CLASSIFICATION: PUBLIC // IDENTITY UNIT: THE-TARTAN
SESSION MONITORING ACTIVE | ALL ACCESS LOGGED | COMPLIANCE REQUIRED

Governance Model

Three-Pillar Architecture

Organizational operations are structured through three integrated pillars, each serving distinct but complementary functions. This separation ensures appropriate checks and balances while maintaining operational efficiency.

The Covenant (Philosophy)

Establishes the foundational principles and policy specifications that govern all organizational activities. Contains 16 core principles and authoritative policy definitions. Changes require Covenant-level approval (2 Watchers + 2 Mentors, 72-hour deliberation period).

The Citadel (Infrastructure)

Implements and enforces the infrastructure specifications defined by The Covenant. Manages GitHub organization, Cloudflare infrastructure, and cloud platform configurations through Infrastructure as Code. Changes require Citadel-level approval (1 Mentor + 1 Watcher).

The Nexus (Operations)

Delivers operational tooling and runtime policy enforcement. Implements observability systems, automation frameworks, and day-to-day operational capabilities. Changes require Stronghold-level approval (1 Mentor).

Decision Authority Matrix

LEVEL APPROVAL SCOPE
COVENANT 2W + 2M, 72h Principles, policies, governance structure
CITADEL 1M + 1W Infrastructure, security baseline, provider config
STRONGHOLD 1M Applications, operational tooling, documentation

Legend: W = Watcher (Administrator), M = Mentor (Code Owner)

Role Definitions

The Immortals

All personnel with repository access. Authorized to submit proposals and participate in technical discussions. Changes must be submitted through pull requests with appropriate peer review.

The Mentors

Code owners with approval authority for their designated domains. Responsible for technical review and ensuring alignment with established principles. Serve as first-level approval in governance hierarchy.

The Watchers

Repository administrators with elevated privileges. Provide oversight for infrastructure changes and policy modifications. Serve as second-level approval for Citadel and Covenant changes.

Enforcement Mechanisms

Automated Validation

  • Commit Format: Conventional Commits specification enforced through repository rulesets
  • Linear History: Squash and merge required, no merge commits permitted
  • Security Scanning: Automated dependency audits and secrets detection on all changes
  • Code Quality: Linting, formatting, and type checking required for merge

Manual Review Gates

  • Peer Review: At least one approval required for all changes
  • Governance Approval: Tiered approval based on change scope and impact
  • Infrastructure Apply: Manual approval gate in HashiCorp Cloud Platform
  • Break-Glass Override: Documented emergency procedures for critical incidents

Navigation