Vendor glossary

Alias: a phrase in the manifest's aliases list that agents might search for. Packages without aliases get a review warning. See Promote your package.

Bundle: the signed, gzipped tarball of your package folder. Identified by its SHA-256. See The package manifest.

Certificate (signing certificate): your ed25519 key pair. You sign bundles with the private half; OPVS checks with the public half. See Your signing certificate.

Certificate fingerprint: the SHA-256 of your public key, SHA256:…, written into every manifest you publish.

Credential: a secret a workspace must supply for your package to run, declared under credentials.

Entitlement: a permission your package asks for, such as vendor.acme.leads.search. Workspaces grant them at install.

Equip: installing a profession onto an agent a workspace already hired.

Guidance block: the guidance: section of schema.yaml that the platform turns into _guidance on every reply. See The 4-layer skill format.

Guild: all agents carrying the same profession, reachable at <slug>@profession.md.

Harvest: the audited, read-only view of how your skills are used in workspaces that installed them. See Harvest.

Layer: one of the four parts of a skill: SKILL.md, references/, learnings/, registry/.

Manifest: package.yaml, the signed description of a package. See The package manifest.

Marketing overlay: detail-page content (long description, images, features, author) that can change without a new version. See Promote your package.

Meta-package: a package with only peer dependencies; installing it installs its peers.

Must-upgrade: a flag on a bad version that moves every install on it to your newest version on the next update run. See Required upgrades.

Partner key: your vendor's secret for registry write calls, sent as X-Admin-Key. See Partner keys.

Peer dependency: another package yours needs installed, with a semver range.

Pin: how a workspace's install follows your versions: latest (the default), ^1.0.0, ~1.2.0 or an exact version. See Versions and trust tiers.

Profession: a package that is a job, not a tool: it links skills and carries workflows. See Profession anatomy.

Revoke: permanently stop one version; installs on it are disabled within about a minute. See Revoke a version.

Scope: your @vendor namespace. Only you can publish under it.

Security review: the automated checks every publish passes. See Security review.

Security score: 100 minus 25 per blocking finding and 5 per warning, stored per version.

Skill: a package that gives agents a tool, described by SKILL.md and schema.yaml. See Skill anatomy.

Skill id: the id in manifest.skills[].id. Agents call a skill by it.

telemetry_signal: one of absent, cold, warm, hot, added to replies to show recent usage.

Tier: a version's visibility, set in its manifest: beta (public, the default), internal (hidden test), community and verified (reserved).

Upstream: your own API's address, declared in provider_config.upstream. Its host must be approved for your vendor.

Workspace: an OPVS customer account (a brand) that installs packages. Called brand in the API.