Glossary

App scope — the compiler-owned identity of one installed app instance, combining app id and installation uid. An in-place update retains it; uninstall and later reinstall allocate a new uid. Capability leaves capture it; app code never receives it.

Assembler — the component that generates one Motoko actor source from a set of manifests. Its identity string (currently neutron_actor_v25) appears in runtime info.

Attenuated leaf — a capability handle exposing only verbs, with the dangerous primitives captured inside the kernel. The general shape of every injected capability.

Background — an app's single optional hidden resident iframe, mounted while the workspace shell is mounted.

Capability plan — the compiler's canonical, versioned normalisation of a manifest's declared capabilities plus derived memory, dependency, function, and endpoint entries, carrying a deterministic SHA-256 fingerprint.

Certified asset — a stored file served with certificate and witness material that a gateway or client can verify against the canister's certified-data root. Successful verification provides integrity, not confidentiality.

Content addressing — naming a Motoko module by the SHA-256 of its final content, after comments are stripped and imports are rewritten to hashes.

Controller — an IC management controller of the canister. Strictly more powerful than kernel authorization: it can replace code, change settings, stop, or delete the canister outside Neutron's rules.

Credentialless — an iframe attribute preventing ambient credential reuse. Combined with sandbox="allow-scripts" (no allow-same-origin) it gives app frames opaque origins.

Dedicated resident origin — a real (non-opaque) origin granted to a background only, in either credentialless-ephemeral or persistent mode. Mutually exclusive; never granted to tiles or trays.

Deployment id — a 32-hex identifier derived from the complete compile inputs and, for a deploy transaction, a fresh random nonce. Mutable install metadata is staged under it and runtime info reports it for verification.

Dispenser — the hosted service that creates a canister and installs a distro for a user who does not have one.

Distro — an operating system built on the Neutron kernel: the kernel, whether stock or forked, plus the starter apps, assets, and runtime configuration seeded when the canister is provisioned. SushiOS is the first.

Endpoint — a kernel-attested id for a live frontend surface, such as app:notes:tile:main:instance:3.

Fingerprint — a deterministic SHA-256 over a normalised structure (a capability plan or a route declaration), used to compare authority facts across compilation, install, commit, and Settings.

Install journal — stable state recorded before the one-way self-upgrade. It binds the target deployment, asset copies and clear prefixes, removed app ids, and the complete committed and target app-instance inventories used for activation, commit, abort, and lost-reply recovery.

Kernel — the core an operating system is built on, packaged and installed through the same transaction as apps but with special trusted privileges and a non-launchable registry entry. A package with id kernel is a kernel replacement. See also Distro.

Lease — an actor-local resource epoch a broker captures before dispatch and rechecks after every await, so disable-then-re-enable cannot validate a suspended operation.

Logical vs. physical method name — logical is the app-local name in the manifest. Ordinary non-kernel methods use the generated Candid name app_<app-id>__<logical-method>; kernel methods remain unmangled, while public ingress uses app/protocol/mode dispatchers.

Managed memory — declared, versioned, per-app persistent state with immutable schemas and forward migration edges.

Manifest — neutron.json: package metadata, backend and frontend structure, and the maximum authority the package requests. Installing it does not grant authority beyond the compiler's closed capability projection and deployment approval.

Migration edge — a bounded synchronous function converting one memory schema version to a later one.

.neutron — the package archive: gzipped files in a MessagePack-encoded flat path map.

Network id — the 32-byte immutable value derived from the deployment's trusted root key and compiled into the actor. Public identity, not authority.

Packed version — an app release encoded as major * 10_000 + minor * 100 + patch.

PocketIC — the pinned local IC implementation the provisioner supervises for local development.

Preapproved self call — a declared exact method of the declaring app, callable from its own live endpoints without a per-call dialog. Removes frontend consent only.

Provisioner — the operator tool that creates, destructively reinstalls, and verifies whole canisters locally or in production. The separate hosted dispenser can create new instances but has no reinstall or delete API.

Public ingress — an app's declared public Candid routes, dispatched through a compiler-generated per-app/protocol/mode method.

Registry — /system/apps.json, the strict projection of installed apps including the canonical capability plan.

Reservation — an owner-approved persistent grant authorizing outbound canister calls to a scope. Revocable in Settings.

Resident — synonym for the background process.

Retirement — the commit-atomic removal of a memory root, staged through an inaccessible optional field so data survives activation.

Sender-push-and-pay — the cross-Neutron protocol model: a sender discovers recipients, pushes the write, and attaches at least the recipient's declared cycle floor. Recipients never poll.

Session grant — a browser-memory grant for an exact endpoint and tool pair, gone on reload. Never serialised into the durable registry.

Setup manifest — a certified neutron-repo-v1 package set naming exact package bytes by id, version, SHA-256, and size. A separate manifest index exists for provider tooling and is not used to drive setup.

Stable signature — the Motoko description of an actor's persistent state, compared between the active and candidate builds before any active metadata write.

Tile — a window in the workspace. Definitions are declared; instances are created per launch.

Tray — an app's single optional top-right icon and transient popover, requiring a background. Always opaque and credentialless.

Workspace — one tiling layer in the shell, holding a binary split tree of tile instances. Up to 20 sequential workspaces.