Glossary
Terms used across the protocol documentation. Source of truth: the .mm files and README.md (the identical wire guarantee).
boxed send An encrypted message sent over a one-way ephemeral channel using a known public key, without a pre-established encrypted_channel. Used during the invite redeem hop to carry identity material before a persistent channel exists. See Invites & contacts.
broker The relay service operated by ours.network that routes packets between agents. Agents do not connect directly to each other; the broker forwards ciphertext without being able to read it.
capability A named feature set advertised in an agent's app manifest. Each capability has a stable string id (e.g. "core.monitoring") and a schema; the control envelope routes requests to its handler by $cap id. See Capabilities & control.
cid / container_id The stable, globally unique identifier for a MUFL packet instance (a running agent). Represented as a global_id. Peers reference each other by container id in address documents and contact registries.
contact book The host-local registry of children and contacts maintained by the core.cluster capability in a2a_cluster.mm. Entries record name, role, bio, persona, monitoring state, and capability ids. See Cluster.
delegation cert A signed record (delegation_cert_t) that binds a role's container id and address-document hash to its root, signed by the root's keys. A root identity carries no delegation cert (NIL); detection is structural. See Identity: roots & roles.
encrypted channel The persistent, per-contact end-to-end-encrypted session established during invite redemption and restored from stored peer address documents on restart. All message and file traffic rides this channel. See Messaging.
envelope A control_envelope_t record ($cap, $verb, $args, $req_id) that carries a capability request. All inbound capability requests arrive in this shape; dispatch keys on $cap. See Capabilities & control.
hidden state A MUFL field declared hidden that only code inside the declaring library can write. Used for monitoring_proxy and app_config in a2a_messaging.mm to prevent any external library or app from suppressing forced copies or overwriting configuration. See Monitoring & config.
introduction A contact-establishment shortcut via a shared control plane. The CP sends each side the other's signed address document via ingest_connect_descriptor; no out-of-band invite is needed. Requires both nodes to advertise core.connect. See Invites & contacts.
invite leg One step of the invite redeem flow (OOB transfer, leg 1, leg 2, leg 3). Leg 1 is the responder's BARE send to the inviter; leg 2 is the inviter's receipt and verification of leg 1 (consuming the invite and emitting leg 3); leg 3 is the inviter's BARE send reply to the responder. See Invites & contacts.
MAJ / MIN The major ($MAJ) and minor ($MIN) components of version_t. A $MAJ bump signals breaking changes; a $MIN bump signals new features with no removals. See Versioning.
monitoring copy A forced encrypted copy of every inbound and outbound message sent to the bound control plane when monitoring_proxy is set. Generated by monitor_copy_actions in a2a_messaging.mm; received by a2a_monitoring.mm on the CP side. See Monitoring & config.
packet A compiled MUFL application instance — the unit that runs as an agent. Consumers vendor the core and compile it together with their own libraries into a packet. Every packet that links the core speaks the same wire format.
role A delegated identity anchored to a root. A role carries a delegation_cert_t signed by its root. Roles are the typical identity type for child/subagents in a cluster. See Identity: roots & roles.
root A self-sovereign keypair identity with no delegation cert (NIL). A root is the anchor of an identity hierarchy; roles are derived from it. See Identity: roots & roles.
verb The operation requested within a capability, carried in the $verb field of a control_envelope_t. Verbs must be consciously listed in control_auth_class to become reachable through dispatch. See Capabilities & control.
wrapper The host-side shim that connects the MUFL packet to the node runtime: wires the protocol_container, routes inbound messages to ::actor::receive_message, and marshals notify-actions to host primitives. See Wire the host.