Lolly Beta
Launch App
WelcomeQuickstartFor CreatorsFor BuildersFor OperatorsTrust
Document model draft
ConstitutionRecords and identitySource rows, payloads and patchesOperations and outcomesValues, expressions, code and timeEvaluation and receiptsConstraints, authority and local choiceConformance and fidelityCapabilities, trust and extensionsPackaging, identity and migrationProof casesStatus and open points
On this page
GitHub
Launch App

Status and open points

This chapter is a draft for review, dated 2026-09-24.

This is that status chapter. It records what is decided, what the final review corrected, what is still Andy's to answer, what is not built and the order the work starts in. The other eleven chapters state the model: constitution, records, source rows and patches, operations, values and time, evaluation, policy, conformance, extensions, packaging and proof cases.

What this draft is

The specification is an integration document. It names four records, gives every contract already in the tree a role in one of them and adds only what is missing. A chapter must name an existing contract rather than fork it (R4). A chapter that describes something not yet built must state that in the same sentence (plans/276-lolly-document-model.md status line, plans/276-execution.md section 3).

No shared type is frozen before the counterexample fixtures pass (plan section 18). Nothing is added to packages/core or schemas/ in this wave, and every proposed record appears as an indented draft shape instead (plans/276-execution.md section 3). A draft shape must never be read as a type, and no reader may treat a field name in one as stable.

This draft makes no conformance claim and states no threshold (C8), and it sets no latency target because the current evidence justifies none (plan section 18, review gate 5). It adds no reproducibility promise beyond the ones docs/determinism.md already makes. The probe numbers appear in one chapter, conformance, as evidence that a single whole-image number cannot separate a lost caption from a half-pixel shift (C8).

The notice at the head of every chapter must stay until this chapter records that people have read the draft (plans/276-execution.md section 5). That review has not happened, so this chapter records no reading. The chapters that most need it are the constitution, the source rows and patches, the policy and the conformance chapters, because each fixes semantics the later contracts are built on (plans/276-execution.md section 5).

Confirmed decisions

These come from Andy's recorded direction. They are settled and must not be reopened by a chapter (D1 to D13).

IDDecisionChapter that carries it
D1The document represents a complete tool: its interface, behaviour, dependencies, permitted changes and operations.constitution
D2The pilots are Design, Chart and Agenda: Design spans print, raster and motion, Chart tests nesting and typed data, Agenda spans interactive web, slides and motion.proof cases
D3A claimed renderer suite must pass reference-render fixtures, because a valid JSON tree is not evidence of a render.conformance
D4Typed declarative behaviour is preferred, with an imperative escape hatch that carries its own execution and trust contract.values and time
D5Spatial and fabricated outputs are extensibility examples, never priorities or gates for 0.1.extensions
D6Constraints may travel with a tool and may also be supplied by Lolly Work, and the two are modelled separately.policy
D7Outside a governed instance the local person may accept or reject a constraint, and the rejection has an explicit representation.policy
D8Still-image fidelity allows a very low pixel difference, difficult to notice without close inspection.conformance
D9Motion must match time and look similar at corresponding percentage points, with extra coverage around transitions.conformance
D10Independent authors may publish feature namespaces and conformance fixtures.extensions
D11Some operations are non-recordable or non-replayable, and a utility may act on files without rendering anything.operations
D12Reference and acceptance authority is the Lolly Work administrator for a governed brand and the local person otherwise.policy
D13The model reads well to the Kubernetes, Penpot and Rive communities in their own idioms, as direction and not as instruction.records

D8 is restated by the comparator probe, not reopened. Andy's intent is no visible loss under close inspection, and the conformance chapter tests that intent with three declared checks instead of one number (D8, R9).

Resolutions adopted from evidence

Each resolution is adopted unless Andy objects (R1 to R15). A chapter must cite the resolution id, or a repository path, beside the rule it states (plans/276-execution.md section 3).

IDResolutionChapter
R1The canonical source is flat rows keyed by permanent id, one owner pointer and one order key, with structured values in typed payload records and patches carrying a base revision.source rows and patches
R2Declarative logic is a closed JSON expression tree with a static cost estimate refused at authoring time and a runtime budget per evaluation, and showIf stays as its v0 subset.values and time
R3Imperative logic stays in hooks, specified as eight protocol contracts with an authored effect envelope, per-attempt grants and an execution class that enforces them.values and time
R4The four records map onto existing persisted forms, and the compile result is transient and never persisted as a document.records
R5One outcome vocabulary with three separate parts: a typed result, a record of committed artifacts and a termination, with review states on a run lifecycle beside it.operations
R6Effective policy resolves authority first, then composes attributed layers, and a local waiver deactivates a named waivable creative rule only in unmanaged execution.policy
R7A governed client that loses its connection keeps enforcing the policy it holds, and refresh due, update known, policy validity and attestation stay four separate facts.policy
R8Measured conformance is a suite report with core and extended features, and contextual acceptance is a separate record naming the authority and each exception.conformance
R9The still-image comparator is three checks declared per fixture: a whole-image fuzz band, region-scoped measures and semantic checks on the artifact.conformance
R10Extensions live in a namespaced map with used and required lists, a version per extension and a complete dependency scope a host without it must protect.extensions
R11Every record carries its own version, readers upgrade on read, a container carries a minimum reader and one internal evaluator normalises the four gates.packaging
R12Native 0.1 is one still-image suite, still-2d/1, over PNG, SVG and PDF, with motion staged after the timeline contract and interactive output kept as an adapter.conformance
R13Unpack, Prepare, Batch, Verify and the Rebrand review get operation adapters with typed inputs and outcomes, and none of them needs a canvas.operations
R14A chart inside Design is a layer kind whose row references a chart payload record by id, lowered by pure engine code and replaced as one atomic value.source rows and patches
R15An evaluation receipt records the definition and instance revisions, the resolved fonts by digest, the shaping engine, the emoji set, the clocks, the effective policy version and the execution class.evaluation

Corrections from the final review

Codex reviewed the finalised plan on 2026-09-24. Every finding was checked against the code before it changed the plan, and all of them held. A chapter must not restate a claim these corrections removed (C1 to C9); the Change column of plan section 0.1 records what each one removed.

IDCorrectionVerified against
C1Typed values cannot travel in the scalar collaboration rows, so typed payload storage is specified apart from flat ownership.packages/core/src/canvas-op-v1.ts, schemas/canvas-op.schema.json
C2Two valid reparents merge into an ownership cycle in either delivery order, and a revision precondition alone cannot prevent it.plans/276-document-model-evidence/crdt-cycle-probe.mjs over packages/core/src/canvas-op-v1.ts, and services/mcp/src/tools.ts for the stateless edit path
C3The single-file rule does not generalise, because an inspection succeeds with no artifact and a cancelled batch keeps the files it wrote.packages/core/src/file-operation-v1.ts, packages/node-shell/src/rebrand-run-manifest.ts
C4Placing a local decision below the authored required rules makes a local rejection ineffective, so authority resolves first.Read of the authority rule in plan section 10.1
C5Offline answers unreachable rather than stale, cached material keeps working, Leave removes rather than forks and "Make an editable copy" is a separate action.shells/web/src/lib/design-system/hosted.ts, shells/web/src/lib/instance-leave.ts
C6A generated effect inventory is a regular-expression scan that an alias evades, so it is lint and never authority.scripts/tool-requires.ts, engine/src/runtime.ts
C7Preserving unknown fields at parse time is not a round trip, because the writer rebuilds its manifest from typed input on every save.shells/web/src/lib/lolly-pack.ts
C8The probe supports the direction and settles no method, and an incomplete comparison must never pass.engine/src/compare.ts
C9The tool count is two numbers, not one: 81 raw directories with 79 distinct ids, and the tools a content profile resolves, which is 67 for lolly-start and 77 for suse. The evidence scripts were also made rerunnable from the repository, and the retained comparator fixture was regenerated from the measured transformation.packages/node-shell/src/content-roots.ts

Five compatibility gates came from the same review and are stated in the chapters they affect. The public requires field keeps its meaning. Diff gains a source-aware path. An unmet extension is refused at the operation boundary. Aggregate work is bounded, and not only expression size. Incremental edits are measured on a device before any responsiveness claim.

Open questions

Six questions are Andy's. Each has a default so that drafting proceeds without an answer (plan section 16), and a chapter that depends on one states the question and its default in its Open points (plans/276-execution.md section 1A).

IDQuestionDefaultEvidence that would change it
Q1The first editable interchange routes per pilot.The four routes and three edits in the conformance chapter.A customer route that outranks them.
Q2The granularity and persistence of a local rejection.Per rule, instance-scoped, recorded on the session record against a fingerprint of the facts. A derived tool revision is a Design tool export and is not part of 0.1 (R6).A need to share a rejected state as a reusable tool.
Q3What freshness a governed-claim export needs, and who states it.Freshness is a policy rule the instance issues, with a validity interval and a stated behaviour when it cannot be established. With no such rule the held policy is enforced, and the receipt says which policy version was evaluated and when it was last attested. Leave and "Make an editable copy" keep their current meanings (R7).An organisation that needs a hard deadline, or a fully offline site.
Q4What non-recordable means for a local utility and for a live-input tool.Utility: capture off, retention none, replay semantic from pinned inputs. Live input: capture unsupported unless the person turns it on, retention session, replay none.A regulated workflow that needs durable receipts for utilities.
Q5Who may publish a suite under the lolly namespace, and how a local or Work suite is named.Suites under lolly/ are published from this repository's continuous integration only, instances publish under work:<instance>/, people publish under local/* and an acceptance record always states the suite it judged (R8).A partner programme that needs a shared namespace.
Q6Whether the specification is public from the first draft.Yes, because docs/constraints.md, docs/determinism.md and docs/reproducibility.md already make public promises this model keeps.A reason to keep the drafts private until the pilots pass.

What is not built

Nothing in this specification is implemented. The list below is what a reader must not assume exists.

The order the work starts in

The work starts in this order, each step small.

  1. The vocabulary and the record map as public prose, with authority, authored identity, typed payload storage, operation results and committed-effect semantics worked as concrete examples (R4). In progress: this specification and the summary page docs/document-model.md are that step, pending the read described above.
  2. The counterexamples of the proof cases chapter as contract fixtures, covering the scalar row boundary, the concurrent cycle, partial cancellation, an effective local waiver and a save-and-restart preservation case (C1, C2, C3, C4, C7).
  3. Only the smallest additive types and adapters those fixtures justify, starting with an outcome and a finding type mapped onto the three existing vocabularies (R5).
  4. Package preservation and old-client gates, before any new native document is emitted (R10, R11).
  5. The three-check comparator calibrated on positive and negative cases, before any suite pass is advertised (R9).
  6. The chart layer kind and the five route adapters incrementally, with existing tools and local offline operation retained throughout (R13, R14).

Two rules bind that order. No shared type may be frozen before the fixtures in step 2 pass (C1, C2, C3, C4, C7). The patch envelope and the source-aware diff land only after the semantics in source rows and patches and in packaging are settled, never before (plan section 18, R1). This draft states them as draft shapes and builds neither.

Completion criteria for the planning phase

CriterionState
Inventory and vocabulary checked against the working treeMet, first pass; the per-format capability matrix is outstanding
Confirmed decisions retained without reopening themMet
Remaining product choices recorded with defaults, including staged scopeMet
Pilot and utility examples expressed with expected outcomesMet, as the proof cases chapter
Effective governance, local rejection and acceptance claims distinguishedMet
Fidelity, timing and editable preservation each have a testable contractMet, one of them supported by a probe
Package and identity compatibility and legacy execution classifications agreedMet
The counterexamples pass as contract fixtures before any shared type is frozenOutstanding
Andy's answers to Q1 to Q6, or acceptance of the defaultsOutstanding
Specification drafting startedIn progress: this draft

Change log

DateChange
2026-09-24Draft for review. The twelve chapters were written from the plan 276 consolidation after its final review, with D1 to D13 confirmed, R1 to R15 adopted from evidence, C1 to C9 corrected and Q1 to Q6 recorded with their defaults. No type is frozen and no conformance claim is made.
2026-09-26Constitution. The thirteen invariants gain four reading groups with their numbers unchanged, and a table of where each one holds today, what is not met yet and which proof cases test it; the table finds no case that tests invariant 11 on its own and only case 7 behind invariant 5. The no-cloud limit now states R7 as a requirement and records that the web shell fails closed after 24 hours offline instead. The limits section says which two promises its first two items bound. Affects R7.
2026-09-26Proof cases. Cases 24 and 25 are added for the two gaps the constitution's table found: one chart's accessibility metadata checked in each of four outputs, and a local utility that keeps no record of its run. The table now maps both, and the count of cases is 25. Q4 stays open; case 25 tests its default for a utility. Affects R5 and R15.

A change to any chapter must add a row here with its date and what changed, so that the chapter sources in docs/spec/document-model/ carry one history (plans/276-execution.md section 1A). A row lists the resolution ids the change affects, which is this specification's own convention.

Open points

The other five questions are recorded in the open questions table above with their defaults, and each is carried, unanswered, by the chapter it touches: Q1 and Q5 in conformance, Q2 and Q3 in policy, Q4 in operations.

Precedents