papers/hanzo-temporal-assertion-graph/sections/04-schema.tex

\section{Schema as assertions}
\label{sec:schema}

\shipped{} The store has no schema table. Four relations and one entity prefix
make up the schema, and each declaration is an assertion with a source,
evidence, a filing identity and a knowable instant:

\begin{center}
\small
\begin{tabular}{@{}ll@{}}
\toprule
assertion & meaning \\
\midrule
(\texttt{acme/person/z}, \texttt{type}, \texttt{person}) & the entity's type \\
(\texttt{relation:works\_at}, \texttt{domain}, \texttt{person}) & what \texttt{works\_at} may be said of \\
(\texttt{relation:works\_at}, \texttt{range}, \texttt{company}) & what \texttt{works\_at} may point at \\
(\texttt{relation:works\_at}, \texttt{cardinality}, \texttt{many}) & how many values it holds at once \\
\bottomrule
\end{tabular}
\end{center}

Each declaration pair holds one value and is resolved by the rule of
\S\ref{sec:model}. What the schema was on a given day is therefore a read with
that day as $\tk$, and a change to a declaration has a filer and evidence like
any other row.

\subsection{When a declaration binds}

A write is checked against the declarations as known at the checked assertion's
own knowable instant, and at a valid instant after every statement begins. A
declaration is a statement about the organization's vocabulary, not about when
something was so in the world, so a fact about 1995 filed today is checked
against today's vocabulary rather than against a 1995 in which the type may not
have existed. A re-declaration binds from the instant it becomes knowable and
does not apply to rows already admitted, which stay as they were admitted.

A batch is checked with the declarations it states itself included, so a
document that types an entity and relates it in one request conforms in that
request. The check costs one indexed read per distinct (entity, relation) pair
the batch needs --- two per relation used, one per entity whose type is asked
--- and never a scan.

\subsection{What is checked, and what is not}

\begin{itemize}[leftmargin=*,itemsep=2pt]
\item A relation with no domain or range in force is open, which is how the
  store behaved before declarations existed. Declaring the empty string reopens
  a relation.
\item When a domain is in force, the entity's type in force must equal it; when
  a range is in force, the value must name an entity ($n = 1$) whose type in
  force equals it.
\item One type is in force per entity and one domain and one range per relation,
  because each is a one-valued pair. A relation that must admit two types admits
  the type they share.
\item The schema relations themselves are not checked, since a schema checked
  against itself has no fixed point, and neither is a retraction: it states no
  value, and a claim under a declared relation must remain withdrawable.
\item A refused member is reported with its reason, and the rest of the batch is
  recorded. A batch with no admitted member is refused whole.
\end{itemize}

Declared cardinality is read at the read's $\tk$, so declaring a relation
\texttt{one} after the fact changes answers as known after the declaration and
leaves answers as known before it as they were (Proposition~\ref{prop:stable}).

\subsection{Decisions as a convention}

The package documents a convention for recording decisions as entities: type
\texttt{decision}; properties \texttt{scenario}, \texttt{reasoning},
\texttt{outcome} and \texttt{confidence}; edges \texttt{decided\_by},
\texttt{caused\_by}, \texttt{influenced} and \texttt{precedent}. Nothing
enforces it unless the organization declares the domains and ranges, and
nothing stores a decision anywhere else. A reversal is a later
\texttt{outcome}; a causal chain is a \op{path} restricted to the relations the
organization uses for cause (\S\ref{sec:queries}).