Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Glossary & vocab

The shared vocabulary of the site, in one place. The product uses a small, canonical set of names precisely — the calm-vocabulary note explains why the words are load-bearing. Terms are grouped for reading; each entry is one to three lines with an external primer where one helps. Where a name is still settling, the entry says so rather than implying it is fixed.

The product surface

  • Xe Computer — the cross-platform runtime (home: xe.computer). The whole “missing layer between the browser and the OS.” Not “the launcher.”
  • Xe Computer Boot Service — the on-demand wake mechanism that stands the runtime up and lets it sleep; zero resident processes when idle. Not a “daemon,” not an “agent.”
  • Xe Computer console — the management UI; the witness for receipts and the update ledger (d/064). xe — the command-line interface.
  • app engine — the substrate layer inside Xe Computer that runs app backends. The concrete engine names (colima, lima, docker, smolvm, WSL2) never appear in user copy.
  • plane — the local, loopback-only serving surface bound to 127.0.0.1:5454, where every installed or peer-served app appears at a stable http://<app>.localhost:5454 origin (d/100).
  • origin router — the small, pinned web server (workerd) behind the plane whose routing table is generated from installed-app records, never hand-edited.
  • console / catalog / forge — see catalog and forge under Distribution.

Browsers & shells

  • Prism — Agent54’s super-app shell: itself an Isolated Web App that frames each app in a Controlled Frame, composes apps, and journals every agent action. The canonical super web app.
  • Xenon — Agent54’s Isolated-Web-App-enabled Chromium fork (the browser, not the runtime). Its differentiator is that IWAs work without developer flags. Phrasing note: the decisions of record (d/008, d/061) name Helium as the confirmed Xenon base and the site’s shell primer states this; that specific “Helium-based” wording is pending a quick human confirmation before it hardens (agenda item 34) — the base decision itself is not re-opened. Repo names like xenon-* are historical.
  • Helium — a privacy-forward, de-Googled Chromium build that ships Isolated-Web-App support; the base Xenon forks. imputnet/helium.
  • darc → Reagent — the resident agent layer that acts through Prism. darc is the current research-preview name; Reagent is the decided rename (d/053), executed later by Luke + Jan. New copy writes darc → Reagent until the rename is performed.
  • super web app / super user agent — an app granted fabric-level capabilities (the L3 tier); interchangeable terms, and never framed as “privileged.” Prism is the example.

The two capability axes

  • install spectrum (L0–L3) — a property of the app (d/076): L0 visited · L1 installed (has a home, icon, stable origin; installed unmodified and un-Xe-aware as a hard promise) · L2 capability-enhanced · L3 super (Controlled-Frame-hosting, agent-grade). One substance (a web app), one axis, no cliffs. See the two axes.
  • agency ladder — a property of the agent’s action (d/082, revised d/091): nothing → allowed / denied / shielded → observed → enhanced → mutated → controlled → driven → composed / generated / delegated → super user agent. Every rung is consented, receipted, undoable.
  • shielded — an agency-ladder state where the agent actively guards a surface; permission denied is a first-class outcome, not an error.
  • driven — the rung where the agent operates a live surface over the Chrome DevTools Protocol (CDP), the wire protocol browser automation uses.

Web-platform primitives

  • IWA (Isolated Web App) — a Chromium mechanism for a web app packaged and signed as a self-contained bundle, running in stronger isolation than an ordinary tab and permitted powerful capabilities. Explainer.
  • swbn (Signed Web Bundle) — the packaged, Ed25519-signed .swbn file an IWA installs from; the origin is key-derived (isolated-app://…). Reserved for the super tier (d/079, d/101).
  • Controlled Frame — a strong, fully partitioned embedding element available inside an IWA — a far stronger cousin of the <iframe> — that lets a host app (Prism) frame and mediate another app. Explainer · spec.
  • COOP / COEP / CORP — the response headers (Cross-Origin-Opener/Embedder/Resource-Policy) that together yield crossOriginIsolated: true, a precondition for hosting a Controlled Frame.
  • CSP (Content-Security-Policy) — an HTTP header declaring exactly which origins a page may load, connect to, or frame; a tight CSP is a declared trust boundary. MDN.
  • secure context / localhost — browsers treat *.localhost as a potentially-trustworthy (secure) origin, which is why plane origins get the web’s isolation without per-app packaging.

Transport, identity & trust

  • iroh — a peer-to-peer transport that dials a device directly by its public key, using relays only to help peers find each other and as a fallback when a direct connection is not possible. iroh.computer.
  • ALPN — Application-Layer Protocol Negotiation: the short string (e.g. xenon/serve/tcp/1) that names which protocol a QUIC/TLS connection speaks; the registry lives in Part V.
  • relay — a third-party (default: number0) or self-hosted server that helps two iroh peers connect; sees connection metadata but not payload. A self-hosted iroh-relay is required before production (d/014).
  • membership plane / group document — the signed, hash-chained document that says which devices are in your group; supports enrollment, immediate revocation, and offline verification. Two lineages exist (v1 crates/net/group, v2 crates/xe-sync); which is canonical is an open decision.
  • ticket — the bearer credential + address card a publisher hands a consumer to serve an app peer-to-peer; a 32-byte secret in a 0600 file today. See Xe Peer Ticket v1.
  • companion — a phone as a remote client and consent surface, not a sync peer (d/042).
  • Ed25519 — a widely used public-key signature scheme (RFC 8032); the device identity is its Ed25519 key.
  • serial anchor — a monotonically increasing number tying each catalog release to an order, so rollbacks are detectable (d/067).
  • UCAN — User-Controlled Authorization Networks: a signed, attenuable, chainable capability token (issuer/audience are keys as did:key) that needs no central server to verify. Xe carries UCAN-compatible semantics with the wire format deferred (d/027).
  • capability / grant / lease — the delegation vocabulary: a capability is (resource × ability × constraints); a grant is a long-lived, authority-signed delegation to an install principal (onward:false); a lease is a short-lived attenuation minted under a grant per action. Outlined in Part V.
  • consent gates (Plan Review / Grant Consent) — the two non-interchangeable install-time gates, distinct from a cross-origin grant (a request-level, ≤3600 s CORS allowance). Do not conflate “install consent” with “cross-origin grant.”

Packaging, engines & distribution

  • XAM (Xe App Manifest) — the manifest carrying an app’s identity, source, and components; the driver (not the packaging) decides how a component renders. See XAM v0.2.
  • XAA — the Xe export archive format that backs update snapshots and per-app export.
  • microVM / smolvm — a lightweight virtual-machine isolation boundary for untrusted backends; smolvm is the default app engine that publishes a unix socket the connector reaches through (d/094). The standalone-firecracker/microVM lane is retired onto this track (d/028 amendment).
  • compose subset — the fail-closed, install-time-validated safe subset of docker-compose an app may declare; anything that would puncture microVM isolation is refused with a stable code. See the normative refusal list.
  • catalog — the signed, static, Ed25519-signed, serial-anchored index that publishing produces; install verifies signature + content hash before anything runs (d/067).
  • forge — the git host Agent54 owns (Forgejo on the NAS), the origin of record; “the forge is home” (d/007, d/025). Pushes go to the forge only (d/013).
  • Folknet — the community compute fabric that backs the fleet.
  • fleet — your set of peer devices, each running its own Xe Computer instance, syncing to each other with no central hub.
  • FROST — a threshold-signature scheme reserved (not built) for future quorum-based key recovery of the group authority.

Naming discipline (things this glossary keeps apart)

  • capability-model / injection-boundary (the product delegation model) vs. delegation-interfaces.md (an unrelated broker) — distinct; do not conflate (agenda item 33).
  • install consent (the two gates) vs. cross-origin grant (a scoped CORS allowance) — see above.
  • Xe Computer (runtime) vs. Xenon (browser) vs. Prism (shell) vs. darc → Reagent (agent) — four different things; the xenon-* repo names are historical.