The envelope

What every bus message carries about itself. This is its data dictionary at contract v24: one entry for every field of its messages a plugin meets, saying what the field is for, what a value means and does not mean, what empty means, who fills it, its bounds and the operations a write must carry it on. Each entry is anchored by its name, the name a refusal's path resolves to and a declaration names, which never changes.

Its messages are declared in meridian/v1/bus.proto, meridian/v1/envelope.proto. A field's entry is the same whatever carries it: a typed operation's parameters take the entries of the message they are made from.

Records

The messages this store keeps and answers.

Record	What it is
Envelope	the frame one bus message travels in: its metadata, its type and its bytes
MessageMeta	what every bus message carries about itself, to route, correlate and audit it

Envelope

meridian.v1.Envelope, a record.

meta

message MessageMeta · since v2 · stable

Carries what the message says about itself.

• Means: its identifiers, topic, publisher, time and the person and scope the sidecar stamped
• Does not mean: the payload
• Empty: never unset
• Filled: stamped, by sidecar

payload_type

text · since v2 · stable

Names the payload's message.

• Means: its full name, which a subscriber checks before decoding rather than guessing from the topic
• Does not mean: the topic
• Empty: never empty
• Filled: stamped, by sidecar

payload

bytes · since v2 · stable

Carries the message itself.

• Means: the payload message, serialised
• Does not mean: a oneof over every message: the bus carries any payload without being compiled against it
• Empty: empty for a message with no field set
• Filled: stamped, by sidecar

MessageMeta

meridian.v1.MessageMeta, a record.

message_id

identifier message · since v2 · stable

Identifies the message.

• Means: unique per message: the idempotency key a handler that has seen it may drop the message by
• Does not mean: a business identifier on the payload
• Empty: never empty
• Filled: stamped, by sidecar

correlation_id

identifier message · since v2 · stable

Ties together every message one originating action caused.

• Means: constant across them, so a person can follow a sync all the way to a position update
• Does not mean: the message that caused this one, which causation_id names
• Empty: empty where the publisher began nothing to correlate
• Filled: stamped, by sidecar

causation_id

identifier message · since v2 · stable

Names the message that caused this one.

• Means: its message_id: correlation gives the set, causation the shape of the tree inside it
• Does not mean: the originating action
• Empty: empty for a message nothing on the bus caused
• Filled: stamped, by sidecar

publisher_instance_id

identifier instance · since v2 · stable

Names the instance that published the message.

• Means: provenance, and the reply address for a request
• Does not mean: the person it was sent for
• Empty: never empty
• Filled: stamped, by sidecar

topic

text · since v2 · stable

Names the topic the message was published on.

• Means: kept so a message stays interpretable once captured away from its subscription
• Does not mean: the payload's type
• Empty: never empty
• Filled: stamped, by sidecar

schema_version

text · since v2 · stable

Says which contract version the publisher was built against.

• Means: v and a number, as the publisher declared it
• Does not mean: the payload's own version
• Empty: empty where the publisher did not say
• Filled: stamped, by sidecar

published_at_ns

moment · since v2 · stable

Records when the message was published.

• Means: the publisher's wall clock at publish: observation time
• Does not mean: when something happened in the world, which only the payload can say
• Empty: never 0
• Filled: stamped, by sidecar
• Unit: nanoseconds since the epoch, UTC

acting_for_subject

text · since v2 · stable

Names the person, or from v21 the service account, a command was sent for.

• Means: the deployment-local subject the sidecar verified (W4.9), so the store records who made the change; acting_for_kind says which kind of user
• Does not mean: anything a plugin supplies: stamped by the sidecar alone (decisions/014)
• Empty: empty when the plugin acted as itself
• Filled: stamped, by sidecar

Changes: v21, clarified: a service account's SA- subject where acting_for_kind says so.

acting_through_delegation

text · since v9 · stable

Names the delegation the person acted through.

• Means: the delegation the assertion named (W4.9, decisions/029), set beside acting_for_subject
• Does not mean: the actor, who stays the person
• Empty: empty for a person at the dashboard, and for a plugin acting as itself
• Filled: stamped, by sidecar

acting_through_client

text · since v10 · stable

Names the client the person acted through.

• Means: the client's registered name as the assertion named it, so a store records the person through that client without a second read
• Does not mean: a person or a plugin instance
• Empty: empty where acting_through_delegation is
• Filled: stamped, by sidecar

account_scope

repeated identifier account · since v2 · stable

Carries the accounts the publishing plugin may read, on a read; from v22 the accounts it may write, on a command naming a record by its ID alone.

• Means: a core store answers only for these; on a command naming an order, a placement, a change request or a locate by its ID alone (W4.9, W11), the sending instance's write scope narrowed to the person's write access where it acts for one, and the book refuses, changing nothing, a command whose record's account is outside it (PERMISSION_DENIED, no reason code)
• Does not mean: the accounts the person may read
• Empty: empty is nothing when account_scope_applies; unread otherwise
• Filled: stamped, by sidecar

Changes: v22, clarified: also stamped on a command naming a record by its ID alone, the write scope the book checks the record's account against (the order-path plan's protos, point 8).

account_scope_applies

boolean · since v7 · stable

Says the account scope applies, so an empty one is nothing.

• Means: set by the sidecar on every query it sends for a plugin (W4.11), and from v22 on every command naming a record by its ID alone; a store answers a query whose scope is empty with nothing, and refuses one naming an account outside it
• Does not mean: anything a core component sets
• Empty: false on a core component's read, which no scope cuts
• Filled: stamped, by sidecar

Changes: v22, clarified: also set on a command naming a record by its ID alone (W4.9, W11).

prepared_call_id

text · since v20 · preview

Names the prepared change a command for a person was made from.

• Means: the PC- ID the assertion named (W4.9, W6.27), set beside acting_for_subject and any delegation, which the store keeps
• Does not mean: the actor, who stays the person; or anything the plugin chose: it cannot set it
• Empty: empty unless the person made the command from a prepared change, and for a plugin acting as itself
• Filled: stamped, by sidecar

acting_for_kind

enum SubjectKind · since v21 · preview

Says the kind of user a command was sent for.

• Means: the claims' subject_kind, stamped beside acting_for_subject (W4.9), so a store records a service account, never a person
• Does not mean: anything a plugin supplies: stamped by the sidecar alone
• Empty: unspecified: a person acted, or the plugin acted as itself
• Filled: stamped, by sidecar

Value	Means
SUBJECT_KIND_UNSPECIFIED	a person, or nobody where acting_for_subject is empty
SUBJECT_KIND_SERVICE_ACCOUNT	a service account: acting_for_subject is its SA- subject

owner_subject

text · since v21 · preview

Names the person answerable for the service account a command was sent for.

• Means: the claims' owner_subject, stamped beside acting_for_subject, which the store keeps on the actor
• Does not mean: who acted, which is the service account
• Empty: empty unless acting_for_kind is a service account
• Filled: stamped, by sidecar

connectivity_allowed

boolean · since v22 · preview

Carries the sending ems sidecar's verdict on a placement's connectivity link.

• Means: true when the placement's connectivity plugin is linked to the stamped ems instance, its link not withdrawn, and the acting user — person, service account or a user group they are in — among the link's users: the placement's connectivity instance is in the caller's CallerClaims.connectivity_instance_ids (W4.9, W11.8); the book refuses a placement stamped false with REFUSAL_REASON_CONNECTIVITY_NOT_ALLOWED and records the refusal
• Does not mean: anything a plugin supplies, or a verdict read on any other command
• Empty: false on every message but a CreatePlacement, where false is the sidecar's refusal of the link
• Filled: stamped, by sidecar

algorithm_id

text · since v22 · preview

Names the algorithm a service account's call named.

• Means: the claims' algorithm_id, stamped beside owner_subject after the sidecar checked it against the version's algorithms; the book copies it to the entry's ServiceAccountActor
• Does not mean: anything a plugin supplies: stamped by the sidecar alone
• Empty: empty for a person, and where the call named none
• Filled: stamped, by sidecar

---

Generated from boundaries/fields.json in meridian-schema at a6a0af7, contract v24.