Glossary

Terms are grouped by theme. Where meroctl uses another word for the same thing, it is given in brackets: namespace = organization, group = team, context = app instance, application = signed package.

Cluster & replication

Cluster — A set of merod nodes that share one system group and one storage key, named by --cluster. See Concepts.

Node — One merod process in a TDX VM, with a numeric id and a public URL. Its inside is the library calimero-node.

Group — One Raft log and its state machine, hosted by calimero-log’s Engine. Group 1 is the system group; each app instance has its own. See Replication.

System group — The cluster-wide group holding nodes, the app directory, packages, bundles, accounts, credentials, organizations, teams, invites, quotas and governance. See The system group.

App group — The group of one app instance, on its replicas only.

Leader — The member of a group that proposes entries. For an app group, it is the only node that runs calls.

Replica — A node hosting a group. An app’s replicas are listed in the directory; a learner is a replica that receives entries but does not vote.

Entry — One committed command in a group’s log: a SystemCmd or an AppCmd. At most 1 MiB.

Outcome — What a run produced: status, result or error, the diff, events, follow-ups, touched entities. Recorded in the entry.

Diff — The run’s storage writes, in order, as key → value or delete. Followers apply it; nobody re-executes.

Base index — The applied index a leader ran a call against. An entry whose base index is no longer the last applied one applies as a no-op (conflict), and the call runs again.

Snapshot — A sealed file of a group’s state at an index, sent to a replica too far behind for the log.

Read index — Asking the leader for its applied index and waiting to apply it, so a local read sees every committed write (Node::sys_fresh).

Trust

Attestation — A TDX quote over a nonce and a key, with the release the node claims to run. See Attestation & receipts.

mero-tee release — A signed node image. Its published-mrtds.json, verified with Sigstore, lists the measurements of each profile.

Measurement policy — What a verifier accepts: none, pinned allowlists, or a signed release with allowed profiles and a minimum version.

Transport key — A node’s X25519 key, in memory only, bound into its quote; what sealed sessions are opened to.

Sealed channel — Noise NK sessions to the transport key carrying whole HTTP requests and framed responses. See Networking.

Cluster key (K_c) — What every node of a cluster, on any release, seals its data with: the founding node’s K_r, kept wrapped under each node’s own K_r and handed to new nodes by attestation. See Encryption.

Cluster secret — HMAC-SHA256(K_c, "calimero.cluster.v1|" ‖ cluster), presented by peers on internal routes.

Receipt — A node’s Ed25519 signature over (app, index, SHA-256(JCS(result)), node), returned with every call and view answer.

Receipt key — The node’s in-memory Ed25519 key that signs receipts, attested together with the cluster’s governance.

verify_app_cluster — The client check that every replica of an app is attested, and returns their receipt keys and the governance they all attest.

Storage key (K_r) — The key a node derives from what its release’s mero-kms releases to an attested TD; it wraps the cluster key K_c on disk, and changes with each mero-tee release.

People & authority

Account — A person, 32 random bytes. [Identity, account]

Passkey — A WebAuthn credential on an account; each one is a device.

Session — A 15-minute token signed by the node that issued it (its attested receipt key), naming the account, the passkey, the issuing node, and, for a frontend, the package it is bound to. Renewed with a single-use refresh token.

Operator key — The operator’s Ed25519 key; its public half is recorded at genesis and every operator decision carries its signature.

API key — A cal_… key acting for an account, optionally scoped to apps, methods, read-only, and relaying confirmations.

Step-up — A fresh passkey assertion with user verification over one exact action: a confirm method, an upgrade, an approval, deleting an organization.

Confirm method — An app method (#[app::confirm], listed in confirmMethods) that runs only with a step-up; the assertion is logged as consent.

Caller — Who a run is for: an account, an API key’s account, the public, or an app (handlers, timers, xcalls). See Who a run acts as.

TEE authority — The author of runs the cluster fires itself (timers, tee: handlers), the only writer of TeeOnly state.

Organization — A name (its owner or an admin renames it), members with roles guest < member < admin < owner, teams, approvals, metadata. [Namespace]

Team — A nested group of an organization’s members, open or restricted, with direct rows of role lead, member or read-only. [Group, subgroup]

App team — A top-level team whose metadata.app.package marks a package: the one team of that app in an organization, whose instances use team access on it. Open, everyone in the organization has the app; closed (restricted), only its rows do, and an admin closes or opens one app team alone. A member an admin gives every app added later (allApps) gets a row on each app team made after. See Organizations.

Move — Taking an app instance to another organization (MoveApp, POST /apps/{app}/move): its data stays on its replicas; its organization, payer, quotas and access change. Not a transfer, which changes its owner within its organization. See Organizations.

Capability — A bit granting a member an action beyond their role (an app team’s default lets its members make private channels, CREATE_CHILD_TEAM). See Organizations.

Access rule — Who reaches an app: owner, accounts, org, team, public. In an organization, only its members; an accounts instance of a package with an app team, only those in the app team.

Governance — Who holds release approvals, app upgrades and outbound approvals, owner or operator, fixed at genesis. See Deployment governance.

Operator — Whoever runs the machines, with the ops token and the Ops API. See The operator.

Apps

App instance — One running copy of a bundle, with an id, an owner, an access rule and its own group. [Context]

Context id — hex(SHA-256(app_id)), what the app reads as env::context_id(); accepted wherever the API takes an app id.

Bundle — A WASM module, named by hex(SHA-256). Stored in the blob store; the log records its hash.

Package / release — [Application] A signed .mpk: package, version, services, frontend, declared outbound prefixes. A package’s signer is pinned by its first release. See Packages & frontends.

Registry — The operator’s package source (--registry-url); each node fetches registry releases from it itself.

Frontend — A package’s web files, served at {label}.{apps-domain}, at its cluster’s {cluster_label}.{apps-domain}, and at each deployment’s own host {dlabel}.{apps-domain}.

Follow-up — A run another run asked for: an event handler or an xcall, queued in the app’s state and run once by the leader. See Event handlers & cross-app calls.

Xcall — A message to another app’s method that allows the sender (#[app::allow(app = ..)]), delivered after the sending entry commits. [Cross-context call]

Timer — An #[app::tee(every = "…")] method the leader fires once per period.

Upgrade run — An organization-wide upgrade of every app running a package. [Cascade upgrade]

Compute action - An app method that runs outside the log on a job node, with no network, over sealed input files, writing sealed output files. See Compute actions.

Compute run - One execution of a compute action, from its start to its final entry, in one or more attempts. Its state is queued, running, done, failed or cancelled.

Job node - A node with role: job that runs compute runs. It is never a Raft member and holds no cluster key; it attests only for purpose=jobs.

Result method - The #[app::compute_result] method the node runs as a logged call, with the system as caller, when a compute run ends. It is the run’s only way into the app’s state.

File (component) - Sealed, content-addressed bytes of a component app, with a mark in its state (size, hash, wrapped key), stored on its replicas and read only by its own code.

Migration — The target bundle’s #[app::migrate] export, run once on the leader, checked by __calimero_migration_check. See Upgrades & migrations.

Blob — Content in the cluster’s blob store; an app’s own blobs are those its state marks. See Blobs.

Private space — An account’s own part of an app’s state: in calimero-sdk, a PerUser<T> value, which each account reads and writes only for itself.

Host key space — Keys under \0calimero. in an app’s state, written only by the node.

Presence — Ephemeral per-device state, in memory on every node. See Presence.