14. Kernel records, schema registry, validation, storage, and APIs
valid_time states when the record applies in the world; recorded_at states when RTracer learned it
Concept & directionLNK
Closed kernel, open registered semantics
Durable identity + typed append-only records + immutable configuration graphs + composable domain packs. The kernel stays small; vocabularies and payload schemas grow without data loss.#14.1 Small universal kernel
| Kernel object | Purpose |
|---|---|
| EntityRoot | Opaque durable identity and root kind |
| DesignDefinition | Controlled design, model, revision, variant and intended characteristics |
| IdentifierAssertion | VIN, serial, plate, MAC, transponder, registration, call sign and other sourced identifiers |
| FacetAssertion | Attributed, scoped and time-bounded classification fact |
| RelationshipAssertion | Typed role, custody, composition, control, coupling, rights or semantic relationship |
| TypedRecordEnvelope | Common immutable wrapper for every event, claim, observation, state, grant and receipt |
| EvidenceArtifact | Content-addressed photo, document, video, scan, signature or raw dataset |
| ConfigurationSnapshot | Immutable exact build and active graphs |
| CapabilityRealization | Function available under configuration and envelope |
| Operation / Mission | Bounded use with configuration, control regime, environment and outcome |
| AuthorityGrant | Scoped, revocable permission from a principal |
| ActionReceipt | Request, authority, execution and result for consequential action |
| VocabularyTerm | Stable namespaced semantic concept |
| SchemaDefinition | Immutable versioned payload or graph contract |
| DomainPackManifest | Signed package of vocabularies, schemas, constraints, mappings and fixtures |
#14.2 Typed append-only record envelope
Illustrative canonical record envelope
{
"record_id": "rec_...",
"record_type": "rtracer.modification.embodied/v2",
"schema_ref": "schema:rtracer.modification.embodied:2.1.0",
"subjects": [{"entity_ref": "asset_...", "role": "modified_asset"}],
"valid_time": {"from": "2026-07-21T10:00:00Z", "to": "2026-07-21T13:00:00Z"},
"recorded_at": "2026-07-21T13:08:12Z",
"actor_ref": "party_...",
"configuration_before": "cfg_...",
"configuration_after": "cfg_...",
"payload": {},
"evidence_refs": ["evidence_..."],
"authority_ref": "grant_...",
"visibility_policy_ref": "policy_...",
"integrity": {"digest": "...", "signature_ref": "..."},
"supersedes": [], "retracts": []
}- valid_time states when the record applies in the world; recorded_at states when RTracer learned it
- records are immutable; correction uses supersedes, corrects or retracts and preserves the previous statement
- contradictory claims can coexist; a current view declares a trust policy rather than overwriting history
- important operations reference exact before/after or as-operated configurations and evidence
#14.3 Missing and disputed knowledge
Never let null carry domain meaning. Use explicit states: known, unknown, not_observed, not_measured, unavailable, withheld, redacted, disputed, not_applicable, unsupported_by_current_client and pending_resolution. Preserve the source precision and original vocabulary even when the current application cannot interpret it.
#14.4 Vocabulary and schema registry
| Registry field | Rule |
|---|---|
| Stable ID | Namespaced URI/identifier never repurposed after publication |
| Semantic metadata | Definition, preferred labels, synonyms, language, broader/narrower/equivalent concepts and examples |
| Version | Immutable publication, semantic version, content digest, publisher signature and compatibility declaration |
| Dependencies | Deterministic graph with lock file per configuration/pack set |
| Deprecation | Replacement/mapping and change note; historical records retain original term |
| Migration | Registered adapter plus receipt, information-loss declaration and round-trip fixtures |
| Governance | Owner, reviewers, license, security/privacy annotations and appeal process |
| Promotion | Private/manufacturer term may map into shared vocabulary without rewriting history |
#14.5 Validation layers
| Layer | Check |
|---|---|
| Structural | Payload conforms to declared immutable schema |
| Registry | Schema, term, pack and dependency references resolve |
| Referential | Entities, records, configurations and artifacts exist or are explicitly pending |
| Dimensional | Quantity kinds, units, vectors, frames, ports and flows are compatible |
| Graph | Composition, connectivity, cardinality, topology and cycle rules hold |
| Temporal | Installation, coupling, state, handover and effectivity intervals are coherent |
| Configuration | Snapshot is immutable, complete to its declared resolution and content-hashed |
| Domain | Pack-specific safety, geometry, mass, software, maintenance and approval constraints |
| Integrity | Digest, signature, capture chain and custody checks succeed |
| Authority | Actor may assert, publish, configure or act within a current grant |
| Privacy | Requested projection/export is allowed; precise location and sensitive identifiers fail private |
Validation disposition should be accept, accept-with-warning, quarantine or reject. Contradictory but structurally valid claims are generally retained; corrupt records or unauthorized effects are quarantined or rejected.
#14.6 Storage boundaries
| Logical store | Responsibility |
|---|---|
| Append-only record ledger | Claims, events, observations, grants, receipts and corrections |
| Entity + graph index | Resolution, traversal, search and current/as-of projections |
| Configuration store | Immutable content-addressed configuration graphs and diffs |
| Evidence store | Encrypted/content-addressed documents, photos, scans, signatures and rights metadata |
| Telemetry store | High-volume time series and raw sensor/media chunks |
| Registry | Schemas, vocabularies, domain packs, mappings, signatures and fixtures |
| Policy + grants | Rights, scopes, privacy, consent, delegation and revocation |
| Projection cache | Rebuildable public profile, maintenance, market, race and regulatory views |
Raw telemetry belongs outside the lifecycle ledger. The ledger retains channel schemas, sensor/calibration references, time range, digest, quality summary, configuration/control context and artifact location. This keeps history verifiable without turning the event log into a media or time-series database.
#14.7 API and export surface
- entity resolution, identifier assertion and time-aware relationship traversal
- append-only record submission, idempotency, correction, dispute and evidence attachment
- configuration create/diff/retrieve and as-of/as-operated queries
- facet search, TypeRecipe matching, explanation and domain-pack discovery
- capability discovery, operating-envelope query and control-assignment history
- action proposal, grant evaluation, approval, execution and receipt
- policy-filtered public/private/regulatory/maintenance/market projection
- portable dossier export containing records, schema/vocabulary locks, configurations, evidence manifest, signatures and rights notes
- canonical JSON for exchange/signing; JSON-LD or equivalent semantic export; binary edge format; columnar analytics export