FieldnoteBuilding the RSM kernel
Fail Closed When the Canon Is Silent
Building the reference kernel kept reaching things the RSM canon names but cannot yet express. Each time, the right move was to refuse and record the gap, not to invent the missing meaning in code.
Three times while implementing authority and disclosure in the reference kernel, we reached a place where the RSM canon used a word that the kernel had no way to check. None of them was a bug. Each was a point where the model names something it does not yet represent, and where a small, reasonable-looking line of code would have quietly decided what the model means.
The first was authority. The RSM Concept Paper is clear that a person acting for themselves needs no organization, and that acting for an organization requires explicit authority: "a verified Affiliation, a Stewardship grant, or a Delegation." The semantic model lists verified affiliation as one of the grounds a representation may cite. But the canonical model gives an affiliation nothing that says it confers authority, or how that was verified. An ordinary affiliation (employee, advisor, member) carries no authority by design. A verified one is supposed to. In the data, the two look the same, so there was nothing for the runtime to check.
The kernel's behaviour here is deliberately narrow. An ordinary affiliation grants no authority, and a request that leans on one is refused. A request that cites verified affiliation is neither honoured nor quietly downgraded to an ordinary one. It is refused, with a reason that says the basis cannot be represented. Representation that genuinely needs authority goes through stewardship or delegation, which the kernel can check today.
The second was history. Every canonical event must carry a type, and the canon illustrates types with plain phrases such as a commitment being strengthened or a capacity being updated. But no governed vocabulary of event types exists among the RSM's governed concept schemes. The kernel has to stamp something, so it stamps its own reference codes. It also declines to promote them. They are not added to the shared context, the validation shapes or any taxonomy. A placeholder is not a vocabulary, and a runtime constant is not a governance decision.
The third was privacy. The first version of the kernel plan promised owner-governed disclosure of "contact/precise location". The canon can express half of that: a place whose broad area is discoverable and whose precise point is protected. It has no fields for email, phone or contact details at all. So disclosure covers the precise point and nothing else. A request for any other field is rejected rather than silently honoured, and no contact field was invented to make the original promise true.
Named is not enforceable
What these three have in common is that the canon names something it cannot yet enforce. In each case the tempting fix was tiny: a boolean on the affiliation, accept the strings as the vocabulary, add an email column. Each would have been a semantic decision made inside one runtime, inherited by every application that consumes the model, and never debated by anyone responsible for the model's meaning. RSM inverts the usual dependency so that applications consume meaning rather than define it. An implementation that invents meaning to keep moving reverses that inversion from the inside.
So the gaps were recorded as governed work on the canon, not as a milestone. Each record states what the kernel does today, why that behaviour is safe, and what governed work would close it: for verified affiliation, a representation that makes "this affiliation confers authority, and how it was verified" checkable; for events, a published vocabulary the reference codes can be mapped onto; for contact details, a decision about which object carries them and how they divide into discoverable and protected parts. These are recorded as cross-cutting questions of meaning, not features waiting for a sprint.
Failing closed has a cost, and we should be plain about it. Someone whose authority really does rest on a verified affiliation cannot use it yet. They need a stewardship or delegation grant instead. When Wellzai later connected to the kernel as its first external consumer, it did not simulate the missing basis either. That is slower than pretending, and it is the right kind of slow. A refusal with a named reason is honest about what the model can stand behind. A guess that happens to work would have been worse, because nobody would know it was a guess.
The open questions are real and remain open: whether verification should be a kind of relationship or a fact that an authority basis resolves against; whether the network needs a governed vocabulary of events at all; and which profile details a self-sovereign network should treat as discoverable. They are questions for the model, not for whichever implementation reaches them first.