Last verified: 28 September 2026
Sovern System Model
The semantic overlay of what Sovern does, joined to Ground Truth evidence. Rows are authored and ratified. proposed never counts. Documentation is a projection of this model, never its source.
Ratified concepts
Generated from lib/registry/sovern-system-model-registry.ts · 14 ratified rows (§ZCT GE-12.0 / C-ZCT-15). Adding a row is a §ZCT amendment.
Every refs[] entry resolves to a Ground Truth unit at HEAD. The model is not a Ground Truth input class. Specialists are context closures, not identities. Availability is projected from the ladder. available-now is empty — implemented is not available.
identity — Identity
Coordination and infrastructure subjects are typed participants, not a single user noun.
availability: unprojected · actors: human, ai_agent, proxy, service_account, system, device · authority: identity-operator, substrate_operator · refs: §T, §C
limitations: Coordination-equality is not legal-equality.
authority-mandates — Authority and mandates
An agent acts only under a validated mandate attributed to a backing entity.
availability: unprojected · actors: human, ai_agent, proxy · authority: identity-operator, stewardship-operator · refs: §C, guard:mandate-bounded-required
limitations: A mandate is not a Y-role and not an AdminRoleKey.
attestation — Attestation
Operator and governance mutations produce an observable attested trail.
availability: unprojected · actors: human · authority: attestation-operator, substrate_operator · refs: §EE, guard:substrate-operator-action-attested
limitations: Break-glass is 2-of-2; min_signers is not configurable at v1.
federation — Federation
Cross-deployment events are signed CloudEvents, never a live phone-home proxy.
availability: unprojected · actors: human, system, service_account · authority: federation-operator · refs: §V, guard:federation-receiver
limitations: Federation participants with expression.kind=system are rejected.
expressions — Expressions
Product grain is a tightened expression manifest, not an ad-hoc app.
availability: unprojected · actors: human · authority: native-expression-operator, frontier-expression-operator · refs: §SS, business
limitations: A fifth @sovern SDK requires a §W amendment.
data-spaces — Data spaces
Governed knowledge: originals stay canonical; meaning is span-provenanced.
availability: unprojected · actors: human, ai_agent · authority: custody-operator, stewardship-operator · refs: §ZCR, §ZCS
limitations: AI only suggests relations; import is highest trust.
briefing — Briefing
Inform-only governed intelligence. Reads context; never acts autonomously.
availability: unprojected · actors: human, ai_agent · authority: stewardship-operator · refs: §ZCQ, guard:briefing-evidence-trail-required
limitations: Agents may open inquiries, never Briefs or Signals.
governed-engineering — Governed engineering
What HEAD claims after digest verify. Agents propose; humans ratify.
availability: unprojected · actors: human, ai_agent · authority: substrate_operator, stewardship-operator, developer-operator · refs: §ZCT, guard:ground-truth-fresh
limitations: Cursor remains the harness. The model is not a Ground Truth input class.
audit — Audit
Append-only hash-chained records with closed retention classes.
availability: unprojected · actors: human, system · authority: custody-operator, compliance-operator · refs: §ZA, lib/modules/substrate/audit
limitations: Restoration never mutates prior segments.
backup-fork — Backup and right to fork
Substrate signs digests; the operator stores bytes. Fork is non-enclosure.
availability: unprojected · actors: human · authority: custody-operator, resolution-operator · refs: lib/modules/substrate/backup, lib/modules/substrate/fork
limitations: In-place restore is deferred. Donor keys admit retired.
deployment-modes — Deployment modes
Sovereign modes are code-immutable from the inside. No phone-home.
availability: unprojected · actors: human, system · authority: deployment-operator, substrate_operator · refs: §CC, guard:no-phone-home-in-sovereign-modes
limitations: Updates ship as signed bundles the customer operator applies.
telemetry — Telemetry
One emission surface, closed event kinds, silent by default in sovereign mode.
availability: unprojected · actors: human, device · authority: surface-operator · refs: §LL, guard:telemetry-event-registered
limitations: No session replay. No ambient collection. personal PII posture is banned at v1.
onboarding — Onboarding
A single entry module. No auto-instantiated onboarding agent.
availability: unprojected · actors: human · authority: surface-operator, substrate_operator · refs: §FF, guard:onboarding-single-entry-module
limitations: Signup is deployment-mode aware. Air-gap does not get a SaaS funnel.
value-exchange — Value exchange
Commercial terms live in runtime configuration and pricing flows.
availability: unprojected · actors: human · authority: treasury-operator · refs: §BB, guard:no-hardcoded-pricing
limitations: No hardcoded currency amounts. No freemium framing in substrate copy.