aslice Nomenclature — The Words of the Project

State, identity, privilege, and recovery contracts: STATE-AND-RECOVERY. Protected-volume patching: SYSTEM-VOLUMES. These specifications do not establish completed implementation or platform validation.

• Status: Reference v0.17 — September 2026
• Companions: DESIGN.md, PACKAGE-FORMAT.md, AUTHORING.md, BUILD-INFRA.md, ORCHARD-POLICY.md, REPOSITORIES.md, MANUAL.md, SETUP.md, TOOLCHAIN.md
• Audience: every reader. When a document uses a word you do not know, it is defined here — or should be.

A project that names everything owes its readers a place where the names are explained. This is that place. Terms are defined once, in one line where possible, with a pointer to the document that owns the term. Section links identify the owning contract; the current linked documents take precedence over historical companion-version pins.

1. Conventions

• Bold introduces the term being defined.
• (DOC §x) names the document that defines the term authoritatively; the definition here is a summary, and the pointer wins on any disagreement.
• cf. points at a related term you probably also want.
• Not to be confused with separates terms that collide in casual speech.

2. Project vocabulary

The words we made up, or made ours.

slice — the binary package: a payload and canonical metadata delivered in a zstd-compressed archive with a detached signature; vendor payloads may be universal. Also the ecosystem's name and the pun the project is built on. (DESIGN §6.2 and DESIGN §9.)

orchard — a Git repository of formula directories; compiled into a signed distribution repository. (README; REPOSITORIES §1.)

formula — the build description: a TOML file naming source, dependencies, phases, and invariants. Lives in a repository; produces slices. (DESIGN §6.1; PACKAGE-FORMAT §3.)

repository — a signed static distribution tree of indexes, authenticated recipes, manifests, and blobs. repo.toml configures its namespace and author metadata. (REPOSITORIES §1; STATE-AND-RECOVERY §1.)

official / core / extended — the official orchard is the project-run repository (and the top trust level, REPOSITORIES §3); core (~300 packages) and extended (~2,000) are its two tiers, with different acceptance bars and prebuild guarantees. (ORCHARD-POLICY §2; DESIGN §9.4.)

flavor — the µarch build of a slice: v1 (SSE2 baseline, every 64-bit Intel Mac), v2 (SSE4.2/POPCNT), v3 (AVX2). A formula declares which flavors it ships; the installer picks the best one your CPU understands, detected by sysctl at install time. (DESIGN §4.2; PACKAGE-FORMAT §3.3; MANUAL §4.2.) Not to be confused with variant.

store — <prefix>/store/<artifact-hex>/, immutable artifact materializations verified against canonical manifests and installed-byte receipts. (STATE-AND-RECOVERY §1.)

generation — an exact package view; its pointer switches atomically, while associated external effects require a journaled recovery transaction. (STATE-AND-RECOVERY §5.)

profile — <prefix>/profiles/<name>, the merged symlink forest (bin/, lib/, share/, …) that points at the current generation: /opt/aslice/profiles/default/bin is what your shell's PATH actually sees. (DESIGN §8.1 and DESIGN §8.2.)

shim — the multicall executable that sits ahead of the profile on PATH and dispatches a bare tool name (php) to the selected runtime stream; exec-only, with no package knowledge and no state of its own. (DESIGN §8.5 and DESIGN §12.9.) Not to be confused with aslice-system.

aslice-system — the privileged helper: the small sudo-authorized executable that performs the privileged half of an operation — kext placement, system patches, elevated grafts — and nothing more. (DESIGN §10.4 and DESIGN §12.7.)

stream — one version line of a multi-version runtime: php 8.4 is a stream. Streams are selected per session, per project, or per profile default, and extensions bind to one. (DESIGN §12.9; MANUAL §6.1; SETUP §2.3.)

leaf — a package with no installed reverse dependencies; this does not determine whether it was explicitly requested. on_request roots govern autoremove. (DESIGN §8.4.)

tombstone — the permanent record a removed formula leaves in a repository index: name, final version, reason, replacement — so historical snapshots and old locks resolve forever; the aslice orchard tombstone verb writes one. (PACKAGE-FORMAT §3.14; ORCHARD-POLICY §8; DESIGN §12.14.) (An earlier edition of this entry used the word for a negated declaration in the setup file — "this shall not be present." That feature does not exist: aslice machine apply asserts what the file declares and never removes what it does not mention, except under the bounded --prune mode. SETUP §3; DESIGN §12.13.)

wishlist — the user-authored package constraints in a machine file, resolved into exact artifacts. (SETUP §2.)

lock — aslice.lock, the recorded resolution of a profile: exact versions and hashes, replayable with aslice apply. (PACKAGE-FORMAT §7.)

index snapshot — a repository's frozen index at a commit, shipped as zstd JSON snapshots plus diffs. Apply resolves against snapshots, not against moving Git heads. (DESIGN §9.6; SETUP §3.2.)

plan — the output of resolution: the exact set of fetch, build, link, and remove steps an apply will perform, shown before anything happens. (DESIGN §12.1 and DESIGN §12.2; SETUP §3.2.)

farm — the CI build fleet as a whole. (BUILD-INFRA §1 and BUILD-INFRA §5.)

coordinator — the farm's scheduler: hands out jobs, collects results, keeps the ledger. (BUILD-INFRA §5 and BUILD-INFRA §6.)

agent — a build host: a real Mac of a known µarch that executes jobs under Seatbelt. (BUILD-INFRA §5 and BUILD-INFRA §7.2.)

signing host — the dedicated networked release Pi: automatically verifies publisher-authenticated candidates, owner-merge authorization, gates, and retained signing state, then signs slices, targets, and snapshots with distinct keys; never runs package builds or supplied scripts. A separate offline Pi holds root authority. (BUILD-INFRA §5 and BUILD-INFRA §7; KEY-RUNBOOK §1.)

publisher — the restricted VM on the owned Mac Pro that checks gates, automatically delivers authenticated candidates, verifies returned signatures, and serializes atomic publication of complete releases. Holds the timestamp key and publication credentials, but no root or release private keys. (BUILD-INFRA §5 and BUILD-INFRA §9.)

job / result — the JSONL work unit handed to an agent and the signed outcome handed back. (BUILD-INFRA §2.)

evidence builder — the independent second builder whose output is compared bitwise against the first: the reproducibility oracle. (BUILD-INFRA §7.4.)

quarantine — the untrusted staging area every agent result lands in; nothing is ever served from it, and publication requires the six gates, automatic release signing, and publisher verification. (BUILD-INFRA §7.1.)

genesis — the from-nothing bootstrap: building the toolchain that builds the toolchain, from a golden image upward. (GENESIS §1 and GENESIS §2; DESIGN §14.)

vendored sources — the blob archive of upstream tarballs the project keeps so that dead URLs cannot kill old builds. (DESIGN §9.6; GENESIS §3.)

dashboard — the farm's public web dashboard at aslice.sh/dashboard: build status, freshness, quarantine — farm-side metrics only; there is no user telemetry to show. (DESIGN §13.4; BUILD-INFRA §10; ORCHARD-POLICY §9.)

transparency log — the append-only, signed record of everything published; the public answer to "who released this, when." (DESIGN §13.4; BUILD-INFRA §7.5.)

build_id — the compatibility key computed from declared build inputs; not a digest of output bytes. artifact_id identifies the canonical manifest and payload; blob_digest identifies the delivered archive. (STATE-AND-RECOVERY §1.)

ABI epoch — a declared break in binary compatibility for a package (abi = true variants rebuild the reverse-dependency cone). (DESIGN §7.3; AUTHORING §5.)

provenance — the recorded lineage of a slice: source hash, formula commit, builder, evidence. Checked at the pre-gate. (DESIGN §9.5; BUILD-INFRA §7.)

origin=local-build — the attribution label on a slice built on your machine rather than fetched; never confused with a farm build. (BUILD-INFRA §3 and BUILD-INFRA §4.)

state DB — the client SQLite projection recording what is installed, why, and from where; durable choice/history records reconstruct it. Cache, protected system state, coordinator, publisher, and release signer use separate databases (DATABASE). (DESIGN §8.1; REPOSITORIES §11.)

pin — a version pin (aslice pin) holds an installed package at its exact release, and the lock records it (MANUAL §3.3; PACKAGE-FORMAT §7). Not to be confused with hash-pinning: every source artifact's sha256 is declared in the formula and countersigned in the index (AUTHORING §1; DESIGN §10.2).

ride — a ride-along utility: a small package that installs alongside another and is governed by the parent's lifecycle. (DESIGN §12.9; PACKAGE-FORMAT §3.13.)

extension — a package bound to one runtime stream: php-redis, ruby-pg. Declared with [extension], loaded through the runtime's scan dir, rebuilt when the stream's extension-ABI epoch bumps. (PACKAGE-FORMAT §3.13; DESIGN §12.9; MANUAL §6.3.)

service — a package-managed launchd unit, declared by the formula and driven by aslice service. (MANUAL §7; DESIGN §12.8.)

system package / system patch — effect-derived privileged capabilities; root services and kexts require system, Apple-file replacement requires system-patch. /System and boot-critical targets remain refused. (STATE-AND-RECOVERY §3; SYSTEM-VOLUMES.)

aslice-machine.toml / machine apply / machine export / machine import / adopt — the declarative core: the file that says what you want, the command that makes it so, the command that writes the file from reality, the command that translates a Brewfile into the file, the command that claims an existing Homebrew install as a plan. (SETUP §2 and SETUP §5; DESIGN §12.13; MANUAL §10 and MANUAL §11.)

graft — a vendor installer script, declared in the formula ([[binary.graft]]), hash-pinned, approved by the user per package, sandboxed to its declared behavior, and recorded for rollback; the sole exception to "no package code at install". (DESIGN §12.15; PACKAGE-FORMAT §3.11; MANUAL §4.5.) cf. behavior manifest, rehearsal.

3. Trust and security

TUF — The Update Framework: the roles-and-thresholds design our repository metadata signing follows. (DESIGN §10.2; REPOSITORIES §5.)

TOFU — trust on first use: the first fetch of a repository key is the moment of trust; afterwards, changes must be explained. (REPOSITORIES §4.)

countersignature — a second, project-held signature: over a community repository's key it earns the verified trust level, and the index countersigns every source hash. (REPOSITORIES §3; DESIGN §10.2.)

trust level — a repository's standing: official, verified, third-party, or local. Capabilities follow the level. (REPOSITORIES §3; DESIGN §12.3.)

capability — a named permission a formula may request (system-package, system-patch); granted per repository, per level, never silently. (DESIGN §12.7 and DESIGN §12.11; REPOSITORIES §3.)

per-repo grant — the recorded user decision that this repository may exercise that capability on this machine. (REPOSITORIES §3 and REPOSITORIES §7.)

signer pinning — remembering which keys may sign a repository's metadata, or which Developer ID may sign a vendor artifact, and refusing surprises. (REPOSITORIES §5; ORCHARD-POLICY §12.)

notarization — Apple's server-side ticket stapling for Developer-ID software; aslice's own bootstrap trust is notarization plus signature, and a vendor artifact's notarization status is pinned in provenance. (DESIGN §12.12 and DESIGN §9.5.)

Gatekeeper — macOS's first-launch policy layer; on 10.11–12 it still decides what may open. (DESIGN §12.12.)

XProtect — Apple's built-in signature-based malware list; present on all supported systems. (BUILD-INFRA §7.5.)

key ceremony — recorded generation or transition of root authority. Initial setup is owner-operated; witnesses and independent custodians are not launch requirements. (KEY-RUNBOOK §2.)

threshold root — TUF root metadata requiring signatures from k distinct keys out of n authorized root keys, not a split private key. Initial custody is 1-of-1; independent multi-party custody can follow through authenticated rotation. (DESIGN §10.2; KEY-RUNBOOK §1.)

minisign — the small Ed25519 signature tool used for human-legible signatures. (KEY-RUNBOOK §1; DESIGN §10.2.)

Ed25519 — the elliptic-curve signature scheme used throughout; small keys, fast verification. (DESIGN §10.2; KEY-RUNBOOK §1.)

OpenPGP / WKD — the older signature ecosystem and its Web Key Directory discovery; used where upstreams already speak it. (REPOSITORIES §5.)

revocation / blocking event / re-pin / repo frozen — the failure vocabulary: a key is revoked, a blocking event halts publishes, users re-pin to successor keys, a compromised repository is frozen. (KEY-RUNBOOK §4; REPOSITORIES §4 and REPOSITORIES §8.)

4. Building and packaging

aslice-toolchain / stage0 / stage1 — the self-hosted compiler bundle (Clang, LLD or ld64, a modern libc++, CMake, Ninja, pkgconf) every build uses; stage0 is built by Apple's host Clang against the oldest archived SDK, stage1 rebuilds the toolchain with itself, and both stages are archived forever. (TOOLCHAIN.md; DESIGN §4.3; GENESIS §1 and GENESIS §3.)

variant — a formula's declared feature switch: +ssl, +x265. Marked abi = true, a variant joins the build identity and its flip rebuilds the reverse-dependency cone; abi = false stays link-compatible. (AUTHORING §5; PACKAGE-FORMAT §3.5; DESIGN §7.1.) Not to be confused with flavor.

livecheck — the formula stanza that knows how to ask upstream "is there a newer release?" (PACKAGE-FORMAT §3.15; AUTHORING §7.1.)

autobump / bump-pr — the machinery that turns a livecheck hit into a version-bump pull request. (ORCHARD-POLICY §9; BUILD-INFRA §6.2; AUTHORING §7.1.)

cooldown / throttle — the rate limits that keep autobump polite: minimum time between bumps of one formula, maximum bumps per sweep. (ORCHARD-POLICY §9.)

revision vs version — version is upstream's number; revision is ours, bumped when the formula changes but the source does not. (PACKAGE-FORMAT §4.4.)

min_os / max_os — the macOS range a slice claims to support; enforced at install. (PACKAGE-FORMAT §3.2.)

payload-only — a slice with no build phase and no grafts: repackaged upstream bits. The default even for vendor binaries. (ORCHARD-POLICY §12; PACKAGE-FORMAT §3.11.)

vendor binary / redistribute — upstream's own build, repackaged and hosted by the farm (redistribute = true) or fetched from the vendor at install (redistribute = false); the cask-shaped case. An installer script the software genuinely needs is declared as a graft, never run silently. (ORCHARD-POLICY §12; DESIGN §12.4 and DESIGN §12.15.)

universal payload / 32-bit — a slice carrying both i386 and x86_64 slices of a library, for the shrinking set that still needs i386. (DESIGN §2.2 and DESIGN §12.4; PACKAGE-FORMAT §3.11.)

ABI gate / symbol fingerprint — the automated check that a rebuilt library still exports what it exported; the fingerprint is the sorted symbol list it compares. (BUILD-INFRA §6.1 and BUILD-INFRA §7.1; AUTHORING §5.2.)

install name / compatibility version — the Mach-O dylib identity and its declared ABI number; both must survive a rebuild. (DESIGN §7.3.)

reproducibility classes — bitwise (identical output), normalized (identical after known fix-ups), unreproducible (declared, tracked, not hidden). (BUILD-INFRA §7.3.)

ctx / phases — the build context object passed through the formula's ordered phases (fetch, patch, configure, build, check, install). (AUTHORING §4; PACKAGE-FORMAT §6.1.)

Seatbelt profile — the sandbox policy a build runs under; the filesystem and network it may touch. (DESIGN §10.5; BUILD-INFRA §2.)

behavior manifest — the complete declared effect set for a graft. Approval binds its digest; an enforced isolated staging boundary and a helper-validated commit constrain execution. Network access is refused in v1; rehearsal is evidence, not containment. (STATE-AND-RECOVERY §4; PACKAGE-FORMAT §3.11.)

rehearsal — the farm running a graft-bearing install in a per-OS VM under instrumentation and diffing the observed behavior against the declared behavior manifest; only an exact match gets the manifest signed. Also runnable locally via aslice orchard ci. (ORCHARD-POLICY §10; DESIGN §12.15; BUILD-INFRA §6.4.)

buildroot / DESTDIR staging — the throwaway tree a build installs into before the payload is harvested. (AUTHORING §4.)

ccache / SOURCE_DATE_EPOCH / prefix-mapping — the reproducibility toolkit: compiler cache, clamped timestamps, rewritten embedded paths. (ORCHARD-POLICY §15; BUILD-INFRA §3; DESIGN §11.)

smoke test — the post-install "does it run at all" check a formula declares. (AUTHORING §6.)

matrix / lanes — the farm's build grid (µarch × macOS) and its queues: freshness, trunk, backfill. (BUILD-INFRA §8 and BUILD-INFRA §6.2.)

lease / pre-gate / backlog sweep — the coordinator's work mechanics: a job's exclusive claim, the checks before publish, the periodic mop-up of stale work. (BUILD-INFRA §6.3 and BUILD-INFRA §7.5.)

5. macOS platform terms

SIP — System Integrity Protection: the kernel policy that makes /System and friends read-only even to root. Present but older on our systems; the system-patch capability exists because of it. (DESIGN §12.7 and DESIGN §12.11.)

kext — a kernel extension; signing rules tighten across our range. (DESIGN §12.7; PACKAGE-FORMAT §3.12.)

launchd / plist / user vs root domain — Apple's service manager, its XML/JSON property lists, and the per-user versus system-wide contexts a service may live in. (MANUAL §7; DESIGN §12.8.)

defaults domain — a preferences namespace addressed by defaults(1). (SETUP §2.6.)

/etc/shells / chsh — the list of valid login shells and the tool that changes yours; both matter when aslice ships a shell. (SETUP §2.5.)

System keychain / SecureTransport — the OS credential store and Apple's TLS stack. aslice's own TLS clients use their private bundle and packaged crypto stack; System-keychain updates are a separate opt-in operation. (DESIGN §12.10; MANUAL §8.)

dyld / dyld shared cache — the dynamic linker and its prelinked cache of system libraries. (DESIGN §7.3 and DESIGN §11.)

Mach-O / dylib / framework — the executable format, the shared-library form, and the bundled-library directory form. (DESIGN §7.3.)

universal binary — one file containing several architectures' code, lipo-ed together. (PACKAGE-FORMAT §3.11; DESIGN §12.4.)

i386 / x86_64 — 32-bit and 64-bit Intel; 10.11–12 is the last range where both matter. (DESIGN §1.2 and DESIGN §2.2.)

SSE4.2 / POPCNT / AVX2 / µarch — instruction-set levels and microarchitecture: the farm builds per-µarch so a Core 2 Duo and a Coffee Lake each get code that fits. (DESIGN §4.2.)

Core 2 Duo / Nehalem / Ivy Bridge / Haswell / Coffee Lake — the Intel generations our µarch lanes are named for. (DESIGN §4.2; BUILD-INFRA §5.)

APFS / HFS+ / rename(2) — the two filesystems in range and the atomic-swap syscall generations rely on. (DESIGN §4.1 and DESIGN §8.3.)

golden image / createinstallmedia / Recovery — the pristine OS install the farm starts from, Apple's installer-to-USB tool, and the recovery partition. (GENESIS §2; BUILD-INFRA §8.)

Developer ID / pkg / dmg / LSMinimumSystemVersion — Apple's signing program, its installer package and disk-image containers, and the Info.plist floor for what an app will launch on. (DESIGN §12.4; PACKAGE-FORMAT §3.11; ORCHARD-POLICY §12.)

6. Acronyms

7. The Homebrew translation table

For readers arriving from the other orchard. The left word is theirs; the right is ours.

8. The §-citation conventions

Active cross-document citations are relative Markdown links whose labels name the document and section. Bare section numbers refer only to the current document. There are no implicit cross-document exceptions.

Cited sections have explicit semantic anchors independent of numbering and heading wording. Keep existing headings and generated destinations; link separate destinations separately rather than pointing a range at its first section. Historical citations, literal examples, captured originals, and Pandoc command references retain their original syntax. Archive wrappers still follow the active citation rule.

Long documents with at least ten second-level sections include compact section navigation. Use tables for compact mappings, paragraphs or subsections for extended explanations, and language labels on code fences. Preserve Pandoc title blocks and definition lists. The offline checker and its exception boundaries are documented in CONTRIBUTING.

History

Historical labels and ordering below are preserved as recorded, including repeated version labels. They do not override the current specification.

Source document