Tenor is a non-Turing-complete, deterministic, closed-world behavioral contract language. Every valid contract has finite state, bounded evaluation, and decidable properties. There are no loops, no recursion, no side effects, and no nondeterminism.

The language defines constructs across four layers. Each construct in the semantic layer depends only on those above it in the dependency order.

Before diving into individual constructs, see Symbols & Operators for the complete operator and symbol reference used across all Tenor predicates.

Semantic Layer (dependency order)

BaseType

The closed set of twelve value types: Bool, Int, Decimal, Text, Enum, Date, DateTime, Money, Duration, Record, List, and TaggedUnion. No user-defined base types are permitted. All type checking is decidable at contract load time. Read more.

Fact

A named, typed, sourced value that forms the ground layer of the evaluation model. Facts are assembled into an immutable FactSet before rule evaluation begins. No fact is derived by any rule, produced by any operation, or computed by any internal evaluation. Read more.

Entity

A finite state machine embedded in a closed-world, well-founded, acyclic partial order. Each entity declares a finite set of states, an initial state, and an explicit transition relation. Entities are the stateful backbone of a contract. Read more.

Rule

A stratified, verdict-producing, side-effect-free evaluation function. Rules read from facts and lower-stratum verdict outputs and produce verdict instances. They do not modify entity state and do not invoke operations. Read more.

Persona

A declared identity token establishing a named participant role that may be referenced in operation authority sets and flow steps. Personas are the authority namespace of the contract. Read more.

Operation

A persona-gated, precondition-guarded unit of work that produces entity state transitions as its sole side effect and declares a finite set of named outcomes. Operations are the only construct that produces side effects. Read more.

PredicateExpression

Quantifier-free first-order logic with arithmetic and bounded quantification over list-typed facts. Predicates appear in rule when clauses and operation precondition fields. See Symbols & Operators for the full predicate grammar.

Flow

A finite DAG of steps that orchestrates the execution of declared operations under explicit persona control. Flows do not compute -- they sequence. All business logic remains in rules and operations. Read more.

Composition Layer

System

A multi-contract composition construct that declares shared personas, cross-contract triggers, and shared entities. Systems enable multi-contract coordination without modifying member contracts. Read more.

Infrastructure Layer

Source

A named declaration of an external system from which facts are populated at runtime. Sources carry protocol identity and connection metadata but have zero impact on evaluation semantics. Read more.

DSL Convenience

TypeDecl

A named alias for Record or TaggedUnion types. TypeDecl is resolved during elaboration and inlined at every use site. It does not appear in interchange output. Read more.

Evaluation Model

The evaluation model separates into a read path and a write path:

Read path:     assemble_facts -> eval_strata -> resolve -> ResolvedVerdictSet
Write path:    execute(op, persona, verdict_set, entity_state) -> EntityState' | Error
Orchestration: execute_flow(flow, persona, snapshot, bindings) -> FlowOutcome

Every step in both paths is bounded, deterministic, and statically analyzable.

Static Analysis Properties

A conforming static analyzer derives these eight properties from a contract alone, without execution:

Property	What it proves
S1	Complete state space -- every entity's state set is enumerable
S2	Reachable states -- every state is reachable from the initial state
S3a	Structural admissibility -- which operations are structurally possible per state
S4	Authority topology -- which personas can invoke which operations in which states
S5	Verdict and outcome space -- all possible verdicts and operation outcomes
S6	Flow path enumeration -- every flow path reaches a terminal
S7	Evaluation complexity bounds -- bounded computation for every expression
S8	Verdict uniqueness -- each verdict type produced by exactly one rule

Design Constraints

These constraints are non-negotiable. Any proposed feature that violates them is rejected regardless of ergonomic benefit:

• C1 -- Decidability. The language is non-Turing complete by design. No construct enables arbitrary computation.
• C2 -- Termination. Evaluation must terminate for all valid contracts. Termination is a structural property, not a runtime check.
• C3 -- Determinism. Identical inputs produce identical outputs across all conforming implementations.
• C4 -- Static analyzability. The complete state space, all reachable states, all admissible operations, all authority boundaries, and all possible verdicts are derivable by static analysis alone.
• C5 -- Closed-world semantics. The contract is the complete description. No implicit behaviors, no ambient authorities, no external references that affect evaluation.
• C6 -- Explicit over implicit. No authority, propagation, dependency, or evaluation order may be inferred.
• C7 -- Provenance as semantics. Every value carries its derivation. The audit log is a theorem, not a constructed artifact.

Numeric Model

All numeric computation uses fixed-point decimal arithmetic. No floating-point anywhere. Rounding mode is round-half-to-even (IEEE 754). Maximum 28 significant digits, scale range 0--28. Overflow produces a typed abort, never silent wraparound.