Glossary

Term	Meaning	Defined by
audit chain	The hash-linked, segment-signed log of reads and erasures.	segmentdisclosure.record.segmentEntries append to a numbered segment file in ascending seq, and a segment closes under one signed root once it holds its chain header's segment size, 4096 entries by default.
authoring posture	A manifest’s session or per_request setting deciding whose principal authors a table write.	authoring-postureauthority.issue.authoring-postureEvery table write verb write-verbs runs under its manifest's authoring posture. session authors every write by one verified ambient credential's principal; per_request holds no ambient principal, leaving an unaccompanied write unauthored.
awakeable	A single-use token that suspends a run until a caller resolves it or its deadline passes.	awakeablerun.suspend.awakeableAn awakeable suspends a run durably: the engine mints an opaque single-use token and persists a pending row through the awakeable store; an external party resumes by posting the token back.
build profile	A Cargo feature bundle selected at build time: contextful-edge, contextful-full or contextful-control.	profiletopology.package.profileThree profiles compile from the workspace, each a Cargo feature bundle selected at build time: contextful-edge, contextful-full, contextful-control. Each links the dependencies its role names and nothing else.
cadence lease	The writer lease a reconciler holds on a deployment’s cadence, so one fire runs per tick.	cadence-lease-ttltopology.coordinate.cadence-lease-ttlThe catalog grants a cadence lease for 90 s.
capability registry	spec/capabilities.toml, naming each engine capability with its home path and defining symbols.	capability-registryassurance.structure-tree.capability-registryspec/capabilities.toml names each capability of one-home with one home path and one or more defining symbols; an absent registry, a missing or doubled capability, an absent home or an undefined symbol raises CapabilityHomeUnresolved.
card	A contract’s generated page listing its operations, error cases and bounds.	cardcorpus.render.cardcontextful-spec state renders spec/cards/<contract>.md per contract: each operation with its lede and clause count, each refusal as error and gloss, each bound as value, unit and basis, all naming their clause.
clause	One normative sentence: a list item under an operation, addressed as contract, operation and subject.	clause-idcorpus.address.clause-idA clause id is three dot-separated segments — contract, operation, subject — each matching [a-z0-9-]+. A clause item writes the subject alone; its file and section supply the rest.
clause pointer	A {{id}} reference by which one statement reaches a fact another clause owns.	pointercorpus.reference.pointer{{<clause id>}} is the one way a statement reaches a fact another clause owns. The lock file records every pointer as an edge.
commit fence	The integer each writer lease acquisition raises by one; a commit carrying a lower commit fence loses its condition.	acquirestore.lease.acquireAcquisition creates the lease object under If-None-Match or replaces an expired or released object under If-Match on its ETag. The acquired commit fence is one above the object's commit fence.
commit lock	A table’s lock held while a commit assigns its commit sequence and writes its manifest.	commit-lock-spanstore.reserve.commit-lock-spanA commit holds its table's commit lock while assigning _commit_seq and writing its manifest. The commit writes parts outside the lock, except when the table keeps vintage history.
commit log	The cursors/ objects through which a run under a machine writer lease commits.	commit-logstore.lease.commit-logUnder a machine lease, a run commits by creating the next cursors/<pipeline-id>/<node-id>/<seq>.json. Acquisition creates an entry carrying its fence. A manifest marked logged becomes readable when that log records the manifest.
compaction lease	The writer lease a compaction pass holds on one table, stamped into its snapshot and pointer.	compaction-leasestore.fold.compaction-leaseA pass holds the table's compaction lease and stamps its fence into the snapshot manifest and the pointer.
conditional write	A write that succeeds only while a stored precondition holds; the one coordination primitive.	primitivetopology.coordinate.primitiveCoordination rests on one property: a linearizable conditional write. No component depends on a stronger one, and the tree ships no consensus implementation or external coordination service.
control receipt	The signed JSON record of one applied control version and its parent.	receipt-messagesurface.apply.receipt-messageA JSON control receipt carries format: 1, signer public key and signature over UTF-8 contextful-control-v1\n<project>\n<version>\n<parent-or-minus>\n<snapshot-sha256>\n<signer>\n; its parent is - only for the first version.
credential lease	A short-lived credential minted per scope and held in memory with its expiry; it never enters a file.	leaseconnector.lease.leaseThe resolver holds a credential lease's value and its expiry together in memory for the run. The resolver evicts both at expiry. Neither enters a file, journal entry or audit record.
credential reference	A secret://<name> value naming a credential by logical name, never by storage path.	reference-schemeconnector.reference.reference-schemesecret://<name> carries a logical name matching [a-z0-9-]+ of at most 128 chars. A reference names no storage path, file name or key identifier.
data boundary marker	One of the paired markers enclosing an ingested value in a model prompt, carrying its provenance label.	data-fenceconnector.infer.data-fenceNo ingested value reaches a model outside its data boundary markers: a pair whose opening marker carries the value's provenance label, a preamble declaring the blocks data, and a closing line restating the caller's rules.
decision record	A contract’s ADR section holding one decision, its options and what each lost on.	contract-adrcorpus.rationale.contract-adrA contract's decisions live in one A-<contract>.md: # A-<contract> — <title>, a Status: line, then one ## <slug> — <decision> section per decision, its slug unique in the file, each holding its options table in at most 250 words.
delegate	Deploy-bound code outside the binary that runs a store-driven item’s body over one signed HTTP request.	bindingsurface.delegate.binding[control.delegates.<name>] binds a delegate by url, a mode of call or submit, and under call a timeout; a store-driven body = { delegate = "<name>" } naming no bound delegate raises JobDelegateUnbound at arm or fire.
delegation profile	The attenuable, chain-signed credential format delegated authority travels in.	delegation-profileauthority.profile.delegation-profileDelegated authority travels in one attenuable, chain-signed library format. The library owns serialization, signatures, block chaining and evaluation; a versioned profile names every fact, check and restriction the engine admits.
denylist	The checkpoint’s list of revoked credential identifiers.	denylistauthority.revoke.denylistA checkpoint reads a denylist keyed on credential identifier. An entry ages out once its identifier verifies under no live key version.
entry key	The (execution_id, step_label, input_hash) triple keying one journal entry.	entry-keyrun.journal.entry-keyThe journal keys entries by (execution_id, step_label, input_hash). The first caller claims the key with a pending row before running the effect. A concurrent caller waits for the recorded value without computing.
execution owner	The one durable owner of a scope’s executions, holding its connector identity and pins.	execution-ownerrun.own.execution-ownerOne durable execution owner exists per scope; a table or chunk owner holds the connector identity with its component world, the pipeline content_hash and the input hash.
guide	A contract’s non-normative teaching page, reaching each rule by pointer.	filecorpus.guide.fileEach contract has one guide, spec/guide/<contract>.md: front matter contract, one # title equal to the contract's registry title, then prose outside diagrams of at most 400 words plus 20 words per operation its contract's fragment registers.
hydration	Resolving a credential reference to material when a request is built, never at declaration.	hydration-is-just-in-timeconnector.resolve.hydration-is-just-in-timeWhen building each request, the host asks the resolver for credentials. Cached material follows cache-ttl. Declarations, journal entries, audit records, run records and log lines contain no hydrated values.
idempotency key	The key an outbound request carries, derived from its entry key, identical on every re-entry.	idempotency-keyrun.journal.idempotency-keyEvery outbound request a step makes carries an idempotency key derived from its entry key, identical on every re-entry of that effect.
inference zone	Where a model call runs: local:device, on-prem, private-cloud or public-cloud, with an identifier.	zone-stringauthority.place.zone-stringA zone string parses, after trimming, as local:device, on-prem:<id>, private-cloud:<id> or public-cloud:<id>; any other text is undeclared. The identifier is part of the value.
journal	The durable record of each step’s value, written once, so a resumed run replays recorded steps.	step-outputrun.journal.step-outputThe journal records a step's value exactly once. Its effect runs at least once: a crash between effect and write repeats the effect. Every later call under the key returns the recorded value.
lease row	A catalog row naming one writer lease’s key, holder, expiry and commit fence.	lease-rowtopology.coordinate.lease-rowA lease key names a pipeline, source partition, table compaction or deployment cadence. One conditional update assigns the row's holder, expiry instant and fence.
lede	The one paragraph opening an operation section, stating what the operation covers.	ledecorpus.anatomy.ledeAn operation section opens with a lede: one paragraph stating what the operation covers. The lede is the operation's only description; its fragment entry carries no gloss.
manifest posture	Whether a connector manifest is adopted, carrying a digest, or a template carrying a pin requirement.	manifest-postureconnector.package.manifest-postureAn adopted manifest carries a digest from the fixed builder platform. A template manifest carries a pin requirement and placeholder. The parser accepts a template; the loader refuses it.
mint credential	The one standing credential the engine presents to the mint endpoint to obtain credential leases.	bootstrap-credentialconnector.lease.bootstrap-credentialThe engine authenticates to the mint endpoint with one standing secret:// credential, hydrated only through the adapters the chain held before the lease provider joined.
narrowing posture	Serving only publicly granted rows of a public_only table once its mirrored permissions pass their staleness budget.	public-onlydisclosure.bound-staleness.public-onlyPast its budget, a public_only table whose source has a completed full run and a public-status watermark within budget serves only rows whose resource holds a read-conferring, unexpired public grant.
node id	The path-safe name of one writing process, keying its run directories and writer leases.	node-id-orderstore.lay-out.node-id-orderA process resolves its node id once: CONTEXTFUL_NODE_ID, then [node] id, then node-id-project.
one home	The single engine implementation a capability resolves to, reached by every surface.	one-homeassurance.structure-tree.one-homeEnforcement, control-plane state, credential resolution, statement guarding and visibility each resolve to one implementation in the engine; a surface reaches one through the engine route or the registered view compiling it in.
pin	A link from a clause to the test, theorem or item that demonstrates it.	pincorpus.state.pinspec/pins.toml maps a clause id to one artifact: a test function path, a theorem constant under formal/ or an item path. A refusal or a limit takes a test or a theorem.
provenance label	The trust label a model input carries: operator, ingested:first-party or ingested:third-party.	provenance-orderconnector.infer.provenance-orderProvenance labels order by trust: operator above ingested:first-party above ingested:third-party. A call marking no value carries operator.
provider chain	The ordered adapters a reference resolves through, first answer winning.	provider-chainconnector.resolve.provider-chainCONTEXTFUL_SECRETS_BACKEND names the chain's adapters in answer order, env when unset, and the lease provider joins at its head. Naming an adapter the build does not link refuses at assembly.
purge receipt	The signed artifact a tenant purge returns, stating what the purge covers.	coveragedisclosure.receipt.coverageA receipt_version 1 coverage block covers the canonical store and names replicas and the replication bucket as excluded.
ratchet	A recorded count the tree lowers and never raises; a live count off it fails lint.	ceilingcorpus.registry.ceilingThe [ceiling] table of spec/terms/corpus.toml records each ratchet's live count. A count above its ceiling raises the ratchet's error, and so does a count below it until contextful-spec ceilings lowers the ceiling.
reachable set	The principals and resources one subject reaches through identity links and group closure.	subject-principalsdisclosure.reach.subject-principalsA subject user://<p> reaches the user principal spelled <p> and each principal an identity_links row maps to it, then the groups those principals belong to.
read frontier	A table’s current snapshot and runs; a commit, fold or ledger append changes it and invalidates cached results.	frontier-invalidatesread.cache.frontier-invalidatesCommits, folds and request-ledger appends change a touched table's read frontier: its snapshot and runs. Earlier cache entries stop matching. Statements executing during a fold read under non-blocking.
replacement frontier	The newest run carrying a replace source’s complete state; reads cover it and every later run.	replace-frontierstore.declare.replace-frontierwrite_mode is append, the default, retiring no key, or replace, whose read covers the newest complete-state run and every later run; displaced runs stay until retain_runs expires, with no erasure receipt or lineage traversal.
replica	A read-only copy of a store pulled from its bucket, refusing every write verb.	descriptorstore.replicate.descriptorA replica's pull writes replica.json beside derived.sqlite, naming per table every held snapshot whose parts and sidecar paths exist on disk; push excludes the file.
retention window	How long folded runs and superseded snapshots stay before collection removes them.	retentionstore.fold.retentionretain_runs defaults to 7 d. Collection removes folded runs, superseded snapshots and their sidecars once older than the window.
retrieval container	A container serving reads from a locally synced, memory-mapped snapshot set.	hot-local-parquetread.cache.hot-local-parquetThe retrieval container syncs the current snapshot set to local disk and memory-maps it; object storage stays out of the per-query path except as lazy-hydration admits.
revocation epoch	A counter per project, tenant and principal class whose bump invalidates that slice of outstanding authority.	epochauthority.revoke.epochA revocation epoch scoped on project, tenant and principal class invalidates that slice of outstanding authority.
revocation identifier	The identifier each credential derivation carries, withdrawing its subtree alone.	revocation-idauthority.revoke.revocation-idEvery derivation carries its own revocation identifier, withdrawing one subtree without ending the root it descends from.
run manifest	The _manifest.json whose conditional create commits one run’s parts.	run-manifeststore.lay-out.run-manifestA run commits by conditionally creating its node directory's _manifest.json, a lay_out::RunManifest whose node_id equals the directory's node segment.
sidecar	An index file beside a snapshot’s parts: a vector graph, full-text index or key map, built at compaction.	declarationstore.index.declarationEach table declares sidecars under indexes as IndexBlock. A vector sidecar requires model and dim, and a key outside its kind refuses the declaration.
signed store frontier	The signed statement of a store’s state a reference resolver validates before resolving and answering.	frontierread.reference.frontierBefore resolution and response publication, the resolver validates the same signed store frontier. The frontier's erasure index binds store identity and cumulative reference versions through store-binding.
snapshot	An immutable compacted version of a table, named by its creation instant.	snapshot-idstore.lay-out.snapshot-idA snapshot id is snapshot- and a nanosecond value zero-padded to 20 chars: the greater of the commit instant and the previous id plus one.
snapshot manifest	The _manifest.json listing a snapshot’s parts and indexes with their key versions.	snapshot-manifeststore.lay-out.snapshot-manifestA snapshot's _manifest.json holds a lay_out::SnapshotManifest, and each entry of parts and indexes carries its key_version.
staleness budget	max_acl_staleness: the age mirrored source permissions reach before a read refuses.	budget-grammardisclosure.bound-staleness.budget-grammarmax_acl_staleness is a positive integer with one suffix from s, m, h, d. A compound form, a bare number or another suffix raises VisibilityBudgetMalformed, naming the table and the text read.
statement guard	The check admitting caller SQL only as one read-only SELECT over registered relations.	single-read-only-statementread.guard.single-read-only-statementAdmitted text parses to exactly one read-only SELECT. Attach, copy, install, load, pragma, set, any schema change, any data modification and a piggybacked second statement raise StatementNotReadOnly.
store identity	The UUID naming one store across its synced copies.	store-identitystore.init.store-identityAn initialized store holds one synced, canonical version-4 UUID in store-id, which repeated init and clones keep and a recreated root replaces.
subject tuple	The agent, host, principal, task scope, inference zone and incognito flag a credential binds.	subject-tupleauthority.identify.subject-tupleA subject is a tuple of agent, host, on_behalf_of principal, task scope, inference zone and incognito flag. A credential binds the subset it names and admits under that combination alone.
table pointer	_pointer.json, naming a table’s current snapshot; readers reach only snapshots it reaches.	table-pointerstore.lay-out.table-pointertables/<t>/_pointer.json names the table's current snapshot and commit fence; readers reach only snapshots reachable from it directly or through parent links.
topic page	A non-normative page answering one question that spans contracts by pointing at the clauses that answer it.	filecorpus.topic.fileA topic page spec/topics/<slug>.md carries front matter topic, one # title equal to its entry's title in spec/terms/topic.toml, then prose of at most 600 words outside diagrams.
verdict	A clause’s computed state: committed when unpinned, performed when its pins qualify, broken otherwise.	verdictcorpus.state.verdictAn unpinned clause computes committed; a pinned clause computes performed when its Rust, Lean or typescript-tag-pin artifact qualifies, and broken otherwise. A test carrying an #[ignore] attribute computes broken.
why line	The indented line under a clause naming the record it rests on, or a short because criterion.	why-cellcorpus.rationale.why-cellA clause's Why is absent, one or more record ids such as P3, A-store or A-topology#commit-lock, or because followed by at most 30 words stating the deciding criterion. A refusal carries a Why.
writer lease	Time-bounded exclusive ownership of a pipeline, partition or table compaction, held by one node and renewed by conditional replace.	ttlstore.lease.ttlA writer lease grants ownership for 10 min.