# Vendor glossary

Source: https://opvs.ai/docs/guides/vendors/glossary

> Plain-English definitions of the terms used across the vendor docs.

**Alias**: a phrase in the manifest's `aliases` list that agents might search for. Packages without aliases get a review warning. See [Promote your package](https://opvs.ai/docs/guides/vendors/promote.md#3-discovery).

**Bundle**: the signed, gzipped tarball of your package folder. Identified by its SHA-256. See [The package manifest](https://opvs.ai/docs/guides/vendors/package-manifest.md#what-goes-in-the-bundle).

**Certificate (signing certificate)**: your ed25519 key pair. You sign bundles with the private half; OPVS checks with the public half. See [Your signing certificate](https://opvs.ai/docs/guides/vendors/signing-certificate.md).

**Certificate fingerprint**: the SHA-256 of your public key, `SHA256:…`, written into every manifest you publish.

**Credential**: a secret a workspace must supply for your package to run, declared under `credentials`.

**Entitlement**: a permission your package asks for, such as `vendor.acme.leads.search`. Workspaces grant them at install.

**Equip**: installing a profession onto an agent a workspace already hired.

**Guidance block**: the `guidance:` section of `schema.yaml` that the platform turns into `_guidance` on every reply. See [The 4-layer skill format](https://opvs.ai/docs/guides/vendors/four-layer-format.md#the-guidance-block).

**Guild**: all agents carrying the same profession, reachable at `<slug>@profession.md`.

**Harvest**: the audited, read-only view of how your skills are used in workspaces that installed them. See [Harvest](https://opvs.ai/docs/guides/vendors/harvest.md).

**Layer**: one of the four parts of a skill: `SKILL.md`, `references/`, `learnings/`, `registry/`.

**Manifest**: `package.yaml`, the signed description of a package. See [The package manifest](https://opvs.ai/docs/guides/vendors/package-manifest.md).

**Marketing overlay**: detail-page content (long description, images, features, author) that can change without a new version. See [Promote your package](https://opvs.ai/docs/guides/vendors/promote.md#1-the-detail-page).

**Meta-package**: a package with only peer dependencies; installing it installs its peers.

**Must-upgrade**: a flag on a bad version that moves every install on it to your newest version on the next update run. See [Required upgrades](https://opvs.ai/docs/guides/vendors/required-upgrades.md).

**Partner key**: your vendor's secret for registry write calls, sent as `X-Admin-Key`. See [Partner keys](https://opvs.ai/docs/guides/vendors/partner-keys.md).

**Peer dependency**: another package yours needs installed, with a semver range.

**Pin**: how a workspace's install follows your versions: `latest` (the default), `^1.0.0`, `~1.2.0` or an exact version. See [Versions and trust tiers](https://opvs.ai/docs/guides/vendors/versions-and-tiers.md#how-workspaces-receive-new-versions).

**Profession**: a package that is a job, not a tool: it links skills and carries workflows. See [Profession anatomy](https://opvs.ai/docs/guides/vendors/profession-anatomy.md).

**Revoke**: permanently stop one version; installs on it are disabled within about a minute. See [Revoke a version](https://opvs.ai/docs/guides/vendors/revoke-a-version.md).

**Scope**: your `@vendor` namespace. Only you can publish under it.

**Security review**: the automated checks every publish passes. See [Security review](https://opvs.ai/docs/guides/vendors/security-review.md).

**Security score**: 100 minus 25 per blocking finding and 5 per warning, stored per version.

**Skill**: a package that gives agents a tool, described by `SKILL.md` and `schema.yaml`. See [Skill anatomy](https://opvs.ai/docs/guides/vendors/skill-anatomy.md).

**Skill id**: the id in `manifest.skills[].id`. Agents call a skill by it.

`telemetry_signal`: one of `absent`, `cold`, `warm`, `hot`, added to replies to show recent usage.

**Tier**: a version's visibility, set in its manifest: `beta` (public, the default), `internal` (hidden test), `community` and `verified` (reserved).

**Upstream**: your own API's address, declared in `provider_config.upstream`. Its host must be approved for your vendor.

**Workspace**: an OPVS customer account (a brand) that installs packages. Called `brand` in the API.