SourceOS-Linux · mdheller · Aug 2, 2026 · Aug 2, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). Thi
 ## [Unreleased]
 
 ### Added
+- Glossary alignment v0.1 (vocabulary as governance substrate, task #13): `GlossaryTerm` extended with `partOfSpeech` (NP/VP, Tesnière), `status`, a 3-method `alignment` (formal ontology class + NP↔VP vector link in the sovereign 768 space + estate entity/service binding), and typed `relations` over a closed RDF/RDFS/SKOS/FOAF predicate set (is-type/has-type, is-a, has-a, is-member/has-member, skos:broader/narrower/related, foaf:member, has-datatype). Fail-closed drift-guard (`validate_glossary_alignment_examples.py`): an `approved` term must be captured+vector-aligned+implemented (NP→entity, VP→action/service) or it's a governance hole; vector links must be reciprocal; relation inverse-pairs reciprocate; `skos:related` is symmetric; `is-a` subsumption is acyclic. Teeth-verified. Backward-compatible (optional). Follow-ups: LSA↔LDA currency detection + agreement test vs the blast-radius graph + neurosymbolic domain.
 - Receipt **epistemicLevel** (SP-GATE-003, closes audit G3): `ReleaseReceipt` and `SyncCycleReceipt` may now carry `epistemicLevel` (`Proved`/`Speculative`/`Refuted`) + an `attestation` block — the MEET of attestation ∧ verification. Optional + backward-compatible; `tools/validate_sync_cycle_receipts.py` RECOMPUTES the meet and rejects a declared value that disagrees, so a receipt can never claim `Proved` while unsigned or after a failed check (absence of a signature returns Speculative, not Proved). Consumes the explicit `attestation.signed` from SP-GATE-002 (source-os #312) and the SyncCycleReceipt attestation from SP-GATE-001. Examples: verified+signed→Proved, verified-but-unsigned→Speculative, failed→Refuted, dry-run→Speculative. Teeth-verified.
 - Data-Acquisition **citable commons** (WO-COMMONS-2): a promoted platform `CatalogEntry` may carry `promotion.doi` and the approving `DataAcquisitionRequest` records the same `mintedDoi` — a citable DOI (Zenodo/DataCite-style) minted when the governance ∧ IP/legal meet approves promotion. Invariants (schema `allOf` + validator): a DOI may appear only on a `promoted` entry, `mintedDoi` only on an `approved` DAR, and where both are present they must be equal (minted once). Grounds the governed platform tier as a citable open commons.
 - Data-Acquisition governance family v0.1 (auto-catalogue + gated promotion): every doc/dataset/collection is auto-catalogued as a `CatalogEntry` at `user`/`project`/`chat` scope (new optional `scope`/`ownerRef`/`promotion` fields, backward-compatible; absent scope = legacy `platform`), visible only in its owner's catalogue view. Promotion to **platform** scope is authorized ONLY by an approved `DataAcquisitionRequest`, whose approval is the fail-closed **meet** of two independent gates — a governance review AND an IP/legal rights review (`state:approved` ⇔ both `approved`; enforced by schema `allOf` and RECOMPUTED by the validator in both directions, so neither a rubber-stamp nor a single-gate approval survives). Binding invariant: a `scope:platform` entry must carry `promotion.state:promoted` + a `darRef` resolving to an approved DAR that names it — no object reaches platform without an approved request. Includes user/platform CatalogEntry + approved/in-flight DAR examples, six negative vectors with named `failValidator`, `validate-data-acquisition-examples` target, and a normative spec note (`specs/data-acquisition-contract.md`). Intended reference implementation: `catalog-gateway`.

diff --git a/Makefile b/Makefile
@@ -1,12 +1,16 @@
-.PHONY: validate validate-resource-contract validate-measurement validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-ingestion-pipeline-examples validate-data-acquisition-examples
+.PHONY: validate validate-resource-contract validate-measurement validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-ingestion-pipeline-examples validate-data-acquisition-examples validate-glossary-alignment-examples
 
-validate: validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract
+validate: validate-glossary-alignment-examples validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract
 	@echo "OK: validate"
 
 validate-ingestion-pipeline-examples:
 	python3 -m pip install --user jsonschema >/dev/null
 	python3 tools/validate_ingestion_pipeline_examples.py
 
+validate-glossary-alignment-examples:
+	python3 -m pip install --user jsonschema >/dev/null
+	python3 tools/validate_glossary_alignment_examples.py
+
 validate-data-acquisition-examples:
 	python3 -m pip install --user jsonschema >/dev/null
 	python3 tools/validate_data_acquisition_examples.py

diff --git a/examples/glossary_term.draft_unaligned.json b/examples/glossary_term.draft_unaligned.json
@@ -0,0 +1,14 @@
+{
+  "id": "urn:srcos:glossary:hermetic-launch-manifest",
+  "type": "GlossaryTerm",
+  "specVersion": "2.0.0",
+  "name": "hermetic launch manifest",
+  "definition": "New field on service manifests (release_gates.hermetic_launch_manifest); not yet captured into the ontology.",
+  "partOfSpeech": "noun-phrase",
+  "status": "draft",
+  "alignment": {
+    "ontologyClassRef": null,
+    "vectorLink": null,
+    "estateBinding": null
+  }
+}
diff --git a/examples/glossary_term.np_entity.json b/examples/glossary_term.np_entity.json
@@ -0,0 +1,32 @@
+{
+  "id": "urn:srcos:glossary:release-gate",
+  "type": "GlossaryTerm",
+  "specVersion": "2.0.0",
+  "name": "release gate",
+  "definition": "A fail-closed check a service must pass to be release-ready.",
+  "partOfSpeech": "noun-phrase",
+  "status": "approved",
+  "alignment": {
+    "ontologyClassRef": "urn:srcos:ontology-class:governance.ReleaseGate",
+    "vectorLink": {
+      "peerRef": "urn:srcos:glossary:promote-to-platform",
+      "model": "nomic-ai/nomic-embed-text-v1.5",
+      "dimension": 768,
+      "cosine": 0.71
+    },
+    "estateBinding": {
+      "kind": "entity",
+      "ref": "urn:srcos:service-graph:release-gate-audit"
+    }
+  },
+  "relations": [
+    {
+      "predicate": "is-a",
+      "target": "urn:srcos:ontology-class:governance.Control"
+    },
+    {
+      "predicate": "skos:related",
+      "target": "urn:srcos:glossary:promote-to-platform"
+    }
+  ]
+}
diff --git a/examples/glossary_term.vp_action.json b/examples/glossary_term.vp_action.json
@@ -0,0 +1,32 @@
+{
+  "id": "urn:srcos:glossary:promote-to-platform",
+  "type": "GlossaryTerm",
+  "specVersion": "2.0.0",
+  "name": "promote to platform",
+  "definition": "Move a catalogued object from user/project/chat scope to platform scope via an approved DAR.",
+  "partOfSpeech": "verb-phrase",
+  "status": "approved",
+  "alignment": {
+    "ontologyClassRef": "urn:srcos:ontology-class:governance.PromoteToPlatform",
+    "vectorLink": {
+      "peerRef": "urn:srcos:glossary:release-gate",
+      "model": "nomic-ai/nomic-embed-text-v1.5",
+      "dimension": 768,
+      "cosine": 0.71
+    },
+    "estateBinding": {
+      "kind": "action",
+      "ref": "urn:srcos:data-acquisition-request:promote"
+    }
+  },
+  "relations": [
+    {
+      "predicate": "is-a",
+      "target": "urn:srcos:ontology-class:governance.Action"
+    },
+    {
+      "predicate": "skos:related",
+      "target": "urn:srcos:glossary:release-gate"
+    }
+  ]
+}
diff --git a/fixtures/glossary-alignment/conformance.json b/fixtures/glossary-alignment/conformance.json
@@ -0,0 +1,150 @@
+{
+  "description": "Negative vectors for GlossaryTerm alignment v0.1. Each MUST fail on its named failValidator; validate_glossary_alignment_examples.py enforces both, plus the fail-closed invariant that an APPROVED term is fully aligned across all three methods and NP↔entity / VP↔action.",
+  "cases": [
+    {
+      "schema": "GlossaryTerm.json",
+      "reason": "vectorLink must be in the sovereign space — a truncated dimension (512) must fail (const).",
+      "failValidator": "const",
+      "document": {
+        "id": "urn:srcos:glossary:release-gate",
+        "type": "GlossaryTerm",
+        "specVersion": "2.0.0",
+        "name": "release gate",
+        "definition": "A fail-closed check a service must pass to be release-ready.",
+        "partOfSpeech": "noun-phrase",
+        "status": "approved",
+        "alignment": {
+          "ontologyClassRef": "urn:srcos:ontology-class:governance.ReleaseGate",
+          "vectorLink": {
+            "peerRef": "urn:srcos:glossary:promote-to-platform",
+            "model": "nomic-ai/nomic-embed-text-v1.5",
+            "dimension": 512,
+            "cosine": 0.71
+          },
+          "estateBinding": {
+            "kind": "entity",
+            "ref": "urn:srcos:service-graph:release-gate-audit"
+          }
+        },
+        "relations": [
+          {
+            "predicate": "is-a",
+            "target": "urn:srcos:ontology-class:governance.Control"
+          },
+          {
+            "predicate": "skos:related",
+            "target": "urn:srcos:glossary:promote-to-platform"
+          }
+        ]
+      }
+    },
+    {
+      "schema": "GlossaryTerm.json",
+      "reason": "estateBinding.kind is closed (entity|service|action).",
+      "failValidator": "enum",
+      "document": {
+        "id": "urn:srcos:glossary:release-gate",
+        "type": "GlossaryTerm",
+        "specVersion": "2.0.0",
+        "name": "release gate",
+        "definition": "A fail-closed check a service must pass to be release-ready.",
+        "partOfSpeech": "noun-phrase",
+        "status": "approved",
+        "alignment": {
+          "ontologyClassRef": "urn:srcos:ontology-class:governance.ReleaseGate",
+          "vectorLink": {
+            "peerRef": "urn:srcos:glossary:promote-to-platform",
+            "model": "nomic-ai/nomic-embed-text-v1.5",
+            "dimension": 768,
+            "cosine": 0.71
+          },
+          "estateBinding": {
+            "kind": "gadget",
+            "ref": "urn:srcos:x:y"
+          }
+        },
+        "relations": [
+          {
+            "predicate": "is-a",
+            "target": "urn:srcos:ontology-class:governance.Control"
+          },
+          {
+            "predicate": "skos:related",
+            "target": "urn:srcos:glossary:promote-to-platform"
+          }
+        ]
+      }
+    },
+    {
+      "schema": "GlossaryTerm.json",
+      "reason": "alignment is a closed object — unknown method must be rejected.",
+      "failValidator": "additionalProperties",
+      "document": {
+        "id": "urn:srcos:glossary:release-gate",
+        "type": "GlossaryTerm",
+        "specVersion": "2.0.0",
+        "name": "release gate",
+        "definition": "A fail-closed check a service must pass to be release-ready.",
+        "partOfSpeech": "noun-phrase",
+        "status": "approved",
+        "alignment": {
+          "ontologyClassRef": "urn:srcos:ontology-class:governance.ReleaseGate",
+          "vectorLink": {
+            "peerRef": "urn:srcos:glossary:promote-to-platform",
+            "model": "nomic-ai/nomic-embed-text-v1.5",
+            "dimension": 768,
+            "cosine": 0.71
+          },
+          "estateBinding": {
+            "kind": "entity",
+            "ref": "urn:srcos:service-graph:release-gate-audit"
+          },
+          "telepathy": true
+        },
+        "relations": [
+          {
+            "predicate": "is-a",
+            "target": "urn:srcos:ontology-class:governance.Control"
+          },
+          {
+            "predicate": "skos:related",
+            "target": "urn:srcos:glossary:promote-to-platform"
+          }
+        ]
+      }
+    },
+    {
+      "schema": "GlossaryTerm.json",
+      "reason": "relation predicate is a closed RDF/RDFS/SKOS/FOAF set — an unknown predicate must fail.",
+      "failValidator": "enum",
+      "document": {
+        "id": "urn:srcos:glossary:release-gate",
+        "type": "GlossaryTerm",
+        "specVersion": "2.0.0",
+        "name": "release gate",
+        "definition": "A fail-closed check a service must pass to be release-ready.",
+        "partOfSpeech": "noun-phrase",
+        "status": "approved",
+        "alignment": {
+          "ontologyClassRef": "urn:srcos:ontology-class:governance.ReleaseGate",
+          "vectorLink": {
+            "peerRef": "urn:srcos:glossary:promote-to-platform",
+            "model": "nomic-ai/nomic-embed-text-v1.5",
+            "dimension": 768,
+            "cosine": 0.71
+          },
+          "estateBinding": {
+            "kind": "entity",
+            "ref": "urn:srcos:service-graph:release-gate-audit"
+          }
+        },
+        "relations": [
+          {
+            "predicate": "causes-vibes",
+            "target": "urn:srcos:x:y"
+          }
+        ]
+      }
+    }
+  ]
+}