Open source
SPEC 00The principles, the refusals,
and the paperwork that locks them in.
Open source is not the distribution model here; it is the trust model. This page holds the principles the project is built on, the things it will refuse to build, the spec library everything traces to, and the governance that stops any of it quietly changing.
Principles
SPEC 00 §1Six sentences the rest of the project is derived from.
- 01
Acknowledge locally before forwarding.
The write path begins with a local write-ahead log, then forwards idempotently and reconciles after interruption. Resilience is a mechanism to test, not an adjective to repeat.
- 02
Never invent one.
Interpolating over an outage manufactures evidence; a gap in the record is information, and the system keeps it.
- 03
The truth carries its provenance.
An aggregate without its data-quality fraction is a guess wearing a suit, so every result ships with its confession attached.
- 04
Exit is a feature.
A system you cannot leave is a system you cannot trust, so the storage format is open and the export path is tested like any other feature.
- 05
The API is the product; the UI is a client.
Anything the portals can do, your code can do, because the portals have no private staircase into the archive.
- 06
Specs before code.
Behaviour is written down and argued about before it is implemented, so the documentation is the design rather than an apology for it.
Non-goals
SPEC 00 §4 · non-goalsWhat this project will refuse to build — kept public, with reasoning, so you can hold us to it.
Most vendor promises decay one product meeting at a time. These are not promises; they are locked in the governance documents, and changing any of them requires a supermajority and a public comment period.
No silent lossy compression.
If data is ever thinned, a human wrote the lifecycle policy that did it, the policy is versioned and audited, and every query over an affected range says so. Compression you cannot see is loss you cannot argue with.
status: governance-locked
No tag-count licensing.
Metering series punishes good instrumentation — the better an engineer does their job, the bigger the invoice. We refuse to price against the product's own purpose.
status: governance-locked
No telemetry.
The product phones home to nobody, and this is verifiable in source. OT networks should not have to firewall their own historian.
status: governance-locked
No proprietary formats.
Cold data is documented Apache Parquet in an open layout. An open format means your archive outlives any vendor decision — including ours.
status: governance-locked
No SSO tax.
OIDC single sign-on is in the free core, because charging extra for security is charging extra for the product working properly.
status: governance-locked
No invented values, no auto-insights.
A historian records what happened. It does not interpolate over outages, guess at gaps, or generate conclusions it cannot source point by point.
status: governance-locked
The spec library
SPEC 00Specs first, code second. Fourteen documents define the system today; two more are staged for the future.
| spec | title | scope |
|---|---|---|
| 00 | Principles & non-goals | The governing principles, the canonical quality and lint tables, and what the project refuses to build |
| 01 | Identity & model | UUID identity, templates, composition and views, registries, units and typed topology links |
| 02 | Ingestion contract | Collectors, the write protocol, store-and-forward buffering, quality mapping, backpressure |
| 03 | Storage & retention | Chunk format, tiering, the open Parquet cold tier, lifecycle policies and failure testing |
| 04 | Query semantics | The read contract: value and aggregation semantics, provenance, and the PI-compatibility mode |
| 05 | Calc engine | Expression and WASM tiers, enforced determinism, the dependency graph, backfill and recomputation |
| 06 | Annotations | One annotation primitive for series, spans, assets, episodes and displays, with its query surface |
| 07 | Episodes | Batches, downtime and campaigns as one primitive: templates, genealogy, S88 nesting, time-slicing |
| 08 | Human-origin data | Manual entry, bulk import, amendment jobs and approval chains — labelled at point level, forever |
| 09 | Visualisation | OrdinateDB visualisation: the instrument-grade design system, generated displays and honesty rendering |
| 10 | Identity & access | OIDC identity, roles and capabilities, allow-only scopes, sessions, tokens and audit |
| 11 | Admin portal | Model editor, registries, jobs, the lint centre, and the AF import / PI extraction workbench |
| 12 | Notifications | Delivery of events the platform already detects: channels, subscriptions, flood control |
| 13 | Public API | One public surface: REST, streaming, gRPC ingest and ordctl, with versioning and deprecation |
| F1 | Foresightfuture | A prediction service configured from the model itself — forecasts, recipes and scenarios |
| F2 | UNS publishingfuture | A collector-shaped publisher pushing model-governed topics and payloads to the broker |
Every claim on this website cites one of these.
Governance
Fast where it can be, deliberately slow where it must be.
Decisions happen in public RFCs.
Behaviour changes start as an RFC in the open repository, argued in public, merged into the specs before any code lands. There is no private roadmap that outranks the public one.
The non-goals have brakes.
The project runs as BDFL-with-brakes: a maintainer can decide most things quickly, but the non-goals are the exception — changing any of them requires a supermajority of the steering group and a public comment period. Speed for the reversible, friction for the irreversible.
The trademark is held by the project.
The name cannot be sold out from under the code. If a company someday steers development, the mark and the specs stay with the project.
Licence
Apache-2.0. Chosen for the paperwork, not the ideology.
Apache-2.0 carries an explicit patent grant, and every corporate legal department already knows how to approve it — a historian that takes six months to clear legal review is a historian that never gets installed. Contributions are DCO sign-off only: no CLA, no copyright assignment, no surprise clause that lets anyone relicense your work later.
the full text lives in the repository, where it cannot quietly differ from this summary.