A-06 — Governance Administration for Community Estates and Infrastructure

Scope: Day-to-day operation of community governance: rule lifecycle, violations, elections, advisory personas, spatial bindings, emergency access, and retention sweeps. Status: as of 2026-11-09 Blueprint sources: AGENTS.md; Config-Track Federation; D-17 — Backlog Validation (platform-map recommendations); docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md

What this means for you

You keep the estate's rules alive after go-live. Your job is not to write code; it is to run a disciplined lifecycle: draft a rule, have it proposed and voted on, watch it enforced, amend it when the community changes its mind, and retire it when it no longer applies — with an audit trail at every step (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Details

1. The rule lifecycle as operations

Run every building or community rule through the same five stages:

1. Draft. The estate manager or board member writes the rule in plain language: who it binds, where it applies, what evidence it needs, and how many approvers it needs. Keep the draft out of force until it passes the proposal step below.
2. Propose. Submit the draft as a formal governance proposal. Content submitted without a proposal record is refused, not queued silently.
3. Amend. If the proposal needs changes, raise an amendment rather than editing the proposal in place. The amendment preserves the original text and records what changed and why.
4. Enforce. Once adopted, the rule applies to new events in its scope. Attempts to act outside the rule — for example closing a ticket without required evidence, or approving one's own request where separation of duties applies — return a refusal, not a silent pass (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).
5. Retire. When a rule is superseded or the estate no longer needs it, retire it rather than deleting it. Retired rules stay visible in history so past decisions remain explainable (source: Config-Track Federation).

Operator watchlist: rules stuck in draft without a proposal; proposals past their voting window; rules enforced in a scope where nobody is currently responsible.

2. Violation handling workflow

Follow the same sequence for every reported breach:

1. Report. A resident, guard, inspector, or resident association files a moderation or violation report. Reports must name the place and the event; anonymous or location-free reports are held, not actioned.
2. Resolve. The assigned moderator or resolver works the report inside the scope that owns the location. While the report is open, the affected action stays refused — the report does not grant an exception.
3. Audit trail. Resolution must close with a reason, the resolver identity, and a link to the evidence reviewed. The audit trail is separate from the report so later reviewers can see both what was alleged and what was decided.

Operator semantics: attempts to resolve outside your scope return 403 Forbidden. Requests for a report that does not exist return 404 Not Found. Attempts to bypass a refusal by re-submitting through a different channel are refused as duplicate workflow attempts, never merged silently (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

3. Amendment mechanics

• Anyone entitled in the scope raises a proposal; members vote; the proposal is resolved by tally, not by voice count.
• A passed amendment creates a new version of the rule and points back to the version it replaced. The old version remains readable.
• A failed amendment closes without changing the enforced rule, but the proposal, votes, and tally remain on record.
• Changes to values such as evidence requirements, thresholds, or quorum sizes are made by changing the declared values in the estate's configuration, not by patching workflow behaviour inline (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).

Operator watchlist: amendments that would widen a parent authority; these must be refused at submission, not at enforcement time (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

4. Elections and oversight automation hooks

Assemblies and elections are instantiated when the community's adopted process calls for them: a periodic board election, a special assembly for a high-risk decision, or an oversight vote after a breach. The operator does not convene these ad hoc; the automation instantiates them when the adopted schedule or trigger fires.

What the operator watches:

• Voter registration and candidate lists complete before a vote opens; incomplete registrations block the open rather than failing the vote later.
• Ballots cast, tallied, and recorded as results — not just counted in the meeting room.
• Oversight reports available after the tally, including who stood, who voted, and the result.

If an assembly fails to reach its quorum threshold, the decision is refused and must be re-called through the normal proposal path. Never fill the gap by counting absent members as assent (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).

5. AI persona management

• Who seeds advisors. Only a named estate or district administrator may create an advisory persona for a scope. Residents and vendors cannot create advisors for their own benefit.
• How advisory outputs appear to admins. Advisory content is presented as a suggestion attached to the case — clearly labelled, with the evidence it considered — and never as an approval, close-out, or payment. An admin must take a separate, visible human action to accept it.
• How to disable. Switch the advisory hooks off for the scope. With hooks off, the estate continues to run fully; only the suggestions stop. Default state in the shipped packs is off (source: S-04 — Week in Review (plain-language summary)).

Operator semantics: requests to act on an advisory suggestion as if it were a decision return 403 Forbidden. The system refuses to record an assistant as the approver of any action.

6. Spatial jurisdiction binding

When block and estate boundaries change — a new block joins, a unit moves between scopes, a ward is redrawn — re-bind the standing rules to the new boundaries before relying on them:

1. Re-attach each rule to its new scope and area.
2. Re-check which rules the affected assets now inherit from their new parent scope.
3. Confirm the predecessor binding remains visible in history.

A rule left bound to a defunct boundary is refused rather than applied to the wrong place (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md). Report affected areas on every boundary change and keep the pre-change binding until the new binding is confirmed.

7. SOS and break-glass administration

Use the emergency ladder for anything life-safety or time-critical:

• SOS seats are held by named responders for the estate or district, not by the whole community. A single press raises a governed signal; dispatch fans out to the responders on duty.
• Break-glass access is dual-controlled: one person requests, a different named person approves, the grant expires on a short clock, and the request, approval, and expiry are all written to the audit trail (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• The vendor is never the approver. "System" cannot approve anything; a human must be named (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Operator language for the escalation ladder:

Operator semantics: emergency access requested without a named human approver is refused with an invented-request refusal — no synthetic approval, no 200 OK with a placeholder. Access with an expired grant returns 403 Forbidden, not a grace period.

8. Retention and compliance sweep cadence

• Receipts and audit trails do not decay on their own. Retention is configured per rule with a declared policy; a child scope may retain more than its parent, never less (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• Run the compliance sweep on the estate's adopted cadence: confirm every enforced rule still has a live owner, every open violation has an assignee, and every expired emergency grant has been closed out.
• Configuration rollouts to connected units follow the federation ladder: offer, admit, verify, apply, report progress, roll up, and finalise only when every unit in the frozen audience has answered. Late joiners after the snapshot do not change the denominator (source: Config-Track Federation).

Failure modes

Open items / gaps

• Field-level redaction on federally shared records is not shipped; do not federate sensitive resident or health-related records until it lands (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• Customer-held signing roots and receipts naming the exact ceiling in force are in flight; until they land, quote the posture in section 1 of the security synthesis verbatim in questionnaires (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• Backlog items concerning anonymous intake carriers, drll packs, and a liability note remain outstanding; sweep cadence figures beyond the above are UNKNOWN (source: D-17 — Backlog Validation (platform-map recommendations)).