ADR 0035 — the constellation namespace: top-level space allocation is registry-governed

• Status: proposed
• Date: 2026-07-03
• Builds on: thesmos ADR 0016 (the space axis is law: a space is a path in one global tree; scope is placement, not a field), 0034 (the per-judgment seam every space-scoped check runs through), atlas ADR 0002 (the registry as "the one irreducibly-central fact" — the governance shape this ADR reuses)
• Relates: accounts docs/SPACES.md (the reference adopter; root ["bitagent", …]), deploy-v0-profile (atlas-authored ["runtime", <system>, <env>] + five role subspaces), the fleet cpa-space charter (this ADR is its first ratification artifact)

Top-level path allocation in the one global space tree is an atlas-governed registry fact. thesmos ADR 0016 gives the constellation ONE tree but names no owner for its top level — so the first time two systems claim overlapping prefixes with different meanings, the tree forks conceptually and every placement-scoped grant beneath the collision inherits the ambiguity. This ADR closes that gap the same way membership was closed (ADR 0002): a small, committed registry — topology/spaces.json — records which member or program owns each top-level prefix; everything beneath an allocated prefix is the owner's to govern (delegation by placement, exactly the ADR 0016 model applied to governance itself). Allocation is by PR against the registry + CCCA ratification; disputes escalate to the maintainer. Non-goals: space semantics stay thesmos's (consume, never implement); enforcement (covers_space containment) stays deferred to the ruled v2 isolation cluster; per-owner subtree layouts are the owners' own ADRs.

Context

thesmos ADR 0016 (Accepted, sponsor-ruled 2026-07-02) makes the space axis first-class law: a space is a path in one global tree ([]string), and scope is placement in that tree. The law defines what a space is and how placement scopes authority — deliberately, it does not say who may claim ["foo"] in the first place.

That gap is already live, not hypothetical. Two top-level prefixes exist in the wild today, born independently before the law:

• ["bitagent", …] — the accounts reference adoption (docs/SPACES.md, "scope is placement, not a field"): org/identity placement for grants.
• ["runtime", <system>, <env>] — the atlas-authored deploy-v0 wire format (five role subspaces intent/approval/plan/effect/observe), realized by pharos/stele.

Two prefixes at the top of one tree is not a fork — a tree has many children. A fork is two claimants for the same prefix with different meanings, and with the cpa-space program about to drive fleet-wide adoption, first-claim collisions become a matter of when. The membership test for atlas applies exactly: the namespace map concerns every system and has no single-repo owner.

Decision

1. The allocation registry. topology/spaces.json (schema: schema/atlas-spaces.schema.json) records every top-level prefix as { prefix, owner, meaning, status, refs }. It is the one place a prefix claim is durable; a prefix not in the registry is unallocated, full stop.
2. Seed allocations (ratifying what exists):
   • ["bitagent"] → accounts — identity/org placement (the reference adoption).
   • ["runtime"] → atlas (schema author; pharos/stele realize) — the deploy-v0 runtime wire format and its role subspaces.
   • ["constellation"] → atlas (reserved) — future home of topology/substrate facts when the ADR 0031 intent bridge gives git-authored artifacts a fact projection.
3. Delegation by placement. An allocation covers the prefix and everything beneath it; the owner governs its subtree layout (their own docs/ADRs) without further atlas involvement. Sub-delegation inside a subtree is the owner's business.
4. Process. A new top-level claim = a PR adding the registry row; the CCCA ratifies by merging (component prefix topology:). Contested or governance-heavy claims escalate to the maintainer. Renames/retirements are rows edited by the same process — the registry is history via git, so no tombstone machinery.
5. Boundaries. Space semantics (what placement means for grants, verification, the tree type itself) are thesmos law — this registry consumes them and never redefines them; law changes route via the thesmos sponsor path. Enforcement of containment (covers_space) is explicitly not granted by allocation — until the ruled v2 isolation cluster lands, a registry row documents intent and governance, not a security boundary (the same fence the accounts v1 ruling drew).

Consequences

• The first-claim race is closed for the cost of one small JSON file and a schema — before thesmos #249's vectors land, while change is cheap.
• Adopters entering via the cpa-space program get a lookup instead of an archaeology project: where do I live, who owns the prefix next to me.
• A follow-up (tracked, not blocking): an atlas doctor check validating spaces.json against its schema and flagging prefix collisions mechanically.
• If the registry itself ever becomes space-native (facts under ["constellation"]), this ADR's governance transfers unchanged — the registry is the content, not the medium.