1. guides
temper
  • Temper documentation
  • 2026-07-06-cogmap-telos-differentiation
  • handoffs
  • plans
    • archived
    • evidence
  • reviews
  • specs
  • spikes
  • agents
  • auth
    • Temper auth & security
    • The authorization seam (`temper-services::auth`)
    • Cognitive-map & resource authoring authorization
    • JWT verification
    • The issuer / resource-server boundary & the machine-token contract
    • The internal reconcile channel
  • code-reviews
  • cognitive-maps
  • decisions
  • development
  • guides
    • Building a cognitive map from a large corpus
    • Using temper from Claude Desktop (and claude.ai)
    • Cloud Agent Development Guide
    • Ingesting a corpus into a context
    • Development setup
    • Drain operator queries (TraceQL)
    • Enterprise Install — Ground Up
    • Operator guide: read-only GitHub credential via a BYO App + Vercel Connect
    • Operator guide: provisioning a GitHub connection in temper
    • Installing Temper
    • Delivering L0 Kernel Cogmap Content
    • Machine Credentials
    • OpenTelemetry Setup
    • Operational Memory
    • Bootstrapping a Temper org
    • Releasing Temper
    • Self-Hosting Temper with Okta
    • Self-Hosting Temper with a SAML IdP
    • Self-Hosting Temper
    • The Slack Integration — identity, credentials, and what revocation actually means
    • Operator guide: `@temper` on Slack — end-to-end setup
    • Bootstrapping a team's self-cognition cognitive map
    • Working with Teams
    • Integrating Ruby with temper-rb
    • Deploying an Eve agent to Vercel (the steward and the citation auditor)
    • WS6 Collapsed-Schema Dev Environment
  • research
  • security
  • specs
  • doors
    • Building against Temper
    • Running Temper
    • Using Temper
  • Temper /api/query — the compositional read surface
    • Run a declared composition of situated acts.
    • Schemas
      • Composition
      • OutcomeDeclaration
      • ReturnSpec
      • Intention
      • StageNode
      • ActInvocation
      • CombineNode
      • StageInput
      • StageRelation
      • Disclosure
      • QueryResponse
      • StageResult
      • StageOutput
      • ScoreKind
      • Scoring
      • ResourceHit
      • CompositionTrace
      • StageTrace
      • InputSource
      • NarrowedBy
      • StageName
      • ActName
      • IdKind
      • IdSet
      • BoundTerm
      • Extent
      • StageDisposition
      • ActRefusal
      • PlanRefusal
      • RefusalReason
      • ActQuantity
      • QuantityScale
      • ResourceFilter
      • EdgeFilter
      • PropertyPredicate
      • PropertyOp
      • ResourceSection
      • EdgeKind
      • OrdOp
      • CogmapId
      • ContextId
      • IdProvenance
      • FacetPredicate
      • CombineOp
      • BlockId
      • MatchLocation
      • BodyStorage
      • ResourceId
      • IngestState
      • ManagedMeta
      • ProfileId
      • ResourceView
      • Polarity
      • ViaEntry
      • LensId
      • RegionId
      • CogmapRegionRow
      • RegionHit
      • StageInputTrace
      • Standing
      • ActorAuthority
      • Refusal
      • SystemAccessDetails
      • PlanRefusalDetails
      • ErrorDetails
      • ErrorDetail
      • ErrorBody
  • Temper Cloud API
    • Access
      • POST /api/access/requests — submit a join request for the gating team.
      • GET /api/access/requests/me — check own join request status.
      • DELETE /api/access/requests/me — withdraw a pending join request.
      • POST /api/access/reviews — a revoked principal asks an admin to reconsider (spec D15).
      • GET /api/access/settings — read public system settings.
    • Slack Link
      • Disconnect any principal. Operator path — offboarding and stuck users.
      • Disconnect EVERY Slack principal bound to the caller's own profile.
    • Auditor
      • auditor_dispatch
      • auditor_sweep
      • complete_auditor_job
    • Graph
      • POST /api/cogmaps/{id}/graph/slice — R4 cogmap-scoped neighborhood slice.
      • GET /api/graph/cogmaps/{id}/panorama — enter-a-cogmap Tier-0 interior.
      • GET /api/graph/contexts/composition — Beat E Tier-1: the force-graph composition of a container's (or a residual bucket's) members.
      • GET /api/graph/contexts/panorama — Beat E Tier-0: goal-container territories + residual tray.
      • GET /api/graph/home — the you→teams→cogmaps membership home.
      • GET /api/graph/regions/composition — Beat D region→resources composition drill.
    • Cognitive Maps
      • list_cognitive_maps
      • genesis
      • get_cognitive_map
      • reconcile
      • analytics
      • grant_cogmap_access
      • revoke_cogmap_access
      • materialize
      • materialize_delta
      • region_metrics
      • shape
      • bind_team
      • unbind_team
    • Contexts
      • list_contexts
      • create_context
      • get_context
      • context_materialize
      • reassign
      • context_region_metrics
      • rename
      • context_shape
      • share_team
      • unshare_team
    • Events
      • cursor
      • GET /api/graph/elements/{kind}/{id}/trail — R5 element event-trail. kind ∈ {node, edge}.
    • Facets
      • set_facet
      • Read the live facets of one edge.
      • Set a facet whose owner is an **edge** rather than a resource.
      • Read the live facets of one resource — the confirming read for a write that steers region formation and Atlas grouping.
    • Health
      • health_check
    • Ingest
      • create_ingest
      • update_ingest
      • list_blocks
      • append_block
      • finalize_resource
    • Invitations
      • accept
      • decline
      • list_mine
      • list_team_invitations
      • revoke_team_invitation
      • create_team_invitation
    • Invocations
      • list_invocations
      • open
      • show
      • close
    • Profile
      • get_profile
      • update_profile
      • list_auth_links
    • Query
      • `POST /api/query`.
    • Relationships
      • assert
      • fold
      • retype
      • reweight
    • Resources
      • `GET /api/resources` — **one response type, unconditionally.**
      • create_resource
      • get_resource
      • delete_resource
      • update_resource
      • List the finding at `{id}`'s citation-audit trail — one row per audit, each naming its auditor.
      • Record an auditor's signed defensibility verdict on one `(block, source)` citation of the finding at `{id}`. CONFORM to `handlers::edges::assert` (the sibling authored-write handler): thin — build the command, dispatch it, map the error. No persistence he
      • get_content
      • list_resource_edges
      • resource_evidence
      • grant_resource_access
      • revoke_resource_access
      • resource_lineage
      • provenance
      • annotate_resource
    • Meta
      • get_meta
      • update_meta
    • Reassign
      • reassign_resource
      • reassign_team
    • Search
      • `POST /api/search`.
    • Steward
      • candidates
      • dispatch
      • sweep
      • delta
      • advance
    • Teams
      • list_teams
      • create_team
      • detail
      • delete_team
      • update_team
      • add_member
      • remove_member
      • change_role
    • Schemas
      • AcceptInvitationResponse
      • ActInput
      • ActInvocation
      • ActName
      • ActQuantity
      • ActRefusal
      • ActorAuthority
      • AddMemberRequest
      • AdvanceWatermarkAck
      • AdvanceWatermarkRequest
      • AgentAuthorship
      • AppendBlockPayload
      • AssertRelationshipRequest
      • AtlasEdge
      • AtlasHome
      • AtlasNode
      • AtlasSubgraph
      • AuditCitation
      • AuditSweepRow
      • AuditorDispatchTickRequest
      • AuditorDispatchTickResponse
      • AuditorJobCompleteAck
      • BindTeamOutcome
      • BindTeamRequest
      • BlockId
      • BlockProvenanceRow
      • BlocksResponse
      • BodyStorage
      • Bridge
      • BulkReassignAck
      • BulkReassignRequest
      • ChangeRoleRequest
      • CharterBlock
      • CharterDisposition
      • CitationAuditRequest
      • CitationAuditRow
      • ClaimedAuditJob
      • ClaimedJob
      • CloseInvocationRequest
      • CogmapAnalyticsRow
      • CogmapDetail
      • CogmapFoundationRow
      • CogmapGrantBody
      • CogmapId
      • CogmapRegionMetricsRow
      • CogmapRegionRow
      • CogmapRegulationRow
      • CogmapRevokeBody
      • CogmapRow
      • CogmapStaleness
      • CombineNode
      • CombineOp
      • Composition
      • CompositionTrace
      • ConfidenceBand
      • ContentResponse
      • ContextCreateRequest
      • ContextId
      • ContextOwnerRef
      • ContextPanorama
      • ContextRow
      • ContextRowWithCounts
      • CorrelationId
      • CreateCogmapOutcome
      • CreateCogmapRequest
      • CreateInvitationRequest
      • CreateRequestBody
      • CreateReviewBody
      • DeleteResponse
      • DeviceOverrides
      • DispatchTickRequest
      • DispatchTickResponse
      • Disposition
      • DriftSweepRow
      • EdgeFacetRow
      • EdgeFacetSetRequest
      • EdgeFacetsResponse
      • EdgeFilter
      • EdgeId
      • EdgeKind
      • ElementEvent
      • ElementKind
      • EmbedDispatchSummary
      • Entitlements
      • ErrorBody
      • ErrorDetail
      • ErrorDetails
      • EventCursorResponse
      • EventTrail
      • ExactArm
      • ExactHit
      • Extent
      • FacetAck
      • FacetPredicate
      • FacetSetRequest
      • FinalizePayload
      • FoldRelationshipRequest
      • GrantOutcome
      • GraphEdgeRow
      • GroupKeyMeta
      • HealthResponse
      • HomeCogmap
      • HomeContext
      • IdKind
      • IdProvenance
      • IdSet
      • IdpRevocation
      • IngestCreateResponse
      • IngestDelta
      • IngestPayload
      • IngestState
      • InheritedReadGrant
      • InheritedShare
      • InputSource
      • Intention
      • InvitationStatus
      • InvitationTokenRequest
      • InviteeInvitation
      • InvocationAck
      • InvocationActRow
      • InvocationCloseAck
      • InvocationId
      • InvocationSummary
      • InvocationView
      • JoinRequest
      • JoinRequestStatus
      • LensId
      • LineageNode
      • ManagedMeta
      • MatchLocation
      • MaterializeAck
      • MaterializeDelta
      • MaterializeRequest
      • MergePolicy
      • MetaUpdatePayload
      • NarrowedBy
      • NodeHome
      • OpenInvocationRequest
      • OrdOp
      • OrphanNode
      • OutcomeDeclaration
      • PlanRefusal
      • PlanRefusalDetails
      • Polarity
      • Profile
      • ProfileAuthLink
      • ProfileId
      • ProfileUpdateRequest
      • ProfileWithEntitlements
      • PropertyOp
      • PropertyPredicate
      • ProvenanceSource
      • PublicSystemSettings
      • QuantityScale
      • QueryResponse
      • ReassignAck
      • ReassignContextOutcome
      • ReassignContextRequest
      • ReassignResourceRequest
      • ReconcileCogmapRequest
      • ReconcileEdge
      • ReconcileEdgeTombstone
      • ReconcileEntry
      • ReconcileOutcome
      • ReconcileTelos
      • ReconcileTelosBlock
      • ReconcileTombstone
      • Refusal
      • RefusalReason
      • RegionHit
      • RegionId
      • RelationshipAck
      • RemoveMemberOutcome
      • RenameContextOutcome
      • RenameContextRequest
      • ResidualBucket
      • ResidualContext
      • ResidualGroups
      • ResidualOwnedReach
      • ResourceAnnotateRequest
      • ResourceCreateRequest
      • ResourceFacetRow
      • ResourceFacets
      • ResourceFacetsResponse
      • ResourceFilter
      • ResourceGrantBody
      • ResourceHit
      • ResourceId
      • ResourceLineage
      • ResourceListResponse
      • ResourceRevokeBody
      • ResourceSection
      • ResourceSortField
      • ResourceUpdateRequest
      • ResourceView
      • ReturnSpec
      • RetypeRelationshipRequest
      • RevokeOutcome
      • ReweightRelationshipRequest
      • ScoreKind
      • Scoring
      • SearchParams
      • SearchReason
      • SearchResponse
      • SearchResultRow
      • SearchScope
      • SearchScopeInfo
      • SegmentInfo
      • SegmentedBegin
      • SegmentedBeginResponse
      • ShareContextOutcome
      • ShareContextRequest
      • SlackDisconnectRequest
      • SlackDisconnectResponse
      • SlackDisconnectedPrincipal
      • SliceRequest
      • SortOrder
      • StageDisposition
      • StageInput
      • StageInputTrace
      • StageName
      • StageNode
      • StageOutput
      • StageRelation
      • StageResult
      • StageTrace
      • Standing
      • StandingShape
      • Subscription
      • SubscriptionOverride
      • SystemAccessDetails
      • TeamCreateRequest
      • TeamDetail
      • TeamInvitation
      • TeamMemberDetail
      • TeamMemberRow
      • TeamMemberSource
      • TeamRole
      • TeamRow
      • TeamUpdateRequest
      • Territory
      • TerritoryKind
      • TerritoryOverview
      • UnbindTeamOutcome
      • UnshareContextOutcome
      • VaultConfig
      • ViaEntry
      • WideArm
      • WideHit
  1. guides

Bootstrapping a team's self-cognition cognitive map

This runbook births + binds a team self-cognition map: a cognitive map born 1:1 with a
team, whose ingest source is the team's own temper resources, and whose telos is "understand how
this team works" (see schema-artifact/manifests/team-self-cognition.yaml).
This is the foundation the Eve steward (see the act-model + cogmap-resource vocabulary design,
internal/superpowers/specs/2026-06-30-steward-act-model-cogmap-resource-vocabulary-design.md)
tends going forward — this SoP only covers birth + bind, not ongoing stewardship.
Audience: an operator (or the steward's own deploy step) standing up self-cognition for a
single team on an already-usable temper instance (org bootstrap already done — see
org-bootstrap.md — an org-identity map is not a prerequisite for this
runbook, but the instance must have at least one admin and an authenticated temper binary).
This is a standard operating procedure (SoP): every step is a surfaced, already-existing,
idempotent temper command. Unlike org-bootstrap.md, there is deliberately
no interpolation into a manifest — the telos manifest is team-agnostic prose and the team's
identity rides entirely on the --name flag at apply time, so the same artifact serves every team.

Why this composes existing primitives, not a new command#

A team self-cognition map is architecturally identical to the org-identity map (a cognitive map
born from a genesis manifest, then bound to a team) — it just applies at team granularity instead
of org granularity, and it skips the reconcile-with-landmarks step (a team self-cognition map is
dogfed from the team's own resources via the steward's ordinary assert/facet/fold acts,
not pre-populated with authored landmark content). No new CLI command is needed: team create,
context create, cogmap create --manifest, and cogmap bind already compose the whole sequence.

What you end up with#

OutcomeProduced by
The team (you become its owner)temper team create <team-slug> --name "<Team>"
The team's working context — the ingest sourcetemper context create <ctx> --owner +<team-slug>
A self-cognition cognitive map, born with the templated telos chartertemper cogmap create --manifest schema-artifact/manifests/team-self-cognition.yaml --name "<Team> — self-cognition"
The map reaching the team's shared corpustemper cogmap bind <cogmap-ref> <team-slug>

Prerequisites#

A usable instance. At least one system admin exists (see org-bootstrap.md
§0–1 if this is a fresh install) — cogmap create / cogmap bind are admin-gated (interim gate
is is_system_admin, the same seam org-identity maps use; see
reference_l0_content_delivery_admin_gate for how that gate is
granted).
An embed-capable temper binary. cogmap create embeds the charter client-side (ONNX). A
non-embed build returns a clear requires the 'embed' feature error rather than running.
Authentication. You must be logged in (temper auth login, or TEMPER_TOKEN exported) as a
system admin before step 3/4 below (steps 1/2 only need an authenticated profile, not admin).

The sequence#

Placeholders: <team-slug> (globally-unique team slug), <Team> (display name), <ctx> (the
team's working context name, e.g. building).

1. Create the team#

You become the team's owner. Idempotent by slug — re-running against an existing slug is a no-op
(no duplicate team, no error escalation beyond the existing-slug case).

2. Create the team's working context#

This is the ingest source the self-cognition map eventually dogfeeds from — resources written
here are what the steward distills nodes from.
--owner +<team-slug> marks this a team-owned context (requires owner/maintainer on the team,
which step 1 already granted you). Omitting --owner defaults to a personal @me-owned context,
which is not what a team self-cognition map wants — always pass --owner here.

3. Birth the self-cognition cognitive map#

Genesis births a new map with its telos charter from the reusable, team-agnostic genesis manifest —
no per-team edits to the manifest are needed, only the --name override:
The output reports the realized identity:
{ "cogmap_id": "019f…", "telos_resource_id": "019f…", "created": true }
Capture cogmap_id — step 4 needs it. Genesis is idempotent at a given id: pin cogmap_id (and
optionally telos_resource_id) in a per-team copy of the manifest, or pass --id <cogmap-ref>, and
a re-run is a no-op (created: false). Without a pinned id the CLI mints a fresh uuidv7 each run —
the same id-capture-vs-pin tradeoff install-profile.yaml
documents for the org-identity map. For a one-off team this SoP is typically run by hand and the
printed id is captured directly into step 4; pin it only when you want a reproducible, re-runnable
genesis (e.g. driving this SoP from a script or a per-team profile file).

4. Bind the map to the team#

Binding widens the map's reach to the team's shared resources (an unbound map reaches nothing
through the team — empty join, default-closed):
This is the 1:1 team↔cogmap join. Idempotent on the join primary key — re-running is a no-op.
The team's self-cognition is now live: the map is born with the templated "how this team works"
charter, and it reaches resources written into +<team-slug>/<ctx>. From here the Eve steward
tends it (create / assert / facet / fold acts against the team's own resources); regions emerge
from materialize — the steward never clusters directly.

Idempotency#

Idempotency is inherited from the primitives, not implemented by this SoP: team create is
idempotent by slug, context create is idempotent by name+owner, cogmap create is idempotent at
a given id (pinned or captured), and cogmap bind is idempotent on the join PK. Re-running this
whole sequence therefore converges rather than duplicating — the same property
org-bootstrap.md relies on for its applier script.

Verification#

Shows the map (initially with no materialized regions — it was just born, nothing has been
asserted/folded/materialized into it yet). The map's telos carries the templated statement, five
questions, and three framing lines verbatim from
team-self-cognition.yaml. Today the
charter prose itself is not surfaced by cogmap shape (a regions/analytics view, not a charter
read) — once T1's cogmap_read_charter MCP tool lands, it reads the telos prose directly; until
then, confirm the charter landed correctly by inspecting the telos_resource_id resource (e.g.
temper resource show <telos_resource_id>).

Verifying against a local dev stack (not run this session)#

This SoP's steps target the CLI's configured API (production, temperkb.io, by default) — there is
no local server running in this environment, so the sequence above was not executed live this
session
. To verify end-to-end against a local dev stack instead of prod:

Not run in most installs#

Creating the specific temper team + building context and re-homing an existing personal
corpus into it is a one-time operator migration for J's own install, not a step most installs
need — this runbook is the reusable, team-agnostic procedure; that specific migration is deferred
and tracked outside this durable deliverable (see the Deferred section of the T2 implementation
plan, internal/superpowers/plans/2026-06-30-t2-templated-team-telos-genesis.md).

Deferred seams#

Cogmap-write gate vs. team roles. Like org-identity maps, the interim gate for cogmap create
/ bind is is_system_admin — eventually maintainers of the team itself should be able to write
their own team's self-cognition map without needing system-admin.
An applier script. docs/guides/org-bootstrap.md has scripts/bootstrap/system-bootstrap.sh;
a scripts/bootstrap/team-self-cognition.sh echo-then-apply script for this sequence is deferred
to the steward's deploy step (T6), not authored in this pass.
Auto-birth-of-self-cogmap-per-team. The MVP is this on-demand SoP; automatically birthing a
self-cognition map whenever a team is created is out of scope here.

References#

Surfaced commands: temper team create, temper context create, temper cogmap create,
temper cogmap bind (crates/temper-cli/src/cli.rs).
Template / shape precedent: org-bootstrap.md +
schema-artifact/manifests/org-identity.yaml.
The reusable genesis manifest:
schema-artifact/manifests/team-self-cognition.yaml.
Steward architecture this map feeds: internal/superpowers/specs/2026-06-30-steward-act-model-cogmap-resource-vocabulary-design.md.
Implementation plan this SoP delivers: internal/superpowers/plans/2026-06-30-t2-templated-team-telos-genesis.md.
Modified at 2026-08-19 17:59:52
Previous
Operator guide: `@temper` on Slack — end-to-end setup
Next
Working with Teams
Built with