Glossary and Alphabetical Index

Detailed definitions, significance, examples, and exact specification references for 229 specialized terms used by the Agent OS program.

Table of Contents

• Purpose and Scope
• How to Use the Glossary
• Alphabetical Index
• 0-9
• A
• B
• C
• D
• E
• F
• G
• H
• I
• J
• K
• L
• M
• N
• O
• P
• Q
• R
• S
• T
• U
• V
• W
• Z

Purpose and Scope

This glossary defines specialized terms that carry architectural, hardware, camera, cellular, security, manufacturing, legal, product, evidence, or program meaning in Agent OS. Common development terms such as commit, deploy, and firmware are omitted unless the program assigns them a narrower contract.

Definitions are normative only to the extent required by the linked specification. Where an industry term varies by vendor or jurisdiction, the entry states the Agent OS interpretation and points to the governing paragraph.

How to Use the Glossary

• Link to a term with GLOSSARY.md#term-...; do not duplicate a competing definition in another specification.
• Use the Used in links to find the exact normative paragraph or program section.
• Treat examples as illustrations, not as additional requirements unless the linked specification says otherwise.
• Add a term only with a definition, significance, example, and at least one exact specification reference.

Alphabetical Index

0-9: 3A (AE/AWB/AF)

A: A/B update · ABI (Application Binary Interface) · Action plan · Action provider · Action schema · Address-space identifier (ASID) · Agent shadow mode · Ambient authority · Anti-circumvention · Anti-rollback · APDU (Application Protocol Data Unit) · Assurance case · Attestation · Authority amplification · Autonomy budget

B: Backend conformance · Backpressure · Baseband · Binary blob · Black level · Black-box observation · Board dossier · Board package · BOM (Bill of Materials) · Boot chain · Boot handoff · BSP (Board Support Package) · Buffer collection

C: Calibration asset · Camera quality oracle · Capability · Capability attenuation · Capability derivation · Capability profile · Capability revocation · Capability routing · Carrier aggregation · Causal consistency · Causal parent · CCM (Color Correction Matrix) · CFA (Color Filter Array) · CHERI · Clean-room implementation · Clock domain · Command stream · Compatibility adapter · Compatibility cell · Compensating action · Complete mediation · Compositor · Conformance suite · Confused deputy · Contract backend · Control plane · Convergence gate · Copy-on-write · CRDT (Conflict-Free Replicated Data Type) · Cryptographic erasure · CSpace (Capability Space)

D: Data authority · Data plane · DCO (Developer Certificate of Origin) · Demosaic · Derived data · Device service · Device tree · DFM (Design for Manufacturability) · DFT (Design for Test) · Differential testing · DMA (Direct Memory Access) · DNG (Digital Negative) · Documentation volume · Documentation-first board · DRBG (Deterministic Random Bit Generator) · Driver domain · DVFS (Dynamic Voltage and Frequency Scaling) · DVT (Design Validation Test)

E: Effect class · EIS (Electronic Image Stabilization) · Entity · Entity resolution · eSIM / eUICC · Event sourcing · Evidence bundle · Evidence class · EVT (Engineering Validation Test) · Execution phase · Execution receipt · External-authoritative state

F: FAE (Field Application Engineer) · Fault injection · First frame · FlexLight · Frame pacing · Functional specification · Fuzzing

G: GCF (Global Certification Forum) · Golden trace · GPU command stream

H: HAL (Hardware Abstraction Layer) · Hardware compromise · Hardware oracle · Hardware root of trust · Hardware-bound key · HDR (High Dynamic Range) · Hotplug · HSM (Hardware Security Module) · Hybrid capability system

I: Idempotency key · IDL (Interface Definition Language) · IMEI and TAC · IMS, VoLTE, and VoWiFi · IntentBox · IOMMU (Input–Output Memory Management Unit) · IOVA (I/O Virtual Address) · IPC (Inter-Process Communication) · IRQ (Interrupt Request) · ISP (Image Signal Processor) · Itemized software

J: JDM (Joint Design Manufacturer) · Journal compaction

K: Key ceremony · Key wrapping

L: Lamport clock · Least authority · Legacy contamination · Lens shading correction · Local-first

M: Malleable software · Materialized view · MBIM (Mobile Broadband Interface Model) · Measured boot · Memory object · MIPI CSI-2 · MMIO (Memory-Mapped I/O) · Modem control protocol · MOQ (Minimum Order Quantity) · MTE (Memory Tagging Extension)

N: Native contract · Native microkernel · Non-exportable state · Normative requirement · NPU (Neural Processing Unit) · NRE (Non-Recurring Engineering)

O: ODM (Original Design Manufacturer) · OEM (Original Equipment Manufacturer) · OIS (Optical Image Stabilization) · Opaque record · Oracle · OSHWA certification

P: Page-table shootdown · Partner-required result · Pipeline handler · Pixel binning · PMIC (Power Management Integrated Circuit) · Priority donation · Priority inversion · Product quality tier · Property-based testing · Provider manifest · Provisioning · PTCRB · Public evidence bundle · Pure capability system · Purpose-bound view · PVT (Production Validation Test)

Q: QMI (Qualcomm MSM Interface) · Quality ceiling · Quality floor

R: RACI · Raw capture path · RAW image · Recovery environment · Redaction · Reference model · Refinement proof · Rehydratable state · Replacement milestone · Replay protection · Resource domain · Restricted evidence bundle · RF and SAR · Rollback · Rolling shutter · Root of trust

S: Sandbox · SBOM (Software Bill of Materials) · Scene graph · Secure boot · Secure element · Semantic checkpoint · Semantic journal · Semantic transclusion · Shutter lag · Sidecar · SideMemo · Signal and wait set · SMP (Symmetric Multiprocessing) · Source authority · Source class and source taint · Source escrow · Supply-chain provenance · Suspend-to-idle

T: Taint boundary · Target dossier · TCB (Trusted Computing Base) · TEE (Trusted Execution Environment) · Thermal envelope · TLB (Translation Lookaside Buffer) · TOCTOU (Time of Check to Time of Use) · Tone mapping · Trace harness · Trace replay · Transactional update · Trust ladder · Trust tier · Tuning profile

U: UEFI (Unified Extensible Firmware Interface) · User-space driver · UVC (USB Video Class) · UWB (Ultra-Wideband)

V: Vector clock · Verified boot · Vsync (Vertical Synchronization)

W: Wake source · Wire format · Working set

Z: Zero-copy

0-9

3A (AE/AWB/AF)

Definition. The combined camera control loop for auto-exposure, auto-white-balance, and autofocus. Each controller consumes image or sensor statistics and produces settings for later frames, so latency, convergence, stability, and interaction between controllers matter.

Why it matters. A camera can produce valid RAW frames yet remain unusable when 3A oscillates, focuses slowly, or chooses wrong color and exposure.

Example. A scene becomes darker; AE lengthens exposure, AWB adapts to warmer light, and AF preserves the selected subject without hunting.

Used in. AOS-HW-006#portable-pipeline; AOS-RES-003#camera-claims

A

A/B update

Definition. An update layout with two independently bootable system slots or equivalent transactional images. A new image is written to the inactive side, verified, activated, health-checked, and rolled back when it cannot boot safely.

Why it matters. It reduces the probability that power loss or a bad image permanently removes the recovery path.

Example. Slot A remains known-good while version 12 is staged to slot B; the boot manager reverts to A after failed health checks.

Used in. AOS-ARCH-013#image-layout; AOS-ARCH-013#update-system

ABI (Application Binary Interface)

Definition. The binary-level contract between compiled code and a runtime or kernel: calling convention, register use, syscall numbers, data layout, alignment, symbol rules, executable format, and error representation.

Why it matters. An ABI can become a long-lived compatibility burden even when source APIs look clean, so Agent OS versions it deliberately.

Example. Changing a handle from 32 to 64 bits without an ABI level would break already compiled services.

Used in. AOS-ARCH-005#api-levels; AOS-GOV-001#api-levels

Action plan

Definition. A typed graph of proposed actions, dependencies, inputs, capabilities, budgets, checkpoints, confirmations, external effects, and compensation paths prepared before execution.

Why it matters. It makes agent behavior inspectable and separates planning from authority to act.

Example. A travel plan contains search, comparison, booking proposal, payment confirmation, calendar insertion, and rollback or support steps.

Used in. AOS-PROD-007#planning; AOS-ARCH-010#action-plan

Action provider

Definition. A component, remote service, device, or compatibility adapter that advertises typed actions and executes accepted requests under explicit capabilities.

Why it matters. Providers are the extensibility boundary; weak provider contracts would recreate application silos or ambient authority.

Example. A transit provider exposes route search and ticket purchase as separate actions with different effect classes.

Used in. AOS-PROD-011#native-first; AOS-PROD-003#provider-selection

Action schema

Definition. A machine-readable contract for a user-meaningful operation, including typed inputs and outputs, required capabilities, provider, effects, idempotency, reversibility, confirmation, cost, data destinations, and receipt behavior.

Why it matters. It lets the shell, agents, providers, policy engine, and audit system reason about the same operation without hidden app-specific behavior.

Example. A message.send action identifies recipient, account, body, external effect, confirmation policy, and non-reversible delivery receipt.

Used in. AOS-PROD-003#action-schema; AOS-ARCH-010#action-plan

Address-space identifier (ASID)

Definition. A processor-supported tag associated with an address space so translations from multiple processes can coexist in the translation lookaside buffer without flushing everything at each context switch.

Why it matters. Correct allocation and reuse are necessary for both performance and isolation; stale ASID reuse can expose old mappings.

Example. Before reassigning an ASID to another process, the kernel invalidates translations belonging to its previous owner.

Used in. AOS-ARCH-003#address-spaces; AOS-ARCH-003#architecture-portability

Agent shadow mode

Definition. An evaluation mode in which an agent observes permitted context and records proposed plans without producing external effects.

Why it matters. It permits measurement of usefulness and dangerous false positives before execution privileges are granted.

Example. The agent predicts which messages to send and appointments to create, but only compares its proposals with the user’s later actions.

Used in. AOS-ARCH-010#shadow-mode; AOS-VAL-005#agents

Ambient authority

Definition. Authority available implicitly from process identity, global namespaces, inherited environment, or unrestricted system calls rather than from an explicit object-specific capability.

Why it matters. Ambient authority makes dependency and security review difficult and creates confused-deputy paths.

Example. A library that can open any path by name has ambient filesystem authority; a library given one document handle does not.

Used in. AOS-ARCH-012#least-authority; AOS-ARCH-004#confused-deputy

Anti-circumvention

Definition. Legal rules governing bypass of technological access controls, distinct from ordinary copyright infringement. Exceptions and exemptions are jurisdiction-, purpose-, device-, method-, and time-specific and do not automatically override contracts, patents, trade secrets, or redistribution limits.

Why it matters. Pixel and undocumented-protocol work can be technically possible yet legally impermissible or publishable only under narrower conditions.

Example. A smartphone interoperability exemption may permit a particular unlock activity but not redistribution of proprietary firmware or leaked documentation.

Used in. AOS-LEGAL-001#device-and-protocol-work; AOS-LEGAL-002#clean-room-principle

Anti-rollback

Definition. A security mechanism that prevents installation or boot of software below an approved security version, even when an older image is correctly signed.

Why it matters. A signature alone cannot stop an attacker from restoring a known-vulnerable signed build.

Example. The boot verifier accepts release 15 but rejects signed release 12 after the device security version has advanced.

Used in. AOS-ARCH-013#anti-rollback; AOS-ARCH-013#migration-and-rollback

APDU (Application Protocol Data Unit)

Definition. A command/response unit used to communicate with smart-card applications such as a SIM, eUICC, or secure element. Raw APDU access can expose highly privileged functions and application secrets.

Why it matters. The cellular service should broker narrow SIM operations instead of giving every client an unrestricted card channel.

Example. The trusted SIM service verifies a PIN command while an ordinary messaging provider receives only subscriber-state information.

Used in. AOS-HW-007#portable-cellular-contract; AOS-ARCH-012#keys-and-secrets

Assurance case

Definition. A structured argument linking security or safety claims to assumptions, architecture controls, implementation, tests, analyses, independent reviews, and residual risks for an exact version and target.

Why it matters. It prevents broad words such as “secure” from outliving the evidence that originally supported them.

Example. The kernel isolation claim cites the memory model, fault tests, fuzzing results, reviewed code revision, and unsupported DMA case.

Used in. AOS-ARCH-012#assurance-roadmap; AOS-RES-003#claim-states

Attestation

Definition. A cryptographically authenticated statement about device identity, boot measurements, software state, configuration, or security mode, usually produced by a protected key and checked by a verifier.

Why it matters. Attestation can support trust decisions but can also create tracking and overclaim risks if its scope and privacy are vague.

Example. A verifier learns that a device booted an approved development image, but not the user’s global identity or unrelated application history.

Used in. AOS-ARCH-013#verified-boot; AOS-ARCH-012#keys-and-secrets

Authority amplification

Definition. A flaw in which a component can transform limited authority into broader authority, often through a privileged intermediary, confused deputy, weak object derivation, or unchecked provider routing.

Why it matters. Capability systems are useful only when delegation is monotonic and intermediaries cannot silently act with their own stronger privilege.

Example. A thumbnail service must not use its broad media-store access to return arbitrary files requested through an untrusted path string.

Used in. AOS-ARCH-004#derivation-revocation; AOS-ARCH-004#confused-deputy

Autonomy budget

Definition. A bounded allowance for agent time, actions, money, network destinations, data fields, energy, or other resources within a defined context.

Why it matters. Autonomy must be constrained by more than a broad permission grant.

Example. A purchasing agent may compare offers for ten minutes and spend up to a stated amount, but cannot add new recipients or payment instruments.

Used in. AOS-ARCH-010#agent-budgets; AOS-PROD-005#interaction-principles

B

Backend conformance

Definition. Evidence that a target-specific implementation satisfies the same native service semantics and negative behavior as other backends.

Why it matters. Portability is meaningful only when backends are interchangeable at a tested contract boundary.

Example. QEMU and an AArch64 board pass identical display-buffer ownership, cancellation, hotplug, and permission tests.

Used in. AOS-ARCH-016#conformance; AOS-VAL-001#portable

Backpressure

Definition. A flow-control mechanism that causes producers to slow, block, drop according to policy, or receive an explicit error when consumers or buffers cannot keep up.

Why it matters. Without backpressure, camera, network, logging, and IPC paths can exhaust memory or hide data loss.

Example. A camera stream reports a dropped-frame reason or blocks capture rather than allocating unbounded buffers when an encoder stalls.

Used in. AOS-ARCH-004#streaming; AOS-ARCH-008#buffer-model

Baseband

Definition. The cellular modem subsystem that implements radio protocols and often runs its own firmware and processors, isolated to varying degrees from the application processor.

Why it matters. It is a complex external trust domain; packet data support does not expose or solve its voice, IMS, emergency, or certification functions.

Example. Agent OS controls a modem through a documented transport while treating modem firmware as an untrusted peripheral with reset and update policy.

Used in. AOS-HW-007#program-boundary; AOS-ARCH-012#trust-boundaries

Binary blob

Definition. A precompiled artifact whose complete source or build process is unavailable. It may be redistributable, device-bound, NDA-restricted, or legally non-redistributable; those categories are not interchangeable.

Why it matters. A blob can be an acceptable bounded dependency only when rights, provenance, update, security, lifecycle, and replacement are explicit.

Example. A signed camera firmware binary is recorded by hash and license, loaded only by its backend, and excluded from public packages when redistribution is not permitted.

Used in. AOS-ARCH-006#firmware-policy; AOS-LEGAL-003#provenance-record

Black level

Definition. The sensor output value representing no light after accounting for electronic offset. It can vary by sensor mode, channel, gain, exposure, temperature, and row/column behavior.

Why it matters. Incorrect black-level correction causes color casts, crushed shadows, banding, and invalid noise measurements.

Example. Calibration records per-channel black levels and subtracts them before demosaic and color processing.

Used in. AOS-HW-006#calibration-lab; AOS-HW-006#metrics

Black-box observation

Definition. The study of a system through controlled inputs and externally observable outputs without using protected internal source or implementation details.

Why it matters. It is a common building block for lawful interoperability work and produces behavioral tests rather than copied expression.

Example. The observation team changes a modem state, records approved response fields and timing, then writes a functional state specification for a separate implementation team.

Used in. AOS-LEGAL-002#workflow; AOS-LEGAL-002#roles

Board dossier

Definition. A versioned record for a specific board or device revision covering boot, recovery, debug, schematics, documentation, firmware, interfaces, supply, legal terms, risks, experiments, and support level.

Why it matters. Board names alone hide revision and access differences that can invalidate a port plan.

Example. The dossier records UART voltage, recovery straps, exact PMIC, image procedure, public TRM revision, and unavailable ISP documents.

Used in. AOS-HW-011#dossier; AOS-HW-004#documentation-audit

Board package

Definition. The target-specific description and backend collection that translates a board’s boot data, buses, MMIO, interrupts, clocks, resets, power rails, pins, DMA/IOMMU, devices, firmware, and quirks into portable Agent OS resource and service contracts.

Why it matters. It confines target variation and allows product and system services to remain unchanged across unrelated boards.

Example. The AM625 package maps its UART and display resources into generic console and display services without exposing device-tree nodes to clients.

Used in. AOS-ARCH-006#board-package; AOS-HW-004#board-package-deliverable

BOM (Bill of Materials)

Definition. A structured list of components, assemblies, revisions, approved alternates, quantities, suppliers, lifecycle status, and costs required to manufacture a hardware product.

Why it matters. A prototype component list is not a production BOM unless substitutions, traceability, availability, yield, and certification impact are controlled.

Example. The carrier-board BOM identifies two approved regulators and requires certification review before replacing the cellular module.

Used in. AOS-HW-008#vendor-package; AOS-PLAN-004#cost-model

Boot chain

Definition. The ordered sequence of reset code, immutable or protected ROM, firmware, bootloaders, verifiers, recovery, kernel, initial image, and policy that establishes the running system.

Why it matters. Security and recoverability depend on every transition, key, measurement, version, and failure path—not only the kernel signature.

Example. ROM verifies a first-stage loader, which verifies the Agent OS image manifest and exposes the resulting trust state to user space.

Used in. AOS-ARCH-013#boot-chain; AOS-ARCH-013#verified-boot

Boot handoff

Definition. A versioned data contract passed from a loader or firmware environment to the kernel, containing normalized memory, CPU, console, device seed, trust, image, and platform information.

Why it matters. A normalized handoff lets the kernel support UEFI, device tree, custom loaders, or secure firmware without embedding each format in core code.

Example. The Pixel or AM625 loader converts native boot structures into the same bounded Agent OS handoff record.

Used in. AOS-ARCH-002#boot-and-architecture; AOS-ARCH-013#boot-chain

BSP (Board Support Package)

Definition. A vendor or project bundle of boot code, configuration, drivers, firmware, patches, build scripts, and documentation for a particular board or SoC. Its content and license quality vary widely.

Why it matters. An available BSP may accelerate research but does not prove that the hardware is documented or that its code can be reused in Agent OS.

Example. The team uses a vendor BSP to identify required clocks and firmware, then implements a native board package under approved provenance rules.

Used in. AOS-HW-004#documentation-audit; AOS-LEGAL-003#dependency-policy

Buffer collection

Definition. A negotiated set of memory buffers shared among producers and consumers with agreed format, size, alignment, usage, security, lifetime, and synchronization constraints.

Why it matters. Display, camera, GPU, and video paths need zero-copy performance without letting participants reuse or inspect memory at the wrong time.

Example. Camera, ISP, compositor, and encoder receive scoped handles to a collection and cannot access frames after ownership is released.

Used in. AOS-ARCH-008#buffer-model; AOS-HW-006#portable-pipeline

C

Calibration asset

Definition. A measured parameter set or reference artifact used to correct a specific sensor, lens, display, microphone, power meter, or laboratory setup.

Why it matters. Quality results are not reproducible when calibration lineage and target identity are missing.

Example. A camera module receives lens-shading, black-level, color-matrix, autofocus, and defect-pixel data tied to its serial and optical assembly.

Used in. AOS-HW-015#calibration; AOS-HW-012#benchmark

Camera quality oracle

Definition. A controlled reference device, corpus, or measurement baseline used to define desired camera behavior without assuming access to its implementation.

Why it matters. A quality target is useful for comparison but must not be confused with source code, a legal license, or a portable pipeline.

Example. Stock Pixel 9 captures are recorded under controlled light, motion, and scene conditions and compared with native backend outputs.

Used in. AOS-HW-012#tracks; AOS-HW-014#evidence-classes

Capability

Definition. An unforgeable reference to an object together with the authority to perform a defined set of operations on it. Possession, not a global name lookup, is the basis of access.

Why it matters. Capabilities make authority explicit, delegable, auditable, and suitable for least-authority service composition.

Example. A photo editor receives a read/write handle to one image object, not ambient access to every user file.

Used in. AOS-ARCH-004#capability-model; AOS-ARCH-012#least-authority

Capability attenuation

Definition. The creation or delegation of a capability with fewer rights, narrower object scope, shorter lifetime, lower quota, or additional constraints than its source.

Why it matters. Attenuation lets a component share only what a callee needs and must never widen authority.

Example. A workspace delegates a read-only, 10-minute projection of one contact to a meeting widget.

Used in. AOS-ARCH-004#derivation-revocation; AOS-ARCH-004#rights

Capability derivation

Definition. The recorded relationship between an original capability and delegated descendants, used to enforce monotonic rights and, where supported, revocation or audit.

Why it matters. Derivation gives the system a precise answer to “where did this authority come from?”

Example. An agent action handle is derived from a user grant; revoking the grant invalidates future derived uses according to the defined model.

Used in. AOS-ARCH-004#derivation-revocation; AOS-ARCH-010#audit-and-explanation

Capability profile

Definition. A machine-readable declaration of optional features, limits, performance classes, and security properties implemented by a service backend or device.

Why it matters. Clients need feature discovery without target names or undocumented assumptions.

Example. A camera profile declares RAW support, maximum streams, control ranges, stabilization modes, metadata fields, and quality tier.

Used in. AOS-ARCH-020#quality; AOS-VAL-001#profiles

Capability revocation

Definition. A mechanism that invalidates future use of a previously delegated capability or a derivation subtree, with explicit semantics for in-flight operations and resource cleanup.

Why it matters. Mobile systems need to withdraw permissions, remove compromised providers, terminate agents, and reclaim device/DMA access.

Example. When a camera provider is revoked, new captures fail immediately and in-flight buffers complete or cancel under a documented rule.

Used in. AOS-ARCH-004#derivation-revocation; AOS-ARCH-010#budgets

Capability routing

Definition. The explicit connection of a provider’s exported capability to a consumer through manifests and policy rather than a global service locator.

Why it matters. Routing makes dependencies reviewable and prevents components from discovering privileged services implicitly.

Example. The service manager routes the logging endpoint to a driver but withholds network and entity-store capabilities.

Used in. AOS-ARCH-004#service-routing; AOS-ARCH-007#service-plane

Carrier aggregation

Definition. A cellular radio technique that combines multiple frequency carriers to increase bandwidth. Support depends on modem hardware, firmware, bands, network deployment, antennas, RF tuning, and certification.

Why it matters. A module’s generic data connection does not prove flagship throughput or regional band combinations.

Example. An ODM response lists supported combinations for each regional SKU and the required antenna/certification evidence.

Used in. AOS-HW-007#modem-strategies; AOS-LEGAL-004#cellular-path

Causal consistency

Definition. A distributed-data guarantee that preserves the order of operations that could have influenced one another while allowing unrelated operations to be observed in different orders.

Why it matters. It supports offline history and collaboration without pretending all devices share one instantaneous global clock.

Example. A reply is never shown before the message it references, while unrelated note edits may arrive in either order.

Used in. AOS-ARCH-009#local-first-sync; AOS-ARCH-009#event-log

Causal parent

Definition. An event identifier recording which earlier event or decision directly led to the current event. Multiple parents represent merged lines of work.

Why it matters. Causal links make history, agent explanations, synchronization, and conflict diagnosis more meaningful than timestamps alone.

Example. An action receipt names the approved proposal and provider result events as its causal parents.

Used in. AOS-PROD-002#event-envelope; AOS-ARCH-010#audit-and-explanation

CCM (Color Correction Matrix)

Definition. A matrix that maps camera sensor color responses into a target color space, usually as one stage of a larger color pipeline and often dependent on illuminant and calibration.

Why it matters. An inaccurate CCM produces systematic hue and saturation errors even when exposure and white balance are correct.

Example. Calibration derives matrices for daylight and tungsten and interpolates them using the estimated illuminant.

Used in. AOS-HW-006#calibration-lab; AOS-HW-006#metrics

CFA (Color Filter Array)

Definition. The mosaic of spectral filters placed over sensor pixels, such as a Bayer or quad-Bayer arrangement. Demosaic algorithms use its pattern and sensor characteristics to reconstruct color images.

Why it matters. The pipeline must know exact CFA layout; a wrong pattern creates severe color and detail artifacts.

Example. A RAW metadata record states RGGB layout and active crop before the demosaic stage runs.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#metrics

CHERI

Definition. An architecture extension that attaches bounds, permissions, provenance, and validity to pointers/capabilities in hardware, enabling fine-grained memory safety and compartmentalization.

Why it matters. Agent OS can design abstractions that benefit from future hardware capabilities without requiring CHERI silicon for its first mobile targets.

Example. A future port represents user pointers and object references with tagged capabilities while preserving the same higher-level service contracts.

Used in. AOS-RES-001#rust-and-research-os; AOS-HW-008#platform-options

Clean-room implementation

Definition. An independently written implementation produced from an approved functional specification and public sources by people separated, when required, from protected implementation material.

Why it matters. It reduces legal contamination risk and creates a reviewable line between interoperability facts and copied expression.

Example. One team records a protocol state machine; counsel reviews it; a separate team writes the Agent OS codec without access to quarantined binaries or source.

Used in. AOS-LEGAL-002#clean-room-principle; AOS-LEGAL-002#workflow

Clock domain

Definition. A time source and conversion context with its own rate, offset, uncertainty, suspend behavior, and synchronization relationship, such as sensor, audio, modem, monotonic system, or wall time.

Why it matters. Combining events from different domains without calibration causes bad A/V sync, stabilization, latency, and history ordering.

Example. A camera frame exposes sensor exposure time plus the measured mapping and uncertainty to system monotonic time.

Used in. AOS-ARCH-002#time-and-determinism; AOS-HW-006#portable-pipeline

Command stream

Definition. A device-specific sequence of GPU or accelerator instructions, state, memory references, and synchronization submitted to hardware.

Why it matters. A public graphics API does not remove the need for a secure backend that validates and isolates vendor-specific command streams.

Example. The Agent OS GPU service accepts portable work, while a Mali backend produces and validates the exact command stream behind its domain boundary.

Used in. AOS-ARCH-006#hal-contracts; AOS-ARCH-008#renderer-backends

Compatibility adapter

Definition. A bounded translator between an external API, protocol, legacy environment, or provider and a native Agent OS contract.

Why it matters. Translation must terminate foreign semantics rather than spread them through the system.

Example. An Android-side Pixel experiment translates capture results into a narrow camera-evidence schema; no Binder type crosses the boundary.

Used in. AOS-ARCH-018#cell; AOS-PROD-011#degradation

Compatibility cell

Definition. An isolated optional runtime that implements a non-native ABI or environment behind explicit Agent OS capabilities and resource limits.

Why it matters. It allows selected legacy software without making Linux, POSIX, Android, or another platform the architecture’s native contract.

Example. A future WebAssembly compatibility cell receives one network endpoint and one document namespace instead of ambient host access.

Used in. AOS-ARCH-011#optional-future-cells; AOS-ARCH-011#anti-leakage-controls

Compensating action

Definition. A new action intended to mitigate or counteract a completed effect that cannot literally be rolled back. It is distinct from an inverse transaction.

Why it matters. Messages, payments, reservations, and published content often have external effects that history replay cannot erase.

Example. After a message is sent to the wrong group, the system proposes a correction or deletion request and records both receipts.

Used in. AOS-ARCH-010#undo-compensation; AOS-PROD-002#replay-and-undo

Complete mediation

Definition. The security principle that every security-relevant use of an object or operation is checked against current authority, rather than trusting only an initial open or cached decision.

Why it matters. Revocation and policy changes are ineffective when later operations bypass mediation.

Example. A provider validates the action handle at execution time and cannot continue after the grant has been revoked.

Used in. AOS-ARCH-004#message-invariants; AOS-ARCH-012#least-authority

Compositor

Definition. The service that combines independently rendered surfaces into final display frames while enforcing visibility, ordering, clipping, transforms, input association, synchronization, and secure-capture policy.

Why it matters. It is a central isolation and performance boundary between applications/providers and display/GPU backends.

Example. The shell gives a video surface a region and z-order; the compositor presents it without granting the video process display-controller access.

Used in. AOS-ARCH-008#graphics-layers; AOS-ARCH-008#surface-model

Conformance suite

Definition. A target-independent test set that verifies an implementation obeys the specified interface, lifecycle, errors, authority, resource, timing, update, and failure semantics.

Why it matters. It distinguishes true portability from multiple backends that merely compile but behave differently.

Example. QEMU, AM625, and a second SoC run the same display-buffer ownership and driver-restart tests.

Used in. AOS-ARCH-015#test-pyramid; AOS-HW-001#portfolio-acceptance

Confused deputy

Definition. A security failure where a privileged component is tricked into using its own authority for an unprivileged requester because the request does not carry explicit, correctly scoped authority.

Why it matters. It is a primary reason Agent OS uses capability-bearing requests instead of path or identity conventions.

Example. A backup service refuses an arbitrary file path and accepts only object handles delegated by the requesting user context.

Used in. AOS-ARCH-004#confused-deputy; AOS-ARCH-012#least-authority

Contract backend

Definition. A target-specific implementation of a native service contract, including lifecycle, errors, cancellation, security, buffer ownership, and quality metadata.

Why it matters. Hardware code can vary while product and system semantics remain stable.

Example. An i.MX 8M Plus camera backend and a QEMU trace backend both implement the native capture-request interface.

Used in. AOS-ARCH-020#semantics; AOS-ARCH-016#backend-contract

Control plane

Definition. The part of a subsystem that configures, authorizes, and manages state, in contrast to a data plane that carries high-volume payloads.

Why it matters. Separating the planes helps keep policy and secrets out of performance-critical buffer paths.

Example. The camera control plane sets exposure and starts streams; the data plane transfers frame buffers.

Used in. AOS-ARCH-006#hal-contracts; AOS-HW-007#portable-cellular-contract

Convergence gate

Definition. A decision point where parallel research or hardware tracks must present comparable evidence and one or more routes are selected, limited, partnered, or stopped.

Why it matters. Parallel tracks reduce early risk only if they eventually converge instead of consuming indefinite resources.

Example. The quality-device gate compares Pixel, semi-open phone, custom carrier, and ODM routes by rights, cost, quality, schedule, and support.

Used in. AOS-PLAN-012#convergence; AOS-HW-013#gate

Copy-on-write

Definition. A memory or storage technique in which shared data remains physically shared until a participant attempts to modify it, at which point a private copy is created.

Why it matters. It supports snapshots and efficient process/image creation but requires clear accounting and failure behavior.

Example. A system snapshot shares unchanged blocks with the active state and allocates new blocks only for later writes.

Used in. AOS-ARCH-003#page-management; AOS-ARCH-009#materialized-state

CRDT (Conflict-Free Replicated Data Type)

Definition. A data type whose operations or states can be merged across replicas so all replicas converge under specified assumptions without central serialization.

Why it matters. CRDTs are valuable for some offline collaborative data but are not correct for every transaction, permission, or external effect.

Example. A tag set can merge concurrent additions, while a payment authorization uses a transactional state machine instead.

Used in. AOS-ARCH-009#crdt-policy; AOS-RES-003#verification-table

Cryptographic erasure

Definition. Making encrypted data unrecoverable by securely destroying the only keys capable of decrypting it, even if ciphertext copies remain.

Why it matters. It can provide efficient deletion for backups or replicated stores, but only when key copies and derivations are controlled.

Example. Deleting a workspace’s data key renders its encrypted historical payloads unreadable while retaining non-sensitive audit envelopes.

Used in. AOS-ARCH-009#privacy-retention; AOS-PROD-002#privacy-controls

CSpace (Capability Space)

Definition. The per-process or per-domain namespace and data structure that stores capability references and their rights, type, generation, and lifecycle metadata.

Why it matters. A CSpace replaces ambient global object lookup and must resist handle forgery, stale reuse, exhaustion, and unauthorized enumeration.

Example. The service receives handle 42, which resolves only inside its CSpace to a read-only entity projection.

Used in. AOS-ARCH-004#capability-model; AOS-ARCH-004#rights

D

Data authority

Definition. The right and technical control to define how a data domain is stored, exposed, derived, synchronized, exported, revoked, and deleted.

Why it matters. User ownership language is meaningless without enforceable authority and provider boundaries.

Example. A user grants a planning agent a purpose-bound view of selected calendar fields without granting access to private notes.

Used in. AOS-PROD-009#ownership; AOS-PROD-004#data-classes

Data plane

Definition. The high-throughput path that carries payloads such as packets, audio samples, display buffers, camera frames, or storage blocks after control-plane authorization.

Why it matters. Its API and buffer ownership must remain fast without bypassing isolation, revocation, or accounting.

Example. A network service grants a bounded packet queue after the control plane approves an endpoint policy.

Used in. AOS-ARCH-004#streaming; AOS-ARCH-006#dma-iommu

DCO (Developer Certificate of Origin)

Definition. A contributor certification, recorded through a Signed-off-by line, that the contributor has the right to submit a change under the project’s license and accepts the stated contribution terms.

Why it matters. It provides a lightweight provenance assertion but does not replace code review, employer authority, license checks, or clean-room disclosure.

Example. A contributor signs off a driver change and separately declares that no proprietary source was used.

Used in. AOS-LEGAL-003#contributions; AOS-GOV-002#contribution-path

Demosaic

Definition. The reconstruction of full-color pixel values from a sensor’s color-filter mosaic. Algorithms trade detail, aliasing, noise, color artifacts, and computation.

Why it matters. It is a core image-pipeline stage whose quality must be assessed with the sensor/CFA and later sharpening/noise processing.

Example. The pipeline uses an edge-aware Bayer demosaic and compares zipper artifacts on slanted high-contrast targets.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#metrics

Derived data

Definition. Information inferred, summarized, embedded, classified, scored, or otherwise produced from source data.

Why it matters. Derived data can remain sensitive and must retain provenance, purpose, retention, and deletion behavior.

Example. A relationship score inferred from messages records its input classes, model version, confidence, permitted uses, and invalidation rules.

Used in. AOS-PROD-009#derived; AOS-LEGAL-010#data-map

Device service

Definition. A user-space service that exposes a native contract for a hardware capability such as display, camera, audio, storage, network, power, sensors, or secure operations.

Why it matters. It separates portable clients from board code and confines complex drivers and vendor integration.

Example. The display service accepts buffers and fences, reports outputs and modes, and survives backend restart according to the contract.

Used in. AOS-ARCH-020#contract-set; AOS-ARCH-006#service-contract-template

Device tree

Definition. A structured hardware description commonly used by firmware and operating systems to describe devices, addresses, interrupts, clocks, buses, and relationships.

Why it matters. It is useful input prior art, but Agent OS normalizes target descriptions into its board-package contract instead of exposing device-tree semantics to product services.

Example. The loader parses a board device tree and produces bounded Agent OS resource records for the driver broker.

Used in. AOS-ARCH-006#device-topology; AOS-ARCH-006#board-package

DFM (Design for Manufacturability)

Definition. Engineering a product so it can be fabricated and assembled with acceptable yield, process capability, cost, substitutions, inspection, and rework.

Why it matters. A functioning prototype may still be expensive or unreliable to manufacture at scale.

Example. The PCB review increases component spacing and changes a connector footprint to fit the selected assembly process.

Used in. AOS-HW-008#prototype-stages; AOS-LEGAL-004#development-stages

DFT (Design for Test)

Definition. Engineering hardware and software so manufacturing and service tests can observe, stimulate, isolate, and diagnose relevant faults efficiently.

Why it matters. Without test points, fixtures, deterministic modes, and traceability, quality and repair costs become unmanageable.

Example. The carrier board exposes a controlled test connector and Agent OS factory service that validates each power rail and camera lane.

Used in. AOS-HW-008#vendor-package; AOS-HW-008#readiness-prerequisites

Differential testing

Definition. Running the same generated input against two models or implementations and comparing normalized results to find semantic disagreement.

Why it matters. It is effective for kernel reference models, codecs, storage reducers, camera metadata, and protocol implementations.

Example. The host capability model and QEMU kernel receive identical delegation operations; any rights or error mismatch is minimized.

Used in. AOS-ARCH-015#test-pyramid; AOS-ARCH-002#formal-methods-path

DMA (Direct Memory Access)

Definition. Hardware access to system memory without CPU copying, used by storage, network, display, camera, audio, GPU, and other devices.

Why it matters. DMA can bypass process page protections, so ownership, pinning, cache coherency, IOMMU mapping, teardown, and accounting are security-critical.

Example. A camera driver receives an IOMMU-scoped mapping to a frame collection and loses it before those pages are reused.

Used in. AOS-ARCH-006#dma-iommu; AOS-ARCH-012#trust-boundaries

DNG (Digital Negative)

Definition. A documented RAW image container and metadata format intended to preserve sensor samples, calibration, color, geometry, crop, preview, and capture context across software.

Why it matters. It gives the camera program a portable evidence and export format, though a valid DNG alone does not guarantee image quality.

Example. The reference pipeline exports an RGGB RAW frame with black/white levels, color matrices, lens shading, exposure, and module identity.

Used in. AOS-HW-006#portable-pipeline; AOS-PROD-004#backup-bundle

Documentation volume

Definition. One of the ten thematic groups in the Engineering Bible; it organizes knowledge independently from chronological implementation phases.

Why it matters. The same architecture document may be written in Phase 2 and revised during hardware work while remaining in the Kernel volume.

Example. Volume 03 contains hardware targets, camera, cellular, Pixel, laboratory, and custom-device material.

Used in. AOS-PLAN-011#volumes; AOS-PLAN-011#workflow

Documentation-first board

Definition. A hardware target selected primarily for complete, lawful, stable documentation, recovery, debug, and community access rather than peak consumer specifications.

Why it matters. Early native ports should minimize unknowns and expose architecture leakage before expensive flagship work.

Example. A documented evaluation board is chosen for the first physical boot even though it lacks phone industrial design and premium camera quality.

Used in. AOS-HW-011#evaluation; AOS-HW-004#selection-rationale

DRBG (Deterministic Random Bit Generator)

Definition. A cryptographic state machine that expands entropy into pseudorandom output while supporting reseeding and defined failure/security properties.

Why it matters. Cryptographic keys and nonces need a reviewed generator and explicit startup/failure behavior rather than ad hoc randomness.

Example. The entropy service refuses key generation until health-tested sources seed the DRBG, then reseeds after resume or defined output limits.

Used in. AOS-ARCH-012#keys-and-secrets; AOS-ARCH-007#identity-time-settings

Driver domain

Definition. An isolated user-space process or component that owns a device backend and receives only the MMIO, interrupt, DMA, clock, reset, power, firmware, and service capabilities it requires.

Why it matters. A driver failure should not corrupt kernel or unrelated services, and its authority must be revoked before resources are reused.

Example. The USB controller driver crashes; the resource broker revokes DMA and restarts it while the shell remains alive.

Used in. AOS-ARCH-006#driver-model; AOS-ARCH-006#driver-lifecycle

DVFS (Dynamic Voltage and Frequency Scaling)

Definition. Runtime adjustment of processor or device voltage and clock frequency to balance performance, energy, and thermal limits.

Why it matters. A mobile OS must coordinate DVFS with scheduler demand, latency classes, camera/GPU workloads, and safe hardware operating points.

Example. During burst processing, the power service raises a CPU/GPU performance state, then lowers it before thermal limits are exceeded.

Used in. AOS-ARCH-014#performance-governors; AOS-ARCH-014#thermal-management

DVT (Design Validation Test)

Definition. A hardware development stage focused on validating a near-final design against product, reliability, compliance, thermal, RF, camera, mechanical, software, and manufacturing requirements.

Why it matters. DVT is not merely a later prototype revision; changes should be controlled because formal testing and tooling become expensive.

Example. The DVT build uses production-intent antennas and enclosure for SAR, RF, thermal, camera, drop, and update testing.

Used in. AOS-HW-008#prototype-stages; AOS-LEGAL-004#development-stages

E

Effect class

Definition. A category describing the consequences of an action—pure query, local reversible, local destructive, external reversible, compensable, irreversible, or privileged system change.

Why it matters. The class drives confirmation, receipt, audit, retry, agent autonomy, and recovery behavior.

Example. Renaming a local note is reversible; sending a message is compensable; advancing anti-rollback state is a privileged irreversible system effect.

Used in. AOS-PROD-003#effect-classes; AOS-ARCH-010#confirmation-policy

EIS (Electronic Image Stabilization)

Definition. Stabilization that estimates camera motion from images and/or inertial sensors and crops/warps frames to reduce apparent shake. It differs from optical stabilization, which physically moves lens or sensor elements.

Why it matters. EIS quality depends on accurate timestamps, rolling-shutter models, motion estimates, crop budget, latency, and interaction with OIS.

Example. The video pipeline aligns gyro samples to exposure time and warps each frame while reporting the effective crop.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#metrics

Entity

Definition. A durable typed object representing something meaningful to the user or system—such as a person, document, place, device, event, task, message, activity, or provider—with stable identity, fields, relationships, provenance, and policy.

Why it matters. Entities let workflows and history survive provider, device, and UI changes instead of being trapped inside application silos.

Example. A trip entity links passengers, reservations, locations, documents, payments, tasks, and provider-specific views.

Used in. AOS-ARCH-009#entity-model; AOS-PROD-001#entity-surfaces

Entity resolution

Definition. The process of deciding whether records from different sources refer to the same real-world entity, while preserving aliases, confidence, conflicts, user decisions, merge and split history.

Why it matters. Incorrect silent merging can expose data or corrupt relationships; never resolving duplicates makes entity-first UX unusable.

Example. Two contact imports are proposed as one person, but the user can inspect source fields and later split them without losing provenance.

Used in. AOS-ARCH-009#provenance; AOS-PROD-001#entity-surfaces

eSIM / eUICC

Definition. An eUICC is a secure component that can store and manage remotely provisioned operator profiles; eSIM refers to the broader provisioning ecosystem and user experience.

Why it matters. Profile lifecycle, credentials, operator/GSMA agreements, certification, migration, and recovery are separate from ordinary SIM reading or backup.

Example. A replacement device re-enrolls a profile through an approved provider flow rather than copying private eUICC keys from backup.

Used in. AOS-HW-007#portable-cellular-contract; AOS-PROD-004#data-classes

Event sourcing

Definition. A persistence approach in which committed domain events are the authoritative history and current state is derived through reducers or materialized views.

Why it matters. It supports audit, replay, sync, migration, and explanation but requires schema evolution, privacy, compaction, and non-replay rules for external effects.

Example. A document’s state is rebuilt from edit transactions and snapshots; a sent-message receipt is replayed as fact, not re-sent.

Used in. AOS-ARCH-009#event-log; AOS-ARCH-009#materialized-state

Evidence bundle

Definition. A versioned package of raw data, logs, traces, build and target identity, configuration, instruments, scripts, processed report, hashes, anomalies, access class, and reproduction information for a claim or experiment.

Why it matters. A screenshot or one-time demo is not enough to support architecture, quality, security, or hardware decisions.

Example. The first-frame bundle contains exact board revision, image hash, boot log, display mode, frame timestamp, photo, script, and reviewer result.

Used in. AOS-ARCH-015#evidence-bundles; AOS-RES-004#evidence-integrity

Evidence class

Definition. A provenance and access category applied to observations, documents, code, traces, legal advice, vendor material, and derived artifacts.

Why it matters. Different classes may be visible to different contributors and may impose publication or clean-room restrictions.

Example. Public vendor documentation, owned-device black-box traces, NDA material, counsel advice, and independent implementation notes use separate classes.

Used in. AOS-HW-014#evidence-classes; AOS-VAL-002#integrity

EVT (Engineering Validation Test)

Definition. An early hardware build stage used to prove architecture, electrical function, interfaces, bring-up, major risks, and testability before the design is production-like.

Why it matters. EVT units are expected to reveal defects; their purpose and acceptance criteria differ from a user-ready device.

Example. The first carrier-board EVT allocates units to power, display, camera, RF, security, manufacturing-test, and destructive bring-up owners.

Used in. AOS-HW-008#prototype-stages; AOS-PLAN-006#technical-gates

Execution phase

Definition. One of the chronological Phase 0–8 work periods, each with accepted inputs, parallelism rules, exit evidence, and milestone relationships.

Why it matters. Phases express sequencing; they must not be confused with thematic documentation volumes.

Example. A hardware dossier belongs to Volume 03 but may be produced in Phase 1 before physical bring-up in Phase 7.

Used in. AOS-PLAN-010#model; AOS-PLAN-010#phase-table

Execution receipt

Definition. An integrity-protected record of an action proposal, authorization, provider, inputs or references, capabilities used, effect, outcome, time, cost, errors, and available inverse or compensation.

Why it matters. Receipts let users and agents explain what happened and prevent history replay from repeating external effects.

Example. A file-share receipt identifies the selected destination, provider, shared object version, link expiry, and revocation action.

Used in. AOS-ARCH-010#audit-and-explanation; AOS-PROD-002#replay-and-undo

External-authoritative state

Definition. Data whose canonical source is an external system, such as a carrier account, server mailbox, payment ledger, or cloud object. Agent OS may cache, index, or journal it but cannot unilaterally define its final truth.

Why it matters. Recovery and deletion language must distinguish local copies from the external authority’s records and policies.

Example. A restored mail account re-fetches server messages from a checkpoint; the backup does not claim to erase or replace the server mailbox.

Used in. AOS-PROD-004#data-classes; AOS-PROD-002#timeline-and-search

F

FAE (Field Application Engineer)

Definition. A vendor engineer who helps customers select, integrate, debug, tune, and qualify a component or platform, often with access to internal specialists and documentation under agreement.

Why it matters. A named FAE path can make the difference between a usable documented component and an unsupported data sheet.

Example. The modem FAE confirms firmware lifecycle, MBIM/QMI support, certification status, reset sequences, and escalation process.

Used in. AOS-LEGAL-005#priority-contacts; AOS-HW-008#vendor-package

Fault injection

Definition. The deliberate introduction of errors—crashes, timeouts, corrupt data, dropped interrupts, power loss, thermal trips, device removal, malformed messages, or resource exhaustion—to test containment and recovery.

Why it matters. Happy-path demonstrations do not reveal whether an OS remains trustworthy under real hardware and service failures.

Example. The test kills a storage driver during flush and verifies that recovery reports the transaction outcome without corrupting unrelated data.

Used in. AOS-ARCH-015#fault-injection; AOS-RES-004#negative-results

First frame

Definition. The earliest point in hardware bring-up where the native display stack presents a verified image through the intended display, buffer, and compositor path.

Why it matters. It is a useful milestone but does not imply GPU acceleration, touch, power quality, camera, radios, or a usable phone.

Example. The documented board boots Agent OS and the compositor presents a test pattern with recorded mode and timestamp.

Used in. AOS-HW-004#acceptance; AOS-ARCH-008#display-and-color

FlexLight

Definition. The global palette and progressively expandable surface for search, commands, entities, actions, previews, settings, and contextual navigation.

Why it matters. It provides a coherent path from a lightweight query to a rich work surface without forcing application switching.

Example. A query returns an entity, previews related actions, and expands into a trip-planning story while retaining context.

Used in. AOS-PROD-007#flexlight; AOS-SRC-N001#product-surface

Frame pacing

Definition. The timing discipline that schedules and presents frames at appropriate intervals relative to display refresh, input, rendering completion, and power constraints.

Why it matters. Correct average frame rate can still feel bad when intervals vary, deadlines are missed, or queues add latency.

Example. The compositor drops a late frame and presents the next one on a vsync boundary rather than building an unbounded queue.

Used in. AOS-ARCH-008#performance; AOS-ARCH-014#performance-governors

Functional specification

Definition. A description of externally required behavior—messages, states, errors, timing, constraints, and security properties—without unnecessary protected implementation expression.

Why it matters. It is the principal handoff between clean-room observation and independent implementation.

Example. The specification states how a device acknowledges reset and reports errors, but not copied source, symbols, or internal algorithms.

Used in. AOS-LEGAL-002#workflow; AOS-LEGAL-002#artifact-controls

Fuzzing

Definition. Automated generation or mutation of inputs to expose crashes, hangs, memory errors, state-machine flaws, parser bugs, and unexpected behavior, ideally with coverage guidance and result minimization.

Why it matters. Kernel, IDL, USB, network, camera, modem, package, update, and backup parsers all handle untrusted structured data.

Example. A fuzzer mutates capability-bearing IPC messages and saves the smallest message that triggers a rights-accounting mismatch.

Used in. AOS-ARCH-015#test-pyramid; AOS-ARCH-012#secure-development

G

GCF (Global Certification Forum)

Definition. An industry certification scheme for mobile devices and implementations, complementary to regional and operator requirements. Exact applicability, work items, and recognized labs vary by product and market.

Why it matters. A modem or prototype registering on a network does not establish production certification or carrier acceptance.

Example. The cellular plan maps required GCF work, module inheritance, final-device tests, software versions, and responsible party.

Used in. AOS-LEGAL-004#cellular-path; AOS-HW-007#acceptance

Golden trace

Definition. A reviewed, versioned trace used as a reference input or expected behavior for deterministic replay and regression testing.

Why it matters. It turns real hardware behavior into repeatable CI evidence without embedding the original operating system or device ABI.

Example. A sanitized modem registration trace is replayed against the native cellular state machine after every change.

Used in. AOS-ARCH-011#trace-replay; AOS-ARCH-015#test-pyramid

GPU command stream

Definition. See Command stream; specifically the hardware-family-specific instructions and state submitted to a graphics processor.

Why it matters. It marks the boundary between portable graphics semantics and a high-risk device backend.

Example. The compositor never constructs a vendor command stream directly; it submits portable work through the GPU service.

Also known as / see also. Command stream

Used in. AOS-ARCH-008#renderer-backends; AOS-ARCH-006#hal-contracts

H

HAL (Hardware Abstraction Layer)

Definition. A typed interface boundary that exposes hardware capabilities and lifecycle without requiring consumers to understand a board, bus, register map, vendor protocol, or legacy operating-system ABI. In Agent OS, HAL is a family of capability-secured user-space service contracts rather than one monolithic library.

Why it matters. A precise HAL is the main mechanism for moving the same product and service layers between QEMU, documented boards, open phones, Pixel experiments, and future contract hardware.

Example. The camera service asks a board backend for capture streams and controls through Agent OS IDL; the backend may use a documented ISP, a temporary Pixel adapter, or a software pipeline without changing the client schema.

Used in. AOS-ARCH-006#hal-contracts; AOS-ARCH-001#portable-boundaries

Hardware compromise

Definition. A measured limitation in quality, openness, performance, power, integration, supply, documentation, or rights accepted for a specific evidence track.

Why it matters. Compromises are useful only when isolated, declared, and paired with a removal or convergence plan.

Example. An open phone’s weak camera is accepted for modem and power work but cannot lower the camera service contract or product quality target.

Used in. AOS-HW-013#ledger; AOS-HW-013#categories

Hardware oracle

Definition. A reference device used to observe expected external behavior or quality without treating its implementation as the native architecture.

Why it matters. It supports differential testing and target setting while preserving independent design.

Example. A stock device supplies suspend timing, camera output, or UI-quality baselines for lawful comparison.

Used in. AOS-HW-014#role; AOS-ARCH-018#allowed

Hardware root of trust

Definition. A hardware-enforced starting point for boot verification, key protection, measured state, attestation, or rollback control. It may be implemented by immutable ROM, fuses, a secure element, a TEE, or a dedicated security processor.

Why it matters. A verified-boot design is only as strong as the key ownership, update path, rollback state, manufacturing provisioning, and recovery rules anchored in this root.

Example. A production board verifies the first mutable boot stage against an owner-controlled key and records the accepted rollback counter before transferring control.

Also known as / see also. Root of trust

Used in. AOS-ARCH-013#verified-boot; AOS-ARCH-012#keys-and-secrets

Hardware-bound key

Definition. A private key whose use is restricted to a particular secure element, trusted execution environment, or device root of trust and whose raw private material is intentionally non-exportable.

Why it matters. Such keys strengthen device identity and data protection, but they cannot be promised as ordinary portable backup data.

Example. During migration, the new device creates a new hardware-bound identity and the account service authorizes it after the old device or recovery process approves the transition.

Used in. AOS-ARCH-012#keys-and-secrets; AOS-PROD-004#data-classes

HDR (High Dynamic Range)

Definition. Capture and processing techniques that preserve useful detail across a scene with a wider luminance range than one conventional exposure can represent. Mobile HDR often combines differently exposed or temporally adjacent frames.

Why it matters. Quality depends on sensor response, motion handling, alignment, merge weighting, local tone mapping, color, noise, and latency—not merely on taking several frames.

Example. The camera pipeline merges a short exposure that protects highlights with longer exposures that improve shadow signal, while rejecting moving regions that would ghost.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#metrics

Hotplug

Definition. The insertion, removal, reset, replacement, or re-enumeration of a device while the system is running, including the required ownership, cancellation, buffer, and recovery transitions.

Why it matters. USB peripherals, modems, cameras, docks, and removable storage fail unpredictably if services assume that a device remains present forever.

Example. When a USB camera disconnects during capture, outstanding buffers complete with a defined device-removed error and the provider advertises capability loss.

Used in. AOS-ARCH-006#driver-lifecycle; AOS-ARCH-007#service-health

HSM (Hardware Security Module)

Definition. A dedicated device or service that protects cryptographic keys and performs restricted cryptographic operations with audit, role, and tamper controls. Manufacturing HSMs and device secure elements solve different parts of the lifecycle.

Why it matters. Factory signing and key injection must not place product roots in developer laptops or generic test stations.

Example. The release service sends a digest to an HSM-backed signer; the HSM enforces role approval and returns a signature without exporting the release private key.

Used in. AOS-ARCH-012#keys-and-secrets; AOS-HW-008#contract-controls

Hybrid capability system

Definition. A system that combines capability-secured object access with some ambient or identity-based authority. The exact boundary must be explicit because ambient namespaces can reintroduce confused-deputy paths.

Why it matters. Agent OS may need transitional or human-facing namespaces, but native service authority must remain carried by explicit capabilities rather than inferred from process identity alone.

Example. A package can discover the display service by name, but opening a surface still requires a delegated display capability with bounded rights.

Used in. AOS-ARCH-004#capability-model; AOS-ARCH-004#service-routing

I

Idempotency key

Definition. A caller-chosen unique token that lets a service recognize retries of the same logical request and avoid applying an external effect more than once.

Why it matters. Mobile actions cross unreliable networks and restartable services; timeout does not reveal whether a payment, message, or provisioning action committed.

Example. The action broker retries a provider call with the same idempotency key, and the provider returns the original receipt instead of sending the message again.

Used in. AOS-ARCH-010#action-plan; AOS-PROD-002#replay-and-undo

IDL (Interface Definition Language)

Definition. A language for declaring typed messages, services, errors, capability-bearing resources, version evolution, and generated language bindings independently of an implementation language.

Why it matters. IDL is the contract spine that prevents board, vendor, Android, Linux, or in-process structure from becoming the native Agent OS API.

Example. The storage schema declares an asynchronous OpenObject operation and typed error union; Rust and test-harness bindings are generated from the same definition.

Used in. AOS-ARCH-005#idl-purpose; AOS-ARCH-005#type-system

IMEI and TAC

Definition. The International Mobile Equipment Identity identifies a mobile equipment instance; its Type Allocation Code identifies an approved device type allocation. Assignment, storage, repair, cloning prevention, and disclosure are controlled operational and regulatory matters.

Why it matters. A cellular prototype must not invent production identifiers, copy identifiers from another device, or assume that a module identifier satisfies final-device obligations.

Example. Engineering units use module/vendor-approved test identities and a controlled lab network until the product certification and allocation plan is approved.

Used in. AOS-HW-007#program-boundary; AOS-LEGAL-004#cellular-path

IMS, VoLTE, and VoWiFi

Definition. The IP Multimedia Subsystem is the operator service architecture commonly used for voice, messaging, emergency and supplementary services over packet networks. VoLTE and VoWiFi are operator-qualified voice services over LTE and Wi-Fi using IMS profiles.

Why it matters. Successful packet data does not imply voice support. Registration, authentication, provisioning, policy, codecs, emergency behavior, handover, audio, and operator certification are separate gates.

Example. A modem attaches to LTE and obtains data, but the release still reports voice unsupported until IMS registration and emergency-call scenarios pass on approved operators.

Used in. AOS-HW-007#ims-and-voice; AOS-HW-007#emergency-calling

IntentBox

Definition. A contextual surface that presents ranked interpretations, suggestions, and inspectable next actions for the current user intent.

Why it matters. Suggestions must expose provider, effect, data flow, confidence, cost, reversibility, and confirmation rather than silently acting.

Example. After selecting a message thread, IntentBox proposes scheduling, summarization, and reply actions with different trust requirements.

Used in. AOS-PROD-007#intentbox; AOS-PROD-007#failure

IOMMU (Input–Output Memory Management Unit)

Definition. Hardware that translates and restricts DMA addresses used by devices, allowing the operating system to isolate device access to explicitly mapped buffers.

Why it matters. A user-space driver model needs DMA confinement; otherwise a compromised device or driver may read or corrupt arbitrary physical memory.

Example. The resource broker maps a camera buffer into the camera domain only, revokes the mapping after completion, and invalidates stale translations before reuse.

Used in. AOS-ARCH-006#dma-iommu; AOS-ARCH-012#trust-boundaries

IOVA (I/O Virtual Address)

Definition. An address visible to a DMA-capable device after translation by an IOMMU. It is distinct from a process virtual address and from the underlying physical address.

Why it matters. Correct lifetime, ownership, cache, alignment, and unmap semantics prevent devices from retaining access to recycled memory.

Example. The GPU service receives an IOVA scoped to its isolation domain; after the job fence signals, the mapping is released before the memory object is delegated elsewhere.

Used in. AOS-ARCH-006#dma-iommu; AOS-ARCH-008#buffer-model

IPC (Inter-Process Communication)

Definition. The message, call, queue, shared-memory, signaling, and capability-transfer mechanisms used by isolated processes or services to cooperate.

Why it matters. IPC semantics define authority transfer, backpressure, cancellation, priority behavior, failure containment, and much of a microkernel system’s performance envelope.

Example. A camera client sends a bounded request over a channel and receives a capability to a shared buffer collection plus a completion event.

Used in. AOS-ARCH-004#ipc-model; AOS-ARCH-004#message-invariants

IRQ (Interrupt Request)

Definition. A hardware event delivered through an interrupt controller to notify software of device or timer conditions. IRQ handling requires explicit routing, acknowledgement, masking, affinity, storm control, and handoff to user-space drivers.

Why it matters. Interrupt mistakes can deadlock a device, starve the system, lose events, or allow one driver to interfere with another.

Example. The kernel acknowledges the controller, signals the authorized driver domain, and masks a repeated level interrupt until the driver clears the device condition.

Used in. AOS-ARCH-006#interrupts; AOS-ARCH-003#scheduler

ISP (Image Signal Processor)

Definition. A hardware or software pipeline that converts sensor data into usable images through stages such as defect correction, black-level correction, demosaic, noise reduction, color correction, tone mapping, scaling, statistics, and sometimes 3A assistance.

Why it matters. A good sensor alone does not create a good camera; ISP controls, tuning, metadata, timing, and calibration determine much of the result.

Example. A documented-board backend programs the ISP for RAW-to-YUV processing while exporting the same controls and metadata used by the software reference pipeline.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#parallel-camera-paths

Itemized software

Definition. A software model in which entities, views, actions, providers, layouts, rules, and automations are independently addressable and composable items.

Why it matters. It enables adaptation beyond monolithic applications while retaining typed contracts and provenance.

Example. A user combines a contact view, map view, travel provider, and expense rule into a task-specific story.

Used in. AOS-PROD-008#item-model; AOS-RES-006#malleable

J

JDM (Joint Design Manufacturer)

Definition. A commercial model in which a manufacturing partner contributes substantial product design and engineering rather than only building a customer-complete design. Responsibility and ownership vary by contract.

Why it matters. JDM can reduce time and engineering load but can also create hidden dependencies on partner schematics, firmware, tooling, component substitutions, and certification evidence.

Example. The RFI asks whether the partner supplies the reference design, who owns modifications and test software, and what rights survive termination.

Used in. AOS-HW-008#platform-options; AOS-HW-008#contract-controls

Journal compaction

Definition. The controlled reduction of an event journal through snapshots, checkpointing, aggregation, retention, or deletion while preserving declared replay, audit, privacy, and recovery properties.

Why it matters. An indefinitely growing global history is expensive and may violate privacy or deletion expectations; careless compaction can make state unrecoverable or destroy evidence.

Example. After a verified snapshot, old edit events are cryptographically erased under the retention policy while the semantic checkpoint and required audit receipts remain.

Used in. AOS-ARCH-009#event-log; AOS-ARCH-009#privacy-retention

K

Key ceremony

Definition. A documented multi-person procedure for generating, backing up, activating, rotating, recovering, or destroying high-value cryptographic keys under controlled roles, equipment, and evidence.

Why it matters. Release, boot, manufacturing, and account-recovery roots become organizational single points of failure without tested ceremonies.

Example. Two authorized custodians initialize an offline release root, record HSM identifiers and public keys, seal recovery shares, and conduct a restore drill.

Used in. AOS-ARCH-012#keys-and-secrets; AOS-ARCH-013#factory-provisioning

Key wrapping

Definition. Encryption and integrity protection of one key under another key-encryption key, usually with explicit algorithm, context, version, policy, and anti-replay metadata.

Why it matters. Wrapped keys can be stored or moved without exposing raw key material, but portability depends on who controls the wrapping key and whether hardware policy permits unwrapping.

Example. A portable backup key is wrapped to the user recovery key, while a device-bound private key is omitted and regenerated rather than falsely exported.

Used in. AOS-ARCH-012#keys-and-secrets; AOS-PROD-004#backup-bundle

L

Lamport clock

Definition. A scalar logical clock that assigns monotonically increasing values to events so that causally ordered events receive ordered timestamps, without claiming to represent real time or totally order concurrent events by itself.

Why it matters. Distributed local-first histories need causal reasoning even when devices are offline or wall clocks are wrong.

Example. A receiving device sets its Lamport counter above the maximum observed value before appending a dependent event.

Used in. AOS-ARCH-009#event-log; AOS-ARCH-009#local-first-sync

Least authority

Definition. The capability-security form of least privilege: each component receives only the specific objects and operations required for its current task, with no ambient path to acquire broader authority.

Why it matters. It limits damage from compromised drivers, integrations, agents, and services and makes authority reviewable from manifests and capability graphs.

Example. A weather provider receives network access only to approved endpoints and a write capability only for its own cache, not the user’s full entity store.

Used in. AOS-ARCH-012#least-authority; AOS-ARCH-004#rights

Legacy contamination

Definition. The appearance of Android, Linux, POSIX, vendor-HAL, or device-specific types and assumptions in native contracts or product state.

Why it matters. Contamination turns a temporary research aid into a permanent platform dependency and blocks clean portability.

Example. A public IDL field containing a Linux ioctl number fails the interface linter and requires redesign rather than documentation.

Used in. AOS-ARCH-018#prohibited; AOS-ARCH-018#audit

Lens shading correction

Definition. Calibration and processing that compensates for spatial brightness and color variation introduced by the lens, sensor microlenses, chief-ray angle, filters, aperture, and focus position.

Why it matters. Uncorrected shading produces dark corners and color casts; incorrect calibration can create rings, noise amplification, or scene-dependent tint.

Example. The calibration bundle stores per-module gain maps for illuminants and focus ranges, and the pipeline interpolates them using capture metadata.

Used in. AOS-HW-006#calibration-lab; AOS-HW-006#portable-pipeline

Local-first

Definition. A data architecture in which the authoritative user interaction can continue against local state without mandatory network availability, while synchronization, collaboration, and remote services reconcile explicitly later.

Why it matters. It improves latency, resilience, ownership, and offline use but requires conflict, identity, encryption, retention, and external-effect semantics.

Example. The user edits an entity on a flight; local history commits immediately and the sync engine later merges independent changes with provenance.

Used in. AOS-ARCH-009#local-first-sync; AOS-PROD-002#event-envelope

M

Malleable software

Definition. Software whose structure and presentation can be safely reshaped by users, tools, or agents from typed reusable parts.

Why it matters. Malleability must preserve authority, accessibility, provenance, performance, undo, and comprehensibility.

Example. An agent creates a temporary research dashboard from existing views and actions without receiving access beyond the selected data domains.

Used in. AOS-PROD-008#malleability; AOS-PROD-008#boundaries

Materialized view

Definition. A derived, query-optimized representation computed from authoritative events or normalized data and updated incrementally or rebuilt as needed.

Why it matters. Entity surfaces and search should not replay an entire journal for each query, but cached state must remain disposable and versioned.

Example. The activity surface reads a per-entity timeline index that can be deleted and regenerated from retained history events and snapshots.

Used in. AOS-ARCH-009#materialized-state; AOS-PROD-002#timeline-and-search

MBIM (Mobile Broadband Interface Model)

Definition. A standardized host-to-modem control protocol commonly transported over USB for mobile broadband functions such as registration, packet sessions, SIM status, SMS, and device information.

Why it matters. Using a documented module protocol can reduce dependence on a vendor Linux driver, but the Agent OS service still needs its own state machine, security, power, and failure semantics.

Example. A native Agent OS MBIM backend opens a packet session and maps protocol indications into the portable cellular service without exposing MBIM objects to applications.

Used in. AOS-HW-007#modem-strategies; AOS-HW-007#portable-cellular-contract

Measured boot

Definition. A boot process that records cryptographic measurements of loaded code, configuration, and state into a protected log or register for later appraisal, rather than merely deciding whether to execute it.

Why it matters. Measured and verified boot solve different problems: a system may measure untrusted software, or verify software without exposing useful attestation evidence.

Example. Each boot stage extends a measurement and the attestation service signs a report identifying the accepted image, configuration, and rollback state.

Used in. AOS-ARCH-013#boot-chain; AOS-ARCH-012#keys-and-secrets

Memory object

Definition. A kernel-managed object representing a bounded region of memory and its rights, mappings, sharing, backing, pinning, and lifecycle independently of any one process virtual address.

Why it matters. Explicit memory objects make shared buffers, DMA, copy-on-write, revocation, accounting, and process isolation tractable.

Example. The compositor and display service receive different rights to the same buffer object while the producer cannot map it after ownership transfer.

Used in. AOS-ARCH-003#address-spaces; AOS-ARCH-008#buffer-model

MIPI CSI-2

Definition. A widely used camera serial interface protocol that transports image data and embedded metadata from sensors or bridges over D-PHY or C-PHY physical links. Controller programming, lane timing, formats, errors, and board routing remain SoC- and board-specific.

Why it matters. Camera feasibility requires more than sensor documentation: the receiver, clocking, pinmux, PHY, capture engine, bandwidth, and error recovery must all be accessible.

Example. A board package declares lane count and mapping; the camera backend configures the receiver and verifies frame counters and error registers under multiple modes.

Used in. AOS-HW-006#parallel-camera-paths; AOS-ARCH-006#board-package

MMIO (Memory-Mapped I/O)

Definition. A mechanism in which device registers are accessed through specially mapped address ranges with architecture-specific ordering, width, volatility, and barrier requirements.

Why it matters. Incorrect MMIO access can reorder commands, clear status accidentally, expose devices to unauthorized processes, or fail only on another architecture.

Example. The resource broker maps only the display controller register window into the display driver domain and the driver uses typed volatile accesses with required barriers.

Used in. AOS-ARCH-006#driver-model; AOS-ARCH-003#architecture-portability

Modem control protocol

Definition. The command and event language used between the application processor and baseband or cellular module, such as MBIM, QMI, AT commands, or a vendor-specific protocol.

Why it matters. Protocol access is only one layer; production support also depends on firmware, power/reset, SIM/eSIM, packet routing, IMS, diagnostics, certification, and lifecycle.

Example. The same portable registration API is backed by MBIM on one module and a reviewed vendor protocol on another.

Used in. AOS-HW-007#modem-strategies; AOS-HW-007#portable-cellular-contract

MOQ (Minimum Order Quantity)

Definition. The smallest purchase volume a supplier or manufacturer will accept for a component, module, custom variant, build, or lifetime order.

Why it matters. MOQ can make a technically ideal part economically impossible and can force inventory, cash, revision, and obsolescence risk.

Example. The product architecture keeps two camera-module footprints viable because the preferred module requires a 50,000-unit commitment before production tuning support.

Used in. AOS-HW-008#vendor-package; AOS-PLAN-004#cost-model

MTE (Memory Tagging Extension)

Definition. An Arm architecture feature that associates allocation tags with memory and pointer tags so some spatial and temporal memory errors can be detected probabilistically or synchronously.

Why it matters. MTE can strengthen unsafe-code and driver testing, but it does not replace language safety, IOMMU isolation, bounds checks, capability checks, or verification.

Example. Development images run driver domains in synchronous tag-check mode to turn use-after-free defects into attributable crashes.

Used in. AOS-ARCH-012#secure-development; AOS-ARCH-003#architecture-portability

N

Native contract

Definition. An Agent OS-defined interface and semantic model independent of Android, Linux, POSIX, vendor mobile HALs, and a particular board.

Why it matters. Native contracts are the unit of portability, security review, conformance, and long-term evolution.

Example. The camera request/result model is defined in Agent OS IDL and implemented by different target backends.

Used in. AOS-ARCH-001#native-contract; AOS-ARCH-016#layer-model

Native microkernel

Definition. The Agent OS kernel — a fork of Fuchsia's Zircon microkernel — providing isolation, capabilities, IPC, scheduling, memory enforcement, interrupts, and minimal architecture mechanisms, with project-specific board drivers and product layers on top.

Why it matters. It distinguishes the project from an Android distribution, Linux phone stack, or Fuchsia fork.

Example. QEMU and physical ports share kernel semantics while architecture modules implement privileged details.

Used in. AOS-ARCH-002#kernel-scope; AOS-ADR-0001#decision

Non-exportable state

Definition. Data that intentionally cannot be copied out of its security boundary, including many hardware-bound private keys, biometric templates, device attestation roots, and some carrier or secure-element credentials.

Why it matters. A truthful migration design must distinguish regeneration or re-enrollment from backup restoration.

Example. The restore report marks the device attestation key as regenerated and requests re-enrollment with services that trusted the old device.

Used in. AOS-PROD-004#data-classes; AOS-ARCH-012#keys-and-secrets

Normative requirement

Definition. A statement that defines required behavior or constraint for a conforming implementation, usually expressed with controlled terms such as MUST, MUST NOT, SHOULD, and MAY.

Why it matters. Separating requirements from rationale, hypotheses, examples, and plans prevents aspirational prose from becoming an unverifiable contract.

Example. “A delegated capability MUST NOT gain rights absent on its parent” is normative; a discussion of possible table layouts is not.

Used in. AOS-META-002#normative-language; AOS-GOV-001#document-states

NPU (Neural Processing Unit)

Definition. A specialized accelerator for tensor and machine-learning workloads, with vendor-specific compilers, memory layouts, operators, scheduling, firmware, and security boundaries.

Why it matters. An advertised TOPS figure does not establish usable latency, power, model coverage, driver availability, or portable agent/camera execution.

Example. The accelerator backend reports supported operations and falls back to CPU/GPU when a model or privacy mode cannot use the NPU safely.

Used in. AOS-ARCH-006#hal-contracts; AOS-ARCH-010#model-isolation

NRE (Non-Recurring Engineering)

Definition. One-time engineering and setup cost for design, tooling, certification, fixtures, firmware adaptation, calibration, test development, or custom manufacturing before per-unit production.

Why it matters. A low component price can hide large NRE, and NRE ownership determines whether another manufacturer can continue the product.

Example. The ODM quote separates enclosure tooling, camera tuning, RF certification, factory-test software, and BSP adaptation from unit pricing.

Used in. AOS-PLAN-004#cost-model; AOS-HW-008#contract-controls

O

ODM (Original Design Manufacturer)

Definition. A company that designs and manufactures a product platform that another organization brands or customizes. The precise split of design authority, software, certifications, tooling, and lifecycle support is contractual.

Why it matters. ODM access can deliver quality hardware sooner, but weak documentation and rights can recreate the closed-device problem inside a supplier relationship.

Example. The contract requires interface documentation, board files, manufacturing-test rights, update support, change notices, and post-termination access before selecting the platform.

Used in. AOS-HW-008#platform-options; AOS-HW-008#contract-controls

OEM (Original Equipment Manufacturer)

Definition. A context-dependent term for the organization whose brand/product responsibility, design authority, or manufacturing role makes it the product manufacturer. Contracts and regulations, not the acronym alone, determine responsibility.

Why it matters. The program must identify who is legally the manufacturer, who controls software updates, and who owns certification and field failures.

Example. Agent OS may be the product manufacturer while an EMS builds units and an ODM supplies a reference design; the responsibility matrix names each obligation.

Used in. AOS-LEGAL-004#scope; AOS-HW-008#contract-controls

OIS (Optical Image Stabilization)

Definition. A closed-loop mechanism that moves lens elements or the image sensor to compensate for angular hand motion using gyroscope data, actuators, control firmware, calibration, and timing.

Why it matters. OIS quality depends on hardware, calibration, synchronization, temperature, focus, exposure, and interaction with electronic stabilization—not a single enable bit.

Example. The video pipeline timestamps gyro samples and lens position, then combines OIS and crop-based stabilization without fighting the actuator loop.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#calibration-lab

Opaque record

Definition. A versioned payload preserved and transported by a layer that does not interpret its internal fields, usually because the authoritative owner is another service or a future version.

Why it matters. Opaque preservation can maintain forward compatibility, but it must not bypass validation, authority, size, retention, or privacy rules.

Example. The backup service stores an encrypted provider state blob with provider ID and schema version, while only that provider can restore or discard it.

Used in. AOS-ARCH-005#versioning; AOS-PROD-004#backup-bundle

Oracle

Definition. A trusted comparison source used to determine expected behavior or quality in a test. An oracle may be a specification, mathematical model, stock device, reference implementation, laboratory instrument, or reviewed golden trace.

Why it matters. Oracles are scoped: a Pixel stock camera is a quality comparator, not proof of its internal algorithm or permission to copy implementation details.

Example. The Pixel 9 stock image and a calibrated chart measurement serve as separate oracles for visual preference and objective response.

Used in. AOS-HW-002#track-purpose; AOS-RES-004#experiment-record

OSHWA certification

Definition. The Open Source Hardware Association certification program for hardware whose design files and documentation meet its open-source hardware definition and licensing requirements.

Why it matters. Certification can make openness claims precise, but it does not certify product quality, regulatory compliance, component availability, or Agent OS support.

Example. A future community carrier board publishes editable design sources and applies for OSHWA certification after license and documentation review.

Used in. AOS-GOV-002#hardware-maintainers; AOS-LEGAL-003#hardware-ip

P

Page-table shootdown

Definition. The coordination required to invalidate stale translation lookaside buffer entries on all processors that may have cached a page-table mapping after it changes.

Why it matters. Incorrect shootdown can expose freed memory, retain permissions, or cause rare multicore corruption; overly broad shootdown harms performance.

Example. Revoking a mapping sends targeted inter-processor requests and waits for acknowledgement before the physical page is reassigned.

Used in. AOS-ARCH-003#address-spaces; AOS-ARCH-003#architecture-portability

Partner-required result

Definition. A subsystem outcome that cannot be reached economically or lawfully through public documentation alone and therefore requires vendor, FAE, calibration, carrier, laboratory, or manufacturing support.

Why it matters. Classifying it early prevents indefinite reverse engineering and supports targeted negotiation.

Example. Production camera tuning or carrier IMS certification may be classified as partner-required while the native service contract remains project-owned.

Used in. AOS-HW-016#contacts; AOS-LEGAL-011#contacts

Pipeline handler

Definition. A hardware-family-specific camera backend that coordinates sensors, receivers, ISP blocks, buffers, controls, metadata, tuning, and request completion behind a portable camera interface.

Why it matters. It isolates unavoidable SoC pipeline knowledge without turning it into application-visible ABI.

Example. The AM62A handler configures its capture and ISP path, while a software handler implements the same request/result contract on RAW files.

Used in. AOS-HW-006#portable-pipeline; AOS-ARCH-006#hal-contracts

Pixel binning

Definition. Sensor readout that combines adjacent photosites, physically or digitally, to trade spatial resolution for signal, noise, dynamic range, bandwidth, or frame rate.

Why it matters. The marketed sensor resolution is not the default output resolution, and binning modes change exposure, calibration, autofocus, rolling-shutter, and processing behavior.

Example. A nominal 50-megapixel sensor exposes a 12.5-megapixel binned mode with separate gain and shading calibration.

Used in. AOS-HW-006#quality-ladder; AOS-HW-006#metrics

PMIC (Power Management Integrated Circuit)

Definition. A chip that supplies, sequences, monitors, and often protects multiple voltage rails, clocks, chargers, battery paths, regulators, and low-power states.

Why it matters. Native phone bring-up requires correct rail order, voltages, reset timing, sleep states, thermal limits, charger behavior, and fault handling; a booting CPU is not enough.

Example. The board package describes regulator dependencies, and the power service refuses deep sleep until the modem and display rails reach safe states.

Used in. AOS-ARCH-014#device-power-states; AOS-ARCH-006#board-package

Priority donation

Definition. A scheduling mechanism that temporarily applies a blocked client’s urgency or budget to the server holding the resource or processing the request, reducing priority inversion across IPC.

Why it matters. Microkernel systems make service chains explicit; without propagation, a high-priority interaction can be delayed by a low-priority server or unrelated work.

Example. An input thread waiting on the compositor donates urgency through the IPC call until the frame-critical request completes or times out.

Used in. AOS-ARCH-003#priority-inversion; AOS-ARCH-004#ipc-model

Priority inversion

Definition. A condition in which higher-priority work is indirectly delayed by lower-priority work that owns a needed resource, often worsened by medium-priority work.

Why it matters. Unbounded inversion can break touch, audio, camera, radio, and real-time deadlines even when average CPU load is low.

Example. A low-priority driver holds a lock needed by the audio server; donation or a lock-free protocol bounds the delay.

Used in. AOS-ARCH-003#priority-inversion; AOS-ARCH-014#performance-governors

Product quality tier

Definition. A declared level of functional completeness and measured quality for an intended release profile, distinct from simple API conformance.

Why it matters. A backend can be semantically correct yet unsuitable for daily use because of latency, power, reliability, or image quality.

Example. A developer device accepts functional camera capture, while a quality-device profile requires defined shutter lag, low-light, color, and video thresholds.

Used in. AOS-ARCH-020#quality; AOS-VAL-004#release-tier

Property-based testing

Definition. A testing method that generates many inputs and state sequences from declared invariants, then shrinks failures to a small reproducible case.

Why it matters. Capability derivation, parsers, journals, schedulers, allocators, and state machines have combinatorial edge cases not covered by examples alone.

Example. The test generates grant/revoke/transfer sequences and asserts that no descendant ever obtains rights absent from its ancestor.

Used in. AOS-ARCH-015#test-pyramid; AOS-ARCH-004#conformance

Provider manifest

Definition. A signed or authenticated description of a provider’s actions, schemas, effects, required capabilities, data destinations, limits, version, provenance, and lifecycle behavior.

Why it matters. Discovery without a trustworthy manifest would let providers misrepresent authority and side effects.

Example. A payment provider declares read-only quote actions separately from irreversible payment actions and names its confirmation and receipt requirements.

Used in. AOS-PROD-011#native-first; AOS-PROD-003#provider-selection

Provisioning

Definition. The controlled process of assigning device identity, keys, configuration, calibration, certificates, carrier or service credentials, ownership state, and traceability during manufacturing, enrollment, repair, or replacement.

Why it matters. Provisioning joins security, manufacturing, privacy, recovery, and support; ad hoc scripts can leak fleet-wide secrets or create irrecoverable devices.

Example. A factory station authenticates to a bounded service, injects only per-device wrapped material, records a signed result, and cannot read the resulting private key.

Used in. AOS-ARCH-013#factory-provisioning; AOS-HW-008#contract-controls

PTCRB

Definition. A certification program used for cellular devices in applicable North American and partner-market contexts, involving defined test plans and authorized laboratories. Exact scope depends on technology, device category, module inheritance, software, and market.

Why it matters. Using a pre-certified modem module can reduce but not necessarily eliminate final-device, antenna, software, operator, or regression obligations.

Example. The certification matrix records which module reports are reusable and which final-device RF, protocol, emergency, and operator tests remain.

Used in. AOS-LEGAL-004#cellular-path; AOS-HW-007#acceptance

Public evidence bundle

Definition. A reproducible evidence package redacted and licensed for public release while preserving links to the restricted original.

Why it matters. Community validation needs usable artifacts without leaking personal, privileged, NDA, security-sensitive, or redistribution-restricted material.

Example. A boot experiment publishes logs, hashes, procedures, and public code but omits protected firmware and device identifiers.

Used in. AOS-VAL-002#integrity; AOS-VAL-003#publication

Pure capability system

Definition. An authority model in which all access to protected objects is mediated by unforgeable capabilities and there is no separate ambient global namespace that grants equivalent authority.

Why it matters. It provides strong reasoning about delegation and confinement, but practical naming, persistence, revocation, and recovery still require explicit design.

Example. A service cannot open an arbitrary filesystem path by process identity; it can access only directory or object capabilities delegated to it.

Used in. AOS-ARCH-004#capability-model; AOS-ARCH-012#least-authority

Purpose-bound view

Definition. A minimal, derived projection of data granted for one stated task, context, duration, and recipient rather than broad repository access.

Why it matters. It reduces unnecessary agent and provider exposure and makes revocation understandable.

Example. A restaurant-booking agent sees party size, time range, dietary constraints, and approximate area but not the full calendar or address book.

Used in. AOS-PROD-009#agent-view; AOS-LEGAL-010#agents

PVT (Production Validation Test)

Definition. A late hardware stage that validates production-intent materials, tools, lines, yields, test coverage, calibration, packaging, traceability, logistics, service, and quality controls.

Why it matters. A functional engineering prototype does not establish that thousands of consistent, repairable, certifiable units can be built.

Example. The PVT build runs production test and provisioning on the intended line and closes yield, calibration, update, and repair escape criteria.

Used in. AOS-HW-008#prototype-stages; AOS-LEGAL-004#development-stages

Q

QMI (Qualcomm MSM Interface)

Definition. A family of host-to-modem service protocols widely used with Qualcomm-based cellular devices and modules for control, registration, packet data, SIM, messaging, diagnostics, and related functions.

Why it matters. QMI knowledge may enable a documented module backend, but vendor extensions, firmware, licensing, power, IMS, certification, and lifecycle remain separate.

Example. The native backend maps QMI network-registration indications into the Agent OS cellular state model while retaining protocol packets only in restricted diagnostics.

Used in. AOS-HW-007#modem-strategies; AOS-ARCH-011#compatibility-policy

Quality ceiling

Definition. The highest target quality the architecture and selected hardware path are expected to support, independent of the weakest development board.

Why it matters. Temporary open-hardware limitations must not become permanent service or product limits.

Example. Pixel-class camera and display behavior define a ceiling while documented boards prove clean native implementation.

Used in. AOS-HW-013#quality-ceiling; AOS-HW-012#quality-model

Quality floor

Definition. The minimum measured functionality, reliability, accessibility, recovery, and performance required for a named support tier.

Why it matters. It prevents vague statements such as “supported” when a device only reaches early console or a partial demo.

Example. A daily-use profile requires repeatable suspend/resume, update rollback, input latency, network recovery, and battery constraints.

Used in. AOS-VAL-004#release-tier; AOS-ARCH-020#quality

R

RACI

Definition. A responsibility model identifying who is Responsible for doing work, Accountable for the outcome, Consulted before decisions, and Informed of results.

Why it matters. Cross-disciplinary phone work fails when legal, security, hardware, software, product, certification, and vendor obligations have no single accountable owner.

Example. The Pixel boot experiment names one accountable track lead, responsible engineers, counsel and security reviewers as consulted, and product leads as informed.

Used in. AOS-PLAN-001#raci; AOS-PLAN-001#roles

Raw capture path

Definition. The controlled path from sensor output through transport, buffers, metadata, and optional ISP stages to a RAW or minimally processed image accessible to the native pipeline.

Why it matters. RAW access enables independent calibration and computational photography but does not by itself solve timing, 3A, noise, optics, or quality.

Example. A CSI sensor streams Bayer frames with exposure, gain, lens position, timestamps, black level, and calibration identifiers.

Used in. AOS-HW-012#portable-pipeline; AOS-VAL-004#matrix

RAW image

Definition. Sensor-proximate image samples with minimal irreversible processing, accompanied by enough metadata and calibration to interpret black level, CFA, gain, exposure, lens, geometry, and color behavior.

Why it matters. RAW access enables independent pipelines and measurement, but “RAW” may still include sensor correction, companding, binning, remosaic, or proprietary packing.

Example. The capture evidence records the exact sensor mode and exports DNG plus original packed bytes and metadata for independent decoding.

Used in. AOS-HW-006#parallel-camera-paths; AOS-HW-006#metrics

Recovery environment

Definition. A minimal separately bootable environment used to diagnose, update, roll back, repair, erase, or restore a device when the primary system cannot start safely.

Why it matters. Recovery is a privileged attack surface and must preserve authentication, data policy, verified state, user clarity, and physical-threat assumptions.

Example. The recovery UI verifies a signed offline update, shows whether user data is accessible, and requires an explicit destructive confirmation before reset.

Used in. AOS-ARCH-013#recovery; AOS-PROD-004#failure-and-rollback

Redaction

Definition. The irreversible or policy-controlled removal, replacement, aggregation, or masking of sensitive fields before storage, export, logging, search, model input, or publication.

Why it matters. Global history, traces, crash dumps, camera metadata, and modem logs can expose secrets and personal data even when the main payload seems harmless.

Example. The evidence exporter replaces subscriber identity and user content with stable test tokens while preserving state transitions needed for reproduction.

Used in. AOS-ARCH-009#privacy-retention; AOS-ARCH-015#evidence-bundles

Reference model

Definition. A deliberately simple executable or mathematical model that defines expected semantics and supports differential, property, or conformance testing without serving as the production implementation.

Why it matters. It can expose ambiguity in capability, scheduler, journal, and action semantics while keeping host test machinery out of the native architecture.

Example. A deterministic capability model generates transfer/revocation traces that the QEMU kernel implementation must match.

Used in. AOS-ARCH-002#time-and-determinism; AOS-ARCH-015#test-pyramid

Refinement proof

Definition. A proof that a lower-level implementation preserves the observable behavior and security properties of a higher-level abstract specification under stated assumptions.

Why it matters. Testing can find bugs but cannot enumerate all kernel states; refinement provides a path from a small model to implementation assurance.

Example. The capability-table implementation is shown to preserve uniqueness, rights monotonicity, lookup failure, and revocation semantics from the abstract object model.

Used in. AOS-ARCH-002#formal-methods-path; AOS-ARCH-012#assurance-roadmap

Rehydratable state

Definition. State that is not backed up as authoritative bytes but can be reconstructed after authentication or re-enrollment from an external service, device capability, or deterministic derivation.

Why it matters. It reduces backup sensitivity while requiring honest restore status, retry, expiry, and provider lifecycle handling.

Example. After restore, a mail provider reacquires tokens and synchronizes server folders while local-only drafts are restored from portable data.

Used in. AOS-PROD-004#data-classes; AOS-PROD-004#migration-flow

Replacement milestone

Definition. The last accepted milestone for retiring a temporary dependency, compatibility cell, undocumented mechanism, or low-quality substitute.

Why it matters. Without an expiration point, experimental shortcuts become permanent architecture.

Example. A Pixel Android camera bridge is permitted for evidence collection only until the native capture backend reaches its specified gate.

Used in. AOS-ARCH-018#retirement-rule; AOS-PLAN-012#anti-dependencies

Replay protection

Definition. Mechanisms that prevent a previously valid message, command, update, credential, or transaction from being accepted again outside its intended context, usually through nonces, counters, epochs, timestamps, or state binding.

Why it matters. Signed data alone may still be dangerous when an attacker can repeat it to downgrade, duplicate an effect, or restore revoked authority.

Example. The bootloader rejects a correctly signed image whose rollback epoch is below the fused or protected accepted minimum.

Used in. AOS-ARCH-013#anti-rollback; AOS-ARCH-010#action-plan

Resource domain

Definition. An isolation and accounting boundary that owns a defined budget of memory, CPU, handles, DMA mappings, interrupts, devices, power, and restart policy for one or more components.

Why it matters. A user-space driver or agent must not exhaust global resources or retain hardware authority after termination.

Example. The camera driver domain receives bounded pinned memory and its own IOMMU mappings; a crash destroys the domain and revokes the resources.

Used in. AOS-ARCH-003#resource-accounting; AOS-ARCH-006#driver-lifecycle

Restricted evidence bundle

Definition. An access-controlled package containing material that cannot be publicly distributed because of confidentiality, personal data, privilege, security, contract, export, or license restrictions.

Why it matters. Review and implementation roles must receive only permitted evidence classes.

Example. NDA datasheets and counsel analysis are stored separately from public design notes and independent implementation code.

Used in. AOS-VAL-002#integrity; AOS-LEGAL-002#roles

RF and SAR

Definition. Radio-frequency engineering covers antennas, matching, coexistence, emissions, sensitivity, and spectrum behavior. Specific Absorption Rate measures regulated human exposure under defined configurations and procedures.

Why it matters. Changing enclosure, antenna, radio module, power, firmware, or placement can affect compliance even when using a certified module.

Example. The product plan reserves antenna keep-outs and schedules pre-scan and SAR work before mechanical tooling is frozen.

Used in. AOS-LEGAL-004#scope; AOS-HW-008#prototype-stages

Rollback

Definition. A controlled return to an earlier system version or state after a failed update or regression, with explicit compatibility, security, data-migration, and anti-rollback rules.

Why it matters. Blind rollback can reintroduce vulnerabilities or corrupt data written by a newer schema; forbidding all rollback can brick devices.

Example. The updater keeps two boot slots, but the data service permits rollback only while a compatible snapshot exists and security policy allows the image epoch.

Used in. AOS-ARCH-013#migration-and-rollback; AOS-PROD-004#failure-and-rollback

Rolling shutter

Definition. Image capture in which different sensor rows begin or end exposure at different times, causing geometric skew, wobble, banding, or flash artifacts under motion or changing light.

Why it matters. Mobile stabilization and multi-frame processing require exact readout timing; nominal frame rate is insufficient.

Example. The calibration records line time and frame start so gyro integration and motion compensation use the exposure time of each row.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#metrics

Root of trust

Definition. See Hardware root of trust. More generally, the smallest assumed-trust anchor from which verification, identity, authorization, or attestation is derived.

Why it matters. The term must name the actual keys, hardware, provisioning, ownership, and recovery assumptions rather than serving as a generic security label.

Example. The boot root is an owner-controlled public-key hash in protected storage; the account identity root may be a separate user recovery key.

Also known as / see also. Hardware root of trust

Used in. AOS-ARCH-013#verified-boot; AOS-ARCH-012#trust-boundaries

S

Sandbox

Definition. A restricted execution environment that limits a component’s code, files, network, devices, IPC, resources, and side effects, ideally through independent isolation mechanisms and explicit capabilities.

Why it matters. Agents, integrations, codecs, parsers, and legacy helpers process untrusted data and should fail without compromising unrelated state.

Example. A third-party integration receives a temporary action capability, a bounded scratch object, and one network endpoint; it cannot enumerate local services.

Used in. AOS-ARCH-010#model-isolation; AOS-ARCH-012#least-authority

SBOM (Software Bill of Materials)

Definition. A machine-readable inventory of software components, versions, identifiers, relationships, licenses, suppliers, and often hashes or build provenance for a release or device.

Why it matters. SBOMs support vulnerability response and licensing, but they are useful only when generated from the actual build and connected to source and firmware provenance.

Example. The release bundle contains SPDX data for kernel, services, tools, firmware references, generated code, and packaged third-party components.

Used in. AOS-LEGAL-003#compliance-tooling; AOS-LEGAL-003#release-gate

Scene graph

Definition. A structured representation of visual objects, transforms, clipping, stacking, effects, semantics, and sometimes input regions used by a compositor to produce a frame.

Why it matters. A scene graph separates product surfaces from hardware display planes and enables accessibility, damage tracking, animation, and multi-display policy.

Example. The shell submits entity cards and semantic nodes; the compositor chooses GPU composition or direct scan-out without changing the surface contract.

Used in. AOS-ARCH-008#graphics-layers; AOS-ARCH-008#entity-first-ui

Secure boot

Definition. A boot policy that allows execution only when each relevant stage is authenticated against an accepted trust policy, including configuration and recovery paths where required.

Why it matters. Secure boot without owner-controlled keys, anti-rollback, update recovery, and manufacturing integrity may protect a vendor’s control rather than the user’s device.

Example. The ROM verifies the first stage, which verifies the Agent OS image manifest and recovery image before releasing protected secrets.

Used in. AOS-ARCH-013#verified-boot; AOS-ARCH-013#boot-chain

Secure element

Definition. A tamper-resistant component or isolated subsystem designed to store secrets and execute limited cryptographic, identity, payment, SIM/eSIM, or authentication operations through a controlled command interface.

Why it matters. Access to a secure element is not equivalent to export of its secrets; lifecycle, applet authority, provisioning, and vendor/operator control matter.

Example. The eUICC backend requests a profile operation through authorized APDUs but cannot read the profile’s private authentication keys.

Used in. AOS-ARCH-012#keys-and-secrets; AOS-HW-007#program-boundary

Semantic checkpoint

Definition. A compact application- or domain-level state record that captures a recoverable user intention boundary rather than raw memory or every input event.

Why it matters. It supports safe recovery of unsaved work without logging passwords, transient keystrokes, or opaque process memory globally.

Example. An editor checkpoints document operations, selection, provider revision, and undo boundary after a coherent paragraph edit.

Used in. AOS-PROD-002#capture-boundary; AOS-PROD-004#backup-bundle

Semantic journal

Definition. A history of typed domain events, actions, receipts, provenance, checkpoints, and user-visible effects rather than a byte-for-byte or keystroke recording of all activity.

Why it matters. It enables search, explanation, replay, undo, and recovery while permitting privacy classification and retention per event type.

Example. The history records “shared document version 42 with Alex” and the provider receipt, not raw pointer events or secret token values.

Used in. AOS-PROD-002#event-classes; AOS-PROD-002#event-envelope

Semantic transclusion

Definition. A live typed reference that embeds or presents another entity, view, or content fragment while preserving identity, provenance, permissions, update behavior, and snapshot options.

Why it matters. It avoids copy/paste divergence and enables contextual composition across stories and tools.

Example. A project note embeds a live decision and can pin a historical snapshot before publication.

Used in. AOS-PROD-010#transclusion; AOS-PROD-010#resolution

Shutter lag

Definition. The elapsed time between a user or program capture intent and the effective exposure of the desired frame, including focus, exposure convergence, buffering, scheduling, sensor timing, and processing decisions.

Why it matters. A camera can produce high-quality static images yet feel unusable or miss action because latency and selected-frame age are not controlled.

Example. The test records input timestamp, chosen sensor exposure timestamp, preview state, and final image availability across lighting conditions.

Used in. AOS-HW-006#metrics; AOS-ARCH-014#performance-governors

Sidecar

Definition. A separately isolated helper used to access a temporary legacy API, protocol, tool, or device path through a narrow Agent OS adapter. It is not part of the portable native contract.

Why it matters. A sidecar allows bounded Pixel experimentation without permitting Android/Linux types or lifecycle assumptions to contaminate the core system.

Example. A Pixel recovery sidecar invokes an approved stock flashing tool and returns a typed result plus evidence; no product service calls the tool directly.

Used in. AOS-ARCH-011#sidecar-pattern; AOS-HW-002#track-purpose

SideMemo

Definition. A contextual side surface attached to an entity, selection, action, event, or story for notes, provenance, related views, and follow-up without disrupting the primary flow.

Why it matters. It keeps secondary context available without forcing a separate application or unstructured global note.

Example. Selecting a claim opens a SideMemo with sources, experiment status, responsible task, and private annotations.

Used in. AOS-PROD-010#sidememo; AOS-SRC-N001#product-surface

Signal and wait set

Definition. Kernel synchronization primitives that let a task wait for one or more object state changes, cancellations, timeouts, or message readiness without polling.

Why it matters. Their semantics affect races, lost wakeups, cancellation, priority, resource cleanup, and scalable event loops.

Example. A driver waits on an interrupt signal, device-removal signal, request channel, and deadline in one bounded operation.

Used in. AOS-ARCH-003#signals-cancellation; AOS-ARCH-004#ipc-model

SMP (Symmetric Multiprocessing)

Definition. A processor model in which multiple cores share a coherent memory system and are managed by one operating-system instance, subject to architecture topology and interrupt/cache details. This is the standard symmetric-multiprocessing meaning; it is not a project name or product acronym.

Why it matters. Kernel locking, scheduling, TLB invalidation, timers, interrupt affinity, per-CPU state, and memory ordering must be correct before multicore performance claims.

Example. The stress test migrates threads while concurrently mapping and revoking memory, then verifies no stale access across all cores.

Also known as / see also. Symmetric multiprocessing

Used in. AOS-ARCH-003#scheduler; AOS-ARCH-003#architecture-portability

Source authority

Definition. The precedence and permitted use assigned to a source according to origin, date, scope, evidence quality, legal status, and relationship to current decisions.

Why it matters. Conflicting documents cannot be resolved by recency or confidence alone.

Example. Current explicit user decisions outrank historical implementation assumptions, while primary law outranks an informal legal summary.

Used in. AOS-RES-005#authority; AOS-META-003#source-record

Source class and source taint

Definition. A source class labels the legal, licensing, confidentiality, and provenance conditions of material; source taint records which people, specifications, code, tests, or artifacts were exposed to restricted material and what downstream use is allowed.

Why it matters. Clean-room work fails when access history is informal and a later contributor cannot prove independence or publication rights.

Example. An NDA register map is Yellow; only the observation team sees it, and the implementation team receives a counsel-approved functional specification with no protected expression.

Used in. AOS-LEGAL-002#source-classes; AOS-LEGAL-002#artifact-controls

Source escrow

Definition. A contractual arrangement in which source, build material, documentation, or keys are held by a trusted third party and released to the customer only on specified events such as insolvency, support failure, or product discontinuation.

Why it matters. Escrow can mitigate vendor abandonment but is valuable only when contents are current, buildable, legally usable, and paired with necessary tool and patent rights.

Example. The modem agreement requires quarterly escrow updates and a release right if security support ends before the contracted lifecycle.

Used in. AOS-LEGAL-001#contract-principles; AOS-LEGAL-005#contract-asks

Supply-chain provenance

Definition. Evidence that identifies the origin, version, custody, build process, signer, dependency graph, and transformations of software, firmware, models, documentation, and hardware artifacts.

Why it matters. A reproducible build is insufficient when inputs are unknown; an SBOM is insufficient when artifacts are not bound to the release.

Example. The signed release attestation links source commit, toolchain, dependency hashes, firmware manifest, builder identity, tests, and final image digest.

Used in. AOS-ARCH-015#release-reproducibility; AOS-LEGAL-003#provenance-record

Suspend-to-idle

Definition. A low-power state in which most user work stops and devices enter reduced-power modes while memory remains powered and selected wake sources can resume the system quickly.

Why it matters. Phone battery life depends on coordinated service quiescence, modem and sensor state, wake filtering, timers, and measurement—not only CPU sleep.

Example. Before suspend, services publish blockers, the power manager arms approved wake sources, and the evidence records residency and unexpected wakes.

Used in. AOS-ARCH-014#system-suspend; AOS-ARCH-014#background-work

T

Taint boundary

Definition. A repository, role, interface, or process boundary that prevents restricted or disallowed source material from influencing independent implementation.

Why it matters. Clean-room and contractual obligations require enforceable separation, not merely contributor intent.

Example. A specification team may see behavioral observations while implementation contributors receive only the approved independent interface specification.

Used in. AOS-ARCH-018#taint; AOS-LEGAL-002#roles

Target dossier

Definition. A decision-grade package for one hardware target, broader than a board dossier when it includes product quality, partner, supply, legal, cost, certification, and stop criteria.

Why it matters. Purchases and ports should follow comparable evidence rather than enthusiasm for a chipset or brand.

Example. The Pixel 9 dossier combines recovery, boot, display, GPU, power, camera, modem, firmware, rights, cost, and replacement evidence.

Used in. AOS-HW-014#inventory; AOS-HW-011#dossier

TCB (Trusted Computing Base)

Definition. The set of hardware, firmware, software, keys, people, and procedures whose compromise can violate a stated security property.

Why it matters. Calling only the microkernel the TCB hides boot firmware, DMA, update signing, secure elements, critical services, and manufacturing operations that may be equally trusted.

Example. The data-confidentiality TCB includes the kernel, memory controller/IOMMU, storage encryption service, boot chain, key service, and recovery path.

Used in. AOS-ARCH-012#trust-boundaries; AOS-ARCH-012#assurance-roadmap

TEE (Trusted Execution Environment)

Definition. An isolated execution environment supported by hardware and privileged firmware, commonly used for keys, attestation, biometrics, digital rights, or sensitive services. Its security and ownership depend on the platform implementation.

Why it matters. A TEE may reduce exposure but can introduce opaque firmware, vendor signing, limited debugging, and lifecycle dependencies.

Example. Agent OS sends a narrowly defined key-use request to a TEE service and treats the TEE as an explicit external trust domain, not as ordinary RAM.

Used in. AOS-ARCH-012#trust-boundaries; AOS-ARCH-012#keys-and-secrets

Thermal envelope

Definition. The combinations of ambient conditions, device temperature, power, workload duration, enclosure, charging, radios, and cooling within which required performance and safety behavior can be sustained.

Why it matters. Peak benchmark performance says little about camera recording, navigation, modem use, charging, or agent workloads over time.

Example. The quality gate measures 4K recording plus cellular upload at defined ambient temperature until steady state, recording frame drops and skin limits.

Used in. AOS-ARCH-014#thermal-management; AOS-HW-010#weighted-categories

TLB (Translation Lookaside Buffer)

Definition. A processor cache of recent virtual-to-physical address translations and permissions.

Why it matters. Page-table changes, address-space identifiers, revocation, DMA, and multicore shootdown must account for cached translations or stale access can persist.

Example. After removing an executable mapping, the kernel invalidates affected TLB entries before reusing the physical page for another process.

Used in. AOS-ARCH-003#address-spaces; AOS-ARCH-003#architecture-portability

TOCTOU (Time of Check to Time of Use)

Definition. A race in which a security or validity condition is checked and then changes before the protected operation uses it.

Why it matters. Pathnames, grants, buffers, manifests, device state, and user confirmations can be swapped or revoked between planning and execution.

Example. The action broker binds confirmation to an immutable action-plan hash and the provider revalidates the live capability at commit time.

Used in. AOS-ARCH-004#message-invariants; AOS-ARCH-010#confirmation-policy

Tone mapping

Definition. The mapping of captured or scene-referred luminance and color into the limited range of an output image or display, often with global and local contrast decisions.

Why it matters. Tone mapping strongly shapes perceived mobile-camera quality and can create halos, flattened faces, clipped highlights, or inconsistent video when unstable.

Example. The HDR pipeline applies a scene-adaptive curve with temporal smoothing and evaluates skin, highlight roll-off, and local contrast on the scene corpus.

Used in. AOS-HW-006#portable-pipeline; AOS-HW-006#metrics

Trace harness

Definition. Infrastructure that records, normalizes, replays, compares, and validates service-level event traces against native contracts.

Why it matters. It turns external behavior into repeatable tests without adopting the external implementation ABI.

Example. A recorded camera lifecycle is replayed in QEMU to test cancellation, metadata ordering, and device-loss behavior.

Used in. AOS-ARCH-020#mocking; AOS-VAL-002#automation

Trace replay

Definition. The deterministic feeding of recorded, sanitized hardware or service events into a native implementation to reproduce timing, state transitions, errors, and regressions without executing the original legacy stack.

Why it matters. It converts Pixel, modem, camera, power, and input observations into portable tests while preserving the Android/Linux containment boundary.

Example. A recorded stock-modem sequence is replayed against the Agent OS state machine and compared with the expected registration and failure transitions.

Used in. AOS-ARCH-011#trace-replay; AOS-ARCH-015#test-pyramid

Transactional update

Definition. An update design in which image installation, verification, activation, migration, health confirmation, rollback, and cleanup have explicit atomic or recoverable boundaries.

Why it matters. Power loss or crash during update must not leave an unverifiable mixture of old and new code or incompatible data.

Example. The inactive slot is written and verified, activation is committed in protected metadata, and the previous slot remains available until health checks pass.

Used in. AOS-ARCH-013#update-system; AOS-ARCH-013#migration-and-rollback

Trust ladder

Definition. A graduated authorization model that increases an agent’s autonomy only as scope, reversibility, sensitivity, evidence, user confirmation, and policy permit.

Why it matters. Treating every agent as either read-only or fully autonomous produces poor usability or unacceptable risk.

Example. An agent may observe calendar state, propose a trip, reserve a refundable option under a budget, but must obtain confirmation before a non-refundable purchase.

Used in. AOS-ARCH-010#trust-ladder; AOS-ARCH-010#confirmation-policy

Trust tier

Definition. A context-specific level controlling whether an agent may observe, propose, execute reversible actions, request sensitive confirmation, or act autonomously within budgets.

Why it matters. Trust must be narrower than a global “agent enabled” switch and can vary by provider, data domain, and effect.

Example. An agent may auto-file local notes but only propose a bank transfer and require explicit biometric confirmation for execution.

Used in. AOS-ARCH-010#trust-ladder; AOS-VAL-005#agents

Tuning profile

Definition. Versioned parameters, curves, matrices, models, thresholds, calibration references, and control policies that adapt a camera or other subsystem to a specific sensor, lens, board, mode, temperature, and quality target.

Why it matters. Tuning is executable product knowledge and must have provenance, licensing, validation, versioning, and rollback like code.

Example. The camera package selects a signed profile by module serial range and sensor mode, then records its hash in image metadata and evidence.

Used in. AOS-HW-006#calibration-lab; AOS-ARCH-013#migration-and-rollback

U

UEFI (Unified Extensible Firmware Interface)

Definition. A standardized firmware interface and boot environment used on many systems to discover devices, load images, expose boot services, and hand control to an operating system.

Why it matters. UEFI can accelerate QEMU and development-board bootstrapping, but Agent OS must still define its post-handoff memory map, trust, device ownership, and architecture-native boot path.

Example. The x86_64 port receives the image and memory map from UEFI, exits boot services, validates ownership, and initializes Agent OS page tables before starting the kernel.

Used in. AOS-ARCH-013#boot-chain; AOS-ARCH-003#architecture-portability

User-space driver

Definition. A hardware driver that executes outside the kernel in an isolated process or domain and accesses only delegated MMIO, interrupts, DMA, clocks, and related resources through kernel-mediated capabilities.

Why it matters. It reduces kernel TCB and enables restart and fault attribution, but requires secure resource brokering, DMA isolation, lifecycle protocols, and performance measurement.

Example. The USB host controller driver crashes; its domain is restarted and re-enumerates devices without granting it unrelated storage registers.

Used in. AOS-ARCH-006#driver-model; AOS-ARCH-006#driver-lifecycle

UVC (USB Video Class)

Definition. A standardized USB device class for cameras and video sources, defining descriptors, streaming interfaces, formats, controls, and negotiation behavior.

Why it matters. UVC provides a practical documented camera bench and early physical capture path without committing to a SoC MIPI/ISP stack.

Example. The board enumerates a UVC camera, negotiates a YUYV stream, and presents frames through the same portable camera service used by native sensors.

Used in. AOS-HW-006#parallel-camera-paths; AOS-ARCH-006#portable-development

UWB (Ultra-Wideband)

Definition. A short-range radio technology using very wide bandwidth for ranging, positioning, discovery, or data functions, with region-specific spectrum and product requirements.

Why it matters. A quality phone may include UWB, but native support requires radio control, secure ranging, calibration, coexistence, privacy, and certification—not just device enumeration.

Example. The service exposes a consented ranging session with bounded peers while the hardware backend owns calibration and regional channel policy.

Used in. AOS-HW-007#wireless-and-gnss; AOS-LEGAL-004#scope

V

Vector clock

Definition. A logical timestamp containing one counter per participant or replica, allowing a system to distinguish causal ordering from concurrency among events.

Why it matters. It provides richer conflict information than a scalar clock but increases metadata and participant-management complexity.

Example. Two offline devices produce incomparable vector clocks, so the merge policy preserves both edits and records a user-resolvable conflict.

Used in. AOS-ARCH-009#local-first-sync; AOS-ARCH-009#crdt-policy

Verified boot

Definition. A boot chain that cryptographically authenticates executable and policy artifacts before use and binds acceptance to a root-of-trust and rollback policy.

Why it matters. It protects integrity but does not by itself guarantee confidentiality, absence of vulnerabilities, correct recovery, or user ownership of the signing key.

Example. The boot manager verifies the signed manifest, each image hash, configuration digest, and rollback epoch before launching the system slot.

Used in. AOS-ARCH-013#verified-boot; AOS-ARCH-013#anti-rollback

Vsync (Vertical Synchronization)

Definition. A display timing event or prediction associated with refresh boundaries, used to schedule composition, buffer presentation, input sampling, and frame pacing.

Why it matters. Ignoring vsync causes tearing, uneven latency, missed frames, and excess power; blindly waiting can also add latency.

Example. The compositor predicts the next presentation deadline and starts rendering early enough to submit the finished buffer before scan-out.

Used in. AOS-ARCH-008#performance; AOS-ARCH-008#display-and-color

W

Wake source

Definition. A hardware or software event authorized to resume a suspended system, such as a power button, timer, modem indication, charger, alarm, or selected sensor condition.

Why it matters. Unbounded wake sources destroy battery life; overly strict policy misses calls, alarms, safety events, or user input.

Example. The power manager arms the modem and alarm timer but suppresses a noisy sensor until its driver clears the fault and records the wake reason.

Used in. AOS-ARCH-014#system-suspend; AOS-ARCH-014#background-work

Wire format

Definition. The exact byte-level representation, alignment, framing, endianness, tags, handles, limits, and evolution rules used to exchange an IDL message or stored record.

Why it matters. Language-level types are not interoperability; a stable and validated wire format is required across processes, versions, architectures, and generated bindings.

Example. An older service skips an unknown optional field but rejects a message whose declared handle count exceeds the bounded envelope.

Used in. AOS-ARCH-005#type-system; AOS-ARCH-005#versioning

Working set

Definition. The subset of code and data actively needed over a time interval, often used to reason about memory pressure, caching, paging, launch latency, and background retention.

Why it matters. Mobile systems have tight memory and power budgets; retaining every agent, surface, or cache harms foreground quality and may increase storage churn.

Example. The process manager trims a background provider’s reclaimable cache while retaining its semantic checkpoint and restart metadata.

Used in. AOS-ARCH-003#resource-accounting; AOS-ARCH-014#background-work

Z

Zero-copy

Definition. A data path that avoids one or more CPU-mediated payload copies by sharing, transferring, mapping, or directly producing into controlled buffers while preserving ownership and synchronization.

Why it matters. Camera, display, audio, networking, and storage throughput benefit, but zero-copy can expand authority, pin memory, expose stale data, and complicate lifecycle.

Example. The camera produces into a buffer collection accepted by the compositor; fences and capability rights prevent reuse until every consumer releases the frame.

Used in. AOS-ARCH-004#streaming; AOS-ARCH-008#buffer-model