D-07 — Starter Bundles for Developers

Scope: Bundle composition for the four shipped bundles and the four expansion bundles — what each bundle binds, how money splits and gates, how a pack is authored, and where a new playbook crosses into claims versus staying in sensing. (source: docs/commercialization/playbooks/dictionary.v1.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: D-17 — Backlog Validation (platform-map recommendations))

Status: as of 2026-11-09

Blueprint sources: docs/commercialization/playbooks/dictionary.v1.json; Playbook Registry — What You Can Run, Who Runs It, What You Get Back; D-06 — FINMON: Money Side — Billing, Desks, and Proof of Value; D-17 — Backlog Validation (platform-map recommendations); Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; D-05 — Starter Packs for Developers; docs/platform-map/jijibora/D-02-PLAYBOOK-DESIGNS.md; docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json; docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json; docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json

What this means for you

A bundle is a set of packs under one offer, gated through practice before it is ever live. You compose bundles by binding existing packs, keys, scenarios, and surfaces — not by writing new code per bundle. The four shipped offers have registered identities; the four expansion offers below are provisional placeholders, not registered offers (source: docs/commercialization/playbooks/dictionary.v1.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).

Details

1. The four shipped bundles

Offer identities exist for the four below; new names in Section 2 are provisional placeholders and do not claim registered identities (source: docs/commercialization/playbooks/dictionary.v1.json). All four share the same rollout discipline: Soft means practice with zero live writes, Soft can never report itself live, and LIVE means the JetStream path with the ceiling enforced and real probes green (source: D-05 — Starter Packs for Developers; source: D-17 — Backlog Validation (platform-map recommendations)).

Jamii starter — community maintenance and dues. The community starter binds one maintenance-desk pack: WhatsApp and USSD intake classified, nearest certified vendor proposed, one-tap manager approval, photo plus location verification, and escrow released only on proof, with a native dues ledger, scheduled reminders, and a monthly statement alongside (source: docs/commercialization/playbooks/dictionary.v1.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). Its money behaviour is narrow entitlement with collection by the subscription owner, resellable flags, meters on work orders and dues transactions, creator share named as a party, and a split that must sum exactly to the whole with two-person approval (source: docs/commercialization/playbooks/dictionary.v1.json; source: D-06 — FINMON: Money Side — Billing, Desks, and Proof of Value). Its gate is the starter Soft acceptance suite: a ticket end to end, an outbox row for the work-order emit, the billing-adapter Soft binding check, and an honest refusal rather than a synthetic answer when a downstream service is down (source: docs/commercialization/playbooks/dictionary.v1.json). Life-safety behaviour degrades gracefully on arrears rather than stopping outright where the profile declares it (source: D-06 — FINMON: Money Side — Billing, Desks, and Proof of Value).

Claims orchestration pilot — guarded adjudication as a pilot. The pilot binds the motor claims pack as the first line, with medical, home, government-benefit, government-compensation, and community-ticket siblings sharing the same umbrella offer (source: docs/commercialization/playbooks/dictionary.v1.json; source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs). It binds the governed claim and entity types, the adjudication value groups for transition policy, separation, thresholds, evidence, panel, meter clocks, and add-on eligibility, the scenario pack, and the intake and external-gate routes, with the workflow flow that records a timeout breach rather than inventing a verdict (source: docs/commercialization/playbooks/dictionary.v1.json; source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs). Its money behaviour runs on a no-charge pilot binding with narrow entitlement, named creator share, and money subjects that never carry claim payloads and never advance a claim (source: D-06 — FINMON: Money Side — Billing, Desks, and Proof of Value). Its gate is the validator's bias: practice with zero writes, dry-run guard verdicts with no mutation, fixture exclusion from metrics by default, the readiness separation between infrastructure-ready and rollout-enabled with rollout environment-gated and default off, and pilot pricing unpublished with no savings promised until a baseline is measured (source: D-17 — Backlog Validation (platform-map recommendations); source: docs/commercialization/playbooks/dictionary.v1.json). A pack cannot declare itself live (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).

Estate Safe — starter plus guard as one bundle. The bundle composes the community starter pack and the community guard pack under one subscription, with one offer covering both maintenance and the guard surface (source: docs/commercialization/playbooks/dictionary.v1.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). Its money behaviour pins the split profile so revenue share is visible, flags the SOS feature as life-safety, and forbids a child estate from widening the parent subscription (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back; source: docs/commercialization/playbooks/dictionary.v1.json). Real money movement stays gated until finance keys, a human approver, and the payments ledger are ready — no bundle action opens that gate (source: D-17 — Backlog Validation (platform-map recommendations)). Its gate is therefore still Soft with manual reconciliation until that operations gate closes (source: A-04 — Starter Packs for Administrators).

Materra AMCOS pilot — cooperative pilot. The pilot binds the cooperative pack scoped to one regional scope: farmer registry, field forms, extension paths, certified bag metering, market prices, and the cooperative organisation (source: docs/commercialization/playbooks/dictionary.v1.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). Its money behaviour meters certified bags, follows the cooperative pilot split profile, keeps creator share named, and refuses heterogeneous-currency settles with a clear error rather than converting (source: D-06 — FINMON: Money Side — Billing, Desks, and Proof of Value; source: docs/commercialization/playbooks/dictionary.v1.json). Its gate is the same validator bias: the pack stays partial rather than soft-shipped, publishes and consumes on its declared subjects, and never lets sealed profile content travel in a match (source: docs/commercialization/playbooks/dictionary.v1.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). Real disbursement remains gated on the same finance operations gate (source: D-17 — Backlog Validation (platform-map recommendations)).

2. The four expansion bundles — provisional placeholders

Offer identities exist only for the four shipped bundles in Section 1. The four names below are provisional placeholders — do not claim registered identities, registered offer packages, or registered split profiles for them (source: docs/commercialization/playbooks/dictionary.v1.json). Their contents follow exactly the design-intent labels you recorded; any finer contents are UNKNOWN in the read set.

Ontology and reflex. A bundle that adds the unified town registry and the active reflex arc on top of a starter: the shared registry with one identity per thing, ceiling inheritance, active monitors that cascade across agencies, and the building sense-reason-actuate family as its reflex surface (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json). It stays sensing plus terminal actuation with no claim adjudication inside it.

Event-sourcing management. A bundle for operating the rule plane itself: rule lifecycle from draft to retirement, tick and cadence policy, kill-switch by family and by rule, and the capacity probes over delivery depth and receipts (source: docs/platform-map/jijibora/D-02-PLAYBOOK-DESIGNS.md; source: D-04 — Environmental Playbooks (developer)). It binds consumers and their terminals, not stores.

Civic maintenance full. The full municipal maintenance flow beyond the starter desk: fault to fair local sourcing to scheduling and routing to on-site work with photo and location to inspector sign-off to verified disbursement, with the escrow and audit steps the starter does not carry (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). It is the only one of the four that carries money movement, and that movement stays gated on the finance operations gate even in this bundle (source: D-17 — Backlog Validation (platform-map recommendations)).

Emergency guard. The guard and dispatch bundle beyond the community guard: the governance-signal dispatch family, forked children under the parent ceiling, scrubbed-fields-only public alerts, and typed emergency receipts (source: docs/event-sourcing/rules/jijibora-mars-ice-dispatch-rule.example.json; source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). It assumes the starter and the guard are already active, the way the shipped bundle already composes them (source: docs/commercialization/playbooks/dictionary.v1.json).

For all four expansion bundles: contents are provisional, billing is not registered, and the gate is the same Soft, rehearsal, then LIVE path — practice with zero writes, rollback rehearsed by re-pinning the previously approved configuration values, then LIVE only on real probes with the ceiling enforced (source: D-05 — Starter Packs for Developers; source: A-04 — Starter Packs for Administrators).

3. Pack authoring checklist

Anatomy, in the order you write it:

Lookups. Declare every lookup value the pack reads, with its canonical subject, canonical event name, and pipeline identity, published to the messaging key-value store by the offline seeder (source: docs/platform-map/jijibora/D-02-PLAYBOOK-DESIGNS.md). Runtime services read those values, never pack files from disk (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).

Scenario and taxonomy. Bind the scenario the orchestration engines execute and the claim and entity types the pack operates on, the way the motor pack binds its claim type with its vehicle kind (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs).

Consumers. Declare publisher and consumer subjects explicitly, declare enrichment stages, and bind the terminal handler that alone may act (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json).

AI-hook allowlists, off by default. Hooks are advisory and tracking-only, the core path works with hooks empty, and there is no second runner and no auto-approval (source: docs/platform-map/jijibora/D-02-PLAYBOOK-DESIGNS.md). A new pack starts with hooks absent, not with hooks disabled-after-the-fact.

Cohort refs. Reference the cohort definition that targets the offer, the way the cohort billing model pins an offer identifier without inventing an invoice and never decides amounts (source: D-05 — Starter Packs for Developers).

Check items before asking for activation: every pack value resolves and a missing value fails closed rather than falling back to an invented default; separation of duties is wired so the creator or resolver cannot approve their own item; missing evidence refuses; unattested providers are refused; Soft is proven with zero writes and rollback rehearsed; and the pack cannot declare itself live (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs; source: D-05 — Starter Packs for Developers).

4. Where a new playbook crosses into claims versus stays sensing

Cross into claims when the playbook adjudicates. Adjudication packs carry a lifecycle — draft, submitted, validated, approved, rejected, disputed, settled, cancelled — guarded transition stages in order, quorum bands by amount and risk, and evidence demands by type, so the runtime refuses on any failing stage rather than advancing silently (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs). Government benefit and compensation are the model: cross-agency quorum, an officer who cannot approve their own file, mandatory audit export, and an outside verdict that is honoured (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back). A new adjudication pack therefore needs the claims taxonomy — claim type, entity binding, panel, thresholds, and evidence — not just a new subject filter.

Stay in sensing when the playbook reacts. A building reflex senses state, reasons over criteria, and fires a standard notice for the terminal handler to actuate; it never mints a claim, never asks a quorum, and never evidences a settlement (source: docs/event-sourcing/rules/jijibora-building-reflex-rule.example.json). Community sourcing stays sensing until a shortlist is bound: qualification plus the solver produce a match transcript and a bind receipt, and sealed content never travels in the match (source: docs/event-sourcing/rules/jijibora-community-sourcing-rule.example.json). If you can describe the playbook as watch, evaluate, and fire for the terminal step, stay in sensing, and add claims taxonomy only at the moment a human must be able to approve, dispute, or settle the outcome.

5. Land and space as the bundle backbone

Treat place as the composition key every bundle shares. The hierarchy runs from the largest jurisdiction through districts and estates down to a block or building and then to a unit or parcel and finally to a sensor or asset site, and each level is a governed kind with its own name and scope, so a bundle that binds a place at one level refines it rather than restating it at the next (source: docs/jijibora-government-trial/04_UNIFIED_ONTOLOGY_AND_REACTIVE_GOVERNANCE.md; source: Data Fabric — Message Bus and Engine Interfaces (Developer Concept Doc)). Land-use types ride as declarative pack values — residential, public, commercial, mixed — read at runtime from the pack, so a bundle can tighten what a parcel may be used for without changing code (source: docs/jijibora-gtm/02_PRODUCT_STRATIFICATION.md).

Bundles attach operations to space by binding rather than copying: permit and inspection claims bind to the parcel or building they concern, utility and maintenance work binds to the site it serves, complaint claims bind to the unit or site they describe, and assessments bind to the parcel they value. That is the same binding the shipped bundles already use for buildings and vehicles — a claim points at its entity and the two share one history (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs). The canonical mapping is closed: land and space entities and their operations map into the claim record, the navigable graph, and the universal integration ledger, with no new stores per bundle and no per-district branch. When a place fact cannot be mapped, stop and ask instead of inventing a store (source: Core Concepts — Vocabulary as Mechanisms (Developer Concept Doc)).

6. Entity history as the bundle continuity layer

Every bundle that touches a thing over time sits on the lifelong entity plane, which joins the enduring entity to its claim history through a reference pointer and keeps version history, attachments, and purpose-gated leases on that same identity (source: Core Concepts — Vocabulary as Mechanisms (Developer Concept Doc); source: Lifelong Entities API (non-fungible lifespan) — OpenAPI 1.0.0). Indexability stays per kind — each of vehicle, building, person, organisation, and resource declares what may become a searchable facet — and scrubbed facets only are what match, so bundles notify on facets without exposing raw metadata (source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json).

A bundle developer composing a new pack therefore declares the entity binding once: the entity kind, the claim type that points at it, and the profile that governs its facets, and then relies on the plane for the timeline and the receipts rather than re-deriving them (source: Claims Plane — Processing Claims, Guarded Transitions, and Declarative Packs). Facet-match notifications and home or building adjudication both reuse that one plane — the watch fires a standard notice, the adjudication pack binds its claim type with its entity kind (source: docs/event-sourcing/rules/lifelong-entity-state-rule.example.json). History never rewrites itself because the trail is append-only and a finalised entity is read-only; a bundle corrects by adding a new claim or a new entity that references the old one, never by editing in place (source: Lifelong Entities API (non-fungible lifespan) — OpenAPI 1.0.0). Merge semantics between two entities that turn out to be one remain UNKNOWN in the read set and must not be invented (source: Core Concepts — Vocabulary as Mechanisms (Developer Concept Doc)).

Open items / gaps

Contents of the four expansion bundles beyond the design-intent labels are UNKNOWN — no registered identities, registered offer packages, or registered split profiles exist for them (source: docs/commercialization/playbooks/dictionary.v1.json).
Canonical subject fields in every pack lookup, a generalised ontology normaliser, and a Soft ceiling assert remain TODO — variants must land with those in mind but cannot assume them (source: docs/platform-map/jijibora/D-02-PLAYBOOK-DESIGNS.md).
Claims pilot pricing is unpublished and no savings figure may be quoted; do not put price-guide numbers into bundle docs as promised prices (source: Playbook Registry — What You Can Run, Who Runs It, What You Get Back).
Live money movement for Estate Safe, Materra AMCOS, and the claims pilot stays gated on finance keys, a human approver, and the payments ledger; trusted timestamping and public-safety formatted location need an external authority customer (source: D-17 — Backlog Validation (platform-map recommendations)).
Headless subjects for several playbook families beyond the three Jijibora rule examples remain UNKNOWN — locate the canonical mapping before building; if no mapping exists, stop and ask (source: docs/platform-map/jijibora/D-02-PLAYBOOK-DESIGNS.md).