UCCA — Capture & Filing Plan¶

What this is. Tonight a great deal surfaced in one window — subtle, nuanced, and easy to lose. This document exists so it isn't lost. It does three jobs: it pins the rulings made tonight (chiefly the naming), it stands up the two structures the project didn't have yet (a canon register and an ADR log), and it names the documents to be written next so the real filing happens fresh, not at 3am. It is deliberately not canon. It is the note that protects the canon.

1. Why this doc exists (the drift it guards against)¶

The cautionary tale is our own: the "dispatcher / service bus / pipeline" insight surfaced once in a GPT conversation, wasn't filed, and sank — we re-derived it tonight from scratch. Being right in a conversation that evaporates is the failure mode. Tonight produced several large realisations (the platform was already right; the whitepaper was already the finished vision; the naming resolved; the AI landscape has re-shaped into a proof of the thesis). All of it currently lives in one chat window. This doc moves the load-bearing parts onto disk so the next session starts warm.

2. The rulings made tonight (pin these)¶

2.1 Naming — resolved. - UCCA = Universal Capability Certification Authority. The engine and the root of trust — the factory. Commercial, closed, first-to-market. A real expansion, not a logo-word. - UCCO = Universal Capability Certification Object. The object the engine manufactures — the cryptographically-signed, expiring, revocable capacity-to-act — and the open standard it conforms to. Object and conformance are treated as one thing under one name. (This is "option (b)": collapse object-and-standard into UCCO, rather than the whitepaper's older split of CCO=object / UCCO=standard.) - CCO — retired. It was the larval pre-name ("Certified Capability Object" in the March whitepaper; a docstring in the engine). Its mature form is UCCO. Everywhere CCO appears in older docs, read UCCO. FOUNDATION-01 was right to retire "CCO" — it just didn't yet know CCO's grown form was already on disk as the UCCO envelope (/ns/ucco/v1). - UCCC — not real. A slip in conversation. Not canonised. - Triumvirate (code: triad) — unchanged. The three-instrument contract/schema a UCCO is manufactured against. Prose says Triumvirate; code says triad; same thing.

2.2 The North Star, in one line. The engine is universal; the gate is the single throat; it must be able to ingest all. RTOpacks is the first meal, not the shape. The actor changes; the obligation does not.

2.3 The build rule (the guardrail made operational). Build for RTOpacks now, but build against the triumvirate contract, never against RTOpacks' domain. Specialisation lives in the adapter (which translates a client's corpus into triumvirate shape), never in the gate. The engine never sees the domain. The throat stays universal even while the first thing it swallows is VET.

2.4 The drift-check (ask this of every build decision). "Does this only work because the client is VET?" If yes → it's the fossil the SEED already caught us building once. Move it out to the adapter. The gate does not narrow.

2.5 The commercial tension (named as foundational; its resolution is strategy, not canon). UCCO must be open for the authority to be trusted (authority-to-act in consequential domains cannot be a proprietary "trust me" lockbox — no one adopts it). UCCA must be closed for the factory to be built and funded. The resolution is sequence: build the factory first, be first to market, earn the authority, then open the standard from the position of already being the authority — at which point openness is the moat (Red Hat / Linux), not a giveaway. The timing of opening is a live strategic call and belongs in the strategy layer, revisable — never frozen into canon.

3. The filing architecture (segment by rate-of-change, not by topic)¶

The organising principle: a document's home is decided by how often it changes. This keeps the "true for years" layer clean and quarantines the "true for now" layer so it can move without touching foundation.

Layer	Changes	Documents
Canon — written to be true	rarely	FOUNDATION-01 · NORTH-STAR (to write)
Ground — true today	as reality changes	SEED (condition report) · RTOPACKS-NEEDS (to write)
Strategy — true for now	as we learn / market moves	STRATEGY (to write)
Decisions — a log, append-only	grows	ADR-log (to start)
Narrative — historical artefact	frozen	the-gate-whitepaper (keep as-is, add dated header)

4. The canon register (this project didn't have one — here it is)¶

The register is the project's list of what its true documents are, so canon can't quietly drift or duplicate. To be maintained going forward.

doc_id	title	layer	status
UCCA-FOUNDATION-01	what the engine is	canon	filed ✓ (needs the CCO→UCCO correction — see ADR-0001)
UCCA-NORTHSTAR-01	the universal engine / single throat / the vision as build-constraint	canon	to write
UCCA-SEED-01	byte-grounded condition report + rebuild verdict + access state	ground	filed ✓ (carry in)
UCCA-RTOPACKS-NEEDS-01	what the first client requires, as a client's requirements	ground	to write
UCCA-STRATEGY-01	open-standard sequencing, pricing, positioning, pitch architecture	strategy	to write
(narrative) the-gate-whitepaper	the founding vision narrative	narrative	exists; add dated header noting naming resolved to UCCO-per-(b)

5. The ADR log (started tonight)¶

An ADR (Architecture Decision Record) captures one decision, with its rationale and status, so a decision is never buried inside prose where the next agent can't find why it was made. Format kept minimal. Two are already earned tonight; both are drafts pending the next session ratifying them.

ADR-0001 — Name the manufactured object UCCO; retire CCO. (proposed, tonight) - Context: The March whitepaper split CCO (the object) from UCCO (the open standard). FOUNDATION-01 retired "CCO" as a docstring with no artefact. In conversation the object and its standard kept collapsing into one. - Decision: Adopt option (b): UCCO is the object and the standard, one name. Retire CCO as the larval pre-name. UCCC is not a term. - Consequences: FOUNDATION-01's CCO section needs a light correction (CCO was not "a name with no artefact" but "the pre-name of UCCO"). The whitepaper needs a dated header. The /ns/ucco/v1 envelope on disk is the UCCO — content-in-its-verifiable-envelope is one object by design; canon must state this explicitly so the envelope-vs-content split isn't re-derived as a contradiction.

ADR-0002 — The gate is domain-neutral; specialisation lives in the adapter. (proposed, tonight) - Context: The SEED found the live engine sources its own TGA data internally (a neutrality violation) — a RTOpacks-shaped tool wearing a UCCA badge. We are about to build for RTOpacks and must not repeat this. - Decision: The single-throat gate checks only that input conforms to the triumvirate contract. It carries no domain knowledge. Per-client/per-domain translation lives in the adapter, outside the throat. The engine never sees raw client corpus. (This ratifies the March adapter design doc as the target architecture.) - Consequences: "Make it functional" for RTOpacks is a bounded build against the contract, not a reactivation of the internal-sourcing path. The receive-across-API input path is both the RTOpacks build and the neutrality fix — same work.

6. What to write next session (the task list, clear-headed)¶

UCCA-NORTHSTAR-01 (canon) — the universal engine, the single throat, substrate-agnostic actor, "the actor changes / the obligation does not." Short. Build-facing. The whitepaper is its long narrative; this is the pinned constraint. Include the build rule (§2.3) and drift-check (§2.4).
UCCA-RTOPACKS-NEEDS-01 (ground) — what client one needs from the engine, framed as a client's requirements (per FOUNDATION-01 §3 and the SEED's neutrality rules). Highest-leverage per the SEED: diagnosis + receive-across-API. Thin on purpose.
UCCA-STRATEGY-01 (strategy, dated) — open-standard sequencing (factory→standard→authority), the investor rebuttal (open standard is the moat, not the leak: Red Hat/Linux, Google/transformer, Stripe), the frontier-moved-from-model-to-application upgrade, trust-tier pricing, pitch architecture. Flag inside it: the landscape claim is fast-moving and must be re-checked before any pitch — do not build a deck on a stale snapshot.
Correct FOUNDATION-01 per ADR-0001 (light touch — CCO as pre-name of UCCO, not a hollow name).
Add a dated header to the whitepaper noting naming resolved to UCCO-per-(b); do not rewrite it.

Not next session: the pitch deck (downstream of STRATEGY, and building it early is the "energy into moving work instead of doing work" trap). And the three canonical stones beyond the North Star (the triumvirate-as-contract and the UCCO-as-capacity-to-act as full canon) can wait until the North Star is down and RTOpacks work is moving — they deserve their own fresh session.

7. Pointers (so nothing gets hunted for)¶

The vision narrative: the-gate-whitepaper.md (March 2026). Already the finished thesis; sections 3/6/7 are the detailed body behind UCCO (the object, the crypto/co-signing, the liability split). Keep as historical artefact.
The gate's detailed spec: the March triumvirate-adapter-design-v1.md — the target architecture ADR-0002 ratifies (edge → adapter → validated triumvirate → engine → UCCO). Schema is 1.0; the homepage's "2.4.1" remains fiction.
What's real on disk: the SEED. Generation proven (1 unit, local). Diagnosis unbuilt (the crown). Cloud orphaned. Neutrality violation in the input path. Cloud door opens (vault token) — wire by UUID, mind the CF_ACCOUNT_ID pin, export don't source.
The seed paragraph for the UCCO standard's opening (Tim, tonight — pin verbatim for NORTHSTAR/STRATEGY): "Any domain. Any knowledge framework. Any jurisdiction. The ingestion engine processes source material through a validated capability schema and outputs binary-verifiable capability objects. Immutable. Cryptographically anchored. API-addressable. The same infrastructure that verifies a licensed practitioner verifies an AI agent operating in a consequential workflow — and the autonomous system that replaces them both. Same schema. Same binary standard. Same audit trail. The actor changes. The obligation does not. The robot does not act until the capability object says it can be trusted to. In the absence of that object, trust is assumed — and assumed trust in autonomous systems is a liability that will eventually be priced. In fines. In failures. In prison."

Capture, not canon. Its only job is that nothing from the 2026-07-01 session sinks: the naming is pinned, the canon register and ADR log now exist, and the next session has a clear task list instead of a blank page. Break ground against the North Star; build the product for RTOpacks; keep the throat universal.