El Mundo · White Paper

RCI's platform for industrial operational data substrates, in upstream oil & gas, geothermal, and completions. A technical white paper for architects, decision-makers, and informed industry readers.

Draft. Lexicon version: el-mundo-lexicon v2026-05-07. Decisions referenced: D-001 through D-021.

1. Executive summary

We are the Ledger.

That is not a slogan. It is the architectural commitment that organizes everything that follows. El Mundo is RCI's formalization and expansion of the data governance concepts first implemented in our Data Platform for an Oil & Gas Operator. That platform is built from multiple components for the work of well construction. It spans data masters catalogs, field reporting data from both a legacy system over 20 years old and a new reporting system, AFE (Authorization for Expenditure) modeling, a Well File lifecycle system, and an analytics system for drilling and completions. The platform's seminal system became officially operational in May 2026 for all field types of operations in well construction, and the platform continues to expand through 2026 and 2027. That platform was the first implementation of the ledgering approach this paper describes. El Mundo is the next step: a re-usable substrate that exposes those concepts as a coherent architecture, available to additional industrial customers across upstream oil & gas, geothermal, and completions. It is built so that operational reality, once observed, is recorded once and recorded forever; so that any conclusion drawn from that record carries with it the methodology under which it was drawn; and so that any party who needs to verify what was recorded, whether a regulator, a counterparty, an internal auditor, or a future version of the operator themselves, can do so without having to trust RCI.

The platform is organized around three ledgers, each recording a different kind of truth and never silently merged with the others:

• A Pulpería, recording what was observed. Atomic unit: the Posta, a single sensor reading, form submission, or operational event, with both source-asserted and platform-receive timestamps preserved verbatim, original units of measurement preserved verbatim, and full provenance attached.
• A Contaduría, recording what was derived. Atomic unit: the Asiento, a value computed from one or more Postas under a versioned methodology specification called a Plan de Cuentas, sealed at periodic close events called Cierres. New methodology versions produce parallel Asientos, never overwrites.
• A Cabildo, recording what was done to the system itself: every configuration change, every authorization, every methodology transition, every export, every conflict resolution. The Cabildo is the SOC 2 evidence layer.

All three ledgers only append. All three are sealed by a cryptographic notary, the Escribanía, which produces a per-record signature called a Sello and verifiable artifacts called Testimonios that customers can validate. All three feed long-term retention in the Bóveda.

The platform spans two tiers. A Baqueano at the field side is the software, running on Aperos at the field side which are the hardware. The Baqueano observes the operational reality of a customer site and forwards Postas along Senderos, which are the wire transports, into a cloud-side Pueblo, a SaaS deployment with multiple tenants, or a Campamento, a single-tenant on-prem deployment. The cloud tier is where the three ledgers live.

This paper describes the substrate, the worked path of a single Posta from sensor to Testimonio, the lifecycle state model that disciplines methodology versioning, the compliance posture, and why the vocabulary, drawn from the institutions of the rural Argentine pueblo of the 19th century, is load-bearing rather than decorative.

2. The problem

Industrial data platforms in upstream oil & gas, geothermal, and completions face four problems that are usually addressed separately and consequently never addressed well.

Immutable provenance versus mutable methodology. The reading from a downhole gauge at 14:32:07 UTC on a Tuesday is a fact. The interpretation of that reading, what it means for stage volume allocation, for royalty calculation, for environmental reporting, depends on a methodology that may legitimately change next quarter. Most platforms either freeze the methodology and accumulate technical debt as the business changes, or mutate the historical record under a new methodology and lose the ability to answer "what did the books say in Q3 of 2026 under the methodology in force then?". Neither is acceptable to a regulator.

Compliance isolation across multiple tenants. A SaaS substrate that serves a high-frequency wireline operator, a methodology-adopting customer in another industrial domain, and a frac and completions service company must offer each of them an evidence boundary that satisfies their auditor and their regulator without leaking either way. A single shared cluster is too coarse; a wholly siloed deployment per customer is too expensive. Most platforms pick one and live with the consequences.

Silent reconciliation of conflicting readings. When two sensors observe the same physical phenomenon and disagree, say a memory gauge versus a surface readout, or an MWD pulse versus a wireline log, the engineering temptation is to average them, pick one, or quietly drop the outlier. That convenience erases the disagreement, which is itself a finding of operational consequence. A ledger that silently reconciles is not a ledger.

Vocabularies that fade with the architecture and don't encode commitments. Most industrial-data platforms accumulate names like IngestService, DataLakeBronze, AuditMicroservice, and KafkaTopicV2 that name implementations rather than commitments. When an architect says "audit microservice," nothing about the name tells the next architect whether it only appends, whether reads of the audit log are themselves logged, whether retention is independent of the operational store, whether it is the SOC 2 evidence layer or merely a debugging convenience. The vocabulary is decorative. Renames are cheap. Commitments leak away.

El Mundo addresses all four problems with the same architectural move: a small set of named institutions, each of which encodes a specific commitment, each of which corresponds to a specific historical role with a specific historical discipline, and none of which can be silently merged with another without violating the metaphor and the architecture simultaneously.

3. The El Mundo approach

El Mundo makes three commitments, supported by a topology in two tiers.

Three commitments

(1) Ledgers that only append. The three ledgers, whether observed, derived, or administrative, accept new entries; they never alter or erase old ones. A Posta written at the moment a sensor sampled is the Posta forever. An Asiento sealed under a Plan de Cuentas at a Cierre is the Asiento forever, even after the Plan de Cuentas itself has been superseded. A Cabildo entry is the Cabildo entry forever, including the Cabildo entry that records a tenant's later request to add an exclusion.

(2) Derivations versioned by methodology. When the methodology changes, whether through a new regulatory rule, a new business interpretation, or a new analytical model, a new Plan de Cuentas version is registered through the Cabildo, the predecessor is atomically deactivated, and the same operational data may be re-derived under the new methodology. Both the original Asientos and the re-derived Asientos coexist permanently. The platform never silently changes a methodology under a customer's feet. The lifecycle state model that governs this discipline is described in §6 and is committed in D-021.

(3) Exports attested cryptographically. Every export from the platform, whether to a customer's data lake, to a regulator's reporting system, or to a counterparty in a royalty dispute, passes through the Mercado, the surface for data exchange, under a contract that is itself recorded in the Cabildo, and carries a Testimonio the recipient can verify. In Mode 1, the platform default per D-019, the Testimonio is an internal certificate. In Mode 2, opt-in per tenant and also available from day one per D-019, the Testimonio includes a Merkle inclusion proof and a transaction hash on a public chain, which the recipient can verify without trusting RCI.

Topology in two tiers

The topology of El Mundo in two tiers, with the field tier or Campo on the left and the cloud tier or Pueblo or Campamento on the right, connected by Senderos, is rendered in the vocabulary scope and coherence diagram.

The field tier is the Campo, the customer's physical site. A Baqueano is the software in the field tier, named for the historical Argentine guide who lived in the terrain rather than being parachuted into it. It runs on Aperos, the hardware in the field tier: embedded board, antennas, sensor interfaces, power conditioning. The Baqueano observes operational reality through Rastros, its perceptive layer of protocol decoding, timestamp resolution, preservation of units of measurement, and assembly of provenance. Multiple Baqueanos at one site cooperate as a Cuadrilla, a peer mesh implemented over NATS clustering with JetStream (D-006), providing at-least-once delivery and idempotent replay across reconnections. Across many sites, a Capataz, the fleet-management agent, coordinates many Baqueanos vertically.

The cloud tier is the Pueblo, operated by RCI with multiple tenants on a SaaS deployment, or the Campamento, operated by the customer as a single tenant on-prem. Both are architecturally identical: the same institutions, the same disciplines, the same data shapes. The choice between them is a tenancy decision per D-003, which sets hybrid isolation: row-level security shared for small tenants, dedicated PostgreSQL for whitelabel and large operators, and full Campamento for customers requiring on-prem evidence boundaries.

Postas travel from Campo to Pueblo or Campamento along Senderos, the wire transport layer, agnostic of the transport at the application layer. Senderos may be Starlink, which is the default, or customer WAN, cellular, or microwave; the Posta does not know which Sendero it traveled. Egress is enforced by nftables on the Aperos under signed policy distributed by the Capataces (D-007); the firewall enforces, the application is not trusted to enforce.

4. The three ledgers in one diagram

The lexicon's structural commitment is that three ledgers only append: the Pulpería for what was observed, the Contaduría for what was derived, and the Cabildo for what was done to the system itself, all sealed by the Escribanía and feeding the Bóveda for long-term retention. This structure is rendered in the authority and provenance diagram.

The Pulpería is the operational ledger, named for the country general store and unofficial-official information hub of the rural Argentine pueblo, which kept the books that everyone in town referenced. Postas land here. They are validated, sealed by the Escribanía, and recorded as the canonical operational record. The Pulpería only appends: Postas are never altered, never deleted, only added. Disagreements between two witnesses, where two sensors observing the same phenomenon produce conflicting Postas, are recorded as both Postas linked together with the disagreement flagged, never silently reconciled. Resolution, if it comes, is a formal procedure called the Careo, ruled on by an Árbitro; the ruling is itself a Cabildo event.

The Contaduría is the corporate ledger, named for the colonial Spanish-American accountancy office, which read from the day-to-day books of the pulpería and produced balanced derivations under a chart of accounts. The Contaduría reads Postas from the Pulpería and produces Asientos, the derived entries, under a Plan de Cuentas, the chart of accounts or methodology specification. Each Plan de Cuentas is version-stamped and immutable per Cierre, the periodic close. When methodology changes, a new Plan de Cuentas version takes effect at the next Cierre forward; the prior version's Asientos remain queryable in perpetuity. Cierres operate in two modes per D-017: driven by events such as end of well, end of stage, or end of campaign, and driven by calendar on a monthly default. Authoring authority is configurable per tenant per D-016, with three patterns: Contador-only, Configurator-Contador-Approver, or pair-authoring.

The Cabildo is the audit ledger, named for the colonial-era town council, the seat of municipal authority where decisions of consequence were ratified and recorded in books distinct from the pulpería's commercial books. Every configuration change in the platform, every authorization granted, every methodology version registered, every export issued, every Careo resolved, every Cartilla revoked: every act upon the system is recorded in the Cabildo. Coverage defaults to deny per D-018: every event is a Cabildo event unless an Approver authors a scoped, expiring exclusion, which is itself a Cabildo event. A global list of event types may never be excluded, covering Plan de Cuentas transitions, Cierre signings, exports, Cartilla lifecycle, changes to egress policy, and transitions of the Escribanía's mode. This global list applies to all tenants.

All three ledgers are sealed by the Escribanía, the cryptographic notary, which applies a Sello, a signature per record linking entries into a tamper-evident chain. All three feed the Bóveda, the long-term archive, once active retention windows close; Sellos travel with records into the Bóveda, and Testimonios over Bóveda records remain producible.

The keepers (Pulpero, Contador, Secretario, Escribano, Archivero) are role names in the codebase and in operational discourse. The architecture's discipline is that the Secretario records the act in the Cabildo's books; the Escribano seals it cryptographically. One institution, one keeper, no conflation.

5. A worked example: a CCL Posta from sensor to Testimonio

To make the architecture concrete, follow a single Posta from a sensor in the Campo to a Testimonio handed to a regulator. Use the high-frequency wireline pilot context (D-005, D-010): a Casing Collar Locator service running at high-frequency acquisition, ≥1 kHz up to 25 kHz top-end, on an upstream operator's well, under a national upstream regulatory regime.

At t₀, observation in the Campo. A wireline tool string at ~3,200 m measured depth produces a magnetic-anomaly reading at the moment the tool passes a casing collar joint. The Aperos's serial interface receives the bytes; the Baqueano decodes them through its CCL adapter, which is a generalization of the rci-ascii-to-mqtt v1 pattern (D-004). The Baqueano resolves three things on the spot: the timestamp asserted by the source, called t_source and taken from the tool's clock; the receive timestamp at the Baqueano, called t_recv_field and taken from the Aperos's PTP-synced clock; and the original unit of measurement, unit_code. It assembles a Posta envelope:

{ tenant_id: "ccl-pilot-01",
  source_id: "tool_ccl_serial_0042",
  stream_id: "ccl_magnetic_anomaly",
  t_source: "2026-05-02T14:32:07.0431-03:00",
  t_recv_field: "2026-05-02T14:32:07.0438-03:00",
  value_num: 1.247,
  unit_code: "mV",
  provenance: { adapter: "ccl-serial", adapter_version: "1.3.2",
                source_uri: "serial:///dev/ttyUSB0",
                ingest_node: "baqueano-ccl-01",
                request_id: "01HXK3...", payload_sha256: "..." } }

Both timestamps are preserved; the original mV value is preserved with no silent conversion to engineering units; full provenance travels with the datum.

At t₀+δ, transit along Senderos. The Posta is published to a NATS subject (D-006); JetStream provides at-least-once delivery and dedup keyed on (tenant_id, source_id, request_id). The Sendero that day is Starlink, the default; had Starlink been degraded, the Cuadrilla would have relayed via a peer Baqueano on customer WAN. The Posta travels under mTLS, with the Baqueano's client certificate bound to its Aperos's TPM 2.0 chip.

At t₁, arrival at the Pulpería. The Posta lands in Pueblo de Buenos Aires's Pulpería. The operator is a Pueblo-dedicated tenant under D-003, with its own dedicated PostgreSQL instance. The Escribanía applies a Sello, linking the Posta into the tamper-evident chain. The Pulpería writes the row, only appending. A Cabildo entry, posta_arrival, records the act.

At t₂, derivation in the Contaduría. The operator's Contaduría runs under a Plan de Cuentas version ccl-pdc/v3 whose rules aggregate raw mV samples into depth corrections per collar joint under the operator's standard interpretation methodology. At end of run, when the wireline operation completes and an event-driven Cierre fires per D-017, the Contador derives the Asientos for this run. Each Asiento references the Posta IDs it derives from; it never copies the Posta content. The Asiento carries the Plan de Cuentas version, the Cierre under which it was sealed, the Contador's Cartilla, and the methodology trace. The Cierre itself is signed by an Approver, since the operator selected the Configurator-Contador-Approver pattern at provisioning per D-016; the signing is a Cabildo event sealed by the Escribanía.

At t₃, export to the regulator. Six weeks later, the national upstream regulator requests a regulatory submission for the Q1 production allocation. The operator's compliance team executes a Mercado contract that exports the relevant Asientos, and at the regulator's option the underlying Postas, to the regulator's reporting system. The Mercado records the contract execution as a Cabildo event, mercado_export, which sits in the list that may never be excluded. Each exported record carries a Testimonio: in this operator's case the Testimonio is an internal certificate signed by the Escribanía's Ed25519 key, because the operator runs Mode 1 default per D-019 since its egress posture forbids outbound traffic to public chains. The Testimonio names the neighbors in the Sello-chain so the regulator can request adjacent records and verify the chain's integrity end-to-end.

A regulator inspecting that submission can query, at any later point: "Which Plan de Cuentas version produced these Asientos?" and "What were the underlying Postas, and what were their original units of measurement, original timestamps, and adapter provenance?" The answers are deterministic, signed, and queryable forever, including after the operator has authored a ccl-pdc/v4 and re-derived a parallel set of Asientos under it.

The same shape, in the geothermal pilot, would produce a Mode 2 Testimonio, opt-in per D-019 once a choice of public chain is committed: the state regulator's inspector verifies the Merkle inclusion proof against the transaction hash on the public chain, and confirms the Posta's authenticity without trusting RCI.

6. Methodology versioning (D-021)

Methodology changes. Regulations evolve; business interpretations refine; analytical models improve. The platform's commitment is that methodology change must never silently rewrite history. D-021, the lifecycle state model, encodes that commitment in five rules.

(1) active is an attribute derived from the Cabildo, not a stored flag. Whether a given Plan de Cuentas version is currently active is computed by walking the Cabildo for registration and deactivation entries pertaining to that version. There is no active column on the Plan de Cuentas table, no flag elsewhere. The Cabildo is the sole source of truth.

(2) At most one version of a lineage may be active at any time. Within a lineage, say the methodology for production-volume aggregation for Pueblo de Houston's frac and completions tenants, the active set has cardinality 0 or 1. Never 2.

(3) Supersession and deactivation are decoupled events but must occur atomically when a successor is registered. A new Plan de Cuentas version that supersedes a predecessor is registered in one Cabildo entry, of kind plan_de_cuentas_supersession, whose effect is compound: register-and-activate the new version and deactivate the predecessor. There is no intermediate state in which both are active; the atomicity is what enforces rule 2.

(4) Soft deletion is a derived predicate, not a stored state. A version is "soft-deleted" if and only if it is inactive and every version in its lineage is inactive. The condition is computed from the Cabildo, never stored. The discipline that only appends is preserved: dormant Asientos remain queryable for audit under the methodology in force when sealed; the lineage simply stops accepting new Cierres.

(5) Rollback is re-registration, not reactivation. A superseded version cannot be reactivated. To return to v1's rules after v2 has been in force, register a new v3 whose computation rules mirror v1's, atomically deactivating v2. The old v1 track stays, inactive and superseded by v2; a fresh v3 track begins. The Cabildo records a deliberate choice with its own version stamp, not a silent reversion that pretends v2 didn't happen.

The four-cell state matrix has three legitimate cells and one forbidden cell:

Why this matters for regulators and customers. A regulator who asks "what did the books say in Q3 of 2026 under the methodology in force then?" gets an unambiguous answer regardless of how many methodology versions have come and gone since. A customer who asks "if we adopt v4 and later wish we hadn't, can we go back?" gets a precise answer: yes, by registering v5 whose rules mirror v3's, with the choice recorded as a deliberate act in the Cabildo. An auditor inspecting the Cabildo distinguishes supersessions, which are compound atomic edits, from soft deletions, which are standalone deactivations, by event kind alone, without payload archaeology.

The model generalizes beyond Plan de Cuentas. Any versioned lineage in the platform, whether Mercado contracts, Sello signing keys, agent definitions, or egress policies, inherits the same five rules. The diagrams that accompany this paper on methodology and versioning render the worked t₁..t₄ example and the four-cell state matrix.

7. Three modes of truth

A natural question: why three ledgers, not one?

Because they record three different kinds of truth, and the kinds are not commutative.

The Pulpería holds observed truth: what was measured, what was reported, what arrived. A Posta is empirical, produced outside the platform, traveling inward through an adapter, carrying its own provenance about the world. Postas are atomic, single-version, and immutable.

The Contaduría holds derived truth: what was concluded from the empirical record under a stated methodology. An Asiento is interpretive, produced inside the platform by the Contador, addressing Postas by ID, never moving them. Asientos are version-aware: the same Postas may be re-interpreted under a new Plan de Cuentas, and both old and new Asientos coexist. Recomputation produces parallel tracks, never overwrites.

The Cabildo holds administrative truth: what was done to the system itself. A Cabildo entry is meta: it records configuration changes, authorizations, methodology transitions, exports, conflict resolutions. The Cabildo is the SOC 2 evidence layer; its retention is independent of the operational store; reads of the Cabildo are themselves Cabildo entries.

If a single ledger held all three, the disciplines would erode under operational pressure. A change in methodology would tempt re-derivation in place. An audit query against the operational store would commingle empirical and interpretive results. The evidence boundary for SOC 2 would blur into the data plane that customers query for analytics. The architecture's separation prevents these erosions by making them structurally impossible: the Pulpería cannot hold an Asiento, because Asientos do not belong there; the Contaduría cannot alter a Posta, because Postas live elsewhere; the Cabildo cannot be quietly trimmed, because every read is itself recorded.

Three, not one, because three commitments require three stores.

8. Compliance posture

El Mundo's compliance posture is SOC 2 by construction, not bolted on at audit time. The architecture's invariants are the evidence the auditor asks for: ledgers that only append, dual timestamps, original units of measurement preserved, full provenance, disagreements between two witnesses as first-class records, exports that are attested, and idempotent forwarding. Where the SOC 2 Type II observation period asks "what is your audit posture?", the platform answers "the Cabildo, defaults to deny per D-018, with a global list of event types that may never be excluded, sealed by the Escribanía, archived in the Bóveda." Where the auditor asks "show me every Approver decision in the past 90 days," the answer is a Cabildo query.

Cabildo coverage defaults to deny (D-018). Every event in the platform is a Cabildo event by default. Exclusions exist, such as routine reads of high cardinality, debug-level traces during incident response, and pings for health checks, but each exclusion is itself a Cabildo entry authored by an Approver, scoped, expiring, and bearing a rationale. RCI maintains a global list of event types that may never be excluded, covering Plan de Cuentas transitions, Cierre signings, Mercado exports, Cartilla lifecycle, changes to egress policy, transitions of the Escribanía's mode, and rotations of Sello signing keys. No tenant can opt out of this list.

Escribanía Mode 1 default; Mode 2 opt-in per tenant from day one (D-019). Mode 1 is the floor of the platform's notarization commitment: every deployment, Pueblo or Campamento, runs Mode 1 from the moment of provisioning. Mode 1's tamper-evident hash chain is sufficient for SOC 2 baseline and for customers whose egress posture forbids outbound traffic to public chains. Mode 2 layers periodic Merkle anchoring on a public chain on top, enabling the property of verification without trust in RCI that some regulators require, including workflows for state regulator inspectors and certain whitelabel SaaS customers. Enabling Mode 2 is itself a Cabildo event, binding the opt-in act to the audit ledger.

Scope across multiple jurisdictions. The Phase-0 pilot domains span multiple regulatory regimes: national upstream regulators, water-well or utility regulators in the case of the methodology adopter, and the trans-jurisdictional concerns of customers in multiple regions federating across Pueblos via Correo Mayor for governance and Diligencias for transport. Retention per tenant is configurable to match.

Tenant isolation (D-003). Three shapes are available: shared Pueblo with row-level security, dedicated Pueblo, and Campamento. They give each customer the evidence boundary their auditor and regulator require, without forcing all customers into the same compliance shape. Promotions between tiers are themselves Cabildo entries; evidence accumulates at each tier.

Identity, with history: Padrón and Cartilla. The Padrón is the registry of who is enrolled: humans, agents, services, devices. The Cartilla is the credential each enrolled entity carries. The Cartilla is record-bearing in the architectural sense the historical document was record-bearing in colonial and republican-era Argentina: it accumulates the bearer's audit history through the Cabildo entries that reference it. An auditor inspecting a Cartilla can read the accumulated operational and administrative history of its bearer. A revoked Cartilla retains its history forever, but authors no further actions.

9. Why metaphor matters

The vocabulary of El Mundo, which includes Mundo, Campo, Pueblo, Campamento, Baqueano, Aperos, Pulpería, Contaduría, Cabildo, Escribanía, Sello, Testimonio, Bóveda, Mercado, Posta, Asiento, Cierre, and Plan de Cuentas, is not decorative. The names are the architecture in its most compressed form, and the source domain, the institutions of the rural Argentine pueblo of the 19th century, was chosen for specific engineering reasons that an industry reader is entitled to understand.

A coherent vocabulary drawn from a single source domain does three things that ad-hoc vocabularies do not.

It encodes commitments rather than implementations. When an architect on the El Mundo team says Pulpería, they invoke the entire historical institution: a place where books are kept by a Pulpero who knows everyone's standing, where conflicts between two patrons' accounts are kept on the books as conflicts rather than averaged into a fictional consensus, where the books only append because a country storekeeper crossing out a line in the ledger would be accused of cheating. Renaming the implementation does not change what Pulpería means. The commitment travels with the name.

It generates new names organically. When a new architectural concern emerges, whether federation governance between regions, conflict resolution between disagreeing sensors, or fleet command over many field deployments, the team does not invent a name. They look for the corresponding institution in the rural Argentine pueblo and adopt it: Correo Mayor for federation governance, Careo and Árbitro for conflict resolution, Capataz for fleet command. The metaphor is a generator. Its coherence is what makes new names predictable rather than arbitrary, and what prevents the N+1 architectural concern from being named after whatever framework the engineer happened to be reading about that week.

It resists the silent erosion of architectural commitments. A vocabulary like IngestService / DataLakeBronze / AuditMicroservice does not push back when commitments slip. A PulperíaService neologism does push back, because the concept of the books of the Pulpería and the Pulpero who keeps them is doing work in the engineer's head that "Service" is not. The lexicon's holism principle is itself an architectural commitment, expressed through naming: the institution names the whole, including store, API, governance, and keeper, not a layer; disambiguation uses Spanish genitive constructions like the books of the Pulpería, not prefix or suffix neologisms.

The discipline of building software around a coherent metaphor drawn from a single, internally consistent source domain, and of treating that vocabulary as load-bearing rather than skinnable, is the subject of an IETF draft, draft-rodriguez-grana-metaphor-vocabularies by Rodriguez and Graña, which articulates the practice as a general method. El Mundo is one instance of the method; the draft describes others. We commend the draft to readers who find the architecture driven by the lexicon compelling and want to understand the engineering theory behind it.

The narrative anchor for El Mundo is "We are the Ledger." In Spanish, "Resguardamos la Verdad." The pair is asymmetric on purpose: the English form makes an identity claim about the platform; the Spanish form makes a custodial claim about what the platform protects. Both are used verbatim, and neither is paraphrased into the other. Whoever owns the operational ledger of an industry owns the transaction layer that gets built on top of it. RCI's positioning is to be the boring authority: the place the operational reality of upstream oil & gas, geothermal, and completions lives, indisputably, regardless of which application happens to render it. The vocabulary is how that positioning becomes architecturally durable rather than rhetorically asserted.

10. Roadmap and call to action

Phase 1: Oil & Gas Data Platform expansion plus geothermal methodology adoption (D-005). Two design partnerships proceed in parallel.

Track A: Oil & Gas Data Platform expansion. Continued production operation and incremental expansion of the platform's coverage throughout 2026 and 2027, with additional capabilities across data masters, field reporting, AFE, Well File, and the analytics system for drilling and completions. The El Mundo formalization is being incorporated as those constructs reach production readiness: the architecture driven by the lexicon, Mode 1 and Mode 2 notarization, the Cierre cadence across both modes, and the patterns for authoring a Plan de Cuentas per tenant. Mode 1 is the operational floor; the operator's egress posture keeps Mode 2 declined for now.

Track B: Geothermal methodology adoption. A geothermal utility, a project with shallow wells under permitting for water wells and focused on temperature equalization, adopts the methodology's record-keeping concepts for its own platform for planning and reporting, without deploying the field tier. That track validates that the architecture's discipline transfers across industrial domains and regulatory regimes.

Phase 2: frac pilots and Mode 2 generally available. The frac and completions pilots ship in Phase 2 across multiple jurisdictions, joining the Phase-1 pilots in production. Mode 2 graduates from an opt-in posture with the public chain pending to an opt-in posture with the public chain committed once the choice is made. Candidates per D-019 include Energy Web X, Hedera plus B4E, Polygon, Bitcoin via OpenTimestamps, or a permissioned alternative. OTA updates for Aperos with Approver gating, automation for mTLS certificate rotation, and FIDO2 / WebAuthn for human users within SOC 2 scope all land in Phase 2.

Phase 3: multi-tenant scale and SOC 2 Type II audit. The Pueblo tier scales to many tenants per region; Pueblo de Houston, Pueblo de Buenos Aires, and Pueblo de Madrid federate via Correo Mayor and Diligencias for customers operating across regions. The SOC 2 Type II audit runs to completion: gap assessment, an observation window of three months, and the formal report. The Bóveda's long-term retention model is exercised against its first migrations of aged-out Pulpería and Contaduría entries.

Call to action. This white paper is the strategic overview; the load-bearing detail lives in three places.

• The lexicon, El Mundo Lexicon, the canonical vocabulary, where every term in this paper is defined with its historical antecedent, its architectural commitment, and its generative rules. Read it next if you found the vocabulary commitments interesting.
• The IETF draft, draft-rodriguez-grana-metaphor-vocabularies, for the engineering theory of vocabularies driven by metaphor as a general practice. Read it if you want to understand why the method works rather than only that it does.
• RCI, to discuss pilot scope, evaluate El Mundo against your operational data substrate requirements, or co-author the next extension to a regulatory regime. Contact: pueblo@roderickc.com.

The platform is the place the data lives. We are the Ledger.

11. References

Lexicon. El Mundo Lexicon, the canonical reference, internal. Version v2026-05-07. 32 architectural terms.

IETF drafts.

• Rodriguez, R., and Graña, J. Vocabularies Driven by Metaphor for Software Architecture. Internet-Draft, draft-rodriguez-grana-metaphor-vocabularies-00.
• Rodriguez, R., and Graña, J. El Mundo Lexicon. Internet-Draft, draft-rodriguez-grana-mundo-lexicon-01.

Decisions log, selected entries.

• D-001 · Phase 0 design accommodates four concurrent pilots: a geothermal pilot, two frac and completions pilots in different jurisdictions, and a high-frequency wireline pilot.
• D-003 · Hybrid tenant isolation: shared RLS, dedicated PostgreSQL, and Campamento.
• D-004 · Canonical import-side reference: rci-ascii-to-mqtt v1.
• D-005 · Phase 1 advances along two tracks in parallel: continued expansion of RCI's Oil & Gas Data Platform as substrate deployment, plus geothermal methodology adoption as a platform for planning and reporting that uses the methodology's concepts without deploying the field tier.
• D-006 · Mesh in the field tier: NATS with JetStream for the Cuadrilla.
• D-007 · Egress policy: a config knob plus enforcement by the nftables firewall on Aperos.
• D-012, D-013, D-014 · Internal code names locked: El Mundo as platform, Baqueano as field tier, full lexicon adopted.
• D-016 · Plan de Cuentas authoring authority: per-tenant choice of three patterns.
• D-017 · Cierre cadence: two modes, driven by events plus monthly calendar, by default.
• D-018 · Cabildo coverage defaults to deny, with a global list of event types that may never be excluded.
• D-019 · Escribanía Mode 1 default; Mode 2 opt-in per tenant from day one.
• D-020 · Lexicon update v2026-05-05 to v2026-05-06: Secretario, three-ledger overview, consistency refinements.
• D-021 · Lifecycle state model for versioned lineages: at most one active per lineage; supersession atomic; soft deletion derived; rollback as re-registration.

This paper is intended for publication at https://www.roderickc.com/pueblo/white-paper. Internal codenames are used throughout because the vocabulary is the architecture; commercial naming is a separate, deferred decision.