# RF Vocabulary

Complete RF Vocabulary 0.1.0 contract, including every embedded Concept and Context.

RF Vocabulary is Rootform's embedded cross-Dialect vocabulary. Its owner is
`rf`; its version is `0.1.0`.

It is not an installable Dialect, local extension, or Policy Pack. Authors do
not declare or download it. Compiler records exact vocabulary dependency when a
Dialect or Policy Pack references an `rf.*` symbol.

## Concepts

| ID | Exact contract |
| --- | --- |
| <a id="rf-concept-kubernetes-cluster"></a>`rf.concept.kubernetes-cluster` | A declared Kubernetes cluster, excluding namespaces, node pools, and workload groups. |
| <a id="rf-concept-managed-database"></a>`rf.concept.managed-database` | A managed database service or instance, excluding logical tables and databases. |
| <a id="rf-concept-object-storage-container"></a>`rf.concept.object-storage-container` | An object storage container, excluding multi-service storage accounts. |
| <a id="rf-concept-service-identity"></a>`rf.concept.service-identity` | A principal explicitly intended for a non-human service or workload, excluding generic roles, permissions, bindings, and credentials. |
| <a id="rf-concept-subnet"></a>`rf.concept.subnet` | A declared native subnet, not a CIDR literal. |
| <a id="rf-concept-virtual-network"></a>`rf.concept.virtual-network` | An explicitly declared virtual network. |

These boundaries are normative. For example, a logical database inside a
managed service is not `rf.concept.managed-database`, and a role is not
`rf.concept.service-identity`.

## Contexts

| ID | Exact contract |
| --- | --- |
| <a id="rf-context-network"></a>`rf.context.network` | A declared network attachment without a connectivity guarantee. |
| <a id="rf-context-runtime"></a>`rf.context.runtime` | A declared execution environment or target without proof of effective execution. |

A network Context records declared attachment. It does not prove routing,
reachability, firewall allowance, or runtime traffic. A runtime Context records
declared execution placement. It does not prove that execution happened.

## Unsupported kinds

RF Vocabulary 0.1.0 defines:

- six Concepts;
- two Contexts;
- no Relations;
- no Rules.

Therefore `rf.relation.*` and `rf.rule.*` are invalid references.

## Using RF Vocabulary in a Dialect

```rf title="subnet.rf.hcl"
rule "subnet" {
  match {
    type = "example_subnet"
  }

  as = rf.concept.subnet

  context {
    as       = rf.context.network
    to       = rf.concept.virtual-network
    via      = source.network_id
    on_null  = "absent"
    on_empty = "absent"
  }
}
```

Use an RF symbol only when provider-specific meaning satisfies its complete
contract. Frequency or a similar name is insufficient.

## Using RF Vocabulary in a Policy Pack

```rf title="network policy"
policy "subnet-has-network-context" {
  target {
    concept = rf.concept.subnet
  }

  assert = exists(
    contexts(rf.context.network, rf.concept.virtual-network)
  )

  message = "Each subnet must declare its virtual network."
}
```

Policy references are always owner-qualified, so `rf.` prefix is required.
Linking verifies exact vocabulary version and semantic digest against the
Form.