Glossary

A reference of all domain terms used across Proxima Console.

Infrastructure & Inventory

Term	Definition
Agent	A lightweight Go binary deployed on a managed server or Kubernetes node. Agents have their own identity in the agents table (created at enrollment) separate from the host record. Agent types: host (collects server inventory, metrics, processes, logs, changes) and collector (collects Kubernetes cluster inventory without creating a host record). Each agent is identified by a UUID (agent_id) used in NATS subjects and JWT naming (agent-{uuid}).
Client	A managed customer account representing a distinct organization whose infrastructure is monitored by Proxima Console.
Environment	A deployment environment (e.g., production, staging) within a client. Used to organize hosts and apply environment-level configurations.
Host	An infrastructure record in the hosts table representing a server. Created by the InventoryWorker on first inventory message from a host-type agent — not during enrollment. Stores inventory details (OS, hardware, IP), agent status, and configuration metadata. The agent_id column links the host row to its owning agent in the agents table.
Host Status	The agent's connectivity state: online, offline, or stale (last seen exceeds threshold).
Inventory	Complete snapshot of a host's static configuration: OS, hardware, packages, services, network interfaces, users, cron jobs, firewall rules, certificates, kernel modules, and security settings.
Collector	A metrics collector plugin (PostgreSQL, Nginx, Docker). Discoverable at runtime and enabled/disabled per host.
Label	A key-value tag applied to a host. Labels are static (stored in YAML/env) or dynamic (computed via shell command on a schedule). Sent with every heartbeat and inventory snapshot.
Tag	A user-defined key=value annotation on an entity (host, environment, client). Managed via the API.
Process	A running process on a host with CPU/memory usage, command line, user context, and parent-child relationships.
Service	A discovered service on a host (e.g., nginx, postgresql) with version, status, listen ports, and configuration path.
Database (asset type)	CMDB asset type for database instances (PostgreSQL, MySQL) discovered via agent integrations. Auto-created from heartbeat integration sync.
Database Cluster	Logical grouping of primary + replica database instances, detected automatically from PostgreSQL replication topology.
Cache (asset type)	CMDB asset type for cache instances (Redis, Memcached) discovered via agent integrations. Auto-created from heartbeat integration sync.
Web Server (asset type)	CMDB asset type for web server instances (Nginx) discovered via agent integrations. Auto-created from heartbeat integration sync.
Container Runtime (asset type)	CMDB asset type for container runtimes (Docker) discovered via agent integrations. Auto-created from heartbeat integration sync.
Package	An installed software package on a host, tracked by package manager (apt, yum, etc.).
Credential	Encrypted credentials (passwords, API keys, tokens) stored per client/environment and referenced by collectors or integrations.
Install Token	A reusable token for agent enrollment. Has a TTL, optional max-use limit, client scope, and use count tracking. Enrollment creates an agent record (agents table) — not a host record.

Metrics & Observability

Term	Definition
Metric	A single time-series data point (timestamp, host_id, metric_name, value, labels) stored in VictoriaMetrics.
VictoriaMetrics	Time-series database for metrics storage with native multi-tenancy (one VM account per client).
MetricsQL	VictoriaMetrics' query language used to retrieve and aggregate metrics.
LiteLLM	LLM gateway for multi-provider routing, used to proxy AI Chat requests to Claude and other language models.
Metric Annotation	A user-created text note on a metrics chart (host or environment scope) with a timestamp and creator.
Metrics Worker	A NATS consumer that processes telemetry messages and writes metrics to VictoriaMetrics with tenant isolation.
Alert Group	Deduplicated collection of related alerts grouped by fingerprint, with lifecycle states (firing, acknowledged, resolved).
Alert Correlation	Automatic enrichment of alert groups with metrics snapshots, recent changes, related alerts, and compliance context.

Healthchecks & Scanning

Term	Definition
Healthcheck Rule	A single compliance check (security, patch, operational) with a slug, name, severity, and source. Can come from Lynis, OpenSCAP, Trivy, or custom checks.
Healthcheck Category	A grouping of related healthcheck rules (e.g., "Security", "Patching").
Healthcheck Run	One execution of a healthcheck scan on a host. Records total/passed/failed/skipped counts, score, and duration.
Healthcheck Result	One check result within a run. Links to a rule, host, and status (pass/fail/skip/warning).
Scanner	A tool that performs healthchecks: Lynis (security audit), OpenSCAP (compliance scanning), Trivy (vulnerability scanning), or custom scripts.
Scanner Finding	A detailed finding from a scanner (CVE, XCCDF rule violation) with severity, title, status, and metadata.

Compliance

Term	Definition
Framework	A collection of compliance controls grouped under a standard (e.g., "Proxima Best Practices"). Can be builtin (shipped with Proxima) or custom (user-defined). Has configurable score thresholds.
Control	An individual compliance requirement within a framework (e.g., "SSH access hardened"). Has a code, title, category, severity, and type.
Control Type	How a control is evaluated: automated (from scanner evidence), manual (requires human attestation), or hybrid (both).
Control Category	Grouping for controls: security, patch_and_vuln, observability, networking, system, docker, backup.
Control Severity	Impact level: critical, high, medium, low.
Control Mapping	Links a control to an evidence source (e.g., healthcheck rule slug) with an operator and expected value. All mappings must pass for the control to pass.
Evaluation	A per-control verdict computed by the compliance worker for a specific scope (host, environment, or client).
Evaluation Status	Possible verdicts: pass, fail, warning, unknown, not_applicable, excepted, pending_manual_review.
Score	Framework compliance score computed as passed / (passed + failed), returned as a 0-1 ratio. Controls with unknown/excepted/pending status are excluded. Frontend displays as percentage.
Score Thresholds	Per-framework JSON config with good and warning values that determine the UI color. Above good = green, above warning = amber, below = red.
Scope	The level at which evaluations, attestations, or exceptions apply: asset (single host), environment, or client.
Asset	A minimal identity abstraction mapping a host, environment, or client to a UUID for compliance scoping and evidence linking.
Rollup	Aggregated framework scores across all active hosts in an environment or client.
Manual Attestation	A human-submitted verdict for a manual or hybrid control. Records the attester, timestamp, status (pass/fail/warning), optional note, and optional expiry. Overrides evidence-based evaluation.
Exception	An approved risk waiver that exempts a control from failing status. Has a reason, approver, and optional expiry. When active, marks the control as excepted and excludes it from the score.
Evidence Summary	JSON key-value data from healthcheck results attached to each evaluation, showing what was checked and the actual values found.
Re-evaluation	Recalculation of compliance results. Triggered automatically after healthcheck runs, manually via API, or as a side-effect of attestation/exception changes.
Top Failed Controls	Ranked list of controls failing across the most hosts in an environment or client scope.
Expiring Exceptions	Exceptions approaching their expires_at date, surfaced in the client compliance tab.
Compliance Worker	A NATS consumer that evaluates all controls in all frameworks against healthcheck evidence and stores evaluations and scores.
Exception Expiry Worker	Background job that periodically marks overdue exceptions as expired and triggers re-evaluation.

Change Detection

Term	Definition
Watched File	A file path on a host monitored for changes. Tracks SHA256 hash, size, mode, owner, and sensitivity flag.
File Version	A snapshot of a file's state at a point in time with version number, SHA256, content, unified diff against previous version, mode, owner, and size.
Change Event	A recorded change with origin (agent file watcher, webhook), type (modified, created, deleted), severity, and timestamped summary.
Changes Worker	A NATS consumer that processes file change messages, handles batch reassembly, computes diffs, and stores file versions and change events.
Baseline Mode	Change detection mode that computes and stores initial file hashes without triggering events.
Delta Mode	Change detection mode that compares current file hashes against baseline and reports only changed files.
Webhook Source	A registered external source for webhook events (GitLab, GitHub, ArgoCD). Receives events via token-authenticated HTTP endpoints and normalizes them as change events.
Runbook	Executable operational procedure defined in YAML DSL with multi-step actions, dispatched to agents via NATS for automated remediation.

Authentication & Authorization

Term	Definition
User	A human account with email, password hash (optional), MFA status, and authentication provider (local or OAuth).
Role	A named permission set (system-defined or custom) with an array of permission strings (e.g., users:read, hosts:write).
Permission	An access right in the system (e.g., hosts:read, compliance:write). Resolved from roles via RBAC.
Session	An authenticated user's session with refresh token, device label, IP address, user agent, and revocation tracking.
Service Account	A machine-to-machine API credential with API key hash, expiry, client scope, and last-used timestamp.
Team	A group of users assigned to a set of clients, used for RBAC at the team level.
MFA	Multi-Factor Authentication using TOTP. Mandatory for admin users.
Audit Entry	A security event record (user action, system change) with actor, action, resource, timestamp, and IP/user agent.
Terminal Session	Browser-based interactive shell access to a managed host, with RBAC enforcement, session recording, and audit logging.
Passkey / WebAuthn	Passwordless authentication via FIDO2 credentials, allowing users to log in with biometrics or hardware security keys.

Configuration & Sync

Term	Definition
Host Config	Per-host configuration (watch_files, healthcheck settings, collector config). One entry per config type per host.
Environment Config	Per-environment configuration applied to all hosts in that environment. Merged with host-level configs.
Config Sync	System allowing operators to push agent configuration changes from the backend API without redeploying agents.
Config Version	Sequential version number for host configurations, used to track rollout progress.
Config Apply Status	Latest result of applying a config to a host (version, status: pending/applied/failed, error message).
Service Layer	Backend architecture layer (backend/internal/service/) containing domain logic extracted from HTTP handlers. Services sit between handlers and stores, encapsulating business rules.

Messaging & Workers

Term	Definition
Agent Identity Layer	The agents table and enrollment flow that separate agent credentials from host data. An agent record is created at enrollment; a host record is created later when the first inventory message arrives. This separation supports collector agents (no host) and idempotent re-enrollment on pod restarts.
NATS	Message broker providing JetStream for persistent pub-sub and request-reply communication between agents and backend.
JetStream	NATS persistent message store with consumer groups and at-least-once delivery semantics.
Subject	NATS message routing key in hierarchical dot-separated format (e.g., proxima.client.env.host.inventory).
Durable Consumer	Named JetStream consumer group that persists acknowledgments to resume from where it left off after restart.
Upsert	Insert-or-update operation (INSERT ... ON CONFLICT DO UPDATE). Used for idempotent message processing.
Heartbeat	Periodic "still online" message from agent to backend. Used to determine host connectivity status.
Stale Host Detector	Background worker that periodically marks hosts whose last_seen_at exceeds a threshold as offline.

Search & Frontend

Term	Definition
PQL (Proxima Query Language)	A domain-specific query language for searching hosts by field/attribute. Compiled to SQL and executed against PostgreSQL.
Saved Search	A named, shareable PQL query saved per user with optional notification trigger.

AI & Automation

Term	Definition
AI Chat	AI-assisted infrastructure investigation powered by Claude via the Model Context Protocol, with 20+ tools and a human-in-the-loop confirmation flow.
MCP Server	Standalone Model Context Protocol server exposing Proxima infrastructure tools to LLMs such as Claude Desktop, Cursor, and Claude Code.
Service Desk	Client-facing ticket management module integrated with Jira ITSM, providing SLA tracking and a kanban board.