# Hybrid Topologies for Authoritative Registers

Some spatial datasets cannot be federated, and pretending otherwise is how a mesh transition acquires a legal problem. A cadastre, a national address file, an official flood map — these frequently carry a statutory requirement that exactly one custodian holds exactly one copy with one audit trail. The workable answer is not to exempt them from the mesh but to keep the register central and expose it as one domain’s product like any other. This guide builds that hybrid: a single-custodian register with a mesh-conformant output port, versioned contract and published SLO. It is the exception case named in Data Mesh vs Traditional GIS Architecture within Geospatial Data Mesh Fundamentals.

# Prerequisites

# Step-by-Step Implementation

# 1. Draw the line between the register and the product

The register is the authoritative store and its write path is untouched. The product is a read-only, contracted projection of it that the mesh routes to.

# register-product.yaml — the register exposed as one domain's product.
apiVersion: mesh.geospatial/v1
kind: SpatialProduct
metadata:
  domain: cadastre
  name: parcels_authoritative
  owner: team-land-registry           # the statutory custodian, unchanged
spec:
  storage:
    class: external                   # the mesh does NOT provision this store
    connection: "register://land-registry/parcels"
    crs: "EPSG:4326"
  write_path: custodian_only          # the mesh never writes here
  ports:
    - type: features                  # read-only projection
    - type: snapshot
      format: geoparquet
      cadence: P1D
  slo:
    availability: 0.9995
    latency_p95_ms: 400
    freshness: P1D
  access:
    principals: ["*/read"]            # broad read, no write principal exists
    spatialScope: extent
  audit:
    retention: P30Y                   # the register's obligation, not the platform's
    fields: [caller, extent, version, timestamp]

Verify the mesh holds no write capability against the register — the single most important assertion in the design:

mesh-platform describe --product "$PRODUCT" | jq '.write_principals'
# expected: []  — an empty write principal set, enforced rather than documented.
psql "$REGISTER_DSN" -c "\du mesh_reader" | grep -q 'Cannot login\|NOSUPERUSER'

# 2. Project the register into a contracted read port

The projection is where the register’s internal schema stops and the published contract begins, which is what lets the register evolve internally without breaking consumers.

-- published_view.sql — the contract surface, not the register's internals.
CREATE OR REPLACE VIEW published.parcels_authoritative AS
SELECT
    r.parcel_uid                                   AS parcel_ref,
    -- The register stores in a national grid; the contract publishes EPSG:4326.
    ST_Transform(r.geom, 4326)                     AS geom,
    r.owner_reference,
    r.tenure_type,
    r.registered_on,
    -- Internal columns deliberately absent: workflow state, staff annotations,
    -- pending-application flags. The boundary is what makes the register evolvable.
    r.register_version                             AS source_version
FROM registry_internal.parcels r
WHERE r.status = 'registered';       -- pending applications are not authoritative

-- Read-only, and grants are explicit rather than inherited.
REVOKE ALL ON published.parcels_authoritative FROM PUBLIC;
GRANT SELECT ON published.parcels_authoritative TO mesh_reader;

Verify that no internal column leaked into the published view, which is the failure that couples every consumer to the register’s workflow:

psql "$REGISTER_DSN" -c "\d+ published.parcels_authoritative" \
  | awk '/^ /{print $1}' | grep -E 'workflow|pending|staff|internal' \
  && echo "LEAK: internal column exposed" || echo "projection is clean"

# 3. Route to it exactly like any other domain product

The routing plane must not special-case the register, or the hybrid becomes an exception that every future change has to remember.

# Register the coverage so the routing plane resolves it normally.
mesh-platform register --manifest register-product.yaml
mesh-platform check-overlap --product "$PRODUCT"

# A consumer request goes through the ordinary path: identity, contract, residency,
# domain resolution, SLA tier, quota. Nothing about the register is special here.
curl -sS -H "x-spatial-domain: cadastre" \
     -H "x-spatial-crs: EPSG:4326" \
     "https://api.internal/collections/parcels_authoritative/items?bbox=-1,50,1,52&limit=5" \
  | jq '.features | length'

# 4. Preserve the register’s audit obligation through the mesh

A statutory register usually has to record who read what. The mesh’s access telemetry becomes that record rather than a second, competing one.

# audit_bridge.py — mesh access records satisfying the register's obligation.
def audit_record(request) -> dict:
    """Every field the register's obligation requires, sourced from the mesh's own
    zero-trust layer. One record, not two systems that will eventually disagree."""
    return {
        "caller": request.authenticated_identity,   # from mTLS, not self-asserted
        "extent_wkt": request.bbox_wkt,             # WHAT was read, not merely that
        "product_version": request.resolved_version,
        "timestamp": request.received_at,
        "response_feature_count": request.response_count,
        "register_source_version": request.upstream_version,
    }

Verify the extent is captured — an audit record naming the caller and the endpoint but not the region read cannot answer the question an audit asks:

curl -sS "$AUDIT_API/records?product=$PRODUCT&limit=1" \
  | jq 'keys, (.[0] | has("extent_wkt"))'

# Configuration Reference

# Common Failure Modes & Fixes

A consumer breaks when the register refactors internally. Root cause: the published view exposes internal columns. Fix: the view is the contract surface — publish the contract’s columns and nothing else, however convenient the extra ones look.

Two versions of the register’s data exist in the mesh. Root cause: a domain cached or copied the register locally for performance. Fix: this is precisely what a single-custodian obligation forbids; if latency is the problem, the answer is a read replica the custodian owns, not a copy another domain owns.

Routing special-cases the register. Root cause: it was onboarded before it had a manifest. Fix: register it properly; a special case in routing survives every refactor and is forgotten by whoever inherits it.

The audit record cannot answer which parcels a caller saw. Root cause: only the endpoint and caller were logged. Fix: capture the requested extent and the response count; the URL is aggregated away long before the audit is asked.

Pending applications appear in published results. Root cause: the view omits the status filter. Fix: filter to registered entries; a pending application is not authoritative and publishing it can have legal consequence.

# FAQ

# Related

• Data Mesh vs Traditional GIS Architecture — the parent topic and when centralization is right
• Migrating from Monolithic GIS to Data Mesh — the migration this pattern sits inside
• Zero-Trust Security for Spatial Endpoints — the identity layer the audit bridge draws on