El Mundo — LinkedIn announcement
Industrial data platforms keep promising immutability and delivering "mostly immutable." At RCI we built a platform that means it: append-only by construction, attested by cryptography, methodology-versioned without silent overwrites. We call it El Mundo (literally "the world" — the whole substrate from sensor to ledger), and it's how we think the upstream and adjacent industries should keep their books.
The problem. Operational data platforms in upstream oil and gas, geothermal, frac completions, and wireline have a recurring pathology. Two sensors disagree, and the platform silently averages them. A methodology gets updated, and the old derivations are quietly recomputed under the new rules — or worse, overwritten in place. The audit trail is a feature you bolt on for SOC 2 season, not the structural backbone of the system. And the vocabulary the platform uses to describe itself — "data lake," "single source of truth," "lakehouse" — doesn't actually encode any commitments. You can call something a single source of truth and still mutate it on Tuesday. We are the Ledger. Our vocabulary, and the architecture under it, encode commitments that the platform cannot violate without breaking its own metaphor.
Three ledgers, kept distinct. El Mundo's cloud tier is built around three append-only, cryptographically sealed ledgers, each recording a different kind of truth. The Pulpería (the frontier general-store-and-tavern, the place where the day's transactions were written into the diario) records what was observed — every sensor reading, every manual gauge entry, every adapter event, with both source-asserted and receive timestamps preserved verbatim and original units of measurement intact. When two witnesses disagree, both readings are stored, linked, and flagged; nothing is silently averaged away. The Contaduría (the accounting house) records what was concluded — derived figures produced under a versioned methodology spec called a Plan de Cuentas, where each closing event (a Cierre) is sealed against a specific methodology version. The Cabildo (the colonial town council that kept the books of governance) records what was done to the system itself — every config change, every authorization, every methodology transition, every export. SOC 2 evidence is a natural read-out of this ledger, not a quarterly archaeology project.
Two-tier topology. In the field, the Baqueano — the local guide who knew the terrain when no map existed — is our field-tier intelligence: a permanent on-site software presence that decodes protocols, preserves provenance, and doesn't depend on a probe-from-the-cloud to know what's happening at the wellsite. El Baqueano y sus Aperos: the Baqueano runs on its Aperos, the hardware kit (embedded board, enclosure, antennas, sensor interfaces, power conditioning). What the Baqueano reads becomes a Posta — our atomic unit of data, named for the relay-station horse that carried mail across the pampas. Postas travel along Senderos (the trails — Starlink, customer WAN, cellular, microwave, all mTLS-secured) toward either a Pueblo (our multi-tenant cloud, RCI-operated) or a Campamento (a single-tenant on-prem deployment with its own private institutions, for customers whose security posture forbids shared infrastructure or outbound traffic to public networks).
Methodology versioning that means it. The hard part of a derived-data ledger isn't writing the first version of the methodology — it's the second. Decision D-021 in our architecture log commits to five things: there is at most one active version of any methodology lineage at a time; supersession is atomic (registering a new version and deactivating its predecessor commit together or not at all); soft-delete is a derived predicate, not a stored state; rollback is re-registration (you cannot reactivate a superseded version — you register a new version whose rules mirror the old one, and the audit ledger records the deliberate choice); and active itself is derived from the Cabildo, never stored as a flag. There is no column anywhere in our schema that says "this methodology is current." The Cabildo says it, by what it does and does not contain. Flag-vs-ledger skew is not possible because there is no flag.
Why a Spanish rural-pueblo vocabulary. Because a coherent metaphor produces names that encode commitments and generates new names organically as the architecture evolves. When we needed a name for the keeper of the audit ledger, we didn't invent one — we asked what the colonial Spanish-American town council called the person who recorded its acts, and the answer was Secretario. When we needed a resolver for two-witness disagreements, the juez de paz pattern was already there, and we named it Árbitro. The metaphor is a generator, not decoration. Ramon Rodriguez and María Paula Graña have written this argument up as an IETF draft, draft-rodriguez-grana-metaphor-vocabularies, proposing metaphor-coherence as a discipline for naming distributed-system components. The draft is linked from the white paper.
Why this matters. For operators, this means provenance you can hand to a regulator without trusting RCI: in our Mode 2 Escribanía (notary) configuration, every Testimonio (the customer-facing verification artifact) carries a merkle inclusion proof anchored to a public chain — anyone can verify a Posta's integrity without our cooperation. For regulators, it means methodology changes that don't pretend the prior version didn't happen: the Asientos (the derived entries) sealed under v1 of a Plan de Cuentas remain queryable forever, even after v2 supersedes it, and the act of supersession is itself a permanent Cabildo entry with the responsible Approver's identity attached. For SOC 2 auditors, it means evidence collection is a query, not a scavenger hunt.
Where this comes from. El Mundo is RCI's formalization and expansion of the data-governance concepts first implemented in our Data Platform for an Oil & Gas Operator — a multi-component well-construction information platform spanning data masters catalogs, field reporting data (from a legacy 20+-year-old system and a new reporting system), AFE modeling, a Well File lifecycle system, and a drilling-and-completions analytics system. The platform's seminal system became officially operational in May 2026 for all field types of operations in well construction, and continues to expand through 2026 and 2027. That platform was the first implementation of the ledgering approach above; El Mundo is the next step — a re-usable substrate that exposes those concepts as a coherent architecture available to additional industrial customers.
What's next. A second design partnership is in motion: a geothermal utility — shallow wells under water-well permitting, temperature-equalization project — adopting the methodology's record-keeping concepts for its own planning-and-reporting platform. They use the discipline without deploying our field tier. Resguardamos la Verdad: from the sensor on the wellhead to the Testimonio in the regulator's inbox, we are the substrate the data lives on, and we safeguard the operational truth that travels through it. We are looking for additional design partners — substrate deployments, methodology adoptions, or both — in industrial domains where the operational ledger needs to actually behave like a ledger.
Read the white paper: https://www.roderickc.com/pueblo/. The IETF draft on metaphor vocabularies is linked from the same page. Reach out: ramon.rodriguez@roderickc.com.
#UpstreamOilAndGas #IndustrialData #SOC2 #DataArchitecture #Geothermal #Provenance #Methodology