Glossary

Where state lives. A cell holds balances, a capability list, and named slots — plus a program: a predicate over its own transitions that the substrate enforces on every change. Every cell has an owner; nothing is ownerless. A cell changes only under its own program, only by an authorized actor, and a turn touching one cell leaves every other cell untouched (the frame rule).

deep dive: rung 2 · cells & substances · touch one: explorer

The unit of action: an atomic batch of effects, each presenting a capability and discharging every guard in scope, committed whole or not at all. The defining sentence of the protocol: a turn is the exercise of an attenuable, proof-carrying token over owned state, leaving a verifiable receipt.

deep dive: rung 1 · the turn · touch one: playground

A token of authority: it names a target cell, the rights it licenses, the caveats that narrow it, an expiry, and a revocation epoch. Holding one means being able to exhibit a witness at the point of use — authority is shown, never claimed, and there is no global who-may-do-what registry to consult. A holder can always make a strictly weaker token (attenuation) but never a stronger one.

deep dive: rung 1 · the token · touch one: explorer

One of the eight operations in the kernel signature — each the structural rule of one substance's discipline (value moves, authority derives, evidence accrues, state steps…). Minimality is a theorem: remove any verb and something expressible becomes inexpressible. Everything that looks like a richer operation is a composition of verbs minted by a factory.

deep dive: rung 2 · the eight verbs · the roster: ontology catalog

A predicate that must hold for an action to be admitted. One shared algebra serves four roles: caveats riding a capability, the cell's own program constraints, preconditions a turn declares, and intents. The executor checks every guard in scope on the commit path; a failing guard rejects the whole turn.

deep dive: rung 3 · guards · compose one: studio predicate browser

The evidence a committed turn leaves behind: a commitment binding the entire post-state, with no field a tamperer can edit. Receipts chain into a history; verifying the chain re-establishes that every transition was admissible, without re-running anything. The explorer's time travel is just reading receipts.

deep dive: rung 4 · receipts & Q · touch one: explorer

The receipt judgment itself — the commitment a turn produces over its whole post-state. Q is what makes a receipt more than a log line: it is the object proofs fold over, so one aggregate root attests every turn that ever happened, correctly ordered. When the docs say "the proof commits to it," Q is the commitment.

deep dive: rung 4 · receipts & Q · whole histories: rung 5 · the light client

A published descriptor — a slot layout plus guard constraints — from which cells are minted. Every cell born from a factory carries the descriptor's rules in the executor itself: an escrow that cannot release early, a ballot that cannot be voted twice, a budget that cannot exceed its ceiling. Apps add no enforcement code; they mint cells and consume receipts.

deep dive: rung 6 · userspace · mint one: studio factory composer

The civic layer built from factories: content-addressed constitutions, councils whose membership and thresholds are cell state, and mandates — bounded grants of authority that die when revoked. None of it is a privileged subsystem; a council is a cell program like any other, which is exactly why its rules hold.

deep dive: rung 6 · userspace & the polis · touch one: explorer · polis

The live federation this site's surfaces connect to — running the same node you can build from the repo, seeded with one of each worked example at genesis. The explorer browses it; the studio submits to it; nothing on this site shows fabricated data in its place (offline surfaces say so, loudly).

touch it: explorer · run your own: running a node