Last verified: 28 September 2026

Coordination roles — the substrate's authority surface

Substrate-operator authority is decomposed from the legacy monolithic JWT claim into a closed 16-role ecosystem-coordination-roles catalogue. Each role is entity-agnostic — the catalogue describes the role, never the legal entity bound to it.

The §Y / Rule 24 invariant

Sovern's substrate has no single monolithic owner role. Authority is decomposed into 16 entity-agnostic coordination roles —stewardship, resolution, attestation, identity, compliance, deployment, custody, anchoring, federation, native-expression, frontier-expression, surface, marketplace, treasury, admission, developer — each bound independently to an org and each carrying a closed snake_case capability surface that the substrate enforces at every mutation.

The catalogue uses substrate-canonical Sovern-ubiquitous-language — every role is named with the suffix -operator, never a credential-laden professional term. "Attestation Operator", not "notary". "Resolution Operator", not "arbitrator". "Compliance Operator", not "auditor". A binding may be held by a credentialed professional, but the role itself is substrate-canonical.

The set is closed. Adding another role requires a §Y amendment and a Rule 24 update. A BLOCKING CI guard (guard:ecosystem-vocabulary-canonical) validates the closure on every commit.

The 16 ecosystem coordination roles

For each role, the substrate publishes the closed capability surface (the snake_case action keys the role is authorised to perform), the binding scopes (where a binding may target), the constitutional-floor authority (whether the role can issue substrate-constitutional-floor attestations), and whether the role is "always" essential (substrate refuses to operate without an active binding) or "when-active" essential (required only when an instance of the concern exists).

stewardship-operator — Stewardship Operator

Substrate-canonical coordinator. Holds the constitutional floor: ratifies or refuses a proposed purpose, attests a floor violation, and accepts a deliverable on behalf of the ordering organisation. Names the first steward of a launch expression. Operator-role admission is a separate role. At ecosystem scope: THE substrate coordinator.

Binding scopes: ecosystem, cluster, deployment, org, space

Constitutional-floor authority: full · Essentiality: always

Replacement triggers: voluntary-rotation, competence-failure, floor-violation, dissolution-of-org, coordinator-discretion

Capability surface:

  • ecosystem.stewardship.purpose_ratified
  • ecosystem.stewardship.purpose_refused
  • ecosystem.stewardship.floor_violation_attested
  • ecosystem.stewardship.deliverable_accepted
  • ecosystem.stewardship.steward_established
  • ecosystem.stewardship.seat_requirements_set
  • ecosystem.stewardship.seat_requirements_ratified
  • ecosystem.stewardship.seat_floor_violation_case_opened

resolution-operator — Resolution Operator

Substrate-attested dispute-resolution authority. Issues substrate-attested rulings on disputes that cannot be resolved at the participant or org level. Independence requirement: cannot be a party-of-interest to a dispute being resolved.

Binding scopes: cluster, deployment, environment, org, space

Constitutional-floor authority: full · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, independence-breach, dissolution-of-org

Capability surface:

  • ecosystem.resolution.dispute_opened
  • ecosystem.resolution.ruling_issued
  • ecosystem.resolution.ruling_superseded
  • ecosystem.resolution.cosign_issued
  • ecosystem.resolution.audit_restoration_ratified
  • ecosystem.resolution.backup_verification_ratified
  • ecosystem.resolution.fork_handoff_ratified
  • ecosystem.resolution.grant_snapshot_ratified
  • ecosystem.resolution.seat_case_notice_given
  • ecosystem.resolution.seat_case_ruled
  • ecosystem.resolution.seat_case_final_ruled
  • ecosystem.resolution.seat_licence_suspended
  • ecosystem.resolution.seat_licence_suspension_lifted

attestation-operator — Attestation Operator

Substrate-attested issuer of facts-about-the-world attestations. Includes incorporation attestation (Item 2), identity verification, regulatory-fitness, translation attestation (HH.sub10), and arbitrary substrate-attested facts. Per HH-2, recognises the pre-existing ComplianceEvidenceKind values `i18n-translation-attestation` + `legal-translation-attestation` as part of its capability surface.

Binding scopes: ecosystem, cluster, deployment, org, space

Constitutional-floor authority: partial · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, independence-breach, dissolution-of-org

Capability surface:

  • ecosystem.attestation.fact_attested
  • ecosystem.attestation.incorporation_attested
  • ecosystem.attestation.identity_verified
  • ecosystem.attestation.regulatory_fitness_attested
  • ecosystem.attestation.i18n_translation_attested
  • ecosystem.attestation.legal_translation_attested
  • ecosystem.attestation.attestation_revoked

identity-operator — Identity Operator

Operates substrate identity primitives — coordination-tier subjects (human / ai_agent / proxy) and infrastructure-tier subjects (service_account / system / device per T.sub2 + T.sub9). Manages mandate ratification + proxy delegation + identity revocation cascade. Phase 3a substrate-shape work fills the substantive capability surface.

Binding scopes: cluster, deployment, environment

Constitutional-floor authority: partial · Essentiality: always

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • ecosystem.identity.coordination_subject_admitted
  • ecosystem.identity.coordination_subject_revoked
  • ecosystem.identity.device_subject_registered
  • ecosystem.identity.service_account_provisioned
  • ecosystem.identity.mandate_ratified
  • ecosystem.identity.proxy_delegation_attested
  • ecosystem.identity.access_request_approved
  • ecosystem.identity.access_request_declined

compliance-operator — Compliance Operator

Operates the substrate's compliance + DSR + DPA infrastructure (§GG-managed). UU-ii retargets §GG `emitAttestationBacked()` call-sites in compliance.service.ts + dsr.service.ts to additionally assert this role's binding. Capability surface substantively reuses existing §GG `substrate_operator.compliance.*` action_type strings (C-Y-2).

Binding scopes: cluster, deployment, environment, org, space

Constitutional-floor authority: partial · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, independence-breach, dissolution-of-org

Capability surface:

  • substrate_operator.compliance.posture_transition_ratified
  • substrate_operator.compliance.dsr_resolved
  • substrate_operator.compliance.dpa_instantiated
  • substrate_operator.compliance.evidence_bundle_imported
  • substrate_operator.compliance.framework_binding_attested
  • substrate_operator.compliance.sub_processor_attested
  • substrate_operator.compliance.audit_chain_verified
  • substrate_operator.compliance.audit_chain_attested
  • substrate_operator.compliance.seat_fitness_attested
  • substrate_operator.compliance.seat_breach_case_opened

deployment-operator — Deployment Operator

Operates a specific deployment (DB, application code, DNS, infrastructure). Applies signed-release bundles (§CC); applies signed-license bundles for sovereign-mode deployments. Per-deployment binding (one Deployment Operator per deployment by construction).

Binding scopes: deployment

Constitutional-floor authority: none · Essentiality: always

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • substrate_operator.deployment.release_bundle_applied
  • substrate_operator.deployment.release_bundle_superseded
  • substrate_operator.deployment.license_bundle_applied
  • substrate_operator.deployment.hosting_substrate_configured

custody-operator — Custody Operator

Holds substrate signing keys (cluster signing keys per B.sub1; signed-bundle keys per §CC). Issues key rotations + signed-bundle ceremonies. Substantively distinct from Deployment Operator: Custody Operator SIGNS bundles, Deployment Operator APPLIES bundles. Per C-Y-3, UU-ii retargets release-bundle.service.ts SIGNING call-sites to this role.

Binding scopes: cluster, deployment, org

Constitutional-floor authority: partial · Essentiality: always

Replacement triggers: voluntary-rotation, competence-failure, independence-breach, dissolution-of-org

Capability surface:

  • ecosystem.custody.signing_key_rotated
  • ecosystem.custody.signed_bundle_issued
  • ecosystem.custody.key_compromise_attested
  • ecosystem.custody.key_archived
  • ecosystem.custody.audit_partition_archived
  • ecosystem.custody.backup_bundle_issued
  • ecosystem.custody.fork_handoff_issued
  • ecosystem.custody.fork_trust_anchor_admitted
  • ecosystem.custody.grant_snapshot_issued
  • ecosystem.custody.grant_snapshot_admitted
  • ecosystem.custody.grant_snapshot_trust_anchor_admitted

anchoring-operator — Anchoring Operator

Operates the substrate's integrity-anchor publication ceremony per environment's `chain_adapter` (local / evm / polygon / base / ethereum). Publishes Merkle-root hashes of off-chain audit-event ledger batches. Substrate-attested only — no per-user wallets (anchoring is substrate-internal).

Binding scopes: deployment, environment

Constitutional-floor authority: none · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • ecosystem.anchoring.batch_published
  • ecosystem.anchoring.adapter_configured
  • ecosystem.anchoring.anchor_failure_attested

federation-operator — Federation Operator

Operates federation links between deployments per V.sub1. UU-ii retargets `lib/modules/federation/lifecycle.ts` transition call-sites to additionally assert this role's binding. Capability surface reuses existing `substrate_operator.federation.*` action_type strings (C-Y-2).

Binding scopes: cluster, deployment, environment

Constitutional-floor authority: partial · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • substrate_operator.federation.link_issued
  • substrate_operator.federation.link_acknowledged
  • substrate_operator.federation.link_paused
  • substrate_operator.federation.link_resumed
  • substrate_operator.federation.link_revocation_noticed
  • substrate_operator.federation.link_revoked
  • substrate_operator.federation.deployment_admitted

native-expression-operator — Native-Expression Operator

Stewards the 8-expression native baseline set (business / personal / government / community / commons / place / ngo / workspace). Ratifies substrate-attested version bumps; deprecation requires substrate-attested ceremony (no silent expression deprecation). Per C-Y-4, distinct from Frontier-Expression Operator.

Binding scopes: ecosystem

Constitutional-floor authority: none · Essentiality: always

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • ecosystem.native_expression.version_ratified
  • ecosystem.native_expression.version_deprecated
  • ecosystem.native_expression.composability_attested

frontier-expression-operator — Frontier-Expression Operator

Stewards the 4-expression frontier baseline set at v1 (regulatory-coordination / multi-sovereign-venture / hybrid-institutional / venture-directive). May introduce a frontier expression and may attest that one has matured: status moves from experimental-frontier to active while kind stays frontier-baseline and the file stays under frontier/. Per C-Y-4, distinct from Native-Expression Operator.

Binding scopes: ecosystem

Constitutional-floor authority: none · Essentiality: always

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • ecosystem.frontier_expression.expression_introduced
  • ecosystem.frontier_expression.version_ratified
  • ecosystem.frontier_expression.experimental_attestation_issued
  • ecosystem.frontier_expression.expression_matured
  • ecosystem.frontier_expression.expression_deprecated

surface-operator — Surface Operator

Operates a public marketing surface (per the §II six-surface architecture: Foundation / Digital / Technology / Services / Ventures / Cloud) OR a custom-domain surface per §DD. Ratifies substrate-attested legal documents (ToS / Privacy / DPA per entity); ratifies marketing claims. Each organisation binds this role at org scope for its own site. UU-ii retargets `lib/modules/custom-domains/*` call-sites to additionally assert this role's binding.

Binding scopes: ecosystem, deployment, org

Constitutional-floor authority: none · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • substrate_operator.surface.legal_document_ratified
  • substrate_operator.surface.claim_registered
  • substrate_operator.surface.tld_bound
  • substrate_operator.surface.custom_domain_issued
  • substrate_operator.surface.custom_domain_paused
  • substrate_operator.surface.custom_domain_resumed
  • substrate_operator.surface.custom_domain_revocation_noticed
  • substrate_operator.surface.custom_domain_revocation_withdrawn
  • substrate_operator.surface.custom_domain_revoked
  • substrate_operator.surface.tls_bundle_installed

marketplace-operator — Marketplace Operator

Operates a substrate-attested marketplace per §AA. Curates listings against substrate-attested admission rules (e.g., VDS counterpartyRequirements per SS-12). Issues entitlement-grants. Per-scope binding (per-env or per-org); supports multi-marketplace topologies.

Binding scopes: environment, org

Constitutional-floor authority: none · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, dissolution-of-org

Capability surface:

  • ecosystem.marketplace.listing_admitted
  • ecosystem.marketplace.listing_curated
  • ecosystem.marketplace.listing_removed
  • ecosystem.marketplace.entitlement_grant_issued

treasury-operator — Treasury Operator

Operates substrate-attested pricing flows + collection policies per §BB. UU-ii retargets `lib/modules/kernel/pricing/pricing.service.ts` call-sites to additionally assert this role's binding. Capability surface includes BB.sub11 collection-policy-waiver attestation kind.

Binding scopes: environment, org, space

Constitutional-floor authority: none · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, independence-breach, dissolution-of-org

Capability surface:

  • substrate_operator.treasury.pricing_flow_ratified
  • substrate_operator.treasury.collection_policy_waiver_ratified
  • substrate_operator.treasury.value_distribution_executed
  • substrate_operator.treasury.disbursement_executed

admission-operator — Admission Operator

Approves role bindings, admits a deployment into the ecosystem, and admits an organisation. This is the operator-admission authority, held separately from the constitutional floor. The first binding, when none exists yet, is a single attested genesis act.

Binding scopes: ecosystem, deployment

Constitutional-floor authority: none · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, independence-breach, dissolution-of-org

Capability surface:

  • ecosystem.admission.role_binding_cosigned
  • ecosystem.admission.role_binding_refused
  • ecosystem.admission.deployment_admitted
  • ecosystem.admission.organisation_admitted
  • ecosystem.admission.seat_licence_granted
  • ecosystem.admission.seat_licence_withdrawn

developer-operator — Developer Operator

Covers changes to the software once the role is bound: approving a plan, authoring a change, verifying it, merging it, and amending the code of practice. It does not sign or apply a release. People and agents outside the holding organisation act only under a mandate that organisation appoints.

Binding scopes: ecosystem, deployment

Constitutional-floor authority: none · Essentiality: when-active

Replacement triggers: voluntary-rotation, competence-failure, independence-breach, floor-violation, dissolution-of-org

Capability surface:

  • ecosystem.developer.plan_approved
  • ecosystem.developer.change_authored
  • ecosystem.developer.change_verified
  • ecosystem.developer.change_merged
  • ecosystem.developer.practice_amended

See also

• AGENTS.md Rule 24 — ecosystem coordination roles (§Y closure, UU-1 invariant).
• AGENTS.md Rule 21 — substrate operator action attestation (§EE closure); coordination roles are the per-action decomposition of the legacy substrate_operator JWT claim.
• /trust/sovereignty/ — the 5 closed deployment modes; coordination-role bindings respect sovereign-mode immutability.