Spatial canister
Datasets, feature writes, versions, audit pages, bbox reads, GeoJSON, and snapshots.
terminode.xyz
Integrate through canisters today, adapters next.
TermiNode exposes canister APIs for the canonical product path and adapter evidence for teams that need conventional GIS integration routes.
Interfaces
Production API surface
Use Candid for datasets, features, credit top-ups, GeoJSON exports, oracle proof workflows, governance, and ledger operations.
Oracle gateway
Premium coordinate verification, proof receipt logic, and metrics.
TRMG ledger
Product-credit balances and approvals through a TermiNode-specific contract. External wallet compatibility requires a versioned migration and accepted conformance tests.
Adoption path
Managed Gateway v1.8 supports controlled partner delivery
Bounded REST/OGC reads can run in an approved customer or operator environment. Opt-in signed intake validates safe references and preserves leases, capped retries, dead-letter state, and transition history across restart. One gateway process owns each owner-only state file and lock; this is not a distributed queue, and stale-lock recovery requires operator confirmation. Signed terminal callbacks notify an approved backend without exposing raw evidence data. The spatial-sync worker, callbacks, and credential verifier are disabled by default. Local acceptance covers one idempotent sponsored write, indexed receipt readback, and a separately signed callback.
GeoJSON export
Viewport and feature evidence exports support downstream tools.
OpenAPI artifact
Documents how an HTTP adapter can sit beside the canonical canister API.
Partner intake boundary
Approved backend clients sign exact request bytes and create bounded awaiting_anchor jobs. Protected state preserves replay guards and worker transitions under one process-owned lock. The lock is not a multi-process queue. The bundled verifier tests result handling on loopback only; cryptographic C2PA validation and approved production readback remain release gates.
Signed completion callback
A privacy-safe terminal payload carries job, receipt, feature, and version references to an operator-approved HTTPS endpoint. HMAC verification, stable delivery IDs, bounded retry, dead letter, and callback-only replay pass locally.
Versioned contract
Ingress, job-status, and callback JSON Schemas, safe request and response fixtures, verifier result catalog, stable error catalog, and OpenAPI document keep partner CI aligned with Gateway v1.8.
QGIS/ETL smoke
Validates CRS84 collection metadata, safe partner fields, proof receipt references, invalid bbox rejection, and geo+json packaging for desktop GIS handoff reviews.
Sample fixture
Provides a safe service-zone GeoJSON sample with source_app, external_reference, partner_feature_id, proof_receipt_id, asset_boundary_id, evidence_hash, recorded_at, review_status, and proof-ready metadata.
Pilot integration pack
Combines sample GeoJSON, adapter contract, OpenAPI artifact, dry-run summary, and evidence checklist for a practical pilot handoff.
Migration guide
Start from EPSG:4326 GeoJSON or WKB and validate geometry before import.
Scheduled GIS jobs
Create, update, retry, and archive through one source-revision contract
Use sync_feature for one record or sync_features_batch for up to 25 entries. Read the accepted revision before a change, treat exact retries as successful no-ops, and reconcile conflicts without overwriting newer geometry.
Optimistic revision
expected_current_revision must match the canister state for every change after the first upsert.
No duplicate billing
An exact revision and payload retry creates neither a new version nor another write charge.
Bounded inventory
List source bindings by dataset to compare TermiNode state with QGIS, PostGIS, an asset registry, or another upstream system.
Decision workflow
Bind review and approval to an exact spatial version
The spatial canister exposes draft, transition, current-pointer, history, and checksummed report methods. The workflow passes three-principal local acceptance and upgrade persistence; production release evidence remains open.
Prepare and submit
Create a draft against an existing feature version, then submit it without mutating geometry.
Review and approve
Reviewer and Approver roles enforce separate transitions; acceptance requires a decision reference plus an evidence hash or proof receipt.
Read and verify
Read the selected decision, current accepted pointer, bounded history, and SHA-256-backed export report.