Architecture

What we intend to build

This is a design, not a system. None of it runs. There is no schema, no runtime and no user, and the counter on the experiment page stands at zero. This page exists so the design can be argued with before it is written – not to suggest that it exists.

The whole thing answers one question about one proposed action: may this be done, to this asset, right now? Everything below is in service of making that answer checkable by someone who did not write it.

The shape

From a proposed action to a verdict

Four kinds of source feed the pack. The gate reads the pack, not the sources. The agent talks to the gate, not to the pack.

How a proposed action becomes a verdict Four sources feed the pack: the device over a local interface, written rules as citations, market prices, and a hand-written mandate. The pack holds the five layers, every fact carrying its source and its age. A foreign agent proposes an action to the gate. The gate reads the pack, evaluates the layers in order, and returns yes, no with a reason, or escalate. Every question and every verdict goes to the journal. The gate has no path to the device: only the agent acts. SOURCES THE PACK THE GATE OUT Device local interface, polled Rules citations, never copies Market tariff and exchange prices Mandate written by the owner 0 · Data connection 1 · Asset physics 2 · Grid and regulation 3 · Market and Bilanzkreis 4 · Mandate every fact carries its source and its age Gate reads the pack, evaluates 0 → 4 in order, stops at the first No Foreign agent outside the system proposes an action Verdict Yes · No · Escalate + the layer + a citation Journal questions and verdicts
Dashed means not built: the mandate layer and the foreign agent are both still to come. The picture ends at the verdict on purpose – what the agent does with it is the agent’s business, and the gate has no way to reach the device at all.

Components

Four parts, and none of them is an agent

The agent is the thing this is built for, and the thing it is not.

  1. 01 not written

    The pack

    One real asset, described across five layers, machine-readable.

    • A value, its source, and the time it was true
    • A validity: how long the value may be used
    • A citation for anything that comes from a rule
  2. 02 not written

    Adapters

    One per source. They turn a device, a rulebook, a price feed or a mandate file into facts with provenance.

    • Device: local interface, polled, with an explicit staleness limit
    • Rules: a reference and a short quotation, never the text itself
    • Market: tariff and exchange prices with their publication time
    • Mandate: a file the owner writes, not a system that infers one
  3. 03 not written

    The gate

    Takes a proposed action and the pack. Returns Yes, No with a reason, or Escalate.

    • Evaluates layer 0 first, then 1 to 4, and stops at the first No
    • Names the layer and the source behind every No
    • Never actuates anything
  4. 04 not written

    The journal

    Every question and every verdict, append-only, so a human can check after the fact.

    • The proposed action, verbatim
    • The verdict, the layer, the citation
    • The age of every value the verdict relied on

Data

What one fact looks like

The shape below is the whole argument in miniature: a value is never alone. It carries where it came from, when it was true, and how long it may be used.

A measured fact — layer 1
state_of_charge:
  value: 0.92
  unit: ratio
  source: device/modbus:40071
  observed_at: 2027-01-14T10:31:07Z
  valid_for: 60s
A normative fact — layer 2
grid_feed_in_limit:
  value: 800
  unit: W
  applies_to: metering_point
  source:
    reference: "EEG §8(5a)"
    quote: "…"
    retrieved_at: 2026-11-02
  valid_for: until_amended

The two differ in exactly one way that matters. The measured value expires in a minute; the normative one expires when somebody changes the law, and nobody sends a notification. The pack has to be able to say “this was true when I last looked, and I last looked in November” – because that is the honest answer, and the agent has to be able to act on it.

Design rules

Five rules the design has to keep

Each of these is here because breaking it would quietly turn the experiment into something that cannot be checked.

  1. 01

    An unreachable source is not a Yes

    If a layer cannot answer, the gate refuses or escalates. It never treats silence as permission. This is why layer 0 is evaluated first and why every value carries its age: without that, a refusal and an outage look identical from the outside.

  2. 02

    Rules are cited, never copied

    Statute text is free to reproduce; DIN, VDE and IEC standards are private and protected even where a law refers to them. The pack therefore stores a reference and a short quotation. That is a legal constraint that turns out to be an architectural virtue: a citation is checkable, a copy is only trustworthy.

  3. 03

    The agent stays outside

    Nothing in the design may require the agent to understand the schema. It proposes an action and receives a verdict. The moment the agent has to read the pack to obey it, every new agent has to be taught, and a foreign agent becomes impossible — which is the whole measure of this project.

  4. 04

    The gate bounds, it does not act

    The write path to the device belongs to the agent, never to the gate. If the gate could act, its refusals would be unfalsifiable: there would be no independent party left to disagree with it.

  5. 05

    The pack may be wrong, and must say so

    A consumer device keeps a write path for its manufacturer that the owner cannot revoke. The asset can therefore change under the pack at any moment. Every verdict states what it assumed and how old that assumption was, so a wrong verdict can be traced to a wrong belief rather than to bad luck.

Open

Decided against deciding, for now

These are open on purpose. Settling them before the first refusal exists would be answering questions nobody has asked yet.