones/addresses, refuse to publish and strip to identifiers (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Before federating: check record_federation_event rules and the cell allowlist; if the record or cell is not allowed, refuse federation (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). Never federate PHI/PII until GOV-08 ships (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).
On erasure request: check legal hold first — legal hold blocks shred (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). Until FIT-02 passes, refuse to promise erasure and say "unavailable" (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
On auditor read: every auditor read of retained value writes an audit entry (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

5. Billing operation — Soft meters and reconciliation

Soft meters. The enterprise billing spine is Kill Bill (bridge service) with FIN ledger, AR/AP, period close, and multi-currency (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). In Soft posture the live money path is sandbox only with manual reconciliation; there is no auto-debit to promise (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Operator reconciliation notes for every pilot pack:

Rails in scope are M-Pesa Daraja, Stripe, Airtel Money, bank — all sandbox keys in Soft; record the key as sandbox in the reconciliation note (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).
Meter from money-subject events only (billing, entitlement, settlement, refund families); money events never advance a claim, so a money trail alone never proves a work order closed (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)).
Reconcile by hand against the FIN ledger + period close; escrow releases are PoCE-governed (photo/GPS proof pattern) (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). On any mismatch, refuse to balance the books by adjustment — escalate (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Refuse to invent balances, rates, or OPTIMAL/APPROVED fallbacks for any billing computation — infra failure is a refusal (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Do not promise customer-managed keys for billing, custody of funds, or automatic filing — the platform is orchestrator, not intermediary (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).

6. Incident posturing — SOS and escalation in operator language

SOS / emergency posture. The sellable emergency surface is gate logs, patrols, ICE/SOS panic button, MARS dispatch (add-on), geofence evaluation (s153), and emergency shelter logic (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Flood/blackout/outbreak playbooks switch the community into crisis posture (MARS + ICE + AfiyaLink leases) (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Operational translation: SOS raises a governed emergency action through the playbook and writes its audit trail; it never skips the ceiling — a widening child still refuses with 422 (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).

Break-glass (emergency override) semantics. Break-glass is dual control: requester ≠ approver, TTL default 1h / max 24h, APF role with expires_at, nats_outbox + audit_entry (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). It does not auto-open PoCE and does not auto-file CAPA (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Liability sits with requester/approver (customer); a human approver is named — "system" never approves — and break-glass cannot rotate the policy root (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Operator steps:

On SOS: raise the ICE/SOS event through the emergency playbook; open the crisis posture; record the PoCE session if the action is governed (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Refuse to dispatch MARS or geofence actions without the playbook envelope and correlation/trace IDs (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)).
On break-glass request: require a second, named human approver, set TTL ≤ 24h (default 1h), attach APF expires_at, and confirm break_glass.* outbox + audit_entry written (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Refuse single-approver or system-approver grants (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
After expiry: verify auto-expiry and that no PoCE was auto-opened and no CAPA auto-filed (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Refuse to extend TTL silently — require a new approved grant (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Escalation rule overall: AI proposes, humans decide (Decision Gates) — escalate to a human at every gate; never let an automation close an incident, a PoCE, or a billing batch without human approval (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Runbook / playbook checkpoints (for A-02 style structure)

RUNBOOK C-01 — Verify one PoCE receipt (auditor walkthrough)

Symptom: auditor asks "prove this escrow release / milestone approval happened as governed."

Do:

Read governance_path_receipt — record path_spec_id, path_spec_version, chain_head, gpr_root, result_hash (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).
Recompute the chain from step records — expected: computed head equals stored chain_head (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
Confirm the governed action is one that starts a PoCE session (escrow / milestone / break-glass / gate evaluation) (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).

Expected output: three-way match (spec version + head + result hash). Refuse rule: on any mismatch, refuse the pack and flag the receipt as tamper-evident-failed — do not edit steps to match (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

RUNBOOK C-02 — Produce the ISO audit export

Symptom: donor/county auditor requests the evidence pack.

Do:

# From an operator workstation against the live cell BFF (port 3030)
# GET /v1/iso/evidence/export — expected JSON contains export_sha256 + signed:false

Expected output: export_sha256 present, signed: false — this is evidence, not certification (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Attach the PoCE receipts from C-01, the break-glass audit_entry + break_glass.* outbox rows, and the federation record_federation_event rows (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md). Refuse rule: refuse to label the pack "ISO-compliant product" or attach a seal — the organization is certified by an accredited body, not by this export (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

CHECKPOINT C-03 — Outbox row missing for a transition

Symptom: transition returns 200 but no nats_outbox row exists; consumer silent (source: A-02 — Runbooks (step-by-step recovery)).

Checklist (in order):

Response outbox.ok — outbox_persist_failed means the sink failed (payload must be an OBJECT literal) (source: A-02 — Runbooks (step-by-step recovery)).
subject/claim-type — claim_type: null falls to default subjects and gets refused (pack_not_found); ensure the transition fn returns claim_type (source: A-02 — Runbooks (step-by-step recovery)).
The envelope must be the payload — build via buildLifecycleEnvelope only; consumers read envelope.claim_id/claim_type/correlation_id (source: A-02 — Runbooks (step-by-step recovery)).
Relay liveness — depth query from A-01 D-01 (source: A-02 — Runbooks (step-by-step recovery)).

Refuse rule: until the row exists and flows to delivered, refuse to claim the lifecycle event was published (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

CHECKPOINT C-04 — Break-glass audit verification

Symptom: break-glass was used; verify control held.

Do: confirm audit_entry + nats_outbox break_glass.* + APF expires_at form a triple; requester ≠ approver; TTL ≤ 24h (default 1h); no auto-opened PoCE; no auto-filed CAPA (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Expected output: all five hold. Refuse rule: if any fails (single approver, missing expiry, system approver), refuse to close the incident — escalate to the named human owner (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

CHECKPOINT C-05 — Federation refuse check

Symptom: request to federate a record that may hold PII/PHI.

Do: check fn::federation::can_federate_record + record_federation_event allow/deny; check the cell allowlist (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Note deny_patterns is stored but not applied (GOV-08) (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). Refuse rule: if the record or cell is not allowed, refuse federation; if the record holds PHI/PII, refuse until GOV-08 ships (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

CHECKPOINT C-06 — Soft billing reconciliation

Symptom: end-of-period dues / escrow reconciliation in Soft posture.

Do:

Pull money-subject trails (billing, entitlement, settlement, refund) — expected: money-only payloads, no claim payloads (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)).
Reconcile manually against FIN ledger + period close; mark every rail key as sandbox (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).
Confirm escrow releases have PoCE receipts with photo/GPS proof pattern (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).

Refuse rule: refuse auto-debit, invented balances, and any balancing adjustment to make the books tie (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md). On mismatch, escalate with the raw trails attached (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

CHECKPOINT C-07 — SOS / escalation discipline

Symptom: SOS pressed or crisis playbook triggered.

Do: confirm the ICE/SOS event went through the playbook envelope with correlation_id/trace_id/voyage_id; crisis posture (MARS + ICE + AfiyaLink leases) engaged per playbook; any governed action has its PoCE session (source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). Confirm ceilings still refuse widening (HTTP 422) even in crisis (source: docs/jijibora-gtm/00_7_MONTH_TECHNICAL_AUDIT.md).

Refuse rule: refuse to let automation close the incident. A named human closes it; "system" never approves (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).