The argument
The case for Columna, top to bottom — about eight minutes, with two live exhibits along the way.
A number owes you its assumptions.
Most numbers don't pay. They arrive alone — clean, confident, formatted — and the choices that made them stay behind. For fifty years that was survivable, because the numbers were made by people, and people argue. Now the numbers are made by machines that never argue at all.
This page is one argument, top to bottom. It will take about eight minutes, and twice along the way you will watch it run.
begin with ninety seconds of data. skip to the running demo ↓
Here is a quarter of sales. The whole thing:
| order | customer | line items |
|---|---|---|
| O1 | Ada | $100, $20 |
| O2 | Ada | $10 |
| O3 | Ben | $40, $40, $40 |
Revenue is $250. Now answer an ordinary question: what was our average order value?
Same data. Same three words. Three answers — none of them wrong. the full ninety-second version → The Grain Gap
They differ only in what you divided by, and what you divided by is a decision the question never stated, the column name never records, and whatever answered you made silently on your behalf.
Ask an AI analyst this question and you will get one of these numbers in less than a second, with a chart, a citation, and no flicker of doubt. Not a hallucination — the SQL is valid, the number is real. Something quieter and worse: a defensible wrong answer. The kind no guardrail catches, because by every check anyone has built, it's correct.
You have just seen the whole problem. The rest of this page is why it exists — and it goes deeper than you think.
Start further back than this industry usually starts — not at the tool, not at the query language, but at what data is.
Every datum is something said about something else. A value, said of something. The measure is what is said; the anchor — the set of coordinates it is said at — is what it is said of. A column is a measure over its anchor. Not the smallest element of data — a data point is — but the simplest structure of data: the unit of structured data operation.
And a table? A table is a container. Form, not substance. Its keys and layouts hint at meaning — but hints are not declarations, and nothing checks them. This is why fifty years of table operations have been necessarily mechanical: you can only do mechanical things to a container, because a container has no aboutness to respect. Operations over columns are substantial — they must honor what the column says, and what it is said of.
Tables are how data is stored. Columns are what data says.
Your average-order-value question went wrong exactly here. The answer had to be computed over something — lines, orders, customers — and that "over" is a property of the column, not of the table it happened to be stored in. The table couldn't tell you. Tables can't. It isn't their job.
Half a century ago — Codd, 1970 — the container got its mathematics. Relational algebra — select, project, join — closed over tables, indifferent to meaning. It was a genuine triumph, and it built everything you use. But it is an algebra of form.
The substance side got theorems, never a grammar. The warnings have been in the literature for decades — summarizability theory (Lenz & Shoshani, 1997) stated precisely when a rollup is lawful; a generation of OLAP tools shipped semi-additive behaviors; newer modeling languages disarm particular traps, one feature at a time. Real fragments — conditions to check, settings to enable, disciplines to remember — and never a constitution: one small, closed algebra in which legality follows from what the columns are, every expression adjudicated before it runs, refusal spoken out loud. The great rebellion against the table — key-value, objects, documents, graphs — reached for substance and won everywhere retrieval rules. But it won everywhere except where structured data live: the moment the workload turned analytical, every rebel surrendered back to SQL, or bolted on a map-reduce with no theory of legality at all. Structured analytical data stayed the container's last kingdom — not because tables are right for it, but because the fragments never became a grammar.
So we wrote the grammar. The framework is called Columna, and the name is the thesis: it stands for Column Algebra. Columns and their operators — mappers and reducers — composing into expressions; some grammatically well-formed, some not; and the line between them drawn by the nature of each column, captured in three anchors: where its values live, where they leak and by what mechanism, which directions of reduction are barred. From these, legality follows. Whether you may sum this, roll that up, divide these two — not policy, not convention, not a style guide.
Here is the part the industry will recognize, because it has been paying for the confusion for decades.
Metadata was never one thing. Some of it is load-bearing: change it and you change what operations are legal, or what value results — which unit an average reduces over, which population a count is drawn from. And some is communicative: it exists so that a person — or now a model — can understand. The test is decidable, not aesthetic: does changing it change legality or value?
For fifty years the two kinds lived fused — some in schema structure, some baked into column names, some in documentation, and the decisive remainder in the analyst's mind. Because the load-bearing kind had no home, the industry forced names to carry it — ARPU forks into ARPPU because a denominator had nowhere else to live — and then built a governance regime to police the names, and called it the semantic layer. Look closely: it was never semantic. It was correctness wearing meaning's clothes — and therefore frozen. Governance solves drift. It cannot solve ambiguity. You cannot decree your way out of a grain.
Language solved this before we were born: grammar decides well-formedness independent of meaning, and that autonomy is what makes language both checkable and infinitely expressive. Data deserves the same constitution. Put correctness in the grammar layer — the algebra above: small, closed, machine-checkable. The moment it has a home, meaning is demobilized: names become pure communication — colloquial, translated, plural, generated — because nothing operational rides on a string anymore.
Codd separated logical from physical and called it data independence. This is the sequel: metadata independence — meaning separated from correctness so each can finally do its job. One inversion, two liberations.
Now return to the machine that answered in a second.
A language model is a semantic engine — magnificent at meaning, constitutionally incapable of guaranteeing correctness. Hand it today's fused metadata and its greatest strength becomes its signature failure: it reads avg_order_value and confidently means something by it. For fifty years, the argument between human analysts was the safety mechanism — three people with three numbers is visible disagreement, and visible disagreement gets caught in the meeting. The AI analyst answers instantly, confidently, singularly. The argument never happens. The debt came due the day the analyst stopped being human.
Split the layers and the model is finally in its element: living entirely in semantics — names, descriptions, intent, conversation — while every operation it proposes is adjudicated by a grammar it cannot touch. Hallucination, injection, drift can corrupt only the semantic layer. The grammar layer is the blast wall. The model proposes; the grammar disposes; the human decides among genuine alternatives. (How this differs from semantic layers, modeling languages, and text-to-SQL — the Ladder.)
And the system's answers gain the vocabulary honesty requires — four moods, as structured data: serve the number; disclose it with its assumptions attached; clarify when the question admits several legitimate readings; refuse what the data cannot answer, with the reason. "It depends," said precisely, is often the most correct answer there is.
That is a claim about running software. So watch it run.
Every number on this site is a recording — read the case.
New here? Start at Learn — the orientation hub: what is Columna, FrameQL, and a Manifold, the three manuals, and the live Explorer.
this is the actual wire — what an AI agent receives. Every answer is a pair: a result, and its disclosure. The mood is how the pair reads.
manifold cascadia · columna 0.18.1 · core 0.18.1 · contract 4 — produced by running the shipped package at build time, and checked again against it when this page was rendered. Nothing here is executing now.
SELECT aov AT {cal.month}serve earned by case 1 of 4
status: served
disclosures: none · rollup severity: none — nothing about this answer was withheld or qualified.
| cal.month | aov |
|---|---|
| 2024-01 | 139.91 |
| 2024-02 | 125.81 |
| 2024-03 | 127.25 |
3 of 24 rows returned
SELECT buyers AT {cal.month}disclose earned by case 2 of 4
approximation · material
buyers.distinct: HLL distinct estimate [HLLSketch(12)]
severity info
estimated · ±1.6% these are estimated values, not an exact count — buyers.distinct: HLL distinct estimate [HLLSketch(12)]
| cal.month | buyers |
|---|---|
| 2024-01 | 589.64 |
| 2024-02 | 550.03 |
| 2024-03 | 603.49 |
3 of 24 rows returned
SELECT avg(aov) AT {cal.year}clarify earned by case 3 of 4
input_anchor_ambiguous
inline reduction 'mean(aov)' does not pin its input anchor — the grain to resolve 'aov' at before reducing to cal.year is underdetermined; pin it, e.g. 'mean(aov@cal.month)'
No result. The request does not yet identify one analytical object.
SELECT stock.sum AT {store*cal.month}refuse earned by case 4 of 4
blocked_reduction
'stock.sum' reduces by 'sum' across blocked lineage 'calendar' — 'sum' is declared BLOCKED along 'calendar', so this reduction has no lawful reading at store*cal.month; per-bucket totals do not reconcile along this axis. Generating a new family does not create the permission: the declared reducer needs the same authority the declaration withholds.
No result. The request has no lawful reading against this manifold.
Browse the whole Manifold → the Explorer
Columna's "wire" is the answer format an AI agent receives from a data query: a RESULT paired with its CONTEXT, in one of four moods — serve, disclose, clarify, refuse — on one contract (contract_version "4"), identical over MCP or a direct API call. Example: asking `avg(aov) @ cal.month` — an average with no pinned input grain — returns `clarify` (which grain to average from), never a guessed number. Explain this wire format to me, and answer my follow-up questions about it.
This transcript is generated by running the shipped package, columna-server demo --play, at build time. It is never edited by hand. What you see is what installs.
The mood you should test first is the one vendors never demo. Ask it for a metric that sounds plausible and doesn't exist. It will not guess. During our own final pre-launch test, our test script did exactly that — and the system refused, listed what it did have, and asked. The test marked it as a failure. The test was wrong; the refusal was the only correct answer in the room. We fixed the test, and we now assert that refusal forever. the whole confession → the story. Vigilance fails — it failed the industry, it failed our own benchmark, it failed the very test we wrote. Structure holds. That is why the defense is an algebra and not a best practice.
That is the argument. The demo is two minutes: pip install columna.