Authority Boundary

Tier: 0 · Normative weight: implements TM-MOD-005; supports TM-CUR-008, TM-CUR-009 Requires: nothing

Problem it removes

Two repositories each half-own a fact — a deployment target, a design token, a customer detail — and drift apart, with neither able to say which copy is authoritative. Observation quietly becomes a fork: a value copied in for convenience starts evolving independently of its owner.

Mechanism

A short section, usually in the Front Door, stating in plain sentences the declared ownership split TM-MOD-005 requires: the facts this repository owns; the facts it observes but that named sibling systems own (“cloud-ops owns production appointment and rollback”); and the material that must never enter (credentials, customer data, raw logs). Owned-elsewhere facts are cited or observed at an exact revision, never copied and maintained (TM-CUR-008). When ownership of a fact moves between repositories, the move is recorded as an explicit handoff naming the receiver and the boundary (TM-CUR-009), and the predecessor stops evolving its account.

Cost

Authoring: the hard part is deciding, not writing — an hour of ownership questions. Per change: only at real ownership changes, each of which deserves a recorded handoff anyway. Per session: none.

Do not adopt when

The repository is genuinely self-contained — it observes nothing owned elsewhere and nothing observes it.

Evidence

Assessed in cloud-ops and inference-ops, whose ownership seams are mechanically checked across repositories. Observed in kinra-os.

Template

None — adopted by convention, as a section of the front door.

Related patterns

Declared Versus Observed is how an owned-elsewhere fact is watched without being forked.