Campus Pack

The Campus Pack (@hellmai/lumenflow-packs-campus) exposes campus-scale compute as governed tool surfaces: read-only facility telemetry and an approval-gated tenant proof-export wedge. It is the pack-side of the campus governance boundary — it proposes observations and serializes proof bundles; it never actuates facility infrastructure, and it never seals a bundle (the cloud applies the cryptographic seal downstream).

Campus Telemetry

Six read-only facility tools — list, node inventory, PUE, power signal, facility energy, and GPU-TEE attestation recording. Every tool requests read permission with a narrow path scope.

Tenant Evidence

Four read-only proof-record tools plus one write tool — proof:export_attested_bundle — gated on the tenant-evidence:export approval.

Published surface

The pack’s tool handlers ship in @hellmai/lumenflow-packs-campus. The contract surface that cloud consumers pin — the event-kind maps, tool-name tuples, tool contracts, and the CanonicalReceipt shape — ships in @hellmai/lumenflow-conductor-sdk and is re-exported from the package root:

import {
  // Campus telemetry (MD1)
  CAMPUS_TELEMETRY_CHANNEL_ID,
  CAMPUS_TELEMETRY_EVENT_KINDS,
  CAMPUS_TELEMETRY_EVENT_KIND_VALUES,
  CAMPUS_TELEMETRY_TOOL_NAMES,
  CAMPUS_TELEMETRY_TOOL_CONTRACTS,
  type CampusEvent,
  type CampusToolContract,
  // Tenant evidence (MD2)
  TENANT_EVIDENCE_CHANNEL_ID,
  TENANT_EVIDENCE_EXPORT_APPROVAL_ID,
  TENANT_EVIDENCE_EVENT_KIND_VALUES,
  TENANT_EVIDENCE_RECORD_KIND_VALUES,
  TENANT_EVIDENCE_TOOL_NAMES,
  TENANT_EVIDENCE_TOOL_CONTRACTS,
  type CanonicalReceipt,
} from '@hellmai/lumenflow-conductor-sdk';

The dual export shape (an event-kind map and an _VALUES tuple exported as const) mirrors software-delivery.ts, so cloud consumers can pin both the named map and the value array — for example to build an exhaustive never-guard or a mirrored Zod enum directly from the source of truth.

Campus telemetry (read-only)

The campus-telemetry pack (INIT-MOONSHOT MD1) is read-only and governance-bounded: it proposes telemetry observations and never actuates facility infrastructure. Every declared tool requests read permission with a narrow path scope (.lumenflow/state/campus/**) — not a broad ** wildcard — so the manifest passes validateDomainPackToolSafety.

Tool	Permission	Reads
`campus:list_facilities`	`read`	All registered campus facilities.
`campus:node_inventory`	`read`	Node / GPU inventory for one facility.
`campus:pue_telemetry`	`read`	PUE (power usage effectiveness) samples.
`campus:power_signal`	`read`	The latest power signal for one facility.
`campus:facility_energy`	`read`	Facility energy windows mapped to EMIT.
`campus:gpu_attestation_record`	`read`	Verifies a GPU-TEE quote and normalizes the receipt (see below).

Every read tool serves the persisted .lumenflow/state/campus tree on disk (ADR-116 decision 2) — facilities/, nodes/, pue/, and power/ subtrees keyed by facility id. An empty or missing tree returns empty results ({ facilities: [] }, { nodes: [] }, and so on); it never falls back to fixture data. The two-facility dataset that shipped as an in-memory fixture through earlier waves survives only as labelled test/contract example data in the pack’s test suite — it is never reachable from production tool execution.

The pack emits six canonical event kinds on the campus-telemetry channel, each carrying the campus: slug prefix:

campus:facility_registered
campus:node_inventory_updated
campus:pue_sampled
campus:power_signal_ingested
campus:facility_energy_recorded
campus:gpu_attestation_recorded (recorded from a verified GPU-TEE attestation)

GPU-TEE attestation recording

campus:gpu_attestation_record (ADR-116 decision 1) calls the kernel’s verifyGpuAttestationQuote before producing any event. It never asserts verified: true without a passing kernel verification: on a failed verification it refuses — returns a ToolOutput error and produces no event — rather than emitting an unverified receipt. On success it normalizes the kernel’s receipt into a campus:gpu_attestation_recorded event carrying compute_assignment_run_id, quote_hash, nonce, verified, and attested_at — the join column that lets a downstream consumer correlate a verified attestation to a specific compute-assignment run. Like campus:facility_energy, it is read permission: the tool computes and returns a normalized event, it does not perform the write itself.

lumenflow-cloud INIT-231 (Met Office Exeter campus readiness, WU-3278) is the downstream consumer of this join column: it ingests campus:gpu_attestation_recorded events keyed on compute_assignment_run_id to attribute verified GPU-TEE evidence to a specific run instead of storing an unlinked, self-asserted verified flag.

Facility energy telemetry

campus:facility_energy normalizes operator-provided facility meter windows into the shared EMIT joules meter contract, and (WU-3748) also constructs the campus-telemetry campus:facility_energy_recorded envelope declared in the pack manifest’s emitted_event_kinds. It accepts PDU, IPMI, Redfish, and smart_meter source labels, plus optional PUE, grid carbon intensity, price, curtailment-window metadata, and an optional compute_assignment_run_id when a facility window can be correlated to a specific compute assignment.

const output = await facilityEnergyTool({
  workspace_id: 'ws-campus-energy',
  facility_id: 'campus-fac-001',
  event_id: 'evt-campus-energy-smart-meter',
  seq: 10,
  timestamp: '2026-06-13T16:00:00.000Z',
  valid_from: '2026-06-13T15:45:00.000Z',
  valid_to: '2026-06-13T16:00:00.000Z',
  region: 'eu-west-1',
  source: 'facility_meter:utility-smart-meter-a',
  quantity_joules: 982000,
  energy_source: 'smart_meter',
  energy_provenance: 'measured',
});

const emitEvent = output.data.energy_meter_event;
emitEvent.kind; // 'emit:energy_meter_recorded'
emitEvent.unit; // 'joules'

const campusEvent = output.data.facility_energy_recorded_event;
campusEvent.kind; // 'campus:facility_energy_recorded'
campusEvent.channel_id; // 'campus-telemetry'
campusEvent.energy_meter_event_id; // links back to the EMIT event's event_id

Both events are produced from one call — the campus envelope is additive (ADR-023 additive-versioning discipline), so existing consumers reading only energy_meter_event are unaffected.

Facility energy remains a Campus Pack extension, not a separate Energy Pack. The Campus Pack owns facility-grain observations; connected compute owns run-grain IT-load meters. Both surfaces emit the same shared EMIT event shape so cloud can attribute joules without any pack owning billing, carbon conversion, or proof composition.

For the shared event shape, measured/modelled provenance tiers, pue_applied double-counting guard, and sensor/coefficient references, see EMIT Energy Telemetry.

Tenant evidence (proof export)

The tenant-evidence pack (INIT-MOONSHOT MD2) is the sellable wedge: LumenFlow serializes a CanonicalReceipt for a tenant’s proof bundle; LumenFlow Cloud applies the cryptographic seal. No sealing happens in the pack — the receipt it produces deliberately carries no seal / signature field. content_digest is a plain content reference the cloud sealer binds its signature to; it is not itself a signature.

The four proof:*_record tools are read-only. The single proof:export_attested_bundle tool is the one write surface, and it is gated on the tenant-evidence:export approval so a bundle export always traces to an explicit operator decision (refuse-over-fallback: the call is refused unless the caller passes that approval in input.approvals).

Tool	Permission	Required approval
`proof:checkpoint_record`	`read`	—
`proof:gate_record`	`read`	—
`proof:approval_record`	`read`	—
`proof:attestation_record`	`read`	—
`proof:export_attested_bundle`	`write`	`tenant-evidence:export`

The read tools scope to, and serve, .lumenflow/state/campus/evidence/** — one evidence/<wu_id>.json document per WU, containing wu_id, tenant_id, and its records array. An empty or missing evidence tree returns a contextual “unknown WU” error, never fixture proof records. The export tool’s write scope is narrowed to the exports subtree (.lumenflow/state/campus/evidence/exports/**) so the write permission cannot reach the whole evidence tree.

Compute resolution (campus governance policy)

The capability-tier resolver (INIT-MOONSHOT MD4) routes a workload to a peer descriptor under campus governance. The port contract and descriptor vocabulary ship in @hellmai/lumenflow-runtime, alongside the concrete ComputeResolver:

import {
  type ComputeResolveRequest,
  type ComputeResolveResult,
  type ComputeResolverPolicy,
  type IComputeResolver,
  type PeerDescriptor,
  PeerDescriptorSchema,
  PEER_DESCRIPTOR_KINDS, // ['runner-node', 'campus-node']
  ComputeResolver,
} from '@hellmai/lumenflow-runtime';

peerDescriptor.kind adds campus-node as a first-class target: a compute node subject to campus governance, alongside the general-purpose runner-node. Every descriptor label (capability_tier, provider_family, campus_affinity) is an opaque, semantic identifier — no vendor brand string appears in the published type or its enums.

Resolution is refuse-over-fallback. A ComputeResolveResult is a discriminated union:

resolved — a clean resolution to a target descriptor.
refused — the safe default: no candidate satisfies the policy and no opt-out permits a relaxation. Carries a human-readable reason.
permitted-with-warning — a same-family reviewer permitted under the allow_same_family_reviewer opt-out, carrying an audit_warning naming the relaxed constraint, the family involved, and that an operator decision enabled it.

ComputeResolverPolicy.allow_same_family_reviewer is the single, narrow opt-out to the refuse posture, and it is default-off. When omitted or false, the resolver refuses if only a same-family reviewer exists.

Governance invariants

The campus pack enforces the three load-bearing invariants of the campus governance boundary:

Proposes, never actuates. The pack emits telemetry observations and serializes proof bundles. No campus capability actuates physical power.
Vendor-name-free. All published types reason in opaque, semantic labels (capability_tier, provider_family, data_egress_class, campus_affinity). No vendor brand string appears in a published type or in branch logic.
Refuse over fallback. The export tool refuses without the tenant-evidence:export approval; the resolver refuses rather than silently downgrading. The only relaxation is the default-off, audited allow_same_family_reviewer opt-out.