- Agent
- An agent in Pega is an internal background process operating on the server that runs activities on a periodic basis. In a multi-node cluster, an agent can run on multiple nodes.
- Agentic Web
- The Holding Company's initiative (renamed from "User Agency Web" on 2026-07-21) for machine-readable personal identity surfaces that AI agents can read and act on: username.md, about-me.md, and finger.md, with the Verified Agent Inbox as the killer feature. Not to be confused with the generic industry phrase "agentic web."
- ACME
- Automated Certificate Management Environment — the IETF protocol Let's Encrypt uses to issue and renew TLS certificates. HC uses Traefik's built-in resolver (DNS-01 via DigitalOcean) for standard cases, and acme.sh for edge cases where Traefik's lego provider fails.
- ATProto
- The AT Protocol (Authenticated Transfer Protocol) — the decentralized social networking protocol behind Bluesky. Identities are DIDs; handles are DNS names resolved via a TXT record at _atproto.<handle> or GET /.well-known/atproto-did. username.md handles double as ATProto handles (HC-929, 2026-07-22).
- DID
- Decentralized Identifier (W3C) — a stable, cryptographically verifiable identifier resolved to a DID document listing public keys and services. ATProto blesses two methods: did:plc (Bluesky's self-authenticating registry at plc.directory) and did:web (resolved from https://<host>/.well-known/did.json). identity-core mints did:web identities for every username.md/about-me.md handle.
- Multikey
- A W3C verification-method type that encodes a public key as multibase base58btc ('z' prefix) over a multicodec varint tag plus the raw key bytes (secp256k1 compressed = 0xe7 0x01 + 33 bytes). ATProto DID documents expose the account signing key as a Multikey with id #atproto.
- PDS
- Personal Data Server — the ATProto server hosting an account's repository and signing key; declared in the DID document as the #atproto_pds service. bsky.social operates the flagship PDS; self-hosting is supported, but no PDS yet allows creating did:web accounts directly (atproto discussion #3140).
- Lexicon
- ATProto's schema language: a namespaced ID (NSID, e.g. chat.bsky.group.createGroup) plus a JSON schema defining an XRPC method or record type. Bluesky's group chats (launched 2026-06-11) live under the chat.bsky.convo.* and chat.bsky.group.* lexicons, served by the centralized chat service did:web:api.bsky.chat rather than user PDSes.
- XRPC
- ATProto's HTTP convention for API calls: GET/POST to /xrpc/<NSID> with JSON in and out. Queries are GETs, procedures are POSTs. Calls to shared services (like Bluesky chat) go through the user's PDS with an atproto-proxy header naming the target service DID (e.g. did:web:api.bsky.chat#bsky_chat).
- ADR
- Architecture Decision Record — a short markdown doc capturing a significant architectural decision (context, decision, consequences). Repos keep ADRs in docs/adr/; a sync job mirrors them into the HC Knowledge Base.
- AEO
- Answer Engine Optimization — structuring content so AI answer engines (ChatGPT, Perplexity, Google AI Overviews) can find, cite, and quote it: JSON-LD structured data (FAQPage, SoftwareApplication), question-shaped headings, canonical/alternate links, and machine-readable endpoints alongside the HTML. The successor discipline to SEO for the agentic web. First HC application: skillx.md/skills/skillx-verify/.
- GEO
- Generative Engine Optimization — sibling term to AEO used in marketing literature: optimizing content for visibility inside generative-AI answers (LLM chatbots, AI Overviews) rather than ranked links. HC treats AEO as the umbrella discipline; GEO appears as a search keyword (e.g. consulting.chrisbergeron.com keywords meta, 2026-08-03).
- EU AI Act
- Regulation (EU) 2024/1689 — the EU’s risk-based AI law. Prohibited practices banned Feb 2, 2025; GPAI model rules Aug 2, 2025; Article 50 transparency obligations and penalty powers (up to €35M / 7% global revenue) in force Aug 2, 2026; standalone high-risk (Annex III) obligations Dec 2, 2027 after the Digital Omnibus deferral. Applies extraterritorially when AI output is used in the EU.
- GPAI
- General-Purpose AI — the EU AI Act’s term for foundation models usable across many tasks (e.g. Claude, GPT). GPAI providers (model makers) carry transparency, technical-documentation, and copyright-policy obligations under Articles 51–56 (in force Aug 2, 2025); companies that merely build on such models are deployers with lighter duties.
- Digital Omnibus
- EU simplification package (proposed Nov 19, 2025; Council-approved Jun 29, 2026) amending the AI Act: deferred the standalone high-risk (Annex III) compliance deadline from Aug 2, 2026 to Dec 2, 2027 (12 months for AI embedded in regulated products), while leaving GPAI and Article 50 transparency timelines untouched.
- BFF
- Backend For Frontend — a dedicated backend service purpose-built for a specific frontend (as opposed to a general-purpose API consumed by many clients). Lets each frontend get a tailored contract, aggregation, and auth flow without bloating a shared API. HC's username.md has a checkout BFF that specifically serves the claim/checkout UI. See HC-1176 (round-robin sometimes hits an instance without the BFF baked in) and HC-1277 (BFF code baked into the AMI never ships because the LT never diffs).
- CMK
- Customer Master Key — the legacy AWS KMS term for a cryptographic key used to encrypt and decrypt data. AWS now formally calls these "KMS keys" but "CMK" persists in older docs, IAM policies, and SDK method names. At HC, bao-01's auto-unseal uses the CMK aliased alias/holdingco/bao-01-seal.
- IAM
- Identity and Access Management — the discipline of managing who can do what across systems. In AWS-speak: the IAM service (users, groups, roles, policies). In generic terms: the umbrella that covers SSO, RBAC, provisioning, and MFA. HC's IAM stack is Keycloak (IdP) + LLDAP (directory) + YubiKeys (MFA).
- IdP
- Identity Provider — the system that authenticates users and issues tokens or assertions to relying parties. HC's IdP is Keycloak at auth.holdingco.com; upstream identities live in LLDAP.
- JWT
- JSON Web Token — a compact, self-contained token format (header.payload.signature, base64url-encoded) used to convey claims between parties. The standard bearer token in OIDC and OAuth 2.0. Payloads are signed (typically HS256/RS256/ES256) but NOT encrypted — anyone can base64-decode and read the claims.
- LDAP
- Lightweight Directory Access Protocol — protocol for querying a hierarchical user/group directory (descendant of X.500). HC runs LLDAP, a Rust reimplementation, on port 6360; Keycloak federates users against it.
- LT
- Launch Template — the AWS EC2 Auto Scaling Group input that defines what a new instance should look like (AMI, instance type, user data, IAM role, network config). ASGs only trigger an instance refresh when the LT's version changes. HC's ongoing gotcha (see HC-1277): fleet-baked code (worker, nginx config, checkout BFF) lives inside the AMI referenced by the LT, but the LT itself is only re-versioned when the AMI ID changes — so code-only rebuilds never trigger a refresh and stay dark forever until someone manually bumps the LT or forces a refresh.
- MFA
- Multi-Factor Authentication (aka 2FA when exactly two factors are used) — requiring more than a password: something you have (YubiKey, phone), something you are (biometric), or something you know (PIN). HC uses YubiKeys as the primary second factor.
- OAuth
- OAuth 2.0 — an authorization framework (NOT authentication — a common confusion). Lets users grant a third-party app scoped access to their resources on another site without sharing the password. Basis for "Sign in with Google/GitHub" flows; OIDC adds an authentication layer on top.
- OIDC
- OpenID Connect — an identity/authentication layer built on top of OAuth 2.0. Adds an ID token (a JWT) with user claims. The modern default for SSO; used by Keycloak, Auth0, Google, GitHub, and every recent OAuth-based flow. Compare with SAML — older, XML-based, still ubiquitous in enterprise.
- PKI
- Public Key Infrastructure — the full stack around asymmetric crypto: certificate authorities, issuance, revocation (CRL/OCSP), trust stores. HC's public PKI runs on Let's Encrypt via ACME; internal PKI options include smallstep-ca and OpenBao's PKI engine.
- Passkey
- A WebAuthn-based credential that replaces passwords. Uses public-key crypto: the private key stays on the device (YubiKey, Touch ID, phone secure enclave); the site holds the public key. Phishing-resistant by design because the browser scopes credentials to the origin. Chris owns two YubiKeys for this workflow.
- RBAC
- Role-Based Access Control — assigns permissions to roles, then assigns users to roles. Simpler than ABAC (attribute-based) but coarser-grained. Used by Kubernetes, Keycloak, AWS IAM, and basically every modern access control system.
- SAML
- Security Assertion Markup Language — XML-based standard for exchanging authentication and authorization data between an IdP and a Service Provider. Older than OIDC (2005 vs 2014) but still ubiquitous in enterprise SSO. Assertions are signed (and sometimes encrypted) XML documents.
- SCIM
- System for Cross-domain Identity Management — a REST-based protocol for provisioning users and groups across systems automatically. When you add someone in Okta and they show up in Slack, GitHub, and Notion five seconds later — that's SCIM.
- SSO
- Single Sign-On — authenticate once with your IdP, get access to all federated apps without re-entering credentials. Implemented via OIDC or SAML underneath. HC's SSO backbone is Keycloak.
- SecureString
- AWS Systems Manager Parameter Store's encrypted parameter type. Values stored as SecureString are encrypted at rest with a KMS key (either the default alias/aws/ssm or a customer-managed CMK). HC's aws-wg-dialhome contract lives under /holdingco/wg-dialhome/* with SecureString values for the WireGuard keys. Compare with OpenBao, which HC uses as the primary secrets store for on-prem-originated secrets.
- TOTP
- Time-based One-Time Password (RFC 6238) — the 6-digit codes generated every 30 seconds by Google Authenticator, Authy, 1Password, etc. Shared secret between the app and the server; both derive the current code from the current timestamp.
- ARD
- Agent-Readable Descriptor — an HC convention: a JSON file published alongside an artifact (e.g. a signed SKILL.md) that gives AI agents everything needed to evaluate, verify, and install it — artifact URL + sha256, signature format, publisher DID, install command, provenance (registry + transparency-log seq), and discovery links. First instance: skillx.md/skills/skillx-verify/ard.json.
- B2A
- Business-to-Agent — serving AI agents as first-class consumers of a website or service, the way B2B/B2C serve businesses and consumers. The 2026 canonical B2A protocol stack is MCP, A2A, x402, AP2, Web Bot Auth, and llms.txt. HC properties publish llms.txt (read layer) and /.well-known/agent.json (identity descriptor) as their B2A surface.
- AGI
- Artificial General Intelligence — hypothetical AI that matches or exceeds human cognitive ability across every domain. The stated long-term goal of Anthropic, OpenAI, and Google DeepMind. Definitions vary; timelines hotly debated.
- Anti-dilution
- Protects investors from dilution when new shares are issued at a lower price than they paid (a "down round"). Two main flavors: full ratchet (most investor-friendly) and weighted average (more balanced, more common). Typically granted to preferred shareholders in VC rounds.
- Articles of Association
- The primary constitutional document of a company (UK/EU/Commonwealth usage; equivalent to "Certificate of Incorporation" + "Bylaws" in the US). Sets out the rules for running the company: share classes, director powers, shareholder meetings, dividends, and transfer restrictions.
- ASK
- Alexa Skills Kit — Amazon's SDK and toolchain for building Alexa voice skills (interaction models, intents, slots, Lambda backends). Used by the username.md Voice Pay skill.
- ASR
- Automatic Speech Recognition — turning audio into text. Whisper is the de-facto open-source baseline. Foundational layer for any voice agent.
- Attention
- The core operation of a transformer: for each token, compute a weighted sum over every other token in the context based on learned similarity. Lets the model decide what to "look at" when predicting the next token. Named in the seminal paper "Attention Is All You Need" (Vaswani et al., 2017).
- CB Consulting
- The AI consulting arm of The Holding Company. Site: consulting.chrisbergeron.com.
- Chain of Thought
- CoT — prompting technique: ask the model to "think step by step" before answering. Often improves accuracy on math, reasoning, and multi-step problems. Modern reasoning models (o1, Claude with extended thinking) bake this pattern in.
- Classify
- All-in-one document classifier accepting input from email, uploads, drafts, webhook, API, and MCP. Domains: classify.md and sink.md.
- Claude
- Anthropic's family of LLMs and HC's day-to-day AI. Current generation is Claude 4.X: Opus 4.7 (frontier reasoning, 1M context), Sonnet 4.6 (balanced), Haiku 4.5 (fast/cheap). Claude Code is the agentic CLI built on these models.
- Context Window
- The maximum number of tokens a model can attend to in a single inference call. Older LLMs were 4k–8k; Claude Opus 4.7 supports up to 1,000,000 tokens.
- Deep Learning
- DL — machine learning using multi-layer neural networks. The breakthroughs of the 2010s (image recognition, AlphaGo, transformers, LLMs) all rest on this stack.
- Drag-along Rights
- A clause allowing a majority shareholder (or investor group) to force minority shareholders to agree to a company sale on the same terms. Prevents small holdouts from blocking an exit.
- Embedding
- A dense vector representation of text, image, or audio produced by a model. Similar meaning → nearby vectors. The substrate of semantic search, RAG, classification, and recommendation.
- EMF
- Embedded Metric Format — AWS CloudWatch convention where a structured JSON blob printed to CloudWatch Logs is automatically extracted into metrics, so emitters need only logs IAM permissions (no PutMetricData). Used by dns-freshness-probe for the UserFreshness/DNS namespace.
- Eval
- Standardized tests used to compare model capabilities — MMLU (general knowledge), HumanEval (code), GSM8K (math), ARC, GPQA. Public benchmarks suffer from leakage and gaming; private evals against your own use case matter more in practice.
- Few-shot
- Zero-shot: give the model only the task. Few-shot: include a handful of input→output examples to anchor format and style. n-shot scales with the number of examples.
- Fine-tuning
- Continuing to train a pretrained model on a smaller, task-specific dataset to specialize behavior. Compare RAG (no weight changes) and prompt engineering (no training at all). LoRA is the common cost-efficient form.
- GFS (Grandfather-Father-Son)
- Backup rotation scheme keeping tiered copies at increasing intervals — HC's db-backup keeps 7 daily, 4 weekly (Sunday), and 6 monthly (1st) dumps per database, promoted by hardlink so older tiers cost no extra disk.
- Good Leaver / Bad Leaver
- Clauses determining equity treatment of departing founders or employees. A good leaver (illness, redundancy, retirement) typically retains vested equity. A bad leaver (resignation without notice, termination for cause) may forfeit unvested and sometimes vested equity.
- Hallucination
- An LLM generating fluent, confident output that is factually wrong or fabricated. Mitigations: RAG, tool use, citation requirements, lower temperature, and treating outputs as untrusted until verified.
- HTTP Message Signatures (RFC 9421)
- IETF standard for cryptographically signing HTTP requests/responses at the header layer. A Signature-Input header names the covered components (e.g. content-digest per RFC 9530, @authority) and a Signature header carries the signature over them, verifiable against a published key. HC usage (HC-1128): identity-core signs every response with a platform Ed25519 key (HKDF-derived from the KEK); JWKS published at /.well-known/http-message-signatures-directory. Lets any agent verify a username.md response without trusting the transport.
- Hinge Hider
- HC's flagship physical product — a household garage door accessory. Domains: hinge-hider.com (primary) and hingecover.com.
- The Holding Company
- THC / HoldingCo — umbrella corporation and financial vessel managing HC's portfolio: an AI consulting agency (CB Consulting), microbrands, and physical products like Hinge Hider. Landing page: holdingco.com.
- JSON-LD
- JSON for Linked Data — W3C standard for embedding machine-readable structured data (usually schema.org vocabulary) in JSON. Used at HC for about-me.md's agent-consumable schema.org/Person profiles at /u/<handle>.jsonld and embedded ProfilePage blocks (HC-1166).
- JRD
- JSON Resource Descriptor — the response format of WebFinger (RFC 7033): subject, aliases, links, properties, served as application/jrd+json. identity-core returns one per handle at /.well-known/webfinger on username.md and about-me.md (HC-1169).
- LFG
- Looking For Group — gaming term for finding teammates for a session, raid, or match. Context for the username.md gamers page (HC-1111): LFG bots and sites are prospective metered resolvers of User Freshness presence records.
- LLM
- Large Language Model — a transformer-based neural network trained on broad text corpora to predict tokens. Powers Claude, GPT, Llama, Gemini and others.
- Lock-in
- Lock-up — a period during which shareholders (typically founders and management) are prohibited from selling their shares, usually post-IPO or post-acquisition. Common periods are 6–12 months.
- LoRA
- Low-Rank Adaptation — parameter-efficient fine-tuning technique. Instead of updating all model weights, train small low-rank matrices added to the existing weights. Drastically reduces compute and storage.
- Machine Learning
- ML — the broader field of which deep learning and modern AI are subsets. Statistical methods that learn patterns from data rather than being explicitly programmed.
- MCP
- Model Context Protocol — the interface Claude Code uses to talk to external services. HC has MCP servers for NotePlan, Slack, Google Calendar, Gmail, Linear, computer-use, and others.
- MoE
- Mixture of Experts — architecture where the model has many "expert" subnetworks but only a few are activated per token via a learned router. Lets total parameter count grow without proportionally increasing inference cost. Used by GPT-4, Mixtral, DeepSeek-V3.
- Multimodal
- A model that handles more than one modality — text, images, audio, video — in a single architecture. Claude is text+image; GPT-4o adds audio.
- NLP
- Natural Language Processing — the field concerned with making computers understand, generate, and operate on human language. The umbrella that LLMs, embeddings, RAG, and modern conversational AI all fall under.
- Ollama
- Local LLM inference server. Wraps llama.cpp with a clean HTTP API for pulling and running open-weight models (Llama, Mistral, Qwen, Phi, etc.). HC runs it at http://192.168.42.108:11434.
- Pastemonkey
- Universal-clipboard product. Domain: pastemonkey.com.
- Prioritizr
- LLM prioritizer and router. Domains: prioritizr.app and priority.md.
- Prompt Caching
- Anthropic-specific feature where repeated prompt prefixes (system prompts, long documents) are cached on Anthropic's servers and reused at a fraction of the input-token cost. 5-minute TTL. Critical for agentic loops.
- Prompt Engineering
- The craft of writing instructions, examples, and structure for an LLM to maximize useful output. Includes role/system prompts, few-shot examples, chain-of-thought scaffolding, and output-format constraints.
- Prompt Injection
- An attack where untrusted input contains instructions that override the system prompt or coerce the model into unintended behavior. Especially dangerous in agentic systems that can take actions.
- Quantization
- Reducing the numeric precision of model weights (FP16 → INT8, INT4, etc.) to shrink memory footprint and speed up inference. Allows large models to run on consumer hardware.
- RAG
- Retrieval-Augmented Generation — grounds LLM responses by retrieving relevant snippets from a corpus (via embedding search in a vector database) and injecting them into the model's context. The canonical alternative to fine-tuning when you want a model to know your own documents.
- RLHF
- Reinforcement Learning from Human Feedback — training technique to align LLMs with human preferences after pretraining. Humans rank model outputs; a reward model is fit; the LLM is RL-optimized against it. The reason modern chat models follow instructions rather than just continuing text.
- ROFR
- Right of First Refusal — gives a party (often the company or existing investors) the right to match any third-party offer before a shareholder can sell their shares externally.
- RPO / RTO
- Recovery Point Objective — the maximum acceptable data loss window (how old the last good backup may be); Recovery Time Objective — the maximum acceptable time to restore service. HC's database backup policy targets a 24-hour RPO and sub-30-minute per-database RTO.
- TCC
- Transparency, Consent, and Control — the macOS privacy subsystem that gates app access to sensitive folders (~/Documents, ~/Desktop, ~/Downloads, etc.). The reason Colima's VM can't see ~/Documents without an explicit Full Disk Access grant to Lima.
- Temperature
- Sampling hyperparameter controlling randomness in LLM output. 0 = always pick the most likely next token (deterministic); higher = more diverse. Set low for factual/code tasks, higher for creative writing.
- Token
- Tokenization — the subword units an LLM reads and emits. A token is typically ~3–4 characters of English. Pricing, context limits, and rate limits are all measured in tokens.
- Tool Use
- Function Calling — pattern where an LLM emits a structured request to invoke an external function (search, file write, API call, etc.) and continues with the result. The mechanism behind every modern AI agent. Anthropic calls it Tool Use; OpenAI calls it Function Calling; MCP standardizes the contract.
- Transformer
- The neural-network architecture (Vaswani et al., 2017, "Attention Is All You Need") underlying nearly every modern LLM. Built around the attention mechanism instead of recurrence; trains in parallel over whole sequences. The T in GPT, BERT, T5.
- TTS
- Text-to-Speech — synthesize speech from text. Modern systems (Chatterbox, ElevenLabs, OpenAI TTS) produce near-human prosody. Used in HC's Avatar Studio stack and Kiko voice agent.
- Vector Database
- A datastore optimized for storing embeddings and answering nearest-neighbor queries at high throughput, usually via HNSW indexes. HC's homelab uses Qdrant at qdrant.chrisbergeron.com.
- WebFinger
- RFC 7033 discovery protocol used by Mastodon and the fediverse: GET /.well-known/webfinger?resource=acct:user@domain returns a JRD describing the identity. identity-core serves it for username.md + about-me.md handles, linking profile page, did.json, and the bound ATProto DID (HC-1169).
- WebMCP
- Google's browser-native take on MCP, shipped in Chrome Canary (2026): websites expose declarative and imperative B2A APIs so in-browser agents can call page-level tools directly instead of scraping the DOM. Complements llms.txt (read layer) as the act layer of the agent-readable web.
- Waterfall
- Distribution priority when a company is sold or liquidated: secured creditors → preferred shareholders (liquidation preference) → common shareholders. Participating preferred holders can double-dip: collect their preference then share in the remainder.
- Whisper
- OpenAI's open-source ASR model — the de-facto baseline for speech-to-text transcription. Used in HC's voice pipelines.
Common terminology commonly used in Location Operations at Cox Automotive. This glossary is self-supported, so item accuracy is not guaranteed.