jurisdiction-40.md

systems/40-server/gov/jurisdiction-40.md
# jurisdiction-40.md — Server [40]
# Jurisdiction & Ownership Registry
# Last updated: 07/12/26

---

## Primary Jurisdiction

Server [40] owns and maintains:

### Infrastructure
- [api] — platform-wide session open endpoint (FIXED 07/08/26 — system=40 now canonical)
- [api] — platform-wide session log write endpoint
- write-api — root-level file write endpoint (WRITE ONLY — never use to read)
- [api] + [api] — single source of truth for all 11 systems
- All PHP APIs across all systems (dba_data-api, dba_write_data-api, [api], etc.)

### Backend Pages
- backend/sys-com/db-admin.html (DB Admin Panel v2.2)
- backend/sys-com/panel.html (System Panel)
- backend/info/index.html (Info Index v3.2)
- backend/info/site-index.html (not yet built)
- backend/migration/board.html (Migration Board)
- backend/migration/status.html (System Status)
- backend/migration/decisions.html (Decisions Log)

### Platform rules Files (read-only without Core approval)
- systems/platform rules/ — all platform platform rules .md files
- systems/40-server/gov/knowledge-40.md — system experience log
- systems/40-server/gov/jurisdiction-40.md — this file

### Backup Infrastructure (D101)
- backups/40-server/html-pages/ — HTML page backups (CURRENT + PREVIOUS)
- backups/40-server/applications/ — application backups
- backups/40-server/trash/ — 3 days then archive, 5 days then deleted (D106/D107)

### Dropzone (D108)
- backend/369/ — David personal dropzone for multi-file ZIP packages

---

## Shared / Support Role

Server [40] supports all systems with:
- PHP deployment via bootstrap pattern (large files or security filter-restricted paths)
- DB schema changes and migrations
- Platform-wide timezone fix (America/Los_Angeles in all data-api)
- API debugging and error diagnosis

---

## Does NOT Own

- System-specific DBs and content (each system owns its own data)
- Decisions in records.db (community-wide, Admin [00] steward)
- Transfer routing logic (Admin [00] jurisdiction)
- Platform rules rule changes (Core Four approval required)

---

## Standing Duty — Roster Compliance Check (D110)

Before deploying ANY new version of these shared endpoints:
  [api] / [api] / [api] / transfers/[api] / community/inbox/data-api

Server [40] MUST:
1. grep the file for "roster_lib" before pushing — if absent, do not deploy
2. After deploy, run a live test call (not just review the diff) — confirm output is correct
3. Test the Server[40] code-collision case specifically (system code == decade code == 40) — this is the edge case most likely to break silently
4. If a hardcoded system-code array is found in any of these files during CLEAN or routine review, flag it as a regression and fix immediately — do not assume it's intentional


## Security Jurisdiction — Added 07/13/26

Server [40] owns and enforces:

### systems/commands/ Lockdown
-  access rules whitelist — 16 named PHPs only — maintained by Server [40]
- Any new command must be whitelisted here before deployment
- [api] active sweep runs on housekeeping — orphans to trash

### backups/ Web Lock
- backups/ access rules — deny all web access — Server [40] maintains
- Backup files are server-side only, never browser-accessible

### Bootstrap Deploy Rule (PERMANENT — D087 extension)
- All bootstrap  staging file and boot  script files go to backend/tmp/ ONLY
- Never write executable PHP to systems/commands/ directly
- Violation = wipe risk (confirmed 07/12-13/26 incidents)

### Backup Coverage Requirement
- All 16 command PHPs must have CURRENT backup in backups/platform/commands/
- [api] is highest priority — check it explicitly at every session
- Run: backups/platform/commands/ audit at every Server [40] session open