3.7 KiB
3.7 KiB
Glossary
The vocabulary of RedFlag, in one place. Terms link to their design-of-record pages.
| Term | Meaning |
|---|---|
| Agent | Stateless Go executor on each managed host. Polls, verifies, executes, reports. Never decides. components/02-agent |
| Capability token | Ed25519-signed grant describing exactly one operation over a resolved closure, with every artifact hash pinned. Minted at approval, executed once. security/05-supply-chain-gate |
| Closure (dependency closure) | The full set of artifacts an operation will touch — the named package and every transitive dependency resolved at dry-run time. |
| Closure hash | Canonical hash over the closure, embedded in the token's signed message. Computed byte-identically in Go (server) and Rust (helper) — the cross-language contract. |
| Discovery vs. mutation | Discovery (scan, dry-run, hash-resolve) runs unprivileged through DiscoveryRunner. Mutation happens only through the helper on gated ecosystems. The agent cannot install. |
| Doctrine / doctrinal | A guarantee with no configuration knob: signing-required, forward-only versioning, no verification skip path. If it's doctrine, there is nothing to misconfigure. core/01-ethos |
| Drift detection | Knowing what should be installed vs. what is, and bridging the gap into update packages. |
| ETHOS | The five principles every change is held to: errors are history, no unauthenticated endpoints, assume failure, idempotency, no marketing fluff in logs. core/01-ethos |
| Fail-closed | When verification can't succeed, the operation doesn't happen. A registered hash that can't be checked blocks; an unknown vulnerability state blocks under block enforcement. The opposite of "warn and continue." |
| Family revocation | Refresh tokens form a lineage (family_id); replaying a stale token burns the entire family loudly. Theft is detected, not coexisted with. security/03-refresh-tokens |
| Forward-only | No downgrades. Versions move forward; the release gate enforces it; there is no override. |
| Helper | The privileged, network-less Rust executor — the only mutation path on gated ecosystems. components/04-helper |
| Legacy command path | Direct signed-command execution for docker / winget / windows_update — ecosystems the capability gate doesn't cover yet. A documented gap, not a feature. OVERVIEW |
| Machine binding | Hardware fingerprint registered at enrollment and checked on every authenticated request, including token renewal. A stolen config.json is inert elsewhere. security/04-machine-binding |
| Nonce | Per-command signed value with a 10-minute window; agents track executed nonces and reject replays. verification/04-replay-protection |
| OSV | OSV.dev, the open vulnerability database. Queried in batches across full closures at detection time; verdicts persist and gate approval. |
| RAF | This document tree — the RedFlag Architecture Framework, the design of record. What the system is, not what's currently on the task list. |
| Soak gate / age gate | Time-based supply-chain policies: minimum package age before approval (Shai-Hulud defense) and a version soak window before install. Policies, not doctrine — configurable, with enforcement modes. security/05-supply-chain-gate |
| TOFU | Trust-on-first-use: the agent caches the server's public key at first connect and verifies everything after against the cached roster, by key_id. verification/03-key-rotation |
| Two execution paths | Capability gate (dnf, apt — token + helper) and legacy command (everything else, for now). OVERVIEW |
Last reviewed: 2026-06-11