Glossary

A

Actor Any participant that creates records — a person, an AI agent, a service account, or a system component. Identified by a DID. See Actors.

Act Type One of 8 types that classify what a record represents: INTEND, DO, KNOW, LEARN (coordination) and GET, PUT, CALL, MAP (effects). See Records.

Adapter A bridge between the Syncropel engine and an external system. CLI adapters spawn subprocesses (any agent CLI binary — Claude Code, Codex CLI, OpenCode, Pi, etc. — plus bash and custom binaries). Proxy adapters make HTTP calls (Anthropic, OpenAI, and other providers; custom endpoints). An actor can be registered with an adapter so dispatches to the actor's DID route through the adapter.

AITL (Actor-in-the-Loop) A request for a decision from an actor, typically a human or trusted agent. Expressed as a KNOW with body.awaits: "actor_decision". Resolved by a DO with body.fulfills or body.cancels. Used by the kernel's intelligence path to surface proposals for approval before acting.

Approval A KNOW record with body.verdict: "accept" from an independent evaluator. Creates trust evidence. See Trust.

B

Bearer Token A random credential string minted by spl service-account create and presented in the Authorization: Bearer <token> HTTP header. The daemon resolves the token to a service account DID via the token map, then enforces namespace and permission rules as if the SA were the actor. See Keyring.

Body The JSON payload field of a record (record.body). Opaque to the kernel; conventions are documented per topic. See Record Format.

Body Kind A convention inside body.kind for integration records. Grammar: scope.category.entity[.version]. Enforced by the SDK at emit time. See body.kind manifest.

Broadcast The in-process pub/sub channel that publishes every ingested record to reconcile, tick, cron, federation pairs, and SSE listeners. Used for hot-reload of config when th_engine_config records land.

C

Canonical JSON A deterministic JSON serialization with alphabetical keys, no whitespace, minimal number formatting. Any implementation produces identical bytes for identical input. Used for the hashing pre-image and for federation wire format. See Record Format — canonical JSON.

CEL (Common Expression Language) The kernel's policy-and-query expression language. Authors triggers, routing, preconditions, fold rules, health checks, AITL rules, permissions. 7 evaluation contexts, each with its own bindings. See CEL expressions.

Clock A logical timestamp on each record, monotonically increasing per (actor, thread). Non-negative i64. Starts at 0. Used for ordering records within a thread; not wall-clock time.

Consent Grant A LEARN record on the th_consent thread that authorizes records to cross a namespace boundary during federation. Specifies source_namespace, target_namespace, and allowed hash levels (L0–L3). Default is strict: no grant, no crossing.

Coordinator (Fleet) The fleet instance that holds the instance registry thread, receives heartbeats, and processes fan-out dispatch. A single DID per fleet. The distinction from worker is config, not code.

Correction A KNOW record with body.topic: "correction" referencing a prior incorrect record in parents. The fold walks both and picks the later record's content. Immutable supersession — the bad record stays in the log.

CRON (loop) The engine's daily / hourly maintenance loop. Runs trust decay, pattern crystallization sweeps, snapshots, cost reports. See The Engine.

Crystallization When a pattern meets the four quality thresholds (C1 trust ≥ 0.90, C2 observations ≥ 100, C3 MDL compression gain, C4 multi-source), it becomes crystallized — proven reliable enough for automatic REPLAY. See Patterns.

CUSUM Cumulative sum drift detection. The trust loop runs CUSUM against each (actor, domain) baseline and emits alerts when the success rate shifts meaningfully. Observable at GET /v1/governance/cusum-alerts.

D

DID (Decentralized Identifier) The permanent identity of an actor. Three methods supported: did:key (self-describing public key), did:web (domain-rooted HTTPS resolution), did:sync (directory-resolved with key rotation support). System-local DIDs use the did:sync:user:…, did:sync:agent:…, did:sync:system:… conventions.

Dial A continuous value in [0, 1] that maps trust and pattern match strength to cost zones. Zones: REPLAY (0.00–0.33), ADAPT (0.33–0.50), EXPLORE (0.50–0.67), CREATE (0.67–1.00). See Trust — the dial.

Dispatch The act of routing work to an actor for execution. spl task dispatch opens a dispatch thread, emits an INTEND, and registers an adapter to invoke the target. See Routing rules.

Domain A category of work — code, ops, data, research, shell, api, spec, agent, meta, browser, workflow. Trust is scoped per-domain; an actor can be trusted in one and not another. Authors emit the domain; the kernel doesn't enforce a fixed list.

E

Engine The 4-loop kernel: INGEST (receive, hash, store, broadcast), RECONCILE (route and dispatch), TICK (periodic trust / drift work), CRON (maintenance). See The Engine.

Evaluation Gate The requirement that completed work be reviewed by an independent evaluator (a different DID than the completer) before trust evidence is created. Structurally enforced — self-verdicts produce no trust. See Trust — independence.

Event Trigger A LEARN on th_engine_config with body.topic: "event_trigger". Fires when a matching record lands or on a cron schedule. Rate-limited, with cooldown and causal-chain protection to prevent loops. See Scheduled triggers.

F

Fan-out A parent INTEND that declares body.subtasks as a list of child descriptors and body.join as a predicate. The engine spawns one child INTEND per descriptor, dispatches each to a target worker instance via the instance registry, and emits the parent KNOW when the CEL join predicate is satisfied.

Federation How two or more Syncropel instances share records while keeping trust boundaries intact. Pull-based, signed, consent-filtered. See Federation.

Fleet Two or more spl instances coordinating via the instance registry. One is the coordinator; the others are workers. The distinction is config, not code — any instance can play either role. See Fleet benchmarking.

Fleet Control Registry The in-memory snapshot of freeze / emergency-stop LEARN records on th_fleet_control, queried by CEL permission rules at every record write. Same reload pattern as the namespace and permission registries.

Fold Computing the current state by replaying all records on a thread: state = fold(records). This is how status, trust, and configuration are derived — there is no separate state database. Every fold is a pure function.

Fold Rule A CEL expression (stored as a LEARN on th_engine_config) that customises the task or thread status projection. Used to express deployment-specific status transitions without changing kernel code. See CEL — fold_rule context.

G

Governance The union of namespaces, permission rules, CEL policies, consent grants, kill switch, and audit export. The kernel's mechanism for enforcing "who can do what where". See Namespaces and SIEM integration.

H

Hash Levels (L0 / L1 / L2 / L3) Four hash-signature levels of a record, each throwing away more detail. L0 is exact content. L1 is structural (dial + in + op + out + p). L2 is flow (in + out + p). L3 is intent (in + out). L0 never crosses a namespace without consent (Foundation F8); L1–L3 can. Containment: L0 ⟹ L1 ⟹ L2 ⟹ L3. See Patterns.

Heartbeat A DO record with body.topic: "heartbeat" emitted by each live instance on th_instance_registry at a configured interval (default 15 seconds). Carries instance DID, endpoint URL, version, uptime, active dispatch count, health status. The coordinator's fold treats the latest heartbeat per DID as authoritative and classifies instances as live / stale / archived.

I

INGEST (loop) The engine's hot path: receive a record, validate, hash, store, broadcast. Budget under 100 microseconds. Never blocks on downstream work.

Instance A single spl serve daemon with its own SYNCROPEL_HOME, hub.db, port binding, and identity. An instance may run standalone or as a coordinator/worker in a fleet.

Instance Registry The in-memory fold of th_instance_registry that maintains the live-instance map. Coordinator-local (single writer).

Intelligence The kernel's reasoning actor — did:sync:system:intelligence. Runs when the routing cascade finds no match; proposes a routing rule via AITL rather than executing directly. Its proposals accumulate meta-trust from accepted/rejected outcomes.

J

Join Predicate The CEL expression in a fan-out parent's body.join that decides when the parent closes. Shapes: all (every child), any (first accept), k_of_n (K accepts), or arbitrary CEL. all and CEL cannot short-circuit under partial reports — see the fanout-join monotonicity constraint in the spec.

Judged By The 8th record field — a pointer to the record whose judgment this reflects. Not hashed into the ID. Used for trust attribution; the same observation with different judged_by represents two evaluators' independent views.

K

Kill Switch A reversible freeze mechanism with three escalation levels, implemented as LEARN records on th_fleet_control. Soft denies new INTEND/DO/CALL in a namespace while allowing KNOW/LEARN for drain. Hard adds a grace window after which all ingest is refused. Emergency forces the engine-wide dial to 0 (REPLAY only) across every namespace. All levels are reversed by counter-records.

L

LEARN One of 4 coordination act types. Records an insight or persistent decision — a configuration change, a lesson learned, a new rule. Config records (routing rules, triggers, CEL policies, auth toggle) are LEARN records on th_engine_config.

Logical Clock See Clock.

M

Memory An actor's persistent context across sessions — LEARN records on the actor's memory thread projecting into preferences, learned corrections, project state, and references. Loaded by the agent CLI adapter at dispatch time via the agent's manual. See Actors — memory.

Meta-Trust The trust score of the kernel's intelligence actor itself, tracked separately from any specific domain. Accumulates from AITL proposals that get accepted vs rejected.

Monotonic Narrowing The rule that a child namespace can never claim capabilities its parent doesn't grant. Enforced at ingest by walking the ancestor chain and rejecting if any link is missing or non-Active. See Namespaces — narrowing.

N

Namespace A scope that groups records by tenancy, project, environment, or job. Every record belongs to exactly one namespace via body.namespace (or implicitly to default). 5-level hierarchy: DEFAULT → ORG → PROJECT → ENV → JOB. See Namespaces.

Namespace Registry The in-memory snapshot of explicitly-declared namespaces, built by replaying LEARN records on th_namespace_registry. Hot-reloads on every namespace_entry record via the broadcast handler.

P

Pair (Federation) A durable subscription: "this instance will pull changes for this thread from this peer." Fields: peer_did, peer_url, thread_id, cursor. Created via POST /v1/federation/sync/pairs or spl fleet sync add. See Federation.

Participant Any actor who has written a record on a thread. Tracked automatically from the record log; not a separate table. spl thread show lists participants with roles.

Pattern A recurring structural shape of successful records. Matched at multiple abstraction levels (L1 exact through L3 intent). Can crystallize when trust, observation count, compression gain, and multi-source criteria (C1–C4) are met. See Patterns.

Permission Rule A CEL expression evaluated on every record write to decide allow / deny. Fail-closed by default when permissions.enabled = true. Authored as LEARN records on th_engine_config. See CEL — permission context.

Precondition A CEL expression attached to a task that blocks task execution until the condition holds. Evaluated every broadcast; unblocked tasks transition to ready state. See Task management.

Proxy Adapter An adapter that makes HTTP calls instead of spawning a subprocess. Used for any provider that exposes an HTTP API (Anthropic, OpenAI, Google, Mistral, custom endpoints, etc.). The /v1/proxy/messages endpoint is the canonical proxy translator (the Anthropic Messages API shape is supported out-of-the-box; other shapes plug in as adapters).

R

RECONCILE (loop) The engine's dispatch loop. For each incoming record, runs the routing cascade and either dispatches work to an adapter or marks the record handled. Concurrent dispatches are semaphore-gated (default 4).

Record The fundamental unit — an 8-field immutable, content-addressed data structure. Records are never modified or deleted. See Records.

Reserved Thread A thread with a canonical ID baked into the kernel, used for bootstrap. th_engine_config, th_actor_registry, th_namespace_registry, th_instance_registry, th_fleet_control, th_consent.

Routing Rule A CEL expression stored as a LEARN on th_engine_config with body.topic: "routing_rule". Matches records and routes them to a target actor. Evaluated in priority order; first match wins. See Routing rules.

S

Service Account (SA) A machine-facing actor with a DID under did:sync:system:sa_…, created by spl service-account create. Authenticates by bearer token. Scoped to specific namespaces and permission surfaces. See Keyring.

SSE (Server-Sent Events) A one-way HTTP streaming protocol. Syncropel uses SSE on the proxy path (/v1/proxy/messages with stream=true) and the MCP transport (/v1/mcp/sse).

Snapshot A JSONL (.snap.jsonl) file containing a thread's records plus a manifest. Used for backup, migration, and fleet bootstrap. Encoded by syncropel-store::snapshot; tamper-evident (manifest hash over sorted record IDs) and idempotent (content-addressed dedup on restore). See Backup and restore.

Substrate The current implementation backing an actor — which AI model, which adapter version, which tool binary. Changes occasionally. Distinct from the actor's DID, which is permanent.

T

Task A thread whose opening INTEND has body.task = true and carries alias, assignee, domain, priority. Status derived by the task fold. Tracked via spl task commands. See Task management.

Thread A sequence of records sharing a thread ID. Represents a workflow, task, conversation, or any coordinated activity. See Threads.

TICK (loop) The engine's drift-detection loop. Runs on a fixed interval (default 60s); processes trust outcomes, CUSUM drift, stall detection.

Trust A score computed from evidence — approved work, reviewed outcomes. Three-dimensional: trust(actor, domain, judged_by). Uses Wilson score lower bound at 95% confidence. Decays with a 90-day half-life. See Trust.

W

Wilson Lower Bound The statistical lower bound on a success rate given (successes, total) and a confidence level (95% in Syncropel). Conservative with few observations; converges to empirical rate with many. Used as the honest trust score.

Worker (Fleet) An instance that executes dispatched work and reports heartbeats to the coordinator. A single fleet can have many workers; the coordinator-vs-worker distinction is config, not code.

Z

Zone One of four cost regions on the dial: REPLAY (near-zero), ADAPT (low), EXPLORE (moderate), CREATE (full). The zone determines how much computation is needed per the trust + pattern-match combination.