Event Schema Registry

Every event conforms to a versioned, registered schema so producers and consumers evolve independently without silent corruption.

Contract-first events

No event enters the backbone without a registered schema. A central registry holds the schema for every topic, assigns it a version and an ID, and refuses writes that fail validation. This turns the event log into a set of enforced contracts between the twin (L3), copilot (L5), orchestration (L4), and control (L1). A malformed equilibrium reconstruction from the breeder twin is rejected at the edge, not discovered mid-procedure.

Canonical envelope

Every event shares an envelope; the payload is schema-specific. The envelope carries the identity, causality, and provenance fields that the audit and replay machinery depend on.

{
  "event_id": "uuid-v7",          // time-ordered, unique
  "schema": "breeder.plasma.equilibrium",
  "schema_version": 7,
  "key": "shot_00421",
  "occurred_at": "2030-04-12T09:14:22.104Z",
  "producer": "l3.twin.equilibrium@v2.3.1",
  "causation_id": "<event that caused this>",
  "correlation_id": "<shot/campaign trace>",
  "idempotency_key": "twin:shot_00421:step_88",
  "payload": { }
}

Compatibility rules

• Backward compatible: new consumers read old events (added fields are optional with defaults).
• Forward compatible: old consumers ignore unknown fields rather than crashing.
• Breaking changes require a new topic or a new major version, never an in-place mutation.

Why it matters on these machines

During a breeder campaign the twin may be upgraded between shots while a long procedure is still draining old-format events from the log. Registry-enforced compatibility lets the new twin version and the in-flight procedure coexist. Schema discipline is what allows replay years later against the exact bytes that were emitted. See schema evolution for the migration rules.

Command schemas are the strictest: a burner plug-field setpoint command carries explicit units, valid-range metadata, and a reference to the safety envelope version it was checked against, so the envelope checker can reject a command minted against a stale envelope.