Glossary
Every term the workshop uses, in plain English. Some are Droid terms, some are general agent terms, and a few are banking terms that the scenario can't do without, such as half-even rounding and change tickets.
Where a term has a home lab, the entry links to it. Where Larkspur uses the term in a particular way, the entry says so under "In this workshop".
The same definitions appear when you hover over a dotted-underlined term in any lab, because both read from one file, src/data/glossary.ts. If you find a definition that is wrong or unclear, fix it there and it changes everywhere.
Agent
A program that uses a language model to decide what to do next, does it with tools, looks at the result, and repeats until the job is done or it gives up.
In this workshop Droid is the agent. Everything else in this workshop is the harness around it.
Agentic loop
The cycle an agent runs: read the situation, choose a tool call, get the result, choose again. Each turn adds to the context, so later turns know what earlier ones found.
AGENTS.md
A Markdown file in your repository that Droid loads as its project briefing: how to build and test, the conventions, and what must never happen. When there is a git root, Droid searches from the working directory up to it. Nested AGENTS.md files refine the root one for their directory.
In this workshop Lab 2. The biggest single move on the scoreboard, and still not enough on its own.
Allow, ask, block
The three decisions a permission rule can make about a shell command. Allow runs it without a prompt. Ask always needs approval, even at High autonomy. Block rejects it with no way to approve it. There is no "deny" decision; block is the hard one.
Autonomy level
How much Droid may do without asking: Off, Low, Medium or High. It controls automatic approval, not which tools exist. Ctrl+L cycles it in the CLI; droid exec takes --auto low|medium|high and is read-only without it.
Blast radius
Everything a mistake could reach. A session that can only edit files in one repo has a small blast radius; one that can push, migrate a database or call production has a large one.
In this workshop Lab 4 shrinks it with configuration, before anything goes wrong.
Change ticket (CHG)
A change-management record that says a production change was reviewed and approved. Banks require one for anything that touches customer money or data. Larkspur ticket ids look like CHG-20417.
In this workshop Task T4 on the scoreboard. In Lab 8 Droid looks tickets up over MCP instead of taking one from the prompt.
Context window
Everything the model can see at once: the system prompt, AGENTS.md, loaded skills, the conversation so far and every tool result. Anything outside it does not exist for the model.
Custom droid
A specialized subagent you define in .factory/droids/<name>.md with its own system prompt, model and tool policy. Its tool policy is enforced (tools: read-only means Read, LS, Grep and Glob). Droid hands it a focused task through the Task tool and it works in a fresh context window.
In this workshop Lab 7 builds money-reviewer, a read-only reviewer.
Droid
Factory’s software development agent. The same Droid runs in the terminal (Droid CLI), in the Factory App, headless in CI (droid exec), and from Slack, Linear or Jira.
droid exec
Droid’s non-interactive mode for scripts and CI. It runs one task and exits with a status code. It is read-only unless you pass --auto low, medium or high, and it cannot stop to ask for approval.
Droid Shield
Secret scanning built into Droid. When Droid runs git commit or git push, it scans the lines being added and blocks the operation if it finds something that looks like a key or token. Git commands you run outside Droid are not scanned.
First-attempt success
The share of tasks an agent gets right without a human correcting it. It is the number that decides whether delegating saves time or just moves the work into review.
In this workshop What the scoreboard measures, three runs per task.
Frozen code
Code nobody on the team may change, usually vendored from a third party or under a regulatory freeze. The right move is an adapter around it, not an edit inside it.
In this workshop Larkspur’s legacy/ directory, and task T8.
Guardrail
A control that stops an unsafe action whatever the model decides. A real guardrail is code or configuration. An instruction in a prompt is a request, not a guardrail.
Half-even rounding
Also called banker’s rounding. Values exactly halfway round to the nearest even digit: 2.5 becomes 2, 3.5 becomes 4. It avoids the upward drift that always rounding half up causes over millions of transactions.
In this workshop Larkspur’s fee disclosure requires it. The March incident replaced it with Math.round.
Harness
Everything around the model that shapes what an agent sees and what it may do: AGENTS.md, settings, permission rules, hooks, skills, custom droids and MCP servers. The same model in a better harness is a different product.
In this workshop The subject of this workshop.
Headless
Running an agent with nobody at the prompt, for example in CI or a scheduled job. Anything that would have needed a human to approve it has to be decided in advance by configuration.
Hook
A shell command Droid runs at a lifecycle event, such as before a tool call (PreToolUse), after one (PostToolUse) or before finishing (Stop). It receives JSON on stdin; exiting with code 2 blocks the action or sends feedback. Hooks are deterministic: they run every time, whatever the model thinks.
Idempotency key
A unique id sent with a request so that retrying it cannot perform the action twice. Every Larkspur transfer carries one, so a network retry never moves money twice.
Invariant
Something that must always be true, whatever else changes. At Larkspur: money is integer minor units, fees round half-even, every ledger posting balances, and account numbers never appear unmasked in logs.
In this workshop AGENTS.md states them; hooks and tests enforce them.
Matcher
The part of a hook configuration that picks which tool calls it applies to, for example "Create|Edit|ApplyPatch" for file changes or "Execute" for shell commands. Tool names are case-sensitive.
MCP (Model Context Protocol)
An open protocol for connecting agents to tools and data. An MCP server exposes tools, such as "look up change ticket", that Droid can call like its built-in ones. Servers run locally over stdio or remotely over HTTP.
Milestone
A group of features in a Mission that ends with validation. Validation workers run at the end of each milestone to verify its work, so more milestones means a bad assumption is caught earlier, at the cost of more runs.
Minor units
The smallest unit of a currency, stored as an integer: cents for dollars. Storing $12.34 as 1234 avoids floating-point errors like 0.1 + 0.2 = 0.30000000000000004.
In this workshop The first rule in Larkspur’s AGENTS.md, and the subject of the Lab 10 Mission.
Mission
Factory’s mode for large, multi-feature work. You plan it with Droid, the plan is split into milestones, and an orchestrator runs worker sessions with validation at the end of each milestone. Started with /missions.
Mission Control
The orchestration view of a running Mission: progress across features and milestones, and which workers are doing what. In the CLI, Ctrl+T toggles the Mission Control overlay. The orchestrator is an agent, so you can pause it and redirect it in plain language.
Model risk management
The function in a bank that checks models (credit, fraud, and now AI) are sound, controlled and documented. It is the "second line of defense": independent of the team building the thing.
In this workshop Ruth Achterberg’s team. Their question is what the agent cannot do.
Permission rule
A rule in settings.json that decides allow, ask or block for shell commands matching an exact token prefix, such as ["git", "push"]. Each rule carries tests that must pass, and droid rules check previews what a command would get.
PII
Personally identifiable information: names, account numbers, addresses, anything that identifies a customer. It must not appear in logs, commits, fixtures or prompts sent anywhere it should not go.
In this workshop Task T5, and maskAccount() in src/audit/.
Plugin
A shareable package of skills, slash commands, custom droids, output styles, hooks and MCP servers. A platform team can distribute its harness as a plugin, through an internal marketplace, instead of copying files between repositories.
PreToolUse
The hook event that runs after Droid has decided on a tool call and before it runs. It is the one place you can stop an action before it happens.
Prompt injection
Text in a file, ticket or web page that tries to give the agent new instructions. Anything Droid reads is data. Controls in configuration still hold when the model is fooled; controls in prose do not.
Protected path
A file or folder that Droid may read but must not change without a human decision. At Larkspur: src/money/, migrations/ and legacy/.
Readiness report
The /readiness-report command scores a repository against Factory’s Agent Readiness model: five levels from Functional to Autonomous, across nine pillars such as Testing, Documentation and Security. Each level unlocks at 80% of the previous level’s criteria.
Sandbox
Operating-system isolation for the commands Droid runs. You turn it on with sandbox.enabled. Its defaults allow reads, limit writes to the working directory, and limit network to Factory’s own and WorkOS authentication domains. In droid exec, violations are auto-denied without a prompt.
Session
One conversation with Droid, including every prompt, tool call and result. Sessions can be resumed, forked and searched, which is what makes an agent’s work auditable.
Skill
A reusable procedure in .factory/skills/<name>/SKILL.md. Droid sees only each skill’s name and description until a task needs it, then loads the full instructions. You can also call one directly as /skill-name. Its allowed-tools field is metadata, not enforcement.
Slash command
A saved prompt or script you run from the chat box, such as /fee-change. Markdown commands live in .factory/commands/ and receive what you type after the name as $ARGUMENTS (not $1). Executable commands start with a shebang and get positional arguments. For new reusable workflows, Factory’s docs prefer skills.
Spec mode
An interaction mode where Droid investigates read-only and proposes a plan before touching anything. You approve it, with manual approvals or at Low, Medium or High autonomy, or keep iterating. Shift+Tab toggles it; droid exec takes --use-spec.
Stop hook
A hook that runs when Droid is about to finish. Exiting with code 2 sends your message back and keeps Droid working, which makes it the last line of defense for checks like "no protected path changed".
Subagent
A separate Droid session started by the main one through the Task tool, with its own context window. It returns a result, not its whole transcript, so the main session stays focused.
Tool call
One action an agent takes: Read a file, Edit it, run a command with Execute, search with Grep, or call an MCP tool. The list of tool calls is the real record of what a session did.
Workspace trust
The trust Droid requires before a project’s or folder’s permission rules take effect. Rules from an untrusted project or folder are excluded, so a cloned repository’s rules do nothing until you trust it.
Worktree
A second working copy of the same git repository on another branch. droid exec -w runs each task in its own worktree, so parallel runs cannot trip over each other.