Unification
One catalog: projected, not re-authored.
Rather than invent a new authoring format, the catalog is a deterministic projection over the eight authoritative registries (one adapter each), so every source stays the single owner of its operators.
- 1,139 operator records spanning stats and time series, data transforms, SQL, visual-pipeline nodes, AutoML preprocessing, and ML estimators; 959 are directly callable, the rest labelled via-API or unavailable with a stated reason.
- Regenerating an unchanged tree is byte-identical; 22 JSON Schemas (draft 2020-12) under 24 versioned schema IDs pin every shape, with the contract iterated v1→v5 in two days.
- A CI conformance harness runs every callable operator on a test dataset in a fresh interpreter under pinned dependencies and commits the verdicts, so the catalog says what actually runs, not what should.
Execution
Typed forms in, runnable code out. Safely.
Each operator page is a typed form (symbol, enum, multi-enum, date, date range, boolean, number, text, and JSON controls with column pickers) that resolves to a frozen plan, a notebook cell, and a receipt.
- Nothing runs until an explicit Run in the user's own scratch kernel; changed parameters mark output stale, observed output is checked against the receipt, and a badge flags library-version drift.
- Kernel operators are generated by introspecting any installed module (scipy.stats or the user's own code) in an isolated child interpreter with a scrubbed environment; deduplicating shared signatures cut the scipy.stats walk from 4.52 MB to 1.70 MB.
- Supply-chain-hardened installs (exact pins, wheels only, sha256-verified, .pth and sitecustomize shadowing refused, replayable receipts); values reach code only through literal renderers and kernel output is treated as untrusted, leaving no injection path.
Delivery
Tamper-evident by construction.
The catalog ships as content-addressed, write-once objects behind a read-only edge worker, and the app verifies every byte against a pinned manifest hash before trusting it.
- No "latest" pointer: rollback is a re-pin, and any mismatch fails closed. Canonical JSON number encoding keeps hashes stable across languages, including integers beyond 253.
- One resolver held identical across three implementations (a Python reference, a TypeScript port, and a stdlib-only kernel copy) by a generated-corpus parity test.
- Four codebases from kickoff to all core changes merged in about four days, including a one-day re-architecture after a platform direction change; 25 design decisions recorded. Delivered to staging.