S-03 — Glossary (plain language)

Each term in one or two plain sentences. Full technical treatment lives in the D-* docs.

Claim. A fact about something that needs governing — a claim, a request, a job. Carries a stage, an owner, and receipts. (D-02)
CNS (Canonical Naming Service). The platform's address book for names: every claim type, interface, and fact has a cns://... address, so packs in different places reference the same thing without copying it.
PoCE (Proof of Correct Execution). The receipt chain for an action: which rule allowed it, who was present, what the input and output were, signed off as a whole. Used to prove an action happened correctly, later.
Quorum. "More than one person must say yes." The platform opens a quorum (named group, threshold) and records each signature; nothing advances until the threshold is met.
SOD (Separation of Duties). Nobody approves their own work. The guard refuses creator == approver outright.
Soft mode. A safe sandbox posture: the system validates and explains (plans) but doesn't commit anything real. Soft never claims to be live.
Live gate. The close-line between proving the pipes work and being allowed to switch on. It only flips when real checks answer on the spot — never from a checkbox.
Outbox. An outbox table like a postbox: the system writes an event there first (so it's durable), then publishes it to the message bus. Nothing is lost between writing and publishing.
Event spine / message bus (NATS). The nervous system: every event travels as a named message (claims.lifecycle.v1...) on a bus, not by apps calling each other directly.
Subscription / consumer. A worker that listens on the bus for a type of event and does its job. The new claims-spine consumer listens for lifecycle events and dispatches what the pack declares.
Scenario pack. An editable bundle describing one line of business (an insurance claim, a benefit claim): its stages, limits, who may do what, and which events it emits.
Lookup (KV). The shared config store (SOVEREIGN_LOOKUPS): named blocks of numbers/rules the code reads at runtime — editable without deploys.
Panel. The registry of which organizations/people may act in a role (broker, assessor, garage…), with their credentials attached.
SLA window. The time budget per stage (e.g. acknowledge in 4h). If it breaches, an action fires (re-dispatch or escalate) — timed by the workflow engine.
VAS (value-added services). Optional extras a cover entitles you to. Eligibility is computed; entitlement is granted by the billing side only.
Entitlement. The right a customer holds because they paid (or were granted). The desk decides; the claim plane never invents it.
Wallet binding. Which payment wallet (adapter class) an account uses. An interface — the platform refuses when it's unset rather than guessing.
Moh/status fence (invent_refuse). Every module can refuse a request that would require inventing live state; the refusal literally says so.
Dual control (MSS). Sensitive edits need two named people: one drafts, the other co-signs; the change lands only when both did (quorum = met) and the base hasn't moved (CAS).
Stratum. A numbered schema layer (s135, s230…). Deployed bottom-up in dependency order.
Vault / BBS+. Encrypted personal documents (information vault), provable selectively (BBS+) without giving the whole document away.
JTDS/ZTDS. Zero-trust data store: encrypted series with leases (who may read, for how long, from where).
APF. Application permissions framework — roles → permissions per app; the gatekeeper for what a user may do inside one application.
Trace/voyage. One id (correlation_id/voyage id) joining everything about one claim across claim, sourcing, PoCE, and outbound events.
Canary/Soft apply/silent-failure discipline. The naming for safe-rollout honesty: Soft, Soft, and the audits in D-15.
Zero bespoke. No domain-specific tables, columns, or functions; every entity maps to canonical claim/truth/integration primitives.
Declarative-first. Thresholds, vocabularies, scenarios, and templates live in config planes, never hardcoded in transactional logic.
Events-not-polling. Background work uses NATS JetStream anchors + sweeps for recovery only; no polling loops.
Fail-closed. Infrastructure failures produce typed errors; synthetic success objects never appear in any response.
No synthetic payloads. UI cards, dashboards, API routes must never display hardcoded numbers, coordinates, or fake data.
CNS address grammar. One canonical naming grammar for every typed thing: cns:// scheme + slash-separated segments, depth floor 2, ceiling 16; empty body and wrong scheme rejected distinctly; ancestors resolved nearest-first; traits and capability references inherited from ancestor paths; interfaces carry versioned category path-at-version; validation callback caches compiled schemas and maps canonical paths to event subjects at runtime.
Claim dual-map. Every claim-eligible entity is both a claim record typed by a canonical claim-type path AND a graph participant linked by a typed edge; claim typing and graph typing must agree; never create a claim without its graph link; never expose a graph object whose typing disagrees with its claim typing.
Scope governance delegation chain. Authority is a formal delegation chain: root scope owns max delegation depth (capped at 10), join policy, and recovery quorum; each delegation is immutable and hash-linked from issuer to subject for a scope and set of claim types, with its own depth, parent hash, validity window, signature, and lifecycle state; hierarchy adds directed A-DAC relation of containment/management/observation between scopes; claim-type registry states which types are valid in which scopes and whether they require a public anchor or trusted-execution attestation; fifteen invariants guard monotonicity, cycles, root binding, membership, join policy, orphanhood, transfer quorum, temporality, scope consistency, stale signatures, expiry, depth overflow, duplicate hashes, and sealing.
Proof machine hash chain. Proof is a hash-chained, append-only receipt trail: each step hash = hash(session, index, stage, spec version, predecessor, inputs, outputs, rules); root binds specification, version, chain head, result claim, and result hash; steps cannot be mutated or reordered after the fact; finalisation binds the root to exactly one result; minting is event-driven, never polled.
Lifelong + quorum bridge. Entity-to-claim linkage as a join model: lifecycle event names entity type, entity identifier, event type, actor, prior/next states, scope, governed-execution flags with path specification reference, and resulting proof session reference; new lifecycle signals publish to the delivery anchor; entity reference pointer remains lifelong identity with index for range/paging lookups by entity and time; governed lifecycle signals publish to anchor rather than persisting as private stream; quorum = named threshold group, default threshold 2, signer array, open status, expiry; no new tables beyond pointer + indexes.