Concepts

Every core term, defined once. This page is authoritative over any conflicting page. Names and retired terms: Naming.

The names

Lepton is the company. Vinxi is the kernel and base platform. NetworkAccess, Trafficure, SmartMarket, SmartBuild are Lepton’s vertical products, built on Vinxi. “NetworkAccess is powered by Vinxi.”

The kernel & the law

• The one resource — the kernel manages exactly one scarce thing: coherent truth about a slice of reality, plus the right to change it. Anything that doesn’t touch it is userland.
• The law — the kernel owns a small closed set of mechanisms; userland composes open meaning on top; the seam between them is the governed path.
• Thin, not empty (meta-semantic) — the kernel knows the grammar of reality-modeling (Entities, Traits, Actions, Policy, Events), never the meaning (“cable” is customer data). Shape, not meaning: schema is kernel-visible; semantics is customer-owned.

The seam & the six verbs

• The seam — the one governed door. Nothing touches truth except through it.
• The six verbs — the entire interaction surface. Effects: Query · Act · Assert · Call. Triggers: Subscribe · Schedule.
• Act vs Call vs Assert — Act = an internal decision (Vinxi changes its own truth). Call = an external side effect (through the egress gateway). Assert = an external observation entering as evidence. Drivers never bypass this triangle (ADR-0005).
• No ambient authority — every invocation carries a capability; being handed a capability is governed, writing is free.
• The SDK is the ABI — userland and agents speak the compiled, typed, generated SDK (sdkgen); a hallucinated action fails to compile.

The five planes

Logical, not deployment units (ADR-0002):

Plane	Truth of	Holds
Process	action	in-flight work, sagas, leases
Truth	history	the log family: StatementLog · DecisionLog · CallLog · SchemaLog · PolicyLog
World	coherent current interpretation	ResolvedValues — never a naked scalar
Serving	nothing	rebuildable read surfaces; “SERVING or invisible”
Materialization	—	the machinery that builds Serving from Truth/World

The transactional outbox is the named seam between Process and Truth.

Ports & adapters

• Port — a kernel-owned, permanent contract (P0–P26). The test: swapping its adapter is invisible to userland. Every port has a fake.
• Adapter — a swappable technology binding behind a port (Postgres, MinIO, DataFusion…).
• Reference profiles — Lean (the honest first build, ADR-0007), Scale, Air-gap: one adapter choice per port per column.
• Services — deployment shapes (vinxi-kernel-server, vinxi-worker, vinxi-cli); an implementation detail, never an architectural layer. The control plane is privileged userland on the same seam.

Structure

• Universe — the top-level reality container. Tenant ≠ Universe: a tenant may hold many universes (e.g. networkaccess-airtel).
• Realm — the namespace primitive; contributes definitions without owning a private store.
• Branch — a copy-on-write world-line. Schema changes are rehearsed on branches; offline is a device branch; merge is rebase-style, conflicts become Adjudication WorkItems.
• sim-time — branch-local clock for simulation and rehearsal.

Data model

• Entity / Entity Type — the modeled things and their declared types.
• Trait — a typed aspect of an entity; the unit the kernel indexes.
• Kind constructors — nine parameterized constructors (including link — the old Entity-Trait-Link three-primitive model is retired); interfaces are semantic capability contracts, and storage is never interface-aware.
• Value types — the type-safety atom for trait values; validation + storage mapping + SDK codegen.
• Statement — an evidence claim (actor, category, confidence, bitemporal stamps); a record shape, not an eighth primitive. Categories include Observation, Measurement, Evidence, Prediction, Correction, Retraction.
• ResolvedValue — what World serves: value + uncertainty + settledness (SETTLED / CONTESTED / STALE / BLIND) + derivedFrom + fusion policy (ADR-0011).

Resources

Everything external is a governed Resource — dataset, stream, file, media, raster, model, virtual dataset — registered in the kernel-owned Resource Registry (P0), with dual identity: physical manifest + governed, versioned, policy-marked identity. BindingPlan — the kernel-owned seam from datasets to ontology (ADR-0006).

The read side

• Query IR — the single logical plan language; the pipeline is BIND → SECURE → ROUTE → OPTIMIZE → EXECUTE → ACCOUNT. Policy compiles into the plan or the plan is invalid.
• Truth tiers — operational · hot · warm · cold · analytical · derived · serving; tiers are semantics, with freshness classes hot(ms)/warm(s)/cold(min).
• OrderToken & watermarks — {cell, seq} ordering plus watermarks and read barriers give read-your-write without lying about freshness. Cell — the shard unit.
• Offline reads are the same pipeline with the first two stages precompiled.

The three IRs

Reality IR (what exists) · Query IR (what to read) · Surface IR (what to show). Surfaces follow the one-interpreter principle: exactly one TS Surface IR interpreter (@vinxi/surface-runtime), hosted by every shell.

Integration

Four distinct shapes (ADR-0005): Infrastructure Adapter (trusted, in-process, implements ports) · Source Connector (ingests external reality → Assert) · Actuation Driver (performs Call, then reconciles — driver success is evidence, not truth) · Virtual Dataset Driver (query pushdown to external engines). The ingest gateway is the only path for external facts; the egress gateway is the only path for external side effects.

Actors & agents

Actors are author-blind — human = agent = service at the seam. Agents run code-mode over the generated SDK (ADR-0009); capability checks per call, approval as control flow, the whole run logged.

Delivery vocabulary

• Reality Package — a deployable declared reality (ontology + policy + surfaces) loaded onto Vinxi; NetworkAccess is the first.
• sdkgen — generates the typed SDKs from the IR contracts.
• Lean first — Postgres/PostGIS + outbox, NATS, custom Rust materializer, DuckDB/DataFusion; graduations to Scale are evidence-gated per port.