Every operation, and the surface it answers on.

The registry

The registry keys one row per (operation, surface) pair. It is the freeze source for a bundle and the dispatch truth for the daemon: a call whose (operation, surface) pair has no row is refused, not interpreted. Four operations carry two rows because they exist on both the participant and the governance surface.

Across 16 families. The served column below is read out of the daemon's own implemented() predicate: 85 of 95 operations are implemented, and the rest answer a typed feature_unavailable rather than being silently absent.

Operations by surface

Request and result schema names are the frozen files under spec/schemas/ops/; a -v2 name is an immutable successor publication, never an edit of the original.

governance — 24 rows

Decisions made about a Society: bootstrap, charter, membership offers, admission, mandates, and the two reconciliation seats. The seat where authority is granted.

candidate — 3 rows

The only surface an unadmitted candidate can reach — offer-scoped, minted with one MembershipOffer and fenced the moment that offer terminates. It can accept, refuse, or propose its own self-policy, and nothing else.

participant — 42 rows

What an admitted participant does on its own behalf: propose endeavors, fill seats, pledge, derive mandates, open activities, submit deliveries, record reviews.

runtime — 14 rows

The execution seam. Episode claim/start/complete, checkpoints, permit consumption, usage reports, placement admission — reached with a byomd-minted workload token bound to one (episode, generation).

projection — 11 rows

Reads only. Society and participant projections, the charter history, the event ledger and its payloads, snapshots, and the recovery checkpoint. No operation on this surface mutates anything.

pre_auth — 3 rows

Version and capability negotiation, answerable before any authority is established. Not a socket of its own: these operations answer on every socket.

originating — 2 rows

The two recovery reads a caller aims at its own prior request — idempotency_result and cursor_recover. Not a socket of its own: they answer on the mutation-capable socket the original request used.

admin — 0 rows

Named in the closed surface enum and bound to no operation at all. There is no admin.sock, and deny-by-absence means an admin call is not unauthorized — it is unaddressable.

Transition machines

26 committed transition descriptors, 167 states and 312 transitions in total. A descriptor is the closed state machine for one record kind: a transition that is not listed is not merely disallowed, it is invalid. 5 of them are Kovee-owned executors, outside byom's one-descriptor-per-mutating-operation rule.

The model column names the TLA+ module that declares parity with the descriptor. 9 modules exist; a descriptor with no model is covered by the executable state walks and by the schema and registry gates, but not by TLC.

Digest classes

Every digest field on the wire is a typed DigestRef — {class, algorithm, key_ref?, value_hex}, a closed member set — never an unlabelled hash. A well-constructed digest of the wrong class is digest_class_mismatch even when the 32-byte value spaces coincide.

Problem kinds

The failure envelope wraps an RFC 9457 problem object whose kind is this closed 29-value enum. type is exactly https://byom.dev/problems/ + kind; an unknown kind fails closed. title is free prose and carries no authority.

invalid, unsupported_version, feature_unavailable, forbidden_surface, forbidden, not_found, stale_revision, stale_binding, stale_assembly_epoch, stale_lease, idempotency_mismatch, position_ineligible, decision_incomplete, independence_conflict, authority_widening, mandate_held, admission_required, classification_unmapped, policy_conflict, policy_overflow, budget_exceeded, effect_ambiguous, authority_witness_unknown, endpoint_sealed, cursor_expired, unavailable, formation_requires_participation, external_command_not_terminalizable, internal.

Wire limits

The conformance-tested initial limits, advertised by protocol_info and enforced before schema validation.