Terminology
A short glossary of the terms used throughout these docs.
Orchestrator — the control-plane API. Accepts download and schedule requests, tracks job status, and is the only service most integrations talk to directly.
Minion — a worker process that performs the actual download for one package ecosystem (Docker, Maven, Python, npm, Helm, file, website, or Hugging Face). Minions pick up jobs from the queue and report status back.
Low side — the part of the deployment that has internet access.
High side — the part of the deployment that doesn't, and that the downloaded artifacts are ultimately delivered into.
Bridge — the mechanism that moves approved artifacts from low side to high side under policy, in the bridge-sync pattern. In the reference stack this role is played by Apache NiFi. See Architecture — Transfer mechanisms for the other supported patterns.
Diode — a one-way data-replication mechanism (hardware network diode, or a file-level equivalent) used in the diode-relay pattern. Unlike the bridge, a diode enforces one-way-ness physically — there is no return path to disable, because none exists. It's used singly in the diode-relay pattern (artifacts flow one direction only), or in a matched pair — one per direction, file- or HTTP-based — in a diode-paired bridge sync, so each leg of the sync stays physically one-way even though the pair together moves data both ways.
Drop point — where Minions write approved output for a diode relay to pick up: a local directory or network share today, with S3 support planned.
Entitlement — a customer's paid access to a set of container images or Helm charts, tied to their subscription. See the pricing/dashboard flow for how this is granted.