canonical schema · IM v0.1 · the single artifact every build agent touches
Information Model & Invariants
The canonical shape of the record: the four primitives that close the vocabulary, the eleven laws that hold on any implementation, the event log they all fold from, the tables the four launch slices require, and the conserved quantities the database itself refuses to break. The document governs; the substrate migration it emits distills.
status · Draftedcites · PRD v0.3 · SER v0.1 · BP v1seeded by · the eleven laws (The System Before Its Name) · the C6 schema cardemits · 0001_substrate.sqlRegenHub, LCA · Boulder · July 2026
§1
Preamble
Every build agent reads this document before touching the schema, because ambiguity here multiplies into every packet downstream. Version 0.1 does three things: it carries the eleven invariant laws already drafted in The System Before Its Name, with one derivation updated and flagged; it specifies in full the tables the four launch slices of PRD v0.3 §4 require; and it carries the post-launch table families by reference to their bylaw anchors, to be re-specified when their slices are authored.
Its inheritance from the estate is the C6 schema reference card, thirty-one tables with source annotations. The nineteen cooperative core tables carry in principle; this document re-specifies the launch subset by name and leaves a reconciliation packet to confirm or retire the remainder against C6, entry by entry, at the merge. The twelve Hub extension tables reduce to the four that Gather needs, plus one salvage into Belong; the rest retire with the grant, per the deprecation record at PRD v0.3 §1a. Open · C6 reconciliation packet
The emission pattern of the series continues: this document governs, and 0001_substrate.sql distills it into the first migration. Row-level policies are not in the emission; they belong to the Authority Map, and until AM lands the substrate ships with row security enabled and denying by default, which is the honest posture for a schema whose visibility function is still being drafted.
§2
The four primitives
Everything in the system resolves to one of four families, and every relationship between records is itself an event. The vocabulary is closed: a new kind of thing enters only by expressing itself through these four. This is Law II, and it is what lets a contribution, a vote, a payment, and a membership be reasoned about in one grammar.
who participatesAgentsPeople, the cooperative itself, external partners, programs as hosts, and the instrument layer. One agent record per participant, persisting across every change in relationship, from visitor to member to patron.
what flowsResourcesThe things of value: money, member time, contributed assets, program deliverables, presence. Valued at contribution in the unit of account, never re-marked except by an explicit revaluation event.
what happensEventsThe happenings that transfer resources between agents under agreements. Every change in the system is an event; the log of them is the single source of truth, per Law I.
what bindsAgreementsFirst-class records, not metadata: the bylaws, the membership agreement, board policies, and the schedules beneath them. Versioned and effective-dated, so every computation binds to the policy version in force.
derives from REA ontology · McCarthy 1982 · as extended in CIS PRD §6 and carried through PRD v0.3 §5
§3
The eleven laws
Carried from the seed artifact with numbering intact, each stated in one line here; the full statements and glosses remain in the source and continue to govern. One derivation is updated below and flagged as a departure rather than slipped in.
LAW ISingle source of truth
state(t) = fold(events where t′ ≤ t) · the log is append-only · a correction is a compensating event, never a mutation
LAW IIOntological closure
every record ∈ { Agent, Resource, Event, Agreement } · every relationship is an Event
LAW IIIConservation
the data layer refuses any state that violates a conserved quantity, before it is written
LAW IVAuthority binding
every governed record cites its authority · every derived value has recoverable inputs · cite as you enforce
LAW VVisibility as a function of the bylaws
visible(agent, record) = f( role, record class, governing § ) · structural, never a toggle
LAW VILifecycle automaton
membership is a finite state machine · each transition an event gated by ( §condition, timing window ) · human-assigned transitions never automatic
LAW VIIOne account, two projections
one capital account per member · one contribution event → { book balance, §704 allocation measure } · both folds, neither a second truth
LAW VIIITax neutrality of the record
a record is evidence, not income · tax attaches at allocation under §704(b) · the paired covering distribution is explicit policy
LAW IXDual-book partition
two books over one substrate, entity and host · shared ontology, identity, treasury, agreements, visibility · records tagged, never duplicated
Derivation updated in this version: the law arose from the grant split, but the partition survives the grant, because the cooperative as host is a standing condition. The host book now carries program arcs generally, cohorts, games, engagements, wherever the cooperative hosts work with its own cadence and reporting. The law's text is unchanged; its ground is wider. Drafted · departure flagged
every record class exports · export ⊕ log reconstructs state on other infrastructure within a bounded window · authoritative state queryable independent of any derived surface
source · The System Before Its Name §2, which retains the full statements and glosses · Laws I to VIII, X, XI carry verbatim in force
§4
The event log
One table, events, is the source of truth for everything computed. It keeps the primitive's true name, and the calendar happenings of the Gather slice are named gatherings and sessions to leave it undisturbed. That naming resolves a real collision and is proposed here rather than assumed; it is Todd's to ratify. Open · naming, Todd
Every row carries: when it occurred and when it was recorded, as two distinct instants; the acting agent; the book it belongs to, entity or host, per Law IX; its kind; its references into the other three primitive families; a payload; and, for rows that change a governed record, the prior value, so the log answers what happened, when, and why the same way it answers what is true now. Capital events additionally carry a book delta and a tax delta, even when equal, per Law VII, and a valuation method and approver where the contribution is non-cash.
Append-only is enforced in the substrate, not requested of it: a trigger refuses updates and deletes outright, and corrections enter as compensating events that reference what they correct. Of the three status axes, provenance and settlement are authored columns; temporal state is never stored, because it is derived from the clock at read time, per PRD v0.3 §5.
§5
The launch tables
The tables the four slices of PRD v0.3 §4 require, named here as this version's canon. Anchors cite the Drafted bylaws and harden at ratification. Anything not listed and not carried in §8 does not exist yet, and creating it is an escalation, not an improvisation.
belong
agentsOne row per participant: person, the cooperative, a program as host, a partner, or an instrument. The identity spine every other table references.
membershipsThe membership relation and its lifecycle state per Law VI, admission subset at launch. Class is held as text while the class structure is before the board. Cites §1.1 to 1.4. Open · Q4, class structure
stock_ledgerIssued shares by class. The one-voting-share conservation lives here as a partial unique index, not an application rule.
agreementsFirst-class, versioned, effective-dated instruments: bylaws, membership agreement, board policies, schedules. Every computation binds to the version in force.
signaturesAgent, agreement version, instant, and the event that recorded it. Signing is a human act; the row is its evidence.
applicationsAdmission intake, salvaged from the Hub application form into the front of the Law VI automaton.
gather
gatheringsThe calendar record: what is happening, who hosts it, under which agreement or policy.
sessionsOccurrences of a gathering, with their own times, so a recurring thing is one record with many instants.
registrationsA member's declared intent to attend a session, cancellable by the member without asking anyone.
attendancePresence recorded where the record counts it, with who recorded it. Cites §2.7.
find one another
opportunitiesOffers and invitations by kind: play, practice, work. Governed records with an author and a lifecycle, open to resolved or withdrawn, never a ranked feed.
responsesA member's answer to an open opportunity, timestamped and attributable.
resolutionsNot a table. A resolution is an event referencing the opportunity, per Law II: the outcome is a happening, recorded when the parties choose to record it.
see your share
No new tables. Contributions are valued rows in events, carrying their two deltas per Law VII; the capital account is a view, defined in §7; allocation logic waits on the counting rules. blocked · Q3
§6
Conserved quantities
Law III, itemized, each with the locus where the substrate refuses. The interface can be wrong; the ledger cannot.
at launchOne voting share per voting memberA partial unique index on issued voting shares in stock_ledger. A second issuance does not warn; it fails.
at launchLifecycle legalityA transition trigger on memberships permits only the moves the automaton defines. Transitions the bylaws assign to a human decision additionally require a recorded human actor, per Laws VI and X.
at launchBalances are foldsNo stored balance column exists anywhere in the schema. The capital account is a view over the log; deleting the view loses nothing.
at launchThe log is append-onlyA trigger refuses update and delete on events outright. Corrections are compensating rows that cite what they correct.
with their slicesVote arithmetic · patron-majority floor · allocation sumsStated now as committed assumptions, enforced in the substrate when the governance and allocation slices land: tallies equal the sum of immutable cast votes; Patron Class economic benefit holds the majority the Colorado act requires; allocated surplus sums to distributable surplus under substantial economic effect.
with its sliceNo phantom incomeAn income allocation and its covering distribution are modeled as linked events, so the commitment is held by the engine, sized to the member's liability, per Law VIII and explicit board policy.
carries the committed assumptions of the patronage spine, A02 through A08 · valuation discipline per A04: fair market value at contribution, revaluation only by explicit event
§7
Views and folds
Everything a surface shows is computed, never stored. The launch set:
directoryAgents joined to their memberships, filtered by the visibility function. Until the Authority Map lands, the view exists and the policies deny, which is the correct order.
capital_accountsOne row per member, two projections per Law VII: the book fold and the tax fold over capital events. Ships as a stub in the emission; its allocation logic waits on the counting rules. blocked · Q3
ledger indexThe generated machine index and status table the instruments read, per BP v1 §8. Derived, disposable, rebuildable.
exportsLaw XI is a criterion, not a phase: every table carries a documented export duty from its first commit, and export plus log reconstructs state on other infrastructure within a bounded window. The duty is stated here; each implementation is packet work verified by the Verification Spec.
§8
Carried by reference
The post-launch families remain canon without being re-specified yet. Each carries its bylaw anchors and waits for its slice, per PRD v0.3 §4's closing note.
Decisions & votesMotions, ballots, thresholds, outcomes; all votes immutable once cast. Cites §2.6, §2.8, §3.13 to 3.15.
Benefit report archiveThe one legally mandated information artifact, with its guaranteed public view. Cites §XV.
Lifecycle beyond admissionSuspension clocks, withdrawal, termination hearings, and the redemption schedule with its fixed horizon. Cites §1.4, §1.9 to 1.11.
Tax & reportingK-1 preparation data and election tracking. Its open constants sit with counsel and the CPA: the deficit-restoration or qualified-income-offset choice, the §704(c) methodology, book-up triggers, and the §754 election. Open · counsel & CPA
Treasury & distributionsAccounts, distribution authorization paths, multi-signature custody as security matures. The system is the record of the money, not the money.
The Hub reduction, stated plainly: of the twelve extension tables, four carry as the Gather set, one salvages as applications, and the remainder, the KPI, liaison, and grant-lifecycle machinery, retire with the grant. The C6 reconciliation packet of §1 confirms or retires the rest of the core by name at the merge.
§9
The emission
The substrate migration 0001_substrate.sql distills this document: the enums, the launch tables, the append-only and lifecycle triggers, the capital view stub, and row security enabled with no policies, denying by default until the Authority Map lands. Every table carries a comment naming its bylaw anchor, per cite-as-you-enforce, and the anchors are marked Drafted because the bylaws are.
What the emission deliberately defers: policies, to AM; seed and fixture data, to packets under the simulation rule; executable checks of the invariants, to the Verification Spec; and each table's export implementation, to packets carrying the §7 duty. Migrations are timestamped and ordered per BP v1 §6, and changes to this document are Tier C, with schema changes beyond it an escalation by definition.
the working agreement of this model
The schema is the part of the constitution that can refuse. Everything above it may advise, warn, or display; only the substrate says no before the fact, and the eleven laws are the list of its refusals. When a needed thing has no place here, the answer is a packet against this document, never a quiet new table.