What the records are, and what each one claims.

Society and charter

A society is one local governance boundary: a charter, sovereign human roots, a classification policy, participants, budgets and an event ledger. It is not a kovee space and not an akson peer — those are other systems' objects, and byom binds to them by reference rather than absorbing them.

A charter is an immutable revision. It defines admission, standing, decision rules, which powers are delegable and which are not, resource ceilings, recursion limits, conflict handling, emergency holds and exit. Amending it means proposing a complete restated revision against the exact current one and adopting it by the current charter's own amendment rule; the prior revision moves to superseded in the same transaction. There is no in-place edit.

Genesis is atomic and human-rooted: society_prepare stages the canonical subjects and required seats, and society_bootstrap consumes exactly that preparation reference and digest. The genesis charter revision lands inside the same transaction. No integration partner is ever the genesis governance actor.

Participants and standing

A participant is a durable society member of kind human, agent or collective. It is explicitly not a process, a model, an alias, a package or a peer. A principal is an authenticated human identity from the local identity provider; it may bind a human participant and fill human-authority seats.

A manifestation is one exact way an agent participant may currently act: a package or deployment binding, or an attached-harness binding, plus a security profile, a controller domain, protocol features and a revision. An agent that acts through a different manifestation is acting under a different record.

Standing is local admission and eligibility state. It permits participation in named procedures and grants no effect authority whatsoever — that is what mandates are for. An independence domain is a protected reference that prevents one controller, or one nested participant, from quietly satisfying several seats that are required to be independent. It is governance metadata, not public identity, and it is redacted from projections outside its closure.

Joining: offer, acceptance, admission

Membership is offered, never assumed. Governance issues a membership_offer; the candidate reaches a single offer-scoped surface and either membership_accepts or membership_refuses, and may propose its own self-policy while it is still a candidate. Admission is a separate governance act that binds an admission subject digest and activates only the candidate-authored self-policy proposals included in that subject.

Among the properties model-checked in MembershipOfferStanding.tla: standing exists only through admission, admission requires acceptance, silence never becomes acceptance, and at most one standing revision survives the compare-and-set that admission, refusal, revocation and expiry all race on. Refusal and revocation fence the coupled onboarding offer in the same transaction, so a refused candidate's compute authority dies with the refusal rather than after it.

Endeavors, calls and pledges

An endeavor is an adopted governed purpose: outcome conditions, sponsor authority, resource accounts, source context and a lifecycle. A call is a non-binding invitation for a proposal, pledge, evidence, critique, review or assembly — it never assigns work to anyone. A pledge is a participant's accepted obligation to deliver an exact outcome under exact terms.

The pledge machine is thirteen states including disputed, plus a folded proposal stage — fourteen rows in the committed descriptor. Two of its rules are worth stating on their own:

• Finalization authors no seat. It is a guard over an explicit set of seat receipts, at pinned revisions and digests — not a promise that the seats were probably filled.
• Amendment does not supersede. pledge_amend only creates a separate proposed successor restating the complete terms. The predecessor is superseded exactly when pledge_finalize accepts the successor's complete fresh seat set under the successor's compare-and-set. There is no window in which the old obligation has quietly lapsed and the new one is not yet real.

A delivery is the pledgor's immutable claim that exact outputs and evidence satisfy the pledge; a review is an attributable decision against the exact terms and the delivery digest. The claim and the judgement are two records because they are two acts, by two parties, at two times.

Mandates

A mandate is a bounded authorization: purpose, operations, data classes, destinations, resources, delegation rules, expiry and the root decision chain that produced it. It is explicitly not a credential — possession of a reference to one confers nothing, and every use rechecks its current dependencies.

Derivation is the heart of it. A child mandate is a mechanical subset of its parent, computed by the kernel over canonical values; an absent selector on the child carries the parent's set unchanged, never wider. Non-delegable human powers never appear in a child at all. Transitively, a grandchild never exceeds the root.

Holding, revoking, exhausting or expiring any ancestor fences every descendant's new uses immediately — and un-sends nothing already sent. Use ordinals are slots: consuming the last one is the exhaustion transition, not a separate bookkeeping step that could be forgotten.

Activity streams, wake intents and episodes

An activity stream is durable participant-owned continuity for pledged work or bounded self-directed activity. It is not a process, a transcript, a scheduler assignment or an authority. A pledge workstream is one bound to exactly one pledge lineage. A continuation is participant-authored portable state for resuming a stream without depending on a private provider transcript.

An episode is one bounded, fenced period of activity, hosted by a runtime or by an attached participant. Getting to one is a pipeline with no skippable stage:

Crash alone never enables a re-claim. A leased head becomes re-claimable only through an explicit expiry guarded by authoritative server time strictly past the deadline minted at the claim, or through a voluntary yield. A worker going silent is stuttering: it enables nothing. And an episode whose external use has an unknown outcome is ambiguous — never reported complete, and never retried blindly.

Acts, effects and disclosure

An act intent is the exact authorized request for a consequential transition; an effect is the separately recorded attempt to affect an external system. They are two records because the authorization and the attempt can disagree, and when they do, that disagreement is the interesting fact.

The chain is: the server prepares the intent (it never supplies a semantic default), seats take positions, finalization authorizes against the locked full seat snapshot, and then exactly one execution_permit_consume spends it. Consumption is one-shot: the same canonical request under the same key returns the same receipt, a changed request is idempotency_mismatch, and a different key against a spent decision is refused. Replay and conflicting consumption are modeled as explicit no-effect actions, so the one-shot invariants are checked against live replay traffic rather than against its absence.

Budgets

Budgets are a ledger with one identity that must hold in every reachable state, per account:

ceiling = remaining + reserved + committed + uncertain + delegated_to_children

It holds under reservation, commitment, measured settlement, release, ambiguous marking, conservative resolution, child delegation and the return of unused delegation. Two consequences are load-bearing. A delegated quantity exists in exactly one place, so a settlement cannot spend it twice and a host bridge cannot double-charge. And an unknown outcome moves the hold into uncertain rather than back to remaining — money that might have been spent is not quietly returned.

The only way out of uncertain is a governance reconciliation seat presenting a fresh challenge. Nothing expires its way out.

Positions, decisions and seats

A position is one participant's separately attributable response to a proposal: assent, support, oppose, abstain, request changes or refuse, as the procedure permits. A decision is the deterministic result of a pinned decision rule over eligible positions and authority seats.

Positions fill only the authenticated actor's own eligible seat — a request naming another participant's identity fails the closed schema, not a policy check. Position revisions are immutable, so a later revision for the same seat is an append; supersession is caught at consumption, where the snapshot digest is recomputed from the currently active positions and refused as stale_binding if it no longer equals the one the authorization locked.

A stale binding epoch invalidates the position itself. The required seats then hold no exact current position revision, and the answer is decision_incomplete naming the epoch that moved — a rebound principal cannot carry an old seat forward.

Institutional memory and the ledger

An Engram is an immutable portable shared-knowledge revision plus society-local admission, trust, visibility and attestation state. Private participant memory does not become an Engram automatically — sharing is an act, with a record.

Everything a society does lands in an append-only event ledger, read through cursored projections. Cursors are opaque and scope- and audience-bound: they carry the authenticated cursor, endpoint incarnation, recovery epoch, filter digest and retention semantics, so a token from another scope is refused rather than reinterpreted. Internal sequence values are never projected, and a filter can narrow visibility but never widen it.

The invariants underneath

Nineteen safety invariants shape every schema, operation, storage transaction and test. Six of them explain most of the design decisions above.