Glossary

How to use this glossary

Canonical naming rules

ContextOS

The portable decision-control, evidence, and conformance specification for AI-agent systems. This repository publishes versioned contracts, a deterministic compiler, execution validators and synthetic reference workflows. Implementing runtimes supply production enforcement and evidence. “Open contract” describes the published interface; reuse rights remain governed by the repository license.

Five planes

Intelligence plane

The substrate of meaning: ontology, identity, knowledge graph, retrieval, memory, embeddings, and evidence provenance. It answers: “What does this entity, fact, relationship, or memory mean?”

Context plane

The compiler layer. It turns a pinned ContextPack, RunContext, evidence, policy, tools, memory, and budget into a CompiledContext. It answers: “What exactly did the model see, and what controls were active?”

Decision plane

The bounded loop: Planner proposes, Critic verifies, Executor runs approved steps, Critic scores, Consolidation emits follow-up artifacts. It answers: “What should happen next, and is the result acceptable?”

Action plane

The external-effect boundary. Every tool call crosses the Tool Gateway with policy, identity, schema validation, native action risk, v1 compatibility, approval state, idempotency, effect evidence, and trace identity. It answers: “What touched the outside world, under which authority?”

Trust plane

The governance layer over the other four: policy, approvals, identity propagation, evaluator gates, observability, replay, incident response, and improvement promotion. It answers: “Why was this allowed, how was it measured, and how can it be replayed?”

Runtime contracts

RunContext

Per-run envelope carried through every plane. Contains run_id, trace_id, session_id, tenant_id, user delegation, agent workload identity, intent, locale, safety_mode, run_budget, and metadata.

Use it when describing execution identity and limits. Do not call it “session state”; sessions are only one scope inside it.

RunBudget

Deterministic limits for one run: total tokens, bucket tokens, max tool calls, max replan attempts, wall-clock limit, cost limit, and atomic usage counters.

Use it when discussing loop guards, context pressure, cost controls, or subagent isolation.

ApprovalMode

Five-value v1 compatibility classification bound to adapter capabilities, policy decisions, and decisions. It is not a complete risk model or a universal total order.

Tools declare the highest mode they can produce. RunContext.safety_mode filters tools above the run’s allowed mode. Policy may constrain execution; it must not silently weaken risk.

ActionRisk

Native 2026 action-risk vector with five independent dimensions: effect boundary, authority basis, reversibility, interaction boundary, and data scope, plus an optional decision TTL. Policy evaluates each dimension rather than collapsing them into a score. The v1 ToolCallEnvelope may carry requested and effective vectors while retaining required compatibility-mode fields; making the vector mandatory requires a future versioned envelope.

ContextPack

Versioned, immutable-after-publication input contract for the Context plane. It declares intelligence refs, business constraints, policy, tools, decisions, memory rules, evaluator targets, and communication constraints. Signing is a deployment profile, not a required field in the current canonical type.

Use ContextPack for the runtime type and “Context Pack” in prose. See Context Pack.

CompiledContext

Compiler output consumed by the Decision plane. Contains compiled_prompt, manifests, runtime_controls, budget_report, and context_ledger.

Use it instead of “the prompt” when referring to the full runtime artifact.

Plan

Typed proposal from the Planner: ordered steps, dependencies, tool intents, approval requirements, and decision checkpoints.

A Plan cannot execute anything by itself.

ToolEnvelope

The ToolCallEnvelope and ToolResultEnvelope pair crossing the Tool Gateway. The call carries capability, arguments, principal chain, v1 modes, optional native-risk vectors, policy linkage, evidence refs, idempotency, auth reference, and trace identity. The result carries status, output, errors, artifacts, citations, mutations, risk tags, policy linkage, metadata, and latency.

Use it instead of “tool call” when the governance boundary matters.

DecisionSpec

Versioned contract for one decision type. Declares decision_key, required_evidence, allowed_outcomes, approval_mode, eligibility rules, input schema, output schema, and decision right.

See Decision Catalog.

DecisionRecord

Emitted, durable decision artifact. Contains outcome, evidence refs, policy decisions, approvals, active controls, budget usage, trace ID, and replay pointer.

Do not call it a log line. It is the audit and replay artifact.

Replay packet

Pinned set of artifacts needed to re-derive a run: request, ContextPack, graph snapshot, policy bundle, model config, tool transcripts, evaluator set, and expected verdict.

Replay should not require live tool execution.

Execution profiles and evidence

The Execution Contract, Control Profiles and Conformance define these versioned attachments without changing the existing v1 envelopes or ContextPack v2 layout.

Context plane terms

Context Pack Compiler

Deterministic pipeline that transforms a ContextPack and RunContext into a CompiledContext.

Canonical stages:

1. Intent classification.
2. Policy resolution.
3. Tool surfacing.
4. Evidence normalization: verify hashes and label source, integrity, freshness, and coverage.
5. Promoted-memory recall with source lineage and freshness.
6. Token budget allocation.
7. Context admission and budgeted bucket assembly with structured omissions.
8. Manifests, context-admission controls, and evidence gates.

Context bucket

One of business, policy, tool, evidence, memory, or session. Each bucket has its own token budget and truncation behavior.

Policy manifest

The compiled list of policy bundles and rule IDs active for the run.

Use it to answer: “Which rules shaped this context?”

Tool manifest

The compiled list of adapters and capabilities exposed to the Planner and Executor.

Use it to answer: “Which tools could this run use?”

Evidence manifest

The compiled list of admitted evidence available to the Decision plane. Each entry carries its evidence ref, source ID, content hash, integrity, freshness, data_only treatment, and the DecisionSpec.required_evidence items it can satisfy.

Use it to answer: “Which current, verified facts were eligible to support the decision?” Rejected or budget-omitted candidates belong in gate and omission diagnostics, not the admitted manifest.

Context provenance

The per-block record of source_refs, origin, integrity, freshness, instruction_treatment, inclusion_reason, content hash, and optional observation/validity timestamps.

Use it to reconstruct why a block entered CompiledContext and whether it may justify a governed action.

Context integrity

Whether a block may justify a governed decision. The values are authoritative, verified, and untrusted.

• authoritative is reserved for compiler-resolved control material such as pinned pack, policy, and tool-registry blocks.
• verified evidence may support facts but remains data_only.
• untrusted material may be observed as data when policy allows, but cannot satisfy an evidence gate.

Integrity is not data classification. Classification controls who may see content; integrity controls what the runtime may rely on.

Context freshness

The validity state of a context block: current, stale, unknown, or not_applicable. Evidence and memory use current, stale, or unknown; compiler-owned controls use not_applicable.

Only current, verified evidence may satisfy a required-evidence gate.

Instruction treatment

Whether a context block is eligible to direct model behavior: control or data_only.

Pinned pack, policy, and tool-registry blocks may be control. Retrieved evidence, promoted memory, and request/session data remain data_only; factual verification never upgrades text into instructions.

Evidence gate

Deterministic runtime control for one DecisionSpec. It records required, satisfied, unresolved, rejected_evidence, and commit_allowed.

A requirement is satisfied only by admitted, current, verified evidence or explicit structured request context. The runtime must authenticate that context and upstream labels; a caller’s assertion cannot prove identity or authority. Untrusted, stale, unknown-freshness, and budget-omitted candidates remain rejected and cannot open the gate. Evidence sufficiency alone does not authorize dispatch.

Runtime controls

Compiled controls active for a run: must_refuse, must_escalate, approval_gates_active, redaction_rules_active, context_admission, and evidence_gates.

Budget report

Compiler output that records allocated and used tokens, per-bucket usage, truncations, dropped block IDs, structured omissions, and warnings.

Budget reports should make context omissions visible.

Omitted context

Context that was eligible but excluded from the compiled prompt. The reference compiler currently emits structured budget_exceeded omissions with block, bucket, estimated tokens, priority, and source refs; evidence gates separately record integrity and freshness rejections.

Prefer naming omitted context explicitly over saying “the model forgot.”

Environment overlay

Auditable, declared environment-specific constraint on a pack, such as endpoint refs, locale defaults, or stricter thresholds.

Overlays may constrain. They should not expand tool power.

Decision plane terms

Planner

Decision-plane component that reads CompiledContext and emits a typed Plan. It cannot execute tools or mutate state.

Executor

Decision-plane component that runs verified Plan steps through the Tool Gateway. It cannot invent new tools or bypass the Plan.

Critic

Decision-plane component that verifies Plans before execution, scores step results after execution, checks required evidence, and emits verdicts.

Critic verdict

Typed control decision from the Critic.

Decision checkpoint

Point in a Plan where the Critic verifies a DecisionSpec before the run can continue.

Decision key

Stable identifier for a decision type, such as support.refund.execute.

Do not use a human label or UI title as the key.

Decision right

What the runtime is allowed to do under a DecisionSpec: propose, recommend, execute, or escalate.

Subagent lane

Isolated bounded sub-run with its own RunContext projection, budget slice, tool surface, and trace span. A lane cannot directly mutate parent effects.

Background session

Durable work that can survive a process restart using an ExecutionCheckpoint and current run, operation and aggregate-budget stores. A session_id identifies scope; it does not authorize resume. Current authority, approval, boundary, external preconditions, ownership/fencing and budget must be revalidated, preserving unknown effects.

Consolidation

Post-step or post-run process that emits memory write proposals, evidence links, trace impressions, and improvement signals.

Action plane terms

Tool Gateway

Single logical boundary between Decision plane and external systems. It validates schemas and arguments, brokers credentials, evaluates native risk and approval obligations, applies policy decisions, verifies result evidence, records transcripts, and propagates trace context.

Adapter

Typed wrapper around an external system or protocol: MCP server, A2A peer, OpenAPI service, database interface, internal service, or custom connector.

Adapter registry

Registry of adapters, capabilities, endpoint refs, schemas, auth profiles, native-risk ceilings, and v1 mode projections.

Capability

Named operation exposed by an adapter. Capabilities are inventory. Permissions decide whether a workflow may use them.

Tool permission

Context Pack entry that binds a workflow to an adapter capability under constraints such as allow, argument limits, or approval gates.

MCP

Model Context Protocol. In ContextOS, MCP is one adapter protocol behind the Tool Gateway. The current integration profile targets MCP 2026-07-28; MCP discovery describes candidates while ContextOS decides admission, risk, authority, approval, evidence, and audit.

A2A

Agent-to-Agent protocol. A2A 1.0 supplies discovery, messages, artifacts, tasks, and authentication metadata. ContextOS adds a narrowing delegation envelope, local policy, native-risk evaluation, evidence, and parent/child trace linkage at each hop.

OpenAPI adapter

Adapter backed by an OpenAPI-described service. Operation schemas inform validation; policy still decides whether execution is allowed.

Idempotency key

Stable token required for write-class tool calls. It supports deduplication only under the target provider’s verified scope, retention and retry semantics. Retain stable operation identity; an unknown effect cannot be blindly retried because a key exists.

Approval gate

Named checkpoint that can pause a governed action, freeze its complete action/evidence binding, collect eligible approval, and allow current authorization checks to proceed. A gate name or expired approval is not dispatch authority.

Frozen evidence snapshot

Immutable hash of the evidence bundle at the moment an approval gate is reached.

Tool transcript

Recorded input, output, policy decision, approval state, metrics, and trace info for a tool step. It is replay input, not just debug output.

Intelligence plane terms

Ontology

Versioned schema for entity types, relationships, attributes, derived fields, validation rules, and identity formats.

Entity type

Named category in the ontology, such as Customer, Order, Invoice, or Workspace.

Relationship type

Named edge type in the ontology, such as order_belongs_to_customer.

CEID

Canonical Entity ID. Stable, human-readable audit handle for an entity, for example customer:cus_77.

SID

Semantic ID. Compact representation for ML, retrieval, ranking, or recommendation. Not an audit handle.

Identity Layer

Intelligence and Trust primitive that maps source identities, CEIDs, SIDs, user identities, and agent workload identities.

Knowledge Graph

Typed graph where nodes and edges carry provenance and evidence refs. Reads are policy-scoped; replay uses pinned snapshots.

Graph snapshot

Fixed view of the Knowledge Graph used for replay, evaluation, or reproducibility.

GraphRAG

Retrieval method that expands from seed entities along permitted graph relationships under hop, policy, and budget constraints.

Evidence bundle

Retrieved evidence with source IDs, hashes, traversal path, snapshot pin, conflict markers, and confidence.

evidence_ref

Pointer to evidence, such as a tool transcript, graph edge, document segment, policy rule, or memory record.

Memory Fabric

Storage and governance layer for working, episodic, semantic, and durable memories.

Promotion-aware memory

Memory model where facts move from capture to candidate to review to promoted state before they can be compiled into context.

Memory tier

Memory write proposal

Candidate memory emitted by Consolidation. Carries fact, write class, target tier, evidence refs, consent result, contradiction result, and owner.

Correction memory

Operator correction recorded as a governed memory candidate. It should outrank prior records on the same key after promotion.

Consent record

Append-only record that gates PII or regulated memory promotion and recall.

Trust plane terms

Policy bundle

Versioned set of policy rules scoped by intent, task, tenant, risk, or workflow.

Policy Engine

Deterministic boundary that evaluates policy outside model code. It returns allow, deny, escalation, required evidence/gates, native-risk evaluation, and a v1 effective-mode projection.

Policy decision

Recorded verdict from the Policy Engine for one boundary check. Carries policy_decision_id, matched rules, rationale, and normalized inputs.

Guardrail

Pack-level control that emits must_refuse, must_escalate, or redaction behavior.

Redaction rule

Named rule that removes or masks sensitive fields before model exposure, tool use, trace export, or final communication.

Evaluator

Function or service that scores a run, step, output, or artifact. Core dimensions are policy, utility, latency, safety, and economics.

Scorecard

Collected evaluator results for a run, intent, pack version, policy version, or release candidate.

Release gate

Threshold that blocks promotion when a candidate pack, policy, prompt, model config, or tool change regresses against baseline.

OTEL trace

OpenTelemetry trace carrying W3C trace context across Compiler, Planner, Critic, Tool Gateway, adapters, and evaluator services.

Trace attributes

Namespaced key-value fields such as contextos.run_id, contextos.intent, contextos.context_pack_ref, and contextos.decision_record_id.

Replay

Offline re-derivation of a prior run’s Critic verdict and DecisionRecord from pinned artifacts and recorded tool transcripts.

Replay determinism

Property that deterministic artifacts reproduce exactly under pinned inputs, while model-dependent stages satisfy declared outcome properties or scorecards under pinned request, pack, policy, snapshot, tool transcript, evaluator set, and model config.

Improvement proposal

Locally versioned change candidate produced by feedback, incident review, Insight Synthesizer, Strategy Compiler, or Autotune under the documented improvement profile. It is not auto-applied and is not yet a canonical exported type.

Insight Synthesizer

Candidate-profile improvement role that finds recurring patterns across traces, DecisionRecords, memory candidates, and operator corrections.

Strategy Compiler

Candidate-profile improvement role that converts validated feedback into candidate strategy rules for prompts, retrieval, planning, tool selection, memory recall, or budgets.

Feedback Store

Candidate-profile auditable store of operator feedback, corrections, tips, and review decisions with provenance.

Autotune

Candidate-profile optimizer that proposes prompt, retrieval, or budget changes against target evaluator metrics and replay evidence.

Sandbox profile

Deployment contract for code-execution capabilities: image, filesystem, network, compute, stdio, secrets, and timeout policy. It is signed when the adopted supply-chain profile requires signatures. This containment configuration is distinct from a versioned control profile; current enforcement observations are required at the execution boundary.

Functional state

Read-only per-turn pressure signals used by the Critic, such as budget pressure, loop pressure, evidence pressure, gate pressure, conflict pressure, and escalation propensity.

Implementation catalogs

Decision Catalog

Registry of DecisionSpec entries and decision bindings. See Decision Catalog.

DecisionRecord

Replay-addressable decision receipt emitted by a conforming implementation. It records the accepted outcome, evidence refs, policy decisions, approvals, active controls, lineage, budget, and trace id. Deployments may add tamper-evident hashes through an explicit audit profile. See Decision Record.

Intent-Task Catalog

Registry mapping canonical intents to risk-classified task templates, decision checkpoints, required evidence, and owner roles.

Adapter Registry

Registry of external capabilities available to the Action plane.

Pack Registry

Signed, immutable registry for ContextPack versions and environment pins.

Policy Bundle Registry

Registry for versioned policy bundles referenced by packs and evaluated by the Policy Engine.

Evaluator Registry

Registry for evaluator definitions, score targets, release gates, and golden sets.

Supporting terms

Intent

Canonical governed name for a user or system request class, for example support.refund.

Task template

Versioned plan blueprint for an intent. It is a starting point for planning, not a hard-coded script.

Channel

Typed inbound surface: app_chat, email, voice, api, webhook, or sms.

Skill

Reusable bundle of capabilities, guidance, and evaluation criteria for a recurring micro-task.

Capability class

Operational category such as observe, recall, think_support, act, or verify. It is separate from native ActionRisk; approval_mode is only the v1 compatibility projection.

Data classification

Label such as PUBLIC, INTERNAL, CONFIDENTIAL, or RESTRICTED that constrains context exposure, logging, tool use, and export.

Kill switch

Control-plane operation that re-pins traffic or disables future use of a capability, pack, policy, evaluator, model config, or adapter. Stopping current work additionally requires cancellation propagation, ownership fencing and verified worker/effect observations; it does not undo a committed external effect.

Golden set

Curated replay/evaluation cases used to detect regressions before promotion.

Incident case

Replayable case produced from a failure or operator correction. Incident cases should become part of future gates.

Common confusions

Anti-terms: do not use

Source docs