The KTP mechanism
A fact from another system arrives as a sensor reading: it can narrow E, never raise A. KTP-SENSORS treats every outside feed as a sensor: it reports a condition, it carries an envelope, and the most it can do is lower what the environment will hold. It can never add authority. The semantic join is how six operating parties share one meaning for the things they all touch, so that a fact observed by one of them can count for the others, under that rule.
The working form, from the workbook
Six seats (Cyber Security, IT Operations, Application Operations, Governance, Regulatory, Compliance), each with what it observes and the join objects it shares. Seven context domains. Five observation classes, each stating the envelope it needs before a slot may constrain. Seven extensibility rules, among them “envelope or it cannot constrain”, “unknown is not zero” and “feeds are sensors”. Three clocks that never collapse into one.
Where it is written down
The five observation classes · how a slot is allowed to count
DIR
Direct
One instrument samples a quantity
envelope Location/modality; calibration. No fake population.
ENU
Enumerated
Computed over a counted set inside a boundary
envelope Membership rule + accumulation window. Empty set = unknown, not zero.
ADJ
Adjudicated
Exists because an authority recorded it
envelope Issuing party + criteria version. No record = unknown, not zero. Deployment must not be its own adjudicator.
PUB
Published
A third party's number, read
envelope Publisher + series + vintage + publication lag. Do not restate as ours.
DER
Derived state
Read from a calendar, config, or table
envelope As-of timestamp + validity horizon replace an observation window.
Without its envelope a slot cannot constrain anything: a reading with no as-of, no modality and no boundary is a number, not evidence. In KTP's terms, a reading can narrow E; it never raises A. Acequia, Inc. is an invented organization. These pages present a working design, not deployment results; its contracted stages and change freezes are illustrative. The sections below mirror the Governed Autonomy workbook (v0.50): its columns, rules, invariants and catalogs, as written, with the worked example's organization named as it is there. The deployment's own rows, parties, contract identifiers and configuration stay with the deployment; where a table's rows stay, its columns are shown.
On this page 11 sections · 51 rows · about 7 min to read · from tabs Semantic join, Physical & public safety, Media signal overlay
01 Operating parties — six-way semantic join (extensible) 6 rows 02 Context catalogue — seven extensible domains 7 rows 03 Observation classes — how a slot is allowed to count 5 rows 04 Extensibility — add is cheap; rename is expensive; unknown is not zero 7 rows 05 Three clocks — joint maturity, platform train, and mission horizon 3 rows 06 Physical and public-safety object classes 4 rows 07 World occupancy — envelope required before any row may constrain (states 2 and 4) 5 rows 08 Non-claims — observe is not control; camera count is not safety 4 rows 09 Media signal domains and observability modes 3 rows 10 Process-spine overlay — same states 0–7; PQC is not ARQ 3 rows 11 Non-claims — observe is not operate; stubs are not coverage 4 rows 01 2. Operating parties — six-way semantic join (extensible) workbook tab 06 · Semantic join The six seats. A party is not a seat: the same organization can occupy more than one, and a seat is never a seventh column.
¶ Cyber Security
SOC / CSIRT / TechnologyTOC security lane
What they observe Alerts, detections, findings, investigations, threat intelligence, identity risk
Join objects (shared IDs) host, identity, finding, case, detection, Acequia, queue, playbook step
Primary capabilities analyst queue; triage agent; detection authoring; SIEM platform; UEBA ¶ IT Operations
NOC / NetOps / venue technology (VTM)
What they observe Network health, infrastructure metrics, wireless, WAN/LAN, routing, device syslog, service monitoring KPIs
Join objects (shared IDs) service, venue, device, interface, dependency, SLO, maintenance window, ITSM infra incident
Primary capabilities Service analytics; Telemetry analytics; Path ana [incomplete in the source workbook; completion pending a workbook revision] ¶ Application Operations
App SRE / IMP application owners / APM
What they observe Service performance, traces, errors, releases, journey health, dependency map
Join objects (shared IDs) application, journey, SLO, trace, release, BIA impact, business dependency
Primary capabilities Service analytics; Telemetry analytics; Exposure ¶ Governance
Cyber Duty Manager; program PMO; playbook and agent owners
What they observe Operating policy, authority matrix, MVG, purpose/scope, promotion
Join objects (shared IDs) purpose, scope, action class, promotion stage, owner, expiry, revoke
Primary capabilities procedure agent; Activity logs; Agentic Workflow Build [incomplete in the source workbook; completion pending a workbook revision] ¶ Regulatory
Acequia policy; Legal; data protection office
What they observe the mission policy, privacy law, retention, cross-border rules, takedown authority
Join objects (shared IDs) legal basis, retention class, jurisdiction, publisher consent, political-speech adjudicated (ADJ
Primary capabilities Activity logs; Compliance registry (implements-c [incomplete in the source workbook; completion pending a workbook revision] ¶ Compliance
GRC / audit / control owners
What they observe Control frameworks, audit evidence, control effectiveness, external attestations
Join objects (shared IDs) control ID, framework mapping, evidence row, gap, remediation owner
Primary capabilities Compliance registry; Detection links; detection authoring KPIs 02 6. Context catalogue — seven extensible domains workbook tab 06 · Semantic join ¶ world
Up
the mission meaning the mission environment
V2 Declare domain. Populate schedule. Stub weather, traffic, safety.
Later without a new version weather, traffic, emergency, infrastructure, geophysical — add without a new version ¶ time
Up / lateral
the mission meaning Clocks and windows
V2 Populate schedule as-of + validity horizon. Device time stays a contract requirement.
Later without a new version lease / consent expiry at V3; forecasts stay observations about forecasts, not facts ¶ information
Lateral
the mission meaning Information environment
V2 Slot only. DISP/GTI already feed TI; do not rebuild as a new ontology.
Later without a new version narrative / brand later (037); never covert inference of private mental state ¶ body
Down
the mission meaning Substrate / infrastructure
V2 Basics: host and endpoint as entities. Not a new CMDB.
Later without a new version power, thermal, compute later if IMP needs them ¶ relational
Lateral
the mission meaning Authority and obligations
V2 Basics: who may consent, who may declare, unknown is not consent.
Later without a new version topology and trust-flow statistics later ¶ soul
Down
the mission meaning Agent / session character
V2 Declare the domain. Do not populate in V2.
Later without a new version V3 session record: purpose, lineage, constraint adherence ¶ meta
Down
the mission meaning Evidence fitness
V2 Basics: freshness, sample count, unavailable vs empty.
Later without a new version coverage, staleness policy, tamper / disagreement in later waves 03 7. Observation classes — how a slot is allowed to count workbook tab 06 · Semantic join How a slot is allowed to count. The crosswalk to OTCS-0020's classes is on the knowledge-graph page.
¶ DIR
One instrument samples a quantity
Envelope required Location/modality; calibration. No fake population. ¶ ENU
Computed over a counted set inside a boundary
Envelope required Membership rule + accumulation window. Empty set = unknown, not zero. ¶ ADJ
Exists because an authority recorded it
Envelope required Issuing party + criteria version. No record = unknown, not zero. Deployment must not be its own adjudicator. ¶ PUB
A third party's number, read
Envelope required Publisher + series + vintage + publication lag. Do not restate as ours. ¶ DER
Read from a calendar, config, or table
Envelope required As-of timestamp + validity horizon replace an observation window. 04 9. Extensibility — add is cheap; rename is expensive; unknown is not zero workbook tab 06 · Semantic join The rules that keep the join cheap to grow and expensive to break.
¶ Add is cheap
A new context object may be declared without opening a version. Populate only when envelope
¶ Rename is expensive
Changing or removing an object ID is a contract change. Do not silently alias.
¶ Envelope or it cannot constrain
Subject, population or membership, and window (or as-of + validity for derived state (DER
¶ Unknown is not zero
Unavailable, empty denominator, or missing record reports unknown. Unknown MUST NOT authorize and MUST NOT score as no risk.
¶ Evidence, never verdict
Slots measure freshness, divergence, and provenance. Verdicts stay with a named authority (adjudicated (ADJ
¶ Risk domain
Every context object declares the KTP risk domain it is computed in: node, neighborhood, or zone (KTP-SENSORS
¶ Feeds are sensors
A context object produced by an observe-type work type KTP-SENSORS verifier executor
05 10. Three clocks — joint maturity, platform train, and mission horizon workbook tab 06 · Semantic join Joint maturity, the platform train, and the mission horizon are versioned separately. A release moves one clock only.
¶ Joint operating maturity
V1 Baseline → V2 Bridge → V3 Agentic → V4 / Horizon
Rule V5 is not used. Same case spine. A new Data Analytics Provider release does not open a joint version. ¶ Platform train
SIEM platform train, its next train, later platform trains; platform runtime; the common data model aligned to SIEM platform
Rule Versioned as join objects with as-of and validity horizon. Adding a release is cheap. Renaming a capability ID is expensive. ¶ mission horizon
Acequia, the next peak operating window, the peak operating window after it
Rule The platform will ship many platform trains across the mission. The join is how those trains attach without a re-platform. 06 Physical and public-safety object classes workbook tab 14 · Physical & public safety ¶ Camera / PACS / badge telemetry
Not a physical-safety declaration and not a verdict
Observation class DIR ENU
Join treatment Evidence on the ITO + Cyber Security entity graph ¶ Physical safety / evacuation declaration
Not a camera count, occupancy KPI, or crowd-density tile
Observation class ADJ
Join treatment Adjudicated declaration on the shared case ¶ Public-safety radio / CAD / public-safety broadband network
Not dispatch, radio control, or a parallel SOC
Observation class Observe-only (ENU / PUB
Join treatment Consume signals when an envelope ¶ national-security event designation / CUI / law enforcement legal request
Not machine authority and not a seventh RELATIONSHIP_PARTY_COLS code
Observation class ADJ
Join treatment Regulatory ADJ object on the same case 07 2. World occupancy — envelope required before any row may constrain (states 2 and 4) workbook tab 14 · Physical & public safety ¶ mission schedule
DER
Occupancy Populate V2
Envelope As-of + validity horizon; venue membership
Process states 2, 4
Constraint rule May constrain when the envelope ¶ Weather
PUB
Occupancy Stub — do not populate
Envelope Publisher + window required before constraint
Process states 2, 4
Constraint rule Empty is unknown, not no-risk ¶ Traffic
ENU
Occupancy Stub — do not populate
Envelope Boundary + window required before constraint
Process states 2, 4
Constraint rule Empty is unknown, not no-risk ¶ Physical safety
ADJ
Occupancy Stub — do not populate
Envelope MOC declaration + window required before constraint
Process states 2, 4
Constraint rule Never infer from camera, badge, or PACS KPI ¶ Emergency slot
ADJ / ENU as declared
Occupancy Stub — do not populate
Envelope Named authority + window required before constraint
Process states 2, 4
Constraint rule Envelope required before any row may constrain 08 6. Non-claims — observe is not control; camera count is not safety workbook tab 14 · Physical & public safety ¶ Observe public-safety networks, do not control them
CAD, public-safety broadband network, or public-safety radio ingest as dispatch or radio control.
Why this boundary exists Those signals may narrow E_trust ¶ Camera count is not a safety declaration
That camera, badge, or PACS telemetry equals physical safety.
Why this boundary exists Those feeds are DIR ENU ADJ ¶ national-security event designation is not machine authority
That national-security event designation or CUI status widens bounded_execute or creates a seventh party.
Why this boundary exists national-security event designation is an ADJ legal/regulatory overlay on the existing six-party join. ¶ CAD ingest is not dispatch control
That observing CAD or 911/PSAP telemetry authorizes dispatch or a parallel SOC.
Why this boundary exists Observe-only. Envelope required before the row may constrain. 09 Media signal domains and observability modes workbook tab 15 · Media signal overlay ¶ venue signal transport
Venue / FOP Data, Intercom, Video, Audio transport
observabilityMode operate
What it is not Media Provider contribution path; in-venue content distribution displays; competing venue signal transport products ¶ in-venue content distribution
In-venue host-content distribution to displays and stakeholder positions
observabilityMode operate
What it is not Media Provider central media hub-to-MRH distribution; venue signal transport FOP transport ¶ Media Provider estate
Production unit → BroadcastTOC → contribution → central media hub/CDU → MRH
observabilityMode observeAtInterface / consumeOnly
What it is not Acequia venue signal transport/in-venue content distribution; security control of media essence 10 5. Process-spine overlay — same states 0–7; PQC is not ARQ workbook tab 15 · Media signal overlay ¶ 2 — Declare & classify
Unknown CompetitionSession or ProtectionPair state is declared unknown; it does not authorize.
Ceiling Fail closed above recommend ¶ 4 — Coordinate
Acequia/Media Provider seam is a handoff of descriptors, not a merge of estates.
Ceiling HANDED_OFF_TO / CROSSES_BOUNDARY ¶ 5 — Verify (ARQ)
PQC is not ARQ. Independent service/path evidence still verifies recovery.
Ceiling Acting is not verifying 11 8. Non-claims — observe is not operate; stubs are not coverage workbook tab 15 · Media signal overlay ¶ Broadcast is not a seventh operating party
That an L2 workstream adds a RELATIONSHIP_PARTY_COLS code
Why this boundary exists Six parties remain; Broadcast participates through existing ITO/Cyber seats ¶ Observe Media Provider; do not operate the media plane
That ingesting feed-state metadata authorizes reroute, take, or essence capture
Why this boundary exists observabilityMode observeAtInterface/consumeOnly; descriptors only ¶ External transport is not Acequia architecture
That a later host or a prior host ST 2110/NMOS facts are Acequia deployment facts
Why this boundary exists Tag as external precedent ¶ Stubs are not coverage
That eleven signal-family rows are Framework-registry or Detection-links coverage
Why this boundary exists Registry arithmetic stays 2,110; no Acequia-SIGNAL promotion 
