Intent Mediation Platform

Manual

La arquitectura, el vocabulario, y cada una de las 441 piezas con un enlace a su propia página.

Leído del taller mismo cuando se construyó esta página: a qué capa pertenece cada pieza sale del registro, qué es cada una sale de su propio README, y el vocabulario sale de los renglones ratificados. Nada de esto se ha vuelto a teclear, así que el manual no puede decir algo que el taller no diga.

Las capas

Una pieza puede depender de las capas que tiene debajo, nunca hacia arriba y nunca de lado. Lee el dibujo de abajo hacia arriba: foundation no depende de nada de aquí, y tools se apoya en todo.

  tools             90  ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
  application      121  ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
  platform          12  ▔▔▔
  operations        43  ▔▔▔▔▔▔▔▔▔▔
  observability      2  ▔
  infrastructure    83  ▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔▔
  data               3  ▔
  content            6  ▔
  domain            44  ▔▔▔▔▔▔▔▔▔▔▔
  identity           8  ▔▔
  foundation        29  ▔▔▔▔▔▔▔

Cada pieza, por capa

foundation 29 piezas

Patterns and types every other tier may use, and which depend on nothing else in the workspace.

identity 8 piezas

Who a thing is: people, organizations, tenancy, authentication, access.

domain 44 piezas

What the business does, as primitives: the nouns and rules a product composes rather than reimplements.

content 6 piezas

Authored material, and how it is stored, rendered and served.

data 3 piezas

Storage and retrieval shared across the tiers above.

infrastructure 83 piezas

Adapters to the world outside the process: databases, mail, HTTP clients, the filesystem, models.

observability 2 piezas

Seeing what happened: measurement, telemetry, traces.

operations 43 piezas

How work itself is coordinated and recorded: runs, evidence, transitions.

platform 12 piezas

The assembled runtime a product is served on: hosts, routing, session and request plumbing.

application 121 piezas

One product, composed of the tiers below it.

tools 90 piezas

Programs the operator and the harness run: the command-line plane, never a dependency of a lower tier.

Glosario

El vocabulario ratificado: 252 palabras, cada una con un significado escrito. No se muestran las propuestas ni las palabras retiradas: una propuesta en una página pública se lee como una decisión.

instrument

sensor
whatever carries out an observation: a device, a program or a personSOSA/SSN admits all three as sensors, which is why a program that reads rows and reports a value is one; a probe is a sensor, and so is the hook that stages a turn as it lands; a sensor observes and never decides — the thing that decides is a check

kind

acceptance criterion
one testable condition a requirement's verification must satisfy, written so that a specific test can fail on itGIVEN / WHEN / THEN; the table is acceptance_criterion; its oracle is the criterion's expected-result source
access role
a named set of permissions a subject may hold over a resourcethe authorization sense, kept apart from role, which is ratified here as the architectural part a unit plays within its design. Two senses, two labels.
act
something a party does that has effect on the record, and which must be recorded when it happens rather than reconstructed latera metaclass: it classifies other terms. Not required to classify itself, but classified as `kind` so the axis is total.
action item
a promise swept from prose or minutes, kept as evidence that it was made, and never a work itema work_item kind; the coined word was obligation
adr
one architectural decision, its context, and what it rules outthe files are docs/architecture/adr
appointment
a meeting held at a stated time with stated attendees, recorded against the work it servesthe client meeting, the follow-up call. task already sends the human to-do to RFC 5545 VTODO; this is VEVENT. domain-scheduling is the code.
approval
a partys recorded decision admitting a thing put to them: who decided, on what, and whenthe part put to them is a work package, which is why the breakdown is what the portal shows: a party holding an access role on a work package approves that package and not the whole project. PMBOK calls the customer-side case Validate Scope, the formalized acceptance of completed deliverables. operations-approval-workflow is the mechanism (propose, approve, reject, one pending per track); platform-customer-ui is the portal it is shown in.
assignment
the placement of one party on a piece of work, holding an access role there, which is what makes their permissions effective on itone mechanism, three parents: a sprint for this workspaces own work, a project for customer work, a work package for a part of one. ANSI/INCITS 359 calls this user assignment. Supersedes project assignment, which named the parent in the term and so could not serve a sprint. identity-rbac today is flat — roles, permissions, user_roles per tenant — so the work dimension is new work, not a reuse.
benefit
the measurable improvement a customer gains from an outcome — money earned, peace of mind held — realised across the releases that got them thereMSP: the measurable improvement resulting from an outcome, perceived as an advantage by one or more stakeholders; realised, not delivered: a release delivers an increment, an outcome follows, a benefit is measured after, across MSP's tranches, our releases; counted apart from the outcome it comes from
bug
one recorded defect: what was observed, where, and what class of failure it belongs tothe files are docs/bugs/B-NNN; the index is rendered, not authored
consensus position
one seat's answer on one decision in one round, with its confidence and what would change itGate 1.5
control account
the point where scope, budget and actual cost meet: a capacity in story points or currency, actual cost posted as work runs, and a parent — a sprint for this workspace's own work, a project for customer workthe table is budget_box, whose coined name retires to this one. Sits above work packages: the billing hangs here, never on the package. Amended 2026-09-10 (batch project-ontology-2026-09-10) to admit a project parent.
coverage manifest
the part of a research result that names every source consulted and whether it was read completely, failed, or was never searched. Absence is a legal verdict only when every mandatory source reports complete: not searched and not found are different answers, and collapsing them is how a collision goes unseen.
dossier
a collection of records about one subject, assembled from other sources rather than authored, and kept together for whoever must act on it. Broad: the subject may be a person, a case, or a word. Where the subject is an investigative subject, the qualified form is written: OSINT subject dossier (operator ruling, 2026-09-11)
encounter
one stateful interaction between a party and this business, from the moment it opens to the moment it closesthe crate is domain-encounters: Encounter, EncounterState, EncounterType, Participant, over identity-parties. A repair, a consultation, a visit and a call are TYPES of it, not separate kinds -- Gate 0.5 names Encounter among the types never to reinvent, and a new kind per activity is exactly that reinvention. What it is about (an item, an animal, a matter) is a separate relation; the encounter is the interaction.
epic
a significant solution-development initiative, large enough to need a minimum viable product and a funding decision before implementation, and spanning more than one releasecontrolling text, SAFe 6.0: epics require the definition of a Minimum Viable Product and approval by Lean Portfolio Management before implementation; two kinds, business and enabler; portfolio-level; written as an epic hypothesis statement (for / who / the / is a / that / unlike / our solution). The container above need: an epic's needs refine into requirements, and only the requirements the reuse check disposes new become sprints; only a business epic must state the seven hypothesis fields. Sprint 4.75 retires initiative with epic as its successor, superseding the 2026-09-10 container ruling that had kept initiative as the container for internal change
execution
one attempt of a step by an executor, with what it was given, what it produced and what it costthe table is execution_run; the coined form was execution run, whose alt label run moves here on retirement
finding
one claim about the repository, admitted only with a file, a line and a quote that verifythe recon state admits nothing that citation-verify cannot resolve; a requirement's reuse, compose or proven absence is a finding
format
the representation bytes are in, independent of what they meana metaclass: it classifies other terms. Not required to classify itself, but classified as `kind` so the axis is total.
increment
the proven work product a release deliversthe payload of a work_product with its provenance and its signature
initiative
a proposal put to a public body or an electorate for decision — a measure placed on a ballot, or a policy a body adopts and pursuesCivic work only: ballots, measures, policies, and the bodies that decide them. Never a container of internal software work — that is a sprint, which is what this word was retired from on 2026-09-10.
instrument
a document that binds parties and carries effect, whose versions are themselves trackeda metaclass: it classifies other terms. Not required to classify itself, but classified as `kind` so the axis is total.
kind
which sort of thing a record is, named by a ratified term and standing on a real table
measure
the variable a value is assigned to by measurement: what is being tracked, not the act and not the valueISO/IEC/IEEE 15939 defines a measure as a variable assigned a value as the result of measurement; a benefit's unit, baseline and target name one measure; distinct from measurement, the act, and from reading, the value obtained on one occasion
need
what a stakeholder must have, in their own words and verbatim, before any refinementthe column is sprint.need (formerly oracle, which is now the criterion's word only); the rows are need, with kind need or want
neighbour
a term whose label is close to the word under research but is not that word: a plural, a singular, a near spelling. Reported so a reader sees it, never used to refuse a proposal.
operation
one invocation of an imp capability: what was asked, which executor ran it, what came backthe record of a single run, not the thing being run. An imp capability is the registered unit; an operation is one use of it, and it is where the executor, the input, the result and the policy decision that allowed it are recorded together
organization
a party that is a body rather than a human: a company, an agency, a court, a householda party of kind organization. Not a tenant, which is an isolation boundary in this system; one organization may be several tenants and a tenant may serve several organizations
outcome
the change in a customer's circumstances when a problem of theirs is solved: the result of a release, never the release itselfMSP: the result of change, normally affecting real-world behaviour or circumstances; ISO/IEC/IEEE 15288 uses the word for what a process achieves; problems solved is the outcome, and what it earns is a benefit; not a work product, which is what we deliver, and not a goal, which is the purpose stated before the work
party
a person or an organization, as the identity other records point atidentity modeling only. Who may do what is tenant_members, never a party relationship (Gate 0.5) -- the two were one thing in the estate this workspace replaced, and separating them is why authorization stopped being inferable from an address book. The crate is identity-parties; need.party_id points here
person
a human party, distinguished from an organization by being onea party of kind person. Held apart from user, which is an account someone signs in with: one person may hold several accounts and an account may outlive the person's involvement
plane
a named region of the system with a stated responsibility -- what a part of the architecture is FOR, as distinct from what it is made ofa metaclass: it classifies other terms. Not required to classify itself, but classified as `kind` so the axis is total.
postmortem
the recorded account of one failure: what happened, the cause found, the fix made, the class it belongs to, and what would prevent the next onea work product with its own page and its own row, read before debugging so a new failure can be checked against the classes already known. NOT a bug record: a bug names the defect and where it lives, a postmortem names the class and the prevention, and one postmortem may cover several bugs. The retrospective section of a sprint cites them; it does not hold them.
project
an endeavour with defined start and finish criteria, undertaken to create a product or service within specified resources and requirementscustomer-facing work run for a party, bounded by its finish criteria and never by a period elapsing. NOT initiative, which is this workspace's own internal change; the row lives in an application corpus, never in corpus_sourcecode, and only the concept is registered here. ISO 21502 and PMBOK say "temporary", which 15288 does not, and which initiative was coined against.
project index
the one place that answers which projects exist and which corpus holds each, so a question about a project routes without the caller knowing the databaseno new machinery: a corpus that holds projects claims the noun project in corpus_claim, with priority, scope and key range, and corpus.read_permission gates it. The index is the union of those claims.
qualifier
a governed narrowing of a relation that does not make it a different relationadmitted per relation kind, so a qualifier cannot attach to a relation it means nothing for; a relation whose kind has no qualifier dimension carries none at all
reading
one value a probe reports on one occasion, with what was read and whenthe value obtained, as distinct from the measure it is a value of and the act that obtained it; metrology calls an instrument's own output an indication (JCGM 200); term_reading is this applied to a governed word, where the value is which sense the word carried in one passage; a reading is a finding, never a ruling
relation
one governed fact that connects one artifact to another artifactthe table is artifact_relation; not a predicate (which a program decides), not a verb (an observable action), not a transition (a subject moving between its own states), not an action (one ordered step of applied work)
release
a version of the software made available for use, with the work products it contains and the proof of what was verified in it; cut as often as each sprint where possibleITIL 4's release; its version number follows SemVer; replaces the coined planning sense of the retired word
repo
the short form of repository, admitted where an identifier is typed rather than read as proseidentifiers only -- repo_artifact, repo_path, a database name. Prose writes repository. Admitted so a handle has a definition instead of becoming an opaque token
repository
a version-controlled tree of files with its history, taken as one unit that a corpus mirrors, a record governs and an executor acts onthe git sense. NOT the data-access pattern that hides a collection behind an interface. One repository resolves through the imp_control registry to its mirror corpus, its record corpus, its source root and its executor
requirement
one need refined into a statement that is unambiguous, verifiable and traced to the need it came fromthe table is requirement; it carries the slots: for whom, done when, what is not asked
role
the architectural part a unit plays within its design, independent of which tier it sits ina metaclass: it classifies other terms. Not required to classify itself, but classified as `kind` so the axis is total.
rule
one governed normative statement saying what must, must not, or may be true or doneA work-product kind: revised under a recorded identity, superseded rather than edited. The rule is the statement; the guard that enforces it and the work item that builds that guard are separate objects related to it.
ruleset
an ordered set of rules evaluated against one subject, where later matching rules supersede earlier results unless evaluation is terminated by a rule designated to decide immediatelythe order is the content: a ruleset is not a set of independent rules, and moving a line changes what it means. The rows are the authority and the file a guard loads is their view, so the guard still decides when the database is unreachable. `quick` is pf.conf(5) spelling of the designated-to-decide rule, not the only one
section
One named part of a document, holding a single subject and answering to one ownerThe generic. A qualified section is named by what it sections -- story section, and any later kind -- following the rule that a composition form is named by what it composes. Does not name a division of code, a database schema, or a physical space.
security plan
the design's stated answer, written before the code, to the security questions a change must answerGate 1.5.6: input limits, subprocess argument vectors, advisory-lock keyspace, batch failure; N/A stated with its reason. Renamed from `security statement` 2026-09-10 -- the gate governs what the implementation WILL do, which is a plan, and the artefact is its written form
setting
a named value a program resolves at run time instead of naming in its own sourcethe row is the authority and the file a program reads is its view; a setting names WHAT is wanted ($corpus_source) and the value says which instance answers today. NOT configuration in general and NOT a secret: a credential is held where credentials are held, and a setting may name it
specification
the set of a story's or a release's requirements with its scope in and out, rendered from rows and never typeda template section, not a table; one per story and one per release
sprint
the governed record of one bounded piece of wanted work: its statement, the criteria that decide it is delivered, the work items that effect it, and the evidence that they didbounded by its acceptance criteria -- not by a period elapsing, and not by effort expended: `story point` is the unit of an estimate and `budget_box` the limit on its spend. Holds at most one story, since a story is the stakeholder-visible wanted outcome and internal work may have none, and any number of work items. NOT the Scrum sprint, which is a fixed-length time-box with negotiable scope. Renamed from `story` 2026-09-10; the table is sprint
sprint section
One named part of a sprint, with the table it renders from, who supplies it and the gate it answersA part of the sprint document, not of the story inside it. Where a story section says what is wanted, a sprint section says how the work is planned, run and judged -- the technical plan, the work items, the execution contract, the review. Both are kinds of section; neither contains the other.
standards shard
the stored question put to a model about which published standard already defines a word, carrying the research that occasioned it. Its answer is attached as an unverified candidate, never as the citation and never as a ruling.
story
one statement of what is wanted and for whom, with the criteria that decide it is delivered -- a promise for a conversation, not a specificationAS A / I WANT / SO THAT; the table is story, which was `user_story` before 2026-09-10. Kent Beck coined the word at Chrysler C3 in 1997 as an antidote to requirements documents, and Cockburn's phrase for it is "a promise for a conversation" -- so it names the informal statement, never the governed record that carries it, which is a sprint. The Scrum Guide's own word for the backlog entry is product backlog item
story section
One named part of a story, with the table it renders from, who supplies it and the gate it answersA section is a PART of a story, never a story in miniature: it has one supplier, one source table where it is DB-backed, and one gate. The fourteen are rows in story_template_section, so the set is queryable rather than a heading convention. Does not name a section of any other document.
strand
one noun-verb-data composition, the unit that is woventhe composition, seen as a thing that attaches to another: a strand's data becomes the next strand's noun, which is what makes a chain rather than a set. Governed by the noun-verb-data composition shape and by nothing this word adds
task
one named piece of work inside a work item, ordered, small enough to be finished or nota child row with an ordinal; 12207's process -> activity -> task, where a task is the smallest unit of work (exact); PMBOK's word for this is activity (close); the human calendar item is to-do (RFC 5545 VTODO), not this
tenant
a group of users with a boundary, renting space in a SaaS product. Not the organization that rents it: an organization is a party — a body in the world — and one organization may rent several tenancies. What a tenant has that an organization does not is a boundary: its own users, its own database, and its own grant of which modules it may reach.
test case
one test with its expected result, registered under a fully qualified path so that a renamed or deleted test is a dangling plan rather than a silent gapthe table is test_registry; a test plan names test cases
test plan
what will be run to decide an acceptance criterion is met, named before the code existsthe table is test_plan; it names test cases
tier
the position of a crate in the dependency order: a crate may depend downward, never upward or sideways into a higher tierthe registry is docs/architecture/layers.toml; the mechanism is foundation-layers A metaclass: it classifies other terms. Ratified 2026-09-09 (work item 1 step 0b).
to-do
a piece of work a person commits to doing by a time, on their own calendar, finished or notthe human calendar item (RFC 5545 VTODO), what Google and Microsoft label a task; not a task, which is the smallest unit of machine-dispatched work inside a work item (ISO/IEC/IEEE 12207); an action item with an owner and a due date is one; no table holds it yet
verb
the observable action recorded in a noun-verb-data triplethe second part of a noun-verb-data triple; distinct from relation, which connects two artifacts, and from predicate, which decides true or false. Also distinct from the privacy-lexicon `verb` concept_kind naming data-handling actions (collect, disclose, erase) -- same word, unrelated domain
want
what a stakeholder would like and could do without, in their own words and ranked below a needa need row with kind want; MoSCoW should and could, never must
wiring
the bindings in program source that select concrete instances directly where resolution could instead occur at run timethe mechanism, not a verdict on it: a wiring site is a file and a line, classified as a call that reads the instance or a mention that only names it, and whether a given binding SHOULD be resolved at run time is policy the measurement serves rather than asserts. NOT a dependency edge, which says a crate uses another
work item
one committed, dispatchable piece of work with its goal, its estimate, its definition of done, its scope envelope and its required context, which an executor may claimthe table is work_item; the envelope is what an executor may write to; a card is its face on the board; the coined word was unit
work order
the record of work performed on one item: what was wrong with it, what was done, and the state it was left inthe item is anything repairable -- a drive, a machine, a shoe. Whose item it is does not change the record: your own stock being refurbished and a customer item being repaired are the same shape, and the party belongs on the encounter, not here. Distinct from encounter, which is the interaction with a party: one encounter may carry several items, and one item may be worked on across several encounters. drive_station_jobs is this shape already -- job_type, device, serial, item_id, status, result, and no party anywhere. The KIND of work is a type on the work order, as EncounterType is on the encounter: a SMART test, a wipe, a resole, a restitch. drive_station_jobs.job_type already carries it -- smart_test 434, quick_wipe 297, smart_short, wipe -- so the dimension exists in rows before it exists in prose. Not ratified as its own term: a type is a value vocabulary the owning crate closes, and EncounterType is not a lexicon term either.
work package
the leaf of a project's breakdown: the smallest named piece of deliverable scope, which decomposes into activities and carries the appointments and worklogs against themand the extent an access grant names when it does not name the whole project. Sits under a control account, which is where scope, budget and actual cost meet -- a work package does not hold the billing, and does not hold an epic, which is larger than it.
work product
anything this workspace produces and revises under a recorded identity: the genus every kind below belongs tothe table is work_product; a kind exists only for a ratified term standing on a real table
worklog
time recorded against a piece of work as it is performed, by whom and for how longthe actual a control account bills from. application-tickets is the code: start and stop timers over a worklog, summarised.

mechanic

action
one ordered step of applied work, with its own inputs and its own recorded outcomethe table is task; an action is what a task performs
alias
a label other than the preferred one that resolves to the same concepta legacy number is never reissued
artifact
one identified thing under governance that relations and versions attach tothe table is repo_artifact
attestation
a statement that specified requirements were shown to be metthe commit-msg CONTRACT-STATUS marking is one
backup policy
the rules deciding what is copied, how often, where it is kept and how long it is retainedcovers the retention period and the restore expectation; the operator rule that a destructive edit is preceded by a backup is an instance of one.
base table
a table whose rows are stored rather than derived
behavior
how an imp capability acts under stated conditions: what it does on timeout, on refusal, on an unresolved termsubordinate to imp capability on the operator's ruling 2026-09-10: the routable unit is the capability, and behavior describes its conduct rather than naming the thing routed. Not the primary term, and not a synonym for it
capability
something the workspace can already do, registered as a row naming the crate that delivers it, so building it a second time is refusedstate delivered or withdrawn says whether the workspace HAS it, never whether an epic has received it; carries no epic reference (operator, 2026-09-10); a delivered row is written only after the claim is confirmed against the crate's API, tests or implementation (Gate 1.5 round 1); the index is capability_search, the guard is capability-guard
capability policy
the rules deciding whether, where and by whom an imp capability may run: remote allowed, lexicon required, data class limit, cache, timeoutrenamed from the bare word policy 2026-09-10: policy had two governed meanings in one database — this one and the lexicon enforcement slice. The bare word stays ordinary English on purpose, because the hook matches on word boundaries and governing it would refuse security policy, backup policy and every other compound. The columns are on imp_capability.
check
decides whether a guard holds by running a program and reading its answer, and performs no workthe coined word was probe: CommandExitZero, CheckerRowsZero, PathExists
column
a vertical division of a table
composition
one governed whole formed by combining named parts according to a defined composition shapethe generic genus, useful across the whole control-plane model. QUALIFIED TERMS SAY WHAT IS BEING COMPOSED, and each has its own composition shape: a noun-verb-data composition (noun, verb, data, and a goal that is part of the composition but extrinsic to the action); a multi-crate composition (2..n crates, their seams, and a goal -- what a finding with disposition `compose` records, as against `reuse` for one crate alone and `new` for none); a subject-relation-object composition (subject, relation, object, which is artifact_relation). These are siblings under this word, not subtypes with separate identities: the qualified name states the genus and the shape at once. Deliberately NOT UML's composition, which is a whole-part association with lifecycle dependency between two classifiers -- same word, a different claim
composition shape
the defined arrangement a composition is assembled according to: which parts it names, how many of each, and what each contributesa shape is what makes a qualified composition legible — noun-verb-data, multi-crate, subject-relation-object — and what distinguishes one composition from another whole of the same size. `triple` remains a narrow structural mechanic for the exactly-three case and is not a shape: it states cardinality and ordering while a shape states what the parts ARE. The shapes are prose here and not yet rows; the mechanism this word will want is a table of shapes and their parts, the way a work-product kind stands on a real table
constraint
a restriction on what values or actions are permitted
context
what an executor is required to have read before it acts, supplied with the packet rather than searched forthe table is work_item_required_context
data
the concrete typed information consumed, affected, or produced by that actionthe third part of a noun-verb-data triple; physical, structural and mechanically verifiable — a row, a file, a hash. Not the object of an artifact relation, which is an artifact endpoint, and not the reason the information was produced, which is the goal
definition of done
the guard set a work item of a given type must satisfy to close, held once and never renegotiated per itemthe AC14 guards of sprint 4.47; never prose
deviation
a departure from a defined process, recorded at the time with its reasonthe Gate 2.1 deviations in this sprint are the example
evidence
the records that show a requirement was met, kept so a later reader need not re-run the workabsence of evidence is never a pass
executor
whoever performs a dispatched piece of work: a model, a program, or a person, recorded by kindan executor is interchangeable because nothing in the flow lives inside it
executor capability
what an executor can do, stated as a property rather than an offer: tool-call dialect, vision, context window, whether it runs local, what it coststhe model-side half of routing, and never something a person invokes -- an imp capability states what it requires, an executor states what it provides, and eligibility is the match between them; policy then narrows the eligible set and the route is recorded on the operation. Kept apart from imp capability because a policy like remote_allowed is a statement about the thing being asked for, not about vision. The rows live today as docs/reference/model-prompt-profiles.tsv and model-routing.tsv
file
a named collection of data stored as a unit
fingerprint
The normalised form of a composition a session performed by hand, as composition read records it, counted across sessions so a repeated reach for an unbuilt thing is measurable.Sprint 4.117 introduced the mechanism under this word; the term ratifies the word it already uses.
funding decision
a ruling on an epic recorded as its own row: proposed or approved before implementation, persevere, pivot or stopped after the MVPappend-only; the epic's current decision is derived from the latest row and never stored in a column, the precedent check_result and budget_box already set
glossary
the record of every governed term and what it means, rendered from the rowsdocs/reference/glossary.tsv, written by `corpus lexicon export`; 248 rows. Distinct from the LEXICON FILE, which carries only the terms that are refused and what to write instead (66 rows) -- a ratified term is in the glossary and not in the lexicon file, because there is nothing to refuse. Both are renderings of the `lexicon` plane; neither is the source of truth, which is `term`, `term_label` and `term_relation`.
goal
the condition a composition is undertaken to bring about, stated before execution so that a predicate can decide whether it holds afterwards; it belongs to the larger composition and is not one of the triple's three partsthe right-hand side of noun + verb + data -> goal as a human writes it, and the postcondition of a typed application as the record holds it: an application does not equal its goal, it creates an obligation to prove it. Decided by a verification policy -- an explicit predicate, a criterion set a SUFFICIENT_FOR relation names, or manual adjudication -- never by the run that executed the composition. Its counterpart on the far side is outcome, what was observed after; goal is the intent before, outcome the consequence after, and success is the verifier finding the outcome satisfies the goal. A goal with no predicate is the unmechanized remainder, reported and never silently counted as met
guard
a condition that must hold before a transition is allowed; it admits or refuses and performs no workthe state machine's guards are rows, read by one transition function
identifier
the value that names a thing across every version and rename of itsprint 4.45/slug is one; 4.45 alone is an alias
imp capability
one thing imp knows how to do, registered so it can be routed and invoked: redact an ask, resolve a term, structure a task, construct a shard, adjudicatequalified because capability is already ratified for the reuse sense -- something the workspace can already do, registered so building it twice is refused, enforced by capability-guard. Two referents for an enforced word is the collision that kept this one from being called stage; where both appear together, the other is the registered capability. What runs it is an executor, what governs whether it may run is a policy, and one invocation of it is an operation
imp role
a named bundle imp is asked to work as: which imp capabilities are in scope, which executors may run them, and which prompt profile shapes the askthe /role-dba, /role-security and /role-reviewer sense. Qualified because role is already ratified for the architectural part a unit plays in its design, which is a property of code and not something a person selects for a turn. An imp role selects and constrains; it performs nothing itself -- the executor performs, and the policy in the bundle says which executors are permitted. Profiles are rows already: docs/reference/model-prompt-profiles.tsv
label
a name a thing answers to, as distinct from the identity it namesprefLabel, altLabel, hiddenLabel
lexicon policy
the rules deciding which words this workspace refuses and what to write insteadthe enforcement subset of the lexicon, rendered to docs/reference/lexicon-policy.tsv and read by the pre-commit and commit-msg hooks. A view of the lexicon plane, never the plane itself.
loom
the admission-controlled mechanism a composition is woven through: only governed nouns and verbs are ever offered, so a strand that would not satisfy its composition shape is never presented as a choiceall three of loom, strand and weave are defined over composition (operator, 2026-09-10): the strand IS one, the loom admits one, the weave attaches one. Rigid deliberately, the way a real loom's fixed structure constrains which threads a weaver can cross. It is the same admission control imp performs on an ask, applied to composition rather than to language: the loom refuses before the strand exists, not after
mediation
the transformation from an utterance to a composition to an ontology-bound composition, each step recorded as evidence on the mediating runwhat imp does between a person's language and the record: interpret, resolve, type-check. Lexicon lookup, vector search, standards research, sharding and adjudication are its mechanisms, not separate systems. Its output is rows with provenance, never a rewritten utterance
migration
a movement from one state or place to another
migration file
one registered file carrying a schema migration
migration status
which registered migrations are applied at a particular time
milestone
the payment event on a control accountnot a level of the ladder; the payment-triggering points inside an epic — the first is retention itself, the consultation converting to engagement
minimum viable product
the smallest increment that tests an epic's hypothesis against real use, before the funding decision that would fund the resta mechanic stated on the epic, never a kind: kind names a record standing on a real table, and an MVP is a claim to be tested, whose testing produces findings and evidence (sprint 4.75)
must have
the part of a plan that may not be dropped when a session runs shortevery sprint names one
noun
the governed thing participating as the actor or focus of an observable action in a noun-verb-data triplethe first part of a noun-verb-data triple; not the subject of an artifact relation, which is a relation endpoint
ontology policy
the rules deciding which kinds may exist, what relations are valid between them, and who may admit onethe meaning level, above the word level a lexicon policy governs and the arrangement level a taxonomy policy governs. The mechanism here: term_ratification_request and its human-only ruling, concept_owner and its one-claim guard, relation_kind, and composition_shape for what a kind is made of.
ordinal
the position of a thing within an ordered sequence, counting from onesays WHERE in the order, and nothing else: not how many there are, which is a count, and not which form a thing takes, which is a version — and in this schema `version` is a content hash (lexicon_version), so the two must not share a name. An ordinal is assigned within its parent and means nothing across parents: composition_shape_member.ordinal orders the parts of one shape, need.ordinal the needs of one sprint. Ordering is what separates a composition from a set, and this is the word for the position that does the separating
out of scope
what a level states it will not do, with a reason and a datescope_statement rows at every level from release to work item; the coined word was non-goal
packet
everything an executor is given for one piece of work, assembled by program and never truncatedthe compiler is tools-packet-compile
policy rule
a stated rule deciding what is allowed, by whom, where and under what conditionthe generic. Every governed policy here is a two-word term standing under it: capability policy, security policy, backup policy, unsubscribe policy, return policy, refund policy, lexicon policy. The bare word policy stays ordinary English deliberately -- the hook matches on word boundaries, so governing it would refuse every one of those compounds.
predicate
a condition a program can decide, whose answer is true or false and not a matter of opiniona done predicate is what closes a work item
promotion
The act by which a recognition or a fingerprint becomes governed work: a work item through the registered sprint create capability on the frequency path, or on first occurrence for a goal-precondition violation or a governing refusal; a bug through bug-open when the cause is a defect.Never a hand insert; the writers are the sanctioned ones.
recognition
The append-only row written when a signature fires: the signature, the observation rows it read, the verdict and the session that ran it.One row per firing; a recognition is evidence, and is never updated.
refund policy
the rules deciding what money is returned, to whom, by when and by what methodthe money. What goods come back is a return policy.
rejection
a recorded refusal of a proposed change, naming what was refused and whya rejection that does not say what to write instead is not usable
repository path
a pathname identifying an object within a repositoryIdentification, not specialization: a repository path identifies a file, it is not a kind of file. No broader relation to file is asserted; the relation vocabulary that would express identifies/identified-by is not yet governed.
repository status
the condition of a repository's working tree at a particular time
resolution
the act and the record of binding one composition member to exactly one governed concept, artifact or value, with the candidates considered, the rule applied and the state reachedone row per member per mediation run; supersedes the prior resolution of that member; carries mediation_run_id. Its state is one of resolved, ambiguous, unresolved, conflicting, decided by a predicate and not by a reading
resolution rule
the first-class output of an adjudication ruling: a rule scoped to a concept scheme, a corpus or a capability -- never global by default -- by which the next occurrence within that scope resolves deterministicallywhat makes a ruling become a rule for the next one in rows rather than prose. Consumed by the resolver before any model is asked; carries provenance to the adjudication and the ruling that produced it
return policy
the rules deciding when goods may be sent back, by when, and in what conditionthe sending back. What money comes back is a refund policy, which is a separate decision -- a return may be accepted with no refund, and a refund given with no return.
round
one pass of a consensus question across the seats, ending in a class: decide, iterate, or escalateGate 1.5
schema migration
a migration that changes a database schema
scope
the set of things a piece of work is allowed to reach: files, tenants, or a document's own extentthe table is work_item_scope
seat
one participant in a consensus round, whose presence or absence is recorded either waya round with one answering seat is insufficient, not a round
seat role
the part one seat plays in a consensus round: who proposes, who answers from evidence, who breaks a tiea property of the round, not of the model filling the seat -- the same model may hold the evidence seat in one round and an ordinary answering seat in the next, and the round records which it held. Distinct from an imp role, which is what imp is asked to work as for a turn and is selected before any round exists
security policy
the rules deciding who may reach which information, and under what conditionsISO/IEC 27002 calls it policies for information security; the enforcement here is identity-rbac and an access role, not a document.
semantic resolution
one row per composition member per mediation run: the source expression, the reference it resolved to, its state, the candidates and evidence considered, the governing rule, and which candidate was selectedthe table that carries resolution; ontology-bound is a view over it (every required member's latest row is resolved), never a stored artifact. A hash proves what ran; this row proves why the mapping was chosen
shard
one bounded excerpt of the corpus shown to a model, identified by its hashthe acknowledged exception to the standards rule: no standard names this, and 9075's partition is a table split by key
sprint goal
one sentence stating what the sprint is forthe column is sprint.goal
state
where a subject stands in its lifecycle, from a closed set the schema enforces
status
the condition of a subject at a particular time
step
one command in a pipeline job, run in sequence with the others in that jobthe CI/CD sense only (GitHub Actions jobs contain steps; Azure Pipelines; Argo). NOT the ordered unit inside a work item, which is a task -- conflating the two is what gave execution_run.step_id a name from the wrong plane.
story point
the unit of an estimate placed on a work item, every placement kept so estimate error is measurablethe unit of a control account; the coined word was coin
table
an arrangement of data in rows and columns
table column
one named, typed attribute of a tableNo broader relation to column is asserted. Whether column is inherently a table concept under the governing standard -- in which case table column is a designation rather than a narrower concept -- is held for explicit adjudication (operator, 2026-09-13).
table constraint
a rule the database enforces on a table's rows
taxonomy policy
the rules deciding how terms are arranged into broader and narrower, and what a valid arrangement isthe arrangement level: term_relation carries SKOS broader, and term_relation_refuses_cycle is the enforcement -- a taxonomy that loops classifies nothing. Not an ontology policy, which governs which kinds exist at all, and not a lexicon policy, which governs which words are refused.
term
a word or phrase carrying system meaning, governed rather than left to habit
transition
one recorded move of a subject from one state to the next, written with its evidence in one actexecution transition is the only write path for a status change
triple
one ordered composition containing exactly three semantic partsa narrow structural mechanic, not one of the concepts the control plane works with: it states cardinality and ordering only and assigns no meaning or concept kind to its three parts. The working concepts are the qualified compositions -- noun-verb-data composition, multi-crate composition, subject-relation-object composition -- whose names state genus and shape at once. Deliberately NOT called three "roles": verb is not the same kind of thing as noun and data, and relation is not the same kind of thing as subject and object. Never "the triple's verb"; name the shape when the shape matters
unsubscribe policy
the rules deciding how a recipient stops receiving a message stream, and how fast the sender must honour itRFC 8058 is the one-click mechanism; CAN-SPAM sets the outer bound on how long a sender may take.
utterance
what a human actually said, kept verbatim and never rewritten; the input to mediation, distinct from the composition interpreted from itthe first of three things mediation keeps apart -- utterance, composition, ontology-bound composition. Origin quoted, screened per 4.120 for interpretation only. A change of what is being asked makes a new composition, never a new utterance
validation
the decision that a need is met, taken by the stakeholder against the needs rather than the requirementsrelease acceptance; not recorded as rows today
verdict
the result a test execution returns, from a closed setSHIP, REVISE, REJECT; PASS, FAIL, UNVERIFIED
verification
the decision that a requirement is met, taken on evidence against its acceptance criteriathe VERIFY state of the sprint machine
verification policy
how a goal is to be decided: by its own explicit predicate, by the conjunction of a criterion set a governed relation names as sufficient, or by manual adjudication ruled by a personstated on the goal; acted on by the verifier; never inferred. Criteria passing does not imply a goal met unless a SUFFICIENT_FOR relation names that set for that goal
version
one immutable form of a work product, naming the version it supersedesthe first version has no predecessor; the column is work_product.version, renamed from the retired word by 0087. Distinct from an ITERATION, which reattempts the same target and is counted by execution_run.attempt -- a new version means what is wanted changed, and the test is whether the acceptance criteria changed. Distinct also from a CONTENT HASH: lexicon_version is a digest, term_version.ordinal is a counter. Successor to the term retired 2026-09-05.
view
a derived presentation of stored rowsan exported registry file is one; editing it is drift, not a change

other

ambiguous
the resolution state in which more than one admissible candidate remains and none dominates under the governing rulea lifecycle state of mediation, and the queue for adjudication. Distinct from conflicting: ambiguity is a shortage of a deciding rule, not a contradiction between asserted resolutions
analyse
to read a row and the record of its class and write what was found under the reader's own labelbug analyse reads the bug and the postmortems of its class through a model and writes the finding as the model's, never a person's
append
add to a record without altering what it already saysthe verb for anything whose history is evidence -- a term version, a need, a ledger entry. Where append is legal and edit is not, the row's own schema says so and this verb is the only one offered
applies
the subject, a composition, applies the object, a registered capabilityadmitted for composition -> capability; a composition applying an unregistered capability is refused before it runs (AC 4.121.11)
apply
to put something into effect
apply migrations
to run each registered schema migration not yet in the ledger, in order
assign
associate an existing subject with an existing assignee, owner, role, or responsibility without creating eitherproduct assign is the spelling when the operation only establishes that association: a belongs_to_product edge in artifact_relation; create is kept for creating the product or the assignment record itself, assign for the governed act the record represents (operator ruling 2026-09-16)
attach
record that one thing belongs with another, as a relation rather than a copythe edge, never the payload: attaching a document to a party writes a relation and leaves the document where it lives. A verb that copied would make two records of one fact
belongs to product
associates an artifact with the product whose artifact set includes itmembership, not composition: actual product composition is a separate and stronger relation carrying component, role and commit, and the 13,024 historical edges are NOT retrofitted into that meaning. The kind is spelled `belongs-to-product` in relation_kind, as every other ratified kind is
compare
to examine two or more subjects to establish how they agree or differ
compare measurements
to take the same measurement on two subjects and report whether they agree
conflicting
the resolution state in which two or more asserted resolutions are mutually incompatible under the rulesa lifecycle state of mediation and not a degree of ambiguity. Cannot be cleared by re-running the resolver; only a ruling that produces a resolution rule clears it
contains
the object is a constituent part of the subjectadmitted today for doc -> doc_section only; a further signature is admitted deliberately, never assumed -- arbitrary containment is what makes a generic word ungovernable
count
to determine how many members a collection has
count rows
to determine how many rows satisfy a predicate
create
bring a row into being that did not exist, with its identity minted at that momentrefuses rather than overwrites when the thing already exists: a create that quietly updates is how two authors edit one record with nobody deciding
criteria conjunction
the verification policy under which a goal is decided by every criterion in a set that a SUFFICIENT_FOR relation names holdingone of the three verification policies. Without the relation, criteria passing is a fact about the criteria and not about the goal
decided by
the subject, a goal, is decided by the object, a predicate over the recordadmitted for goal -> predicate only; a goal with no such edge is the unmechanized remainder and never counts as met (AC 4.121.3)
delivered by
names the crate that delivers a capability, so the register says what can already do the thing rather than only that something cansignature capability -> crate; a capability may be delivered by more than one crate and a crate may deliver more than one capability; says nothing about whether any epic has received it, which is a finding
depends on
the subject requires the object to be present for it to build or runthe qualifier carries Cargo's normal, dev and build sections, so a dependency's scope never mints a second relation
development dependency
the subject requires the object only to build its tests, examples and benchmarks, never to runCargo's `dev-dependencies` section; a consumer of the subject does not acquire it
draw
render a structure as a picture of itself, in whatever form the reader asked forone verb, several spellings: draw, diagram, map, sketch, plot and chart are the same act and resolve to this row, which is what lets a person type the word they think in and still get a governed command. Says nothing about the FORM -- ASCII for a terminal, SVG through tools-mermaid-render for a page -- because the form is the reader's, not the verb's. It renders what is already there and decides nothing: a drawing that adds a box the rows do not have is a claim, not a picture
exists
to be present
explicit predicate
the verification policy under which a goal is decided solely by the predicate row it namesone of the three verification policies. The predicate is a registered predicate row of a typed kind or registered SQL, never free text
export
to provide governed instances of a noun as data only -- CSV, TSV, SQL -- in the form a program loadsexport is paired with import, and the authority boundary is what that pair is about: export provides the instances, import accepts them for validation and admission. The boundary does not separate export from render, because a rendering crosses boundaries too; the artifact does. Data only -- no template, no display -- so the registry TSVs and sprint-template-export are exports, and the postmortem pages are not. Cardinality is payload-level: party export, invoice export, term export; the verb's meaning is constant across nouns and noun-specific validation belongs to the capability, not the verb
has goal
the subject is undertaken to bring about the object, a goal stated before executionadmitted for story -> goal, work-item -> goal and capability -> goal; one goal per subject; the goal is never a member of the subject's composition (AC 4.121.15)
import
accept instances of a noun from outside the authority boundary for validation and admissionthe inverse of export: artifact import, term import; cardinality is payload-level; noun-specific validation belongs to the capability implementation (operator ruling 2026-09-16)
incorporates
one product incorporates another product as a constituent of itselfproduct to product, not product to artifact: `corpus product incorporate` writes it, refusing a self-edge and the direct reverse of an existing edge. Governed -- a person decided it
list
to read the rows of one kind, filtered, and present them; writes nothingbug list reads bugs by status; a list is a reading, never a mutation
manual adjudication
the verification policy under which a goal is decided by an operator's ruling row and never by a modelone of the three verification policies, and the default for every goal backfilled from prose. Schema check on the ruler, the 0016 pattern
mark
associate a subject with a newly allocated identifying or classificatory labeldistinguishes allocation-plus-association from assign, which presumes an existing assignee or object; bug mark allocates the next label in a series and associates it (operator ruling 2026-09-16)
measurement
obtaining one or more values that can reasonably be attributed to a quantitythe International Vocabulary of Metrology (JCGM 200) defines measurement as the process of experimentally obtaining quantity values; rows in run_measurement and benefit_measurement are its results; the act decides nothing, and a program that decides is a check
move
to carry a row from one status to another along an edge the transition registry admits, recorded as an executionbug move records the transition and its note; a move outside transition_legal is refused
normal dependency
the subject requires the object to build and to runCargo's `dependencies` section; written explicitly rather than implied by an absent qualifier
observation
carrying out a procedure to determine the value of a property of a thing, at a timeW3C SOSA/SSN and ISO 19156 (Observations and Measurements) both make the observation the act, carrying a result, a time and the thing observed; an observation states what was observed and when, and decides nothing about it
promote
To turn a recognition or a fingerprint that meets its path's condition into a work item or a bug through the sanctioned writer.The verb of recognition promote.
read
to obtain what something contains, without altering it
read as
the subject, a story, has its source triple interpreted as the object, a composition on the noun-verb-data shape whose utterance keeps the story's words verbatimadmitted for story -> composition only; one composition version per reading, a re-reading is a new version superseding the prior on the same utterance; never containment (operator ruling 2026-09-16)
read record
to obtain what a record contains, without altering it
recognise
To evaluate every signature against the observation rows and write a recognition for each that fires.The verb of recognition run; it reads and writes, and decides nothing a predicate does not.
references
the subject holds a resolvable reference to the objectproves a reference resolves, not that it was cited as authority; subject kind and provenance carry whether the scan found a Markdown link or a path written as a code literal
render
to generate a document for display -- Markdown or HTML through a template -- from the rows that are its authority, so that re-rendering reproduces it byte for bytethe tell is the artifact: a rendering is .md or .html, produced through a template, and read by a person; an export is data only -- .csv, .tsv, .sql -- and read by a program. Stories, sprints, work items, tasks, documentation, source files and postmortem pages are rendered. The rows remain the authority and the document is a view (ISO/IEC 9075), never a second authority; a file that re-rendering does not reproduce is not a rendering but an edited artifact, and the --check form that proves the difference is what makes the word mean anything
resolved
the resolution state in which exactly one admissible candidate remainsa lifecycle state of mediation. A member is resolved by the resolver applying a governing rule, or by a ruling that produced one; a model may propose a candidate and may not set this state where the policy is manual adjudication
reword
to change the wording of a row that is still pending, preserving its identity and recording the wording it replacedPermitted only while the row remains semantically unsettled: before execution, evidence, satisfaction or ruling. A story in the backlog, a task not started, a criterion unsatisfied and carrying no evidence, a proposal not yet ruled. Once any of those has made the old wording historical, correction is by append and version, never by rewriting — the prior wording is a version, and a version is immutable. Distinct from append, which adds to a record without altering what it already says; from move, which changes lifecycle status rather than wording; and from state, which is where a subject stands in that lifecycle.
find existing rows a subject matches, changing nothingone verb, one meaning, whatever noun it is applied to -- that consistency is the reason the verbs are governed rather than spelled per command. It says nothing about HOW the match is made: exact lookup, ranked lexical search and vector recall are three mechanisms behind one verb, and which one ran is recorded on the operation rather than encoded in the word
start
cause a configured executable subject to enter its running statethe attempt and its result are recorded as an execution row; the inventory remains observational reconciliation (operator ruling 2026-09-16)
stipulate
to record a previously unstated condition or decision procedure governing an existing subjectApplies only where the condition is presently absent. For a criterion it records the initial oracle_kind and oracle, preserving the criterion's identity and statement. Refuses if one has already been stipulated, and refuses once evaluation or evidence has made the criterion historical. Distinct from reword, which changes wording and not how a row is decided; from append, which adds to a record without altering what it already says; from move, which changes lifecycle status; from attach, which relates two existing objects rather than recording a property that was absent; from create, which brings a row into being; and from apply, which puts into effect a procedure already recorded. Chosen over specify because specification is ratified as a rendered template section of requirements, so the two would read as a pair and are not.
stop
cause a running executable subject to leave its running statethe attempt and its result are recorded as an execution row; the inventory remains observational reconciliation (operator ruling 2026-09-16)
sufficient for
the subject, a set of acceptance criteria, is sufficient evidence for the object, a goal, by rulingadmitted for criterion-set -> goal; the criteria-conjunction policy reads this edge, and a goal without it is not the conjunction of its criteria by default (AC 4.121.18)
triage
to rank open rows by priority and class and propose the order, deciding nothingbug triage proposes; a person applies
unresolved
the resolution state in which no admissible candidate was founda lifecycle state of mediation. Names the state the ordinary word unknown would have named; the operator declined governing that word. An unresolved required member blocks admission of its composition
verify
decide whether a goal holds from the evidence a record carries, and write the verdict; done by a verifier that is never the executorthe fourth term of the equation; the verdict is one of satisfied, unsatisfied, indeterminate, error (AC 4.121.20); the executor never verifies its own goal (AC 4.121.9)
view of
the subject is a derived presentation of the object, and the object is the source of truththe subject is rewritten from the object and never edited in place; an edit to the subject is drift, not a change. Distinct from CONTAINS, which is constituency, and from REFERENCES, which is a resolvable pointer that leaves both sides authoritative.
weave
to add a strand to the canvas through the loomthe customer's verb, not the model's: a model may propose a strand, and only a person weaves it. Refusing is the loom's, drawing is the canvas's, and this word is neither

plane

canvas
the area of the document imp draws into: the woven chain of strands, and whatever else imp puts there for a person to read or act on -- a file, a schema, a diagram, an editorthe middle of the three thirds, named for the HTML element (operator, 2026-09-10: the HTML5 name is standard, and the canvas is the actual DOM area). Widened by the same ruling from the note's narrower sense, the fabric alone, so that one area carries one name. The distinction the name does not settle: a literal canvas element is a bitmap a script draws pixels into, with no nodes and no selectable text inside it, while a code editor, a table or a schema in this area are ordinary DOM -- so the woven chain may be drawn in a canvas element while its neighbours are not. Chosen over stage, board, workspace, thread, wire and node, each of which already means something else here. What imp draws is not what imp decides: nothing in the canvas acts on its own
code corpus
one governed repository's code and documents, indexed: symbols, citations, search, structural metricsthe database corpus_sourcecode; the tool today is `corpus` (operator ruling 2026-09-05: the binary rename is a later refactor, the database stays shared with the control plane for now)
control
the plane holding what the system knows how to do -- definitions, vocabulary, policy and registries -- as distinct from the record of what was decided and the mirror of what was readimp_control, and operations-control-plane which names the same plane in code. NOT control account, which is the accounting term already ratified
corpus
a data store: a named body of content held so that a question about it is a query rather than a walkwidened by operator ruling 2026-09-10 from the narrower sense it carried, which named one instance -- this repository ingested into corpus_sourcecode -- as though it were the concept. It is not: org_knowledge holds eleven corpora in one connection, the staff host's database holds the parties corpus beside its content, and knowitall holds the host corpus. A corpus is the addressable node, which is why routing resolves a noun to corpora and not to databases; where a corpus LIVES is a connection, and a connection owns nothing. The narrower sense survives as an instance, named sourcecode
crate
one Rust package in this workspace, registered to exactly one tierthe registry is docs/architecture/layers.toml
host corpus
arbitrary host-resident content indexed in place: documents, images, files, filesystem metadata, extracted content, host-local searchthe program is knowitall, a product name kept as the binary; host-corpus is the doctrinal classification (operator ruling 2026-09-05)
imp
mediates between a person's language and a model's: it screens the raw ask, rewrites it through the governed lexicon, compiles a bounded prompt, routes it to a model, and admits or refuses what comes back before anything is writtendecided by ADR 0044: a harness crate in the operations tier owning the mode state machine, engine and pipeline composition, the single egress chokepoint every network-capable operation traverses, the control-plane client and typed session-event emission -- its clients (the tools-imp CLI, the console terminal, imp-gui) render typed signals and never parse its prose. Three artifacts are kept per turn and none replaces another -- raw_ask (exactly what the person wrote), mediated_ask (that ask rewritten through the lexicon, with terms that have no governed equivalent named rather than guessed) and model_prompt (the bounded prompt actually sent): provenance runs human language -> governed language -> model instruction, and imp never silently replaces what was said. Models are interchangeable seats behind it; the safety property lives at imp's external, auditable boundary -- schema, lexicon, chain validity -- because a seat's own reasoning cannot be checked. A seat proposes, imp admits, the seat never executes directly against the database
knowledge base
curated and promoted knowledge: external research, transcripts, ledgers, organisational knowledgethe database org_knowledge; the tool today is `wiki`, renamed when it is materially broader than a wiki
ledger
an append-only record of what happened, kept so that a later reader need not reconstruct itthe module migration ledger; the double-entry ledger in domain-ledger
lexicon
the governed vocabulary itself: which terms carry system meaning and what may be writtenthe source of truth is the database; the TSVs are renderings
library crate
a crate other crates depend on, as opposed to one that only runs
module
one bounded piece of code inside a crate, owning its own migrations where it has any
probe
to observe and report a value without deciding anything, and the instrument that does it; distinct from check, which decides whether a guard holds and returns a verdictretired 2026-09-05 in favour of check (OMG UML guard evaluation). NOT YET PUBLISHED to lexicon.tsv: the word names probe_run, /lab/probe-run and PROCESS section 14, 5484 occurrences across 583 files, so publishing it would refuse every commit touching them. The rename is one unit; publication is its last step.
record
the stored, authoritative form of something, as opposed to any rendering of itthe rows are the record; the markdown is the rendering
sprint doc
the rendered document for one sprint, whose authority is the rows it is rendered fromdocs/userstories
wiki
material from outside this workspace, fetched and indexed for referencethe database is org_knowledge; it is not the corpus
worktree
a checkout with its own index, so two sessions cannot stage over each otherone worktree per session

role

author
the person or agent responsible for creating a work. A NOUN of category role: it names a party in relation to a work, not the act of making one. The former verb sense is retired rather than relocated (operator ruling 2026-09-12) -- bringing a row into being is `create`, and `draft` remains a status rather than becoming a verb. Where something must store an author, the field names what it holds.
object
the destination artifact endpoint of an artifact relationscoped to relation semantics, not the data of an noun-verb-data triple: an object is an artifact a relation points at, while data is the typed information an action produces. artifact_relation.object_id is this endpoint
subject
the originating artifact endpoint of an artifact relationscoped to relation semantics, not the noun of an noun-verb-data triple: the two occupy the first position of different structures and are not synonyms. artifact_relation.subject_id is this endpoint; relation_signature constrains which kinds may fill it. SOSA/SSN calls the observed one the feature of interest, and the observational columns (check_result, state_transition, evidence, scope_statement) use the word in that same endpoint sense

status

accepted
an architecture decision ruled on and in force
admitted
the composition's status once typecheck and ontology_bound both holdadmissibility is a gate, not a term in success (AC 4.121.17)
composed
the composition's status once IMP's interpretation is written as membersadmission has not been decided; typecheck and ontology_bound are the gate
error
the verdict that the goal's predicate failed to executeterminal; three different facts from unsatisfied and indeterminate, never collapsed
executed
the composition's status once the admitted application has runthe run's record is what the verifier reads
indeterminate
the verdict that the goal could not be decided: evidence missing, or a policy that needs a ruling not yet madeterminal; a goal with no predicate is decided by nobody and never counts as met (AC 4.121.3)
intended
the composition's status while an intent exists and no interpretation has been writtenthe initial status; the utterance is kept, nothing is composed yet
observed
the composition's status once the run's record is captured as evidencethe evidence the verification reads
proposed
an architecture decision put forward and not yet ruled on
refused
the composition's status when admission failed and the refusal names what failedterminal; a new interpretation is a new composition version
satisfied
the verdict that the goal's predicate evaluated true over the recordterminal; success is executed and satisfied, never admission alone
superseded
an architecture decision replaced by a later one, kept because it was once in force
unsatisfied
the verdict that the goal's predicate evaluated false over the recordterminal
verified
the composition's status once a verifier that is not the executor has decided its goalthe verdict is one of satisfied, unsatisfied, indeterminate, error (AC 4.121.20)
withdrawn
an architecture decision taken back before it was ever in force

tier

application
one product, composed of the tiers below italready ratified as a ddd-hexagonal-v2 ROLE; this row governs the tier sense
content
authored material and how it is stored, rendered and served
domain
what the business does, as primitives: the nouns and rules a product composes rather than reimplements
foundation
the lowest tier: patterns and types every other tier may depend on, and which depend on nothing in this workspace
identity
who a thing is: people, organizations, tenancy, authentication and access
infrastructure
adapters to the world outside the process: databases, mail, HTTP clients, the filesystem, modelsalready ratified as a ddd-hexagonal-v2 ROLE; this row governs the tier sense
operations
how work itself is coordinated and recorded: runs, evidence, transitions, telemetry
platform
the assembled runtime a product is served on: hosts, routing, session and request plumbing
tools
programs the operator and the harness run: the CLI plane, never a dependency of a lower tier