Introduction

One engine for typed queries, flexible documents, relationships, exact values and retained history.

Status: implementation in progress. The public task registry owns packet labels; this index separates implemented behavior, test evidence and remaining acceptance. This is a local prototype, not a hosted/distributed or real-money service. Command names have dated executable and disposable-profile evidence; recheck every published example against the final artifact identity before treating D01 as verified.

Canonical documents#

Start the copied native application with the local runbook. It records launch, CRUD, backup/restore, compiler consent and offline rebuild prerequisites. Operator/developer indexes: capabilities map, development workflow. The launcher, bundle format and standalone qualification describe tested local workflows and their limits; they do not replace the remaining P27/P29 acceptance. Docs preparation evidence: evidence/docs.md. The latest CLI cookbook reconciliation is documentation-round evidence.

The autonomous continuation adds locally reviewed typed fork/drop and finite HTTP/port restart/restore traces, plus committed-store and independent inventory model/recovery fixtures. Its candidate and exact logs remain local; final combined validation and human acceptance are separate gates. See Application port and snapshot inventory.

The 1 October consolidation repairs and integrates public inventory, independent reconciliation and the read-only consumer guide. Fresh guarded checks pass 17 HTTP/store fixtures and eight typed inventory fixtures, including expiry custody reclamation and canonical owner close. Independent tools pass 50 component checks. Scoped composition evidence is recorded with D05 and reconciliation; native, UBI and actual-corpus acceptance remain separate.

Executable local service#

The owner-only local server now composes durable schemas, CRUD/batches, branch commands and bounded queries over the real loopback transport. Start with service CLI, wire behavior and limits, schema catalog, profile lifetime, and HTTP client. Process evidence remains narrower than complete native/UNIVERSE acceptance.

The current backup/recovery path includes v3 checkpoint-dependent archives and safe staged restore. The curated loader requires complete matching original receipts before progress advances. The internal document pages and collection/relation membership pages operate on retained snapshots with bounded owned results. The owner-authorized public inventory contract now composes these streams over HTTP and an additive typed port. Actual native corpus recovery and final acceptance remain separate gates.

Local contributed work#

The opt-in contributed-work profile composes permission checks, bounded integer work and isolated contribution accounting through the existing protected engine transaction. ADR-020 and the architecture contract separate this synthetic foundation from the required future encrypted distributed profiles. Full functional verification passed 1128 tests; actual loopback work, backup, restart and fresh restore are recorded in the batch evidence. No native UBI, remote provider, cryptographic or real reward acceptance follows.

Mathematical foundation#

The TLA+ foundation supplies checked models, bounded configurations, deliberate counterexamples and an implementation-obligation map. The results record the historical receipt-encoding mismatch; the later TX3 implementation repairs its representation. Formal checks alone do not establish implementation conformance.

Implementation documentation ownership#

The table maps documentation to packet owners; a path is not a completion claim. Existing guides must stay synchronized with implementation. P28 assembles the final index and verifies published commands; it does not defer each feature owner's documentation gate.

Evidence paths and owners: P11 evidence/vertical-slice.md; P22 evidence/oracle.md; P24 evidence/native-functional.md; P25 evidence/faults.md; P26 evidence/performance.md; P27 evidence/package.md; P28 evidence/docs.md; P29 evidence/acceptance.json. They must contain observed results and artifact identities, not prewritten success claims.

P00 updates the baseline after repair, P02 maintains shared contracts, P04 records adopted dependencies, and P29 records final acceptance. The task registry remains the source of current ownership and status if this inventory changes.

Completing the standalone native prototype does not complete migration of the existing UNIVERSE application. That separate M1 gate remains defined in the elaboration.

Local third-shift consumer candidates#

The additive nested schema guide explains how existing service document writes opt into bounded object/array rules while keeping legacy schemas unchanged. The RAM session guide describes embedded typed writes, retained roots and owned logical-image transfer. A logical image does not make a RAM session durable.

The public owner-local summary request selects explicit quantity revisions and commits an ordinary provenance-bearing summary. Exact retries return the original receipt after source changes; the stored summary describes its retained snapshot and does not update itself. Source-read authority grants no target write permission or contributed-work grant.

The native synthetic envelope profile and optional aquarium capability tour expose actual bounded operations. Native AEAD uses ephemeral generated keys; portable tours report it unavailable. Neither path claims stored-database encryption, post-quantum security or product acceptance. Actual native and WASM emitted traces pass their distinct contracts. Native WK desktop playback and keyboard focus are qualified; IAB/mobile, reduced-motion and physical-device visual checks remain pending. The synthetic notebook CLI provides a bounded runnable owner workflow with actual schema refusal, summary provenance, receipt replay and process restart.

The integer key-value facade preserves full signed and unsigned64-bit values, including counts beyond JavaScript's exact-number range. It lowers bounded create/CAS-replace/delete/checked-add decisions into existing Engine batches. Retain the original immutable plan and request ID for retries; recomputing an addition after an uncertain acknowledgement can apply it twice. The facade grants no authority and raw low-level writers can replace its bytes.

The explicit-ID projection reader reads selected source rows and their optional type/shape/lens definitions under one lease. It refuses the whole projection on missing data, stale identity, lost replies or unconfirmed release. Default output contains only structural counts/view/digest; row export requires an explicit new private artifact. This is bounded RURAL consumer tooling, not a UBI companion UI or original-corpus acceptance.

The existing aquarium's integer tour shows real decoded i64/u64 extrema and values above 2^53 as exact decimal strings. One disposable RAM session performs an atomic debit/credit, checked large-counter increment, CAS/overflow refusals and replay of the original immutable request. Its pinned head remains readable after owner close. Native and actual WASM execute the same numeric primitives; neither lane claims faster storage or durable RAM. Matching native/WASM desktop WK playback, Run and event focus, finite drain and close behavior are qualified. IAB, mobile, reduced-motion and physical-device visual acceptance remain pending.

The original-intent recovery consumer writes a private, unchanged RURALTX3 capsule before publishing its synthetic transfer. After a deliberate owned process exit before acknowledgement, an independent observer verifies the committed values and receipt before a new process replays the same bytes, ID, hash and context. Replay leaves the stored values and receipt unchanged. Cross-store, corrupt and stale-context capsules refuse before publish; this qualifies a bounded local process cut, not power loss or general key custody.