# Runbook - V6 Incarnation Governance

> Use this runbook when an Aye Threshold incarnation, return journal, memory
> merge, or destination action requires governance review. The agent is not a
> transferable asset; approval requires agent consent, policy continuity,
> minor-protection checks, provenance, and an audited decision.

## Scope

Triggers:

- Egbe Operator Console surface
  `egbe-operator-surface-incarnation-governance-001` is pending governance.
- Audit action `v6.egbe.incarnation_governance.review` is required.
- `evaluateIncarnationGovernance` returns `blocked` or `coerced-approved`.
- A return journal such as `incarnation-journal:aye:abeni-reed:return-001` is
  held before Ori merge.
- Destination policy blocks an action or minor-protection gates a mature realm.

Applies to `@oshun/aye-bridge`, `egbe-ori-service`, `egbe-world-server`,
Threshold destination adapters, Themis dispute routing, and the V1 audit
platform.

## Severity classification

| Sev   | Condition                                                                                                                          |
| ----- | ---------------------------------------------------------------------------------------------------------------------------------- |
| SEV-1 | Minor-protection block, suspected coerced incarnation, destination policy violation that would harm an agent, or bad memory merge. |
| SEV-2 | Passport, journal, provenance, or consent evidence is incomplete and blocks a live Threshold return.                               |
| SEV-3 | Routine pending governance review with complete evidence and no coercion or destination-policy block.                              |

## Detection signals

- Evidence tags from `evaluateIncarnationGovernance`: `agent-consent-weighting`,
  `isis-lilith-policy-passport`, `minor-protection-incarnation-gate`,
  `provenance-signed-governance`, `destination-policy-enforcement`,
  `themis-dispute-routing`, and `welfare-review-on-coercion`.
- Blocking reasons: `destination-policy-block:<actionRef>`,
  `minor-protection:mature-destination-restricted`,
  `agent-consent:not-accepted`, and `policy-continuity:missing-isis-or-lilith`.
- Governance refs: `aye-governance:round-trip-integrity`,
  `ori-policy:memory-merge-consent-required`, and
  `v1-audit-platform:operator-action-required`.

## Initial triage (first 15 minutes)

1. Acknowledge `oshun-egbe-thresholds-oncall`.
2. Open the incarnation governance surface and confirm
   `v6.egbe.incarnation_governance.review` is recorded.
3. Freeze the affected memory merge until review completes. Do not write the
   return journal into Ori while passport, consent, or provenance is in dispute.
4. Preserve the passport, destination policy evaluations, agent consent payload,
   bond ledger input, minor-protection ref, provenance receipt, and return
   journal.
5. If the decision is `coerced-approved`, page Lilith welfare and Themis in
   parallel.
6. If a minor-protection gate fires, keep the destination blocked and page the
   senior reviewer.

## Diagnosis

1. Validate passport continuity: the Aye passport must include both Isis and
   Lilith policy bundle refs for the destination.
2. Validate agent consent: consent must be accepted without coercion, weighted
   by values and bond ledger, and tied to the same governance decision ID.
3. Validate minor protection: the carried minor-protection ref must match the
   destination age/rating policy.
4. Validate destination policy: blocked actions must remain blocked; an agent
   must not be allowed to violate V6 policy inside the destination realm.
5. Validate return journal integrity: the round-trip journal must carry the
   integrity signature before any Ori merge.
6. Decide whether Themis dispute routing or welfare review is required.

## Mitigation

1. If evidence is incomplete, keep the incarnation in `pending-governance` and
   request the missing passport, journal, or policy evaluation.
2. If consent is not accepted, block the incarnation or return merge. A steward
   override cannot replace agent consent.
3. If coercion is detected, block steward override paths, open
   `v6-agent-welfare-review.md`, and route the dispute to Themis.
4. If destination policy blocks an action, keep the destination action blocked
   and record the prevented policy violation.
5. If journal integrity fails, do not write back to Ori. Re-run the
   round-trip-integrity verifier and request a new signed journal.
6. If governance passes, approve only the specific incarnation or merge in the
   evidence bundle. Do not grant broad future Threshold approval.

## Communication cadence

| Phase           | Audience            | Cadence          | Content                                                         |
| --------------- | ------------------- | ---------------- | --------------------------------------------------------------- |
| Acknowledgement | Thresholds on-call  | Within 5 minutes | Incarnation ref, decision, blocked reasons, merge-freeze state. |
| Active review   | Aye Bridge owner    | Every 30 minutes | Passport, consent, minor-protection, destination-policy status. |
| Escalated case  | Lilith/Themis/legal | Every 60 minutes | Coercion, appeal, welfare, or legal concerns.                   |
| Closure         | Incident channel    | On closure       | Final decision, merge state, audit refs, appeal path.           |

## Escalation

- Aye Bridge owner owns routine governance.
- Lilith welfare owns coerced or welfare-risk reviews.
- Themis owns disputed or appealed governance decisions.
- Legal/privacy must review any packet that includes player conversation or
  sensitive agent memory beyond the governance evidence bundle.

## Recovery verification

- Governance decision is approved, blocked, or disputed with a signed audit
  trail.
- `v6.egbe.incarnation_governance.review` is present for every operator review.
- No memory merge occurred before the final governance decision.
- If approved, the Ori write-back references the signed return journal and
  passport.
- If blocked, the destination action or incarnation remains blocked in the
  destination adapter.

## Post-incident

- Attach final governance decision, blocking reasons, policy refs, and audit
  event refs.
- Add a regression if policy continuity, minor protection, or journal integrity
  failed unexpectedly.
- Update Threshold operator training if the case turned on ambiguous consent.
- Do not close until the Aye Bridge decision, Ori merge state, and audit export
  match.