Article series · No 7

The hard part was never the code

The federation layer from the book now runs: four demonstrations, seven schemas, under a thousand lines of code. It is the smallness that proves the argument.

Markus Harmaavirta · August 2026

After six articles of argument there is a suspicion I have earned, and it goes like this: every failed programme of the last twenty years also had an architecture document, and the diagrams were always beautiful. An architecture that exists only as chapters and radar charts is safe from the one test that matters. Fair enough. So this article reports a different kind of progress. The federation layer the book specifies now exists as running code: the seven primitives as typed, validated objects, the book's worked example as seed data, and an append-only event log underneath. It is not a product, and it is not trying to become one. It is the runnable form of the book's argument.

What counts as working

Software claims need a definition of done, so I gave this one the hardest definition I could think of: four demonstrations, each one the mechanical form of a failure this series has already described. Not features, not screens. Four questions the industry has been unable to answer, answered by a running system.

The first demo is the trace

DEMO 1 · THE TRACE One query. Every hop a typed object with provenance. FIELD EVENT Service failure · EV high-voltage bus What did we know, and when? INTERFACE i4-motor-terminal The contract that governed the boundary owner: hv.systems.lead  ·  status: in-effect VERIFICATION t789-revC EMC result: −2 dB, conditional, tested at rev E by: verification.eng  ·  evidence: demo-MES DECISION connector-family The constraint set at design time by: hv.systems.lead  ·  rationale: recorded JUDGMENT emc-2db-accept The marginal case, accepted conditionally, years earlier assessor: hv.systems.lead  ·  standing: 12 years HV integration The walk the digital thread promised for twenty years, as one function call: trace(interface:i4-motor-terminal)

That walk is the query the digital thread has promised for twenty years. The first article argued why it never arrives: the objects the trace needs to pass through do not exist in the data model, so every hop dies in a document, a meeting, or a retired expert's memory. Give the objects existence and the trace is not an achievement. It is one function call.

The second demo is the aging

DEMO 2 · THE AGING Staleness is computed, not remembered. EVENT · NEW CONFIGURATION STATE Revision F is recorded Rev F changes the shielding termination at the motor terminal Rule 1: a bound configuration changed JUDGMENT emc-2db-accept The 2 dB shortfall, accepted conditionally against rev E, years ago. Nobody remembers it exists. in-effect review-required the same event, the same second VERIFICATION t789-revC  → review-required DECISION connector-family  → review-required Nobody remembered the judgment. The event did. Three objects flip themselves the moment their world changes, with the triggering event recorded in their history. Staleness query: 3 objects, 1 cause, 0 meetings

If you have taken the self-training on the book's site, you have already executed this demonstration once, by hand: the whole exercise walks you through discovering that exact stale judgment yourself. The layer does the same walk without you, at the moment the event arrives, for every judgment it holds. The third article argued that the most valuable engineering data ages silently in people's heads and files. This is what it looks like when the aging is a mechanism instead of an accident.

The third demo is the fleet answer

DEMO 3 · THE FLEET ANSWER Per-unit configuration states, population-level queryable. THE QUESTION Which delivered units contain the substituted contactor, lot CT-K42? VP2-2031-0007 · as-maintained · by svc.eng original lot CT-A17 · 29 units lot CT-K42 · 11 units 11 of 40, listed by serial, in one query Each from that unit’s current as-maintained state, each naming the service engineer who recorded it. The recall scope, the warranty exposure, and the retrofit quote: parameters to a query, not reconstruction projects. population(lot/CT-K42)

This is the question the previous two articles called the defining question of the serialised tier, the one the machinery company in both of them could not answer. The superseded as-delivered states stay in history, because supersession is not deletion, so no unit is counted twice and the audit trail survives. And nothing clever happens here. Per-unit configuration states simply exist as data, which is the entire reason the recall scope, the warranty exposure, and the retrofit quote stop being reconstruction projects.

The fourth demo is the defensible answer

DEMO 4 · THE DEFENSIBLE ANSWER The same question, asked of two assistants. THE QUESTION Can we rely on the EMC result at the motor terminal for rev F? RETRIEVAL OVER DOCUMENTS plausible “Yes. Test T-789 shows the interface passed EMC testing with an accepted deviation. The result was approved by engineering.” Fluent. Sourced. And it cites a test report that no longer describes the product in the field. validity: unchecked · assessor: unnamed · conditions: unread THE LAYER, OVER MCP defensible “No. Not without re-rendering.” The 2 dB shortfall was accepted conditionally by person:hv.systems.lead · standing: 12 years HV, reviewed by chief engineer Basis: identical shortfall on Platform X, three years of production, no EMC field failure Invalidated by: event:demo-config-change Rev F changed the shielding termination the result depends on review-required every clause is a field on a managed object One answer retrieves documents. The other cites objects, names the assessor, and knows what has changed since. Plausible versus defensible. Side by side, it stops being philosophy.

The question is the one a programme manager would actually ask, and the two answers come from the same product data. The second article called this the context problem: a model with retrieved documents produces fluency, and a model with managed objects produces accountability. Every clause in the second answer is a field the layer can show you, down to the event that invalidated the judgment. That is the whole difference, and no amount of prompt engineering closes it from the document side.

Under a thousand lines

Here is the part I find most instructive. The layer that passes all four demonstrations is under a thousand lines of ordinary Python plus a set of JSON schemas. There is no clever algorithm in it. The primitives are small typed objects, the store is an append-only log with projections, the invalidation engine is a handful of rules watching events against conditions, and the agent interface is a thin server exposing five query tools. Authority never moves: the layer holds federation references that point into the source systems, and it masters nothing that a source system masters, which is the same property the fourth article argued separates a destination from another migration.

If this substrate were technically hard, its twenty-year absence would be an engineering story. Fewer than a thousand lines say it is not technically hard. The hard part was never the code. The hard part is the institutional machinery the previous two articles kept circling: deciding that judgment is data, giving interfaces owners on both sides, agreeing whose event means what, and running the cadence that keeps the objects honest. That work does not compress into a repository, which is exactly why vendors do not ship it and programmes do not fund it. The code was only ever the cheap part, and now there is a concrete number on how cheap.

What it is not

Calibration, because the claim only holds if it is not inflated. This is a reference implementation at demonstration scale. One worked example. Mock source systems, whose only job is to prove authority stays outside the layer. No authentication, no multi-tenancy, no vendor connectors, no dashboards. It does not have a name yet, and I am in no hurry to give it one, because names are for products and this is an existence proof. What it proves is narrow and, I think, sufficient: the objects the book specifies can be typed, stored, traced, aged, and queried by an agent, on a laptop, today.

One consequence for the reader

The schemas and the specification are available as a companion pack for readers of the book, through the book's site. But the more portable consequence fits in four questions, and you can bring them to your next vendor meeting without any code at all. When the intelligence layer is presented, ask: can it trace a failure back through contract, evidence, decision, and judgment as typed objects? Does recorded evidence age when configurations change, mechanically? Can it tell you, now, which delivered units carry a given component? And when its AI answers, is the answer defensible down to named objects, or plausible down to retrieved documents? Four demonstrations, twenty minutes. You will learn more from where the demo stalls than from the roadmap slide.

One more thing

The layer implements the architecture that Beyond the BOM: A Federation Architecture for Complex Engineering Data specifies across 395 pages, now on Amazon: the seven primitives, the federation pattern that carries them, and the operating model the code deliberately does not contain, because that part runs on people. The earlier articles argued that the digital thread, the AI copilot, the knowledge-retention programme, and the replacement fantasy all fail on the same missing substrate, mapped which pieces of it your product needs, and handed you the tape measure. This one is the existence proof: the substrate runs, and it was never the expensive part. What remains expensive is the decision to want it.

This article develops an argument made at book length in
Beyond the BOM: A Federation Architecture for Complex Engineering Data. 395 pages, available now.

Buy on Amazon

Comments and discussion live on the LinkedIn version of this article.