El Mundo — White Paper

RCI's data-substrate platform for upstream oil & gas, geothermal, and completions A technical white paper for architects, decision-makers, and informed industry readers.

Draft. Lexicon version: el-mundo-lexicon v2026-05-07. Decisions referenced: D-001 through D-021.

1. Executive summary

We are the Ledger.

That is not a slogan. It is the architectural commitment that organizes everything that follows. El Mundo is RCI's formalization and expansion of the data-governance concepts first implemented in our Data Platform for an Oil & Gas Operator — a multi-component well-construction information platform spanning data masters catalogs, field reporting data (from both a legacy 20+-year-old system and a new reporting system), AFE (Authorization for Expenditure) modeling, a Well File lifecycle system, and a drilling-and-completions analytics system. The platform's seminal system became officially operational in May 2026 for all field types of operations in well construction, and the platform continues to expand through 2026 and 2027. That platform was the first implementation of the ledgering approach this paper describes; El Mundo is the next step — a re-usable substrate that exposes those concepts as a coherent architecture, available to additional industrial customers across upstream oil & gas, geothermal, and completions. It is built so that operational reality, once observed, is recorded once and recorded forever; so that any conclusion drawn from that record carries with it the methodology under which it was drawn; and so that any party who needs to verify what was recorded — a regulator, a counterparty, an internal auditor, a future version of the operator themselves — can do so without having to trust RCI.

The platform is organized around three ledgers, each recording a different kind of truth and never silently merged with the others:

A Pulpería, recording what was observed. Atomic unit: the Posta — a single sensor reading, form submission, or operational event, with both source-asserted and platform-receive timestamps preserved verbatim, original units of measurement preserved verbatim, and full provenance attached.
A Contaduría, recording what was derived. Atomic unit: the Asiento — a value computed from one or more Postas under a versioned methodology spec called a Plan de Cuentas, sealed at periodic close events called Cierres. New methodology versions produce parallel Asientos, never overwrites.
A Cabildo, recording what was done to the system itself — every configuration change, every authorization, every methodology transition, every export, every conflict resolution. The Cabildo is the SOC 2 evidence layer.

All three ledgers are append-only. All three are sealed by a cryptographic notary, the Escribanía, which produces a per-record signature called a Sello and customer-verifiable artifacts called Testimonios. All three feed long-term retention in the Bóveda.

The platform spans two tiers. A field-side Baqueano (software) running on field-side Aperos (hardware) observes the operational reality of a customer site and forwards Postas along Senderos (wire transports) into a cloud-side Pueblo (multi-tenant SaaS) or Campamento (single-tenant on-prem). The cloud tier is where the three ledgers live.

This paper describes the substrate, the worked path of a single Posta from sensor to Testimonio, the lifecycle-state model that disciplines methodology versioning, the compliance posture, and why the vocabulary — drawn from the institutions of the 19th-century rural Argentine pueblo — is load-bearing rather than decorative.

2. The problem

Industrial data platforms in upstream oil & gas, geothermal, and completions face four problems that are usually addressed separately and consequently never addressed well.

Immutable provenance versus mutable methodology. The reading from a downhole gauge at 14:32:07 UTC on a Tuesday is a fact. The interpretation of that reading — what it means for stage volume allocation, for royalty calculation, for environmental reporting — depends on a methodology that may legitimately change next quarter. Most platforms either freeze the methodology (and accumulate technical debt as the business changes) or mutate the historical record under a new methodology (and lose the ability to answer "what did the books say in Q3 of 2026 under the methodology in force then?"). Neither is acceptable to a regulator.

Multi-tenant compliance isolation. A SaaS substrate that serves a high-frequency wireline operator, a methodology-adopting customer in another industrial domain, and a frac-completions service company must offer each of them an evidence boundary that satisfies their auditor and their regulator without leaking either way. A single shared cluster is too coarse; a wholly siloed deployment per customer is too expensive. Most platforms pick one and live with the consequences.

Silent reconciliation of conflicting readings. When two sensors observe the same physical phenomenon and disagree — a memory gauge versus a surface readout, an MWD pulse versus a wireline log — the engineering temptation is to average them, pick one, or quietly drop the outlier. That convenience erases the disagreement, which is itself a finding of operational consequence. A ledger that silently reconciles is not a ledger.

Transient-architecture vocabularies that don't encode commitments. Most industrial-data platforms accumulate names — IngestService, DataLakeBronze, AuditMicroservice, KafkaTopicV2 — that name implementations rather than commitments. When an architect says "audit microservice," nothing about the name tells the next architect whether it is append-only, whether reads of the audit log are themselves logged, whether retention is independent of the operational store, whether it is the SOC 2 evidence layer or merely a debugging convenience. The vocabulary is decorative. Renames are cheap. Commitments leak away.

El Mundo addresses all four problems with the same architectural move: a small set of named institutions, each of which encodes a specific commitment, each of which corresponds to a specific historical role with a specific historical discipline, and none of which can be silently merged with another without violating the metaphor and the architecture simultaneously.

3. The El Mundo approach

El Mundo makes three commitments, supported by a two-tier topology.

Three commitments

(1) Append-only ledgers. The three ledgers — observed, derived, administrative — accept new entries; they never alter or erase old ones. A Posta written at the moment a sensor sampled is the Posta forever. An Asiento sealed under a Plan de Cuentas at a Cierre is the Asiento forever, even after the Plan de Cuentas itself has been superseded. A Cabildo entry is the Cabildo entry forever — including the Cabildo entry that records a tenant's later request to add an exclusion.

(2) Methodology-versioned derivations. When the methodology changes — new regulatory rule, new business interpretation, new analytical model — a new Plan de Cuentas version is registered through the Cabildo, the predecessor is atomically deactivated, and the same operational data may be re-derived under the new methodology. Both the original Asientos and the re-derived Asientos coexist permanently. The platform never silently changes a methodology under a customer's feet. The lifecycle-state model that governs this discipline is described in §6 and is committed in D-021.

(3) Attested exports. Every export from the platform — to a customer's data lake, to a regulator's reporting system, to a counterparty in a royalty dispute — passes through the Mercado (the data-exchange surface) under a contract that is itself recorded in the Cabildo, and carries a Testimonio the recipient can verify. In Mode 1 (the platform default per D-019), the Testimonio is an internal certificate. In Mode 2 (opt-in per tenant, also from day one per D-019), the Testimonio includes a Merkle inclusion proof and a public-chain transaction hash, which the recipient can verify without trusting RCI.

Two-tier topology

The two-tier topology of El Mundo — field tier (Campo) on the left, cloud tier (Pueblo or Campamento) on the right, connected by Senderos — is rendered in the vocabulary scope and coherence diagram.

The field tier is the Campo — the customer's physical site. A Baqueano (the field-tier software, named for the historical Argentine guide who lived in the terrain rather than being parachuted into it) runs on Aperos (the field-tier hardware: embedded board, antennas, sensor interfaces, power conditioning). The Baqueano observes operational reality through Rastros (its perceptive layer — protocol decoding, timestamp resolution, UoM preservation, provenance assembly). Multiple Baqueanos at one site cooperate as a Cuadrilla — a peer mesh implemented over NATS clustering with JetStream (D-006), providing at-least-once delivery and idempotent replay across reconnections. Across many sites, a Capataz (fleet-management agent) coordinates many Baqueanos vertically.

The cloud tier is the Pueblo (RCI-operated, multi-tenant SaaS) or Campamento (customer-operated, single-tenant on-prem). Both are architecturally identical: the same institutions, the same disciplines, the same data shapes. The choice between them is a tenancy decision (D-003: hybrid isolation, with shared row-level-security for small tenants, dedicated PostgreSQL for whitelabel and large operators, full Campamento for customers requiring on-prem evidence boundaries).

Postas travel from Campo to Pueblo or Campamento along Senderos — the wire-transport layer, transport-agnostic at the application layer. Senderos may be Starlink (the default), customer WAN, cellular, or microwave; the Posta does not know which Sendero it traveled. Egress is enforced by nftables on the Aperos under signed policy distributed by the Capataces (D-007); the firewall enforces, the application is not trusted to enforce.

4. The three ledgers in one diagram

The lexicon's structural commitment — three append-only ledgers (Pulpería for what was observed, Contaduría for what was derived, Cabildo for what was done to the system itself), all sealed by the Escribanía and feeding the Bóveda for long-term retention — is rendered in the authority and provenance diagram.

The Pulpería (named for the country general store / unofficial-official information hub of the rural Argentine pueblo, which kept the books that everyone in town referenced) is the operational ledger. Postas land here. They are validated, sealed by the Escribanía, and recorded as the canonical operational record. The Pulpería is append-only: Postas are never altered, never deleted, only added. Two-witness disagreements — the case where two sensors observing the same phenomenon produce conflicting Postas — are recorded as both Postas linked together with the disagreement flagged, never silently reconciled. Resolution, if it comes, is a formal procedure (the Careo) ruled on by an Árbitro; the ruling is itself a Cabildo event.

The Contaduría (named for the colonial Spanish-American accountancy office, which read from the day-to-day books of the pulpería and produced balanced derivations under a chart of accounts) is the corporate ledger. The Contaduría reads Postas from the Pulpería and produces Asientos — derived entries — under a Plan de Cuentas (chart of accounts / methodology specification). Each Plan de Cuentas is version-stamped and immutable per Cierre (periodic close). When methodology changes, a new Plan de Cuentas version takes effect at the next Cierre forward; the prior version's Asientos remain queryable in perpetuity. Cierres operate in dual mode (D-017): event-driven (end-of-well, end-of-stage, end-of-campaign) and calendar-based (monthly default). Authoring authority is per-tenant configurable (D-016): Contador-only, Configurator-Contador-Approver, or pair-authoring.

The Cabildo (named for the colonial-era town council, the seat of municipal authority where decisions of consequence were ratified and recorded in books distinct from the pulpería's commercial books) is the audit ledger. Every configuration change in the platform, every authorization granted, every methodology version registered, every export issued, every Careo resolved, every Cartilla revoked — every act upon the system is recorded in the Cabildo. Coverage is default-deny per D-018: every event is a Cabildo event unless an Approver authors a scoped, expiring exclusion (which is itself a Cabildo event). A global must-not-exclude list — Plan de Cuentas transitions, Cierre signings, exports, Cartilla lifecycle, egress policy changes, Escribanía mode transitions — applies to all tenants.

All three ledgers are sealed by the Escribanía (the cryptographic notary), which applies a Sello — a per-record signature linking entries into a tamper-evident chain. All three feed the Bóveda (the long-term archive) once active retention windows close; Sellos travel with records into the Bóveda, and Testimonios over Bóveda records remain producible.

The keepers — Pulpero, Contador, Secretario, Escribano, Archivero — are role names in the codebase and in operational discourse. The architecture's discipline is that the Secretario records the act in the Cabildo's books; the Escribano seals it cryptographically. One institution, one keeper, no conflation.

5. A worked example: a CCL Posta from sensor to Testimonio

To make the architecture concrete, follow a single Posta from a sensor in the Campo to a Testimonio handed to a regulator. Use the high-frequency wireline pilot context (D-005, D-010): a Casing Collar Locator service running at high-frequency acquisition (≥1 kHz, up to 25 kHz top-end) on an upstream operator's well, under a national upstream regulatory regime.

At t₀ — observation in the Campo. A wireline tool string at ~3,200 m measured depth produces a magnetic-anomaly reading at the moment the tool passes a casing collar joint. The Aperos's serial interface receives the bytes; the Baqueano decodes them through its CCL adapter, which is a generalization of the rci-ascii-to-mqtt v1 pattern (D-004). The Baqueano resolves three things on the spot: the source-asserted timestamp (t_source, from the tool's clock), the Baqueano-receive timestamp (t_recv_field, from the Aperos's PTP-synced clock), and the original unit of measurement (unit_code). It assembles a Posta envelope:

{ tenant_id: "ccl-pilot-01",
  source_id: "tool_ccl_serial_0042",
  stream_id: "ccl_magnetic_anomaly",
  t_source: "2026-05-02T14:32:07.0431-03:00",
  t_recv_field: "2026-05-02T14:32:07.0438-03:00",
  value_num: 1.247,
  unit_code: "mV",
  provenance: { adapter: "ccl-serial", adapter_version: "1.3.2",
                source_uri: "serial:///dev/ttyUSB0",
                ingest_node: "baqueano-ccl-01",
                request_id: "01HXK3...", payload_sha256: "..." } }

Both timestamps are preserved; the original mV value is preserved (no silent conversion to engineering units); full provenance travels with the datum.

At t₀+δ — transit along Senderos. The Posta is published to a NATS subject (D-006); JetStream provides at-least-once delivery and dedup keyed on (tenant_id, source_id, request_id). The Sendero that day is Starlink (the default); had Starlink been degraded, the Cuadrilla would have relayed via a peer Baqueano on customer WAN. The Posta travels under mTLS, with the Baqueano's client certificate bound to its Aperos's TPM 2.0 chip.

At t₁ — arrival at the Pulpería. The Posta lands in Pueblo de Buenos Aires's Pulpería (the operator is a Pueblo-dedicated tenant under D-003, with its own dedicated PostgreSQL instance). The Escribanía applies a Sello, linking the Posta into the tamper-evident chain. The Pulpería writes the row, append-only. A Cabildo entry — posta_arrival — records the act.

At t₂ — derivation in the Contaduría. The operator's Contaduría runs under a Plan de Cuentas version ccl-pdc/v3 whose rules aggregate raw mV samples into per-collar-joint depth corrections under the operator's standard interpretation methodology. At end-of-run — the wireline operation completes, an event-driven Cierre fires (D-017) — the Contador derives the Asientos for this run. Each Asiento references the Posta IDs it derives from (it never copies the Posta content). The Asiento carries the Plan de Cuentas version, the Cierre under which it was sealed, the Contador's Cartilla, and the methodology trace. The Cierre itself is signed by an Approver (the operator selected the Configurator-Contador-Approver pattern at provisioning per D-016); the signing is a Cabildo event sealed by the Escribanía.

At t₃ — export to the regulator. Six weeks later, the national upstream regulator requests a regulatory submission for the Q1 production allocation. The operator's compliance team executes a Mercado contract that exports the relevant Asientos (and, at the regulator's option, the underlying Postas) to the regulator's reporting system. The Mercado records the contract execution as a Cabildo event (mercado_export, must-not-exclude). Each exported record carries a Testimonio: in this operator's case (Mode 1 default per D-019, because the operator's egress posture forbids outbound traffic to public chains), the Testimonio is an internal certificate signed by the Escribanía's Ed25519 key, with the Sello-chain neighbors named so the regulator can request adjacent records and verify the chain's integrity end-to-end.

A regulator inspecting that submission can query, at any later point: "Which Plan de Cuentas version produced these Asientos?" and "What were the underlying Postas, and what were their original units of measurement, original timestamps, and adapter provenance?" The answers are deterministic, signed, and queryable forever — including after the operator has authored a ccl-pdc/v4 and re-derived a parallel set of Asientos under it.

The same shape, in the geothermal pilot, would produce a Mode 2 Testimonio (opt-in per D-019 once a public-chain choice is committed): the state regulator's inspector verifies the Merkle inclusion proof against the public chain transaction hash, and confirms the Posta's authenticity without trusting RCI.

6. Methodology versioning (D-021)

Methodology changes. Regulations evolve; business interpretations refine; analytical models improve. The platform's commitment is that methodology change must never silently rewrite history. D-021 — the lifecycle-state model — encodes that commitment in five rules.

(1) active is an attribute derived from the Cabildo, not a stored flag. Whether a given Plan de Cuentas version is currently active is computed by walking the Cabildo for registration and deactivation entries pertaining to that version. There is no active column on the Plan de Cuentas table, no flag elsewhere. The Cabildo is the sole source of truth.

(2) At most one version of a lineage may be active at any time. Within a lineage — say, the production-volume aggregation methodology for Pueblo de Houston's frac-completions tenants — the active set has cardinality 0 or 1. Never 2.

(3) Supersession and deactivation are decoupled events but must occur atomically when a successor is registered. A new Plan de Cuentas version that supersedes a predecessor is registered in one Cabildo entry (kind plan_de_cuentas_supersession) whose effect is compound: register-and-activate the new version and deactivate the predecessor. There is no intermediate state in which both are active; the atomicity is what enforces rule 2.

(4) Soft-delete is a derived predicate, not a stored state. A version is "soft-deleted" if and only if it is inactive and every version in its lineage is inactive. The condition is computed from the Cabildo, never stored. Append-only is preserved: dormant Asientos remain queryable for audit under the methodology in force when sealed; the lineage simply stops accepting new Cierres.

(5) Rollback is re-registration, not reactivation. A superseded version cannot be reactivated. To return to v1's rules after v2 has been in force, register a new v3 whose computation rules mirror v1's, atomically deactivating v2. The old v1 track stays (inactive, superseded by v2); a fresh v3 track begins. The Cabildo records a deliberate choice with its own version stamp — not a silent reversion that pretends v2 didn't happen.

The four-cell state matrix has three legitimate cells and one forbidden cell:

Lifecycle state	Meaning
(active, current)	A version is in force; no successor exists. New Cierres seal under it.
(inactive, superseded)	A version was replaced by an active successor in the same atomic Cabildo edit. Historical, queryable, no new writes.
(inactive, no current successor)	A version was deactivated without a successor; every version in the lineage is inactive. The lineage is dormant. Soft-delete.
(active, superseded)	Forbidden by the atomic-edits rule. Impossible to reach by construction.

Why this matters for regulators and customers. A regulator who asks "what did the books say in Q3 of 2026 under the methodology in force then?" gets an unambiguous answer regardless of how many methodology versions have come and gone since. A customer who asks "if we adopt v4 and later wish we hadn't, can we go back?" gets a precise answer: yes, by registering v5 whose rules mirror v3's, with the choice recorded as a deliberate act in the Cabildo. An auditor inspecting the Cabildo distinguishes supersessions (compound atomic edits) from soft-deletions (standalone deactivations) by event kind alone, without payload archaeology.

The model generalizes beyond Plan de Cuentas. Any versioned lineage in the platform — Mercado contracts, Sello signing keys, agent definitions, egress policies — inherits the same five rules. The methodology and versioning diagrams that accompany this paper render the worked t₁..t₄ example and the four-cell state matrix.

7. Three modes of truth

A natural question: why three ledgers, not one?

Because they record three different kinds of truth, and the kinds are not commutative.

The Pulpería holds observed truth — what was measured, what was reported, what arrived. A Posta is empirical: produced outside the platform, traveling inward through an adapter, carrying its own provenance about the world. Postas are atomic, single-version, and immutable.

The Contaduría holds derived truth — what was concluded from the empirical record under a stated methodology. An Asiento is interpretive: produced inside the platform by the Contador, addressing Postas by ID, never moving them. Asientos are version-aware: the same Postas may be re-interpreted under a new Plan de Cuentas, and both old and new Asientos coexist. Recomputation produces parallel tracks, never overwrites.

The Cabildo holds administrative truth — what was done to the system itself. A Cabildo entry is meta: it records configuration changes, authorizations, methodology transitions, exports, conflict resolutions. The Cabildo is the SOC 2 evidence layer; its retention is independent of the operational store; reads of the Cabildo are themselves Cabildo entries.

If a single ledger held all three, the disciplines would erode under operational pressure. A change in methodology would tempt re-derivation in place. An audit query against the operational store would commingle empirical and interpretive results. The evidence boundary for SOC 2 would blur into the data plane that customers query for analytics. The architecture's separation prevents these erosions by making them structurally impossible: the Pulpería cannot hold an Asiento, because Asientos do not belong there; the Contaduría cannot alter a Posta, because Postas live elsewhere; the Cabildo cannot be quietly trimmed, because every read is itself recorded.

Three, not one, because three commitments require three stores.

8. Compliance posture

El Mundo's compliance posture is SOC 2 by construction, not by audit-time bolt-on. The architecture's invariants — append-only ledgers, dual timestamps, original UoM preserved, full provenance, two-witness disagreements as first-class records, attested exports, idempotent forwarding — are the evidence the auditor asks for. Where the SOC 2 Type II observation period asks "what is your audit posture?", the platform answers "the Cabildo, default-deny per D-018, with a global must-not-exclude list, sealed by the Escribanía, archived in the Bóveda." Where the auditor asks "show me every Approver decision in the past 90 days," the answer is a Cabildo query.

Default-deny Cabildo coverage (D-018). Every event in the platform is a Cabildo event by default. Exclusions exist — high-cardinality routine reads, debug-level traces during incident response, health-check pings — but each exclusion is itself a Cabildo entry authored by an Approver, scoped, expiring, and rationale-bearing. RCI maintains a global must-not-exclude list (Plan de Cuentas transitions, Cierre signings, Mercado exports, Cartilla lifecycle, egress policy changes, Escribanía mode transitions, Sello key rotations) that no tenant can opt out of.

Escribanía Mode 1 default; Mode 2 opt-in per tenant from day one (D-019). Mode 1 is the floor of the platform's notarization commitment — every deployment, Pueblo or Campamento, runs Mode 1 from the moment of provisioning. Mode 1's tamper-evident hash chain is sufficient for SOC 2 baseline and for customers whose egress posture forbids outbound traffic to public chains. Mode 2 layers periodic Merkle anchoring to a public chain on top, enabling the verify-without-trusting-RCI property that some regulators (state-regulator inspector workflows, certain whitelabel SaaS customers) require. Mode 2 enabling is itself a Cabildo event, binding the opt-in act to the audit ledger.

Multi-jurisdictional scope. The Phase-0 pilot domains span multiple regulatory regimes — national upstream regulators, water-well / utility regulators in the methodology-adopter case, and the trans-jurisdictional concerns of multi-region customers federating across Pueblos via Correo Mayor (governance) and Diligencias (transport). Per-tenant retention is configurable to match.

Tenant isolation (D-003). Three shapes — shared (RLS) Pueblo, dedicated Pueblo, Campamento — give each customer the evidence boundary their auditor and regulator require, without forcing all customers into the same compliance shape. Tier promotions are themselves Cabildo entries; evidence accumulates at each tier.

Identity, with history (Padrón + Cartilla). The Padrón is the registry of who is enrolled — humans, agents, services, devices. The Cartilla is the credential each enrolled entity carries. The Cartilla is record-bearing in the architectural sense the historical document was record-bearing in colonial and republican-era Argentina: it accumulates the bearer's audit history through the Cabildo entries that reference it. An auditor inspecting a Cartilla can read the accumulated operational and administrative history of its bearer. A revoked Cartilla retains its history forever, but authors no further actions.

9. Why metaphor matters

The vocabulary of El Mundo — Mundo, Campo, Pueblo, Campamento, Baqueano, Aperos, Pulpería, Contaduría, Cabildo, Escribanía, Sello, Testimonio, Bóveda, Mercado, Posta, Asiento, Cierre, Plan de Cuentas — is not decorative. The names are the architecture in its most compressed form, and the source domain (the institutions of the 19th-century rural Argentine pueblo) was chosen for specific engineering reasons that an industry reader is entitled to understand.

A coherent vocabulary drawn from a single source domain does three things that ad-hoc vocabularies do not.

It encodes commitments rather than implementations. When an architect on the El Mundo team says Pulpería, they invoke the entire historical institution: a place where books are kept by a Pulpero who knows everyone's standing, where conflicts between two patrons' accounts are kept on the books as conflicts rather than averaged into a fictional consensus, where the books are append-only because a country storekeeper crossing out a line in the ledger would be accused of cheating. Renaming the implementation does not change what Pulpería means. The commitment travels with the name.

It generates new names organically. When a new architectural concern emerges — federation governance between regions, conflict resolution between disagreeing sensors, fleet command over many field deployments — the team does not invent a name. They look for the corresponding institution in the rural Argentine pueblo and adopt it: Correo Mayor for federation governance, Careo and Árbitro for conflict resolution, Capataz for fleet command. The metaphor is a generator. Its coherence is what makes new names predictable rather than arbitrary, and what prevents the N+1 architectural concern from being named after whatever framework the engineer happened to be reading about that week.

It resists the silent erosion of architectural commitments. A vocabulary like IngestService / DataLakeBronze / AuditMicroservice does not push back when commitments slip. A PulperíaService neologism does push back — because the concept of the books of the Pulpería and the Pulpero who keeps them is doing work in the engineer's head that "Service" is not. The lexicon's holism principle (the institution names the whole — store, API, governance, keeper — not a layer; disambiguation uses Spanish genitive constructions like the books of the Pulpería, not prefix/suffix neologisms) is itself an architectural commitment, expressed through naming.

The discipline of building software around a coherent metaphor drawn from a single, internally consistent source domain — and of treating that vocabulary as load-bearing rather than skinnable — is the subject of an IETF draft, draft-rodriguez-grana-metaphor-vocabularies (Rodriguez & Graña), which articulates the practice as a general method. El Mundo is one instance of the method; the draft describes others. We commend the draft to readers who find the lexicon-driven architecture compelling and want to understand the engineering theory behind it.

The narrative anchor for El Mundo is "We are the Ledger." In Spanish, "Resguardamos la Verdad." The pair is asymmetric on purpose: the English form makes an identity claim about the platform; the Spanish form makes a custodial claim about what the platform protects. Both are used verbatim, and neither is paraphrased into the other. Whoever owns the operational ledger of an industry owns the transaction layer that gets built on top of it. RCI's positioning is to be the boring authority — the place the operational reality of upstream oil & gas, geothermal, and completions lives, indisputably, regardless of which application happens to render it. The vocabulary is how that positioning becomes architecturally durable rather than rhetorically asserted.

10. Roadmap and call to action

Phase 1 — Oil & Gas Data Platform expansion + geothermal methodology adoption (D-005). Two design partnerships proceed in parallel.

Track A — Oil & Gas Data Platform expansion. Continued production operation and incremental expansion of the platform's coverage throughout 2026 and 2027 (additional capabilities across data masters, field reporting, AFE, Well File, and drilling-and-completions analytics). The El Mundo formalization — the lexicon-driven architecture, Mode 1 / Mode 2 notarization, the dual-mode Cierre cadence, the per-tenant Plan de Cuentas authoring patterns — is being incorporated as those constructs reach production readiness. Mode 1 is the operational floor; the operator's egress posture keeps Mode 2 declined for now.

Track B — Geothermal methodology adoption. A geothermal utility — a shallow-well, water-well-permitted, temperature-equalization project — adopts the methodology's record-keeping concepts for its own planning-and-reporting platform, without deploying the field tier. That track validates that the architecture's discipline transfers across industrial domains and regulatory regimes.

Phase 2 — frac pilots and Mode 2 generally available. The frac-completions pilots ship in Phase 2 across multiple jurisdictions, joining the Phase-1 pilots in production. Mode 2 graduates from opt-in-with-public-chain-pending to opt-in-with-public-chain-committed once the choice is made (candidates per D-019 include Energy Web X, Hedera + B4E, Polygon, Bitcoin via OpenTimestamps, or a permissioned alternative). OTA updates for Aperos with Approver gating, mTLS cert rotation automation, and FIDO2/WebAuthn for SOC-2-scoped human users land in Phase 2.

Phase 3 — multi-tenant scale and SOC 2 Type II audit. The Pueblo tier scales to many tenants per region; Pueblo de Houston, Pueblo de Buenos Aires, Pueblo de Madrid federate via Correo Mayor and Diligencias for customers operating across regions. The SOC 2 Type II audit — gap assessment, three-month observation window, formal report — runs to completion. The Bóveda's long-term retention model is exercised against its first migrations of aged-out Pulpería and Contaduría entries.

Call to action. This white paper is the strategic overview; the load-bearing detail lives in three places.

The lexicon — El Mundo Lexicon, the canonical vocabulary, where every term in this paper is defined with its historical antecedent, its architectural commitment, and its generative rules. Read it next if you found the vocabulary commitments interesting.
The IETF draft — draft-rodriguez-grana-metaphor-vocabularies — for the engineering theory of metaphor-driven vocabularies as a general practice. Read it if you want to understand why the method works rather than only that it does.
RCI — to discuss pilot scope, evaluate El Mundo against your operational data substrate requirements, or co-author the next regulatory-regime extension. Contact: pueblo@roderickc.com.

The platform is the place the data lives. We are the Ledger.

11. References

Lexicon. El Mundo Lexicon (canonical reference, internal). Version v2026-05-07. 32 architectural terms.

IETF drafts.

Rodriguez, R., and Graña, J. Metaphor-Driven Vocabularies for Software Architecture. Internet-Draft, draft-rodriguez-grana-metaphor-vocabularies-00.
Rodriguez, R., and Graña, J. El Mundo Lexicon. Internet-Draft, draft-rodriguez-grana-mundo-lexicon-01.

Decisions log (selected).

D-001 — Phase-0 design accommodates four concurrent pilots: a geothermal pilot, two frac-completions pilots in different jurisdictions, and a high-frequency wireline pilot.
D-003 — Hybrid tenant isolation: shared RLS, dedicated PostgreSQL, and Campamento.
D-004 — Canonical import-side reference: rci-ascii-to-mqtt v1.
D-005 — Phase 1 advances along two tracks in parallel: continued expansion of RCI's Oil & Gas Data Platform (substrate deployment) + geothermal methodology adoption (planning-and-reporting platform that uses the methodology's concepts without deploying the field tier).
D-006 — Field-tier mesh: NATS with JetStream for the Cuadrilla.
D-007 — Egress policy: config knob + nftables firewall enforcement on Aperos.
D-012, D-013, D-014 — Internal code names locked: El Mundo (platform), Baqueano (field tier), full lexicon adopted.
D-016 — Plan de Cuentas authoring authority: per-tenant choice of three patterns.
D-017 — Cierre cadence: dual-mode (event-driven + monthly calendar) by default.
D-018 — Cabildo coverage: default-deny, with global must-not-exclude list.
D-019 — Escribanía Mode 1 default; Mode 2 opt-in per tenant from day one.
D-020 — Lexicon update v2026-05-05 → v2026-05-06 (Secretario, three-ledger overview, consistency refinements).
D-021 — Lifecycle-state model for versioned lineages: at-most-one-active per lineage; supersession atomic; soft-delete derived; rollback as re-registration.

This paper is intended for publication at https://www.roderickc.com/pueblo/white-paper. Internal codenames are used throughout because the vocabulary is the architecture; commercial naming is a separate, deferred decision.

Download the white paper as Markdown