Glossary
The vocabulary of the vault
agentvfs has a small, precise vocabulary. Here is what each term means inside the runtime.
- Vault
- A single-file workspace (SQLite by default, Sled or LMDB optional) at ~/.avfs/vaults/<name>.avfs. The agent operates inside it and never touches your real filesystem.
- Execution boundary
- The single line agentvfs draws: the top-level command an agent asks to run. Everything an agent does passes through this one auditable surface.
- Fork
- A millisecond clone of a vault into a separate task workspace (avfs vault fork). Lets an agent run parallel experiments without copying files, then discard the fork.
- Checkpoint / rollback
- A saved rollback point inside a vault (avfs checkpoint save). checkpoint restore snaps the workspace back if an execution mutated state you did not want.
- PolicyEngine
- The side-effect-free classifier that grades a top-level command as allow, allow_with_checkpoint, deny, or require_approval before any workspace work happens.
- Proxy boundary
- The agent-facing execution surface (avfs proxy exec -- <cmd>): classify, optionally checkpoint, mount, run, and return one structured result.
- MountSession
- The FUSE mount lifecycle that exposes a vault as a real directory through an explicit state machine, with double-unmount protection and cleanup on drop.
- ExecutionEnvelope
- The versioned result of a proxy exec: stdout, stderr, exit code, duration, the policy decision, and a ChangeSummary of files touched.
- ChangeSummary
- The list of files an execution created, modified, or deleted — the audit trail an agent uses to reason about what a command actually did.
- microVM composition
- Running agentvfs inside a container, microVM, or under seccomp to add kernel-level containment. agentvfs supplies the workspace and boundary; the OS supplies the isolation.
- Syscall monitor (what it is NOT)
- A tool that observes every syscall or subprocess. agentvfs deliberately is not one — full syscall tracing is an explicit non-goal, keeping the boundary cheap and predictable.
- Quota
- Per-vault limits (max_size_mb, max_files, max_file_size_mb) that block runaway writes with typed QuotaExceeded errors.