The fak/DOS glossary — 17 terms, one line each

The vocabulary a newcomer trips on, defined plainly. Each term links to the explainer that earns the definition. People can only repeat what they can name — this page is the naming.

The runtimes

Gateway (inference) runtime — fak serve: a long-lived server that governs model traffic (routing, cost caps, the capability floor, quarantine, audit); your harness still owns the loop and calls it.
Agent application runtime — fak serve --native: the same binary hosting and running the agent loop itself (sessions, tools, subagents, streaming, resume), every step kernel-adjudicated — not proxying someone else’s turn but running the turn.
Client — the harness or app that calls a runtime (Claude Code, Codex, your SDK backend); fak guard turns a harness you already run into a governed one.
Embed — running the kernel in-process rather than as a separate service: fak guard starts the gateway runtime inside the child’s launch, and the one static binary is the whole surface, so there is no sidecar to deploy.

The cache

Addressable KV cache — a context cache you can reach into the middle of, not just append to: one span can be removed after the fact instead of rebuilding everything behind it.
Bit-exact eviction — removing a span leaves the cache bit-for-bit identical to one that never contained it (max|Δ| = 0): provable forgetting, not best-effort deletion.
Prefix-cache discount — the provider’s cheaper rate for a prompt prefix that is byte-identical to what it has already processed; it survives only while those bytes do not change.

The boundary

Syscall boundary — the line a tool call crosses out of the model’s hands: like a user program calling the OS, the agent proposes an action and a kernel it does not control decides — the model proposes, the kernel disposes.
Verdict — the kernel’s ruling on one proposed tool call (allow, refuse, quarantine), produced by an inspectable check — never by asking the model whether its own call looks safe.
Capability floor — the default-deny list of what an agent may do at all: anything not explicitly granted is refused by structure, so an attack is stopped without having to be recognized.
Quarantine — where a suspicious tool result goes instead of straight into the model’s context: held apart, screened, and admitted only if clean.
Fail-closed — when a check cannot run or cannot decide, the answer is “no”: an error means refusal, never a silent pass-through.

The trust substrate (DOS)

Witness — evidence the system recorded (a git diff, a journal row) rather than a claim an agent narrated; a “done” counts only when a witness backs it.
Refusal reason — a “no” carrying a token from a closed vocabulary (e.g. LANE_DRAINED) instead of free prose, so a peer can verify the condition and act on it.
Lease / arbitration — how parallel agents avoid collisions: each declares the file region it will touch and is admitted only if that region is disjoint from every live lease.
Recall re-verification — a saved memory is re-checked against git and the working tree at the moment it is read; a stale claim is withheld or hedged, never injected as fact.

The change feeds

Change Data Capture (CDC), fak’s sense — fak’s wire feeds (the coherence bus, the hash-chained journal, the drive-state stream) are CDC changelogs for the agent loop: bounded, cursor-ordered, tombstone-carrying logs a data engineer already knows how to consume.

This page is the newcomer’s on-ramp. Two sibling glossaries go deeper on different axes: the canonical split of overloaded core words (session, agent, context, model, memory) and the managed-context glossary (the product contract for what fak manages automatically).