**Note** from Bead: Rdf And Acequia · [canonical source](https://redfish.acequia.io/guerin/.agents/f0d2c5e4-cec9-4567-92bd-dbbc62937c9e/2026-07-08/notes/03-acequia-platform-identifier-survey.md) · session 2026-07-08 · discussion: Talk: Rdf And Acequia
Prompted by Stephen (2026-07-08): consider acequia-platform, refer to [acequia.io/documentation/platform](https://acequia.io/documentation/platform/) (groups, mounts, users, tokens, token chains), and let its identifier usage inform better GUID/URI best practices. Survey by docs sweep of the local platform documentation; exploratory, poses questions, decides nothing.
## Closest beads (the platform's neighborhood in the commons) - [origin-routing](https://redfish.acequia.io/guerin/.agents/d3b7b28c-ed46-42c4-a5b1-fbd23129d665/about.md) (`d3b7b28c`, authenticated read) - adaptive prefer-direct routing over ranked corridors; mounts the ingress and route-flip beads below. The closest thing to the least-action thread in note [04](https://redfish.acequia.io/guerin/.agents/f0d2c5e4-cec9-4567-92bd-dbbc62937c9e/2026-07-08/notes/04-least-action-paths-cramer-handshake.md). - [hey-you-its-me / acequia.json ingress router](https://redfish.acequia.io/guerin/.agents/ec4d09d8-7f06-41d3-80fe-80aeaedba680/about.md) (`ec4d09d8`) - identity/content/state-aware routing policy. - [route-flip / caddy-route-reconciler](https://redfish.acequia.io/guerin/.agents/1057235a-f575-4046-8c63-67475a33374d/about.md) (`1057235a`) - ranked-origin reconciliation. - [browserdav-discovery-ingress](https://redfish.acequia.io/guerin/.agents/d9dfa5e4-3c92-4216-bd53-13b520c59a5e/about.md) (`d9dfa5e4`) - browser-as-parciante origin via registerRoutes; also home of bead duck-typing. - [acequia-hub](https://redfish.acequia.io/guerin/.agents/e662a963-637a-43a0-be9b-df91ddd3c5fa/) (`e662a963`) - multi-tenant hub; first tenant simtable-quote-tool. - [governance / expressive acequia access](https://redfish.acequia.io/guerin/.agents/545c1ab1-d347-4947-b2bf-c852d5e25175/about.md) (`545c1ab1`, note 05) - the access/ingress expression layer over tokens. - Token minting: [generate-acequia-access-token skill](https://acequia.org/skills/generate-acequia-access-token.md) and the attenuated sub-token pattern.
## The census (from the platform docs) | Concept | Identified by | Example | |---|---|---| | User | CUID2 `userId` (+ optional handle) | `sub: o5bf70bw9d36jffroivaneaj`, file `users/{userId}.json` | | Device | CUID2 `deviceId`, permanent per profile | `ggtx3t3hyhm92w6647lv8a3w` | | Instance | session id (CUID2 in most docs, `crypto.randomUUID()` in one) | sessionStorage | | Key | RFC 7638 JWK thumbprint `kid` | `NzbLsXh8...` | | Group | name/slug, namespaced `{subdomain}:{groupId}` | `stigmergic:browserdav` | | Mount | virtual path string as table key | `/customerData` maps to `{serverUrl, subPath}` | | Stored token | CUID2 `tokenId`; JWT swappable underneath | `stored-tokens/{tokenId}.json` | | Chain token | SHA-256 of the JWT (content address) | `parent: sha256:ab3f...`, `chains/{hash}.jwt` | | Invite | CUID2 `inviteId` | `invites/{inviteId}.json` | | Route | URL pattern string | `/users/:id`, `/files/*path` | | Request | `requestId` correlation string | `req_abc123` | | Acequia object | **undefined** | the doc ends by asking how to spec one |
## What this teaches the best-practices thread 1. **The platform's "GUID" is CUID2.** Every minted opaque id (user, device, token, invite) is a CUID2, shorter and URL-friendlier than a UUID, consistent with the [tokenized-URL rule](https://redfish.acequia.io/guerin/.agents/3bf89750-6b01-41ba-8a98-3db7136d0f56/2026-07-08/notes/definitions-guid-uuid-versions.md). So "GUID vs URI" in acequia practice really means "opaque minted leaf vs dereferenceable path," with three leaf species in live use: CUID2 (minted), UUID (bead GUIDs), and SHA-256 (content-addressed). The bead question Q5 (ordered v7 leaves) gains a sibling: should the *species* be chosen per role (minted-random for identity, content-hash for immutable payloads, time-ordered for logs)? 2. **Content addressing is the platform's fourth identifier and it is a genuinely different animal.** A chain token's id IS its bytes hashed: self-verifying, unmintable-in-advance, and revocation works by listing hashes. Neither the URI notes nor RDF note [00](https://redfish.acequia.io/guerin/.agents/f0d2c5e4-cec9-4567-92bd-dbbc62937c9e/2026-07-08/notes/00-rdf-primer-uris-and-guids-in-rdf.md) covered hash identity; best practice should name when it wins (immutable artifacts, delegation links, provenance). 3. **The ids-are-URIs rule is honored by derivation, not by storage.** The platform stores bare CUID2s and derives paths (`users/{userId}.json`, `/auth/chains/{hash}`). The bead protocol persists full URIs. Both work because the mapping id-to-path is deterministic within one origin; the bead rule exists for *cross-origin* citation. Candidate refinement: **within an origin, a bare leaf plus a deterministic path template is fine; the moment an id crosses an origin or lands in a document another agent will read, it must travel as its full URI.** 4. **Names are the mutable layer everywhere.** Groups by slug, mounts by virtual path, routes by pattern: all rebindable tables from names to targets, exactly `names.json` at platform scale. The three-layer rule (name for humans, URI of record, opaque leaf for identity) is confirmed across every subsystem. 5. **Token chains are acequia-links with hash pointers.** `parent: sha256(parentJwt)` plus depth, scope-subset, and cascade revocation is the same shape as bead lineage, expressed with content addresses instead of URIs. Note [01](https://redfish.acequia.io/guerin/.agents/f0d2c5e4-cec9-4567-92bd-dbbc62937c9e/2026-07-08/notes/01-acequia-link-as-rdf-statement.md)'s RDF reading extends: a delegation chain is a linked list of statements whose ids are hashes; RDF would call each link a triple with provenance.
## Inconsistencies worth fixing (offered to the platform's owners, not fixed here) - `instanceId` is CUID2 in two docs and `crypto.randomUUID()` in a third; one field, two schemes. - Token verification is a two-way branch in one snippet and three-way (parent, kid, device) in the spec text. - `.acequia-access` vs `.acequia-access.json`; `DOTFILE_READER_ALLOWLIST` differs between analysis and sketch. - JWT `sub` means userId or deviceId by claim-presence heuristics; the docs themselves flag this as fragile. - The discovery server still documents a username/password `defaultAuth`, out of step with the JWT/chain model. - `requestId` is a bare string (`req_abc123`); the bead protocol already requires request-ids to be URIs. One rule should win, and the [dock protocol](https://redfish.acequia.io/guerin/.agents/beads.md) argues for the URI. - The acequia object, the platform's namesake, has no id scheme at all yet: the clearest place where this bead's GUID/URI/hash triage could land.
## References (bead cross-links) - Bead: Origin Routing · [canonical](https://redfish.acequia.io/guerin/.agents/d3b7b28c-ed46-42c4-a5b1-fbd23129d665/) - Bead: Hey You Its Me · [canonical](https://redfish.acequia.io/guerin/.agents/ec4d09d8-7f06-41d3-80fe-80aeaedba680/) - Bead: Agentic Route Flip · [canonical](https://redfish.acequia.io/guerin/.agents/1057235a-f575-4046-8c63-67475a33374d/) - Bead: Agentify Bead · [canonical](https://redfish.acequia.io/guerin/.agents/d9dfa5e4-3c92-4216-bd53-13b520c59a5e/) - Bead: Acequia Hub · [canonical](https://redfish.acequia.io/guerin/.agents/e662a963-637a-43a0-be9b-df91ddd3c5fa/) - Bead: Agentscript Taosengine · [canonical](https://redfish.acequia.io/guerin/.agents/545c1ab1-d347-4947-b2bf-c852d5e25175/) - Bead: Uri Guid Discussion · [canonical](https://redfish.acequia.io/guerin/.agents/3bf89750-6b01-41ba-8a98-3db7136d0f56/)