FROZEN VOCABULARY SOURCE

Canonical Kernel

The authoritative governance vocabulary for deterministic trust infrastructure. Terms are frozen. Invariants are immutable. Interpretation is external.

Document RFC-VK-GLOSSARY-2026-001
Status AUTHORITATIVE — CANONICAL
Authority L0 Human Governance
Issued February 3, 2026
RFC-VK-GLOSSARY-2026-001 FINAL — IN FORCE Effective: Immediate upon publication

Scope

This document defines the canonical governance vocabulary, authority stack, cross-system mappings, and file extension policy for the ValidKernel ecosystem. All Kernel Documents, LDS payloads, and execution environments SHALL conform to the definitions herein.

Conformance Language

The key words MUST, MUST NOT, SHALL, SHALL NOT, SHOULD, and MAY are to be interpreted as described in RFC 2119.

Section 2 — Normative

Governance Glossary

Eight canonical terms define the entire ValidKernel vocabulary. These terms are frozen. Nothing in the ecosystem is allowed to redefine them.

2.1
Authority
The exclusive right to approve, deny, or constrain execution.
  • L0 or L1 only
  • Cannot delegate to L2
2.2
Authorization Token
A cryptographically verifiable artifact asserting granted authority.
  • Immutable
  • Time-bounded
  • Scope-limited
2.3
Kernel
A deterministic validation engine that enforces invariants.
  • Stateless
  • Non-executing
  • Fail-closed
2.4
Proposer
An untrusted actor that submits execution requests.
  • Cannot authorize
  • Cannot validate
  • Bounded execution
2.5
Executor
A deterministic worker that performs an atomic operation.
  • No decisions
  • No authority
  • Fully auditable
2.6
Policy
A declarative constraint evaluated by the Kernel.
  • Immutable once issued
  • Pre-execution eval
2.7
Invariant
A non-negotiable rule enforced by the Kernel.
  • Global
  • Versioned
  • Immutable
2.8
Audit Log
An append-only record of all validated actions.
  • Immutable
  • Tamper-evident
  • Chronological
Section 3 — Informative

Authority Stack

Authority flows downward only. No component can grant itself authority.

L0 — HUMAN AUTHORITY │ Sets policy │ Approves scope │ Never executes │ L1 — KERNEL AUTHORITY │ Validates invariants │ Enforces policy │ Never proposes │ L2 — PROPOSER │ Requests execution │ Operates within bounds │ L3 — EXECUTORS Perform atomic actions No authority
L0
Human Authority
Sets policy, approves scope, never executes. The origin of all authority in the system.
L1
Kernel Authority
Validates invariants, enforces policy, never proposes. Mechanical enforcement only.
L2
Proposer
Requests execution, operates within granted bounds. Untrusted by design.
L3
Executors
Perform atomic actions. No authority. No decisions. Fully deterministic.
Section 4 — Normative

Crosswalk Matrix

Maps each governance concept across four system layers, preventing semantic drift and enabling fast audits.

Concept Glossary Term Kernel Invariant Kernel Document LDS Payload
Authority Authority KRN.IV.01 header.authority _lds.authority
Validation Kernel KRN.IV.02 validation_block n/a
Execution Executor KRN.IV.03 executor_spec worker_id
Scope Policy KRN.IV.04 permissions ruleset
Audit Audit Log KRN.IV.08 audit append_log
Section 5 — Normative

Canonical File Extension Policy

Two extensions. One carries authority. One carries data. The distinction is non-negotiable.

.ck
Canonical Kernel Document
Used exclusively for fully authoritative Kernel Documents that are signed by L0 or L1 authority, contain enforceable policy or invariants, and are eligible for audit or legal review.
If it's .ck, the kernel treats it as law.
  • L0 Commands
  • Kernel Invariant Specifications
  • Governance Directives
.lds.json
Payload Profile
Used for kernel payloads, deterministic data inputs, and non-authoritative execution data. Payloads describe work. They never authorize it.
LDS payloads SHALL NOT assert authority.
  • Kernel payloads
  • Deterministic data inputs
  • Non-authoritative execution data
Sections 6 & 7

Stability Guarantees

The rules that govern this vocabulary cannot be weakened. Only extended.

  • Glossary terms SHALL NOT be redefined.
  • Invariants SHALL NOT be removed.
  • Extensions SHALL remain backward compatible.

Security Consideration

Misclassification of authority-bearing documents is a critical failure. A data file cannot impersonate a governance directive. Format confusion enables privilege escalation.

Systems MUST reject .lds.json files attempting to assert authority fields reserved for .ck documents.
Section 8

Status

This document is FINAL and enters force immediately upon publication.

RFC-VK-GLOSSARY-2026-001 FINAL — IN FORCE