NS-15: System model binding (identity levels, passports, chronotopes, relationships, risk routes and engines, cell intelligence, agent genomes)

The system model defines seven identity levels for a selectable object. NS-15 fixes the identifier each level may carry and the records each level may bear.

• NS15-R1 A UNI shall be allocated to a subject only at level 4 and only through the record allocation authority (NS1-R2, NS-3); levels 0 to 3 never allocate. Vector-tile feature ids, feature.id, properties.id, tile-local indexes, loop indexes, array positions, geometry ordinals, display labels and nearby names shall not become a UNI or a candidate key.
• NS15-R2 A level is a recorded fact, carried as identityLevel on the passport, and shall not be inferred from presentation. Escalation requires the receipt or enrolment that the level requires; de-escalation (quarantine on an identity conflict) is a correction record (CR), never a deletion.
• NS15-R3 A clause (NS-10) shall bind only subjects at level 4 or higher; a policy that names lower levels is invalid.
• NS15-R4 An attestation (NS-11) shall name the subject by its SU UNI, or by an NS-9 contextual UNI whose context.ofUni resolves to one; an attestation on a representation is REFUSED (reason SUBJECT_IDENTITY_LEVEL).

The system model defines three passport levels and thirteen standard sections. NS-15 binds them to records.

The thirteen sections (header and status; identity; location and geometry; classification; relationships; chronotope; data and evidence; dynamic risk state; science and methods; scenarios; policy and reliance; corrections; exports and interoperability) are the information architecture of every passport. NS-15 fixes the standards fields inside them:

• NS15-R5 A durable passport shall exist only for a subject at level 4 or higher; a rendered or investigative passport states durable: false and carries no UNI of its own.
• NS15-R6 Every section shall be either filled from records or marked NOT_AVAILABLE with the reason; no section shall be filled from a display value.
• NS15-R7 limitations is required and shall be non-empty on every durable passport version.
• NS15-R8 The policy-and-reliance section shall show attestation results as recorded (PASS, FAIL, INDETERMINATE, NOT_APPLICABLE, REFUSED); it shall not render a score, badge or certificate (NS0-P8).
• NS15-R9 A public-safe projection shall be a separate record version with its own digest; it omits restricted sections and states that it does so.

The system model specialises passports through profiles. NS-15 catalogues each profile as a schema artifact (NXS-GRX-SC-…) and fixes the id each subject carries as objectProfileId:

• NS15-R10 A profile id is a classification, not a name; a new profile shall be proposed under NS-13 and catalogued before any subject uses it.

The typed relationships of the system model are the edge vocabulary: identity and alias; part-of and contains; occupies and operates; owns (where lawful); located-in and intersects; depends-on and supplies; controls and mitigates; causes and contributes-to; exposed-to; vulnerable-to; observed-by; financed-by; insured-by (where authorized); regulated-by; affects; supersedes; derived-from; contradicts; validates; invalidates. NS-15 fixes:

• NS15-R11 An edge shall name both ends by UNI (SU, DP, PR or a record UNI) and shall carry evidenceRef (<recordUni>@<recordVersion>), validFrom and validUntil, direction and, when applicable, probability, scenarioRef, disputed, capacity, threshold, commonCauseRef, substitutes and state (failure or recovery). A relationship among more than two parties is a hyperedge with an ordered participants list.
• NS15-R12 supersedes, derived-from, contradicts, validates and invalidates are the only classes that a standards record (clause, policy, attestation, crosswalk) may use; validates and invalidates edges from an attestation to a subject shall be written by the NS-11 evaluator alone.
• NS15-R13 A disputed edge shall be shown as disputed; it shall not be dropped to make a graph consistent (NS0-P8, NS0-P9).

A chronotope version NXS-GRX-CT-…@v is the only record that fixes the time, space, knowledge and situation dimensions of a subject: valid, transaction, observation, acquisition and publication time, forecast issue and valid time, scenario, decision, execution, outcome and correction time; geometry version, spatial support, coordinate reference system and datum, boundary version, jurisdiction, worldview, coverage and resolution, positional uncertainty; source cut, evidence available, ontology version, model version, epistemic state, contradiction and dispute state, correction state; hazard, operational, dependency, control, policy, intervention and scenario state.

• NS15-R14 Every NS-11 attestation and every NS-9 context whose validity depends on time or place shall carry chronotopeRef; an evaluation over records of different chronotopes is INDETERMINATE (reason CHRONOTOPE_MISMATCH) unless the clause declares the window that reconciles them.

• NS15-R15 The lifecycleState of an engine descriptor (DECLARED, SCAFFOLDED, IMPLEMENTED, CONNECTED, EVALUATED, ASSURED, DEPRECATED, QUARANTINED, RECALLED, RETIRED) is a recorded fact. ASSURED requires an NS-11 attestation chain with result PASS on the engine's validation and uncertainty-profile clauses, under a verified mandate. No other state shall be raised by an attestation.
• NS15-R16 The policyDecisionRef of a risk route shall be a recorded policy decision of the implementation's trust authority; its excludedCandidates shall be kept with their exclusion reasons; the route record is append-only, and a re-route supersedes it.
• NS15-R17 Numbered placeholder engines and generated wrappers that do not represent a distinct capability shall not be catalogued; a request to catalogue one is refused with ENGINE_NOT_DISTINCT.
• NS15-R18 claimCeiling on every engine, route and product record shall follow the claim registry and shall not exceed INTEGRATED until the registry changes.

An implementation may organise intelligence over a discrete global grid (for example H3 cells): pins that mark cells of interest, indicator layers, frames that record a layer over cells at an instant, graphs, edges, runs and jobs. Such an implementation keys these objects by opaque internal identifiers.

• NS15-R19 Opaque internal identifiers of cell-based intelligence shall remain internal keys; they shall not be shown as names and shall not replace a UNI.
• NS15-R20 A pin that is durable and that its owner enrols as a subject shall receive an SU UNI through the record allocation authority and shall keep its internal identifiers as representationRefs; its cells (for example H3 indexes) are location, not identity.
• NS15-R21 A frame is an observation record (OB) of one indicator layer over its cells at recordedAt; the composite value, its lower and upper bounds and riskState shall be presented as recorded, and a withheld composite (all values null) shall be shown as withheld.

• NS15-R22 An agent genome (a declarative description of an agent with the sections apiVersion, kind, metadata, identity, niche, authority, tools, memory, chronotope, outputs, evaluation and limitations) shall be catalogued as a software artifact NXS-NXQ-SW-… with the NS-12 obligations. Its authority section names the mandate the agent acts under; an agent that evaluates a clause (NS-11) is an evaluator whose mandate is verified like any other, never a privileged one.
• NS15-R23 A risk-context envelope (requester, purpose, subject kind and UNIs, spatial extent, temporal extent, chronotopeRef) is the request record of an evaluation or a risk route; it shall be digested into the evidence of the attestation or route, so that the question asked is as citable as the answer.
• NS15-R24 subject.kind values (UNI, OBJECT, LOCATION, PROCESS, NETWORK, PORTFOLIO, ROUTE, SCENE, POPULATION, SYSTEM, MODEL, TECHNOLOGY) map to object profiles (section 3) or to NS-9 contexts; an envelope without a resolvable uniRefs entry evaluates at identity level 1 to 3 and yields no attestation (NS15-R4).

8a. Identity registries (NS15-R25)

• NS15-R25 An implementation may operate a durable identity registry beside the NS-3 record allocation authority (for example a registry of namespaces, registrations, identity records, versions, acceptance receipts, quarantine events and integrity checkpoints). The two are bound and do not compete: the NS-1 UNI is the only public, citable identifier, and only the record allocation authority allocates it; the identity registry holds the evidence that a subject exists at identity level 4 to 6 (NS15-R1) and records the subject's SU UNI as its canonical key once one is allocated. The identity registry shall not mint an identifier in the NS-1 form, and the record allocation authority shall not store identity evidence. A registry record without an SU UNI is a candidate identity (level 1 to 3) and yields no passport.

An implementation declares its level in registry/consumers.yaml. The declaration is SELF_DECLARED until NS-11 attestations under a verified mandate raise it to VERIFIED.

schemas/nexus-subject-passport.v1.json is the standards envelope of a durable passport: the fields NS-15 fixes in section 2, the identity level, the profile id, the relationship edges (section 4) and the policy-and-reliance block. An implementation's own passport contract remains authoritative for everything else; the schema validates the envelope, not the science.

• NS15-O1: whether SU UNIs for durable pins are allocated under GRX or under the functional class that owns the context in which the pin is used.
• NS15-O2: the signing arrangement that turns a VERIFIED engine assurance into ATTESTED (NS-10 section 3).
• NS15-O3: a crosswalk of the relationship classes to W3C PROV-O and to the OGC GeoSPARQL and CityGML relation vocabularies (an NS-14 register entry).