# ── Blueprint metadata (machine-readable; the panel generator and the back-office builder read this block) ──
blueprint:
  aioc: "<[ORG]AIOC-INITIALS>"            # e.g. [ORG]AIOC-SL or TenAIOC-SL. Only cores carry a [ORG]AIOC code; it never changes when the AIOC moves.
  parent: "<code of the unit that holds this AIOC, or none>"   # e.g. [ORG]AIOC-OCO, an example only; its place, never part of its code; a top-level AIOC's parent is the Charter of its [ORG]AION
  full_name: "<Full name>"                # e.g. Organization Core Office
  organisation: "<organisation>"          # e.g. Ten
  type: "<foundational | structural | specialised | connector | other>"   # why the AIOC exists; a card field, never part of the name
  org_aion: "<[ORG]AION>"                # the [ORG]AION this AIOC belongs to, e.g. TenAION
  blueprint_version: "<vN.N.N>"
  status: "<draft | in force | replaced>"
  template:
    name: "49GAION AIOC Blueprint Template"
    version: "v2.1.1"
    source: "github.com/49g-holding/49GAION-aioc, template/AIOC-BLUEPRINT-TEMPLATE.md @ <commit>"
  mother:
    name: "<Library blueprint name>, or none yet"
    version: "<version>, or none"
    source: "<location>, or none"
  writing_repository: "<org>aioc-<abbr>"
  code_project: "<code project path>, or none"
  panel_register_id: "<panel register id, or none>"
  capabilities:                           # plain English names only; no codes, no [ORG]AIOC prefix
    standard: ["Chief of Staff", "Office", "Input socket", "Panel"]   # Office only where a position needs more than one Chief of Staff
    functional: ["<name>", "<name>"]

Blueprint · <[ORG]AIOC-INITIALS> · <Full name> · <blueprint version>

The 49GAION AIOC Blueprint Template, v2.1.1. Blank: every field is a placeholder; it holds no AIOC's content.

What this file is. This is the one git file that defines an AIOC. It is its blueprint and its panel definition. It lists every capability the AIOC has, and each capability is written in four parts: Definition, Process (SOP), Role card, Fixed test. The AIOC's Panel and its Back office are both built from this one file. A change to the AIOC is a tested git commit to this file; the Panel then rebuilds from that commit, so the blueprint never drifts from what runs (docs/WHAT-IS-AN-AIOC.md §2). Where this template names [ORG]AIOC-OCO, it means the hub of the operation: the Top Management Group, or a separate [ORG]AIOC-OCO where the organisation has one. The Panel is the organisation's own interface, written in code; the Back office, the AI chat workspace, keeps it.

How to fill it.

1. Copy this file into the AIOC's writing repository as blueprint/<AIOC>-BLUEPRINT.md. Record in the metadata block the template version and the commit it was copied from (each AIOC records this in its own repository; 49GAION-aioc keeps no copy of any AIOC's blueprint), and the mother blueprint and version it was customised from, or "none yet".
2. Fill every field. If a field does not apply, write "none" and say why.
3. Keep the standard capabilities (§4). Adopt their default definitions (docs/STANDARD-CAPABILITIES.md) unless the AIOC differs, and record each difference in §11.
4. Add one functional capability per function the AIOC performs (§5), each in the four parts.
5. Write for any organisation where you can; the organisation's own names go in the organisation table (§2).
6. Write positions, never people. No person's name appears anywhere: who holds a position is the organisation's own mechanism, outside the system (DR-0049).
7. Cite every rule to its source by ID and version. Never invent a fact, a version, a score or an appointment. NOT_RUN is never PASS.
8. Names. Capabilities have plain, recognisable English names — Chief of Staff, Office, Input socket, Panel, and the AIOC's own (for example Service Desk). They carry no code and no branding. Branded names exist only at the 49GAION level: 49GAION for the framework, [ORG]AION for its product, [ORG]AIOC-… for cores (hub standards/49GAION-NAMING-STANDARD.md). The retired codes listed there are never used.

Sources: DR-0041.

0. Identity and lineage

Sources: DR-0019.

1. Card (49GAION Operating Protocol §3)

The card declares what this AIOC receives, what it delivers, and in what format; it is the card of 49GAION Operating Protocol §3 (Protocol §4 is the Work Item). It is the only card for this AIOC; the protocol AIOC's map reads it from here. It follows spec/schemas/unit-card.schema.json in 49g-holding/49GAION-protocol.

card:
  unit_kind: "AIOC"
  code: "<code>"
  parent: "<code of the holding unit, or none>"
  inner_units: ["<code>"]                 # by link; empty if none
  type: "<foundational | structural | specialised | connector | other>"   # required; if other, add type_description
  org_aion: "<[ORG]AION>"
  card_version: "<vN.N.N>"
  input_door: "Chief of Staff"            # always; the AIOC's voice to its HOAC seat (input arrives only through the typed ports and the Input socket)
  wake: { method: "queue", verified: false }   # runtime woken from its queue
  receives:
    - kind: "<a kind of work>"
      format: "<format>"
      acceptance_test: "<test ID and version>"
      decision_needed: false
  delivers:
    - kind: "<a kind of output>"
      format: "<format>"
      usual_receivers: ["<AIOC>"]
  anatomy:
    panel: { health: { tests: true, metrics: ["stuck", "returned", "late"] } }
    back_office: { converses_with_humans: true, hosts: ["Chief of Staff", "Office"], protocol_traffic: true }
    definition: { location: "<repository and path of this file>", version: "<commit or version>" }
    delivery: { rollback: "one-click" }
    connectors:
      - { role: "<tool role, e.g. task tracking>", connector: "<connector id>", access_managed_in: "panel" }   # the Panel shows and requests it; the grant is signed at the tool gateway as connect-external-port (49GAION/DR-0019)
    gateway: { metering_id: "<per-AIOC metering id on the shared AI gateway>" }
  # With the keys below, the card carries every key the unit card schema requires (spec/schemas/unit-card.schema.json).
  full_name: "<Full name>"
  version: "<N.N.N>"
  lineage: { id: "<code it derives from>", version: "<N.N.N>", relation: "<original | derived | merged | split>" }
  lifecycle_state: "<proposed | designed | built | joined | live | replaced | retired>"   # a state before joined: see Joining the protocol, below
  blueprint_version: "<vN.N.N>"
  template_version: "<vN.N.N>"
  accountable_to: "<code of the human Cell carrying a HOAC label that this AIOC answers to>"   # Standard §1.7, item 12
  top_cell: "<code of exactly one Cell whose parent is this AIOC>"                            # Standard §1.7, item 11
  hoac: "<[ORG]HOAC-ACS | [ORG]HOAC-TM | [ORG]HOAC-GOV>"   # omit if none; with it, label_holder (decision_rule withdrawn, DR-0049)
  label_holder: "<code of the human Cell, inside this AIOC, that holds the label>"
  fixed_test: { id: "<test ID>", version: "<vN>", owner: "<code of the human Cell that owns the test>" }
  skills:
    - { id: "<skill-id>", name: "<skill name>", tags: ["<tag>"] }
  ports:                                  # one input and one output of each kind, plus exactly one stop door (Standard §6.1)
    - { unit: "<code>", port: "ai-in", direction: "input", type: "AI", identification: "technical-key", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "ai-out", direction: "output", type: "AI", identification: "technical-key", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "hu-in", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "hu-out", direction: "output", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "stop", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["stop"], authority_limit: "stop only", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit", stop_door: true }
  configuration:                          # §15; every slot filled, each with who set it, when and in which version
    office_accountable_human: { value: "<HOAC seat accountable for OCO>", set_by: "<seat>", date: "<date>", version: "<vN>" }
    central_head: { value: "<OCO of this [ORG]AION>", set_by: "<seat>", date: "<date>", version: "<vN>" }
    discussion_limits: { value: "<limits>", set_by: "<seat>", date: "<date>", version: "<vN>" }
    waiting_deadlines: { value: "<per status>", set_by: "<seat>", date: "<date>", version: "<vN>" }
    bounce_limit: { value: "<number>", set_by: "<seat>", date: "<date>", version: "<vN>" }
    chain_depth: { value: "<number>", set_by: "<seat>", date: "<date>", version: "<vN>" }
    halt_request_priority: { value: "immediate", set_by: "<seat>", date: "<date>", version: "<vN>" }
    budget_cap: { value: "<amount per period>", set_by: "<seat>", date: "<date>", version: "<vN>" }
    unattended_action: "<read-record-triage | act-within-limits>"

Joining the protocol. This AIOC joins the 49GAION Operating Protocol only after every input and output claimed on this card passes fixed samples. A claim that fails is removed from the card. Until then the card's lifecycle_state is a state before joined, and no Work Item is routed to it.

2. Organisation table and placement

2.1 Organisation table

The design uses general terms; this table says what each term is in this organisation.

2.2 Placement

• Where it sits: under whom, beside whom.
• Its role: one sentence.
• Scope: what it does; what it does not do.
• Companies it serves: all, or which.
• Boundaries with other AIOCs: each boundary, and who holds what on the other side.
• Overlap: each overlap with an existing AIOC and how it is resolved.

3. Positions

Every AIOC, Pod and Cell has one accountable [ORG]HOAC-ACS seat: it answers along accountable_to to the nearest HOAC above it, and the seat is that HOAC's, a human position (Standard §4.1, §4.2, item 6). Who holds it is never written here: it is the organisation's own mechanism, outside the system (DR-0049).

"Run today by" records only whether an AI agent or a human position runs it; who holds a human position is the organisation's own mechanism, outside the system and outside the Blueprint. A deputy of a human position is the organisation's own too (DR-0049). Two positions are two parties, and the Blueprint never counts or compares the persons behind positions (Standard §1.1, item 10).

Each position's role pack (job description, responsibilities, limits, permissions, checklists, KPIs, coverage, handover, first week) is carried in the role cards of the capabilities it performs.

4. Standard capabilities

Every AIOC has these: Chief of Staff, Input socket and Panel, and an Office where a position needs more than one Chief of Staff. Their default definitions are in docs/STANDARD-CAPABILITIES.md (49GAION level). Write "default" in a part to adopt the default text unchanged, or write this AIOC's own text and list the difference in §11.

4.1 Office

Definition

<default | this AIOC's text> · form: <single Chief of Staff | Office of several Chiefs of Staff>

Process (SOP)

<default | this AIOC's text>

Role card

<one card per Chief of Staff in the Office, Annex A.3 fields>

Fixed test

<test ID and version> · result NOT_RUN

4.2 Chief of Staff

Definition

<default | this AIOC's text> · it is this AIOC's voice to its HOAC seat; input arrives only through the typed ports and the Input socket

Process (SOP)

<default | this AIOC's text>

Role card

<Annex A.3 fields>

Fixed test

<test ID and version> · result NOT_RUN

4.3 Input socket

Definition

<default | this AIOC's text> · this AIOC's standard format: <format>

Process (SOP)

<default | this AIOC's text> · converters: <one per input type, each with its test>

Role card

<Annex A.3 fields>

Fixed test

<one test per converter + the shared mechanism test> · result NOT_RUN

4.4 Panel

Definition

<default | this AIOC's text>

Process (SOP)

<default | this AIOC's text>

Role card

<Annex A.3 fields>

Fixed test

<test ID and version> · result NOT_RUN

5. Functional capabilities

One block per function the AIOC performs. Use the four-part capability form (Annex A). Name each capability by a plain English name, with no code.

The stages, for an AIOC whose work runs in stages. Before the capabilities, a table 5.0 The stages: input, output, done-test, one row per stage: its ID, plain name, run state, gate, exact input, exact output, done-test and the human decision it needs. Each stage has one input, one output and one done-test, and each capability's Done when row (Annex A.1) names the gate it closes. A design stage of the Library (the Protocol section The design chain) also states there its release notice to the next stage and how it carries each return to an end.

Sources: DR-0019.

5.N <Capability name>

Definition

Process (SOP)

Role card

Fixed test

6. Coordination and routes

• Whom it works with, and the route to each: always through the 49GAION Operating Protocol (one Work Item per hand-off; this AIOC's Chief of Staff as its door).
• Routing rows this AIOC contributes to the routing table of its [ORG]AION.
• Requests and objections. Owners do not design or change this AIOC's AIs: every proposal, correction or critique is a design-proposal Work Item to OCO; where they disagree, the [ORG]HOAC-ACS seat may hold the objection open until it reaches the HOAC seat accountable for OCO, which decides.

7. Records and where things live

8. Tools and the shared AI gateway

All model calls go through the shared AI gateway: the tool gateway in the [ORG]AION, with keys, cost and logs in one place; 49GAION runs no gateway for an [ORG]AION (Standard §4.4, item 11).

Connectors and metering. Each tool is reached through a swappable connector, recorded by tool role; access is granted and withdrawn in the Panel. This AIOC's AI usage and cost are metered separately on the shared AI gateway; its budget cap is set in §15. A new tool enters only by a sourced proposal, a side-by-side test against the current tool and an update of the part's card.

Mechanism register (GOV, 14 October 2026). Every mechanism this AIOC uses, one row each. A row is never deleted, and every change that builds a mechanism cites its row (Standard §3.2).

Reserve (GOV, 14 October 2026). Ideas not adopted, with the reason and a reconsider-when trigger (Standard §2.1).

9. Fixed tests: index, triggers and scores

• Re-run triggers: any change to a model, instructions, this AIOC's card, this blueprint or the 49GAION Operating Protocol re-runs the affected tests automatically; also any change to tools or access, an Input socket converter or the AIOC's standard format, or any shared panel part.
• Evidence levels: MEASURED_IN_BUILD_ENVIRONMENT ranks above OWNER_ATTESTED; only a measured score counts toward widening authority (the owner requests with the score attached; the [ORG]HOAC-ACS seat decides and OCO prepares, checks and carries out).
• Complete only when every capability's test has a visible result.
• The Library's cases. Where the AIOC is made from a Library part, its fixed test keeps the Library part's cases, and where the Library numbers added cases in its own series, this section maps each Library case to the AIOC's own cases that cover it. A Library case with no AIOC case fails the joining test.

Checks that are not fixed tests (GOV, 14 October 2026). Each such check declares how it is placed and when it may block (Standard §3.2). A fixed test and a Human Floor negative test never appear in this table.

• Discriminating evidence. A passing check counts only if it has been shown able to fail on the case it guards, and evidence is written by the runner, never by the worker.

Sources: DR-0019.

10. Build: what is generated from this file

Delivery path: definition change → tests → Panel and Back office update → one-click rollback to the previous commit. Both the Panel and the Back office can be rebuilt from any commit of this file.

11. Exceptions

Anything in which this AIOC differs from the template defaults, and why.

12. Lessons and proposals to the mother

One dated line per lesson, each with the test question it added and whether it was proposed to the mother (written without the organisation's details).

13. For the [ORG]HOAC-ACS seat

What the [ORG]HOAC-ACS seat is asked to decide. Money, people and legal matters are listed here so they are seen.

14. Change log

15. Configuration

49GAION fixes the path; who holds each role is configured here (docs/WHAT-IS-AN-AIOC.md §5). Every slot is filled by this organisation or unit; an AIOC with any empty slot does not pass the joining test (Protocol §11). Each value records who set it, when, and in which version; a changed value records what it replaced.

Configuration added (GOV, 14 October 2026). Each value records who set it, when, and in which version. Where 49GAION offers a default, the slot may keep it.

A load line on the people behind positions, if any, is the organisation's own mechanism and record, outside the system, and is never set in a Blueprint (Standard §1.1, item 10; DR-0049).

16. Type

• Type: <Foundational / Structural / Specialised / Connector / other>, as in §0.
• Why this AIOC exists in this organisation: one sentence (the [ORG]AION decides which AIOCs the organisation has).
• Type-specific test: <test ID and version> · result NOT_RUN.

The Type sets no count limit, no default connections and no mandatory sections. The Panel is a capability (§4.4), not a type.

17. Cells and Pods

The parts inside this AIOC (docs/CELLS-AND-PODS.md). One card per Cell and per Pod, following spec/schemas/unit-card.schema.json in 49g-holding/49GAION-protocol. The role and nature of this AIOC are read from the type of its top Cell.

Position codes only (GOV, 15 October 2026). Every field of a card that points to a human (accountable_to, label_holder, attached_to, a signer's seat, a fixed test's seat) takes a position code only, in the form <[ORG]CELL-INITIALS>, <[ORG]POD-INITIALS> or <[ORG]AIOC-INITIALS>, never a person's name, initials of a person or internal person ID. Who holds a position is the organisation's own mechanism, outside the system (Standard §5.2, Position Principle; DR-0049).

Complete card forms. The blocks below carry every key the unit card schema requires and are the ones a Blueprint fills. A HOAC label sits only on a Cell whose filler kind is human (Standard §4.1, item 11). An attached AI Cell sits in this Blueprint, has this AIOC (or its Pod) as parent, and names the served position's Cell in attached_to.

cell:
  unit_kind: "CELL"
  code: "<[ORG]CELL-INITIALS>"
  full_name: "<Full name>"
  parent: "<code of this AIOC or of its Pod>"
  accountable_to: "<code of the human Cell carrying a HOAC label that this Cell answers to>"
  # hoac: "<[ORG]HOAC-ACS | [ORG]HOAC-TM | [ORG]HOAC-GOV>"   # only on a Cell whose filler_kind is human; omit if none
  # authority_scope: { decision_types: ["<listed type>"], expires: "<YYYY-MM-DD>", authority: "<constituted | delegated>" }   # every Cell carrying a HOAC label (Standard §4.4, item 8)
  # attached_to: "<code of the served position's Cell>"   # only for an attached AI Cell; omit otherwise
  type: "<from the organisation's list>"
  filler_kind: "<human | ai | human-or-ai>"
  card_version: "<vN.N.N>"
  version: "<N.N.N>"
  lineage: { id: "<code it derives from>", version: "<N.N.N>", relation: "<original | derived | merged | split>" }
  lifecycle_state: "<proposed | designed | built | joined | live | replaced | retired>"
  fixed_test: { id: "<test ID>", version: "<vN>", owner: "<code of the human Cell that owns the test>" }
  ports:                                  # one input and one output of each kind, plus exactly one stop door (Standard §6.1)
    - { unit: "<code>", port: "ai-in", direction: "input", type: "AI", identification: "technical-key", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "ai-out", direction: "output", type: "AI", identification: "technical-key", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "hu-in", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "hu-out", direction: "output", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<code>", port: "stop", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["stop"], authority_limit: "stop only", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit", stop_door: true }

A Pod example (a Pod holds Cells only; a Pod with a HOAC label names its label_holder; a board behind a position is the organisation's own, DR-0049):

pod:
  unit_kind: "POD"
  code: "<[ORG]POD-INITIALS>"
  full_name: "<Full name>"
  parent: "<code of this AIOC>"
  accountable_to: "<code of the human Cell carrying a HOAC label that this Pod answers to>"
  type: "<from the organisation's list>"
  inner_units: ["<[ORG]CELL-INITIALS>"]
  hoac: "<[ORG]HOAC-ACS | [ORG]HOAC-TM | [ORG]HOAC-GOV>"   # omit if none
  label_holder: "<code of the human Cell, in this Pod, that holds the label>"
  card_version: "<vN.N.N>"
  version: "<N.N.N>"
  lineage: { id: "<code it derives from>", version: "<N.N.N>", relation: "<original | derived | merged | split>" }
  lifecycle_state: "<proposed | designed | built | joined | live | replaced | retired>"
  fixed_test: { id: "<test ID>", version: "<vN>", owner: "<code of the human Cell that owns the test>" }
  ports:                                  # one input and one output of each kind, plus exactly one stop door (Standard §6.1)
    - { unit: "<[ORG]POD-INITIALS>", port: "ai-in", direction: "input", type: "AI", identification: "technical-key", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<[ORG]POD-INITIALS>", port: "ai-out", direction: "output", type: "AI", identification: "technical-key", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<[ORG]POD-INITIALS>", port: "hu-in", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<[ORG]POD-INITIALS>", port: "hu-out", direction: "output", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["<content>"], authority_limit: "<limit>", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "<[ORG]POD-INITIALS>", port: "stop", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["stop"], authority_limit: "stop only", audit_trail: "<where recorded>", required_tests: ["<test ID and version>"], enforcement: "shared-gateway-outside-unit", stop_door: true }

• A Pod holds Cells only; anything that needs nesting is an AIOC.
• An external service, API or tool is a port on the card of the Cell that receives or sends, never a Cell; an external AI agent acting directly in the work is an AI Cell.

Annex A. The four-part capability form (normative for every capability)

A.1 Definition — must contain

Sources: DR-0019.

A.2 Process (SOP) — must contain

A.3 Role card — must contain

A role card never counts or compares the persons behind positions: two positions are two parties, even when one natural person holds both (Standard §1.1, item 10).

A.4 Fixed test — must contain

A.5 Bot identity card — must contain

Every bot performing a role card has one identity card.

Schema: 49GAION-protocol spec/schemas/bot-identity-card.schema.json.

49GAION AIOC Blueprint Template v2.1.1 · Powered by 49GAION