The wire contract every shard of an org speaks. Pure.

ONE PROCEDURE, <Org>/rag.query_shard_v1. Each shard node provides it under its org's namespace, so macula 12 only lets a node provide it with a D25 procedure_delegation from that org, and only calls a provider whose delegation verifies against the realm key. That is what makes "the shards of this org" a checked set rather than whoever says so.

TWO FACTS, canonical app facts under the org:

<realm>/<org>/rag/shard/shard_summarized_v1 what a shard holds <realm>/<org>/rag/shard/shard_withdrawn_v1 it holds nothing any more

A summary names the EMBEDDING the shard's index was built with, model and dimension. Scores from two embeddings are not comparable, so a query is only sent to, and only merged across, shards whose embedding matches the querying node's own.

WHO SENT A FACT IS NOT IN THE PAYLOAD. macula delivers every event with its verified publisher; a summary belongs to that node, whatever it claims. shard_id is informational: the node id is the shard's identity.

A HIT'S MINIMUM is a binary id and a numeric score. Everything else in a hit, and the whole query, is the consumer's, carried as it is.

Build functions take atom keys. parse/2 reads what a peer receives, where macula's codec hands text back as {text, Binary}: received maps, the consumer's query and hits included, come back with binary keys.