This document defines Rey's target ownership boundaries and data flow. It is an implementation baseline, not a claim that the components already exist.
Rey is an environment-aware, deterministic diff-directed mining and compute runtime. It first inventories the bounded context surfaces and useful tools available where it is running. It then mines those surfaces through versioned relational and source operations, retains typed collections as DataFrames and native evidence in its natural form, computes directed deltas, and uses unresolved deltas to schedule subsequent probes or mutations. It records enough lineage to explain how evidence was derived, why each action ran, and what a scoped proof actually covers.
Rey has a useful standalone profile over explicit local context. A model may guide the feedback loop, but model inference and provider integration are policy concerns rather than runtime correctness dependencies.
Rey separates ten responsibilities:
- Workload plane — versioned workloads compose generated compute graphs, scenarios, claims, policy, qualification, effects, and total limits.
- Context-surface plane — environment providers expose observed process seeds, declared external applications, maps, and provider guarantees as an admitted environment snapshot. Workspace roots remain request/source bindings, not synthetic capabilities.
- Mining plane — provider-neutral relational and source operations
retrieve, extract, organize, compare, and visualize bounded evidence while
concrete providers retain source and execution ownership.
The implemented survey slice uses
rey-locatorbindings and emits retained topography patches; browser projections never become a resolver. - Scene-editor candidate plane — agents, surveys, and eventually humans
assemble bounded native feature, marker/POI, exact terrain-source, terrain-control, hydrology,
boundary, highway, road, district, lot, structure, utility, label, beacon,
construction, and connector artifacts into reviewable INDEX state and
linear
SCENE@ncommits with immutable candidate packages; deterministic generators retain their exact recipes, packages grant no admission authority, and they reach Explorer only through a qualified workload. - Projection-engine plane — exact admitted evidence and a versioned coordinate/projection basis compile into immutable scenes, bounded fields, semantic LOD, render passes, picking, and high-fidelity browser pixels; rendering never becomes semantic authority.
- Reasoning plane — selected frontier work and mined evidence become a bounded reasoning surface with exact omissions and admissible operations.
- Observation plane — lenses bind exact inputs and materialize bounded typed frames or native artifact references.
- Delta plane — relational, text, and structural comparison preserves directed changes and derives invalidation.
- Runtime plane — compiled intrinsic capabilities have their own automatic snapshot; transitions validate proposals, execute bounded probes or effects, update the frontier, and stop on convergence or an explicit bound.
- Policy plane — an agent, deterministic rule, or human proposes a compute graph revision or another admissible action.
These are responsibility boundaries, not requirements for separate processes.
The first topology is the foreground local Rey process started by rey agent.
Its root role is an orchestrator that owns all in-process background-work
lifecycle. The registered workers are the embedded Axum operator HTTP server and
the exact admitted GitHub Channel inbox poller. Following a retained GitHub
mailbox evidence link may request one immediate poll through the same exact CLI
contract; its receipt resets the worker's next deadline to the admitted
steady-state cadence;
the startup log binds that process to its package version and build commit,
while the startup document and GET /api/v1/agent expose the exact process,
worker, and supervision edge. rey version projects the same immutable build
identity without starting the process. SIGINT or SIGTERM requests cooperative
shutdown, and an unexpected worker exit fails the Rey process closed. V1 has a
fixed operator-and-scheduler bound and no restart, daemonization,
multi-process fencing, or crash-durability claim.
The operator projection attaches to that process. / redirects to the
operator app at /explore. /api is the API discovery root,
/api/docs/ serves vendored Swagger, and
/api/openapi.json projects the registered OpenAPI 3.1 document. API routes
and documentation derive from one declarative catalog. Synchronous evidence
projections execute outside the HTTP event loop, so a cold portfolio request
does not prevent health, documentation, assets, or other pages from being
accepted. This concurrency is transport mechanism, not workload scheduling.
Its explicit browser writes are bounded
unauthenticated Journal admission, conditional Channel WORKING replacement,
an exact clicked-message GitHub schedule request with local poll/message retention,
and exact workload file qualification/admission on any explicitly configured
listener. It is not a separate runtime or scheduler; none of those writes
grants general compute or proof authority.
The topology is a lifecycle graph, not agent execution authority. Discovered
agent runtimes remain potential environment capabilities; the orchestrator
does not invoke, assign, or supervise one until a later explicit admission
contract exists. The orchestrator also supervises one rey scheduler child OS
process. That process owns recurring observation and provider schedules,
retained controls and receipts, and semantic invalidation publication. Browser
routes revalidate from that event stream and own no recurring scan timer.
workload declaration
graph · scenarios · claims · policy · limits
│ │ environment requirements
│ ▼
│ explicit environment boundary
│ │
│ ┌────────────────┴────────────────┐
│ ▼ ▼
│ process seeds declared applications
│ reasoning maps provider observations
│ └────────────────┬────────────────┘
│ ▼
│ environment snapshot
│
│ compiled Rey operations
│ ▼
│ runtime capability snapshot
└───────────────────┬─────┘
│ both exact identities
┌───────────────────▼───────────────────┐
│ mining capabilities │
│ relational source │
│ query · group search · parse │
│ traverse · compare index · measure │
└───────────────────┬───────────────────┘
│
Git/source activation · policy proposal
│
▼
┌───────────────────┐
│ Rey runtime │
│ admit · budget │
│ transition · stop │
└───┬───────────┬───┘
│ │
mine/observe │ │ act through provider
▼ ▼
┌──────────────┐ ┌──────────────┐
│ frame/native │ │ local action │
│ projections │ │ │
└──────┬───────┘ └──────┬───────┘
│ │
└────────┬────────┘
▼
┌───────────────────┐
│ typed/native delta│
│ invalidation │
│ frontier │
└───────┬───────────┘
│
┌────────┴───────────────┐
▼ ▼
mine · visualize proof evaluator
│ │
▼ ▼
reasoning surface local evidence
│
▼
next proposal
See Environment and Capabilities for detailed provider,
snapshot, profile, admission, and degradation contracts.
See Mining Context Into Evidence for relational/source operation,
artifact, result, visualization, and provider boundaries.
See Workloads, Compute Graphs, and Scenarios for the public
composition, test-campaign, qualification, progress, catalog, and command
contracts.
See Rey Command-Line Interface for the agent-facing command model,
explicit mutation posture, and HEAD → INDEX → WORKING admission loops.
See Git Context and Activation for software-repository snapshots,
poll cursors, and delta-triggered workloads.
| Concept | Meaning | Owner or retention boundary |
|---|---|---|
| Rey process | Foreground local OS process started by rey agent, with package version, orchestrator role, runtime-only PID, implementation revision, and cooperative shutdown boundary |
Process lifetime; not retained semantic evidence or process-crash durability |
| Agent topology | Bounded live graph of the Rey process, supervised background-work nodes, lifecycle edges, authority, limits, and omissions | Foreground orchestrator; projected through CLI and HTTP status |
| Background work | Work whose lifetime extends beyond one request or command stack and must therefore be registered, bounded, supervised, and cooperatively cancelled | Owning orchestrator and the provider that owns the work's effects/evidence |
| Environment | Explicit boundary from which providers may discover context | Host/deployment configuration; observed by Rey |
| Capability snapshot | Frozen inventory of providers, tools, operations, trust, and limits | Local Rey evidence |
| Workload | Public versioned composition of graph contract, scenarios, environment, claims, policy, qualification, effects, and budgets | Rey declaration and catalog provider |
| Compute graph | Immutable content-identified typed nodes, ports, and dependency edges proposed for one workload | Catalog/result provider with explicit retention profile |
| Scenario | Exact fixtures, expected observations or claims, comparator, and limits used to test one graph revision | Rey declaration and retained evidence |
| Test campaign | Bounded lineage of graph proposals, scenario attempts, typed deltas, and qualification decision | Local result provider |
| Space | Named boundary over sources, lenses, actions, claims, and limits | Rey declaration |
| Source binding | Strongest exact input identity available | Source system; referenced by Rey |
| Coordinate binding | Provider-qualified semantic address for one object or bounded region; camera and lens are not identity | Owning provider; local bindings disclose local-only guarantees |
| Lens | Versioned deterministic observation definition | Rey declaration |
| Frame | Bounded typed observation plus schema and lineage | Working state or explicit local evidence |
| Mining operation | Versioned relational or source transformation with typed inputs, outputs, effects, limits, and completeness | Rey contract; implemented by built-in or discovered provider adapters |
| Mining request | Exact source/artifact bindings, operation, parameters, capability snapshot, limits, and frontier rationale | Rey transition or graph-node evidence |
| Mining result | Manifest of produced native, relational, tree, graph, delta, metric, or visual artifacts plus lineage and omissions | Rey evidence index; artifacts remain provider-owned or explicitly retained |
| Topography patch | Admitted survey result containing coordinate anchors, classified relationships, coverage, frontier, omissions, lineage, and a directed map delta | Rey evidence index; source artifacts and coordinates remain provider-owned |
| Editor project | Rey-owned mutable declaration of bounded workspace-native scene sources, explicit roles, and one coordinate-system contract | Selected local editor state (.rey/editor/project.json by default); native authored sources remain workspace files |
| Scene commit | Linear immutable editor revision binding sequence, parent, timestamp, message, and one exact candidate package | Local editor history; authoring HEAD but explicitly not admitted evidence |
| Scene generation recipe | Generator revision, source identity, seed, bounds, and complete effective geometry/effect hyperparameters embedded in its native output | Workspace source lineage; deterministic authoring, never evidence authority |
| Scene package | Immutable candidate containing an exact scene snapshot, native-object references, POI/feature index, limits, omissions, and directed prior-package delta | Local content-addressed editor candidate store; explicitly not admitted evidence |
| Scene admission request | Content-identified handoff naming one exact scene package and the workload operation required to validate it | Editor candidate store until an explicit workload accepts or rejects it |
| Semantic atlas | Content-identified bounded layout over separately typed admitted survey and regional-scene evidence with stable region identity, synthetic spherical coordinates, clusters, occupied fixed-grid sectors, compiler, limits, omissions, lineage, and a directed typed revision delta | Retained production history includes survey patches and accepted regional scenes with verified non-owning scene back-references and explicit stable sector membership |
| Admitted regional scene | Qualified result binding one exact editor package to native-to-semantic and county-local transforms, an optional exact source-bound County footprint, independently typed native layers, validity/no-data, limits, omissions, and lineage | Workload result and Explorer input; candidate packages remain outside this boundary |
| Projection packet | Bounded target envelope binding admitted evidence, coordinate/projection basis, scalar/vector channels, surveyed-validity masks, scene layers, revisions, limits, completeness, omissions, and lineage | Pure Rey projection input; reproducible from exact evidence or retained only under an explicit evidence profile |
| Terrain dataset | Content-identified regional grid binding exact source objects, revisions, row-major coordinates, height/material values, explicit valid/no-data vertices, and interpolation scope | Admitted scene evidence; source artifacts remain authoritative and no-data carries no height or material |
| Terrain program | Deterministic evaluator plus exact source/validity rules; survey programs add seed, multiscale bands, and bounded camera-working-set policy, while regional programs may bind one admitted dataset | Pure projection input; authored controls and admitted sources remain authoritative, while evaluated buffers are disposable |
| Terrain working set | Camera-relative scalar/vector/mask buffers and geometry sampled from one exact terrain program under declared cell/byte limits | Browser/GPU working state and optional bounded proof capture; never an admitted tile or sole source copy |
| Scene snapshot | Immutable, stably ordered engine scene compiled from one projection packet; semantic identity excludes camera motion and measured frame time | Browser working state and optional bounded proof artifact; never authoritative source evidence |
| Portfolio snapshot | Exact bounded catalog, qualification, environment, dependency, capability, ownership, and coverage inputs for one portfolio observation | Rey runtime evidence; derived from catalog/result/environment providers |
| Workload attention | Canonical typed relation of refine, retest, create, block, or policy-excluded subjects with reasons, readiness, evidence, priority, and cost | Rey runtime working evidence |
| Journal entry | Ordered typed collaboration document bound to an exact semantic coordinate, numeric camera scale, and source revision; admission grants no execution authority | Local Rey journal |
| Action proposal | Policy request naming frozen inputs, effect class, and bounds | Rey trace |
| Run/attempt | Provider-owned execution and capture lineage | Local executor |
| Delta | Directed typed comparison between compatible frames | Local Rey evidence |
| Frontier | Bounded prioritized unresolved work | Rey working state; checkpointed when needed |
| Trigger | Versioned predicate mapping a source delta to workload test selection or graph entry points | Rey declaration |
| Activation | Idempotent trigger match against exact source/target snapshots | Rey transition evidence |
| Claim | Predicate and required evidence over a named scope | Rey declaration |
| Proof | Claim assessment bound to exact evidence and evaluator inputs | Rey artifact with explicit provider guarantees |
| Trace | Graph connecting the concepts above | Local artifacts |
Working DataFrames and queues are never the only durable copy of authored content. A frame may be reproducible from exact sources and a lens, or retained as an Arrow evidence artifact when replay cost, external volatility, or proof requirements demand it.
The Axum operator worker started by rey agent embeds a TanStack Router
single-page application and serves the live bounded workload-list document
used by the CLI. The server root redirects to the human operator's
/explore app; the CLI remains the agent's primary interface and the human's
deeper diagnostic plane. Its root browser loader admits only the lightweight
operator shell: process identity, Channels, Observations, conversation, and
the exact revalidation cursor. Workload portfolio projection cannot delay
Cadence, Environment, retained Journal entries, or exact scenario/delta
evidence. Feed establishes readiness from signals and admissions before
attaching workload flow; Agents establishes readiness from Journal and process
evidence before attaching runtime attention and the work ledger. Explorer,
Journal authoring, and Workloads remain demand-scoped portfolio consumers.
Mailbox runtime attention loads explicitly and identifies its pending
portfolio boundary while retained Channel history stays usable. Packed
regional terrain validates retained value/validity columns directly and uses
a lossless source-derived cell-identity transport; it does not expand hundreds
of thousands of cells merely to re-prove derivable identities. Before any
workload HEAD or admitted topography
exists, Explorer projects exact request/WORKING/INDEX workload file state as
attention beacons on a presentation-only orientation globe. That globe is an
unmapped consent surface, not rey.semantic-atlas.v1; it claims no semantic
distance, terrain, project boundary, or agent activity. Inspection and consent
descend into the exact workload record and its approval control. Feed receives
the resulting admission item only after the workload commit is retained. Only an
explicitly admitted survey run or qualified regional-scene run may replace it
with mapped evidence. The Explorer projects admitted topography patches and the
latest accepted non-scenario regional result through one persistent semantic
scene. Survey and regional World membership come from the current
rey.semantic-atlas.v1. Each regional member binds its exact accepted scene,
admission, package revision, projection packet, and unchanged
native-to-synthetic placement; Explorer rejects a mismatch and assigns zero
inferred footprint radius. Both
synthetic longitude/latitude axes have no Earth CRS or physical-distance claim.
Occupied fixed-grid synthetic sectors now organize atlas membership without
claiming surveyed coverage or native footprints. A regional scene may now bind
one content-identified County footprint only when a unique admitted boundary
Polygon matches its exact envelope. Closer regional lenses stop at Atlas until
the operator selects an exact admitted regional identity with that footprint.
The selected footprint's native rings become the County fabric and validity
boundary under the revision-bound County-local frame; the envelope remains only
a frame bound and physical-distance claims remain absent. Explicit admitted
source roles remain separate County layers for native features, qualified
terrain sources, terrain controls, hydrology, boundaries, highways, roads, districts, lots, structures,
utilities, POIs, labels, beacons, construction, and connectors. The role is
source-declared and admission-bound; shape, path, or styling never reclassifies
an object. Admitted non-terrain Point, LineString, and Polygon objects retain
their exact native coordinates as well as independently verified bounds. Wider
GeoJSON geometry families remain admissible with an explicit bounds fallback
until an exact retained representation exists. Terrain-grid Points do not
duplicate coordinates in every native object because the qualified row-major
grid is their canonical representation. Isolated terrain Points with exact altitude and bounded material
remain point-valid with no interpolation or coverage expansion. A complete
rectilinear Point source may instead retain one content-identified terrain
dataset with row-major source identity and explicit valid/no-data vertices;
only triangles with three valid vertices authorize interpolation. Terrain
controls remain candidate geometry, not qualified terrain.
At Object and Evidence lenses each regional object links by workload, exact
scene identity, and object revision to one read-only evidence route. That route
projects its source path/artifact, admission, typed layer, validity, native
bounds, current directed atlas delta, limits, omissions, and lineage from the
same verified retained workload document. It explicitly discloses that no
object-local source delta or browser source-reader provider is retained.
Local charted survey envelopes,
unresolved probe horizons, and boundary weather remain available in closer
survey lenses.
As the lens enters Atlas, that same synthetic sphere unwraps through a horizontally wrapping spherical-Mercator transform with explicit pole, antimeridian, and distortion behavior. This semantic Mercator chart is not EPSG:3857 and does not relabel native CRS84 scene sources. Sector polygons and admitted county footprints are separate identities; focus may raise a sector as transient presentation without changing its evidence or height.
The browser implements this transform as
rey.semantic-mercator-projection@3, a deterministic primitive with an exact
360000000µ° wrap, ±85051129µ° cutoff and polar disclosure, analytic inverse,
view-relative shared-identity fragments, cross-renderer frame and marker
parity, and stable World/Atlas endpoints. The
coordinate facing the rotated globe remains centered, and the surface seam
moves behind that view before the map unfurls. Its compiler revision is part of
each regional immutable scene snapshot. Regional Atlas points and occupied
sector rectangles use it now. The snapshot retains a renderer-neutral
transition manifest over those exact identities, and the reference renderer
interpolates its point/sector geometry continuously across the declared
0.14 → 0.24 World-to-Atlas scale band. Settled Atlas draws three bounded
horizontal copies; duplicate copies are pointer-only and accessibility-hidden,
inverse selection returns one canonical coordinate and retained identity, and
pan is recentered modulo rendered chart width. The revisioned semantic-label engine
applies the grammar's bounded World/Atlas budgets after globe, morph, and chart
projection. Selected canonical focus wins deterministic collision ordering;
culled/limited labels collapse without removing semantic markers or pick
targets. Its revision participates in immutable scene compiler lineage.
Atlas derives terrain-style contour isolines from bounded anchor-sample
influence. An explicit admitted-region selection now expands its verified
native-envelope-centered tangent frame under a bounded stylized isometric
camera with analytic forward/inverse plane projection. The renderer projects
the selected footprint's exact closed native rings with even-odd hole validity
and does not draw an envelope substitute. Landscape, Neighborhood, Object, and Evidence progressively add
terrain, watersheds, admitted highways/roads/lots/structures/artifacts, labels,
relationships, inspection objects, and exact basis without replacing the map.
Exact survey edges remain deep inspection evidence rather than relief, roads,
or path geometry. Identity, relationship classification, bounds, and omissions
survive every visual transition. Semantic coordinates are provider-qualified addresses;
camera center, continuous scale, viewport, and lens remain separate view state.
The current hard-cut interface uses rey+local://... semantic coordinates and
the /explore?coordinate=...&scale=... browser envelope. Matrix paths are not
part of the v1 Explorer contract. Journal v2 stores coordinate and scale
separately and places its typed blocks in a bounded 12-column broadsheet.
/environment projects the same typed
HEAD → INDEX → WORKING environment delta as rey env status; /workloads
retains the exact catalog/detail routes and aligns admitted revisions plus
creation requests as separate Hifi dense evidence relations. Exact workload
routes continue that relation grammar across runtime or request posture, exact
bindings, and retained mining output. /agents begins with the Journal:
current requests and non-excluded attention produce derived system entries;
retained human and agent entries use one bounded typed contract and point to exact
/explore coordinates. /journal/new and exact /journal/{slug} routes share
one live editing surface; a retained edit appends an exact superseding entry
instead of rewriting history. Entry blocks expose stable fragment permalinks.
Agents admit through rey journal add, and neither path executes notebook
blocks. The live supervised Rey process and agent topology follow with exact
nodes, lifecycle, restart policy, endpoint, authority, and explicit omissions.
The route then projects an observed-work ledger from exact workload revisions, tests, runs, mining
outputs, deltas, and attention. Journal entries communicate direction without
becoming assignments or execution authority. Tasks still organize intent,
operation, artifact references, desired delta, readiness, and assignment;
journeys remain derived. Agent
application discovery stays on /environment, and generator tuples remain
provenance rather than activity or assignment. A separately admitted exact
gh application may be invoked only by the bounded Channel poll contract; the
CLI verifies one tick and the supervised scheduler repeats it at the exact
committed cadence. Its retained GitHub notifications and pull-request comments
then enter the mailbox.
/cadence
keeps bounded Git reachability, environment sequence, and runtime schedule
schedules on separate clocks instead of fabricating a total event order. Its
repository-state plane separately shows staged, unstaged, untracked, and
conflicted working-tree attention plus exact HEAD-to-local-upstream
publication. That relation is revision-bound and performs no remote transport.
The fixed footer is a live communications channel over current retained
Channel poll messages, typed attention, and scheduler/event-stream health. A
quiet mailbox means no operator attention is requested; it is not filled with
authored Observations or synthetic heartbeat activity. The mailbox
control selects the history axis. The center chevrons select a separate
operator/Rey/agent conversation axis with a conventional transcript and
composer. A bounded workspace-local transcript provider admits exact sessions
and messages without delivery or execution effects. The operator server now
projects that provider and conditionally appends only through an exact
session-declared human browser writer; unavailable transport leaves the
composer disabled and no UI-owned transcript is invented.
The collaboration substrate preserves those boundaries. A workspace-local
Channel graph addresses channels, subscriptions, Feed
streams, ordered layouts, and explicit relay declarations through a separate
Git-shaped operator index. Standalone immutable Channel observations and their
channel-local admissions remain outside that topology index and form a bounded
collaboration-frontier projection. Journal remains the deliberate rich
synthesis surface and may cite exact observations or begin from an unretained
Journal seed. Feed, mailbox, conversation, observations, and Journal remain
different interfaces; channel admission grants no action or transport
authority. The local revision slice implements the canonical built-in graph,
bounded snapshots/deltas, symlink-safe CHANNEL HEAD → INDEX → WORKING store,
and channels list/status/diff/apply/add/commit/log. Immutable file-backed
messages, explicit relay attempts, bounded one-shot polling-beacon ticks, and
an exact-environment-HEAD gh poll for unread GitHub notifications
plus issue-level and review-thread comments on bounded pull-request subjects
are also implemented. The Channel graph and browser API remain non-navigable
substrate behind Feed, mailbox, and conversation; there is no top-level
/channels route or navigation item. Feed selects detached URL preview,
WORKING, HEAD, then built-in layout state; deliberate adoption and stable
pointer/keyboard movement use the conditional WORKING write under exact HEAD
and WORKING snapshot preconditions and retain typed deltas or rollback failures.
Its Admission stream merges the bounded verified environment and workload
commit histories directly; it does not synthesize posts from WORKING, INDEX,
attention, qualification, or repository posture.
A separate tamper-detecting observation log
now owns immutable statements, exact source/evidence bindings, Channel
admission edges, retained partial broadcast receipts, single supersession or
resolution closure, and the bounded collaboration frontier. Its CLI exposes
add/list/show/resolve and exact partial broadcast receipts. Browser Feed and
direct bounded human admission from Feed's rich-text modal, and deterministic
unretained Journal seeding are
implemented. The separate local conversation log now retains immutable
sessions, declared participants/writers, per-session message order, exact
sources, availability, authority, limits, and failure posture; no append
invokes an agent or uses Channel relay. Browser conversation projection and
conditional append are delivered. Durable remote provider cursors remain
planned behavior. The implemented GitHub poll has both an explicit one-shot
CLI and a dynamic supervised scheduler entry; its
latest exact-Channel-HEAD receipt defines the current provider mailbox
frontier. The mailbox projects that frontier beside
typed runtime attention and event-driven revalidation failures; it does not
reinterpret authored Observations as mail.
Hifi's Kinetic grammar with the Precision theme defines the interaction and material language. StyleX owns compiled structural and stateful presentation while typed Kinetic material values remain runtime data; Rey's typed documents remain authoritative.
The supervised operator listener defaults to loopback and carries no authentication, multi-user, or remote-service guarantee. Its explicit writes are bounded Journal and conversation admission, conditional Channel WORKING replacement, and qualified exact workload-INDEX approval. An explicit non-loopback bind exposes all four writes to every client that can reach the listener; the typed health and topology projections retain that exposure boundary. No bind grants Channel INDEX/HEAD, relay, workload execution, or proof authority. See Context Topology Explorer, Collaboration Journal, Conversation Transcripts, and Git Context and Activation.
Explorer is a high-fidelity spatial game engine specialized for evidence-bound projections of high-dimensional context. Its browser placement does not reduce it to a React visualization component. The target boundary has five layers:
- Evidence adapters translate exact workload, topography, portfolio, and future high-dimensional provider artifacts into one versioned bounded projection packet. They own semantic interpretation and validity.
- Scene and field compilation creates stable scene identities, data-oriented scalar/vector working sets, procedural frequency bands, validity masks, natural-feature derivations, omissions, and invalidation dependencies.
- Engine mechanism owns camera transforms, semantic and geometric LOD, culling, picking, label budgets, scene retention, and dirty-set scheduling.
- Render graph and backends own ordered materials, hillshade, occlusion, contours, water, weather, boundaries, POIs, labels, selection, antialiasing, declarative React Three Fiber scene reconciliation, accelerated resources, and visible fallback.
- React shell owns routes, browser controls, accessibility, evidence panels, exact links, and lifecycle integration around the engine surface.
The flow is one-way:
request/WORKING/INDEX → orientation beacon → human consent
│
▼ admitted survey + explicit run
editor WORKING → INDEX → immutable candidate package
│
▼ explicit qualified admission workload
admitted evidence
→ versioned projection packet
→ immutable scene + fields + validity
→ camera/LOD/culling
→ ordered render passes
→ pixels
The editor arrow cannot bypass the admission workload. rey.scene-package.v1
is not a topography patch, projection packet, browser scene, or proof. The
editor registers existing native GeoJSON through a bounded, non-symlinked,
explicit-role source add receipt; status/diff retain the reviewable WORKING
change, and the editor freezes bytes and feature/POI indexes only through
INDEX. The file-backed
scene-admission workload now validates exact current packages and native
objects, qualifies deterministic acceptance/rejection scenarios, and retains
an admitted regional scene plus projection packet through the CLI. The
workload-list read model exposes only the last production run, and /explore
projects it only when its accepted status and exact workload, graph,
capability, package, snapshot, packet, terrain, coordinate-plane, and placement
bindings agree. Candidate commits and qualification fixtures remain outside
that projection. Explorer, Mining, and Plan
0003 own this boundary.
Picking reverses only screen position to a stable scene identity and exact coordinate. It does not reverse pixels into evidence. The CLI inspects the packet, compiler revisions, field semantics, validity, limits, omissions, and lineage through the existing workload surface; the browser is responsible for high-fidelity spatial verification.
Terrain fidelity begins with an admitted dataset and validity contract, then a bounded deterministic terrain program or renderer-neutral working field. Height, normal, slope, aspect, curvature, runoff, erosion, material, and shading are separate channels or passes with explicit derivation and revision. Unknown and unsupported validity never become sampled height merely because a material feathers their visual boundary. Semantic scene identity is backend-independent; generated buffers, GPU pixels, and measured frame time are not authoritative evidence.
The browser uses an immutable scene graph plus data-oriented field buffers and
an explicit render graph. React Three Fiber 9.7.0 declaratively reconciles
the backend scene and runs only invalidated frames. A narrow lifecycle adapter
initializes the pinned Three.js WebGPURenderer and TSL material graph, using
WebGPU as the preferred backend and Three.js's WebGL2 backend as the
compatibility path; Rey's reference renderer owns deterministic semantic
proof. A generic ECS, physics runtime, or free-orbit 3D requires a later
qualified need. Plan 0003 owns the
remaining direct-transport qualification; Plan
0005 owns scaled regional Landscape
terrain.
A Rey workload is the public unit users list, test, run, and inspect. It declares providers, typed inputs and outputs, a compute-graph contract, scenarios, triggers, admissible operations, claims, policy, qualification, and total budgets under one versioned identity.
One immutable graph revision contains stable nodes, typed ports, dependency edges, exact operation contracts, capability/effect requirements, and limits. The initial graph is acyclic. An agent, rule, or human may propose a graph, but the runtime validates it and deterministic scenarios decide qualification.
The product catalog observes sys/*/workload.yaml as WORKING proposals.
A package binds the generated graph and frozen scenario suite plus proposal
producer, revision, and inputs; it owns no admission decision. Exact source
bytes and path participate in the proposal identity. workloads add freezes
the complete catalog in INDEX, test --staged binds passing qualification to
that exact snapshot, and a human workload commit advances HEAD. Compiled
workloads are explicitly selected conformance and system diagnostics, not
default portfolio entries.
workloads create precedes package admission with a content-addressed
sys/*/request.yaml contract. That request is an explicit handoff to an
external coding harness, not an LLM embedded in the runtime. Request-only
entries remain visible drafts and cannot be tested or run. Rey imports the
materialized package into WORKING only after its graph, suite, provenance,
frozen oracle, limits, and request/package identity match validate. Automatic harness
invocation remains a later campaign boundary. See Workloads,
CLI, and Runtime.
A scenario executes that exact graph against fixture bindings and compares
EXPECTED to ACTUAL; the retained structured artifact remains the observed
output. Conclusive mismatches retain typed deltas; missing or incompatible
evidence is inconclusive. All required scenarios must freshly
pass for every package in the exact staged INDEX before a human can admit that
snapshot; workloads run resolves only the resulting HEAD.
Manual, policy-selected, Git, or future stream activations select a workload test campaign, scenario subset, or declared graph entry point through normal admission. Workload, graph, scenario, campaign, and run revisions participate in transition and proof identity. See Workloads, Compute Graphs, and Scenarios.
Environment awareness is provided through narrow providers rather than an unbounded host scan. Initial provider classes may include:
- process-owned
HOME,PWD, andPATHdiscovery seeds; - built-in Rey functions retained in a separate automatic runtime snapshot;
- an explicitly supplied, agent-authored environment mapping resource for relevant variables, input files, desired executable inventory, and reference edges;
- an explicit local workspace bound as request and source lineage;
- a Git provider with commit/ref/index/worktree frames and polling;
- known developer tools resolved from configured paths or
PATH; and - language-specific toolchains, analyzers, build systems, and test runners.
Each provider has stable identity, version, detection rules, trust class,
source/effect capabilities, supported enforcement, and probe limits. Discovery
may use narrowly defined read-only operations such as executable resolution,
metadata inspection, or a bounded --version invocation. It never executes an
unknown file merely because it exists.
Bootstrap discovery loads no project configuration and assumes no remote
service variable names. The frozen discovery record becomes input to agent reasoning;
an emitted mapping resource enters observation only through explicit --map.
The mapping graph is a context declaration, not a provider adapter or policy
grant. Each desired executable declares why it belongs in the inventory. An
exact semantic identity over those declarations is the inventory record; the
exact target capability snapshot is a separate bounded search record.
Executable nodes remain potential capabilities
until an admitted adapter freezes their exact operation contract. The mapping
provider projects bounded graph, node, edge, variable-presence/digest/value,
file-identity, and executable-identity evidence into the snapshot used by
environment history. Exact variable values are retained only for explicit
non-sensitive capture: value declarations under a byte bound. Sensitive
variables remain presence-only, and mapped file bytes are never retained.
Environment and runtime capability snapshots are separate typed relations. A capability schema should be able to represent provider id/revision, capability id, kind, resolved location, version, content or provenance digest when available, availability, trust, supported operations, enforcement claims, observation time, and errors.
Environment discovery is repeatable during a trace. A delta between snapshots can invalidate actions, lenses, and proofs. An executable path, version, digest, provider health, or capability change is part of transition input rather than ambient trivia.
The human environment revision loop adds a separate admission index between a
fresh capability snapshot and committed history. Status exposes
HEAD → INDEX → WORKING; add updates that index; commit records only the index
and never re-runs discovery. This provides review stability without turning an
accepted executable observation into action authority.
- Standalone requires only built-in capabilities and an explicitly selected local context. Evidence may be retained in a caller-selected local artifact directory, but Rey makes no restart, transactional, multi-process, or remote durability claim beyond the underlying filesystem and content digests.
- Required-capability is a per-space or per-claim constraint, not a separate runtime. Admission fails early when the snapshot lacks a named capability or guarantee.
A proof states its profile and provider set. No provider may silently change a claim's required guarantees.
A lens contains:
- stable identity and revision;
- expected logical schema and key semantics;
- exact or resolvable source requirements;
- a pure query, projection, or probe definition;
- normalizer identities;
- row, byte, time, memory, and traversal bounds; and
- completeness rules that decide whether truncated or unavailable input is usable, inconclusive, or an error.
Materialization resolves every mutable source name to the strongest exact identity its provider can establish before evaluation. The frame records those bindings, the capability snapshot, and relevant local tool revisions, query checkpoints, request ids, run ids, capture digests, and other lineage.
A lens may consume another frame. Those dependencies form the invalidation graph. A source or upstream-frame delta marks only affected dependent lenses eligible for re-evaluation; it does not imply that every eligible lens must run immediately.
Mining is the shared capability layer between environment inventory and runtime orientation. It does not introduce one universal query language or force every provider into one execution mechanism. Instead, a common operation contract binds exact input/output kinds, parameters, semantics, effects, capabilities, effective limits, completeness, invalidation, and implementation identity.
The two primary families are:
- relational mining, which retrieves and organizes typed records through select, filter, join, group, aggregate, align, traverse, compare, summarize, and visualization operations; and
- source mining, which locates, searches, segments, tokenizes, parses, indexes, traverses, measures, compares, and visualizes text, code, configuration, logs, documents, and native artifacts.
The families interoperate through exact projections. Search matches, syntax nodes, symbols, references, dependencies, diagnostics, and metrics may become typed frames. Their rows retain links to exact native source spans and the operation/parser/index revision that derived them. Source bytes, ordered text, syntax trees, patches, and binary artifacts remain native when tabularization would lose meaning.
An exact read of already identified immutable evidence may participate in
bounded orientation. Pure projection over frozen evidence is deterministic
compute. Reading mutable state or invoking rg, a parser, compiler service,
language server, or other external miner is an explicit probe with normal
admission and execution lineage. Discovery never grants that authority.
Visualization is a versioned mining projection over authoritative artifacts. It records grouping, ordering, context, layout, aggregation, elision, sampling, limits, omissions, and deep links. Tables, patches, trees, graphs, timelines, and metric panels cannot change the underlying delta assessment, proof status, coverage, confidence, or progress.
Mining operates in two nested loops. The inner workload campaign mines a declared domain, evaluates scenarios, and uses output deltas to refine its graph. The outer portfolio campaign mines exact catalog, retained result, environment/dependency, capability, ownership, and coverage inputs to derive which workload or uncovered surface needs attention. Workloads are therefore both mining instruments and mineable runtime context.
rey.workload-attention.v1 is evidence between derivation and scheduling. Its
ready rows feed the generic frontier; blocked and policy-excluded rows stay
visible but ineligible. The scheduler does not invent attention reasons, and a
policy cannot resolve its own row. See Frontier, Progress, and
Scheduling and Runtime.
See Mining Context Into Evidence.
Git is a specialized context and activation provider for software spaces. It
observes the object database, commit graph, refs, per-worktree HEAD and index,
and optionally bounded worktree status. It produces typed repository, ref,
commit, parent, path-change, index-entry, status, and activation relations.
Repository state is not folded into the rey env admission snapshot: that
surface retains the git application identity, while cadence and workload
activation retain exact Git observations on their own clock.
Workloads may declare exact repository/worktree HEAD or semantic-index revisions. Portfolio invalidation compares those declarations only with the acknowledged Git cursor snapshot; an ambient observation or pending transition does not become workload evidence before its exact acknowledgement.
A poll compares the current repository snapshot with its last completely processed cursor. Initialization freezes exact watched-ref names and retains their targets or absence; each later movement is classified independently from HEAD. Every changed ref retains bounded canonical added/removed reachable commit sets from the raw object graph and a bounded canonical tree-to-tree path delta. Path evidence preserves reversible byte identity, direction, source and target modes/OIDs, omissions, and exact ref scope; rename inference is disabled. Semantic index changes expose staged proposals before a commit exists, while raw index changes caused only by stat-cache refresh do not activate staged-content workload entries.
The explicit Git watch recurrence retains every successful or failed attempt before continuing. Iteration, elapsed time, retry, and cadence are independent bounds; recovered failures remain partial, and cooperative signal cancellation retains a terminal receipt without claiming convergence. This read-only loop does not generalize retry safety to actions or execute an activation.
Triggers select delta subsets and name an affected workload revision, scenario selection, or declared graph entry point. An activation has deterministic identity over the trigger, workload/graph/scenario selection, source/target snapshots, and matched delta. It is a proposal that must enter ordinary action admission and can be replayed after a crash. The poll cursor advances only after required transition evidence reaches its claimed retention boundary.
The delta engine selects a comparison contract that matches the mined artifact shape. Relational comparison aligns compatible frames under explicit direction, keys, ordering, and normalizers. Text comparison preserves ordered content, encoding, segmentation, and context. Structural comparison aligns declared tree or graph identities without guessing through incompatible or incomplete evidence. Human tables, patches, trees, graphs, summaries, Tabular Diff CSV, JSON, and Arrow are projections of authoritative results.
The frontier is a relation derived from deltas and claims. A frontier row can name the affected entity, delta, violated claim, dependent lenses, admissible actions, priority inputs, and estimated cost. Prioritization is versioned policy and must not alter the underlying delta.
The initial runtime may recompute complete bounded frames. Incremental physical execution is accepted only when it produces the same semantic frame and delta as full recomputation for the declared contract.
Rey separates initial observation from recurring transitions. Bootstrap discovers capabilities, materializes declared initial observations, and establishes baselines or evaluates claims without inventing a prior observation or artificial transition delta. The steady-state loop begins only from a committed transition and its derived frontier:
committed delta/frontier
-> schedule -> mine -> project
-> propose -> admit -> probe|mutate
-> observe -> compare -> evaluate
-> commit transition
-> next delta/frontier
A transition delta states what changed from the relevant pre-action frame to the post-action frame. A residual delta states what remains between a declared expected or baseline frame and the current observation. Claims that do not reduce naturally to one frame comparison remain typed claim facts; the frontier combines them with applicable residual deltas, invalidation, and dependencies rather than flattening them into an artificial mega-delta.
Orientation is the bounded inner loop that turns a committed frontier into a reasoning surface. Rey identifies mining needs from frontier rows, retrieves exact read-only evidence through the provider that owns it, and applies versioned deterministic relational or source projections. Mining does not grant new execution authority or duplicate provider ownership. Any read that observes mutable state, invokes a tool, or creates a new lens result is an explicit probe transition.
Mining and projection may repeat inside one orientation phase as exact evidence changes the surface. The runtime owns iteration, time, byte, and provider bounds plus lineage; a versioned orientation strategy owns evidence order and readiness. The phase stops as ready, without eligible evidence, or at an explicit bound. Expected information value is navigation metadata, while actual progress remains a post-action assessment.
The reasoning surface binds its frontier and delta inputs, exact source and capability revisions, retrieved evidence identities, projection contract, omissions, truncation, and effective limits. It may contain bounded typed relations and handles to native artifacts. It is policy input and trace evidence, not a replacement source or a durable content store.
After the action, Rey compares the next residual/frontier state with the prior one. Progress is a typed assessment of resolved, introduced, reopened, unchanged, or incomparable work; information and completeness gained; changed guarantees; and cost consumed. A policy may use an explicit versioned ranking objective, but no scalar progress score replaces the authoritative deltas or proof status.
Provider execution, semantic transition, and proof/evidence state remain orthogonal. A process can terminate successfully while semantic work is unchanged or regresses, and retained evidence can later become stale. Budget exhaustion, missing evidence, or incompatible residuals stop explicitly rather than producing convergence. See Runtime Transitions and Reasoning Surfaces.
Within a workload test campaign, one pass freezes a graph revision, executes selected scenarios, compares expected to observed outputs, and derives a frontier from failing deltas and unresolved claims. The recurring transition machine then retrieves and projects that bounded evidence before policy may propose the next graph revision. Graph dependency order is distinct from frontier scheduling: edges determine which nodes can run, while the frontier determines which unresolved scenario evidence should receive the next bounded unit of reasoning or compute.
An action has one of two effect classes:
- probe — read-only computation that may produce new observations or derived artifacts; or
- mutation — an explicit change to a declared target through an admitted provider action.
One transition follows this protocol after a committed frontier is available:
- freeze the current workload, graph, scenario selection, activation/frontier, source revisions, and relevant frame ids;
- select bounded ready frontier work under exact record, frontier, capability, scheduler, and budget inputs;
- mine declared exact read-only evidence and project the bounded reasoning surface, recording operation lineage, omissions, and effective limits;
- receive a policy proposal citing that surface and frontier evidence;
- validate action identity, capability snapshot, allowed effect, preconditions, and remaining budget;
- submit or perform the action through its owning contract;
- retain action, run, attempt, output, and failure lineage;
- materialize affected post-action lenses;
- compute transition and applicable residual deltas;
- evaluate claims, progress, and the next frontier; and
- commit the transition record before selecting another action.
An action can complete successfully while its transition fails semantically. For example, a compiler process may exit zero while the dependency graph or test evidence still differs from the claim. Post-action observations, not exit status, determine convergence.
A policy receives a bounded view of the current workload, graph/scenario evidence, space, frontier, admissible graph operations or actions, and budgets. It returns a structured proposal. The runtime treats that proposal as untrusted input and validates it identically whether it came from a model, a rule, or a human.
Provider credentials, prompt construction, inference retries, and model context management do not belong in core diff or proof crates. A provider adapter may exist later behind the policy contract.
Providers implement narrow Rey-owned contracts and retain ownership of their source, query, execution, capture, and retention semantics. Rey binds exact provider identities and advertised guarantees into evidence; it never reaches through a public interface into private storage or upgrades local evidence into a stronger claim.
The implemented profile is local. Any future adapter requires a concrete Rey workload need, an accepted decision, bounded public-contract fixtures, and a human-verifiable CLI path. No provider becomes a privileged architectural plane by anticipation.
A codebase explorer might define these frames:
files(path, digest, language, bytes, generated)
symbols(symbol_id, path, kind, name, visibility, span)
references(source_symbol_id, target_symbol_id, kind)
dependencies(source_unit, target_unit, kind, scope)
diagnostics(tool, path, span, severity, code, message)
tests(test_id, target, status, duration_ms, output_digest)
changes(path, before_digest, after_digest, change_kind)
claims(claim_id, entity_id, status, evidence_id)
Source text remains versioned content rather than a giant cell. Relations carry stable identities and spans back to that content. A mutation to one file can invalidate symbol, dependency, diagnostic, and test lenses; the resulting deltas identify the smaller frontier that should direct the next action.
Those relations may be produced by different mining rungs: bounded text search can populate matches, a parser can populate syntax nodes, a semantic index can populate symbols and references, and grouped transforms can derive metrics. Every rung retains exact source, operation, completeness, and dependency lineage so a richer but partial index cannot silently replace source truth.
The first design proposes these Rust ownership boundaries:
| Crate | Ownership |
|---|---|
rey |
Workload CLI, catalog/configuration composition, the foreground agent-process orchestrator, and user-facing orchestration |
rey-core |
identities, revisions, limits, statuses, and shared value contracts |
rey-mining |
provider-neutral mining operation/request/result, artifact, completeness, dependency, and visualization contracts; no query engine, parser bundle, or storage |
rey-locator |
canonical coordinate bindings, locator syntax, resolution outcomes, and exact resolver limits; no retrieval authority |
rey-dataframe |
frame metadata, Polars schemas, Arrow codecs, and bounded rendering |
rey-environment |
capability discovery, snapshots, provider contracts, and local context adapters |
rey-git |
repository identity, bounded current reachable-commit sequence, commit/ref/index frames, polling cursors, triggers, and activations |
rey-diff |
relational, text, and structural comparison contracts, typed changes, summaries, and diff projections |
rey-runtime |
workload/graph/scenario lifecycle, spaces, lenses, actions, transitions, budgets, cancellation, and trace assembly |
rey-frontier |
canonical frontier/progress relations, prioritization inputs, convergence evaluation, and bounded deterministic selection |
rey-proof |
claims, evidence manifests, certificates, verification, and staleness |
rey-policy |
bounded reasoning surfaces plus provider-neutral proposal and admissible-action contracts |
This table is an ownership proposal, not a requirement for one process per
crate. The narrow rey-mining contract crate is implemented; provider
execution remains in the adapters that own its source and tool semantics.
The browser workspace has a parallel one-way ownership boundary. @rey/agent
owns evidence adapters, projection-packet semantics, immutable scenes, fields,
camera, LOD, render graph, picking, versioned terrain derivation, routing,
controls, accessibility, reference rendering, and evidence panels.
@rey/explorer owns only the reusable browser canvas: declarative React Three
Fiber scenes, bounded Three.js resources, upload parity, backend lifecycle, and
pixels. The agent passes already compiled, structurally typed scene inputs into
that package; the package cannot import the application, fetch evidence, or
reinterpret semantic state. Neither React Three Fiber nor the Three.js
lifecycle adapter can absorb Rey's immutable scene, field, or evidence
ownership. No new Rust crate is implied until a shared CLI/browser contract or
server-side compiler requires one.
Rey treats capability drift, Git ref rewrites, incomplete history, index conflicts, cursor replay, source drift, stale proposals, unsupported mining, partial parsing/indexing, duplicate keys, incompatible schemas, probe failure, action rejection, process loss, capture/visualization truncation, cancellation, budget exhaustion, and unavailable optional or required capabilities as ordinary explicit outcomes. None imply equality or convergence.
Every loop has total time, iteration, action, and evidence-byte limits. Every frame and delta has row, column, cell-change, and encoded-byte limits. A policy has a response deadline and proposal-size limit. Proofs retain which limit stopped evaluation.
Rey is not an execution sandbox. It records the actual trust and enforcement claims of a local executor. Policy proposals carry no ambient authority. Rey configuration and proof artifacts contain references to secret handles, never secret values.
Local adapters must distinguish trusted developer input from remote or adversarial content, remain within explicitly selected roots, and never silently widen host filesystem access. Tool discovery is not execution authority. An adapter must never reinterpret a local host path as a provider resource or silently widen access.
The standalone capability path is implemented across rey-core,
rey-dataframe, rey-environment, rey-git, rey-diff, rey-proof, and the
rey composition/CLI crate. It includes bounded environment observation, a
partial read-only Git observation plus verified local cursor, pending
transition/history, and proposal-only activation contracts, verified
capability snapshot loading, an
exact capability comparator, typed structured and Arrow deltas, Tabular Diff
projection, required-capability certificate evaluation and verification, and
bounded content-addressed local proof bundles with explicit filesystem-only
guarantees. The env CLI now adds a verified bounded linear history of
capability snapshots: status derives HEAD-to-working state, commit accepts
one non-empty semantic revision, and log -p reopens exact parent-directed
environment patches. Status separates staged and unstaged working-tree rows,
interactive add confirms environment-native hunks, and new commit identities
bind explicit retention time. These environment commits are local Rey observations, not
Git objects or remotely durable revisions. rey-runtime implements the pure
formal state reducer through an explicit scheduling phase; rey-frontier
implements canonical frontier, progress, and bounded selection contracts; and
rey-policy implements the bounded reasoning-surface document and DataFrame
projection.
The rey CLI now hard-cuts the former ui command to agent. That command
starts one foreground rey.process.v1 orchestrator, supervises the embedded
Axum operator HTTP worker and exact admitted GitHub inbox poller under
rey.agent-topology.v1, exposes the topology in JSON, browser, and HTTP health
projections, logs lifecycle transitions, emits only the listening URL in
default human startup output, and cooperatively closes both workers on
SIGINT/SIGTERM. No autonomous workload or discovered agent runtime starts with
it.
The workload slice implements a bounded workspace package catalog, typed DAG
execution, scenario deltas, exact qualification, verified local result state,
and the list, status, test, and run commands. The prior compiled
fixture catalog remains behind explicit conformance selection.
The v1 frontier, progress, scheduling, reasoning-surface, and runtime-state
contracts bind workload, graph, scenario-suite, and campaign identities.
The source-search conformance workload supplies one narrow workload-specific
frontier derivation and provider execution path. The admitted
context-anchor-survey workspace package adds a bounded local survey provider,
typed topography patches, directed patch deltas, and CLI/UI projections over
the retained result. The browser additionally derives bounded World geometry,
anchor-only relief, unresolved atmospheric fronts, projected hydrology and
erosion, and probe prerequisites; the CLI exposes their admitted inputs,
excluded edge provenance, projection limits, and boundary actions. Discovered
or constructed paths require a separate future evidence contract. Revisioned
survey, survey-layout, survey-terrain, and portfolio projections now own their
respective adaptation; the topology boundary retains shared types, orientation,
high-level dispatch, and admitted regional projection. rey-mining now defines
and validates rey.projection-packet.v1; rey.workload-list.v1 carries it beside
the exact patch and also carries the deterministic rey.semantic-atlas.v1
portfolio projection. Production survey transitions retain a bounded linear
atlas history plus rey.semantic-atlas-delta.v1; accepted production regional
scene runs enter the same history as a separately typed evidence family, while
qualification fixtures and reads cannot advance it. The CLI exposes exact
source/target revision,
inserted, removed, moved, interest-changed, merged, and split counts alongside
the atlas revision, region/cluster counts, synthetic coordinate authority,
reclustering rule, and the packet's
terrain evaluator, macro/meso/micro bands, absolute-coordinate validity rules,
and maximum transient working-set allocation. Explorer requires those
identities to match. The browser compiles bounded haloed absolute-coordinate survey
validity/elevation/hydrology/normal/curvature/material patches, retains exact
patch identities in a byte/cell-bounded LRU, and renders continuous relief
through declarative React Three Fiber components over the Three.js WebGPU/TSL
backend with WebGL2 and deterministic reference paths. The immutable scene
binds a revisioned ordered pass graph consumed by both surfaces, and the R3F
demand loop suppresses frames whose exact scene, camera, material, and graph
identity is unchanged. Accelerated terrain totals
exact vertex/index upload bytes before geometry allocation, enforces a 64 MiB
engine budget, verifies every upload sample against isolated deterministic CPU
fields, and exposes the allocation and parity revision through the live
renderer report.
Qualified regional grids follow a separate non-procedural path: the browser
maps exact admitted row-major height/material and valid/no-data vertices into
one renderer-neutral field, binds its dataset/compiler revisions into the
immutable scene, and shares one adaptive validity-safe triangulation between
the reference and accelerated paths. A conservative source-bound tile pyramid,
cancellable worker, bounded residency, 3D County camera, and reversible
Atlas-to-Landscape projector now consume that field. Revisioned material,
hillshade, occlusion, contour, hydrology/weather/boundary, feature, and
selection passes execute in the accelerated terrain group. Supported admitted
vectors use exact retained geometry rather than rectangular object envelopes.
Drape compilation
checks every crossed grid cell and splits at no-data; labels, evidence, and
accessibility remain in the mounted deterministic reference overlay. The first
in-memory grid and absent imagery provider remain explicit boundaries; Plan
0005 owns retained fidelity/performance qualification and future native raster
adapters.
Both surfaces project the active admitted subset of that graph without changing
the immutable graph or scene identity. Explorer exposes no transient per-layer
controls: available contours, water, weather, and probes remain visible while
base terrain and validity retain their independent pass identities.
The centered canvas footer uses the canvas header's background but remains a
transient status projection rather than an evidence or mailbox store. Every
notice remains visible for at least five seconds by default; map input during
that interval queues dismissal without shortening it. The footer resurfaces
only for exact lens, focus, source-revision, or last-good revalidation changes;
ordinary readiness, camera motion, and renderer-status changes remain quiet.
Renderer degradation stays
explicit in machine-readable diagnostics and the visible reference fallback
without publishing a footer notice. The zoom/geographic-coordinate
diagnostics track that motion, sitting above a visible notice and returning to
the lower canvas edge when quiet. Their latitude/longitude authority remains
explicit: globe-view, synthetic semantic-Mercator, or footprint-bound native
CRS84; unbound local coordinates remain unavailable rather than being relabeled
as geographic. A regional World entry reuses the globe's human caption and
abbreviated exact source revision. Notice content has an independent bounded
entrance transition and remains mounted while the footer eases closed.
The revisioned survey-terrain scene compiler owns reference field evaluation,
contours, projected hydrology/weather, and natural-feature derivation. Named
reference, WebGL2, and WebGPU voyages retain both target viewports; parity
manifests require exact scene/source/pass/evidence equality before measuring
pixels, and native backend-loss voyages preserve the visibly degraded reference
scene. A separately named voyage proves that the five-second passive refresh
publishes a bounded generated attention stimulus into the mailbox without
changing the exact Explorer scene. Direct browser networking and named
GPU/frame-time proof remain incomplete
Plan 0003 work.
The local software-renderer qualification separately binds versioned ceilings
for observable CPU compilation, upload residency, backend draw calls, label
candidates, JavaScript heap, interaction convergence, and browser presentation
cadence across that six-voyage matrix without calling presentation cadence GPU
execution.
Generic graph-entry
activation, persistent cross-poll activation processing, and policy proposals
remain target architecture. Compatible admissions within one
retained Git transition already reuse a directly evaluated scenario result
under exact input equality and the receiving evidence budget.
rey-mining also defines and verifies rey.explore-grammar.v1,
rey.admitted-regional-scene.v1, and
rey.regional-projection-packet.v1. Those contracts bind projection posture,
LOD, picking, camera bounds, exact editor/workload lineage, distinct native,
synthetic, Mercator, County-local, and camera coordinate planes, typed native
objects/layers, validity, limits, omissions, and explicit optional
topography/atlas/terrain relationships. Multi-region fixtures prove their
bounded structural invariants. rey-runtime now produces these contracts
through the qualified file-backed workload, and the CLI exposes exact human and
JSON evidence for a real SCENE@n. The browser consumes only a matching
accepted production result whose retained regional-atlas member binds the exact
scene, admission, package revision, packet, and synthetic point, then projects
that point and exact native object bounds. The retained scene carries the exact
atlas revision as a non-owning back-reference: it is excluded from scene_id
to avoid recursive content identity, included in result/run identity, and
verified against the retained atlas member before state can be saved. Each
region also names one stable occupied 30-degree synthetic sector. The sector
polygon is membership geometry only, never surveyed coverage or a native County
footprint.
The rey-mining crate now implements the provider-neutral operation, request,
result, artifact, completeness, lineage, dependency, and bound contracts.
Canonical semantic identities include evidence-changing
parameters and effective limits; replay verification rejects tampering and
request, provider, capability, or implementation drift. rey-environment now
implements an exact explicit local corpus binding, deterministic case-sensitive
UTF-8 literal search, native context retention, and the typed
rey.source-matches relation through those manifests. rey-diff implements
rey.text-delta.v1 and rey.source-match-delta.v1; rey-runtime composes the
source provider and renderer in one qualified graph, derives one frontier row
from its complete failing evidence, selects it with the generic scheduler, and
projects one verified reasoning surface. The CLI exposes complete, different,
and truncated mining evidence through the workload conformance projections and
retains product execution behind workload HEAD.
The first portfolio-mining slice adds rey.portfolio-snapshot.v1, the
Polars-backed rey.workload-attention.v1 relation, and the qualified
rey.portfolio.attention system workload. The workload CLI now exposes exact
attention actions, reasons, readiness, coverage, evidence, priority, cost, and
exclusions. Read-only list/status consume retained environment state; the
explicit conformance run evaluates the same retained portfolio inputs under
fresh qualification. Workspace packages declare bounded mapped-surface and
Git HEAD/index dependencies. List/status derive live invalidation from retained
environment evidence and the acknowledged Git cursor, then hand ready rows to
the generic frontier and one bounded reasoning surface. One selected CREATE
row can cross an immutable harness request/response and exact human workload
admission cycle without Rey invoking the harness. An acknowledged Git
activation can separately cross exact workload/runtime preconditions into a
content-identified admission and replay-stable selected-scenario execution.
Recurring scheduling, cross-poll activation coalescing, admitted rg search,
parser/index breadth, general structural delta, and a provider-specific agent
loop remain unimplemented. Those require the same human-verifiable end-to-end
boundary before they count as delivered.