# The One mental model

One is easiest to understand through five ideas: meaning has an owner, every
deliverable has a root, consequences cross explicit stages, claims require
evidence, and physical choices remain replaceable.

## Meaning has an owner

Every stable concept has one semantic owner. The owner defines the value,
validates it, derives its identity, and explains it. Other parts of the system
carry an owner-qualified reference; they do not reinterpret private bytes or
mint an equivalent identity.

This applies to small values and large operational records alike: schemas,
faults, effects, operations, requirements, provider realizations, artifacts,
grants, observations, and historical facts. A digest commits a complete owned
record. It never upgrades a weaker fact into a stronger one.

## Every deliverable has a root

A root is the unit One closes, plans, builds, authorizes, releases, and
inspects. A repository can contain a browser application, API, worker,
migration, operator, and provider, while each receives only its own code,
schemas, artifacts, providers, secrets, and authority.

Reachability comes from explicit semantic edges. Workspace membership,
installed packages, generated files, Cargo features, and available providers
do not activate anything by proximity.

## Consequence crosses stages

The public lifecycle is short:

```text
declare -> check -> test -> invoke -> plan -> build -> apply -> inspect
```

The records underneath it remain deliberately separate:

```text
D-IR -> S-IR -> R-IR -> L-IR -> P-IR -> A-IR -> DPL-IR -> REC-IR
```

A declaration says what is meant. A requirement says what is needed. A
physical plan selects exact realizations. Build materializes artifacts. A
deployment plan fixes placement and proposed authority. Reconciliation makes
and observes changes. None of these records is accepted as evidence for a
later stage.

That separation is why a readable command can still be safe. One may derive
the routine records, but it cannot skip them.

## Claims require scoped evidence

One never asks whether a provider, artifact, release, or system is simply
“trusted.” It asks which exact claim is supported, for which revision,
configuration, target, environment, subject, time, and policy.

Evidence can show that a schema round-trips, a provider meets a durability
profile, an artifact came from a locked action graph, an approver authorized a
bounded effect, or observed state satisfies a postcondition. No one receipt
proves universal correctness.

Missing evidence remains missing. Unsupported behavior remains unsupported.
An ambiguous external result remains outcome unknown until reconciled.

## Physical choices remain replaceable

System meaning does not name PostgreSQL, Kubernetes, a particular cloud, or a
particular programming language unless those names are themselves part of the
user's domain. Meaning produces requirements. Planning selects admitted
realizations and records the reasons, constraints, cost, and rejected
alternatives.

A local function can later cross a process or network boundary without
changing the operation's meaning, but the new plan must account for codecs,
identity, transport, deadlines, cancellation, retries, partial failure,
observation, and cost. One does not pretend distribution is free.

## Convenience follows progressive disclosure

For ordinary work, you select a root and intent. One derives closures,
projections, provider support, artifacts, and evidence. It interrupts only for
a meaningful choice, a missing capability, a policy decision, or an approval.

When you need to know why, inspection resolves the exact owned records and
proof paths. Human output leads with the outcome and next action; machine
output retains every coordinate. This is the glass-box promise: simple use is
not purchased with hidden state.

Next: understand [source and meaning](/one/model/source-and-meaning), then learn
[the `.one` source language](/one/authoring/source-language).