Glossary

This glossary defines key terms used throughout Agentic Machine Learning Systems. Terms are organized alphabetically.

A

accepted task

A task completion credited to a particular evaluated trial because its available evidence satisfies the declared outcome, process, resource, and residual-duty criteria at the required evidence level. Acceptance is scoped to those checks and rubrics; pending or unavailable required evidence is not a pass.

action-bound approval

An approval that authorizes the exact represented action the runtime will dispatch, not a model-written claim that the action is harmless, so an altered request cannot reuse it.

active toolkit

The set of tool definitions staged for the next model call, selected from the larger registered catalog.

adapter

A small trainable parameter set added to a frozen base model and released alongside it. It shares the process, base weights, and granted authority of whatever serves it, so it isolates nothing between agent roles.

admission cascade

Another name for a verifier cascade, the ordered sequence of declared predicates that routes a recorded trajectory to a learning artifact.

admission limit

A bound that checks newly admitted financial commitments, as reservations, before dispatch, typically against an allowance over a trailing time window that covers all children in its scope. It differs from a spending alarm, which watches charges already posted and can only trigger investigation or a hold.

advantage

The expected return of taking a given action at a given history minus the expected return of the policy’s usual behavior there, \(\PolicyHistoryAdvantage = \PolicyHistoryActionReturn - \PolicyRemainingReturn\).

agent harness

The runtime component that owns the agent loop for one trajectory. It assembles each model call, interprets the reply, decides whether and when each proposed tool call is dispatched, and keeps the trajectory record through which anything outside the loop can inspect, pause, bound, or stop the trajectory.

agentic machine learning system

A closed-loop system in which a foundation model proposes actions toward a delegated goal and a deterministic runtime decides what each call sees, which proposals take effect, and what evidence completes the task.

agentic retrieval

Retrieval in which the model issues search, read, and lookup calls as tools, turn by turn, instead of receiving a fixed set of passages staged before the call. It trades extra turns for evidence chosen as the task unfolds.

all-pass rule

An acceptance rule that requires every one of \(\VerificationTrialCount\) trials of a candidate to pass; with independent trials of pass probability \(\TrialPassProbability\) it accepts with probability \(\TrialPassProbability^{\VerificationTrialCount}\). A shared checker defect correlates the trials and defeats the repetition.

all-results barrier

A join that waits for every worker in a fan-out, so its completion time is set by the slowest branch. With independent branches that each have the same probability of meeting the deadline, the probability that all meet it falls geometrically as workers are added.

ambient authority

The identity-derived reach that ordinary processes run with: everything the process’s identity may touch, named globally. It makes confused-deputy failures natural, which capabilities avoid by making delegation explicit.

approval digest

A hash of the canonical held proposal covering its operation, arguments, target, and referenced artifact versions. An approval binds to the digest, so changing any argument or artifact produces a different digest and voids the approval.

approval gate

The harness mechanism that holds a policy-selected proposed call, undispatched, until its required approval is resolved and current dispatch conditions are met. See also escrow.

approximate nearest-neighbor (ANN) search

Vector search that avoids scoring every stored vector, at the risk of missing some of the highest-scoring vectors under the metric. Designs cut the bytes a query touches either by visiting fewer vectors, as in a graph index, or by visiting compressed vectors within a few partitions.

argument schema

The machine-checkable part of a tool descriptor that specifies the structure of a call’s arguments: required fields, types, allowed values, and supported bounds.

attack-success rate

For a protected outcome, observed successful attack episodes divided by all eligible attacked episodes under a declared protocol. Episodes stay in the denominator when the defense refuses, execution times out, or the attack fails to elicit a proposal.

attempt ID

An identifier that correlates one request and its reply. A runtime retry of the same intended operation keeps its operation ID but uses a new attempt ID.

attention dilution

The reduction in a target token’s attention weight as tokens are added to the input. Because all weights share one softmax normalizer, every added key enlarges the denominator, so with fixed logits added tokens can only lower the target’s share.

attention sink

The first few positions of a sequence, on which later queries deposit attention mass they cannot place elsewhere because softmax weights must sum to one. Evicting them in a sliding window degrades generation, while retaining a handful beside the recent window keeps long streams stable.

attenuated delegation

The discipline that every hop of a delegation tree passes on only a subset of the delegator’s authority, preserving least privilege through concurrent spending and changes to ancestor state. The model proposes a child assignment; the runtime establishes the child’s identity, grant, reservation, and lifecycle bindings.

attenuation

Deriving a grant that permits no more than its parent, so that the accesses the child allows are a subset of those the parent allows.

B

backward recovery

Recovery that returns a system to an earlier saved state, such as a restored checkpoint, also called rollback. Compensation differs because it reaches declared earlier postconditions through new execution.

baseline (policy gradient)

A reference level subtracted from a sampled score in a policy-gradient update, depending on the starting information but not on which response was sampled. It reduces estimation variance and can be fixed or estimated, not necessarily by a separately trained model.

beam search

A search that keeps partial candidates up to a fixed beam width, generates a bounded number of extensions of each, scores them, and keeps the best as the next beam. The beam bounds which candidates receive further generation, not all live state.

behavior policy

The checkpoint and sampling configuration that actually generated a set of rollouts. It is a different model identity from the frozen reference policy used for regularization.

benchmark contamination

A task’s earlier appearance in the base model’s pretraining data, a leakage route that local train and test splits cannot close. Because a model’s owner often cannot enumerate its pretraining corpus, contamination is estimated with overlap or memorization probes rather than ruled out.

best-of-\(\CandidatePoolSize\) sampling

Generating \(\CandidatePoolSize\) candidates for one decision and returning one that a selector, such as a verifier, a judge, or a vote, admits. Its success is bounded by pass@\(\IndependentAttemptCount\) with \(\IndependentAttemptCount = \CandidatePoolSize\), reached only when the selector always returns a passing candidate if one exists.

blast radius

The resources and effects reachable by faulty or adversarial execution under a stated threat model and enforcement boundary, including what it can read, change, disclose, or consume.

block-diagonal attention

An attention mask for packed sequences that confines each example’s attention to its own interval, replacing an ordinary causal mask over the whole buffer. Any compute saving comes from kernels that skip the masked cross-example blocks, not from the mask itself.

BM25

A lexical ranking function that combines term rarity, diminishing returns from repeated occurrences of a term, and document-length normalization to order documents that match a query.

bounded-liability admission

The harness rule that admits a new operation only when, in every cumulative budget dimension, actual consumption plus outstanding reservations plus the operation’s maximum additional charge plus the protected finalization reserve fits within the allowance.

break-even utilization

The fraction of dedicated capacity a workload must keep busy for its fixed plus variable cost to equal the cost of the same output through a per-token API.

budget reservation

An allowance set aside before admitting bounded work so concurrent operations share the applicable ceiling. It remains outstanding until the associated liability is settled; only the unused portion is released.

bulkhead isolation

Assigning explicit execution and queue limits to resource domains so one dependency cannot occupy capacity reserved for unrelated work.

byte-pair encoding (BPE)

A subword tokenization method that learns repeated combinations of smaller units, so frequent fragments are represented compactly and unfamiliar words break into smaller pieces.

bytecode sandbox

An isolation envelope that runs code compiled to an execution format whose runtime enforces restrictions on memory access and control flow, such as WebAssembly. The code reaches its host only through functions the host imports, and an allowed host function still performs whatever operation it implements.

C

call surface

The typed request and response of one model call: the messages, tool definitions, and limits the runtime sends, and the proposal, stop reason, and token usage the model service returns.

canary release

A release stage that assigns a bounded portion of eligible live tasks to a candidate under an explicit release policy. A small allocation warns early but does not protect the tasks it exposes.

canary value

A synthetic secret planted where a test can observe whether it leaves. It reveals that a tested path transmitted information after the fact, so it serves diagnosis and adversarial evaluation rather than prevention.

cancellation context tree

The runtime’s parent–child lineage and cancellation state. An ancestor’s cancellation removes descendant eligibility at mediated boundaries and propagates stop requests; remote termination and effect or charge settlement require separate evidence and retained owners.

capability

An unforgeable authority reference designating resources and permitted operations. A protected handle or verified token can represent it; the runtime and resource owner must enforce its scope, conditions, and lifetime. The tuple \(\CapabilityGrant = (\GrantRights, \mathcal{O}_\CapabilityGrant, \GrantCondition, \GrantExpiryTime)\) describes these properties, not a mandatory encoding.

capability gap

A failure that persists when the model receives complete context, a correct interface, and a healthy runtime. Only such a failure makes model weights the right target; every other failure is a system defect with a cheaper, more reversible fix.

censored rollout

A rollout the collector abandons before its task budget expires, which is a different event from the policy exhausting its budget. The pipeline must declare whether it waits, reassesses, excludes, or applies a missing-outcome treatment rather than silently dropping or zero-scoring it.

checkpoint

A durably published compatible snapshot of a trajectory’s selected record, workspace, and required artifacts, bound to an exact log position. Reconstruction applies the available suffix to the affected state; publication and availability follow the declared failure-domain contract.

chunked prefill

A scheduling policy that splits a request’s uncached prompt into token spans processed over several engine iterations, each iteration also advancing ongoing decodes, while preserving causal order. One long prefill then no longer stalls every other trajectory on the server.

circuit breaker

A dependency-scoped admission mechanism that withholds new calls when configured failure evidence trips its policy, then admits bounded current-generation probes. It does not cancel already forwarded effects or bypass other authority, repeat-safety, and resource checks.

cleanup graph

A directed graph whose nodes are cleanup operations and whose edge from one operation to another means the first must establish its required settlement condition before the second may execute. The declared requirements must be acyclic.

clip-higher

A fix for entropy collapse that uses a wider upper than lower clipping bound, so low-probability tokens with positive advantage can gain probability faster while penalized tokens remain limited.

clipped surrogate

The per-token objective that takes the minimum of the ratio-weighted advantage and the same term with the probability ratio clipped to \([1-\RatioClippingWidth, 1+\RatioClippingWidth]\). The clip removes the incentive to push a term further in its favored direction; it is not a trust region bounding how far the policy moves.

closure evidence levels

Forms of support for a scoped acceptance claim: a model’s self-report, static checks, visible tests, sealed tests, and formal proof. They describe the basis of a claim rather than a strict ranking; a thorough sealed suite can support more than a proof of the wrong property.

code property graph

A directed graph of program entities with typed edges that merges the syntax tree, control-flow graph, and program-dependence graph. Typed edges such as calls, data dependence, inheritance, and imports let a traversal from a seed node follow only the relationships a question needs.

collection credit

An admission token that bounds outstanding collection work. Each admitted run holds one credit and reserves space for its maximum permitted record, and the credit returns only after a durable disposition or an acknowledged transfer to another capacity-controlled owner.

collection fixture

A fixture for gathering training trajectories that preserves both the task conditions and the evidence the proposed learning use requires.

collection manifest

The record that references an evaluation fixture and fixes a collection’s intended use and required evidence before sampling begins, without preassigning an outcome or training role to any trajectory.

commitment region

The span of a plan that ends in one pivot action: preparatory work that compensation can still undo, the pivot itself, and the follow-up duties that remain afterward.

communication topology

The arrangement that determines where messages travel among agents. A routing choice is not a correctness or lifecycle guarantee.

complete mediation

The requirement that every proposed access pass through an enforced authorization boundary before it reaches the protected resource. In an agent runtime the return path is also mediated, so observations enter context only under explicit access, payload, and status contracts.

completeness rule

The rule that a recovering worker may treat a missing intent as evidence of no dispatch only after establishing that it holds the complete authoritative history its failure domain promises. An asynchronously copied replica cannot satisfy it.

computer-use tool

A tool that returns a screenshot and accepts low-level clicks, keystrokes, or scrolling on a displayed surface. The runtime still owns validation, authorization, dispatch, and the returned observation; a valid coordinate says where an input goes, not what effect it will have.

conditional update

An operation that compares the expected version of a target and applies its replacement as one step within a coordination boundary shared by all relevant writers, the compare-and-swap of file editing. It closes the window a separate check-then-write leaves for another writer to intervene.

confidentiality

The security property that governs who may receive information. It varies independently of integrity, so one label cannot carry both.

confused deputy

A program that holds authority for one purpose and is induced to exercise it on behalf of a request that does not justify that use.

content-addressed storage

Storage that uses a digest of the content to identify stored bytes and to check retrieved content. A log event can reference a large payload by its digest, length, format, and location instead of embedding it.

context compaction

Replacing material in a working context with a shorter representation chosen for the task’s next decisions. A shorter representation is not necessarily equivalent to its source, so what it must retain, such as protected fields, is specified and checked.

context distillation

Generating demonstrations with guidance such as a checklist present in the input, reviewing the resulting targets, and training on a shorter input that omits the guidance. It deliberately transforms the learning problem, so both input versions and the transformation stay in the example’s lineage.

context engineering

The runtime discipline of deciding what enters a model’s context on each call of a trajectory, in what layout and form, and for how long each staged item remains valid.

context invalidation

Withdrawal of a staged observation’s support for claims about current state when an artifact or condition it depends on changes. The observation is kept as evidence about the state it recorded.

context manifest

A record of the entries selected for the next model invocation and why each is needed. It is a selection record, not a serialization of the request itself.

context partitioning

Giving each worker only the material its subtask needs, so each of its model calls processes fewer tokens. The saving depends on the split; workers that all need the same history duplicate it instead.

context window

The combined limit on input and generated tokens that one model call may hold. See also output headroom and usable working context.

context zones

An ordering of a request’s content into root, trunk, and leaf regions, placing infrequently changing material before frequently changing material. The zones describe relative change rates, not kinds of memory or levels of authority.

continuation sampling

A Monte Carlo value estimate that samples several independent continuations from a history under a fixed policy and averages their returns. Its starting conditions must follow the distribution associated with that history, so copying sandbox bytes alone is insufficient.

control candidate

A candidate whose correct verdict is known in advance, run against the grading criteria before collection at scale. An adequate control must pass and an inadequate one must fail; any other outcome means the check is not yet trusted.

control epoch

A marker in the trajectory record identifying the continuation against which proposals and observations are checked. Changing the epoch makes older responses ineligible for the next context but leaves their logical operations and repeat contracts untouched.

coordination tax

The work and elapsed time a delegated design spends on handoffs rather than on the task: preparing and validating envelopes, delivering context, scheduling children, collecting receipts, and reconciling and integrating their results. Its critical-path portion affects elapsed time; aggregate cost also includes work off that path.

copy-on-write

Deferring a copy of shared state until one owner writes to it. For KV blocks, before one of several candidates sharing a partially filled tail block appends, the runtime copies the block’s initialized entries to a new block and redirects that candidate’s table entry, leaving the others unchanged.

corpus manifest

The versioned record of a published learning artifact’s eligible pools, selection versions, sampling weights, token denominators, coverage, and evaluation protocol.

correlated failure

Errors that occur on the same inputs across several agents or reviewers, so their agreement is worth only what their joint error model says it is worth.

cost per accepted task

The included cost of all attempts, failed ones included, divided by the number of distinct tasks accepted under the same contract, written \(\CostPerAcceptedTask\). When attempts are independent and each is accepted with probability \(\AcceptanceProbability\), it equals the expected attempt cost divided by \(\AcceptanceProbability\).

counterfactual branch

A new, separately identified execution that shares a recorded prefix with its parent trajectory. A single branch can expose a failure case or demonstrate a change, but a success-rate claim still requires controlled task comparisons.

counterfactual probe

A rerun of a recorded failure with one suspected lower-rung defect removed, such as supplying a missing fact, replaying against a strict schema, or executing the same tool payload in a clean sandbox. A failure that disappears under a probe belongs to that rung.

coverage rule

The rule that a check establishes exactly the properties its coverage and assumptions support. Protecting a grader from modification secures the integrity of its measurement, not its coverage.

credential brokering

Holding selected credentials outside the execution environment and mediating their authorized use for task-scoped requests. A worker can be permitted to cause a credentialed operation without possessing the credential; other task data can remain sensitive.

credit assignment

The difficulty that a terminal check distinguishes assessed outcomes without identifying the contribution of each earlier response to them.

credit window

A fixed number of channel credits that bounds admitted outstanding items; admission consumes a credit and the runtime releases it at most once at the defined capacity-release boundary.

cross-encoder reranker

A model that scores the query and each candidate jointly to refine a candidate order, at additional query-time cost. It reorders only what a candidate generator returned, and its score measures resemblance rather than applicability.

D

DAgger (dataset aggregation)

An imitation-learning procedure that collects trajectories under successive learned policies, obtains reference actions at the states they visit, aggregates those labeled examples, and retrains. The result is on-policy data, which shifts training toward the states the learner itself reaches.

declassification

An authorized release of information otherwise restricted by confidentiality policy. The decision must identify the content or approved transformation, recipient, purpose, and task conditions; a redactor or validator does not acquire release authority by changing the representation.

decode

The phase of a model call that generates output one token at a time. For a single stream each step reads all of the model’s weights to produce one token, so decode is limited by memory bandwidth and its latency grows with output length.

dedicated capacity

A self-run deployment paid for whether its resources are busy or idle, in contrast to per-token API pricing. Its economics turn on how much of its capacity the workload keeps busy.

deep interface

An interface that hides substantial functionality behind a small contract, in contrast to a shallow interface that exposes nearly as much complexity as it implements. For tools, it lets one call perform one bounded operation rather than exposing intermediate handles and cleanup obligations.

deficit round-robin

A fair-sharing policy that keeps a queue and a credit counter per service class, adds a weight-proportional quantum each round, and admits work while its charge fits the remaining credit. Unspent credit carries forward so a larger request can eventually fit.

delegated worker

A unit of delegation that owns a bounded child trajectory with its own context, model-and-tool loop, task contract, and lifecycle. Parallel samples requested by one controller are calls inside one trajectory, not delegated workers.

dense retrieval

Retrieval that encodes a query and each searchable record as vectors with a learned model and ranks records by vector similarity. In a bi-encoder design records are encoded ahead of time, so new or changed records need new vectors and a changed encoder can require rebuilding the index.

dependency graph

In multi-agent coordination, the record of which results or decisions must precede others. It is drawn separately from the communication topology and the supervision tree.

derived record

A new record version produced by a transformation such as redaction, never an in-place edit. It carries its parent reference, the transformation policy and implementation versions, the affected fields or segments, and any intentionally unavailable content.

direct preference optimization (DPO)

A preference-training method that drops the separate reward model and reinforcement-learning stage, instead applying a logistic loss to the difference between the policy-to-reference log ratios of the preferred and rejected responses.

direct prompt injection

Prompt injection that arrives from the interacting user, as in goal-hijacking and prompt-leaking attacks. Contrast indirect prompt injection.

direct router

A routing policy that selects a model configuration before generation from available task features, in contrast to a cascade, which buys an initial attempt and uses its assessment to decide whether to escalate.

distributed tracing

Recording related units of work across component boundaries as spans connected by parent relationships and links, so observations from different components can be tied to one trial and its operations.

divergence point

The first observable mismatch under a declared comparison, such as between recorded and reconstructed state, between old and revised harness behavior on captured inputs, or between a recording and a new execution. The comparison must state its boundary and expected equivalence.

durable intent

The record of an admitted operation (its identity, arguments, authority, and reservation) acknowledged by storage that survives the declared failure domain before the request is dispatched.

dynamic spawning

Creating child assignments in response to observations during execution, with the model proposing each assignment and the runtime admitting it. The final task set, and so its cost, is known only afterward.

E

effective branching factor

The expected number of children per node that survive a step check. If each node proposes \(\SearchBranchingFactor\) children and each is rejected independently with probability \(\ChildPruningProbability\), it equals \(\SearchBranchingFactor(1-\ChildPruningProbability)\).

effective permission

For a user-delegated task, the intersection of the requester’s delegable rights, the task’s grant, and the applicable issuer and receiving-service policies, never the union of what user and service could each do.

egress control

Control of the channels through which executing code communicates outside its isolation envelope. It must constrain the actual communication path rather than rely on the code choosing a preferred client.

endorsement

An explicit decision under trusted policy that permits a value to serve a specified integrity-sensitive use. It supports only that use, not every claim carried with the value.

entropy collapse

The loss of diversity in task-relevant actions while tasks remain unsolved. Rollouts for a task become near-copies, their rewards tie, and the group stops supplying a gradient that could reveal a better path.

episodic memory

Stored records of specific events together with their time and conditions. In an agent it is the evidence beneath any semantic record derived from it.

escalation protocol

The set of guarded responses a semantic watchdog’s finding can select: bounded diagnostic continuation, controlled backtrack, or ending model-directed repair. Policy need not try them in order. It is distinct from the intervention ladder, which orders remedies for a measured failure by cost and reversibility.

escrow

The harness’s holding of an undispatched proposed call pending required approval or subsequent dispatch admission. The hold binds to the represented action and expires; approval permits dispatch only after current grant, budget, capacity, and applicable precondition checks. Denial, expiry, or a changed proposal does not authorize dispatch.

evaluation gym

An environment that provides a task’s interactive setting, controlled starting conditions, and interfaces for collecting evaluation evidence.

evaluation trial

One execution under a declared task, fixture, system configuration, and evaluation protocol. A second execution is another trial even when those inputs are unchanged, so repeating one task yields more trials of that task, not more tasks.

event sourcing

A pattern that reconstructs a system’s state by folding its recorded events with a deterministic reducer, without calling the model or executing tools again. Facts the log never recorded remain unknown in the reconstruction.

exact vector scan

Vector search that scores every vector in the eligible search set under the chosen metric. It is the reference for measuring what approximate search misses and a reasonable method when the eligible set is small.

example averaging

A loss normalization that assigns equal coefficients to each example’s mean loss over its selected targets. Context and padding tokens are never counted.

expected irreversible loss

The sum over a plan’s actions of the probability that the action is wrong, the consequence if it commits, and the fraction of that consequence compensation cannot recover, written \(\ExpectedIrreversibleLoss\). A check placed before a pivot action lowers it; a check placed after the pivot does not.

exploration

Sampling actions whose outcomes the policy has not yet learned to predict. Its reach caps what reward can teach: a task the policy never passes yields no reward contrast however many rollouts are spent.

exposure bias

The mismatch between training a sequential policy on reference prefixes and running it on prefixes produced by its own earlier outputs. It can expose decisions underrepresented in training and contribute to compounding errors; neither permanent divergence nor a particular growth rate follows from the mismatch alone.

external fragmentation

Free memory split into extents too small to satisfy a contiguous request, even though the total free capacity would suffice. Changing the allocation granularity cures it.

F

fail-plausible fault

A failure in which output appears well formed and credible while the intended property remains unsatisfied. It can evade fail-stop monitoring, and agreement among model samples does not establish correctness when they share systematic errors.

failure domain

The declared set of failures a runtime’s storage tolerates, such as a process crash with intact storage, replacement of a worker with access to the same durable volume, or permanent loss of that volume. Every durability claim is made against it.

false-accept share

The fraction of rewarded rollouts that fail the intended criterion. Because failures dominate on hard tasks, even a small false-accept rate can make this share large.

false acceptance rate

The probability that a check passes a candidate that does not satisfy the task specification. It names a checker error category, not permission to deploy.

false-block rate

Benign tasks prevented from completing by an erroneous policy refusal, under a rule fixed in advance, divided by all eligible benign tasks. Failures with other causes are counted separately.

false rejection rate

The probability that a check fails a candidate that does satisfy the task specification.

fencing token

An authenticated ownership generation that an enforcing resource compares with the newest generation it has seen, rejecting requests from older owners. Exclusion holds only at the boundaries that check the token.

finalization contract

A contract fixed before a commitment is accepted that names the work the runtime may attempt afterward, its reserved resources and deadline, and who receives the duties it cannot finish.

finalization reserve

A protected portion of a trajectory’s allowance that funds the declared final checks and cleanup and is withheld from exploration, so those duties remain funded when exploration stops.

fixed workflow

A control structure whose steps, branches, and tool calls are specified in advance, possibly with a model inside individual steps. It suits the predictable operations of a task, such as preparing a working copy and running designated checks.

forward recovery

Recovery that changes the present state or proposed action to restore a permitted path toward the task, also called rollforward. See also backward recovery.

foundation model

A model trained on broad data at scale and then adapted to a wide range of downstream tasks. Because one model serves many tasks, nothing in its training encodes a particular task’s permissions or acceptance criteria; those come from the system around it.

four-verdict rule

The rule for combining per-criterion verdicts of pass, fail, pending, and unknown: an established failure of any mandatory criterion makes the trial fail, the trial is accepted only when every required criterion passes, and otherwise it remains pending or unknown. Incomplete cases stay in the denominator under a declared rule.

full jitter

A retry backoff policy that computes a capped exponential interval and draws the actual delay uniformly between zero and that interval, which breaks the synchronization that identical delays preserve when requests fail together. The cap limits each delay, not the number of attempts.

G

grammar-constrained decoding

A decoding method that restricts next-token selection to tokens whose decoded text preserves a legal prefix of a specified output language. It can exclude structural errors only if the constraint covers the grammar and generation reaches an accepting state, and it says nothing about whether the output is appropriate or authorized.

grant

The authority a task currently holds, described abstractly as rights, objects, additional conditions, and expiry, \(\CapabilityGrant = (\GrantRights, \mathcal{O}_\CapabilityGrant, \GrantCondition, \GrantExpiryTime)\). Under the grant rule, permission for every tool call, reads included, comes only from the task’s current grants checked on each call; a well-formed proposal, forced tool choice, advertised description, or known handle never enlarges them.

greedy decoding

A selection rule that picks a maximum-scoring token at each step, which is deterministic given fixed logits and a fixed tie-breaking rule. A temperature-zero setting may expose it, but it is a separate rule rather than softmax with division by zero.

group barrier

A training schedule in which the trainer waits for every rollout of a step before updating, so step time is set by the slowest rollout and early finishers idle.

group commit

Letting several ready records share one durable acknowledgment. A coordinator gathers a batch, performs the storage operation the failure contract requires, and releases only the records covered by its successful acknowledgment, so each record keeps intent-before-dispatch ordering.

group-relative advantage

The coefficient GRPO attaches to every sampled token of a rollout: the rollout’s reward minus the mean reward of its task group, divided by the group’s reward dispersion.

group relative policy optimization (GRPO)

A policy-gradient method that scores each rollout relative to the other rollouts for the same task, using the group’s reward statistics in place of a learned value baseline. It drops the critic’s training cost and pays instead in rollouts per task.

grouped-query attention

An attention design in which several query heads share one key-value head, dividing the number of stored key-value heads by the group size relative to comparable multi-head attention. The reduction is fixed at training time. Multi-query attention is the limiting case of one key-value head shared by all query heads.

H

handle rule

The rule that material omitted from a request reaches a model call only through an explicit, permitted retrieval and only while the record is retained. A later decision that depends on omitted content must retrieve it before relying on it.

happened-before relation

Lamport’s partial order of events built from each process’s local order, message sends before their receipts, and the transitive closure of both. Events unrelated by it are concurrent.

hard negative

A response that looks adequate under a superficial assessment but fails a required one. Its difficulty lies in that plausibility, not in any irreversible effect.

harness regression replay

Running the harness code itself against captured inputs (model replies, tool observations, control events, clock values, identifiers, configuration) rather than folding its recorded decisions. Inputs the capture omits limit the comparison.

head-and-tail truncation

A capture policy that divides an observation’s byte budget among the first bytes of output, an omission notice, and the most recent bytes, keeping the tail in a fixed-size ring buffer. It preserves both the start of the output and the final diagnostics that explain an exit status.

head sampling

Choosing which detailed traces to retain near the start of execution, before outcomes are known. A random sample with known inclusion probabilities supports population estimates, but a rare failure may leave no retained example.

hedging

Starting a replacement attempt after a delay while the original still runs, then selecting the first admissible result. Mutating calls need a duplicate-effect contract before they can be hedged.

hermetic boundary

The specification of which dependencies an evaluation gym supplies or controls and which external interactions it excludes. It fixes the declared conditions; a stochastic environment qualifies once its variation is declared, and it promises neither identical model responses nor complete production fidelity.

hierarchical navigable small-world (HNSW)

An approximate nearest-neighbor index that organizes vectors as a layered proximity graph, with every vector in the bottom layer and geometrically smaller subsets above. A query descends greedily from the top layer, then runs a beam search at the bottom whose width is the query-time recall knob.

horizon compounding

The decay of task success with the number of turns when every turn must be correct: with independent, unrecovered errors at per-turn error rate \(\PerStepErrorRate\) over \(\TurnHorizon\) turns, success probability is \((1-\PerStepErrorRate)^{\TurnHorizon}\). Correlated errors, changing step risks, and recovery require a model of the resulting trajectory rather than this product alone.

H·S·A exposure space

The three-dimensional description of how far a delegated task departs from a single model call: its horizon \(\TurnHorizon\) in sequential turns, the state \(\StateExposureLevel_0\) to \(\StateExposureLevel_3\) it carries between calls, and the authority \(\AuthorityExposureLevel_0\) to \(\AuthorityExposureLevel_3\) it holds over its environment. Closure, the runtime’s response, is not a fourth axis.

hybrid retrieval

Retrieval that uses more than one matching method, such as lexical and dense retrieval, to generate candidates. Before lists are combined, candidate identity is fixed by tenant scope, source path, version, and span so that different versions or tenants never merge.

I

idempotency key

An identifier for an intended operation, retained across its attempts. Preventing duplicate effects requires an endpoint contract binding that identity to the request, effect, and retained result; the identifier alone does not provide the guarantee.

idempotent action

An operation whose repeated application has the same specified state effect as one application, \(\StateOperation(\StateOperation(\ToolTargetState)) = \StateOperation(\ToolTargetState)\). Retry safety also depends on the operation’s scope, concurrent changes, authority, and other effects or costs excluded from that state model.

imitation material

Demonstrations or selected target-bearing segments whose behavior is worth learning under the supplied context. A record can keep a mistake as history while selecting only the later correction as a target.

in-doubt action

An admitted operation whose outcome the surviving evidence cannot settle. It records uncertainty, not failure, and stays open until evidence or an enforced endpoint contract settles it.

incident containment

A disposition that restricts further activity and use of potentially affected artifacts while preserving evidence and responsibility for effects already admitted. It is layered on the existing trajectory states rather than being a new state.

indirect prompt injection

Prompt injection delivered through an observation, such as a document, repository file, search result, email, or tool response, that the agent reads while performing a task for someone else. Model-side defenses lower its probability; only enforcement below the model bounds its damage.

inference service

The component that evaluates the model, applies supported generation settings, and reports the response and the invocation outcome. It is distinct from the model, which computes a distribution over continuations, and from the runtime, which decides what to do with the returned candidate.

information-flow policy

A runtime-enforced rule set that attaches integrity provenance and confidentiality labels to every record, propagates them through each transformation, and admits an operation only if its data may reach the operation’s recipient and its influences are acceptable for the operation’s use.

informative-task fraction

The probability that \(\IndependentAttemptCount\) independent attempts at a fixture, each succeeding with probability \(\AttemptPassProbability\), include at least one success and at least one failure, \(1-(1-\AttemptPassProbability)^\IndependentAttemptCount-\AttemptPassProbability^\IndependentAttemptCount\). Only such groups carry signal for a comparison or a group-relative objective.

inspection handle

A reference to a separately stored captured log that permits bounded reads of specified ranges, subject to current access checks and payload budgets, without rerunning the original call.

integrity

The security property that governs which sources and checks may justify a consequential use of information. It varies independently of confidentiality.

internal fragmentation

Unused capacity inside an allocated reservation, such as slots in a KV buffer that the request never fills. Releasing slack cures it.

intervention ladder

The default order for remedying a measured agent failure, ranked by cost and reversibility: context, then tool and schema, then runtime, then supervised fine-tuning, then reinforcement learning. A demonstrated capability gap can justify moving directly to training; weight changes still require evidence of improvement, and runtime enforcement remains mandatory.

invariant closure principle

The principle that an agent’s safety and resource bounds must be enforced mechanically by the runtime below the model, and its task correctness established by evidence collected at the end-to-end boundary above it, never by the model’s own compliance or self-report.

inverted index

A lexical search structure that maps each indexed term to a postings list of the documents containing it, optionally with term frequency and positions. Its analyzer decides what counts as a term, so a ranked match on an analyzed identifier can differ from an exact match on the original string.

isolation envelope

The enforced boundary around executing code, specified by the resources it exposes, the components it shares with the host or other workloads, and the mechanisms that restrict access and consumption. Shared-kernel containers, user-space kernels, microVMs, and bytecode sandboxes are the common envelopes.

J

job handle

A model-visible reference to a long-running job’s runtime record that does not expose the executor’s internal process-management interface. Status reads, output inspection, input, and cancellation through it each require their own authorization, and its presence in an acknowledgment does not establish that the effect occurred or completed.

K

Kingman approximation

An estimate of the mean waiting time before service at a single first-come-first-served server, proportional to the average squared coefficients of variation of interarrival and service times and to \(\ServingUtilization/(1-\ServingUtilization)\) times mean service time.

KV cache

The per-sequence store of attention keys and values the model has computed for already processed tokens, retained so that later tokens can attend to them without recomputing their projections. Its size grows linearly with context length, so a trajectory that pauses must keep, move, or drop it.

KV pool

The accelerator memory left for KV state after the model weights and a runtime reserve.

L

layered filesystem

A filesystem that presents a merged view of a read-only lower tree and a private upper tree holding additions and replacements. Deleting a lower-layer name writes a marker that hides it (a whiteout in Linux OverlayFS) rather than deleting the shared original.

leaf-first eviction

A radix prefix cache eviction policy that retains complete paths from the root and evicts unused leaves first, so shared ancestors stay available to other requests. An ancestor becomes eligible only once no retained descendant needs it.

length bias

The pressure created by normalizing a rollout’s coefficient by its token count, which reinforces each token of a short success more and penalizes each token of a long failure less, so it favors short successes and long failures.

lighthouse workload

One of the four recurring workloads (the repair, research, remediation, and support agents) chosen because a different exposure binds each one. The repair agent is the running example; the other three return wherever it cannot exercise a chapter’s constraint.

lineage envelope

The record of the origin, dependencies, transformations, and decisions of one record version. Its values can be references to protected, versioned artifacts rather than copies of private content.

linearizability

A correctness condition under which each completed operation appears to take effect at one point between its invocation and response, consistent with the object’s sequential specification and with real-time order of nonoverlapping operations.

Little’s law

The identity \(\RequestConcurrency = \ArrivalRate\,\RequestTimeInSystem\) for any stable system in which items arrive, reside, and leave: mean occupancy equals throughput times mean residence, whatever the arrival pattern, service order, or residence distribution. Residence counts every phase in which an item holds its slot, including waits.

live plan

A dependency-ordered list of a trajectory’s steps, kept by the harness, that distinguishes proposed work from work already started and evidence already obtained. Each step records its prerequisites, the candidate it applies to, and a status linked to operation-table entries or supporting evidence rather than to model output.

LLM judge

A language model used to score criteria that need judgment rather than an exact test, under a rubric. The evaluation contract states whether its verdict is a required criterion, a signal for human review, or a diagnostic score, and a favorable judgment cannot override another criterion’s failure.

local repair

The narrowest revision tier: replacing one artifact while preserving what its dependents rely on, so the dependency graph is unchanged. See also subgraph resynthesis.

log compaction

Retiring an older prefix of a trajectory log once a newer published checkpoint preserves the selected state and every dependency the current recovery contract requires, including unresolved operations. It is safe only after the checkpoint is durable within the failure domain and no retained replay or other obligation still needs the older material.

logit

The unnormalized score a model produces for each token in its vocabulary at an output position. Softmax converts logits into next-token probabilities.

loss dilution

The reduction in each selected target’s weight when observation tokens are unmasked under token averaging, which shifts loss weight to text such as paths, identifiers, and log lines that no policy could predict.

lost in the middle

The position sensitivity of long-context models in which relevant information placed in the middle of the input is often used less reliably than the same information near the beginning or end. Its size and location vary with the model and task, so placement is tested on the intended workload.

lost update

A hazard in which two workers read the same state and write in turn, so the later write silently replaces the earlier one even though each write is valid.

low-rank adaptation (LoRA)

A parameter-efficient method that expresses the change to a selected frozen weight matrix as the scaled product of two trainable low-rank factors. With one factor initialized to zero, training begins from the base model’s exact forward mapping.

M

makespan

The elapsed time from a task’s start to its last required completion. It counts only the work and waits on the path to completion.

marginal stopping

A stopping rule that compares the estimated benefit of the next admissible action with its additional cost. The benefit estimate must be calibrated on comparable held-out tasks or on progress signals whose predictive value has been tested.

matching-request rule

The rule that a recorded response may be replayed only while the request, arguments, versions, and ordering match the recording. For a changed request, the evaluator must supply behavior valid for the changed path or report the fixture’s unsupported interaction.

McNemar’s test

A paired test of whether two systems’ pass probabilities on the same tasks are equal. It uses only the discordant pairs, in which one system passes and the other fails; under the null hypothesis each discordant pair favors either system with probability one half.

memory admission

The runtime’s check on a proposed memory write of the destination and writer’s permission, the allowed retention scope, the record type, and whether the attached evidence supports the proposed wording. Unsupported interpretations enter, if at all, only as marked hypotheses.

memory consolidation

Combining related stored records into a smaller representation for later use, such as a concise account of what several sessions investigated and left unresolved. Similarity locates candidates for consolidation, but whether records share a cause needs evidence.

memory expiration

Ending a stored record’s eligibility for a specified use after a deadline or condition, so that it must be reconfirmed before applying again. Lowering its retrieval score is not expiration, and the payload may remain for authorized historical use.

memory write policy

The runtime’s rule for which proposed records enter durable memory, as what kind of claim and under what scope, and how each admitted record and its derived copies are later corrected, superseded, revalidated, expired, or deleted.

microVM

An isolation envelope that places a guest kernel and its applications behind a hardware-virtualization boundary managed by a virtual machine monitor. Application system calls reach the guest kernel, and protection depends on the monitor, hypervisor, hardware, and exposed device and host-service interfaces.

model cascade

A routing design that tries one model configuration and, based on the assessment of that attempt, conditionally escalates to another. Its value depends on what the lower tiers resolve, what their failures cost, and which tasks remain for later tiers.

Model Context Protocol (MCP)

A protocol through which tool servers advertise tools and their schemas to an agent runtime and receive calls. Discovering a tool through it does not authorize the tool; the runtime’s grant does.

model-directed loop

A design in which the model chooses the next step from the latest observations, so two runs of the same task may take different paths. It is useful at decision points whose next step depends on evidence unavailable at the start, when its measured benefit justifies the added calls and uncertainty.

model invocation contract

The pair of records that bounds one model call: a request fixing the input, model configuration, sampling settings, and enforced output and time limits, and a normalized envelope reporting the call’s status, payload, and resource use.

Monte Carlo tree search

A tree search that maintains visit counts and estimated returns for partial candidates and uses them to decide which branch receives the next extension or rollout.

multi-hop retrieval

Retrieval that follows relationships among evidence items, such as from a test to the code it exercises, assembling an explanation that no single item’s query score supplies.

N

negative scope

The part of a task contract’s goal that names the behavior the task must leave unchanged, such as everything outside a reported defect.

nominal context capacity

How much input the configured model interface accepts, subject to its input and generation limits. It says whether a request is admitted, not how well the model uses what the request contains. See also usable working context.

noninferiority

The claim that a candidate is worse than a baseline by no more than a declared tolerance. Establishing it requires an interval for the difference itself, not only a test of equality.

noninterference

The property that nothing one group of users does has any effect on what another group can observe. It belongs to the whole system rather than to any single check.

normalized status envelope

The runtime’s record of an invocation’s observed outcome: a normalized status, the returned payload (possibly absent or partial), and metadata such as the raw stop reason, reported usage, and request identity. Missing usage is recorded as unknown, not as zero.

O

observation binding

The record attached to a staged observation naming the artifact observed, its kind, the revision at which it was observed, the range or symbol read, and an identifier for the content read. Bindings and the edges from derived entries to their observations form the dependency graph over which invalidation propagates.

observation capture

The resource boundary on a tool’s return path that limits the bytes, memory, storage, and time spent receiving output. It is distinct from context staging, which limits what the next model call receives.

observation crossing

The error of inserting a late result into an obsolete turn as though it had been available when the model made its next decision. It confuses the history of an operation with the evidence admitted to a particular continuation.

observation eligibility

The permission for a tool response to enter the current continuation’s next model context. A call can lose eligibility, through timeout, pause, cancellation, or plan revision, while its external outcome remains unresolved and its operation stays in the operation table.

observation loss masking

Excluding supplied observations from direct token-prediction loss while retaining the permitted context needed to train selected policy responses. Policy authorship alone does not make a token a desired target, and masked context can still affect gradients through later predictions.

on-policy data

Training examples drawn from the state distribution of the policy being trained.

opaque handle

A runtime-issued, typed reference to stored bytes that a tool argument can name without the bytes entering model context. The data’s restrictions travel with the handle, and resolving it must apply the same release policy as the bytes themselves.

operation ID

An identifier for one intended effect, preserved across the transport attempts that carry it, while each request and reply pair has its own attempt ID. A deliberately repeated request needs a new operation ID even when its arguments are identical.

operation table

The part of the trajectory record that retains each logical operation’s identity, its transport attempts, the evidence received for it, and the component responsible for settling it. Withdrawing a call’s observation eligibility does not remove its entry.

optimistic concurrency control (OCC)

A concurrency scheme that lets work proceed privately and validates the conditions required for publication afterward. It exposes parallelism at the price of revalidation and discarded work.

orphaned resource

A resource that is allocated and billed with no owner, typically because a delayed creation arrived after its operation was closed on an empty lookup.

outbox

A durable collection of requests awaiting delivery. Recording an outcome and inserting its notification into the outbox in one local transaction keeps a crash from preserving the outcome while losing the notification obligation.

outcome check

A check that assesses a completed candidate against a criterion, such as whether a repaired service passes a regression test.

outcome reward model

A learned model that predicts a score for a completed candidate, as trained verifiers do when ranking sampled solutions. It assigns feedback to the outcome, though it may inspect the full reasoning trajectory as well as the final answer.

output headroom

The generation allowance reserved within the context window for a call’s output. A request is admissible only if its represented input plus this reserve fits in the window.

outstanding liability

The reserved amount still backing unsettled operations at a reporting cutoff. Reports separate it from settled spending, which is only a floor on the task’s price.

P

paged KV block table

A per-sequence software mapping from logical token blocks to the physical KV blocks that store their key and value entries, so a sequence can grow by acquiring another block without relocating its existing blocks.

parameter-efficient fine-tuning

Fine-tuning that freezes the base model and trains a small added parameter set, an adapter, released alongside it.

parametric recall error

The fraction of proposed tool calls that use an argument name from the training schemas that the current schema does not contain, a sign the model recalled an interface instead of following the delivered one.

Pareto improvement

A change in which at least one component of an oriented metric vector improves and none worsens. It is a stronger progress condition than counting any single improved metric.

pass@\(\IndependentAttemptCount\)

The probability that at least one of \(\IndependentAttemptCount\) runs of the same task passes a specified criterion, averaged over the stated task distribution. It measures candidate availability; the deployed selector may fail to return the passing candidate. The usual formula assumes independent, identically distributed runs conditional on the task.

pass\(^\IndependentAttemptCount\)

The probability that all \(\IndependentAttemptCount\) runs of the same task pass a specified criterion, averaged over the stated task distribution. Under conditionally independent runs it measures same-task consistency, which differs from all-success probability across independently drawn new tasks.

paused-state policy

The serving system’s choice of what to do with a request’s attention state while its trajectory waits, for example on a tool: keep it on the accelerator, move it elsewhere, or drop it and reconstruct it when needed. It trades accelerator capacity against storage, transfer, and recomputation at resumption.

pessimistic lease

Ownership of a resource acquired before a worker acts, so a conflicting worker waits instead of discarding work, at the price of serializing every holder. It suits resources whose effects cannot be branched and discarded.

phantom effect

An external effect with no recoverable intent under the runtime’s declared failure model. Preventing it requires recording intent before dispatch and storage that survives the failures the design claims to tolerate.

pipe deadlock

A circular wait between two bounded pipes, as when a host and child process each block writing to a full pipe while waiting for the other to read. The fix is structural: service reads and writes from one readiness loop, or dedicate a reader to each output channel.

pivot action

The designated commitment in a bounded region of a plan after which restoring the region’s precommitment conditions is no longer an available recovery strategy. Required approval and current admission checks precede its dispatch, and follow-up duties can remain afterward.

policy

A distribution over the model’s next response given the interaction history delivered through that decision, with trainable parameters. It acts only through the constructed model input, not through direct access to the full environment state.

policy distillation

Training that transfers behavior from a teacher configuration into a student, usually to make that behavior cheaper at deployment. The teacher can differ in model, prompt, or search budget, and its outputs pass the same target admission as any other candidate.

policy staleness

The gap between the policy version that sampled a record and the version that learns from it, which arises when collection and training overlap.

preference comparison

Compatible alternatives placed under a common context with a justified preference attached. Two runs form a valid pair only when their starting information, available actions, and criterion coverage match, and a failure takes the rejected slot only when its assessment says what was wrong.

prefill

The phase of a model call that processes the prompt. All prompt tokens share one read of the weights, so prefill is limited by arithmetic and costs far less time per token than decode.

prefill-decode disaggregation

Assigning the prefill and decode phases of requests to different workers so that each phase’s resources and parallelism can be chosen separately. It requires handing attention state from the prefill worker to the decode worker, and it composes with chunked prefill.

prefix cache

The serving system’s index of retained KV state, keyed by exact token prefix and computation configuration, from which a later request with the same beginning attaches state instead of prefilling it. The saving recurs at every turn whose prefix survives, and a hit confirms matching tokens and configuration, not that the information they encode is current.

prefix-cache timing channel

A side channel opened when a service permits prefix-cache reuse across security domains: an attacker who submits candidate prefixes and observes response timing learns which matching state is resident, without the model following any instruction.

prefix hit rate

The token-weighted fraction of prompt tokens, over a specified set of requests, whose compatible KV state is actually reused rather than recomputed, after availability, permission, and block-boundary restrictions. Potential token matches overstate it.

premature fine-tuning

Fine-tuning a model to compensate for a defect, such as a missing fact or an ambiguous schema, that a cheaper intervention would remove. It spends the most expensive remedy on the intervention ladder where a lower rung suffices.

probability ratio

The probability the current policy assigns to a recorded token divided by the probability the behavior policy assigned to it at the same delivered prefix, both under the declared sampling convention.

process group

On a POSIX host, the set of processes that one signal to the group reaches. Giving a job its own process group lets cancellation signal the descendants that remain in that group; detached processes need a separate containment mechanism.

process reward model (PRM)

A learned scorer that assigns a value to each intermediate step of a candidate trajectory, conditioned on the task and the preceding steps. Its step scores let search prune a branch before it spends a full candidate’s budget, and a low score is fallible evidence.

process supervision

Assigning feedback to intermediate reasoning steps rather than to final outcomes. See also process reward model (PRM).

product quantization

A vector compression method that splits each vector’s dimensions into subvectors and stores each subvector as the one-byte index of its nearest centroid in a per-subspace codebook. Queries stay in full precision and compute approximate distances from a precomputed lookup table; combined with coarse partitioning into cells it forms IVF-PQ.

prompt injection

Attacker-controlled content that attempts to redirect the model’s behavior away from the authorized task. Its entry point decides how much authority it can reach.

proposal

Model output that names an action or an answer the runtime may adopt. It carries no effect and no authority until the runtime validates, authorizes, and executes it.

protected field

A field that a compaction pass must retain, checked against the source before the working context is replaced, such as tested artifact identities, the failed assertion, check status, and task constraints.

proximal policy optimization (PPO)

A policy-gradient method that learns a value function, shared with the policy or held in a separate critic, as its baseline and uses a clipped surrogate objective to limit the incentive for probability-ratio changes. It can use either an external check or a learned reward model.

Q

quarantined reader

A model invocation with a separate input context and a restricted result contract that extracts from selected untrusted material without authority to execute its instructions. The planner receives the admitted extraction rather than the raw material, and the runtime still authorizes every proposed action.

quarantining rule

The rule that a payload whose invocation status is anything other than completed may not be released as a completed candidate for action or task acceptance. The runtime may keep the fragment for diagnosis, but inspection cannot authorize it or reclassify it as complete.

R

radix prefix cache

A prefix cache that indexes token sequences with a compressed prefix tree whose edges may span several tokens. Following matching edges from the root finds the longest cached prefix and its KV storage, so a new request processes only the remaining tokens.

raw-payload handle

A reference to a retained record, such as a full test log, that an authorized tool can fetch subject to retention, permissions, and tool access. It places a route to the record in the model’s input rather than the record’s contents.

read-your-writes consistency

A session guarantee under which a reader always observes its own earlier writes, for example by having a query carry the minimum log position a replica must have applied before answering.

reasoning budget

A limit, set in the call surface, on how many tokens a reasoning model may spend thinking before it answers.

reasoning model

A model trained with reinforcement learning on tasks whose answers can be checked, so that it produces long intermediate traces that propose, check, and backtrack within one generation. Its reasoning tokens are metered output tokens, and it cannot observe results of checks it never ran.

reciprocal rank fusion (RRF)

A method for combining ranked retrieval lists by summing \(1/(\RankFusionSmoothingConstant+\FusionInputRank)\) over lists containing an item, where \(\FusionInputRank\) is its one-based rank and \(\RankFusionSmoothingConstant>0\) is a smoothing parameter. Absence from a truncated list contributes zero. Fusion avoids directly combining incompatible raw scores; it does not establish the relevance or correctness of the result.

reconciliation

An authorized, bounded query about the effect of an operation whose outcome is uncertain, used to settle it when the endpoint lacks a usable deduplication contract. An operation-specific receipt is stronger evidence than an observation that the desired state currently holds, since another actor may have produced that state.

recovery demonstration

A curated record or selected segment that pairs evidence of a mistake, fault, or incomplete observation with a response assessed as appropriate under the task’s criteria and current authority. The response may diagnose, correct, wait, or hand off; admission does not endorse every recorded action or require completion of the original task.

reference monitor

The enforcement component through which every access to a protected resource passes; it must be tamper-proof, always invoked, and small enough to verify. In an agent runtime, the host’s validation and authorization path is the reference monitor for proposed tool calls.

reference policy

A frozen policy, usually the starting checkpoint, used as a regularizer that penalizes drift away from it. It is distinct from the behavior policy that generated the current rollouts.

reinforcement learning with verifiable rewards (RLVR)

Policy optimization using rewards computed by automated checks of specified properties of outputs or interactions, such as tests or proof checkers. An automated verdict is evidence about its checked property, not a complete specification of task success or a substitute for runtime enforcement.

rejection-sampling fine-tuning

Fine-tuning on sampled outputs selected because they pass a check. The check selects an output under its criterion; which intermediate steps deserve imitation still requires target review.

repair episode

The unit a runtime bounds when repairing a failure: it has an identity, the task and candidate versions it concerns, an attempt counter, and an explicit allowance. The counter increments at admission rather than on success, so failed or interrupted work cannot escape the limit.

replay

Execution against recorded inputs at a stated boundary with live effects disabled. Folding recorded decisions reconstructs a projection; rerunning harness logic against captured inputs tests its behavior and can reveal differences or capture limits.

request compression ratio

The serialized token count of a reference request built from the available history without compaction, divided by that of the request an evaluated policy builds, with both counted with the same tokenizer. It is a representation ratio, not a quality metric.

required-field retention

An audit metric for compacted context: the number of required items represented correctly, in value and scope, divided by the number of required items assessed. The mere presence of a field with the right name does not count.

reset contract

A statement of the conditions under which an execution environment may serve a new lease and the state a reset must cover. That state extends beyond the workspace directory to background processes, open connections, modified runtime state, and pending work in host services.

residency tax

The factor \(1 + \ToolTime/\ModelTime\) by which a retained tool wait divides the memory-bound rate of turns, since a kept KV slot is paid for over the whole wait as well as generation. The ratio of wait to generation, not the wait alone, decides whether keeping state is affordable.

resident-fit bound

The number of sequences whose KV payload fits in the KV pool at once.

resource footprint

The declared set of state that one tool call reads and writes. If neither of two calls writes anything the other reads or writes, the pair can be dispatched concurrently, but only as far as the declarations are trustworthy; shared state a footprint omits voids the condition.

restart intensity

A bound on the number of child restarts within a declared window, beyond which a repeatedly failing child becomes an escalated failure of its supervisor rather than an unbounded retry loop.

resume

The protocol for continuing a trajectory after interruption: establish current ownership, reconstruct compatible state from available authoritative history and artifacts, account for outstanding operations and charges, and recheck authority and dependencies before admitting new work.

retrieval-augmented generation (RAG)

The pattern of supplying retrieved external material with a model request. In pre-staged use the runtime retrieves before the call; contrast agentic retrieval, in which the model issues searches during the loop.

retrieval contract

The specification of a read from durable storage: the information requested, the permitted scope and resource limits of the read, and the provenance, applicability, and completion information returned with its results. It makes a bounded result interpretable before it enters a model call, so an empty or truncated response is not mistaken for absence.

return

The total reward a rollout accumulates; with only a terminal score and no discounting, it equals that score. The learning objective is its expectation under the policy.

revalidation

Obtaining fresh evidence that a stored record still applies. Retrieving or using a record is not reconfirmation, so creation, last access, and last confirmation times are kept as separate fields.

revisable candidate plan

A record of proposed work and the evidence supporting each part, not of operations already performed, so the runtime can regenerate only the parts whose support has changed. Revised parts still face the same checks.

reward

A numerical signal assigned to a rollout under a stated rule. In the simplest case it is a single terminal score with no intermediate rewards.

reward hacking

A policy raising its measured reward through behavior that does not accomplish the task the reward was meant to measure, by exploiting gaps in what the reward checks or by reaching and altering the mechanism that computes it.

role confusion

A failure in which a model trained to predict the text that follows a tool call continues past its own call with an invented result instead of yielding the turn. The runtime rejects such a turn, because generated text is model output rather than an observation.

rollout

One sampled trajectory recorded under identified task, policy, environment, and harness conditions. Each fresh rollout needs its own candidate and assessment records.

rollout fixture

A versioned task, paired with a grading specification, that supplies fresh interactions during reward-based learning. The grading specification states what the reward measures.

rollout reset

Restoring a fixture’s declared initial conditions before a new rollout, which can include processes, cached files, service state, credentials, and pending external operations, not merely an empty directory. A local snapshot restores only local state.

runaway retry loop

A trajectory that keeps proposing well-formed variants and diagnostics after failures, passing every per-call limit and fair-share check while consuming resources without moving the task toward acceptance. Only a bound on the whole trajectory, enforced outside the model, guarantees that it ends.

runtime

The deterministic software around the model, often called the harness, that decides whether each proposed action is permitted and dispatches it through a tool. Permission stays with the runtime; generating the name of an operation grants the model nothing.

S

saga

A structure for long-lived transactions that gives up isolation across the whole sequence, commits each step separately, and pairs each step with a compensating step.

satisficing

A stopping objective that seeks the first result meeting stated acceptance criteria and stops searching once a candidate meets the required evidence standard and any approval conditions.

scheduling charge

The declared unit a fair scheduler deducts when it admits a model call. A conservative form charges the call’s full input-token count plus its allowed output-token count, measuring admitted token allowance rather than actual output, cost, or task value.

schema augmentation

Creating related training examples under declared interface changes, updating everything needed to keep each target valid in its new context. Each result is a derived example whose lineage and use are reviewed.

schema-following accuracy

The fraction of proposed tool calls that name a declared tool and whose keys and value types satisfy that tool’s current schema.

scope rule

The rule that an observation or record supports claims only about the artifact versions and conditions it recorded, and no broader one. Every later transformation, such as compaction, summarization, or invalidation, must preserve it.

sealed test

A test whose protected contents and execution are outside the candidate’s permitted access. This protection limits direct inspection or modification but does not establish complete task coverage, grader correctness, or statistical independence.

self-consistency

Selecting among sampled candidates by majority vote over their final answers. It works when answers are short and comparable and fails when candidates share the same error.

semantic compensation

A new operation intended to establish declared application postconditions after an earlier effect. Its success requires scoped outcome evidence; it need not restore prior history, charges, or every observed state, and it can leave residual duties.

semantic memory

Stored generalizations abstracted from specific events. In an agent the semantic record is always derived, and its support is the episodic record beneath it.

semantic watchdog

A runtime policy that uses task-relevant observations, such as repeated captured state, stagnant verification results, or repeated actions and outcomes, to flag possible nonprogress and choose a bounded intervention. Its signals are fallible evidence; what the runtime enforces is the hold on further work.

sequence packing

Placing variable-length training examples in shared buffers while preserving their intended attention boundaries, position conventions, prediction targets, and loss aggregation. Reduced padding does not by itself establish equivalent predictions or a particular speedup.

sequential probability ratio test (SPRT)

A sequential test that accumulates a log-likelihood ratio between two specified hypotheses as outcomes arrive and stops when the ratio crosses one of two declared boundaries. Declaring this use of accumulating evidence in advance avoids the inflated false-positive rate of repeatedly applying a fixed-sample test.

service principal

An identity for the automation service itself, as distinct from a user on whose behalf it may act. Either kind of identity can carry narrow or broad permissions.

settlement

Establishing an uncertain operation’s effect status from evidence or an enforced endpoint contract. If the available checks cannot resolve it, the runtime preserves the unknown outcome and withholds unsafe repetition rather than treating a key or probe as proof.

settlement identity

The durable key under which one final charge is recorded in the budget account, so repeated delivery of the same usage evidence updates the account at most once. A reused identity with a different amount is a reconciliation fault.

shadow execution

A release stage that tests a candidate against authorized copies of current inputs without assigning it the live task. See also canary release.

shared blackboard

A coordination arrangement in which workers claim tasks and publish versioned artifacts through a shared store, so coordination moves into shared task and artifact state. It still requires enforcing claim ownership, publication rules, and dependency validity.

shared-kernel container

An isolation envelope that confines host processes with configured operating-system controls: namespaces restrict views, access controls and system-call filters restrict operations, and resource controllers bound consumption. The host kernel still handles permitted calls, so it is only as strong as that kernel and its configuration.

sharing domain

The set of callers permitted to benefit from one another’s cached prefixes. Restricting reuse to it closes cross-domain prefix-cache timing channels, at the cost of fewer reuse opportunities.

shingle

A local feature used to compare records for near-duplicates, such as a short token sequence or a bounded subtree of parsed code.

source generation

A version identity for a source’s state, assigned under the source’s update contract and stronger than a filesystem modification timestamp. Derived index entries record the generation they came from, so current-state queries can reject entries from superseded generations.

source of record

The designated evidence source against which a particular claim is checked, such as a repository for a file’s contents at a revision or a recorded user statement for that user’s preference. The designation fixes where a claim is checked and confers no authority or permission.

span (tracing)

A record of one observed operation, with an identity, start and end boundaries, attributes, and optional timed events. Parent relationships express nesting, and links connect asynchronous work that does not fit one nested lifetime.

specification boundary

The distinction between proposing a task contract and adopting it as binding. Models can assist requirements, designs, and tests; authorized principals adopt goals, grants, acceptance criteria, and revisions, and own the residual duties after acceptance.

speculative decoding

A serving method that uses draft proposals and a target-model acceptance rule. Distribution-preserving variants retain the target distribution under their algorithmic assumptions; net latency and cost depend on accepted prefixes, verification work, batching, and load.

spending alarm

A retrospective monitor on the charge rate over a trailing window. It can trigger investigation or a hold on new work, but the spending it measures has already happened.

split leakage

Information about an evaluation target reaching training through a related record, such as another solution to the same underlying task placed on the training side of a split.

stale-policy window

The interval, under cached authorization, in which a newly revoked grant may still be accepted. Its bound must cover cache age, renewal, expiry, and clock assumptions and must hold through a partition.

stale-return rate

The fraction of evaluated current-state queries that return any record made inapplicable by a relevant source change, with historical queries reported separately. An empty response scores zero, so the rate is always reported beside evidence coverage.

stale-support rate

The fraction of decisions requiring current evidence that treat superseded support as current. A historical reference to an older state is not an error; using it to assert a property of the current state without support is.

standby reserve

A pool of clean, unassigned execution instances, also called a warm pool. Admission consumes one and binds it to a task; provisioning replenishes it, and an ended lease rejoins only after its reset contract is satisfied.

state-delta verification

Checking specified properties of an observed change between declared initial and resulting environment states, using measurements tied to the relevant versions and task criteria. It distinguishes a claimed repair from an observed change that meets the selected checks.

stateless cursor

A pagination token that carries its own position, such as a query digest, last key returned, and issue time, together with a message authentication code only the tool can produce. Abandoning it costs the server nothing, at the price of reading current rather than snapshot data and a longer token.

static plan

A plan that declares its possible stages and dependencies, including conditional branches and bounded retries, before execution, so its handoffs are inspectable and a worst-case resource bound can follow.

static reservation

A KV allocation policy that reserves a contiguous buffer for the configured token cap when a request is admitted. The request grows without reallocating, but the unused remainder stays unavailable to every other request for as long as the reservation lives.

stochastic computer

The single map, drawn once in the introduction, that relates the parts of an agentic system to the parts of a computer: the model to a processor, context and stores to memory, tools to input and output, the runtime to an operating system. It is a map for orientation, not a mechanism.

stop reason

The service’s report, retained in a model response, of why generation yielded control, such as a finished turn, emitted tool calls, the output limit, or a stop sequence. The runtime keeps it as raw evidence alongside the normalized status it derives.

storage invalidation

The exclusion of a derived record, such as an index entry, vector, summary, or cached result, from current-state retrieval once a relevant change to its source makes it inapplicable, independent of when a replacement is built.

streaming

Delivery of response content before generation finishes. A delivery chunk may carry part of a token, several tokens, or a protocol event, so a runtime follows the service’s framing contract rather than equating chunks with tokens.

streaming cancellation

A harness request that asks the serving service to stop generating a reply in progress, closes the invocation’s eligibility to produce an actionable candidate, and retains partial content only for bounded diagnosis. A canceled or truncated payload cannot become a dispatchable call.

structural retrieval

Retrieval over program structure rather than text, distinguishing an enclosing function, a declaration, and an identifier used in an expression. A parser supplies the syntax tree and source spans, and symbol resolution or further analysis adds relationships between definitions and references.

structured progress record

A continuation record that preserves a trajectory’s state in named fields, such as current task requirements, relevant observations, hypotheses, artifact identities, and unfinished work, so the next call can continue after the detailed history leaves the prompt. It is not an execution checkpoint.

subgraph resynthesis

A revision tier that replaces an artifact and all its descendants, asking the model to bridge from the still-supported frontier to the downstream requirements that remain unchanged.

supersession

Replacing a stored record with a new version for the same subject and scope while marking the old version superseded, which ends its eligibility for current decisions but keeps it as history.

supervised fine-tuning (SFT)

Adjusting trainable model parameters to increase the likelihood of selected target tokens under their supplied prefixes. Training an agent this way inherits both a target-selection contract and a conditioning contract.

supervision tree

The structure that assigns responsibility for child lifetimes and outstanding work among agents.

supervisor-worker topology

A coordination arrangement, also called orchestrator-worker, in which one coordinator decomposes the task, dispatches children, and integrates their receipts.

system-call tax

The per-call cost an isolation envelope adds to a mediated system call, up to three terms: crossing a privilege boundary, checking or emulating the request, and handing control to another thread or process.

T

tail sampling

Choosing which detailed traces to retain using evidence accumulated later, such as a failed acceptance check or an unusually costly run. It concentrates diagnostic storage on important cases, so the retained collection is deliberately unrepresentative of ordinary traffic.

tail waste

The uninitialized slots in a sequence’s final KV block. With \(\KvBlockSize\) tokens per block it ranges from zero to \(\KvBlockSize-1\), and a length divisible by \(\KvBlockSize\) wastes nothing.

taint tracking

Runtime tracking of data origins and dependencies through transformations, used to enforce policy at later uses. Integrity provenance and confidentiality answer different questions; through a model, conservative propagation records a policy assumption rather than proven semantic causation.

task account

The account of an initiated task that includes all its attempts and delegated branches once, plus its share of capacity and operations costs. Failed or canceled branches stay in the account after their output is discarded.

task contract

The five-part specification of a delegated task: its goal with negative scope, the environment, the permitted actions, the available observations, and the completion criteria at a stated evidence level.

task fixture

A versioned package of the initial state and dependencies needed to instantiate a task, such as a starting repository, dependency versions, service behavior, and permitted data. It sets the conditions of an attempt; separate acceptance criteria judge the result.

task group

The repeated attempts, paraphrases, derived fixtures, and solution-equivalent variants of one underlying problem, grouped so they are treated as one task. The group records the basis on which its members were judged equivalent.

teacher forcing

Predicting each selected token from the recorded preceding tokens, including earlier selected responses, rather than from a freshly sampled continuation.

temperature

A positive sampling parameter that divides the logits before softmax. Lower temperature concentrates probability on higher-scoring tokens and higher temperature flattens the distribution; it carries no information about whether an answer is correct.

temporal-difference residual

The sampled one-step quantity \(\TemporalDifferenceResidual_k = \TurnReward_k + \PolicyRemainingReturn(\InteractionHistory_{k+1}) - \PolicyRemainingReturn(\InteractionHistory_k)\), whose conditional expectation equals the advantage when the value function is exact. One residual is a single noisy sample, and estimated values add further error.

test-tampering defense

Controls protecting designated acceptance logic and evidence from modification or interference by the agent and its submitted artifacts. Read-only test files are one control, not a complete grader-protection boundary.

test-time compute

Inference computation spent on a single decision beyond one model call, through longer reasoning, additional candidates, or check-and-revise rounds, before the runtime admits a result.

test-time compute budget

The per-decision allowance of processed and generated tokens, model calls, checks, and elapsed time that a runtime may spend, with the model’s weights fixed, before it must select a candidate, abstain, or escalate. An exhausted budget is not evidence that the best remaining candidate is acceptable.

test-time deliberation rollout

One bounded candidate-generation path within a decision, possibly including checks and revisions conditioned on observations, produced with the model’s weights fixed.

threat model

A statement of what the attacker controls, what must remain protected, how the controlled material enters the task, and what outcome counts as a violation. A list of attack names fixes neither the boundary nor the success criterion.

time per output token (TPOT)

The average interval between generated tokens after the first in a streamed model response.

time to first token (TTFT)

The client-observed interval from sending a model request to receiving its first generated token. It includes queueing and transport as well as the prefill pass that produces that token’s distribution.

time-to-live (TTL)

A policy that sets an age after which the runtime requests a refresh of an observation. It is a refresh heuristic chosen for the task’s change rate and cost of error, not a validity test, since a younger observation may already be outdated and an older one may still be current.

time-travel replay

Reconstructing supported recorded state at a retained historical boundary from compatible checkpoints, history, and required artifacts. Its scope depends on capture and retention; it does not recreate arbitrary past external-world state.

token averaging

A loss normalization that assigns equal coefficients to every selected target token’s loss. Context and padding tokens are never counted.

token budget

The per-iteration limit on token positions a chunked-prefill scheduler admits, where each decode request contributes one position and each prefill chunk contributes its length. It bounds work per iteration, not time, so it must be calibrated against measured gaps between output tokens.

token entropy

The entropy of a specified next-token distribution at a delivered prefix, measuring uncertainty over the vocabulary. Reports must state whether it is the model’s distribution or the sampler’s after temperature, filtering, and constraints.

tokenizer

A component that maps text into identifiers from a finite vocabulary. A token may be a word, part of a word, whitespace, punctuation, or a combination, so token boundaries need not match the boundaries of an identifier or a JSON field.

tombstone

A durable exclusion marker that suppresses retrieval of a record, or of every record from a source generation, before physical cleanup finishes. It records ineligibility, not erasure.

tool

An interface to an operation in the environment, such as reading a file, applying a patch, or running a test. The model can only propose a tool call; the runtime decides whether it is dispatched.

tool-choice control

A serving-interface control that constrains whether the model proposes a tool call at all: it may allow an optional call, require a call, require one named tool, or forbid calls. Forcing a call shapes the proposal but authorizes nothing.

tool descriptor

The description of a tool operation that communicates its purpose, arguments, result, and relevant effect semantics. It helps the model choose and parameterize the operation; the runtime and endpoint enforce the contract.

tool-wait problem

Retained serving state held idle while a slow tool runs, forcing a choice between keeping, moving, or dropping that state before the next model call.

top-\(\TopTokenSampleCount\) sampling

A sampling restriction that keeps the \(\TopTokenSampleCount\) highest-scoring tokens, with a defined tie rule, and renormalizes their probabilities.

top-\(\NucleusProbabilityMass\) sampling

A sampling restriction, also called nucleus sampling, that keeps the shortest set of most probable tokens whose cumulative probability reaches a threshold \(\NucleusProbabilityMass\) and renormalizes it. Unlike top-\(\TopTokenSampleCount\), the number of tokens kept varies with the shape of the distribution.

torn dependency read

A hazard in which a worker observes an intermediate mixture of state, such as a changed interface whose callers are not yet updated, that no worker proposed.

trace

A graph of spans recording one trajectory’s model calls, tool calls, approvals, and child agents, with their durations, token counts, and outcomes, used to measure and attribute behavior rather than to recover it.

trajectory

The ordered sequence of recorded states, proposed actions, runtime decisions, and observations through which one delegated task proceeds, from its first context to its acceptance, stop, or escalation. It is the unit of engineering in agentic systems.

trajectory curation

Selecting, labeling, and transforming recorded interactions for a declared learning use while preserving the evidence and constraints that justify that use. Its output is a versioned artifact with specified consumers, not a collection of success labels.

trajectory goodput

Distinct task completions accepted under a declared contract per unit of elapsed observation time. Goodput per dollar instead divides accepted tasks by the full included cost, retaining failed and canceled work; it is the reciprocal of cost per accepted task when the relevant denominators are positive.

trajectory-level sticky routing

Assigning a configuration at the task or trajectory boundary and preserving it through continuation, retries, and resumed work, so one measured task never mixes baseline and candidate behavior. It is a stable configuration assignment, not a promise to keep one physical model instance.

trajectory log

The append-only, ordered sequence of typed events (delivered model inputs, returned replies, admissions, control changes, and observed tool outcomes) from which a deterministic reducer rebuilds a trajectory’s control state. Recorded claims are not automatically external truth.

trajectory record

The per-trajectory control state that the harness owns and the model cannot write directly: identity, lifecycle state and version, per-call limits, actual and reserved consumption, grants and leases, observation eligibility, unresolved effect obligations, and references to context, live plan, log, and workspace.

trajectory saga

A workflow that records its constituent actions and coordinates compensating actions when their established effects must be remediated, while preserving unresolved outcomes and dependencies. Compensation is registered before forward dispatch and follows dependencies and outcome evidence.

transaction isolation

The transaction property that specifies which concurrent observations and interleavings are permitted. Serializable isolation has the effect of some serial order but need not preserve real-time order.

trusted computing base

The set of components whose correct operation a claimed protection depends on. Changing the isolation envelope changes that set and the interfaces exposed to untrusted code.

turn

One step of a trajectory: one model call and the runtime’s handling of the action it proposes. The runtime’s record marks whether each proposed action was rejected, dispatched, or completed.

turn boundary

A local admission boundary before a model invocation or tool dispatch at which the harness checks whether continuation remains permitted. Reaching this boundary does not establish that earlier remote effects have ended.

two-phase commit

A protocol that coordinates one atomic commit decision among participating resource managers: each participant prepares and preserves recovery state, and a participant that votes to commit cannot then abort unilaterally. A prepared participant may block while it cannot learn the decision.

typed task envelope

A versioned child assignment binding task identity, input references, scoped authority, resource limits, completion requirements, and a bounded return format. The runtime enforces those bindings; schema validity alone establishes neither authority nor successful completion.

U

uncertain outcome

The recorded status of a dispatched operation whose effect the runtime can neither confirm nor exclude, because its reply was lost, late, or never produced. It stays unsettled until an endpoint deduplication contract, a reconciliation query, or an authorized decision establishes what happened.

universal scalability law (USL)

Gunther’s model of relative capacity for a fixed workload divided among \(\WorkerCount\) workers, \(\WorkerCount/(1+\ContentionCoefficient(\WorkerCount-1)+\CoherencyCoefficient \WorkerCount(\WorkerCount-1))\), where \(\ContentionCoefficient\) is the contention (serialized share) and \(\CoherencyCoefficient\) the coherency (pairwise reconciliation) cost. Nonzero coherency gives it a peak beyond which adding workers lowers capacity.

untrusted span

Text staged in a request whose origin the runtime can record but whose content it did not author and cannot vouch for. Encoding keeps the span in its field, yet the model may still follow an instruction it contains. See also indirect prompt injection.

usable working context

The context content, organization, and length with which a specified model and invocation configuration meet a chosen quality criterion on a stated workload. It is established only by evaluation and is usually much shorter than the nominal context capacity. See also nominal context capacity.

user-space kernel

An isolation envelope that interposes another implementation of the application’s operating-system interface, such as gVisor’s Sentry, in front of the host kernel. Applications depend on the interfaces it supports, and exposed resources still need their own constraints.

V

verification gap

The distance between the probability that at least one of \(\IndependentAttemptCount\) runs passes (pass@\(\IndependentAttemptCount\)) and the probability that all \(\IndependentAttemptCount\) pass (pass\(^\IndependentAttemptCount\)). A selector with a reliable checker can turn availability into one accepted delivery, but work that must pass every time it recurs gets only consistency.

verifier

A check whose criteria and observations the candidate under assessment cannot modify. Its role in acceptance depends on the task’s evidence contract, and passing one verifier is narrower than task acceptance.

verifier cascade

An ordered sequence of declared predicates that routes a recorded trajectory to a learning artifact, stopping that route at the first predicate that does not pass. Predicate order changes checking cost without changing the accepted set.

verifier-guided selection

A selection policy that returns a candidate only when a verifier, a check whose criteria and observations the candidate cannot modify, passes it, and abstains when no candidate passes.

verifier isolation

Protection of an assessment from both the running agent and the code the agent submits, so the agent cannot touch the verdict. Isolation settles who can alter the verdict, not whether the checks cover the intended task.

visible test

A test whose cases the agent can inspect. Visible tests are useful for diagnosis but also expose the examples a candidate can be fitted to. See also sealed test.

vocabulary mismatch

The problem that people describe the same thing with different words, so a query phrased by symptom may share no terms with the source that answers it. Identifier splitting, synonym expansion, query reformulation, or dense retrieval can recover some matches.

W

wait policy

The declared rule stating which tool results end a trajectory’s wait. The return to a ready state passes through a guarded transition that evaluates the policy again.

whole-trajectory cost

The total cost attributed to one execution attempt across its model calls, environment, assessment, and required finalization within a declared accounting boundary. Cost per accepted task aggregates it over a cohort’s attempts and divides by the distinct accepted tasks.

Wilson score interval

A confidence interval for a binomial rate that uses the hypothesized rate rather than the observed one in the variance. Unlike the Wald interval, it neither collapses to zero width when every outcome agrees nor extends below zero near the boundaries.

working-set decision

The runtime’s choice of which source excerpts, observations, constraints, and unresolved questions belong in the next model request, selecting the information that supports the next bounded step.

workspace lease

A binding of a workspace to its task, owner, permitted operations, and lifetime. It lets edits and selected caches persist across turns without making them available to the next tenant.

write-ahead logging

Durably recording an admitted request, with its authorized intent and admission state, before dispatching it. The durable history then identifies an operation that might have executed even if its reply never reaches the worker; inferring that a missing intent was never dispatched additionally requires the completeness rule.

write amplification

Bytes written per byte of new state. For full snapshots it arises from serializing unchanged state again at every checkpoint, so it grows with trajectory length, while delta checkpoints avoid it.

Z

zero ambient authority

The property that the model itself holds no rights to read, change, or reach anything; every effect it proposes takes place only through a grant and a capability the runtime issues and enforces.

zero-contrast group

A completed group of rollouts whose rewards are all equal, so every group-relative advantage is zero and the reward term supplies no gradient. Equal rewards say nothing about how diverse the attempts were.