# Implementation Guide

## Recommended build order

1. Deploy immutable registries for scales, dimensions, profiles, and policies using the supplied schemas.
2. Implement the effective-profile resolver exactly as `INHERITANCE.md`; persist field provenance.
3. Implement observation authorization/minimization before measurement.
4. Port the pure functions from `reference-implementation/coherence-engine.mjs` into the production language.
5. Add the state store and append-only observation/Event pipeline.
6. Implement policy predicates and response-permission intersection.
7. Add synchronous LLM output and Actor Action preflight hooks.
8. Add the Sentinel orchestrator with idempotent interventions and explicit release/appeal paths.
9. Build Source controls: profile, current state, drift, edit, explain, history, recommendations, creation, Realm creation, and mediation.
10. Add calibration, retention/deletion, aggregate privacy, and governance operations.
11. Run supplied schemas, fixtures, engine tests, Skill validation, and cross-artifact terminology checks.

## Production requirements

- Pin object and schema versions in every assessment/intervention.
- Make the constitutional policy available locally to preflight; fail closed if it cannot be verified.
- Separate inference service credentials from Action execution credentials.
- Encrypt human-related evidence and enforce field-level visibility.
- Use append-only audit Records with redaction overlays rather than silent mutation.
- Maintain a kill/pause path and independent release Authority for Sentinels.
- Publish latency budgets: deterministic preflight should not depend on an LLM.
- Monitor missing observations, measurement drift, false intervention rate, appeals, overrides, and calibration by valid context—not a human rank.

## Reference implementation boundary

The engine demonstrates merging, decay weighting, state aggregation, target/band calculations, zone selection, confidence gating, boundary precedence, and entity response limits. It does not provide authentication, storage, a policy DSL sandbox, production model inference, legal policy, or live Kiduna integration. Those are explicit integration responsibilities rather than missing model semantics.

## Genuine product decisions still open

- Which body ratifies the first Kiduna constitutional boundary set and appeal routes.
- Exact production retention periods by jurisdiction/data class.
- Which default dimensions ship enabled versus available.
- Minimum cohort size for Realm aggregate display by threat model.
- Whether a production Sentinel is one service or isolated regional/Realm processes.

These decisions change governance/deployment values, not the object model or runtime contract.