jonnify·bcs /bcs/ideas/identity-contract

B1.2 · The Identity Contract, Read as Architecture — manuscript chapter 1.2

One document. Two readings.

An implementer reads the contract for how to compute — the alphabet, the bit layout, the vectors a port must reproduce. An architect reads it for what systems may rely on — and since the law admits exactly one value across every boundary, that second reading is the architecture's entire interface definition.

This module performs the second reading: each property of the contract, the failure it retires, the committed evidence that it holds, and how Elixir and Go each carry it. Every constant is from content/vectors.json; every measured figure is verbatim from a committed output.

The contract sheet — four load-bearing properties, four failures retired (content/bcs1.2.md, constants per content/contract.md). Select a property.
typed ns in the value + the type retires the silent join ordered string order = mint order retires the second clock placed hash32 — anyone may run it retires the routing table canonical membership = passing the suite retires the dialect one value crosses every boundary — these four properties are everything a system may rely on
readout · Select a property. A property that nothing may rely on is a property the contract wasted; a reliance the contract never promised is a defect waiting for a port to expose it (content/bcs1.2.md).
§1

The wire form first

content/contract.md · content/vectors.json

The wire form is fixed-width before it is anything else: three uppercase letters and eleven base62 characters, fourteen bytes, always. Fixed width is itself architectural — comparators are bytewise over a known length, parsers index instead of scan, and the storage layer rewards the shape: 65 bytes per key on the measured table, with the encode at 5.14 nanoseconds in the canon's own Rust.

content/contract.md · the normative vectorsfrozen
encode("USR", 274557032793636864)        = "USR0KHTOWnGLuC"  ← the canonical vector
base62(2^63 − 1)                         = "AzL8n0Y58m7"     ← MAX_PAYLOAD — 62¹¹ exceeds 2⁶³, the range gate’s reason
§2

Four properties, four failures retired

content/bcs1.2.md

typed

The namespace rides in the first three bytes and in the type, wherever the runtime can hold one. A wrong-kind identity cannot cross a declared boundary silently.

retired · the silent join

ordered

String order equals numeric order equals mint order. A table keyed by branded ids is a timeline with no clock in the process.

retired · the second clock

placed

Any holder of an id computes where its row lives — trie slot, cache shard, partition, queue lane — with no directory and no rendezvous.

retired · the routing table

canonical

One Rust source, one C reference, one vector file, a conformance suite per runtime. Which language a system is in becomes a deployment detail.

retired · the dialect

The trading registry — AST, TXN, PRT, ORD, RSK, STR — inherits every property at registration: a new entity kind costs three uppercase bytes and receives typing, chronology, placement, and cross-runtime identity without one line of per-kind design.

§3

The boundary's error vocabulary

content/contract.md §9 · content/vectors.json

Length, namespace, charset, range — four refusals a gate may speak, so that a 400 can say why without leaking what. One runtime speaks it coarsely: the BEAM's parser reports :invalid without subclassification — a Chapter 1.1 decision that refused a second parser; if the taxonomy ever sharpens there, it sharpens in BrandedId once.

content/contract.md §9 · the reject vectorsfrozen
reject "USRzzzzzzzzzzz"                  → range
reject "usr0KHTOWnGLuC"                  → namespace
reject "USR0KHTOWnGLu"                   → length
reject "USR0KHTOWnGL!C"                  → charset
§4

One authority per fact

content/bcs1.2.md · Decisions

There is deliberately no bcs1.2.specs.md. The one authority is the contract with vectors.json beside it; the manuscript chapter cites it and adds no second normative text, because a paraphrase of a spec-of-record is a drift surface. This module inherits the same discipline: it reads the contract, it does not restate it.

§5

The four dives

one property per dive
B1.2 · dive 1

The Namespace Discriminant

Carried twice — the first three bytes and the type. One compiler error, the 200 / 400 / 400 / 404 gate row, the substrate's {:error, :namespace} — the silent join retired three layers deep.

the typed property B1.2 · dive 2

The Order Theorem

Snowflake's "roughly sortable" hardened to exact per node. Two thousand mints paged newest-first from byte comparison alone; a streams window returned its predicted 40960 entries.

the ordered property B1.2 · dive 3

Placement, Not Security

hash32's one finalizer round — 234878118 reproduced by seven runtimes at 0.9586 ns in pure Go — and the hard edge the contract states: an invertible round, with truncation's 2³² preimages the only veil.

the placed property B1.2 · dive 4

The Minting Law and the Canon

The counter that excludes node bits by normative text, the burst that borrows the next millisecond, the four-refusal taxonomy, and the suite whose green is the fleet's membership card.

minting · gates · canon

Read in order: the dives chain dive 1 → dive 4 and return here. Each quotes its evidence verbatim, source-labelled, from the committed outputs the manuscript froze.

§6

References

sources · related

Sources

Related