| AuthRight Harness | Identity & Access Security Decision Layer for AI software engineering |
@authright/cli | npm package; binary authright |
| Auth Context | Current IAM picture after scan (.authright/context.yaml), including notes that are still unconfirmed |
| Unconfirmed | Something scan or the assistant noted, but you have not confirmed. It is not a decision |
| Request match | After the plan is locked, check that it still matches what you originally asked (authright request-match). Export waits until this check passes |
| Technology Registry | Canonical product/protocol catalog in the CLI pack — not Project KG facts |
| Project Knowledge Graph | This project's ASKG YAML under .authright/knowledge/ |
| Constitution file | Empty stub (.authright/constitution.yaml); not enforced project law |
| Auth Change | One decision-work unit under .authright/changes/ |
AUTH-YYYY-NNNN | Immutable Auth Change id |
| Decision | Explicit accepted/rejected architecture or security choice |
| Decision Lock | Accepted decisions must not be silently inverted in implementation |
| AuthRight Design | Projected YAML after --ready; not a lock; not /auth:design. CLI Design Validator may fail with DESIGN_CONFLICT |
| CurrentState | Scan-projected instance nodes (state.*) and accepted instance claims; not a Decision Lock |
| IAM Ontology | Compiled semantic contract in the CLI pack (Internal ontology verbs). Browse on the site Ontology page |
| Contract | Implementable constraints for a change (contract.md) |
| Review | Post-export verification under .authright/reviews/ |
| Doctor | Chat command /auth:doctor: reads app source and writes a risk report at .authright/diagnosis/report.md. Not the same as /auth:doc |
| Doc | Chat command /auth:doc: writes a decisions summary under .authright/docs/. Does not scan code for risks |
| Handoff channel | A path from locked decisions to coding agents (OpenSpec or Agent Plan-mode). Two commands (/auth:to-openspec | /auth:to-plan); pick one. See Implementation |
| OpenSpec | One handoff option; not bundled with AuthRight; needs the separate openspec tool |
| Agent Plan-mode | One handoff option: package under .authright/changes/<dir>/agent-plan/ for your editor’s Plan mode |
| Supported agents | Cursor / Claude Code (/auth:…) and Codex ($authright-*) |
| Technology Pack | Per-language repo plugin for scan and pack-idiomatic IAM landing. Strongest today: Java, Node.js / TypeScript. Also supported: Python, Go. More stacks planned. |
| Understand → Decide → Request Match → Handoff | Product chain before implementation (OpenSpec or Agent Plan-mode). Verify comes after code lands |
