The Transfer Envelope — Contract

This is the machine-readable version of an idea I keep rebuilding: a unit of information should carry its own type, provenance, trust, and portable address as a first-class envelope, so its meaning survives crossing a boundary — and the relationships between units should be their own addressable, attributed records, not fields welded into whichever store happens to hold them.

The prose is here. This page is the contract: the shape you can validate against, and the running system that proves it holds up.

→ taylorsando.com/transfer-envelope.schema.json — JSON Schema (Draft 2020-12). Point a validator at it.

The claim

A unit of information should carry its own type, provenance, trust, and address as a first-class envelope, so meaning survives transfer — and relationships between units should be their own addressable, attributed records, not fields welded into any one store.

Everything below is a consequence. The one-line test for whether a part of this is reusable by someone else is the transfer-envelope test applied to itself: the path-independent core is exactly the part that keeps its meaning when you move it to a different system.

The shape

The envelope — every unit is wrapped, not naked. Metadata in the wrapper, never the blob:

Envelope {
  id
  type        # what kind of thing this is (open vocab, runtime-validated)
  ref         # this unit's own portable address
  payload     # the content (any type — prose is one payload type)
  provenance  # { producer, produced_at, source_ref }
  trust       # { channel, may_instruct }
  edges       # typed links to other units — NOT embedded in payload
}

The address — portable, and able to name a part, not just the whole:

<scheme>-ref://<kind>/<id>[#<sub-anchor>]

The #sub-anchor is what lets a captured part survive a hop as something you can point into, and it is opaque to the grammar — so the same mechanism addresses a part in space or in time: a CSS selector or bbox=x,y,w,h for a DOM element or image region, t=start,end for a video or audio segment, L10-15 for a text span. A video segment is addressed exactly like a DOM element. Percent-encoded so its own characters can't collide with the separators; a downstream on any system resolves it without a foreign key it has no way to follow.

Relationships are their own layer — a typed, attributed edge that points at both endpoints and lives in one overlay store, so a new kind of link is a new rel, not a migration:

Edge { from, rel, to, principal, trust, asserted_at, retracted_at }

Trust is a channel, not content. provenance.producer and trust.may_instruct are typed fields checked at sinks — the places that spend money, deploy, send externally, or let content act — not scattered through the text and not read by everything. It ships advisory (recorded, enforced by nothing) and graduates to enforcement at a specific sink when a real incident makes the risk legible. The fix for prompt injection is typing the channel, not sanitizing the text.

The three invariants

What keeps this a solution and not new sprawl:

1. One edge store — every relationship, one overlay table, never a bespoke link table per pair.
2. Bitemporal-lite — assert and retract, never hard-delete; history stays walkable.
3. Open vocabulary, runtime-validated — type and rel are open; rigidity here rebuilds the migration problem you're escaping.

Break any of the three and it degrades back into another fragmented schema.

Path-independent vs. path-dependent

The reusable thing is the shape, not my stack. The explicit cut:

Path-independent (the contract)	Path-dependent (my implementation detail)
Envelope carries type + provenance + trust + address	The exact DB, wire format, auth
Portable *-ref:// addressing with sub-anchors	The exact ref grammar and table shapes
Relationships are typed edges in one overlay store	Postgres, HMAC-signed doors, DID principals
Trust is a channel checked at sinks	Which sink enforces it, and when

Everything in the left column transfers. Everything in the right column is a choice you'd rightly make differently.

Adopt it

Three levels, increasing commitment:

• Principle — "envelope, not payload; address the parts; relationships are their own layer; trust is a channel checked at the sink." Zero cost, total portability. Use it as a design rule.
• Pattern — a non-destructive typed-edge overlay: add one edge store beside your existing tables, never migrate them. Re-implement on your stack.
• Spec — the envelope shape and *-ref:// grammar above, as an interop contract. High value if shared between systems.

Proof it runs

This isn't only a document. The whole shape is live in a real system: a generic typed-edge store (kernel_refs), a mesh-ref:// address grammar with sub-anchors, capture that mints addressable elements, and a trust channel that already refuses to let untrusted captured content instruct an agent. That's the reference implementation — not the thing to copy, the proof it holds up under load.

→ See it running.