CFC audit · point-in-time record

CFC label vocabulary audit

A cross-repository inventory of the labels minted by the specification surface, Labs, the Common Fabric Service, and the Weaver—and the work needed to make their vocabulary globally coherent.

Snapshot 2026-09-21 4 repositories Confidentiality, integrity, provenance, and observation

Scope

This audit compares the current CFC specification with executable, non-test minting paths in Labs, the Common Fabric Service, and the Common Fabric Weaver. It includes shipped example patterns because they persist real labels through the same authoring surface. It excludes fixtures, tests, benchmarks, and the Service's vendored Labs copy.

The snapshot is:

Repository Revision
CFC specification 34fb8680caa9f68005a438854fa5dc2ef15ff953
Labs 88d2a74f88e82fa2817c1747a46db7e063228017
Common Fabric Service dacef6a95080fa37b8a3ecc3cd8ebe53b2bff77a
Common Fabric Weaver ebc39a98fe66419efb9eb008eb7a1957a581f74b

"Mint" means code creates an atom, clause, or complete label for a value, schema, ceiling, boundary evaluation, or persisted label component. Merely matching or displaying an existing atom is not a mint. Constructors and trusted-mint allowlists without a production caller appear separately.

Result

There is no globally coherent vocabulary yet. The system has four overlapping vocabularies:

  1. the structured URI atoms in the specification;
  2. Labs atoms and trusted claims, including several extensions in the core URI namespace and several non-URI strings;
  3. Service connector atoms, including a Service-owned extension and bare DID principals; and
  4. persisted component and observation names that are sometimes called labels, although they are axes over labels rather than atoms.

The problem is not merely that the implementations have extensions. Extension atoms are part of the specification's design. The problem is that identical URIs sometimes have incompatible shapes or kinds, intended synonyms are not structurally equal, and some unregistered strings have acquired durable policy meaning.

Minted confidentiality vocabulary

Wire spelling Minted by Use Correspondence and status
Bare did:... string Labs SQLite principal() and dbOwner(); Service owner_atom() Owner or row-participant confidentiality Intended to mean the same reader as User{subject}, but it is not the structured atom required by specification section 4.1.2 and does not compare equal to it.
.../atom/User {subject} Labs current-principal resolution, share snapshots, agent connector, shell and CLI ceilings One user principal Canonical specification family. It duplicates the bare-DID spelling above.
.../atom/Space {id} Labs sharing and residency checks Shared-space audience Canonical specification family.
.../atom/PersonalSpace {owner} Labs shell default ceiling Per-user space audience Canonical specification family; narrative examples also treat it as equivalent to User(owner), but the runtime compares the two structurally.
.../atom/Context {name:"facet:<id>", subject} without hash Service connector row contracts and ceilings; the Weaver originates the facet UUID carried into the Service Facet/posture classification The current specification has no facet profile. It permits the hashless form only in schemas/templates and requires a hash on runtime labels. Service code deliberately persists the schema-time form as a fail-closed taint.
.../atom/Policy Labs schema lowering for PolicyOf and the public policy-reference constructors Named or module exchange-policy principal The module form is actively lowered. Named constructors exist, but no direct non-test caller was found. Canonical when its runtime form is hash-bound.
.../atom/Resource {class, subject, scope?} Labs schemas, FUSE projection, harness corpus and demonstration patterns; every Service connector profile Data classification or nested caveat source Canonical only as confidentiality. Labs also uses this same URI as integrity evidence; see the integrity table. The class vocabulary is open and unregistered.
.../atom/Caveat {kind, source, by?} Labs schema sanitization, FUSE and demonstration patterns; Service free-text columns Source-linked release obligation Canonical family, but not canonical shape: the specification requires source: Reference, while Labs accepts any atom and the Service supplies ConnectorObserved.
Caveat kind .../concepts/prompt-injection-risk-unscreened Labs prompt helpers and Service connector free text Unscreened external text Canonical concept URI. Labs policy rules can add the ingress-screened and value-screened variants as alternatives if their evidence ever exists.
Caveat kind .../concepts/prompt-influence Labs prompt helpers Prompt influence that needs disclosure, acknowledgment, or a disclaimer Canonical concept URI. Two shipped galleries instead mint the short string prompt-influence, which the standard discharge profile does not match.
Caveat kinds metadata-incomplete and fact-check-required Labs FUSE and galleries Fail-closed FUSE projection; application disclosure Open strings. They have no controlled URI vocabulary.
Bare string secret Labs background piece service and Plaid OAuth tool Credential confidentiality A second spelling of the idea represented elsewhere by Resource{class:"CredentialSecret"}.
Bare string pii Labs row-label demonstration pattern PII confidentiality Unregistered example vocabulary that can persist like any other atom.
cfc:label-read-failed Labs fail-closed label-view acquisition Ungrantable marker that prevents a failed metadata read from exposing a value to an LLM A private safety sentinel rather than an application classification. It is deliberately non-grantable, but still needs a reserved, documented namespace so it cannot collide with author atoms.
.../atom/Expires {timestamp} Labs public constructor Absolute expiry Canonical family; no non-test caller was found.

The Resource.class values found at mint sites are themselves a vocabulary:

Class set Values and users
Service connector classes email (Gmail, Apple Mail); message (iMessage, Signal, WhatsApp, Telegram, Discord, Google Messages and current Google Voice records); call (Signal and WhatsApp call records); calendar (Apple, Google occurrence sidecars and Service calendar); contact (Apple, Google and Fabric Lobby); finance (Plaid and Amazon orders); document (Drive, Readwise, Airtable, sample files and Amazon Kindle); activity (GitHub, Linear, local development state, browser/loom context and Amazon crawl); location (location context); health (Epic FHIR).
Labs operational classes CredentialSecret, CommonFabricFuseProjectionMetadataIncomplete, FilesystemTopologyObservation, CommonFabricFuseSymlinkTarget, CommonFabricHarnessOperatorProvisionedReference.
Labs example classes PromptInfluenceSource, SourceProvenance, ExternalClaim, HostileVendorBriefing, AgentDirectCommand, SensitiveHealthRecord.

The dedicated specification atom .../atom/FilesystemTopologyObservation is not what FUSE mints. FUSE mints Resource{class:"FilesystemTopologyObservation"}. These spellings are not equivalent.

Minted integrity vocabulary

Wire spelling Minted by Use Correspondence and status
.../atom/InjectionSafe Labs schema sanitizer and prompt-injection demonstration Exact value/path is instruction-inert Canonical family and canonical value-bound class.
.../atom/Builtin {name} Labs prompt-injection authoring helper Trusted built-in identity Canonical shape. The specification says value-bound; Labs classifies it as provenance.
.../atom/UserSurfaceInput {user,surface,valueDigest} Labs prompt-injection demonstration Exact user-entered value Canonical compatibility family. The specification says value-bound; Labs classifies it as provenance.
.../atom/LlmDerived {model?} Labs LLM dialog and agent result writer Model-produced bytes Labs extension under the core specification namespace. It appears in specification demos but not the atom registry.
.../atom/ExternalIngest vouched-channel or fetch form Labs custody-ingest preparation Host-observed external bytes Labs extension under the core specification namespace. It is not registered. It partly overlaps Origin and NetworkProvenance, but neither is a safe synonym.
.../atom/PromptSlotBound {...} Service run manifest, Labs harness and demonstration Trusted binding into a prompt role Canonical family. The specification says provenance; Labs classifies it as value-bound.
.../atom/PromptSlotInfluence {...} Labs harness invocation context Inputs influenced by a prompt slot Canonical family and provenance class. It is distinct from the confidentiality Caveat whose kind is prompt influence.
.../atom/LinkReference {source,target} Labs prepare path on link writes Exact reference provenance Canonical family, shape and value-bound class.
.../atom/TransformedBy {identity} Labs default flow derivation Implementation that authored all relevant writes in a transaction Incompatible with the same specification URI, whose shape is {codeHash, operation?, inputs} and whose class is value-bound. Labs calls its reduced form staged and classifies it as provenance.
.../atom/HasRole {principal,space,role} Labs render ceiling from verified membership Exchange-rule membership evidence Canonical family and provenance class.
.../atom/BoundaryContext {key,value?,ref?} Labs sink evaluation and render ceiling Ephemeral sink name/class and other boundary facts Canonical family and provenance class; deliberately not persisted.
.../atom/Resource {class:"CommonFabricHarnessOperatorProvisionedReference", subject:<path>} Labs documentation corpus loader Operator-provisioned corpus endorsement Reuses a specification confidentiality family as integrity. Labs' propagation table classifies all Resource atoms as value-bound to support this use. A new integrity family is required.
{kind:"authored-by", subject} Labs AuthoredByCurrentUser lowering, runtime principal resolution and authorship-chat example Trusted claim that the acting principal authored a value Non-URI implementation family. It resembles specification AuthoredBy{sender,messageId?} but is neither its shape nor its URI.
{kind:"represents-principal", subject} Labs profile schemas, agent connector and current-principal resolution Value represents a principal Non-URI implementation family with no atom-registry entry.
{kind:"claimed-authored-by", subject} Labs SQLite row-rule evaluator Content-derived, forgeable authorship claim Deliberately weaker than AuthoredBy, but unregistered and structurally adjacent to the trusted authored-by claim.
{kind:"claimed-endorsed-by", subject} Labs SQLite row-rule evaluator Content-derived, forgeable endorsement claim Deliberately weaker than EndorsedBy, but unregistered.
https://loom.commonfabric.org/cfc/atom/ConnectorObserved {connector,connection,provider?} Service connector table contracts Row came through one connector store/channel Valid Service-namespaced extension. The design says it later lowers to ExternalIngest, but no canonical translation or equivalence rule was found.
cf-compiled-by:cf-compiler Labs compilation cache Compiler-authored cache entry Gated trusted mint, but a non-URI string that overlaps the purposes of Builtin and CodeHash.
plaid-posted Service Plaid row rule Posted transaction Non-URI Service integrity fact.
profile-link Labs profile-create pattern Profile link integrity Non-URI application fact; its relationship to canonical LinkReference is unstated.
cf-harness/label-entry Labs harness console Label-entry presence marker Non-URI subsystem fact.

Defined or matched, but not currently minted

The distinction matters because an atom can appear mature in the public API or standard policy while no trusted component can produce its evidence.

Family Present surface Finding
CaveatScreened Labs constructor, policy guards and runtime-mint allowlist No non-test production caller found. The screening gradient therefore has rules but no producer in this snapshot.
DisclosureRendered, DisclosureAcknowledged, DisclaimerAttached, CaveatAssessment Labs constructors, policy guards and runtime-mint allowlist No non-test production caller found. The prompt-influence discharge rules have no production evidence source.
PolicyCertified Labs registry, hereditary propagation table and runtime-mint allowlist No constructor or production mint found.
Origin Labs registry, introspection and runtime-mint allowlist No production mint found. The specification says confidentiality, while Labs also assigns it an integrity propagation class.
Concept Labs constructor, matching and runtime-mint allowlist No production mint found. The specification says it is a trust principal and is not carried on values.
Named Context/Policy and Expires constructors Labs public API No direct production callers found; module Policy references are emitted by schema lowering, and the Service directly constructs hashless Context.

Many normative registry families have no implementation mint at all, including Service, TTL, Capability, FilesystemPathObservation, the dedicated FilesystemTopologyObservation, CodeHash, EndorsedBy, AuthoredBy, IntegritySummary, the measured tool/plan/subagent families, runtime observation families, AuthorizedRequest, and NetworkProvenance. Absence is not itself a defect, but local substitutes must not be treated as those atoms without a specified normalization.

Labels that are not atoms

Labs persists several names beside a label. These names say where the label came from and how it updates; they are not atoms and must not enter policy vocabulary as if they were.

Labs origin Specification term Update rule
declared declared store-policy component Monotone
derived derived per-value data-label component Replace on overwrite; creation-time shape freezes
link link-carried/reference component Replace on link rewrite
structure No separate normative component; an implementation decomposition of derived container shape/membership Replace with the structural derivation; creation-time shape freezes
external-ingest No separate normative component Replace per ingested document
label-metadata No separate normative component Recompute from the final payload-label entries

The observation classes are another independent axis: value, shape, enumerate, followRef, and the separate labelMetadata. The specification's weaker count observation is conservatively implemented as enumerate. A globally coherent vocabulary should call all of these component origins or observation classes, never atom types or labels.

Cross-repository flow

Cross-repository CFC label flow Weaver facet UUIDs flow to the Service, which mints Context, Resource, ConnectorObserved, and Caveat atoms. Those atoms enter Labs label components. Dashed arrows mark unresolved correspondences between bare DIDs and User atoms, ConnectorObserved and ExternalIngest, and hashless Context and a valid runtime representation. Common Fabric Weaver IdentityFacet UUID transported, not an atom Facet display name display only Common Fabric Service connection/account facet mapping maps the Weaver UUID hashless Context name = facet:<id> Resource 10 connector classes bare owner DID compact principal ConnectorObserved Service provenance Caveat unscreened text Labs runtime declared label component store policy and connector contract User{subject} canonical principal ExternalIngest host boundary event derived component + TransformedBy link component + LinkReference boundary facts HasRole + BoundaryContext UUID only display only exchange evaluation same reader, unequal wire form intended provenance lowering; no rule needs hash or a new atom
actual mint/carriage intended correspondence that is not wire equivalence

The Weaver does not mint a CFC atom. It mints or stores facet UUIDs and sends them as a query parameter or array. The Service turns those identifiers into Context atoms. Comments in the Weaver that say a lens "mints" a CFC context therefore describe the eventual effect, not the minting boundary.

Reconciliation required

The order below minimizes migrations and prevents more durable spellings from appearing while the vocabulary is unsettled.

  1. Make one machine-readable registry authoritative. For every atom and caveat kind it must state URI, channel (confidentiality, integrity, or trust principal), exact schema, propagation class, mint authority, and stability. Generate the Labs TypeScript constants and Service Python constants from it. Extension registries can remain repo-owned, but must declare their relationship to the core registry.
  2. Choose one user-principal wire form. Prefer User{subject} because it is the normative structured atom. Normalize legacy bare DIDs at the SQLite and Service boundary, or formally specify a compact encoding and require every equality, ceiling, display, and policy path to normalize it.
  3. Settle the facet atom before hashless contexts spread. Either make a facet a real hash-bound Context with a discoverable policy record, or add a dedicated confidentiality Facet{owner,id} classification atom. The present runtime-label use of the schema-time Context shape is not a third stable option. The current specification contains no facet section despite Service documentation citing one.
  4. Stop sharing a URI across incompatible schemas or kinds. Keep Resource confidential and mint a dedicated integrity endorsement for the documentation corpus. Make TransformedBy conform to the witness-bearing specification shape, or give the staged {identity} claim a distinct extension URI. Decide whether Caveat.source is a reference or a source descriptor/atom union and change the specification and all producers together.
  5. Generate propagation classes from the registry. This removes the current disagreements for Builtin, PromptSlotBound, TransformedBy, and UserSurfaceInput, and prevents confidentiality/principal families such as Resource, Caveat, Origin, and Concept from silently becoming integrity families.
  6. Specify the provenance ladder rather than equating its rungs. ConnectorObserved proves a Service store/channel, ExternalIngest proves a host boundary event, NetworkProvenance proves transport facts, and AuthoredBy proves an author under a trust policy. Define explicit derivation rules and required evidence between them. Do not call any two synonyms.
  7. Replace durable string atoms. Give plaid-posted, profile-link, cf-harness/label-entry, and the compiler attestation controlled URIs or replace them with an existing canonical family whose exact semantics fit. Replace secret and pii with registered Resource classes. Reserve the fail-closed cfc:label-read-failed sentinel as an implementation atom that authors can neither mint nor grant. A mint gate does not make a non-URI spelling globally meaningful.
  8. Unify authorship and representation claims. Use canonical AuthoredBy and EndorsedBy only for trusted claims. Register explicit ClaimedAuthoredBy, ClaimedEndorsedBy, and RepresentsPrincipal extension families, or define an upgrade/normalization into canonical families. The current kind records are too easy to mistake for their trusted counterparts.
  9. Registry-bind caveat kinds and resource classes. At minimum, normalize the short prompt-influence spelling to its concept URI. Publish the ten connector resource classes and the operational Labs classes. Application classes may remain extensions, but names such as SourceProvenance must not imply integrity when the atom is confidential.
  10. Name the non-atom axes consistently. Align link with the specification's link-carried term, and document structure, external-ingest, and label-metadata as implementation component origins. Keep observation classes separate in APIs, diagrams, and logs.
  11. Assign a minter for every standard evidence family before depending on its policy. The present standard prompt policy can match screening and disclosure evidence that no production component emits. A registry entry without a trusted mint boundary is vocabulary, not an enforcement path.
  12. Make the developer glossary point at the registry. The current global glossary defines facet, principal, space, and provenance, but not CFC label, atom, clause, caveat, component origin, or observation class. The CFC specification glossary should remain authoritative for those technical terms; the global glossary needs one pointer and only the product-facing meanings that differ.

Principal source locations