The GOVENANT Standard — Part 12: The Porting Guide

How to convert any product — greenfield or existing, any domain — into a conforming OCMAS. The checklist is tiered to the maturity ladder; the build order is dependency-correct; the definition of done is the ALIVE + COVERED pair. An item is done only when it has fresh rows, a live consumer, and real side effects — never when the file exists.

12.1 Setup

Copy the standard into the target repo:

mkdir -p docs/govenant && cp <source>/docs/govenant/*.md <source>/docs/govenant/SCHEMA.sql docs/govenant/

Map the domain (Part 0 §0.7) before anything else: this product’s tenants, roles, levers, terminal edges, outcome vocabulary. Write the mapping into docs/govenant/DOMAIN-MAP.md — every later step reads it.
Run the audit prompt (Part 9 §9.6). For a product with zero substrate the deliverable degrades to a gap register in the §12.4 build order — that register is the project plan.
If old code is being rewritten: copy the legacy system into an old-code/ reference folder in the new repo so agents have instant access to prior logic and behavior without archaeology.

12.2 Conversion checklist

Tier 1 — Non-negotiable substrate (claims L1/L2)

#	Component	Done when…	Part
1	Append-only action ledger	Every action writes input/output/cost/model/outcome fields; no UPDATE path; cost/model populated at the LLM-client chokepoint.	4-S1
2	One real terminal side effect	At least one outbound action that is NOT a log line, traceable to a ledger row. No delivery = FLATLINED, whatever else exists.	4, 5
3	Lever registry + ownership gate	Single owner per lever; unowned → request; the check fires at EVERY actuation surface including delivery edges (AP-5).	1, 4-S2
4	Validation gate	Deterministic hard-blocks + judged lenses on every outbound artifact; never fails open.	4-S3, 5
5	Constitution plane	Settings as rows w/ truthful provenance; sticky lock; snapshots append per write (AP-4).	8
6	Approval queue + tiers	Tier-2 acts pend; expiry writes `decided_by='system:expired'` atomically (AP-7).	7
7	Event bus w/ named consumers	Typed constants both sides import (AP-3); every type has a consuming duty; latency measured.	4-S6
8	Duty roster (minimum viable) ⭐	All scheduled work derives from `role_duties` (deploy-config crons retired); every duty asserts an outcome; duty_runs ledgered w/ required reasons.	3
9	Conductor + standup	`missed` rows written, escalated; per-tenant standup generated from the roster diff.	3 §3.6, 4-S9
10	Circuit breakers + liveness	Every external dep wrapped, breakers test-tripped once; liveness flag+dep gated.	7 §7.3

Tier 2 — Delivery + coverage verification (claims L3)

#	Component	Done when…	Part
11	Outcome-keyed completion	100% of agenda items carry assertions (inherited from duties); unverified = FAILED + escalated.	3, 5
12	Coverage invariants C1–C3	Enforced on roster writes + nightly; the uncovered-responsibility list is empty or ticketed.	3 §3.5
13	Motion-vs-delivery panel + coverage board	Both operator-visible with real data.	11
14	Falsifiability at the chokepoint	Placeholders structurally rejected inside `logDecision` (AP-1); baselines captured live.	6 §6.2
15	Metric domain binding	Levers declare `expected_metrics[]`; non-sequiturs rejected (AP-2).	6 §6.3
16	Prompt registry	Versioned, provenance, rollback, per-scope override, UI-edited — the storage template the other dimensions copy.	2 §2.2
17	Block/defer reasons schema-required	A blocked/skipped row without a reason cannot be written.	3 §3.2
18	Delivery-integrity audit	Set-relationship invariants (drafts≫ships, churn, coverage %) daily, with a live consumer for its breaches (AP-6).	7 §7.3

Tier 3 — Earned autonomy (claims L4)

#	Component	Done when…	Part
19	Promotion + demotion live	Thresholds in code; one correction demotes; pinned actions are a code constant no config can defeat.	7 §7.1
20	Grader + calibration feeding back	% past-horizon decisions graded → 100; miscalibrated roles get a raised evidence bar.	6 §6.4–6.5
21	Five-tab Agent Configuration	Prompt/Skills/Tools/Context/Schedule as data, runtime-enforced, UI w/ provenance + usage.	2
22	Significance gate	No winner/loser on noise; `instrument` mode below sample floor.	6 §6.8
23	Ledger rules	Lessons stored, injected, human-lockable; rule changes approvable.	6 §6.7
24	Review sessions + trust receipts	Recorded review → structured tickets; pinned DoD; per-delivery receipt from the record.	11 §11.6

12.3 Definition of done (the honest bar)

A real inbound event (an issue, a lead, a ticket) can flow:

event → consuming duty wakes the right role → deliberate → decide (owned lever or request)
  → validate → act (real side effect via a granted tool) → verify outcome row
    → record + falsifiable prediction → grade on horizon

…with a human able to lock any lever, a conductor that catches any silent beat, and a throughput alarm if an edge goes quiet under demand. Then run Part 9 end-to-end: the product must come back ALIVE and COVERED with no load-bearing pillar below L2. If any edge only logs instead of acts, it is not done.

12.4 Build order (dependency-correct; climbs L0→L4)

flowchart TD A[1 Ledger + tenancy scope_kind from day one] --> B[2 One tool-calling worker\nthat actuates for real] B --> C[3 Monitors ALONGSIDE not after:\nthroughput + liveness + breakers] B --> D[4 Constitution plane + tiers + approvals] D --> E[5 Lever registry + ownership gate] E --> F[6 Validation gate] F --> G[7 Duty roster + dispatcher +\noutcome-keyed completion + conductor] G --> H[8 ONE executive end-to-end\npredict → actuate → grade\nbefore adding the rest] H --> I[9 Significance + calibration] I --> J[10 Remaining roles + rosters\ncoverage C1-C3 green] J --> K[11 Ledger rules learning loop] K --> L[12 Boardroom + @mentions + chat-that-acts] L --> M[13 Prompt registry → then Skills/Tools/Context/Schedule tabs] M --> N[14 Full UI: coverage board,\nmotion-vs-delivery, ant farm]

Sequencing rules that save rework:

Monitors ship with the first actuator, not after it. Every week an edge runs unmonitored is a week of invisible flatline risk.
One executive end-to-end before breadth. A single role that genuinely predicts→actuates→ grades teaches more than six that deliberate beautifully.
The roster before role sprawl. Adding roles before coverage exists multiplies silence.
scope_kind on day one (Part 1 §1.5) — retrofitting project scope touches every table.

12.5 Domain retargeting quick-reference

Substrate element	GTM	Engineering	Legal
Levers	send_volume, spend_cap, segment_pause	deploy_gate, rollback, merge_policy, coverage_threshold, cve_policy	filing_release, disclosure_policy, engagement_scope
Validation lenses	brand-truth / funnel / risk / compliance	correctness / security / perf / maintainability	accuracy / privilege / jurisdiction / tone
Hard blocks	missing CTA, naked links, claims w/o source	secrets, failing tests, CVE ceiling	missing citations, unverified facts, deadline breach
Terminal edges	email sent, demo booked, deal closed	PR merged, deploy verified, incident resolved	filing accepted, document executed
Duty examples	drain reply queue (event), campaign review (cron 10:00), grade after metrics (dependency)	triage new issues (event), dependency scan (cron), release notes after deploy (dependency)	docket check (cron), intake triage (event), draft after research (dependency)
Entity timeline	contact	work item / PR	matter / filing

12.6 Common porting mistakes

Porting the UI before the substrate — screens over empty tables demo well and audit as L0.
Prompt-porting the charters — describing authority instead of gating it (Law 1).
Keeping the old scheduler “temporarily” — two sources of scheduled truth means the coverage audit is wrong from day one; cut over, don’t straddle.
Deferring the audit until “done” — run Part 9 at every tier boundary; the gap register is the backlog, and anti-patterns are far cheaper to fix before call sites multiply.
Building breadth before one closed loop — see §12.4.