Architecture
Five commitments. Each mapped to a concrete failure mode. Each with an architectural response drawn as a diagram.
The commitments below are the technical spine of urSynergy. Each one resolves a specific class of failure the reader will recognize from /why. The architecture is vertical-agnostic — subject-centered records, consent-scoped stewardship transitions, authority composition, and provenance-labeled data are primitives that apply to any professional- records domain. Animal care is the first operating vertical.
The record travels with the animal
Stewardship transfers are first-class events in the identity backbone, not exports. When an animal moves from breeder to buyer, shelter to adopter, or owner to rescue, the record moves with it as a continuous chain — not as a snapshot that gets handed off and begins drifting from the source.
Append-only history preserves the full sequence. Earlier stewards cannot overwrite what came after them; later stewards cannot erase what came before. Each transition carries a consent gate tied to the outgoing steward, a timestamp, an attributable actor, and the scope of access being transferred. The chain stays auditable across the animal’s lifetime.
Three identity peer domains — users, organizations, animals — sit beside each other as equals rather than nested hierarchically. The animal is the primary subject; humans and organizations are stewards in relationship with the animal rather than owners of an identity the animal carries. The distinction shapes the whole protocol: stewardship can transfer without the animal’s record changing hands in any ownership sense.
Put concretely: the Case 02 intake note from /why, under this model, becomes a tagged observation attributed to the surrendering-shelter staff member who made it, carried with the animal through the adoption, and visible to the adopting family and the emergency vet as part of the same record. Not a buried attachment. Part of the chain.
Every data point carries its source
Every row in the identity backbone carries a provenance_source field. It is not nullable. The schema does not permit a record to exist without declaring where its data came from.
Six source categories discriminate between meaningfully different kinds of knowledge: authority-operated (a regulator has attested), institution-verified(an institution’s records show), user-verified (a credentialed individual has confirmed), self-reported (the owner has reported), AI-curated (an agent has inferred), and platform-computed (the platform itself has derived). These distinctions are load-bearing for clinical, regulatory, and stewardship decisions that depend on knowing how sure the data is.
Citation HP-003: Provenance is enforced at schema and render layers — not editorial discipline.. A component cannot display a data field without resolving its provenance. Verified data is visibly verified; self-reported data is visibly self-reported; AI-curated data is visibly AI-curated. There is no category of unlabeled data, because neither the schema nor the render can hold it.
Case 03 from /why is the counter-example. Under provenance discipline, the Missouri vet’s careful note — “single elevated creatinine, documented as specifically not chronic” — would carry provenance_source = institution-verified and persist alongside any subsequent owner summary. The new vet would see both, would see which is which, and would have the information needed to prescribe correctly.
Welfare law, operable at the transaction layer
Citation HP-004: The authority engine resolves jurisdictional rules at decision time, not after a violation.. Not after a violation; not retrospectively at audit. At decision time, in the workflow, as the action is being taken.
A veterinarian writing a controlled-substance prescription is shown the state’s compliance requirements before the prescription is issued. A municipal licensing officer verifying a rabies vaccination sees the jurisdiction’s verification rules before the compliance record updates. A breeder filing a litter registration sees the breed registry’s scope requirements before the filing commits. The authorized path becomes the default path because the professional is shown it without asking.
Every rule the engine surfaces exists because an animal was harmed in the past and a legislator codified a protection in response. When the engine warns a professional, it names the welfare concern behind the rule — not just the rule number. The professional sees required because animals housed under these conditions have shown measurable welfare decline, not violation of Section 14.3.B.
The platform does not practice law or veterinary medicine. It operates the rulebook the animal could not testify to write. Every welfare regulation the authority engine enforces is a sentence in the animal’s testimony, codified by legislators who looked at specific harms and wrote protections in response.
Every existing identifier, made more useful
Microchips, municipal licenses, breed registrations, smart tags — every identifier from every vendor is accepted and resolved through an operator-resilient backbone. Format-agnostic, vendor- agnostic, operator-agnostic. An identifier issued in 2014 by a vendor acquired three times since is still resolvable, because urSynergy’s backbone is not the vendor’s scanner; it is a lookup that any channel can invoke.
Citation HP-005: Existing microchips become more useful when registered with urSynergy; urSynergy does not replace microchips.. An owner registering an existing chip gains the ability to resolve that chip number through a phone-camera scan, a typed short-code lookup, a voice query, or a shelter’s legacy scanner. The chip’s utility stops depending on which vendor’s scanner-to-database connection is intact this year.
The urSmartID tag extends the same principle for animals without a chip or owners wanting redundancy. Three independent identifiers on a single tag — QR, NFC, short code — that resolve to the same backbone record through three independent channels. If a scanner is not available, a phone camera reads the QR. If the QR is scratched, the NFC tap works. If NFC fails, the short code types into any browser.
Case 01 from /why is the failure mode this commitment addresses. Under urSynergy’s permanence layer, the chip number is registered as a resolvable identifier in the backbone — independent of the original vendor’s lifecycle — and the lookup that failed in 2026 succeeds through any channel the shelter has access to.
Humans as allies of the animal
urSynergy operates the infrastructure; the humans using it are allies of the animal they are caring for. The platform records; it does not judge. No user audience is framed as a compliance risk. No feature is built to catch people. The system’s posture toward its users is that everyone in the animal world is already trying, and the infrastructure’s job is to make their work easier to do right.
This commitment is not a tagline; it is an architectural constraint that affects every feature decision. A breeder is a partner, not a surveillance target. A veterinarian is a partner, not a suspect at the authority engine’s checkpoint. A municipal officer is a partner in welfare, not a revenue-generation layer for the platform. A rescue is a partner, not an adversary to the breeding industry. The platform connects them to each other through the animal at the center.
The animal is the subject — not a party in any transaction, but the subject the transactions serve. This is the distinction that shapes the partnership topology: humans partner with each other in the service of the animal, and urSynergy operates the edges of that partnership without claiming ownership of the animal’s record.