Glossary

Analytics projection

Rollups of decisions, scores, filter activity, sessions, model usage and cost, kept inside the audit database and pruned at 90 days. The community dashboard reads a 7-day window; Pro adds 30- and 90-day ones. See Analytics.

Audit log

The hash-chained SQLite record of every decision, at ~/.local/share/grith/audit/audit.db. One process holds the writer lock; everything else reads. Older records are archived to cold/ on the same machine. See Logging and audit retention.

Canary

A fake credential you place where an attacker would find it. If it appears in an outbound call, the call scores 9.5 and is denied. Reading a canary file is not a detection. See Canary tokens.

Capability

A permission token - fs:read, net:http - granted to a plugin in config/filters/capabilities.toml. The file ships empty, so the filter runs permissive; add one grant and every plugin without the right grant scores 10.0.

Composite score

The plain sum of what the filters contributed. No per-filter cap, no clamp on the total, no filter verdicts, and two filters emit -1.0 - so the total can go down. See Composite scoring.

Daemon

The long-lived process that owns the audit database, the digest queue, the filter pipeline, the session registry and the HTTP server. grith dashboard is a retained alias for it. See Daemon and thin-client sessions.

Decision

Allow at or below 3.0, queue above 3.0 up to and including 8.0, deny above 8.0. A deny is one EPERM returned to the caller, not a kill - except an authority-delegating spawn caught at exec, which is SIGKILLed.

Digest

The queue of calls in the review band, at ~/.local/share/grith/audit/digest.db. Reviewed from the grith exec prompt, grith digest review or the dashboard. See The quarantine digest.

DLP gate

The filter that scans the arguments of an outbound call for credential-shaped content. Its default policy is to queue the call rather than deny it.

Filter

One of the 18 scorers in the pipeline, each returning a score and a reason. All 18 are on by default and every config toggle is an off switch. See Filter overview.

IPC

How a supervised session talks to the daemon: loopback HTTP with a bearer token from ~/.config/grith/daemon.token. There is no unix socket. See IPC routes.

Learned rule

An approval you made with [l] at the exec prompt, persisted for the profile so the same call stops asking. Stored under the config directory and scoped per profile, not globally.

Meta-rule

One of the five rules in config/filters/meta_rules.toml that run once after phase 3 and adjust the composite. Every condition must match, and a rule that sets score_override replaces the score and stops the loop. See Meta-rules.

Phase

One of the three groups the pipeline runs in order: static, pattern, context. A phase that pushes the score past the deny line ends the evaluation. See Three-phase pipeline.

Profile

The description of what a given tool routinely does: its routine paths, commands and destinations. Eleven are compiled into the binary and you pick one with --profile. Users cannot author profiles. See How profiles work.

ptrace

The Linux syscall that lets one process stop and inspect another. grith uses it together with seccomp to hold a supervised thread at a syscall whilst it decides.

Reputation

Two different things. The reputation filter scores a destination by what it is - known safe -1.0, raw IP, suspicious TLD, known malicious. The learned reputation table is a separate per-shape trust record that can flip a queued call to allow. See Adaptive reputation.

seccomp-BPF

The kernel facility that decides, in the kernel, which syscalls are worth stopping. grith installs a filter that traps 84 curated syscall identities and lets everything else through untouched - that is what makes supervision affordable.

Session

One supervised process tree, started by grith exec and ended when its root process exits. Identified by a UUID, and carrying its own allowlist, taint and containment state.

Session allowlist

The set of calls a profile marks routine for the session. A match short-circuits everything - the proxy is never invoked, so there is no score at all. Session containment suspends it.

Session containment

Two mechanisms sharing a name. Sticky containment arms when a session touches a high-taint path such as ~/.ssh; it has no TTL, clears only when the session ends, and whilst it is set the session allowlist is not consulted at all. Windowed containment is a filter that adds score to egress, spawns and shells for 600 seconds after a sensitive read. See Session containment.

Supervisor

The half of grith exec that intercepts syscalls and applies decisions, using ptrace and seccomp. Linux x86_64 and aarch64 only.

Taint

The mark a session carries after reading something sensitive - high for .ssh, id_rsa, id_ed25519, private_key, shadow, medium for .env, .aws, credentials, secrets, .gnupg, .kube/config. Later outbound calls score higher for it, and entries expire after an hour. See Taint tracking.

Thin client

A short-lived command that owns no state and defers to the daemon - grith exec, grith supervisor, grith reputation. The daemon holds the audit database, digest queue, reputation table and session registry; the client holds none of it.

Trust boundary

The line between what grith trusts - the kernel, and itself - and what it does not: the agent, the model, and anything either reads. See Trust boundaries.

Workspace

What grith exec --workspace-only fences a session to: the directory you launched from, its linked git worktrees, and any additional_project_roots you configured. Your other projects and the rest of your home directory are outside it. See Workspace boundary.