Everstream

A stream is one connection to one external source, owned by a collection, typed by its source. A module is a domain surface that ships tools, routes, and panels — and a module either owns a stream type or composes across several, fanning out across more than one store and returning a single answer.

Every stream type falls into one of two camps, and picking first is what keeps the safety property real rather than aspirational.

Read-only sources return a frozen client object, so no caller can monkey-patch a write method onto it, and the router file locks down mutating routes in a way that is grep-verifiable. Read-write sources carry an explicit permission level defaulting to read-only, enforced both by the client and by a keyword guard at the query layer that strips comments before scanning and whitelists first-statement verbs per level.

Generated output is persisted as a serializable archive-swap: the previous generation is archived and the new one written in one transaction, alongside an audit row recording the generation. A refusal is recorded as an outcome with its exact error rather than silently producing nothing.