Institutions

An institution is a versioned YAML spec: departments (= hosts), profiles, A2A trust. The architect proposes. The human approves. The gated arm applies. The service never provisions on its own.

Operate views (screenshots)

View	Guide
Template catalog	operar-vistas/catalogo-plantillas
Provisioning	operar-vistas/provisionamiento
Dev (Fresh Reset)	(Dev view only in authenticated internal guide)

Full index: Console — Operate.

Prepare → Approve → Deploy cycle

Canonical flow (not Admin → Approvals):

1. Catalog → ldteam template → Prepare.

2. Pending at gate — stepper with Prepare ✓ and Approve active. Still does not create hosts.
3. Approve → Approved; Deploy appears. Still no containers.
4. Deploy → gated arm applies the spec; institution becomes Active with n/m hosts alive.

What to expect: after deploy, in ~10 s Hosts and Profiles refresh on their own.

If it fails: 403/409 on Deploy → executor M2M scopes (#79).

After Deploy (verification)

1. Catalog — ldteam Active, 1/1 hosts alive.
2. Provisioning — Applied filter.
3. Hosts + Profiles — live inventory.

Retire institution (scoped)

1. Provisioning → Applied filter → Retire institution.
2. Confirm by typing the exact name (e.g. ldteam).

Action	Where	Scope
Retire institution	Provisioning	One institution
Retire on catalog card	Catalog	May be global teardown
Fresh Reset	Dev	Full topology (Primary survives)

CLI (same truth)

society builder deploy-approved --spec <yaml> --yes
society builder provision-profiles --spec <yaml> --yes

The CLI only hands you the command. Detail: runbook 13.

Presets

Operate → Dev → presets → Prepare → approve. The map preset is a historical example. MAP is not an institution in any environment.

What exists today

• IdentIA client install: no institution deployed (institution_specs=0 in ENVIRONMENTS).
• Reference client: ldteam + bufete-abogados.
• Development: whatever you have applied in the working tree.

At bootstrap there is no institution: only the Primary Host (host-1 / society-agents-host) and the architect.