UM in the RP1 Spatial Fabric

You enter a spatial fabric. Your browser has held your manifest in cache since you authenticated with your identity service provider this morning. The fabric's service layer requests authentication via RMAP. Your browser presents your manifest at the Service layer: a one-time presentation; the verified session is retained until your manifest's expiresAt is reached.

The fabric resolves your DID, retrieves your public key, verifies the Ed25519 signature over the JCS-canonicalized manifest. The signature is valid. The TTL is current. The fabric reads your entity type (human, signed by a trusted identity service provider) and admits you. A session-admitted receipt is written.

Three services activate inside the fabric. Each one is a different receiver role; each one gets a different projection. The map service receives a position-bearing projection: persona, position, fabric attachment. A map-anchored retail kiosk at your nearest waypoint receives a narrower projection: display name, entity type, position, and the consent set its service-requirement manifest names. A commerce service inside the fabric wants to verify you are over 18: it receives an age verifiable credential presented as a ZKP, learning only that the threshold is met. Three projections; one envelope.

The browser mediated every projection. No service received a facet outside its receiver-role contract. Each decision produced a typed receipt. The chain is local-hashed and batched per the receipt taxonomy's 5-60 second cadence; safety-critical receipts (if any had occurred) would have flushed immediately.

Surfaces exercised: 1 Identity Credential, 2 Entity Type, 4 RMAP Service Credentials, 5 Consent Model, 7 ZKP Selective Disclosure, 10 Spatial Addressing, plus the Stage 6 receipt taxonomy and the receiver-role table.

A maintenance technician puts on AR glasses at the start of an 8-hour shift in a 40,000-square-foot manufacturing plant. The browser loads the technician's manifest from the corporate identity service provider. The manifest carries persona, three signed safety certifications (OSHA 30-Hour, Lockout/Tagout Qualified Person, Confined Space Entry), an equipment-access credential authorizing five equipment categories and three zones, an enterprise policy facet declaring mandatory safety-alert and emergency-evacuation services and prohibiting social / entertainment / advertising categories, and a derived-variant sensor consent set (location allowed, eye tracking denied, hand tracking allowed, room geometry denied, camera passthrough denied, GPS denied; the enterprise policy reinforces the sensor denials).

The technician walks the fabric for the full shift. At entry, the fabric verifies the signature, reads the consents, applies the enterprise policy, activates the two mandatory services. At a hydraulic press station, the equipment monitoring service receives a scoped projection containing the equipment-access credential; the press's category is in the authorized list and full telemetry renders. The service writes to its authorized SOM branch (/factory/production-A/press-07/telemetry); it cannot write to the safety service's branch.

A training service guides the technician through a pump replacement. Its WASM module passes the content trust chain check (module hash + publisher signature + revocation lookup) before execution. The training service reads the certifications and the equipment-access level to confirm authorization. The safety monitoring service detects a forklift in the adjacent aisle and needs to tell the navigation service to reroute pedestrian traffic. The fabric operator's inter-service authorization manifest declares the safety-to-navigation channel with allowed message type hazard-alert. The browser verifies source DID, target category, message type, size limit, rate limit, and operator signature. All checks pass. The message forwards. The navigation service reroutes traffic. A safety overlay renders on the technician's glasses; because the safety service is mandatory per the enterprise policy, the technician cannot dismiss it.

At end of shift, the manifest's expiresAt is reached. All services invalidate their cached references. The receipt chain for the shift is sealed into a departure manifest.

Surfaces exercised: 1 Identity Credential, 4 RMAP Service Credentials, 5 Consent Model, 6 Content Trust Chain, 11 SOM Branch Authorization, 12 Inter-Service Communication Authorization.

A new fabric is being composed. A service vendor offers a predictive-maintenance module as a WASM binary. The browser refuses to execute the module until the content trust chain is verified. The chain has three steps: the module hash matches the hash signed by the publisher in their content trust attestation; the publisher DID resolves to a recognized identity that has not been revoked by the fabric operator's service-catalog manifest; the publisher's signature over the module bytes is valid.

All three checks pass. A package-trusted receipt is written. The module enters execution. It receives only the projection the publisher's service-requirement manifest declares; no facets outside that contract. The module writes to its assigned SOM branch and cannot touch any other.

A second module from a different publisher is offered. Its publisher DID has been revoked by the fabric operator since the manifest was issued. The browser blocks execution. A package-rejected receipt is written. The fabric operator's audit log records both the revocation and the block. The module never reaches the runtime.

Surfaces exercised: 6 Content Trust Chain, 6A RMAP Package and Service Catalog Manifest, 11 SOM Branch Authorization, plus the Stage 6 typed receipts (package-trusted, package-rejected).