D-06 — Governance Rules Architecture and Event Contracts

Scope: Six-family governance taxonomy, its event contracts, guards, canonical storage, and three fully spelled property playbooks for Jijibora building and community governance. Status: as of 2026-11-09 Blueprint sources: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; datasets/lookups/lookup.claims.threshold.v1.json; datasets/lookups/lookup.claims.evidence.v1.json; datasets/lookups/lookup.claims.sod.v1.json; AGENTS.md; docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json; docs/event-sourcing/rules/standing-order-breach-rule.example.json; docs/event-sourcing/rules/truth-graph-state-rule.example.json; docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md

What this means for you

Governance here is a declarative, event-driven layer over the canonical claim and graph record — not bespoke workflow code. Packs and lookups supply values only; the runner never branches on claim type, and swapping a value group changes refusal rules with zero code change. A referenced-but-missing value fails closed, and dry-run validation produces zero writes (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).

Details

1. The six-family taxonomy

Family 1 — Scope rules

• PROBLEM it solves. Decides which group has legitimate authority over a building, estate, block, or district action, including inheritance and ceilings: a parent standard is inherited by children, children may only tighten it, and a child can never widen beyond its parent (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• CONTRACT it exposes. Consumes scope and membership establishment events and emits rule applicability and ceiling-refusal events. Blocked widening is observable as a refusal, not a silent override (source: Config-Track Federation).
• GUARDS. Refuses work proposed outside the acting scope; refuses any child scope whose authority exceeds its parent ceiling; refuses membership changes that would create self-approval inside a governed scope.
• STORE. The rule lives on the canonical scope, membership, and claim records; no bespoke governance tables are introduced (source: AGENTS.md).

Family 2 — Compliance policies

• PROBLEM it solves. Ensures that before any guarded step advances, the declared evidence, separation-of-duties, and external-verdict conditions are actually true (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).
• CONTRACT it exposes. Consumes lifecycle-stage transition requests and evidence-attachment events, and emits guarded-transition receipts including refusal receipts. Example receipt shape per the claims plane is a governed-transition receipt with step, actor, and guard verdict (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs). Observable refusal semantics are fail-closed: failure of an infrastructure dependency returns refusal with 502 / 503 semantics and never returns a synthetic pass (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• GUARDS. Refuses on missing required evidence references; refuses when the mover is the creator on types where creator-approval is forbidden or when a declared barred pair co-approves; refuses when the required quorum band has not reached its threshold; refuses when an execution-proof or external-verdict stage is unmet (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; source: datasets/lookups/lookup.claims.evidence.v1.json; source: datasets/lookups/lookup.claims.sod.v1.json).
• STORE. Compliance state lives on the canonical claim and its receipts, with verdict history preserved as receipts; UNKNOWN exact projection shape — confirm with the deployed schema (source: AGENTS.md).

Family 3 — Spatial rules

• PROBLEM it solves. Binds each rule to the physical area where it applies so behaviour follows the map — an estate, a block, a school wall, a pump house — and boundary crossings are detected rather than assumed (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md).
• CONTRACT it exposes. Consumes boundary and attribute-change signals and emits jurisdiction verdicts. Illustrated by the library/pole-case audit pattern in the stakeholder guide: an action is permitted only inside the bound area, and crossing the boundary emits an observable event.
• GUARDS. Refuses actions whose spatial binding does not match the asset's current area; refuses rules bound to defunct scopes rather than applying them to the wrong place.
• STORE. The binding lives on the canonical asset and graph records; the platform's canonical graph record is the durable store, with the message bus carrying live evaluation (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json).

Family 4 — AI persona (advisory) rules

• PROBLEM it solves. Lets the assistant draft and suggest while keeping every consequential decision human-made, with suggestions labelled and evidence-linked (source: S-04 — Week in Review (plain-language summary); source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• CONTRACT it exposes. Consumes case context events on advisory-enabled scopes and emits advisory suggestion events that carry no decision authority. Advisory hooks are present but disabled by default and their enablement is a product decision, not an implementation gap (source: S-04 — Week in Review (plain-language summary); source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).
• GUARDS. Refuses to record a suggestion as an approval, close-out, or payment; refuses any path that would let a suggestion advance a transition on its own.
• STORE. Persona configuration lives as declared declarative configuration, not as workflow state; suggestions live on the canonical case record as advisory content only (source: AGENTS.md).

Family 5 — Threshold, separation-of-duties, and evidence value families

• PROBLEM it solves. Makes approval and evidence expectations data: swapping a value group changes quorum, separation, and evidence rules with zero code change (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).
• CONTRACT it exposes. Referenced from the transition-policy stages by declarative config references (config.threshold_ref, config.evidence_ref, config.rule) and resolved at runtime against the named value groups (source: datasets/lookups/lookup.claims.threshold.v1.json; source: datasets/lookups/lookup.claims.evidence.v1.json; source: datasets/lookups/lookup.claims.sod.v1.json). Shape, minimally:

{
  "risk_vocabulary": ["low", "standard", "high"],
  "quorums": {
    "cns://claim/type/community/ticket": {
      "resolver": { "min_approvals": 1 },
      "assembly": { "min_approvals": 3 }
    }
  }
}

(source: datasets/lookups/lookup.claims.threshold.v1.json — quorum thresholds are data, the resolver never defaults; no matching band refuses rather than inventing a threshold.)

{
  "requirements": {
    "cns://claim/type/community/ticket": {
      "triage": { "required_fields": ["triage_note"] }
    }
  }
}

(source: datasets/lookups/lookup.claims.evidence.v1.json — evidence requirement values by claim type.)

{
  "rules": {
    "cns://claim/type/community/ticket": {
      "standard": { "forbid_creator": false }
    }
  }
}

(source: datasets/lookups/lookup.claims.sod.v1.json — separation-of-duties values by claim type.)

• GUARDS. Refuses on unknown claim type, missing value reference, or an unmatched band rather than inventing a default; insurance and government lines forbid creator-approval while community lines use the lenient form (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; source: datasets/lookups/lookup.claims.sod.v1.json).
• STORE. Values live as declarative lookup configuration in the configuration store; verdicts land on the canonical claim and its receipts (source: AGENTS.md).

Family 6 — Event bindings (reactive rules)

• PROBLEM it solves. Turns declarative signatures into live reactions — building state deltas, sourcing requirements, and emergency signals — evaluated on the message bus with the database as system of record only (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
• CONTRACT it exposes. Each binding declares an input stream, an evaluation key, and an output event on match. Worked examples taken directly from the rule files:

Building reflex — consumes building state, emits a reflex event (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json):

{
  "rule_id": "rule:jijibora:building-reflex:v1",
  "inputs": [{ "stream": "platform.criteria.v1.building.entity_state", "filter": { "entity_type": "building" } }],
  "evaluation": { "kind": "criteria", "engine": "tgc", "key_by": ["meta.tenant", "entity_id"] },
  "outputs": [{ "on_match": { "event_type": "building.reflex.fired", "subject": "platform.criteria.v1.match.fired", "envelope": { "inherit_causation": true } } }],
  "side_effects": { "handled_by": "terminal:actuate", "note": "Commands only from terminal stage." }
}

Community sourcing — consumes a sourcing requirement, emits a match (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json):

{
  "rule_id": "rule:jijibora:community-sourcing:v1",
  "inputs": [{ "stream": "platform.criteria.v1.sourcing.requirement", "filter": { "entity_type": "sourcing_requirement" } }],
  "evaluation": { "kind": "criteria", "engine": "tgc", "key_by": ["meta.tenant", "payload.match_key"] },
  "outputs": [{ "on_match": { "event_type": "sourcing.match.fired", "subject": "platform.criteria.v1.match.fired", "envelope": { "inherit_causation": true } } }],
  "side_effects": { "handled_by": "terminal:shortlist", "note": "Commands only from terminal stage." }
}

Emergency dispatch — consumes a governance signal, emits a dispatch (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json):

{
  "rule_id": "rule:jijibora:mars-ice-dispatch:v1",
  "inputs": [{ "stream": "platform.criteria.v1.governance.signal", "filter": { "entity_type": "emergency_incident" } }],
  "evaluation": { "kind": "criteria", "engine": "tgc", "key_by": ["meta.tenant", "entity_id"] },
  "outputs": [{ "on_match": { "event_type": "emergency.dispatch.fired", "subject": "platform.criteria.v1.match.fired", "envelope": { "inherit_causation": true } } }],
  "side_effects": { "handled_by": "terminal:dispatch", "note": "Commands only from terminal stage." }
}

Standing-order breach (reference shape): consumes normalised inventory state, emits a breach evaluation and, on breach within cooldown, a fire command:

{
  "rule_id": "rule:standing_order:breach:inventory:v1",
  "inputs": [{ "stream": "platform.criteria.v1.inventory.state", "filter": { "entity_type": "inventory", "event_type": "state_changed" } }],
  "outputs": [
    { "on_breach_evaluated": { "event_type": "platform.criteria.v1.standing_order.breach_evaluated", "subject": "platform.standing_orders.v1.breach_evaluated", "envelope": { "inherit_causation": true, "rule_id": "rule:standing_order:breach:inventory:v1", "correlation_id": "{{correlation_id}}", "payload": { "standing_order_id": "{{standing_order_id}}", "entity_id": "{{entity_id}}", "criteria_result": "{{criteria_result}}", "breached": true, "cooldown_active": false } } } },
    { "on_fire": { "command_type": "platform.standing_orders.v1.fire", "subject": "platform.standing_orders.v1.fire", "envelope": { "inherit_causation": true, "rule_id": "rule:standing_order:breach:inventory:v1", "correlation_id": "{{correlation_id}}", "payload": { "standing_order_id": "{{standing_order_id}}", "entity_id": "{{entity_id}}", "criteria_result": "{{criteria_result}}", "trigger": "breach_rule" } } } }
  ]
}

(source: docs/event-sourcing/rules/standing-order-breach-rule.example.json; state key template claim:standing_order:{standing_order_id} — authoritative watcher and cooldown state lives on the standing-order claim.)

• GUARDS. Only terminal stages issue commands; intermediate stages emit only match events. Events inherit causation and correlation identifiers. Duplicate or past-cooldown firings are suppressed by the declared cooldown window (source: docs/event-sourcing/rules/standing-order-breach-rule.example.json).
• STORE. No bespoke tables: authoritative state lives on the canonical claim or graph record, and the declarative signature is hoisted configuration read at runtime from the configuration store, never from the filesystem (source: AGENTS.md).

2. Event geography

Governance traffic uses the canonical envelope only, outbox-first publishing, and idempotency on subject-plus-event and cell-plus-digest-plus-track. Legacy bare payloads without the envelope are refused (source: Config-Track Federation).

3. Playbook compositions (property flavour)

Playbook A — Night-time break-glass at the school wall

1. A governance signal arrives for an emergency incident inside the bound school-wall area (spatial family; signal shape follows the dispatch binding: platform.criteria.v1.governance.signal with entity_type: emergency_incident) (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
2. The reactive binding keyed by tenant plus incident emits emergency.dispatch.fired on platform.criteria.v1.match.fired with inherited causation; only the terminal dispatch stage issues commands (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
3. Dual-controlled break-glass is granted with a short expiry; the grant, the dispatch, and the high-risk close-out each produce receipts. Close-out requires the community evidence shape (triage_note) and, where the band selects it, an assembly quorum rather than a single resolver (source: datasets/lookups/lookup.claims.evidence.v1.json; source: datasets/lookups/lookup.claims.threshold.v1.json; source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
4. Proof: signal-to-dispatch receipt chain plus guarded close-out receipt; refusal cases include expired grants and single-person close-outs on high-severity bands.

Playbook B — High-value elevator inspection

1. An inspection claim is opened against the elevator asset in its bound area; the asset's inspection history is consulted from the canonical graph for assignable, inspectable context and prior servicing state.
2. Guarded evaluation runs in order — gate, quorum, separation, evidence, execution proof, external verdict — with values resolved from the declared packs and lookup groups (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs). Property inspection requires an assessment note plus a photo reference, and litigation-grade property inspections add the municipal inspection reference (source: datasets/lookups/lookup.claims.evidence.v1.json).
3. Amount-by-risk band selection picks the quorum: higher amount or higher risk selects the two-person or three-person quorum and widens the approver role set; creator-approval is forbidden on property lines (source: datasets/lookups/lookup.claims.threshold.v1.json; source: datasets/lookups/lookup.claims.sod.v1.json).
4. Proof: inspection receipt chain with per-stage verdicts and an exportable evidence checklist; missing-evidence submissions are refused, never completed with defaults.

Playbook C — Lease boundary-crossing evidence chain

1. A vendor crew or tenant asset approaches the pump-house or block boundary; the boundary watch emits a crossing-approach signal on the reactive bus, keyed by tenant plus entity.
2. The spatial family checks destination jurisdiction: access is granted only inside the standing authority of the destination scope, and denials emit a federation allow or deny record visible to the auditor (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
3. The access claim advances through the guarded lifecycle: evidence for the standing permission is required, separation of duties applies, and the crossing itself is recorded as a receipted boundary event.
4. Proof: pre-entry authorisation, crossing record, post-exit close-out — an evidence chain that stands on its own in front of a donor or auditor (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md).

4. Authoring recipe

1. Declare values. Write the thresholds, evidence requirements, and separation-of-duties values as declarative lookup groups, referencing them from the transition policy by the declared configuration keys. Keep them as data so a pack swap changes refusals with zero code change (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; source: datasets/lookups/lookup.claims.threshold.v1.json).
2. Bind to scope. Attach the rule to exactly one governing scope and its spatial binding. Child scopes inherit but may only tighten; never loosen a parent standard (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md).
3. Apply configuration policy. Load the declared values and rule signatures through the configuration store; runtime reads them from the store, never from the filesystem. Track, cell, audience snapshot, and ceiling semantics follow the federation contract: one distribution track per rollout, frozen recipient snapshot at offer time, recomputed rollups, and signed receipts with hop proofs (source: Config-Track Federation; source: AGENTS.md).
4. Subscribe. Declare the reactive binding with a named input stream, evaluation key, match output, and terminal-stage side effects only, following the three worked payload shapes in Family 6 (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json).
5. Verify with the respond catalog. Run the dry-run, plan-only validation across each guard stage without mutation; confirm the wrapped refusal path for each guard (missing evidence, barred creator, under-threshold quorum, stale spatial binding); confirm the spine consumer accepts the outbox event and emits the expected receipt; and confirm the negative case — an allowlist-external subject for a ghost identity produces no receipt (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).

5. Evolution, ownership, and versioning of rules

• Rule versions on immutable events. A rule's history is a sequence of adopted versions over immutable events; no version is edited in place (source: Config-Track Federation). Rollback is a new change set under dual control, never a silent undo (source: Config-Track Federation).
• Amendment preserves lineage. An amendment names the version it replaces and carries the proposal and vote behind it; the predecessor remains readable (source: Config-Track Federation).
• Ownership. Every rule and every reactive binding carries a declared owning team in its metadata, and decisions are attributable to a named human, never to "the system" (source: docs/event-sourcing/rules/standing-order-breach-rule.example.json; source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• Custody and signing. Policy fragments are authored in version control and loaded into the configuration store; runtime reads the store, not the repository. A customer-held signing root and per-receipt records of the ceiling in force remain in-flight and must not be claimed as present facts (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).

Open items / gaps

• Recipient-weighted approval matrix behaviour and trusted timestamping on finalise remain UNKNOWN or deferred in the sources; treat any timestamp or matrix claim as unconfirmed (source: Config-Track Federation).
• Field-level redaction on federated record sharing is not shipped; do not share sensitive records across peers until it lands (source: docs/jijibora-gtm/08_SECURITY_AND_COMPLIANCE_POSTURE.md).
• Exact reconciliation between procurement-threshold values and claims-threshold values is an open item; the seam reads the claims keys explicitly (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).