Ultra IR
Every query, whether it starts as SQL, a search or an AI request, becomes an Ultra IR plan: a small graph of typed operators. The plan is what gets optimized, cached, checked and run.
A plan
A plan is a small graph of typed operators. The example in the specification reads active sales contacts in one workspace, newest first, with email hidden: a scan, the security operators, a filter, a top-k, a projection and the result. A text form exists for tests and debugging; plans travel as binary.
Operators
| Operator | Does |
|---|---|
SCAN | Reads a collection with its declared schema. |
TENANT_ISOLATE, ACL_FILTER, FIELD_MASK | Security operators: keep one tenant's rows, apply the access policy, hide restricted fields. |
FILTER, PROJECT | Keep rows where a predicate is true; compute output columns. |
JOIN (inner, left), UNION | Combine inputs. |
AGG | count, sum, min, max, grouped or global. |
SORT, LIMIT, TOPK | Order and cut results. |
RESULT | The sink: where the verifier's requirements are checked. |
Search, vector, graph, retrieval and AI operators are specified and arrive with their phases.
Types and values
Booleans, integers of 8 to 64 bits, floats, exact decimals up to 38 digits, strings, bytes, UUIDs, dates, times, timestamps, intervals, arrays, maps, structs, JSON, vectors and embeddings tagged with their model and version.
- No silent lossy conversion. Narrower integers widen to wider ones and to decimals with room for every value; anything else needs an explicit cast that either fails or yields NULL.
- SQL NULL logic throughout:
NULL = NULLis NULL, and a filter keeps only rows where the predicate is TRUE. - Integer overflow and division by zero are errors, never wrap-around.
- Sorting is total: NULLs sort last ascending, every NaN sorts together above all numbers, and +0 equals −0.
Canonical encoding
Plans and values are encoded as protocol buffers with extra rules (UCE v1) so that one plan has exactly one byte string: fields in order, defaults omitted, shortest integer encodings, one NaN, minimal decimals, sorted maps. The decoder rejects every other encoding, including ones a normal protobuf library would accept.
Before encoding, plans are put in canonical form: a AND b and b AND a become the same, 5 = x becomes x = 5, double negation disappears, and nodes and parameters are renumbered. The schema is published as ir.proto, and the encoder's output matches the reference protobuf implementation byte for byte.
Fingerprints
A plan's logical fingerprint is a BLAKE3 hash of its canonical encoding, with a domain prefix so it can never be confused with any other hash. Plans that mean the same thing share a fingerprint, which makes the plan cache safe and simple. A request fingerprint adds the parameter values, tenant, policy version and snapshot.