Deliver L0 Kernel Content

For operators. This playbook delivers or updates the content of the L0
kernel cognitive map (system-default) on a live Temper instance. It covers
the non-obvious fail-closed admin gate and the grant → reconcile →
re-lock procedure an operator must follow to write to L0.

L0 is release/operator-governed, not operationally stewarded. This is an
operator runbook, not an end-user flow.

Outcome

By the end you will have: the 22 kernel landmarks plus the telos charter
reconciled into the live L0 map, and the fail-closed admin gate restored so
the kernel is immutable again. A re-run against unchanged content is an
idempotent no-op.

Prerequisites

A deployed, migrated instance — see
self-hosting Temper, or the
enterprise install for the full end-to-end
sequence.

The charter-set primitive applied. The cogmap_charter_set function
must be present on the target database before a telos-bearing reconcile.

An embed-capable temper binary. The reconcile path embeds each
manifest entry client-side (ONNX), so it requires a binary built with the
embed feature. The default install bundles it; a non-embed build
returns a clear requires the 'embed' feature error rather than running.

An admin connection to the instance's Postgres (admin role) for the
grant and re-lock steps.

The operator's profile id. Sign in once before the grant so the profile
row exists; capture its UUID.

A fork of the Temper repository. Self-hosters run this playbook
alongside steward-agent deployment, and both need a checkout — fork first.

For the trust model that gates the L0 write, see
trust boundary.

What L0 is

The L0 kernel cognitive map is the public, root-team-joined "what is temper"
cognitive map. It is born deterministically by migration under the
system actor, with reserved ids:

Entity	Reserved id
L0 cogmap	`00000000-0000-0000-0005-000000000001`
L0 telos resource	`00000000-0000-0000-0005-000000000002`
Root team slug	`temper-system`

L0 is a living map, but it evolves only by shipping new additive
migrations that call the substrate mutation functions against L0's reserved
id — never by editing the immutable birth migration. Its content (landmarks

telos charter) is delivered separately from its schema, via the operator
reconcile flow described here.

The gotcha: L0 writes are fail-closed

temper cogmap reconcile against L0 is gated by
require_cogmap_write_admin → is_system_admin. Two things make this
non-obvious:

is_system_admin reads kb_principal_governance and nothing else. Not
team membership, not gating_team_slug, not a column on kb_profiles. A
profile is a system admin exactly when it has a row in that table.

Nothing has one out of the box. The canonical seed grants no governance,
so the L0 write gate denies everyone and the kernel is immutable on a
fresh instance. A reconcile attempt returns 403 Forbidden until the
temporary operator grant below has been run.

This is intentional: the L0 special-case is fail-closed so an unconfigured
instance cannot have its kernel rewritten by any authenticated user. The cure
is not a permission flag — it is the temporary operator grant below.

Procedure

Snapshot prod before a hand-run data change. Take a backup of your
target database before running the grant or re-lock SQL.

0. Fork and clone

Self-hosters run this playbook alongside steward-agent deployment; both need a
repository checkout. Fork the Temper repository and clone your fork. The
inlined manifest below is saved into it.

1. Grant (temporary admin)

Connect to the target database with an admin role — any admin connection to
your instance's Postgres will do; the steps below are plain SQL. Point the
gating slug at the root team and make the operator an owner of it:

2. Reconcile

Save the manifest below as l0-kernel.yaml in your checkout, then reconcile
the live L0 map against it:

The CLI reads the manifest, embeds each entry client-side (ONNX, via the
embed feature), builds a pre-embedded request, and PUTs it to
PUT /api/cognitive-maps/{id}.

It is idempotent — a re-run against unchanged content reports zero
changes:

{ "created": 0, "updated": 0, "folded": 0, "unchanged": 22, "charter": "unchanged" }

The charter field is a distinct grain from the landmark counts. Its values
are absent (manifest carried no telos:), unchanged, created (first
delivery into an empty telos), or updated (live charter differed and was
replaced). First delivery reads "created": 22, … "charter": "created".

Confirm the outcome counts match expectation (first delivery creates; a re-run
reports unchanged / charter: unchanged).

3. Re-lock (restore fail-closed)

Undo the grant so L0 returns to immutable:

Delivered content persists. The next lifecycle update repeats this same
grant → reconcile → re-lock dance.

The L0 kernel manifest

Save the following as l0-kernel.yaml. It delivers the 22 orientation
landmarks and the authored telos charter to the live system-default cogmap.
The CLI embeds each entry client-side (ONNX) before the PUT, so the server
stays embed-free on the request path.

Each entry carries a pre-generated, stable id (uuidv7) — the landmark's
substrate identity. The reconcile diff matches manifest entry ↔ live resource
by this id, and edges reference their target by id. origin_uri is pure
attribution (loose, non-unique — never a key). These ids are permanent once
shipped; a future landmark gets a freshly-generated uuidv7. First delivery is
all-additive: no fold_resources / fold_edges.

The telos: section is delivered via cogmap_charter_set (fold-then-reproject).
block_mutate is revise-only and cannot populate an empty telos;
cogmap_charter_set is the correct primitive for initial and subsequent
charter delivery.

Lifecycle framing

L0 content evolves through two complementary mechanisms:

Schema / structural birth and additive evolution ship as migrations
that call the substrate mutation functions against L0's reserved id. These
are immutable once shipped.

Content delivery (landmarks + telos charter) is operator-directed
reconciles of the manifest, each gated by the temporary grant above.

Both are operator-governed; neither is ambient or steward-driven. L0's charter
declares its ambient steward wake = never.

Deliver L0 Kernel Content

Outcome#

Prerequisites#

What L0 is#

The gotcha: L0 writes are fail-closed#

Procedure#

0. Fork and clone#

1. Grant (temporary admin)#

2. Reconcile#

3. Re-lock (restore fail-closed)#

The L0 kernel manifest#

Lifecycle framing#

Further reading#