Home Contact
Universal Substratev1.4
/
For agents Markdown
Appendicesnormative v1.4.0bundle v1.4.133 blocks

Appendix O. Exact v1.4 proof, ledger, event, projection, cursor, control, and dispatch profiles

Every listed field is inside the digest. auxiliaryDigests are sorted by their declared semantic key before canonicalization. COSE protected headers repeat suite, verification method/key ID and epoch, content type, and profile; each repeated value MUST…

Concept & directionLNK

#O1. Proof target

Table
ProofTargetV1_4 {
  profile, proofId, targetKind, targetId,
  targetProfile, targetDigest, auxiliaryDigests[],
  proofPurpose, signerPrincipalId, verificationMethodId,
  keyEpoch, suite, createdAt, validUntil?, audience?, challenge?
}

proofTargetDigest = SHA256(
  "RTRACER\0PROOF-TARGET\0v1.4\0" || JCS(ProofTargetV1_4)
)

Every listed field is inside the digest. auxiliaryDigests are sorted by their declared semantic key before canonicalization. COSE protected headers repeat suite, verification method/key ID and epoch, content type, and profile; each repeated value MUST match the target. A mismatch is RTR-PROOF-TARGET-MISMATCH or RTR-PROOF-ALGORITHM-CONFUSION, never a fallback to another algorithm.

#O2. Shard head, commit order, and receipt

Table
ShardHead {
  ledgerId, tenantId, logicalShardId, chainEpoch,
  lastCommitSequence, lastReceiptDigest,
  publisherEpoch, shardMapVersion
}

IngestReceiptV1_4 {
  receiptProfile, receiptId, ledgerId, tenantId,
  logicalShardId, chainEpoch, commitSequence,
  shardMapVersion, streamId, streamSequence,
  recordId, recordDigest, admissionDecision, findingCodes[],
  receivedAt, committedAt, writerEpoch,
  previousReceiptDigest, validatorSetDigest,
  schemaRegistrySnapshotDigest, policyDecisionRef,
  canonicalAdmissionEventId, storeId, storeWorkloadIdentity,
  receiptDigest, storeProofRef
}

receiptDigest = SHA256(
  "RTRACER\0INGEST-RECEIPT\0v1.4\0" ||
  JCS(receipt_without_receiptDigest_and_storeProofRef)
)

commitSequence is a transactional, gap-free uint64 inside ledgerId + tenantId + logicalShardId + chainEpoch. shardPosition may remain a nonsemantic physical locator for legacy storage, but it MUST NOT drive receipt chaining, event ordering, checkpointing, cursors, or user-visible chronology.

The first receipt in an epoch references a defined genesis digest or signed epoch bridge. Every later receipt’s previousReceiptDigest equals the immediately preceding receiptDigest. Replication produces a CustodyReceipt rather than a second local admission receipt.

#O3. Mandatory append transaction

Table
append(request):
  1 lock idempotency binding
  2 lock all ShardHead rows sorted by canonical shard key
  3 lock all stream_head rows sorted by canonical stream key
  4 recheck writer, policy, registry, and shard-map epochs
  5 require expected stream sequence; allocate next stream sequence
  6 allocate next commitSequence by transactional ShardHead increment
  7 validate exact record/proof/request digests and authorization
  8 build receipt using locked lastReceiptDigest
  9 insert record, receipt, exactly one canonical admission event, and outbox row
 10 advance stream and shard heads; commit

If the transaction rolls back, neither head advances and no commitSequence is consumed. Concurrent writes to one logical shard serialize on ShardHead. Multi-shard transactions lock in canonical key order and either commit all shard prefixes or none.

#O4. Exact request digest and idempotency resolution

Table
RequestDigestInput {
  profile, operationFamily, tenantId, streamId,
  expectedStreamSequence, writerEpoch, requestedPurpose,
  contentType, recordDigest, contentDigest,
  detachedProofSetDigest
}

requestDigest = SHA256(
  "RTRACER\0REQUEST\0v1.4\0" || JCS(RequestDigestInput)
)

detachedProofSetDigest input order:
  sort proof references by proofId then proofDigest

POST /v1/idempotency:resolve
{ operationFamily, idempotencyKey }

Resolution is authenticated and scoped to current tenant and principal. It returns the original authorized receipt/state or a non-leaking absent response. A retry that changes any digest input is equivocation. A client with an unknown network result resolves the original key before creating a new intended operation.

#O5. Canonical admission event and publisher

Table
CanonicalAdmissionEventV1_4 {
  profile, eventId, eventKind: "ledger.record-admitted.v1",
  ledgerId, tenantId, logicalShardId, chainEpoch, commitSequence,
  streamId, streamSequence, recordId, recordDigest,
  receiptId, receiptDigest, correlationId?, causationId?,
  recordedAt, eventDataDigest
}

brokerPartitionKey = tenantId || logicalShardId || chainEpoch

One admitted record produces exactly one canonical admission event. A fenced publisher emits commitSequence in order within the broker partition and preserves event ID and canonical bytes on every retry. CloudEvents attributes duplicate routing fields for transport only; disagreement with canonical EventData quarantines the envelope. Derived topics may partition by semantic stream but MUST NOT advance canonical shard checkpoints.

#O6. Projection checkpoint, cross-shard fold, and replay

Table
ProjectionCheckpointV1_4 {
  profile, projectionId, projectionVersion, codeDigest,
  registryCheckpoint, policyBundleDigest, orderingMode,
  ledgerId, tenantId, logicalShardId, chainEpoch,
  inclusiveCommitSequence, terminalReceiptDigest,
  stateDigest, generation, priorCheckpointDigest?,
  status: ACTIVE|DEGRADED|NON_REPRODUCIBLE_BY_POLICY|FAILED
}

Consumer deduplication, projection mutation, and checkpoint advance commit atomically. A checkpoint advances only over a contiguous applied prefix. A checkpoint vector is compared componentwise and is never collapsed into a scalar.

Cross-shard projectors declare one of three contracts: independent per-shard fold plus deterministic reduction; associative/commutative merge; or a canonical computational fold explicitly carrying no chronological meaning. They MUST NOT invent cross-shard wall-clock order from receipt time, UUID locality, or broker arrival.

Recovery has two valid modes: restore a state snapshot with its exact checkpoint, or start from empty state with genesis checkpoints and replay the complete required prefix. Erased inputs produce typed ReplayTombstone and ErasureReceipt records. A view needing destroyed bytes is NON_REPRODUCIBLE_BY_POLICY, not verified or silently incomplete.

#O7. Confidential query cursor

Table
CursorBindingV1_4 {
  cursorProfile, queryDigest, requestingPrincipalId?, audienceClass,
  purpose, checkpointVector, projectionDescriptorDigest,
  codeDigest, registryCheckpoint, policyBundleDigest,
  sortPosition, expiresAt, keyEpoch
}

The client receives authenticated encryption of this binding or an opaque random server-side handle. Plaintext tokens are prohibited. A cursor is rejected when principal/audience, purpose, query, projection generation, code, registry, policy, checkpoint scope, expiry, or key epoch changes. Private sort tuples and tenant identifiers are not readable by the client.

#O8. Authority clock, lease, command, and disposition

Table
AuthorityClockRef {
  arbiterId, clockId, arbiterBootId, tickRate,
  authorityEpoch, antiRollbackStateDigest
}

ControlCommandV1_4 {
  profile, commandId, controllerId, controllerBootId,
  authorityClockRef, leaseId, authorityEpoch,
  commandSequence, sequencePolicy,
  functionId, targetSelector, setpointOrAction,
  frameRef, envelopeRef, issuedTick, expiresTick,
  commandDigest, controllerProofRef
}

CommandDispositionV1_4 {
  commandId, commandDigest, admissionResult, admissionReasonCodes[],
  admittedAtTick?, executionState, executionEvidenceRefs[],
  finalAtTick?, dispositionDigest, arbiterProofRef
}

Arbiter reboot changes arbiterBootId and increments a persisted authority epoch before arming. Anti-rollback failure latches SAFE. Exact duplicate ID/sequence/digest returns the original disposition without actuator re-entry. Same ID or sequence with different digest is equivocation and fences the controller. Lower sequence is stale. A gap follows the function’s STRICT_CONTIGUOUS or validated MONOTONIC_SUPERSEDING policy. Admission decision and physical execution outcome remain separate.

#O9. Atomic external action dispatch

Table
ActionDispatchEnvelopeV1_4 {
  profile, actionId, proposalDigest, policyDecisionDigest,
  confirmationDigest, budgetReservationDigest,
  connectorManifestDigest, renderedProviderRequestDigest,
  oneTimeDispatchNonce, dispatchEpoch, expiresAt,
  envelopeDigest, brokerProofRef
}

dispatch transaction:
  require current grants, policy, confirmation, reservation, connector, epoch
  require nonce unconsumed and envelope exact
  consume nonce and append DISPATCHING atomically
  commit before provider network I/O
  reconcile provider effect to SETTLED, PROVEN_NOT_EFFECTED,
    UNKNOWN_EFFECT, COMPENSATING, or OPERATOR_REQUIRED

Two workers can never both consume one nonce. Provider timeout is not failure. Vehicle persona, content, and social runtimes do not possess the R5 action type; denial is structural before policy.

#O10. Merkle checkpoint construction

Table
leaf = SHA256("RTRACER\0MERKLE-LEAF\0v1.4\0" ||
              uint64_be(commitSequence) || receiptDigest)

node = SHA256("RTRACER\0MERKLE-NODE\0v1.4\0" || left || right)

odd level rule:
  promote the final unpaired node unchanged with a domain-separated
  level/width commitment in the checkpoint; do not duplicate it

LedgerCheckpointV1_4 {
  profile, ledgerId, tenantId, logicalShardId, chainEpoch,
  firstCommitSequence, lastCommitSequence, leafCount,
  merkleConstructionProfile, merkleRoot, terminalReceiptDigest,
  priorCheckpointDigest?, createdAt, signerKeyEpoch,
  backupSnapshotRefs[], checkpointDigest, proofRef
}

Golden fixtures include odd/even leaf counts, inclusion paths, prefix consistency, epoch bridge, and corrupted-leaf rejection. Implementations cannot choose their own odd-leaf convention.