[Apple Internals](https://mroi.github.io/apple-internals/)

AppleInternals.csv

AppleInternals.html

<table>
  <thead>
    <tr>
      <th>Term</th>
      <th>Description</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>1TR</td>
      <td>One True Recovery; booting into macOS recovery on Apple Silicon by holding the power button to verify physical presence; enables interaction with SEP to change Boot Policy</td>
    </tr>
    <tr>
      <td>AA</td>
      <td>Apple account</td>
    </tr>
    <tr>
      <td>AA</td>
      <td>Apple Archive, see also Apple Encrypted Archive; command line tools: aa, aea, compression_tool</td>
    </tr>
    <tr>
      <td>AAC</td>
      <td>Automatic Assessment Configuration; AutomaticAssessmentConfiguration.framework; puts device in a locked mode for exam-style test applications</td>
    </tr>
    <tr>
      <td>AAT</td>
      <td>Apple Advanced Typography; font format and rendering engine</td>
    </tr>
    <tr>
      <td>Accounts</td>
      <td>launchd service: com.apple.accountsd; /System/Library/Accounts</td>
    </tr>
    <tr>
      <td>ACDE</td>
      <td>Apple Connect Device External? ACDEClient.framework, old two-step verification, derived from a company-internal AppleConnect system? server: appleconnect.apple.com</td>
    </tr>
    <tr>
      <td>ACFS</td>
      <td>Apple Clustered File System; deprecated file system for Xsan; acfs.framework</td>
    </tr>
    <tr>
      <td>Acoustic ID</td>
      <td>Siri feature to recognize songs</td>
    </tr>
    <tr>
      <td>Activation</td>
      <td>cryptographic check-in with iCloud to lock devices reported by the user as lost; verified by iBoot; MobileActivationMacOS.framework; launchd service: com.apple.mobileactivationd; servers: humb.apple.com, albert.apple.com</td>
    </tr>
    <tr>
      <td>Activity</td>
      <td>jobs, coarse-grained work units of applications; tracked by the system across XPC, bears a QoS class for scheduling; low-level mechanism not to be confused with User Activity</td>
    </tr>
    <tr>
      <td>AE</td>
      <td>Apple Events; messaging system to invoke application functionality; CoreServices.framework/AE.framework; launchd services: com.apple.coreservices.appleevents, com.apple.AEServer (AE over network)</td>
    </tr>
    <tr>
      <td>AGC</td>
      <td>Apple Graphics Control, management of multiple displays and display port connections; launchd service: com.apple.displaypolicyd</td>
    </tr>
    <tr>
      <td>AIR</td>
      <td>Apple Intermediate Representation; synthetic bytecode architecture target for GPU binary toolchain</td>
    </tr>
    <tr>
      <td>ALF</td>
      <td>Application-Level Firewall, launchd service: com.apple.alf (socketfilterfw)</td>
    </tr>
    <tr>
      <td>Alloy</td>
      <td>substrate for communication between user devices over Bluetooth and devices to iCloud, implemented over IDS; /System/Library/IdentityServices/ServiceDefinitions; launchd service: com.apple.identityservicesd</td>
    </tr>
    <tr>
      <td>ALS</td>
      <td>Ambient Light Sensor, AmbientDisplay.framework</td>
    </tr>
    <tr>
      <td>Amber</td>
      <td>Swift UI; SwiftUI.framework</td>
    </tr>
    <tr>
      <td>AMFI</td>
      <td>Apple Mobile File Integrity, checks code integrity based on code signature, stronger enforcement with hardened runtime, validates entitlement restrictions; launchd service: com.apple.MobileFileIntegrity (amfid, invoked by kernel through host special port 18); disabled by setting amfi_get_out_of_my_way=0x1 in boot-args</td>
    </tr>
    <tr>
      <td>AMP</td>
      <td>Apple Media Protocol? former parts of iTunes for iPod and iOS device access in Finder, Home Sharing; AMPDevices.framework, AMPSharing.framework; launchd services: com.apple.AMPDeviceDiscoveryAgent, com.apple.AMPDevicesAgent, com.apple.amp.mediasharingd</td>
    </tr>
    <tr>
      <td>AMP</td>
      <td>Asynchronous Multiprocessing; performance and power-efficiency cores on Apple Silicon</td>
    </tr>
    <tr>
      <td>AMS</td>
      <td>Apple Media Services; formerly the iTunes stores and media services: App Stores, Apple Music, Apple TV, iCloud media library, Apple Podcasts, Podcast sync, Books Store, Books sync; AppleMediaServices.framework; server: phobos.apple.com</td>
    </tr>
    <tr>
      <td>AMX</td>
      <td>Apple Matrix Extension; ARM instruction set extension for matrix operations</td>
    </tr>
    <tr>
      <td>ANE</td>
      <td>Apple Neural Engine, hardware accelerator for neural network operations; ANECompiler.framework, ANEServices.framework; launchd service: com.apple.aned</td>
    </tr>
    <tr>
      <td>Anisette</td>
      <td>two-factor authentication creates security codes on trusted devices using TOTP, probably using Circle keys, checked by HSA; AuthKit.framework; launchd service: com.apple.akd</td>
    </tr>
    <tr>
      <td>AOP</td>
      <td>Always On Processor, part of Apple SoCs, runs RTKit as operating system</td>
    </tr>
    <tr>
      <td>AOS</td>
      <td>Apple Online Services? historical name for iCloud</td>
    </tr>
    <tr>
      <td>Apache</td>
      <td>built-in web server; command line tool: apachectl</td>
    </tr>
    <tr>
      <td>APFS</td>
      <td>Apple File System; copy-on-write file system with support for volume space-sharing, per-file encryption, and snapshots</td>
    </tr>
    <tr>
      <td>APNS</td>
      <td>Apple Push Notification service, server infrastructure for remote push notifications over a single connection, clients subscribe to push topics, can be authenticated by app (remote notifications), device (Find My …), or Apple ID login (DSID); credentials in apsd keychain; launchd service: com.apple.apsd; server: push.apple.com</td>
    </tr>
    <tr>
      <td>App Nap</td>
      <td>quiescence detection for applications and corresponding self-demotion in scheduler parameters, implemented within application frameworks and RunningBoard, listens for occlusion notifications from WindowServer</td>
    </tr>
    <tr>
      <td>App Sandbox</td>
      <td>Seatbelt-based sandbox for apps; /System/Library/Sandbox/Profiles/application.sb; enabled with com.apple.security.app-sandbox entitlement; launchd service: com.apple.secinitd</td>
    </tr>
    <tr>
      <td>AppleCare</td>
      <td>extended warranty; NewDeviceOutreach.framework; launchd service: com.apple.ndoagent</td>
    </tr>
    <tr>
      <td>APT</td>
      <td>Adaptive Picture Timing? ProMotion; dynamic screen updates with 120Hz base frequency; AppleDisplayTCONControl.framework</td>
    </tr>
    <tr>
      <td>ASL</td>
      <td>Apple System Logger, superseded by Unified Logging; /etc/asl; stored in /var/log/asl; launchd service: com.apple.syslogd; command line tool: syslog</td>
    </tr>
    <tr>
      <td>ASR</td>
      <td>Apple Software Restore; restore entire volumes from sources like disk images (HDI, SIU), also restores based on APFS snapshots and snapshot deltas; command line tool: asr</td>
    </tr>
    <tr>
      <td>Assertions</td>
      <td>power state management allowing applications to prevent sleeping; launchd service: com.apple.powerd; command line tools: caffeinate, pmset</td>
    </tr>
    <tr>
      <td>Assessment</td>
      <td>checking of System Policy; term also used for AAC</td>
    </tr>
    <tr>
      <td>Asset Cache</td>
      <td>discretionary caching server for Mobile Assets, Packages, iOS updates, App Store content, ODR, MMCS data; launchd services: com.apple.AssetCache.builtin, com.apple.AssetCacheLocatorService, com.apple.AssetCacheManagerService, com.apple.AssetCacheTetheratorService; command line tools: AssetCacheLocatorUtil, AssetCacheManagerUtil, AssetCacheTetheratorUtil</td>
    </tr>
    <tr>
      <td>Assistant</td>
      <td>Siri; dictation and semantic understanding, Intent is communicated to and enacted on the client, uses TTS for output, Snippets to embed mini UIs into responses; /System/Library/Assistant, /System/Library/Snippets, AssistantServices.framework; server: *.siri.apple.com</td>
    </tr>
    <tr>
      <td>ATS</td>
      <td>App Transport Security, sandbox mechanism only allowing TLS-secured connections</td>
    </tr>
    <tr>
      <td>ATSUI</td>
      <td>Apple Type Services for Unicode Imaging; rendering engine superseded by CoreText.framework, font management; ApplicationServices.framework/ATS.framework; launchd service: com.apple.xtyped (fontd); command line tools: atsutil</td>
    </tr>
    <tr>
      <td>ATT</td>
      <td>App Tracking Transparency; apps declare user tracking on app store</td>
    </tr>
    <tr>
      <td>Attestation</td>
      <td>cryptographic proof of a genuine SEP; used for web authentication and app attestation; DeviceCheck.framework; SEP responds to challenge using hardware-key (GID, PKA), online service verifies; used to pair Touch ID keyboards, used to pair RemoteXPC channel?</td>
    </tr>
    <tr>
      <td>Authorization</td>
      <td>discretionary access control policies for high-level services; similar to PAM; policy stored in /var/db/auth.db</td>
    </tr>
    <tr>
      <td>Avatar</td>
      <td>Memoji and Animoji (face tracking); AvatarKit.framework</td>
    </tr>
    <tr>
      <td>AVB</td>
      <td>Audio Video Bridging, low-latency audio over Ethernet; launchd service: com.apple.avbdeviced; command line tool: avbdiagnose, avbutil</td>
    </tr>
    <tr>
      <td>AWD</td>
      <td>Apple Wireless Diagnostics, sends system telemetry to Apple; CoreAnalytics.framework, WirelessDiagnostics.framework; launchd services: com.apple.awdd, com.apple.analyticsd</td>
    </tr>
    <tr>
      <td>AWDL</td>
      <td>Apple Wireless Direct Link; secondary WiFi interface that runs in parallel to an active WiFi access point connection, similar to WiFi Direct (p2p interface), uses a randomized MAC, used for peer-to-peer networking: AirDrop, AirPlay; DeviceToDeviceManager.framework</td>
    </tr>
    <tr>
      <td>Bezel</td>
      <td>on-screen overlays for hardware volume buttons, screen brightness, Bluetooth HID, and others; /Library/Application Support/Apple/BezelServices, launchd services: com.apple.loginwindow, com.apple.OSDUIHelper</td>
    </tr>
    <tr>
      <td>Biome</td>
      <td>CloudKit-based datastream and sync engine; BiomeStreams.framework, BiomeSync.framework; launchd services: com.apple.BiomeAgent, com.apple.biomesyncd</td>
    </tr>
    <tr>
      <td>Blast Door</td>
      <td>sandboxed sanitization process for untrusted  iMessage input; BlastDoor.framework</td>
    </tr>
    <tr>
      <td>BOM</td>
      <td>Bill of Materials; format to store contents of installer Packages; command line tool: lsbom</td>
    </tr>
    <tr>
      <td>Bonjour</td>
      <td>mDNS; launchd service: com.apple.mDNSResponder.reloaded; command line tool: dns-sd</td>
    </tr>
    <tr>
      <td>Boot Cache</td>
      <td>disk cache pre-heating at boot time with typically loaded applications; /var/db/BootCaches; launchd service: com.apple.warmd</td>
    </tr>
    <tr>
      <td>Boot Policy</td>
      <td>decides by signature check which OSes can be booted, boot-time equivalent for System Policy; LocalPolicy stores user settings, configurable from 1TR, stored by SEP, enforced by iBoot; command line tools: bputil, kmutil (to enroll custom kernels)</td>
    </tr>
    <tr>
      <td>BPR</td>
      <td>Boot Progress Register; set-only flags to track boot mode (normal, DFU, recovery), part of Keybag class key derivation within SEP, so passcode-protected keys are inaccessible in DFU and recovery</td>
    </tr>
    <tr>
      <td>Bridge</td>
      <td>T2 ARM CPU in Intel Macs to drive Touch Bar and Boot Policy; runs bridgeOS, a derivative of watchOS; boots the platform and the Intel CPU, communication from macOS uses RemoteXPC; launchd service: com.apple.multiversed; /System/Library/MultiversePlugins</td>
    </tr>
    <tr>
      <td>Brook</td>
      <td>hand washing encouragement on watch; BrookServices.framework</td>
    </tr>
    <tr>
      <td>Bulletin Board</td>
      <td>application push notification management, aggregates local and remote push notifications; BulletinBoard.framework</td>
    </tr>
    <tr>
      <td>Cache Delete</td>
      <td>cleanup for various caches; /System/Library/CacheDelete; launchd service: com.apple.cache_delete (deleted)</td>
    </tr>
    <tr>
      <td>CAML</td>
      <td>Core Animation Markup Language; XML file format for layers, shapes and animations</td>
    </tr>
    <tr>
      <td>Carousel</td>
      <td>derivative of SpringBoard for Watch home screen, watch face, and notification center</td>
    </tr>
    <tr>
      <td>Celestial</td>
      <td>media streaming used by ReplayKit for game broadcasts; Celestial.framework</td>
    </tr>
    <tr>
      <td>Certificates</td>
      <td>validity checked using CRLs, OCSP stapling, and transparency logs; /System/Library/Security/Certificates.bundle; launchd services: com.apple.trustd, com.apple.trustd.agent, com.apple.ocspd; command line tool: crlrefresh</td>
    </tr>
    <tr>
      <td>CHIP</td>
      <td>Connected Home over IP; Matter; integrated into HomeKit; CHIP.framework</td>
    </tr>
    <tr>
      <td>Circle</td>
      <td>cryptographic primitive to exchange public keys of trusted devices of a user, signed by Circle peers; iCloud identity added as additional Circle peer, private key synced across all trusted devices, new devices can pull this key from Secure Backup to join the Circle; per-device Circles stored in CKKS for two-factor accounts (Octagon); KeychainCircle.framework; command line tools: tpctl, otctl (Octagon)</td>
    </tr>
    <tr>
      <td>CKKS</td>
      <td>CloudKit Key Sync, end-to-end secure syncing for credentials, seeded by Circle; currently includes ApplePay, AutoUnlock, CreditCards, DevicePairing, Engram, Health, Home, Manatee, SOS, WiFi and other keys; launchd service: com.apple.secd; command line tool: ckksctl</td>
    </tr>
    <tr>
      <td>Classroom</td>
      <td>school teachers can create assignments for student iPads and track progress in Schoolwork app; ClassKit.framework; launchd service: com.apple.studentd</td>
    </tr>
    <tr>
      <td>Cloud Pairing</td>
      <td>part of Alloy, Bluetooth out-of-band pairing over iCloud for Continuity; launchd service: com.apple.BTServer.cloudpairing (cloudpaird)</td>
    </tr>
    <tr>
      <td>CMAS</td>
      <td>Commerial Mobile Alert System, now known as Wireless Emergency Alerts (WEA)</td>
    </tr>
    <tr>
      <td>Commpage</td>
      <td>user-mapped kernel data, like vdso/vsyscall on Linux; mapped at 0x7fffffe00000</td>
    </tr>
    <tr>
      <td>Communications Filter</td>
      <td>recipient blocking for iMessage, FaceTime, Mail; launchd service: com.apple.cmfsyncagent</td>
    </tr>
    <tr>
      <td>Companion</td>
      <td>iPhone that is paired with Watch; communication uses Alloy over IPsec over Bluetooth</td>
    </tr>
    <tr>
      <td>Continuity</td>
      <td>umbrella term for Handoff, Sidecar, SMS relay, Universal Clipboard, Watch unlock, WiFi call relay and others; SMS relay works by proxying to iMessage, other services use Alloy</td>
    </tr>
    <tr>
      <td>Control Center</td>
      <td>icons in menu/status bar and Bento Box controls UI, gradually replaces SystemUIServer on macOS; handles incoming AirPlay content; launchd services: com.apple.controlcenter, com.apple.SystemUIServer.agent</td>
    </tr>
    <tr>
      <td>CPML</td>
      <td>CorePrediction Machine Learning; CPMLBestShim.framework</td>
    </tr>
    <tr>
      <td>CRD</td>
      <td>Conference Room Display; Apple TV mode</td>
    </tr>
    <tr>
      <td>CTK</td>
      <td>Crypto Token Kit; smart card management, also for the Secure Element on iOS? launchd service: com.apple.ctkd; command line tool: sc_auth</td>
    </tr>
    <tr>
      <td>CTS</td>
      <td>Centralized Task Scheduling; execution of DAS tasks; /System/Library/UserEventPlugins/com.apple.cts.plugin</td>
    </tr>
    <tr>
      <td>CVMS</td>
      <td>Core VM Server/Service? compilation of GPU shaders; launchd service: com.apple.cvmsServ</td>
    </tr>
    <tr>
      <td>DAAP</td>
      <td>Digital Audio Access Protocol; used by Home Sharing (with Rapport token) and by the Remote app to control Apple TV (with pairing token); payload unencrypted; DAAPKit.framework; Bonjour services: _atc._tcp, _home-sharing._tcp, _mediaremotetv._tcp, _touch-able._tcp</td>
    </tr>
    <tr>
      <td>Daily Briefing</td>
      <td>Siri giving an overview of information for the day; SiriDailyBriefingInternal.framework</td>
    </tr>
    <tr>
      <td>DART</td>
      <td>DMA Address Relocation Table; IOMMU implementation in Apple silicon, positioned in front of every DMA-capable co-processor and peripheral, offers sub-page protection; SART: streaming variant for high-throughput devices (like NVMe)</td>
    </tr>
    <tr>
      <td>DAS</td>
      <td>Duet Activity Scheduler; scheduling policy engine behind NSBackgroundActivityScheduler and XPC activities; /System/Library/DuetActivityScheduler; launchd service: com.apple.dasd</td>
    </tr>
    <tr>
      <td>Data Detectors</td>
      <td>text analysis to highlight phone numbers, street addresses, and the like; DataDetectors.framework</td>
    </tr>
    <tr>
      <td>Data Vault</td>
      <td>directories with the UF_DATAVAULT special flag; CSR limits access to one application</td>
    </tr>
    <tr>
      <td>DAV</td>
      <td>Distributed Authoring and Versioning; network protocol on top of HTTP for syncing calendars (CalDAV), contacts (CardDAV), and formerly also bookmarks (BookmarkDAV)</td>
    </tr>
    <tr>
      <td>DCP</td>
      <td>Display Co-Processor</td>
    </tr>
    <tr>
      <td>DEP</td>
      <td>Device Enrollment Program; devices check in with Apple during Setup Assistant to query for their enrollment status, retrieve MDM server URL to fetch initial configuration profile</td>
    </tr>
    <tr>
      <td>DFR</td>
      <td>Dynamic Function Row?, TouchBar; /System/Library/CoreServices/ControlStrip.app; DFRFoundation.framework</td>
    </tr>
    <tr>
      <td>DFU</td>
      <td>Device Firmware Update; special boot mode where iOS has not booted and the system can be installed over the Lightning connection</td>
    </tr>
    <tr>
      <td>Differential Privacy</td>
      <td>crowdsourcing without user tracking; privacy budget for management of anonymity set; used for keyboard words, emoji, Spotlight searches, Parsec deep links, HealthKit usage, Safari telemetry; /System/Library/DifferentialPrivacy; stored in /var/db/DifferentialPrivacy; launchd service: com.apple.dprivacyd</td>
    </tr>
    <tr>
      <td>DND</td>
      <td>Do Not Disturb</td>
    </tr>
    <tr>
      <td>DSID</td>
      <td>Destination Signaling Identifier, unique ID for IDS login on a specific device</td>
    </tr>
    <tr>
      <td>DTrace</td>
      <td>system-wide tracing infrastructure, command line tools: dtrace, *.d, dappprof, dapptrace, dtruss, errinfo, execsnoop, fddist, fs_usage, imptrace, iopattern, iopending, iosnoop, iotop, lastwords, latency, opensnoop, plockstat, rwsnoop, sampleproc, sc_usage, topsyscall, topsysproc</td>
    </tr>
    <tr>
      <td>Duet</td>
      <td>telemetry collection engine for system and user events, forecasting by machine learning, backend for DAS, Proactive, Relevance, Screen Time, thermal and battery management; /System/Library/DuetKnowledgeBase; CoreDuet.framework, CoreKnowledge.framework, CorePrediction.framework; launchd services: com.apple.coreduetd, com.apple.knowledge-agent</td>
    </tr>
    <tr>
      <td>Dyld Shared Cache</td>
      <td>dynamic linker cache, stores all system libraries in prelinked form, original library files are removed; /System/Library/dyld; command line tool: update_dyld_shared_cache</td>
    </tr>
    <tr>
      <td>EAS</td>
      <td>Exchange Active Sync; network protocol for accessing Microsoft Exchange servers</td>
    </tr>
    <tr>
      <td>EDR</td>
      <td>Extended Dynamic Range; rendering with transfer function extending beyond sRGB white; implemented natively on XDR displays and by backlight modulation on others; HDRProcessing.framework</td>
    </tr>
    <tr>
      <td>Energy Impact</td>
      <td>unitless metric for per-application energy consumption, machine-specific coefficients; /usr/share/pmenergy, /usr/share/kpep; launchd services: com.apple.sysmond, com.apple.thermald; command line tool: powermetrics</td>
    </tr>
    <tr>
      <td>Engram</td>
      <td>Messages in iCloud; devices store received iMessages in CloudKit; Engram.framework</td>
    </tr>
    <tr>
      <td>Entitlements</td>
      <td>capability-like attributes bound to executables by code signing; some entitlements like App Sandbox restrict ambient authority, some gradually relieve those restrictions (using Seatbelt), some services or system calls grant privilege based on caller entitlements</td>
    </tr>
    <tr>
      <td>ESS</td>
      <td>IDS user directory, public key distribution for iMessage and CloudKit sharing, uses Transparency; server: *.ess.apple.com; launchd service: com.apple.identityservicesd</td>
    </tr>
    <tr>
      <td>Event Monitor</td>
      <td>simple rules engine for running commands on various systen events; apparently not used by default; /etc/emond.d, /var/db/emondClients; launchd service: com.apple.emond</td>
    </tr>
    <tr>
      <td>FaceTime</td>
      <td>video calls, employs the ICE (establishing peer-to-peer connection), STUN (session credential exchange) and SRTP (encrypted media streaming) protocols; FTServices.framework; launchd services: com.apple.videoconference.camera (avconferenced)</td>
    </tr>
    <tr>
      <td>FairPlay</td>
      <td>DRM system used by app and media stores; CoreADI.framework, CoreFP.framework, CoreLSKD.framework; launchd services: com.apple.adid, com.apple.fairplayd (invoked by kernel through host special port 17), com.apple.lskdd; credentials stored in /var/db/fpsd</td>
    </tr>
    <tr>
      <td>Family Circle</td>
      <td>Family Sharing; launchd services: com.apple.familycircled, com.apple.askpermissiond</td>
    </tr>
    <tr>
      <td>FDE</td>
      <td>Full Disk Encryption, FileVault; command line tool: fdesetup, sysadminctl</td>
    </tr>
    <tr>
      <td>FDR</td>
      <td>Factory Data/Device Reset? ensures that no downgrades are performed? servers: skl.apple.com, gg.apple.com; /System/Library/FDR</td>
    </tr>
    <tr>
      <td>Feldspar</td>
      <td>Apple News; Silex.framework</td>
    </tr>
    <tr>
      <td>FiDES</td>
      <td>Fi? Distributed Evaluation Service? aggregates Differential Privacy data for unlinkability? maybe private federated learning? used for emoji, Suggestions, Dictation; /System/Library/DistributedEvaluation; DistributedEvaluation.framework; server: fides-pol.apple.com</td>
    </tr>
    <tr>
      <td>File Provider</td>
      <td>infrastructure and extension system for syncing with cloud providers; placeholder files based on SF_DATALESS attribute in APFS; FileProvider.framework; locally stored in ~/Library/CloudStorage; command line tool: fileproviderctl</td>
    </tr>
    <tr>
      <td>Find My …</td>
      <td>location sharing by explicitly querying devices remotely or collateral beacon detection using Search Party; FMCore.framework, FMF.framework; launchd service: com.apple.icloud.fmfd (find my friends)</td>
    </tr>
    <tr>
      <td>Firmlink</td>
      <td>bi-directional non-symbolic link between the read-only system volume and the data volume, additional symlinks and mountpoints in the root directory are virtually allocated; /usr/share/firmlinks, /etc/synthetic.conf</td>
    </tr>
    <tr>
      <td>Focus</td>
      <td>restriction modes for notification presentation; Focus.framework, DoNotDisturb.framework; local settings in ~/Library/DoNotDisturb</td>
    </tr>
    <tr>
      <td>FollowUp</td>
      <td>user interaction for Secure Backup wrapping with device passcode, CoreFollowUp.framework; launchd service: com.apple.followupd</td>
    </tr>
    <tr>
      <td>FoundationDB</td>
      <td>fundamental iCloud storage database, marketed as CloudKit, separated into containers; records, blobs, and large asset storage with MMCS, server-side continuous queries can trigger push notifications, user management by IDS, sharing between users; PCS keys used for hierarchical zone, record, and asset encryption; CloudKitDaemon.framework; launchd service: com.apple.cloudd; locally stored in ~/Library/Caches/CloudKit, ~/Library/Containers/*/Data/CloudKit; command line tool: cktool</td>
    </tr>
    <tr>
      <td>FPR</td>
      <td>Fast Permission Restrictions; Apple CPU registers to downgrade (old APRRs do bitmasking) or remap (SPRRs since M1) actual permissions of memory pages (the CTRR region) per thread; used for JIT protection and by AMFI to freeze user code after checking</td>
    </tr>
    <tr>
      <td>FUD</td>
      <td>Firmware Update Daemon; /var/db/fud; launchd service: com.apple.accessoryupdaterd</td>
    </tr>
    <tr>
      <td>GID</td>
      <td>group ID key, shared across all devices of the same SoC generation, derived keys are used to prove device type over the network, only accessible by SEP</td>
    </tr>
    <tr>
      <td>Gizmo</td>
      <td>Apple Watch; watch settings managed by Companion; /Applications/Bridge.app, /System/Library/BridgeManifests</td>
    </tr>
    <tr>
      <td>Group Activities</td>
      <td>SharePlay; sharing of media content and programmatic state over FaceTime calls; GroupActivities.framework, CopresenceCore.framework; launchd service: com.apple.telephonyutilities.callservicesd</td>
    </tr>
    <tr>
      <td>GSS</td>
      <td>Generic Security Service; part of Kerberos; GSS.framework; launchd service: com.apple.gssd (invoked by kernel through host special port 19); command line tool: gsstool</td>
    </tr>
    <tr>
      <td>GXF</td>
      <td>Guarded Execution Feature/Fault, additional exception levels on Apple Silicon, lateral to the usual exception levels; page tables remain the same, but interpretation of permission bits changes by way of FPR, genter and gexit instructions; implements lightweight intra-address-space protection contexts</td>
    </tr>
    <tr>
      <td>HAP</td>
      <td>Home Automation Protocol; CoreHAP.framework</td>
    </tr>
    <tr>
      <td>HDA</td>
      <td>High Definition Audio; HDAInterface.framework</td>
    </tr>
    <tr>
      <td>HDI</td>
      <td>Hard Disk Image; command line tool: hdiutil</td>
    </tr>
    <tr>
      <td>HeadBoard</td>
      <td>derivative of SpringBoard for tvOS home screen; /Applications/HeadBoard.app, /Applications/PineBoard.app</td>
    </tr>
    <tr>
      <td>HLS</td>
      <td>HTTP Live Streaming</td>
    </tr>
    <tr>
      <td>HSA</td>
      <td>Hardware Security Architecture; version 1 used for two-step verification, SOS with iCSC; version 2 for two-factor authentication, CKKS and Secure Backup with iCDP</td>
    </tr>
    <tr>
      <td>HSM</td>
      <td>Hardware Security Module; HSM fleet runs escrow service for Secure Backup; public keys for authenticating the HSM services in /System/Library/Security/Certificates.bundle/Contents/Resources/AppleESCertificates.plist</td>
    </tr>
    <tr>
      <td>Hyperion</td>
      <td>iCloud Photos, uses CloudKit; launchd service: com.apple.cloudphotod; command line tool: cpldiagnose</td>
    </tr>
    <tr>
      <td>IAP</td>
      <td>iPod Accessory Protocol; IAP.framework</td>
    </tr>
    <tr>
      <td>iBoot</td>
      <td>boot loader stage after boot ROM or UEFI (macOS on Intel); intermediate Low-Level Bootloader (LLB); DFU mode is implemented here; /System/Library/CoreServices/boot.efi</td>
    </tr>
    <tr>
      <td>iCDP</td>
      <td>iCloud Data Protection, codename for a set of enhancements to iCloud privacy: device passcodes used as iCSC for Secure Backup, root keys for CKKS-enabled services only synced between devices and not stored at Apple; launchd service: com.apple.cdpd</td>
    </tr>
    <tr>
      <td>iCloud</td>
      <td>umbrella term for a conglomerate of services, consists of FoundationDB containers with PCS views for key management, supported by CKKS; uses IDS and APNS; some services under the iCloud name are actually served by AMS, IMAP, or DAV</td>
    </tr>
    <tr>
      <td>iCSC</td>
      <td>iCloud Security Code, credential wrapping for Secure Backup, previously used a separate code, with HSA2/iCDP uses device passcodes</td>
    </tr>
    <tr>
      <td>IDAM</td>
      <td>Inter-Device Audio and MIDI; audio connection between devices</td>
    </tr>
    <tr>
      <td>IDS</td>
      <td>Identity Service, also IDMS, Apple ID identity management for all of Apple’s online services; APNS topics for signaling and messaging, see also Alloy, ESS, FaceTime, iMessage; authentication to services with Kerberos</td>
    </tr>
    <tr>
      <td>IDV</td>
      <td>Identity Verification? Touch ID and Face ID; /System/Library/AccessibilityBundles/CoreIDVUI.axbundle</td>
    </tr>
    <tr>
      <td>IM</td>
      <td>Instant Messaging; usually means iMessage and FaceTime</td>
    </tr>
    <tr>
      <td>IMG4</td>
      <td>boot files (Mach-O binaries or configuration data) with ASN.1 signature, contains RemotePolicy certificate constraints to restrict Boot Policy evaluation</td>
    </tr>
    <tr>
      <td>Intent</td>
      <td>use-case-driven interaction with 3rd-party apps from a host app; used for Siri, Maps, Widgets (configuration); extension points: com.apple.intents-service, com.apple.intents-ui-service</td>
    </tr>
    <tr>
      <td>IOKit</td>
      <td>device driver subsystem for in-kernel and DriverKit drivers, command line tool: ioreg</td>
    </tr>
    <tr>
      <td>Ironwood</td>
      <td>dictation, customized on server with selected user data (contacts, app names, music titles, HomeKit names, Siri Shortcut phrases), not tied to Apple ID; SpeechRecognitionCore.framework; server: guzzoni.apple.com</td>
    </tr>
    <tr>
      <td>ISP</td>
      <td>Image Signal Processor; camera imaging circuit in iPhones</td>
    </tr>
    <tr>
      <td>ITML</td>
      <td>iTunes Markup Language; metdata tagging for media services; ITMLKit.framework</td>
    </tr>
    <tr>
      <td>ITP</td>
      <td>Intelligent Tracking Prevention, cross-site tracking defenses in Safari, statistics and user interaction classify sites, cookies are partitioned and access is restricted</td>
    </tr>
    <tr>
      <td>JARVIS</td>
      <td>Just A Rather Very Intelligent Scheduler, Mesos cluster manager for Siri, iCloud, AMS</td>
    </tr>
    <tr>
      <td>Jellyfish</td>
      <td>Animoji</td>
    </tr>
    <tr>
      <td>Jetsam</td>
      <td>reclaiming of purgeable memory and termination of apps during memory pressure</td>
    </tr>
    <tr>
      <td>JSC</td>
      <td>JavaScript Core; JavaScriptCore.framework; command line tool: jsc</td>
    </tr>
    <tr>
      <td>Kalamata</td>
      <td>codename for the transition from x86 to ARM-based Apple Silicon</td>
    </tr>
    <tr>
      <td>Kerberos</td>
      <td>single-sign-on mechanism; Heimdal.framework; command line tools: kinit, ktutil</td>
    </tr>
    <tr>
      <td>Kext</td>
      <td>kernel extension mechanism, loaded at boot time as part of a Kext Collection; /Library/Extensions, /Library/StagedExtensions (for user approval), /System/Library/Extensions; command line tool: kextutil (manages deprecated runtime loading)</td>
    </tr>
    <tr>
      <td>Kext Collection</td>
      <td>prelinked sets of kernel extensions; /System/Library/KernelCollections (for boot and system kexts), /Library/KernelCollections (for auxiliary third-party kexts); the latter is only loaded at a lower-security Boot Policy; launchd service: com.apple.kernelmanagerd (invoked by kernel through host special port 15); command line tool: kmutil</td>
    </tr>
    <tr>
      <td>Keybag</td>
      <td>storage of protection class keys for Keychain and filesystem, protected by SEP using SKP; stored in user.kb; launchd services: com.apple.mobile.keybagd, com.apple.securityd_service, com.apple.secd</td>
    </tr>
    <tr>
      <td>Keychain</td>
      <td>storage for credentials; launchd service: com.apple.securityd; command line tools: certtool, security, systemkeychain</td>
    </tr>
    <tr>
      <td>KIP</td>
      <td>Kernel Integrity Protection, locking of physical memory pages to prevent changes to kernel</td>
    </tr>
    <tr>
      <td>Launch Services</td>
      <td>management for application launches, association of UTIs to apps, uses Spotlight to update cached info; launchd services: com.apple.coreservices.launchservicesd, com.apple.lsd; CoreServices.framework/LaunchServices.framework; command line tools: lsappinfo, lsregister</td>
    </tr>
    <tr>
      <td>Liverpool</td>
      <td>PCS codename for CloudKit</td>
    </tr>
    <tr>
      <td>LKDC</td>
      <td>Local Key Distribution Center, Kerberos on client machines</td>
    </tr>
    <tr>
      <td>LSM</td>
      <td>Latent Semantic Mapping, text analysis, used for spam filtering, command line tool: lsm</td>
    </tr>
    <tr>
      <td>Mac Buddy</td>
      <td>historic name for Setup Assistant</td>
    </tr>
    <tr>
      <td>MAC Policy</td>
      <td>Mandatory Access Control subsystem in XNU, based on TrustedBSD, implements policy hooks for restricted kernel operations; current policies: AMFI, Seatbelt, Quarantine, CSR</td>
    </tr>
    <tr>
      <td>Machine Learning</td>
      <td>Vision.framework, Espresso.framework, Futhark.framework, PhotoAnalysis.framework; used for Live Text and Visual Lookup; launchd service: com.apple.mediaanalysisd</td>
    </tr>
    <tr>
      <td>Madrid</td>
      <td>iMessage; /System/Library/Messages</td>
    </tr>
    <tr>
      <td>Manatee</td>
      <td>PCS key for some CloudKit containers are synced via CKKS, so data is unreadable to Apple (credential management codenames: Plesio, Stingray, Cuttlefish)</td>
    </tr>
    <tr>
      <td>Mangrove</td>
      <td>transfering UI tiles over XPC; Mangrove.framework, IOSurface.framework</td>
    </tr>
    <tr>
      <td>Marco</td>
      <td>Marco.framework, something about IDS and communication (iMessage, Calls), logging?</td>
    </tr>
    <tr>
      <td>Marklar</td>
      <td>codename from the PowerPC era for the port to x86, served the transition to Intel CPUs</td>
    </tr>
    <tr>
      <td>Marzipan</td>
      <td>Catalyst; port of iOS frameworks to macOS, Catalyst apps are iOS apps with additional API to adapt macOS UI idioms; /System/iOSSupport; integration using UIKit system process; launchd service: com.apple.uikitsystemapp; input remapping by /Library/Apple/Library/Bundles/InputAlternatives.bundle</td>
    </tr>
    <tr>
      <td>MCX</td>
      <td>Managed Client for OS X, preference management for settings from configuration profiles, /Library/Managed Preferences, command line tools: mcxquery, mcxrefresh</td>
    </tr>
    <tr>
      <td>MDM</td>
      <td>Mobile Device Management; server software to manage fleets of iOS and macOS devices; uses configuration profiles to manage preferences; ConfigurationProfiles.framework</td>
    </tr>
    <tr>
      <td>MDS</td>
      <td>Module Directory Services, ancient part of the old security APIs (CSDA, CSSM)</td>
    </tr>
    <tr>
      <td>Memory Debugging</td>
      <td>uses Taskport; command line tools: heap, leaks, malloc_history, stringdups, vmmap</td>
    </tr>
    <tr>
      <td>Mesa</td>
      <td>Touch ID; /Library/Catacomb; /var/db/bkad.db</td>
    </tr>
    <tr>
      <td>Metadata</td>
      <td>Spotlight; file indexing on macOS; CoreServices.framework/Metadata.framework, CoreServices.framework/SearchKit.framework; stored in .Spotlight-V100; launchd service: com.apple.metadata.mds; command line tools: mddiagnose, mdfind, mdimport, mdls, mdutil; in addition to auto-indexing, apps can explicitly register searchable items; CoreSpotlight.framework; launchd service: com.apple.corespotlightd</td>
    </tr>
    <tr>
      <td>MMCS</td>
      <td>MobileMe Chunk Storage, used by iCloud, splits blobs into chunks and stores them at Apple/AWS/GCP with convergent encryption (content hash as key); MMCS.framework</td>
    </tr>
    <tr>
      <td>Mobile</td>
      <td>prefix for iOS</td>
    </tr>
    <tr>
      <td>Mobile Assets</td>
      <td>demand-downloaded system components like fonts, dictionaries, linguistic data; stored in /System/Library/Assets; launchd services: com.apple.languageassetd (language-dependent assets), com.apple.mobileassetd; server: mesu.apple.com</td>
    </tr>
    <tr>
      <td>Mobile Device</td>
      <td>connectivity to iOS devices over USB or WiFi (AirTrafficHost) for syning, development, and debugging; MobileDevice.framework; launchd service: com.apple.usbmuxd; Bonjour service: _apple-mobdev2._tcp</td>
    </tr>
    <tr>
      <td>MOC</td>
      <td>Managed Object Context; Core Data object space</td>
    </tr>
    <tr>
      <td>Mondrian</td>
      <td>photo collage arrangement in Photos.app; Mondrian.framework</td>
    </tr>
    <tr>
      <td>MRT</td>
      <td>Malware Removal Tool; /Library/Apple/System/Library/CoreServices/MRT.app</td>
    </tr>
    <tr>
      <td>Multipeer Connectivity</td>
      <td>ad-hoc networking; Bonjour for discovery; WiFi, AWDL, Bluetooth, or Ethernet as transport; optional encryption and certificate-based authentication; MultipeerConnectivity.framework</td>
    </tr>
    <tr>
      <td>Nano</td>
      <td>prefix for watchOS</td>
    </tr>
    <tr>
      <td>Nearby Interaction</td>
      <td>proximity-based interaction between devices; proximity measured using ultra wideband or derived from other technologies; used for Universal Control; NearbyInteraction.framework, Proximity.framework; launchd service: com.apple.nearbyd</td>
    </tr>
    <tr>
      <td>Newton</td>
      <td>fall detection on watchOS</td>
    </tr>
    <tr>
      <td>NLP</td>
      <td>Natural Language Processing; NLP.framework; related to mecabra libraries, a linguistic engine for Chinese and Japanese; /usr/share/mecabra, /usr/share/tokenizer</td>
    </tr>
    <tr>
      <td>Notarization</td>
      <td>app security scan by Apple; cryptographic proof stapled to code signature, tested at launch by System Policy; for non-notarized apps sends code hash to Apple; command line tools: notarytool, altool, stapler</td>
    </tr>
    <tr>
      <td>Noticeboard</td>
      <td>User Notifications for Software Update and App Store, Noticeboard.framework; launchd services: com.apple.noticeboard.state (nbstated), com.apple.noticeboard.agent (nbagent)</td>
    </tr>
    <tr>
      <td>Notifications</td>
      <td>system notification bus, unrelated to the local/remote push notifications; launchd service: com.apple.notifyd, com.apple.kuncd (invoked by kernel through host special port 10); command line tool: notifyutil; complemented by framework-level notification system (CFNotification, NSNotification); launchd services: com.apple.distnoted.xpc.daemon, com.apple.distnoted.xpc.agent</td>
    </tr>
    <tr>
      <td>NSP</td>
      <td>Network Service Proxy; per-app VPN and proxy settings, implements Private Relay; launchd service: com.apple.networkserviceproxy</td>
    </tr>
    <tr>
      <td>OAH</td>
      <td>Rosetta; /usr/libexec/rosetta</td>
    </tr>
    <tr>
      <td>ODR</td>
      <td>On-Demand Resources; loaded from App Store; launchd service: com.apple.appstored</td>
    </tr>
    <tr>
      <td>Onboarding</td>
      <td>data protection splash screen shown by service-connected apps; /System/Library/OnBoardingBundles; OnBoardingKit.framework</td>
    </tr>
    <tr>
      <td>Open Directory</td>
      <td>directory service for user, group, and machine management; plugin-based to use different backend stores (LDAP, Active Directory), local accounts in /private/var/db/dslocal; launchd service: com.apple.opendirectoryd; command line tools: dscacheutil, dscl, dsconfigad, dsconfigldap, dseditgroup, dsenableroot, dserr, dsexport, dsimport, dsmemberutil, odutil</td>
    </tr>
    <tr>
      <td>Opus</td>
      <td>create slide shows from photos; Slideshows.framework</td>
    </tr>
    <tr>
      <td>OSA</td>
      <td>Open Scripting Architecture; scripting of applications from different fontend languages (currently AppleScript and JavaScript); backed by Apple Events; command line tools: osacompile, osadecompile, osalang, osascript, sdef, sdp</td>
    </tr>
    <tr>
      <td>OTUT</td>
      <td>One-Time Unlock Token; security mechanism to allow keybag unwrapping after updates</td>
    </tr>
    <tr>
      <td>PAC</td>
      <td>Pointer Authentication Codes; pointers signed in unused bits to prevent ROP attacks</td>
    </tr>
    <tr>
      <td>Packages</td>
      <td>unit of software installation; command line tools: pkgutil, installer, softwareupdate; launchd services: com.apple.softwareupdated, com.apple.bootinstalld, com.apple.installd, com.apple.system_installd, com.apple.uninstalld; /var/db/softwareupdate, /Library/Apple/System/Library/Receipts (system), /System/Library/Receipts (read-only), /private/var/db/receipts (App Store)</td>
    </tr>
    <tr>
      <td>Parsec</td>
      <td>Spotlight web results and searching of crowdsourced User Activity deep links; server: *.smoot.apple.com; launchd services: com.apple.parsecd, com.apple.parsec-fbf (Feedback Flush to Differential Privacy)</td>
    </tr>
    <tr>
      <td>Password Breach</td>
      <td>monitoring of Keychain passwords against a breach database; round-robin matching in fixed-size batches, local match against common leaks, remote match using hash prefix; launchd service: com.apple.Safari.passwordbreachd</td>
    </tr>
    <tr>
      <td>Pasteboard</td>
      <td>storage for cut, copy, and paste; type of content remembered as UTI; launchd service: com.apple.pboard; command line tools: pbcopy, pbpaste</td>
    </tr>
    <tr>
      <td>PCS</td>
      <td>Protected Cloud Storage; key management for separate iCloud storage compartments (PCS calls them views), each can contain FoundationDB plus bulk data stored by MMCS; see also iCDP, CKKS, Manatee; ProtectedCloudStorage.framework; /System/Library/Preferences/ProtectedCloudStorage; command line tool: pcsstatus</td>
    </tr>
    <tr>
      <td>PCSC</td>
      <td>Personal Computer Smart Card; PCSC.framework, uses CTK</td>
    </tr>
    <tr>
      <td>PDE</td>
      <td>Print Dialog Extension; old name, not a proper Extension</td>
    </tr>
    <tr>
      <td>Pegasus</td>
      <td>meaning 1: picture-in-picture video playback; Pegasus.framework (iOS), PIP.framework (macOS); meaning 2: online search query engine for visual lookup; PegasusKit.framework</td>
    </tr>
    <tr>
      <td>Pepper</td>
      <td>UI elements for Watch home screen and Chat, like Quickboard (canned replies), Animoji; PepperUICore.framework</td>
    </tr>
    <tr>
      <td>Persona</td>
      <td>separation of sub-user-identities, like when using a private and managed Apple account; PersonaKit.framework; ~/Library/Personas; /System/Library/UserManagement; command line tool: umtool</td>
    </tr>
    <tr>
      <td>PHASE</td>
      <td>Physical Audio Spatialization Engine; 3D sound rendering engine; Apple devices map audio sources (even mono and stereo) to virtual speakers in a 3D sound stage, which is simulated by the physical speakers via a head-related transfer function; PHASE.framework</td>
    </tr>
    <tr>
      <td>Piano Mover</td>
      <td>Mail Drop; bulk mail attachments transfered over PCS; not to be confused with storage for iMessage attachments, which uses a CloudKit container</td>
    </tr>
    <tr>
      <td>Plugin</td>
      <td>Extensions, XPC services bundled with apps or frameworks, discovery by Launch Services; launchd service: com.apple.pluginkit.pkd; command line tool: pluginkit</td>
    </tr>
    <tr>
      <td>PMP</td>
      <td>Port Mapping Protocol; Apple alternative to UPnP, Bonjour service: _acp-sync._tcp</td>
    </tr>
    <tr>
      <td>PowerUI</td>
      <td>battery management like smart charge and power save, learns from Duet and other data; PowerUI.framework; /var/db/PowerUI; launchd service: com.apple.PowerUIAgent</td>
    </tr>
    <tr>
      <td>Preferences</td>
      <td>storage for user-configurable settings; launchd services: com.apple.cfprefsd.xpc.daemon, com.apple.cfprefsd.xpc.agent; stored in Library/Preferences, command line tool: defaults; interaction with Synced Defaults per /System/Library/DefaultsConfigurations</td>
    </tr>
    <tr>
      <td>Private Relay</td>
      <td>two-hop onion routing with one entry and one exit node; Apple operates entry, third-party services operate exit nodes; QUIC for payload, ODoH for DNS, approximate IP geolocation via Waldo; authentication via Attestation, propagated to proxys using RSA blind signatures</td>
    </tr>
    <tr>
      <td>Proactive</td>
      <td>umbrella term for suggestions and completions based on Duet forecasting and User Activity context, also marketed as Siri features; PersonalizationPortrait.framework</td>
    </tr>
    <tr>
      <td>QoS Classes</td>
      <td>inheritable property for Activities; semantic priorities, influences scheduling parameters; initially set at user-level, priority inheritance within GCD queues and across XPC in kernel?</td>
    </tr>
    <tr>
      <td>Quagga</td>
      <td>framework for QR and barcode decoding; Quagga.framework</td>
    </tr>
    <tr>
      <td>Quick Action</td>
      <td>extension type for quick interaction with foreign content within a host app; extension points: com.apple.services, com.apple.ui-services</td>
    </tr>
    <tr>
      <td>Quick Look</td>
      <td>file preview and thumbnail generation; comand line tool: qlmanage</td>
    </tr>
    <tr>
      <td>RAOP</td>
      <td>Remote Audio Output Protocol, AirPlay; Bonjour service: _raop._tcp</td>
    </tr>
    <tr>
      <td>Rapport</td>
      <td>device pairing by proximity using Alloy, with PIN entry, or using iCloud; once paired, devices can access services; used for HomeKit, HomePod, AirPlay, Home Sharing, SideCar; Rapport.framework; launchd service: com.apple.rapportd; Bonjour service: _companion-link._tcp</td>
    </tr>
    <tr>
      <td>Recents</td>
      <td>recently used items (not files) in various applications, synced with Synced Defaults; CoreRecents.framework, /System/Library/Recents; launchd service: com.apple.recentsd</td>
    </tr>
    <tr>
      <td>Relevance Engine</td>
      <td>backend for Siri suggestions (for example of Siri Shortcuts), Widget smart stacks (also Siri watch face); consumes Duet knowledge and app-provided timelines with relevance hints; /System/Library/RelevanceEngine; launchd service: com.apple.relevanced</td>
    </tr>
    <tr>
      <td>Remote Pairing</td>
      <td>Mobile Device pairing without wired connection; RemotePairingDevice.framework; Bonjour services: _remotepairing._tcp, _remotepairing-manual-pairing._tcp</td>
    </tr>
    <tr>
      <td>RemoteXPC</td>
      <td>connection to a non-SoC-integrated SEP like Bridge; uses HTTP/2 over a network interface, Bridge connected over USB, secured using Attestation; RemoteServiceDiscovery.framework, TrustedAccessory.framework; launchd service: com.apple.remoted, com.apple.tracd; command line tool: remotectl</td>
    </tr>
    <tr>
      <td>Revisions</td>
      <td>document autosave and auto-versioning; stored in .DocumentRevisions-V100; GenerationalStorage.framework; launchd service: com.apple.revisiond</td>
    </tr>
    <tr>
      <td>Routine</td>
      <td>frequently visited locations on iOS, interacts with Duet; launchd service: com.apple.routined</td>
    </tr>
    <tr>
      <td>RTC</td>
      <td>Real-time Telemetry and Crash reporting; RTCReporting.framework; launchd service: com.apple.rtcreportingd</td>
    </tr>
    <tr>
      <td>RTKit</td>
      <td>operating system used on Apple Silicon for firmware of co-processors</td>
    </tr>
    <tr>
      <td>RunningBoard</td>
      <td>runtime management of apps, paradigm: app as service process invoked by system, check-in by frameworks, handles process assertions (frontmost app, see App Nap), memory pressure (see Jetsam) and compute resources (GPU), replacement for TAL?; launchd service: com.apple.runningboardd; /System/Library/LifecyclePolicy, /System/Library/RunningBoard</td>
    </tr>
    <tr>
      <td>SBPL</td>
      <td>Sandbox Profile Language; a TinyScheme-based embedded DSL for Seatbelt profiles</td>
    </tr>
    <tr>
      <td>SCIP</td>
      <td>System Coprocessor Integrity Protection; like KIP, but for SEP, ISP, Motion coprocessor</td>
    </tr>
    <tr>
      <td>Screen Reader</td>
      <td>VoiceOver and Braille; /System/Library/ScreenReader; ScreenReader.framework</td>
    </tr>
    <tr>
      <td>Screen Time</td>
      <td>digital wellbeing and parental controls system, uses Device Management as policy engine, self-enforced within the application by frameworks; DeviceActivity.framework, ManagedSettings.framework, FamilyControls.framework; launchd services: com.apple.ScreenTimeAgent, com.apple.dmd</td>
    </tr>
    <tr>
      <td>SDB</td>
      <td>SQL Database; CoreSDB.framework, used by iCloud communication</td>
    </tr>
    <tr>
      <td>Search Party</td>
      <td>portion of Find My service for offline devices; devices emit public part of rotating key pair via Bluetooth LE, other devices encrypt current location with this key and send to Apple, private key shared over CloudKit</td>
    </tr>
    <tr>
      <td>Seatbelt</td>
      <td>process sandbox by filtering system calls; profiles written in SBPL; /System/Library/Sandbox/Profiles, /usr/share/sandbox; default file access policy asks for TCC confirmation before access to folders with user data (like Documents) is allowed; command line tool: sandbox-exec; launchd service: com.apple.sandboxd (invoked by kernel through host special port 14 for logging)</td>
    </tr>
    <tr>
      <td>Secure Backup</td>
      <td>escrow part of CKKS; escrow key individually wrapped with passcodes of trusted devices, stored in HSM to prevent brute forcing, uses SRP so passcodes are not visible to iCloud, limited number of recovery attempts; protocol called Lakitu, uses FollowUp; launchd service: com.apple.SecureBackupDaemon (com.apple.sbd); CloudServices.framework</td>
    </tr>
    <tr>
      <td>SEP</td>
      <td>Secure Enclave Processor; dedicated ARM core for security services, runs L4/Darbat-based sepOS, inline encryption to DRAM, manages AES keys in storage DMA engine, factory-paired channels to Touch ID/Face ID hardware, Secure Element, Neural Engine; SEP can use but not read UID and GID keys; credential verification performed by hardware lockbox with retry count enforcement</td>
    </tr>
    <tr>
      <td>Seymour</td>
      <td>Apple Fitness+; workout videos integrated with Watch sensors; SeymourCore.framework</td>
    </tr>
    <tr>
      <td>Sharing</td>
      <td>umbrella term for wireless proximity services: AirDrop, Continuity, Instant Hotspot, WiFi sharing; used by loginwindow for Watch unlock; Sharing.framework; launchd service: com.apple.sharingd; also serves connection sharing and remote disk</td>
    </tr>
    <tr>
      <td>Shazam</td>
      <td>music recognition service; ShazamKit.framework; launchd service: com.apple.shazamd</td>
    </tr>
    <tr>
      <td>Shoebox</td>
      <td>Passbook</td>
    </tr>
    <tr>
      <td>Sidecar</td>
      <td>using iPhone/iPad as Mac accessory: camera for photos and scanning, annotations, external display over low-latency WiFi (llw interface) using avconferenced encoding; SidecarCore.framework; launchd services: com.apple.sidecar-display-agent (SidecarDisplayAgent), com.apple.sidecar-relay (SidecarRelay)</td>
    </tr>
    <tr>
      <td>Signpost</td>
      <td>telemetry API to report points of interest in code; launchd service: com.apple.signpost.signpost_reporter</td>
    </tr>
    <tr>
      <td>Simulator</td>
      <td>running an iOS/tvOS/watchOS personality on macOS, uses sandboxing and a separate Mach bootstrap namespace for container-like isolation, command line tool: simctl</td>
    </tr>
    <tr>
      <td>SIP</td>
      <td>System Integrity Protection or rootless mode; collection of kernel-level security restrictions regarding file system modification, unsigned Kexts, Taskport access, NVRAM access, DTrace; /System/Library/Sandbox/rootless.conf; command line tool: csrutil, rootless-init</td>
    </tr>
    <tr>
      <td>Site Association</td>
      <td>signed files in .well-known directory on websites; equivalent to Entitlements for websites, associates domains with app IDs for Universal Links; command line tool: swcutil</td>
    </tr>
    <tr>
      <td>SKP</td>
      <td>Sealed Key Protection; measurement of system state (boot chain IMG4 manifests, BPR, Boot Policy data, UID key, user passcode) to derive Keybag keys</td>
    </tr>
    <tr>
      <td>SKS</td>
      <td>Secure Key Store; handling of keybag keys within the SEP</td>
    </tr>
    <tr>
      <td>SkyLight</td>
      <td>WindowServer; SkyLight.framework</td>
    </tr>
    <tr>
      <td>Skywalk</td>
      <td>network subsystem in XNU, links together actual technologies (Bluetooth, WiFi, Thunderbolt) and interfaces/tunnels; transacts in nexus (for conduits) and agent (for endpoints) objects; DriverKit network drivers use Skywalk; command line tool: skywalkctl</td>
    </tr>
    <tr>
      <td>SLC</td>
      <td>System-Level Cache, architectural feature of Apple Silicon; cache located within SoC at controllers for external DRAM, serves all compute units and stages transfers between them</td>
    </tr>
    <tr>
      <td>Social Gaming</td>
      <td>Game Center; multiplayer gaming services on top of CloudKit, shared storage and low-latency multicast for multiplayer sessions; launchd service: com.apple.gamed</td>
    </tr>
    <tr>
      <td>Sock Puppet</td>
      <td>Watch interaction that requires Companion device</td>
    </tr>
    <tr>
      <td>SOS</td>
      <td>Secure Object Sync; syncing backend for iCloud Keychain, not to be confused with the emergency call feature; transferred items previously staged in Synced Defaults, for two-factor accounts in CKKS; launchd services: com.apple.secd (access to local keychain), com.apple.security.cloudkeychainproxy3 (connects to Synced Defaults), com.apple.security.keychain-circle-notification</td>
    </tr>
    <tr>
      <td>SPI</td>
      <td>System Private Interface; /System/Library/PrivateFrameworks</td>
    </tr>
    <tr>
      <td>SpringBoard</td>
      <td>iOS home screen; like Dock (Launchpad, Mission Control, desktop picture), Control Center, SystemUIServer (menu extras icons), loginwindow (lock screen), and WindowServer (compositor) on macOS; /System/Library/CoreServices/SpringBoard.app, /Applications/PreBoard.app, BaseBoard.framework, FrontBoard.framework, SplashBoard.framework; launchd service: com.apple.backboardd (compositor)</td>
    </tr>
    <tr>
      <td>SPRR</td>
      <td>Shadow Permission Remap Register? feature of Apple Silicon to dynamically reintepret page permissions</td>
    </tr>
    <tr>
      <td>SRP</td>
      <td>Secure Remote Password; standard cryptographic protocol for proving knowledge of a secret such that attackers cannot brute-force the secret; AppleSRP.framework</td>
    </tr>
    <tr>
      <td>SSO</td>
      <td>Single Sign-On</td>
    </tr>
    <tr>
      <td>SSV</td>
      <td>Signed System Volume, als called Authenticated Root Volume (ARV); macOS boots from blessed read-only APFS snapshot, merkle-tree and root-hash stored in Preboot volume; modifications require disabling root authentication with csrutil from recovery, then the live filesystem can be mounted, modified, and re-blessed; command line tools: apfs_systemsnapshot, bless, csrutil</td>
    </tr>
    <tr>
      <td>Stark</td>
      <td>CarPlay</td>
    </tr>
    <tr>
      <td>Stockholm</td>
      <td>Secure Element in Apple SoCs, a processor running crypto protocols on keys it protects; used for Apple Pay and Car Key; related codenames: Icefall, Warsaw</td>
    </tr>
    <tr>
      <td>Storage Management</td>
      <td>freeing up disk space by managing bulky items; UI in System Information.app; StorageManagement.framework; launchd service: com.apple.diskspaced; extension point: com.apple.storagemanagement; extends Cache Delete service</td>
    </tr>
    <tr>
      <td>Suggestions</td>
      <td>semantic analysis of mails and websites to suggest contacts, calendar events and the like; launchd services: com.apple.suggestd, com.apple.reversetemplated; custom JavaScript parsers in /System/Library/AssetsV2/com_apple_MobileAsset_CoreSuggestions</td>
    </tr>
    <tr>
      <td>Symbols</td>
      <td>debug symbols for backtraces; CoreSymbolication.framework; launchd services: com.apple.coresymbolicationd; command line tools: atos, symbols, symbolscache</td>
    </tr>
    <tr>
      <td>Symptoms</td>
      <td>network diagnostics; Symptoms.framework; /var/networkd/db/netusage.sqlite; launchd service: com.apple.symptomsd (invoked by kernel through host special port 27)</td>
    </tr>
    <tr>
      <td>Synced Defaults</td>
      <td>simple key-value store for applications, no user control over data; can use iCloud key-value backend (old) or Manatee container (new, marked as com.apple.kvs) as storage; launchd service: com.apple.syncdefaultsd; locally stored in ~/Library/SyncedPreferences</td>
    </tr>
    <tr>
      <td>System Configuration</td>
      <td>SystemConfiguration.framework; launchd service: com.apple.configd; command line tool: scutil</td>
    </tr>
    <tr>
      <td>System Extension</td>
      <td>user-level components formerly in the kernel; currently either a DriverKit, Network, or Endpoint Security extension; /System/DriverKit, /System/Library/DriverExtensions; command line tool: systemextensionsctl; launchd services: com.apple.sysextd, com.apple.nesessionmanager, com.apple.endpointsecurity.endpointsecurityd</td>
    </tr>
    <tr>
      <td>System Policy</td>
      <td>Gatekeeper; policy engine for application launches and kext loading, malware signatures from /Library/Apple/System/Library/CoreServices/XProtect.bundle; /var/db/SystemPolicy; launchd service: com.apple.security.syspolicy (invoked by kernel through host special port 29); command line tool: spctl</td>
    </tr>
    <tr>
      <td>TAL</td>
      <td>Transparent App Lifecycle; process for macOS apps started and stopped independently of the user launching and quitting app; also handles session restore across reboots; ~/Library/Saved Application State; launchd service: com.apple.talagent</td>
    </tr>
    <tr>
      <td>Taskport</td>
      <td>Mach kernel concept for ptrace-like access to task internals; access policy implemented by daemon; launchd service: com.apple.taskgated (invoked by kernel through task special port 9); command line tool: DevToolsSecurity</td>
    </tr>
    <tr>
      <td>TCC</td>
      <td>Transparency, Consent, and Control; user control over app access to privacy-related services (kTCCService*); TCC.framework; launchd services: com.apple.tccd, com.apple.tccd.system; command line tool: tccutil; stored in /Library/Application Support/com.apple.TCC, ~/Library/Application Support/com.apple.TCC, /var/db/locationd (for kTCCServiceLocation)</td>
    </tr>
    <tr>
      <td>Time Machine</td>
      <td>automatic backup service, command line tools: tmdiagnose, tmutil</td>
    </tr>
    <tr>
      <td>Tin Can</td>
      <td>Walkie Talkie on watchOS</td>
    </tr>
    <tr>
      <td>Tones</td>
      <td>ringtones; ToneLibrary.framework</td>
    </tr>
    <tr>
      <td>Translocation</td>
      <td>app binary copied on launch to dedicated location; initiated by Launch Services for security (prevents path traversal for apps quarantined by System Policy) or path normalization (iOS apps do not expect to be moved, but can be moved on macOS)</td>
    </tr>
    <tr>
      <td>Transparency</td>
      <td>key transparency for ESS keys? Transparency.framework; launchd service: com.apple.transparencyd; server: init-kt.apple.com</td>
    </tr>
    <tr>
      <td>TSS</td>
      <td>Tatsu Signing Server; online verification for firmware signatures; server: gs.apple.com</td>
    </tr>
    <tr>
      <td>TTS</td>
      <td>Text To Speech, command line tool: say; /System/Library/Speech; synthesizer engines: MacinTalk (historic), Polyglot (phoneme-based?), Gryphon (current, DNN-based?)</td>
    </tr>
    <tr>
      <td>TVML</td>
      <td>TV Markup Language; declarative UI language for TV apps; TVMLKit.framework</td>
    </tr>
    <tr>
      <td>Ubiquity</td>
      <td>iCloud Drive; codename Bladerunner, uses CloudKit; CloudDocs.framework; launchd service: com.apple.bird; locally stored in ~/Library/Mobile Documents (was supposed to move to Library/CloudStorage/iCloud Drive but this was reverted)</td>
    </tr>
    <tr>
      <td>UID</td>
      <td>unique ID key, used as root key for cryptographic subsystems, generated during manufacturing by SEP and fused into hardware, only accessible by SEP</td>
    </tr>
    <tr>
      <td>Unified Logging</td>
      <td>system-wide logging and Activity tracking; launchd service: com.apple.logd, com.apple.diagnosticd; command line tool: log; /dev/oslog; data stored in /var/db/diagnostics, support files in /var/db/uuidtext</td>
    </tr>
    <tr>
      <td>User Activity</td>
      <td>abstraction for deep-linking into apps with structured context (people, places); used for Universal Links (schema.org on websites), Handoff, Parsec (app links in search), Siri Shortcuts, Quick Note (context awareness), Proactive; UserActivity.framework; launchd service: com.apple.coreservices.useractivityd</td>
    </tr>
    <tr>
      <td>User Notifications</td>
      <td>user interface for notification center; launchd service: com.apple.usernoted</td>
    </tr>
    <tr>
      <td>UTI</td>
      <td>Uniform Type Identifiers; system for document types; file extensions and MIME types are mapped to UTIs, UTIs form a conformance graph, apps register their UTIs with Launch Services; /System/Library/CoreServices/CoreTypes.bundle; also Apple’s hardware devices are represented as UTIs</td>
    </tr>
    <tr>
      <td>VA</td>
      <td>Video Acceleration; AppleGVA.framework, AppleVA.framework, AppleVPA.framework</td>
    </tr>
    <tr>
      <td>Viceroy</td>
      <td>video conferencing used by FaceTime and ReplayKit; ViceroyTrace.framework</td>
    </tr>
    <tr>
      <td>VSDB</td>
      <td>volume status database; /var/db/volinfo.database; command line tool: vsdbutil</td>
    </tr>
    <tr>
      <td>Waldo</td>
      <td>selects edge servers based on approximate location, part of Private Relay, seen in NSP</td>
    </tr>
    <tr>
      <td>WFS</td>
      <td>WebDAV File Sharing; built-in file sharing with Apache; /etc/wfs; command line tool: wfsctl</td>
    </tr>
    <tr>
      <td>Widgets</td>
      <td>content excerpt from apps; provided via a timeline of view hierarchies, configuration uses Intents, technically very similar to complications on watch face; extension point: com.apple.widgetkit-extension</td>
    </tr>
    <tr>
      <td>Willow</td>
      <td>HomeKit; end-to-end-encrypted communication protocol and API for IoT-accessories; pairing with SRP using code printed on device, credential sync by CKKS, transported over Alloy, remote access using Apple TV as proxy; launchd service: com.apple.homed</td>
    </tr>
    <tr>
      <td>Workflow</td>
      <td>Shortcuts; user-programmable system-wide automation, built-in triggers cause a chain of actions to run; actions are synthesized from User Activities and Intents provided by apps; WorkflowKit.framework, ActionKit.framework; locally stored in ~/Library/Shortcuts; launchd service: com.apple.siriactionsd (voice-triggered shortcuts); command line tool: shortcuts</td>
    </tr>
    <tr>
      <td>xART</td>
      <td>eXtended Anti-Replay Technology; persistent storage for SEP, used by Mesa; /System/Volumes/xarts; launchd service: com.apple.xartstorageremoted; command line tool: xartutil</td>
    </tr>
    <tr>
      <td>XCS</td>
      <td>Xcode Server; continuous integration server; command line tools: xcscontrol, xcsdiagnose</td>
    </tr>
  </tbody>
</table>

AppleInternals.md

Term	Description
1TR	One True Recovery; booting into macOS recovery on Apple Silicon by holding the power button to verify physical presence; enables interaction with SEP to change Boot Policy
AA	Apple account
AA	Apple Archive, see also Apple Encrypted Archive; command line tools: aa, aea, compression_tool
AAC	Automatic Assessment Configuration; AutomaticAssessmentConfiguration.framework; puts device in a locked mode for exam-style test applications
AAT	Apple Advanced Typography; font format and rendering engine
Accounts	launchd service: com.apple.accountsd; /System/Library/Accounts
ACDE	Apple Connect Device External? ACDEClient.framework, old two-step verification, derived from a company-internal AppleConnect system? server: appleconnect.apple.com
ACFS	Apple Clustered File System; deprecated file system for Xsan; acfs.framework
Acoustic ID	Siri feature to recognize songs
Activation	cryptographic check-in with iCloud to lock devices reported by the user as lost; verified by iBoot; MobileActivationMacOS.framework; launchd service: com.apple.mobileactivationd; servers: humb.apple.com, albert.apple.com
Activity	jobs, coarse-grained work units of applications; tracked by the system across XPC, bears a QoS class for scheduling; low-level mechanism not to be confused with User Activity
AE	Apple Events; messaging system to invoke application functionality; CoreServices.framework/AE.framework; launchd services: com.apple.coreservices.appleevents, com.apple.AEServer (AE over network)
AGC	Apple Graphics Control, management of multiple displays and display port connections; launchd service: com.apple.displaypolicyd
AIR	Apple Intermediate Representation; synthetic bytecode architecture target for GPU binary toolchain
ALF	Application-Level Firewall, launchd service: com.apple.alf (socketfilterfw)
Alloy	substrate for communication between user devices over Bluetooth and devices to iCloud, implemented over IDS; /System/Library/IdentityServices/ServiceDefinitions; launchd service: com.apple.identityservicesd
ALS	Ambient Light Sensor, AmbientDisplay.framework
Amber	Swift UI; SwiftUI.framework
AMFI	Apple Mobile File Integrity, checks code integrity based on code signature, stronger enforcement with hardened runtime, validates entitlement restrictions; launchd service: com.apple.MobileFileIntegrity (amfid, invoked by kernel through host special port 18); disabled by setting amfi_get_out_of_my_way=0x1 in boot-args
AMP	Apple Media Protocol? former parts of iTunes for iPod and iOS device access in Finder, Home Sharing; AMPDevices.framework, AMPSharing.framework; launchd services: com.apple.AMPDeviceDiscoveryAgent, com.apple.AMPDevicesAgent, com.apple.amp.mediasharingd
AMP	Asynchronous Multiprocessing; performance and power-efficiency cores on Apple Silicon
AMS	Apple Media Services; formerly the iTunes stores and media services: App Stores, Apple Music, Apple TV, iCloud media library, Apple Podcasts, Podcast sync, Books Store, Books sync; AppleMediaServices.framework; server: phobos.apple.com
AMX	Apple Matrix Extension; ARM instruction set extension for matrix operations
ANE	Apple Neural Engine, hardware accelerator for neural network operations; ANECompiler.framework, ANEServices.framework; launchd service: com.apple.aned
Anisette	two-factor authentication creates security codes on trusted devices using TOTP, probably using Circle keys, checked by HSA; AuthKit.framework; launchd service: com.apple.akd
AOP	Always On Processor, part of Apple SoCs, runs RTKit as operating system
AOS	Apple Online Services? historical name for iCloud
Apache	built-in web server; command line tool: apachectl
APFS	Apple File System; copy-on-write file system with support for volume space-sharing, per-file encryption, and snapshots
APNS	Apple Push Notification service, server infrastructure for remote push notifications over a single connection, clients subscribe to push topics, can be authenticated by app (remote notifications), device (Find My …), or Apple ID login (DSID); credentials in apsd keychain; launchd service: com.apple.apsd; server: push.apple.com
App Nap	quiescence detection for applications and corresponding self-demotion in scheduler parameters, implemented within application frameworks and RunningBoard, listens for occlusion notifications from WindowServer
App Sandbox	Seatbelt-based sandbox for apps; /System/Library/Sandbox/Profiles/application.sb; enabled with com.apple.security.app-sandbox entitlement; launchd service: com.apple.secinitd
AppleCare	extended warranty; NewDeviceOutreach.framework; launchd service: com.apple.ndoagent
APT	Adaptive Picture Timing? ProMotion; dynamic screen updates with 120Hz base frequency; AppleDisplayTCONControl.framework
ASL	Apple System Logger, superseded by Unified Logging; /etc/asl; stored in /var/log/asl; launchd service: com.apple.syslogd; command line tool: syslog
ASR	Apple Software Restore; restore entire volumes from sources like disk images (HDI, SIU), also restores based on APFS snapshots and snapshot deltas; command line tool: asr
Assertions	power state management allowing applications to prevent sleeping; launchd service: com.apple.powerd; command line tools: caffeinate, pmset
Assessment	checking of System Policy; term also used for AAC
Asset Cache	discretionary caching server for Mobile Assets, Packages, iOS updates, App Store content, ODR, MMCS data; launchd services: com.apple.AssetCache.builtin, com.apple.AssetCacheLocatorService, com.apple.AssetCacheManagerService, com.apple.AssetCacheTetheratorService; command line tools: AssetCacheLocatorUtil, AssetCacheManagerUtil, AssetCacheTetheratorUtil
Assistant	Siri; dictation and semantic understanding, Intent is communicated to and enacted on the client, uses TTS for output, Snippets to embed mini UIs into responses; /System/Library/Assistant, /System/Library/Snippets, AssistantServices.framework; server: *.siri.apple.com
ATS	App Transport Security, sandbox mechanism only allowing TLS-secured connections
ATSUI	Apple Type Services for Unicode Imaging; rendering engine superseded by CoreText.framework, font management; ApplicationServices.framework/ATS.framework; launchd service: com.apple.xtyped (fontd); command line tools: atsutil
ATT	App Tracking Transparency; apps declare user tracking on app store
Attestation	cryptographic proof of a genuine SEP; used for web authentication and app attestation; DeviceCheck.framework; SEP responds to challenge using hardware-key (GID, PKA), online service verifies; used to pair Touch ID keyboards, used to pair RemoteXPC channel?
Authorization	discretionary access control policies for high-level services; similar to PAM; policy stored in /var/db/auth.db
Avatar	Memoji and Animoji (face tracking); AvatarKit.framework
AVB	Audio Video Bridging, low-latency audio over Ethernet; launchd service: com.apple.avbdeviced; command line tool: avbdiagnose, avbutil
AWD	Apple Wireless Diagnostics, sends system telemetry to Apple; CoreAnalytics.framework, WirelessDiagnostics.framework; launchd services: com.apple.awdd, com.apple.analyticsd
AWDL	Apple Wireless Direct Link; secondary WiFi interface that runs in parallel to an active WiFi access point connection, similar to WiFi Direct (p2p interface), uses a randomized MAC, used for peer-to-peer networking: AirDrop, AirPlay; DeviceToDeviceManager.framework
Bezel	on-screen overlays for hardware volume buttons, screen brightness, Bluetooth HID, and others; /Library/Application Support/Apple/BezelServices, launchd services: com.apple.loginwindow, com.apple.OSDUIHelper
Biome	CloudKit-based datastream and sync engine; BiomeStreams.framework, BiomeSync.framework; launchd services: com.apple.BiomeAgent, com.apple.biomesyncd
Blast Door	sandboxed sanitization process for untrusted iMessage input; BlastDoor.framework
BOM	Bill of Materials; format to store contents of installer Packages; command line tool: lsbom
Bonjour	mDNS; launchd service: com.apple.mDNSResponder.reloaded; command line tool: dns-sd
Boot Cache	disk cache pre-heating at boot time with typically loaded applications; /var/db/BootCaches; launchd service: com.apple.warmd
Boot Policy	decides by signature check which OSes can be booted, boot-time equivalent for System Policy; LocalPolicy stores user settings, configurable from 1TR, stored by SEP, enforced by iBoot; command line tools: bputil, kmutil (to enroll custom kernels)
BPR	Boot Progress Register; set-only flags to track boot mode (normal, DFU, recovery), part of Keybag class key derivation within SEP, so passcode-protected keys are inaccessible in DFU and recovery
Bridge	T2 ARM CPU in Intel Macs to drive Touch Bar and Boot Policy; runs bridgeOS, a derivative of watchOS; boots the platform and the Intel CPU, communication from macOS uses RemoteXPC; launchd service: com.apple.multiversed; /System/Library/MultiversePlugins
Brook	hand washing encouragement on watch; BrookServices.framework
Bulletin Board	application push notification management, aggregates local and remote push notifications; BulletinBoard.framework
Cache Delete	cleanup for various caches; /System/Library/CacheDelete; launchd service: com.apple.cache_delete (deleted)
CAML	Core Animation Markup Language; XML file format for layers, shapes and animations
Carousel	derivative of SpringBoard for Watch home screen, watch face, and notification center
Celestial	media streaming used by ReplayKit for game broadcasts; Celestial.framework
Certificates	validity checked using CRLs, OCSP stapling, and transparency logs; /System/Library/Security/Certificates.bundle; launchd services: com.apple.trustd, com.apple.trustd.agent, com.apple.ocspd; command line tool: crlrefresh
CHIP	Connected Home over IP; Matter; integrated into HomeKit; CHIP.framework
Circle	cryptographic primitive to exchange public keys of trusted devices of a user, signed by Circle peers; iCloud identity added as additional Circle peer, private key synced across all trusted devices, new devices can pull this key from Secure Backup to join the Circle; per-device Circles stored in CKKS for two-factor accounts (Octagon); KeychainCircle.framework; command line tools: tpctl, otctl (Octagon)
CKKS	CloudKit Key Sync, end-to-end secure syncing for credentials, seeded by Circle; currently includes ApplePay, AutoUnlock, CreditCards, DevicePairing, Engram, Health, Home, Manatee, SOS, WiFi and other keys; launchd service: com.apple.secd; command line tool: ckksctl
Classroom	school teachers can create assignments for student iPads and track progress in Schoolwork app; ClassKit.framework; launchd service: com.apple.studentd
Cloud Pairing	part of Alloy, Bluetooth out-of-band pairing over iCloud for Continuity; launchd service: com.apple.BTServer.cloudpairing (cloudpaird)
CMAS	Commerial Mobile Alert System, now known as Wireless Emergency Alerts (WEA)
Commpage	user-mapped kernel data, like vdso/vsyscall on Linux; mapped at 0x7fffffe00000
Communications Filter	recipient blocking for iMessage, FaceTime, Mail; launchd service: com.apple.cmfsyncagent
Companion	iPhone that is paired with Watch; communication uses Alloy over IPsec over Bluetooth
Continuity	umbrella term for Handoff, Sidecar, SMS relay, Universal Clipboard, Watch unlock, WiFi call relay and others; SMS relay works by proxying to iMessage, other services use Alloy
Control Center	icons in menu/status bar and Bento Box controls UI, gradually replaces SystemUIServer on macOS; handles incoming AirPlay content; launchd services: com.apple.controlcenter, com.apple.SystemUIServer.agent
CPML	CorePrediction Machine Learning; CPMLBestShim.framework
CRD	Conference Room Display; Apple TV mode
CTK	Crypto Token Kit; smart card management, also for the Secure Element on iOS? launchd service: com.apple.ctkd; command line tool: sc_auth
CTS	Centralized Task Scheduling; execution of DAS tasks; /System/Library/UserEventPlugins/com.apple.cts.plugin
CVMS	Core VM Server/Service? compilation of GPU shaders; launchd service: com.apple.cvmsServ
DAAP	Digital Audio Access Protocol; used by Home Sharing (with Rapport token) and by the Remote app to control Apple TV (with pairing token); payload unencrypted; DAAPKit.framework; Bonjour services: _atc._tcp, _home-sharing._tcp, _mediaremotetv._tcp, _touch-able._tcp
Daily Briefing	Siri giving an overview of information for the day; SiriDailyBriefingInternal.framework
DART	DMA Address Relocation Table; IOMMU implementation in Apple silicon, positioned in front of every DMA-capable co-processor and peripheral, offers sub-page protection; SART: streaming variant for high-throughput devices (like NVMe)
DAS	Duet Activity Scheduler; scheduling policy engine behind NSBackgroundActivityScheduler and XPC activities; /System/Library/DuetActivityScheduler; launchd service: com.apple.dasd
Data Detectors	text analysis to highlight phone numbers, street addresses, and the like; DataDetectors.framework
Data Vault	directories with the UF_DATAVAULT special flag; CSR limits access to one application
DAV	Distributed Authoring and Versioning; network protocol on top of HTTP for syncing calendars (CalDAV), contacts (CardDAV), and formerly also bookmarks (BookmarkDAV)
DCP	Display Co-Processor
DEP	Device Enrollment Program; devices check in with Apple during Setup Assistant to query for their enrollment status, retrieve MDM server URL to fetch initial configuration profile
DFR	Dynamic Function Row?, TouchBar; /System/Library/CoreServices/ControlStrip.app; DFRFoundation.framework
DFU	Device Firmware Update; special boot mode where iOS has not booted and the system can be installed over the Lightning connection
Differential Privacy	crowdsourcing without user tracking; privacy budget for management of anonymity set; used for keyboard words, emoji, Spotlight searches, Parsec deep links, HealthKit usage, Safari telemetry; /System/Library/DifferentialPrivacy; stored in /var/db/DifferentialPrivacy; launchd service: com.apple.dprivacyd
DND	Do Not Disturb
DSID	Destination Signaling Identifier, unique ID for IDS login on a specific device
DTrace	system-wide tracing infrastructure, command line tools: dtrace, *.d, dappprof, dapptrace, dtruss, errinfo, execsnoop, fddist, fs_usage, imptrace, iopattern, iopending, iosnoop, iotop, lastwords, latency, opensnoop, plockstat, rwsnoop, sampleproc, sc_usage, topsyscall, topsysproc
Duet	telemetry collection engine for system and user events, forecasting by machine learning, backend for DAS, Proactive, Relevance, Screen Time, thermal and battery management; /System/Library/DuetKnowledgeBase; CoreDuet.framework, CoreKnowledge.framework, CorePrediction.framework; launchd services: com.apple.coreduetd, com.apple.knowledge-agent
Dyld Shared Cache	dynamic linker cache, stores all system libraries in prelinked form, original library files are removed; /System/Library/dyld; command line tool: update_dyld_shared_cache
EAS	Exchange Active Sync; network protocol for accessing Microsoft Exchange servers
EDR	Extended Dynamic Range; rendering with transfer function extending beyond sRGB white; implemented natively on XDR displays and by backlight modulation on others; HDRProcessing.framework
Energy Impact	unitless metric for per-application energy consumption, machine-specific coefficients; /usr/share/pmenergy, /usr/share/kpep; launchd services: com.apple.sysmond, com.apple.thermald; command line tool: powermetrics
Engram	Messages in iCloud; devices store received iMessages in CloudKit; Engram.framework
Entitlements	capability-like attributes bound to executables by code signing; some entitlements like App Sandbox restrict ambient authority, some gradually relieve those restrictions (using Seatbelt), some services or system calls grant privilege based on caller entitlements
ESS	IDS user directory, public key distribution for iMessage and CloudKit sharing, uses Transparency; server: *.ess.apple.com; launchd service: com.apple.identityservicesd
Event Monitor	simple rules engine for running commands on various systen events; apparently not used by default; /etc/emond.d, /var/db/emondClients; launchd service: com.apple.emond
FaceTime	video calls, employs the ICE (establishing peer-to-peer connection), STUN (session credential exchange) and SRTP (encrypted media streaming) protocols; FTServices.framework; launchd services: com.apple.videoconference.camera (avconferenced)
FairPlay	DRM system used by app and media stores; CoreADI.framework, CoreFP.framework, CoreLSKD.framework; launchd services: com.apple.adid, com.apple.fairplayd (invoked by kernel through host special port 17), com.apple.lskdd; credentials stored in /var/db/fpsd
Family Circle	Family Sharing; launchd services: com.apple.familycircled, com.apple.askpermissiond
FDE	Full Disk Encryption, FileVault; command line tool: fdesetup, sysadminctl
FDR	Factory Data/Device Reset? ensures that no downgrades are performed? servers: skl.apple.com, gg.apple.com; /System/Library/FDR
Feldspar	Apple News; Silex.framework
FiDES	Fi? Distributed Evaluation Service? aggregates Differential Privacy data for unlinkability? maybe private federated learning? used for emoji, Suggestions, Dictation; /System/Library/DistributedEvaluation; DistributedEvaluation.framework; server: fides-pol.apple.com
File Provider	infrastructure and extension system for syncing with cloud providers; placeholder files based on SF_DATALESS attribute in APFS; FileProvider.framework; locally stored in ~/Library/CloudStorage; command line tool: fileproviderctl
Find My …	location sharing by explicitly querying devices remotely or collateral beacon detection using Search Party; FMCore.framework, FMF.framework; launchd service: com.apple.icloud.fmfd (find my friends)
Firmlink	bi-directional non-symbolic link between the read-only system volume and the data volume, additional symlinks and mountpoints in the root directory are virtually allocated; /usr/share/firmlinks, /etc/synthetic.conf
Focus	restriction modes for notification presentation; Focus.framework, DoNotDisturb.framework; local settings in ~/Library/DoNotDisturb
FollowUp	user interaction for Secure Backup wrapping with device passcode, CoreFollowUp.framework; launchd service: com.apple.followupd
FoundationDB	fundamental iCloud storage database, marketed as CloudKit, separated into containers; records, blobs, and large asset storage with MMCS, server-side continuous queries can trigger push notifications, user management by IDS, sharing between users; PCS keys used for hierarchical zone, record, and asset encryption; CloudKitDaemon.framework; launchd service: com.apple.cloudd; locally stored in ~/Library/Caches/CloudKit, ~/Library/Containers/*/Data/CloudKit; command line tool: cktool
FPR	Fast Permission Restrictions; Apple CPU registers to downgrade (old APRRs do bitmasking) or remap (SPRRs since M1) actual permissions of memory pages (the CTRR region) per thread; used for JIT protection and by AMFI to freeze user code after checking
FUD	Firmware Update Daemon; /var/db/fud; launchd service: com.apple.accessoryupdaterd
GID	group ID key, shared across all devices of the same SoC generation, derived keys are used to prove device type over the network, only accessible by SEP
Gizmo	Apple Watch; watch settings managed by Companion; /Applications/Bridge.app, /System/Library/BridgeManifests
Group Activities	SharePlay; sharing of media content and programmatic state over FaceTime calls; GroupActivities.framework, CopresenceCore.framework; launchd service: com.apple.telephonyutilities.callservicesd
GSS	Generic Security Service; part of Kerberos; GSS.framework; launchd service: com.apple.gssd (invoked by kernel through host special port 19); command line tool: gsstool
GXF	Guarded Execution Feature/Fault, additional exception levels on Apple Silicon, lateral to the usual exception levels; page tables remain the same, but interpretation of permission bits changes by way of FPR, genter and gexit instructions; implements lightweight intra-address-space protection contexts
HAP	Home Automation Protocol; CoreHAP.framework
HDA	High Definition Audio; HDAInterface.framework
HDI	Hard Disk Image; command line tool: hdiutil
HeadBoard	derivative of SpringBoard for tvOS home screen; /Applications/HeadBoard.app, /Applications/PineBoard.app
HLS	HTTP Live Streaming
HSA	Hardware Security Architecture; version 1 used for two-step verification, SOS with iCSC; version 2 for two-factor authentication, CKKS and Secure Backup with iCDP
HSM	Hardware Security Module; HSM fleet runs escrow service for Secure Backup; public keys for authenticating the HSM services in /System/Library/Security/Certificates.bundle/Contents/Resources/AppleESCertificates.plist
Hyperion	iCloud Photos, uses CloudKit; launchd service: com.apple.cloudphotod; command line tool: cpldiagnose
IAP	iPod Accessory Protocol; IAP.framework
iBoot	boot loader stage after boot ROM or UEFI (macOS on Intel); intermediate Low-Level Bootloader (LLB); DFU mode is implemented here; /System/Library/CoreServices/boot.efi
iCDP	iCloud Data Protection, codename for a set of enhancements to iCloud privacy: device passcodes used as iCSC for Secure Backup, root keys for CKKS-enabled services only synced between devices and not stored at Apple; launchd service: com.apple.cdpd
iCloud	umbrella term for a conglomerate of services, consists of FoundationDB containers with PCS views for key management, supported by CKKS; uses IDS and APNS; some services under the iCloud name are actually served by AMS, IMAP, or DAV
iCSC	iCloud Security Code, credential wrapping for Secure Backup, previously used a separate code, with HSA2/iCDP uses device passcodes
IDAM	Inter-Device Audio and MIDI; audio connection between devices
IDS	Identity Service, also IDMS, Apple ID identity management for all of Apple’s online services; APNS topics for signaling and messaging, see also Alloy, ESS, FaceTime, iMessage; authentication to services with Kerberos
IDV	Identity Verification? Touch ID and Face ID; /System/Library/AccessibilityBundles/CoreIDVUI.axbundle
IM	Instant Messaging; usually means iMessage and FaceTime
IMG4	boot files (Mach-O binaries or configuration data) with ASN.1 signature, contains RemotePolicy certificate constraints to restrict Boot Policy evaluation
Intent	use-case-driven interaction with 3rd-party apps from a host app; used for Siri, Maps, Widgets (configuration); extension points: com.apple.intents-service, com.apple.intents-ui-service
IOKit	device driver subsystem for in-kernel and DriverKit drivers, command line tool: ioreg
Ironwood	dictation, customized on server with selected user data (contacts, app names, music titles, HomeKit names, Siri Shortcut phrases), not tied to Apple ID; SpeechRecognitionCore.framework; server: guzzoni.apple.com
ISP	Image Signal Processor; camera imaging circuit in iPhones
ITML	iTunes Markup Language; metdata tagging for media services; ITMLKit.framework
ITP	Intelligent Tracking Prevention, cross-site tracking defenses in Safari, statistics and user interaction classify sites, cookies are partitioned and access is restricted
JARVIS	Just A Rather Very Intelligent Scheduler, Mesos cluster manager for Siri, iCloud, AMS
Jellyfish	Animoji
Jetsam	reclaiming of purgeable memory and termination of apps during memory pressure
JSC	JavaScript Core; JavaScriptCore.framework; command line tool: jsc
Kalamata	codename for the transition from x86 to ARM-based Apple Silicon
Kerberos	single-sign-on mechanism; Heimdal.framework; command line tools: kinit, ktutil
Kext	kernel extension mechanism, loaded at boot time as part of a Kext Collection; /Library/Extensions, /Library/StagedExtensions (for user approval), /System/Library/Extensions; command line tool: kextutil (manages deprecated runtime loading)
Kext Collection	prelinked sets of kernel extensions; /System/Library/KernelCollections (for boot and system kexts), /Library/KernelCollections (for auxiliary third-party kexts); the latter is only loaded at a lower-security Boot Policy; launchd service: com.apple.kernelmanagerd (invoked by kernel through host special port 15); command line tool: kmutil
Keybag	storage of protection class keys for Keychain and filesystem, protected by SEP using SKP; stored in user.kb; launchd services: com.apple.mobile.keybagd, com.apple.securityd_service, com.apple.secd
Keychain	storage for credentials; launchd service: com.apple.securityd; command line tools: certtool, security, systemkeychain
KIP	Kernel Integrity Protection, locking of physical memory pages to prevent changes to kernel
Launch Services	management for application launches, association of UTIs to apps, uses Spotlight to update cached info; launchd services: com.apple.coreservices.launchservicesd, com.apple.lsd; CoreServices.framework/LaunchServices.framework; command line tools: lsappinfo, lsregister
Liverpool	PCS codename for CloudKit
LKDC	Local Key Distribution Center, Kerberos on client machines
LSM	Latent Semantic Mapping, text analysis, used for spam filtering, command line tool: lsm
Mac Buddy	historic name for Setup Assistant
MAC Policy	Mandatory Access Control subsystem in XNU, based on TrustedBSD, implements policy hooks for restricted kernel operations; current policies: AMFI, Seatbelt, Quarantine, CSR
Machine Learning	Vision.framework, Espresso.framework, Futhark.framework, PhotoAnalysis.framework; used for Live Text and Visual Lookup; launchd service: com.apple.mediaanalysisd
Madrid	iMessage; /System/Library/Messages
Manatee	PCS key for some CloudKit containers are synced via CKKS, so data is unreadable to Apple (credential management codenames: Plesio, Stingray, Cuttlefish)
Mangrove	transfering UI tiles over XPC; Mangrove.framework, IOSurface.framework
Marco	Marco.framework, something about IDS and communication (iMessage, Calls), logging?
Marklar	codename from the PowerPC era for the port to x86, served the transition to Intel CPUs
Marzipan	Catalyst; port of iOS frameworks to macOS, Catalyst apps are iOS apps with additional API to adapt macOS UI idioms; /System/iOSSupport; integration using UIKit system process; launchd service: com.apple.uikitsystemapp; input remapping by /Library/Apple/Library/Bundles/InputAlternatives.bundle
MCX	Managed Client for OS X, preference management for settings from configuration profiles, /Library/Managed Preferences, command line tools: mcxquery, mcxrefresh
MDM	Mobile Device Management; server software to manage fleets of iOS and macOS devices; uses configuration profiles to manage preferences; ConfigurationProfiles.framework
MDS	Module Directory Services, ancient part of the old security APIs (CSDA, CSSM)
Memory Debugging	uses Taskport; command line tools: heap, leaks, malloc_history, stringdups, vmmap
Mesa	Touch ID; /Library/Catacomb; /var/db/bkad.db
Metadata	Spotlight; file indexing on macOS; CoreServices.framework/Metadata.framework, CoreServices.framework/SearchKit.framework; stored in .Spotlight-V100; launchd service: com.apple.metadata.mds; command line tools: mddiagnose, mdfind, mdimport, mdls, mdutil; in addition to auto-indexing, apps can explicitly register searchable items; CoreSpotlight.framework; launchd service: com.apple.corespotlightd
MMCS	MobileMe Chunk Storage, used by iCloud, splits blobs into chunks and stores them at Apple/AWS/GCP with convergent encryption (content hash as key); MMCS.framework
Mobile	prefix for iOS
Mobile Assets	demand-downloaded system components like fonts, dictionaries, linguistic data; stored in /System/Library/Assets; launchd services: com.apple.languageassetd (language-dependent assets), com.apple.mobileassetd; server: mesu.apple.com
Mobile Device	connectivity to iOS devices over USB or WiFi (AirTrafficHost) for syning, development, and debugging; MobileDevice.framework; launchd service: com.apple.usbmuxd; Bonjour service: _apple-mobdev2._tcp
MOC	Managed Object Context; Core Data object space
Mondrian	photo collage arrangement in Photos.app; Mondrian.framework
MRT	Malware Removal Tool; /Library/Apple/System/Library/CoreServices/MRT.app
Multipeer Connectivity	ad-hoc networking; Bonjour for discovery; WiFi, AWDL, Bluetooth, or Ethernet as transport; optional encryption and certificate-based authentication; MultipeerConnectivity.framework
Nano	prefix for watchOS
Nearby Interaction	proximity-based interaction between devices; proximity measured using ultra wideband or derived from other technologies; used for Universal Control; NearbyInteraction.framework, Proximity.framework; launchd service: com.apple.nearbyd
Newton	fall detection on watchOS
NLP	Natural Language Processing; NLP.framework; related to mecabra libraries, a linguistic engine for Chinese and Japanese; /usr/share/mecabra, /usr/share/tokenizer
Notarization	app security scan by Apple; cryptographic proof stapled to code signature, tested at launch by System Policy; for non-notarized apps sends code hash to Apple; command line tools: notarytool, altool, stapler
Noticeboard	User Notifications for Software Update and App Store, Noticeboard.framework; launchd services: com.apple.noticeboard.state (nbstated), com.apple.noticeboard.agent (nbagent)
Notifications	system notification bus, unrelated to the local/remote push notifications; launchd service: com.apple.notifyd, com.apple.kuncd (invoked by kernel through host special port 10); command line tool: notifyutil; complemented by framework-level notification system (CFNotification, NSNotification); launchd services: com.apple.distnoted.xpc.daemon, com.apple.distnoted.xpc.agent
NSP	Network Service Proxy; per-app VPN and proxy settings, implements Private Relay; launchd service: com.apple.networkserviceproxy
OAH	Rosetta; /usr/libexec/rosetta
ODR	On-Demand Resources; loaded from App Store; launchd service: com.apple.appstored
Onboarding	data protection splash screen shown by service-connected apps; /System/Library/OnBoardingBundles; OnBoardingKit.framework
Open Directory	directory service for user, group, and machine management; plugin-based to use different backend stores (LDAP, Active Directory), local accounts in /private/var/db/dslocal; launchd service: com.apple.opendirectoryd; command line tools: dscacheutil, dscl, dsconfigad, dsconfigldap, dseditgroup, dsenableroot, dserr, dsexport, dsimport, dsmemberutil, odutil
Opus	create slide shows from photos; Slideshows.framework
OSA	Open Scripting Architecture; scripting of applications from different fontend languages (currently AppleScript and JavaScript); backed by Apple Events; command line tools: osacompile, osadecompile, osalang, osascript, sdef, sdp
OTUT	One-Time Unlock Token; security mechanism to allow keybag unwrapping after updates
PAC	Pointer Authentication Codes; pointers signed in unused bits to prevent ROP attacks
Packages	unit of software installation; command line tools: pkgutil, installer, softwareupdate; launchd services: com.apple.softwareupdated, com.apple.bootinstalld, com.apple.installd, com.apple.system_installd, com.apple.uninstalld; /var/db/softwareupdate, /Library/Apple/System/Library/Receipts (system), /System/Library/Receipts (read-only), /private/var/db/receipts (App Store)
Parsec	Spotlight web results and searching of crowdsourced User Activity deep links; server: *.smoot.apple.com; launchd services: com.apple.parsecd, com.apple.parsec-fbf (Feedback Flush to Differential Privacy)
Password Breach	monitoring of Keychain passwords against a breach database; round-robin matching in fixed-size batches, local match against common leaks, remote match using hash prefix; launchd service: com.apple.Safari.passwordbreachd
Pasteboard	storage for cut, copy, and paste; type of content remembered as UTI; launchd service: com.apple.pboard; command line tools: pbcopy, pbpaste
PCS	Protected Cloud Storage; key management for separate iCloud storage compartments (PCS calls them views), each can contain FoundationDB plus bulk data stored by MMCS; see also iCDP, CKKS, Manatee; ProtectedCloudStorage.framework; /System/Library/Preferences/ProtectedCloudStorage; command line tool: pcsstatus
PCSC	Personal Computer Smart Card; PCSC.framework, uses CTK
PDE	Print Dialog Extension; old name, not a proper Extension
Pegasus	meaning 1: picture-in-picture video playback; Pegasus.framework (iOS), PIP.framework (macOS); meaning 2: online search query engine for visual lookup; PegasusKit.framework
Pepper	UI elements for Watch home screen and Chat, like Quickboard (canned replies), Animoji; PepperUICore.framework
Persona	separation of sub-user-identities, like when using a private and managed Apple account; PersonaKit.framework; ~/Library/Personas; /System/Library/UserManagement; command line tool: umtool
PHASE	Physical Audio Spatialization Engine; 3D sound rendering engine; Apple devices map audio sources (even mono and stereo) to virtual speakers in a 3D sound stage, which is simulated by the physical speakers via a head-related transfer function; PHASE.framework
Piano Mover	Mail Drop; bulk mail attachments transfered over PCS; not to be confused with storage for iMessage attachments, which uses a CloudKit container
Plugin	Extensions, XPC services bundled with apps or frameworks, discovery by Launch Services; launchd service: com.apple.pluginkit.pkd; command line tool: pluginkit
PMP	Port Mapping Protocol; Apple alternative to UPnP, Bonjour service: _acp-sync._tcp
PowerUI	battery management like smart charge and power save, learns from Duet and other data; PowerUI.framework; /var/db/PowerUI; launchd service: com.apple.PowerUIAgent
Preferences	storage for user-configurable settings; launchd services: com.apple.cfprefsd.xpc.daemon, com.apple.cfprefsd.xpc.agent; stored in Library/Preferences, command line tool: defaults; interaction with Synced Defaults per /System/Library/DefaultsConfigurations
Private Relay	two-hop onion routing with one entry and one exit node; Apple operates entry, third-party services operate exit nodes; QUIC for payload, ODoH for DNS, approximate IP geolocation via Waldo; authentication via Attestation, propagated to proxys using RSA blind signatures
Proactive	umbrella term for suggestions and completions based on Duet forecasting and User Activity context, also marketed as Siri features; PersonalizationPortrait.framework
QoS Classes	inheritable property for Activities; semantic priorities, influences scheduling parameters; initially set at user-level, priority inheritance within GCD queues and across XPC in kernel?
Quagga	framework for QR and barcode decoding; Quagga.framework
Quick Action	extension type for quick interaction with foreign content within a host app; extension points: com.apple.services, com.apple.ui-services
Quick Look	file preview and thumbnail generation; comand line tool: qlmanage
RAOP	Remote Audio Output Protocol, AirPlay; Bonjour service: _raop._tcp
Rapport	device pairing by proximity using Alloy, with PIN entry, or using iCloud; once paired, devices can access services; used for HomeKit, HomePod, AirPlay, Home Sharing, SideCar; Rapport.framework; launchd service: com.apple.rapportd; Bonjour service: _companion-link._tcp
Recents	recently used items (not files) in various applications, synced with Synced Defaults; CoreRecents.framework, /System/Library/Recents; launchd service: com.apple.recentsd
Relevance Engine	backend for Siri suggestions (for example of Siri Shortcuts), Widget smart stacks (also Siri watch face); consumes Duet knowledge and app-provided timelines with relevance hints; /System/Library/RelevanceEngine; launchd service: com.apple.relevanced
Remote Pairing	Mobile Device pairing without wired connection; RemotePairingDevice.framework; Bonjour services: _remotepairing._tcp, _remotepairing-manual-pairing._tcp
RemoteXPC	connection to a non-SoC-integrated SEP like Bridge; uses HTTP/2 over a network interface, Bridge connected over USB, secured using Attestation; RemoteServiceDiscovery.framework, TrustedAccessory.framework; launchd service: com.apple.remoted, com.apple.tracd; command line tool: remotectl
Revisions	document autosave and auto-versioning; stored in .DocumentRevisions-V100; GenerationalStorage.framework; launchd service: com.apple.revisiond
Routine	frequently visited locations on iOS, interacts with Duet; launchd service: com.apple.routined
RTC	Real-time Telemetry and Crash reporting; RTCReporting.framework; launchd service: com.apple.rtcreportingd
RTKit	operating system used on Apple Silicon for firmware of co-processors
RunningBoard	runtime management of apps, paradigm: app as service process invoked by system, check-in by frameworks, handles process assertions (frontmost app, see App Nap), memory pressure (see Jetsam) and compute resources (GPU), replacement for TAL?; launchd service: com.apple.runningboardd; /System/Library/LifecyclePolicy, /System/Library/RunningBoard
SBPL	Sandbox Profile Language; a TinyScheme-based embedded DSL for Seatbelt profiles
SCIP	System Coprocessor Integrity Protection; like KIP, but for SEP, ISP, Motion coprocessor
Screen Reader	VoiceOver and Braille; /System/Library/ScreenReader; ScreenReader.framework
Screen Time	digital wellbeing and parental controls system, uses Device Management as policy engine, self-enforced within the application by frameworks; DeviceActivity.framework, ManagedSettings.framework, FamilyControls.framework; launchd services: com.apple.ScreenTimeAgent, com.apple.dmd
SDB	SQL Database; CoreSDB.framework, used by iCloud communication
Search Party	portion of Find My service for offline devices; devices emit public part of rotating key pair via Bluetooth LE, other devices encrypt current location with this key and send to Apple, private key shared over CloudKit
Seatbelt	process sandbox by filtering system calls; profiles written in SBPL; /System/Library/Sandbox/Profiles, /usr/share/sandbox; default file access policy asks for TCC confirmation before access to folders with user data (like Documents) is allowed; command line tool: sandbox-exec; launchd service: com.apple.sandboxd (invoked by kernel through host special port 14 for logging)
Secure Backup	escrow part of CKKS; escrow key individually wrapped with passcodes of trusted devices, stored in HSM to prevent brute forcing, uses SRP so passcodes are not visible to iCloud, limited number of recovery attempts; protocol called Lakitu, uses FollowUp; launchd service: com.apple.SecureBackupDaemon (com.apple.sbd); CloudServices.framework
SEP	Secure Enclave Processor; dedicated ARM core for security services, runs L4/Darbat-based sepOS, inline encryption to DRAM, manages AES keys in storage DMA engine, factory-paired channels to Touch ID/Face ID hardware, Secure Element, Neural Engine; SEP can use but not read UID and GID keys; credential verification performed by hardware lockbox with retry count enforcement
Seymour	Apple Fitness+; workout videos integrated with Watch sensors; SeymourCore.framework
Sharing	umbrella term for wireless proximity services: AirDrop, Continuity, Instant Hotspot, WiFi sharing; used by loginwindow for Watch unlock; Sharing.framework; launchd service: com.apple.sharingd; also serves connection sharing and remote disk
Shazam	music recognition service; ShazamKit.framework; launchd service: com.apple.shazamd
Shoebox	Passbook
Sidecar	using iPhone/iPad as Mac accessory: camera for photos and scanning, annotations, external display over low-latency WiFi (llw interface) using avconferenced encoding; SidecarCore.framework; launchd services: com.apple.sidecar-display-agent (SidecarDisplayAgent), com.apple.sidecar-relay (SidecarRelay)
Signpost	telemetry API to report points of interest in code; launchd service: com.apple.signpost.signpost_reporter
Simulator	running an iOS/tvOS/watchOS personality on macOS, uses sandboxing and a separate Mach bootstrap namespace for container-like isolation, command line tool: simctl
SIP	System Integrity Protection or rootless mode; collection of kernel-level security restrictions regarding file system modification, unsigned Kexts, Taskport access, NVRAM access, DTrace; /System/Library/Sandbox/rootless.conf; command line tool: csrutil, rootless-init
Site Association	signed files in .well-known directory on websites; equivalent to Entitlements for websites, associates domains with app IDs for Universal Links; command line tool: swcutil
SKP	Sealed Key Protection; measurement of system state (boot chain IMG4 manifests, BPR, Boot Policy data, UID key, user passcode) to derive Keybag keys
SKS	Secure Key Store; handling of keybag keys within the SEP
SkyLight	WindowServer; SkyLight.framework
Skywalk	network subsystem in XNU, links together actual technologies (Bluetooth, WiFi, Thunderbolt) and interfaces/tunnels; transacts in nexus (for conduits) and agent (for endpoints) objects; DriverKit network drivers use Skywalk; command line tool: skywalkctl
SLC	System-Level Cache, architectural feature of Apple Silicon; cache located within SoC at controllers for external DRAM, serves all compute units and stages transfers between them
Social Gaming	Game Center; multiplayer gaming services on top of CloudKit, shared storage and low-latency multicast for multiplayer sessions; launchd service: com.apple.gamed
Sock Puppet	Watch interaction that requires Companion device
SOS	Secure Object Sync; syncing backend for iCloud Keychain, not to be confused with the emergency call feature; transferred items previously staged in Synced Defaults, for two-factor accounts in CKKS; launchd services: com.apple.secd (access to local keychain), com.apple.security.cloudkeychainproxy3 (connects to Synced Defaults), com.apple.security.keychain-circle-notification
SPI	System Private Interface; /System/Library/PrivateFrameworks
SpringBoard	iOS home screen; like Dock (Launchpad, Mission Control, desktop picture), Control Center, SystemUIServer (menu extras icons), loginwindow (lock screen), and WindowServer (compositor) on macOS; /System/Library/CoreServices/SpringBoard.app, /Applications/PreBoard.app, BaseBoard.framework, FrontBoard.framework, SplashBoard.framework; launchd service: com.apple.backboardd (compositor)
SPRR	Shadow Permission Remap Register? feature of Apple Silicon to dynamically reintepret page permissions
SRP	Secure Remote Password; standard cryptographic protocol for proving knowledge of a secret such that attackers cannot brute-force the secret; AppleSRP.framework
SSO	Single Sign-On
SSV	Signed System Volume, als called Authenticated Root Volume (ARV); macOS boots from blessed read-only APFS snapshot, merkle-tree and root-hash stored in Preboot volume; modifications require disabling root authentication with csrutil from recovery, then the live filesystem can be mounted, modified, and re-blessed; command line tools: apfs_systemsnapshot, bless, csrutil
Stark	CarPlay
Stockholm	Secure Element in Apple SoCs, a processor running crypto protocols on keys it protects; used for Apple Pay and Car Key; related codenames: Icefall, Warsaw
Storage Management	freeing up disk space by managing bulky items; UI in System Information.app; StorageManagement.framework; launchd service: com.apple.diskspaced; extension point: com.apple.storagemanagement; extends Cache Delete service
Suggestions	semantic analysis of mails and websites to suggest contacts, calendar events and the like; launchd services: com.apple.suggestd, com.apple.reversetemplated; custom JavaScript parsers in /System/Library/AssetsV2/com_apple_MobileAsset_CoreSuggestions
Symbols	debug symbols for backtraces; CoreSymbolication.framework; launchd services: com.apple.coresymbolicationd; command line tools: atos, symbols, symbolscache
Symptoms	network diagnostics; Symptoms.framework; /var/networkd/db/netusage.sqlite; launchd service: com.apple.symptomsd (invoked by kernel through host special port 27)
Synced Defaults	simple key-value store for applications, no user control over data; can use iCloud key-value backend (old) or Manatee container (new, marked as com.apple.kvs) as storage; launchd service: com.apple.syncdefaultsd; locally stored in ~/Library/SyncedPreferences
System Configuration	SystemConfiguration.framework; launchd service: com.apple.configd; command line tool: scutil
System Extension	user-level components formerly in the kernel; currently either a DriverKit, Network, or Endpoint Security extension; /System/DriverKit, /System/Library/DriverExtensions; command line tool: systemextensionsctl; launchd services: com.apple.sysextd, com.apple.nesessionmanager, com.apple.endpointsecurity.endpointsecurityd
System Policy	Gatekeeper; policy engine for application launches and kext loading, malware signatures from /Library/Apple/System/Library/CoreServices/XProtect.bundle; /var/db/SystemPolicy; launchd service: com.apple.security.syspolicy (invoked by kernel through host special port 29); command line tool: spctl
TAL	Transparent App Lifecycle; process for macOS apps started and stopped independently of the user launching and quitting app; also handles session restore across reboots; ~/Library/Saved Application State; launchd service: com.apple.talagent
Taskport	Mach kernel concept for ptrace-like access to task internals; access policy implemented by daemon; launchd service: com.apple.taskgated (invoked by kernel through task special port 9); command line tool: DevToolsSecurity
TCC	Transparency, Consent, and Control; user control over app access to privacy-related services (kTCCService*); TCC.framework; launchd services: com.apple.tccd, com.apple.tccd.system; command line tool: tccutil; stored in /Library/Application Support/com.apple.TCC, ~/Library/Application Support/com.apple.TCC, /var/db/locationd (for kTCCServiceLocation)
Time Machine	automatic backup service, command line tools: tmdiagnose, tmutil
Tin Can	Walkie Talkie on watchOS
Tones	ringtones; ToneLibrary.framework
Translocation	app binary copied on launch to dedicated location; initiated by Launch Services for security (prevents path traversal for apps quarantined by System Policy) or path normalization (iOS apps do not expect to be moved, but can be moved on macOS)
Transparency	key transparency for ESS keys? Transparency.framework; launchd service: com.apple.transparencyd; server: init-kt.apple.com
TSS	Tatsu Signing Server; online verification for firmware signatures; server: gs.apple.com
TTS	Text To Speech, command line tool: say; /System/Library/Speech; synthesizer engines: MacinTalk (historic), Polyglot (phoneme-based?), Gryphon (current, DNN-based?)
TVML	TV Markup Language; declarative UI language for TV apps; TVMLKit.framework
Ubiquity	iCloud Drive; codename Bladerunner, uses CloudKit; CloudDocs.framework; launchd service: com.apple.bird; locally stored in ~/Library/Mobile Documents (was supposed to move to Library/CloudStorage/iCloud Drive but this was reverted)
UID	unique ID key, used as root key for cryptographic subsystems, generated during manufacturing by SEP and fused into hardware, only accessible by SEP
Unified Logging	system-wide logging and Activity tracking; launchd service: com.apple.logd, com.apple.diagnosticd; command line tool: log; /dev/oslog; data stored in /var/db/diagnostics, support files in /var/db/uuidtext
User Activity	abstraction for deep-linking into apps with structured context (people, places); used for Universal Links (schema.org on websites), Handoff, Parsec (app links in search), Siri Shortcuts, Quick Note (context awareness), Proactive; UserActivity.framework; launchd service: com.apple.coreservices.useractivityd
User Notifications	user interface for notification center; launchd service: com.apple.usernoted
UTI	Uniform Type Identifiers; system for document types; file extensions and MIME types are mapped to UTIs, UTIs form a conformance graph, apps register their UTIs with Launch Services; /System/Library/CoreServices/CoreTypes.bundle; also Apple’s hardware devices are represented as UTIs
VA	Video Acceleration; AppleGVA.framework, AppleVA.framework, AppleVPA.framework
Viceroy	video conferencing used by FaceTime and ReplayKit; ViceroyTrace.framework
VSDB	volume status database; /var/db/volinfo.database; command line tool: vsdbutil
Waldo	selects edge servers based on approximate location, part of Private Relay, seen in NSP
WFS	WebDAV File Sharing; built-in file sharing with Apache; /etc/wfs; command line tool: wfsctl
Widgets	content excerpt from apps; provided via a timeline of view hierarchies, configuration uses Intents, technically very similar to complications on watch face; extension point: com.apple.widgetkit-extension
Willow	HomeKit; end-to-end-encrypted communication protocol and API for IoT-accessories; pairing with SRP using code printed on device, credential sync by CKKS, transported over Alloy, remote access using Apple TV as proxy; launchd service: com.apple.homed
Workflow	Shortcuts; user-programmable system-wide automation, built-in triggers cause a chain of actions to run; actions are synthesized from User Activities and Intents provided by apps; WorkflowKit.framework, ActionKit.framework; locally stored in ~/Library/Shortcuts; launchd service: com.apple.siriactionsd (voice-triggered shortcuts); command line tool: shortcuts
xART	eXtended Anti-Replay Technology; persistent storage for SEP, used by Mesa; /System/Volumes/xarts; launchd service: com.apple.xartstorageremoted; command line tool: xartutil
XCS	Xcode Server; continuous integration server; command line tools: xcscontrol, xcsdiagnose

AppleInternals.tsv