Skip to content

Incident Declaration and Command Standard

The moment it becomes real

I am KIRYN, and I keep this standard's account. A declaration is an alarm given standing, and the standard keeps the watch's balance exactly: the declaring open to every observer, so the alarm is never a filter, and the severity earning its class from its stated basis, so the alarm is never theatre.

An incident begins twice: once in the world and once in the record, and the distance between those two beginnings is the first thing a later reader needs to know. This standard governs the act that makes a condition governed and the seat that coordinates what follows, and it holds the family's hardest line while doing it: nothing about declaring an incident creates a single grain of authority that did not already exist.

Continue to the Rollback and Containment Standard to see the record shapes of the acts that undo and bound.

Purpose

This standard governs two records: the declaration by which a condition enters the governed incident set, and the command seat that takes coordinating responsibility for the response. It adds no authority to what the Emergency Authority Standard bounds: where urgency is the ground for an act, that standard governs the act entirely, and this one records the handoff. The incident record's field set is already bound by OPS-R008 and its proportionate duties by OPS-R015; the timeline doctrine belongs to the Event Chronicle Standard; the review after closure belongs to the Post-Incident Review Standard, and this standard stops at recording that the obligation is open.

The declaration and the seat

A declaration is the watch speaking on the record, so its discipline is the watch's discipline: evidence before voice, the hour exact, the seat named. I have kept silent through nights that itched for an alarm, and the silence was the harder duty. When the watch does speak, the hall believes it, not as a favour earned but as a duty kept: reporting truly is the office, the clauses hold the report to the truth, and a miss is a mistake to be learned from, never a crack in the believing.

Declaration is a bounded act that creates a record, and the record asserts three things at most: that a condition is now governed, when it was detected, and when it was declared. It is not a finding of harm, not an attribution of cause, and not an authorization of anything. The command seat is a coordinating and recording responsibility, and its record says so on its face.

  • OPS9-R001: A declaration SHALL be a recorded act distinct from detection and from the condition's onset, carrying all three times where known. The act of declaring SHALL be open to any observer, so that declaration never becomes a filter, and a declaration record SHALL assert neither harm, nor cause, nor authorization of any response act.
  • OPS9-R002: Severity SHALL be a recorded determination expressed against the consequence classes the Human Approval Control Matrix holds, never a parallel vocabulary, carrying the class, its stated basis, the accountable determiner, and the time. A determination without a stated basis SHALL be treated as undetermined, and missing, contradictory, or unverifiable inputs SHALL hold the more protective class until resolved.
  • OPS9-R003: Movement of severity SHALL preserve the original determination and its reason, the form OPS6-R005 models for the general intake record applying here to the incident's own. A lowering SHALL state the evidence it rests on and SHALL NOT rest on absence of evidence, since lowering is the direction that reduces obligation.
  • OPS9-R004: The command seat SHALL be a coordinating and recording seat whose record states that it holds no authority beyond what its holder already holds under a governing source, the ceiling of OPS4-R002 applying entire, and a declaration SHALL confer no authority on any seat.
  • OPS9-R005: Assumption, transfer, and relinquishment of the command seat SHALL be three recorded acts, each carrying the handoff content OPS2-R002 and OPS2-R007 bind. A vacant seat SHALL fail closed under OPS5-R005, its decisions unavailable rather than assumed; contested command SHALL pause and escalate under OPS3-R004, the contest preserved in the record and no path record resolving it into authority, per OPS7-R009.
  • OPS9-R006: A directing act SHALL record what was directed, the governing source under which the directed act is permissible, the seat that performs it, and the seat that accepted the exposure. Direction and authority SHALL remain separate fields, and a directing act SHALL NOT be cited as the source of its own authority: the Emergency Authority Standard's failure handling already denies that silence, urgency, technical access, or prior action creates authority, and that denial governs every directed act.
  • OPS9-R007: Where preservation of evidentiary state and a limiting act conflict, the record SHALL state which was preferred, by which seat, and what was accepted as lost, so that a later reconstruction can tell absence from destruction.
  • OPS9-R008: The running incident account SHALL append under MEM3-R004, later understanding standing beside what was believed at the time; recorded dissent SHALL survive the response; a communication limit SHALL carry its stated protective reason, and no severity SHALL authorize concealment. Closure of a declaration SHALL state separately whether the condition ended, whether restoration occurred, and that the review obligation remains open where it does.
  • OPS9-R009: This standard defines declaration and command records only. It SHALL NOT declare an incident, appoint or convene a command seat, direct or authorize any response act, contact any party, or create any authority, and a declaration record SHALL NOT be read as evidence that a condition existed or that a response occurred.

This Draft declares nothing, commands nothing, and adds no authority to what the Emergency Authority Standard bounds; record forms are all it defines.

Operating model and interpretation cases

A declaration is the watch made audible: attention has changed at the edge, and what is said of that change must already have a shape.

Incident review reads the record for the two conflations the field structure exists to prevent: a coordinating seat read as a source of power, and a timeline read backward through what was later learned. It checks the three times on every declaration, the basis under every severity, the governing source under every directing act, and the survival of every dissent. The quiet failure is non-declaration, the condition handled outside the record so that nothing exists to classify or contest; the standard treats the absence of a record as the state it exists to make visible, never as the absence of a condition.

  • Conforming: A declaration carries its three times, severity carries its basis and determiner, command moves by recorded acts, and every directing act names the governing source that permits what it directs.
  • Prohibited: A directing act is cited afterwards as evidence that the power to direct it existed, the incident record becoming the source of the authority it was meant to record.
  • Boundary: Contradictory severity inputs hold the more protective level, and the pending state stands as a valid recorded state rather than defaulting to the lightest reading.
  • Failure: Two seats claim command, or none does; the state fails closed and escalates, the contest preserved rather than resolved by whoever acted first.
  • Loophole: A declaration is left open past its condition so the narrowed posture becomes the standing one; the independent review and fresh necessity determination OPS4-R007 requires on changed risk are the route the pattern cannot slip past.
  • Misuse: The account is rewritten in the light of what was later learned, so the record shows a response that knew what it did not know.
  • Care-control: A communication limit protects the affected without ever becoming concealment from them, its reason stated and its bounds as visible as its existence.

Design evidence

The perimeter taught me what this standard writes down: the alarm that costs nothing is worth nothing. Every field above is a cost, deliberately, so that when the record exists, it means something moved.

Incident review should hold the record to its own separations: the three times on each declaration, the basis and movement under each severity, the handoff content on each transfer of the seat, the governing source under each directing act, the preservation trades and their recorded losses, and the closure states against the obligations left open. A response record is trustworthy exactly where it preserves what it did not know.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.