Protocol and grid · Explainer

Providers admitted for a stated scope and nothing wider. Devices qualified against the environment they will meet. Nodes that form a cell, cells that federate across trust domains, plans compiled from declared intent, and evidence that can be checked by anyone holding the chain.

Admission states

10

Admission transitions

35

Compiler phases

14

Protocol flows

12

01 · Admission

Admitted for a scope. Nothing wider.

A provider starts as a candidate with no reliance permitted. Its manifest is validated, then its rights, its supply chain and a bounded test profile; a jurisdiction review follows where the deployment needs one. The policy decision admits it under a key: provider, artifact digest, profile, jurisdiction, purpose and qualification revision. Change any part of the key and the admission does not carry over.

Profile

Purpose

Evidence

State

DISCOVERED

Last guard

–

Admission key

–

Keys admitted so far

0

02 · Qualification

Tested against the place it will live.

Qualification starts from the use environment: it decides which methods apply, the tests record their conditions and instruments, failures are evaluated, limits and derating are declared, and the result binds to the exact hardware and firmware bill of materials. Pick an environment, run the suite, then set any cell to see the row decide.

Environment

Suite

pass

derated

fail

not run

not required

Methods required here

–

Devices qualified for this environment

–

Failing closed

–

03 · Site

A wedge node, then a cell.

One wedge node establishes the site from signed media. It discovers its peers, each proves itself by mutual attestation, policy assigns roles, and members join the cell and share local services, including a local authority that keeps operating inside its lease when the backhaul is gone. The cell closes with acceptance evidence.

Members

Run

Cell state

WEDGE_NODE

Members in the cell

–

Held outside

–

04 · Federation

Cells federate. Trust stays explicit.

Federation is asynchronous exchange under a binding: trust, scope, data-locality, version and correction contracts. Each cell sends signed summaries, not raw state. When a domain is cut off it keeps operating inside its lease; on reconnection the sides exchange digests and resolve conflicts by authoritative owner and version.

Domain C

Bindings across domains

–

Summaries held by domain C

–

Domain C

–

05 · Orchestration

Declared intent in, an immutable plan out.

A deployment plan declares capabilities and policy, not a bill of materials. The compiler resolves only providers admitted for the scope, evaluates policy and fails closed, then checks resources, network and timing, data rights and locality, and trust prerequisites in parallel before it places workloads and emits a plan with a digest and proof obligations. Planning is not execution.

Constraint

Run

Phase reached

–

Result

–

Plan digest (SHA-256)

–

06 · Evidence

Every step leaves a record you can check.

Each step of a plan’s delivery writes a record that carries the hash of the one before it. Anyone holding the chain can recompute it: change one record after the fact and its hash no longer matches the link stored in the next, so the break shows exactly where. The hashes below are SHA-256 over each record, computed in your browser.

Records

–

Chain

–

Head

–