Skip to content

Glossary — TLSStress.Art proprietary terms

Plain-language definitions of the project-specific acronyms and codenames used across the docs. Standard industry terms (TLS, QUIC, BGP, Kubernetes, SBOM…) are assumed. Terms marked [no-translate] stay in English in the pt-BR / es docs (see tools/doc-audit/glossary.yml).

Core concepts

Term Expansion Meaning
DUT Device Under Test The NGFW being measured. It sits between the agents and the personas, performs TLS decryption/inspection/re-signing, and is the whole point of the bench.
NGFW Next-Generation Firewall The class of device the DUT belongs to.
MÓDULO X.Art [no-translate] — A deployable capability module of the bench (e.g. CLONER.Art, SPAN.Art, RELAY.Art, TREX.Art). The .Art suffix and the term "MÓDULO" are the project's naming convention; there are 37 MÓDULOs.
Persona — One of the 100 webserver targets (Caddy + backend) the agents drive traffic to, one per public-IP /24 across 20 countries. Personas are the "webservers" — there is no other webserver.
Test Kind — One of the 7 categories of stress test the bench runs (e.g. browser-realistic, synthetic-load, L2/L3 saturation).
CPS Connections Per Second Primary throughput metric read off the DUT — new TLS connections established per second.

Posture & safety architecture

Term Expansion Meaning
ZTP-prem [no-translate] Zero-Trust Prem The 12-layer insider-operator security posture for the on-prem appliance — assumes the operator's own network/host is hostile. See SECURITY_ZTP_PREM.md.
DOM DUT Operating Mode The core discriminator that classifies a target as greenfield / staging / lab / production and gates which operations are allowed. See ADR 0014.
PIE Production Integration Envelope The family of operator-safety helper subsystems around the DOM core (replay, restore, health, auto-approve). See the PIE family primer.
PIE-PA PIE Production Approval The PIE auto-approval gate for production runs — on production mode it auto-approves reads only and requires an operator click-through for writes.
CPOS Customizable Profile / Override Stack The atomic 2-phase-commit system that coordinates a multi-step config change (e.g. "push profile to DUT + restart agents") so it lands all-or-nothing. See the CPOS primer.
CPOS 2PC CPOS two-phase commit The commit protocol CPOS uses.

Out-of-band & bridge infrastructure

Term Expansion Meaning
OOBI [no-translate] Out-Of-Band Infrastructure The management/control fabric (VLAN 2777, 802.1Q, no VXLAN — ADR 0043) separate from the test data plane. Carries operator control + Prometheus scrape.
OBP Operator Bridge Proxy The daemon on the operator's notebook that bridges the operator to the on-prem control plane over a semi-air-gapped channel. See the OBP primer.
RELAY.Art [no-translate] — The bridge MÓDULO that federates control traffic across sites.
SPAN.Art [no-translate] — The line-rate packet-capture MÓDULO (3-way fusion correlation).

Cloud / SaaS control plane

Term Expansion Meaning
TBI Testbench Image The downloadable on-prem appliance artifact (img/qcow2/oci) a customer boots in their datacenter.
TSU Testbench Service Unit The metered usage token minted at checkout and spent as the bench runs. Backed by a UTXO ledger.
cell-0 [no-translate] — The always-online SaaS provisioning cell (Hetzner K3s + Temporal) that onboards tenants.
OCTOPUS [no-translate] — The umbrella name for the multi-cell hyperscale control-plane architecture.