Terminology
Status: Accepted · Version: 0.1
Use these words in specs, APIs, events, and UI copy. Do not invent synonyms in runtime code.
If a term here conflicts with an older sketch, this page wins. Specs may narrow a term; they may not redefine it.
Product
| Term | Meaning |
|---|---|
| Titip | The product. In Indonesian, “titip” means to entrust something to someone. In this platform it means entrusted guidance, not custody of secrets or legal authority. |
| Owner | The account holder. Also called the user in APIs (user_id). |
| Organisation | A billed tenant that may contain one or more owners (household, family office, or company). |
| Membership level | The paid plan for an organisation or household: Silver, Gold, or Platinum. It controls limits and channels. It is not a place in a recipient chain. See membership.md. |
| Guidance | An instruction that helps someone act. Not a secret, not a legal instrument. |
| Informational guidance | Content Titip is willing to store and show. It is not legal advice. |
| Legal advice | Out of scope. Titip must not present itself as a notary, lawyer, or executor. |
People
| Term | Meaning |
|---|---|
| Trusted contact | A person invited to confirm, during escalation, that the owner has not responded. Not automatically a recipient. |
| Recipient | A person explicitly assigned one or more vaults. Not automatically a trusted contact. |
| Successor | The next recipient in an ordered chain for the same vault, used only when a prior recipient cannot take delivery. |
| Recipient chain | An ordered list of recipients for one vault: primary, then successors. Example: spouse → adult child → relative. Delivery tries the first reachable person; it does not send the same vault to everyone in the chain at once. |
| Confirmation | A trusted contact’s statement, after verification, that escalation should continue. It is evidence. It is not a death certificate and not a release. |
| Reviewer | The human who approves or holds a release candidate before any real delivery. |
Records
| Term | Meaning |
|---|---|
| Asset record | A documented item the owner cares about (insurance, property, a message). It points at guidance. It does not store a secret. |
| Instruction | The guidance text attached to an asset or vault. Owner-reviewed, including when AI drafted it. |
| Vault | A named, recipient-scoped container of guidance. Example: “Insurance”, “Business continuity”. |
| Assignment | The explicit link from a vault to a recipient, including any extra rule (for example recipient age). |
| Chain assignment | An assignment that names a recipient chain instead of a single recipient. Release still waits for evidence and review; only the reachable successor receives that vault. |
Life check
| Term | Meaning |
|---|---|
| Life check | The owner’s configured presence cycle. Not a cron that compares last_seen to a threshold. |
| Check-in / confirm alive | The owner’s explicit confirmation. From any escalation state this returns the cycle to ACTIVE. |
| Inactive | Operational only: the owner has not confirmed, and the current cycle has moved past CHECK_DUE. Inactive does not mean dead, and does not mean releasable. |
| Dead man's switch | A familiar analogy (silence may eventually lead to action). Not a product term. Do not use it in APIs, events, or UI labels. Prefer life check, escalation, and release. Marketing may say Titip is related to the idea but is not a classic dead man's switch. |
| Grace period | A configured wait after reminders and the alternate channel, before trusted-contact verification is requested. Prototype default: 14 days. |
| Policy version | An immutable snapshot of life-check and release rules. Changes create a new version. The previous version is archived, not edited. |
Canonical life-check states are in TITIP-006 and TITIP-007.
Release
| Term | Meaning |
|---|---|
| Release policy | The versioned rules for when a case may become eligible, and whether release is automatic. Prototype: automatic: false. |
| Evidence | A recorded fact cited by a release decision. Canonical codes are listed below. |
| Eligible | Required evidence for the active policy version is present. Eligibility is not delivery. |
| Release candidate | A case created when the policy is satisfied. It waits for review. It does not notify recipients with content. |
| Manual review | A reviewer decision on a candidate. Required before any non-simulated release (ADR-005). |
| Release case | The record that binds an owner, a policy version, evidence, per-recipient vault decisions, and status. |
| Hold | A recipient or case must not be delivered. Example: child, rule recipient age >= 18, status HOLD. |
| Simulation | The same state machine and evidence rules, with no real delivery and no token that can read a live vault. |
| Global release hold | release.disable=true. Stops controlled releases. Does not stop the owner using the app. |
Evidence codes
These strings are the contract. Do not rename them in emitters without a spec change.
| Code | Means | Does not mean |
|---|---|---|
life_check_unconfirmed |
The owner did not confirm during this cycle, and the machine left the reminder path | The owner has died |
alternate_channel_attempted |
The configured secondary channel was attempted | The owner was reached |
grace_period_elapsed |
The configured grace duration passed without owner confirmation | Release is allowed |
trusted_contact_confirmed |
At least the configured minimum of verified trusted contacts confirmed | A recipient may be shown a vault |
manual_review_approved |
A reviewer approved this case for real delivery | Recorded on approval, not required merely to become eligible |
life_check_failed is not a canonical code. It sounds like a death determination. Emitters use life_check_unconfirmed.
Security
| Term | Meaning |
|---|---|
| Secret | Password, PIN, recovery phrase, seed phrase, private key, OTP, CVV, or any value that authenticates to another system. Storage is prohibited. |
| Envelope encryption | A data encryption key encrypts content; a KMS key encrypts the data encryption key. The database does not store sensitive plaintext. See ADR-006. |
| Step-up authentication | An extra check before a recipient sees a vault. Email or phone possession alone is not enough for real delivery. |
Channels and notices
A notice tells someone to come to Titip. It is not the payload.
Notices must not include instruction text, document bytes, or secrets. The sentence to use is equivalent to: “Ada informasi Titip yang tersedia untuk Anda.”