One Encore application model; one owned stack beneath it. EchoMQ on
Valkey 9 carries the events, the schedules, and the jobs; EchoStore answers the
reads; Postgres keeps the ledger; Graft seals history to Tigris. The whole
system runs live on one laptop — and the same system, unchanged, runs live on Fly.
echdash manages it either way, the tunnel joins the two, and one 14-byte
branded identity threads the whole.
The senior successor to the CAP chapters this course grew from: the theorem is
a menu, and the platform orders from it. The foundation is the course's own manuscript,
Perspectives of Echd on the CAP Theorem. The sibling courses hold the depth:
/bcs · /echomq ·
/redis-patterns.
Vision · real substrate
echd speaks in the present tense over a build ladder. Every module, verb, key, and port named
on this page is real; the composition into one standing platform is the vision the ladder
builds.
One System, Standing · the master frame · hover a switch in the
switchboard below to light its tier
§1
The thesis — four claims
echd.design.md · echd.course.md
Claim one
One live system — on the laptop and on Fly
Everything named here runs: Valkey 9 answers on :6390, the daemon on
:9400, the dashboard on :8891 — one laptop carries the whole
platform. The same system, unchanged, runs in production: echo-valkey and
echo-postgres as private Fly machines on the 6PN mesh, the services beside them.
Local or remote is a deployment coordinate, not an architecture.
echdash manages both through the same pane · E1 → E6 → E7
Claim two
The substrate is opened, not replaced
Encore's app model and its open dev plane are kept: the daemon speaks JSON-RPC over
ws://localhost:9400/__encore to anyone who dials, and status.meta
carries the whole application verbatim. The line is drawn at the closed infrastructure — and
everything below that line is owned.
the open plane is the contract · E1
Claim three
Supersession is honest
Four primitives re-land on owned substrate, each with a citation: PubSub on the stream tier,
cron on the scheduler, task queues on claims and lanes, caches on EchoStore. The fifth is a
declared gap: secrets stay platform-native.
a platform that cannot say not superseded cannot be trusted saying
superseded · E3
Claim four
One identity threads every tier
A brd14 branded id is minted once and gated at every ingress: the ledger books it, the cache
names it, the stream orders by it, the dashboard resolves it. Only identities — and messages
about identities — cross a boundary.
it names state rather than carrying it · E2 → E7
§2
The supersession switchboard
the signature figure · grounding: echd.roadmap.md
Six switches. Hover one to read what replaces the Encore primitive — and watch its
tier light in the master frame above. The sixth switch is the register's credibility anchor.
PubSub → the stream tier. A topic is a retained, replayable log on the bus: XADD appends, consumer groups read with XREADGROUP, acknowledge with XACK, reclaim the dead with XAUTOCLAIM — at-least-once, bounded by trim policy. Any runtime that speaks Valkey is a first-class subscriber; a non-BEAM reader stands in the same consumer group. This is E3.2.
Cron → the scheduler. A schedule is a visibility fence over the schedule set: enqueue_at/enqueue_in score work by its run-at; Repeat registers cron/every cadences, each occurrence a fresh branded mint; the Pump releases due work through the promote verb on the server's clock. This is E3.3.
Task queues → the queue core. Work is claimed, not taken: an atomic claim sets a lease on the server clock with the attempts counter as the fencing token; retry backs off; fair lanes rotate groups with the Metronome — park, don't poll; batches claim in bulk. This is E3.3.
Caches → EchoStore. A declared near-cache: L1 ETS tables over the shared L2 Valkey, values framed version<>value, coherence pushed as a 29-byte message about a name over RESP3 client tracking. This is E4.
The dev dashboard → echdash. The owned surface on :8891: honest status, requests with payloads verbatim, a catalog that renders while the app is down, logs that mark their gaps. Every answer stamped plane + as_of. This is E6.
Secrets → the honest gap. No owned surface supersedes Encore's secrets; they stay platform-native. The nearest owned ground is config distribution — latest-value-per-key reads on the stream tier. The gap is declared, in amber, on purpose: it is what keeps the vision register honest. This is E3.4.
Hover or focus a switch to read it; click to pin. Without scripting, all six read in sequence.
All eight chapter landings are built and served — a card opens its
chapter; the sections below remain the atlas (abstract, schema, modules) for reading the course in
one page. Two pages from the CAP lineage still serve beside the E-arc:
/echd/impossible ·
/echd/best-effort-consistency — their material folds
into E0's and E4/E6's modules as those hubs ship. A module title becomes a link the same way: when
its pages ship, and not before.
The whole platform in one sitting. A theorem opens the course: no unreliable
distributed system holds both safety and liveness — consistency and availability — through a
partition. The platform does not defeat the theorem; it orders from it. Every tier sits at
a chosen point on the trade: the ledger blocks rather than diverges, the cache answers rather
than waits, the dashboard stamps its staleness rather than hiding it. The chapter teaches the
reading protocol, then the theorem as an instrument — safety and liveness, the proof in two
indistinguishable writes, the four coping strategies — and closes by walking the master frame end
to end.
Underneath everything, one daemon. Encore's dev runtime owns the port fan —
:9400 for the dashboard plane, :9500 for databases, :9600
for trace ingest, :9900 for MCP — and speaks an open plane: JSON-RPC 2.0 over
/__encore, one message per frame, results carried as protojson verbatim.
status.meta is the full meta/v1 proto and renders runless from
the daemon's cache. The same daemon carries a closed surface: a hosted SPA, shallow trace
retention, notifications that drop at cap. This chapter opens the substrate, reads it
bare-handed, and draws the line the course builds on: the open plane is kept; the closed
infrastructure is superseded.
E1.1 One Daemon, Many Ports — the-port-fan · one-daemon-law · the-app-model E1.2 The Open Plane — json-rpc-one-frame · status-meta-verbatim · the-push-and-the-poll E1.3 The Closed-Infra Diagnosis — the-closed-spa · app-not-running-diagnosed · shallow-history E1.4 Workshop — Opening the Daemon — dial-the-plane · read-the-catalog-runless · watch-a-trace-land
Fourteen bytes hold the platform together. A branded id is a 3-letter uppercase
namespace over an 11-character Base62 snowflake — time-ordered, coordination-free, mintable on
any node with no registry. The brand is the type: every system gates every ingress on its
namespace, and what crosses a boundary is never an object graph — only identities, and messages
about identities. Property stores keep :private tables exported to nobody; the
EdgeStore law makes a relation a system — rows keyed {subject, object} forward and
reverse, both ends gated, never an embedded id list. The workshop carries the law across a
runtime border: BCS-lite in Go, the id vendored, the vectors re-asserted — the law travels as a
test suite, not a runtime.
E2.1 The Brand Is the Type — brd14-anatomy · gate-every-ingress · mint-once E2.2 Systems Own Their Data — private-ordered-set · exported-to-nobody · messages-about-identities E2.3 The EdgeStore Law — relation-as-a-system · both-ends-gated · forward-and-reverse E2.4 Workshop — BCS-lite as a Contract — vendor-the-id · re-assert-the-vectors · the-law-as-the-suite
The platform's events, schedules, and jobs ride one owned bus. EchoMQ is a
Valkey-native protocol — the braced emq:{q}: keyspace, branded JOB ids,
every Lua key declared, the server's clock wherever a lease is touched, the wire fenced at
echomq:3.0.0 — organized as twelve command families from admission to lifecycle.
Because the protocol is Valkey commands and inline Lua, any runtime that speaks them is a
first-class peer: the polyglot seam is proven by a non-BEAM reader on the same consumer
group. On this bus, Encore's closed primitives are superseded one by one — and one primitive
stays, said in amber: secrets remain platform-native.
Reads are answered from the nearest tier that can tell the truth. EchoStore is a
declared near-cache: the ecc:{table}:{id} keyspace, values framed
version<>value, an L1 of ETS tables over the shared L2 Valkey. The L1 is
:publicon purpose — a hit is a caller-side lookup that never enters the
owner process — and the chapter names the contrast once, precisely: BCS systems keep
:private tables to enforce the gate; the cache publishes its table to serve the read
path. Two disciplines, one primitive, both deliberate. Coherence is a message about a name:
twenty-nine bytes, id:version, pushed over RESP3 client tracking — invalidation
deletes one L1 row, newer-wins decided by mint order. The journal — SQLite, WAL, a transactional
outbox — replays writes the network dropped.
E4.1 The Keyspace and the Frame — ecc-keys · the-framed-value · fetch-and-put E4.2 L1 Public, On Purpose — caller-side-reads · single-flight-fill · two-ets-disciplines E4.3 Coherence, Three Ways — tracking-on-bcast · a-message-about-a-name · newer-wins-and-the-journal E4.4 Workshop — Watch an Invalidation Land — write-through-l2 · the-push-deletes-the-row · the-staleness-window
The system's critical objects refuse to be eventual. The ledger is the
consistency-first persistence layer beneath them: one Repo.transaction — row
locks taken FOR UPDATE, exactly-once enforced by a partial unique index, every
change paired with a signed entry in an append-only ledger under the RVL brand. No
transaction composer, no second idiom — and the worked instance is the consumer's wallet, where
the critical objects happen to be money.
Beneath the ledger, the deep record: Graft, two engines under one law — the native engine on
CubDB's append-only B-tree, the Rust engine on Fjall — streaming sealed segments to Tigris behind
a conditional-create fence, so exactly one writer wins each LSN. Streams fold into the archive
and trim; time travel reads a window by mint instant. The synthesis is the vault: traces
outliving the daemon's reaper under branded TRC keys, bytes verbatim, replayed on an
explicit third clock.
E5.1 The Ledger, One Transaction — one-transaction-no-multi · exactly-once-by-index · the-paired-credit E5.2 Graft, Two Engines — the-append-only-btree · the-rust-backend · snapshots-and-lsn E5.3 The Tigris Horizon — streamer-not-litestream · the-conditional-create-fence · fold-trim-time-travel E5.4 The Vault and the Third Clock (synthesis) — the-harvester-vs-the-reaper · trc-keys-verbatim-bytes · replay-a-third-clock
The platform is visible, and the visibility is honest. echdash — the owned
dashboard on :8891 — replaces the hosted SPA with a surface that tells the truth the
stock page cannot: live status with degraded states rendered rather than masked, requests with
payloads verbatim, a catalog that renders while the app is down, logs that mark their gaps
instead of splicing them. Topology is not a drawing; it is a relation held by a system — a Go
registry of branded names and edge stores under the EdgeStore law, declared graph beside
observed, laid out by a hand-rolled layered SVG. Every response is stamped
plane + as_of. The management plane completes the surface: the panel, the
ech MCP census, sessions in view. Degradation here is a CAP stance: the surface
chooses availability and stamps its staleness.
E6.1 The Owned Dashboard — the-status-truth · requests-verbatim · catalog-and-logs-honest E6.2 Topology as a BCS Edge-Graph — meta-to-edges · declared-and-observed · the-hand-rolled-layout E6.3 The Plane Ladder and the Management Panel — one-interface-per-family · plane-and-as-of · the-mcp-census E6.4 Honest by Construction (synthesis) — degradation-as-a-cap-stance · the-raw-tab-proof · the-build-register
The last chapter leaves the laptop. jonnify-tunnel carries the platform to the
world — a reverse tunnel of yamux streams over one WebSocket, raw-hijacked so SSE and WebSockets
pass transparent, subdomains routed by Host from a ONE-machine registry at
tunnel.jonnify.com; its sessions stand in the management panel. The daemon was
always app-plural: the harvest unifies every app into one topology, and the cross-app
forwards edge — observed, labeled as the heuristic it is — draws the arrow between
apps no per-app dashboard can see. On Fly the production system runs live — the same organs, now
private machines: echo-valkey.internal:6390 and echo-postgres.internal:5432
answer only inside the 6PN mesh, the services deploy beside them — while Tigris holds the sealed
segments. The capstone
replays the master frame with a single branded id traversing tunnel → app → bus
→ memory → record → surface — one identity, many trades, one standing system —
and then opens the doors out.
E7.1 The Tunnel — yamux-over-ws · raw-hijack-transparent · sessions-and-the-management-panel E7.2 The Multi-App Mesh — apps-plural-harvest · the-forwards-edge · one-topology E7.3 The Fly Edge — machines-and-private-apps · tigris-sealed-segments · user-and-hierarchy-partitioning E7.4 One System, Flying (capstone) — one-id-end-to-end · the-master-frame-replayed · the-doors-out