AI is assistive only. AI may advise, summarize, score, draft, and recommend. AI may never autonomously mutate canon, approve decisions, or execute writes without human approval.

Every governed mutation must emit an audit event with actor, action, target, and before/after metadata. Audit records are append-only.

Canon changes only through explicit structured review and ledger write. Never from a chat reply, a note, a connector sync, or an AI suggestion.

All API endpoints return { ok: boolean, data?: any, error?: string }. Failures return appropriate HTTP status codes with clear error messages.

State transitions on governed objects must follow an explicit allowed-transition map. Invalid transitions are rejected with a clear error.

Cross-domain visibility is allowed. The brain may surface signals across domains.

Cross-domain mutation is denied by default. No domain may write to another domain's state without explicit approval.

Database is for structured truth only. Files, PDFs, screenshots, transcripts, and analytics dumps go to Blob Storage.

Only unlocked (draft) decisions may be edited. Edit is limited to title, decisionText, and context fields.

Decision lock is one-way. Locked decisions cannot be edited or unlocked. There is no unlock path.

Every governed object must have a domainKey validated against canon.domains at creation time. Unregistered domains are rejected.

External systems are integration boundaries only. They emit signals. They do not hold write authority over internal canon.

Finance data lives on a separate database server. No finance automation until finance policy is locked in canon.

Focus items follow a three-state lifecycle: active, paused, completed. Completed is terminal — no transitions out, no edits.

Focus item priority is constrained to: low, medium, high. Default is medium.

Open loops follow a two-state lifecycle: open and closed. Transitions are bidirectional (open↔closed). Both directions are allowed.

Governed objects cannot be deleted. Terminal states (closed, locked, completed) are the end of the lifecycle.

No public page may share runtime, secrets, or direct data access with the private brain. Public surfaces are separate deployments.

Personal Microsoft tenant under sharpescommandcenter.com is the root authority. No outside SSO may become root.

Single-write authority per domain. No parallel write paths allowed. If two systems can write the same object, one is wrong.