BrainPath: A Deterministic Addressing Layer for Multimodal Human Brain Data
1. Introduction
Public human neuroscience data is abundant. The TUH EEG Corpus holds recordings from more than 15,000 subjects; OpenNeuro hosts over 1,600 BIDS datasets (Gorgolewski et al. 2016); HCP, UK Biobank, and ABCD together contribute tens of thousands of multimodal participants. By subject count the field has enough data to train models at the scale that transformed language and vision.
Yet this data remains largely unusable in aggregate. Teams training models across these archives typically spend months assembling a corpus by hand, reconciling layouts, formats, identifiers, and preprocessing conventions that differ across sources. The result is coupled to that team’s modeling assumptions: a sampling rate, a parcellation, a coordinate frame. Change one and much of the assembly is redone. Such corpora are laborious and idiosyncratic, and they are rarely published, plausibly because their value is specific to the assumptions that produced them. The bottleneck is therefore not how much data exists but that it has no shared way of being named and requested.
Research agents sharpen the problem and make it measurable. Asked to assemble datasets, they inherit infrastructure built for humans clicking through browsers. On a benchmark of viral sequence retrieval, agents scored between 16.9% and 91.3% mean accuracy; three runs of one prompt returned 106, 15, and 5 records where 266 were expected, and the resulting phylogenies moved an inferred outbreak date by months (Nasri et al. 2026). A deterministic retrieval layer lifted every agent above 90% and removed most run-to-run variance. The limit is not agent reasoning but the absence of a machine-actionable way to express a data request and re-execute it.
The object does not exist yet. Sequence retrieval at least returns something stored. In neuroimaging the requested object typically is not. A user wants denoised BOLD in MNI152, parcellated by an atlas, for a cohort filtered on head motion. Such an object rarely sits on disk. It is the output of a pipeline, and the pipeline admits many defensible variants, a 0.1 Hz versus 0.5 Hz high-pass cutoff among them.
These variants are not cosmetic. Scoring preprocessing operations by the percentage of channels showing a significant condition difference, Delorme found that apart from high-pass filtering and bad-channel interpolation, automated corrections either had no effect or decreased statistical power; among optimized pipelines built in EEGLAB, FieldTrip, MNE, and Brainstorm, only one beat plain high-pass filtering (Delorme 2023). Across whole workflows the spread is wider: when 70 teams analyzed one fMRI dataset, no two chose identical workflows, and their hypothesis tests diverged even between teams whose statistical maps correlated highly (Botvinik-Nezer et al. 2020). The neuroimaging analogue of retrieving coordinates from the wrong genome build is therefore not recording which analytic variant you received.
How the field copes. Curated catalogs fix the choices. MOABB (Jayaram and Barachant 2018) standardizes datasets and preprocessing for BCI benchmarking; the HCP minimal preprocessing pipelines (Glasser et al. 2013) and UK Biobank’s fixed pipeline do the same for MRI. Standardization works, but the choices live in code, and “minimal” is itself a choice. ABIDE Preprocessed goes further and distributes derivatives under URLs of the form
.../Outputs/{pipeline}/{strategy}/{derivative}/{file_id}_{derivative}.{ext}with four pipelines, four combinations of filtering and global signal regression, and roughly twenty outputs; Nilearn’s fetcher exposes the same grid as function arguments. This is a hierarchical path whose segments encode the analytic variant, built by hand by people who needed one.
Three observations follow. First, the need is real and already felt: practitioners independently reach for variant-bearing paths. Second, each such answer is a fixed grid rather than a grammar, so it expresses only the variants enumerated in advance, and its vocabulary remains local to one catalog. Third, because the variants cannot be derived on request, the whole cross product must be materialized ahead of time, which is what holds it to sixteen combinations.
These catalogs therefore force a trade: fix the pipeline and lose flexibility, or assemble your own and lose comparability. Naming the variant dissolves the trade, since a shared default and a deviation from it become the same kind of object, differing in an address rather than in whether an address exists.
Contributions. We present BrainPath, an addressing layer with four components. First, the address is a URI, so transport, authority, hierarchy, and parametrization are inherited rather than reinvented. Second, a small sigil algebra lets one string serve as both a name and a query, which makes the state of curation itself queryable. Third, the analytic variant is carried in the address, with one normal form behind three surface forms, so requesting a different parameter requests a different artifact. Finally, resolution derives a plan from declared operator contracts and reuses materialized derivatives by longest-prefix matching. Table 1 lists the requirements each component discharges, and Section 9 positions the design against BIDS URI, build systems, workflow engines, and view-based query answering.
2. Requirements
| Requirement | Section | |
|---|---|---|
| R1 | One address denotes one artifact: the same address yields the same bytes, across catalogs and over time | Section 3, Section 4.3, Section 6 |
| R2 | Identity is location-independent under a change of catalog, transport, or storage tier | Section 3 |
| R3 | Identifiers are collision-free across datasets, without linking individuals across them | Section 5 |
| R4 | One grammar covers fMRI, EEG, MEG, DWI, fNIRS; adding a modality does not change it | Section 3 |
| R5 | Addresses are legible to a reviewer and constructible by a program | Section 3 |
| R6 | Addresses are safe to publish: no personally identifying information | Section 3, Section 5 |
| R7 | An address may name an artifact that does not exist; resolution materializes it | Section 4, Section 6 |
| R8 | The analytic variant is in the address, not in a pipeline configuration | Section 4 |
| R9 | Provenance is machine-readable and re-executable | Section 5, Section 6 |
| R10 | The cost of a request is knowable before execution | Section 6 |
| R11 | New operators and vocabulary terms need no grammar change | Section 3, Section 5 |
| R12 | Partially curated data stays queryable | Section 3, Section 7 |
| R13 | Cohorts are selectable on quality metrics and subject facets | Section 6 |
| R14 | One expression selects a set of artifacts | Section 6 |
| R15 | Reads are chunked and zero-copy, sized for training batches | Section 7 |
| R16 | Access tiers are enforced across differing data use agreements | Section 6, Section 7 |
Two constrain the design in ways easy to get wrong. R3 is weak by intent. A naive reading would have the scheme assert that subject X in one archive is the person behind subject Y in another. Public archives are released under de-identification guarantees, and cross-archive linkage is the risk those guarantees exist to prevent. The requirement is only that names not collide: sub-01 occurs in hundreds of datasets. Prefixing with the dataset makes identifiers unique and provenance legible while asserting nothing about the people behind them. Entity resolution is out of scope by design, not omission.
R6 follows from what an address is for. Unlike a connection string, an address is meant to be written down: pasted into a paper, a notebook, a log. Anything it contains is published, which rules out personal data and argues against embedding credentials even though the URI grammar permits them.
3. The address
3.1 A URI, not an identifier resembling one
A URI already factors an access specification into the components this problem needs: a scheme selecting how a thing is reached, an authority naming who resolves it and under what credentials, a hierarchical path naming the thing, and reserved query and fragment components for request-scoped parametrization. A new identifier format would re-derive all four incompatibly, then require client tooling that already exists.
One address runs through this paper:
brain:///hcp-100307/:fmri/:mni152/:bold/:rest/:denoised/@xyz=-42,38,12;t=0:It names subject 100307 of the HCP dataset; modality fMRI; expressed in MNI152; data type BOLD; acquired at rest and denoised; sliced at one voxel across the full time course. Where the bytes live, in what format, and which pipeline produced them appear nowhere, and the artifact need not exist when the address is written.
The brain scheme names the logical namespace; a transport suffix names how to reach a catalog that resolves it. brain:///<path> uses the default local catalog, brain+https://catalog.example.org/<path> a named one, brain+s3://archive/<path> an object store. These name one artifact: the transport says how bytes are fetched, never what they are (R2).
The authority holds the catalog, which keeps a separation enforceable by syntax. Where an address resolves is independent of whose data it is, recorded by the dataset prefix inside the key (hcp in hcp-100307). Provenance rides in the key and survives being copied between catalogs, the property lost when provenance is encoded in a storage location, as a filesystem layout encodes it. The authority also admits user:pass@host:port; we do not use it, since an address is publishable (R6) and the transport handles authorization.
Everything after the authority is the identity, so two addresses with identical paths denote one artifact regardless of scheme or authority, making R1 checkable by comparison. The query and fragment stay free for request-scoped options such as output format, a chunk-layout hint, or an access token. Literal ? and # are therefore forbidden in a path, and unresolved terms take ! rather than the more obvious ?. One rule keeps this honest: a parameter that changes the produced bytes is not request-scoped, and canonicalization lifts it into the path (Section 4.3).
Two layers. The raw layer is the set of provider-native URIs (s3://openneuro.org/ds002158/..., file:///mnt/archive/...) under which the original bytes live. These are never rewritten: that layout is the provenance record, and normalizing it would destroy the evidence tracing a derived artifact to a specific release. The canonical layer is the brain:// address. A catalog maps canonical addresses to raw sources plus the derivation producing what was asked for, and a .raw accessor returns the native URI, keeping provenance one dereference away (R9).
3.2 Grammar
address = scheme "://" [ authority ] "/" keys *( "/" facet ) [ "/" coords ]
scheme = "brain" [ "+" transport ]
transport = "https" / "s3" / "file" / token
authority = catalog ; empty selects the default local catalog
keys = key *( "," key ) / "*"
key = prefix "-" local-id *( "/" sublevel )
facet = sigil term [ "(" param *( "," param ) ")" ]
sigil = ":" / "!" ; resolved / unresolved
param = name "=" value
coords = "@" ( "*" / axis *( ";" axis ) )
axis = akey "=" ( point / range / namelist )
point = number *( "," number )
namelist = token *( "," token )
range = [ number ] ":" [ number ] [ ":" step ] ; half-open; ends omissible
step = numberLexical productions are omitted. catalog, prefix, local-id, sublevel, term, akey, name, value, and token are unreserved-character strings in the sense of RFC 3986 (Berners-Lee et al. 2005); number is an integer or decimal literal.
Four sigils carry the expressive power while keeping every address a valid URI: : marks a controlled-vocabulary term, ! an unresolved one that is not yet mapped but stays indexable and queryable, @ introduces the coordinate selector, and * is a wildcard at any position.
: and ! partition the facets into what the catalog understands and what it does not yet. Making “not yet understood” an indexable state keeps partially curated data queryable rather than blocked (R12), and turns ingestion into the rewriting of ! terms into : terms (Section 7). * lets one string serve as both name and query: brain:///*/:fmri/... names a cohort (R14), so the common case needs no separate query language. Both rejected alternatives were the obvious first choice: ~ collides with shell home-directory expansion, and ? would forfeit the query component.
3.3 Facets and coordinates
Three facets are required and positional: :modality (:fmri, :eeg, :meg, :t1w, :dwi, :fnirs), :space (:native, :mni152, :fsaverage, :source), and :dtype (:bold, :voltage, :fa, :connectivity). Optional qualifiers follow, drawn from acquisition condition (:rest, :task), processing (:denoised, :filtered), and feature form (:parcellated, :roi-mean). Terms are lowercase-normalized. Encoding facets as path segments over a closed vocabulary lets them be dictionary-encoded to integers (Section 7), matched as a vector, and validated by set membership; adding a modality means adding a term and its operators, never changing the grammar (R4, R11).
The trailing @ segment selects a region within an artifact, following W3C Media Fragments (Troncy et al. 2012): @* for the whole artifact, @xyz=-42,38,12 for a point, @xyz=-42:40,30:50,10:20 for a box, @t=0:1200 for a time range, @t=0: for an open one, @t=0:1200:2 strided, @ch=Cz for a named stream, and ; to combine axes. Two conventions need stating. Ranges use : rather than the comma of Media Fragments, since the comma already separates the components of xyz. And ranges are half-open, matching Python and NumPy slicing, which is how these arrays are read, so adjacent ranges tile without off-by-one correction.
Selectors are typed by the facets preceding them. A coordinate means nothing alone: :space fixes the units of @xyz, so a template space implies millimetres while :native implies voxel indices, and :modality fixes how @t indexes. This typing lets one syntax serve volumetric, surface, and sensor data, and it is why the selector comes last.
Normalization resolves an empty authority, lowercases terms, rewrites the key to {prefix}-{local-id}, defaults an absent selector to @*, and applies the parameter rules of Section 4.3, yielding the unique normal form under which an artifact is indexed and cached. Validation then checks that the string parses; that : terms are vocabulary members; that parameters are declared with values in their domain; that the selector is well formed against the facets typing it; and that no literal ? or # appears. An unrecognized term can be rewritten with ! and stays queryable; a malformed parameter or selector cannot, since it marks a request no operator can satisfy.
4. Addressing analytic variants
4.1 The problem
Section 1 established that preprocessing admits many defensible variants and that the choice moves results. The methodological response is settled: enumerate the reasonable paths and report across them, as multiverse analysis prescribes (Steegen et al. 2016). How to name the results is not. In practice the variant lives in a pipeline configuration file, a directory name, or a BIDS desc- label documented elsewhere or not at all. In each case two artifacts that differ materially can carry one name. An address that does not determine the bytes is not an address, and it fails R1.
The space is also combinatorially large. A pipeline exposing k parameters with m plausible values each yields m^k variants per recording, before multiplying by subjects and modalities. The requirement is therefore sharper than recording the variant: the naming scheme must denote variants never computed, cheaply, so the space is addressable without being materialized (R7, R8).
4.2 Three surface forms
Parameterized qualifiers are the primary form:
brain:///hcp-100307/:eeg/:native/:voltage/:rest/:filtered(hp=0.1,lp=40)/@ch=Cz
brain:///hcp-100307/:eeg/:native/:voltage/:rest/:filtered(hp=0.5,lp=40)/@ch=CzTwo artifacts, two names, both derivable on demand. Parentheses, commas, and = are sub-delimiters RFC 3986 permits in a path segment (Berners-Lee et al. 2005), so this needs no percent-encoding.
Named presets are vocabulary terms expanding to a parameterization: a lab can publish :bandpass-strict meaning :filtered(hp=0.5,lp=40), keeping common addresses short and making a convention citable. Query parameters support late binding, letting a client sweep one parameter without rebuilding paths; this form does not survive canonicalization.
4.3 One normal form
Three surface forms would be three identities without a rule collapsing them. Canonicalization applies in order: expand presets; lift byte-affecting query parameters into the path; fill omitted parameters from the operator’s declared defaults; sort parameters by name; and normalize values, so 0.50, 0.5, and 5e-1 converge. The three addresses below therefore share one cache key:
in: .../:rest/:bandpass-strict/@ch=Cz
in: .../:rest/:filtered(lp=40,hp=0.50)/@ch=Cz
in: .../:rest/:filtered/@ch=Cz?hp=0.5&lp=40
out: .../:rest/:filtered(hp=0.5,lp=40)/@ch=CzEager default expansion defends against a failure that is easy to miss. If defaults resolved lazily at execution, a bare :filtered would mean whatever the operator’s default happened to be that day; change the default in a later release and every address omitting the parameter silently changes meaning, breaking R1 along the time axis, invisibly. Expanding at normalization pins the variant when the address enters the system.
The lifting rule is likewise not stylistic. If a byte-affecting parameter stayed in the query, two requests differing only in their query strings would return different data, so the cache key must include the query, so the query is part of the identity, contradicting its request-scoped role. Worse, HTTP caches, proxies, and CDNs differ in whether they key on query strings, leaving correctness to deployment configuration. The resolving rule is easy to check: a parameter that changes the bytes belongs in the path.
Parameters are not free-form. Each operator declares the parameters it accepts with types, domains, and defaults, and that declaration governs validation and default expansion. An undeclared name or an out-of-domain value is rejected at parse time rather than producing a plausible artifact nobody can reproduce. Unresolved terms are the exception: !weirdfilter(hp=0.1) carries its parameters verbatim until the term resolves during ingestion.
4.4 Addressable is not materialized
Most points in the variant space are never materialized; an address for an uncomputed variant resolves by deriving it (Section 6). Which variants to precompute is a view-selection problem under a compute budget: the catalog observes the distribution of requests and materializes what pays for itself, leaving the rest available at the cost of running the pipeline.
Two capabilities follow from combining parameters with the sigil algebra. Since a parameter value is a position and * is a wildcard at any position, a sweep is addressable:
brain:///*/:eeg/:native/:voltage/:rest/:filtered(hp=*,lp=40)/@ch=CzA specification curve becomes a query result rather than a scripting exercise. And because the variant is in the name and the name is publishable (R6), a method becomes citable: a paper can state its preprocessing by quoting an address instead of describing a pipeline in prose a reader must reimplement, and a reader who disagrees with a choice can evaluate the alternative by changing one parameter.
5. Data model
Three classes, expressed in LinkML so the schema is machine-readable rather than prose. Expressiveness lives in the address grammar and the operator registry, not in an elaborate entity model.
Key names a scope of data. Brain data follows a containment hierarchy, catalog to dataset to subject to session to run, and the obvious model of five joined entity classes makes every cross-level question a five-way join. Key collapses them into one recursive relation with id (hcp-100307/ses-01/run-2), level, and parent. Because ids are hierarchical strings, descendants share a prefix, so subtree selection is a prefix scan and roll-up traverses one relation. The explicit parent pointer keeps structural edits cheap, avoiding the renumbering interval-based encodings pay on insertion. Level-specific attributes hang off the same class, populated only where they apply: age, sex, and diagnosis at subject level; modality, repetition time, sampling rate, and the raw locator at run level. The honest cost is that the relation is semi-structured, with attributes conditioned on level rather than guaranteed by the schema; we accept it because the alternative pays a join on every query for a guarantee a level check already provides.
A key’s id is {dataset_prefix}-{local_id}, where local_id is the dataset’s own subject label, normalized. It is never derived, hashed, or linked (R3). Sensitive attributes live in the model, not in the name: age, sex, and diagnosis are queryable attributes held under the access controls the source agreement requires (R16), and none appear in an address. The name carries identity, the catalog carries attributes, and the two are governed separately.
Representation is what an address names. Its identifier is the canonical address minus the selector. Beyond the content facets it records materialized, rawUri, derivedFrom (the ordered operator chain with resolved parameters), the pinned pipeline version, and quality metrics (meanFd, tsnr, nOutlierVolumes) usable as query predicates. Two fields carry the weight: materialized makes an address a specification rather than a pointer, so a representation may be described, indexed, and queryable while no bytes exist (R7); derivedFrom makes a result re-executable by a third party (R9). space does double duty, fixing coordinate units and serving as the alignment key joining modalities.
Transform is a registered operator: requires and provides over representation properties, an operationType (map, flatMap, reduce, filter, compose, write), a versioned uses, declared parameters with domains and defaults, auxiliary inputs that are themselves addresses, and a relative cost. The requires/provides pair is a precondition-effect contract, the operator model of classical planning; it lets a plan be derived from a goal instead of written by hand, and makes adding an operator a registry entry, not a planner change (R11). parameters is the authority behind Section 4. inputs makes planning recursive: registration needs a structural scan, parcellation an atlas, source reconstruction a head model, each resolved by its own plan, so a shared input resolves once.
Two small classes support parcellation: an Atlas with its space, region count, and version, and a Region with its index and hemisphere. A parcellated representation is interpretable only against a specific atlas version, so the atlas belongs to the artifact’s identity, never an assumption buried in the pipeline.
6. Querying and resolution
6.1 Patterns
Since * is admissible at any position, the grammar that names one artifact names a set:
brain:///*/:fmri/:mni152/:bold/:rest/:denoised/@* every subject
brain:///*/!* anything unresolved
brain:///*/:*/:*/:*/@* only fully resolved artifactsThe last two have no obvious equivalent elsewhere. Because unresolved terms are an indexable state rather than a missing value, the state of curation is queryable: !* returns the backlog, an all-: pattern the frontier, and their difference measures progress. A pattern matches when every constrained position agrees and the coordinate extent intersects the selector; facets are dictionary-encoded integers and keys are prefix-indexed, so matching is a vectorized scan, not a join. Matched artifacts need not exist: a pattern ranges over what a catalog can produce.
Cohort predicates, motion thresholds and age ranges among them, are not expressible in the address, since they are not identity. Encoding them would make two selections of one artifact look like different artifacts and would badly reimplement filtering a database does well. A query therefore has two parts:
dataset.query(
"brain:///*/:fmri/:mni152/:bold/:rest/:denoised/@*",
where="mean_fd < 0.5 and outlier_fraction < 0.3 and group == 'control'",
)The pattern gives the shape, the filter the selection, so training-set construction with quality control is one query rather than a script that fetches, computes, and discards (R13). Two join forms follow from the model: an alignment join on space, since representations of different modalities in one frame are coordinate-comparable, and a containment roll-up on the key hierarchy.
Results are access-scoped. Archives carry different agreements, so a catalog evaluates queries against the caller’s entitlements and one pattern legitimately returns different result sets (R16). Two properties keep this honest: restriction is visible, so a caller can tell a small cohort from a restricted one and cannot silently train on less data than they believe; and restriction never changes identity, so a withheld artifact keeps the address it would have had. Access governs resolution, never naming.
A query returns names, not bytes. The expansion of a pattern is a publishable specification of a training set, every element stating its subject, modality, space, variant, and extent, referring to no filesystem. This also exposes a limit: a pattern is evaluated against a catalog at a moment, and a growing corpus changes what it returns, so a cohort meant to be reproducible must be pinned by publishing the expanded list.
6.2 Resolution
Resolving an address proceeds through nine stages: parse, normalize, resolve, expand, match, plan, bind, slice, return. The first three are addressing; the rest are query compilation and execution. An address naming an existing artifact and one naming an artifact never computed take the same route, differing only in how much work the match stage leaves for the last.
The address states a goal. Planning selects every operator in the goal’s modality family whose condition holds, then topologically orders them by their precondition-effect dependencies, seeded with properties already holding. A native-space goal starts with the spatial property satisfied, so registration operators are never selected. For the running example the derived chain is lookup, fmri.read, fmri.mc, fmri.coreg, fmri.norm, fmri.denoise, coord, return, with declared relative costs summing to 26. This chain is written down nowhere as a pipeline: it is derived from the goal and the registry, so requesting a different variant means registering operators rather than editing a planner (R11). Planning is recursive over a DAG of addresses, since auxiliary inputs are themselves addresses, and the cost of a request is the cost of its DAG, which lets a caller learn the price before committing (R10).
Reuse. Standard pipelines already produce expensive derivatives. A materialized derivative records which properties it satisfies, so the planner takes the longest leading prefix of the plan those properties cover, skips it, and executes the remainder. For the running example an fMRIPrep derivative in MNI152 provides the first five steps, leaving three to run and reducing cost from 26 to 7. This is answering-queries-using-views (Halevy 2001) specialized to linear chains: the view is a derivative, usability is prefix containment, and the rewrite is prefix truncation. Restricting to prefixes keeps matching cheap, at the cost of missing derivatives that overlap a plan without prefixing it.
Two properties matter. Reuse never affects correctness. With an empty cache the same address yields the same bytes, more slowly, so materialization is an optimization and never a dependency. Matching is also parameter-aware, in that a derivative filtered at hp=0.5 does not satisfy a goal requiring hp=0.1, so the properties a derivative provides include its resolved parameters. Without this, prefix matching would serve the wrong variant while reporting success, the failure this scheme exists to prevent.
Not every request yields one chain. A wildcard facet leaves a template grounded once per matching entry; a cross-modal target is an entity join across per-modality subgraphs, planned as a join over sub-plans. The planner reports which case applies rather than silently producing something plausible.
Every artifact carries the operator chain that produced it, with parameters resolved and versions pinned, and the raw sources stay reachable. A colleague or an agent receiving a result can inspect not only what was retrieved but how, re-execute it, and get the same bytes (R1, R9).
7. Storage, serving, and ingestion
Metadata and bytes are kept apart. The catalog holds keys, representations, operators, and quality metrics: small, structured, queried constantly. The store holds bytes. Queries run against the catalog and return addresses; only resolution reads the store, so filtering 100,000 subjects scans a compact table rather than traversing an archive.
An embedded analytical database (DuckDB in our implementation) holds the catalog. Vocabularies are closed and small, so each term maps to an integer code and a facet suffix becomes a short integer vector, making matching integer comparison over a columnar layout and giving !* an indexable code. A containment index over Key serves subtree selection as a range scan on a sorted index. Coordinate indexing is delegated to R-tree-family structures for spatial extents and interval structures for time, and is consulted only when representations must be found by extent.
The store holds derivatives in two shapes: arrays chunked and compressed, as Zarr in our implementation, and tables read as Arrow buffers so a consumer receives usable memory without deserializing. Both let the selector push down to native access.
Chunking is co-designed with the selector. The training loop draws shuffled minibatches through parallel workers, each item a window of channels over a time range or voxels over a volume range (R15). If chunk shape and selector shape disagree, every item read amplifies. Chunking a 4D volume per-timepoint, for instance, makes a voxel time course touch every chunk. Here the addressing scheme pays back. Since every request is an address carrying an explicit typed selector, a catalog holds a structured log of its access pattern. It records not “a process opened this file” but “this region of this representation, with these facets, this often.” Chunk shape, compression, and materialization choices then follow from that log rather than from guesses made when the archive was laid out. Two constraints qualify this: compression trades IO against CPU, and on object storage fine chunking multiplies request count, so chunks are grouped into larger objects with the fine grid preserved inside.
Because identity is location-independent and raw data is never rewritten, a derivative can be materialized, evicted, re-chunked, or moved between tiers and no address changes. This is physical data independence at the granularity of an individually derivable artifact, and it lets a deployment start with nothing materialized and grow cheaper without rewriting a query. Scaling adds catalogs rather than reshaping data: one logical request is served unchanged by a local catalog or an institutional one, and dataset prefixes are globally meaningful, so catalogs compose into federations without a coordinating authority.
Ingestion. Onboarding is usually all-or-nothing: a dataset must be mapped onto a schema before any of it is usable, so the cost of the last confusing field falls due before the first useful query. Here the minimum is keys for the entities and a raw locator for each run. Every recording then has an address, appears in results, and resolves, because resolution derives what it needs from raw data. Facets readable from source metadata become resolved terms; the rest take !. No byte is copied or converted, keeping the cost proportional to entity count rather than data volume.
Curation then proceeds against a live corpus and can follow demand: the catalog knows which unresolved terms appear in requests that failed, so the order of work derives from the request log. The metric that follows is time to queryable, the interval between obtaining a dataset and its first successful resolution, worth measuring in place of time to fully ingested, which describes a state a living corpus never reaches. Making data addressable is bounded and mechanical; making it well described never finishes; conflating them turns onboarding into a project.
Dataset revisions bear on determinism. The raw locator pins a specific release, so a re-release is a different raw source, not a mutation. If it changes bytes for entities that already have addresses, a catalog must not quietly serve one for the other: either the key carries the release, so old and new coexist, or the catalog records the switch in provenance. We prefer coexistence, which costs a longer key only for datasets that revise.
8. Reference implementation
The implementation shows that the scheme is mechanically resolvable. A parser takes an address to a syntax tree of transport, catalog, key set, classified facets, and selector, enforcing the resolved/unresolved/wildcard distinction at parse time. A registry of roughly thirty operators across five modality families declares conditions, requires and provides sets, auxiliary inputs, costs, and dataflow shapes; it is data, not code. The planner computes the goal, selects operators, orders them topologically, collects auxiliary inputs, and reports the non-linear cases explicitly. A small set of registered derivatives standing in for standard pipeline outputs supports longest-prefix reuse matching, which can be switched off to confirm it changes cost and never the plan’s target. Plans export to a standard workflow notation, and an interactive page shows parse, plan, costs, and reuse live; it produced the examples here and makes the claim that plans are derived rather than authored checkable by a reader.
Editing one facet changes the derived plan as the design predicts, with no pipeline edited anywhere: a template space introduces registration steps a native request never selects, and a processing qualifier introduces the operator providing it.
The implementation stops at planning. It does not execute operators, read neuroimaging data, or implement the catalog, store, access scoping, or ingestion; those are design, and this paper makes no measured claim about them. It also predates the parameterized qualifiers of Section 4 and does not yet parse, canonicalize, or match on them. Since parameterized variants are the paper’s principal contribution, closing that gap is the priority: extend the parser, implement the canonicalization rules including eager default expansion, add parameter declarations to the registry, and make reuse matching parameter-aware.
10. Limitations
Determinism ends where the operators do. One address yields one artifact only if the operators are deterministic, and registration routines that sample stochastically, decompositions with random initialization, and nondeterministic GPU reductions are not. A random seed is a parameter like any other, so an operator exposing its seed brings that variation into the address; what remains is variation an operator does not expose, such as library versions and thread scheduling. For these the guarantee weakens to “the same address yields the same specification, resolved against a recorded implementation.” This is a known build-system hazard (Mokhov et al. 2018), inherited more acutely here, since numerical nondeterminism is routine rather than exceptional.
Scope of planning and reuse. Planning covers a linear chain over a DAG of auxiliary inputs. Derivations that branch, iterate to convergence, or depend on a value computed midway fall outside the model, handled as joins over sub-plans. The planner is a topological ordering rather than a search, so it does not choose between alternative routes to a goal. Longest-prefix matching likewise misses derivatives that overlap a plan without prefixing it, leaving recoverable computation on the table; how much is an empirical question we have not answered.
Patterns and governance. A pattern is not reproducible on its own, and publishing the expanded address list is a workaround, not a property of the design. The scheme’s usefulness also scales with agreement on vocabulary while offering no mechanism for reaching it: ! makes disagreement survivable and presets let a group publish a convention, but neither settles who admits a term, how terms are deprecated, or how two catalogs that resolved one term differently are reconciled.
Harmonization does not fit. Multi-site harmonization depends on the subjects it was fitted over, so it is not a function of one representation. Expressing it would require naming the reference cohort in the artifact’s identity, reintroducing the pattern-stability problem where correctness depends on it. We leave this open, and note that a corpus assembled across sites will want it.
Will better models make this unnecessary? If agents become capable enough to navigate archives unaided, an addressing layer still earns its place, for reasons independent of model capability. An agent working through a bespoke retrieval does it anew each time, producing a result whose correctness rests on that run rather than on anything checkable afterward. That a published cohort be re-derivable years later by someone else is a requirement about naming, not intelligence, and it does not relax as models improve. A weaker claim also suffices: having an agent not need to reconstruct the retrieval is cheaper and easier to audit, and the argument does not require agents to be bad at their jobs.
What we have not evaluated. This is a design paper. Everything in Section 6 and Section 7 is argued rather than measured: how the catalog behaves at 100,000 subjects, what chunk shapes suit real training loops, how much reuse prefix matching finds against a real derivative population, and what onboarding a dataset costs. Each is measurable, and none is measured here.
11. Conclusion
Public neuroscience data is hard to use together not because the archives are badly built but because there is no shared way to name what a researcher or an agent wants, which is rarely a stored file and usually a specification of a derivation.
BrainPath is an addressing layer for that. Its address is a real URI, the decision the rest follows from. A small sigil algebra lets one string serve as name and query and makes the state of curation queryable. The analytic variant lives in the address, with one normal form behind three surface forms, so requesting a different parameter requests a different artifact rather than yielding a silently different result under one name. Resolution derives a plan from declared operator contracts, reuses derivatives by longest-prefix matching, and returns provenance sufficient to re-execute it.
Two consequences recur, both following from naming what was wanted rather than which bytes were touched. A catalog accumulates a log telling it what to chunk, what to materialize, and what to curate next: the workload describes itself. And a method becomes citable, since two studies quoting one address used one preprocessing, verifiably, and a reader who disagrees can evaluate the alternative by editing one parameter. A multiverse stops being a scripting exercise and becomes a query.
What remains is to build it at scale and find out which arguments survive contact with a real corpus.