Appendicesnormative v1.4.0bundle v1.4.117 blocks

Appendix D. Reference persistence contracts and canonical examples

This appendix is an executable design sketch, not a mandate for one database product. Types and indexes may differ by deployment, but the invariants, separation of semantic meaning from admission metadata, and replay behavior are normative for the…

Concept & directionLNK

#D1. Minimal relational ledger skeleton

Table

Reference SQL - compact v1.4 ledger skeleton
CREATE TABLE entity_root (
  tenant_id uuid, entity_id uuid, entity_kind text, created_record_id uuid,
  PRIMARY KEY(tenant_id,entity_id));

CREATE TABLE stream_head (
  tenant_id uuid, stream_id uuid, logical_shard_id text,
  last_stream_seq bigint, last_record_digest bytea, writer_epoch bigint,
  PRIMARY KEY(tenant_id,stream_id));

CREATE TABLE shard_head (
  ledger_id uuid, tenant_id uuid, logical_shard_id text, chain_epoch bigint,
  last_commit_sequence bigint, last_receipt_digest bytea, publisher_epoch bigint,
  shard_map_version text,
  PRIMARY KEY(ledger_id,tenant_id,logical_shard_id,chain_epoch));

CREATE TABLE record_ledger (
  ledger_id uuid, tenant_id uuid, logical_shard_id text, chain_epoch bigint,
  commit_sequence bigint, stream_id uuid, stream_sequence bigint,
  record_id uuid, canonical_bytes bytea, record_digest bytea,
  PRIMARY KEY(ledger_id,tenant_id,logical_shard_id,chain_epoch,commit_sequence),
  UNIQUE(tenant_id,record_id), UNIQUE(tenant_id,stream_id,stream_sequence));

CREATE TABLE idempotency_binding (
  tenant_id uuid, principal_id uuid, operation_family text,
  idempotency_key text, request_digest bytea, receipt_id uuid, status text,
  PRIMARY KEY(tenant_id,principal_id,operation_family,idempotency_key));

Outbox and projection checkpoints share the contiguous commit prefix.
Section 34 and Appendix O are normative for complete columns and constraints.

Canonical bytes are retained exactly as digested; parsed convenience columns are indexes, never an alternate source of meaning.
Foreign keys may be deferred or represented as typed unresolved references because evidence can arrive before the referenced entity is known.
Proofs, subjects, relations, artifacts and receipts use child tables keyed by immutable record or receipt IDs; they never overwrite RecordCore.
Tenant sequence allocation and stream-head advance occur in the same transaction as the ledger/outbox insert.

#D2. Four distinct signed and operational objects

Table

Semantic, cryptographic, admission and projection separation
RecordCore {                         ProofRecord {
  recordId, recordType, schemaRef,       proofId, recordId, recordDigest,
  subjectRefs[], validTime?, body        proofPurpose, verificationMethod,
}                                         createdAt, signatureBytes
                                        }

IngestReceipt {                       ProjectionReceipt {
  receiptId, recordId, tenantId,        projectionId, projectionVersion,
  receivedAt, recordedAt, ledgerSeq,    inputLedgerRange, inputDigests[],
  streamId, streamSeq, writerEpoch,      policy/schema/packLock,
  canonicalDigest, priorDigests[],       outputDigest, checkpoint,
  policyDecisionId, idempotencyBinding   generatedAt, derivationFindings[]
}                                      }

Signature target = canonical RecordCore bytes or a named manifest digest.
Operational receipt fields are never inserted into RecordCore after signing.

#D3. Configuration snapshot and diff

Table

Exact build state and explicit change
ConfigurationSnapshot {
  configurationId: "urn:rtracer:configuration:kun:2026-07-22T10:00Z",
  assetId: "urn:rtracer:entity:kun",
  validInterval: {from: "2026-07-22T10:00:00Z"},
  itemInstances: ["...engine", "...gearbox", "...rear-axle", "...tracker"],
  portInstances: ["...engine.output", "...gearbox.input", "...tracker.can"],
  connections: [{fromPort: "...engine.output", toPort: "...gearbox.input",
                 medium: "mechanicalRotation", state: "connected"}],
  softwareSet: [{component: "...tracker", releaseDigest: "sha256:..."}],
  calibrationSet: ["urn:rtracer:calibration:tracker:..."],
  sourceRecordIds: ["urn:rtracer:record:inspection:..."]
}

ConfigurationDiff {
  beforeConfigurationId, afterConfigurationId,
  addedItems[], removedItems[], replacedItems[],
  connectionChanges[], softwareChanges[], calibrationChanges[],
  authorizingChangeRecordId, executionRecordIds[], verificationRecordIds[]
}

#D4. Telemetry segment manifest

Table

Raw bytes remain interpretable and auditable
SegmentManifest {
  segmentId, captureSessionId, sourceDeviceId, configurationId,
  artifactDigest, byteLength, encoding, compression,
  channelSchemaRef, channelSchemaDigest,
  sequenceStart, sequenceEnd, sampleCount,
  clockDomains[{clockId, kind, nominalRate, wrapRule}],
  timeMappings[{fromClock, toClock, model, parameters, uncertainty}],
  observedStart, observedEnd, receivedAt,
  quality{gaps[], duplicates[], saturation[], invalidRanges[], flags[]},
  calibrationRefs[], privacyClass, retentionClass, rightsRef
}

#D5. Governed action transaction

Table

Conversation cannot bypass authorization or reconciliation
ActionProposal {
  actionId, agentId, personaVersion, principalId, beneficiaryId,
  actionKind, canonicalParameters, evidenceCheckpoint,
  requestedProvider, riskTier, requestedAt, proposalDigest
}
ActionGrant {
  grantId, principalId, agentId, allowedActionKinds[], resourceScope,
  purpose, moneyLimits?, confirmationRule, validInterval, grantEpoch
}
ActionReceipt {
  actionId, proposalDigest, policyDecisionId, grantId, grantEpoch,
  confirmationArtifactId?, providerOperationId?, providerReceipts[],
  state, startedAt?, reconciledAt?, resultRecordIds[], compensationIds[]
}

State path: PROPOSED -> EVALUATED -> CONFIRMED? -> RESERVED? -> EXECUTING
            -> SETTLED | REJECTED | FAILED | UNKNOWN_EFFECT -> RECONCILING
            -> SETTLED | COMPENSATED | OPERATOR_REQUIRED

#D6. Auction close and settlement lock

Table

Serialized winner decision; explicit settlement saga
AuctionCloseReceipt {
  auctionId, auctionVersion, trustedCloseTime, closePolicyDigest,
  sellerAuthorityRecordId, eligibleBidRecordIds[], excludedBidFindings[],
  reserveDisposition, winnerBidId?, closingPrice?, currency,
  decisionEngineVersion, closeDigest
}

SettlementSaga {
  settlementId, closeReceiptId, buyerId, sellerId, beneficiaryId,
  titleIdentityChecks[], inspectionDecision?, paymentIntentId?, escrowId?,
  taxAndFeeQuoteId?, transferDocumentIds[], custodyHandoffId?,
  personaRightsDispositionId?, states[], compensations[], finalReceiptId?
}

Only the close receipt selects a winner. A feed rank, notification order,
payment arrival, appraisal or later higher offer cannot replace that decision.