The vocabulary

A re-checkable artifact produced by reasoning (logos): an answer paired with the derivation that earns it.

The organizing judgment of the substrate — admissible(actor, verb, operand, evidence), true when a protected substrate action may be admitted at a gate with an account any party can re-check (a fact entering the record is one specialization). The substrate's theories are its independent premises.

The integration / realization runtime over the substrate (ADR 0029) — the layer that *does* what the record only *describes* (resolve → judge → enforce → mediate), realized by kosmos as a custodial fluency lens that holds clients' keys and runs the proof/signing machinery so clients hold nothing. It is not a tier of off-record referents: the surfaces a runtime brokers — content, state, flow, i.e. what the immutable-small-fact substrate cannot *be* (bulk, mutable, moving) — are realized by generic providers / connected services that register as downstream, none named by the model (corpus is the worked content provider; state/flow are unbuilt candidates). Providers are ordinary untrusted occupants; their bindings stay re-checkable under an identity discipline (e.g. content-addressing). The layer "adstrate" value (ADR 0018, re-pointed by 0029) marks the runtime; the Greek/Latin naming line is under review (kosmos is Greek yet is the adstrate, ADR 0029 §8). Access and storage are space-governed (ADR 0021/0022): the payload is stored within and owned by its space — keyed on (space, identity), reached only through its space-scoped binding fact and resolved by projection, never a bare-identity path. The bare identity (hash) names what the payload is; (space, identity) is the capability to reach it and the unit it is accounted to — every object is owned by exactly one space, so the space's read/write ACL is the content's ACL and quota/billing/lifecycle are per-space. This is what makes adstrate content delegable, federable, and billable like everything else. Writes go through the same fact interface (ADR 0024): a write is two facts by two parties — the caller asserts the binding (content; provenance + authority, self-proved to the record), the occupant asserts custody (stored; only the holder can) — and the byte upload itself needs no separate authorization, since binding-existence is the authority proof and content-addressing the integrity proof, so occupants stay untrusted for writes too (and stored doubles as the served-by routing signal).

A signed fact admitted to the record (stele).

Candidate theory. What an entity affords and requires — provides / requires / operation — the integration surface that lets an unknown future participant bind to it. Irreducible over horos and thesmos while referencing both. Placeholder name: dynamis.

A system that consumes the family without being in the substance stack — an application or product on top. A first-class layer value that drives a real invariant (substance must never depend on downstream). Which systems are downstream lives in the registry/topology, not here.

A system with a name and a mark whose place in the stack is not yet ratified (draft: true in constellation.json). It is the sanctioned way to register a not-yet-ratified system without faking its edges; a draft member is held out of the ratified substance roster until its edges land, then graduates. Which members are currently draft lives in the registry/topology, not here.

The substrate's central goal — a participant written later can discover, understand, authorize, and compose with one written earlier, through substrate-visible evidence rather than private integration, central registries, or ambient trust.

A plain-named repo that cuts across the stack rather than sitting in it — design (surface) and atlas (structure).

A protected effect surface, uniform across spaces and not composable from existing primitives — facts, CAS, cell, wire. A vault is not primitive (ciphertext in CAS + metadata in facts); cell and wire are.

A concrete contract for a surface: operations, DTOs, an authority mapping, conformance vectors.

Candidate theory. How an immutable declaration becomes a running or produced effect, over declaration -> artifact -> desired state -> effect -> observation. The irreducible semantic behind 'artifact'/'program'; the theory checks claims around running, it does not run. Placeholder name: energeia.

The substrate invariant — finding evidence is untrusted search (expensive, heuristic, even LLM-assisted); verifying it is trusted check (small, deterministic, portable). admissible is always a check; stele admission already runs it.

The placement axis of the substrate — an ordered path of segments at which facts (and every substrate primitive) are addressed. Scope is carried by placement: authority and visibility project downward through the tree (parent covers child, siblings are isolated), and the space is erased from the logic above the line — real in storage, ordering, and visibility; absent from the policy program. One global root makes the tree one logical truth: authority is logically central but operationally no central operator (stele is the memory; the thesmos law over re-checkable proofs decides), and federation is subtree delegation, not root-to-root mapping (ADR 0028).

The Greek-named systems that build on one another (five today), floor to top: ontos → logos → horos → thesmos → stele.

A checkable family of judgments the whole family relies on across implementations (thesmos gives authorized; horos gives v : T). Distinct from a primitive, a vocabulary, and a profile. Required + irreducible are the two tests for theory-hood; the inquiry into which theories must exist lives in atlas/theory/.

The one sanctioned filled shape in a system's mark — its model's anchor. (Defined fully in design.)

All the Bitspark repos together — the substance stack, downstream consumers, and the orthogonal infrastructure (design, atlas).

Predicates and descriptors a population agrees to use — the cheapest tier, where most concepts start and should stay.