Skip to content
Embabel Worlds

visibility: public — a world's mirror, and why the scope differs from reference/

A mirrored public dataset belongs to no user: its only writer is the source’s ingestion, not a person. A source that declares visibility: public therefore opens its label, and its anchor’s label, in the world that installs the realm. The records its ingestion writes there carry the Public label and the world they were mirrored for, and the scope rewriter reads them without a per-user predicate — the same treatment as a REFERENCE taxonomy, for a very different kind of data.

The distinction matters operationally even though the scoping is identical. A reference/ vocabulary is a handful of curated nodes, seeded, static, safe to wipe and rebuild, small enough to project into a prompt. A mirrored public dataset is hundreds of thousands of rows with a refresh cycle, a staleness window, and an ingestion job as its only legitimate writer. Treating them as one thing invites a factory reset that deletes the register, or a schema projection that inlines it.

The declaration is narrow, and the engine holds it there:

  • It takes effect only in the world that installs the realm. A label name is not a namespace: another world’s Customer may be its owner’s private CRM records, or a mirror of a different feed. Everywhere else the label keeps its ordinary scope. A world has one owner, so the mirrored records are readable by that owner and by everything acting in the world for them — chat, handlers, routines and agents — and by no other user. Removing the realm withdraws the declaration: once the world is rebuilt without it, the label is private again there too.
  • It opens only what ingestion wrote. In the declaring world, MATCH (c:Customer) answers the source’s mirrored records and the caller’s own Customer records. It never answers another user’s, and never another world’s mirror filed under the same label: a declaration makes no user-owned node readable.
  • A source may not open a label somebody else declares. A source whose label, or anchor label, is declared by another realm installed in the world, or by the world’s own types, is refused at load and named in the realm’s status, and nothing it declares takes effect. A label the platform itself scopes private or organization-shared is never opened.
  • Each world keeps its own mirror and coverage. Two worlds that install a realm with the same public source each walk it and hold their own copy, merged on the record’s identity and the world, so neither can read or rewrite the other’s. A field in a fetched record that claims to name the world is dropped. Coverage is kept per world, source and partition. There is no mirror shared across worlds.
  • Only ingestion writes Public. Public and Coverage are reserved to the platform’s own writers. A realm type, a realm provenance label, a DERIVE head, a projection’s hub: or target:, and any record a query fetches or materializes cannot carry either label. A type name, provenance label or rule set naming one is a load problem; a projection naming one is no spine; and a query that would materialize a node carrying one is refused.
  • Public is opt-in per label and never inferred. The rewriter’s default stays fail-closed at PRIVATE, and a label no source in the world declares public is private.