Applications never
touch raw disk.
Import, export, and data access are contracts between workspace apps and storage. An app asks for a named contract. The plane evaluates it, performs the scoped operation, and records it.
- request importPOST /contracts/drive.import
- evaluateapp, role, workspace, target
- allowrule: drive.import
- scoped writedrive/imports
- stored
- append eventworkspace_events
- 202 queued
Importer queues a reading list into the workspace drive.
Policy evaluator
Ask the plane what it would do.
Choose an application, an operation, a path and a role. The scope matrix shows what each application holds. The evaluator reads the contracts and returns a decision you can inspect.
Allowed
Importer asks to import drive/imports.
Matched drive.import. The request stays inside the scope the contract names.
1{2 "decision": "allow",3 "status": 202,4 "contract": "drive.import",5 "rule": "drive.import",6 "reason": null7}Audit tape
- helper-planecontract · read granted, archive/records
- notebooktask · completed “Re-run calibration”
- research-leadprompt · approved “Tighten citation rule”
- research-agentdraft · created beside “Literature summary”
- importerimport · queued “Reading list”
Flows
Four paths through the plane.
Every way data enters, leaves, or is read goes through one of these contracts, and leaves a record shaped like the one beside it.
Import
contract · drive.import
A member or a job queues an item into the workspace drive. The plane checks the contract, stores it under the workspace, and records who asked.
1{2 "source": "Manual",3 "item": "Reading list",4 "status": "Queued",5 "note": ""6}Export
contract · drive.export
Finished work leaves through a named handoff. Any assigned member can create one, and the handoff target is a control that managers set on the workspace.
1{2 "target": "Partner review pack",3 "status": "Available",4 "note": ""5}File upload
contract · drive.import
Uploads are stored under a generated name. The original name, type, size and uploader stay as metadata on the record.
1{2 "name": "calibration.csv",3 "mime_type": "text/csv",4 "byte_length": 18240,5 "owner": "A. Researcher"6}Read
contract · records.read
Applications read the indexed records a contract names. They get no path to the disk underneath and no view of other workspaces.
1{2 "workspace": "biology",3 "op": "read",4 "target": "archive/records",5 "decision": "allow",6 "status": 2007}
The record
What was accepted, and by whom.
Each accepted request becomes an event the workspace can read back: the actor, the action, a detail line and the time. Members see it arrive on the workspace stream.
- notebookmessage · posted in #method-notes
- helper-planecontract · read granted, archive/records
- notebooktask · completed “Re-run calibration”
- research-leadprompt · approved “Tighten citation rule”
- research-agentdraft · created beside “Literature summary”
- importerimport · queued “Reading list”
How it behaves
Questions a reviewer asks.
What happens when no contract names a request?
Does the plane replace permissions?
Who can declare a contract?
Can an application reach another workspace?
Is every accepted request recorded?
Where do the JSON shapes above come from?
Latest papers
Infrastructure
First papers are in preparation.
Each piece states what it claims and what it does not. See what the institute has published so far in Papers.
See the plane from the inside.
Access is invite-only. Tell us what you are working on and an administrator will review it.