The scheme

Four primitives: source, node, version, act

Everything stored is a source, a node, a version or an act. The last three borrow Git’s model as concepts: fixed snapshots, a moving pointer, an append-only chain.

Sources stand apart because outside evidence must stay citable byte for byte, whatever anyone later writes about it. The other three are Git’s ideas, separated: content that never changes, a name that points at the current content, and a causal history of every move.

Concurrent changes never overwrite each other. Two acts that move one node from the same version leave it with two causal heads: the node is contested, readers get one deterministic value plus a contested flag, and a merge act resolves it. Versions and acts append without coordination; only a node’s pointer is coordinated, per node or per namespace — never globally.

Four classes of node

Authored content, the relations within it, the queries that list it, and one task’s working set. Each is a node, named, versioned and checked the same way.

1. 01 · class

   Unit

   Anything referred to, graded, attacked or replaced on its own is a unit.

   Authored content — a document, or a part of one. A part is its own file.

   topcstmtquesnote

2. 02 · class

   Edge

   A relation that can be wrong deserves an identity.

   A named relation stored as a node: from, to, why it holds, and its attributes.

   dpndgrndrltd

3. 03 · class

   View

   If it lists things, it is computed.

   A declarative query over the graph. Its result is a real subgraph, pinned to what it showed.

   view

4. 04 · class

   Context

   A task reads what it pinned, at the version it pinned.

   A task's working set: the question, plus a bounded list of nodes pinned to versions.

   ctxt

Granularity follows use, not formatting. If a paragraph is cited, contested or replaced on its own, it is its own unit in its own file — and a document is reassembled by a view. If it is only ever read as part of something larger, it stays inside it.

An agent’s attention is a declared, auditable object. It widens only by an act.

A kind is permanent. Nothing is promoted.

Every kind has a registered short code that leads each identity of that kind. A kind never changes: when a question is answered, the answer is a new node.

Permanence is what makes a reference type-checkable: a dependency on a stmt-… can be checked the way a compiler checks an argument, because the thing behind it is a statement for as long as it exists. A question that gets answered stays a question; the answer is a new statement, linked to it. So the record can always show both what was asked and what was decided.

Adding a kind is a content change, not a software release. A new kind is registered within the scheme and never brings its own mechanism.

An identity that explains itself

Kind, time, randomness, handle. Each part of a minted identity buys something specific — and no part of it is chosen by judgement.

Minting is always a tool act, so no agent can pick an identity that pre-empts another. Measured on AI agents: asked to name things independently, parallel agents collide, because their choices are correlated.

Native names first

A thing that already has a unique, stable name keeps it. The scheme mints identities only for what it creates, so nothing has two answers to which thing this is.

A repository’s host/org/name, a package, a command, an MCP tool, a kind, a term — each already has a name that is unique within a stated namespace. Inventing a second name for any of them creates two answers to “which thing is this?”, and reconciling two answers never ends.

So the scheme refers to them by the name they have, qualified by its namespace, and mints only for the things it makes. Either way, every stored reference carries a digest of what it meant.

A unique, stable name is already an identity.

Versions are addressed by what they contain

A version’s identity is the digest of its content and card. A record never contains its own digest, and every reference pins the exact version it relied on.

A structure cannot contain its own hash — exactly why a Git object does not contain its own SHA. The digest is the address, computed by whoever holds the bytes. Facts about a version live in the act that made it; put inside the version, they would change the very digest they describe. A signature, likewise, lives outside what it signs.

Every relation and every act records the exact digests it relied on. So “what did this conclusion rest on?” always has an exact answer, and a later change to a premise is detectable rather than invisible.

Paths derive from identity, so nothing moves

A file’s location is computed from its identity alone: kind, then two levels of time. No topic ever appears in a path, so reorganizing knowledge never moves a file.

Reorganizing knowledge is a change to views and relations, never a file move. A link keeps resolving however the knowledge is regrouped, because nothing about a thing’s subject, status or owner is encoded where it sits.

The identity’s time segment doubles as a free shard key.

The card: what an agent reads instead

Every version carries a short, flat, typed card whose text fields have word budgets. Agents navigate by cards and open content only for the task in hand.

Measured on AI agents: accuracy degrades when what matters sits in the middle of a long context, and retrieval is rarely the bottleneck — reading is. What works for them is a small index read up front and navigation on demand, with titles and one-line summaries as the scent. A newcomer to a project meets the same limit: nobody reads everything before starting. Cards make that pattern mandatory for every agent, and the check makes it measurable.

Agents read cards, not content.

References point up. Every list is a view.

A record holds only its own foreign keys. Children, backlinks and outlines are computed, never stored — so adding a leaf never rewrites a parent.

Versions are immutable and references are pinned, so a parent that listed its children would cascade a new version up every ancestor for every change below it. The scheme turns that around. A unit holds one part_of; an edge holds its from and to; nothing lists what points at it.

A document, then, is its content plus a view: its parts find each other by part_of and order themselves by a sparse rank. “What does this contain?”, “what attacks this?” and “what was built on this?” are all queries.

Edges are nodes, and staleness is mechanical

A relation has its own identity, card and history; its act pins both ends. When a pinned version is superseded, a tool flags everything that relied on it.

A bare link can only exist or not. A relation stored as a node can say why it holds, be graded, be attacked (“this dependency is not real”), and be superseded — and the act that created it pinned the exact versions on both ends.

id        dpnd-…-e8f6tc
title     Retention rests on the erasure policy
critical  true           # the premise caps the dependent's confidence
from      stmt-…-p7d0sa  # events are retained for thirteen months
to        stmt-…-w4c9yg  # erasure completes within thirty days
pinned    sha256:a07d…   # by the act, not the card

When stmt-…-w4c9yg gets a new version, the edge’s pin no longer matches — and the flag travels:

1. 01 act

   Superseded

   A premise gets a new version. Its old version is kept, by digest.

2. 02 tool

   Mismatch

   Every edge, view and context that pinned the old digest no longer matches the current one.

3. 03 tool

   Flagged

   Each of them is flagged stale — mechanically, at once, with nothing left to anyone's memory.

4. 04 agent

   Assessed

   Did the meaning change? One declared answer, checked by a second agent.

   no impactrefinesextendscontradictsinvalidates

Only contract changes climb. A new title re-renders views; a change to asserts, covers, excludes or an edge asks for judgement upward. If a change touches nothing a parent quotes, a tool records no impact and stops without asking an agent. A change stops rising exactly where it stops mattering.

Metadata on everything — including the metadata

A field is defined once, as its own document. Kinds reference the fields they use. The scheme’s own vocabulary is stored and governed exactly like its content.

A field described inside every kind that uses it has as many definitions as there are kinds, and they drift. So the scheme defines each field once, as its own document — meaning, value type, value rules — and a kind references it, stating for that kind whether it is mandatory and whether it repeats. That is the split DCTAP and RDFS make. Kinds and fields are the meta-metadata, and they live in the same store, under the same rules, as everything else.

Terms follow SKOS and ANSI/NISO Z39.19, with definitions in the ISO 1087 form: name the broader concept, then what distinguishes this one. Alternate labels are what stop an agent missing something that already exists. The exclusion note — what a term is not for — is what stops an agent filing a question as a statement.

Three written forms. State is a fold.

Only manifests, events and blobs are ever written, and none of them changes. Status, facts, summaries and indexes are derived — so every past state is a query.

Anything that happens after a manifest is written is a separate record that refers to it — an acceptance, a defeat, a supersession, a retirement — never a field edited onto it. An unfinished record is a draft, its own kind, and becomes a manifest only by passing strict validation. There is no half-valid record. Nothing is overwritten. Everything is superseded. shows what that buys.

A system that greps its logs to make decisions has made its logs load-bearing without making them checkable. Here, anything in a blob must first be extracted into a structured event by a pinned, deterministic parser before any rule may use it.

The scheme checks itself

One check refuses broken records and prints the organization debt as a number that must never rise. The scheme’s own vocabulary passes the same check.

The rule of work: zero problems before every commit. Existing debt is reported, not refused — refusing it would block all work. The check prints it as a number on every run, and an inventory lists exactly where it is.

A rule without a mechanical check does not hold.

The scheme applies to itself. Its kinds, fields and terms are its own nodes, stored and checked exactly like the content they describe. Its specification is a rendered view of those nodes, regenerated and never edited by hand. Anything the scheme cannot apply to itself is not one of its rules.