OctoView LabsVocabulary
The words we use, defined the way we use them. A system that wants to be audited should not make its auditors guess what its words mean.
Ledger
The single append-only record of everything that happened: every action, claim, approval, refusal and verdict. Hash-chained so alteration is detectable. Every dashboard and report is derived from it and can be rebuilt from it. If a thing is not in the ledger, the system does not know it.
Intent
The unit of governed work: a plain-language statement of what is being attempted, why, and what it may touch. Work is registered as an intent before it starts; an intent moves through phases (registered, design, build, verify, release) and may decompose into governed children.
Blast radius
The parts of the system an intent declares it will touch, stated up front and enforced as a lock. Two intents with overlapping blast radius serialize rather than collide.
Gate
A point where work stops until a decision is made. Operator gates require a named human's signed decision and present a short plain-language brief. Mechanical gates check evidence at a boundary and need no one's attention unless they refuse.
Policy act vs. fact
The central distinction. A fact is a record of what happened; machines sign facts. A policy act changes what is allowed: approving a design, widening a scope, overriding a limit. Only named humans sign policy acts, and each one is a durable record.
Verdict
The result of independent verification. "Done" in Topos is a verdict issued by something other than the author of the work, never a claim by the author. Prose without evidence does not count.
Refusal
What happens to a claim that cannot prove what it asserts: it is turned away at the boundary before entering the record, and the refusal itself is preserved. Refusals are the immune system working, which is why we publish their counts instead of hiding them.
Canary
A planted, known violation used to prove an enforcement mechanism can actually fire. A gate that has never caught its canary is treated as theater, not protection.
Constitution lock
The rule that agents cannot edit the rules. Gates, validators and enforcement configuration can only change with a named human's signed approval, checked mechanically at the door.
Arming date
The honest way to ship machinery switched off. Anything deliberately disabled carries a signed expiry date; when the date passes, the build fails until a human either arms the machinery or signs a new date. Deferring is allowed. Silent deferring is not.
Provenance
The ability to answer, with records a third party will accept: who authorised this, what verified it, and what evidence exists. Not a log. Logs describe; provenance testifies.
Operator
The named human who holds signature authority over a deployment. The system is built so this authority cannot drain away silently into agents, processes or defaults.
Substrate
What Topos is: the layer under the agents, the way an operating system sits under programs. Agents are the processes; the ledger is the record; human signatures are the permission layer. Domain skillsets plug in on top; the substrate itself stays domain-blind.