| Filename | Latest commit message | Latest commit date |
|---|---|---|
`cargo audit` over all 47 workspace lockfiles reported 142 vulnerability instances. The dangerous ones were not exotic: the S2 executor was pinned to wasmtime 43.0.2, which carries eight advisories including RUSTSEC-2026-0379 (9.9), -0327 (9.3) and -0269 (8.8). That crate is the one component whose whole job is to execute untrusted guest code, so a sandbox-escape class defect there is not a dependency hygiene matter — it is the confinement claim itself. wasmtime moves 43.0.2 -> 49.0.4, the single version every one of the eight advisories names as patched (50.0.0 exists but no advisory lists it as fixed, so it is not yet the safe choice). WASMTIME_VERSION is updated with it: the constant is attested into the mechanism commitment under SPEC §7.9, so leaving it stale would attest confinement to a runtime that did not run. The crate's own `wasmtime_version_matches_the_lockfile` test enforces that pairing. The rest are semver-compatible bumps carrying no API change: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots/webpki-root-certs 1.0.10, quinn-proto 0.11.18 (RUSTSEC-2026-0340/-0343, both 7.5), tokio 1.54.1, crossbeam-epoch 0.9.20, rtrb 0.3.5. Not fixed here, and deliberately so rather than silently: zip (>=9.0.0), hpke-rs (>=0.6.0), quick-xml (>=0.41.0) and libcrux-kem (>=0.0.10) are all semver-major moves, three of them transitive, so each needs its dependent assessed on its own. rsa RUSTSEC-2023-0071 has no fixed version at all. Co-Authored-By: Claude Opus 5 <[email protected]> |
||
| .. | ||
| conformance | ||
| map-rs | ||
| spec | ||
| vocab | ||
| CHANGELOG.md | ||
| CONTRIBUTING.md | ||
| LICENSE | ||
| LICENSE-SPEC | ||
| README.md | ||
| ROADMAP.md | ||
| SPEC.md | ||
Map
A carrier for place. Range-requestable, signed, energy-attributed, owned by no one.
Map is the geospatial cargo class of the Transaction Science substrate. Where Smart Byte carries value, EOC carries compute, and Joule Code carries coding work, Map carries place — a region of the world at a position, an altitude, an instant, and a fidelity — as a content-addressed, signed tile with its energy cost intrinsic.
A tile is not an image and not an API response. It is a vesicle carrying exactly five things: identity (the BLAKE3 content address of its canonical serialization), a 4D cell key (where, how high, when, and how detailed), provenance (the signed tileset root it was published under, and the author key that signed it), cargo (the payload — terrain, a scalar/vector field, vector features, or 3D Gaussian splats), and a two-part joule cost (measured + estimated, with an honest provenance tag on every reading). Render requests resolve through an explicit energy-tiered fidelity cascade — cache, then a terrain base floor, then fields, then features, then photoreal splats — and return the highest tier present for the cell at or below the requested fidelity, falling back to the floor, which is defined everywhere. Graceful fallback is a property of the standard, not of an implementation.
The substrate is intentionally ownerless: no protocol-level token, permissive licensing on the spec text and reference code, and conformance vectors so any implementer can verify canonicity without a trust relationship with the authors. A conforming reader resolves a cell, verifies it against a signed manifest, renders it, and meters it — against static storage, with no contact with any single company's servers as a condition of operation. Transaction Science is one steward: it publishes the spec, ships a reference implementation, and operates commercial services (capture pipelines, hosted tilesets, a registry) around the substrate — not its proprietor.
The doctrine
The map is a file, not a service. The durable layer of a mapping platform is not tile serving or per-load billing — both are commoditized and both expire. It is the published, signed, dated file that renders forever from dumb storage, measured in joules per resolved cell.
Three consequences, normative in SPEC.md:
- The cascade. Every render request resolves through
F0:Cache → F1:Base → F2:Field → F3:Feature → F4:Photorealand returns the highest tier ≤ the requested fidelity that holds data for the cell, falling back to the F1 base floor — which is defined everywhere on the datum, so a covered region never fails to render. - The receipt. Every resolve/decode reports a two-part energy cost in microjoules —
measured + estimated— with aProvenancetag (HwShunt | ModelBased | Estimator), sealed as a JCR-1 envelope (canonical det-CBOR + COSE_Sign1/EdDSA — the family's shared signed-receipt format). - No capture. No protocol token. A tileset is a single range-requestable file on dumb storage; reading it requires the bytes and a public key, nothing more. Revisions (a new forecast hour, a new AIRAC cycle) are signed, dated transitions over the manifest root — never in-place mutations.
The 4D cell key
Map's one genuinely new primitive is the address. A tile is keyed by four orthogonal axes — S2 cell (horizontal, Hilbert-ordered), altitude band (signed; band 0 = datum), time bucket (half-open TAI interval; bucket 0 = atemporal), and within-tier LOD. The horizontal axis is what makes a tileset range-requestable; the temporal axis is first-class, which is exactly what 3D Tiles lacks and what weather and flight navigation require. A "map of Tuesday at 14:00Z" is a different, equally addressable region from the same place on Wednesday.
Contents
SPEC.md— the normative specification (RFC 2119). The tile cargo, the 4D cell key, canonical serialization, the tileset + manifest, the cascade, and the receipt.spec/— sub-specifications: the cell key, the tileset container, the manifest + revision chain, and the receipt format.vocab/— the controlled vocabulary and stable IRIs (LEXICON.md).conformance/— signed wire vectors. An implementation is conformant if it round-trips these.map-rs/— the Rust reference library: the protocol crates (schema, cascade, receipt, conformance) plus the ported substrate (index, tiles, orbital, route). This is the lean library a third party implements against — not a renderer.
Reference implementation and consumers
The Rust reference lives in map-rs/. The demonstrator pillar is maps.transaction.science — a WebGPU globe (Rust → WASM + native, on wgpu) that consumes map-rs: a satellite/terrain/weather basemap with live orbital, ADS-B, and AIS entity layers and an AI-native query surface. The demonstrator is a demonstration of the standard, the way the pillars demonstrate the other standards — not the product.
Status
v0.1.0 draft. Specification core published (SPEC.md + spec/). Reference workspace map-rs/: map-schema (the 4D cell key, tile, tileset directory, manifest + revision, content addressing), map-cascade (the F0–F4 fidelity resolver with guaranteed F1 fallback), map-receipt (JCR-1 sealing, interoperable with the family's verifiers), and the map-conformance harness. The substrate crates (map-index from joule-s2 + joule-spatial3d, map-tiles from joule-tiles, map-orbital from joule-orbital, map-route from joule-maps) are being ported from the existing engine; see ROADMAP.md. Not certified for primary navigation (see SPEC §9).
Licence
- Reference code (
map-rs/): Apache-2.0 — seeLICENSE. - Specification text (
SPEC.md,spec/,vocab/): CC-BY-4.0 — seeLICENSE-SPEC.