Why this matters now
Agent memory that is replayed or audited inherits every time bug the codebase carries. When a derivation step silently calls a “now” primitive, two replays of the same nominal history can diverge in bytes and in downstream decisions. That failure mode is orthogonal to intent: it is an engineering fact about implicit clocks.
A parallel issue is representational. Civil calendars and stepped scales—UTC with its leap-second policy—are built for human coordination and Earth rotation, not for “same input, same output” lineage. The telecommunications and distributed-systems literature documents operational friction from that discontinuity class (ITU, “Synchronization and the impact of UTC discontinuities,” 2023). Choosing what to treat as canonical time for append-only history is therefore a design decision with testable consequences.
Work in the open-source Memory Lab reframes canonical event time as a small kernel: International Atomic Time (TAI) as the counting mechanism, plus a heliocentric ecliptic pair derived from a pinned ephemeris—solar age in megayears and Earth’s heliocentric ecliptic longitude—surfacing together as a physical_moment payload alongside deterministic logical ordering (sequence_in_stream, hybrid logical clock). The contract is specs/TAI_TIMEKEEPING.md; the kernel code lives in src/heliotime and src/timekeeping.
Working definition
- Mechanism (time as count): TAI advances in SI seconds without leap-second steps (IERS glossary — International Atomic Time; BIPM SI Brochure annex — time). UTC, by contrast, can insert or omit integer seconds to track UT1.
- Coordinate (time as place-in-orbit): A second axis locates the same moment on a solar-system trajectory model: cumulative solar age from a declared anchor at J2000, and ecliptic longitude from an ephemeris-backed barycentric state. This is not a claim that ecliptic longitude is “the” cosmic clock; it is a declared, reproducible angle useful for human legibility and cross-environment sanity checks when bytes must match on replay.
- Logical layer: Hybrid logical clocks mix a physical and a logical component for ordering (Kulkarni et al., “Logical Physical Clocks,” 2014); the kernel implements that algorithm “deterministic from TAI + sequence” in
src/timekeeping/hlc.py. Keyed off replayed physical time rather than wall clock where the lineage contract requires it, they break ties when physical timestamps collide.
Together: physical moment = explicit TAI anchor + declared astronomical computation context + logical ordering, with version pins (timezone data, leap-second table, ephemeris identity and data hash, library versions) bound by a deterministic time_context_id.
Risk/failure taxonomy
| Category | Description | Example signal |
|---|---|---|
| Hidden wall-clock | Replay path calls now() or equivalent | Diffing replay outputs shows drifting timestamps |
| Stepped civil scale mistaken for axis | UTC/Gregorian treated as the lineage counter | Non-monotonic or ambiguous instant around a leap second |
| Ephemeris drift | Same ephemeris_id, different kernel bytes or astropy build | ecliptic_lon_deg differs across machines at “same” TAI |
| Anchor uncertainty | Solar age offset wrong or upgraded without declaration | Slow systematic error in solar_age_myr; context id should change |
| Dangling context | Events reference undeclared time_context_id | Quarantine reason dangling_time_context_id in spec |
| HLC nondeterminism | Physical component fed from wall clock under replay | Replay changes hlc_timestamp byte-for-byte |
Design/implementation patterns
- Explicit input moments for anything replayable: the kernel’s own contract is that “every public function accepts an explicit input moment… only
now()reads the clock and it is explicitly named” (src/heliotime/__init__.py); replay threads TAI from lineage instead. time_context_declared+ hash preimage pins the environment that turns TAI into angles and civil cross-checks; mismatches are visible in lineage, not silent float drift (src/timekeeping/context.py).- Tiered payload: Tier 1 required physical anchors; Tier 2 computed/source-present fields with closed null reasons; Tier 3 version pins via
time_context_id; Tier 4 logical/causal time—no silent defaults (specs/TAI_TIMEKEEPING.md§5). - Batch markers resolve “declared in the same atomic commit” without guessing from wall-clock proximity (
canonical_batch_committed,src/timekeeping/batch.py).
Evaluation protocol (pre-deploy + production)
Pre-deploy
- Round-trip and leap-second-crossing tests as in §12 “Falsification and acceptance tests” of the spec (TAI monotonicity, UTC bridge behavior); the kernel ships
_phase1_verify.py–_phase3_verify.pyundersrc/timekeeping. - Replay invariance: identical lineage, identical payloads including derived
computed_at-class fields when the contract says they are signature-eligible. - Ephemeris pin hash changes when kernel bytes or declared identifier changes; exercise fallback paths if DE440 is unavailable.
- HLC: repeated replay from identical lineage yields identical
hlc_timestampwhenhlc_signature_eligibleis true.
Production
- Monitor quarantine rates for
missing_physical_moment,dangling_time_context_id,nondeterministic_time_context_id. - Log
time_context_idtransitions as material changes: tzdata, leap table, ephemeris data hash, solar age anchor, HLC variant. - Sample audits comparing Tier 2 civil fields against independent UTC/leap-state sources when non-null.
One failure case walkthrough
An ingestion path defaults computed_at = datetime.utcnow() during chain-signal computation. Under load, replay on Tuesday reproduces different proof bytes than Monday because the default is outside lineage. The fix is not “better UTC”; it is threading physical_moment.tai_iso from the tick that is already canonical for the event and forbidding implicit clocks in replay paths (the motivation stated in §1 “Purpose” through §3 “Time model” of the spec).
Practical checklist
- Every replayable module lists clock sources;
now()appears only in named APIs. - Ingress converts civil/UTC inputs once; canonical rows carry
physical_moment. -
time_context_idresolves in lineage before signature steps. - Ephemeris hash and library versions are recorded before trusting angle comparisons across environments.
- Falsification tests from the spec are CI gates, not documentation.
Open problems
- Relativity and coordinate time: Astronomical practice also uses Terrestrial Time (TT), related to TAI by the fixed conventional offset TT = TAI + 32.184 s at useful precision (IERS glossary — Terrestrial Time); deeper models may need explicit TT/TCB discussion when nanosecond relativistic effects matter.
- Which physical axis for which question: Heliocentric ecliptic longitude is geocentric navigation in disguise—it answers “where was Earth on this ephemeris?” not “what is cosmologically universal time.” Stellar/galactic frames remain out of scope in v1 of the spec; that is an honest boundary.
- Solar age anchor spread: Meteoritic chronology and helioseismic ages cluster near ~4.57–4.60 Gyr depending on method (Connelly et al. 2012, Science 338:651; Bonanno & Fröhlich 2015, A&A 580, A130); pinning
SOLAR_AGE_AT_J2000_MYR = 4603.0(src/heliotime/__init__.py) is a declared lab default with cited literature, not a unique physical constant. - Operational leap-second policy: CGPM/IERS directions may change how civil time relates to atomic time; lineage must track table versions, not assume today’s policy forever.
Claim-evidence map
| Claim | Source | Evidence strength | Scope limits | Operational implication |
|---|---|---|---|---|
| TAI uses the SI second and is continuous (no leap seconds) | IERS glossary — International Atomic Time (TAI); BIPM SI brochure annex — time | high | Realizations have small errors vs ideal; not “truth,” a maintained scale | Prefer TAI (or a fixed offset from it) for monotonic lineage counters |
| UTC can step with leap-second policy | ITU hub note on UTC discontinuities | high | Policy evolution continues | Treat UTC-derived fields as boundary/witness unless leap table is pinned |
| Hybrid logical clocks mix physical and logical time for ordering | Kulkarni et al., “Logical Physical Clocks,” 2014 | high | Algorithm variant must be declared for comparable HLC values | Declare hlc_variant; feed physical leg from replayed TAI, not wall clock |
| Modern planetary ephemerides (e.g., DE440) are fit observations with published uncertainty tradeoffs | NASA/JPL DE440/DE441 documentation; Park et al. 2021, AJ 161:105 | high | DE440 vs DE441 span/accuracy tradeoff | Pin kernel identity and data hash; record fallback |
| Absolute chronometry of early solar-system solids is narrow at Myr scale but not identical across methods | Connelly et al. 2012, Science 338:651 | high | Answers age of solids in meteorites, not “clock in the sky” | Treat solar-age intercept as declared anchor with uncertainty, not as sub-Myr truth |
| Helioseismic solar age estimates are precise at per-mille level but model-dependent | Bonanno & Fröhlich 2015, A&A 580, A130 | medium | Stellar models, EOS, and rates matter | Keep ±1 Myr (or wider) honesty in docs when interpreting solar_age_myr slopes |
| TT = TAI + 32.184 s by convention (astronomical coordinate time) | IERS glossary — Terrestrial Time | high | Microsecond subtleties for some Earth-rotation products | If Astropy paths move through TT explicitly, document scale in time_context |
References
- IERS glossary — International Atomic Time (TAI).
https://www.iers.org/IERS/EN/Service/Glossary/Functions/glossary?searchTerm=tai - BIPM — SI Brochure annex: time scales.
https://www.bipm.org/en/publications/si-brochure/annex-1/time - ITU — synchronization and UTC discontinuities (hub).
https://www.itu.int/hub/2023/05/synchronization-and-the-impact-of-utc-discontinuities/ - Kulkarni, S., Demirbas, M., Madeppa, D., Avva, B., Leone, M. (2014). “Logical Physical Clocks.” PDF:
https://cse.buffalo.edu/~demirbas/publications/hlc.pdf - NASA/JPL — The planetary and lunar ephemerides DE440 and DE441.
https://ssd.jpl.nasa.gov/doc/de440_de441.html - Park, R. S., et al. (2021). “The JPL Planetary and Lunar Ephemerides DE440 and DE441.” The Astronomical Journal 161, 105.
https://doi.org/10.3847/1538-3881/abd414 - Connelly, J. N., et al. (2012). “The Absolute Chronology and Thermal Processing of Solids in the Solar Protoplanetary Disk.” Science 338, 651–653.
https://doi.org/10.1126/science.1226919 - Bonanno, A., & Fröhlich, H.-E. (2015). “A Bayesian estimation of the helioseismic solar age.” Astronomy & Astrophysics 580, A130.
https://www.aanda.org/articles/aa/full_html/2015/08/aa26419-15.html - IERS glossary — Terrestrial Time (TT).
https://www.iers.org/SharedDocs/Glossareintraege/EN/T/tt?nn=c1f2e951-ab6e-4f7d-a72c-87f384cd1d75 - Memory Lab (open source). Repository:
https://github.com/stack-research/memory - Memory Lab —
specs/TAI_TIMEKEEPING.md(mechanism/coordinate split, payload tiers §5, HLC determinism §8, replay signature §9, falsification tests §12).https://github.com/stack-research/memory/blob/main/specs/TAI_TIMEKEEPING.md - Memory Lab —
src/heliotime/__init__.py(explicit-input-moment contract;SOLAR_AGE_AT_J2000_MYRanchor).https://github.com/stack-research/memory/blob/main/src/heliotime/__init__.py - Memory Lab —
src/timekeeping/(hlc.py,context.py,batch.py, phase verifiers).https://github.com/stack-research/memory/tree/main/src/timekeeping
Limits Of This Article
- Astrophysical ages and ephemeris angles are declared-model outputs. They complement TAI; they do not remove the need for version pins or uncertainty language.
- No universal claim is made that TAI + heliocentric longitude is the only coherent choice; it is one explicit design aimed at replay legibility and byte-stable lineage under stated conventions.
- Relativistic time scales (TT, TCB, etc.) matter for some instruments and reduction pipelines; v1 of the lab spec deliberately scopes out corrections beyond the Astropy/ephemeris path—double-check before borrowing the pattern for regimes where light-time and relativistic reductions dominate error budgets.