{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://taylorsando.com/transfer-envelope.schema.json", "title": "Transfer Envelope", "description": "A unit of information that carries its own type, provenance, trust, and portable address, so its meaning survives crossing a boundary (world to system, system to agent, agent to durable output). Relationships between units are their own attributed records (edges) that POINT at units without rewriting them, never fields welded into any one store. Path-independent: the shape below is adoptable on any stack; the database, wire format, and auth are yours to choose. Prose: https://taylorsando.com/writing/the-transfer-envelope . Running reference implementation: https://taylorsando.com/proof .", "type": "object", "required": ["type"], "additionalProperties": true, "properties": { "id": { "type": "string", "description": "Stable identifier for this unit within its producing system." }, "type": { "type": "string", "description": "What kind of thing this is. OPEN vocabulary, validated at runtime, not a rigid closed enum — rigidity here rebuilds the very migration problem the envelope exists to escape." }, "ref": { "$ref": "#/$defs/ref", "description": "This unit's own portable address, so a downstream can point back at it (and at its parts) instead of copying it." }, "payload": { "description": "The content itself. Any type. Prose/markdown survives as ONE payload type among many — the fix is the envelope AROUND the content, not a new content syntax." }, "provenance": { "$ref": "#/$defs/provenance" }, "trust": { "$ref": "#/$defs/trust" }, "edges": { "type": "array", "description": "Typed links to other units. Kept HERE (or in a shared overlay store), never embedded inside the payload, so a relationship is a first-class, queryable, attributed record.", "items": { "$ref": "#/$defs/edge" } } }, "$defs": { "ref": { "type": "string", "description": "A portable address of the form -ref:///[#]. The optional #sub-anchor names a PART of the unit and is OPAQUE to the grammar, so the SAME mechanism addresses a part in SPACE or in TIME: a CSS selector or `bbox=x,y,w,h` (a DOM element or image region), OR `t=,` / `t=` (a video/audio segment or frame), OR `L-` (a text span). The anchor is percent-encoded so its own characters cannot collide with the structural separators. Any system can resolve it without a foreign-key integer it has no way to follow. This is why a video segment is addressed exactly like a DOM element — one grammar for capture, video, and text.", "pattern": "^[a-z][a-z0-9+.-]*-ref://[^/#]+/[^#]+(#.+)?$", "examples": [ "mesh-ref://kernel-ref/1007", "mesh-ref://dom_element/cap-42#div.article%20p:nth-child(3)", "mesh-ref://media_segment/9f3c1a#t=12.5,15.0", "mesh-ref://frame/9f3c1a#t=12.5", "mesh-ref://region/9f3c1a#bbox=10,20,64,64" ] }, "provenance": { "type": "object", "description": "Who/what produced this unit, when, and from what upstream — carried WITH the unit, not reconstructed by a downstream.", "required": ["producer"], "additionalProperties": true, "properties": { "producer": { "type": "string", "description": "The AUTHENTICATED producer identity (component, agent, or human). At a trust boundary this is the verified caller, never a self-declared body value." }, "produced_at": { "type": "string", "format": "date-time" }, "source_ref": { "$ref": "#/$defs/ref", "description": "The upstream unit this was derived from — a walkable edge, not a copied blob." } } }, "trust": { "type": "object", "description": "Trust is a CHANNEL, checked at sinks (the places that spend money, deploy, send externally, or let content act) — not a property of the content to be sanitized. Ships ADVISORY (recorded, enforced by nothing) and graduates to enforcement at a specific sink only when a real incident makes the risk legible. This is the capability-security / dual-channel idea: the fix for prompt injection is typing the channel, not scrubbing the text.", "required": ["channel"], "additionalProperties": true, "properties": { "channel": { "type": "string", "enum": ["authored", "derived", "tool_result", "external"], "description": "The channel the unit entered by. `external` marks an untrusted source: a captured web page, an inbound email, a third-party tool result." }, "may_instruct": { "type": "boolean", "default": false, "description": "May content reached through this unit STEER an agent, versus be inert data it only analyzes? A sink that turns content into agent instructions checks this field; default-false is the fail-closed posture." } } }, "edge": { "type": "object", "description": "A typed, attributed relationship between two units. It points at both endpoints by ref and lives in one overlay store — so adding a new kind of relationship is a new `rel`, not a schema migration on whichever table holds an endpoint.", "required": ["from", "rel", "to"], "additionalProperties": true, "properties": { "from": { "$ref": "#/$defs/ref" }, "rel": { "type": "string", "description": "The relationship type. OPEN vocabulary, runtime-validated (e.g. captured_from, contains, derived_from, answers, references). A new rel needs no migration." }, "to": { "$ref": "#/$defs/ref" }, "principal": { "type": "string", "description": "The authenticated identity that asserted this edge." }, "trust": { "$ref": "#/$defs/trust" }, "asserted_at": { "type": "string", "format": "date-time" }, "retracted_at": { "type": ["string", "null"], "format": "date-time", "description": "Bitemporal-lite: edges are asserted and retracted, never hard-deleted, so history is walkable." } } } } }