Glossary

Every term, defined once

The vocabulary behind the loop and the boundary. Terms that name a Lodestar OSS capability are marked OSS; Machinaut v0.3.0 is live, and per-capability status lives on the roadmap and in the console, not here.

Architecture & the two planes

LodestarOSS: The open-source (Apache-2.0) trust layer that runs inside your environment. It wraps your agent, records every step as a verifiable chain, and holds risky actions until they’re approved and signed. Machinaut is built on top of it and consumes its stable APIs; it never forks Lodestar’s read/verify logic. Lodestar OSS.
Machinaut: The hosted, multi-tenant control plane on top of Lodestar: the read-side and approval-authority transport where a team governs its agent fleet.
Control plane: Machinaut cloud. Ingest, tenant store, indexed search, explorer, approval relay, audit, fleet, governance. The right-hand box in the govern loop.
Data plane: Your environment, running Lodestar OSS: guard proxy, kernel, adapters, event-log writer, approver keys, the local approval side-channel. Machinaut never hosts this.
Guard proxy · wrap · runtime gateOSS: The three ways Lodestar wraps an agent so its steps are recorded and its risky actions are gated. “Supported agent” means an agent fits one of these paths, not that a per-agent adapter exists.
Memory firewallOSS: The Lodestar subsystem that vets the agent’s beliefs as they form, along four axes — truth · retrieval · security · freshness — flagging or quarantining ones that are contested, poorly sourced, suspicious, or stale. Several governance signals below report where a belief sits in the firewall.

The record

EnvelopeOSS: One recorded event in the log — the atomic unit Lodestar writes and Machinaut ingests. A session is a stream of envelopes.
Session: One agent run. The unit that gets shipped, projected into a chain, and shown in the explorer.
ChainOSS: The projection of a session’s envelopes into the six-stage reasoning spine below. Reading a chain top to bottom is reading the agent’s reasoning from raw input to governed action. The projection is OSS; Machinaut renders it, never recomputes it.
Chain report (a.k.a. post-mortem when shared)OSS: The rendered, shareable view of a session’s chain. “Chain report” is the primary term; a post-mortem is the same artifact made public — the two names refer to one thing.
Project: A named stream of sessions within a tenant (e.g. one agent deployment or one repo). The ingest and relay contracts are project-scoped.
Tenant: The isolation boundary. All storage is tenant-scoped; one org’s data is never visible to another.
Org: The identity container: users, roles, invites. Maps to a tenant.

The six-stage chain

The reasoning spine every shipped session projects to.

#	Stage	Definition
1	Observations	What the agent took in — tool results, files, messages.
2	Claims	Assertions the agent derived from those observations.
3	Evidence	What supports or contradicts each claim.
4	Beliefs	The agent’s calibrated confidence, given the evidence.
5	Decisions	The choices it made from those beliefs.
6	Actions	The effects on the world — the governed, approvable steps.

Governance signals

The per-signal definitions shown as inline tooltips in the chain views. Every one describes an OSS dimension the signal comes from — it explains the model you’re looking at, and never claims that model as Machinaut’s.

Trust (provenance): Provenance of this observation — raw as captured, validated, or synthetic.
Sensitivity: Data-sensitivity class that drives redaction: public · internal · confidential · secret.
Claim status: Where the claim sits in the firewall: extracted → contested → accepted / rejected.
Confidence: The agent’s stated confidence in this belief — the number calibration scores.
Truth status: Truth axis — whether the belief is held as supported, contested, or contradicted.
Security status: Security axis — whether the memory firewall flagged this belief (e.g. suspicious, quarantined).
Authority: The authority on whose say-so this belief is held.
Calibration class: The calibration bucket this belief is scored under — drives the Calibration view.
Lifecycle: The belief’s four firewall axes: truth · retrieval · security · freshness.
Evidence relation: How each item bears on the claim — supports, contradicts, or contextualizes.
Decision maker: The actor that made this decision.
Trust level: Trust level the action requires to run — higher levels gate riskier actions.
Contract: The action’s risk contract — blast radius, reversibility, and the sensitivity of data it touches.
Terminal phase: Where the action ended in its lifecycle (e.g. proposed, executed, blocked).
Outcome: What actually happened when the action ran — success, failure, or partial.

Governance & approvals

Hold / held actionOSS: A risky action the policy kernel gates on allow / deny / hold, paused until a human approves it. In the app, held actions surface in the approval inbox. Safe default: a hold that is denied or never resolved does not run — an unresolved hold times out to a deny.
Approval inbox: The hosted queue of holds awaiting a decision, with a deep-link to the shipped chain so the approver reads the reasoning before signing.
Resolution: A signed Approve or Deny decision, bound to the specific request and action. Verified customer-side — Machinaut only transports it.
Approver keys: The Ed25519 key pair that signs resolutions. Customer-held on every tier today, Free included; Machinaut never sees them. See the trust boundary.
Ceiling (sensitivity ceiling)OSS: The redaction threshold. Data above the ceiling is redacted at the source before it ships; only its hash travels, as a commitment. The approval announce is ceiling-gated too, since it can leak an action’s inputs.
RedactionOSS: Sensitivity-driven removal of data above the ceiling, done locally before shipping. Tamper-evident: a payload hash ships as a commitment, so a later clearance can verify the original against it.
Calibration (ECE / Brier): How well the agent’s stated confidence matches reality, scored per class. The math is OSS; Machinaut charts it over a fleet.
Sentinel: An OSS detector that flags a condition (e.g. an anomaly). Machinaut’s read-side rolls these up per-session and per-fleet — a security-alert feed, not a metrics dashboard — with optional best-effort Slack / webhook alerting. (Email alerting is planned.)
Policy: The signed rule set the kernel enforces. Machinaut hosts policy drafting and indicative impact-simulation as beta API endpoints, but the signed set is minted customer-side — the cloud exports an unsigned draft, a local signer signs it, the kernel verifies it. (The policies console surface is planned; signing is customer-side by design — never in the cloud.)
Draft vs. signed policy: A draft is the unsigned rule set authored in the cloud editor. A signed policy is that draft after a customer-side signer has signed it; only signed policies the kernel can verify take effect. Cloud never signs.
Audit log: The org-scoped record of governance actions (approvals, role changes), exportable to CSV / NDJSON.
Fleet: Cross-session, cross-project views over a whole tenant — the “many agents, many projects” rollup the single-operator OSS viewer can’t give.

The ship / ingest / relay contracts

The three touch-points where the two planes meet, described at a glance.

ShipOSS: The OSS command that sends a copy of a session’s event log to a Machinaut ingest endpoint. Batch, not a live tail; re-shipping a grown session is free (ingest dedupes).
Ingest: Machinaut’s receiver for shipped logs: it verifies each non-redacted record’s tamper-evidence, retains a redacted record’s hash as a commitment, and dedupes so retrying the whole batch is safe.
Relay: The transport the customer-side proxy calls to run a hold through Machinaut. Three operations: announce (best-effort push when a hold opens, ceiling-gated), fetch (get the resolution, if any), and consume (clear it). What the relay returns is untrusted transport, verified customer-side.
Payload hashOSS: The tamper-evidence commitment on each envelope. Verified on non-redacted records; retained on redacted ones so a later clearance can check the original.

Where the status lives

Machinaut v0.3.0 is live — the explorer is shipped; the governance console and the v0.3.0 enterprise surfaces are in beta. For the honest, per-capability status (shipped · beta · planned), see the roadmap.