A model can be swapped. A vendor can be left. A session ends. What your company decided, what it produced and why should outlive all of it.
.on
One record for each thing that happened. A decision and who took it. A source and who ratified it. A signal that arrived from a connected system. A version, an approval, a piece of feedback on the result — and the work itself. Each is written down as its own structured record, with its own identity, instead of a line in a conversation.
.theon
A scoped set of those records, plus what connects them. So the work arrives somewhere else already explained: what was asked, what it drew on, what was decided, what it produced and how a person judged it.
The next agent reasons better. It is handed the decisions and the evidence under them, not a transcript to read again and guess at. And the work survives the session: another model, another provider, another Nieme installation, and it still knows what it is, where it came from and what was decided.
A .theon carries many .on units, and each keeps its own type and identity — an Operation is still an Operation inside it. The manifest names what travelled and separates the admitted units from the canonical records carried with them; that list is the whole of it, and a reference does not drag the rest of the institution along behind it.
Read, Graph, Context and Raw are projections of whichever unit you have open inside the bundle. Every line in the graph is a relationship the Runtime actually stores, and Context is the Trail from the turn that produced the work — or an honest blank where no turn did.
An Operation to hand over, a Project to carry, an investigation, an institution's whole history — same container, different root and scope. What each one includes is a decision the bundle states, not a rule that quietly expands.
A bundle is data, not a runtime. No executable code, no model weights, no credentials — and importing one grants no authority in the Runtime that receives it.
Nieme is opening to a small group of operators.