Canonical Glossary

Tools, context, models, and interoperability

Tool — A typed executable capability through which an agent observes or changes an external system. A tool supplies capability; policy and credentials determine whether a particular call is authorized.

Model Context Protocol (MCP) — An interoperability protocol for exposing tools, resources, prompts, and negotiated extensions between hosts and servers. MCP standardizes communication and discovery; it does not by itself establish tenant isolation, trustworthy tool behavior, least privilege, or acceptance.

MCP Task — A protocol-extension handle used to manage a long-running MCP operation. It is not the same as a factory Task: the domain Task organizes authorized WorkOrder execution and retains business and acceptance lineage.

Agent Client Protocol (ACP) — An editor-to-agent interoperability protocol for portable coding-agent sessions and interaction. The acronym is ambiguous outside this usage, so implementations must pin the specification and version. ACP does not establish factory workflow authority or acceptance.

Agent–User Interaction Protocol (AG-UI) — An event-oriented protocol for connecting an agent backend to a user-facing application through lifecycle, message, tool, state, and interaction events. It does not make UI state the authoritative factory state.

Agent2Agent Protocol (A2A) — An interoperability protocol through which independent agent applications can discover capabilities, exchange messages, delegate work, and manage remote tasks. Delegation through A2A cannot widen a WorkOrder's authority or make a remote agent trustworthy by default.

Data Understanding — The discipline of determining whether source data is complete, current, valid, consistent, attributable, permitted, and fit for a particular decision. It precedes retrieval and model reasoning.

Data Contract — A versioned agreement describing a data source's schema, semantics, owner, quality thresholds, freshness, lineage, sensitivity, allowed uses, and failure behavior. A contract does not guarantee that current data actually satisfies it.

Knowledge Engineering — The governed lifecycle that registers sources and turns approved data and documents into normalized, indexed, retrievable, correctable, and traceable knowledge. It prepares reusable knowledge; it does not decide the final context for one Attempt.

Semantic Engineering — The design and operation of controlled vocabulary, canonical identities, aliases, relationships, mappings, disambiguation, and meaning across sources and systems. It prevents the factory from treating raw string similarity as shared meaning.

Semantic Contract — A versioned agreement defining canonical concepts, identifiers, aliases, relationships, disambiguation rules, source mappings, ownership, and compatibility. A semantic change can invalidate retrieval, context, evaluation, and evidence that depended on the prior meaning.

Controlled vocabulary — A versioned set of preferred domain terms, definitions, aliases, and deprecated terms. It is the smallest useful semantic control and need not become a full ontology.

Ontology — A formal model of domain concepts, relationships, and constraints. It is useful when explicit semantic reasoning and integration justify its modeling and maintenance cost.

Entity resolution — The process of determining when source-specific names or identifiers refer to the same canonical entity while preserving provenance, uncertainty, and correction history.

Retrieval-Augmented Generation (RAG) — A pattern in which model input is augmented with information retrieved from external sources. RAG does not by itself establish source quality, permission, freshness, semantic correctness, or grounded output.

Hybrid retrieval — Candidate retrieval that combines complementary methods, commonly lexical, vector, metadata, and relationship-based search. Its value must be measured against the target query distribution.

Reranking — A second-stage method that reorders retrieved candidates for a specific query or task. Reranking cannot recover a required item that candidate retrieval omitted.

Context engineering — The design and operation of selecting, filtering, ordering, budgeting, refreshing, and attributing the information available to an agent for one task. More context is not automatically better context.

Context Package — An immutable, provenance-backed, budgeted set of code, documents, decisions, history, and retrieval results frozen for one Attempt. It is a versioned, addressable unit that may carry a declared type such as skill, rule, documentation, workflow, tool guide, or prompt template. It is advisory input and cannot silently change approved intent, grant authority, or satisfy an acceptance criterion.

Context compaction — The controlled replacement of a growing working context with a smaller representation that preserves governing instructions, accepted decisions, unresolved issues, evidence links, and necessary state. Compaction is lossy and must not silently rewrite authority.

Memory — Durable information retained across runs, such as accepted decisions, outcomes, failures, preferences, and recovery patterns. Memory is a potentially stale or poisoned context source, not an authority record.

Model gateway — The governed interface that normalizes provider access, identity, credentials, policy, telemetry, quotas, and failure handling. It separates product workflows from provider-specific APIs.

Model catalog — A scoped inventory of available model routes and their capabilities, constraints, cost, latency, availability, security classification, qualification evidence, and lifecycle status. Registration does not imply production eligibility.

Exact model route — A digest-bound execution identity that includes the provider route, model, harness adapter and configuration, and runtime artifact. It prevents a familiar model name from hiding materially different execution.

Model router — A policy-governed decision component that filters ineligible routes, ranks eligible routes using quality, latency, cost, security, context, availability, and historical outcomes, and records the applied decision and fallback. Routing cannot override admission or acceptance policy.

Task-Specific Agent Profile — A versioned eligibility template that binds the capabilities required for a task class to approved model routes, instructions, tools, skills, context policy, harness features, budgets, and verification. It is not permission to execute a particular WorkOrder.

Conditional routing — Selection of the next eligible agent, model, tool, workflow node, fallback, or human decision from observable state and policy. Model classification may inform the decision but cannot bypass deterministic eligibility.

Loop Engineering — The design of bounded agent iteration, including generation, verification, diagnosis, repair or replanning, changed-hypothesis retry, convergence, budgets, stop conditions, fallback, and escalation. An iteration cap is containment, not a substitute for progress detection.

Architecture, governance, and operations concepts

Factory System Record — The governed accountability and classification record for one material autonomous delivery system. It identifies purpose, owners, scope, registry references, data, integrations, risk, autonomy ceiling, evidence, incidents, and lifecycle without duplicating the authoritative service, capability, model, policy, or evidence registries.

Autonomy ceiling — The highest action class a system, workflow, capability, or grant may perform under current policy and evidence. The narrowest applicable ceiling wins; runtime confidence cannot raise it.

Boundary Contract — The versioned command or event contract crossing a responsibility or trust boundary. It defines identity, authority, schema, state, delivery, idempotency, timeout, failure, evidence, human decision, and compatibility behavior.

Side-effect class — The highest consequence category of a capability call: read-only, reversible mutation, publication, deployment, destructive mutation, privileged administration, or external communication. It determines minimum authorization, evidence, and recovery controls.

Delegation Record — A durable, versioned assignment from one authorized participant to another that binds purpose, scope, capability, context, authority, budget, completion, failure, and return contracts. Delegation cannot widen the authority held by the delegator.

Emergency Control — A tested independent mechanism for pausing, cancelling, revoking, quarantining, rolling back, failing over, or shutting down a governed subject. A visible control is not evidence until enforcement and recovery have been exercised.

Recertification — A periodic or event-triggered decision that rechecks ownership, purpose, risk, autonomy, models, evaluators, capabilities, dependencies, policy, evidence, incidents, drift, cost, and outcomes for an exact governed scope.

Control Tower — An operations projection that links governed system inventory to authority, health, quality, safety, cost, drift, incidents, response, and verified closure. It invokes authoritative control APIs but does not replace their records.

Verified closure — The incident or finding state reached only after containment, recovery, downstream reconciliation, independent validation, notification decisions, residual risk, and accountable acceptance are recorded. Service restoration alone is not closure.