FieldnoteBuilding the RSM kernel
The First Plan Had Semantic Debt
Reconciling the first RSM kernel plan with the canon, before anything was built against it, exposed engineering shorthands that would have encoded the wrong ontology. The correction produced a rule for what a first implementation may postpone.
The first plan for the RSM kernel was a good engineering plan. It chose the smallest slice that could prove the model: a person describes a capability, publishes an offer for themselves and becomes discoverable, while an attempt to act for an organization without authority is refused. It sequenced the work sensibly. It put contracts before infrastructure. It said the plan "does not define meaning", and that where it conflicted with the canonical model, the canon would govern.
Then we read it line by line against the canon, before anything was built on it, and found that it did define meaning, in several places, through the ordinary shorthands engineers use to get moving. The corrected plan names the problem precisely. Its corrections "remove semantic debt that v1.0's engineering shorthands would have created."
The clearest case was the participant. The first plan listed "Participant (Person)" and "Participant (Organization)" as the kinds the slice needed. That is a natural table design, and it is exactly what the RSM forbids. In the canon, Person and Organization are agents with their own identities. Participant is a contextual role that a person, an organization or a governed community plays. It is never a synonym for organization. A participant table with a type column would have made "role" into "kind" in the storage itself, and every later distinction between participation and representation would have had to work against the schema. The corrected plan says it outright: the kernel must not model a participant with a person-or-organization type.
The others were smaller, and the same in character. The first plan described describe as "create/enrich a Person", which turns a governed act of description into a create-and-update call. It listed the protocol operations it would build and left one out of the canonical registry altogether. It defined acting for an organization as resting on "verified Affiliation = owner, Stewardship, or Delegation", which put affiliation on the authority path at the point where the canon is most careful to keep it off. And it wrote a commercial product rule into the slice that kernel conformance would test, which bundled one application's policy into the definition of the model.
The corrected plan replaced each shorthand with the canon's own distinction. Person and Organization are agents, and participation is a role, recorded as an association rather than an actor table. Self has no stored record at all. Describe is a governed description of a canonical subject. The full operation registry is present, and operations not yet built return a semantic "unsupported" result instead of "no such thing". Representation rests on stewardship or delegation, and an affiliation alone confers no authority. RSM conformance and product acceptance became two separate gates that pass independently. "No organization required" is an RSM agency requirement. The commercial rule is the product's.
Viewgraph5 frames
Building the RSM kernel
What a first implementation may postpone
Features can wait. The meanings those features will need cannot.
Wellzai
Four pairs
Postpone the feature, keep the seam
Each pair names what was deferred and what had to exist from the first milestone.
Unbuilt operations stay registered and answer "unsupported", never "no such thing".
One process, one store; canonical identity is still not a database key.
No biography views yet; every material change is still recorded as an event.
No agricultural vocabulary yet; classifications already point to governed concepts.
Reconciliation
Shorthands that would have become ontology
What the first plan wrote, and what the canon required instead.
Person and Organization are agents; participant is a role they play.
A governed description of a canonical subject, not a create-or-update call.
Stewardship or delegation; an affiliation alone confers no authority.
Moved to product acceptance, a separate gate.
Authority
A test that refusal cannot pass
The refusal cases only mean something if legitimate representation must succeed.
Rendering diagram…
Refusing every organization-scoped request passes two cases and fails the suite.
The test of the plan
Build the first chain without blocking the second
The kernel implements identity, authority, discovery and disclosure. Formation reasoning comes later and must not require their redesign.
Defer capability, not semantics.
Defer capability, not semantics
The correction did not change the strategy. The kernel was still the smallest correct thing, and most features were still deferred. What changed was the understanding of what may be deferred, and the corrected plan states it as a principle: "Defer capability, not semantics. Defer distributed deployment, not federatability. Defer Biography projections, not the historical substrate. Defer domain-pack content, not the taxonomy architecture."
Each pair separates a feature from a commitment of meaning that the feature will later depend on. The kernel builds no biography views, but it records every material change as an event, because a biography cannot later be built from history that was overwritten. It holds no agricultural vocabulary, but classifications already point to governed concepts rather than hard-coded lists. It runs as one process over one store, but canonical identity is not a database key. Postponing the first half of each pair is cheap. Postponing the second half creates debt that grows with every consumer.
One more correction deserves to be remembered separately. The authority tests in the corrected plan include acting for oneself (allowed), acting for an organization with no authority (refused), acting on affiliation alone (refused), and acting with valid stewardship or delegation (allowed). The plan then adds a sentence that matters more than any single case: an implementation that passes the refusal cases "by simply rejecting every Organization-scoped operation fails the suite." A test suite about authority can be passed by refusing everything. Only a suite that also requires legitimate representation to succeed is testing authority rather than caution.
The lesson we carry forward is modest and practical. Reading a plan against the canon is cheap before code exists and expensive after. The shorthands were not careless. They were the most natural way to write the plan, and that is exactly why they needed checking.