Architecture thesis and invariants
Design synthesis, 7 October 2026. This chapter incorporates the supplied Astra report. Its models and acceptance tests describe intended architecture; they do not certify current implementation. The report inventoried 140 public routes and compared substantive sections of 51 documents. Repository source and current qualification receipts determine what ships.
Architecture thesis and invariants · Nodes, ports and hyperedge vocabulary · Composition and execution semantics · Compiler, source publication and consistency · Shadow, evidence and region releases · Authoring and industry precedents · Cross-runtime systems and worked scenarios · Impact, design obligations and qualification
Reaktor is a typed, transactional language for describing, realizing, inspecting and safely changing multi-runtime systems. The graph is the semantic authority; specialized runtimes remain responsible for specialized execution.
1. Architectural thesis
Documentation scope: 140 routes exposed by the public documentation navigation were inventoried, including archive entries and a redirect/alias. Substantive sections of 51 documents were compared across graph, data, execution, FFI, UI, build, agents and operations. Additional legacy material was checked separately. The coverage ledger distinguishes retrieval, substantive review and inaccessible material.
The architecture depends on exact contracts connecting Reaktor’s mechanisms: capabilities, completion protocols, lifecycle ownership, source publication, evidence validity, specialized UI execution and actual harness authority.
Compact definition: Reaktor is a typed, transactional language for describing, realizing, inspecting and safely changing multi-runtime systems, with specialized execution behind qualified boundaries. This expresses the Living Graph’s intended scope without claiming that all of it currently ships. [The Living Graph] [Reaktor plan and roadmap] [FFI / Switchboard] [Shadow workspaces]
2. Core ideas and invariants
1. One semantic identity system
Problem: Duplicated models drift across build, runtime and tools.
Mechanism: Stable definition, operation and resource identities; versioned joins to artifacts and activations.
Theory: Denotational meaning; content-addressed identity.
Precedent: Unison; MLIR symbol/operation models.
Qualification: Stable identity is not the same as a mutable name, hash or runtime address.
Sources: The Living Graph, Source ownership, Unison — Code as content-addressed definitions, MLIR — Interfaces
2. Typed, role-labelled port hypergraph
Problem: Binary links lose the meaning of multi-party relations.
Mechanism: Nodes own ports; incidences carry relation, role and optional position.
Theory: Typed hypergraphs; relational incidence models.
Precedent: Ptolemy II port-connected actors.
Qualification: Topology does not define ordering, coordination or protocol progress.
Sources: Graph substrate redesign, Data graph, Ptolemy II: hierarchy, ports and models of computation
3. Open hierarchical regions
Problem: Reuse must preserve boundaries while changing internals.
Mechanism: Exported ports and explicit replacement boundary mappings.
Theory: Cospans; symmetric monoidal composition; typed substitution.
Precedent: Ptolemy hierarchical composition; FMI boundaries.
Qualification: Ownership-constrained composition must not introduce arbitrary resource copying.
Sources: The Living Graph, Fong — Decorated Cospans (2015), Functional Mock-up Interface — Model exchange and co-simulation
4. Orthogonal facets and semantic layers
Problem: Class inheritance and duplicate graphs couple unrelated concerns.
Mechanism: One identity space, typed facts and relation families; versioned dialects.
Theory: Multilayer graphs; extensible algebraic signatures.
Precedent: MLIR dialects and interfaces.
Qualification: Unknown required semantics block execution; optional display metadata may round-trip.
Sources: Module execution plan, MLIR — Interfaces, Cozzo et al. — Structure of Triadic Relations in Multiplex Networks
5. Definitions are not activations or observations
Problem: A deployment plan is mistaken for current reality.
Mechanism: Separate revision streams for definitions, activations, observations and evidence.
Theory: Temporal databases; partial orders and causal cuts.
Precedent: Kubernetes desired/observed state.
Qualification: A federated snapshot is not automatically a globally consistent cut.
Sources: The Living Graph, Operational graph evidence, Lamport — Distributed clocks, snapshots and temporal specifications, Kubernetes — Controllers
6. Source and visual projections share edit authority
Problem: Source and canvas become independent editable truths.
Mechanism: One owner per region; source-backed transformations or graph-owned programs.
Theory: Bidirectional lenses and round-trip laws.
Precedent: MPS projectional editing.
Qualification: Round-trip laws apply only to a declared supported language subset.
Sources: Source ownership, Visual language, Foster et al. — Combinators for Bidirectional Tree Transformations, JetBrains MPS — Projectional Agent Toolkit (2026.1, experimental)
7. General computation with qualified execution profiles
Problem: A DAG-only tool cannot express the intended systems.
Mechanism: Executable regions with control, state and effects; specialized actor/stream/native profiles.
Theory: Operational semantics; abstract machines; models of computation.
Precedent: Ptolemy directors; ordinary compilers.
Qualification: Turing completeness provides expressiveness, not decidable verification or bounded execution.
Sources: The Living Graph, Actor execution model, Ptolemy II: hierarchy, ports and models of computation, Lee & Parks — Dataflow Process Networks (1995)
8. Protocols, not only payload types
Problem: A well-typed message can arrive in an illegal phase.
Mechanism: Versioned interaction protocols, local state machines, cancellation and completion semantics.
Theory: Session types; labelled transition systems; Petri nets.
Precedent: Session-type research; Temporal execution contracts.
Qualification: Progress guarantees require specified failures, fairness and transport assumptions.
Sources: Service contracts, Graph protocol, Honda, Yoshida & Carbone — Multiparty Asynchronous Session Types, A Mechanised Theory of Multiparty Asynchronous Session Types (ECOOP 2025), Temporal — Workflow execution
9. Explicit state, lifetime and resource ownership
Problem: GC, native buffers, actors and host teardown disagree.
Mechanism: Owners, leases, affinity, borrow scopes and activation epochs.
Theory: Linear/affine resource reasoning; structured lifetimes.
Precedent: WIT resources; Arrow release callbacks; Erlang ownership.
Qualification: A generation handle prevents reuse confusion, not arbitrary native memory corruption.
Sources: Component lifecycle, Actor execution model, FFI / Switchboard, WebAssembly Component Model — WIT, Apache Arrow — C data interface
10. Effects and authority are different contracts
Problem: Knowing an API exists is mistaken for permission to use it.
Mechanism: Effect declarations, scoped grants, policy decisions and actual effect receipts.
Theory: Effect systems; non-amplification and access-control invariants.
Precedent: Koka effect typing; reference-monitor architecture.
Qualification: A graph annotation does not sandbox trusted in-process code.
Sources: Formal methods and evidence, Authentication module, Koka — Types and effect handlers
11. Adaptive capability selection
Problem: Platform conditionals and fallback logic scatter throughout apps.
Mechanism: Filter offers by hard constraints and authority, then rank qualified preferences.
Theory: Constraint satisfaction; partial orders; control hysteresis.
Precedent: Ptolemy/FMI qualified heterogeneous implementations are partial precedents.
Qualification: No single cited precedent supplies the whole Reaktor adaptation contract.
Sources: Capability selection, Reaktor plan and roadmap, Functional Mock-up Interface — Model exchange and co-simulation
12. Multiple backends preserve one contract
Problem: Cross-platform code paths silently change semantics.
Mechanism: Semantic profiles, lowering legality, source maps and translation qualification.
Theory: Compiler refinement and simulation relations.
Precedent: MLIR conversion targets and dialect interfaces.
Qualification: A successful conversion is not itself a proof of behavioral equivalence.
Sources: The Living Graph, MLIR — Dialect conversion, MLIR — Interfaces
13. One interop contract, several physical paths
Problem: Each language pair becomes a bespoke bridge.
Mechanism: Switchboard + Service contracts; direct typed calls or framed FlexBuffers and leased attachments.
Theory: Representation independence; ABI lowering; resource semantics.
Precedent: WIT/Canonical ABI; Arrow C data interface.
Qualification: Zero-copy is qualified per address space and lifetime, not promised universally.
Sources: FFI / Switchboard, Mutable memory and publication, WebAssembly Component Model — WIT, Apache Arrow — C data interface
14. Transactional system definitions
Problem: Partial edits produce invalid intermediate published systems.
Mechanism: Immutable snapshots, typed patches, per-authority serialized commit and durable receipts.
Theory: MVCC; serializability; atomic state transition.
Precedent: SQLite; PostgreSQL; FoundationDB.
Qualification: Graph ACID does not atomically include remote APIs or unrelated application databases.
Sources: Stable foundations, Data transactions, SQLite — Isolation, PostgreSQL — Transaction isolation, FoundationDB — A Distributed Unbundled Transactional Key Value Store (SIGMOD 2021)
15. Legal rewrites carry obligations
Problem: A valid syntax edit breaks references, authority or invariants.
Mechanism: Preconditions, boundary mappings, affected invariants and explicit authority changes.
Theory: DPO rewriting; Hoare-style preservation; assume/guarantee reasoning.
Precedent: Graph transformation research; compiler rewrite systems.
Qualification: Structural preservation is weaker than behavior preservation.
Sources: Formal methods and evidence, Stable foundations, Patch Graph Rewriting: comparison with DPO rewriting, MLIR — Dialect conversion
16. Coordination follows invariants
Problem: Optimistic collaboration violates exclusive bindings or ownership.
Mechanism: Start conservative; coordinate where merges are not invariant-confluent.
Theory: Invariant confluence; predicate conflicts.
Precedent: Serializable databases.
Qualification: Commuting writes do not necessarily preserve invariants after merge.
Sources: Data transactions, PostgreSQL — Transaction isolation, Bailis et al. — Coordination Avoidance in Database Systems
17. Deployment is recoverable realization
Problem: Restoring a graph pointer is mistaken for undoing external effects.
Mechanism: Desired release manifest; prepared activation root; fences, drain and compensations.
Theory: State-machine replication; reconciliation; sagas.
Precedent: Kubernetes controllers; Erlang release handling; Temporal.
Qualification: Rollback after an incompatible data migration may require forward repair.
Sources: Component lifecycle, DevOps integration, Kubernetes — Controllers, Erlang/OTP — Release handling, Temporal — Workflow execution
18. Incremental queries and transformations
Problem: Every tool rescans the full graph after every change.
Mechanism: Indexed relations and dependency-tracked derivations across queries, plans and evidence.
Theory: Fixed-point computation; incremental view maintenance; build calculus.
Precedent: Differential Dataflow; Build Systems à la Carte.
Qualification: Absence predicates and opaque dependencies must invalidate conservatively.
Sources: Graph visitors, Module execution plan, McSherry et al. — Differential Dataflow, Mokhov, Mitchell & Peyton Jones — Build Systems à la Carte
19. Shadow executes controlled counterfactuals
Problem: Production defects are expensive to reproduce or compare.
Mechanism: Pinned input/state/artifact closures with explicit substitution boundaries and fault schedules.
Theory: Transition systems; deterministic simulation; controlled comparison.
Precedent: FoundationDB simulation; durable workflow replay.
Qualification: Replay fidelity and model coverage constrain the claims it supports.
Sources: Shadow foundations, Capture and replay, Shadow verification and capsules, FoundationDB — A Distributed Unbundled Transactional Key Value Store (SIGMOD 2021), Temporal — Workflow execution
20. Claim-indexed evidence, not a global green check
Problem: Tests and proofs get oversold as universal correctness.
Mechanism: Claim → assumptions → evidence → verifier → artifact and coverage.
Theory: Proof obligations; epistemic scope; partial orders.
Precedent: TLA+ models; translation validation; simulation test portfolios.
Qualification: This revises the docs’ ordinal EvidenceLevel model; evidence kinds are not totally ordered.
Sources: Formal methods and evidence, Shadow verification and capsules, Lamport — A high-level view of TLA+, MLIR — Dialect conversion, FoundationDB — A Distributed Unbundled Transactional Key Value Store (SIGMOD 2021)
21. Maps make one model legible
Problem: A universal canvas becomes an unreadable hairball.
Mechanism: Task-scoped maps, semantic zoom, projections and provenance-aware unknowns.
Theory: Graph queries; abstraction; information hiding.
Precedent: Ptolemy hierarchy; compiler IR views; structured editors.
Qualification: A diagram is a presentation, not the authority for inferred missing facts.
Sources: Graph visitors, Workbench layers, Ptolemy II: hierarchy, ports and models of computation
22. Human and agent actions share commands
Problem: Agents act through brittle text edits and privileged shortcuts.
Mechanism: Typed commands, scoped reads, patch validation, receipts and the same policy gates.
Theory: Capability discipline; transition-system semantics; projectional editing.
Precedent: MPS Projectional Agent Toolkit (experimental, 2026.1).
Qualification: MPS already supplies structured agent editing. External harness tools may bypass graph commands unless their effective authority is qualified.
Sources: Workbench layers, Formal methods and evidence, JetBrains MPS — Projectional Agent Toolkit (2026.1, experimental), Conductor harness boundaries
23. Interaction semantics are portable, rendering remains specialized
Problem: Generic cross-platform trees destroy performance or accessibility.
Mechanism: State/events/behavior contracts with specialized renderer and island implementations.
Theory: State machines; refinement; unidirectional dataflow.
Precedent: Compose architecture; Unreal native visual scripting.
Qualification: Preserve focus, IME, drafts and assistive semantics; not merely visual similarity.
Sources: Surface contracts and interaction, Dynamic UI and verification, Surface renderers, Jetpack Compose — Architecture and state, Unreal Engine — Introduction to Blueprints
24. Reusable features include operational obligations
Problem: Reusing a library does not transfer its deployment or safety assumptions.
Mechanism: Feature regions package contracts, effects, placement, migrations and acceptance scenarios.
Theory: Assume/guarantee composition; refinement types.
Precedent: FMI component exchange; reusable workflow/component systems.
Qualification: Reuse reduces obligations only when environment assumptions are discharged.
Sources: Reaktor plan and roadmap, Module execution plan, Functional Mock-up Interface — Model exchange and co-simulation, Honda, Yoshida & Carbone — Multiparty Asynchronous Session Types
25. Privacy and trust survive inspection and replay
Problem: Immutable histories retain secrets or resurrect deleted data.
Mechanism: Artifact references, scoped disclosure, retention/revocation and suppression records.
Theory: Information-flow reasoning; provenance; lifecycle policies.
Precedent: Existing storage/identity systems remain the enforcement providers.
Qualification: Reference retention is not a legal compliance proof or automatic secure erasure.
Sources: Shadow workspaces, Shadow verification and capsules, Authentication module
26. Adoption and qualification are part of the architecture
Problem: The platform only works after a complete rewrite.
Mechanism: Library-first boundaries, honest opaque regions, native escape hatches and measured guarantees.
Theory: Refinement boundaries; experimental ablation; modularity.
Precedent: MLIR incremental adoption; MPS host integration; specialist runtimes.
Qualification: The benefit must exceed modeling, runtime and operational overhead for external teams.
Sources: The Living Graph, Reaktor plan and roadmap, MLIR — Dialect conversion, JetBrains MPS — Projectional Agent Toolkit (2026.1, experimental)
3. Semantic kernel and graph substrate
The semantic kernel should own stable identity, typed incidence structure, region boundaries, schemas, protocols, effect/ownership declarations, immutable snapshots and a closed change algebra. It should expose indexed query and transformation facilities. Modules contribute domain vocabulary, validators, lowerings, providers and inspection support.
It should not own every product record, event sample, media frame or game transform. It also should not force every operation through a mailbox or a serialized value tree. The same declared service may use a direct typed call, a framed FFI call, a live session or a durable request profile where the chosen contract supports that interpretation. [The Living Graph] [Data graph] [Service contracts] [FFI / Switchboard]
Integration is not an import dependency. Low-level core, storage and authorization libraries can remain graph-free. Their graph-facing modules register facts, resources and effects at the composition boundary. Otherwise “everything uses the graph” creates cyclic dependencies and prevents headless or incremental adoption. The existing Core and Build Tools documents already establish the relevant separation. [Core dependency boundary] [Build control-plane responsibilities]
Likewise, one common semantic identity system need not imply one centralized database or transaction domain. A device, server and authority can have local publication rules and a declared distributed revision vector. The federation must explain what it knows and what it cannot yet join; it must not invent global simultaneity.
Open-world node, port and relation grammar
An extensible system cannot enumerate all future domain types. This catalog instead gives a generative specification and 100 concrete starter entries: 40 node families, 24 port profiles and 36 hyperedge schemas. Families overlap through facets. They are not 100 mandatory kernel classes or proof that every combination is meaningful.
Node descriptor = semantic family + facets + owned ports + execution profile + source/instance/lifetime metadata. A node may describe a pure function, actor, store, UI component, native adapter, schema, deployment or evidence record. Represent a value as its own node only when identity, relationships, ownership or provenance justify doing so.
Port contract = payload/schema × protocol × incidence role × multiplicity × ownership/lifetime × effects/required authority × clock/ordering × target requirements. This is a constraint product: many combinations are invalid. A borrowed GPU buffer cannot simply be sent to a remote host as an ordinary value.
Hyperedge descriptor = typed roles with per-role cardinalities + relation laws + layer + optional execution interpretation. Binary bindings are two-incidence specializations. A transaction hyperedge records participation under a named authority; it does not create a distributed transaction. A quorum relation does not implement consensus. An authorization relation does not itself grant access.
Adding a module means registering versioned schemas, compatible port descriptors, relation invariants, optional validators/lowerings, tooling metadata, migration and qualification support. Unknown optional inspection metadata can round-trip. Unknown required execution semantics block execution. Nothing requires adding every domain type to a central enum.
For FFI, use the existing Switchboard contract and graph identities. FlexBuffers carries checked structured values, manifests and patch metadata; leased attachments carry large buffers/resources where allowed. The typed contract lives above the wire encoding. Local direct calls and serialized calls are two lowerings, not separate semantic APIs. Reaktor FFI / Switchboard
The graph is the system language
The revised center is a small semantic kernel plus qualified interpretations and changes.
Law / model / proof obligation: meaning → legal plan → qualified realization → attributable observation
Reaktor design decision
Keep graph semantics authoritative while letting Gradle, platform renderers, databases and native kernels do their specialized jobs. Low-level libraries can remain graph-free; higher-layer contributions register the operational boundary.
What this does not establish
A universal graph-shaped intermediate object on every hot call would defeat the performance and adoption goals. A diagram cannot certify unmodeled native or external harness behavior.
Falsifiable acceptance test. Replace a service region across two runtimes; trace its source, policy, artifacts and outcomes without inventing a second identity graph.
Theory, precedent and Reaktor context: The Living Graph Core dependency boundary Module execution plan FFI / Switchboard Build control-plane responsibilities
Core ideas and invariants
Twenty-six ideas covering meaning, execution, controlled change and leverage. Precedents support individual mechanisms; the complete integration is a design hypothesis to qualify.
01One semantic identity system
Problem
Duplicated models drift across build, runtime and tools.
Reaktor mechanism
Stable definition, operation and resource identities; versioned joins to artifacts and activations.
Theory
Denotational meaning; content-addressed identity.
Precedent
Unison; MLIR symbol/operation models.
Qualification
Stable identity is not the same as a mutable name, hash or runtime address.
The Living Graph Source ownership Unison — Code as content-addressed definitions MLIR — Interfaces
02Typed, role-labelled port hypergraph
Problem
Binary links lose the meaning of multi-party relations.
Reaktor mechanism
Nodes own ports; incidences carry relation, role and optional position.
Theory
Typed hypergraphs; relational incidence models.
Precedent
Ptolemy II port-connected actors.
Qualification
Topology does not define ordering, coordination or protocol progress.
Graph substrate redesign Data graph Ptolemy II: hierarchy, ports and models of computation
03Open hierarchical regions
Problem
Reuse must preserve boundaries while changing internals.
Reaktor mechanism
Exported ports and explicit replacement boundary mappings.
Theory
Cospans; symmetric monoidal composition; typed substitution.
Precedent
Ptolemy hierarchical composition; FMI boundaries.
Qualification
Ownership-constrained composition must not introduce arbitrary resource copying.
The Living Graph Fong — Decorated Cospans (2015) Functional Mock-up Interface — Model exchange and co-simulation
04Orthogonal facets and semantic layers
Problem
Class inheritance and duplicate graphs couple unrelated concerns.
Reaktor mechanism
One identity space, typed facts and relation families; versioned dialects.
Theory
Multilayer graphs; extensible algebraic signatures.
Precedent
MLIR dialects and interfaces.
Qualification
Unknown required semantics block execution; optional display metadata may round-trip.
Module execution plan MLIR — Interfaces Cozzo et al. — Structure of Triadic Relations in Multiplex Networks
05Definitions are not activations or observations
Problem
A deployment plan is mistaken for current reality.
Reaktor mechanism
Separate revision streams for definitions, activations, observations and evidence.
Theory
Temporal databases; partial orders and causal cuts.
Precedent
Kubernetes desired/observed state.
Qualification
A federated snapshot is not automatically a globally consistent cut.
The Living Graph Operational graph evidence Lamport — Distributed clocks, snapshots and temporal specifications Kubernetes — Controllers
06Source and visual projections share edit authority
Problem
Source and canvas become independent editable truths.
Reaktor mechanism
One owner per region; source-backed transformations or graph-owned programs.
Theory
Bidirectional lenses and round-trip laws.
Precedent
MPS projectional editing.
Qualification
Round-trip laws apply only to a declared supported language subset.
Source ownership Visual language Foster et al. — Combinators for Bidirectional Tree Transformations JetBrains MPS — Projectional Agent Toolkit (2026.1, experimental)
07General computation with qualified execution profiles
Problem
A DAG-only tool cannot express the intended systems.
Reaktor mechanism
Executable regions with control, state and effects; specialized actor/stream/native profiles.
Theory
Operational semantics; abstract machines; models of computation.
Precedent
Ptolemy directors; ordinary compilers.
Qualification
Turing completeness provides expressiveness, not decidable verification or bounded execution.
The Living Graph Actor execution model Ptolemy II: hierarchy, ports and models of computation Lee & Parks — Dataflow Process Networks (1995)
08Protocols, not only payload types
Problem
A well-typed message can arrive in an illegal phase.
Reaktor mechanism
Versioned interaction protocols, local state machines, cancellation and completion semantics.
Theory
Session types; labelled transition systems; Petri nets.
Precedent
Session-type research; Temporal execution contracts.
Qualification
Progress guarantees require specified failures, fairness and transport assumptions.
Service contracts Graph protocol Honda, Yoshida & Carbone — Multiparty Asynchronous Session Types A Mechanised Theory of Multiparty Asynchronous Session Types (ECOOP 2025) Temporal — Workflow execution
09Explicit state, lifetime and resource ownership
Problem
GC, native buffers, actors and host teardown disagree.
Reaktor mechanism
Owners, leases, affinity, borrow scopes and activation epochs.
Theory
Linear/affine resource reasoning; structured lifetimes.
Precedent
WIT resources; Arrow release callbacks; Erlang ownership.
Qualification
A generation handle prevents reuse confusion, not arbitrary native memory corruption.
Component lifecycle Actor execution model FFI / Switchboard WebAssembly Component Model — WIT Apache Arrow — C data interface
10Effects and authority are different contracts
Problem
Knowing an API exists is mistaken for permission to use it.
Reaktor mechanism
Effect declarations, scoped grants, policy decisions and actual effect receipts.
Theory
Effect systems; non-amplification and access-control invariants.
Precedent
Koka effect typing; reference-monitor architecture.
Qualification
A graph annotation does not sandbox trusted in-process code.
Formal methods and evidence Authentication module Koka — Types and effect handlers
11Adaptive capability selection
Problem
Platform conditionals and fallback logic scatter throughout apps.
Reaktor mechanism
Filter offers by hard constraints and authority, then rank qualified preferences.
Theory
Constraint satisfaction; partial orders; control hysteresis.
Precedent
Ptolemy/FMI qualified heterogeneous implementations are partial precedents.
Qualification
No single cited precedent supplies the whole Reaktor adaptation contract.
Capability selection Reaktor plan and roadmap Functional Mock-up Interface — Model exchange and co-simulation
12Multiple backends preserve one contract
Problem
Cross-platform code paths silently change semantics.
Reaktor mechanism
Semantic profiles, lowering legality, source maps and translation qualification.
Theory
Compiler refinement and simulation relations.
Precedent
MLIR conversion targets and dialect interfaces.
Qualification
A successful conversion is not itself a proof of behavioral equivalence.
The Living Graph MLIR — Dialect conversion MLIR — Interfaces
13One interop contract, several physical paths
Problem
Each language pair becomes a bespoke bridge.
Reaktor mechanism
Switchboard + Service contracts; direct typed calls or framed FlexBuffers and leased attachments.
Theory
Representation independence; ABI lowering; resource semantics.
Precedent
WIT/Canonical ABI; Arrow C data interface.
Qualification
Zero-copy is qualified per address space and lifetime, not promised universally.
FFI / Switchboard Mutable memory and publication WebAssembly Component Model — WIT Apache Arrow — C data interface
14Transactional system definitions
Problem
Partial edits produce invalid intermediate published systems.
Reaktor mechanism
Immutable snapshots, typed patches, per-authority serialized commit and durable receipts.
Theory
MVCC; serializability; atomic state transition.
Precedent
SQLite; PostgreSQL; FoundationDB.
Qualification
Graph ACID does not atomically include remote APIs or unrelated application databases.
Stable foundations Data transactions SQLite — Isolation PostgreSQL — Transaction isolation FoundationDB — A Distributed Unbundled Transactional Key Value Store (SIGMOD 2021)
15Legal rewrites carry obligations
Problem
A valid syntax edit breaks references, authority or invariants.
Reaktor mechanism
Preconditions, boundary mappings, affected invariants and explicit authority changes.
Theory
DPO rewriting; Hoare-style preservation; assume/guarantee reasoning.
Precedent
Graph transformation research; compiler rewrite systems.
Qualification
Structural preservation is weaker than behavior preservation.
Formal methods and evidence Stable foundations Patch Graph Rewriting: comparison with DPO rewriting MLIR — Dialect conversion
16Coordination follows invariants
Problem
Optimistic collaboration violates exclusive bindings or ownership.
Reaktor mechanism
Start conservative; coordinate where merges are not invariant-confluent.
Theory
Invariant confluence; predicate conflicts.
Precedent
Serializable databases.
Qualification
Commuting writes do not necessarily preserve invariants after merge.
Data transactions PostgreSQL — Transaction isolation Bailis et al. — Coordination Avoidance in Database Systems
17Deployment is recoverable realization
Problem
Restoring a graph pointer is mistaken for undoing external effects.
Reaktor mechanism
Desired release manifest; prepared activation root; fences, drain and compensations.
Theory
State-machine replication; reconciliation; sagas.
Precedent
Kubernetes controllers; Erlang release handling; Temporal.
Qualification
Rollback after an incompatible data migration may require forward repair.
Component lifecycle DevOps integration Kubernetes — Controllers Erlang/OTP — Release handling Temporal — Workflow execution
18Incremental queries and transformations
Problem
Every tool rescans the full graph after every change.
Reaktor mechanism
Indexed relations and dependency-tracked derivations across queries, plans and evidence.
Theory
Fixed-point computation; incremental view maintenance; build calculus.
Precedent
Differential Dataflow; Build Systems à la Carte.
Qualification
Absence predicates and opaque dependencies must invalidate conservatively.
Graph visitors Module execution plan McSherry et al. — Differential Dataflow Mokhov, Mitchell & Peyton Jones — Build Systems à la Carte
19Shadow executes controlled counterfactuals
Problem
Production defects are expensive to reproduce or compare.
Reaktor mechanism
Pinned input/state/artifact closures with explicit substitution boundaries and fault schedules.
Theory
Transition systems; deterministic simulation; controlled comparison.
Precedent
FoundationDB simulation; durable workflow replay.
Qualification
Replay fidelity and model coverage constrain the claims it supports.
Shadow foundations Capture and replay Shadow verification and capsules FoundationDB — A Distributed Unbundled Transactional Key Value Store (SIGMOD 2021) Temporal — Workflow execution
20Claim-indexed evidence, not a global green check
Problem
Tests and proofs get oversold as universal correctness.
Reaktor mechanism
Claim → assumptions → evidence → verifier → artifact and coverage.
Theory
Proof obligations; epistemic scope; partial orders.
Precedent
TLA+ models; translation validation; simulation test portfolios.
Qualification
This revises the docs’ ordinal EvidenceLevel model; evidence kinds are not totally ordered.
Formal methods and evidence Shadow verification and capsules Lamport — A high-level view of TLA+ MLIR — Dialect conversion FoundationDB — A Distributed Unbundled Transactional Key Value Store (SIGMOD 2021)
21Maps make one model legible
Problem
A universal canvas becomes an unreadable hairball.
Reaktor mechanism
Task-scoped maps, semantic zoom, projections and provenance-aware unknowns.
Theory
Graph queries; abstraction; information hiding.
Precedent
Ptolemy hierarchy; compiler IR views; structured editors.
Qualification
A diagram is a presentation, not the authority for inferred missing facts.
Graph visitors Workbench layers Ptolemy II: hierarchy, ports and models of computation
22Human and agent actions share commands
Problem
Agents act through brittle text edits and privileged shortcuts.
Reaktor mechanism
Typed commands, scoped reads, patch validation, receipts and the same policy gates.
Theory
Capability discipline; transition-system semantics; projectional editing.
Precedent
MPS Projectional Agent Toolkit (experimental, 2026.1).
Qualification
MPS already supplies structured agent editing. External harness tools may bypass graph commands unless their effective authority is qualified.
Workbench layers Formal methods and evidence JetBrains MPS — Projectional Agent Toolkit (2026.1, experimental) Conductor harness boundaries
23Interaction semantics are portable, rendering remains specialized
Problem
Generic cross-platform trees destroy performance or accessibility.
Reaktor mechanism
State/events/behavior contracts with specialized renderer and island implementations.
Theory
State machines; refinement; unidirectional dataflow.
Precedent
Compose architecture; Unreal native visual scripting.
Qualification
Preserve focus, IME, drafts and assistive semantics; not merely visual similarity.
Surface contracts and interaction Dynamic UI and verification Surface renderers Jetpack Compose — Architecture and state Unreal Engine — Introduction to Blueprints
24Reusable features include operational obligations
Problem
Reusing a library does not transfer its deployment or safety assumptions.
Reaktor mechanism
Feature regions package contracts, effects, placement, migrations and acceptance scenarios.
Theory
Assume/guarantee composition; refinement types.
Precedent
FMI component exchange; reusable workflow/component systems.
Qualification
Reuse reduces obligations only when environment assumptions are discharged.
Reaktor plan and roadmap Module execution plan Functional Mock-up Interface — Model exchange and co-simulation Honda, Yoshida & Carbone — Multiparty Asynchronous Session Types
25Privacy and trust survive inspection and replay
Problem
Immutable histories retain secrets or resurrect deleted data.
Reaktor mechanism
Artifact references, scoped disclosure, retention/revocation and suppression records.
Theory
Information-flow reasoning; provenance; lifecycle policies.
Precedent
Existing storage/identity systems remain the enforcement providers.
Qualification
Reference retention is not a legal compliance proof or automatic secure erasure.
Shadow workspaces Shadow verification and capsules Authentication module
26Adoption and qualification are part of the architecture
Problem
The platform only works after a complete rewrite.
Reaktor mechanism
Library-first boundaries, honest opaque regions, native escape hatches and measured guarantees.
Theory
Refinement boundaries; experimental ablation; modularity.
Precedent
MLIR incremental adoption; MPS host integration; specialist runtimes.
Qualification
The benefit must exceed modeling, runtime and operational overhead for external teams.
The Living Graph Reaktor plan and roadmap MLIR — Dialect conversion JetBrains MPS — Projectional Agent Toolkit (2026.1, experimental)
Reusable feature contracts
Assume/guarantee reasoning is the practical bridge between libraries and system-level confidence.
Law / model / proof obligation: Environment ⊨ A(C), and (implementation C under A(C)) ⊨ G(C), under the declared model.
Reaktor design decision
Package the conditions of a reusable region alongside its code: owner, protocol, replay-safe effects, migration requirements, acceptance and evidence. Composition creates obligations where those assumptions meet the host.
What this does not establish
Assumptions can be wrong, incomplete or circular. Opaque providers need explicit trust/qualification; annotations alone do not discharge their obligations.
Falsifiable acceptance test. Bind a component requiring distributed conditional writes to a process-local keyed mutex. Reject the claimed guarantee rather than silently degrading it.
Theory, precedent and Reaktor context: Formal methods and evidence Stable foundations Data transactions Multitenancy Functional Mock-up Interface — Model exchange and co-simulation Honda, Yoshida & Carbone — Multiparty Asynchronous Session Types
Store the relation once; preserve each participant’s role
A multi-party relation should not dissolve into unrelated pairwise edges.
Law / model / proof obligation: I ⊆ H × P × Role × Position
Reaktor design decision
The incidence model supports joins, pub/sub relationships, sessions and replicated groups without manufacturing fake coordinator objects. Fast binary indexes remain possible.
What this does not establish
The “one provider per consumer” invariant belongs to the corresponding binding schema, not every port in every relation. A hyperedge is not automatically an executable join.
Falsifiable acceptance test. Add two participants and one authority. Reject a second authority without accidentally rejecting the valid multi-party relationship.
Theory, precedent and Reaktor context: Graph substrate redesign Data graph Formal methods and evidence Ptolemy II: hierarchy, ports and models of computation
An edge’s meaning survives the map
Layer-aware reachability prevents false security, placement and dependency conclusions.
Law / model / proof obligation: A(ℓ) is indexed by relation layer; aggregation can destroy relevant distinctions.
Reaktor design decision
An authorization map can join invocation and policy facts without pretending they are the same relation. Semantic layers are not copied objects or separate sources of truth.
What this does not establish
A path in an aggregated graph may not correspond to a legal path in any execution or authority model. Degree and centrality are diagnostics, not automatic measures of risk.
Falsifiable acceptance test. An invocation route reaches a store, but the required grant is missing. The map must flag the mismatch rather than infer permission from connectivity.
Theory, precedent and Reaktor context: The Living Graph Graph visitors Cozzo et al. — Structure of Triadic Relations in Multiplex Networks