An owner and an agent work in one store.

Roles

Isolate the authority, not the work

Copying the work into separate clones forced every change through several git crossings. What has to be kept apart is who signs as whom and who publishes. iter separates who works, who decides, who accepts and who publishes:

The declaration

What holds for every user of the store travels with it

jj keeps its per-repository config in each user's directory, not in the repository. So the policy is declared in the repository, in iter.ncl and allowed_signers, held to schema/declaration.ncl, and each user applies it with iter setup:

• Read from the published trunk. setup reads main@origin, never a working copy or the local bookmark: anyone who writes in a shared store could move either, and the agent could add itself as a trusted signer. The remote's URL is pinned on first use and the commit is checked against the forge.
• sign_on_push is always false. A shared store always mixes authors, and signing on push would rewrite another author's commits. Each author signs their own change when describing it; publishing refuses what is unsigned.
• workspace_root is where users' workspaces open: <root>/.iter-ws/<store>/<name>, declared once, here.

A change, end to end

Nobody runs a synchronisation step

1. Open

   iter workspace <name> <store> --root <dir> colocates a plain git repository first if needed, opens the user's workspace and links its .claude and .coder to the project's.

2. Work and finish

   jj snapshots the folder; there is no staging, no commit and no push. Finishing is jj describe and jj new: the change, signed by its author, stops being the working copy.

3. See

   iter status computes, from the store, each unpublished change's workspace, author, state, signature, collisions with other sessions and the next act. Nobody reports it, so it cannot fall behind.

4. Accept

   iter accept <change> brings the change into the trunk only when every commit is signed by its author, the contracts covering what it touches are paid on its own tree, and every crossing is under a verified verdict. It puts an accept commit by the caller on top and moves the bookmark: the agent's commit is never rewritten, so its signature survives.

5. Publish

   iter publish, run by the integration identity, judges everything between the published trunk and the local bookmark as accept does, requires the bookmark to descend from what was published, and pays the contracts due at publish time: a red one leaves the forge's trunk where it was.

The owner's signature appears only at accept, and only when the class of the change requires it.

Commands

The operations of work, each idempotent or judged

Principles

What holds in a shared store

Boundaries

What iter is not

ontoref Gov

Seven projects, one domain: how a project governed by ontoref governs itself.

What it is

Gov is ontoref's own domain. It holds the arrangement — what a project's boundary declares, its members, which artefacts a consumer inherits — and the exercise — what work is committed and how an act is delivered. Its name is the root of governance, governability and government, and elects none of them.

Why

A decision, a boundary or a delivery that lives only in someone's memory binds no one. In Gov each one is a declaration a project can be held to, and what holds it is a mechanism, not a good intention.

What for

A project reaches Gov by bond, never by imposition, and takes only the parts it needs. Each of the seven carries one: the contract, the host boundary, the operations of work, the signature, the dossier, the observed session and the opening by name.

More about ontoref Gov →

Part of the same system