Governance catalogue — codegen'd views
The same 85 mechanisms, re-grouped live from card metadata. Every card is emitted by renderForView(card); a view is just a grouping key + order, so adding a mechanism or a view is data, not layout. Click a card for its writeup; hover for its one-line summary. · the governance map · the book models · the development process · home
Two organizing spines over one method trunk: the fleet's lifecycle models and the product's 4+1 views, with the sub-models that plug into each and the perimeter grouped under the model it serves. Activate a node on the map — or read the full hierarchy below. ★ = an is-a-model entry; ⇆ = a model shared across spines by projection.
The fleet — the self-operate lifecycle models — Part 2's spine
Anchored by ★ Lifecycle model (typed operational map → generated runbook) — Typed map of the system's operation: per-lifecycle health predicate, generating the runbook.
manage-agents
Dispatch → registry → worktree isolation → the gate staircase → tombstone and clean.
Models plugged in
- ★ Agent-orchestration model (developer journeys) — The fleet + orchestrator loop modeled with the product's own MBSE method: developer journeys.
- ★ Mediator & single-writer contracts — Declared mediator and single-writer contracts, coverage-checked.
- ⇆ Required-configuration-per-role manifest (admission policy on complete env) shared by projection — Role × plane → the complete required config set, checked as an admission policy at start-up.
Perimeter — filed under this lifecycle
- Role-typed dispatch — A typed role fixes LLM, isolation, and gates per dispatch.
- Brief-linting — Reject a malformed dispatch brief before it can launch.
- Agent registry (append-only log + marker cache) — Authoritative record of which agents are live right now.
- Tombstone commits (lifecycle close records) — A close record proving a worktree is safe to reclaim.
- Orchestrator-as-reactor over an event bus — The orchestrator reacts to typed fleet events via a per-topic playbook.
- Caused-by provenance (agent-side change traceability) — A typed `caused-by` field, minted at the cause and gated at commit, threads a change to its reason.
manage-context
Banking, compaction, and session-start reconstruction of the agent's working context.
Perimeter — filed under this lifecycle
- Dynamic context injection — Inject the rules governing these files into the brief.
- Docs hierarchy + governance index — One enforced, numbered rule index every agent boots with.
- Lifecycle hooks (interpose on the agent runtime's events) — A hook on a runtime lifecycle event so an operator's omitted step can't be forgotten.
- Reflection-facet substrate (tempo-gated policy nudges) — Many policy-reflection nudges as one facet registry over a shared tempo budget — ≤1 emission/window.
manage-git-repo
Main as the deploy tip; cherry-pick and merge-train reachability; the commit gate.
Perimeter — filed under this lifecycle
- Pre-commit hook (3-stanza, tree-sha markers) — Cheap changed-file checks gate every commit, marker-verified.
- Sentinel first-commit early-abort — Abort a broken agent at its first commit, not its last.
- Merge-train MIS batching — Land non-conflicting worktrees together via a maximum independent set.
manage-deploy
The local → staging → prod staircase, its canaries, heartbeats, and topology.
Models plugged in
- ★ Deployment & tier topology — Structured models of where things run and how they layer.
Perimeter — filed under this lifecycle
- Staged deploy gates (canary → smoke → promote) — Canary → smoke → promote; gate before users see it.
- Deploy heartbeats + stale-worker detection — Periodic liveness so a hung deploy differs from a slow one.
manage-dev-machine
Host compute rationed across concurrent worktrees; the locks that keep them from colliding.
Models plugged in
- ★ Synchronization model (meta-sync) — A registry of every lock, what it guards, and its ordering.
Perimeter — filed under this lifecycle
- Test-serializer (N=1 flock on `dotnet test`) — Serialize dotnet test to a single writer per host.
- Build-serializer (M=8 semaphore) — Cap concurrent heavy builds with an M=8 host semaphore.
- Aggregate-compute protection (`lint-all` host mutex) — One lint-all per host; one in flight per orchestrator.
- Resource-pressure gating (admit before, shed during) — One pressure signal gates heavy work at admission and execution — admit before, shed during.
gc-cron plane
The periodic garbage-collection crons and their typed alert stream.
Perimeter — filed under this lifecycle
- Cron-alerts gate — Block new dispatch while a HIGH cron alert is unresolved.
orchestrator-hooks
The orchestrator session's own hook machinery and the governance-document mechanisms.
Models plugged in
- ★ Governance graph (mechanism-interaction model) — A typed graph of the governance mechanisms, edged by their conflicts over shared resources.
Perimeter — filed under this lifecycle
- CLAUDE.md rule index (the governance document as a mechanism) — The governance document itself, enforced by its own lints.
- Mandatory snippet-table enforcement — Brief-linting asserts every required brief snippet is present.
- Epic Definition-of-Done (Final-Opus trust-nothing re-run) — Close an Epic only after re-running its checks at HEAD.
- Doc-hygiene lints (index coverage, autogen provenance) — Lints keep docs indexed, provenance-headed, and cross-reference-valid.
- Operational playbooks — Situation-keyed devops procedures agents follow instead of improvising.
- Operator runbook skill (positive map first, symptom index fallback) — Positive substrate map + symptom→doc routing, generated from typed YAML, ref-lint-checked.
- Epic & design-doc templates — Fixed section-templates for Epics and design docs so plans are complete.
- Independent pre-implementation design review — Before code, a fresh non-author re-derives the design and rules on its open forks.
- Self-governance (detect your own recurring issues; convert each into a tasteful control) — Detect a recurring failure class; convert it into a proportionate control, fired on a cadence.
The product — the 4+1 views of the shipped system — Part 3's spine
Logical
The system's functional decomposition — including the product's own document models, which carry the artifact-side mechanisms.
Models plugged in
- ★ Service-flow / API model — The SOA source-of-truth NetworkPolicy and wiring are generated from.
- ★ Domain registries — Frozen typed registries for the system's domain facts.
- ★ PdfModel (sole PDF mutation surface) — All PDF I/O through one structured model; raw canonical-PDF-library access banned.
- ★ Office Models ({Slides,Docs,Sheets}Model) — All OOXML through structured models; raw SDK access banned.
- ★ Canonical walkers (one traversal per tree) — One canonical traversal per tree, not ad hoc recursion.
- ★ Typed contract surfaces (the contract is a checked model, not a comment) — The contract between two parties is a structured, checked model, not a shared assumption.
Perimeter — filed under this view
- ContentValidator (input ⊆ output fidelity) — Assert input content survives remediation — a fidelity gate.
- Standards / WCAG rule engine — Map each finding to the WCAG/508/PDF-UA criterion it closes.
- Blocking semantic lints — The blocking semantic-lint fleet over the tool's own source.
- Cross-source coherence lints — Assert independent sources agree — catch cross-source drift.
- Per-mutator attribution stamps — Every mutation embeds an attribution stamp in the artifact.
- `derive-changelog` (reconstruct mutations) — Reconstruct the attributed mutation history from the stamps.
- `a11y_` prefix convention — Prefix invisible inserts so they're distinguishable and tracked.
- Test-onion tiers (Smoke / Lite / targeted / full) — Cost-stratified test tiers: Smoke, Lite, targeted, full.
- FsCheck property tests — FsCheck invariants over generated inputs find hidden bugs.
- Fuzz campaigns (+ auto-coverage) — Malformed-input campaigns; fix to the spec, not the seed.
- DDT pin-trailers (doc-derived characterization) — Doc-derived characterization pinned to a cited source.
- Typed `ViolationCategory` / `FailureCategory` enums — Typed enums replace free-form failure strings.
- Closed remediation-verb sets — A closed, named set of remediation actions — bounded moves.
- Codemod-first threshold (N≳50 → AST transformer) — For 50+ deterministic sites, write one AST transformer.
- ServiceClient (typed cross-service seam) — A BinaryIO seam makes file-path-over-wire impossible.
- Sole raw-Redis seam (the dispatch module) — All raw Redis in one seam; queue atomicity encoded once.
Process
What runs at once and where it can collide.
Models plugged in
- ★ Composed state-machine model (typed lifecycles + cross-machine invariants) — Typed state machines + cross-machine invariants, each routed to its checker by its shape.
- ★ Process view (concurrent processes, lanes, and racing edges) — Concurrent processes, their lanes, and the edges where they race over shared state.
- ★ Timeout-budget ordering model (nested wall-clock budgets, checked) — Scattered wall-clock budgets unified into one surface with a checkable nesting order.
- ⇆ Synchronization model (meta-sync) shared by projection — A registry of every lock, what it guards, and its ordering.
- ⇆ Mediator & single-writer contracts shared by projection — Declared mediator and single-writer contracts, coverage-checked.
Development
How the codebase is zoned and layered.
Models plugged in
- ★ Component & zone model — A typed map of every component's code zone and seams.
- ★ Rule-metadata registry (machine-readable metadata on governance rules) — Machine-readable metadata on each governance rule, extracted into a typed, queryable registry.
Physical
Where things run and what depends on what.
Models plugged in
- ★ Control↔substrate dependency (computed blast-radius) — Each control declares its substrate assumption as metadata; a query computes the blast radius.
- ★ Compliance data-flow model (typed sinks and edges for privacy reasoning) — Typed sinks and edges for a governed data kind, so privacy and erasure are a model walk.
- ★ Required-configuration-per-role manifest (admission policy on complete env) — Role × plane → the complete required config set, checked as an admission policy at start-up.
- ★ Telemetry-collection provenance (per-stream origin, landing, per-env coverage) — Each telemetry stream's origin, landing, and per-environment coverage as a checkable record.
- ⇆ Deployment & tier topology shared by projection — Structured models of where things run and how they layer.
Scenarios
The journeys that tie the views together.
Models plugged in
- ★ User-journey model (product-goal → implementation bridge) — User journeys as typed entities: actor, goal, ordered steps joined to the endpoints they cross.
- ⇆ Agent-orchestration model (developer journeys) shared by projection — The fleet + orchestrator loop modeled with the product's own MBSE method: developer journeys.
The method trunk — governs every model in both spines
The method trunk
What holds ANY model true, regardless of subject — governs every model in both spines.
Models plugged in
- ★ Symbol-anchored traceability graph (derived edges) — A typed model↔lint↔code↔proof↔registry graph whose edges are derived, symbol-anchored, re-checked.
The method mechanisms — govern every model
- Executable source-of-truth models — Structured models read every run and generated from; can't drift.
- Drift & parity gates — Bidirectional model↔reality checks so models cannot drift.
- The agent-first MBSE harness — Structured frozen-record models + five hand-rolled disciplines; adopt the schema, skip the runtime.
- Formal invariant verification (temporal form → model checking) — Each invariant's temporal-logic form derives its checker — proven, not sampled.
- Coverage → model-node mapping (which invariants are actually tested) — Project test coverage onto model nodes (states, seams, invariants) so untested ones are visible.
- Model query surface (`repo-query`) — repo-query — the agent-facing read API over the models.
- Meta-model consumption discipline (read, don't hardcode) — Read the model at runtime; never hardcode a snapshot.
- Model-driven codegen — Generate real artifacts from the models, provenance-headed.
- Model-graded finding severity (distance-graded gate) — A gate grades each finding block/warn/silence by its model-distance from the changed files.
- Invariant-DAG execution policy (a typed Scheduler separates correctness from resource + cost) — A DAG holds correctness + cost-gate edges only; a typed Scheduler rations load + budget per host.
- Enforce at the right semantic level — Match a mechanism's enforcement scope to the semantic scope of the property it checks.
- Journey-criticality → test-tier placement (which host a test runs on, derived) — A journey's criticality derives its test's host tier; a lint holds the local-coverage floor.
- Journey task-closure (type the terminal post-condition, derive its strength) — Type a journey's terminal assertion as a boolean over observables; a derived strength gates it.
- F10 mutator-stamp-wiring lint — Fail the build if any mutator verb lacks a stamp.
- Model-derived test-obligation census (derive what should be tested, lint the gap) — Derive the should-be-tested set from the models and lint the gap to the tests that exist.
- Control-coverage census (controls per governance target) — Classify each control by its governance target; roll up per target; an empty target is a gap.
- Orphan-coverage metric (walk code → governance; score the un-covered remainder) — Walk code → governing model/control; score the orphans; each orphan cluster is candidate work.