How another system delegates governance without merging into it.

The bundle

byom_governed_work_v1 is the compatibility unit for the kovee seam. It ships as 28 closed record schemas in two slices: the binding, enablement and formation records, and the episode, effect, budget-bridge and driver contracts. Kovee owns every host schema; the shapes byom publishes are the byom-normative side, and the three host-integration operations name the frozen record as their result schema, so the seam cannot fork its own wire.

five of byom's committed transition machines are marked kovee-owned executors. They sit outside byom's one-descriptor-per-mutating-operation rule on purpose: they describe transitions the counterparty drives, and byom commits them so that both sides are reading the same closed machine rather than two prose descriptions of it.

Greenfield enablement: the only owner transition there is

Byom is kovee's governance owner from day one. There is no migration path into byom governance, and after amendment A9 there is no path out and back either: a governed scope is either owned by byom or owned by nothing.

Enablement is a saga with a strict order — create the bindings durably and inertly, then compare-and-set the owner from none to byom at the expected revision. The two steps are separate because the first one must be recoverable without having granted anything.

absent ──governance_enable──▶ bindings_created ──owner_cas_none_to_byom──▶ active
             ▲                     │        │                                │
             │(new epoch)          │(retry: │(governance_enable_rollback)     │(retry: same
             │                     │ same   ▼                                 │ binding)
             └────────────── rolled_back  (pre-CAS only)       governance_disable
                                   pending bindings)                          ▼
                                                                          disabled

Five properties are model-checked in GreenfieldEnablement.tla:

• No scope has two active owners, and no two enablement slots overlap — rejection is the absence of a transition, not a guard that could be relaxed.
• Retry is identical. A repeated command returns the same binding, byte-for-byte, under an exact compare-and-set at the expected revision.
• Rollback is strictly before activation. Once the owner has flipped, there is no rollback path; re-enabling means a fresh saga under a new binding epoch.
• An active epoch is never rolled back, and no activation follows a rollback.
• The owner arm flips exactly at the compare-and-set and survives the freeze.

The allowed actor is a human realm-owner principal only — never a service identity, a session, an assistant or a connector. Kovee may start, configure and bind the daemon, and supply inert context; it is never the genesis governance actor, and the society it enables was bootstrapped through a human's own governance channel.

One governed turn, end to end

The call order below is the achievable one, and it is not negotiable: placement admission binds the exact resource allocation — including its portable digest — so it can only run after the request that creates that allocation. Placement never comes first.

The budget bridge

A hosted turn spends on both sides of the seam, and the invariant is that it can never spend twice. The bridge is an idempotent saga over a stable external reservation key with these committed rules:

• Never above parent, never in parallel. A subordinate reservation may narrow or deny, but never parallel-charge; the charge is bounded by the reservation, which is bounded by the parent's worst case.
• Created once, settled once. At most one counterparty row exists per stable key across a direct commit, a lost reply, and any number of retries. Measured settlement is monotonic and applied once on both sides.
• Resolution is real. The recovery path queries the durable truth. Guessing is not a transition — there is no row for it.
• Uncertain does not expire. An unknown result stays uncertain, and the only way out is a governance reconciliation seat presenting a fresh challenge.

All of these are invariants of SubordinateReservation.tla, checked exhaustively over two keys. Its non-vacuity probes — releasing from uncertain, confirming a query whose hidden truth is "not created", a second counterparty commit — have been run ad hoc rather than in a harness.

Dispatch and outcome admission

When an act reaches out through akson, kovee's driver stages it, consumes akson consent and dispatches. Exactly one signed outcome receipt comes back as a closed union, against one head compare-and-set. Byom admits the effect outcome only from that verified receipt.

The ambiguous arm is the interesting one, and it is the point of separating an act intent from an effect: an unknown non-idempotent outcome is recorded ambiguous and is never retried blindly. It becomes settled only through a governance disposition — and until then the budget hold stays in uncertain, where the conservation identity can still account for it.

Onboarding compute: one shot, never assent

A candidate may need to compute once — to read the offer, to answer — before it is a member of anything. That is a genuinely awkward case, because the authorization has to exist before the host's final context bytes do.

Byom's answer is a one-shot permit with a pinned invariant set: at most one episode, a three-operation allowed set, and general effect and child authority explicitly none. The intent pins the society-authorized exact disclosed context and proposed manifestation; the receipt carries the host's final manifest, disclosure and model digests as presented by the broker. The permit is consumed at most once, and its channel binds the offer and its fence — so a refusal, which advances that fence and revokes unused compute authority in the same compare-and-set, invalidates the workload's own credential.

Completing that compute is evidence, and evidence only. It is never acceptance.

Sender-constrained channels

Each narrow channel binds the record whose authority it carries, so a stolen or copied token has nothing generic to spend. The permit channel binds the exact act intent — an unauthorized act answers decision_incomplete and a spent decision answers stale_revision, never an opaque forbidden. The broker channel binds the compute key. The candidate channel binds the offer and its fence. The workload tokens are minted over the exact (episode, generation) subject, and the narrow trusted-meter token is the only channel whose usage report settles: the worker's own episode-scoped token may file evidence and nothing else.

The amendment record

The v0.2 design text is byte-frozen and digest-pinned. Amendments ride alongside it and override it wherever they conflict, rather than being folded in by editing a pinned artifact. That is deliberate: an amendment record shows what changed, when, and on whose authority, where a silent edit would not.

Two of these are worth reading on their own. A8 is the only rule in the stack that was found by two independent implementations meeting at a live seam rather than by review — a frozen contract could not surface it, because both sides conformed to the contract and the contract was underspecified. Its cross-boundary digest rule is on the encoding page →

A9 is the opposite kind of correction: it removed something. The governance-owner enum carried a third arm naming a discarded predecessor design. No operation ever produced the value, every consumer branched on the other two, and a model invariant asserted the arm was never taken — an invariant over a value no implementation can produce checks nothing, and only makes the model look more thorough than it is. The arm was withdrawn, the cutover machine it existed for was withdrawn with it, and a negative vector now feeds the exact value the old schema accepted, so the narrowing is proven rather than asserted.

Decision records

An ADR records one decision with lasting consequences. It is proposed until merged with maintainer approval, then accepted; superseding requires a new ADR linking both ways.

ADR-0003 carries an erratum. It cites a cargo test invocation naming a crate that has never existed in this workspace, and the same sweep that found that found the larger fact behind it. Both are on the proofs page, stated plainly →