Glossary

This page defines every word these docs use with a special meaning, in alphabetical order. Each word is defined here once, and the link after it leads to the page that explains it in full. Other pages link here instead of explaining the word again. The dashboard and the command line use the same words. Where the dashboard shows a different label, the last column gives it.

Word	Meaning	In the dashboard
Accept the unknown	A person lets a change with an Unknown check go ahead. It is recorded as accepted, never as a pass. See What Unknown means	Accept the unknown
Admission policies	Rules the Kubernetes cluster runs on every request before it accepts it. Pacto's check who may ask for and approve a change, and records say whether they were on (guarded). See Install	—
Agent	An AI agent, such as Claude, that calls Pacto's tools over MCP. It can plan and ask for changes, and only a person approves one. See Who may approve. An agent you build is a service like any other: see an agent is a service. The pacto agent command is the runtime watcher; see Node agent	Agent
Anchor	One fixed digest per Stage in the streams repository. Every record of that Stage hangs on it as a referrer, so the anchor is where the Stage's whole history is read. See Where records live	—
Approval	A person's answer on one held change: approve, accept the unknown or reject. See Look, then decide	Approve
Argo CD	A GitOps tool that applies Kubernetes files to a cluster. Pacto works with an OCI-sourced Argo CD Application, one that reads its files from an artifact in a registry, and moves a version by writing its digest onto it. See Apply through Argo CD	—
Auto-hold	Set when someone rolls a Stage back by hand, or promotes it back to a version it already verified. Automation stops promoting there until a person unfreezes it or promotes a version it has not verified yet. See Roll back by hand	—
Break-glass	A group, pacto:break-glass by default, allowed to force a version past every check. A forced version freezes the Stage. See Force a version	—
Breaking change	A change that removes or changes something consumers may use. Pacto classifies every change as breaking, possibly breaking or non-breaking. See Change classification	—
Bundle	A contract together with the files it points to (OpenAPI documents, schemas), as one folder or one published artifact. See Bundle structure	—
Change	One requested move of a Stage to another version, from request to outcome. In Kubernetes it is an object of kind Operation. See What happens to a change	Change
Check	A test Pacto runs on a version before or after it moves: was it published and signed, does it break a consumer, does the running service do what its contract says. Each answers Pass, Fail or Unknown. See What happens to a change	Checks
Check suite	A test or eval file a version ships in its checks list. A Stage runs it, and only a verdict about that exact file counts. See Checks	—
Clear	The contracts clear a change when every consumer accepts the new version. See Who is asked and why	—
Cold start	A new Stage begins on observe and earns more freedom from there. See Cold start	—
Collector	What gathers evidence, such as the Kubernetes observer or the eBPF node agent. See Collectors	—
Compliant	The compliance state of a contract whose evidence covers it and raises no error or warning.	Compliant
Consumer	A service that calls another one. Checkout is a consumer of payments. See Impact analysis	Consumers
Consumer range	Which versions of another service a contract accepts, such as ^2.0.0 (any 2.x), set in compatibility. Pacto judges each change per consumer by these ranges, never per field or endpoint. Also called version range. See Who is asked and why	—
Contract	One file, pacto.yaml, that says what a service offers, who owns it and which other services it calls. See the contract reference	Contract
Contract graph	All your contracts together: who calls whom and which versions each accepts. See Operational graph	Graph
cosign	The Sigstore command-line tool that signs artifacts in a registry and verifies their signatures. pacto publish signs in the same format, so cosign verify checks a version, and cosign verify-blob-attestation checks a record. See Verify a record	—
Delivery	The opt-in part of Pacto, also called the delivery component, that decides which version of each service runs in each environment. It is a separate install. See How delivery works	Delivery
Digest	The fingerprint of one exact published artifact (sha256:...)	—
DRI	Directly responsible individual: the one person a contract names as accountable for the service (service.owner.dri). When a contract names no team, the DRI is its owner. See OwnerInfo	—
Earned autonomy	Raising a Stage's level after enough good changes, confirmed by a person. See Earned autonomy	—
Environment	A place a service runs, such as test or prod. In Kubernetes it is a namespace of the same name	Environment
Evidence	What was observed about a running service, such as which ports listen or which services it called. See Evidence	Evidence
Evidence Server	The service that receives evidence and stores it in your registry next to the contract it is about. See Evidence Server	—
External dependency	A dependency outside this Pacto system, such as a managed database or a model. It has a contract and a range, or only a version, and then anything relying on it is Unknown. See External dependencies	—
Finding	One result of comparing a contract with the evidence: a contradiction such as INTERFACE_ABSENT, or a reason Pacto could not tell, such as EVIDENCE_STALE. See Compliance model	Findings
Fleet	All your services together, as Pacto sees them from contracts, clusters and registries. See Fleet views	Fleet
Flux	The GitOps tool that applies each version in the cluster. Pacto moves a version by writing its digest onto a Flux OCIRepository. See How a change moves	—
Follower	A Stage in another cluster that takes the versions an upstream Stage verified, by reading that Stage's stream. See Follow a Stage in another cluster	—
Freeze	Stop automation moving a Stage until a person unfreezes it. See When a Stage is frozen	Frozen
GitlessOps	Signed artifacts in your registry and evidence decide which version runs where, while your code and manifests stay in git. See What GitlessOps means	—
GitOps	Keeping a cluster in line with files in git, with a tool such as Flux or Argo CD. Pacto works with it	—
Held change	A change waiting for a person to decide. See Why you were asked	Inbox
in-toto	A standard format for signed statements about software. Every record is an in-toto statement. See What a record says	—
Invalid	The compliance state of a contract that fails validation. It ranks worse than NonCompliant.	Invalid
Interface	One way a service is called, such as an HTTP API described by an OpenAPI file. See interfaces	Interfaces
Kustomization	The Flux object that applies a set of Kubernetes files, such as the files a version ships, as the ServiceAccount it names. See Manifests and the levels	—
Level	How much a Stage lets Pacto do on its own: observe, advise, auto for non-breaking (auto-nonbreaking) or autonomous. Also called autonomy level. See The four levels	Level
MCP	Model Context Protocol, the standard way an AI agent finds and calls tools. pacto mcp is an MCP server. See Drive Pacto from an agent	—
Mediated	A Stage condition that says whether only the pointer decides what runs. See What the pointer guarantees	—
Node agent	The Pacto collector that runs on every Kubernetes node and watches with eBPF which ports each service listens on and which services it calls. It is a program in the cluster, separate from an AI agent. See Runtime conformance	—
NonCompliant	The compliance state of a valid contract when the evidence contradicts it, for example a declared interface that is absent.	Non-Compliant
OCIRepository	The Flux object that points at one artifact in a registry, whose files a Kustomization applies. Pacto moves a version by writing its digest onto it. See How a change moves	—
Operator	The Pacto controller you install in a cluster. It checks that each running service matches its contract. See Kubernetes overview	—
oras	A command-line tool that lists and fetches artifacts and referrers in a registry. See Check one record without Pacto	—
Owner team	The team a contract names under service.owner. Pacto asks its members about that service. See OwnerInfo	Owner
Pactify	Give a service a contract and connect it to delivery. See Pactify a service	—
pactoVersion	The contract format version in each pacto.yaml, "2.0", "2.1", "2.2" or "2.3". It is separate from the Pacto core and operator release versions. See Versions	—
Plan	What Pacto would do with a change, and who must agree, before anyone asks. See Plan, propose and approve	Plan
Pointer	The digest a Stage moved its environment to (status.pointer). See What the pointer guarantees	—
Policy	A rule a contract must follow, such as "every service names an owner", checked with the contract. See policies	Policy
Promote	Move a Stage to a newer version	Promote
Promoter	The part of delivery that plans each change, runs its checks and moves the pointer. It holds no signing key. See How a change moves	—
Proposal	The next level Pacto suggests for a Stage, with its evidence or what blocks it. See Earned autonomy	—
Readiness assessment	A dated statement in a contract of which readiness claims are done, with evidence. It counts for nothing once it expires. See Readiness	Readiness
Recent sign-in	An opt-in rule: deciding on a held change needs a login newer than delivery.promoter.authFreshness. Off by default, so a person decides with the sign-in they have. See A recent sign-in to decide	Sign in again to decide
Record	A signed account of one finished change, stored in your registry and checkable without Pacto. See Verify a record	Record
Recorder	The part of delivery that signs records. It is the only part that holds the signing key, and it is off until you turn it on. See Signed records and history	—
Referrer	A file a registry stores attached to an artifact, listed by the OCI Referrers API. Evidence and records are stored this way, so they need a registry that serves that API. See What delivery needs	—
Registry	The place your container images are stored. Pacto stores contracts, versions and records there too	—
Rollback	Put back the version that ran before. See What happens to a change and Roll back by hand	Roll back
Service	Something you run and other things call, such as payments	Service
Session	What a shared dashboard keeps after a person signs in: their token, held on the server behind a cookie until dashboard.auth.session.idleTimeout or maxAge ends it. See Sessions	Sign out
Shadow consumer	A service seen calling another at runtime that no contract declares. See Observed dependencies	—
Sign-in	How a person proves who they are to a shared dashboard, with your identity provider or a pasted Kubernetes token. Every view and action then runs with their Kubernetes RBAC, and the delivery views need it. See Dashboard authentication	Sign in
Stage	One service in one environment, such as payments in prod, and the version it runs there. See Stages and records	Stages
Step-down	Dropping one level after a version Pacto shipped with no person fails. See Step-down	—
Stream	The numbered history of one Stage's records, each naming the one before it, hung on the Stage's anchor. See Streams, stand-ins and gaps	—
Target	One running deployment of a service, such as payments in one cluster. See Three identities	Targets
Transitive closure	A service's dependencies, their dependencies and so on to the last one. pacto.lock pins all of them by digest. See Lockfile	—
Transparency log	Sigstore's public, append-only log of signatures, which anyone can read. pacto publish writes each signature there unless told otherwise, so a private or throwaway key can stay out of it. See Signing	—
Unknown	The answer when Pacto could not see enough to decide. A check answers Unknown instead of Pass or Fail, and a contract's compliance state is Unknown when its evidence is missing or inconclusive. Unknown never counts as a pass. See What Unknown means	Unknown
Version	One published copy of a contract, such as payments 2.4.0. It never changes once published. See Publish a version	Version
Would have	On observe, what Pacto would have done with a change. It is advice only. See Cold start	—