Skip to main content

Glossary

Every word this documentation uses that you might not already know, defined in one plain sentence and linked to the page that explains it in full. If a term you met isn't here, search the troubleshooting page — error messages often introduce their own vocabulary.

A​

  • Acknowledge (ack) — telling Pub/Sub you have finished with a message so it is never delivered to you again; a message you don't acknowledge comes back. See publish and consume.
  • Ack deadline — how long you may hold a pulled message before the platform assumes you failed and redelivers it (1 to 600 seconds, 30 by default). See topics and subscriptions.
  • Activity — one retryable step inside a workflow, such as calling an agent. See durable execution.
  • Agent — a folder of Python agent code that the platform builds into a container and runs as a chat endpoint with sessions, memory, and tools wired in. See Agent Engine overview.
  • API key — a long-lived credential in the form cai_... that a script sends instead of signing in; its secret is shown exactly once and it can be revoked instantly. See service accounts and API keys.
  • Apply — the step that actually delivers your bound secrets to an agent and rolls a new revision; recording a binding alone changes nothing. See manage secrets.
  • At-least-once — the delivery promise for Pub/Sub: every message arrives, but it may arrive twice, so consumers must tolerate duplicates. See publish and consume.
  • Audit log — your project's append-only record of who changed what and when, readable by every member of the project. See break-glass and audit.
  • Automation token — a cluster-level machine credential that operators and the CLI can fall back on when no other credential is present. See API authentication.

B​

  • Backlog — the Pub/Sub messages that have been published but not yet acknowledged by a subscription; this is what the storage budget counts. See publish and consume.
  • Binding (secret map) — the recorded rule "stored secret X should arrive as environment variable Y on agent Z". See manage secrets.
  • Break-glass — a platform admin's self-granted, reason-required, expiring access to a project they are not a member of; it is visible to the project's members and recorded in the audit log. See break-glass and audit.
  • Build — the automatic packaging of your uploaded code into a container image; when it fails, its output lands in the resource's status message. See deploy an agent.

C​

  • CloudEvent — the standard envelope the platform wraps an event in when it delivers one to your code over HTTP. See HTTP and events.
  • Cold start — the extra delay on the first request after idle, while the platform starts an instance and loads your code. See autoscaling and scale to zero.
  • Collection — the internal storage name behind a VectorDB index (p_<project-short>_<index>); the platform derives it so two projects can each have an index called documents. See collections and points.
  • Command palette — the console's Cmd/Ctrl+K search box that finds any resource you can see and switches projects. See console overview.
  • Concurrency — how many requests one instance handles at the same time before the platform starts another (80 by default). See autoscaling and scale to zero.
  • Condition — one named pass/fail check behind a resource's overall status, such as whether its public URL actually answers yet. See deploy a service.
  • Console — the web interface for the whole platform, at https://console.codyhill.dev. See console overview.

D​

  • Data plane — talking to something you deployed (invoking an agent, calling a function); it is open by default, unlike the management plane. See invoke.
  • Dead-letter topic — a second Pub/Sub topic where a repeatedly failing message is parked instead of being lost. See topics and subscriptions.
  • Dimensions — how many numbers are in every vector in a VectorDB index; it must match your embedding model and can never be changed. See collections and points.
  • Distance metric — how VectorDB measures "near": cosine (angle, the usual choice), dot, or euclid. See search.
  • Durable execution — running multi-step code whose progress is checkpointed, so it survives crashes and retries failed steps automatically. See durable execution.

E​

  • Embed key — the public identifier (emb_ followed by 24 characters) that ties a pasted chat-widget snippet to one agent; it is an app id, not a secret. See embed chat.
  • Embedding — a list of numbers that represents the meaning of a piece of text, produced by a model, so that similar text produces similar numbers. See VectorDB overview.
  • Eviction policy — what a MemoryStore instance does when it hits its memory limit: refuse new writes (noeviction, the default) or drop old keys by a rule (allkeys-lru and friends). See MemoryStore overview.
  • External URL — the public HTTPS address a published workload gets, in the form https://<name>-<project-short>.apps.codyhill.dev. See public endpoints and domains.

F​

  • Framework — which agent library your code is written for: ADK, LangGraph, or CrewAI, decided by your entry file and fixed per agent. See ADK, LangGraph, CrewAI.
  • Function — a single file exposing one handle(event) entry point, in Python, Node.js, Go, or Ruby, deployed as a scale-to-zero HTTPS endpoint. See functions overview.

G​

  • Grant — the role (member or admin) that gives one person or one machine access to one project; access is never automatic from being in the same organization. See projects and access.

H​

  • Harness — the small web server the platform bakes into every agent image; it loads your code and exposes the standard invoke API so callers never see framework differences. See Agent Engine overview.

I​

  • Index — a named container in VectorDB for vectors that all share one width and one distance metric. See VectorDB quickstart.
  • Instance — either one running copy of a workload, or one private MemoryStore server your project owns; context tells you which. See MemoryStore overview.
  • Invitation — a one-time link that grants someone a project role and, for newcomers, creates their account with a password they choose. See projects and access.
  • Invoke — sending a message to a deployed agent and getting its answer back. See invoke.

M​

  • Management plane — everything that creates, changes, or inspects platform state (deploy, logs, secrets, delete); it always requires a credential. See API authentication.
  • MCP server — your Python tool code hosted as a Model Context Protocol endpoint that agents and MCP-speaking apps can call. See MCP servers overview.
  • Member — the project role that can use a project's resources but not do the irreversible things (delete, reveal, mint credentials). See projects and access.
  • Memorize — the deliberate step that distills one conversation into an agent's long-term memory, where every later conversation can find it. See memory.
  • Memory bank — an agent's searchable long-term memory, shared by all of that agent's conversations. See memory.
  • MemoryStore — the managed in-memory key-value service (Redis-compatible) for caching, counters, queues, and session state. See MemoryStore overview.
  • Metadata authority — power over the project object itself: rename it, delete it, change who is in it. See projects and access.
  • Minimum / maximum instances — the floor and ceiling on how many copies of a workload run; a floor of 1 removes cold starts at the cost of always-on capacity. See autoscaling and scale to zero.

O​

  • Organization (org) — the top-level tenant that owns projects and users; only a platform admin creates one. See projects and access.
  • Org admin — someone who administers one organization and inherits the admin role on every project inside it, re-checked on every request. See projects and access.
  • Owner — the user who deployed an agent; only the owner or a project admin can manage it. See deploy an agent.

P​

  • Page token — the opaque cursor a list returns so you can fetch the next page; hand it back unchanged, and never reuse one from a different list. See API overview.
  • Payload — the arbitrary JSON you attach to a vector, which you can filter on at search time. See collections and points.
  • Persistence — MemoryStore's append-only log on disk, on by default, so data survives a restart with roughly a one-second loss window. See MemoryStore overview.
  • Platform admin — an operator role with authority over every project object and over no project's contents; reaching your data requires a visible break-glass grant. See break-glass and audit.
  • Point — one row in a VectorDB index: a vector, plus an optional JSON payload and an optional id. See collections and points.
  • Project — your workspace: everything you create lives in exactly one, with its own quota, member list, and isolation boundary. See projects and access.
  • Publish — two different things depending on context: making a workload reachable on the public internet (public endpoints), or sending a message to a Pub/Sub topic (publish and consume).
  • Pull — asking a Pub/Sub subscription for waiting messages and acknowledging the ones you finish. See publish and consume.
  • Push delivery — the platform posting each Pub/Sub message to a service inside your project and retrying failures for you. See topics and subscriptions.

Q​

  • Quota — a per-project cap on running instances, services, CPU, memory, and Pub/Sub budget, enforced by the platform. See quotas and audit.

R​

  • Request id — the short identifier on every API error and console error message; quoting it lets support find your exact call. See troubleshooting.
  • Resource authority — power over what is inside a project: agents, functions, secrets, topics, indexes. See projects and access.
  • Reveal — the single audited, admin-only call that returns a stored secret's value in plaintext. See manage secrets.
  • Revision — an immutable numbered snapshot of a workload (code plus environment plus settings); every change creates a new one and the running one never changes. See traffic and revisions.
  • Rotate — replacing a credential with a new one: a new secret version, a new MemoryStore password, or a new embed key. See manage secrets.
  • Runtime — which language a function is written in: python, nodejs, go, or ruby. See runtimes.

S​

  • Sandbox — a locked-down, throwaway container where code runs exactly once and is then destroyed. See code sandbox overview.
  • Scale to zero — an idle workload running no copies at all, consuming no capacity, and starting one again on the next request. See autoscaling and scale to zero.
  • Secret — a named, versioned value your project stores; every write is a new version and nothing is overwritten. See Secrets Manager overview.
  • Serverless service — a container image you already have, run as a scaling web endpoint with revisions and traffic splitting. See serverless overview.
  • Service account — a machine identity that belongs to one project and holds a project role like a person would; its name is reserved permanently, even after deletion. See service accounts and API keys.
  • Session — one conversation with an agent, identified by a session_id; the platform stores its history and replays it to the model each turn. See sessions.
  • Session token — the 12-hour credential you get by signing in; it cannot be revoked before it expires. See API authentication.
  • Short — a project's permanent id fragment, used in namespaces and hostnames; renaming a project never changes it, so URLs keep working. See projects and access.
  • Size class — MemoryStore's small, medium, or large setting, which fixes the instance's memory and usable dataset size. See MemoryStore quickstart.
  • Subscription — a durable reader of one Pub/Sub topic that remembers its position; messages are kept only while a subscription still owes an acknowledgement. See topics and subscriptions.
  • Subscription type — the ordering choice: shared (no order), key-shared (ordered per key), exclusive or failover (fully ordered, one reader at a time). See topics and subscriptions.

T​

  • Tag (traffic tag) — a label on one traffic target that gives that revision its own address so you can test it directly. See traffic and revisions.
  • Task queue — the named mailbox that connects a started workflow to the worker that runs it. See run a workflow.
  • Tool — a function an agent can decide to call, such as running Python or searching its memory. See tools.
  • Tool call — one instance of the model choosing a tool and the platform running it; the invoke response summarizes each one. See tools.
  • Topic — a named Pub/Sub channel you publish messages to; it reserves part of your project's storage budget from the moment it exists. See topics and subscriptions.
  • Traffic split — how requests are divided across a workload's revisions; the percentages must total exactly 100. See traffic and revisions.
  • Trigger — an object that fires a serverless service on a schedule or on activity elsewhere, always within the same project. See serverless overview.

U​

  • User id — the caller identity a session belongs to; omit it and the platform derives a stable one from the session id. See sessions.

V​

  • Vector — a list of numbers representing meaning, which VectorDB stores and searches; you produce them, the platform does not. See VectorDB overview.
  • VectorDB — the managed vector database behind semantic search, retrieval-augmented generation, and agent memory. See VectorDB overview.
  • Version — a numbered, immutable snapshot: of a secret's value (manage secrets) or of an MCP server's published tool set (versions and rollback).

W​

  • Warm pool — the handful of pre-started sandbox pods the platform keeps ready so code starts running in about a second. See security and limits.
  • Worker — your process that hosts workflow and activity code and waits on a task queue for work. See run a workflow.
  • Workflow — code whose progress is checkpointed after every step, so it survives crashes and picks up where it left off. See durable execution.
  • Workload key — the narrow credential the platform injects into a deployed workload, usable only to read its own project's secrets at call time. See use secrets in workloads.

Y​

  • Yank — retiring one version of an MCP server so nobody can roll back to it, without deleting its history. See versions and rollback.
  • Core concepts — the same ideas, explained as a story rather than a list
  • FAQ — the questions these terms usually raise
  • Limits reference — every number in one table