07 — Glossary

One word, one meaning. If a term drifts in conversation, bring it back to here.

Action / action-file — A .action text file; the unit of behavior. Filename = the action's name; body = statements executed by the engine. One file, one function.

Boot — The single seed action main() loads and runs. Everything else (locating the object, the class chain, dispatch, rendering) is self-hosted from boot.

Capability — A thing the system can do, installed *per device, when needed*. DSL capabilities arrive from the store and light up instantly (no release); native capabilities (camera, scanner, on-device inference) are compiled into the shell and need an app update.

Capability profile — A device's manifest declaring what it *is* and *can do*: door, start page, DSL + native capabilities, oracle routing. The only difference between the same install on a weak handheld and a flagship phone.

Class — A folder. .action = methods, .data = state, parent = = single inheritance. Synonymous with "folder" and (as a kind) "thing."

Compiled view — An action lowered to native C++ and shipped as _views-<platform>.{so,dylib} inside a class folder; loaded on demand for speed. POSIX desktop/server only.

Content-addressed version — Every action write saved as an immutable .versions/<sha>.snap with {reason, parent} meta; any version is re-runnable by hash.

DSL — The small language action-files are written in. Versioned via a schema window, executed by the engine.

Door — A device's trust model: mobile / desktop / tv (owner-trusted loopback) or web (public, authenticated). The desktop app is "not an app, a door."

Engine — The ~2,400-line C++ core. Executes action-files; everything else is data in a store. Versioned via ZERO9_VERSION; declares the schema window.

Evolve / evolution loop — The author → run → verify → version → (migrate) cycle by which the system improves its own behavior. Modes: write (immediate), propose (human-gated).

Folder — See Class. The composable block: actions + data. Treated as a small intelligent thing that reuses and cross-connects with other folders.

Home — A node's writable data root ($HOME); where objects and the local store cache resolve.

Hydrate / copy-on-hydrate — Fetch a class the machine lacks once over HTTP, then read it locally forever. How behavior (and compiled views) is delivered without releases.

Lens — A scoped projection of a thing to a viewer (a store-only grant_* posture, no data). Needs zero engine change; the access substrate already exists. *Status: convention planned.*

Mesh — The peer network (over iroh) connecting nodes through a blind relay that forwards ciphertext only. Encrypted endpoint-to-endpoint against a key the name directory pins rather than authenticates, so the property is confidentiality against the relay, not end-to-end encryption to a verified peer (../remote-access.md §5).

Node — One running instance of the engine on a device, identified by a Zero-ID; the billable unit in the business model.

Object — An instance ("thing") whose data names its class; what a request acts on (<object>.<action>).

Oracle — The LLM primitive, provider-abstracted: resolves per profile to local (llama.cpp + GGUF), bring-your-own key, or a peer node. Always has a fully-local fallback. Calls are crash-proof (try_call).

Personal mode / Node mode — The two store modes. Personal (default): only classes hydrate; objects stay local. Node ($ZERO_STORE_BASE set): an explicit node serving a published home; classes *and* objects hydrate.

Schema (version) / schema window — What a valid action looks like (the DSL grammar version). The engine supports a range [kSchemaMin, kSchemaMax]; a class may carry a .schema marker; a load-time gate refuses-above / migrates-below / runs-in-window.

Store — A directory tree of classes, cached locally, backed by a remote HTTP base (.remote). One cache serves every home/folder/user on a machine. The default store is oneaurica.com. All behavior lives here.

Substrate — The whole idea: the engine as the only universal floor, everything else a thing in the store. What Zero *is*.

Thing — A class/folder regarded as a small intelligent unit (actions + data + demands), or an object instance of one. Same root concept as class/folder.

Three gates — What bounds any device action: capabilities installed × OS permissions granted × zcap grants authorized.

Verify — functions/verify <action> <expected>: the deterministic outcome check. The pillar that makes autonomous authorship safe and lets the language drift past human legibility.

zcap — A proven capability/session token (principal:expiry.HMAC(node_secret, …)), held in a Service Worker, never a cookie. Sessions are proven, not asserted.

Zero-ID / ZeroKey — A recoverable P-256 wallet whose scalar *is* your identity, shown as a recovery key, importable anywhere → the same ID everywhere, never two.

zero_serve() — The single library entry point that runs the engine: a child process on desktop, an in-process worker-thread call on mobile.