A ref under refs/meta/* is simultaneously the unit of storage (the ref points at a commit whose tree is the entity), synchronization (fetch or push only the entities a client cares about), authorization (refname-keyed rules gate who may advance the ref), and history (its commit chain is the audit trail). One ref holds exactly one independently-authored entity, or one piece of repository-global state; see meta-ref.adoc.

A Rust struct annotated #[derive(Facet)] is the storage schema: no serialization format sits between the struct and the git tree facet-git-tree maps it to, and changing the struct is a storage migration — a signed commit, not a silent break; see meta-ref.adoc.

A durable pointer into source — a blob, an optional line range, and the commit it was taken against — embedded in the anchoring document’s own tree so it survives force-push, branch deletion, and gc, and projected onto newer commits at read time by blame plus fuzzy matching, never mutated; see anchor.adoc.

Every meta-ref mutation is an author-signed commit whose signature replicates with the repository and verifies offline in any clone. A signature proves authorship, not placement, so the refname is bound by recomputation from the commit’s own signed content — a genesis oid, a natural-key tree field, a composite of fields and signer — and adopting someone else’s commit onto a canonical ref is always a merge, never a cherry-pick, so the author’s signature survives intact in ancestry.

Verification is a pure function over ref-store reads — is the new tip signed by a member authorized for this refname, does the refname recompute from its signed content, does it descend from the old tip, does the update commit via atomic CAS — evaluated identically at three call sites: hosted CAS (mandatory, failure aborts the write), local UI verdict (advisory), and push pre-flight (advisory).

A declarative, content-addressed subscription to a commit-set query, whose execution is sandboxed and whose output re-enters the repository only as signed commits on a results ref. The trigger fires once per commit entering the query’s set, work is monotone and entry-only, and the runner is a member, not an ambient authority, so an official result is a refname rule on canonical results refs rather than a runtime property of a blessed machine.

''

The honesty test for these boundaries — a new composition root constructible from library crates alone, no library modification — is a deployment requirement and lives in roots.adoc as <<roots.honesty-test>>.