Appendix A — Glossary

This appendix collects every term that the book defines in a Term callout, from the packaging vocabulary of Chapter 1a to the production vocabulary of the capstone. Each entry gives the term in bold, a definition of one to four sentences, and a link to the section where the term is developed with its mechanism, its numbers and its code. When several chapters define the same term, the first link is the main one and the following ones ("also") show where the idea returns in another setting, a Python one, a Java one or a more operational one.

Note. The definitions are condensed from the chapters, not rewritten, so a term keeps the meaning it has where it is used. For the formulas behind the quantitative entries (entropy, perplexity, Wilson interval, composed reliability, queueing), follow the link: the glossary states what a term means, the chapter shows how to compute it with worked numbers. Appendix D gathers the mathematics, Appendix B the commands and code idioms side by side in Python and Java, and Appendix C the symptom-to-fix tables.

How to read an entry:

**Term.** Definition, one to four sentences — [Chapter N §section](file.md#anchor); also [Chapter M §section](...)

Entries are sorted alphabetically, ignoring case, backticks and punctuation; terms that start with a digit come first. Jump to a letter: 0–9 · A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · Y

0–9

95% confidence interval. A 95% confidence interval is an interval computed from the data by a procedure that, over many repeated samples, contains the true value 95% of the time. It does not say that "the true value is in this interval with probability 95%" for one fixed interval; it describes the reliability of the method. — Chapter 3 §9.2

A

A2A (Agent2Agent). An open protocol for one agent (the client agent) to discover another agent (the remote agent), hand it a task and follow that task to completion, without knowing which framework, language or model the remote side uses. — Chapter 14 §9.1

A2A task. The unit of delegated work. It has an id and a state that evolves over time; a client can fetch it later, stream its updates or cancel it. — Chapter 24 §6.1

Accelerator. accelerate.Accelerator exists to make one piece of training/inference code run unmodified across CPU, single-GPU, multi-GPU, and distributed setups by centralizing device placement and mixed-precision plumbing behind one object instead of scattered .to(device) calls. — Chapter 1e §7.6

aclose() / GeneratorExit. Calling agen.aclose() throws a GeneratorExit exception into an async generator at its current suspension point, letting any finally: block run and release whatever the generator was holding, then marks it closed. — Chapter 1c §4.1

Active parameters. The parameters actually multiplied with a given token. For a dense model, all of them. For an MoE, the shared layers plus the few routed experts. — Chapter 9 §1.2

Activity. A function that does the side-effecting work: a model call, a tool call, a database write. The engine runs it at least once, records its result in the history, and retries it under a retry policy with its own timeouts. — Chapter 18 §9.1

ADR (architecture decision record). A short document, one per significant decision, with a fixed shape: status, context, the decision, its consequences, and the condition under which it should be reopened. — Chapter 25 §2.1

Advisor (Spring AI). An interceptor around a ChatClient call that can modify the request before the model sees it and the response after. Memory in Spring AI is an advisor: it loads the history for a conversation id into the prompt, and saves the new exchange afterwards. — Chapter 12 §12.2; also Chapter 16 §2.3, Chapter 16a §1.1

Agent. A system built around the PLAN → ACT → OBSERVE loop of section 1.2 of the source chapter: it carries state across more than one model call, it decides for itself what to do next rather than following a path fixed in advance, at least one of its actions can change something outside itself, and something explicit — not "the model felt like stopping" — tells it when to stop. — Chapter §1.3; also Chapter 10 §1.1, Chapter 16b §7.1

Agent card. A JSON document an agent publishes at a well-known URL describing who it is, where its endpoints are, which protocol versions and bindings it speaks, whether it streams, and which skills it offers. — Chapter 14 §9.2; also Chapter 24 §6.1

Agent harness. The runtime around the model: the loop that sends messages, executes tool calls and feeds results back, plus everything attached to it (permission checks, context compaction, session storage, built-in tools). — Chapter 15b §1.1

Agent loop. The cycle call the model, run any tools it requested, append the results, call the model again until the model answers without a tool call or a budget is hit. — Chapter 15 §1.1

Agent SDK (Claude). The claude-agent-sdk Python package. It does not call the Messages API itself. It starts the Claude Code CLI as a child process, exchanges newline-delimited JSON with it over stdin and stdout, and turns those lines into typed Python messages. — Chapter 15b §6.1

Agentic RAG. A RAG system in which an LLM controls retrieval: it chooses whether to retrieve, formulates the query, inspects the results, and may retrieve again or switch tools before answering. — Chapter 8 §10.1

AI Service. The object returned by AiServices.builder(MyInterface.class)…build(): a java.lang.reflect.Proxy (a JDK dynamic proxy) implementing MyInterface. Each method call is intercepted and turned into one or more requests to a ChatModel, with memory, tools, retrieval and guardrails applied around it. — Chapter 16b §2.1

Alembic autogenerate. alembic revision --autogenerate diffs the ORM models' MetaData against the live database schema and writes a migration script for the difference — a starting draft, not a guaranteed-correct migration. — Chapter 1d §9.1

Algebraic data type (ADT). A type built from two operations: product (a value contains this and that — a tuple, a record) and sum (a value is this or that — an enum with data, a tagged union, a sealed hierarchy). "Algebraic" because the number of values of the composed type is computed with ordinary arithmetic on the number of values of the parts. — Chapter 2b §4.1

Allow-list (versus deny-list). A list of what is permitted, with everything else refused by default. Deny-lists fail open — the attacker needs one string you forgot — while allow-lists fail closed. — Chapter 21 §4.1

Allowlist versus availability. A tool can be available (the model is told it exists), auto-approved (it runs without asking) or denied. The SDK has one option for each state and they interact, which is the most frequent source of misconfigured agents. — Chapter 15b §6.3

Analyzer / anonymizer. The analyzer takes text and returns a list of spans — (entity type, start, end, confidence score) — produced by a registry of recognizers (regex, checksum validators, NER models, context words). — Chapter 21 §9.2

Any information relating to an identified or identifiable natural person. "PII" is the engineering shorthand; the legal term in the EU is personal data (GDPR Art. 4(1)), which is broader: it includes an IP address or a customer number if it can be linked to a person. — Chapter 21 §9.1

anyio. A library providing one structured-concurrency and networking API that runs unmodified on either the asyncio or the trio event loop, selected at anyio.run(main, backend=...) time. anyio.create_task_group() is its portable TaskGroup-equivalent; anyio.CancelScope and its move_on_after/move_on_at/fail_after helpers are its portable cancellation and timeout primitives. — Chapter 1c §2.3; also Chapter 1f §2.2

Apache Arrow. A specification for how columnar data is laid out in memory — column-major, fixed-width or offset-indexed buffers, a defined null-bitmap encoding — implemented as native libraries multiple languages and tools link against. — Chapter 1e §4.1

Apache Kafka. A distributed, replicated, append-only log. A topic is a named log split into partitions; each record in a partition has an offset (its position). Producers append; consumers read by offset and remember where they are by committing offsets, so reading does not delete anything. — Chapter 2e §11.1

APIRouter. A Starlette-style router FastAPI lets you build independently of the main app — with its own prefix, tags, and dependencies — then mount with app.include_router(...). app.mount(...) goes further: it attaches an entirely separate ASGI application (its own middleware, its own exception handlers) at a path prefix, useful for something like an internal admin surface with different auth entirely. — Chapter 1d §2.4

ArchUnit. A Java library that reads compiled classes into an object model and lets a unit test assert rules about packages, dependencies, annotations and naming, so architecture violations fail the build like any other bug. — Chapter 2f §7.1

Arithmetic intensity. FLOPs divided by bytes read from memory. A kernel is compute-bound if its intensity exceeds the hardware's ratio of peak FLOP/s to peak bytes/s (the "ridge point", \(312\times10^{12}/2.039\times10^{12}\approx153\) FLOP/byte on the A100) and memory-bound otherwise. — Chapter 3 §2.3; also Chapter 9 §5.2

Arize Phoenix. An open-source LLM observability and evaluation tool that runs as one container, ingests OTLP natively, and renders LLM traces (messages, tool calls, token counts) in a purpose-built UI. — Chapter 20 §5.2

Array layer. Code that operates on dense, fixed-shape numeric buffers — vectors, matrices, tensors — where every element has the same dtype and the same operation applies to all of them at once. — Chapter 1e §1.1

ASGI (Asynchronous Server Gateway Interface). A specification for one async callable, app(scope, receive, send), that a server calls once per connection. It is to async Python web servers what WSGI is to sync ones — a wire contract that lets any compliant server (uvicorn, granian, hypercorn) run any compliant application (raw ASGI, Starlette, FastAPI, Django's async views) interchangeably. — Chapter 1d §1.1

ASGI middleware. Any callable with the exact same (scope, receive, send) shape as an app, that wraps another such callable — indistinguishable from an app to whatever called it. This is the mechanism Starlette.add_middleware and BaseHTTPMiddleware are built on. — Chapter 1d §1.3

ASR (attack success rate). The fraction of attempts in a fixed attack corpus that achieved their goal. It is a rate with sampling error, not a property: the honest way to report it is with a confidence interval. — Chapter 21 §12.1

Asynchronous job. An API that accepts work, answers immediately with 202 Accepted and a job identifier, and lets the client learn the result later by polling a status resource or by receiving a webhook. — Chapter 18 §1.1

asyncio.Future. A low-level "result box": an object with a set_result(value) or set_exception(exc) method and nothing that runs inside it. Awaiting a Future suspends the awaiting coroutine until someone else — typically the event loop's own low-level callback machinery — calls one of those two methods. — Chapter 1c §1.2

asyncio.shield(). shield(awaitable) protects one inner awaitable from being cancelled when the outer scope containing it is cancelled — useful when an outer timeout should not interrupt an operation that has already committed a side effect (e.g. a write request already sent to a tool and awaiting only its acknowledgement). — Chapter 1 §5.4

asyncio.Task. A Future subclass that wraps a coroutine and drives it: internally, a Task repeatedly calls .send(None) (or .throw(exc), for cancellation) on the coroutine object, and after each call inspects what the coroutine just awaited. — Chapter 1c §1.2

asyncio.to_thread. Sugar (3.9+) over loop.run_in_executor(None, functools.partial(fn, *args)) using the loop's default executor — a lazily-created ThreadPoolExecutor — with one behavioral addition raw run_in_executor does not give you: it captures the current contextvars.Context and runs the function inside a copy of it on the worker thread. — Chapter 1c §5.1

At-most-once. A record is processed zero or one times (commit before work; a crash loses it). At-least-once: one or more times (commit after work; a crash repeats it). Exactly-once: Kafka offers it inside Kafka (transactions that atomically write output records and commit input offsets). — Chapter 2e §11.4

Auto* classes. AutoModel, AutoTokenizer, and their siblings do not implement any model themselves — they read a repository's config.json (specifically its model_type field, or the tokenizer's own files), look the name up in an internal registry, and return an instance of the concrete class that name maps to. — Chapter 1e §7.1

Autograd. PyTorch builds a dynamic computation graph as operations run on any tensor with requires_grad=True: each operation records itself as a node (grad_fn) pointing back at its inputs. Calling .backward() on a scalar output walks that graph in reverse, applying the chain rule (Chapter 3's calculus, not re-derived here) and accumulating each leaf tensor's gradient into its .grad attribute. — Chapter 1e §6.2

Automatic module / unnamed module. A plain jar placed on the module path is treated as an automatic module: it exports every package and reads every other module. Its name is the Automatic-Module-Name entry of its MANIFEST.MF if present, otherwise a name derived from the file name (spring-ai-openai-1.1.8.jar → spring.ai.openai). — Chapter 2a §10.1

autoregressive. A model is autoregressive if it produces a sequence one element at a time, each element drawn from a distribution conditioned on all the elements already produced. — Chapter 3 §3.3

B

Backpropagation. The algorithm that computes \(\nabla_{\mathbf w}L\) for every parameter of a network in one backward sweep, by applying the chain rule of calculus to the computational graph of the forward computation and reusing intermediate results. — Chapter 3 §7.2

Barrier. The end of a superstep. The engine waits for every node of the round to finish, applies all their writes through the channels' merge rules (reducers), and only then decides which nodes are ready for the next round. — Chapter 15a §1.1

Baseline. A recorded list of the violations that exist today, so that a new rule can go live and fail only on new violations. ArchUnit's freeze is one; SpotBugs has an exclusion filter; Error Prone has per-check severities and -XepExcludedPaths. — Chapter 2f §10.1

BaseSettings. A pydantic-settings (2.15.0, confirmed) class that looks exactly like an ordinary Pydantic model — typed fields, validators, nested models — but fills its fields from the environment instead of (only) constructor arguments. — Chapter 1d §7.1

bfloat16. 8 exponent bits (matching float32's dynamic range exactly) and 7 mantissa bits — trades precision for range, which is why it, not float16 (5 exponent bits, 10 mantissa bits, float32's range roughly halved), is the default reduced-precision dtype for training: it very rarely overflows the way accumulating float16 gradients can. — Chapter 1e §6.4

Bi-encoder. A model that maps a single piece of text to one fixed-size vector, independently of any other text. "Bi-" refers to the fact that the same tower is run twice — once over the query, once over each document — and the two resulting vectors are compared after the fact with a cheap similarity function. — Chapter 7 §1.1; also Chapter 8 §4.1

Blackboard. A shared, structured store that all agents read and write. Agents do not call each other. Each declares the state it needs and acts whenever the board satisfies its preconditions. — Chapter 14 §5.2

Blast radius. The worst-case damage a single action can cause: money moved, data exposed, state that cannot be undone. — Chapter 21 §4.2

Blocking I/O. A thread that is blocked on I/O — waiting for a network response, a disk read, or anything the operating system has not yet finished — is not doing useful work, but on the classic JVM thread model it still occupies the OS thread it was scheduled on, which nothing else can use until the I/O completes. — Chapter 2 §1.2

BM25 (Okapi "Best Match 25"). A ranking function that scores a document against a query by summing, over the query's terms, how rare the term is across the corpus times how often it occurs in the document, with the occurrence count saturating and the document length normalized. — Chapter 8 §2

BOM (Bill of Materials). A pom.xml with <packaging>pom</packaging> that declares no code of its own, only a <dependencyManagement> block pinning a consistent set of versions for a whole dependency family. Importing it (<scope>import</scope>, <type>pom</type>) pulls those version pins into your own dependencyManagement without forcing every module that uses the family to repeat the version string. — Chapter 2 §2.2; also Chapter 2a §1.1, Chapter 16b §1.1

bootstrap. The bootstrap estimates the uncertainty of any statistic by treating the sample as the population: resample it with replacement many times, recompute the statistic on each resample, and read the interval from the spread of those recomputed values. — Chapter 3 §9.4; also Appendix D

Boundary. A place where your program exchanges bytes with a system you do not control or deploy together with: a provider API, another team's service, a message broker, a file produced by a batch job. — Chapter 2e §1.1

Breaking boundary. A release after which code written against the previous release may stop working by the project's own versioning policy: a new major for projects that follow Semantic Versioning, and a new minor (0.x.0) for projects still at 0.x, where SemVer promises nothing. — Chapter 15 §10.1

Brier score. A proper scoring rule for probability quality: \(\text{Brier} = \frac{1}{N}\sum_{i=1}^{N}(p_i - y_i)^2\), where \(p_i\) is the predicted probability of the positive class and \(y_i \in \{0,1\}\) is the true label. — Chapter 1e §9.4

Broadcasting. NumPy's rule for applying an operation to two arrays of different shapes without copying either one to match the other. Compare shapes from the trailing (rightmost) dimension leftward: for each pair of dimensions, they are compatible if they are equal, or if one of them is 1. — Chapter 1e §2.2

Budget (agent loop). A hard cap on one dimension of a trajectory's resource consumption, checked on a specific transition, that routes the loop to ESCALATED the moment it is exceeded. — Chapter 10 §4.1

Build backend. An importable Python object, declared in [build-system].build-backend, that implements a small standard interface — build_wheel(), build_sdist(), build_editable() — which a builder (pip, uv build) calls, never by importing it into its own process, but by spawning it inside an isolated environment built exactly to the backend's own stated requirements. — Chapter 1a §3.2

Build cache. A content-addressed store of task outputs. Before executing a cacheable task, Gradle computes a cache key — a hash of the task's implementation (its own code and the classpath of the plugin that provides it), its input property values, the content of its input files and the names of its declared outputs. — Chapter 2a §8.2

Bulkhead. A resource partition that stops one dependency from consuming what the others need: a separate thread pool, connection pool or concurrency limit per specialist, named after the watertight compartments of a ship. — Chapter 14 §8.1

Byte-Pair Encoding (BPE). A tokenizer-training algorithm that starts from single symbols and repeatedly merges the most frequent adjacent pair into a new symbol, recording each merge. The ordered list of merges is the tokenizer. — Chapter 4 §1.2

C

Cache policy. CachePolicy(key_func=…, ttl=…) on a node tells the engine to memoise the node's result by a key computed from its input; a hit skips the node body. The cache is attached at compile time (compile(cache=InMemoryCache()), or SqliteCache), and ttl is in seconds. — Chapter 15a §9.4

Calibration. A classifier's raw predict_proba output is a score, not automatically a calibrated probability — a model that outputs "0.80" for a class is calibrated only if, across every instance where it says 0.80, that class is actually correct about 80% of the time. — Chapter 1e §9.4

Capability. In PydanticAI 2.x, an object registered with the agent that can add tools, instructions and settings and observe or wrap each stage of a run: the run, each graph node, each model request, each tool validation and execution, each output validation. — Chapter 15b §2.6

Capability negotiation. The exchange at the start of a connection in which each side declares which optional features it implements and which protocol revision it will speak. Afterwards, each side may use only what the other declared. — Chapter 11 §9.1

Cascade. Cascade. A routing pattern in which a request goes first to a cheap model, and is escalated to an expensive one only when a confidence signal from the cheap model falls below a threshold \(\tau\). — Chapter 22 §6.1

CDF. The cumulative distribution function \(\Phi(z)=P(Z\le z)\) for a standard normal \(Z\). \(\Phi(1.96)=0.975\), which is why \(z_{0.975}=1.96\) marks the edge of a 95% two-sided interval. — Appendix D

Channel. A named, typed slot in the graph state with a merge rule. A key of your TypedDict becomes one channel; the engine also creates internal channels that carry "run this node next" signals. — Chapter 15a §1.1

ChatClient. Spring AI's fluent facade over a chat model. You describe one request (.prompt().user(...).advisors(...).call()), and the client builds the prompt, runs it through a chain of advisors, calls the model, and gives the result back as text, a ChatResponse or a typed object. — Chapter 16 §2.1

ChatMemory (LangChain4j). The component that holds the messages of one conversation and applies an eviction policy to them. MessageWindowChatMemory keeps the last \(N\) messages; TokenWindowChatMemory keeps as many as fit in a token count. — Chapter 12 §12.1

Checked exception. A subclass of Exception that is not a RuntimeException. A method that can throw one must declare it with throws or catch it, and the compiler enforces that at every call site. — Chapter 2b §11.1

Checkpoint. A durable snapshot of everything the loop needs to continue after the process that produced it is gone: written after every step, keyed by thread, readable by a different process. — Chapter 12 §3.2; also Chapter 15 §4.1

Checkpoint namespace (checkpoint_ns). The path that says which graph in the tree a checkpoint belongs to. The root graph's namespace is the empty string; a subgraph running as the node eligibility has a namespace of the form eligibility:<task_id>, nested subgraphs join with |. — Chapter 15a §4.2

Checkpointer. The component that saves a snapshot of the graph — the channel values and the bookkeeping needed to resume — at every barrier, and loads it back. You pass one to compile(checkpointer=…). — Chapter 15a §5.1

Chroma. An embedded, local-first vector store (SQLite plus an on-disk index in a local directory, or run in-process with no separate server) built for zero-operations prototyping: pip install chromadb and a local collection is running with no Docker container, no connection string, nothing to tear down. — Chapter 7 §5.3

Circuit breaker. A state machine in front of a remote call. While the dependency is healthy the breaker is closed and calls pass. When failures cross a threshold it opens and calls fail immediately, without touching the dependency, which gives it room to recover and gives callers an instant error instead of a timeout. — Chapter 2e §12.4

Client. Any process that starts a workflow, sends it a signal or reads its result. Relay's HTTP handler becomes a client: where section 5.2 of the source chapter inserted a jobs row, it now calls start_workflow. — Chapter 18 §9.1

Closed workload model. Closed workload model. A fixed population of \(N\) virtual users, each of whom sends a request, waits for the reply, thinks for a while, and repeats. The load adapts to the system: when it slows, users send less. — Chapter 22 §11.2

Closed-world assumption. The premise that the full set of reachable code is known and fixed at build time. A classic JVM's ClassLoader can load a class it has never seen before at any point during execution; a native image cannot — anything not proven reachable during the build is simply absent from the compiled binary. — Chapter 2 §13.1

Cohen's kappa (\(\kappa\)). A chance-corrected agreement score between two raters labelling the same items. It is 1 for perfect agreement, 0 for agreement no better than chance given each rater's own tendencies, and negative if they agree less than chance. — Chapter 19 §4.2

Collector. The recipe for a terminal collect operation, made of four functions — a supplier that creates a mutable container, an accumulator that folds one element into it, a combiner that merges two containers (used by parallel streams) and an optional finisher that converts the container to the final result. — Chapter 2b §7.4

Community detection. Partitioning a graph's nodes into groups that are more densely connected inside than to the outside. Modularity \(Q\) measures how good a partition is. — Chapter 8 §9.4

Compaction. Any operation that reduces the token footprint of the working memory while preserving what the rest of the trajectory still needs. Compaction is lossy by construction, which is why section 4.3 pairs it with an information-loss check. — Chapter 12 §4

Composed reliability. The probability that a pipeline of \(n\) steps completes with no failed step. With independent steps of success probabilities \(p_1,\dots,p_n\) it is \(R=\prod_ip_i\), and the number \(\bigl(\prod_ip_i\bigr)^{1/n}\) is the geometric-mean per-step reliability. — Chapter 3 §10.1

Concatenate. Concatenate[Session, P] describes a parameter list whose first parameter is a fixed type (Session) and whose remaining parameters are whatever P (a ParamSpec) captures. — Chapter 1b §2.4

conditional probability. The conditional probability \(P(A\mid B)\) is the probability of \(A\) given that \(B\) is known to have occurred: \(P(A\mid B)=P(A\cap B)/P(B)\), defined when \(P(B)>0\). — Chapter 3 §3.2; also Appendix D

Confidence interval (95%). A range computed from the sample by a procedure that, repeated over many samples, contains the true value in 95% of them. It is a statement about the procedure, not a 95% probability that this particular range holds the truth. — Chapter 19 §6.1; also Appendix D

Configuration cache. A file in which Gradle stores the task graph that configuration produced — the tasks, their inputs and their wiring — together with a fingerprint of everything the configuration phase read (build scripts, gradle.properties, environment variables, system properties, files). — Chapter 2a §8.3

conftest.py. A file pytest auto-discovers (no import needed) that defines fixtures and hooks visible to every test in its own directory and every directory below it. — Chapter 1f §1.5

Confused deputy. A program with legitimate authority that is tricked by a less-privileged party into using that authority on the party's behalf. The deputy is not malicious and not compromised; it is confused about whose interests it serves. — Chapter 21 §7.1; also Chapter 21 §8.4

Consumer group (Kafka). A set of consumers that share a topic's partitions so each record is processed by one of them; adding consumers up to the partition count scales throughput. — Chapter 24 §4.3

Consumer-driven contract. The consumer (here Relay-agent, which calls Relay-core) writes down, as executable examples, exactly which requests it sends and which parts of the response it depends on. Those examples are recorded as a pact, a JSON file. — Chapter 24 §10.1

Content-addressed cache. The Hugging Face Hub cache (~/.cache/huggingface/hub/models--<org>--<name>/) stores each downloaded file as a blob named by its hash under blobs/, with a snapshots/<revision>/ directory of symlinks giving it a human-readable filename — the same revision downloaded twice, or shared by two model repos with an identical file, is stored once. — Chapter 1e §7.5

Context isolation. Giving each agent only the tools, instructions and history its own sub-task needs, and starting each segment from a fresh context instead of inheriting the whole conversation so far. — Chapter 14 §6; also Chapter 15b §4.1

Context precision. Rank-aware: are the relevant retrieved documents near the top of the list? Context recall. What fraction of the documents the question needs was retrieved at all? Faithfulness. What fraction of the claims in the answer is supported by the retrieved context? — Chapter 8 §12.1

Context propagation. The mechanism by which "the current span" follows the flow of execution, so that a span started deep in a call stack automatically becomes a child of the right parent without anyone passing a span object around. — Chapter 20 §3.2

Contextual retrieval. An indexing-time step that prepends an LLM-written, document-aware situating sentence to each chunk before it is embedded and lexically indexed, so that a chunk carries the context that chunking removed. — Chapter 8 §6.2

contextvars. Python's contextvars module (stdlib, not structlog-specific) provides storage that is local to the current task, not the whole process — the mechanism asyncio itself uses to make each task's cancellation and exception state independent. — Chapter 1 §9.2

Continue-as-new. The engine's escape hatch for workflows that legitimately run forever (a daily summary loop, a long-lived conversation): the workflow ends and immediately starts a new execution of itself with a fresh, empty history, carrying forward only the state it passes as arguments. — Chapter 18 §8.4

Continuous batching (also in-flight or. Continuous batching (also in-flight or iteration-level batching). The scheduler works at the granularity of one decode step, not one request: at every step, finished sequences leave the batch and waiting ones join. vLLM, TGI and TensorRT-LLM all do this. — Chapter 22 §7.1

Contract test. A test that proves a tool's interface — its JSON Schema, as an LLM provider's function-calling API will see it — has not silently changed shape, independent of whether its implementation still behaves correctly. — Chapter 1f §6.1; also Chapter 15b §10.3

Convention plugin. A Gradle plugin, written in your own repository, whose only job is to apply other plugins and set the defaults a family of projects shares. Modules opt in with one line, plugins { id("relay.java-conventions") }. — Chapter 2a §8.1

copy. Shadow deployment. The candidate receives a copy of production requests; its answers are recorded and compared offline, never returned to users. Zero customer risk, but it also produces no user-facing signal: no real latency under its own load, no reaction from a customer. — Chapter 23 §9.1

CoreSchema. A plain nested Python dict (no custom classes) that fully describes how to validate and serialize one shape — one node per field, one node per constraint, one node per union branch. — Chapter 1b §8.1

Cosine distance. \(1 - \cos\theta\) between two vectors; pgvector's <=> operator. It is 0 for identical directions, 1 for orthogonal, 2 for opposite. With the HNSW opclass vector_cosine_ops, ORDER BY embedding <=> :q LIMIT k is answered from the index. — Chapter 25 §4.3

Cost ledger. A table with one row per (tenant, feature, day) holding call counts, input tokens, output tokens and a derived dollar cost. It is derived from telemetry, never an independent source of truth, so that a price change or a bug fix can be applied retroactively by recomputing. — Chapter 20 §8.1

Cost per resolved task. Cost per resolved task. The expected total spend needed to obtain one successful outcome: cost per attempt divided by the probability that an attempt succeeds. It charges failures to the successes, which is exactly how a finance team will see them. — Chapter 22 §2.1

Cross-encoder. A model that takes a pair of texts (query, document) concatenated together and outputs a single relevance score for that pair. — Chapter 7 §1.1; also Chapter 8 §4.1

Cross-entropy. The average surprise of the outcomes drawn from \(p\) when you are measuring surprise with the wrong distribution \(q\): \(H(p,q)=-\sum_ip_i\log_2q_i\). It is at least \(H(p)\), and it is the quantity a language model's training loss minimizes. — Appendix D

Cumulative success probability. If each retry attempt has its own, generally different, probability of succeeding — different because each retry includes the previous attempt's error as context, which is exactly what should make attempt 2 more likely to succeed than a blind repeat of attempt 1 — the probability of succeeding by attempt \(k\) is one minus the probability that every attempt up to \(k\) failed: — Chapter 1b §12.3

Custom metric (HPA). Custom metric (HPA). A metric other than CPU or memory that the HPA scales on, supplied through the Kubernetes custom or external metrics API. — Chapter 23 §6.1

D

datasets.Dataset. Backed by an Arrow table on disk, memory-mapped rather than loaded fully into process RAM — a Dataset built from a file larger than available memory still works, because only the pages actually touched get paged in. — Chapter 1e §7.4

Dead-letter queue (DLQ). A queue that receives messages the consumer could not process (rejected without requeue, expired, or retried too often), so one poison message cannot block the queue forever and is kept for inspection instead of being lost. — Chapter 24 §4.3

Debate / voting. Run \(v\) independent agent instances on the same question and take the majority answer (or let a judge pass choose). It trades tokens for accuracy the way an ensemble trades compute for variance reduction. — Chapter 14 §5.3

Decision matrix (weighted-sum scoring). Each option gets an integer score from 1 (poor) to 5 (excellent) on every criterion; each criterion has a weight; the option's total is the weighted sum. Its value is not the number, it is that the weights and scores are explicit, so a disagreement becomes "you scored the ecosystem 2, I scored it 3" instead of "I prefer Java". — Chapter 24 §1.1

decode. Inter-token latency (ITL). The time between consecutive output tokens during decode, the sequential phase that generates one token per forward pass. Its inverse is the decode throughput in tokens per second. — Chapter 22 §3.1

Decoding (or sampling). The procedure that turns the next-token distribution \(P(t\mid t_{<i})\) into one chosen token. Truncation sets some probabilities to zero before the draw; renormalization divides the survivors by their total so that they again sum to 1. — Chapter 3 §8

Deduplication threshold (\(\theta_{\text{dedup}}\)). The cosine similarity at or above which two fact embeddings are treated as the same statement and merged instead of stored twice. Relay uses \(\theta_{\text{dedup}} = 0.92\). — Chapter 12 §8.2

Deferred tool call. A tool call the agent has decided to make but may not execute yet, because it needs approval (ApprovalRequired) or external completion (CallDeferred). The run ends with a DeferredToolRequests output listing them; a later run resumes with DeferredToolResults. — Chapter 15b §4.3

Degrees of freedom. The number of values free to vary after the data have constrained something. Once \(\bar x\) is fixed, only \(n-1\) deviations are free (the last is forced so that they sum to zero), hence \(n-1\) degrees of freedom for \(s\) and for \(t\). — Appendix D

Dependency confusion. A supply-chain attack where an internal package name that exists only on a private index is also published, by an attacker, on the public index under the same name and a deliberately high version number — if the resolver is configured to consider both indexes without an explicit pin, it can select the attacker's public package instead of the organization's real one, because a higher version number looks, to a naive resolver, like a legitimate update. — Chapter 1a §8.1

Dependency injection (DI). Passing the collaborators a function needs (database handle, API client, configuration) as arguments instead of reaching for module-level globals. In PydanticAI the collaborators travel in a deps object that every tool receives through a RunContext. — Chapter 15 §7.1; also Chapter 15b §2.1

Dependency resolution. Given a set of direct dependencies, each with a version constraint (e.g. httpx>=0.27), and each candidate version's own constraints on its dependencies, find one version per package such that every constraint in the whole transitive graph is satisfied simultaneously — or prove that no such assignment exists. — Chapter 1a §2.1

Dependency-injection (DI) graph. The tree FastAPI builds from an endpoint's parameters and each dependency's own parameters, recursively, and resolves leaf-first, once per request — not once at decoration time. A dependency reached by two different paths through that tree in the same request runs only once by default (use_cache=True, the default) and its result is shared by reference. — Chapter 1d §2.2

Derivative. The instantaneous rate of change of a function: \(f'(x)=\lim_{h\to0}\frac{f(x+h)-f(x)}{h}\). Read it as "if \(x\) increases by a tiny \(\delta\), \(f\) increases by about \(f'(x)\,\delta\)." — Appendix D

Deterministic profiler. A profiler that instruments every function call and return (sys.setprofile-based, in cProfile's case, implemented in C for lower overhead than the pure-Python profile module) — as opposed to a sampling profiler, which periodically interrupts a running program and records where it currently is. — Chapter 1c §12.1

deterministic verifier. A deterministic verifier is code, with no model call, that takes a candidate decision (or plan) and the facts it should be consistent with, and returns the rules it breaks. — Chapter 13 §10.2

Dev Services. A Quarkus feature: when an extension needs an external service (a database, a message broker, a model server) and you have not configured one, quarkus dev and @QuarkusTest start a container for it and wire the configuration automatically. — Chapter 16b §10.3

Discriminator (type id). The field whose value selects the concrete type, such as "type": "tool_use". Jackson calls it the type id; Pydantic and OpenAPI call it the discriminator. — Chapter 2e §3.1

Distribution. The rule giving the probability of each possible value of a random variable. A discrete one is a probability mass function (pmf); a continuous one is a density. — Appendix D

dot product. The dot product (inner product) of two vectors of the same dimension is the sum of the products of matching coordinates. The norm (here the \(L^2\) or Euclidean norm) of a vector is its length. — Chapter 3 §1.2; also Appendix D

DPO (direct preference optimization). Rafailov et al. (2023). It optimizes the same "reward minus KL" goal as RLHF without a reward model or an RL loop, as one supervised loss computed directly on preference pairs. — Chapter 4 §6.4

Drift. The difference between the file the model read and the file that is on disk when its edit lands. Causes: a human saving in an editor, another agent, a formatter that ran in between, or a hook. — Chapter 17 §3.1; also Chapter 20 §9.2

dtype. The fixed element type of an ndarray's buffer — how many bytes each element occupies and how those bytes are interpreted (signed integer, IEEE-754 float, etc.). Every element in an array shares one dtype; this is what makes vectorized, uniform operations possible in the first place. — Chapter 1e §2.4

Dual-LLM pattern. An architecture with two roles. A quarantined LLM reads untrusted content (documents, web pages, tool results) and has no tools; it returns only a small, typed extraction (for instance {"return_window_days": 30}), never free text. — Chapter 21 §3.1

Durable execution. A programming model in which a function's progress survives the death of the process running it. The engine persists each externally visible step of the function (an I/O call, a timer, a received message) to a log; after a crash, another process re-runs the function and the engine feeds it the logged results instead of performing the steps again. — Chapter 18 §8.1

E

Eager execution. Every dataframe operation runs immediately and materializes its full result before the next line of code executes — the opposite of the lazy, deferred-until-.collect() model section 3.2 of the source chapter introduces for Polars. — Chapter 1e §3.1

Editable install (PEP 660). An installed "wheel" whose actual payload is not a copy of your source code but an import redirect — a .pth file or a generated __editable___*.py finder — that points the interpreter's import machinery back at your source tree, so edits to tracked files are visible without reinstalling. — Chapter 1a §3.4

Effective input budget (\(B_{\text{eff}}\)). The number of prompt tokens the assembler may send: the window minus the output reservation minus a safety margin. — Chapter 12 §2.2

Egress control. Restricting where outbound data can go (domains, addresses, ports) by a policy enforced outside the model, so a hijacked agent still has no way to deliver the stolen data. — Chapter 21 §4.4

Embedded analytical engine. DuckDB is not a server you connect to over a socket — it is a library, linked into your Python process, with its own vectorized, columnar query executor. — Chapter 1e §3.3

Embedding. A learned dense vector standing for a discrete id. The embedding matrix \(E \in \mathbb{R}^{V \times d}\) has one row per vocabulary entry; \(V\) is the vocabulary size and \(d\) (written \(d_{\text{model}}\)) the model width, the length of the vector that flows through every layer. — Chapter 4 §2.1; also Chapter 16a §6.1

Enterprise integration seam. A point where the agent's world (slow, non-transactional, probabilistic) meets the host system's world (transactional, authenticated, audited). The three that matter are the transaction boundary, the security context and the message broker; section 14 of the source chapter treats them. — Chapter 16 §1.1

EntityRuler. A pattern-matching pipeline component, added before or after the statistical ner component, that tags spans matching a fixed token pattern with a chosen label — a regex/rule engine operating over spaCy's own token stream, not a separate text-preprocessing pass. — Chapter 1e §10.3

entropy. The entropy of a distribution \(p\) is the average surprise of an outcome drawn from it, where the surprise (information content) of an outcome with probability \(p_i\) is \(-\log p_i\): rare events are surprising, certain ones are not. — Chapter 3 §5.1; also Appendix D

Entrypoint. A function decorated with @entrypoint(checkpointer=…). Calling invoke on it starts a run; its body is the workflow. Task. A function decorated with @task: a unit of work whose result is checkpointed and which returns a future-like object. — Chapter 15a §2.3

Episodic memory. A record of specific past events, here one row per resolved ticket: what the customer asked, which tools Relay called, how it ended. It lives in a Postgres table with an embedding column. — Chapter 12 §1.1

Erasure (right to be forgotten). The obligation to delete a person's personal data on a valid request, in all systems that process it, within a bounded delay. For an agent it covers not just the primary row but every copy and every derived artefact: embeddings, summaries, extracted facts, checkpoints, caches, logs. — Chapter 12 §10; also Chapter 21 §13.3

Erlang. The unit of offered load. One Erlang is one server's worth of continuously busy capacity, so \(a = 3\) Erlangs means that, on average, three workers' worth of work arrives each second. — Chapter 18 §12.2

Erlang C. The probability \(C(c, a)\) that an arriving request finds all \(c\) servers busy and must wait, given offered load \(a = \lambda/\mu\) (the average number of busy servers). — Chapter 25 §7.4

Error budget. The amount of unreliability an SLO permits. A 99.5 % SLO allows 0.5 % of events to fail; those failures are a budget to spend on releases, experiments and provider incidents, not a defect to eliminate. — Chapter 20 §7.3

Errors as data. A tool failure that is returned to the model as a structured result, with a stable code, a human-readable message and a retryable flag, instead of thrown as an exception that unwinds the loop. — Chapter 11 §4.1

ETL (extract, transform, load). The offline pipeline that turns source files into embedded chunks in the vector store. — Chapter 16a §7.1

EU AI Act (Regulation (EU) 2024/1689). The EU regulation that sorts AI systems by risk and attaches obligations to each tier. Two roles matter: the provider (who develops a system or has it developed and places it on the market or puts it into service under its own name) and the deployer (who uses it professionally). — Chapter 21 §13.1

.eval(). Switches layer behavior, not gradient tracking: dropout layers stop dropping activations, batch-norm layers switch from batch statistics to their stored running statistics. A model with no dropout and no batch-norm layers — like MiniLM's encoder, which has dropout but no batch-norm — is only partially affected by .eval(); a CNN with batch-norm is affected far more. — Chapter 1e §6.3

Eval. A repeatable measurement of a system's behaviour over a fixed set of cases, producing a score per case and an aggregate. Unlike a unit test, an eval can pass 91.7% of the time and still be useful. — Chapter 15b §5.2; also Chapter 19 §1.1

eval set. An eval set is a fixed list of inputs with a labeled correct output for each, used to compare strategies on identical data. A paired comparison runs every strategy on the same tickets, so differences in difficulty cancel. — Chapter 13 §11.1

evaluator-optimizer loop. An evaluator-optimizer loop is the general pattern: a generator produces a candidate, an evaluator judges it and explains any defect, and an optimizer (the generator again, now given the critique) produces a revision. — Chapter 13 §4.1

Event loop. A single thread that runs many coroutines by switching between them whenever one reaches an await. While a coroutine awaits a socket, the loop runs another; while a coroutine runs without awaiting, nothing else on that loop runs at all. — Chapter 18 §2.1

Event-driven workflow. A program expressed as handlers that react to typed messages. There is no shared mutable state object: what a step needs must arrive in the event it receives, and what it produces is the next event. — Chapter 15 §8.2

Exhaustiveness checking. assert_never in the final case _ branch tells the type checker "every value of this Literal was already handled above; if you ever see this branch, either a new value was added to FinishReason and this match wasn't updated, or something upstream lied about the type." If a fifth finish reason is later added to FinishReason without adding a matching case, pyright/mypy flag the case _ branch itself as … — Chapter 1 §3.4

Expectation. The probability-weighted average of a random variable, \(\mathbb{E}[X]=\sum_x x\,P(X=x)\) for a discrete \(X\). It is the long-run average over many repetitions. — Appendix D

F

Facade vs. implementation. SLF4J (Simple Logging Facade for Java) is a compile-time API — Logger, LoggerFactory.getLogger(...), .info(...) — with no logging behaviour of its own. Logback is one concrete implementation that binds to that API at runtime. — Chapter 2 §12.1

Factory-as-fixture. A fixture that returns a function, not a value — so a test calls the returned function (possibly several times, with different arguments) while still getting pytest's setup/teardown machinery for every call. — Chapter 1f §1.2

FAIL_TO_PASS / PASS_TO_PASS. The two test sets that define success in SWE-bench. FAIL_TO_PASS (F2P) are the tests that fail on the buggy snapshot and must pass after the agent's patch: they encode "the issue is fixed". — Chapter 17 §6.1

false-hit rate. False hit. A cache hit whose stored answer is wrong for the new query. The false-hit rate is the fraction of hits that are false; the wrong-answer share is the fraction of all queries that receive a wrong cached answer. — Chapter 22 §5.2

FFI boundary. The point where control and data cross from one language's runtime into another's — here, from CPython's object model into compiled Rust code and back. — Chapter 1c §13.3

Figure/Axes API. Matplotlib's object-oriented interface — fig, ax = plt.subplots(), then methods called directly on ax — as distinct from the older, implicitly-stateful plt.plot()/plt.xlabel() "pyplot" shortcut, which mutates a hidden "current figure" and composes badly into multi-panel layouts. — Chapter 1e §11.1

Fine-tuning. Continuing to train a pretrained model's weights on your own examples, so that the behaviour you want becomes the model's default instead of something the prompt has to ask for. — Chapter 9 §7.1

Fixture. A pytest function decorated @pytest.fixture that a test requests as a parameter by name. pytest calls it, runs setup code up to a yield (or returns a plain value), hands the result to the test, then — after the test finishes — resumes the fixture past the yield to run teardown. — Chapter 1f §1.1

Flaky test. A test whose pass/fail outcome varies between runs against unchanged code — timing jitter, ordering non-determinism, a race in shared fixture state. A flaky test is a bug, either in the test itself or in the code it exercises; it is never a fact of life to route around with a retry. — Chapter 1f §14.2

Flat (exact) index. No index structure at all: a query vector is compared against every stored vector, and the top-\(k\) by similarity are returned. Recall is exactly 1.0 by definition — it is mathematically impossible to miss a true nearest neighbor, because nothing is skipped. — Chapter 7 §4.1

FLOP. A FLOP (floating-point operation) is one addition or one multiplication of two floating point numbers. FLOPs (lowercase s) counts operations; FLOP/s is a speed. The two are confused constantly. — Chapter 3 §2.2; also Chapter 4 §5.3, Appendix D

FOR UPDATE SKIP LOCKED. A Postgres row-locking clause. FOR UPDATE locks the selected row until the transaction ends; SKIP LOCKED makes a second transaction skip rows another transaction has locked instead of waiting for them. — Chapter 18 §5.1

Free-threaded ABI tag. A distinct wheel platform tag (cp313t, cp314t) that a package must publish in addition to its ordinary cp313/cp314 wheel, because a C extension compiled against the ordinary build's assumptions (non-atomic refcounting, no per-object locks) is not merely slower but unsafe — potentially crashing or corrupting memory — if loaded into a free-threaded interpreter without being recompiled against its different ABI. — Chapter 1a §7.3

Free-threaded build (PEP 703). A CPython build variant, identified by a t suffix on its ABI tag (cp313t, cp314t), that removes the Global Interpreter Lock entirely — multiple Python threads can execute Python bytecode truly simultaneously on separate cores, at the cost of replacing CPython's simple reference-counting scheme with a more expensive one. — Chapter 1a §7.2

Frozen install. Frozen install. Installing exactly the versions recorded in a lock file, with no resolution step and no network lookups to pick versions. The build either reproduces the tested graph or fails; it can never produce a different one. — Chapter 23 §2.1

Functional interface. An interface with exactly one abstract method. A lambda or method reference is a way to write an instance of one without naming a class. Default methods, static methods and methods inherited from Object (equals, toString) do not count toward the "one". — Chapter 2b §9.1

G

Garbage collector (GC). The part of the JVM that finds objects no longer reachable and reclaims their memory. A pause (stop-the-world) halts all application threads; a concurrent phase runs alongside them. — Chapter 2f §12.3

Gatherer. An object of type Gatherer<T, A, R> (input element T, private state A, output element R) made of four functions: an initializer that creates the state, an integrator that receives each input element with the state and a handle to the downstream and pushes zero or more outputs, an optional combiner that merges two states for parallel evaluation, and an optional finisher that runs once at the end of the input and may push final outputs. — Chapter 2b §8.1

GAV (groupId, artifactId, version). The three coordinates that identify an artifact in a repository, e.g. org.springframework.ai:spring-ai-openai:1.1.8. Packaging (jar, pom) and classifier (sources, javadoc) extend it to the full groupId:artifactId:version[:packaging[:classifier]]. — Chapter 2a §1.1

Generated client. Source code (classes for the schemas plus one method per operation) produced mechanically from the OpenAPI document. If the document says skuCount was renamed lineCount, the next generation produces a client without sku_count / getSkuCount(), and every caller that used it fails at type-check or compile time instead of throwing KeyError in production at 3 a.m. — Chapter 24 §2.1

Gold label. The label a careful, informed human assigns, treated as ground truth for the purpose of the eval. "Gold" does not mean infallible; it means the standard the cheaper methods are measured against, which is why two humans must agree on it before it is trusted. — Chapter 19 §3.3

Golden set. A fixed list of inputs with the expected behaviour written down by a human: the tools that must be called, the facts the answer must contain, the actions that must not happen. — Chapter 25 §9.1

GQA (grouped-query attention). Ainslie et al. (2023). Instead of one key/value head per query head, groups of query heads share a K/V head: with \(h = 32\) query heads and \(n_{\text{kv\_heads}} = 8\), four query heads read the same keys and values. — Chapter 4 §7.3

GraalPy (25.4.4.1.1). A Python 3 implementation written in Java on the Truffle framework. Host: Java. Guest: Python, but not CPython: a reimplementation that runs on any JVM through the GraalVM polyglot API. — Chapter 24 §7.1

gradient. The gradient \(\nabla_{\mathbf w}L\) of a loss \(L\) with respect to a parameter vector \(\mathbf w\) is the vector of partial derivatives \(\partial L/\partial w_j\). It points in the direction in which \(L\) increases fastest, and its length is the rate of that increase. — Chapter 3 §7.1; also Appendix D

Granian. A Rust-implemented ASGI/WSGI/RSGI server built on Hyper and Tokio (version 2.8.3, confirmed against PyPI this session). Its CLI exposes --workers for OS-level multi-process scaling and a separate --runtime-threads for its own Tokio runtime's thread count per worker — a second, Rust-side concurrency knob with no Python-server equivalent. — Chapter 1d §6.2

Grounding. Mapping the model's intent ("press the submit button") to a concrete, executable target in the interface. The action space is the set of actions the harness accepts and how they designate a target. — Chapter 17 §8.3

gRPC. An RPC framework from Google: you describe a service and its messages in a .proto file, a compiler generates client stubs and server skeletons for each language, and calls travel as protobuf-encoded messages over HTTP/2. — Chapter 24 §3.1

Guardrail. A check that runs next to the agent and can abort the run. An input guardrail inspects the user's input, an output guardrail the final answer, and a tool guardrail one tool's arguments or result. — Chapter 15b §8.4; also Chapter 16b §6, Chapter 21 §10.1

H

Handoff. Transferring the conversation to another agent. In this SDK a handoff is exposed to the model as an ordinary tool named transfer_to_<agent_name>; when the model calls it, the Runner intercepts the call, swaps the current agent and continues the loop with the new agent's instructions and tools. — Chapter 15b §8.3

Handoff tax. The overhead of moving a task from one agent to another: a token cost (serialising the task, looking up the target, writing a summary) and a failure probability (wrong target, dropped task, schema mismatch, target down). — Chapter 14 §1.2

Harness. The program around the model: it owns the loop, executes tools, enforces budgets and decides when the run is over. The model only proposes the next action. "Claude Code", "Codex CLI" and "Aider" are harnesses; the models behind them are interchangeable. — Chapter 17 §4.1

Head-based sampling. The keep-or-drop decision is made when the trace starts, at the root span, before anything is known about how it will end. It is cheap and stateless, and it propagates through the sampled flag of traceparent. — Chapter 20 §12.2

Hexagonal architecture (ports and adapters). A way of drawing a boundary around business logic so that logic depends on abstractions it defines, never on the concrete frameworks that fulfil them. Domain: plain Python — Order, Ticket, RMA — zero imports from FastAPI or SQLAlchemy. — Chapter 1d §13.2

Hierarchical decomposition. A supervisor whose workers are themselves supervisors. Each level applies section 2 of the source chapter's mechanism one level down: classify, dispatch, optionally resolve short jobs locally. — Chapter 14 §4.1

Histogram buckets. Upper bounds, chosen when you create the instrument, that partition the value range. The OpenTelemetry SDK defaults top out at 10 s, which would place every Relay trajectory (7–28 s) in the overflow bucket. — Chapter 20 §7.1

HMAC (hash-based message authentication code). A keyed hash, \(\text{HMAC}(K, m)\), computable only by someone who knows the secret \(K\). The sender computes it over the request body and sends it in a header; the receiver recomputes it with its own copy of \(K\) and compares. — Chapter 18 §5.3

HNSW. A multi-layer proximity graph: the top layer has few nodes and long-range edges (for fast coarse navigation), each layer below has progressively more nodes and shorter edges, and the bottom layer contains every vector. — Chapter 7 §4.3; also Chapter 25 §4.1

Hook. A callback the SDK invokes at a defined point in the loop, with a payload describing what is about to happen or just happened. A hook can observe, modify or veto. — Chapter 15 §5.3; also Chapter 15b §7.2

Host. The application the user (or a program) interacts with: Claude Desktop, Claude Code, an IDE, or Relay's own agent runtime. The host owns the model, the conversation and the decision of which tools a model may call. — Chapter 11 §7.2

HTTP client. A library that owns a pool of TCP (and TLS) connections, encodes your request, decodes the response, follows redirects, and decides how long to wait for each stage. — Chapter 2e §7.1

Human approval gate. A checkpoint inserted before any side-effecting tool call whose estimated monetary value exceeds a fixed threshold, requiring a human (typically a support rep) to approve before the action executes. — Chapter §4.4

Hybrid search. Running a lexical retriever and a dense retriever over the same corpus and merging their results into one ranked list. Fusion is the merge step. Two families exist: score fusion (normalise each retriever's scores, then combine) and rank fusion (ignore the scores, combine the positions). — Chapter 8 §3.1

HyDE (Hypothetical Document Embeddings). Instead of embedding the question, ask an LLM to write a plausible answer, embed that hypothetical document, and retrieve the real documents nearest to it. The hypothetical answer may be factually wrong; it is used only to land in the right region of the embedding space, and is never shown to the user. — Chapter 8 §5.3

Hypercorn. An ASGI/WSGI server built on the hyper/h11/h2/wsproto libraries (version 0.18.0, confirmed against PyPI this session), explicitly modelled on Gunicorn's process-management style. It supports asyncio, uvloop, or trio as its async backend — the pick when Chapter 1c section 2.4 of the source chapter's trio-based structured concurrency matters more than raw throughput. — Chapter 1d §6.2

I

Idempotency key. A caller-generated identifier, one per logical operation, sent with every attempt of that operation. The server remembers key → first result and, on a repeated key, returns the remembered result instead of executing the side effect again. — Chapter 11 §4.2; also Chapter 18 §11.1

Idempotent consumer. A consumer for which processing the same message twice has the same effect as processing it once. — Chapter 24 §4.3

Immutable collection. A collection whose contents can never change after construction, whatever reference you hold. Distinct from an unmodifiable view, which only blocks mutation through that reference while the underlying collection may still change. — Chapter 2b §12.1

Importance decay. The reduction over time of a memory's importance score in the absence of reinforcement. Relay uses a half-life model: after every \(\tau_{1/2}\) days, the importance halves. — Chapter 12 §8.3

Index. Pandas' one structural feature Polars and DuckDB do not have: every DataFrame and Series carries a separate Index object — by default a RangeIndex (0, 1, 2, …), but settable to any column, including a non-unique or non-sorted one — that .loc[] looks values up by label through, while .iloc[] always means by position, regardless of what the index currently is. — Chapter 1e §3.1

In-process MCP server. A Model Context Protocol server that runs inside your Python process instead of as a separate program. create_sdk_mcp_server() builds one from @tool coroutines; the CLI sees it as an ordinary MCP server (it lists tools and calls them), but every call is routed back over the existing stdio pipe into your function. — Chapter 15b §7.1

Input and output pricing. Input and output pricing. Input tokens (also called prompt tokens) are everything you send: system prompt, tool schemas, conversation history, retrieved documents, the user message. Output tokens (completion tokens) are what the model generates. — Chapter 22 §1.1

Intent routing. A fast, cheap classifier that decides which downstream path a request takes — does this ticket need retrieval, a write action, or a one-line templated reply; is it a repeat of a category the customer already asked about — before any LLM call happens, so the LLM's latency and cost are spent only on the tickets that actually need it. — Chapter 1e §9.1

Inter-rater agreement. A measure of how consistently two labelers (two humans, or a human and an LLM judge) assign the same category to the same items. — Appendix D

Interrupt. A node calls interrupt(payload); the run stops, the checkpoint is saved, and invoke returns with the payload under __interrupt__. A later call invoke(Command(resume=value), config) makes that same interrupt(...) expression return value. — Chapter 15 §4.2; also Chapter 15a §6.1

I/O-bound. A workload is I/O-bound when the process spends most of its wall-clock time waiting on something external — a network response, a disk read — rather than executing instructions on the CPU. — Chapter 1 §1.1

IVF (Inverted File Index). Partition the corpus into nlist clusters via k-means at index build time. At query time, find the nprobe clusters whose centroid is closest to the query vector, and only scan vectors inside those clusters — skipping every vector in every other cluster entirely. — Chapter 7 §4.2

J

Jackson. The de facto JSON library of the JVM. Spring, most provider SDKs, LangChain4j and the OpenAPI generators all use it, so even if you never write new ObjectMapper() you inherit its defaults. — Chapter 2e §2

Jackson 3. A major release that moves the core packages from com.fasterxml.jackson.* to tools.jackson.*, makes mappers immutable and exceptions unchecked, and changes several defaults. Spring Boot 4 and Spring Framework 7 default to it; Spring Boot 3.5 (this chapter's Spring baseline) uses Jackson 2. — Chapter 2e §2.5

Jailbreak. An attempt by the user themselves, in their own turn, to make the model violate its safety training or the operator's policy — for Relay, to make it act as if the €500 approval rule, the return policy or the confidentiality of its instructions did not exist. — Chapter 21 §11.1

Java module (JPMS). Java module (JPMS). Since Java 9 the JDK itself is split into named modules (java.base, java.sql, java.net.http, …). jlink assembles a runtime image from a chosen set of modules and their transitive dependencies; jdeps analyses class files to list the modules they reference. — Chapter 23 §3.2

JEP (JDK Enhancement Proposal). The numbered document (openjdk.org/jeps/N) that specifies one feature, with its status and the release that finalised it. When this chapter says "JEP 440", it means the record-patterns specification. — Chapter 2b §1.1; also Chapter 24 §7.1

JFR (JDK Flight Recorder). An event recorder built into the JVM. The JVM, the JDK libraries and your own code emit small typed events (a CPU sample, an allocation, a GC pause, a lock wait, a socket read) into per-thread buffers; the recorder flushes them to a .jfr file. — Chapter 2f §13.1

JIT compiler. The part of the JVM that translates hot bytecode to machine code while the program runs, using what it learned from running it. HotSpot has two: C1 (fast to compile, lightly optimized) and C2 (slow to compile, heavily optimized). — Chapter 2f §12.1

jlink. The JDK tool that links a set of modules and their transitive requires into a self-contained runtime directory (bin/java, lib/, a release file). It needs the module list; for a class-path application, jdeps --print-module-deps produces it from the bytecode. — Chapter 2a §11.3

JMH (Java Microbenchmark Harness). The OpenJDK project's benchmarking framework, written by the JIT's own engineers. It generates the measurement loop, forks fresh JVMs, runs warm-up and measurement iterations, defeats dead-code elimination through a Blackhole, and reports a score with a confidence interval. — Chapter 2f §11.1

JPype (1.7.1). Starts a JVM inside a Python process through JNI and exposes Java classes as Python objects. Host: Python (real CPython). Guest: Java (real JVM). — Chapter 24 §7.1

JSON Lines (JSONL). A text format with exactly one JSON object per line and \n between lines. — Chapter 10 §10.1

JSON Schema. A JSON document that describes the shape of other JSON documents: types, required properties, ranges, patterns, enumerations. A validator takes a schema and an instance and returns the list of violations. — Chapter 2e §5.1; also Chapter 11 §2.1

Jupiter engine vs. the platform. JUnit 5 is three separable pieces: the Platform (discovers and runs tests, hosts other engines — this is what Surefire actually talks to), Jupiter (the @Test/@ParameterizedTest/@ExtendWith programming model this chapter uses throughout), and Vintage (runs old JUnit 4 tests on the Platform, unused in this chapter). — Chapter 2 §11.1

JWT (JSON Web Token). Three base64url-encoded segments joined by dots — header.payload.signature — where the header names a signing algorithm, the payload carries claims (sub, exp, custom fields like Relay's scope), and the signature is computed over the first two segments using either a shared secret (HS256) or a public/private key pair (RS256). — Chapter 1d §11.2

K

Kernel namespace. The single, persistent set of variables a running Jupyter kernel holds, built up by whatever cells have been executed, in whatever order they were run — not the order they appear in the .ipynb file. — Chapter 1e §5.1

kind (Kubernetes in Docker). A tool that runs Kubernetes nodes as Docker containers: a conformance-tested cluster for integration tests, on one machine. It proves manifests, probes, Secrets and ingress policy, and says nothing about multi-node failure, cloud load balancers or storage classes. — Chapter 25 §11.4

KL divergence (Kullback-Leibler). \(D_{KL}(p\Vert q)=\sum_ip_i\log_2\frac{p_i}{q_i}\), the extra bits per outcome paid for using \(q\) in place of \(p\). Zero if and only if \(p=q\); it is not symmetric, so it is a "divergence", not a distance. — Appendix D

Kullback–Leibler (KL) divergence. The Kullback–Leibler (KL) divergence \(D_{KL}(p\,\Vert\,q)\) measures how much extra surprise, in bits or nats, is incurred by predicting with \(q\) when the truth is \(p\). It is zero iff \(p=q\) and never negative. — Chapter 3 §5.3

KV cache. For every layer and every token already in the context, the key and value vectors \(k_i, v_i\) computed in section 3.2 of the source chapter, kept in GPU memory so that later tokens can attend to them without recomputing them. — Chapter 4 §7.2; also Chapter 23 §7.1

L

LangChain vector store / retriever. In LangChain, a VectorStore wraps a database and exposes add_documents and similarity_search; .as_retriever() turns it into a Runnable that composes into chains and graphs (Chapter 15). — Chapter 7 §8.3

LangChain4j. A Java library of model, embedding and retrieval abstractions (ChatModel, EmbeddingModel, EmbeddingStore<TextSegment>, ContentRetriever) with provider modules behind them. The core is GA (langchain4j-core 1.0.0). — Chapter 7 §9.2

Langfuse. An open-source (MIT core) LLM engineering platform: trace viewer, prompt management with versions, user-feedback and score tracking, datasets and evaluation runs, in one UI. — Chapter 20 §5.1

LangGraph Server (the "Agent Server" of the LangGraph Platform). A process that hosts compiled graphs behind an HTTP API and adds what the library leaves to you: a persistent task queue with workers, assistants (a graph plus a configuration), threads, runs, cron jobs, a store API, SSE streaming and pluggable authentication. — Chapter 15a §11.3

Lax vs strict validation. Lax (Pydantic's default) allows type coercion: a numeric string becomes an int, an int becomes a float, an ISO date string becomes a date. Strict disables coercion: the input must already be the declared Python type, or validation fails. — Chapter 1b §8.2

Layer cache invalidation. Layer cache invalidation. A Docker image is a stack of layers, one per instruction. Docker reuses a cached layer only if its instruction and all its inputs are unchanged (for COPY, the content of the copied files). — Chapter 23 §2.2

Layered jar. Layered jar. A jar whose contents are split into named layers by change frequency: dependencies (releases), spring-boot-loader, snapshot-dependencies and application. Each layer is extracted to its own directory and copied into the image by its own COPY, so a commit that touches only application code invalidates only the last, smallest layer. — Chapter 23 §3.1

LazyFrame. A Polars object that records a graph of operations (scan_parquet, .filter(), .select(), .group_by(), …) without executing any of them, until .collect() is called. Because Polars sees the whole graph before running anything, it can reorder and prune operations the way a SQL query planner does — this is the entire reason lazy exists, not merely "run it later." — Chapter 1e §3.2

Leaky bucket. A bounded queue of capacity \(Q\), draining at a constant rate \(r\) regardless of how bursty the arrivals are. Unlike a token bucket, a leaky bucket never bursts — even when the queue is empty, output never exceeds \(r\); arrivals beyond what the queue can hold are rejected or delayed, not smoothed into a temporary burst. — Chapter 1c §10.3

Learning rate (\(\eta\)). The step-size multiplier. Too small and training crawls; too large and it overshoots and may diverge. — Appendix D

Lease. A credential's bounded lifetime: after the lease expires the credential stops working and must be re-issued, so a stolen copy has a limited useful life. — Chapter 21 §6.3

Lethal trifecta. The three capabilities that, held together by one agent in one session, make a data-exfiltrating prompt injection possible: (D) access to private data; (U) exposure to untrusted content; (E) a channel that can send data outside (email, an HTTP request, a post to a public place, even a rendered image URL). — Chapter 21 §2.3; also Chapter 25 §8.1

libuv. A cross-platform C library providing an event loop, asynchronous I/O primitives, and timers, originally built for Node.js. uvloop wraps it in a Cython layer that implements asyncio's loop interface on top, rather than reimplementing an event loop from scratch. — Chapter 1c §9.1

Lifecycle, phase, goal (mojo). A lifecycle is an ordered list of phases. A phase is a named slot. A goal (implemented by a mojo, a Java class) is a unit of work in a plugin, written plugin:goal, e.g. compiler:compile. — Chapter 2a §2.1

Lifespan protocol. A third scope["type"] (besides "http" and "websocket") that a server opens exactly once per process lifetime — not per request — to let the application run startup and shutdown code. — Chapter 1d §1.2

likelihood. The likelihood \(L(\theta)=P(\text{data}\mid\theta)\) is the probability that a model with parameters \(\theta\) assigns to the data that was actually observed, viewed as a function of \(\theta\). Maximum-likelihood estimation (MLE) picks \(\theta^\star=\arg\max_\theta L(\theta)\): the parameters under which the data you saw was most probable. — Chapter 3 §6.1; also Appendix D

Line coverage. Was this line executed at least once, by any test. Branch coverage. Was each direction of every conditional taken at least once — both the True and False outcome of every if. — Chapter 1f §7.1

Little's Law. For any stable queueing system, the long-run average number of items in the system, \(L\), equals the average arrival rate, \(\lambda\), times the average time each item spends in the system, \(W\): \(L = \lambda W\). — Chapter 1d §6.5; also Chapter 23 §1.2, Chapter 25 §12.3

llama.cpp. A C/C++ inference engine (and the ggml tensor library under it) that runs quantized models on CPUs and consumer GPUs with no Python. Most "local LLM" tools are built on it. — Chapter 9 §2.1

LlamaIndex. A Python framework organized around nodes (chunks with metadata), indexes built from nodes over a vector store, and retrievers that query an index. For RAG its value is the uniform retriever/query-engine interface and many vector-store connectors. — Chapter 7 §8.2

LLM application. A system whose entire behavior is one request to a model and one response back to the caller — no loop, no tool call with a side effect, no state that survives past that single exchange. — Chapter §1.1

LLM gateway. LLM gateway. A proxy that speaks the provider wire format (usually OpenAI's) on one side and routes to many models and providers on the other. It owns the concerns that cut across every call: routing and fallback, credentials, per-key and per-tenant budgets, rate limits, caching, and one place to record cost and latency. — Chapter 22 §10.1

LLM-as-judge. Using a (typically stronger or differently prompted) LLM to grade another model's output against a rubric, instead of an exact-match string comparison — necessary whenever "correct" is a matter of judgment (a helpful reply, a well-reasoned classification) rather than one exact string. — Chapter 1f §14.3; also Chapter 16a §11.1, Chapter 19 §4

Log. A timestamped, structured record of one discrete event: "tool lookup_order failed with ORDER_NOT_FOUND for tenant acme-gmbh". Cheap to write, expensive to search at volume, and blind to causality: two log lines about the same request are only related if you remembered to put a shared id in both. — Chapter 20 §1.1

Logit. The unnormalized score \(z_i\) for token \(i\). Softmax turns logits into probabilities, \(P(i) = e^{z_i}/\sum_j e^{z_j}\) (derived in Chapter 3). Greedy decoding picks \(\arg\max_i z_i\) every time. — Chapter 4 §8

Logits. The raw, unbounded real-valued scores \(z_1,\dots,z_V\) that the last layer of an LLM produces, one per vocabulary token. Softmax is the function that turns logits into a probability distribution. — Chapter 3 §4.1

Long-term user memory. A small set of short, durable statements about one subject (a customer, an account), extracted from finished conversations and stored outside any thread. It answers "what do we know about this person?". — Chapter 12 §8

LoRA (Low-Rank Adaptation). Instead of fine-tuning a linear layer's full weight matrix \(W \in \mathbb{R}^{d\times d}\), LoRA freezes \(W\) and trains two small matrices \(A \in \mathbb{R}^{r\times d}\) and \(B \in \mathbb{R}^{d\times r}\) with \(r \ll d\), so the effective update is \(W + BA\). — Chapter 1e §7.7; also Chapter 9 §8.2

LST (Lossless Semantic Tree). OpenRewrite's representation of a source file: a syntax tree that is type-attributed (each method call knows which class's method it resolves to) and lossless (whitespace, comments and formatting are part of the tree, so printing an unchanged tree reproduces the original file byte for byte). — Chapter 17 §10.1

LTS (long-term support). A Java release the vendors commit to patching for years. The LTS line is 8, 11, 17, 21, 25. Everything between is a six-month release supported only until the next one. — Chapter 2b §1.1

M

Makespan. The wall-clock time from the start of a set of tasks to the completion of the last one. — Chapter 14 §3.2; also Chapter 22 §8.1

Marker. A decorator (@pytest.mark.<name>) attached to a test that changes how pytest treats it — skips it, expects it to fail, or tags it for selective inclusion/exclusion via -m. — Chapter 1f §1.4

Matcher. A rule that relaxes an example from "equals this exact value" to "has this type" or "matches this regular expression". The skill in writing a pact is choosing exact values only where the consumer's behaviour depends on the value. — Chapter 24 §10.1

matrix. A matrix \(W\in\mathbb{R}^{m\times n}\) is a rectangular grid of numbers with \(m\) rows and \(n\) columns. A tensor is the generalization to any number of axes. A tensor's shape is the tuple of its axis lengths, and almost every bug in numeric code is a shape bug. — Chapter 3 §2.1; also Appendix D

Matryoshka Representation Learning (MRL). A training technique (Kusupati et al., 2022) that adds a nested loss term so that the first \(k\) dimensions of a \(d\)-dimensional embedding are themselves a good, independently-usable embedding, for many values of \(k \le d\) — like Russian nesting dolls, the smaller vector is a complete embedding, not a truncated fragment of one. — Chapter 7 §1.4

McNemar's test. A test for paired binary outcomes. Under the null hypothesis "the two systems have the same pass rate", a discordant ticket is equally likely to favour either system, so \(b\) should be about half of \(b + c\). — Chapter 19 §6.3

MCP (Model Context Protocol). A JSON-RPC protocol over which a client discovers (tools/list) and invokes (tools/call) capabilities published by a server. Streamable HTTP is its HTTP transport: one endpoint, POST for requests, optional server-sent events for streaming replies. — Chapter 25 §3.2

MCP client. The connection object a host creates per server. It holds that connection's state (negotiated version, capabilities, session id) and translates between the host's internal calls and JSON-RPC. One client talks to exactly one server. — Chapter 11 §7.2; also Chapter 16b §8.1

MCP host / client / server. The host is the agent application that talks to an LLM and decides which tools to call; it embeds an MCP client that speaks the protocol to an MCP server, which exposes tools (and resources and prompts). "Language-neutral" means the host and server can be written in different languages without either knowing. — Chapter 24 §5.1

MCP Inspector. The MCP project's interactive debugger: it connects to any server as a client and lets you list and call primitives, send arbitrary requests and read the raw JSON-RPC traffic. — Chapter 11 §12.6

MCP server. A program that exposes primitives (tools, resources, prompts) to clients over a transport. It may be local (a subprocess) or remote (an HTTPS endpoint), written in any language. — Chapter 11 §7.2

MCTS. Repeats four phases per simulation: select a path down the existing tree by a rule that trades off promising and under-explored children; expand one new child; roll out from it to a complete plan with a cheap default policy; backpropagate the final score to every node on the path. — Chapter 13 §6.1

MDC (Mapped Diagnostic Context). A map, keyed by string, that a logging framework attaches to the current thread and includes automatically in every log line that thread emits until the key is removed. — Chapter 2 §12.2

Message broker. A server that accepts messages from producers, stores them, and delivers them to consumers, so that the two sides need not be up at the same time. At-least-once delivery: the broker redelivers a message until a consumer acknowledges it, so a message may arrive more than once but is not lost. — Chapter 24 §4.1

Metadata filter. A predicate on structured fields stored beside each chunk (customer_id, product_line, valid_to, language), evaluated together with the similarity search. Access-control filter (ACL). A metadata filter that is a security boundary rather than a ranking preference: a chunk that fails it must never reach the prompt, however similar it is. — Chapter 8 §8

Metric. A numeric time series aggregated across many events: calls per second, the 95th percentile of latency, tokens consumed per tenant per hour. Metrics are cheap to store and fast to alert on, and they throw away the individual request. — Chapter 20 §1.1

Micrometer Observation. Spring's instrumentation abstraction. You wrap a unit of work in an Observation; handlers attached to the registry turn that one observation into a metric (a timer), a span (through a tracing bridge) and log correlation (trace id in the MDC). — Chapter 20 §6.1

Mixture of experts (MoE). A transformer whose MLP sublayer is replaced, in some or all blocks, by \(E\) parallel MLPs of identical shape called experts, plus a small router that chooses, for each token separately, the top-\(k\) experts to run. — Chapter 4 §10.1

M/M/c. Kendall's shorthand for the model used here: Markovian (Poisson, D.3.2) arrivals, Markovian (exponentially distributed, memoryless) service times, \(c\) servers. The exponential service-time assumption is a simplification chosen because it makes the algebra exact, not a claim about how long an LLM call really takes (D.10.4 relaxes it). — Appendix D

Model Context Protocol (MCP). An open protocol, built on JSON-RPC 2.0, in which an AI application connects to servers that expose tools, data and prompt templates in one standard shape. A server written once works with every compliant application; an application written once works with every compliant server. — Chapter 11 §7.1; also Chapter 15b §4.4

Modular RAG. Retrieval-augmented generation split into replaceable stages (query transformation, query expansion, retrieval, joining, post-processing, augmentation) instead of one fixed "search then stuff the prompt" step. Spring AI 2.0 ships it as the module spring-ai-rag and one advisor, RetrievalAugmentationAdvisor (Chapter 8 covers the theory of each stage). — Chapter 16a §8.1

Module (JPMS). A named set of packages plus a descriptor (module-info.class, compiled from module-info.java) that declares its dependencies (requires) and its API (exports). Modules are resolved from the module path; the compiler and the JVM check that every requires is satisfied before anything runs, and that code only touches packages that were exported to it. — Chapter 2a §10.1; also Chapter 2e §2.3

Multimodal. A model input or output that is not text: an image, audio, a PDF page. In Spring AI the input side is Media attached to a UserMessage; the output side has its own model types (ImageModel, speech and transcription models). — Chapter 16a §10.1

Multi-stage Docker build. A Dockerfile with more than one FROM line, where an early stage (builder) has every tool needed to produce an artifact (a synced virtual environment, in this chapter's case) and a later stage COPY --from=builder only the finished artifact, discarding everything the builder stage needed to create it — compilers, package caches, the build backend itself. — Chapter 1a §10.1

Mutant. The original source with one small, syntactically valid change applied — a comparison operator flipped (>= → >), a string literal altered, a returned constant changed. — Chapter 1f §8.1

Mutation score. \(\text{killed} / (\text{killed} + \text{survived})\) — the fraction of deliberately introduced logic changes that some test in the suite actually noticed. Unlike coverage's "did this line execute," mutation score answers a strictly stronger, causal question: "if this exact piece of logic were subtly wrong, would some test have failed?" — Chapter 1f §9.1

Mutation testing. Make a small change to the program (a mutant: > becomes >=, a returned true becomes false), run the tests that cover the changed line, and see whether any fails. — Chapter 2f §9.2

N

Namespace. A tuple of strings that scopes a group of Store items, like a directory path: here ("customers", "A-2217", "facts"). Searches and deletes operate inside a namespace or under a prefix of one. — Chapter 12 §11.2

Native (foreign) memory and function. Memory not managed by the garbage collector — allocated by malloc, memory-mapped from a file, or owned by a library — and a function compiled in another language. — Chapter 2b §13.6

Native time (scalene's sense). Time scalene attributes to a line but not to CPython's own bytecode interpreter — time spent inside a C extension doing real work (numpy's BLAS call, for instance), as distinct from Python-level overhead on the same line (argument marshalling, attribute lookups). — Chapter 1c §12.3

ndarray. NumPy's core object: a flat block of raw memory (the buffer) plus a small amount of metadata — shape, dtype, and strides — that tells NumPy how to interpret that flat buffer as an N-dimensional grid. — Chapter 1e §2.1

NDJSON (newline-delimited JSON, also JSON Lines). A stream of complete JSON values, one per line, separated by \n. No framing beyond the newline, no enclosing array, so a reader can process the first record before the last exists and a writer can append forever. — Chapter 2e §8.5

Nearest-wins (Maven). Among all requests for an artifact, the one whose path from your project is shortest wins; ties are broken by the order of declaration in a depth-first walk of the POMs. — Chapter 2a §4.1

Network latency. Network latency. Every hop between client and model: your service to a gateway, the gateway to the provider, TLS handshakes, DNS, cross-region distance. It is the most ignored component, and for short outputs it can rival the model itself. — Chapter 22 §3.1

NF4 (4-bit NormalFloat). A 4-bit data type whose 16 levels are placed at the quantiles of a normal distribution, because pretrained weights are approximately normal; each block of 64 weights has its own scale. — Chapter 9 §8.3

Non-blocking (async) parser. A JsonParser that never reads from an InputStream. You hand it a chunk through a ByteArrayFeeder; nextToken() returns the next complete token or NOT_AVAILABLE when it needs more bytes. — Chapter 2e §4.3

Norm. A function \(\lVert\cdot\rVert\) that turns a vector into one non-negative number measuring its size. It must satisfy three rules: \(\lVert\mathbf{x}\rVert=0\) only for the zero vector; \(\lVert c\mathbf{x}\rVert=|c|\,\lVert\mathbf{x}\rVert\); and the triangle inequality \(\lVert\mathbf{x}+\mathbf{y}\rVert\le\lVert\mathbf{x}\rVert+\lVert\mathbf{y}\rVert\). — Appendix D

Null hypothesis (\(H_0\)). The default claim of "no effect", here "the two prompts have the same true accuracy, \(p_1=p_2\)". The alternative (\(H_1\)) is "they differ" (two-sided) or "B is better" (one-sided). — Appendix D

Nullness annotation. A type annotation (@Nullable, @NonNull, @NullMarked) that documents and lets a tool verify which references may be null. The compiler ignores it; a separate checker (NullAway, the Checker Framework, IntelliJ, Error Prone) enforces it. — Chapter 2b §10.4

O

OAuth 2.1 authorization-code flow with PKCE. The user's browser is sent to the authorization server, authenticates there, and returns a short-lived one-time authorization code to the client; the client exchanges the code for an access token. — Chapter 11 §10.1

Object header. The bookkeeping the JVM stores at the start of every object: a mark word (lock and hash state, 8 bytes) and a class pointer (4 bytes with compressed class pointers). — Chapter 2b §3.5

Observability. The property of a system that lets you answer new questions about its internal behaviour from the data it already emits, without shipping new code. Monitoring checks known failure conditions; observability lets you investigate an unknown one. — Chapter 20 §1.1

Observation. Micrometer's single instrumentation API: you start an Observation, and registered handlers turn it into a timer metric, a trace span and a log line at once. Spring AI instruments every layer of this chapter with observations, so one registry yields metrics and traces without separate code (Chapter 20 covers the back-end stack). — Chapter 16a §12.1

Open workload model. Open workload model. Requests arrive at a given rate regardless of how the system is doing, like real independent customers. If the system slows, requests pile up. — Chapter 22 §11.2

OpenAPI. A YAML/JSON document describing an HTTP API: paths, parameters, request and response bodies, status codes, security. OpenAPI Generator — a tool that reads such a document and generates client libraries, server stubs and models in dozens of languages. — Chapter 2e §10.1; also Chapter 24 §2.1

Open-loop load. Requests arrive on a schedule that does not depend on how fast the system answers, as customers do. A closed-loop generator (N users who each wait for their reply) slows down exactly when the system slows down and hides overload: it can never queue more than N. — Chapter 25 §12.2

opens. Circuit breaker. A per-dependency state machine that opens after \(k\) consecutive failures (calls are skipped immediately instead of waiting out a timeout), then half-opens after a cooldown to let one trial request through; success closes it, failure re-opens it. — Chapter 23 §12.1

OpenTelemetry (OTel). A vendor-neutral, CNCF-hosted standard for emitting telemetry: an API and SDK per language to create spans, metrics and logs; a wire protocol (OTLP) to ship them; and a Collector to receive, process and route them. — Chapter 20 §2.1

OpenTelemetry Collector. A standalone process built from pipelines: receivers (accept data, e.g. OTLP), processors (batch, filter, sample, redact, enrich) and exporters (send to a backend). One binary, configured in YAML, with no code changes in the services. — Chapter 20 §4.1

Open-weight model. A model whose trained parameters you can download and run yourself, under a licence that may still restrict how you use or redistribute them. — Chapter 9 §1.1

Operating point. One particular threshold on a classifier's score, and hence one particular (precision, recall) pair. A classifier is not "90% accurate"; it is a curve of operating points, and you choose where to stand on it. — Chapter 21 §10.3

Optional<T>. An immutable container that holds either one non-null value or nothing. It is a return type that tells the caller, in the signature, that "no result" is a normal possibility they must handle — the thing a null return cannot say. — Chapter 2b §10.1

Orchestrator-workers. An orchestrator decomposes a task into \(m\) independent sub-tasks of the same shape, launches one worker agent per sub-task in parallel, and an aggregator merges the results. The decomposition is data-dependent (how many sub-tasks) but the workers do not depend on each other. — Chapter 14 §3.1

Order. An int returned by getOrder(). Lower runs closer to the caller. Ordered.HIGHEST_PRECEDENCE is Integer.MIN_VALUE (-2147483648), the very outside; Ordered.LOWEST_PRECEDENCE is Integer.MAX_VALUE, the very inside, right above the model. — Chapter 16a §2.1

OSV / CVE. OSV (Open Source Vulnerabilities) is a public, machine-readable database of known security vulnerabilities in open-source packages, keyed by package name and affected version ranges. — Chapter 1f §12.3

P

Parallel tool calls. A single assistant turn that requests several tool invocations at once, each with its own id. The runtime may execute them concurrently and returns all the results in the next message, matched to their calls by id. — Chapter 11 §6.3

Parameter. One learned number (a weight or a bias). \(N\) denotes the total count. A model's size in memory is \(N\) times the bytes per parameter: 2 for fp16/bf16, 1 for int8, 0.5 for 4-bit. — Chapter 4 §5.1

Parametrize. A decorator that runs the same test function once per row of data supplied, reporting each run as its own test — test_foo[10.0-False-low], not one test that loops internally. — Chapter 1f §1.3

ParamSpec. A TypeVar captures a single type — "the return type is whatever T is." A ParamSpec captures an entire parameter list — every positional argument, every keyword argument, and their types — so a wrapper function can accept "whatever arguments the wrapped function accepts" and have the type checker verify calls against the original function's signature, not some erased *args: Any, **kwargs: Any. — Chapter 1 §3.2

Parquet. An on-disk file format that stores data column-major (all values of one column contiguous, then the next column), split into row groups, each with its own per-column min/max statistics and, for low-cardinality columns, dictionary encoding (store each distinct value once, then a compact integer per row pointing at it). — Chapter 1e §4.2

pass@k. The probability that at least one of \(k\) attempts succeeds. It rewards giving the system several tries and accepting the best (code generation checked by tests, a tool call that may be retried). — Chapter 19 §6.4

pass^k. The probability that all \(k\) attempts succeed. It measures reliability under repeated, unattended use (a nightly job, a scheduled workflow, a customer who asks again). — Chapter 19 §6.4

Path convertor. FastAPI's type-directed extension of Starlette's path templates: a path parameter's declared type (order_id: int, inferred from the function signature, or written explicitly as {order_id:int}) selects a conversion/validation rule applied before your function runs. — Chapter 1d §2.1

Pattern. A construct that (1) tests whether a value has a certain shape and (2) if it does, binds variables to parts of it. String s is a type pattern; TextBlock(var t) is a record pattern; case X when cond adds a boolean guard. — Chapter 2b §5

Payload tax. The cost of keeping a tool result in the context for the remaining steps of a trajectory. A result of \(s\) tokens produced at step \(i\) is part of the input of every later model call, so it is billed again at each of them. — Chapter 11 §5.2

PECS. If a parameterised argument produces Ts for your method to read, declare it ? extends T. If it consumes Ts that your method writes, declare it ? super T. — Chapter 2b §2.2

Peer handoff (swarm). Any agent can transfer a task directly to any other agent when it recognises it is out of its depth. There is no central supervisor; the "route" is the sequence of decisions the agents make. — Chapter 14 §5.1

PEP 621. The standard that defines the [project] table in pyproject.toml — name, version, dependencies, requires-python, classifiers, [project.scripts], [project.entry-points] — as backend-agnostic project metadata that any PEP 517 build backend reads the same way. — Chapter 1a §3.1

PEP 723. A structured TOML comment block — # /// script … # /// — embedded at the top of a standalone .py file, declaring that file's own dependencies and requires-python, so a single-file script can specify exactly what it needs without a pyproject.toml, a project, or any shared environment. — Chapter 1a §6.2

percentage rollout. Feature flag. A named value (boolean, string, number or small object) that the running code reads at decision time from a configuration source it can re-read, so behaviour can change without a restart or a deploy. — Chapter 23 §10.2

Perplexity. The exponential of the average cross-entropy per token. It reads as "the model is as uncertain as if it were choosing uniformly among PPL equally likely tokens at every step". — Chapter 3 §5.4; also Chapter 9 §3.5, Appendix D

Personalised PageRank. PageRank scores a node by how much random-walk probability mass reaches it. The personalised variant restarts the walk at a chosen set of seed nodes instead of uniformly, so the score becomes "how reachable is this file from the files that matter for this task". — Chapter 17 §2.2

PgBouncer transaction-mode pooling. An external process sitting between application workers and Postgres, multiplexing many application-side connections onto far fewer real Postgres backend connections — a client "checks out" a real connection only for the duration of one transaction, then returns it to the pool for another client to use. — Chapter 1d §9.5

pgvector. A Postgres extension that adds a vector(d) column type and index types (ivfflat, hnsw) over it, plus three distance operators tied directly to section 2 of the source chapter's metrics: <-> (Euclidean/L2), <#> (negative inner product — negative so that ORDER BY ascending still means "most similar first"), and <=> (cosine distance). — Chapter 7 §5.1

pickle.__reduce__. Python's pickle protocol lets any object customize how it is reconstructed on load via a __reduce__ method that returns (callable, args) — pickle.loads then calls that callable with those arguments. — Chapter 1e §7.8

Pickling. Python's built-in object-serialization format (pickle), used by multiprocessing and ProcessPoolExecutor to move data across the process boundary: every positional/keyword argument passed to the worker function, and every value it returns, is pickled in the sending process, written to a pipe (or a multiprocessing.Queue built on one), read on the other end, and unpickled there. — Chapter 1c §8.1

Pinning. A virtual thread is pinned when it blocks while the JVM cannot safely capture and suspend its call stack — chiefly, on Java 21–23, inside a synchronized block or method, because the monitor a synchronized block acquires is tied to the carrier thread, not to the virtual thread logically holding it. — Chapter 2 §7.1

pipeline(). A transformers.pipeline(task, model=...) call chains tokenization, a model forward pass, and task-specific post-processing into one object with a single __call__. It picks sensible defaults for all three steps so a five-line script works, at the cost of hiding exactly which defaults it picked. — Chapter 1e §7.2

plan. A plan is a data structure, not prose: an ordered list of steps, each naming a tool, its arguments (possibly references to earlier steps' results) and an optional guard, the condition on the observation that the plan assumed. — Chapter 13 §3.1

Planning. Choosing a sequence of actions by considering at least some of their consequences before committing to them. — Chapter 13 §1.1

Poisson process. A stream of events where occurrences in disjoint time intervals are independent and the chance of an event in a short interval is proportional to its length. Tickets arriving from thousands of independent customers are well approximated this way; a batch job that dumps 500 tickets at 09:00 is not. — Appendix D

Pooling. A transformer's own forward pass produces one vector per input token — a (batch, seq_len, hidden) tensor, exactly the shape section 7.2 of the source chapter's raw pipeline() output exposed. Pooling collapses the token axis into a single fixed-size vector per input, by some explicit rule (mean, [CLS], max) a caller must choose or inherit from a model's own convention. — Chapter 1e §8.1

Port and adapter. A port is an interface your application owns and defines in its own vocabulary. An adapter implements the port on top of a specific library. Application code calls the port and never imports the library. — Chapter 15 §1.3; also Chapter 15b §10

Position bias. In pairwise judging, the tendency of a judge to prefer the response shown first (or, for some models, second), independent of quality. — Chapter 19 §4.3

Power. \(1-\beta\), the probability that the test detects a real effect of a given size. The usual target is \(0.80\). — Appendix D

Preference pair. A prompt \(x\) with two responses, a preferred one \(y_w\) ("winner") and a rejected one \(y_l\) ("loser"). DPO (direct preference optimization, Rafailov et al., 2023) — a loss that trains the policy directly on preference pairs, with no reward model and no sampling loop, by showing that the RLHF optimum can be written in terms of the policy itself. — Chapter 9 §9.1

Prefill. Processing the entire prompt in one parallel forward pass, filling the KV cache and producing the distribution for the first output token. Decode — generating the remaining tokens one at a time, each requiring a forward pass over just the single new token. — Chapter 4 §7.1; also Chapter 22 §3.1

Prefix caching. A provider-side optimization that bills a repeated, byte-identical prompt prefix at a discount (and serves it faster). It changes the price per token sent, not the number of tokens sent: the loop still serializes and transmits the whole history on every step. — Chapter 10 §7.1

Pretraining. The first and by far the most expensive training stage: the model reads a huge, broad corpus and is trained, at every position, to put high probability on the token that actually came next. — Chapter 4 §6.1

Preview feature. A feature that is fully specified and implemented but may still change (or disappear) before it is final. It is disabled by default and must be switched on with --enable-preview. — Chapter 2b §1.2

probability distribution. A probability distribution over a finite set of outcomes assigns each outcome a number \(p_i\ge0\) so that \(\sum_ip_i=1\). A random variable is a quantity whose value is drawn according to a distribution. — Chapter 3 §3.1

Procedural memory. Knowledge of how to do something: the steps for an RMA above €500, the house style of a refusal. It lives either in versioned playbook files that the prompt assembler includes verbatim, or in fine-tuned weights. — Chapter 12 §1.1

Producer stall time. The cumulative time a stage's producing task spends blocked inside queue.put() because the downstream queue is full — the concrete, measurable symptom operators should alert on when a pipeline is backpressure-bound rather than simply slow end to end. — Chapter 1c §11.3

Product Quantization (PQ). Split each \(d\)-dimensional vector into \(m\) contiguous sub-vectors. Run k-means independently on each of the \(m\) sub-vector spaces (typically with \(2^{8}=256\) centroids per sub-space — "8-bit codes"), so every sub-vector is replaced by a single byte: the index of its nearest centroid. — Chapter 7 §4.4

Progressive disclosure. Loading information in tiers: a cheap index always, a full body only when relevant. It converts a fixed cost proportional to everything you know into a cost proportional to what the task needs. — Chapter 17 §5.2

Prompt caching. Prompt caching. A provider feature that stores the model's internal state (the KV cache, Chapter 4) for a repeated prompt prefix and reuses it on later requests that begin with exactly the same tokens. — Chapter 22 §4.1

Prompt injection. An attack in which attacker-controlled text, placed in the model's context, changes the model's behaviour against the operator's intent. It is direct when the attacker is the user typing the message, and indirect when the text arrives through content the model reads on someone else's behalf. — Chapter 21 §2.1; also Chapter 25 §8.1

Prompt template. A string with placeholders that is rendered with a variable map before it becomes a message. PromptTemplate delegates to a TemplateRenderer; the default is StTemplateRenderer, built on the StringTemplate engine. — Chapter 16a §1.2

Prompt/tool artifact. Prompt/tool artifact. A prompt template, tool schema or model identifier treated as a versioned, reviewed, tested release artifact with the same lifecycle as code, rather than as a runtime setting. — Chapter 23 §4.3

Prompt/tool versioning. Prompt/tool versioning. Treating the system prompt and the tool-schema JSON as immutable, content-addressed artifacts: a version is a directory in the repository whose contents are hashed; a deployed pod is pinned to exactly one version; changing behaviour means shipping a new version through the pipeline, never mutating the old one. — Chapter 23 §8.1

Property graph. A database model of nodes (things, each with a label such as Part and key-value properties) and directed, typed relationships between them (which can carry properties too). Knowledge graph. A property graph (or RDF graph) whose nodes and edges encode facts about a domain, built to be queried or reasoned over rather than merely stored. — Chapter 8 §9.2

Property-based testing. Instead of picking specific example inputs, a test states a property that must hold for all inputs matching a description (a "strategy"); the framework generates hundreds of inputs — including deliberately adversarial ones — looking for a counterexample. — Chapter 1f §5.1; also Chapter 2f §8.1

Protocol. Python's structural interface (typing.Protocol): any class with the right methods satisfies it, without inheriting from it. It plays the role a Java interface plays, minus the implements keyword. — Chapter 15b §1.3

Protocol Buffers (protobuf). A binary serialisation format driven by a schema file (.proto): fields are identified by numbers, not names, so messages are small and evolve without breaking old readers. gRPC — an RPC framework that sends protobuf messages over HTTP/2 and generates client and server stubs from the same .proto. — Chapter 2e §9; also Chapter 24 §3.2

Provider state. A named precondition the consumer's example assumes (order ORD-2026-0417 exists). The provider test maps each name to set-up code (insert a row, stub a clock) before replaying the request. — Chapter 24 §10.1

Pseudonymization. Replacing an identifier with a stable token such that the same person always maps to the same token, while the mapping back to the real value is kept elsewhere under separate control. — Chapter 21 §9.4

PubGrub. A dependency-resolution algorithm (also used by Dart's pub and Rust's Cargo) that resolves not by trial-and-error search but by deriving incompatibilities — logical statements of the form "these package-version choices cannot all hold simultaneously" — and combining them the way a SAT solver combines clauses, so that when no solution exists, the algorithm can construct a human-readable explanation from the specific incompatibilities that made the set unsatisfiable, rather than reporting the last search branch it happened to be on. — Chapter 1a §2.1

p-value. The probability, assuming \(H_0\) is true, of seeing data at least as extreme as what was observed: \(P(\text{data this extreme or more}\mid H_0)\). A small p-value means the data would be surprising under "no effect". — Appendix D

pydantic-core. Pydantic v2 rewrote its validation engine in Rust (pydantic-core), compiled once and called from Python through a thin binding, rather than walking the class's type annotations in pure Python on every validation call as v1 did. — Chapter 1 §4.2

Q

Qdrant. A purpose-built vector database: gRPC and REST APIs, structured payload filtering (metadata predicates combined with vector search in a single query — Postgres can do this too via a WHERE clause, but Qdrant's filtering is a first-class part of its query planner), native scalar and product quantization built in (no separate PQ library to wire up), and a horizontal sharding story for corpora that outgrow one machine. — Chapter 7 §5.2

Quantization. Storing each weight in fewer bits than the 16 (bf16/fp16) it was trained and released in, trading a small, measurable loss of accuracy for a proportional cut in memory and memory traffic. — Chapter 9 §3.1

Queueing system. Items (tickets) arrive, wait in a line if every worker is busy, are served by one of \(c\) workers, and depart. — Appendix D

R

Random variable. A number whose value depends on a chance outcome: the number of tool calls Relay makes on a ticket, the latency of a request, whether a step succeeds (coded 1 or 0). — Appendix D

ReAct. The loop Thought → Action → Observation, repeated until the model emits a final answer. A Thought is a short natural-language reasoning step; an Action is a tool name plus arguments; an Observation is the tool's result appended to the history. — Chapter 13 §2.1

Reactive execution. Marimo statically analyzes which variables each cell reads and writes, and builds a dependency graph from that — a cell is a node, a variable reference is an edge. — Chapter 1e §5.2

Reactor. Maven's multi-module build engine: the component that discovers the modules of a project, orders them by dependency, and executes the lifecycle on each. "The reactor build order" is the sequence printed at the start of a multi-module build. — Chapter 2a §5.1

Readiness-based I/O. An API where the operating system tells the calling program which of a set of registered file descriptors are ready for a read or write right now, without the program blocking on any single one of them individually. — Chapter 1c §1.1

real. Canary deployment. The candidate serves a small real fraction of traffic. Its failures reach real customers, which is the price of getting the signal that matters: did the customers' tickets get resolved? — Chapter 23 §9.1

Reasoning model (also "thinking" model). A language model trained to generate a long chain of intermediate reasoning tokens before its final answer, so that it spends more computation on harder problems. Test-time compute (also inference-time compute) — the computation spent per query rather than per training run. — Chapter 4 §9.1

Reciprocal Rank Fusion (RRF). A rank-fusion rule from Cormack, Clarke and Büttcher (2009): a document's fused score is the sum, over retrievers, of the reciprocal of a constant plus its rank in that retriever's list. — Chapter 8 §3.2

Record. A Java class, declared with record, whose state is exactly its declared components: the compiler generates a canonical constructor, equals/hashCode/toString derived from every component, and a read-only accessor per component (name(), not getName()) — all of it immutable and all of it without writing a line of boilerplate. — Chapter 2 §3.1; also Chapter 2b §3.1

RED. Rate, Errors, Duration — the three metrics that describe any request-driven service: how many requests per second, what share fail, how long they take. The LLM adaptation keeps all three and adds token usage and the TTFT/TPOT split. — Chapter 20 §7.4

Red teaming. Deliberately attacking a system to find the inputs that make it misbehave, then turning the attacks that worked into a regression suite so they never work again unnoticed. — Chapter 19 §10.1; also Chapter 21 §12.1

Reducer. In LangGraph, a function attached to a state key that decides how a node's returned value is combined with the value already in the state: operator.add appends lists, a custom function can take a maximum or merge dictionaries. — Chapter 14 §13.2; also Chapter 15 §3.2, Chapter 15a §1.2

Regression suite. A fixed set of cases whose purpose is to detect that something that used to work no longer does. For an LLM application the "something" is a rate, so the suite's output is a pass rate per stratum and a paired comparison with the last accepted run. — Chapter 19 §7.1

Reifiable type. A type whose full description is available at run time: primitives, non-generic classes, raw types, and parameterised types whose arguments are all unbounded wildcards (List<?>). List<String> is non-reifiable. — Chapter 2b §2.4

--release N. A javac option that sets three things at once: the language level (-source N), the class-file version (-target N), and the API surface — the compiler sees only the classes and methods that existed in Java N. — Chapter 2a §9.2

Relevance judgment (oracle). A human or a trusted process saying which documents should be retrieved for a question. — Chapter 8 §1

Relevance label (ground truth). A human (or a reviewed heuristic) judgment that a chunk contains what is needed to answer a query. Binary labels say relevant or not; graded labels give a scale (e.g. 0–3). — Chapter 7 §7

Replay. Re-running a thread from an earlier checkpoint without changing it: invoke(None, snapshot.config). Nodes before that checkpoint are not run again (their effect is already in the saved state); nodes after it execute again. — Chapter 15a §6.4; also Chapter 18 §8.1

Repo map. A compact, ranked table of contents of a repository: file paths followed by the signatures of the classes and functions they define, with no bodies. It is the model's index card for "where to look". — Chapter 17 §2.2

Reproducibility (packaging sense). Given the same declared inputs (a pyproject.toml and a lockfile), a packaging tool installs the identical set of package versions, built from the identical wheels, on any machine that satisfies the declared platform constraints — not "a compatible version", the same bytes. — Chapter 1a §1.1

Residual connection. A sublayer's output is added to its input instead of replacing it: \(y = x + \text{Sublayer}(x)\). The running sum is called the residual stream: each sublayer reads from it and writes a correction back. — Chapter 4 §4.1

Resilience4j. A small, dependency-light Java library of fault-tolerance building blocks, each a decorator for a function: Retry, CircuitBreaker, TimeLimiter, Bulkhead (limit concurrent calls) and RateLimiter (limit calls per period). — Chapter 2e §12.1

Resource indicator (RFC 8707). A resource parameter in the authorization and token requests naming the exact server the token is for. The authorization server binds the token's audience to it, so a token minted for Relay's order server is worthless against the carrier's server. — Chapter 11 §10.1

Retrieval score. One number per candidate memory that combines recency, importance and relevance, used to rank candidates and to fill the injected-memory budget. — Chapter 12 §9

Retrieval-augmented generation (RAG). A pipeline that answers a question in two stages: first retrieve the few passages of your own corpus most likely to contain the answer, then generate with an LLM that is shown those passages and instructed to answer from them. — Chapter 7 §6

Retry policy. A per-node rule that re-runs a node when it raises a retryable exception, waiting longer between attempts. Failed attempts leave no trace in the state. — Chapter 15a §9.1

RLHF (reinforcement learning from human feedback). A two-step recipe. First train a reward model that scores a (prompt, response) pair so that responses people prefer score higher; then use reinforcement learning to push the language model (the policy) toward outputs the reward model scores highly, while a penalty keeps it close to the SFT model. — Chapter 4 §6.3

RMA (Return Merchandise Authorization). A record that authorizes a customer to return a product for refund, replacement, or credit — creating one is a side-effecting action: it changes data in the order service, not just reads it. — Chapter §4.4; also Chapter 25 §1.1

RoPE (rotary positional embedding). A position scheme (Su et al., 2021) that adds nothing to the embeddings. Inside every attention layer, it rotates each pair of dimensions of the query and key vectors by an angle proportional to the token's position, so that a query–key dot product depends only on the distance between the two tokens. — Chapter 4 §2.4

Row-level security (RLS). A Postgres feature: a policy attached to a table adds a predicate to every SELECT/INSERT/UPDATE/DELETE issued by the roles it applies to, evaluated inside the engine. Superusers and the table owner bypass it by default, so the application must connect as an unprivileged role. — Chapter 8 §8.3

Runbook. The written procedure attached to an alert: what it means, what to look at first, how to mitigate. The best runbook is a link that opens the right view already filtered, because nobody reads prose at 3 a.m. — Chapter 20 §10.3

Runnable. LangChain's universal interface. Anything that implements invoke(input), batch(inputs) and stream(input) (plus async twins) is a Runnable: a prompt template, a model, an output parser, a plain function wrapped in RunnableLambda. — Chapter 15 §2.2

S

sample mean. The sample mean \(\bar x=\frac1n\sum_{i=1}^nx_i\) estimates the population mean \(\mu\). The sample variance \(s^2=\frac1{n-1}\sum_{i=1}^n(x_i-\bar x)^2\) estimates the population variance \(\sigma^2\), and the standard deviation \(s=\sqrt{s^2}\) has the units of \(x\). — Chapter 3 §9.1

Sampling profiler. A profiler that periodically interrupts an already-running process from the outside (reading its stack via /proc on Linux, no cooperation from the target process required) and records where execution currently is. — Chapter 1c §12.2

Sandbox. An execution environment that enforces, from outside the code running in it, hard limits on what that code may touch: CPU, memory, processes, filesystem, network, system calls. The enforcement must not depend on the code's cooperation. — Chapter 21 §5.1

SARIF. Static Analysis Results Interchange Format — a JSON schema (bandit --format sarif emits it directly) that lets a security dashboard, a GitHub code-scanning tab, or a policy gate ingest one common shape regardless of which underlying tool produced it. — Chapter 1f §12.2

SBOM (Software Bill of Materials). A structured, machine-readable inventory of every component (and, ideally, its exact version and origin) that makes up a shipped artifact — the compliance-facing sibling of a lockfile, meant to be consumed by a security team's tooling rather than by a package manager. — Chapter 1a §8.5; also Chapter 2a §13.5

Scoped value. An immutable value bound for the dynamic extent of a piece of code — a run or call — and readable by everything that code calls, without being passed as a parameter. — Chapter 2b §13.2

ScopedValue. A JEP 446/506 API (preview on Java 21, finalized in Java 25) that binds an immutable value for the dynamic extent of one call — every method invoked, directly or indirectly, from inside ScopedValue.where(VALUE, x).call(...) sees VALUE.get() return x, including on a different thread the call forks — and the binding is automatically removed the moment that call returns. — Chapter 2 §6.2

Screenshot-based perception. The harness renders the page or desktop to a raster image and sends it to a vision-capable model, which answers with an action expressed in pixel coordinates (click(412, 237)). — Chapter 17 §8.1

Sealed interface. An interface declared with sealed ... permits A, B, C that restricts which types may implement it to an explicit, closed list, known completely at compile time. — Chapter 2 §3.2; also Chapter 10 §9.1

Sealed type. A class or interface declared sealed with an explicit (or inferred) list of permitted direct subtypes. Only those may extend or implement it. The compiler and the JVM both enforce this, and pattern matching uses the list to check exhaustiveness. — Chapter 2b §4.2

secrets_dir. A directory pydantic-settings scans for one file per secret, filename as the field name, file contents as the value — the shape Docker Swarm secrets and Kubernetes Secret volumes mount by default, so a Settings class written against secrets_dir reads production secrets with zero code difference from reading a .env file in development. — Chapter 1d §7.2

Self-consistency. sample \(k\) times, aggregate by vote. The majority vote returns the answer chosen by more than \(k/2\) samples; the plurality vote returns the most frequent answer even when it has fewer than half the votes (the usual implementation, and the one used below). — Chapter 13 §7.1

Semantic cache. Semantic cache. A cache keyed by the embedding of the query. A new query is embedded, the nearest stored query is found, and if their cosine similarity is at least a threshold \(\theta\) the stored answer is returned without calling the LLM. — Chapter 22 §5.1

Semantic conventions. The part of OTel that standardises attribute names. If every library calls the input token count gen_ai.usage.input_tokens, then a dashboard, an alert or a cost job written once works for every provider and every language. — Chapter 20 §2.1

Semantic memory. General facts that are true independently of any event: return-policy clauses, product documentation, a bearing's dimensions. It lives in the same kind of vector index Chapter 7 builds. — Chapter 12 §1.1

Send(node, payload). An instruction, returned from a router or a Command, that creates one task of node whose input is payload, not the graph state. N Sends to the same node make N tasks in one superstep. — Chapter 15a §3.3

Server-Sent Events (SSE). A plain-text/event-stream framing on top of ordinary streaming HTTP: each event is data: <payload>\n\n — the blank line terminates the event — with optional event:/id: lines for typed, resumable streams. — Chapter 1d §5.2; also Chapter 2e §8.1, Chapter 18 §1.1

Session. The persisted transcript of a conversation, stored by the CLI as a JSON-lines file under the config directory (~/.claude/projects/<cwd-slug>/<session-id>.jsonl, or wherever CLAUDE_CONFIG_DIR points). A session is the unit you resume, fork and list. — Chapter 15b §6.4; also Chapter 15b §8.5

Significance level (\(\alpha\)). A threshold fixed before looking at the data; if the p-value is below it, reject \(H_0\). The conventional value is \(\alpha=0.05\). — Appendix D

Single source of truth. For each boundary, exactly one schema artifact is authoritative. Every other description of the same data (types in each language, validators, documentation, client stubs) is generated from it or checked against it. — Chapter 24 §8.1

SLI, SLO. A service level indicator is a measured ratio that describes user experience: "the share of turns that finish within 30 seconds". A service level objective is the target for that ratio over a window: "95 % of turns within 30 s over 30 days". — Chapter 20 §7.2

SLO (service level objective). A numeric target for a measured behaviour over a window, such as "99.5% availability over 30 days". The error budget is the amount of failure the SLO allows: \(B = (1 - A) \times T\). — Chapter 25 §1.2

Slot-step. One sequence advancing one decode step. A batch of \(B\) slots running \(S\) steps offers \(B\times S\) slot-steps; the ones that produce a token a client asked for are useful, the rest are wasted on a finished sequence waiting for its group. — Chapter 9 §6.1

Small-to-big (parent-document) retrieval. Retrieval that scores small child chunks but returns the larger parent text each matched child belongs to. LangChain calls the pattern ParentDocumentRetriever; LlamaIndex has the same idea as sentence-window and auto-merging retrieval. — Chapter 8 §7.2

Snapshot test. A test that compares actual output against a stored reference and fails with a diff if they differ; a human reviews the diff and either fixes the bug or intentionally accepts the change as a new baseline. — Chapter 1f §4.1

spaCy pipeline. An nlp object is a configurable sequence of components (nlp.pipe_names), each reading and annotating a shared Doc object in order — a tokenizer first, then a tagger, a dependency parser, and a named-entity recognizer as separate, individually-disableable stages, not one monolithic "NLP model." — Chapter 1e §10.1

Span. One timed operation in a trace, with a name, attributes and a parent. A trace is the tree of spans for one request. OpenTelemetry (OTel) is the vendor-neutral standard for emitting them; Logfire is Pydantic's OTel-based observability platform. — Chapter 15b §5.3

Spring AI VectorStore. Spring's portable interface over vector databases (add(List<Document>), similaritySearch(SearchRequest), delete(...)), with PgVectorStore as the pgvector implementation and EmbeddingModel as the embedding abstraction. In a Spring Boot application the beans are auto-configured; the example builds them by hand to show what the starter does. — Chapter 7 §9.3

SQLAlchemy 2.0-style select(). One query-building construct that works identically whether you want plain rows (Core) or mapped Python objects (ORM) — select(OrderRow) returns mapped instances, select(OrderRow.id, OrderRow.status) returns plain tuples, same select() function, same .where()/.join()/.order_by() chain. — Chapter 1d §8.1

SSE (Server-Sent Events). A one-way text streaming format over HTTP. The unit is the event, not the TCP segment: a network read may return half an event, three events, or an event cut inside a multi-byte UTF-8 character. — Chapter 2f §5.3

State graph. A directed graph whose nodes are functions and whose edges say which node runs next, plus one shared state object every node reads and partially updates. The model call, the tool call and the human approval are all just nodes. — Chapter 15 §3.1

State machine (agent loop). The agent loop modeled as a small, fixed set of named states with explicit, guarded transitions between them — as opposed to an unstructured while True loop whose only implicit "state" is still running or stopped. — Chapter 10 §3.1

Static batching. Static batching. The server collects \(B\) requests, runs them together until the slowest has finished, then starts the next batch. Short requests wait for long ones, and a request arriving just after a batch started waits for the whole batch. — Chapter 22 §7.1

Step reliability. The probability \(p\) that one step of a workflow (a tool call, a retrieval, a model call with a parseable answer) produces a correct result. The model here is a Bernoulli trial (D.3.2): success with probability \(p\), failure with \(1-p\). — Appendix D

StopAsyncIteration. A plain generator signals "no more values" by raising StopIteration internally (handled for you by for); an async generator's equivalent is StopAsyncIteration, raised when the function body returns (the bare return above) or falls off the end. — Chapter 1 §8.2

Store (BaseStore). A key-value database of JSON documents addressed by a namespace (a tuple of strings) and a key, optionally indexed for semantic search. It is attached with compile(store=…) and is visible to every thread of the graph. — Chapter 15a §7.1

Stratified sampling. Splitting the population into groups (strata) by a property that matters, then sampling each group separately so that every group is represented as much as you decided it should be, rather than as much as chance allows. — Chapter 19 §3.2

Stream. A description of a computation over a sequence of elements: a source, zero or more intermediate operations (map, filter, sorted…) and exactly one terminal operation (toList, count, collect…). — Chapter 2b §7.1

Streaming (ASGI sense). A response sent as one http.response.start followed by repeated http.response.body messages, more_body: True on every one but the last. yielding chunks as they become available and sending each as its own message is streaming. — Chapter 1d §5.1

Stride, overlap, chunk size. Chunk size \(C\) is how many tokens go into one chunk. Overlap \(O\) is how many trailing tokens of one chunk are repeated as the leading tokens of the next, so a sentence that straddles a chunk boundary still appears whole in at least one chunk. — Chapter 7 §3.2

Strides. The number of bytes to skip in the underlying buffer to move one step along each axis. A (40000, 384) array of float32 (4 bytes each), stored row-major (C order), has strides (384 × 4, 4) = (1536, 4): stepping one row forward skips 1,536 bytes; stepping one column forward skips 4 bytes. — Chapter 1e §2.1

Structural vs. nominal typing. Nominal typing checks a declared relationship (a class explicitly inherits from a base). Structural typing checks the actual interface (does the object have a method with this name and this signature) regardless of what, if anything, it inherits from. — Chapter 1 §3.3

Structured concurrency. A discipline (not a specific API) guaranteeing two things about any block of code that spawns concurrent work: the block cannot exit — normally, via exception, or via cancellation — while any child task it spawned is still running, and any exception raised by a child is guaranteed to be observed by the parent before the block exits. — Chapter 1c §2.1; also Chapter 2 §6.1

Structured output. A model answer constrained to a schema (here a Pydantic model) and parsed into a typed object, as opposed to free text. Chapter 5 covers the wire-level mechanisms (JSON mode, tool calls); section 3.1 of the source chapter shows how PydanticAI selects among them. — Chapter 15b §2.1; also Chapter 16a §4.1

Subagent. A second agent the main agent starts through the built-in Task tool (shown to the model as Agent). It has its own context window, its own prompt, its own tool list and optionally its own model; only its final message returns to the parent. — Chapter 15b §7.4

Subinterpreter (concurrent.interpreters, PEP 734). A separate PyInterpreterState running inside the same OS process, with its own module namespace and — critically, under the non-free-threaded build — its own GIL, so two subinterpreters in one process can execute Python bytecode in true parallel without either multiprocessing's fork/pickle overhead or free-threading's ABI break. — Chapter 1a §7.4

Superstep. One round of the engine. All nodes that are ready in this round run (in parallel when there are several), each reading the channel values as they were at the start of the round. — Chapter 15a §1.1

Super-step. One round of LangGraph execution: every node whose inputs are ready runs, their updates are merged by the state's reducers, and a checkpoint is written. In a linear graph, one node equals one super-step. — Chapter 25 §5.1

Super-type token. A pattern (Neal Gafter's) that captures a generic type at run time by creating an anonymous subclass of a generic class: new TypeReference<List<ToolCall>>() {}. The {} is mandatory — it creates the subclass; without it there is nothing to reflect on. — Chapter 2b §2.5

Supervised fine-tuning (SFT). Also instruction tuning — continuing training of the base model on a much smaller, curated set of (prompt, ideal response) pairs, with the same next-token loss but computed only on the response tokens. — Chapter 4 §6.2

Distillation. Training a small student model to imitate a large teacher on a target task. For LLM applications this is almost always supervised fine-tuning on the teacher's outputs: you collect (input, output) pairs from M-large's real traffic, filter them for quality, and fine-tune an open-weight small model on them (LoRA or QLoRA, Chapter 9). — Chapter 22 §9.1

Supervisor (router). One agent whose only jobs are to classify incoming work, dispatch it to the right specialist and, for work shorter than the section 1.4 of the source chapter break-even, finish it itself. Specialists never talk to each other; everything flows through the supervisor. — Chapter 14 §2.1

T

Table layer. Code that operates on row-and-column data with named, differently-typed columns — the shape of a CSV, a SQL query result, or an eval log. pandas, Polars, and DuckDB are three different engines for the same table layer. — Chapter 1e §1.1

Tail sampling. Choosing which traces to keep after they finish, so the decision can depend on what happened: keep every trace that contains an error or ran longer than 20 s, and a random share of the rest. — Chapter 25 §10.3

Tail-based sampling. The decision is made when the trace ends, by a component that has buffered all its spans. It can use the outcome — error, duration, a tenant — but it needs memory and a single place where every span of a trace arrives. — Chapter 20 §12.2

Task. One execution of one node inside a superstep, with its own input. A superstep with three parallel nodes has three tasks; a node fanned out with Send five times is five tasks of the same node. — Chapter 15a §1.1

Task decomposition. Splitting a goal into subgoals whose results compose into the answer. A decomposition is sequential when a subgoal needs the previous one's output, parallel when subgoals are independent, and hierarchical when a subgoal is itself decomposed. — Chapter 13 §9.1

TCK (Technology Compatibility Kit). The conformance test suite a build must pass to be called "Java SE compatible". All distributions in the table are TCK-certified, so for application code they are interchangeable; they differ in packaging, support contract, patch timing, extra tooling, and in one case the virtual machine itself. — Chapter 2a §9.1

Temperature. \(T>0\) is a scalar that divides the logits before softmax. \(T<1\) sharpens the distribution toward the top token, \(T>1\) flattens it, \(T=1\) leaves it unchanged. — Chapter 3 §4.2

Template method. A pattern where a base class defines the skeleton of an operation as a concrete method (execute, here handling timing uniformly for every handler) and defers one or more steps of that skeleton to an abstract method subclasses must fill in (_run). — Chapter 1b §3.2

Terminal condition. Any condition under which the loop must stop transitioning and report a result, rather than looping again. Relay's loop has exactly three: DONE (the model produced a final answer), ESCALATED (a budget was exhausted, or a human handoff was requested), and FAILED (a tool error survived retries). — Chapter 10 §3.3

Test double. Any object that stands in for a real collaborator during a test. The vocabulary (dummy, stub, spy, mock, fake) is made precise in section 4.1. of the source chapter — Chapter 2f §1.1; also Chapter 15b §5.1

Testcontainers. A library that starts throwaway Docker containers from inside a test, waits until they are ready, passes the test their address and removes them afterwards, so the test runs against the real service rather than an imitation. — Chapter 2f §6.1

TestModel. A model that never touches the network. It inspects the tools and the output type you registered and generates schema-valid calls: it calls the tools you ask it to (call_tools="all") with arguments synthesised from their JSON schema (the string 'a' for a str, 0 for an int), then returns an output that validates. — Chapter 15 §7.3

Text block. A multi-line string literal delimited by """. The opening delimiter must be followed by a line terminator; the content starts on the next line. The compiler removes the incidental indentation, strips trailing whitespace on each line, normalises line endings to \n, and then interprets escape sequences. — Chapter 2b §6.1

The Global Interpreter Lock (GIL). A single mutex, held by whichever OS thread is currently executing Python bytecode, that CPython's standard build uses to protect its object model — reference counts and internal interpreter data structures — from concurrent corruption. — Chapter 1c §7.1

Thinking tokens (also called reasoning tokens). The tokens a reasoning model generates between receiving the prompt and writing the visible answer. They are produced by the same decoder as any other output, so they are billed at the output rate and consume decode time at the same speed. — Chapter 13 §8.1

Thread. One conversation (or one ticket), identified by a key, whose working memory is saved after each step and reloaded before the next. LangGraph calls the key thread_id; Spring AI calls it conversationId; LangChain4j calls it the memory id. — Chapter 12 §3.1

Timeout policy. TimeoutPolicy(run_timeout, idle_timeout, refresh_on): run_timeout bounds one attempt of a node, idle_timeout bounds the gap between signs of life, and with refresh_on="auto" any callback event (a streamed token, a nested call) resets the idle clock; "heartbeat" resets it only on an explicit heartbeat. — Chapter 15a §9.2

Token. The unit of the streaming API: a structural marker (START_OBJECT, END_ARRAY), a FIELD_NAME, or a scalar value. The parser produces one per nextToken() call and forgets the previous one. — Chapter 2e §4.2; also Chapter 4 §1, Chapter 22 §1.1

Token bucket. A rate limiter holding up to \(B\) "tokens" (disambiguated below), refilling continuously at rate \(r\) tokens/second, capped at \(B\). A request consuming \(c\) tokens proceeds immediately if \(\geq c\) tokens are available (debited on acceptance); otherwise it waits until enough have refilled. — Chapter 1c §10.2; also Chapter 18 §13.2

Token exchange / on-behalf-of. A grant type (urn:ietf:params:oauth:grant-type:token-exchange) in which a client trades one token (the subject_token, representing the user) plus its own credential (the actor_token, representing the agent) for a new token whose scope and audience are chosen by the authorization server. — Chapter 21 §7.2

Tool calling (also function calling). The model answers a request with a structured request to run a function (name and JSON arguments) instead of text; the application runs it and sends the result back as a tool message; the model then continues. — Chapter 16a §3.1

Tool latency. Tool latency. The time an agent step spends outside the model: the network round trip to the tool plus its execution (a database read, a vector search, a third-party API). — Chapter 22 §3.1

Tool poisoning. An attack in which the natural-language description or schema of a tool — text the model reads as documentation — carries instructions that make the model misuse that tool or another one. — Chapter 21 §8.2

Tool schema. The machine-readable description of a tool that the host sends to the model with every request: a name, a natural-language description, and an inputSchema written in JSON Schema that says which arguments exist, what types they have and which are required. — Chapter 11 §2.1

Tool surface. The set of tool schemas present in one agent's prompt at one decision. Its size \(k\) is the count of those schemas. Hiding a tool from an agent shrinks its tool surface even if the tool still exists elsewhere in the system. — Chapter 14 §1.1

ToolContext. A map of out-of-band values that you hand to tools but that the model never sees: the tenant, the authenticated principal, a correlation id. It is not part of the prompt and not in the JSON schema. — Chapter 16a §3.3

Tool-selection accuracy. The fraction of model turns on which the model calls the objectively correct tool for the stated intent (or correctly calls none). It is the per-step success probability \(p\) of Chapter 10 restricted to the choice of tool, and it is what section 3 of the source chapter shows decaying with the size of the inventory. — Chapter 11 §2.3

torch.no_grad() / torch.inference_mode(). Both disable gradient tracking for a block of code — no grad_fn nodes are recorded, no .grad accumulates. inference_mode() (the newer, stricter API) additionally disables the version-counter bookkeeping autograd normally uses to detect unsafe in-place mutations of tensors it is tracking — bookkeeping that has a real, measurable cost even when no gradient is ever requested. — Chapter 1e §6.3

torch.Tensor. PyTorch's array type — the same buffer-plus-shape-plus-dtype idea as a NumPy ndarray, with two additions: a device attribute (cpu, cuda:0, …) saying where the buffer physically lives, and, when requires_grad=True, participation in autograd's computation graph. — Chapter 1e §6.1

TPOT (time per output token). The mean time between consecutive output tokens after the first, in seconds. It is dominated by decode, one token at a time, and is roughly independent of prompt length: 25 ms on the baseline. — Chapter 20 §7.1

Trace and span. A span is one named, timed operation with attributes ("chat mock-relay-v1, 3.4 s, 800 input tokens"). A trace is the tree of all spans that belong to one request, linked by parent ids and sharing one trace id. — Chapter 20 §1.1

Trace, span. A span is one timed operation with a name, attributes and a parent; a trace is the tree of spans that share a trace id. OpenTelemetry (OTel) is the vendor-neutral standard for producing them (APIs, SDKs, the OTLP wire protocol and a collector). — Chapter 25 §10.1

Trajectory. The full sequence of states, actions, and observations an agent loop passes through from its first PLAN to a terminal state — the unit section 2 of the source chapter's arithmetic, section 7 of the source chapter's cost formula, and section 10 of the source chapter's trace file all operate on. — Chapter 10 §2.1; also Chapter 19 §5.1

Transport. The mechanism that carries MCP's JSON-RPC messages between client and server. MCP separates what is said (the data layer: lifecycle, primitives) from how it is carried (the transport), so every primitive works identically over either transport. — Chapter 11 §8

tree of thoughts (ToT). In a tree of thoughts (ToT) a state \(s = (x, z_1, \dots, z_k)\) is the problem plus the first \(k\) thoughts (coherent intermediate steps). A thought generator \(G(s)\) proposes \(b\) candidate next thoughts; a state evaluator \(V(s) \in [0,1]\) scores how promising a state is; a search algorithm decides which states to expand. — Chapter 13 §5.2

Trust boundary. A line in a system's data flow across which the level of trust changes — typically where input from a less-trusted party enters the code of a more-trusted one. — Chapter 21 §1.1

Trusted publishing. A PyPI mechanism where a CI system (GitHub Actions, GitLab CI) proves its identity to PyPI via a short-lived OIDC token issued by the CI provider itself, which PyPI exchanges for a temporary, single-publish API token — no long-lived secret is ever generated, stored, or capable of being leaked, because none exists. — Chapter 1a §8.3

TTFT (time to first token). Seconds from the moment the request is sent to the arrival of the first output token (for a streamed response, the first SSE chunk). It is dominated by prefill, the parallel pass over the whole prompt, so it grows with input length: \(\text{TTFT} \approx 0.5\ \text{ms} \times n_{\text{in}}\) on the book's baseline. — Chapter 20 §7.1

Type erasure. The compilation scheme in which a generic type's parameters are replaced by their leftmost bound (or Object) in the class file, and casts are inserted where needed. At run time a List<String> and a List<Integer> are the same class. — Chapter 2b §2.4

Typed memoryview. Cython's double[:, :]/double[:] argument syntax — a view onto a C-contiguous buffer (here, a numpy array's underlying memory) with element type and dimensionality known at compile time, letting Cython emit direct C array indexing instead of going through Python's object model for every element access. — Chapter 1c §13.2

TypedDict. A type that says "this is a dict[str, ...], and here specifically are the keys it must have and the type each key's value must be" — purely a static-typing construct; at runtime a TypedDict-typed value is an ordinary dict, with no validation, no __init__, and no extra attributes. — Chapter 1 §3.4

TypeGuard vs TypeIs. TypeGuard[X] narrows only the True branch, and only to exactly X — it is a documented, deliberate soundness hole: the function body can return True for an input that is not actually X and the checker trusts it unconditionally ("trust me" semantics), and the else branch gets no narrowing at all, staying the full original union. — Chapter 1b §5.1

TypeVarTuple vs a plain *args: T. *args: T (a single ordinary TypeVar) says "every positional argument has the same type T" — fine for def first_of(*args: T) -> T, useless for a function whose arguments are heterogeneous, like add(a: int, b: int). — Chapter 1b §2.3

typing.Protocol. A structural type — a class that any object satisfies simply by having the right method signatures, with no inheritance relationship required. mypy/pyright check the match statically, at type-check time, with no runtime cost. — Chapter 1f §3.5

U

Unigram tokenizer. Instead of growing a vocabulary by merging, start from a large set of candidate pieces with probabilities and prune the pieces whose removal least reduces corpus likelihood. A string is segmented into the pieces that maximize the product of piece probabilities. — Chapter 4 §1.4

Unit normalization. Rescaling a vector to length 1: \(\hat{v} = v / \lVert v \rVert_2\), where \(\lVert v \rVert_2 = \sqrt{\sum_i v_i^2}\) is the Euclidean (L2) norm. After normalization, \(\lVert \hat v \rVert_2 = 1\) by construction, and — as section 2.2 of the source chapter derives — cosine similarity and Euclidean distance become two ways of asking the same question. — Chapter 7 §1.3

Universal resolution. uv resolves a project's dependencies once, for every platform its requires-python and dependency markers admit, and records the result as one lockfile with per-package, per-platform wheel entries — rather than resolving separately (and needing a separate lockfile) per platform. — Chapter 1a §2.3

Unnamed variable / pattern. A declaration (var _, Type _) or pattern component (_) whose name is _. It introduces no variable, cannot be referenced, and can be repeated freely in one scope. — Chapter 2b §5.5

UTF-8. The encoding that writes each Unicode character as 1–4 bytes: ASCII letters are one byte, accented Latin letters two (é = 195 169), most CJK characters three, emoji four. — Chapter 4 §1.3

uv. A single Rust-built tool that replaces pip, venv, pyenv and poetry for the purposes this book needs: it installs and pins a Python interpreter version, creates and manages a project's virtual environment, and resolves and locks dependencies into a uv.lock file — one tool instead of four, and the one every Python example in this book assumes is on the reader's PATH. — Chapter §8.1; also Chapter 1a §1.2

uv tool. A uv subsystem that installs a command-line tool into its own, private virtual environment under ~/.local/share/uv/tools/<tool-name>, exposing only its entry-point executables on PATH — completely decoupled from any project's own dependency set. — Chapter 1a §6.1

uv workspace. A root pyproject.toml declaring [tool.uv.workspace] with members (and optionally exclude) globs, under which every matched member package is resolved together, into one shared uv.lock at the workspace root, rather than each member locking independently. — Chapter 1a §4.1

V

Validator. The deterministic code on the server side that checks the model's arguments against the schema before any business logic runs. The model is a probabilistic proposer; the validator is the last line of defence. — Chapter 11 §2.2

Variance. For a generic type Box[T] and a subtype relationship Dog <: Animal, variance answers: is Box[Dog] a subtype of Box[Animal]? Covariant — yes, substitution follows the same direction as the element type (Sequence[Dog] is a Sequence[Animal]). — Chapter 1b §2.1; also Chapter 2b §2.1, Appendix D

vector. A vector is an ordered list of \(d\) real numbers, written \(\mathbf{a}\in\mathbb{R}^d\) and read as a point (or an arrow from the origin) in \(d\)-dimensional space. The number \(d\) is its dimension. — Chapter 3 §1.1; also Appendix D

Vectorized execution (query-engine sense — distinct from section 2 of the source chapter's NumPy vectorization, though the same underlying idea). DuckDB's query executor pushes data through its operator pipeline in batches of roughly 2,048 rows at a time (one column-chunk "vector" per batch, not one row at a time), so each operator — filter, aggregate, join — runs its logic as a tight loop over a batch that fits comfortably in CPU cache, rather than one function-call-per-row the way a naive row-at-a-time interpreter would. — Chapter 1e §3.3

Verbosity bias. The tendency of judges (and, less strongly, humans) to prefer a longer response at equal correctness. — Chapter 19 §4.4

Verifier. A deterministic program, independent of the model, that decides whether a candidate result is acceptable. For a coding agent: the test suite, the type checker, the compiler. The agent's own claim "I fixed it" is never the stopping condition; the verifier's exit code is. — Chapter 17 §1.1

Version specifier vs. environment marker. A version specifier (>=0.27, this section) constrains which version of a package is acceptable. An environment marker (python_full_version < '3.15', section 2.3 of the source chapter) constrains on which interpreter/platform a dependency applies at all. — Chapter 1a §2.5

Virtual thread. A JVM-managed thread (final in Java 21, JEP 444) whose stack lives on the heap and which the runtime mounts on a small pool of OS carrier threads only while it is running. — Chapter 10 §9.2; also Chapter 18 §3.1

Virtual threads. A JDK 21 feature (Project Loom) where the runtime, not the operating system, schedules lightweight threads — an I/O-bound loop that blocks waiting on a model API can run thousands of concurrent instances on ordinary hardware, at a fraction of the memory a platform thread would cost. — Chapter §3.2

Vision encoder. A (usually transformer) network that maps an image to a sequence of vectors. Patch — a small square tile of the image, typically 14×14 or 16×16 pixels, that becomes one position in that sequence (Vision Transformer, ViT, Dosovitskiy et al., 2021). — Chapter 4 §11.1

W

W3C Trace Context. The standard HTTP header format for carrying a trace across a service boundary. The traceparent header has four dash-separated hex fields: version-traceid-parentid-flags, for example 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01. — Chapter 20 §3.3; also Chapter 25 §10.2

WebSocket. A bidirectional, message-framed protocol that starts as an HTTP request. — Chapter 18 §4.1

WebSocket handshake. An HTTP request that upgrades to a persistent, bidirectional connection. In FastAPI: await websocket.accept(), then a loop of await websocket.receive_text() / receive_json() and await websocket.send_text(...), with WebSocketDisconnect as the expected, graceful termination signal rather than an error. — Chapter 1d §5.3

Wildcard. The ? in a type argument. ? alone means "any type"; ? extends T means "some unknown subtype of T" (an upper bound); ? super T means "some unknown supertype of T" (a lower bound). — Chapter 2b §2.2

Wilson score interval. A confidence interval for a proportion (a pass rate, a click-through rate, any \(k\)-successes-out-of-\(n\)-trials observation) that stays well-behaved at small \(n\) and near 0% or 100%, where the more familiar normal-approximation interval becomes unreliable or can even extend past 0 or 1. — Chapter 1f §14.3; also Chapter 9 §10.3, Chapter 25 §9.2

WordPiece. The subword tokenization algorithm BERT-family models (including MiniLM) use: greedy longest-match-first splitting against a fixed vocabulary, continuation pieces prefixed with ##. An out-of-vocabulary string is never a single [UNK] token if any prefix of it is a known subword — it is split into the longest known pieces that cover it. — Chapter 1e §7.3

Worker. A process that polls a task queue over gRPC and executes workflow code and activity code on behalf of the engine. A worker holds no durable state: you can kill it, and any other worker on the same queue continues. — Chapter 18 §9.1

Workflow. A system in which LLM calls are orchestrated through a control flow the developer wrote in advance: a fixed sequence, a branch on a classifier's output, a fan-out over a known list. — Chapter 10 §1.1; also Chapter 18 §9.1

Working memory. Everything the model can see on the current call: system prompt, tool schemas, the trajectory so far, anything retrieved this turn. It lives in process RAM and in the prompt string itself. — Chapter 12 §1.1

Y

yield dependency. A dependency written as a generator function: the code before yield runs on entry, the yielded value is injected, and the code after yield runs after the response has been generated — wrapped internally in a try/finally, so it runs even if the route raised an unhandled exception. — Chapter 1d §2.3