Glossary

Terms in the order you meet them, not alphabetically — each one builds on the ones above it.

Identity

Identity (vault) — an email address, protected by a password, held in the Authenticator on your phone. The app titles the list Identities; the button says + New Email Vault. Same thing. A person has one; an agent does not.

Resource — a name assigned to your identity, which an agent then runs under. Two kinds: generic (the name is generated, like api12-lock-java-pressure83) and domain (a name on a domain you control, proven by a DNS TXT record checked when a licence is granted).

Subject — how a person is named inside the system: sha512(their email), never the address itself. Policy rules and vouches use the hash.

Agent token — lets a browser app authenticate to your agent. Created in the Authenticator under a resource. Not how people sign in — that is alt-auth.

ASK (Asymmetric Shared Key) — the key material one identity fetches to talk to another. It is issued per (sender, recipient, time window), rotates every 15 minutes, and is derived from the sending machine’s fingerprint, its resource name and its password — so the same resource name on a different machine, or with a different password, produces a different ASK. The 15-minute window governs when the platform will issue it, not how long it works: an ASK you already hold decrypts its messages permanently. The corollary matters — if you need to read those messages after the window closes, keep the ASK with the ciphertext, because the platform will not reissue it and there is no escrow.

Dead Drop Encryption (DDE) — how two identities exchange a message without exchanging keys. Each pair derives a shared key for a 15-minute window from their identities alone, so you can encrypt to a name before that name exists, the recipient need not be online, and the platform that issues keys is never in the data path. It is the primitive underneath every other term here.

The parts you run

Agent — a running identity. It proves who is calling, decides whether they are allowed, and hands the work to an engine. One folder, one identity, its own policy.

Runner — a second agent whose job is to serve outside callers, with its own ports and policy and one sealed engine. Branching one off is how you let users in without exposing your workspace.

Engine — the unit of work an agent encloses. You do not write an agent; you write or seal an engine, and the agent wraps it in identity and policy. Every agent ships with the built-in harness engine (hexaeight-engine): memories, sessions, the tool loop and missions.

Router — holds the model credentials so no agent does. Agents ask for a route name; the router resolves it to a provider and decides whether that caller may use it. Runs under its own identity, in its own folder.

Route — a glob you choose (*-ant-aws, glm5br*) that names an upstream in upstreams.yaml. An engine sends route|model; the router matches the left half and puts the right half on the wire.

Harness — the AI runtime that ships with every agent and runs on your machine, in a sandbox. The agent starts it for each question; it searches memories, follows missions and reaches the model only through the router. See The harness.

Workspace — the browser console for the operator. A client, not the agent. It holds no identity and no model keys. See The workspace.

heia — the command the installer adds to start, stop, restart and check the router, the agent and the workspace, from any folder. See Lifecycle.

What an agent works with

Memory — how an agent reaches information: a named, searchable body of documents, an API, or another agent. Local (ingested on this machine) or served (held by another agent and reached by name over an encrypted channel). See Memories.

connect-to-agent — the memory every agent has built in, through which it asks another agent a question by name.

Shard — one part of a large collection, indexed by its own process. The shards are then searched together as one memory.

Mission / procedure — a written-down method an agent follows instead of improvising: a flowchart (which card handles which question), cards (the steps), and a fence (what it may touch), plus optionally the files it carries and a command set sealed in the agent. The CLI and log lines say mission; some pages say procedure. Same thing. See Missions.

Mission Runner — the place in the workspace where you run a mission and check its answers.

HexaPilot — long jobs the agent runs on its own. You describe the job and approve its flowchart once; it then plans, works and checks its own work inside its own folder.

Guided / direct mission — in a guided mission the agent’s model walks the map and the card’s steps. A direct mission has one card with mode: direct: every message is written to a file and handed to one approved command, with no model step in the harness. Framework runners are direct.

Mission files — files kept beside a mission’s cards (a framework’s runner.py, say). They travel with the mission and are copied fresh into every turn’s working folder.

Card (capability card) — one procedure, for one kind of question: intent, match cues, resources, steps, dos and don’ts, and a done-check. The decisions a mission makes are made on its cards.

Fence — the _manifest.md listing the only memories and commands a mission may use. Not a guideline: a limit.

Cmdset — the set of shell commands a mission is permitted to run, sealed in the agent (never in the mission’s bundle) and each pinned to the sha256 of the file it runs. No cmdset means no shell at all, which is the default. cmdset seal records one; enable does it for a framework mission.

Runner store — a runner’s own harness root. A runner sees only its mission until a memory is exported into it with runner-memory --share (a served memory’s pointer, or a local memory linked or copied).

Letting others in

BYOA — bring your own auth. You keep whatever login you already have; your backend calls the runner and names the user. Your users notice nothing.

alt-auth — the other door. Users sign in with the HexaEight Authenticator: the agent seals a one-time code to their address, they type it in, and no password ever reaches you.

Front door — the /external/* surface a runner exposes, which both BYOA and alt-auth arrive at.

Vouch — permission for one identity to act on behalf of a subject. It is what makes a turn bind to a person rather than to the agent.

Opaque caller — a caller the agent keeps private: it sends :opaque: to the router instead of who the caller is, and the router records the call against the agent. An agent does this for outside callers when external.opaqueCallers is on.

OAuth link — an agent linked to your company’s OAuth app, so that other agents can check, on every message, that your company still stands behind it. See HexaEight and OAuth.

Records and controls

Audit trail — the agent’s sealed, chained record of what it allowed, ran and refused. It never holds the content of a message. See Audit trail.

SIEM sink — where the audit trail is sent as it is written: your log pipeline, over HTTPS.

Compliance report — a read-only report of the controls in force, checked against SOC 2, HIPAA, the EU AI Act and India’s DPDP Act. See Compliance reports.

Access review — a read-only list of who and what can reach an agent: rules, sessions, approvals and machines.

Approval — a person’s yes or no to something the agent wants to do, such as a command or the first use of the web. Approvals in conversations and HexaPilot are recorded in the audit trail.

Startup check — before it starts, the agent opens every encrypted store. If one does not open, it does not start. See Encrypted stores.

Last-good copy — one of the two copies of a store kept after a start that passed. restore-store puts one back.

Idle sign-out — the workspace signs a person out after a period without activity. See Admin settings.

Privacy notice — what the terms screen tells people before they accept. It can be the standard one or your organisation’s own, and it goes together with consent withdrawal.

Files and places

env-file and hexaeight.mac — the identity, machine-bound. Never copied; hardlinked when one machine needs them in two folders.

upstreams.yaml — the router’s only config: its upstreams, and its own settings such as requireIdentifiedCaller.

router-policy.he — the router’s rules, sealed under the router’s own key. Read it by starting the router (it prints every rule) or with --init-policy.

engines.he, policy.csv, vouch.he — some of the agent’s sealed stores. Changed through the CLI or the workspace, never with an editor. See Every setting.

hexaeight-agent.json — the agent’s settings, in plain JSON. The running agent only reads it, and every change to it is recorded in the audit trail.

Harness root — where an engine keeps its memories, missions and sessions. Passed as --root. A runner usually has its own, separate from the workspace agent’s.

HEIA_DIR — an agent’s own store for sessions and skills. A caller and the door it calls must not share one, or the door answers your question back to you.

Sealed — encrypted under the agent’s own key, so only the agent can read or change it. Sealed files are edited through the CLI.

Jail — every engine turn runs with the identity folder masked, so a turn cannot read env-file even though it runs as the agent.