Purpose: one shared vocabulary so docs, code, CLI, API, and AI agents use the same words for the same things. If a term is used in two places with two meanings, that is a bug — fix it here first.
| Term | Definition |
|---|---|
| Desktop Shell | The Tauri + WebView UI process. Renders screens, holds no business logic, talks only to the Local API. |
| Application Core | The local Rust service that owns all stateful logic (profiles, vault, proxy, fingerprint, automation, core provider). The only thing allowed to touch storage and browser processes. |
| Local API | The single in-process/loopback control boundary exposed by the Application Core. Every other surface (UI, CLI, MCP, scripts) is a client of it. |
| Browser Core | The actual browser binary that renders pages (today: temporary Chromium; later: patched Chromium). |
| Browser Core Provider | The abstraction that locates, launches, and drives a Browser Core. Swappable implementation; the rest of the system does not know which core is running. |
| Profile | A persistent browser identity: its user-data-dir (cookies, storage, history) plus its fingerprint config, proxy binding, and metadata. Not “just a folder”. |
| Profile Blob | The serialized, compressed, encrypted + signed form of a profile used for storage and sync (<uuid>.blob + <uuid>.sig). |
| Materialization | Turning a Profile Blob into a live, runnable user-data-dir on the local disk. |
| Profile State | The lifecycle phase of a profile (see PROFILE_STORAGE_SYNC.md): CLOUD_ONLY, LOCAL_CACHED, MATERIALIZED, RUNNING, DIRTY, SYNCING_UPLOAD, SYNCING_DOWNLOAD, CONFLICT, LOCKED_REMOTE. |
| Fingerprint Config | A structured, validated catalog describing the identity Chromium should present (OS, version, GPU, screen, fonts, timezone, WebRTC policy…). Not random JSON. |
| Vault | The encrypted local store for secrets (proxy creds, cookies on export, automation variables, tokens). Access is gated by policy mode. |
| Proxy Binding | The association of a profile to a proxy, enforced consistently across HTTP/DNS/WebRTC/QUIC. |
| Automation Script | A unit of automation (visual graph or code) executed against one or more profiles. |
| Module | A reusable, versioned automation building block composed into scripts; custom code runs in the Node sidecar. |
| Task | One execution of an Automation Script against one profile. |
| Task Group | A named collection of automation runs over a set of profiles, with scheduling, retries, and logs. |
| Run | A live or finished execution with status, logs, and artifacts. |
| Runner | A separate worker process that executes a Task and drives its profile’s core; the daemon supervises it (ADR-0020). |
| Synchronizer | Opens N profiles at once and mirrors a master’s actions across them; synchronizer.broadcast applies one action to several running profiles in one call, isolating per-profile failures (PHASE5_PLAN §3e). |
| Patch Series | The ordered set of independent diffs applied on top of an upstream Chromium tag to produce the patched core. |
| Core Provider Contract | The interface every Browser Core Provider must satisfy (launch, attach, CDP endpoint, version, capabilities, shutdown). |
| Policy Mode | The active permission level for dangerous operations: normal, power, danger/admin. |
| Action Log | Append-only audit record of meaningful/dangerous operations (who, what, when, mode, result). |
| Control Plane | Local API + CLI + MCP + agent tooling: the surfaces used to operate the system. |
| Data Plane | The actual browsers + profile data being operated on. |
| Pack | Turning a live user-data-dir back into a Profile Blob (compress → encrypt → sign). The inverse of Materialization; together they are the only dir↔blob bridges. |
| Data Key (DEK) | The random per-profile key that AEAD-encrypts a Profile Blob’s payload. Wrapped by one or more KEKs; never stored unwrapped. (ADR-0008) |
| Key-Encryption-Key (KEK) | A key that wraps (encrypts) a DEK. Several per profile — password (Argon2id), Recovery Key, optional passkey/OS-keychain, team org-KEK — any one unwraps the DEK. (ADR-0008) |
| Envelope Encryption | Encrypting data with a DEK and wrapping that DEK with multiple independent KEKs, so recovery never needs server-held plaintext. (ADR-0008) |
| Recovery Key | A high-entropy secret generated at setup, stored offline by the user (emergency kit); an independent KEK that recovers a profile if the password is lost. (ADR-0008) |
| Trust Score | A per-identity score = provenance × validator result × core capability; low-trust launches are flagged, not silently shipped. (FINGERPRINT_CONFIG_CONTRACT §6) |
| Walking Skeleton | The minimal end-to-end Phase-1 slice (≈6 Local API methods) that opens a real browser through the full boundary — proves the architecture before breadth. |
| Lockstep / Contract Codegen | The rule that CLI, MCP tools, and SDKs are generated from the one OpenAPI contract and CI-checked against it, so the surfaces can’t diverge. (CODEGEN_PIPELINE, invariant #8) |