# Glossary

Short meanings used on this site. Language details are in the raw language pages.

add
: `rig add`. Pull a published layer and add its flake input to the workspace. Does not edit agent files.

agent
: A name and a compose list of layer modules. Composed into one image.

attach
: `rig attach`. Stdin and stdout on the session agent process. Disconnect does not stop the agent.

compose
: Layer modules in order. Later entries override on conflict. If a layer named `base` exists, you do not list it.

harness
: OpenCode or Claude Code, generated from the same composed agent. `rig build --harness` checks that harness's files exist.

image
: A published agent or layer at a host, name, and tag. Pull and push talk in image refs.

layer
: One reusable slice. The file is `layers/<name>/default.nix`, or a published flake with a `layer` output.

pull
: `rig pull`. Download a published agent or layer into the local dest store. Does not edit the workspace flake.

push
: `rig push`. Publish a local agent or layer to an image repo.

repository
: A cache and a registry of third-party agents. Public default is https://repo.slopkit.dev.

sandbox
: Default deny. Layers grant domains, CIDRs, and write paths. No grant, no access.

secretspec
: Secret keys declared on layers. The image holds the manifest, not the tokens. Injected at process start.

session
: A running agent instance with its own root and sandbox. `rig session create` starts one.

trigger
: A webhook subscription. Provider plus kind, then exactly one of `prompt` or `handler`.

workspace
: A flake that calls `rig.lib.workspace`. `rig new workspace` writes one. Build, catalog lists, and `rig add` need it. Pulled images do not.