D-03 — Jijibora Playbook Designs (developer)

Scope: The developer side of the SAME registry as S-03 — Jijibora Playbook Registry (stakeholder + developer) — for each playbook the design contract (consumed subjects → logic → emitted subjects → guard gates → store-of-record table/class → variant-pack authoring without code). Includes the "how to build the next playbook" recipe and per-playbook evolution/versioning + refusal modes. Status: as of 2026-11-09 Blueprint sources: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json; docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json; docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json; docs/event-sourcing/rules/criteria-pipeline-sla.example.json; docs/event-sourcing/rules/lifelong-entity-state-rule.example.json; docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md; docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md; docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; Playbook Registry — What You Can Run, Who Runs It, What You Get Back; D-17 — Backlog Validation (platform-map recommendations); docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md

What this means for you (plain)

Every Jijibora playbook is declarative data on a shared substrate: 4 primitives + CNS + manifest + NATS/Camel/Kestra/Solver (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md). "Declarative-first" means a new variant is new CNS types + fragments + APF vocab + KV lookups, never new tables and never fs.readFile template lookups at runtime (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md). If you cannot express it as a fragment/config/lookup, say so before writing code (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md). The three Jijibora rule examples illustrate the shape all variants must copy: rule_id, runtime.tier/chain, pipeline.id/stage, inputs[] (stream + filter), evaluation (kind, key_by), outputs[] (on_match/on_feasible), side_effects.handled_by terminal-only (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).

How to build the next playbook (recipe derived from the rule shapes + declarative-first mandate)

Reuse the spine, add nothing new. Consume platform.criteria.v1.* subjects and emit platform.criteria.v1.match.fired (or the pack's allowlisted subject) with inherit_causation: true; do not invent a second bus or envelope (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md; source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json).
Copy the rule JSON shape exactly. Fields: rule_id, name, domain, enabled, version, description, runtime{ tier, engine, chain }, pipeline{ id, stage, max_depth, terminal }, inputs[]{ stream, filter }, evaluation{ kind, engine, key_by }, outputs[]{ on_match|on_feasible|on_breach }, side_effects{ handled_by } (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json; source: docs/event-sourcing/rules/criteria-pipeline-sla.example.json).
Declare the pack in dictionary.v1.json first: emits / consumes / enrichment / solver_stages / security_bound per pack; schema validates against doc 32 §8 matrix (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Declare every lookup in NATS KV with canonical_subject, canonical_event_type, pipeline_id (pattern from GTM lookups); the seeder loads KV — never read lookups/templates from disk at runtime (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md; source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Put logic in the engine the tier demands: Tier-1 Camel/Kestra for criteria/reflex; Flink Job A for continuous join (min_score 0.8, keyed tenant + match_key) and Job B for event-time windows; solver-gateway :3070 only for allocation — Camel timers are explicitly out for SLA CEP (source: docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json; source: docs/event-sourcing/rules/criteria-pipeline-sla.example.json; source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json).
Keep side effects terminal-only: non-terminal stages emit criteria only; the terminal handler owns tickets/notifications/PoCE and publishes the receipt (source: docs/event-sourcing/rules/criteria-pipeline-sla.example.json; source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json).
Gate before anything live: Soft = outbox + subject in ceiling/allowlist; LIVE = JetStream + ceiling; drill packs enforce meta.is_test with no production incident path (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Variant without code: new community = new cns_type_catalog + cns_interface_catalog + manifest + fragments + APF vocab, floor/ceiling fragments that only narrow (child cannot widen parent); thresholds change declaratively; AI hooks stay advisory and optional (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).

Design contracts (developer)

Format per playbook: consumed → logic → emitted → guards → SoR → variant authoring → evolution/versioning → refusal modes.

D-01 Building reflex

Consumed: platform.criteria.v1.building.entity_state, filter entity_type: building (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json).
Logic: Tier-1 Camel (tier: "1", chain: ["kestra","camel"]); pipeline pipe:jijibora:building-reflex, stage sense, max_depth: 8, terminal: false (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json). Evaluation kind: criteria, engine: tgc, key_by: ["meta.tenant","entity_id"] (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json).
Emitted: building.reflex.fired on platform.criteria.v1.match.fired, envelope inherit_causation: true (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json).
Guards: side_effects.handled_by: terminal:actuate — commands only from terminal stage (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json).
Store-of-record: SurrealDB is SoR only; live evaluation in Camel/Kestra (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json). Specific table = UNKNOWN in read set.
Variant authoring: new rule_id, new pipeline.id/stage, new inputs[].filter, new outputs[].on_match.event_type; thresholds via lookup, not code (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Evolution/versioning: rule_id embeds name + :v1; version: "1.0.0"; promote to Flink Job A when fan-out warrants (ADR §5.2 cited in community-sourcing twin) (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json).
Refusal modes: non-terminal stage attempting a command → refuse (terminal-only handled_by); engines down in Soft voyage → refuse, never invent dispatch (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-02 Community sourcing (qualify-to-shortlist + continuous match)

Consumed: platform.criteria.v1.sourcing.requirement (entity_type: sourcing_requirement) + platform.criteria.v1.candidate.state (entity_type: candidate) (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; source: docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json).
Logic: Tier-1 require qualify-to-shortlist (chain: ["kestra","solver-gateway"], keyed meta.tenant+payload.match_key); Tier-2 continuous-match join (engine: flink, job: criteria-sourcing-continuous-match, min_score: 0.8) (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; source: docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json).
Emitted: sourcing.match.fired on platform.criteria.v1.match.fired (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; source: docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json).
Guards: TGC qualify + solver before shortlist; sealed content never in match; request for sealed content refused; unattested provider refused; non-terminal, handled_by: terminal:shortlist (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Store-of-record: SurrealDB SoR only (description field), specific table = UNKNOWN (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json).
Variant authoring: change filter.entity_type, payload.match_key, min_score via KV lookup; add candidate facets via entity_state scrubbed-facet contract (facets only, never raw metadata) (source: docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json; source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json).
Evolution/versioning: Tier-1 v1.0.0 with promotion.status: promoted, Flink Job A is sole continuous matcher, no prior Camel evaluate on the fabric (source: docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json).
Refusal modes: sealed-content request → refuse; unattested provider → refuse; solver down → 503/invent_refuse (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-03 MARS/ICE dispatch

Consumed: platform.criteria.v1.governance.signal, filter entity_type: emergency_incident (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
Logic: Tier-1 Camel (chain: ["kestra","camel"]); pipeline pipe:jijibora:mars-ice-dispatch, stage sos_raised; evaluation criteria/tgc, keyed meta.tenant+entity_id (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
Emitted: emergency.dispatch.fired on platform.criteria.v1.match.fired (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
Guards: handled_by: terminal:dispatch; SOS forks to fire/ambulance children each with own scope; parent scope is the ceiling, child cannot widen; public alert from scrubbed fields only unless purpose grant exists (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Store-of-record: SurrealDB SoR only; table = UNKNOWN (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
Variant authoring: new filter.entity_type, new child scopes via APF vocab + fragments; do not hardcode agency lists (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json; source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Evolution/versioning: rule:jijibora:mars-ice-dispatch:v1, version: "1.0.0"; external_assert/EXT gate (CLAIMGEN-01) FAIL blocks advance, no invented PASS (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Refusal modes: missing scrubbed fields → no public alert emission; engines down → refuse dispatch (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-04 Government benefit / compensation claims packs

Consumed: UNKNOWN in read set (publishes consumes/emits per pack is ESP-01 — DONE initial fill 2026-11-07, values not reproduced in the read set) (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Logic: Zero-write practice check first; desk runs the pack under quorum + SoD (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). Claims console UI shipped as a single static file with zero hardcoded data and honest empties + Soft banner driven by rollout_enabled (source: D-17 — Backlog Validation (platform-map recommendations)). Processing-claim voyage shares correlation_id with the flood voyage (TRACKING, CLAIMGEN-05) (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Emitted: Guarded-transition receipt, quorum receipt chain, evidence seal, audit export (benefit); decision pack + evidence seal + approval receipt (compensation) (source: docs/platform-map/system/S-05-PLAYPLAY-REGISTRY.md).
Guards: cross-agency quorum; officer cannot approve own file; missing evidence refused; threshold + mandatory audit export; outside verdict honoured (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Store-of-record: processing-claim strata database/schema/strata/s282_processing_claim.surql cited as blueprint source (table shape UNKNOWN beyond that citation) (source: D-17 — Backlog Validation (platform-map recommendations)).
Variant authoring: new claims pack = dictionary entry + KV lookup (canonical_subject/canonical_event_type/pipeline_id) + APF vocab + fragments; readiness (infra_ready vs rollout_enabled) is env-gated, not a code branch (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md; source: D-17 — Backlog Validation (platform-map recommendations)).
Evolution/versioning: claims spec v1.2.0, source-scanning OpenAPI drift test (23 paths + param templating) (source: D-17 — Backlog Validation (platform-map recommendations)).
Refusal modes: fixture metrics excluded by default (metadata.fixture=true); missing evidence → refuse; forged finalize blocked; pack cannot self-declare live (source: D-17 — Backlog Validation (platform-map recommendations); source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).

D-05 Civic maintenance pilot

Consumed: UNKNOWN headless subject in read set; narrative inputs = fault + sourcing + routing + photo/GPS + inspector approval + escrow disbursement (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md).
Logic: Five-step flow (fault → fair sourcing → scheduling/routing → on-site work + photo/GPS → verified escrow disbursement) (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md). Estate twin: WhatsApp/USSD/Jamii intake → S2-cell location extract → vendor match → one-tap approval → photo/GPS verify → PoCE receipt → escrow release only on proof (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Emitted: PoCE receipt seals the milestone; escrow via Sikasie/Fineract → M-Pesa/Stripe/bank (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Guards: resolver ≠ approver; no payout without GPS + time-stamped photo + inspector signature; "no sign-off, no payout" (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Store-of-record: resource/claim/truth_node as canonical base per the zero-bespoke rule; no new maintenance_* table permitted (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Variant authoring: another ward/service = new CNS type + fragment + sourcing lookup entry; never a new maintenance table (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Evolution/versioning: UNKNOWN in read set (no rule version provided for this pilot); version by pack pipeline_id + CNS fragment lineage (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md).
Refusal modes: photo/GPS missing → no disbursement; inspector signature missing → refuse; honest-empty on compose failure (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-06 Procurement tier (multi-source fill)

Consumed: platform.criteria.v1.match.fired with meta.pipeline_stage: continuous_match (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json).
Logic: Tier-1/2 engine: kestra_camel_solver, capability procurement.multi_source_fill@1, contract decision-request-v1, min_score: 0.8, objective_default: min_suppliers_then_score; optional logistics.route@1 (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json).
Emitted: sourcing.fill_plan on platform.criteria.v1.sourcing.fill_plan (feasible) / sourcing.fill_infeasible on platform.criteria.v1.sourcing.fill_infeasible (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json).
Guards: solver only after match; Soft Soft≠LIVE; solver :3070 down → 503, no OPTIMAL fake (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Store-of-record: UNKNOWN in read set (no SoR statement in the rule); reserve/award consumes fill_plan downstream (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json).
Variant authoring: new solver pack procurement.multi_source_fill.v1.yaml; thresholds/objectives via lookup, never hardcoded supplier lists (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Evolution/versioning: promotion.status: designed, soft_soft_ne_live: true, example "need 100 kg; farms 30/20/60 → allocate 30+20+50"; land Soft before SOURCING_SOLVER_LIVE=1 (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json).
Refusal modes: infeasible shortlist → fill_infeasible (no silent award); solver down → refuse (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-07 Audit-file assembly

Consumed: UNKNOWN headless subject in read set (assembles PoCE receipt + photo/GPS/lab + PDF certificate) (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Logic: Verification steps (photo/GPS/lab) + PoCE receipt + Gotenberg PDF certificates + Superset budget-vs-actual (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md; source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Emitted: Verified photo-backed compliance report in two clicks; monthly statement PDF (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Guards: auditor recomputes PoCE receipt in the walkthrough; no receipt → no export (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Store-of-record: UNKNOWN in read set; canonical PoCE receipt store referenced only by name (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Variant authoring: new report = new NATS KV template (EN/SW/FR) + manifest fragment; never a bespoke export table (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Evolution/versioning: UNKNOWN in read set (no sourced audit-file schema version).
Refusal modes: unverified receipt → refuse export; compose unmet → honest-empty (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-08 Citizen notifications

Consumed: UNKNOWN headless subject in read set (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Logic: Kutuma reminders (SMS/WhatsApp/email) on schedule; Matrix + Kutuma multi-channel rendering from NATS KV templates (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md). Government cascade adds warning texts in local languages to low-lying residents, plus works/transport/welfare tasks (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md).
Emitted: Unknown typed subject in read set; client event catalog (/v1/events/stream) includes pack emits — alignment TODO (ESP-10) (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Guards: tenant scoping (Keycloak realm, MinIO prefix, scope:<community>), APF roles, audit log, presence; break-glass dual approval + TTL + audit (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Store-of-record: UNKNOWN in read set; templates live in SOVEREIGN_TEMPLATES (NATS KV) (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Variant authoring: new notice = new KV template + fragment; i18n EN/SW/FR + plain-English narration; no resident-surface jargon (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Evolution/versioning: KV revision manifest (datasets/lookups/kv-manifest.json, key → revision/bytes/at) provides per-key versioning (source: D-17 — Backlog Validation (platform-map recommendations)).
Refusal modes: non-scrubbed public alert → refuse; out-of-ceiling publish → refuse (MIB deny, ESP-12) (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-09 AI hooks (advisory-only)

Consumed: enrichment-stage hooks; lifelong platform.criteria.v1.entity_state (entity_type: lifelong_entity, meta.domain: lifelong) keyed by entity_id, facets only (source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Logic: Akili classifies (plumbing/electrical/security/facilities), extracts S2 cell + urgency + photo, proposes assignment; answers from community docs with citations; local Gemma4 lane for air-gapped retirement communities (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md).
Emitted: Proposal/narrative only; lifelong facet match emits lifelong.entity.facet.matched via Flink (lifelong-facet-match job); Camel normalize kept, Camel evaluate retired when LIFELONG_CAMEL_FACET_EVALUATE=0 (source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json).
Guards: manager approves in one tap (Decision Gate); board approves what AI proposes; indexability scrub required (lookup.entity.indexability.<cns_slug>.v1); never auto-APPROVED; no second runner (source: docs/jijibora-gtm/03_ENTRY_POINT_AND_STARTER_PACK.md; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md; source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json).
Store-of-record: UNKNOWN in read set; indexability lookup in NATS KV (source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json).
Variant authoring: prompt/policy via SOVEREIGN_LOOKUPS lookup (new KV key), never a code switch; core path must work with hooks empty (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Evolution/versioning: lifelong rule version: "1.1.0", promotion.status: promoted 2026-10-28; volume gate decides Flink vs Camel cutover, avoid dual evaluators (source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json).
Refusal modes: unscrubbed raw metadata in a facet → refuse to match (facets only); hook proposes unapproved award/payout → refuse to emit payment command (source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json; source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).

D-10 Industrial / local-content gate

Consumed: UNKNOWN headless subject in read set (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Logic: minimum local-content share checked; authority verdict before award (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Emitted: local-content verdict receipt + award decision receipt (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Guards: authority verdict required before award; missing verdict blocks; threshold changeable without code change (declarative lookup) (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Store-of-record: UNKNOWN in read set; canonical primitives only, no bespoke table (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Variant authoring: new threshold/policy = lookup + fragment; EUDR evidence pack is a Month 6+ supplier-sell add-on, not a new code path (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Evolution/versioning: UNKNOWN in read set (no rule version sourced for this gate).
Refusal modes: missing verdict → block award; publish outside ceiling → refuse; forged counts cannot finalize (federation flavor analogue) (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).

Pattern library (copy these shapes for any new playbook):

Criteria one-shot: kind: criteria, key_by: [meta.tenant, entity_id|payload.match_key], single input, on_match → platform.criteria.v1.match.fired (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json).
Join (Flink): two inputs (requirement + candidate), kind: join, min_score: 0.8, non-terminal (source: docs/event-sourcing/rules/sourcing-continuous-match-rule.example.json).
Solver stage: input = match.fired filtered by pipeline stage, kind: solver, contract-versioned capability, on_feasible/on_infeasible pair (source: docs/event-sourcing/rules/sourcing-multi-source-fill-rule.example.json).
Windowed SLA (Flink): two inputs (qualified + ack), kind: window, event_time, on_missing: breach, Flink emits criteria + command only, escalation handler owns tickets/notifications/PoCE (source: docs/event-sourcing/rules/criteria-pipeline-sla.example.json).

Open items / gaps

canonical_subject / canonical_event_type / pipeline_id in every pack lookup (ESP-02) is TODO; generalize the ontology normalizer to pack-event-ontology (ESP-03) is TODO; Soft ceiling assert (ESP-04) is TODO — variants must land with these in mind but cannot assume them (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Per-pack Flink promotion candidates flink_candidates[] (ESP-11), hierarchy-aligned ACL subscriptions (ESP-08), and typed SSE client catalog (ESP-10) are TODO/P1–P2 (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Claims finance gates remain OPEN-OPS: TSA customer (FCT-18), PSAP customer (INTRQ-20), Kill Bill prod migration (FINMON-16) — live money paths that need an external party (source: D-17 — Backlog Validation (platform-map recommendations)).
Drill/test-track enforcement meta.is_test (ESP-13) is TODO — until then, ensure test packs never carry production incident keys (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
OpenAPI product map documenting emit/consume per SKU was SUPERSEDED and absorbed into CAPSRC-01 (ESP-14) (source: docs/commercialization/33_EVENT_SPINE_PLAYBOOK_BACKLOG.md).
Headless SoR table names for D-05, D-06, D-07, D-08, D-10 remain UNKNOWN in the read set — developers must locate the canonical resource/claim/truth_node mapping before building; if no mapping exists, STOP AND ASK (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).
Trusted timestamping and PSAP-formatted location exist only when a TSA/PSAP customer arrives (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: D-17 — Backlog Validation (platform-map recommendations)).