System model
The Substrate is Lamarck's durable public contract. System modules implement, protect, and operate it.
This page names the major ownership boundaries. It deliberately leaves manifest fields, OAuth flows, and SQL policy to their module documentation.
Clients & toolsPeople · Apps · AI · operator tooling
App Runtimeruns AppsConnector Runtimecreates SourcesCredentialholds external authorityAuthority & Guardmediates data operationsControl Planeowns lifecycleInterfacesexposes bounded surfaces
Personal SubstrateTimeline · Source · App · Document · Table
The public contract
The Substrate is the part of Lamarck that survives changes in implementation. Timeline preserves Events. System Shape describes the current Sources, Apps, Documents, and Tables.
Its technical contract includes stable identity, durable representation, provenance, mutation rules, and workspace materialization. A different Shell or runtime must still preserve those contracts.
The machinery
| Module | Relationship to the Substrate |
|---|---|
| App Runtime | Turns an App package into isolated UI, service, and job workloads. |
| Connector Runtime | Turns a trusted Connector package and configuration into a Source. |
| Credential | Supplies external credentials without making them part of the Substrate. |
| Authority & Guard | Derives identity, authorizes operations, and audits durable mutations. |
| Control Plane | Owns runtime configuration, lifecycle, supervision, and system.db. |
| Interfaces | Lets people, Apps, tools, and AI operate the same bounded system. |
Cross-module invariants
- Modules may change without silently changing the durable Substrate contract.
- Runtime state in
system.dbis not personal Timeline data. - Credentials are secret control state, not Documents, Tables, or Events.
- Every durable managed mutation reaches the Substrate through an authenticated, authorized interface.
- Interfaces do not gain authority merely by presenting the same data differently.
NextThe Substrate contract