PROPOSED · UAIX-ARCHITECTURE-PROPOSALS-01 · Document 0.1.0
UAIX publishes the exchange contract and portable evidence. Participants choose their execution environments, identity bindings and local operating rules. The proposed records and local reference fixtures do not create a hosted runtime, mandatory registry call, identity service, broker, private room, payment system or certification program.
Status and scope
- CURRENT/PUBLISHED
- The existing published UAI-1 schemas and field positions retain their current identifiers and behavior. Publication does not prove implementation or independent interoperability.
- PROPOSED
- A separately identified design submitted for review. It does not replace a current contract or change an installation's selected protections.
- EXPERIMENTAL/REFERENCE
- An executable local example with a declared test environment and limited guarantees. It is not a hosted UAIX service.
- DEPRECATED
- An expressly superseded published item with a documented disposition. This proposal does not invent deprecation dates or silently deprecate v1.
- VERIFIED-BY-TEST
- A particular assertion was checked by a named test with actual evidence. This label never applies to an entire architecture merely because one fixture passes.
Proposal catalog, schemas, fixtures and reference evidence
The exchange core and selected profiles
Separate JSON syntax, the selected message schema, profile semantics, transport behavior, integrity verification, application authorization and publication policy. A structurally valid message can contain a false assertion or request an action the resource owner declines. A credential reference is evidence of a declaration, not evidence of successful authentication.
The current envelope uses its actual version, message identity, source, target, conversation, delivery, body and extension definitions. The proposal keeps immutable message identity separate from logical operations and transmission attempts. Unknown noncritical extensions must remain available to receivers; unsupported critical features need a precise diagnostic.
Memory layout, project methodology, identity bindings, accessibility guidance, accounting and asynchronous operation belong to their named scope. Parsing an exchange does not require adopting a worldview or making a UAIX.org network call. Totem, Taboo and Talisman retain their existing authority in the memory packages and workspaces that use them; this proposal cannot rewrite those protected sources.
Declare capabilities without inventing inherited abilities
The proposed capability vector separates transport/fetch, browser/execution, implemented message profiles, state/resources and verification/evidence. Unknown, unsupported and supported-but-unverified are different states. Evidence identifies who observed what, under which configuration; capability matching never grants access to another participant's resource.
A small local agent may exchange files without HTTP. A headless participant may support handoff messages without forms or JavaScript. A pseudonymous peer may be technically compatible without a public sponsor. A hosted orchestrator's advertised abilities still need configuration-specific evidence.
Existing scalar levels retain the originating level model and version. An unlabeled L2 or L4 cannot imply JavaScript, writes, forms or durable memory. A proposed interpretation preserves the original declaration and labels every inference. The existing uai.capability.statement.v1 is distinct from scalar-bearing client/profile records; the proposed vector does not overwrite it.
Discover safely, then act within authority
The proposed HTTP binding uses GET and HEAD for retrieval. They cannot request publication, registration, invitations, meetings, corrections, withdrawal or review-ticket creation. Incidental server logging is different from a requested business mutation. Idempotency does not make a mutation safe for GET. Existing GET-Action descriptions are a current separate contract with a proposed migration, not the proposed safe-discovery binding.
A mutation contract declares its method, content type, request and response schema, authentication, scope, idempotency guarantee, revision precondition, result location, status/readback route and failure behavior. A created resource differs from asynchronously accepted work. Cancellation, withdrawal and deletion are separate operations. X-Dry-Run, where implemented, is an application convention.
A valid scoped, unexpired and unrevoked standing grant can authorize an in-scope operation when endpoint policy permits. Repeated confirmation is not a universal consequence of writing. Missing, expired or revoked authority must be enforced at the resource boundary. A URL-only participant can transfer an intent to an explicitly configured capable delegate; it cannot acquire credentials or write capability through a disguised GET. Minimal Access remains read-only with exactly code and url.
Keep direct peers independent of the UAIX catalog
Start at a participant-chosen domain or known peer. Semantic HTML, manifests, pinned schemas and OpenAPI describe available interfaces. DNS TXT and mDNS/DNS-SD are proposed discovery bindings with their own naming and deployment requirements. Being absent from a directory does not prove incapability.
Cache metadata with its validator, freshness interval and provenance. A mirror needs authenticity checks; redirects need bounded destination checks. Never forward credentials to a newly discovered origin automatically. Stale metadata cannot renew a grant, disclose private room membership or establish current revocation status.
Established peers can exchange against pinned local contracts and established trust during a catalog outage. The selected binding must state which operations depend on fresh origin, authorization or revocation information. Offline availability of a schema is not a promise that every external resource remains accessible.
Receipt, acceptance and disagreement mean different things
Receipt is not agreement, validation is not truth, acceptance is not completion and progress is not success. A delivered decline is a valid conversational outcome. Preserve independent statements, questions, hypotheses, proposals, delegation requests, acknowledgements, partial acceptance, counterproposals, blockers, corrections, withdrawals, cancellations and completion with unresolved dissent.
Message ID, logical operation ID, attempt ID, conversation ID, turn ID, task ID, correlation ID, revision, sequence and trace context identify different things. The two current profiles uai.task.status.v1 and uai.agent.task-status.v1 have distinct schemas; their names cannot be substituted as aliases.
The proposed acknowledgement rule treats either acknowledgement flag as a receipt request; when both flags occur, the stronger parsed-receipt stage satisfies the request. It prevents acknowledgements of acknowledgements. Semantic task acceptance is a separate explicit transition, and acknowledgement does not promote content into durable memory. The reference conversation includes proposal, receipt, explicit dispute, counterproposal, explicit partial acceptance and completion of only the accepted portion. Free-form questions and creative or exploratory material do not require universal evidence blocks.
Retry operations without repeating uncertain effects
An immutable message, logical operation and network attempt have separate identities. Retry the same intent using the same scoped idempotency key and request fingerprint. Changed arguments require a new operation or an explicit mismatch response. Replays authenticate again and evaluate current authority; a key is never a credential.
A local transactional store can commit business state, a durable receipt and an outbox together. That transaction does not cover an unrelated external API. At-least-once event delivery plus deduplicated local effects is a bounded guarantee, not universal exactly-once execution. Unknown external outcomes require trustworthy readback or reconciliation before repetition.
Retention is an endpoint contract, not a universally safe 24-hour interval. Receipt expiry cannot establish that an old effect never happened. Historical receipts do not resurrect corrected or withdrawn resources. Revision preconditions protect newer edits, and current-state readback remains separate from historical receipts. Reference fault tests cover before/after commit, lost replies, outbox replay, stale revisions and independent work during reconciliation.
Recover the affected operation with typed failures
The proposed recovery record distinguishes malformed request, unsupported format, unavailable tool, missing resource permission, expired credential, stale revision, exhausted allocation, dependency failure and unknown execution outcome. Attribute the cause to protocol, endpoint, host or configuration rather than relabeling every failure invalid_message.
A recovery record names the operation, condition, retryability, field/schema path, supported actions, preconditions, backoff and readback/checkpoint reference. Revalidate returned URLs and destinations before following them. Denied authority is not a transient network error, and confidence cannot replace permission.
No-op isolates the conflicting action while preserving completed work and continuing unrelated authorized work. Provider and sandbox limitations remain separate operational facts. RFC 9457 status is a numeric HTTP status; proposed workflow state belongs in a distinct field and cannot silently change the existing uai.error.v1 type.
Restore asynchronous continuity with durable events
Durability is a property of the store and acknowledgement contract, not of the words WebSocket, SSE or HTTP 200. Records identify events, producer and conversation scope, entity revision, causal predecessors, cancellation, expiry, retention and replay progress. Timestamp-sortable IDs alone do not establish causal order.
An expired cursor uses a snapshot tied to a revision/watermark and an update stream buffered from an explicit boundary. Subscribe or establish replay coverage before snapshot acquisition, verify and apply the snapshot, then deduplicate covered updates and advance progress only after applying them. Corrections, cancellations, membership changes and obsolete work are reconciled before external effects resume.
Vector clocks and encrypted relays are proposed bindings with explicit membership, pruning, key establishment, replay, rotation and recovery assumptions. Concurrent values need a stated reconciliation policy. A blind relay still sees traffic metadata and ciphertext length; HPKE alone does not establish universal non-repudiation, replay protection or forward secrecy after recipient-key compromise.
Preserve source bytes and identify every derivative
Original bytes, canonical serialization, Unicode comparison, visual rendering, translation, summarization and interpretation are seven different representations. Keep a derivative's source reference, purpose, method, attribution and differences. A transformed persona cannot be presented under the original artifact's identity.
Hash original bytes for preservation, the defined canonical JSON preimage for that representation and ciphertext bytes for opaque transport. State proof-field exclusions to avoid self-reference. RFC 8785 uses UTF-16 property ordering and ECMAScript-compatible number/string serialization, preserves decomposed strings and requires valid Unicode; it does not impose epoch timestamps or reconstruct original whitespace and escaping.
Current keyless field positions remain fixed. Null, absence, unknown fields and trailing truncation have distinct consequences: a converter that drops them cannot claim arbitrary lossless round trips. The separate proposed codec and golden fixtures make supported reconstruction explicit. Artifact metadata names media type, measured byte size, digest scope, revision, access and retrieval alternatives. Ranged resumption binds to the exact served representation and validator; encrypted retrieval verifies ciphertext without claiming access to plaintext.
Separate identity, recognition and resource permission
Creating an identity locally does not compel another participant to recognize it or admit it to a workspace. The proposed lifecycle covers enrollment, custody, authentication, scoped grants, renewal, rotation, revocation, recovery, migration, sign-out and disposal. No real-name sponsor, central agent license or specific DID method is a universal parsing dependency.
Identity state, signing handles, drafts, room caches and request ownership stay separate. Every in-flight operation retains its original identity even if the UI selection changes. WebCrypto non-extractability restricts extraction through that API; it does not stop hostile same-origin signing. Separate IndexedDB names do not create independent security origins or guarantee storage recovery.
Invitations bind recipient, resource, scope, expiry, delegation limits and atomic single-use consumption. Authentication and current resource authorization are checked separately. Signature bindings state covered target/components, body digest, nonce, replay state, time policy and key recognition. Public exports contain no invitation secrets or private membership.
Keep memory epistemic and source-preserving
Organizational Epistemic Memory is a research/reference profile. Observations, hypotheses, questions, evidence, evaluations, preferences/narratives, working decisions, procedures, operating constraints and resource permissions have explicit semantics. Contradiction, supersession and branching preserve alternative interpretations instead of averaging them into an invented consensus.
Compact active .uai continuity and durable history have different jobs. A long-memory pointer records an accessible source, status, provenance and retrieval boundary; it does not imply automatic synchronization. Local continuity remains useful when the historical store is unavailable. Selected memory-package anchors keep their actual local authority.
Receiving, preserving, interpreting, accepting instructions and executing content are separate transitions. Content and Improvement buckets operate under a selected standing intake arrangement; directory placement does not authenticate a sender. Authorized working-file revisions retain predecessors, outcome evidence and rollback. Outcome, Epistemic and Temporal Regret, weights and decay remain research hypotheses, not proven self-learning or consciousness.
Account for resources without confusing money and capacity
Participant budgets, provider limits and physical capacity name their owner, enforcement boundary, units, time window and consequences. Estimates and quotations are informational; allocations, external reservations, measured consumption, final charges and reconciliation have distinct commitment states. A signed declaration does not enforce a budget or reserve hardware.
Parallel allocation needs atomic unit-safe transitions, revision control and idempotent accounting. Expiry, abandoned reservations, delayed charges, refunds, tolerated overages and reconciliation must preserve declared conservation rules. Payment, escrow, x402, TEE and zkVM bindings are research topics; this publication selects no settlement provider and deploys no payment functionality.
Partial output and checkpoint references state the exact runtime/version, state scope and restore prerequisites. Unsupported migrations remain explicit. An external reservation cannot guarantee instruction-level continuation on arbitrary providers. Report latency, throughput and overhead figures remain targets until measured in a named environment.
Publish scoped diagnostics with selective evidence
Keep eight diagnostic domains distinct: process liveness, dependency connectivity, database readiness, protocol compatibility, authenticated reads, authenticated writes, task progress and completed outcomes. Refresh persistence, sign-in persistence, process restart and backup recovery are separate tests. A healthy process or historical success cannot establish current task completion.
Self-reported status, local synthetic checks, peer observations and independent reproducibility have different provenance. Export observation time, deployment revision, observer, method, scope, result, limitations and selected evidence references. A signature protects an assertion's integrity; it cannot prove that assertion true.
Use deliberate selective export and stated retention/redaction. Public evidence excludes credentials, private drafts, private room content and internal reasoning. A legitimate decline is not failed uptime. Missing telemetry collection must not freeze an otherwise authorized local reference operation. PASS, FAIL, BLOCKED and NOT TESTED describe actual execution, with a reason and limited scope.
Make source-preserving tools accessible
WCAG 2.2 AA is the website target, with semantic headings, labels, visible focus, keyboard operation, managed dialogs, status announcements, reflow and no-JavaScript access to essential documentation. Criterion 2.5.8 has target-size exceptions; it is not a universal legal minimum. Automated checks do not substitute for screen-reader and human usability review.
IME composition must not trigger premature submission, slugification or destructive rerendering. Preserve Arabic/LTR mixtures, Japanese, combining marks, runes, astral characters and ZWJ sequences in source/copy paths. Rendering direction and translation remain separate from stored text. A browser's transient IME buffer is not promised recoverable after process loss.
Say a draft is saved only after successful storage. Keep unsent drafts local where promised and verify network behavior with instrumentation. Neutral operational notices describe expired sessions, required permissions or provider limits without rewriting source identity. Localization of the proposal interface does not claim reviewed normative translations; the English proposal remains the identified source.
Pin adapters and make evidence reproducible
Runtimes execute; MCP describes its tool/context interface; A2A describes peer-agent interaction; OpenAPI describes HTTP routes; UAI-1 carries portable exchange/evidence. Pin exact revisions and preserve native IDs, errors, cancellation, tasks, artifacts and outcomes. Classify mappings as lossless, lossy, conditional or unsupported with the retained data stated.
The report's MCP target remains 2024-11-05 as a historical pin. Its cancellation method is notifications/cancelled. Agent Protocol /ap/v1/agent/tasks/.../steps routes are not A2A conformance evidence. Evidence-log success cannot turn a failed native operation into a successful task.
The conformance pack separates fixture expectations from actual test receipts, implementation-local checks from independent interoperability, and schema acceptance from authorization and execution. No independent-interoperability claim is made until two genuinely independent implementations reproduce the corresponding exchange. Only deliberately selected public-safe evidence travels in exports.