Acknowledgement (ack). The first response an implementation writes for a request, before the command has finished. Its presence proves something is listening. See spec/04.
Allowlist. The closed set of verbs an implementation will execute. Held as a literal in the implementation itself, not in editable configuration.
Argument vector (argv). The exact list of program name and arguments passed to the operating system when executing a command, with no shell between. The whole point of building one from a fixed table is that nothing from a request is ever parsed as shell syntax.
Audit log. The authoritative, append-only record of every request and its outcome, written outside the shared mount so the agent cannot alter it.
Bridge. The whole mechanism: client, spool, implementation, and the contract between them.
Drain. One pass of the implementation over the spool, handling every request it finds.
Fixed-argv table. The closed mapping from verb to argument vector. One entry per verb; no entry is constructed from request content.
Hardcoded-deny set. Verbs the implementation refuses unconditionally, checked before the allowlist so that no configuration mistake can make them reachable.
Integrity gate. A check that the trusted files the implementation executes have not changed since the operator last approved them.
Kill switch. A host-only control that makes the implementation refuse every request without stopping it, so requests still receive clean denials.
Mirror. A copy of a log placed inside the shared mount so the agent can read it. Never authoritative, because the agent can write to it.
Mount. The bind-mounted directory shared by the host and the agent container. The one channel that already crosses the boundary.
Mutating verb. A verb that changes the state of the stack or the host. Contrast a read-only verb, which only reports.
Placement authentication. The design property that being able to write into the spool is itself the credential, because only the agent and the host can.
Poison request. Any spool entry that cannot be processed normally: malformed, hostile in name, not a regular file, unreadable, or empty.
Response state machine. The states a response passes through:
queued → running → done | failed | denied | expired.
Single-flight. The property that only one drain runs at a time.
Spool. The directory tree on the mount holding requests, responses and archives.
Trusted computing base (TCB). The set of files whose contents determine what the implementation actually does. Keeping it small, host-only and integrity-checked is the core of the security model.
Two-Surface Law. The rule that the agent drives only the request-writing surface and the operator keeps the underlying orchestration script authoritative, with no crossing in either direction. See spec/03.
Verb. The named action a request asks for, for example status or restart.
Watcher. The host-side implementation, named for the trigger mechanism most commonly used to start it.