Rhizomatic

§1One structure, all the way down

There is exactly one hardcoded structure in the entire system: the delta — an immutable assertion connecting entities and values through role-labeled pointers. Schemas, queries, retractions, trust lists, transactions, even the vocabulary for all of those: every one of them is expressed as deltas. Semantics travel as payload.

A delta's identity is the BLAKE3 hash of its canonical CBOR bytes. Edit anything below and watch the identity change — identity is content. There is no autoincrement, no UUID, no instance minting names. Two machines that have never met, writing the same claim, produce the same bytes and the same id.

Try clearing the property field: the format refuses the delta outright. Invalid deltas are rejected, never repaired. And the line under the identity isn't decoration — an independent Rust implementation, compiled to WebAssembly and loaded on this page, recomputes the bytes for every edit you make. Two codebases, two languages, one answer, live.

§2Every pointer is a perspective

Notice what §1's delta did not have: a subject. A delta connects entities through role-labeled pointers, and it can be read from the perspective of any entity it touches. The optional context on each pointer names the property under which the delta files at that target — so the same delta is director when you ask the movie and movies when you ask the director (SPEC-1 §2.3).

And context is consent. Clear one below: that vertex simply stops growing a property. The reference still exists — the delta still names the entity, still matches queries about it — but the backpointer was never granted. Nobody gets indexed against their will by someone else's claim.

For n-ary deltas (a purchase with buyer, seller, item) the same machinery holds: each entity pointer grants — or withholds — its own differently-named backpointer, and the value at any vertex composes from the other pointers' role/target pairs. Primitives, by contrast, are not vertices: a bare string has no perspective to file under, by construction.

§3Disagreement is data

Alice says Ridley Scott directed Blade Runner. Bob says Denis Villeneuve. (Bob is thinking of 2049. Bob is confidently wrong. Bob is every distributed system's favorite user.)

A conventional database makes you pick a winner at write time — usually by letting the second write silently clobber the first. Rhizomatic stores both. Contradiction is not an error to resolve at the gate; it is information, held in superposition, with full provenance on every side of the dispute.

§4Truth is a lens

If the data holds contradictions, what does reading mean? It means choosing a resolution policy: an explicit, inspectable declaration of whom you trust, in what order, with what tie-breaks. Below, the same stored data resolves under four different policies — simultaneously.

Same rhizome, four truths, each one deterministic: resolve(policy, view) is a pure function. Two readers disagree only because they chose different policies — never because the machine wobbled. Add a third opinion in §3 and watch all four panes react.

§5Nothing is ever deleted

There is no UPDATE and no DELETE. Retraction is a new claim about an old claim — signed, timestamped, and attributed like any other. Retract something below and watch the log: nothing is struck from it; a negation appends. Then flip on the audit lens: the negated claim is still there, marked, with the retraction itself fully accountable.

And since every claim carries its time, current state is just one point on a slider. Drag it back before the negation and the original claim is — for that moment — simply true again; drag to the end and the state respects every negation that has arrived.

Now scroll back to §3 and §4 — they updated too. They are not copies; they are different lenses over the same rhizome. The past stayed queryable, the present stayed consistent, and nobody lost any data. This is what audit logs, soft deletes, and event sourcing keep trying to bolt onto systems whose atoms can't support them.

§6Merge is union

Because deltas are immutable and content-addressed, a collection of them is a grow-only set. Fork a dataset by taking a subset. Merge two datasets with set union. These are not features somebody implemented — they are arithmetic facts about how the atom is defined.

Below: two sovereign peers who remember the same man very differently. Obi-Wan remembers a betrayal; Vader remembers becoming. Neither is primary, and neither has to recant. Add claims to either side, then sync — convergence is guaranteed, in any order, with no coordination and no conflict-resolution code, because the disagreements simply ride along (§3).

After the sync, anyone who pulls from either peer — Luke, say — holds both accounts of his father's fate, each signed by its author. What I told you was true… from a certain point of view. Here that line isn't a dodge; it's the type signature of reading. A resolution policy (§4) is a point of view you can write down, share, and apply deterministically.

One more, because it's the property everything else stands on — order independence. Take every delta one peer holds, shuffle them, and replay them into a brand-new reactor:

press the button. any order. every time.

This is why federation here is arithmetic instead of engineering: peers exchange filtered subsets of claims (through lenses they each choose to offer and admit), and union does the rest. No vector clocks to manage, no operational transforms, no central sequencer. Signed claims, sovereign peers, set union.

And because the logical form is sacred while the physical form is free, a peer's entire world round-trips through cold bytes:

a pack is one canonical CBOR item. press the button.

Burying that on a USB stick is a valid backup strategy — and, on a long enough timeline, a valid federation event.

§7Computation is an author

The operator algebra is deliberately closed — eight operators, decidable predicates, no Turing-complete escape hatch. So where does real computation live? It isn't banished; it's given an identity. A derived author is a function installed by explicit consent, holding its own keypair, watching a materialization. When the data changes, it computes — and writes the result back as an ordinary signed claim, no different from anything a human asserts.

Except for one thing: it carries a receipt. Every derived claim pins which function produced it, under which binding, and — in canonical bytes — the exact input view it was computed from. Rate the movie below; the bot recomputes the average, signs it, and supersedes its previous claim. Then audit it: replay the function on the pinned input and check that the recomputed content address matches the claim's id.

"Trust me" becomes "check me" — for a reducer today; for an ML model or an LLM adjudicator tomorrow, since anything that computes joins the same way. And because outputs re-enter through the ordinary ingest path, runaway loops are handled structurally: every binding carries a budget, and exhausting it produces a signed suspension claim — divergence becomes an observable event, not a melted reactor.

§8Two languages, one digest

Rhizomatic is a format with a conformance suite, not a reference implementation. The repo contains the specification, a language-agnostic vector suite, and two implementations — TypeScript and Rust — grown in lockstep as independent witnesses. Neither is a port of the other. When they disagree, the spec was ambiguous, and that's the deliverable: the suite caught real spec bugs, recorded in per-spec errata.

The capstone: a Rust peer pulled from a live TypeScript server over HTTP — lens filtering, signature verification, atomic bundles and all — and converged to the byte-identical canonical digest:

And don't take this page's word for any of it. The conformance vectors committed in the repo — the very files CI runs both witnesses against — are bundled into this page, and your browser just ran them: canonical bytes, content addresses, key derivation, deterministic signatures (including rejecting a tampered delta), the order-independent set digest, and the byte-exact output of all eight operators.

Then it goes further: the Rust witness itself is on this page, compiled to WebAssembly, speaking a hand-rolled JSON-over-linear-memory ABI. The same vectors run through both implementations, side by side, in your tab — and §1's live delta builder asks the Rust witness to reproduce every edit you make, byte for byte.

Where this sits among its neighbors:

Every design decision in the spec exists to keep all five columns true at once — and §7 showed the rule that keeps the table from needing a sixth: everything that computes is an author. One rule, all the way up.