Governance

Who will act at IXS, and the trust shape that will gate it. First cut.

Governance at IXS follows the same model as the other NSLS-II beamlines: people and autonomous agents are facility principals at the NSLS-II Site, and on the beamline they surface through the actions they take. Their commands are gated by a trust shape (a Zone grouping the beamline's resources, a Conduit binding the surfaces that may issue commands, and Policies that say who may do what).

IXS is not yet driven by CORA, so this shape is not yet instantiated. As a modelling-exercise scaffold, the deployment is descriptor and docs today, so the concrete Zone, Conduit, and Policy instances are deliberately not materialized. The profile collection exposes only coarse queue-server groups, not the human roster, so the NSLS-II operator and review structure is carried pending on the NSLS-II Site, shared with the rest of the fleet (GOV-1).

The safety tier is the other piece that is not yet settled. The PSS search-and-secure permit signals and the front-end and photon shutters are absent from the beamline's profile collection, so the Enclosure permit leaves and the interlock structure are carried pending and are not invented here (PSS-1). What is already settled is the boundary: clearances (the safety forms that must be active to start) are issued at the NSLS-II Site, not on the beamline, and the beamline links up to them. IXS adds the hazard classes that come with a hard X-ray endstation under vacuum and a temperature-stabilized crystal analyzer; those land with the instruments that bring them, and an experiment Clearance would carry them.

The concrete Zone, Conduit, and Policy instances, and the operator pool, land when the deployment approaches the point where CORA drives IXS, following the 2-BM governance shape.