GLOSSARY.md

Glossary

Each term below has one meaning across these docs.

Term	Meaning
Agent files	tools.json, AGENT.md and skills/ beside manifest.json, plus the manifest's agent fields, which together declare an app's own agent (OctoSense ADR 0002). App Hub's gate admits them. Once the person allows the app's agent, the OctoSense shells give it a peer with ask_user_question, read tools over its folder and its granted tools.json tools, and load AGENT.md and skills as guidance for each turn. A tools.json without an agent block still gives the app an agent. See AI-SERVICES.
AI providers	The system app (os.ai-providers) where the person chooses the assistant's models and enters API keys, on host sheets. Its llm host service answers only system apps.
App agent	The agent an app declares (agent, tools.json, or any octos.* name), running on its app peer. The person talks to it directly (the shell's "Ask <app>" panel, a card's sys.chat, or the app's own screens through octos.*), in a lane of its own beside the system agent's, and the system agent hands it work. See AI-SERVICES.
App Hub	OctoSense-App-Hub: the publication contract, the gate, the scan, the signed catalog, the hub command, the store (appstore) and card-host.
App peer	The octos peer the shell gives one app's agent, one for each account the app keeps: private contexts, a workspace (the account's folder) and memory (app/<app>/acct-<hash>), owned by the system agent. A script app's peer is card.<app id>; the shell creates it once the person allows the app's agent. See AI-SERVICES.
Bundle	The directory that is the app: manifest.json, listing.json, the entry (main.splash or page.card), artwork and screenshots. The only thing submitted. hub stamp hashes its bytes into the manifest.
Capability	One named permission from the closed list KNOWN_CAPABILITIES. The list holds 105 names: 27 broad capabilities, such as storage, net, glance, model and auth, and 78 exact service names (4 octos.*, 45 matrix.*, 29 palpo.*). Not requested means not granted. See CAPABILITIES.
Card app	An app whose bundle holds page.card (L0), optional page.data.json and a kit/. The host lowers the card to widgets; the card holds no program. Produced by the image-to-card flow.
Card runner	The part of an OctoSense shell (App Hub's appstore crate, card module) that runs one installed or system app: it admits the app, resolves its policy, sets up its jail, evaluates it and pumps its host services.
card-host	App Hub's reference contained host for one bundle on the desktop (crates/card-host). Run it during development with card-host --bundle <dir> --allow-unsigned. It applies the same policy code as the Card runner but serves no host services except runtime discovery.
Catalog	The authenticated list of admitted app versions a Store reads. GitHub-attested v2 and legacy Ed25519 catalog.json have distinct verifier paths; catalog publication requires Hub approval, not just an app release.
Contained app	A script or card app that runs in a policed isolate, under the policy its manifest resolves to. Store apps and system apps are both contained.
Flow	A documented, step-by-step procedure in flows/ (FLOW.md) that a person or agent follows from an input to a checked bundle.
Gate	hub check: the deterministic admission rules (file types, digest, assets, secrets, listing, policy, version and publisher continuity). The same code runs on the developer's machine and in App Hub's admission.
Glance	The screen of cards that apps publish with glance.publish: a panel on the desktop and a feed on the phone. A Glance card opens only the app that published it. See AI-SERVICES.
Host API family	The first segment of a host.request name (mail in mail.list), served by one host service. HOST-API-FAMILIES lists every family with the capability a manifest declares for it, who the shells serve, on which platforms, and since which release.
Host service	Work the shell does for an app, in Rust, with things the app must never hold (a socket, a credential, a device). The app calls host.request("<family>.<method>", args, fn(r){…}); the capability <family> must be granted. See HOST-SERVICES.
hub	App Hub's command-line tool (crates/app-hub/src/bin/hub.rs), with commands including stamp, check, scan, publisher-prepare, publisher-attach, publisher-verify and publisher-pack; the legacy key and catalog commands remain for maintainers, and App Hub #168 decides their future. Not GitHub's hub CLI.
Isolate	One Splash VM with its own heap, jail, storage quota, capability list, host allowlist, instruction budget and heap ceiling. Every app runs in its own.
Jail	An app's private storage directory, <app-data>/<id>/. Only an app granted storage has one.
Kit	A named set of widgets and styles a card is lowered with (kit/ in a card bundle); the sketch kit flow builds one.
L0	The declarative card language a card app's page.card is written in: data, state, events and views, lowered to widgets by a kit. Examples in docs/l0/.
Listing	bundle/listing.json: what the store shows before install (subtitle, description, category, keywords, screenshots, icon, platforms, publisher, release notes, age rating, license). Reviewed with the bundle. Schema: crates/app-policy/src/listing.rs.
Manifest	bundle/manifest.json: id, version, name, integrity digest and publisher proof (GitHub attestation or legacy signature), capabilities, network hosts, storage and compute requests, optional agent. It is the only place an app states its own limits, and the gate refuses unknown fields. Schema: crates/app-contract/src/manifest.rs in OctoSense-App-Hub, the app contract crate octosense-app-contract.
Model text	Words a model wrote (model-copy, a digest's summary, a sys.chat reply). An L0 card may show it only in a text slot, where the kit marks it AI-written, and never acts on it (OctoScript docs/ui-profile-l0.md §4.2).
Native app	A compiled Rust app the shell links from OctoSense's native-apps.json, such as Rinx. Most run inside the shell's process as native modules; on the desktop, Terminal and Task run as separate process apps.
octos	The agent kernel inside OctoSense (octos-org/octos): one per shell, configured by AI providers. Not tools/octo, which is this repository's CLI. See AI-SERVICES.
OctoScript	The layer above Makepad that gives this repository its name: the OctoScript VM and OctoScript-Makepad (the UI framework, kits and L0 lowering). Not a language app authors write.
OctoSense app	Anything a person installs or opens on an OctoSense device as an app. Two kinds ship through App Hub: a script app and a card app.
Palpo	A Matrix server. Its operations are the 29 palpo.* capabilities; no OctoSense shell serves them.
GitHub publisher proof	A GitHub Actions attestation over the canonical app manifest, bound to the repository/owner IDs, workflow, version tag and source commit. App Hub accepts only releases that carry it, so no developer signing key is involved. Requires publisher-github-v1 / contract 1.8.0 or later and a compatible host, OctoSense desktop 0.1.0-rc.1 or later (public samples verified on macOS).
Publisher key	An Ed25519 key that signed legacy releases, such as the 0.1.x reference apps. App Hub no longer accepts key-signed releases; never create a publisher key to publish an app.
Rinx	A Matrix client that OctoSense links as a native app. Its mini-app host serves octos.* to bundles a person imports into it. Unverified: it serves matrix.* to them too. No OctoSense shell serves matrix.* to an installed app.
Runtime types	Every type name a script can resolve in the pinned runtime, by namespace, in RUNTIME-TYPES. Resolving is not support: SCRIPT-API documents the supported subset.
Scan	hub scan: the review packet a human or model reviewer answers after the gate passes. It holds the app's source, listing and grants, and seven questions (eight when the bundle ships agent files), but no screenshots.
Script app	An app whose bundle holds main.splash, a Splash program with its own state, handlers, storage and requests. The host runs it unchanged in a policed isolate. It is the default kind, and the one this repository's QUICKSTART builds.
Served	Whether a host service answers a store app at all, as opposed to declarable, which only means the gate admits the capability. llm is declarable and system-only; clipboard is declarable and served by nothing through host.request.
Sheet	A host-owned surface a host service draws over an app, in its own isolate under no app's policy, for things only the person may type (a password). Only the sheet may call <family>.sheet.* methods.
Shell	The OctoSense host that installs and runs apps: the desktop, or Home on the phone.
Splash	Makepad's runtime script and widget language (Splash widget, widgets/src/splash*.rs in OctoSense-org/makepad). A script app's main.splash is Splash source.
Stamp	Writing the bundle's BLAKE3 digest into manifest.json (hub stamp <bundle>). Editable source needs a restamp after byte changes; never restamp a sealed attested/signed release.
Store app	An app installed from the App Hub store. Its id never starts with os..
sys.chat	An L0 source for a chat with the publishing app's agent inside a card; the host keeps the transcript and writes the agent's replies (OctoScript docs/ui-profile-l0.md §5.15). See AI-SERVICES.
System agent	The shell's own assistant session (_main:api:octosense#system), owner of every app peer, which the person talks to in the system chat (the assistant pane). It lists app agents and hands them work (peer_list, peer_send_input), holds no app's tools, cannot approve for an app and cannot close an app's peer.
System app	A script app that ships inside a shell build rather than from the store: News, Mail, Calendar, Photos, Maps, YouTube and AI providers, plus Camera on the phone. Its id starts with os., an id prefix no store may install. Lives in OctoSense apps/.