The open runtime for apps on NEAR — composed from published config and loaded through a shared host, UI, and API runtime.
Runtime:
A published app configuration (bos.app.ts authored, resolved through extends) that the host loads as remotes.
Avoid: app (ambiguous between the runtime and a tenant), project
SlotResolver:
The host's entry-URL seam (entryUrls in everything-dev/ui/slot) — one pure derivation from a stamped config slot (EntrySlot) to the URLs each surface loads: web (browser entry — bustered fixed name in development, pin-derived hashed outside it), ssr (server container entry; undefined when the slot has no SSR coordinates), and browserManifest (the pin-derived hashed mf-manifest, structurally absent for local slots — atomic-deploys 08). Surfaces resolve lazily and throw loudly outside development naming slot + surface; buster arithmetic (integrity for web, ssrIntegrity→containerVersion for the server) lives inside the module, never at call sites.
Avoid: resolveEntryUrlForEnv (the deleted per-surface helper), remoteEntryUrlOf/ssrEntryUrlOf/getSsrEntryUrl (the deleted per-site wrappers), buster at the call site
Quiet build:
The prerequisite dist builder in everything-dev/build — one function (buildPackageQuietly) over the three framework packages (every-plugin, better-near-auth, everything-dev), each identified by its staleness-check dist entry. Skips when the dist is fresh, rebuilds captured-output-quietly, and fails loudly on nonzero exit; used by bos build's train and the bos dev boot build.
Avoid: buildEverythingDevQuietly/buildEveryPluginQuietly/buildBetterNearAuthQuietly (the deleted triplication), force-rebuild as the default path
Authored surface:
The ui files an app owns and edits freely — routes, lib, components, plus the scaffolded-once router.tsx (router policy) and app.ts (@/app public surface). The framework owns none of it after init.
Avoid: framework files (ambiguous — the generated stubs are framework-owned too), boilerplate
Framework-owned file:
A child-repo file in the src/services/scaffold/ownership.ts inventory (everything-dev package) — reconciled from the parent template by bos sync / bos upgrade with three-way hash comparison, template-wins-on-conflict, and backups under .bos/sync-backup/ (ADR 0032). Local edits are legitimate; a permanent change requires an upstream issue at the framework repo, which ships it in package versions.
Avoid: sync file (implementation detail), boilerplate (ambiguous), "don't touch" framing (the marker says edits are allowed)
Upstream-change protocol: The standard for changing framework behavior (ADR 0032): edit framework-owned files locally when needed, then file an issue at https://github.com/NEARBuilders/everything-dev/issues describing the change — the framework team implements it in the parent repo via PR + changeset and ships it in package versions, after which the child copy and the template converge. A local edit without an upstream issue is an undocumented fork claim. Avoid: "you can't change this" (wrong), silent forking (the issue is the contract)
Generated stub:
A .gen-suffixed, gitignored ui file the framework emits — web entry, hydrate wiring, SSR router module, compose expose, globals — regenerated by dev/build/typecheck from the installed package version, never edited or synced.
Avoid: sync file, template file (sync no longer carries ui source)
Deploy leg:
One of the post-publish stages of bos deploy — image (build/push or pin the runtime image), smoke (the boot gate), railway (the redeploy trigger). Each leg reports an outcome (ok / skipped / failed + reason) on the deploy result; a skipped leg never fails the deploy.
Avoid: stage (dev/build/upload/publish are train stages, not legs), step
Runtime tier:
Whether the deploy train owns its runtime image — root (a Dockerfile at the config root or BOS_IMAGE; the train can produce a digest and must pin Railway to it) or child (inherits the platform's universal image per ADR 0020/0021; its image ref derives from the platform release manifest — no image bytes to build, pin, or boot). One function resolves it; the image, smoke, and Railway gates all consume it.
Avoid: root vs consumer (the account naming, not the image-ownership question), tenant tier
Platform release manifest:
The machine-readable contract of one framework release (ADR 0034): framework + every-plugin versions, the release catalog, exact shared-dep versions with their flags, the hashed template inventory, and the compat floor — composed once by the deploy train and published to two homes with byte-identical content (the FastKV pointer slot apps/<root-account>/<root-gateway>/platform.json beside the config, and the in-image copy generated inside the docker build). Carries image ref + tags, never the digest.
Avoid: version manifest (that's the per-workspace deploy pin), plugin manifest (the per-plugin bundle metadata), release notes
Derived pin:
The child's single authored platform: "<framework-version>" field in bos.app.ts — everything else (catalog entries, the deploy-time image ref ref@v<version> with its registry digest, the release-scoped sync source, compat verification) derives from the resolved manifest, so no hand-correlated pin pairs remain. Exact in v1: no ranges; absent means latest via extends. The old ci.image hand-pin is removed — a deploy fails fast on it.
Avoid: platform version (ambiguous with the manifest's own frameworkVersion), image pin (the digest is derived, not authored), version bump
Runtime map:
The generated composition inventory (ADR 0034-adjacent, #591/#594) — every bos types gen run composes the ui sources (core, auth-ui, plugin UIs) with core-wins precedence and emits .bos/generated/runtime-map.json + ui/src/lib/runtime-map.gen.ts: mounts, every route with its owner and full path, shadowed claims, and the backend inventory (host, api, the auth server, plugin backends — remote ones carry the composed plugin version + contract hash from their published plugin.manifest.json). A static model of constructTree, kept honest by a parity test against the real engine. The first lookup for route/service ownership and local-vs-upstream classification (docs/agents/runtime-map.md); never grep node_modules.
Avoid: version manifest (that's the per-workspace deploy pin), plugin manifest (the per-plugin bundle metadata), route manifest (the per-ui-source input the map is composed from), composition report
Pin plane: One of the three independently-pinned byte sources a booting runtime consumes — image (the digest-pinned universal image), config (on-chain FastKV, account-key signed, atomic), bundles (CDN bytes whose sha384 SRI is recorded inside the on-chain config). The security model (ADR 0036): each plane's bytes verify against pins recorded in a different plane, so compromising any single plane is insufficient. Speed asymmetry is part of the model — config moves fast (atomic publish, minutes), image moves slow (rare smoke-gated rebuilds). Avoid: trust layer, security layer (nothing is layered — the planes are peers), integrity plane (integrity is one pin among three)
Team: A named sub-group within an organization that shares access to the organization's feature areas. Avoid: team account, team wallet
Active Team: The Team currently selected for a user's organization work. Avoid: current team, team account
Feature Area: A product capability that an organization can grant to a Team. Avoid: permission, role
Team Workspace: The organization view scoped to an Active Team and its granted feature areas. Avoid: organization account
Statement:
A declared resource-to-actions entry in the permission catalog (email: ["read"]); the only things a role can grant. Undeclared means denied.
Avoid: permission (reserve for a statement:action pair), scope, binding
Role Grant:
The per-statement action grants a Role carries, declared in the runtime's siwn.permissions.roles config — the plugin ships no defaults.
Avoid: role permissions, role config
Effective Permissions:
The caller's resolved statement-to-actions map as of the request: session principals get their active organization's role grants, API-key principals get the key's declared permissions, anonymous callers get none. Surfaced by getContext and checked by requirePermission.
Avoid: permissions (unqualified, when you mean the resolved map), grants (when you mean the map)
Permission Registry: The runtime's normalized statements catalog plus role grants, built from config at boot and exposed as the auth plugin's registry service. Avoid: ACL, access list
Session Data Cookie: Better Auth's short-lived cookie cache of the session as of its last refresh; its team guards resolve the session from it, not from the database row. Writes that clear session state in the database strip it from the forwarded request so the guard re-reads the fresh row via the session token. Avoid: session cache, active-team cookie (say which state it caches)
Gateway Origin: The canonical base runtime origin for a network, where every passkey ceremony takes place regardless of which domain the member arrived from. Avoid: base URL, main domain
Device Link: Signing a desktop browser into an existing session by approving the desktop's QR code from a phone that is already signed in. Avoid: device pairing, sync, cross-device passkey (the browser-native hybrid flow is a different mechanism)
Stack:
The fixture a regression suite runs against: start (the production command — the host booted over locally built, statically served artifacts via bos start --config) or dev (the dev server, bos dev — smoke-covered only).
Avoid: environment (that's production/staging), target
Variant:
The render mode a stack runs with: ssr (server-composed) or csr (no ssr URL — the client composes). Written stack:variant (e.g. start:csr); a bare stack name runs both variants serially (test:regression:start / test:regression:dev).
Avoid: mode (reserved for production/staging env), project
Stall Watchdog: The Playwright reporter that fails the suite after minutes of zero test progress, printing a runner snapshot so a freeze produces evidence instead of eating the job timeout. Avoid: timeout (the job-level kill; the watchdog exists because that kill loses artifacts)
Gas Key: A NEAR access key (NEP-611) with its own prepaid gas balance and parallel nonce lanes; gas burns from the key's balance, not the account's. Avoid: prepaid key, allowance (a function-call key's allowance spends the account's own NEAR — a different mechanism)
Session Gas Key:
The browser-generated Gas Key scoped to the FastKV namespace's __fastdata_kv method, bootstrapped onto a user's account at their opt-in and used to sign platform writes locally.
Avoid: session key, FCAK, gas key (that's the protocol concept — be specific about which)
Sponsor:
The funding role of the ephemeral relayer account: it tops up Session Gas Keys via TransferToGasKey under server-enforced per-user caps.
Avoid: relayer for this role (the relayer is the NEP-366 role of the same account — say which you mean)
Bootstrap:
The one-time, wallet-signed AddKey transaction that installs a Session Gas Key on the user's account; refused for wallets whose manifest lacks features.gasKeys.
Avoid: provision, register
Lane: One of a Gas Key's independent nonce sequences; parallel sends pick different Lanes and never serialize on each other. Avoid: nonce (the per-lane counter), slot
Custody Wallet:
An OutLayer Agent Custody wallet (wk_… key, TEE-held keys) registered once per user and network during bos login --custody; its implicit hex account is the signing identity for publish.auth = "custody" publishes.
Avoid: outlayer credential, agent wallet (say custody)
Machine identity:
The custody wallet's implicit hex account as the deploy target: the authored config's account must equal it, so configs publish under apps/<hex-account>/<gateway> instead of a named account.
Avoid: bot account (not a named account), executor (OutLayer's own term for something else)
Hosting adapter: The platform's only seam for operating runtime instances — deploy an image with identity env, report what is running, restart, stop. Substrate implementations (Docker, Railway, Fly) hide behind it; swapping substrate is a wiring change. Avoid: provider (Alchemy's own term for its resource kits — say which), deploy leg (a train stage, not the seam)
Deploy console: The root app surface that lists deploys from on-chain audit manifests and drives rollback and log investigation for the root and every child. Avoid: dashboard, admin panel, hosting UI
Rollback unit: The whole of a console rollback, FastKV-first: re-publish the previous verified snapshot (config + manifest pins, SRI-checked, refused outright on failure), then restart the instance against the rolled-back pin. Shared-host tenants get the config half only — per-request resolution makes it instant. Avoid: redeploy (the instance half alone), image rollback (implies the image is the unit)
Reconciler: The platform-side watcher that converges platform-hosted instances to each namespace's latest published fingerprint — making publish the deploy action. Idempotent; failures surface as drift. Avoid: relay, agent, deploy trigger
Fleet: The set of runtime instances the platform hosts on its own managed substrate — the root pair, own-instance children, and sandbox leases. Avoid: cluster (carries Kubernetes connotations we rejected), infra (too broad)
Secrets vault:
The per-deployment store of sealed runtime secrets in the api shell — keyed (account, gateway, name), sealed with the proven sealed-box cipher under a per-runtime KEK. Values are never echoed back; each deployment keeps its own vault (a single global one would be a trust disaster).
Avoid: KMS (implies an external service), .env (the vault's whole point is not needing one), secret manager
KEK (key-encryption key):
The per-runtime AES key that seals a runtime's secrets — HKDF'd from the platform root secret (BETTER_AUTH_SECRET) with a runtime-scoped salt. Its source is a swappable sub-seam: the custody-TEE swap (ticket 13) changes where the KEK comes from without touching the schema, CLI, or config declarations.
Avoid: root key (that's the platform secret the KEK derives from), master key