Glossary
Terms are defined by current behavior, not by an older phase label. Where a term names a provisional capability, the definition says so.
Identity
Agent
A compute identity that calls the proxy. It belongs to exactly one organization and is presented as X-IBEX-Agent-ID. Status can be active, paused, suspended, or archived.
Organization (org / tenant)
The isolation boundary. Every durable customer record carries org_id. Org A must never read or mutate Org B data through any service, cache, log, projection, or backup.
User
A human operator. Users are not agents. Operator sessions, TOTP, roles, and invitations belong to the management plane.
Personal Access Token (PAT)
A long-lived bearer credential in the wire form ibex_pat_{uuid}_{secret}. Stored as an Argon2id hash; plaintext is shown once. Carries a 64-bit permission bitmap.
Permission bitmap
A 64-bit field encoding allowed operations. Defined in packages/permissions/permissions.go and ADR-0009. A valid token without the required bit is authenticated but not authorized.
Step-up / MFA
A recent TOTP verification required for high-risk permissions such as SecretUse, OperatorRawRead, and PolicyChange.
Principal
The authenticated identity a service acts for: organization, subject, selected agent, and permission set. Principal propagation is a gate, not a completed repo-wide migration.
Proxy and API
LLM proxy
The Go HTTP edge on port 8080. It validates tokens and agents, applies admission controls, optionally assembles context, forwards to a provider, and emits evidence.
Provider adapter
A package that translates a normalized request to a provider API. Mock, OpenAI-compatible, Anthropic, and self-hosted adapters exist. Adapter presence is not a model capability guarantee.
Error envelope
The stable JSON shape { "error": { "code", "message", "request_id", "timestamp", ... } }. Codes come from packages/apierror.
Request ID
A UUID v4/v7 correlation identifier in X-Request-ID, echoed in logs, traces, and error bodies.
Idempotency key
An opaque client key used to deduplicate a mutation. Chat uses Redis and fails open on cache outage; memory writes and worker enqueue use PostgreSQL and fail closed.
Session
A conversation lifecycle record with an external ID, checkpoints, and an idle sweep. The sticky header is X-IBEX-Session-ID.
Directive
A versioned system-prompt fragment resolved per organization and agent, then injected before the provider call. Directive content is never logged by default.
Memory and context
Memory
A persistent knowledge record with content, embedding, labels, confidence, validity, status, and lifecycle metadata. Storage, dedup, conflict candidates, and search are implemented locally; the typed lifecycle is provisional.
Quarantine
A memory status for content that must not be treated as ordinary active context, commonly due to low-confidence PII handling or policy.
Deduplication
Exact dedup uses a SHA-256 hash of normalized post-PII content. Near dedup uses vector similarity above a configured threshold. A duplicate is not automatically a semantic replacement.
Supersession
A directional relationship indicating that a newer memory replaces an older one for a subject and validity interval.
Hot cache
A Redis-backed set of recently useful memories. It is an optimization, not the source of truth. Keys are tenant-prefixed.
Context assembly
The bounded pipeline that retrieves directives and memories, scores them, packs within a budget, and formats them as escaped, nonce-delimited data. The service is provisional and has no caller auth interceptor.
Token budget
The maximum context allowance minus the response reserve. Estimation is conservative and not provider-tokenizer-exact.
Evidence and operations
Status ledger
The authoritative record of what is evidenced, at what scope, with what limitations and review date. It outranks diagrams, ADRs, release notes, and this glossary.
Shipped-local
Implemented and locally evidenced. Not a claim of hosted, HA, or production readiness.
Provisional
A seam or contract exists, but evidence, review, or a gate remains open.
Proposed
Design intent only. No runtime or acceptance evidence.
Deferred
Intentionally outside the current dependency set.
Trace
A correlated record of an inference or service operation. ClickHouse traces store metadata and counts, not prompt or completion text by default.
Evidence outbox
A PostgreSQL table written with the durable effect, later projected by the relay. The projection is not atomic with the request.
Relay
A default-off Go daemon that claims outbox rows, checks the session fence, delivers to a sink, and finalizes. It is not certified for hosted/HA use.
Budget reservation
A durable hard-cap admission hold in PostgreSQL. Terminal rows are excluded from the cap sum, so bounded overshoot is possible until reconciliation.
RLS
PostgreSQL Row-Level Security. Policies compare org_id to current_setting('app.current_org_id'). RLS is a backstop; application predicates are still required.
Fail closed
Deny access when a security dependency cannot make a reliable decision. Auth and rate-limit failures on the proxy fail closed.
Fail open
Continue in a degraded but safe mode. Context retrieval can fall back to directive-only context; it must never widen tenant scope.
ClickHouse projection
A non-authoritative analytics copy with no RLS. Every query must carry an explicit org_id predicate. There is no global enforcement switch.