Glossary
PartialThe authoritative glossary: every official term in the architecture, defined once; the other pages introduce them in bold as the story reaches them. A term the code does not implement yet is not a plain row here: design-only terms live in the :::design fences at the bottom, or on the sketch page that owns their domain (templates, calculations, expressions, time, views, AI).
| Term | Definition |
|---|---|
| fleet | Everything an install manages: the systems, the components in them, and the locations they occupy. Renamed from the earlier noun by ADR-0123. Fleet-wide is the widest scope a grant or a rollup can name. |
| fleet zoom | The /fleet page, read from GET /views/fleet: one band per root location, one round mark per system, coloured by the system’s verdict, worst first. One zoom down (a location’s ?zoom=1 face) marks are square components inside a system outline that carries the system’s verdict. A hole is a dashed card for a location with no system. A shared component draws solid once, ringed, in its primary system, and as a ghost outline elsewhere. Round means system, square means component. |
| id | A uuid. Immutable, the primary key, and what every foreign key stores (audit_log.resource_id included), so a rename rewrites nothing. |
| name | The renameable machine identifier an operator types and an address carries. One rule everywhere: a single kebab segment, no dots, at most 100 characters (ADR-0079); icmp-rtt-avg, not icmp.rtt-avg. storage.ValidateName is the one validator (ADR-0076). |
| label | An optional friendly string a human reads (“HQ Boardroom DSP”); a surface with none falls back to the name rather than re-casing it, VERBATIM. Nullable, and unset is SQL NULL and nothing else, normalized in Go at the gateway write path rather than by a constraint (ADR-0118); a read projects it as coalesce(label, ''), so nothing above the Storage Gateway sees the null, and a list ordering by it is order by label nulls last, name. On component, system and location it is half of a stored pair with label_generated, the pen: true means the platform owns the field and re-renders it from the resolved label rule, typing a value clears the pen, clearing the field returns it (ADR-0098). |
| label rule | An operator-authored Go text/template that renders an entity’s label, resolved most-specific-first (product / standard, then the type chain, then the global rule per entity kind; NULL at a tier defers outward). It runs over a closed map of strings and a closed grammar (an allowlist over the parsed tree: a fixed set of node types, and a fixed set of function names, rendered from the engine’s own declaration rather than listed here). The map bounds what a rule can read, so a secret is absent from it rather than filtered out of a syntax; the grammar bounds what a rule can do, since a value built inside a pipeline is never written and so cannot be caught by a cap on output. Unparseable is a 422 at edit time; unrenderable degrades to no label (ADR-0098). words turns the separators a NAME is built from into spaces, which is what lets a rule read a kebab name as words and is why the global LOCATION rule ships as {{title (words .Name)}} (ADR-0105). |
| acronym list | The platform dictionary a label rule’s title consults, label.acronyms in the platform,client settings namespace: a list of words with a fixed form, matched whole-word and case-insensitively, with the entry itself the form emitted (PoE, not poe). One install-wide list an admin writes and any authenticated caller reads, since the console renders a label from the same dictionary the server did. An operator’s list REPLACES the shipped one and provenance tells them apart; it is a fallback, not a guarantee, since vendor model numbers are unbounded and a missing entry degrades to ordinary title case (ADR-0099). |
| label recompute | The preview-then-apply verb a rule change is applied through (POST /components:previewLabels, then POST /components:recomputeLabels, and the same pair on /systems and /locations), gated by the entity’s own :update. A preview lists exactly the rows the apply then changes and leaves the fleet as it found it; it does that by RUNNING the apply and rolling back, since a location recompute stales the components and systems placed at it and a read-only pass could not see rows that only exist as a consequence of writes it never made. One audit row for the operation, keyed on the rule, never one per changed entity (ADR-0100). |
| label cascade | The eager half of the same engine: the restamp an act carries out inside its own transaction when its blast radius is bounded by a PLACEMENT (a location’s rename or relabel restamps what is placed at it, a system’s reclassify restamps its members, a membership move restamps that component). An act bounded only by the fleet (a rule edit, a classification row’s label, the acronym list) cascades nothing and waits for the verb. Unlike the verb, a cascade is not scope-filtered: it is the rest of a write the operator already made, not a query they asked for (ADR-0100). |
| segment | The shape of every name: lowercase letters, digits, and hyphens, opening on a letter or a digit. A name is exactly one segment; the former dot-joined keyspace rule is retired (ADR-0079). An address (below) is several segments joined by dots; no name is ever itself more than one. |
| address | The uuid id: immutable, the only reference the platform itself generates or persists, surviving every rename and move (ADR-0089). Distinct from a lookup (below), a second, human-typed way to name the same row. |
| lookup | A dotted path, a human-typed positional reference over a location, system, or component: location segments from a root, an accessor that switches plane, then plane-local segments (boi.17c.415a.$comp.display-1). Resolves to whatever occupies that position now; a positional reference honestly reporting a swap is the point, not a defect. Never stored, never a name: no name column holds a dot today, and this epic adds none (the last one that did, a keyspace catalog key, was backfilled dot-free by the one-name-rule collapse, ADR-0079). |
| accessor | The $comp / $sys / $role sigil that switches a lookup from the location plane (the path’s root, needing no accessor of its own) into the component, system, or role plane. $role parses (reserved syntax) but resolves nowhere today: no table addresses a system role yet. |
| render | A display-only compact projection of a resolved address, never accepted back by the resolver: the dash render (boi-17c-415a-display-1, the accessor stripped) and the bare render (boi17c415afp1 on a single GET, the final segment further compacted to the component’s component_type.abbrev and the row’s own stored ordinal, so a name an operator chose, which has no ordinal, is never restamped; a LIST skips that lookup and returns the segment uncompacted). Stripping and compacting are both lossy, which is why neither round-trips. |
| stem | The naming prefix a generated name is built from: <stem>-<n>, inherited down a classifier tree and overridable at any node. A component’s comes from component_type (ADR-0085); a system’s from system_type (ADR-0096). Distinct from the same row’s abbrev, the shorter form a render (above) uses. |
| name rule | A classifier’s opt-in to naming the rows it classifies, and what it names them: a nullable location_type.name_rule today, a declaration (a stem, possibly empty, plus whether the first of that stem in a bucket carries an ordinal) rather than the label rule’s template. NULL is the opt-out and means an operator names every row of that type, which is where all four shipped location types stay: a positional type is one an operator declares. An empty stem is a positional type, whose ordinal genuinely is its name (a parking deck called 1), right where the number is an arbitrary disambiguator and wrong where it is a designation read off a wall, which is why a floor is nominal (ADR-0103: a designation is B2, LG, 12A, never an ordinal). The declaration IS the mint, so a rule that could produce an illegal name is refused when the RULE is edited, by minting from it; a rule change renames nothing that already exists (ADR-0102). Not to be confused with the repo’s other name rule, the one kebab-token validation every name-bearing table shares (the name entry above). |
| ordinal | The number the platform allocated to distinguish one generated name from its siblings (display-1), stored on the row rather than read back out of the name (ADR-0097). Null means the platform owns no number here: an operator typed the name, or renamed the row and took it. Allocation still picks the lowest free one by testing the name it would mint against the placement bucket, which is why a stem-less name (a floor called 1) is expressible at all. |
| lane | Which of the five signal families a record belongs to: metric, property, event, and log inbound (what you receive), command outbound (what you issue; an instruction, not a reading). The lane is decided by catalog membership (which registry the name resolves in), not a per-key kind column, which retired with the catalog split. “Five telemetry lanes” is retired as the collective noun (ADR-0084): four lanes are telemetry, the fifth is not. |
| node | Edge process (omniglass node run); pulls and runs tasks and commands over interfaces; carries placement, heartbeat, bound credential. |
| node mode | The Storage Gateway’s placement-scoped write mode for node-driven ingest, between scoped and system: visibility is the node’s placement-derived visible_set, not all-visibility. See identity and access. |
| placement visible_set | The owners a node may write, derived from its materialized worklist (the owners of the tasks assigned to it). A node’s writes are confined to this set; an emitted owner outside it is an orphan / discovery candidate, never an authoritative write. See collection. |
| task | A node’s unit of collection: poll (we ask) or listen (we wait), over a stateless or stateful (session) interface. Content-addressed. |
| interface | A connection to a component, declared once per protocol; transport stateless or stateful (to a session). |
| interface_type | The transport: the wire an interface speaks over (ssh, http, snmp, tcp, icmp…), carrying its connection-param schema and its default reachability probe. Not the protocol handler, which is the driver. Decided to be a code registry rather than an operator-editable table (ADR-0073); today it is still a table. |
| driver | The collect layer: a protocol handler plus the transports it can run over plus the normalized catalog (what to fetch, how to parse) that turns a device family’s API into a pick-from menu. Consumes transports, never is one. Today the driver table carries identity only (name, version, official); the catalog is unbuilt (#489). |
| metric | A quantity: a numeric reading of a registered metric_type, a float8 row in metric. Quantities aggregate: AVG, percentiles, rate-over-time are all meaningful. The firehose. |
| property | A value: what something is right now, a jsonb row in property typed by a registered property_type. A value can be a number used as a name (input 3, zone 4): it does not aggregate, it has duration (how long was the input 3?). Written transition-only, so the series is its own edge history. Config is keyed to one as its observed side. |
| sample | One reading in a sample lane: its value on one owning entity at one time, with provenance + source + on-row lineage. A row in metric / property. |
| series | One sample stream: (type, owner arc, instance, provenance). The unit current-value reads, transition detection, and retention all key on. |
| current value | The latest series row, derived by reading the series (order by ts desc), never stored separately: the one-catalog design’s latest-value store retired (ADR-0079). A declared series whose latest row is the unset tombstone has no current value; the effective read (EffectiveProperties) coalesces the contract default in. |
| log_line | A component’s log lines, untyped raw arrival on its own ingest lane (not a sample, no registry gate, no catalog). Component-only: a node’s self-logs land in node_log. A rule may derive an event from one. |
| node_log | A node’s own operational log lines (the self-log lane), keyed to the node, same payload shape as log_line without the owner arc. Split by origin (ADR-0079); read at GET /nodes/{name}/logs. |
| canonical signal | A registered, owner-agnostic measurement name (power-state, not room-power); one comparable signal across every vendor. |
| owner / owner_kind | A sample/event/command’s subject, the exclusive-arc: owner_kind + the matching typed FK (component_id/system_id/location_id/node_id), + CHECK. An alarm is component-local today; the arc is its design. (The singleton global arm is design, fenced below.) |
| metric_type | Registry for metric names: name, data_type (int / float), unit, precision, fusion_policy, and the official boolean. The numeric half of the split catalog (ADR-0079); every metric sample is typed by one (the FK is non-null). |
| property_type | Registry for property names: name, data_type (string / bool / json), validation, fusion_policy, and the official boolean. No unit, no precision, no kind: those are the metric lane’s facts. Every property sample is typed by one (the FK is non-null). (The template / org / official scope ladder and the promotion re-scope are design, fenced below.) |
| data_type | The lane key: a catalog row’s value encoding. int / float rows live in metric_type, string / bool / json rows in property_type, so the lane is the value type and no discriminator column is needed. |
| canonical unit | The one unit a metric_type stores in (its unit column): stored values are always in it, so the firehose is single-unit and every threshold / calc / fusion compares like with like. Native unit is a collection-time fact, display unit a presentation fact; neither is stored, and the conversion machinery is the unit registry (design, fenced below) with convert() on expressions. See samples. |
| event_type | Registry for event names: name, label, payload_schema, and the official boolean; seeded at boot (ADR-0063). (The template / org / official scope ladder it would share with property_type is design, fenced below.) |
| provenance | How we know a value: observed, calculated, intended, declared. Per row; each series carries one. The property lane admits all four; the metric lane admits the first three today (no declared-metric writer yet). |
| observed | Measured from a component. On-row lineage: source_rule (+ version), the edge function. |
| calculated | Derived from other samples by a calc_rule. On-row lineage: source_rule (+ version), the calc_rule. Distinguished from observed by the provenance column. |
| intended | A command’s declared effect, pending reconciliation. Lineage: command_id, the command that opened it (ADR-0079); the caused event stays stamped but optional. Only commands set it. |
| declared | An operator’s assertion, recorded as an ordinary series row (provenance='declared', no lineage: no rule, no event, no command). An edit appends; the history is the series. See tombstone. |
| tombstone | The unset of a declared value: an appended declared row whose value is JSON null, which every reader resolves as absence. Unset is itself an edit in the history, and PruneSamples never deletes it out from under a series. |
| source | Which sensor/path produced an observed value; the source column on every sample row, distinct from provenance; enables multi-source rows and the perspectives they carry. (A source registry with default weights is design, fenced below.) |
| perspectives | The source-tagged observed rows for one signal: multiple sources reporting one value, all preserved; a reduce-on-read policy produces the effective value, while every perspective stays queryable. |
| fusion_policy | Per-type reduce-on-read default/hint for multi-source observations (mode + tie-break + source weights), carried on both sample catalogs, not a mandate: a policy may default from the type but can be source-weighted, per-instance, or left to read time (keep all perspectives, decide on read). Applied on read. |
| config | The declared side of a canonical signal: an operator-set value keyed to a property_type, compared against the observed sample (drift) under a per-item reconcile policy. See config and credentials. |
| credential | An access secret with a structured shape, a pluggable SecretProvider (inline or external), and a lifecycle (refresh / rotation / expiry); read is secret:read-gated and every decrypt audited. Template-driven. |
| variable | A free interpolated value (a macro): $var:<name>, resolved platform→template→instance down the cascade; org-keyed, not signal-bound, no observed side. |
| drift | The gap between config’s declared value and its observed sample, on one signal. |
| reconcile | Closing config drift on one signal. Built: the read side (the /components/{name}/reconciliation want / told / is pivot). The per-item policy modes (observe / warn / enforce) and the one-shot adopt-observed import are design; see config and credentials. |
| cascade | Resolves the effective config / variable value by folding bindings (things somebody decided): platform, the component’s product, the system’s standard, then the location / system / component trees (weight-free, pure depth); most-specific (deepest) wins. Falls through to the type’s default when no rung bound anything. Type is not a layer (it resolves via a group filter); groups are placed by weight on the same specificity scale. |
| platform | The cascade’s least-specific binding tier, on both the fleet axis (owner_kind = platform, no FK) and the settings axis (the platform level): what an admin set for the whole install. A write there needs platform:<action> on top of the resource permission. Distinct from the global fleet owner, from a “platform credential” (a vendor account secret), and from the settings platform domain (a namespace classifier: a namespace only ever set at this level, never further down the principal axis, named after the level but not the same thing as it). See cascade. |
| default | What a value is when nobody bound it: a column on a declaration row (a setting’s struct tag, a classifier contract’s default_value on product_property and its siblings), beside the unit and the kind. Not a cascade tier: it shadows nothing, nothing shadows it, and the fold falls through to it. A kind with no declaration row has none (variable, secret, tag: absent means absent). |
| event | A discrete semantic occurrence the action layer reacts to. Keyed, point-in-time, owned via the arc. Not a sample. |
| origin | How an event arose: caught, caused, derived, scheduled. |
| alarm | One raised condition on a component: a stateful row with a severity (info / warning / critical), a message, a raised_at, and a nullable cleared_at. Clearing keeps the row, so what was wrong and when survives the fix. It reaches a system only through the component’s own verdict, which impairs every role that component occupies (below). Not event-sourced. The ITSM anchor. Design: the open-to-close lifecycle driven by an event_rule’s paired events, and an alarm owned by a system, location, or node rather than a component. |
| alarm capability | Retired (#626): alarm_capability. An alarm impairs its component wholesale now (any active alarm), rather than naming a capability it degrades. |
| severity | An alarm’s alert importance: the severity column, a fixed three-value domain today (info / warning / critical, a CHECK the storage validation mirrors); distinct from health (a different axis). It drives the component’s own verdict (any active alarm degrades it, a critical one is an outage) and nothing above: what reaches a system is that verdict, not any per-alarm detail. (The operator-editable severity-level registry is design, fenced below.) |
| command | A recorded invocation: a component was told to do something. A command row carries the same owner arc as a sample, the command_type it invokes (the seeded, driver-owned catalog of what a component can be told), its params, a recorded status (issued until a terminal settled / failed / timed-out, with settled_at stamping the terminal moment), and the caused command-issued event. A settleable command_type targets a property or a metric (a two-armed arc, never both); issuing opens an intended value naming the command (command_id) that settles against the observed value. The settlement verdict stays computed, never stored; the status records the outcome. Issued via :issue on the owner. |
| lineage (on-row) | A derived row carries its own lineage; no execution table. The rule version is the backtest hinge. |
| correlation id | A read-side trace id threading one causal chain end to end: the originating event through every downstream event and action it caused (event -> alarm -> flow/action -> command). Built on the causation lineage; alarm_id links one alarm’s open/clear events, the correlation id links the whole chain. DX/observability sugar, not a sample kind or a stored span subsystem. |
| component | A deployed instance (device/app/service); owns samples; a variable-depth tree; points at the product it is, the source of its shape. |
| product | The concrete SKU (Kestrel VRoom): binds a vendor, a driver, a kind, the component_type it is classified under, and the property contract its instances carry. Carries the official boolean. |
| capability | Retired (#626): the flat capability registry and its four join tables (product-side, component-side, role-side, alarm-side) are all gone. A product’s device-class genus is now component_type (the classification tree above product); what a component may fill is the typed-slot guard (system_role_type, system_role_product); what impairs a component is its own active alarms. |
| product_property | One line of a product’s declared-property contract: a catalog property, an optional default, and whether an instance must set it. |
| standard | The blueprint a system conforms to (Huddle Room, Classroom): the system-side counterpart of product, carrying variants (parent_standard_id) and the property contract its systems inherit. Optional on a system. A separate axis from system type (below): the standard is what a system is built to. |
| system type | The coarse genus of what kind of space a system is (board, class, video-wall): a nested, universally seeded registry (system_type), the system-side counterpart of component_type, carrying the stem, abbrev, and icon its systems inherit down the tree (ADR-0096). Optional on a system while the column is nullable. Not the standard (above), and not the retired column of that name, which became standard_id. |
| standard_property / location_type_property | The same contract line as product_property, declared by a standard for its systems and by a location type for its locations. |
| system role | A slot a system needs filled (a table microphone, a main display), declared on a standard (inherited live by every conforming system) or directly on one system (ad-hoc), on the same exclusive arc property uses. Carries a quorum, a typed-slot requirement (accepted component_types, optionally pinned products), and an impact. Not an IAM role (below). See core entities. |
| role (disambiguation) | The word is overloaded, and the two senses never cross. A system role is a slot in a system, filled by a component (system_role, system_role_assignment, storage methods ListSystemRoles / SetSystemRole / DeleteSystemRole). An IAM role is a permission set granted to a principal (viewer / operator / admin / owner; the role table, ListRoles / UpsertRole, the /roles routes). A health_role was a third, narrower sense (how a member counts in its system’s health rollup), now superseded by the system role’s quorum and impact. |
| role capability | Retired (#626): system_role_capability. A role’s requirement is now the typed-slot guard (system_role_type, system_role_product), checked once at assignment, not a conjunctive capability set. |
| component capability | Retired (#626): component_capability. A component’s own condition is now purely its active alarms (health); it no longer carries capability facts layered over its product. |
| effective capabilities | Retired (#626): EffectiveCapabilities. Nothing resolves a component’s provided set any more: assignment checks its product’s component_type classification once, and health checks its own alarm-derived verdict, on every read. |
| role assignment | The row that puts a component in a role in one system (system_role_assignment). Refused (422) when the component’s product is not classified within a component_type the role accepts (or, if the role pins products, its product is not one of them), and the refusal names both parties. The component FK is on delete restrict: a component staffing a role cannot be deleted out from under the system. |
| quorum | How many components a system role wants filling it, at least one. Two readings ride it: staffing (a role with quorum 2 and one assignment is understaffed by one, on operator-entered data alone) and health (a role with fewer occupying components than its quorum is impaired). It is also the redundancy knob: quorum 1 with two assigned tolerates one failure. |
| impact | What an impaired system role means for its system: outage, degraded, or none (a column on system_role, defaulting to degraded). It lives on the role, not the alarm or the component, because the same broken box matters differently depending on the slot it was filling: a dead confidence monitor is not a dead main display. The one input the health rollup takes from the declaration side. |
| impaired | A system role with fewer occupying components than its quorum. A component occupies a role unless its own health verdict is currently outage: a critical alarm takes it out of every role it fills, but an info or warning alarm only degrades it, and it keeps its slot. An impaired role contributes its impact. |
| understaffed vs. short | Two shortfall counts on the same role that are allowed to disagree (#626). understaffed (the roles read, EffectiveRole.Understaffed) is quorum - len(assigned): health-blind assignment arithmetic, unaware of whether an assignee is actually occupying its slot. short (the health read, HealthRole.Short, paired with satisfying) is occupancy-aware: quorum - satisfying, where satisfying counts only assignees whose own verdict is not outage. A quorum-1 role whose sole assignee carries a critical alarm reports understaffed: 0 (the assignment row is untouched) and short: 1, impaired: true (the assignee no longer occupies the slot) at the same instant; both are correct under their own definition, and a merely degraded (warning) assignee never causes the two to diverge, since it still occupies. |
| effective roles | The resolved read for one system: the roles its standard declares (from_standard) UNION those declared on it directly, each with its typed-slot requirement, quorum, impact, assignments, and its served assigned / understaffed counts (see understaffed vs. short above for the health read’s occupancy-aware counterpart). A one-off system resolves only the ad-hoc arm. |
| TelemetryBatch | The protobuf message a producer ships (proto/og/v1/telemetry.proto): one batch for one owner, carried on og.v1.telemetry.<node> (a node) or og.v1.api.telemetry (an authorized push). Per-lane arrays: metrics, properties, events, and logs, each entry validated against its own catalog at ingest; the polymorphic samples array retired with the split (ADR-0079). Named for what it carries, not for a passenger (ADR-0072). |
| component_template / _version | Retired by ADR-0071. The device shape is the product (with its product_property contract), which a component points at; nothing is pinned or versioned. A template now means a clonable example, not a shape an instance holds. |
| system | A composition of components/subsystems (the service tree); located at a location; classified as an optional system_type (what kind of space it is) and conforms to an optional standard, with live inheritance. |
| system_template / _version | Retired by ADR-0071. The composition shape is the standard a system conforms to, and the slots are system roles (a typed-slot requirement, a quorum, an impact). The frozen BOM is gone with the pin. |
| role requirement | Folded into system role. A slot’s requirement is now typed-slot (accepted component_types, optionally pinned products) rather than a capability set (#626); AssignRole refuses and names both parties. No allow-list: declare what you accept, any qualifying component fills it. See ADR-0049. |
| location | A place tree; classified by location_type; no template. |
| tag | An operator key: value label. The key is a tenant-wide governed vocabulary (the tag registry; new keys need tag:create, autocompleted in the UI); values bind per entity (tag_binding) and resolve union on key, override on value down the cascade. See config and credentials. |
| group | A named set of principals used as a grant subject: the principal_group, the built case. (The general entity group, a weighted cascade overlay and access scope over components / systems / locations, is design, fenced below.) |
| health | The first-class operational state of every entity, carried as a calculated property sample on the owner arc (source_rule = health-rollup): an alarm impairs a component’s own verdict, a role short one occupant falls below quorum and is impaired, its impact sinks its system, and a location takes the worst of its systems. A model, not just a rule. A health state is this concept, not a table: the sample table formerly named state is now property. See health. |
| verdict | One health value: healthy < incomplete < degraded < outage, ordered so “worst” has a meaning. outage rather than down, because a device is down and a room has an outage. Distinct from severity (a different axis). |
| commissioning gap | A role short of quorum because its hardware was never installed, as against short because installed hardware is failing. It reads the verdict incomplete, and no alarm will ever fire for it: nothing exists yet to alarm. impact describes what a failure means, so it does not apply, and a role declaring impact: none reads healthy when empty rather than incomplete. See health. |
| health transition | One recorded edge: the moment an owner’s verdict changed and what it changed to. Health is written transition-only on the property series, so its history is edges and only edges, which is what makes “when did this break” answerable weeks later. See health. |
| recompute at the write | The rule that a verdict is recomputed by every mutation that can change it (alarm raise / clear, assign / unassign, role declare / withdraw, quorum or impact change, system create, standard change, relocation), in the same transaction. A product swap is deliberately NOT on this list any more (#626): a component’s own verdict depends only on its active alarms, never on what it is classified as. A read never writes: computing on read keeps no history, and writing through on read stamps the edge at the moment somebody looked. See health. |
| health impact | Superseded by impact on a system role (above). The design hung an optional down / degraded tag on an event_rule; an alarm now reaches a system only through the component’s own verdict (ADR-0050). |
| health_role | Superseded by quorum plus impact on a system role. The design tagged a member required / redundant / informational on the slot; the same three cases are quorum 1 with impact outage, a quorum below the number assigned, and impact none, with no fourth vocabulary. A third sense of “role” (see the disambiguation above). |
| Storage Gateway | The single door to the database; every read and write goes through it, and scope is injected here. |
| audit_log | Who-did-what ground truth; one row per operator write, same-tx; the lineage target for operator writes, including config changes. |
| ground truth | Immutable append-only records. Built: log_line, node_log, and audit_log. (session_log and internal_log are design, fenced below.) |
| principal / role / grant | IAM subject (kind human / service / node; identity is an opaque uuid, never a name); an RBAC capability set crossed with a scope. The base principal holds identity + kind only; a human’s label lives on the human per-kind table. A principal_group is a group of principals used as a grant subject. An AI tool acts via OAuth as a human / service principal (first-class agent identity is deferred, identity and access). See identity and access. |
| secret:read | The IAM permission to read a credential in plaintext; gated per role, and every decrypt is audited. |
| file / blob | Searchable metadata over content-addressed bytes (pgblobs/S3/disk); dedup. |
Design-only terms
Section titled “Design-only terms”Every term below is committed architecture nothing in the code implements yet: no live table, column, route, or seeded registry row carries it; each fence names the tracker that owns the gap. Terms whose domain has its own sketch page are defined there instead: calc_rule on calculations (event_rule / action_rule stay below because their home pages are not sketches), convert() and disagree() on expressions, schedule and timer on time, the view and ViewResult contract on views, and the template catalog, signature, and capability manifest on templates.