El Mundo · LinkedIn announcement
Industrial data platforms keep promising immutability and delivering "mostly immutable." At RCI we built a platform that means it. Records only append. Every record is attested cryptographically. Every derivation carries the methodology version that produced it, with no silent overwrites. We call it El Mundo. The name means the world, the whole substrate from sensor to ledger, and it's how we think the upstream and adjacent industries should keep their books.
The problem. Operational data platforms in upstream oil and gas, geothermal, frac completions, and wireline have a recurring pathology. Two sensors disagree, and the platform silently averages them. A methodology gets updated, and the old derivations are quietly recomputed under the new rules, or worse, overwritten in place. The audit trail is a feature you bolt on for SOC 2 season, not the structural backbone of the system. And the vocabulary the platform uses to describe itself, words like data lake, single source of truth, lakehouse, doesn't actually encode any commitments. You can call something a single source of truth and still mutate it on Tuesday. We are the Ledger. Our vocabulary, and the architecture under it, encode commitments that the platform cannot violate without breaking its own metaphor.
Three ledgers, kept distinct. El Mundo's cloud tier is built around three ledgers that only append, each cryptographically sealed, each recording a different kind of truth. The Pulpería is named for the frontier general store and tavern where the day's transactions were written into the diario. It records what was observed: every sensor reading, every manual gauge entry, every adapter event, with both source-asserted and receive timestamps preserved verbatim and original units of measurement intact. When two witnesses disagree, both readings are stored, linked, and flagged; nothing is silently averaged away. The Contaduría, the accounting house, records what was concluded: derived figures produced under a versioned methodology specification called a Plan de Cuentas, where each closing event, a Cierre, is sealed against a specific methodology version. The Cabildo takes its name from the colonial town council that kept the books of governance, and it records what was done to the system itself: every config change, every authorization, every methodology transition, every export. SOC 2 evidence is a natural read-out of this ledger, not a quarterly archaeology project.
A topology in two tiers. In the field, the Baqueano is our intelligence at the site. The name comes from the local guide who knew the terrain when no map existed. The Baqueano is a permanent software presence on the wellsite that decodes protocols, preserves provenance, and doesn't depend on a probe from the cloud to know what's happening. El Baqueano y sus Aperos: the Baqueano runs on its Aperos, the hardware kit comprising an embedded board, enclosure, antennas, sensor interfaces, and power conditioning. What the Baqueano reads becomes a Posta, our atomic unit of data, named for the horse that carried mail across the pampas through the chain of relay stations. Postas travel along Senderos, the trails of Starlink, customer WAN, cellular, and microwave, all secured with mTLS, toward either a Pueblo, our multi-tenant cloud operated by RCI, or a Campamento, a single-tenant on-prem deployment with its own private institutions for customers whose security posture forbids shared infrastructure or outbound traffic to public networks.
Methodology versioning that means it. The hard part of a ledger of derived data isn't writing the first version of the methodology. It's the second. Decision D-021 in our architecture log commits to five things: there is at most one active version of any methodology lineage at a time; supersession is atomic, so registering a new version and deactivating its predecessor commit together or not at all; soft deletion is a derived predicate, not a stored state; rollback is re-registration, meaning you cannot reactivate a superseded version, you register a new version whose rules mirror the old one, and the audit ledger records the deliberate choice; and active itself is derived from the Cabildo, never stored as a flag. There is no column anywhere in our schema that says "this methodology is current." The Cabildo says it, by what it does and does not contain. Skew between flag and ledger is not possible because there is no flag.
Why a vocabulary from the rural pueblo of Spain's colonies. Because a coherent metaphor produces names that encode commitments and generates new names organically as the architecture evolves. When we needed a name for the keeper of the audit ledger, we didn't invent one. We asked what the colonial Spanish-American town council called the person who recorded its acts, and the answer was Secretario. When we needed a resolver for disagreements between two witnesses, the juez de paz pattern was already there, and we named it Árbitro. The metaphor is a generator, not decoration. Ramon Rodriguez and María Paula Graña have written this argument up as an IETF draft, draft-rodriguez-grana-metaphor-vocabularies, proposing coherence of metaphor as a discipline for naming the components of a distributed system. The draft is linked from the white paper.
Why this matters. For operators, this means provenance you can hand to a regulator without trusting RCI. In our Mode 2 Escribanía, our notary configuration, every Testimonio, the verification artifact for the customer, carries a Merkle inclusion proof anchored to a public chain. Anyone can verify a Posta's integrity without our cooperation. For regulators, it means methodology changes that don't pretend the prior version didn't happen. The Asientos, the derived entries sealed under v1 of a Plan de Cuentas, remain queryable forever, even after v2 supersedes it, and the act of supersession is itself a permanent Cabildo entry with the responsible Approver's identity attached. For SOC 2 auditors, it means evidence collection is a query, not a scavenger hunt.
Where this comes from. El Mundo is RCI's formalization and expansion of the data governance concepts first implemented in our Data Platform for an Oil & Gas Operator. That platform is built from multiple components for the work of well construction, spanning data masters catalogs, field reporting data from both a legacy system over twenty years old and a new reporting system, AFE modeling, a Well File lifecycle system, and an analytics system for drilling and completions. The platform's seminal system became officially operational in May 2026 for all field types of operations in well construction, and continues to expand through 2026 and 2027. That platform was the first implementation of the ledgering approach above. El Mundo is the next step: a re-usable substrate that exposes those concepts as a coherent architecture available to additional industrial customers.
What's next. A second design partnership is in motion. A geothermal utility is adopting the methodology's record-keeping concepts for its own platform for planning and reporting, with shallow wells under permitting for water wells and a project for temperature equalization. They use the discipline without deploying our field tier. Resguardamos la Verdad: from the sensor on the wellhead to the Testimonio in the regulator's inbox, we are the substrate the data lives on, and we safeguard the operational truth that travels through it. We are looking for additional design partners across substrate deployments, methodology adoptions, or both, in industrial domains where the operational ledger needs to actually behave like a ledger.
Read the white paper: https://www.roderickc.com/pueblo/. The IETF draft on metaphor vocabularies is linked from the same page. Reach out: ramon.rodriguez@roderickc.com.
#UpstreamOilAndGas #IndustrialData #SOC2 #DataArchitecture #Geothermal #Provenance #Methodology