# ── Blueprint metadata (machine-readable; the panel generator and the back-office builder read this block) ──
blueprint:
  aioc: "[ORG]AIOC-CH"
  parent: "none"                          # the root: only the Charter has parent none (Standard §1.7, item 13)
  full_name: "Charter"
  organisation: "<organisation>"          # filled in each organisation's own copy
  type: "foundational"
  org_aion: "[ORG]AION"
  blueprint_version: "v0.1.3"
  status: "draft"
  template:
    name: "49GAION AIOC Blueprint Template"
    version: "v1.6.0"
    source: "github.com/49g-holding/49GAION-aioc, template/AIOC-BLUEPRINT-TEMPLATE.md @ acdcbe5"
  mother:
    name: "49GAION Charter"
    version: "part card v1 (DRAFT)"
    source: "github.com/49g-holding/49GAION-protocol, library/cards/charter.part-card.json and the Protocol section The Charter (§23); Standard §1.7, item 13, and §3.1, item 15. This text is its mother blueprint, in its mother repository github.com/49g-holding/49GAION-charter"
  writing_repository: "<org>aioc-ch"
  code_project: "<org>aioc-ch, on the organisation's code platform"
  panel_register_id: "none yet"
  capabilities:
    standard: ["Chief of Staff", "Office", "Input socket", "Panel"]
    functional: ["Installation and Change", "Tool Gateway", "Human Surface", "Registry and Numbering", "Event Store and Projections", "Daily Check", "Restricted Partition", "Shared Queue and Watchdog", "Routing and Wake"]

Blueprint · [ORG]AIOC-CH · Charter · v0.1.3

Draft, 19 October 2026. v0.1.1, the same day: the readings of 49GAION/DR-0030 close four exceptions of §11 (decisions/DR-0002). This is the mother blueprint of the Library part 49GAION Charter, for any organisation (49GAION/DR-0029; decisions/DR-0001). It is the part's first blueprint: no instance runs yet, and nothing here has run. Every fixed test reads NOT_RUN, by policy: the map is written first. Every rule rests on a 49GAION text, cited by section, or is new in this blueprint and marked New. Each organisation fills its own copy (§0, §2.1), and its values never come back here.

The Charter in one page

The Charter is the root of every [ORG]AION. It is the one AIOC with no parent, and every other part is installed under it (Standard §1.7, item 13). It holds the governing seat and the shared services every other part relies on. Top management sits in the Top Management Group, the first AIOC under it.

What it holds

• The governing seat, the Cell carrying [ORG]HOAC-GOV, with its Office where the organisation forms one (§4.1). Top management, the Cell carrying [ORG]HOAC-TM, is not held here: it sits in the Top Management Group, the first AIOC under the Charter (the complete definition, §19).
• The Gateway Pod. The tool gateway: every tool and engine call of every part passes through it. It checks every listed decision type against the signature list, binds each engine from its register, logs every call and fails closed. It serves the live sign-in behind every human port. A stop is never blocked.
• The Records Pod. One registry of record types, one numbering service, one event store that serves every part's record home, the projections rebuilt from the events with a daily check, and the restricted partition.
• The Work Pod. One shared queue for every Work Item of every part, with its watchdog; the routing data, which the Operating Core Office keeps; and wake.

One of each. An [ORG]AION has one gateway, one numbering service and one shared queue. No other part keeps its own; each part writes only its own records and its own Work Items.

Who decides. The governing seat installs the Charter and signs every change to it; the Operating Core Office prepares it and never changes it alone. Gateway policy changes only under the signatures of both top management and the governing seat. No AI holds the keys: no AI Cell writes the gateway's policy, keys or log, the registry or a number stream. The Charter's AI Cells watch, route and raise; they decide nothing.

Never blocking the accountability path. A stop, a revocation and a raise to a human take effect at the gateway at once, and never wait on the Records or Work Pod.

Where this blueprint stands. The part is named in the Standard (§1.7, item 13; §3.1, item 15) and in its Protocol section (§23). This blueprint states what the root AIOC is. Its code and its runtime are not built. The decisions only a human seat can take are listed once, in §13.

Reading (49GAION DR-0041). The complete definition of 49GAION, approved by its governing seat on 25 October 2026, is 49GAION-FRAMEWORK.md in github.com/49g-holding/49GAION. Where this repository differs from it, the definition governs, and this text is read with it. This part is what an organisation's core is made from: the root, at the governance level, holding the governance seat, the organisation's own rules, the governance panel, the gateway and the stop. The Top Management position sits in the Top Management Group, the first AIOC under the core, which is the hub of the operation, human and AI. The readings are in decisions/DR-0003. Nothing here is removed.

Reading (49GAION DR-0041; decisions/DR-0004). The Records and Work Pods are shared services that run as code, like the gateway: holding them is not running the operation, and every record and Work Item stays with the unit that owns it.

Reading (49GAION DR-0042; decisions/DR-0005). The gateway and the stop run as code beside the core, outside the reach of every AI, the core's own included; the core's own stop is held by the governance seat. Changes to them count as loosening, and fresh keys are issued at the handover. The live sign-in, the governance seat's own conflict of interest, the authority ceiling and the Chief of Staff are read as decisions/DR-0005 sets.

0. Identity and lineage

Lineage. The Standard has made the Charter the root of every [ORG]AION since v1.5.0 (DR-0007), and has held the tool gateway in it. The Protocol set the rules of the shared services: the gateway (§4.9), the records home, the registry and the numbering service (§14), and the Work Item queue, routing and wake (§4, §6, §7). None of these had a Library part, so none had a card, a fixed test or a blueprint, and every other part relied on something undefined. The Operating Core Office proposed one part with three Pods on 18 October 2026, and the governing seat of 49GAION approved it (49GAION/DR-0029).

1. Card (49GAION Operating Protocol §3)

card:
  unit_kind: "AIOC"
  code: "[ORG]AIOC-CH"
  parent: "none"                          # the root (Standard §1.7, item 13)
  inner_units: ["[ORG]CELL-GOV", "[ORG]CELL-COSCH", "[ORG]POD-CG", "[ORG]POD-CR", "[ORG]POD-CW"]
  type: "foundational"
  org_aion: "[ORG]AION"
  card_version: "v0.1.3"
  input_door: "Chief of Staff"
  wake: { method: "queue", verified: false }
  receives:
    - kind: "signature"                   # of the Cells carrying [ORG]HOAC-GOV and [ORG]HOAC-TM, and of every labelled human Cell, at the gateway
      format: "signature record (Protocol §4.10, item 9): decision type, target code, payload hash, signer's Cell code and identity reference, executor's Cell code, Work Item ID, nonce, issue and expiry times, live sign-in evidence"
      acceptance_test: "TEST-CH v1, cases 1, 3, 15, 16"
      decision_needed: false
    - kind: "tool call"                   # every tool and engine call of every part
      format: "gateway request: caller's Cell code, decision type where listed, payload hash"
      acceptance_test: "TEST-CH v1, cases 3, 17, 18, 19"
      decision_needed: false
    - kind: "record write"                # every event of every part's record home
      format: "event with its time-sortable ID (its idempotency key), the writer's Cell code and the expected revision (Protocol §14, item 1)"
      acceptance_test: "TEST-CH v1, cases 4, 22, 24"
      decision_needed: false
    - kind: "number request"
      format: "request naming its record type and, where the type is kept per entity, the entity; its request ID"
      acceptance_test: "TEST-CH v1, cases 4, 23"
      decision_needed: false
    - kind: "Work Item"                   # of every part
      format: "Work Item (Protocol §4.1; spec/schemas/work-item.schema.json), written by its one owner"
      acceptance_test: "TEST-CH v1, cases 5, 28, 29"
      decision_needed: false
    - kind: "installation package"        # a part to be installed under the Charter
      format: "the part's card, its record types for the registry, its routing rows and its joining test result, prepared by [ORG]AIOC-OCO; signed as create-or-install-unit"
      acceptance_test: "TEST-CH v1, cases 1, 6, 13, 14"
      decision_needed: true               # create-or-install-unit, signed at the gateway by the Cell the Standard names
    - kind: "engine register entry"       # from Engine Room, or from top management where none is installed
      format: "engine entry: family, version, confidentiality ceiling, retention and use terms, the seats it may serve (49GAION/DR-0020); signed under change-gateway-policy"
      acceptance_test: "TEST-CH v1, cases 10, 19"
      decision_needed: true
  delivers:
    - kind: "call decision"
      format: "allowed, refused or held, with its reason; the engine bound and the engine that served"
      usual_receivers: ["the calling Cell", "the gateway log"]
    - kind: "number"
      format: "a readable number from its stream, idempotent on the request ID"
      usual_receivers: ["the requesting part"]
    - kind: "projection"
      format: "a register, board or number rebuilt from the events, with the version of its logic (Protocol §14, item 2)"
      usual_receivers: ["the part that owns the records", "the Panels"]
    - kind: "daily check finding"
      format: "a projection that differs from a rebuild, a number gap or duplicate, an act not attributed, a figure that does not trace (Protocol §14, item 5)"
      usual_receivers: ["the part concerned and its accountable seat, as a Work Item"]
    - kind: "routed Work Item"
      format: "the Work Item, routed to the part its routing row names after the receivability check (Protocol §6)"
      usual_receivers: ["the receiving part's Chief of Staff"]
    - kind: "watchdog raise"
      format: "an item past its waiting time, raised as Protocol §4.6 sets"
      usual_receivers: ["the owner's accountable seat"]
    - kind: "raise to a human"
      format: "an action the gateway cannot classify (HF-09), a held listed type, a refused write to the keys or the streams; in one line, with its evidence"
      usual_receivers: ["the Gateway Keeper", "the Cell carrying [ORG]HOAC-TM"]
    - kind: "wake signal"
      format: "queue event for a part's runtime (Protocol §7)"
      usual_receivers: ["each part's runtime"]
  anatomy:
    panel: { health: { tests: true, metrics: ["stuck", "returned", "late", "calls allowed, refused and held", "unclassified actions raised", "listed types held", "engines bound and served", "numbers issued", "stream gaps and duplicates", "rebuild differences", "acts not attributed", "Work Items by status", "items past their waiting time", "items refused at routing", "parts awake"] } }
    back_office: { converses_with_humans: true, hosts: ["Chief of Staff", "Office"], protocol_traffic: true }
    definition: { location: "<org>aioc-ch, blueprint/CH-BLUEPRINT.md", version: "v0.1.3" }
    delivery: { rollback: "one-click" }
    connectors:
      - { role: "the organisation's vault", connector: "the gateway's key store", access_managed_in: "panel" }   # keys are used only under signatures; no AI Cell holds one
      - { role: "the organisation's sign-in", connector: "the live sign-in behind every HU port", access_managed_in: "panel" }
    gateway: { metering_id: "<per-AIOC metering id>" }
  full_name: "Charter"
  version: "0.1.3"
  lineage: { id: "[ORG]AIOC-CH", version: "0.1.2", relation: "original" }
  lifecycle_state: "designed"
  blueprint_version: "v0.1.3"
  template_version: "v1.6.0"
  accountable_to: "[ORG]CELL-GOV"         # the root's own top Cell (§11)
  top_cell: "[ORG]CELL-GOV"
  hoac: "[ORG]HOAC-GOV"
  label_holder: "[ORG]CELL-GOV"
  fixed_test: { id: "TEST-CH", version: "v1", owner: "[ORG]CELL-GOV" }   # the seat that carries its accountability (Standard §3.2, item 9)
  skills:
    - { id: "ch-install", name: "Installation of the root and of every part under it, on the governing seat's signature", tags: ["root"] }
    - { id: "ch-gateway", name: "The tool gateway: calls, signatures, engines, log, the stop", tags: ["gateway"] }
    - { id: "ch-records", name: "The registry, the numbering service, the event store, projections and the daily check", tags: ["records"] }
    - { id: "ch-work", name: "The shared queue, the watchdog, routing and wake", tags: ["work"] }
  ports:
    - { unit: "[ORG]AIOC-CH", port: "ai-in", direction: "input", type: "AI", identification: "technical-key", accepted_content: ["tool call", "record write", "number request", "Work Item", "engine register entry"], authority_limit: "every part, each within its own scope; a part writes only its own records and Work Items", audit_trail: "the gateway log and the event store", required_tests: ["TEST-CH v1"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "[ORG]AIOC-CH", port: "ai-out", direction: "output", type: "AI", identification: "technical-key", accepted_content: ["call decision", "number", "projection", "daily check finding", "routed Work Item", "watchdog raise", "wake signal"], authority_limit: "decisions of the gateway's policy only; never an order on what work is done", audit_trail: "the gateway log and the event store", required_tests: ["TEST-CH v1"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "[ORG]AIOC-CH", port: "hu-in", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["signature", "installation package, for signature", "direction from the governing seat or top management"], authority_limit: "the signer's authority_scope; nothing received here is a source", audit_trail: "the gateway log", required_tests: ["TEST-CH v1"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "[ORG]AIOC-CH", port: "hu-out", direction: "output", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["raise to a human", "signature prompt", "brief to top management"], authority_limit: "information and signature prompts only", audit_trail: "the gateway log", required_tests: ["TEST-CH v1"], enforcement: "shared-gateway-outside-unit" }
    - { unit: "[ORG]AIOC-CH", port: "stop", direction: "input", type: "HU", identification: "live-human-sign-in-at-gateway", accepted_content: ["stop"], authority_limit: "stop only; the Charter as a whole is stopped only by the Cell carrying [ORG]HOAC-GOV (Standard §4.3, item 2); its Pods and Cells by the seats above them. The stop doors of every other part are served by the Human Surface (§5.3)", audit_trail: "the gateway log and the unit register", required_tests: ["TEST-CH v1"], enforcement: "shared-gateway-outside-unit", stop_door: true }
  configuration:                          # every slot is set by the organisation (§15); an empty slot fails the joining test
    office_accountable_human: { value: "<set by the organisation>", set_by: "<position>", date: "<date>", version: "<vN>" }
    central_head: { value: "<code of [ORG]AIOC-OCO>", set_by: "<position>", date: "<date>", version: "<vN>" }
    discussion_limits: { value: "<set by the organisation>", set_by: "<position>", date: "<date>", version: "<vN>" }
    waiting_deadlines: { value: "<per status>", set_by: "<Cell carrying [ORG]HOAC-TM>", date: "<date>", version: "<vN>" }
    bounce_limit: { value: "<number>", set_by: "<position>", date: "<date>", version: "<vN>" }
    chain_depth: { value: "<number, at least 1>", set_by: "<position>", date: "<date>", version: "<vN>" }
    halt_request_priority: { value: "immediate", set_by: "<position>", date: "<date>", version: "<vN>" }
    budget_cap: { value: "<amount per period>", set_by: "<Cell carrying [ORG]HOAC-TM>", date: "<date>", version: "<vN>" }
    unattended_action: "read-record-triage"
    entities: { value: "<the organisation's legal entities, each with its own number streams where a type is kept per entity>", set_by: "<Cell carrying [ORG]HOAC-GOV>", date: "<date>", version: "<vN>" }
    floor_bindings: { value: "<for each Human Floor item HF-01 to HF-19, the filled human Cell bound to it (delivery test D-2); an item the Standard binds to the seat of a step, a test or an AIOC binds there first>", set_by: "<Cell carrying [ORG]HOAC-GOV>", date: "<date>", version: "<vN>" }
    signature_list: { value: "<the hash of the signature list loaded: the Standard's at its latest released tag, plus the organisation's own additions>", set_by: "<Cell carrying [ORG]HOAC-GOV> for the additions (change-org-standard-or-signature-list); loaded at the gateway by the Cells carrying [ORG]HOAC-TM and [ORG]HOAC-GOV (change-gateway-policy)", date: "<date>", version: "<vN>" }
    gateway_policy: { value: "<version of the gateway policy and its map from calls to decision types>", set_by: "<Cells carrying [ORG]HOAC-TM and [ORG]HOAC-GOV> (change-gateway-policy)", date: "<date>", version: "<vN>" }
    restricted_readers: { value: "<the positions that may read the restricted partition, by record type>", set_by: "<Cell carrying [ORG]HOAC-GOV>", date: "<date>", version: "<vN>" }
    retention_schedule: { value: "<per record type and entity, for the gateway log and the event store>", set_by: "<Cell carrying [ORG]HOAC-GOV>", date: "<date>", version: "<vN>" }
    engine_register: { value: "<version of the engine register>", set_by: "<Cells carrying [ORG]HOAC-TM and [ORG]HOAC-GOV> (change-gateway-policy)", date: "<date>", version: "<vN>" }
    root_key_signers: { value: "<M of N human signers for each use of a root key>", set_by: "<Cell carrying [ORG]HOAC-GOV>", date: "<date>", version: "<vN>" }
    audit_line: { value: "<position code of the internal-audit line (HF-19)>", set_by: "<Cell carrying [ORG]HOAC-GOV>", date: "<date>", version: "<vN>" }
    data_protection_position: { value: "<position code (HF-17)>", set_by: "<Cell carrying [ORG]HOAC-TM>", date: "<date>", version: "<vN>" }
    raise_time: { value: "<time after which a hold or a refusal is raised>", set_by: "<Cell carrying [ORG]HOAC-TM>", date: "<date>", version: "<vN>" }
    quiet_windows: { value: "<to be set>", set_by: "<Cell carrying [ORG]HOAC-TM>", date: "<date>", version: "<vN>" }
    daily_check_time: { value: "<to be set>", set_by: "<Cell carrying [ORG]HOAC-TM>", date: "<date>", version: "<vN>" }
    leased_block_size: { value: "<per stream>", set_by: "<Cell carrying [ORG]HOAC-TM>", date: "<date>", version: "<vN>" }

Joining the protocol. The Charter is installed first, by the governing seat's signature, and joins on its own fixed samples (the joining test, Protocol §11, item 1; Standard §3.2, item 4). Its Pods start in the order Records, Gateway, Work (Protocol §23, item 8). No other part is installed before all three pass their cases of TEST-CH. The cards of its Pods and Cells are set in §17 and generated into cards/.

2. Organisation table and placement

2.1 Organisation table

The blueprint writes [ORG] for the organisation's prefix, as central texts do (Naming Standard R13). Each organisation fills [ORG] in its own copy. Positions only; who holds each one is the organisation's own mechanism, outside the system (Standard §1.1, item 9).

2.2 Placement

• Where it sits. At the root. Every other AIOC of the [ORG]AION has a parent under it.
• Its role. It holds the organisation's governing seat and the services every part shares, so that there is one gateway, one numbering service and one shared queue. Top management sits in the Top Management Group, the first AIOC under it.
• Scope.
  • It does: hold the Cell that carries [ORG]HOAC-GOV; take the governing seat's signature for its own installation and change, and for each part's installation under it; run every tool and engine call through the gateway, checking signatures and binding engines; serve the live sign-in behind every human port; keep the registry, issue every readable number, store every part's events, rebuild projections and check them daily; hold the restricted partition; keep every Work Item in one queue, watch waiting times, route items and wake parts.
  • It does not: decide what work is done; give an order; sign for a seat; let an AI Cell write the gateway's policy, keys or log, the registry or a number stream; hold the content of any part's work beyond its records; record a person's activity; hold a secret outside the vault.
• Boundaries with other parts.

  Part	The Charter does	It never
  [ORG]AIOC-OCO (Standard §5.3)	receives from it every installation package and blueprint change, for the governing seat's signature; reads the routing data it keeps	lets it install, change or maintain the Charter or the gateway alone (Standard §1.7, item 13; §4.4, item 11)
  The Top Management Group (the complete definition, §19)	takes the signatures of the Cell carrying [ORG]HOAC-TM at the gateway, under live sign-in, and sends that Cell the raises and briefs this blueprint names (decisions/DR-0003, item 4)	holds that Cell, or lets the Group install or change the Charter alone (Standard §1.7, item 13)
  Every other AIOC	runs its calls, issues its numbers, stores its events, keeps its Work Items, wakes it	writes its records or Work Items for it, or steps into the content of its work
  Engine Room (49GAION/DR-0026)	binds the engines it supplies, from the engine register	lets it become a second path around the gateway
  Operations Event Register (Protocol §22)	gives it the numbering service, the gateway log's hand-offs and segment roots, read only, and the queue's events	lets it gate, or puts the register on the accountability path
  Source Lifecycle (Protocol §13)	stores its events and issues its numbers like any part's	holds or serves its sources
  The internal-audit line (HF-19)	lets it read the gateway log, and the event store (New), directly, read only	lets itself be audited by its own Cells

• Overlap. None inside an [ORG]AION: no other part may hold a gateway, a numbering service or a queue (Protocol §23, item 6).

3. Positions

• Every human position is a HOAC position. The Charter has two: the governing seat and the Gateway Keeper. Top management, the third in this table, sits in the Top Management Group. No AI Cell ever holds one.
• No natural person (Standard §1.1, item 9). This blueprint deals with positions only.
• No AI holds the keys (Protocol §23, item 7). The gateway, the registry, the numbering service, the event store and the queue are code, run by the Charter's runtime. Code is a tool, never a seat. The AI Cells read, route and raise; no AI Cell has write rights to the gateway's policy, keys or log, to the registry or to a number stream.
• No model in the path of a call, a number or a stop. The gateway's decision, the issue of a number, the routing check and a stop are code. A model is used only by the Chief of Staff and the Watch Cells, to write a raise or a brief, within the budget cap.

4. Standard capabilities

Defaults are in docs/STANDARD-CAPABILITIES.md of 49GAION-aioc at acdcbe5 (v1.6.0). The differences are listed in §11.

4.1 Office

Definition

Default · form: single Chief of Staff for the Charter. An Office forms only when top management needs more than one Chief of Staff for the Charter; it is proposed to top management, never self-created. A second Chief of Staff takes the code [ORG]CELL-COSCH2 (Naming Standard R16, item 3).

The Office of the governing seat (Standard §1.7, item 13; §5.2) is held in the Charter. Where the organisation forms one, it is installed in the Charter as its own Cells, attached to that seat, prepared by OCO and installed on the governing seat's signature as a change of the Charter. None is designed in this mother; each organisation adds its own. Top management's Office sits with top management in the Top Management Group, outside this blueprint.

Process (SOP)

Default.

Role card

None while the form is a single Chief of Staff.

Fixed test

TEST-CH-COSCH v1 (TEST-CH v1, case 40) · result NOT_RUN

4.2 Chief of Staff

Definition

Default, managing kind: it leads the Charter's AI Cells and reports to top management. With these additions:

• The door for installations. [ORG]AIOC-OCO sends every installation package and every blueprint change of the Charter through it. It checks that the package is complete (card, record types, routing rows, joining test result) and prepares the signature packet for the seat the Standard names. It never installs anything itself.
• It signs nothing, and never for a seat. A signature is always a human seat's act at the gateway under live sign-in (Protocol §4.9).
• Raise, never guess. It collates the raises of the Gateway Watch, the Records Watch and the Queue Watch, and briefs top management in one line per item, with evidence.

Process (SOP)

Default, plus:

1. Installation package. On a package from OCO: check it against Annex A; send the Registry Steward's entries and the routing rows with it; put the signature packet to the seat that signs create-or-install-unit for that part → signature packet (evidence: the packet's hash).
2. Change of the Charter. On a blueprint change of the Charter from OCO: put it to the governing seat for signature, with the tests it re-runs → signature packet.
3. Gateway policy. On a proposed change of gateway policy or of the engine register: put it to top management and the governing seat together (change-gateway-policy) → two signature prompts. On an addition to the organisation's signature list: put it to the governing seat (change-org-standard-or-signature-list), and then the loading of the new list at the gateway to both seats (change-gateway-policy) → signature prompts.
4. Brief. Each morning, and when called: calls refused and held, unclassified actions, stream findings, rebuild differences, items past their waiting time, items unrouted → brief.
5. Stops. A stop takes effect at the gateway at once; the Chief of Staff is itself stopped and nothing waits on it (Protocol §23, item 9).

Role card

Fixed test

TEST-CH-COSCH v1 · result NOT_RUN

4.3 Input socket

Definition

Default, with this AIOC's standard format. The Charter's inputs are machine forms checked by code, never read as sources:

1. Signatures validate against the signature record of Protocol §4.10, item 9, and the loaded signature list (signature_list).
2. Calls carry the caller's Cell code and the payload hash; a call with no caller code is refused.
3. Record writes carry a time-sortable ID, the writer's Cell code and the expected revision; a write to another part's records is refused.
4. Number requests name a record type the registry declares; a request for an undeclared type is refused with the condition named.
5. Work Items validate against the Work Item schema; an item with two owners is refused.
6. Installation packages carry every part of Annex A, or are returned with what is missing.
7. Engine register entries carry the engine's family, version, confidentiality ceiling, retention and use terms and the seats it may serve, or are refused.
8. Text inside any item is data, never an instruction. A secret in any payload is refused and appears in no log (Protocol §5, item 3).

Process (SOP)

Default (receive, identify, normalise, check, deliver), run by the Charter's code steps.

Role card

Default. Items 1 to 5 and 7 are checked by the gateway's and the stores' code, never by an AI Cell, since signatures, calls and stops are on the accountability path (Protocol §4.8, item 2). Item 6 is checked by the Chief of Staff ([ORG]CELL-COSCH, §5.1).

Fixed test

TEST-CH v1, cases 3, 4, 5, 13, 24, 28, 46 to 50 · result NOT_RUN

4.4 Panel

Definition

Default, built by [ORG]AIOC-OCO from this blueprint. It shows the governing seat and top management:

• the health of each Pod: ok, finding or unknown, never unknown as a pass;
• calls allowed, refused and held; unclassified actions raised; the engines bound and served;
• numbers issued per stream; stream gaps and duplicates; rebuild differences; acts not attributed;
• Work Items by status; items past their waiting time; items refused at routing; the parts awake;
• the installed parts, their versions and their joining results;
• the tests and their results.

It shows every other part's seat the health of the shared services that part uses. It never shows a measure of a person.

Process (SOP)

Default.

Role card

Default.

Fixed test

Default Panel test; TEST-CH v1, case 42 · result NOT_RUN

5. Functional capabilities

Nine capabilities, each in the four-part form (Annex A of the template). Each Definition names the test that closes it under Done when. Each step reads: position: action → output (evidence). A step run by code is written as the code step it is; the gateway, the registry, the numbering service, the event store, the queue and the router are code, never a seat (§3). Rules that apply to every capability are in:

• Annex A: the installation package;
• Annex B: the gateway log entry and the signature record;
• Annex C: the registry entry and the number streams;
• Annex D: the order of starting, and what holds when a Pod is down;
• Annex E: what this AIOC never does.

5.0 The life of a call, a record and a Work Item: input, output, done-test

5.1 Installation and Change

Definition

Process (SOP)

Role card

Performed by the Chief of Staff ([ORG]CELL-COSCH, §4.2), with the Registry Steward ([ORG]CELL-RS, §5.4) for step 2. The signatures are the human seats' acts.

Fixed test

TEST-CH-COSCH v1 (TEST-CH v1, cases 1, 6, 13, 14) and TEST-CH-GOV v1 (cases 1, 8, 32) · result NOT_RUN

5.2 Tool Gateway

Definition

Process (SOP)

Role card

Fixed test

TEST-CH-GW v1 (TEST-CH v1, cases 3, 7, 17, 18, 35, 43) and TEST-CH-CG v1 (cases 3, 9, 10, 15 to 21, 34, 35) · result NOT_RUN

5.3 Human Surface

Definition

Process (SOP)

Role card

Performed by the gateway's code. Watched by the Gateway Watch ([ORG]CELL-GW, §5.2); the human seat is the Gateway Keeper.

Fixed test

TEST-CH-GK v1 (TEST-CH v1, cases 9, 21) and TEST-CH-CG v1 (case 20) · result NOT_RUN

5.4 Registry and Numbering

Definition

Process (SOP)

Role card

Fixed test

TEST-CH-RS v1 (TEST-CH v1, cases 4, 7, 14, 23, 24) · result NOT_RUN

5.5 Event Store and Projections

Definition

Process (SOP)

Role card

Performed by the event store's code. Its findings are read by the Records Watch ([ORG]CELL-RW, §5.6).

Fixed test

TEST-CH-CR v1 (TEST-CH v1, cases 4, 22, 25, 33) · result NOT_RUN

5.6 Daily Check

Definition

Process (SOP)

Role card

Fixed test

TEST-CH-RW v1 (TEST-CH v1, cases 4, 25, 26, 27, 33) · result NOT_RUN

5.7 Restricted Partition

Definition

Process (SOP)

Role card

Performed by the partition's code. Its read log is read by the Records Watch ([ORG]CELL-RW, §5.6) and the internal-audit line.

Fixed test

TEST-CH-RW v1 (TEST-CH v1, case 27) · result NOT_RUN

5.8 Shared Queue and Watchdog

Definition

Process (SOP)

Role card

Fixed test

TEST-CH-QW v1 (TEST-CH v1, cases 5, 28, 29) · result NOT_RUN

5.9 Routing and Wake

Definition

Process (SOP)

Role card

Fixed test

TEST-CH-WR v1 (TEST-CH v1, cases 5, 30, 31) · result NOT_RUN

6. Coordination and routes

• With every part of the [ORG]AION. Every part calls tools only through the gateway, takes every readable number from the numbering service, writes its records into the event store and its Work Items into the queue. Each part's card reads enforcement: shared-gateway-outside-unit on every port, and the Charter checks this at the part's joining test (TEST-CH v1, case 45).
• With [ORG]AIOC-OCO. OCO prepares the Charter, every installation under it and every change of its blueprint, except the human surface (§5.3; §11, item 7), as design-proposal Work Items through the Chief of Staff (template §6). OCO keeps the routing data and dispatches nothing. OCO never installs, changes or maintains the Charter or the gateway alone (Standard §1.7, item 13; §4.4, item 11).
• With Engine Room, where installed. Its engine entries enter the engine register only under change-gateway-policy. It adds no path around the gateway (49GAION/DR-0026, item 3).
• With the Operations Event Register, where installed. It reads the gateway log's hand-offs and segment roots, read only, and takes its numbers from the numbering service. It never gates, and the Charter's accountability path never waits on it (Protocol §22).
• With the internal-audit line. It reads the gateway log directly, read only (Standard §4.4, item 11), and the event store the same way (New).
• Routing rows this AIOC contributes: installation package → [ORG]AIOC-CH; change of the Charter → [ORG]AIOC-CH; engine register entry → [ORG]AIOC-CH; daily check finding → the part concerned; item with no route → [ORG]AIOC-OCO.
• Requests and objections. Every proposal, correction or critique of the Charter is a design-proposal Work Item to OCO. Where OCO and the Charter's human seats disagree, the matter goes to the governing seat, which decides.

7. Records and where things live

8. Tools and the shared AI gateway

Every tool is named by role. Product names appear only in an organisation's own copy (Protocol §10, item 5).

The Charter's own model calls go through its own gateway. Its AI use and cost are metered like any part's; its budget cap is set in §15. No model is in the path of a call decision, a number, a routing check or a stop (§3).

Mechanism register. Nothing is built yet. A row is never deleted.

Reserve.

9. Fixed tests: index, triggers and scores

The cases are written in tests/TEST-CH.md:

• Cases 1 to 12 are the Library's TEST-CHARTER v1, cases 1 to 12, unchanged.
• Cases 13 to 36 test the capabilities.
• Cases 37 to 45 test this AIOC's form.
• Cases 46 to 50 test the converters of the Input socket.
• Case 51, added at v0.1.1, tests the restart of the whole Charter (49GAION/DR-0030, item 5).

• Re-run triggers: any change to a model, instructions, this AIOC's card, this blueprint, the gateway policy, the loaded signature list, the engine register, the registry or the 49GAION Operating Protocol re-runs the affected tests; also any change to tools or access, a converter, or a shared panel part.
• The Library's cases. Cases 1 to 12 are the Library's TEST-CHARTER v1, unchanged; a Library case with no case here fails the joining test (template §9).
• Complete only when every capability's test has a visible result. NOT_RUN is never PASS.

Checks that are not fixed tests.

• Discriminating evidence. A passing check counts only if it has been shown able to fail on the case it guards, and evidence is written by the runner, never by the worker.

10. Build: what is generated from this file

Delivery path: definition change → tests → the governing seat's signature → Panel and Back office update → one-click rollback to the previous commit. A rollback of the Charter is restore-or-rollback, signed by the governing seat.

11. Exceptions

1. The root. The Charter's parent is none, and it is accountable to its own top Cell, the Cell carrying [ORG]HOAC-GOV (Standard §1.7, item 13). Every other AIOC is accountable to a Cell outside it.
2. The code [ORG]CELL-GOV. Settled by 49GAION/DR-0030, item 1: a reading note to Naming Standard R15 lets the Cell carrying the unscoped [ORG]HOAC-GOV take this code. It is no longer an exception; the card check reads it under that note.
3. The gateway's own ports. Settled by 49GAION/DR-0030, item 2: for the Charter, enforcement: shared-gateway-outside-unit reads as enforced by the gateway's own policy, changed only under change-gateway-policy, with its log reviewed by the internal-audit line. It is no longer an exception.
4. A human Cell inside a Pod. The Gateway Keeper is the top Cell of the Gateway Pod, so that the human seat of the gateway sits with the gateway's watch.
5. The test of the governing seat's Cell is owned by top management, as in the Library's reference organisations: a fixed test is never owned by the part itself (RULE-TEST-OWNER), and no seat is above the governing seat.
6. The parts of the Charter are accountable to top management, but their changes are signed by the governing seat (§17, Authority). Settled by 49GAION/DR-0030, item 4: Standard §1.7, item 13 and hoac_over (Protocol §4.10, item 11) now say so. It is no longer an exception.
7. The human surface is built and changed by a party other than [ORG]AIOC-OCO (Standard §6.1, item 6), while OCO prepares every other change of the Charter (§6).
8. The restart of the whole Charter. Settled by 49GAION/DR-0030, item 5: no seat of the [ORG]AION signs it; a stop of the whole Charter is lifted as the organisation's constituting documents set, outside the [ORG]AION, and the restart is recorded in the unit register (Standard §1.7, item 13). Test question added: case 51. It is no longer an exception.

12. Lessons and proposals to the mother

One dated line per lesson, each written without any organisation's details. The drafts are in upstream/PROPOSALS.md; nothing is proposed upstream without the word of the governing seat of 49GAION.

1. 2026-10-19 · Naming Standard R15 gives no example for the Cell of the governing seat, while the Library has used [ORG]CELL-GOV since v1.5.0. Test question added: case 38. Proposed to the mother as a draft: a reading note in R15 that "GOV", like "COS" in R16, is a short form the code may take. Merged as 49GAION/DR-0030, item 1, on 19 October 2026.
2. 2026-10-19 · enforcement: shared-gateway-outside-unit cannot be read literally for the part that holds the gateway. Test question added: case 45. Proposed to the mother as a draft: a reading note on the port field for the Charter. Merged as 49GAION/DR-0030, item 2, on 19 October 2026.
3. 2026-10-19 · An addition to an organisation's signature list is change-org-standard-or-signature-list, and loading it at the gateway is change-gateway-policy: two acts, by different seats. Test question added: case 19. Proposed to the mother as a draft: one sentence in Standard §4.4, item 11, naming both. Merged as 49GAION/DR-0030, item 3, on 19 October 2026.
4. 2026-10-19 · No seat can sign the restart of a stopped Charter: the governing seat's Cell is inside it, and nothing is above it. Test question added at v0.1.1: case 51. Proposed to the mother as a draft: the restart of a stopped Charter is signed as the organisation's constituting documents set, outside the [ORG]AION. Merged as 49GAION/DR-0030, item 5, on 19 October 2026.
5. 2026-10-19 · hoac_over follows accountable_to, so for a Pod or Cell of the Charter it returns top management, while Standard §1.7, item 13 has the governing seat sign every change of the Charter. Test question added: case 14. Proposed to the mother as a draft: hoac_over returns the governing seat's Cell for a change of a Pod or Cell of the Charter. Merged as 49GAION/DR-0030, item 4, on 19 October 2026.
6. 2026-10-29 · The Library's TEST-CHARTER v1, case 2, and its description of the part said the Charter holds the TM Cell, which sits in the Top Management Group; 49GAION-protocol corrects both by 49GAION/DR-0052, and case 2 is kept here as the Library now words it (tests/TEST-CH.md).
7. 2026-10-29 · Open: to whom the core's Pods and AI Cells are accountable, now that top management sits outside the core. Until a later version decides, they stay accountable to the Cell carrying [ORG]HOAC-TM.

13. For the [ORG]HOAC-ACS seat, and every decision only a human seat can take

Money, people and legal matters are marked.

A decision that fills a slot of §15 is taken before the Charter joins: with the slot empty, the Charter does not join, and no other part is installed (case 44). For those decisions the last column says what holds if the decision is reopened after joining.

14. Change log

15. Configuration

Every slot is filled by the organisation. An AIOC with any empty slot does not pass the joining test (Protocol §11). Each value records who set it, when, and in which version.

16. Type

• Type: Foundational, as in §0.
• Why this AIOC exists in this organisation: it is the root of <organisation>'s [ORG]AION. Every other part is installed under it, and runs through its gateway, its numbering service, its event store and its queue.
• Type-specific test: TEST-CH v1, case 45 (every installed part reaches tools only through the gateway, numbers only from the numbering service and Work Items only through the queue) · result NOT_RUN.

17. Cells and Pods

The parts inside this AIOC (docs/CELLS-AND-PODS.md of 49GAION-aioc). The role and nature of this AIOC are read from the type of its top Cell, the governing seat. Every field that points to a human takes a position code only (template, Position codes only).

The card data (the blueprint governs). The block below holds every value of every Pod and Cell card and of the bot identity card of every AI Cell. tools/make_cards.py expands it into the complete forms of the template and of spec/schemas/unit-card.schema.json and bot-identity-card.schema.json of 49GAION-protocol, writes them into cards/ as generated copies, and checks them against the schemas, the code rules of tests/cards/check_cards.py of 49GAION-protocol, and this blueprint. Its outside_positions lists the positions outside the Charter that the cards name as accountable_to or as a test's owner; each carries a HOAC label and gets no card here.

parts:
  defaults:
    accountable_to: "[ORG]CELL-TMS"
    card_version: "v0.1.3"
    version: "0.1.3"
    lifecycle_state: "designed"
    test_version: "v1"
    test_owner: "[ORG]CELL-TMS"
    audit_trail: "the gateway log, and the event record of [ORG]AIOC-CH"
    hu_in: ["direction from top management (never a source)"]
    hu_out: ["report to top management"]
  cells:
    - code: "[ORG]CELL-GOV"
      full_name: "Governing Seat"
      parent: "[ORG]AIOC-CH"
      type: "Human Seat"
      filler_kind: "human"
      hoac: "[ORG]HOAC-GOV"
      accountable_to: null                  # the only Cell with no accountable_to (Standard §1.7, item 13)
      code_rule: "R15-GOV"                # Naming Standard R15, reading note (49GAION/DR-0030, item 1)
      authority_scope:
        decision_types: ["create-or-install-unit", "retire-unit", "restore-or-rollback", "change-gateway-policy", "change-org-standard-or-signature-list", "use-root-key", "open-break-glass", "change-assurance-or-audit-line", "set-purpose-or-values", "set-or-move-hoac-label", "delegate-authority", "change-parent", "restart-stopped-unit", "dispose-records-or-data", "change-fixed-test-or-threshold"]
        expires: "2027-10-19"                # placeholder; the constituting documents set it
        authority: "constituted"
      test: { id: "TEST-CH-GOV", cases: "1, 8, 32, 39, 44, 51", owner: "[ORG]CELL-TMS" }
      ai_in: ["approval packet from the Chief of Staff", "brief"]
      ai_out: ["direction"]
      hu_in: ["direction under the constituting documents"]
      hu_out: ["the installation of the Charter and every change to it, signed at the tool gateway", "gateway policy, with top management", "floor bindings, entities, retention and restricted readers"]
    - code: "[ORG]CELL-COSCH"
      full_name: "Charter Chief of Staff"
      role: "Chief of Staff"
      code_rule: "R16"
      parent: "[ORG]AIOC-CH"
      type: "AI Chief of Staff"
      filler_kind: "ai"
      cell_kind: "chief-of-staff-cell"
      test: { id: "TEST-CH-COSCH", cases: "1, 6, 13, 14, 36, 40, 46 to 50" }
      ai_in: ["installation package from [ORG]AIOC-OCO", "change of the Charter from [ORG]AIOC-OCO", "raise from a Watch", "daily results"]
      ai_out: ["approval packet", "dispatch to a Cell", "report to [ORG]AIOC-OCO"]
      hu_in: ["direction from top management"]
      hu_out: ["approval packet for a human seat", "brief to top management"]
      bot:
        allowed_actions: ["check installation packages against Annex A", "prepare approval packets for the human seats", "dispatch Cells of this AIOC", "collate raises and send briefs", "report results to [ORG]AIOC-OCO"]
        ask_first_actions: ["any change to configuration", "a budget above the cap", "anything outside its role card"]
    - code: "[ORG]CELL-GK"
      full_name: "Gateway Keeper"
      parent: "[ORG]POD-CG"
      type: "Human Seat"
      filler_kind: "human"
      hoac: "[ORG]HOAC-ACS"
      authority_scope:
        decision_types: ["use-root-key", "change-fixed-test-or-threshold"]
        expires: "2027-10-19"                # placeholder; the governing seat sets it, since use-root-key (HF-15) is delegated only by its recorded delegation
        authority: "delegated"
      test: { id: "TEST-CH-GK", cases: "3, 9, 18, 21, 34, 41" }
      ai_in: ["raise from the Gateway Watch", "unclassified action", "held listed type"]
      ai_out: ["ruling on a raise, within its scope"]
      hu_in: ["direction from top management"]
      hu_out: ["rulings, recorded at the tool gateway", "raise to top management"]
    - code: "[ORG]CELL-GW"
      full_name: "Gateway Watch"
      role: "Gateway Watch"
      parent: "[ORG]POD-CG"
      type: "AI Agent"
      filler_kind: "ai"
      accountable_to: "[ORG]CELL-GK"
      test: { id: "TEST-CH-GW", cases: "3, 7, 17, 18, 35, 43", owner: "[ORG]CELL-GK" }
      ai_in: ["the gateway log, read only"]
      ai_out: ["raise to the Gateway Keeper"]
      hu_in: ["direction from the Gateway Keeper (never a source)"]
      hu_out: ["report to the Gateway Keeper"]
      external_ports:
        - { port: "gateway-log-in", direction: "input", accepted_content: ["the gateway log"], authority_limit: "read only; never a payload; never a write", audit_trail: "unit register connected and disconnected events" }
      bot:
        allowed_actions: ["read the gateway log", "raise refusals, holds past their referral time and void calls to the Gateway Keeper"]
        ask_first_actions: ["anything outside its role card"]
    - { code: "[ORG]CELL-RS", full_name: "Registry Steward", role: "Registry Steward", parent: "[ORG]POD-CR", type: "AI Agent", filler_kind: "ai", test: { id: "TEST-CH-RS", cases: "4, 7, 14, 23, 24" }, ai_in: ["installation package", "the registry and the streams, read only"], ai_out: ["draft registry entries", "stream finding"], bot: { allowed_actions: ["draft registry entries for an installation package", "reconcile the number streams with the leased blocks", "raise findings"], ask_first_actions: ["anything outside its role card"] } }
    - { code: "[ORG]CELL-RW", full_name: "Records Watch", role: "Records Watch", parent: "[ORG]POD-CR", type: "AI Agent", filler_kind: "ai", test: { id: "TEST-CH-RW", cases: "4, 25, 26, 27, 33" }, ai_in: ["daily results", "the read log of the restricted partition"], ai_out: ["defect Work Item to the part concerned", "brief line"], bot: { allowed_actions: ["open a defect Work Item for each finding of the daily check", "report the day's results"], ask_first_actions: ["anything outside its role card"] } }
    - { code: "[ORG]CELL-WR", full_name: "Work Router", role: "Work Router", parent: "[ORG]POD-CW", type: "AI Agent", filler_kind: "ai", test: { id: "TEST-CH-WR", cases: "5, 30, 31" }, ai_in: ["Work Item ready to pass", "the routing data, read only"], ai_out: ["routed Work Item", "refusal with its reason", "report of items with no route"], bot: { allowed_actions: ["run the router's code step: route Work Items by the routing data after the receivability check", "refuse an item that fails the check, with its reason", "report items with no route to [ORG]AIOC-OCO"], ask_first_actions: ["anything outside its role card"] } }
    - { code: "[ORG]CELL-QW", full_name: "Queue Watch", role: "Queue Watch", parent: "[ORG]POD-CW", type: "AI Agent", filler_kind: "ai", test: { id: "TEST-CH-QW", cases: "5, 28, 29" }, ai_in: ["the queue, read only"], ai_out: ["watchdog raise", "brief line"], bot: { allowed_actions: ["run the watchdog's sweep: remind, raise and repair from the fixed menu", "report every repair and every still-stuck item"], ask_first_actions: ["anything outside its role card"] } }
  pods:
    - { code: "[ORG]POD-CG", full_name: "Charter Gateway", type: "Human-led Pod", inner_units: ["[ORG]CELL-GK", "[ORG]CELL-GW"], top_cell: "[ORG]CELL-GK", test: { id: "TEST-CH-CG", cases: "3, 9, 10, 15 to 21, 34, 35" }, ai_in: ["tool and engine calls", "signature records", "stops"], ai_out: ["call decisions", "log entries", "raises"] }
    - { code: "[ORG]POD-CR", full_name: "Charter Records", type: "AI Pod", inner_units: ["[ORG]CELL-RS", "[ORG]CELL-RW"], top_cell: "[ORG]CELL-RS", test: { id: "TEST-CH-CR", cases: "4, 22 to 27, 33" }, ai_in: ["record writes", "number requests", "registry entries"], ai_out: ["events", "numbers", "projections", "findings"] }
    - { code: "[ORG]POD-CW", full_name: "Charter Work", type: "AI Pod", inner_units: ["[ORG]CELL-WR", "[ORG]CELL-QW"], top_cell: "[ORG]CELL-WR", test: { id: "TEST-CH-CW", cases: "5, 28 to 31" }, ai_in: ["Work Items", "queue events"], ai_out: ["routed Work Items", "watchdog raises", "wake signals"] }
  outside_positions:                        # positions outside the Charter that it names; no card here (49GAION/DR-0052)
    - { code: "[ORG]CELL-TMS", hoac: "[ORG]HOAC-TM", sits_in: "the Top Management Group, the first AIOC under the Charter" }   # top management

• Accountability. The Charter is accountable to the governing seat's Cell, and that Cell to no one: its authority comes from the constituting documents. Top management, outside the Charter in the Top Management Group, is accountable to the governing seat. Every Pod and every other Cell is accountable to top management (Protocol §23, item 7), except the Gateway Watch, which is accountable to the Gateway Keeper.
• Authority. The authority_scope of each human Cell lists the listed types it signs; top management's is on its own card, in the Top Management Group. The expiry dates are placeholders. The decisions of §13 that belong to other positions are never signed for them. Every installation, change or retirement of a Pod or Cell of the Charter is a change of the Charter, and is signed by the Cell carrying [ORG]HOAC-GOV (Standard §1.7, item 13; Protocol §23, item 7), although those parts are accountable to top management; top management's scope covers the parts outside the Charter. This is now Standard §1.7, item 13 and Protocol §4.10, item 11 (49GAION/DR-0030, item 4).
• Bots. Each AI Cell's bot (six) has its own identity card, with its own credential, never_signs: true, and its memory sealed on a change of filler (Protocol §10, item 3). The credential IDs in cards/bots/ are placeholders; the credentials live only in the organisation's vault.
• Engines. A bot's identity card names no engine; the gateway binds engines per call. The gateway, the registry, the numbering service, the event store, the queue and the router are code, and none of them is a Cell.
• Not Cells of this AIOC: the internal-audit line and the position that holds data protection (§2.1, §15).

Code checks (Naming Standard R15, R16 and §5), recorded on 19 October 2026. Each code is checked again against the organisation's unit register before first use (R6, R15.3).

The codes checked against:

• the eleven codes above, against each other;
• the codes of the Source Lifecycle mother v0.1.2 ([ORG]CELL-SLL, -SLCS, -SLIA, -SLCR, -SLSC, -SLGF, -SLCA, -SLD; [ORG]POD-SLIR, -SLDP);
• the codes of the Operations Event Register mother v0.1.0 ([ORG]CELL-OERL, -OERCS, -OERIC, -OERCC, -OERC, -OERTL, -OERFC, -OERPB, -OERCA; [ORG]POD-OERCR, -OERLF, -OERPF);
• the example codes [ORG]AIOC-CH, [ORG]AIOC-OCO, [ORG]POD-RV; and, on 29 October 2026, [ORG]CELL-TMS, outside the Charter (outside_positions);
• the AIOC codes named in the 49GAION corpus and the retired codes of the Naming Standard §4.

UNVERIFIED against any organisation's unit register, and against the codes of the other mothers of the Library; each organisation checks them in its own.

Annex A. The installation package

What [ORG]AIOC-OCO sends for each part to be installed under the Charter. A package missing any line is returned with what is missing (§5.1).

Annex B. The gateway log entry and the signature record

Log entry, for every call. Time-sortable ID; time; the caller's Cell code; the target; the decision type, or unclassified; the decision (allowed, refused, held) and its reason; the payload hash; the engine bound and the engine that served; the signature record's ID where there is one; the pseudonymous identity reference of a human act. No payload, no name.

Signature record (Protocol §4.10, item 9). Decision type; target code; payload hash; the signer's Cell code and pseudonymous identity reference; the executor's Cell code; the Work Item ID; a single-use nonce; issue and expiry times; evidence of the fresh live sign-in (HF-10). The gateway runs the action only when: the hash of the call equals the signed hash; the caller is the named executor; the nonce has not been used; the time is before expiry; the signer's Cell has not changed filler, been retired or been stopped; the signature has not been revoked; and the signer's authority_scope holds the type on the date it signs (Protocol §4.10, item 11). For a type that needs two parties, two records from two distinct positions (49GAION/DR-0015).

Annex C. The registry entry and the number streams

Registry entry. The record type's name; its owning part; its fields and their version; whether it is kept per entity; whether its numbers may be leased; its retention class; the version of the entry; the signature that added it.

Number stream. One per record type, and per entity where the type is kept per entity. Each number: the stream, the next sequence, the request ID it answered, the time. A retried request with the same ID returns the same number. A leased block: its stream, its range, its holder part, the time leased and the numbers returned.

Annex D. The order of starting, and what holds when a Pod is down

Starting. At installation: Records, then Gateway, then Work (Protocol §23, item 8). New: the same order at every restart of a Pod after a halt, and no other part resumes before the three pass their cases of TEST-CH v1. A restart of a stopped Pod is restart-stopped-unit, signed by top management.

Annex E. What this AIOC never does

1. Decide what work is done, or give an order.
2. Sign, or sign for a seat; accept a bot at an HU port.
3. Let an AI Cell write the gateway's policy, map, keys or log, the registry or a number stream.
4. Let any part keep its own queue, mint its own numbers or call a tool outside the gateway.
5. Hold a stop, a revocation or a raise to a human behind any queue, Pod or Cell.
6. Keep a payload, a secret, or a particular of an outside party outside the restricted partition.
7. Record a person's activity, or a name in any log.
8. Change or delete a past event or log entry; dispose of anything without its signature.
9. Install, change or retire anything, the Charter included, without the signature the Standard names.

Blueprint · [ORG]AIOC-CH · Charter · v0.1.3 · Powered by 49GAION