Glossary

Domain Model

Access grant — A permission assigned to a user or group for one file or one Root Folder (and its descendants), with read, write, or manage authority.

Admin override — Unconditional administrator access to any folder or file in the organization. Every such access is automatically recorded in the audit trail with adminOverride: true and an optional reason (when --admin-reason is supplied). Override is always explicit and auditable; never silent.

Archived Root Folder — A self-service, reversible soft-delete status a Root Folder owner or manager applies. Archive is allowed only when the folder holds zero files and zero child folders (active or archived). The default Root Folder can never be archived.

Audit event — An append-only accountability record for a security-sensitive or file-changing action and its result. Append-only enforcement is database-guaranteed; cannot be edited, removed, or purged.

Correlation ID — A non-secret identifier connecting a CLI operation to service, storage, SQL, application-log, and audit records. Every audit event carries a correlation ID.

Default Root Folder ("My Files") — The automatically provisioned Root Folder for every active member, idempotently created at bootstrap, invitation acceptance, or reactivation. Exactly one per member, identified by isDefault flag (not by name). Cannot be deactivated while remaining default.

File — The stable logical record users refer to by opaque file ID. A file contains one or more immutable content versions.

File version — An immutable content record with a sequential version number, private storage key, original filename, MIME type, byte size, SHA-256 checksum, uploader, and timestamp.

Global administrator — The auditable bootstrap operator with unrestricted administrative authority in the single MVP organization.

Group — A named, organization-local, flat (non-nestable) collection of active members. Created by any member and owned by its creator. Has explicit owner, manager, and member roles. A group must always retain at least one active owner.

Group invitation — A pending -> accepted | declined | revoked | expired record gating group membership. Only the invited member may accept or decline. At most one pending invitation per email per group.

Group role — One of owner, manager, or member, held per user per group. Owners manage roles, invitations, and ownership transfer. Managers may invite and remove members. Members have access only.

Metadata definition — An administrator-managed schema for a custom text, number, boolean, date, or choice field.

Metadata revision — An immutable before/after record of a file's name, Root Folder, description, custom metadata, or archive state change.

Object storage — Private storage for file bytes. Not directly enumerable or permanently credentialed to CLI users.

Root Folder — A canonical, first-class classification record owned by exactly one active member (the creator). Not free text or a generic custom field. May be a root (parentFolderId is null, depth 0) or a subfolder nested beneath a root or another subfolder (depth 1-32).

Root Folder-scoped grant — An owner-bounded grant that applies to qualifying files in a Root Folder and all descendant folders, without authorizing unrelated owners' files.

Subfolder — A Root Folder nested beneath a root or another subfolder (parentFolderId is set, depth 1-32). Created by anyone with live manage access to the immediate parent. Owner is always inherited from the root.

Tag — A permanent, user-managed, free-form name=value pair attached directly to a file with tv file tag set/unset. Fully separate from administrator-managed metadata definitions. At most one active value per normalized (case-insensitive) name.

Tag revision — An immutable before/after record of one tag set or unset, stored separately from metadata revisions but surfaced alongside them in revision history.

tv — The Thalix Vault command-line executable and only complete product interface for MVP file and administrative workflows.

Security Model

Anti-enumeration — Authorization-gated information hiding. A caller without sufficient access to a file, folder, grant, or audit target sees the identical NOT_FOUND (or absent row for search/browse) that a genuinely nonexistent target would produce. Existence itself is authorization-gated information.

Authorization — Deny-by-default server-side access control. The backend authorizes every protected operation; the CLI never decides access itself.

Delegation — The ability to grant access to others within the scope of one's own access. A delegating user cannot grant more authority than they currently possess. Only an owner or a user with manage may create, change, or revoke a grant.

Immutable history — Content versions and metadata revisions are not edited in place. Each change creates a new immutable record. Enforced by database triggers, not just application convention.

Ownership — For files: the user who uploaded the first version. For Root Folders: the user who created it. For groups: the user who created the group. Ownership implies manage for that resource. Ownership transfer is not supported for files or folders; group ownership transfer is supported.

Audit Model

Append-only — Audit events can never be edited, removed, or purged. Database BEFORE UPDATE/BEFORE DELETE triggers enforce this unconditionally for every role.

Audit details — Safe structured metadata attached to each audit event (operation, domain, actor, target, result, etc.). Passes through redaction allowlist before writing; never contains passwords, tokens, credentials, or file bytes.

Audit domain — A category of audit events: identity, device/token authentication, folders/metadata, groups, files, access grants, search, and authorization denials.

Redaction allowlist — Fixed set of allowed keys and length limits for audit event details. Secrets (tokens, passwords, credentials) are dropped unconditionally as defense in depth.

Admin Model

Admin override — See definition above under Domain Model. Automatic and always audited; never requires a flag or blocks the request.

Deactivation — Reversible administrative suspension of a user, Root Folder, or metadata definition. Rows and historical references remain; the entity-specific reactivation or replacement rules still apply.

Owner deactivation and group recovery — Deactivating a user removes their effective group participation. When they are the last active owner while other active members remain, deactivation is refused until ownership transfers. A group with no active owner is surfaced for explicit administrator recovery; the group itself is not deactivated.

Invitations — Invite-only membership model for organizations and groups. Invitations are one-time-use after acceptance. Pending invitations can be revoked; expired invitations cannot be accepted.

Purge is structurally forbidden — No permanent-delete path for files, versions, metadata revisions, or audit events. All deletions trigger database constraints that unconditionally reject the operation.

Product Model

Agent skill — Local, versioned instructions that teach an AI coding agent to discover and safely use the installed tv CLI through the current user's session.

Archive — Reversible soft-delete. Archived files and folders are hidden from normal searches but available through explicit archived-item queries.

CLI-first — Every MVP workflow required for the product must work through the tv command-line interface.

Controlled metadata — Fields that require consistency use explicit administrator-managed schemas (metadata definitions). Separate from user-managed tags.

Folder hierarchy — Nested folder structure (depth 0-32) where access grants inherit down the entire subtree. Files moved between folders immediately recalculate access.

Narrow authorization — MVP policies cover file and Root Folder scope only, not a general-purpose policy language.

Reversible delete — Archive and restore operations instead of permanent purge. Archived items remain auditable and restorable.

Secure by default — Storage is private and access is denied unless explicitly allowed. Users never hold permanent credentials.

Single organization — The MVP supports one organization only. No multi-tenancy.

User-managed tags — Free-form name=value pairs set by file owners/managers. No administrator schema required. Separate from metadata definitions.