Governance

Who will act at ESM, and the trust shape that will gate it. First cut.

Governance at ESM follows the same model as the other NSLS-II beamlines: people and autonomous agents are facility principals at the NSLS-II Site, and on the beamline they surface through the actions they take. Their commands are gated by a trust shape (a Zone grouping the beamline's resources, a Conduit binding the surfaces that may issue commands, and Policies that say who may do what).

ESM is not yet driven by CORA, so this shape is not yet instantiated. The profile collection exposes only coarse queue-server groups, not the human roster, so the NSLS-II operator and review structure is carried pending on the NSLS-II Site (GOV-1).

What is already settled is the boundary: clearances (the safety forms that must be active to start) are issued at the NSLS-II Site, not on the beamline, and the beamline links up to them. ESM carries the soft X-ray hazard classes (ultra-high vacuum and the cryostat's cryogens at the ARPES endstation) that an experiment Clearance would carry; those land with the instruments that bring them.

The concrete Zone, Conduit, and Policy instances, and the operator pool, land when the deployment approaches the point where CORA drives ESM, following the 2-BM governance shape.