Glossary
For the terms grouped by topic with more context, see Core concepts.
Access override — A per-repository access level (NONE, READ, WRITE, ADMIN)
that takes precedence over the holder’s organization role for that one repository.
Artifact — A stored object viewed through the Git index: its oid plus the
paths, commits and releases referencing it. In the SDKs, additionally a logical name,
kind and version addressed by a cavs:// URI.
Audit log — The admin-only, security-oriented record of privileged actions, with actor, IP and user agent. Distinct from the activity feed.
Activity feed — The product-level event log for a repository or organization, readable by anyone with access.
AssumeRole — The recommended BYOS authentication method for AWS. CAVS exchanges a role ARN plus an external ID for temporary STS credentials, so no long-lived secret is stored.
BG4 — A per-chunk byte-grouping pretransform applied before compression. Improves compression of numeric payloads: model weights, vertex buffers, audio samples. On by default.
BLAKE3-256 — The hash used to address chunks. (Objects use SHA-256.)
BYOS — Bring Your Own S3. A storage mode where object bytes live in your own S3-compatible bucket under your credentials, and CAVS keeps only metadata.
cavs:// URI — The SDK-level artifact reference.
cavs://{org}/{project}/{kind}/{name}:{version} is logical and mutable;
cavs://{org}/{project}/{kind}/{name}@sha256:{oid} is immutable. Store the immutable
form in production.
CAS / chunk tree — The content-addressed static export the transfer agent produces
and reads: asset manifests, chunk maps and immutable packfiles under
<namespace>/cas/.
Chunk — The unit of deduplication. Objects are split by content-defined chunking and each chunk is addressed by its BLAKE3-256 hash.
Circuit breaker — The webhook protection that auto-disables an endpoint after 10 consecutive delivery failures.
Collaborator — Someone with an access override on a specific repository. May be external — a collaborator does not need organization membership.
Content-defined chunking (FastCDC) — Choosing chunk boundaries by a rolling hash over the content rather than at fixed offsets, so an insertion shifts only one chunk instead of every subsequent block.
Control plane — The metadata half of the API: identity, organizations, RBAC, repositories, tokens, billing, usage, audit.
Correlation id — The per-request id returned as X-Correlation-Id / X-Request-Id
and embedded in error bodies as request_id.
Data plane — The byte-moving half: upload sessions, download authorization, Git LFS endpoints. It hands out presigned URLs rather than proxying bytes.
Dedup ratio — 1 − physical / logical, reported as a percentage saved.
Delivery — One webhook attempt, identified by X-CAVS-Delivery. Use it to
deduplicate.
Effective permission — The composition of organization role + repository override + token scope + account status + organization status. Any input can deny.
Egress — Bytes served on download authorization, metered per calendar month for managed storage.
Finalize — The call that promotes a session’s objects into a repository, bumps the generation and emits events. Objects are invisible until it runs.
Generation — A monotonic counter on the repository, bumped on every finalized push. Marks a consistent tree state; the file-tree index is snapshotted per generation and swapped atomically.
Git index — The read-only, Git-semantic layer over the oid-only data plane: commits,
branches, tags, tree entries, releases and activity. Populated by cav repo index and the
pre-push hook.
GC — Garbage collection: reclaiming chunks nothing references. Currently a coordinator stage that does not yet reclaim bytes.
Idempotency key — Idempotency-Key: <stable string>. Resending the same key returns
the same resource instead of duplicating work. Honoured on session create, finalize and
snapshot create.
Index session — The bracket around a Git-index upload: commits, tree entries, then finalize with refs and tags.
LFS agent — cavs-lfs-agent, the standalone Git LFS custom transfer agent that
replaces LFS transfer and storage with chunk-level dedup.
Logical bytes — The sum of your objects’ nominal sizes. What a naive store would need.
Managed storage — The default storage mode. CAVS administers the bucket, credentials, lifecycle, integrity, GC and egress. Runs on Cloudflare R2.
Merkle root — The per-object tree hash over its chunks, verified during reconstruction.
Object — An immutable blob of bytes, named by its oid. The data plane’s only unit.
oid — Object id: the lowercase hex SHA-256 of an object’s raw bytes, 64
characters. The content address used everywhere.
Organization — The billing and ownership boundary. Owns repositories, members, tokens, connections, webhooks and the subscription.
Overage — Managed storage or egress beyond the plan’s included amount, billed per GB at micro-cent precision.
PAT — Personal access token, cavs_pat_. Acts as you, capped by your role.
Physical bytes — The unique compressed bytes actually stored, after dedup. What you pay for.
Presigned URL — A short-lived signed object-storage URL for one operation. A bearer credential; 15-minute default lifetime; never log it.
Profile (chunk profile) — The chunking configuration: fastcdc-16k/32k/64k/128k,
fixed-256k/512k/1m, or auto (chosen per file by size). Part of a chunk’s identity, so
changing it breaks dedup continuity.
Project — An alias for repository, used by the SDKs.
Release — A Git tag with metadata. Derived automatically during indexing; name and notes are editable.
Repack — Compacting dead bytes out of packfiles. Currently a coordinator stage.
Repository — The unit of storage, access control and usage accounting.
Role — An organization-level role: OWNER, ADMIN, DEVELOPER, VIEWER,
BILLING.
Scope — A token capability cap: repo:read, repo:write, repo:admin, org:read,
usage:read. Never widens anything.
Service account — A cavs_sk_ machine identity with fine-grained keys.
Documented in the SDK contract but not deployed — use cavs_ci_ tokens.
Snapshot — A point-in-time capture of a repository’s storage state, queued on demand and captured by the worker.
Static export — The content-addressed chunk tree, syncable to a CDN and readable over plain HTTP with no server.
Storage connection — An organization-level BYOS target: provider, endpoint, region, bucket, prefix, auth method, encrypted credentials, health status.
Storage group — A purely organisational label for rolling repository usage up by team, product or lifecycle stage.
Storage mode — managed or byos. Fixed at repository creation.
Storage namespace — The per-repository key prefix in object storage.
Token — A machine credential: cavs_pat_, cavs_repo_ or cavs_ci_. Stored only as
a SHA-256 hash.
Transfer event — A measured record of one push or pull reported by the CAVS agent — duration, bytes, chunk counts. What the Benchmarks tab renders.
Tree entry — One indexed (path, oid, size) at a generation. What makes the Files
view possible.
Upload session — The bracket around a batch of uploads. 6-hour lifetime; objects become visible only at finalize.
Usage ledger — The immutable per-event record of metered operations. The internal system of record behind usage figures and invoices.
Visibility — PRIVATE, INTERNAL or PUBLIC.
zstd — The compression applied per chunk. Level 3 by default; 1–22 available, or
none.