Terms that have specific meaning in Benten. Alphabetical.
Acceptor — The Phase-3 freshness + nonce-store + revocation-list seam consumed by DeviceAttestationEnvelope::verify. Lives at benten_id::Acceptor::accept_at; composes a parent-chain signature check, a configurable replay-window (FreshnessPolicy), and a parent-issued nonce store. The Acceptor is one of the three cryptographic defenses against device-attestation forgery (alongside envelope-signature + payload-hash binding). Operator-deployment residual: the engine ships with FreshnessPolicy::seconds(u64::MAX) as a test-grade default; production deployments override via Engine::set_acceptor with a concrete time-bound — see SECURITY-POSTURE.md Compromise #23.
actor_cid — Phase-3 attribution slot decoupled from device_cid. Identifies the logical actor (the user / Atrium principal) whose authority the write claims, independent of which device emitted the write. Pinned by sync_replica_explicit_actor_cid_decouples_from_device_cid (see crates/benten-sync/tests/sync_replica_attribution.rs). The decoupling lets multi-device users (laptop ↔ phone-OS-app ↔ desktop) carry consistent actor identity across heterogeneous devices.
Algorithm B — The IVM (Incremental View Maintenance) strategy Benten selects for most views: dependency-tracked incremental maintenance. Phase 1 shipped five hand-written views; Phase 2b production-registered Algorithm B with per-view strategy selection (Strategy::A / Strategy::B) at Engine::create_user_view for the 5 canonical view IDs AlgorithmBView supports natively. Phase 3 generalized Algorithm B beyond the canonical-view fallback: user-defined view IDs declaring Strategy::B now run a generic single-loop kernel (benten_ivm::algorithm_b::GenericKernel) keyed on (label_pattern, projection). See docs/ARCHITECTURE.md.
Anchor (Anchor Node) — A Node with stable identity that never changes. External edges point to anchors, not to versions. The anchor has a CURRENT edge to its latest Version Node. See "Version chain."
4-category navigation IA — Phase-4-Foundation admin UI v0 user-facing navigation per post-R1-triage ratification #4: Plugins / Workflows / Content Types / Views. Surfaces 4 distinct concepts over the unified subgraph substrate (workflow ↔ plugin ↔ schema = same subgraph shape per D-4F-14; manifest presence + sharing intent distinguish a plugin from a workflow). See ADMIN-UI.md §2.
Active reference — A pointer to a specific plugin-version currently in use, held in the user's active graph (NOT the plugin library subgraph). Per Phase-4-Foundation post-R1-triage ratification #2: active reference = CURRENT pointer in a per-device-local Loro Map. "Switching active version" = updating this map's per-device entry; per-user sync surface presents the per-device-keyed map. See "Plugin library subgraph," "Plugin manifest," PLUGIN-MANIFEST.md §5.
App-level plugin — The Phase-4 extensibility shape: a content-addressed subgraph of operation Nodes (handlers, materializers, SANDBOX nodes) packaged for sharing through Atrium peer groups. Each plugin has its own plugin-DID + an attenuated UCAN delegated by the user at install. The engine evaluator walks plugin subgraphs the same way it walks any handler — there is no separate plugin runtime. Trust model = three layers: user-as-root + install-time signed manifest envelope (requires + shares) + runtime UCAN delegation within manifest envelope. Phase-4-Foundation refinement (per D-4F-12 post-R1-triage retense): four distinct identity concepts NOT conflated (content-CID + peer-DID signature on original content + plugin-DID minted at install + user-DID). Contrast with "Engine extension." See SECURITY-POSTURE.md "Plugin trust model" + ARCHITECTURE.md "Plugins and engine extensions" + PLUGIN-MANIFEST.md.
Cap-change-triggered consent — Phase-4-Foundation upgrade rule (post-R1-triage ratification #8): silent within-lineage upgrade if requires is a strict subset of installed manifest; full re-consent if requires GREW; cross-fork merge = user-initiated through same consent flow. The cap envelope is the unit of consent — when it changes, fresh consent is required; when it doesn't, silent upgrade is allowed. See PLUGIN-MANIFEST.md §4.3.
Atrium — The Phase-3 P2P-sync social unit: a per-user (or per-group) trust boundary inside which member devices sync content + capability state through iroh transport + Loro CRDT merge + MST diff. Each Atrium has a member set of DIDs (one per principal) and a device set (multiple devices per principal). The engine surface is benten_engine::engine_sync::AtriumHandle (per crates/benten-engine/src/engine_sync.rs); the underlying transport + CRDT lives in benten-sync. See ARCHITECTURE.md §benten-sync and SECURITY-POSTURE.md Compromise #22 (public iroh-relay metadata leak) + Compromise #23 (wire device-attestation envelope).
Attribution — The Phase-2a Inv-14 contract that every executed TraceStep carries an AttributionFrame naming the actor (principal CID), handler (registered subgraph CID), and the head-of-chain capability grant CID that authorized the step. Stamped automatically by the DSL on every emitted Operation Node and threaded through the evaluator runtime; opt-out is a Phase-6 affordance, not a Phase-2a one. Missing or malformed frames fire E_INV_ATTRIBUTION at registration or runtime. Phase 3 widened Inv-14 with three additive sync-boundary slots — peer_did_set / device_did / sync_hop_depth — populated at the CRDT merge boundary; see "device-DID," "peer_did_set," "sync_hop_depth," and INVARIANT-COVERAGE.md §"Inv-14 Phase 3 device-grain extension."
benten-dsl-compiler — The Phase-2b crate that compiles textual handler-DSL source into a SubgraphSpec ready for Engine::register_subgraph. Sibling of benten-engine; depends only on benten-core. Used by packages/engine-devserver to route hot-reload edits through the canonical engine path rather than parallel infrastructure.
BLAKE3 — The cryptographic hash function used for CID derivation. Fast, tree-hash-friendly, multi-threaded.
CID / CIDv1 — Content Identifier version 1. IPLD standard: version byte + multicodec + multihash. Benten uses CIDv1 with multicodec 0x71 (dag-cbor) and multihash 0x1e (BLAKE3).
Codepoint dispatch — The crypto-agility seam pattern (per CLAUDE.md baked-in #5 + RATIFIED-pq-default-reframe-2026-05-19.md). Signature / hash / cipher-suite selection happens via a typed codepoint enum (SigCodepoint / HashCodepoint / CipherSuiteCodepoint) that maps to vetted upstream RustCrypto primitives. Unknown / reserved codepoints surface UnsupportedAlgorithm — never a silent fallback. Sizes flow dynamically from upstream type-level constants; no hardcoded Ed25519-shape assumptions anywhere. The integration crate benten-crypto-suite is the ONLY workspace call site that direct-deps a crypto-primitive crate.
Crypto-suite integration crate (benten-crypto-suite) — The 13th workspace crate (added Phase 4-Meta-Core G-CORE-2). The ONE thin Benten-owned signature / hash / cipher-suite agility integration crate (concat / hash / codepoint / envelope glue ONLY — never forks or reimplements primitives). Wraps vetted upstream RustCrypto crates (ed25519-dalek, ml-dsa, blake3, sha2, sha3; G-CORE-3 adds x25519-dalek, ml-kem, chacha20poly1305, hkdf). The "crypto-agility-contract:6" only-call-site rule is structurally enforced via a workspace-scan invariant.
Code-as-graph — The paradigm where application logic is represented AS graph structure, not stored IN graph properties. A handler is a subgraph of Operation Nodes connected by control-flow Edges. The engine walks the subgraph to execute it.
Content-addressed — A storage model where an item's identity is derived from its bytes. Identical content has identical identity; different content has different identity. Enables cryptographic verification, dedup, and peer sync without schema reconciliation.
Capability grant chain — The ordered delegation chain from a root grant to the leaf grant that actually authorizes a write. Phase-2a GrantBackedPolicy walks the chain at every refresh point; each link must attenuate (narrow scope, never widen). The head-of-chain grant CID is persisted in the WAIT ExecutionStateEnvelope so resume re-checks the chain at the same head it was authorized against. Chain depth is capped (default 64) — exceeding fires E_CAP_CHAIN_TOO_DEEP.
CURRENT pointer — An Edge from an Anchor Node to its latest Version Node. Atomic update moves the pointer within a storage transaction, giving versioned entities "single latest" semantics while preserving history.
BentenHlc — The concrete Phase-3 HLC type implementing benten_core::hlc::Hlc. Carries (physical_secs, logical_counter) and resolves causal ordering across Atrium peers under bounded skew. Exercised at the sync-replica WRITE per-row cap-recheck boundary inside apply_atrium_merge. See "HLC."
DAG-CBOR — The IPLD subset of CBOR with canonical (map-keys-sorted, no indefinite-length) encoding. The on-the-wire format for content-addressed Nodes. Implemented via serde_ipld_dagcbor.
Drop bundle (benten-drop) — Phase-4-Meta-Core G-CORE-3f offline-share format. A self-contained CBOR-on-disk envelope DropBundle{version, mode, spec_cid, audience, auth_grant, content: Vec<EncryptedContent>, restricted_spec, per_node_attestation, envelope_sig, issuer_verifying_key} shipped over the iroh-blobs two-CID seam. Consumer reads filesystem-only — no network, no live publisher. Three sendme delivery modes per 00-implementation-plan.md §3 G-CORE-3 def input-constraints refinement #6 L341: Mode 1 (online-pull, G-CORE-3e ALPN), Mode 2 (offline-Drop, this surface — SHIPPED at G-CORE-3f), Mode 3 (inline-tiny — deferred to post-v1; the DropContentMode enum has no InlineTiny arm). Defense-in-depth per Spike G: envelope-sig over header (outer integrity layer) + per-Node AEAD authentication tags (inner integrity layer); content-only tampers are caught at the AEAD layer, header tampers at the envelope-sig layer. Per RATIFIED-sharing-and-confidentiality-2026-05-21.md §R6 revocation-reach reality: Drop bundles are forever-valid once distributed — already-derived keys remain decryptable; mitigations = tight nbf/exp + periodic key rotation. See docs/SECURITY-POSTURE.md § "Revocation reach" for the online-vs-offline asymmetry framing.
device-DID — The device-grain attribution carrier in the Phase-3 device-heterogeneity contract. A did:key-shaped identifier (one per device) bound by parent-issued DeviceAttestation to a parent identity. Populated in AttributionFrame.device_did for sync-attributed and device-DID-attested writes; lets multi-device users distinguish per-device origins inside a single per-user Atrium. See "DeviceAttestation" + "DeviceAttestationEnvelope."
DeviceAttestation — The benten_id::DeviceAttestation surface — a parent-issued capability envelope binding a device's public key to the parent identity (a signed certificate of the form "parent attests this device_did is mine"). Verified at chain-construction time via benten_id::Acceptor; consumed by DeviceAttestationEnvelope at sync-time. See "DeviceAttestationEnvelope" and crates/benten-id/src/device_attestation.rs.
DeviceAttestationEnvelope — The Phase-3 on-the-wire envelope shape carrying signed payload_hash + session_nonce alongside the embedded DeviceAttestation. Defined at crates/benten-engine/src/engine_sync.rs::DeviceAttestationEnvelope. The V2 wire shape is (version, attestation, payload_hash, session_nonce, envelope_signature); verify enforces three cryptographic defenses: (1) envelope-signature against the device's resolved public key (DID forgery defense); (2) Acceptor::accept_at (parent-chain signature + freshness window + nonce-store replay defense); (3) constant-time BLAKE3(payload) == envelope.payload_hash (frame-pair binding). All three failure modes reject with E_DEVICE_ATTESTATION_FORGED. See SECURITY-POSTURE.md Compromise #23 for the full closure narrative.
Edge — A typed directional link between two Nodes. Labels include NEXT (control flow), ON_ERROR, ON_NOT_FOUND, GRANTED_TO, CURRENT, etc.
Embedded webview — Phase-4-Foundation deployment shape (c) per CLAUDE.md baked-in #17. A native shell (Tauri 2.x is the first concrete impl; future swap targets include tauri-runtime-verso once Verso matures + Electron as a fallback) wraps a webview that loads the same wasm32-unknown-unknown bundle as deployment shape (b). The native shell IS a full peer internally (shape a); the webview is the thin compute surface (shape b) talking to its embedded full peer via in-process IPC instead of fetch. Preserves the thin-client architecture (same bundle, same protocol) while giving users a launched-on-my-machine admin UI surface. The renderer integration lives in benten-renderer-tauri; the trust posture is "you compiled this in" (engine extension per CLAUDE.md #19) — distinct from app-level plugin subgraphs. Contrast with "Full peer," "Thin compute surface."
Engine extension — A Rust crate compile-time linked into the engine binary. Distinct from "App-level plugin": rare; for custom IVM strategies, alternate transports (post-iroh — Tor / Nostr / shaped relays), alternate persistence backends (post-redb — sled / fjall / cloud-KV), custom signature schemes (post-Ed25519 — X25519 / BLS / post-quantum), performance-critical primitives that need raw Rust speed beyond SANDBOX. Trust model = "you compiled this into your engine binary" — same trust as Benten core. No UCAN, no manifest envelope, no read_node_as boundary; the boundary is cargo and code review. See SECURITY-POSTURE.md "Plugin trust model" + ARCHITECTURE.md "Plugins and engine extensions."
ExecutionStateEnvelope — The DAG-CBOR-serialized shape a Phase-2a WAIT primitive produces when suspending. Carries the frame stack, pinned subgraph CIDs, resumption principal, and context bindings needed to resume atomically across process boundaries. Envelope CID is content-addressed for tamper detection.
FieldEnum / FieldUnion / FieldList / FieldMap / FieldObject / FieldRef / FieldScalar / SchemaRoot — The 8 labels of the Phase-4-Foundation canonical typed-field-Node vocabulary (per D-4F-NEW-TYPED-FIELD-NODE-VOCAB post-R1-triage resolution). Schema-subgraphs are built from these labels (SchemaRoot is the root container; Field* labels describe field shapes). 5 labeled edges connect them (ITEM_TYPE / KEY_TYPE / VALUE_TYPE / REF_TARGET / VARIANT); object-to-field relationships are implicit-via-recursion in schema_compiler::emit (no FIELD edge label minted). 8 scalars (derived from benten-core::Value variants). 4 mandatory field properties (name / required / default / scope — scope is schema-derived per sec-3.5-r1-4). Composability invariant (cag-r1-1): every label maps to a composition over the existing 12 primitives via the schema-compiler; no new PrimitiveKind variants. See SCHEMA-DRIVEN-RENDERING.md §2 + ADMIN-UI.md §2.1 (user-facing field-type labels — "Text" / "Number" / "Date" etc. — map to engine-facing vocabulary via the 1-to-1 mapping table at ADMIN-UI.md §2.1 per ux-r1-12).
Fork (DAG-shape branch) — Phase-4-Foundation extends the Phase-1 anchor + Version Node pattern to DAG-shape per D-4F-14 (anchor → v1 → {v2-mainline, v1.5-fork}; CURRENT can point at any branch tip; per-user-local version history). A fork is created when a user edits a non-configurable plugin Node — admin UI prompts before committing the fork. Cross-fork merge = user-initiated through cap-change-triggered consent flow per ratification #8. See PLUGIN-MANIFEST.md §5.
FreshnessPolicy — The operator-configurable replay-window for the Acceptor's nonce store (benten_id::FreshnessPolicy). Phase-3 ships with a test-grade FreshnessPolicy::seconds(u64::MAX) default (no time-window pruning); production deployments MUST override via Engine::set_acceptor with a concrete time-bound (e.g., FreshnessPolicy::seconds(86_400) for a 24h replay window) BEFORE participating in adversarial sync. See SECURITY-POSTURE.md Compromise #23 "operator-deployment residual."
Full peer — The Phase-3 deployment shape that IS a sync participant: native Rust on user-owned hardware (laptop / phone OS app / desktop / future Benten Runtime instances). Carries durable storage (redb), full Atrium sync participation (iroh + Loro CRDT in benten-sync), SANDBOX runtime (wasmtime), persistent UCAN grant store. Contrast with "Thin compute surface."
Handler — A registered subgraph that acts as an entry point for external calls. crud('post') produces a handler with five actions.
Install record — A user-DID-signed Node, written into the user's graph at plugin-install time, that records the install decision: which plugin (content-CID), which version, which manifest envelope was consented to, and when. Per CLAUDE.md baked-in #18 (user-as-source signing model): the plugin's original content carries peer-DID signatures from whoever shared/authored it; the install record is a LOCAL anchor signed by the user's own DID, not by the plugin author or a Benten-project key. Contrast with the plugin manifest itself (signed by the plugin author at publish time + immutable per release) and the active reference (per-device-local pointer at which version is in use right now). See PLUGIN-MANIFEST.md §3.
HLC — Hybrid Logical Clock. Monotonic timestamps combining physical and logical clocks, used for causal ordering. Relevant in Phase 3 (P2P sync) and in Phase-2a capability wall-clock revocation paths. Implemented directly in benten-core::hlc; rationale at the module rustdoc — uhlc crate evaluated and rejected for async-std + no_std + async-return-shape mismatch. See "BentenHlc" for the concrete type used at sync-replica WRITE boundaries.
Hybrid signature (LAMPS Composite ML-DSA) — The v1-beta default signature construction: the byte-faithful IETF LAMPS composite id-MLDSA65-Ed25519-SHA512 (OID 1.3.6.1.5.5.7.6.48, IANA early-allocated 2025-10-20), pinned to draft-ietf-lamps-pq-composite-sigs-19 + test-vector commit f0627ab3. Both halves sign a shared message representative M' = "CompositeAlgorithmSignatures2025"(32) ‖ "COMPSIG-MLDSA65-Ed25519-SHA512"(30) ‖ len(ctx)u8 ‖ ctx ‖ SHA-512(M) (ML-DSA-65 signs M' with context = Label; Ed25519 signs M'). Wire = mldsaSig(3309) ‖ tradSig(64) = 3373 B (ML-DSA FIRST, raw concat, NO commitment trailer); pubkey = mldsaPK(1952) ‖ tradPK(32) = 1984 B. Verify requires BOTH halves to cryptographically verify — strip / substitution / cross-message-splice / tamper attacks fail closed via the shared-M'/ctx=Label binding + both-halves-required (this replaces the prior Benten-own NF-4 SHA3-256 commitment, which is dropped — the IETF composite wire has no slot for it). Wired in benten-crypto-suite::sig; codepoint SigCodepoint::HYBRID_ED25519_MLDSA65 = 0x0001. The classical half is the audited security floor; the hybrid construction means unaudited PQC is never the SOLE trust path. Security posture is EUF-CMA-only / Weakly-Non-Separable per the LAMPS draft §9.2.2/§10 (see Compromise #31); SUF-CMA-equivalence is closed at the application layer by Inv-15. (draft-19 is not yet a final RFC — the M' Prefix embeds the literal "2025"; re-verify at the final RFC, with crypto-agility absorbing any change additively.)
Invariant — A structural or runtime check the engine enforces. See ARCHITECTURE.md for the full 14-invariant list and their phase landing.
iroh — The P2P networking library (QUIC, dial-by-public-key, NAT traversal with relay fallback) used in Phase 3.
Kith — Working name (subject to user change) for the Phase-5+ exploratory decentralized identity-and-attestation substrate that would supersede Phase-4-Foundation's MVP rotation mechanism. Differentiated from Phase-3 peer-DID + RotationLog primitive by: relational attestations ("X says Y is Z to me" as first-class graph data) + trust-graph traversal + per-relationship privacy controls + organizational attestations (Gardens/Groves, schools, certifying bodies) + UCAN-mediated contextual sharing. Phase 4-Foundation does NOT depend on Kith. Naming research in flight; final name TBD. See docs/future/kith-decentralized-identity.md. Substantively wired in benten-sync (crates/benten-sync/src/transport.rs); the Phase-3 ATRIUM_ALPN is advertised over iroh's QUIC connection establishment. Public-iroh-relay metadata leakage is honestly disclosed at SECURITY-POSTURE.md Compromise #22.
Loro / Loro CRDT — The per-property LWW + HLC-ordering CRDT used in benten-sync for device-to-device merge. Loro's LoroDoc is wrapped in benten_sync::crdt::InnerLoroDoc; winning_attribution collects the contributing peer DIDs into peer_did_set at merge time. Phase 3 wired Loro substantively into the production sync pipeline.
Manifest envelope — The bound on an app-level plugin's runtime authority, established at install time when the user consents to the plugin's signed manifest. The envelope is the union of the manifest's requires (caps the plugin needs) and shares (delegation policy for what other plugins it will hand caps to). Plugins may delegate UCANs to other plugins at runtime if and only if the request fits the source plugin's manifest envelope. The CapabilityPolicy backend validates the resulting cap chain at access time. See "App-level plugin," "Plugin manifest," + SECURITY-POSTURE.md "Plugin trust model."
Manifest envelope chain validation — Phase-4-Foundation seam at crates/benten-caps/src/manifest_envelope_chain_validation.rs (G24-D-FP-2 NEW) joining benten-platform-foundation::plugin_manifest (Layer 2 manifest envelope) with benten-caps::plugin_delegation (Layer 3 runtime UCAN delegation). Validates: chain traces to user-root + each delegation step fits source plugin's manifest shares policy + requested cap is within attenuation envelope. See PLUGIN-MANIFEST.md §8 + SECURITY-POSTURE.md "Plugin trust model."
Materializer pipeline — Phase-4-Foundation engine-side surface (crates/benten-platform-foundation/src/materializer.rs) that walks a schema-driven SubgraphSpec + content CID + walk principal and produces a rendered output (MaterializerOutput). The pipeline composes via the IVM-subgraph generalization per D-4F-2: schemas are subgraphs of typed-field Nodes, the materializer walks them, and per-row reads route through the MaterializerCapRecheck gate paired with the engine-side MaterializerEngine::read_node_as seam (Class B β per CLAUDE.md baked-in #18). Default consumer is HtmlJsonMaterializer; admin UI v0 routes use render_category_content. See SCHEMA-DRIVEN-RENDERING.md §3 + the materializer-arch reviewer findings.
Module manifest — The Phase-2b ModuleManifest shape (benten-engine::module_manifest::ModuleManifest) that declares one or more WASM modules (name + version + content CID + capability requirements + migration steps + optional signature). Installed via engine.installModule({manifest, manifestCid}); see MODULE-MANIFEST.md for the schema and SECURITY-POSTURE.md Compromise #19 for the in-memory persistence boundary that lifts in Phase 3. Distinct from "Plugin manifest" — module manifests describe wasm bundles for SANDBOX; plugin manifests describe shareable subgraphs.
MST / Merkle Search Tree — The Phase-3 sync diff structure used to locate divergent subtrees between Atrium peers efficiently. Each node carries a CID over its (key, value, child-CIDs) tuple; identical CIDs prove identical subtrees, letting peers exchange only the differing branches. Wired in benten-sync alongside Loro CRDT merge; the MST diff yields the candidate write set that the receiver's apply_atrium_merge then runs through per-row cap-recheck (per Compromise #2 sync-replica sub-narrative).
Multiplicative budget — The Phase-2a Inv-8 cumulative iteration budget. Computed at registration time as the worst-case product of ITERATE.max values and non-isolated CALL callee bounds along any DAG path through the handler. Caps the worst-case iteration space so nested ITERATE + CALL combinations cannot trigger combinatorial explosion. CALL { isolated: true } resets the cumulative for the callee frame (the callee runs under its own grant's bound). Default registration-time bound: DEFAULT_INV_8_BUDGET = 500_000. Exceeding fires E_INV_ITERATE_BUDGET at registration; the runtime flat budget (DEFAULT_ITERATION_BUDGET = 100_000) remains as a Phase-1 backstop.
IVM — Incremental View Maintenance. Benten keeps materialized views up to date via change subscriptions; common reads hit them in O(1).
KVBackend — The storage trait in benten-graph that abstracts over the key-value store. The Phase-1 implementation is redb; a future WASM implementation will fetch content-addressed Nodes from peer storage.
napi-rs — The Rust-to-Node.js binding framework. v3 compiles the same codebase to native and WASM targets and auto-generates TypeScript .d.ts files.
NoAuthBackend — The default benten-caps policy: allows all writes without capability checks. Ships as the engine's default so embedded / local-only users pay no capability-system overhead.
Node — The basic unit of Benten storage. A Node has a label, properties (key-value pairs), and a CID derived from its bytes.
Operation Node — A Node representing one of the 12 operation primitives. Operation subgraphs are DAGs of Operation Nodes connected by control-flow Edges.
Operation subgraph — A handler represented as a DAG of Operation Nodes. Bounded (max depth, max fan-out, max Nodes, iteration budget). Deterministically evaluable. Content-hashed. Immutable once registered.
Plugin DID — The cryptographic identity an app-level plugin runs under. Generated at install time; distinct from the user's DID and from any other plugin's DID. Receives an attenuated UCAN delegated from the user at install and acts as the principal under which the engine evaluator walks the plugin's subgraph. Capability checks fire against the plugin's UCAN chain rather than the user's. Phase-4-Foundation refinement (D-4F-12 + D-4F-16 post-R1-triage): plugin-DID is UCAN audience AND constrained issuer within manifest shares envelope (NOT just an audience handle; the "just an audience" framing was too narrow). NO device-DID-style attestation chain back to user-DID; plugin-DID has no inherent authority — its issuance is bounded by source plugin's manifest shares policy. did:key:... shape with engine-held Ed25519 signing keypair (fresh OsRng keypair per install; no derivation from user-DID per sec-4f-r1-13). See "App-level plugin," PLUGIN-MANIFEST.md §2.
Plugin library subgraph — Phase-4-Foundation per D-4F-14 + plugin-arch-r1-6: a subgraph at the canonical anchor system:plugin_library:<user_did> that holds all installed plugin versions + forks (content-addressed; cheap). Engine-init walks this anchor. Lives separately from "active references" (the per-device-local CURRENT pointers in a Loro Map per ratification #2 that name which version is in use right now). Switch-version = update-active-reference via per-device Loro Map write; this does not change the library subgraph. See PLUGIN-MANIFEST.md §5 + ADMIN-UI.md §3.4.
Private namespace — Phase-4-Foundation cap-scope of shape private:<plugin_did>:* per plugin-arch-r1-10 + sec-4f-r1-7. Implicitly shares: none regardless of declared policy; enforced by crates/benten-caps/src/plugin_delegation.rs::is_private_namespace_cap (composed with manifest-envelope chain validation at crates/benten-caps/src/manifest_envelope_chain_validation.rs). Provides plugins a sovereign space (AI agents' working memory, intermediate state, scratchpads, in-progress workflow drafts) without breaking the cross-plugin sharing model — same UCAN machinery, different policy. See PLUGIN-MANIFEST.md §6 + SECURITY-POSTURE.md "Plugin trust model."
Plugin manifest — The signed, install-time-consented declaration that bounds an app-level plugin's authority. Two halves: requires (caps the plugin needs to function) and shares (delegation policy for what other plugins are allowed to receive from this one). Both are signed by the plugin author so they cannot drift post-install. The user reviews the manifest at install and consents to the envelope, not to each runtime access. Schema lands in Phase 4-Foundation (full schema with install-time consent flow + per-plugin DID minting + runtime delegation envelope enforcement + private-namespace caps + DAG-shaped versioning + meta-plugin composition + workflow↔plugin unification). NO manifest schema versioning field per D-4F-13 (CID covers shape; pull-not-push obviates schema-version field). Distinct from "Module manifest" (which describes wasm bundles for SANDBOX). See "App-level plugin," "Manifest envelope," PLUGIN-MANIFEST.md for the FULL Phase-4-Foundation spec.
peer_did_set — The BTreeSet<Did> attribution slot on AttributionFrame, populated at the Loro CRDT merge boundary. Some(set) when the frame originates from a sync merge (captures contributing peer DIDs observed via benten_sync::crdt::LoroDoc::winning_attribution); None for purely-local writes. The peer-node-id → DID resolution lives in crates/benten-engine/src/engine_sync.rs against the local trust store. See "Attribution."
PublisherRegistry — The Phase-3 durable manifest-signing publisher key registry per Compromise #21 closure. Maps publisher DIDs to Ed25519 public keys; consulted at module-manifest verification time as the fallback path when the manifest's UCAN proof-chain doesn't already attest the publisher. See SECURITY-POSTURE.md Compromise #21.
redb — The Phase-1 embedded key-value store: pure Rust, ACID, MVCC (concurrent readers with single writer), crash-safe via copy-on-write B-trees.
Renderer trait / Renderer backend — Phase-4-Foundation abstraction (pub trait Renderer at crates/benten-platform-foundation/src/materializer.rs:548) that lets multiple concrete impls (BrowserRender for shape (b); TauriRenderer in benten-renderer-tauri for shape (c); future native-toolkit renderers like Slint or Iced) plug into the same materializer pipeline. The deployment shape determines which renderer backend ships in the binary, not what the engine internals look like. The pattern mirrors KVBackend (storage swap) + materializer-as-generic — "like storage, materializers should be generic + render-to-UI generic + Tauri/Electron/native swappable" (Ben's 2026-05-11 framing). Renderer impls are compile-time linked engine extensions per CLAUDE.md baked-in #19; their trust posture is "you compiled this in." See "Embedded webview," ARCHITECTURE.md §benten-platform-foundation.
Schema-driven rendering — Phase-4-Foundation pipeline that takes a schema-subgraph (built from the 8-label typed-field-Node vocabulary — FieldScalar / FieldEnum / FieldUnion / FieldList / FieldMap / FieldObject / FieldRef / SchemaRoot) plus a content CID and produces a rendered UI surface via the materializer pipeline. Schemas are themselves subgraphs of typed-field Nodes — same content-addressing + same composition machinery as handlers + plugins. Ingest dialects (JSON Schema, OpenAPI, GraphQL SDL) are admin-plugin workflows that lower to this canonical typed-field-Node form per D-4F-NEW-TYPED-FIELD-NODE-VOCAB. See SCHEMA-DRIVEN-RENDERING.md for the full spec + the 1-to-1 user-facing-label-to-engine-vocabulary mapping table.
SelfRevocation attestation — Phase-4-Foundation MVP key-rotation mechanism (post-R1-triage ratification #6). Old-key signs a timestamped revocation attestation marking itself as revoked; propagates via Atrium sync; peers reject content signed by the revoked key after the revocation timestamp. New-key trust is NOT transferable from old key — re-established out-of-band (same channel used for initial bootstrap). The MVP doesn't defeat the purpose of rotation (it doesn't ask receivers to trust the old key for new-key establishment) — it just propagates revocation cleanly. Kith (working name; Phase 5+ exploratory) would supersede this MVP by providing web-of-trust attestation chains for non-compromise rotations. See docs/future/kith-decentralized-identity.md.
sync_hop_depth — Inv-14 device-grain extension; bounded merge-hop counter (default cap SYNC_HOP_DEPTH_CAP = 8, mirrors Inv-4's sandbox-depth precedent). Increments at each CRDT merge hop; the typed ErrorCode::SyncHopDepthExceeded fires at the merge seam when a merge would push the depth past the cap. Defends against unbounded replay across an Atrium peer mesh. See INVARIANT-COVERAGE.md §"Inv-14 Phase 3 device-grain extension."
Thin compute surface — The Phase-3 wasm32 deployment shape (browser tab + edge worker / WinterTC-compatible runtime) that is NOT a sync participant. Stateless reads against snapshot data; writes go via fetch to a Full peer. Excludes Loro / iroh / SANDBOX / direct sync state from the bundle. IndexedDB persistence (where target supports it) is for snapshot cache + manifest-store, NOT full sync state. Contrast with "Full peer."
SANDBOX — The WASM computation escape hatch (landed Phase 2b, wasmtime-backed, fuel-metered, no re-entrancy, default 1 MiB output ceiling per call).
serde_ipld_dagcbor — The CBOR serialization crate Benten uses. Deterministic by default (sorts map keys); IPLD-native.
STREAM — A primitive (landed Phase 2b) producing partial/ongoing output with back-pressure. For Server-Sent Events, WebSocket messages, LLM token streams, progress updates.
Subgraph — See "Operation subgraph."
SUBSCRIBE — A primitive (landed Phase 2b) providing reactive change notification. The base primitive on which IVM views, sync delta propagation, and event-driven handlers all compose.
System zone — The reserved namespace for engine-internal Nodes (capability grants, version-chain metadata, IVM view definitions, subscriber bookkeeping). Labels and node IDs prefixed with system: are off-limits to user subgraphs. Phase-2a Inv-11 enforces this at three layers: registration-time literal-CID rejection in benten-eval::invariants::system_zone, runtime resolved-label probing in benten-engine::primitive_host, and storage-layer defence-in-depth in benten-graph::redb_backend::guard_system_zone_node. Reads collapse to Ok(None) on the user-visible surface (symmetric with a backend miss); writes fire E_INV_SYSTEM_ZONE. System-zone Nodes are only writable through dedicated engine APIs (engine.grantCapability, engine.createView, …).
TOCTOU — Time-of-check-to-time-of-use. The security class where a permission check succeeds but the underlying permission changes before the protected action runs. Phase-2a hardens five TOCTOU points across capability enforcement (commit, CALL entry, ITERATE boundary, WAIT resume, wall-clock revocation ceiling).
Transaction primitive — An engine-provided begin/commit/rollback cycle wrapping all WRITEs in a subgraph evaluation. If any WRITE fails, all WRITEs in the transaction roll back atomically.
Typed-CALL — The Phase-3 dispatch surface for the 10 engine-known fixed-shape ops (ed25519_sign / ed25519_verify / keypair_generate / keypair_from_seed / blake3_hash / multibase_encode / multibase_decode / did_resolve / ucan_validate_chain / vc_verify). Reserved handler-id namespace engine:typed:; closed registry (no user-extensibility — see TYPED-CALL.md). Each op declares required cap + determinism class + input/output shape. Consumed via the standard CALL primitive with target = engine:typed:<op> (Rust path goes through <Engine as benten_eval::PrimitiveHost>::dispatch_typed_call; Engine::dispatch_typed_call_public is the direct-invocation helper) or via engine.typedCall() sugar in the napi/TS DSL.
UCAN — User-Controlled Authorization Networks. Capability-based auth tokens. Phase 3 ships UCAN as a benten-caps policy backend alongside the default NoAuthBackend and the existing GrantBackedPolicy.
UCAN-blobs handler — The Phase-4-Meta-Core G-CORE-3e custom-ALPN handler that validates the requester's AuthorizationGrant per request before dispatching to upstream iroh_blobs::provider::handle_connection. Flavor B per-request UCAN check (Spike A2 finding) — a previously-validated grant is NEVER trusted across requests. Six-arm validation pipeline (fail-closed at first reject): unresolvable-peer short-circuit → audience binding (Spike A2 zero-conversion: iroh EndpointId IS ed25519_dalek::VerifyingKey, no parse) → time-bounded UCAN validity → revocation observance → binding-sig verification → scope check. ALPN identifier benten/ucan-blobs/1. Lives at crates/benten-sync/src/ucan_blobs_protocol.rs::UcanBlobsHandler. See SECURITY-POSTURE.md "UCAN-gated iroh-blobs custom-ALPN handler — per-request validation."
TwoCidStore — The Phase-4-Meta-Core G-CORE-3e wave-3e adapter wrapping a ciphertext-bytes backing store + the two-CID mapping (plaintext_cid → ciphertext_cid → bytes). The named iroh-blobs FsStore swap-point at ciphertext_bytes is the production wire-up boundary (the wave-3e in-memory BTreeMap swaps to iroh_blobs::FsStore at a future integration wave). Lives at crates/benten-sync/src/two_cid_store.rs. Couples G-CORE-3d's benten_graph::two_cid_map::TwoCidMap partition-keyed lookups at the storage seam. See SECURITY-POSTURE.md "UCAN-gated iroh-blobs custom-ALPN handler."
Version chain — Benten's opt-in history pattern: Anchor + Version Nodes + NEXT_VERSION edges + CURRENT pointer. History = traverse. Undo = move CURRENT. Sync (Phase 3) = exchange version Nodes. Ephemeral data does not pay versioning cost.
WAIT — A primitive (landed Phase 2a) that suspends execution until an external signal arrives or a duration elapses. The engine produces an ExecutionStateEnvelope at suspend time; resume runs a 4-step integrity + principal + pin + capability protocol before continuing.
wasmtime — The WASM runtime for SANDBOX (landed Phase 2b at v43.0.2). Rust-native, Bytecode Alliance, fuel-metered, Component Model support.