Deliver L0 Kernel Content

For operators. This playbook delivers or updates the content of the L0
kernel cognitive map (system-default) on a live Temper instance. It covers
the non-obvious fail-closed admin gate and the grant → reconcile →
re-lock procedure an operator must follow to write to L0.

L0 is release/operator-governed, not operationally stewarded. This is an
operator runbook, not an end-user flow.

Outcome

By the end you will have: the 22 kernel landmarks plus the telos charter
reconciled into the live L0 map, and the fail-closed admin gate restored so
the kernel is immutable again. A re-run against unchanged content is an
idempotent no-op.

Prerequisites

A deployed, migrated instance — see
self-hosting Temper, or the
enterprise install for the full end-to-end
sequence.

The charter-set primitive applied. The cogmap_charter_set function
must be present on the target database before a telos-bearing reconcile.

An embed-capable temper binary. The reconcile path embeds each
manifest entry client-side (ONNX), so it requires a binary built with the
embed feature. The default install bundles it; a non-embed build
returns a clear requires the 'embed' feature error rather than running.

An admin connection to the instance's Postgres (admin role) for the
verification SELECT and, on a fresh instance, the root bootstrap SQL.

The operator's profile id. Sign in once before the grant so the profile
row exists; capture its UUID.

A fork of the Temper repository. Self-hosters run this playbook
alongside steward-agent deployment, and both need a checkout — fork first.

For the trust model that gates the L0 write, see
trust boundary.

What L0 is

The L0 kernel cognitive map is the public, root-team-joined "what is temper"
cognitive map. It is born deterministically by migration under the
system actor, with reserved ids:

Entity	Reserved id
L0 cogmap	`00000000-0000-0000-0005-000000000001`
L0 telos resource	`00000000-0000-0000-0005-000000000002`
Root team slug	`temper-system`

L0 is a living map, but it evolves only by shipping new additive
migrations that call the substrate mutation functions against L0's reserved
id — never by editing the immutable birth migration. Its content (landmarks

telos charter) is delivered separately from its schema, via the operator
reconcile flow described here.

The gotcha: L0 writes are fail-closed

temper cogmap reconcile against L0 is gated by
require_cogmap_write_admin → is_system_admin. Two things make this
non-obvious:

is_system_admin reads kb_principal_governance and nothing else. Not
team membership, not gating_team_slug, not a column on kb_profiles. A
profile is a system admin exactly when it has a row in that table.

Nothing has one out of the box. The canonical seed grants no governance,
so the L0 write gate denies everyone and the kernel is immutable on a
fresh instance. A reconcile attempt returns 403 Forbidden until the
temporary operator grant below has been run.

This is intentional: the L0 special-case is fail-closed so an unconfigured
instance cannot have its kernel rewritten by any authenticated user. The cure
is not a permission flag — it is the temporary operator grant below.

Procedure

Snapshot prod before a hand-run data change. Take a backup of your
target database before running the grant or re-lock SQL.

0. Fork and clone

Self-hosters run this playbook alongside steward-agent deployment; both need a
repository checkout. Fork the Temper repository and clone your fork. The
inlined manifest below is saved into it.

1. Grant (temporary admin)

is_system_admin reads kb_principal_governance and nothing else, so the
grant is a governance grant — made through the shipped admin surface, never by
editing team rows. If the instance already has a system admin, promote the
operator as that admin:

On a fresh instance nobody is admin yet, so the first grant is the SQL root
step from
Bootstrap an Org —

SELECT principal_governance_set('<operator-profile-uuid>'::uuid, true, NULL,
'root bootstrap');

— run over an admin connection to your instance's Postgres.
Confirm the grant took either way:

2. Reconcile

Save the manifest below as l0-kernel.yaml in your checkout, then reconcile
the live L0 map against it:

The CLI reads the manifest, embeds each entry client-side (ONNX, via the
embed feature), builds a pre-embedded request, and PUTs it to
PUT /api/cognitive-maps/{id}.

It is idempotent — a re-run against unchanged content reports zero
changes:

{ "created": 0, "updated": 0, "folded": 0, "unchanged": 22, "charter": "unchanged" }

The charter field is a distinct grain from the landmark counts. Its values
are absent (manifest carried no telos:), unchanged, created (first
delivery into an empty telos), or updated (live charter differed and was
replaced). First delivery reads "created": 22, … "charter": "created".

Confirm the outcome counts match expectation (first delivery creates; a re-run
reports unchanged / charter: unchanged).

3. Re-lock (restore fail-closed)

Undo the grant so L0 returns to immutable:

Delivered content persists. The next lifecycle update repeats this same
grant → reconcile → re-lock dance.

The L0 kernel manifest

Save the following as l0-kernel.yaml. It delivers the 22 orientation
landmarks and the authored telos charter to the live system-default cogmap.
The CLI embeds each entry client-side (ONNX) before the PUT, so the server
stays embed-free on the request path.

Each entry carries a pre-generated, stable id (uuidv7) — the landmark's
substrate identity. The reconcile diff matches manifest entry ↔ live resource
by this id, and edges reference their target by id. origin_uri is pure
attribution (loose, non-unique — never a key). These ids are permanent once
shipped; a future landmark gets a freshly-generated uuidv7. First delivery is
all-additive: no fold_resources / fold_edges.

The telos: section is delivered via cogmap_charter_set (fold-then-reproject).
block_mutate is revise-only and cannot populate an empty telos;
cogmap_charter_set is the correct primitive for initial and subsequent
charter delivery.

Lifecycle framing

L0 content evolves through two complementary mechanisms:

Schema / structural birth and additive evolution ship as migrations
that call the substrate mutation functions against L0's reserved id. These
are immutable once shipped.

Content delivery (landmarks + telos charter) is operator-directed
reconciles of the manifest, each gated by the temporary grant above.

Both are operator-governed; neither is ambient or steward-driven.

Deliver L0 Kernel Content

Outcome#

Prerequisites#

What L0 is#

The gotcha: L0 writes are fail-closed#

Procedure#

0. Fork and clone#

1. Grant (temporary admin)#

2. Reconcile#

3. Re-lock (restore fail-closed)#

The L0 kernel manifest#

Lifecycle framing#

Further reading#