Governance

Who will act at P09, and the trust shape that will gate it. First cut.

Governance at P09 follows the same model as the rest of the fleet: people and autonomous agents are facility principals at the PETRA III Site, and on the beamline they surface through the actions they take. Their commands are gated by a trust shape (a Zone grouping the beamline's resources, a Conduit binding the surfaces that may issue commands, and Policies that say who may do what).

P09 is CORA's seventh PETRA III beamline: the DESY operator pool and the safety-review structure are carried pending on the PETRA III Site, shared across the facility's beamlines, until DESY staff confirm them (GOV-1). P09 is a reverse-engineered scaffold rather than a pilot, so the concrete Zone, Conduit, and Policy instances are deliberately not materialized; they land when the deployment approaches the point where CORA drives P09, following the 2-BM governance shape.

The safety tier is the other piece that is not yet settled. The OnlineXML carries beamline devices, not the personnel-safety interlock leaves, so the Enclosure permit signals (across the three areas) and the interlock structure are carried pending and are not invented here (PSS-1). What is already settled is the boundary: clearances (the safety forms that must be active to start) are issued at the PETRA III Site, not on the beamline, and the beamline links up to them.

P09 also carries the hazard classes that come with a high-field magnetism endstation: a 14 T superconducting magnet and its liquid-helium cryogen, a stored-energy and field hazard that gates access to the MAG endstation. Those land with the instruments that bring them when the deployment firms up; the magnet is modelled as a sample-environment Magnet Asset, not a beam-steering device CORA drives.

The concrete Zone, Conduit, and Policy instances, and the operator pool, land when the deployment approaches the point where CORA drives P09, following the 2-BM governance shape.