Glossary
Scroll sideways to see the full table. Use the arrow keys when focused.
| Term | Meaning |
|---|---|
| Manager | Control plane process and /api/v1 |
| Agent | Node runtime that heartbeats to a Manager |
| Hosting Agent | Observation profile (enforcement: false); cannot receive rules/restart |
| Virtualization Agent | Enforcement profile (XDP/TC on KVM/libvirt hosts) |
| Hybrid | Example YAML protection_model; does not match Hosting v2 profile identity |
| AI Preview | Advisory analysis; not autonomous enforcement |
| Internal AI development endpoints | Dormant Enterprise paths; not AI Preview or customer cookbooks |
| zwallctl | Operator CLI (cobra); not README folklore commands |
/api/v1 | Customer REST API |
| AUTH_ERR | {"error":"..."} |
| V1ERR / V1OK | {success,error,message,code} / {success,message,data} |
| License 403 | {success,code,message,license{...}} |
| Community agent limit | 403 COMMUNITY_AGENT_LIMIT_REACHED (3 Agents) |
| pass-only | Hosting eBPF observer must not drop |
| pre-register | Admin-created one-time Agent admission |
| Agent JWT | Token from POST /api/v1/agents/register; not an admin token |
| session cookie | HttpOnly browser session; not in login JSON |
| pin dir | Local eBPF map pin path (/sys/fs/bpf/fw default in zwallctl) |
| testing mode | Inspect-before-enforce; not a benchmark |
| blocking pipeline | Fail-closed authority for blocked IPs when required for readiness |
| Filesystem prefixes | No single canonical filesystem prefix |
| Manager URLs and ports | Manager example port 8443 vs zwallctl default 8080 |
| UID/GID filtering | UID/GID filtering not a stable customer contract |
Related: Status vocabulary