Key concepts — ontoref

The words this project uses, and what they mean

This glossary is not written here. It is projected from .ontoref/ontology/glossary.ncl — the same file «ontoref describe term» answers from in the terminal. Change a definition once, and it changes in both.

.domains-ontoref/

ArtifactThe consumer-side container a bonded project carries: one subfolder per bonded domain (`.domains-ontoref//`). Each subfolder holds a REQUIRED `bonds.ncl` (a BondSet) and an OPTIONAL implementation spine (federated `ontology/schemas/`, `reflection/modes/`). Multi-domain membership is just multiple subfolders — never derived from the manifest's scalar `repo_kind` (carrier-only). Detected by `domain.nu :: project-domains` as kind `bonded_dir`; it supersedes the deprecated flat marker `.{domain}.ontoref/`, and both are recognized during the 0047 migration window.related: Bond, Domain (specialization surface, activated by repo_kind or by bond), Ontoref node

Ambient affordances

ConceptStructural properties that make an environment legible and actionable without anyone giving instructions: you can see what can be done just by looking. Kept in English in Spanish prose — there is no settled Spanish form, and inventing one would grow a seventh vocabulary where the registry exists to prevent exactly that. Its ontoref correlate is [[harnessability]], with one difference: affordances describe an environment a harness finds; harnessability, a subject that declares itself.

avoid

affordance as a property of an OPERATION — what it may do, what must hold before it runs, whether it can be undone. That is a capability contract, and this term does not name it. Sighted 2026-08-22 in yu-evolution-of-ontology, which moves «from entities and relationships toward affordances and actions» in exactly that sense: an operation's declared preconditions, effects and reversibility. The registered sense is Fowler's — a property of an ENVIRONMENT a harness finds legible, not of an act it may perform. Both are defensible readings of the English word and the alias list already claims «affordance» and «affordances», so an author reaching for the operation sense would land on this entry and mean something else.

Apoptosis

Conceptcomes from ADR · adr-089Programmed death: the deliberate collapse of a cell that enables reconstitution. Cell-scale projection of `pole-collapse` — a collapse chosen and recorded, as opposed to one suffered. A cell whose paid case no longer exists, or whose claim has been absorbed by another, is retired ON PURPOSE and its lineage records that it was; what it must not do is remain in the census answering 'pass on a question nobody asks.

avoid

Calling neglect apoptosis: a cell nobody evaluates any more is abandoned, not retired by design
Retiring a cell without recording it in the lineage — an undocumented death is indistinguishable from a loss

Bond

ConceptA typed relation between projects (and their domains) within the ontoref framework — distinct from a `link`, which is a generic node reference (the `ln`/Link schema). A bond carries an AXIS: governance (the project is an ontoref-node in a domain's DAG) or dependency (the project inhabits an ontoref-plane with peer nodes). A dependency bond is typed with a DDD Context-Map kind (CustomerSupplier, Partnership, OpenHostService, Conformist, SharedKernel, AnticorruptionLayer) and may be `mutual`. Every bond resolves against the domain roots of both endpoints — their definitions, attributes, states and capabilities — never on the edge itself. Bonding is orthogonal to ontoref project management: a project may bond to the framework whether or not ontoref governs its development.related: Ontoref node, Ontoref plane, Domain (specialization surface, activated by repo_kind or by bond)

Bond axis

ConceptThe eje a bond runs along — one of two. GOVERNANCE: who governs whom, an acyclic DAG resolved with Delegate / Override / Compose. DEPENDENCY: who needs whom, a plane that permits cycles, typed with a DDD dependency-edge and optionally `mutual`. A single bond carries exactly one axis; a project relates to a domain along both by declaring two bonds. The word is `axis` / `eje`, NEVER "dimension" — that is reserved for the project FSM dimensions (state.ncl).

avoid

dimension (reserved for FSM state dimensions)

related: Bond, Ontoref node, Ontoref plane

Cell

Conceptcomes from ADR · adr-088A unit with a constitutional nucleus and an expression interface, which participates in operational processes and whose validity is determined by its real participation, not by its form. The nucleus is stateless and portable; memory, role and cadence belong to the tissue that expresses it. That separation is not tidiness — it is what makes export possible: a cell carrying its own history cannot cross, because that history means nothing in the receiving tissue. Its verdict is ternary ('pass | 'fail | 'unknown), and 'unknown is first-class: a cell declaring what it NEEDS in order to answer reports 'unknown where that reach is absent, instead of being excluded per context — which would weld it back to a place.

avoid

Storing memory, role or cadence inside a cell — each of the three is what would prevent it from being exported
Calling a predicate a cell when it cannot alter any decision in any circuit (see making-a-difference)
Treating 'unknown as an error or as a failure: it is the only way the unforeseen enters the model

Cellular latency

Conceptcomes from ADR · adr-089A held tension at cell scale: no tissue expresses the cell right now, its lineage is intact, and the criterion for reactivating it is written down. Cell-scale projection of `spiral` — the tension is sustained rather than resolved by deletion. Latency is a declared state with a way out, which is what distinguishes it from a cell that merely stopped being used.

avoid

Parking a cell that reports 'fail as latent: a silenced failure is not a held tension, it is a hidden one
Declaring latency without a written reactivation criterion — without it the cell is abandoned under a better name

Complementarity (relation class)

Conceptcomes from Schema · ontology/schemas/core.ncl::edge_typeRelation class of the `Complements` edge kind: two things that add without implying each other. Removing one leaves the other intact and meaningful. This is the WEAKEST of the four symmetric classes and the default one — in ontoref's own graph it carries 65 of 186 edges with no discriminating criterion applied, which is exactly why an impact traversal that cannot tell it from Nonduality reports 91% of the graph at depth 3. A Complementarity edge is a real fact; a Complementarity edge chosen because no other kind was considered is a deferral.

in use

21 of the 65 Complements edges in core.ncl are incident to a 'Spiral node — the undecided zone between this class and Nonduality, reviewable by a person and by nothing else

avoid

Writing a check that reclassifies a Complements edge incident to a 'Spiral node. The 21 such edges are the judgement, not the defect; automating the call would be a lexical proxy for it (`derived-criterion-enforced-as-given`, ondaod).
Treating this class's population as evidence that the finer kinds are unused — the enum's own history records FlowsTo, ValidatedBy and LimitedBy being dropped as 'unused' and restored across 11 consumer projects (see ../../ontology/schemas/core.ncl header).

Consistency is not correctness

ConceptA passing check accredits CONSISTENCY — that everything it looked at agrees — and never CORRECTNESS, which is a claim about a domain the check was never handed. The formulation is Nicolas Figay's, from «The Other Ceiling»: a reasoner returning no contradiction has verified the fragment it was given, not the domain. Its second half travels with it — decidability is not adequacy: that a machine can always answer a question does not make it the question worth asking. Here it names the boundary of every gate this project runs. `validate ontology` answered «0 findings» while the self-describing axiom declared three artifacts that did not exist; the answer was consistent and was not correct. The remedy is never to trust the green harder — it is to declare what the gate does NOT look at, which is why a closed finding must state the extent of the floor that closed it.

in use

`ontoref validate ontology` reporting «61 nodes · 175 edges · 0 findings» over an axiom whose three declared artifacts had not existed for months — case file 0/10.
A fail-closed provisioning rule that judged retrieval by an exit code which `describe ` returns as 0, so 111 bytes of usage text came back as a materialized level — case file 111/0.

avoid

Reading a passing gate as a claim about the world rather than about its own extent.
Closing a finding without declaring what the new gate does NOT cover — the green then carries a claim nobody made.
Citing the formulation without attribution: it is adopted vocabulary, and the source is held in custody precisely so the quote can be checked.

Dependency edge

ConceptThe typed arista of a DEPENDENCY-axis bond, classified with a DDD Context-Map kind: CustomerSupplier, Partnership, OpenHostService, Conformist, SharedKernel, AnticorruptionLayer. DDD is borrowed ONLY here — as the dependency-edge type enum — never as the overall frame (that stays native ontoref: nodes / edges / axes / planes). The enum grows by witnessed evidence, never speculation (enforcement-vs-emergence). A `mutual` dependency-edge (Partnership) is the 2-cycle that constitutes an ontoref-plane. Governance is NOT typed this way — it uses resolution (Delegate / Override / Compose).

avoid

typing a governance bond with a DDD kind (DDD is dependency-axis only)

related: Bond, Ontoref plane

Deploy answer

ConceptA party's declaration that it answers for one need of one service — building or rebuilding the image, publishing, syncing, terminating TLS, holding secrets, keeping state — written in ITS OWN `.domains-ontoref//answers.ncl`, never by the service and never on the bond. It names its cardinality: 'Sole (the only writer of that act) or 'Shared with what reconciles the writers. Uniqueness is declared, not forced. «Who answers» is composed on read from the answers that name the service; the realisation stays in the answering party's repo, referenced (adr-128).related: Deploy need, Bond

Deploy need

ConceptWhat a service requires in order to be deployed — an env var, a secret, a state path, a layer, a port, TLS, liveness, the sync of what it publishes — declared by the SERVICE in `.domains-ontoref//needs.ncl`, beside its bond. A need says what is required and why (the case that paid for it), and the project's value when it has one; never how a host realises it, never an origin, never an operation. A secret is named, never valued. The protocol types the base, the domain publishes its class over it, the project gives the values (adr-128).related: Deploy answer, Bond, .domains-ontoref/

Differentiation

Procedurecomes from ADR · adr-089Expressing a cell in a tissue without collapsing its definition: target, threshold, circuits and role are set here, and the nucleus is not touched. Cell-scale projection of `synthesis` — the cell keeps its general definition AND acquires a concrete expression, instead of one replacing the other. Differentiation does not change lineage. In level terms it is what adr-018 calls Delegate, Override or Compose: an instance takes the domain cell unchanged, supplies its own for the same id, or wraps it.

avoid

Modifying the nucleus and calling it differentiation — that is a mutation and it requires authorship
Differentiating in a way that changes what the cell CLAIMS rather than how it is expressed

Domain (specialization surface, activated by repo_kind or by bond)

Conceptcomes from ADR · adr-064An ontoref extension with a territory it is responsible for — artefacts in projects, a territory it brings, or a manner projects adopt — over which it declares, validates and composes rules, methods and actions (adr-076: schemas, adrs, qa and modes together). It has an AUTHORITY side and a CONSUMER side (code/domains/README.md). The authority is either an entry under code/domains/{id}/ (adr-012) or a registered project whose manifest declares it in `domain_provides` — the provider, found by `domain-root` (adr-117 path b). A project reaches a domain in one of two ways, and neither removes the other (adr-076 `domain-activation-coexists-on-two-paths`): its repo_kind matches the domain's repo_kinds, or it carries a bond at .domains-ontoref//bonds.ncl (adr-073). A domain provided outside ontoref may be reachable by bond only (custody, wuwei). `schema_cmd` names WHERE a domain's schema lives (in ontoref vs the implementing project) — it is a schema-location field, NOT federation. Measured 2026-10-15: eleven domain ids — seven authority entries (corpusref, framework, gov, opus, personal, provisioning, rustelo) and four provided only (custody, htmx-site, personal-ontology, wuwei). Re-measure, never trust this count: `ls code/domains` plus `provided-index` in `reflection/modules/domain.nu`.

in use

opus is a domain reached by repo_kind KnowledgeBase/ContentProject (renamed from knowledge-works, opus adr-006)
custody is provided by the custody project and reached by bond only, never by repo_kind

avoid

Do NOT read schema_cmd as federation — it is where the schema lives, not a cross-dev link
Do NOT conflate a domain with a door (marketing funnel entry): ADR-064 fixes 4 doors, an axis distinct from the domains
Do NOT read a domain as repo_kind-activated only — a provided domain may be reachable by bond alone
Do NOT carry the domain count as settled fact — it is a dated measurement

Door (marketing funnel entry)

Conceptcomes from ADR · adr-064One of the outward funnel entries projected from spine.ncl (ADR-057/064): gov / infrastructure / authoring / personal. A door is an AUDIENCE-facing routing hook that carries a content `tag` (e.g. gov, knowledge-works) and routes to real content, never argues the core. ADR-064 fixes FOUR doors — an axis distinct from the domains (their number is measured, never frozen: see the term `domain`) and the ONE convergence membrane.

in use

The authoring door (audience authoring-knowledge) maps to the knowledge-works content tag

avoid

Do NOT equate a door with a domain — a door is an audience entry, a domain is a repo_kind CLI surface; rustelo is a domain but NOT a door
Do NOT read a SHARED WORD as a collision — `gov` is the domain id AND the door key, `personal` likewise: two axes may name their own thing with one word, and adr-102 records the day a rule forbidding that was written and refuted

Encargo (work commission)

Practicecomes from ADR · adr-063Umbrella for the governance unit that constrains an agent by checking the deliverable against explicit terms instead of trusting the operator. An Encargo = one SOW (the terms) + its runs (the executions). Two atomic rules make it a habit: (1) no scope + contract, no start; (2) no witness, no done. Each element kills a specific failure: minimal scope kills drift, falsifiable contract kills unverified prose, witness kills "trust my word", external ownership kills the fox-built-the-henhouse, contained verdict kills the propagation of broken code.

in use

Encargo #0: enforce 'NCL config as source of truth' on the failure that opened the interview

avoid

Let the operator author the contract in the same gesture it satisfies it

Epigenetics

Conceptcomes from ADR · adr-089The fast path: contextual modulation of how a cell is expressed, without touching its nucleus — without altering its constitution. It is the counterpart of the slow constitutional path, and the pair is the point — the two speeds are what let a tissue adapt daily while identity and lineage change rarely and with authorship. Everything epigenetic is local and rewritable, and may persist in its tissue; what it does not do is cross the lineage envelope, because a mark is a coordinate in one tissue's expression space and means nothing in the space of another.

avoid

Using the fast path to work around a nucleus that should have been mutated — repeated local overrides for the same reason are evidence the claim is wrong, not that the tissue is special
Making anything epigenetic part of what crosses to another tissue

Gate

Artifactcomes from Schema · ontology/schemas/gate.nclTyped prerequisites and policies controlling FSM state transitions in a project. Lives at `.ontoref/ontology/gate.ncl`. Each dimension declares the conditions a transition must satisfy (catalysts present, blockers cleared); the reflection layer evaluates the gate before allowing a state change.related: on+re

Glossary Extension Pattern

Practicecomes from Axiom · voluntary-adoptionThree-level inheritance for vocabulary: a protocol seed at reflection/defaults/glossary.ncl shipped with ontoref; project terms appended in .ontoref/ontology/glossary.ncl::project_terms via d.seed_terms @ project_terms; optional domain splits in .ontoref/ontology/glossary/.ncl when a project grows past ~30 terms. No merge, no copy of the seed into projects — inheritance through import. Local edits to the protocol seed are forbidden; redefining a protocol id locally is caught by the drift hook. Link local terms to protocol ones via related_terms to weave the lexicon across levels.

in use

Provisioning project adds lifecycle-plane, data-plane, pole-flip in its own .ontoref/ontology/glossary.ncl
Local term that needs to diverge from a protocol concept must use a different id (e.g. provisioning-discipline) and link via related_terms

avoid

Editing reflection/defaults/glossary.ncl in a consumer project — overwritten on next install
Redefining a protocol term id locally — caught by glossary-drift hook as duplicate
Promoting a project-specific term to the protocol seed without ecosystem-wide justification

Graph-Formalized Knowledge

Conceptcomes from Axiom · dag-formalizedProject axiom: all project knowledge — concepts, tensions, decisions, state — is formalized as typed graphs. Where a relation carries order — governance, the level chain, the ladder, a mode's steps — it is acyclic, and a check refuses a cycle. Where a relation carries mutuality — a dependency plane, a symmetric or spiralling relation between nodes — it may cycle (adr-137). Enables transversal queries, impact analysis and ecosystem-level visibility. The 'dao-formalized' spelling that occasionally appears in conversation is folklore for the same axiom.related: on+re

Guide

ConceptFeedforward control in a coding-agent harness: what steers the model BEFORE it writes — architecture docs, convention files, skills. In ontoref a guide is not a file the agent must remember to read: it is what the subject SERVES when queried (`describe`, `qa`, discipline views), so the steering survives the session and the harness swap. A guide you have to remember is not a guide; it is a sign by the road.related: Sensor, HarnessLearn more →

Hard / Soft severity

Conceptcomes from ADR · adr-050The typed severity of an ADR constraint. `'Hard` BINDS — a violation breaks. `'Soft` IS AUDITED — it is reported and does not block. Severity says how much the rule obliges; it does not say whether anyone checks it, and that gap is the whole of the 95-of-212 figure this project keeps about itself. The values are written in English because they name the TYPE's value, not an adjective.

avoid

Translating the value names into an adjective in prose — they name a type's value, not a degree of firmness.

related: SensorLearn more →

Harness

ArtifactThe wrapper that runs the model: context, tools, loop. An agent is model + harness. The harness steers with guides and corrects with sensors. Ontoref is NOT a harness and must never be described as one: it is what a harness QUERIES — the typed, witnessed subject that outlives any one harness and survives the swap to the next.

avoid

Calling ontoref a harness. Both published posts stake the distinction: the harness runs the agent, the subject is what the harness queries.
Naming any ontoref component `*-harness` — a node id, a module, a profile, a CLI verb. The prohibition above is about the claim; this one is about the label, and the label leaks the claim: a reader arriving from the posts parses `X-harness` as the agent wrapper, whichever component it actually names. Found and repaired 2026-07-26, when the node `audit-harness` (the check runner) was renamed `audit-runner` — the term is fixed for the thing that runs the MODEL, and everything ontoref runs is sensors. Citations of the session file .coder/2026-07-05-audit-harness-consolidable.plan.md are exempt: a filename is history, not a name in use.

Harnessability

ConceptA property of a PROJECT, not of its harness: how much any harness can learn about the project BY ASKING, with nobody having explained it first. It is measured by what the project declares and serves, never by how well a particular harness happens to be configured. Coined here (2026-07-23) as the correlate of Böckeler's «ambient affordances», with the axis moved from the environment to the subject: affordances describe an environment a harness FINDS; harnessability describes a subject that DECLARES itself and can generate its own answer.related: Harness, Ambient affordances, SensorLearn more →

Knowledge lineage

Artifactcomes from ADR · adr-080The descent of what a project knows: which outside work a claim came from, reached by a stable address, quoted in bounded literal form with a locator, and backed by custody of the artefact it was read in. It is NOT the list of sources — sources are the artefacts read, and the lineage is the descent, which includes what a reading REFUSED to conclude: the judgements that touched nothing, the anchors measured absent, and what turned out to be the project's own rather than inherited. A project without it mistakes its achievements for gifts, and a gift teaches nothing about how to repeat it.

avoid

Citing without a locator: a quote nobody can check against the artefact is a rented citation, which is the defect the custody split exists to end
Publishing a claim that is not in the source record — the rule generalised from the talk's own «a figure not in this table is not said in the room»
Recording only the productive readings: a mechanism that captures nothing when the verdict is «this touches nothing» reproduces the bias that made the record necessary
Inflating an adoption into a convergence, or the reverse: what was built here before it was read elsewhere is convergence, whatever the other's date

Lineage

Artifactcomes from ADR · adr-089The derivation chain of nuclei: which cell a cell came from, who changed it, when, and what the diff was. Differentiation does not touch it; mutation extends it. Lineage is what makes a cell that has crossed between tissues auditable — without it, moving a cell is not export, it is copy-paste with elegant vocabulary.

avoid

Horizontal transfer without lineage: copying a cell between tissues with no parent reference and no diff
Rewriting lineage to make a history tidier — a lineage that can be edited proves nothing

Linkage state

ConceptThe FSM state a bonded project occupies: None (not bonded), Linked (a dependency bond — inhabits a plane), Node (a governance bond — a governed node in a domain's DAG), or Managed (ontoref governs the project's development). Transitions are `onboard` (climb: None→Linked/Node→Managed), `update` (retype a same-tier bond), and `offboard` (descend: Managed→Node→None). Bonding is orthogonal to management: a project reaches Linked or Node WITHOUT Managed — a bond needs no `.ontoref/` spine.related: Bond, Ontoref node, Ontoref plane

Making a differenceDRAFT

PracticeThe validity criterion for a cell: it is alive if and only if its verdict can alter at least one decision in at least one circuit. Cell-scale projection of adr-070 ("existing is not participating") and adr-072 (a check that could not look): those two diagnose non-participation after the fact and per surface, while this makes it a standing property of the predicate itself. The consequence is structural rather than syntactic — a no-op predicate never changes an outcome, so it appears in the inert census by its own uselessness, instead of having to be caught by an audit that goes looking for it.

avoid

An operation-born signal may PROPOSE a tension; it may NEVER declare one. Detecting a repeated pattern is mechanical, naming it as a tension is a decision, and a harness that declares its own tensions is drift. The harness proposes, the human ratifies
Calling a predicate a cell when no circuit consumes its verdict
Answering the census with a cell that always returns 'pass because nothing it looks at can vary

related: Cell, Membrane, Apoptosis, Gate, Ondaod

Membrane

Conceptcomes from Schema · ontology/gate.nclA permeability boundary at any level: it decides what crosses and under what condition. Cell-scale projection of `gate` — same concept, different scale, and deliberately a different id rather than a redefinition. This term closes a gap that was measurable: `membrane` has been a field in `ontology/gate.ncl` while no entry in the term registry defined it, so the word bound nothing at its point of use. Today a membrane's `opening_condition` can only count tension dimensions and read prose; it cannot open on the state of a running system, because there is nothing referenceable to compose such a condition from. That is what a cell supplies.

avoid

Redefining `gate` under a biological name instead of linking to it via related_terms
Writing an opening_condition as English prose when the state it describes could be composed from cells — that is the shape this vocabulary exists to end

related: Gate, Cell, Tissue, Making a difference

Nonduality (relation class)

Conceptcomes from Schema · ontology/schemas/core.ncl::edge_typeRelation class of the `SpiralsWith` edge kind: difference that is not separation. The endpoints do not decompose into independent things, typically because one of them is the seam where the other two meet. Nonduality does NOT mean the difference is false or that the endpoints are one thing — that would be a stronger and different claim. It means only that the distinction, which is real and useful, does not imply two independent realities. The taijitu is the picture: it does not erase black and white to make grey.

in use

`witness-as-axis-seam` ('Spiral) SpiralsWith BOTH `ontology-axis-substance` and `reflection-axis-act`: the witness is neither pure substance nor pure act, it is the point at which the two are bound (ADR-031)

avoid

Deriving the class from the endpoints' poles. All 11 SpiralsWith edges in core.ncl are incident to a 'Spiral node, which reads as a rule and is not one — 21 Complements edges are too. A check over the pole pair would be a lexical proxy for a judgement (`derived-criterion-enforced-as-given`, ondaod) and a 'Hard check over a named tension (ADR-050).
Reading it as «everything is one» or «the differences are false» — a metaphysical claim the class does not make and the graph could not carry.

Nucleus

Artifactcomes from ADR · adr-088The `.ncl` of a cell: claim, evaluation and interface, plus the identity and lineage that make it the same cell across tissues. It is constitutional and slow — changing it IS a mutation, and a mutation carries author, date and parent. It is also stateless by construction: it declares what it needs in order to answer, never what it has seen. The slowness is the guarantee, not friction: a nucleus that changes weekly has no identity, and its lineage means nothing.

avoid

"Let it evolve": a nucleus changed without author, date and parent is drift, not evolution. Differentiation is free; mutation is authored
Putting state of any kind in the nucleus — participation memory, last verdict, last run

Ondaod

Disciplinecomes from Tension · ontology-vs-reflectionOntoref Dao Discipline. Before architectural analysis or ADR drafting, read the named tensions in core.ncl, identify which the question engages, and describe the synthesis state and direction of motion — do not collapse the Spiral by picking one pole. Two-layer canonical content via the installed CLI: `ontoref qa show ontoref-dao-discipline --format json` for the protocol baseline, and `ontoref qa show -dao-discipline --format json` for project-specific extensions.

in use

Required by adr? criterion 5 in any ontoref-onboarded project
`ontoref qa show ontoref-dao-discipline --format json` returns the procedure

avoid

Pick one pole as 'the answer'
Skip reading the named tensions

Ontoref node

ConceptA project seen along the GOVERNANCE axis of a bond: a governed member of a domain's graph. The governance axis is a DAG (acyclic, hierarchical): a domain (level N) governs its instances/implementations (level N+1) with Delegate / Override / Compose semantics (ADR-018, ADR-045). Being a node states who governs and is governed — not who depends on whom (that is the ontoref-plane). Hexagonal reflection: a domain exposes ports (a catalog `provides`) that a node's implementations adapt.related: Bond, Ontoref plane, Domain (specialization surface, activated by repo_kind or by bond)

Ontoref plane

ConceptThe coexistence surface a project inhabits along the DEPENDENCY axis of a bond. Unlike the governance DAG, the dependency graph permits cycles: a `mutual` bond (DDD Partnership — "no deploy without service, no service without deploy") is a 2-cycle that CONSTITUTES a plane, where neither node governs the other yet each requires the other to exist. The constitutive, mutual case is where the value lives (plane-habitability); a one-way dependency (CustomerSupplier) is a degenerate plane.related: Bond, Ontoref node

Opposition (relation class)

Conceptcomes from Schema · ontology/schemas/core.ncl::edge_typeRelation class of the `Contradicts` edge kind: A and not-A held together, unresolved. The relation IS the friction, and recording it does not discharge it — an Opposition edge is a standing report that two declared things do not both fit, kept visible instead of arbitrated. Distinguish from Polarity: the poles of an Opposition do not define each other and neither turns into the other; they simply collide.

in use

`protocol-not-runtime` Contradicts `ontoref-daemon` (weight Low): the invariant says never a runtime dependency, and the project ships a daemon — held, not argued away

avoid

Deriving the class from the endpoints' poles. Same-pole is the shape this class happens to take in ontoref's corpus (1 of 1 edges); it is not the criterion, and a check over the pole pair would be a lexical proxy for a judgement (`derived-criterion-enforced-as-given`, ondaod).
Reading an Opposition edge as a defect to be closed — an unresolved contradiction that is DECLARED is a report; the same contradiction undeclared is the drift.

PAP

Conceptcomes from Axiom · self-describingProject's Architecture Principles. The active set of invariants, patterns and rules that define how a specific project is built — drawn from its axioms, accepted ADRs and named practices. Saying something is anti-PAP means it is completely against the project's established architecture.related: anti-PAP, adr?

Polarity (relation class)

Conceptcomes from Schema · ontology/schemas/core.ncl::edge_typeRelation class of the `TensionWith` edge kind: correlative poles. Each endpoint is defined by reference to the other, and a process can turn one into the other. This is the Yin/Yang relation proper — not two enemies and not two halves of a whole, but two readings that only exist as a pair. A Polarity edge is the machine-readable form of what ondaod calls a named tension, which is why collapsing one by picking a pole is the forbidden move (see pole-collapse).

in use

`ontology-axis-substance` ('Yin) TensionWith `reflection-axis-act` ('Yang): substance and act, neither readable without the other (ADR-031)

avoid

Deriving the class from the endpoints' poles. A Yin↔Yang pair is the shape a Polarity usually takes, not the criterion that makes it one; a check over the pole pair would be a lexical proxy for a judgement (`derived-criterion-enforced-as-given`, ondaod).
A 'Hard constraint over a Polarity edge — it collapses the Spiral to the check author's preferred pole (ADR-050). Soft constraints report direction of motion.

Projection (constellation member)

Conceptcomes from ADR · adr-062In the constellation member taxonomy (ADR-062), a member category: one source whose frontier lives INSIDE the build, never its own git repo. A Projection is materialised into each surface that needs it (e.g. assets, examples, docs), synced not cloned — the repo driver is a publication boundary, and a Projection has none of its own. Contrast Primary (owns a boundary → own repo) and Addon (declared edge to a Primary).

in use

assets/ is a Projection(copy): canonical brand source materialised into each sub-repo

avoid

Do NOT confuse with projection-positioning (the reveal of the positioning surface onto the site) — that is a rendering step, not a member category

Projection (positioning reveal)

Conceptcomes from ADR · adr-057In the reveal architecture (ADR-057), the act of PROJECTING the positioning graph (spine.ncl + generator) onto the outward site: doors generated from a structured contract, a drift fixed by re-running the projection, never by hand-editing the served copy. "The window becomes a projection of a described state, not a construction site." A rendering discipline, not a member category.

in use

The four doors are a projection-positioning of spine.ncl; editing the served copy is forbidden

avoid

Do NOT confuse with projection-member (ADR-062 taxonomy category, one-source-no-repo) — same word, different axis

Rung

Conceptcomes from Schema · reflection/schemas/ladder.nclOne link of the ladder: a claim about what must hold for a project's reason for being to stay CHECKABLE rather than merely remembered. A rung carries the ontology nodes that already hold it, the verbs that answer it, the necessary conditions a machine can check — and, required and non-empty, what it asks that no check can answer. Rungs are a chain, not a set: each one is the condition of the next, and you can only step on one if the one below holds.

avoid

Reading a rung's passing checks as a holding rung: they are necessary conditions — failure is decisive, success is not
Writing a rung with an empty `judgement` to obtain a fully mechanical ladder — that is the lexical proxy for a judgement the schema exists to refuse
Calling a rung a step, a level or a tier: all three are taken (a mode's steps, a node's `level` and adr-018's hierarchy, the adoption tiers)

Sensor

ConceptFeedback control in a coding-agent harness: the check that fires AFTER the model generates, correcting what a guide could not prevent. Böckeler splits sensors into COMPUTATIONAL (deterministic, cheap, milliseconds — linters, tests, structural checks) and INFERENTIAL (an LLM judging semantics: richer, slower, probabilistic). Ontoref adopts the term whole and adds one axis the canon does not carry: a sensor DECLARES WHAT IT LOOKED AT, and its verdict is witnessed. A green check that declares no scope is not a sensor — it is a harness lying by omission. Severity is typed, not chosen: `Hard` is legal only where the question is binary; a sensor watching a named tension may report drift and direction, never failure (ADR-050).

avoid

A sensor whose verdict declares no scope — coverage unstated is coverage unproven.
`Hard` severity on a named tension: it collapses the Spiral to the check author's preferred pole (ADR-050).
A gate declaring more coverage than it has (`coverage-superset-of-extent`, ADR-072).

Spiral

Conceptcomes from Tension · ontology-vs-reflectionResolution mode of a Yin/Yang tension where neither pole wins and the system oscillates between them with synthesis emerging from the motion itself. In core.ncl, nodes carry `pole = 'Spiral` when they ARE the tension rather than a position within it. Spirals do not collapse — collapsing one is an antipattern (see pole-collapse).

in use

The ADR review (G→H) is the ondaod moment: stay in Spiral, do not flip to Yin/scripted

Statement of Work (SOW)

Artifactcomes from ADR · adr-066The terms layer of an Encargo: scope (minimal context + one-sentence objective), a falsifiable contract (a machine check, schema or constraint), and the validation mode ('Machine | 'Adversarial, signed or not). Owned by the human, outside the agent's editable surface — this ownership boundary is what resolves the fox-and-henhouse. It is the same document from draft to signed: the signature ratifies it and does not turn it into anything else. One SOW authorizes many runs. A signed SOW is stored as `/.governance/wo-.ncl`, beside its `.minisig`.

in use

SOW-0: contract = a check that fails on any runtime flag absent from the NCL schema

avoid

A non-machine-checkable contract ('design the auth') — that is prose again; use 'Adversarial instead

Synthesis

ConceptResolution of a Spiral tension by giving each pole its own plane of operation instead of choosing one. Both poles remain active, applied to different aspects. Synthesis is the productive answer to a Spiral; collapse is the regressive one.

in use

Lifecycle plane stays centralized; data plane leaves Cilium — both poles kept, separated by plane

related: Spiral, Yin/Yang Collapse, Ondaod

Tissue

Conceptcomes from ADR · adr-088The context that differentiates cells, holds their participation memory and specialises them. It is local and does not cross: the same cell is a sensor in one tissue and a policy in another, because role is an axis of expression the tissue assigns, not a property of the cell. The tissue is also what knows when it last asked — cadence lives here. In the protocol's level hierarchy the tissue is the Level-3 instance, and the split between what converges at the domain (declarations) and what diverges per instance (execution, memory, cadence) is the one adr-030 mechanism #6 already drew.

avoid

A single converged tissue serving every instance — adr-030 states the reasons it is refused: shared failure domain, forced release cadence, and every instance's signing keys in one process
Treating tissue memory as exportable: it means nothing in another tissue, which is why the nucleus and not the tissue is what crosses
Letting tissue memory grow into a metrics store — it holds the last N verdicts and transitions, not a time series

Verified witness

Artifactcomes from ADR · adr-050A content-addressed, Ed25519-signed receipt of an act, deposited at the witness-as-axis seam. It proves *that* a check ran and what it returned — structure, never truthfulness (ADR-050). Necessary but not sufficient as a gate: a witness is post-hoc evidence that X happened, not a barrier that forbids not-X. It becomes a gate only when a control point refuses to proceed without a valid witness (e.g. a commit rejected unless it carries a signed witness that the pre-flight occurred). It is the receipt a run deposits when it completes.

in use

A run writes a JSONL witness carrying the check's real exit code, not a claim

avoid

Treat a witness as a gate by itself — it records, it does not refuse

Yin/Yang Collapse

AntipatternAntipattern in which a Spiral tension is forcibly resolved by adopting one pole as 'the answer' and dropping the other. Usually appears as a flip: Yang → Yin (e.g. all-centralized to all-scripted) or vice versa, when the correct move is synthesis — keeping each pole in its proper plane.

in use

First draft was full systemd (Yang→Yin collapse); the objection forced synthesis

avoid

Treat collapse as 'finally getting clarity' — it is loss of dimensionality

related: Spiral, Synthesis, Ondaod

adr?

Procedurecomes from Practice · adr-lifecycleEvaluation procedure invoked at the end of a session or feature. Five criteria must all hold to justify an ADR: (1) a meaningful alternative was consciously rejected; (2) lasting constraints for future contributors; (3) reversal needs coordinated multi-component effort; (4) not already captured in an existing ADR; (5) ondaod — engaged tensions identified and synthesis state described. Verdict and rationale are stated concisely; no artifact is created without confirmation.

avoid

Create an ADR file without user confirmation
Skip criterion 5 (ondaod) in ontoref-onboarded projects

related: Ondaod, PAP

anti-PAP

AntipatternApproach that violates the project's PAP outright. Not 'slightly off' or 'in tension with' — a proposal called anti-PAP is rejected at design time, before implementation.related: PAP

foedusDRAFT

ConceptThe federated agreement the parties of signature governance bind to: its conditions, its violations, its change procedure and one annex per party, stating what that party answers for and what it does not; and its tests at three levels — unit checks, contract vectors, integration walks. A version is named by its digest; endorsements are opinions over that digest. Data written in ontoref's protocol, provided by the foedus project and operated by warden. A project is in signature governance because it is a party to it. It is one part of governance, not the whole: a project can bond, and be governed by coherence alone, without it. ontoref is not a party: it brings its own agreements, not signature or audit ones.related: warden, mandatum, governance mode, Bond

gov (the root, not one of its three words)

Conceptcomes from ADR · adr-102`gov` is the id, the CLI alias and the host root of ontoref's self-domain (code/domains/gov/). It is the ROOT the three governance words share and abbreviates NONE of them — English has all three, with three referents, declared one per row in `referents`: governance, governability, government. The domain carries the arrangement AND the exercise, so electing any one word would be a pole-collapse on a question with three referents. HOMOGRAPH, declared rather than inherited: `ontoref governs ` is a different act — it derives which constraints govern a route. Dispatch compares argv[1] exactly, so `governs` ≠ `gov` and nothing collides mechanically; with `gov` read as the shared root the two are the same trunk, which is coherence rather than collision.

Word	What it names	Reach
governance gobernanza	the ARRANGEMENT	boundaries, members, what is published (the domain's four ADRs)
governability gobernabilidad	the CAPACITY	whether a subject admits government at all; a property of the PROTOCOL, not of this domain
government gobierno	the EXERCISE and the organ	the domain's seven modes: release, governed-delivery, ordinary-act, create-pr…

in use

ontoref gov scope --lens Base
gov.ontoref.dev (host root; its own ADR)

avoid

Do NOT expand `gov` into one of the three words in a title, nav label or page copy — «gov (governance)» re-elects the pole the id refuses (adr-102 anti-pattern gov-read-as-an-abbreviation)
Do NOT read `gov` as short for `government` — .gov and gov.uk carry that sense and it is the word furthest from the arrangement
Do NOT confuse `ontoref gov` (the domain) with `ontoref governs` (derives constraints over a path)

governance modeDRAFT

ConceptThe level of governance a project chooses for itself, one of three. Governability: coherence only, with ontoref alone and no signature. Auditable governance: the person's signature, which detects a departure and does not prevent it. Applied governance: signature plus isolation, which prevents it. Bonds are protocol, so a project can bond under any mode. Each project declares its own; where it has not, it reads "not declared". Not the protocol's `Mode` (Local, SingleServer, MultiHost), which is a deployment topology; and the first mode is not the governability that `gov` names as one of its three words, the capacity to admit government at all.related: gov (the root, not one of its three words), foedus, Bond

mandatumDRAFT

Conceptcomes from Schema · code/ontology/schemas/mandatum.nclThe protocol's types for a signed core — the skeleton with its issuers, events, the signed head, signed time and grants — and the library a reader links to verify them in its own process. Protocol, not a governance's: a reader that adopts no governance verifies them too. The skeleton names no governance and no issuer; whoever holds the issuing keys is not protocol. A mechanism, not a member: warden holds a core, it is not the mandatum.related: warden, foedus, governance mode

on+re

Practicecomes from Axiom · self-describingShorthand for the Ontoref dual layer: ontology (`.ontoref/ontology/`: core.ncl, state.ncl, gate.ncl, manifest.ncl — what IS) + reflection (`.ontoref/reflection/`: modes, backlog, constraints, qa — what BECOMES). Both live under the single hidden root `.ontoref/` (ADR-032, propagated by migration 0023 — the flat `.ontology/` at the project root is the PRE-0023 layout and no longer exists). Every onboarded project instance carries both. A project may host multiple on+re instances at different paths. The `ontology` half is the project's OWN declared subject — the map of one subject, checkable against that one project. It is NOT an ontology in the ontology-engineering sense: a conceptualization negotiated and shared across communities so that independent systems interoperate. Ontoref makes ONE subject falsifiable; it does not negotiate a common vocabulary between organizations, and a project's ontology binds nobody outside it. Where two subjects must relate, the protocol verifies a slice of the other's declaration without adopting it (ADR-028, witness-not-clone) instead of converging both on a shared model.

in use

`rustelo/` and `website/website-impl/` are two separate on+re instances

avoid

Reading a project's ontology as a conceptualization shared between organizations — it is one project's declared subject and binds nobody outside it.
Offering ontoref as an answer to semantic interoperability between organizations: the protocol makes ONE subject falsifiable; agreement BETWEEN subjects is not something it produces.

onre

ArtifactShell alias for the `ontoref` CLI. Not a separate binary — invoked as `onre `, equivalent to `ontoref `. `onre` (on+re) replaced the former `ore` alias. Used in documentation and conversation as the operator-facing name.

in use

`ontoref describe project`
`ontoref describe constraints`
`ontoref sync assets check`

related: on+re

ontoref

Conceptcomes from Axiom · self-describingThe protocol itself: a typed, queryable surface on which a project declares WHAT IT IS (ontology) and HOW IT ACTS (reflection), so a claim about the project can be contradicted by a machine and not only by a reader. Its dual layer is `on+re`; the two are NOT synonyms. `ontoref` is the protocol, the tool and the name; `on+re` is the ontology+reflection pair each instance carries. Outward-facing prose says `ontoref`; `on+re` appears only when the DUAL LAYER is what is under discussion, glossed on first use.

avoid

Using `on+re` unglossed in outward-facing prose — it is an internal abbreviation and a cold reader cannot expand it.
Treating `ontoref` and `on+re` as interchangeable: the first is the protocol, the second is the layer pair.

reflection

Conceptcomes from ADR · adr-031The act axis of on+re, and one movement in two directions. Outward: what the project knows is executed — a mode, a step, a verifier — and leaves a trace of having run (the ladder's second rung). Back: what the runs leave behind proposes changes to what the project knows — state, backlog, proof candidates — and only proposes: a person accepts them, and nothing rewrites the knowledge's authority on its own (adr-051, adr-052). Not introspection and not a workflow engine: the two directions are one loop.related: on+re, RungLearn more →

run

Artifactcomes from ADR · adr-123The execution layer of an Encargo, under one SOW: disposable, contained, owned by the agent. Carries the deliverable, an observability envelope (workdir, Rust-style log level, JSONL output, start/end timestamps), the verified witness, and a contained verdict ('Accepted | 'Rejected | 'Escalated). A failure dies inside the run rather than contaminating the session. Opened with `ontoref run start`, read with `ontoref run status`.

in use

Red-team of SOW-0: run A rejects real code 12/12, run B accepts a clean fixture, run C catches only the rogue flag

avoid

Let the run rewrite the SOW that invoked it

wardenDRAFT

ConceptThe operating centre of signature governance, and the only piece that signs on an agent's behalf — only inside a core the owner signed, with one key per project and author, after checking the core's head, the window and the paths. It holds the core and its chain and answers a party's section and the core's head; a head it cannot vouch for reads unknown, never current. It is never the judge: readers decide with mandatum, in their own process. It never signs a person's act and holds no person's key.related: mandatum, foedus

warrant

ConceptThe evidence on whose authority something is admitted — a term into a vocabulary, a node into the graph, a result into the verifiable set. Borrowed from ANSI/NISO Z39.19, which admits a term on three distinct grounds that routinely conflict and must be reconciled deliberately: LITERARY warrant (the corpus being described), USER warrant (what the people and machines searching actually say) and ORGANIZATIONAL warrant (what the institution approves). In ontoref the concept has TWO FACES, one per axis, and they are the same question at two strengths of verification: DECLARED warrant, on the ontology axis — `origin = { kind, ref }` on a term, `warrant : Array WarrantRef` on a node ('Adr 'Emergence 'Interview 'Session 'External). It answers «on whose authority does this DECLARATION exist?». Checkable only by trusting the record, audited Soft and never Hard, because a required warrant is ceremony-capture (adr-029). ATTESTED warrant, on the reflection axis — the signed witness. It answers «on whose authority does this RESULT exist?» and answers it with an exit code: any third party can check it without trusting the declarer. `witness-as-axis-seam` is where the two meet, and the asymmetry between them is the term's whole content: the declared face is asserted, the attested face is accredited. Do not read one as a weaker spelling of the other — they govern different objects (declarations vs acts) and no amount of typing turns the first into the second.

in use

A glossary term whose `origin.kind` is 'External with an empty `ref` claims literary warrant and cites no corpus — 11 of 35 terms did on 2026-08-06.
This very entry: its warrant is the corpus it names, and it is the first term in the glossary to cite a real one.
A signed sensor verdict is attested warrant for the act of verifying. A harness GUIDE asserts what should hold and carries no warrant at all — that remainder is bl-044.

avoid

Reading `warrant` as a guarantee about the future. It is evidence about the past — the grounds on which something was already admitted.
Making the declared face Hard. A required warrant produces fields filled in to pass a gate, which is worse than an honest default because the lie then typechecks.
Calling a typed warrant «accredited». Accredited means signed and checkable (sufficient-verification); a declared warrant is asserted.

related: Gate, SensorLearn more →