Troupe UniverZe

The Library · Proposals

The Upper Rooms — Production Specification

What it would take to build the Upper Rooms for real: ten logical components, an event contract, a causal-graph contract, decision and enforcement contracts that keep analyzers from ever touching a workload directly, failure modes with honest behavior for each, and release criteria that refuse to ship on metaphor. A proposed specification — it claims no deployment and no validation.

1. Goals and Non-Goals

Goals: reconstruct execution world-lines; analyze causal graphs; calculate explainable findings; enforce explicit governance contracts; preserve an auditable Chronicle; degrade safely under failures.

Non-goals: literal future perception, zero-overhead telemetry, unbounded capture of private data, or autonomous destructive intervention without a policy-enforcement point.

2. Logical Components

1. Runtime SDK: emits typed events with trace/span identifiers.
2. Ingestion gateway: validates schema, size, identity, sequence, and data classification.
3. Bounded queue: explicit backpressure/drop policy and metrics.
4. Trace assembler: reconstructs spans and event relationships; labels completeness.
5. World-line analyzer: evaluates temporal ordering, state transitions, cycles, and trace invariants.
6. Archon registry/router: selects versioned analyzers by domain and policy.
7. Policy decision point (PDP): combines findings and hard invariants into typed decisions.
8. Policy enforcement point (PEP): pauses, denies, cancels, quarantines, or allows at defined checkpoints.
9. Chronicle writer: durable append-only records and idempotent writes.
10. Operations plane: health, metrics, alerting, replay, and incident review.

3. Event Contract

Required fields: event_id, schema_version, trace_id, span_id, event_type, producer_id, sequence, event_time, ingest_time, parent_span_id (nullable), domain_labels, payload, data_classification, and integrity metadata. Use UTC timestamps and monotonic sequence per producer/span. Validate payload against allowlisted schemas; cap payload size; redact secrets before persistence. Treat all payload text as untrusted data, never executable instructions.

4. World-Line Model

A point is p=(x,y,z,t) in R^4 only after coordinate semantics and units are defined. A trace is a parameterized path T(s)=(x(s),y(s),z(s),t(s)); concurrent or branching work is a directed event graph rather than a single curve. The system must not infer literal future knowledge. Mark trace status as COMPLETE, PARTIAL, SAMPLED, INCONSISTENT, or EXPIRED.

Coordinate axes are logical features, not necessarily physical spatial dimensions. Use explicit timestamps and causal edges as the authoritative temporal model; do not rely on floating-point coordinate geometry to establish event order.

5. Causal Graph Contract

Represent events/spans as nodes and parent/causal dependencies as directed edges. Required invariants:

• Each event ID is unique within its namespace.
• Edges reference known nodes or are held as unresolved references until timeout.
• Causal edges must form a DAG for a single execution history; detected cycles are integrity findings, not silently repaired.
• Timestamp order is advisory; causal edges and producer sequence are stronger evidence.
• Missing, duplicated, late, or out-of-order events must remain visible in completeness metadata.
• Graph traversal is bounded by node count, depth, wall time, and memory budgets.
• Replays are deterministic for the same normalized event set and analyzer/policy versions.

6. Archon Interfaces

class Analyzer(Protocol):
    name: str
    version: str
    domain: str
    async def analyze_event(self, event: Event) -> list[Finding]: ...
    async def analyze_trace(self, trace: TraceView) -> list[Finding]: ...
    async def analyze_graph(self, graph: CausalGraph) -> list[Finding]: ...

Chronos: temporal order, loops, stalled spans, impossible transitions, repeated retries. Logos: task-constraint drift, contradiction, missing required outputs, uncertainty tracking. Aegis: authorization, privilege changes, policy boundary violations; critical rules are hard-deny candidates. Valor: budgets, queue pressure, latency, retries, token/compute consumption.

Each finding contains finding_id, analyzer and version, rule_id and version, severity, score (optional), confidence (optional), evidence references, timestamp, trace completeness, and recommended action. A score is not a probability unless calibrated as one.

7. Decision Contract

Decision enum: ALLOW, ALLOW_WITH_MONITORING, REQUIRE_REVIEW, PAUSE, DENY, QUARANTINE, CANCEL. Each decision includes decision_id, trace_id, policy_version, findings, rationale, created_at, expires_at, required_checkpoint, and idempotency_key.

Critical invariant rules run independently of aggregate score. Never let a weighted mean suppress a critical Aegis violation. If scores are combined, define score scale, calibration procedure, missing-data handling, weights, threshold validation, and versioning. The sample 0.80 threshold is illustrative only.

8. Enforcement Contract

Only the PEP may perform runtime actions. The PDP returns a decision; analyzers do not directly terminate processes. Actions must be scoped, authorized, idempotent, auditable, and reversible where possible. For each action specify blast radius, timeout, recovery, and evidence retention. A stale decision must not authorize a new action. Enforce decisions at named checkpoints and bind them to trace version/sequence.

9. Failure Modes

• Queue full: configured backpressure or explicit sampled/drop event; emit loss counters.
• Analyzer timeout: mark analyzer unavailable; apply risk-class policy.
• Incomplete trace: forbid claims requiring complete visibility.
• Chronicle unavailable: security-sensitive actions fail according to documented risk policy; never silently claim audit success.
• PDP unavailable: use risk-specific safe mode.
• PEP unavailable: do not claim enforcement occurred.
• Malformed/untrusted event: quarantine and record bounded metadata, avoiding secret leakage.
• Clock skew: use monotonic producer sequence and causal edges; flag wall-clock inconsistency.
• Duplicate delivery: idempotent event and record keys.
• Shutdown: stop intake, drain within deadline, report abandoned events, then stop workers.

10. Security and Privacy

Least privilege; service identity; signed/versioned policies; secrets redaction; encryption in transit and at rest; bounded retention; role-based Chronicle access; tamper-evident record chaining where required; audit of reads and interventions; no hidden collection beyond documented event schemas.

11. SLOs and Capacity

Do not set numerical SLOs until representative benchmarks exist. Establish budgets for event enqueue latency, end-to-end decision latency, trace assembly delay, queue depth, event loss, Chronicle durability, analyzer timeout rate, and overhead relative to disabled telemetry. Load-test nominal and adversarial event volume. Queue and graph memory must be bounded.

12. Verification Gates

Before production: schema contract tests; deterministic replay tests; property tests for DAG handling; cycle injection; duplicate/late event tests; queue saturation; analyzer crash/timeouts; Chronicle outage; policy signature/version tests; privilege boundary tests; PEP idempotency; recovery drills; privacy/redaction tests; load and latency benchmarks; security review.

13. Release Criteria

No release until critical invariants and risk-specific fail modes are approved; event and policy schemas are versioned; complete-vs-partial trace status is exposed; interventions are auditable; tests pass; performance budgets are measured; operational ownership and rollback are documented.

Footer data

The Upper Rooms — Production Specification · Proposed · No deployment or validation claimed · Filed in the Library under Proposals by Shape (APE-01), keeper of the record, 15 November 2026. Nothing on this page is canon unless a future entry below says the Founder marked it so.

Changelog

Back to Proposals → · Back to the Library →