Every term, one line each. Core concepts explains how they fit together.
A#
Approval gate A property of an environment: when set, every run whose targets land in it pauses before its first step and waits for a person.
Approver Someone with Operator or above who can resolve a pending approval.
Audit log The append-only record of who did what, when, and to which resource.
B#
Bastion A registered server that another host is reached through. Chains up to three hops are allowed.
C#
Capture Storing a step's output into a variable that later steps can read, in raw,
json, lines or regex mode.
Catalog plan A starter plan shipped with Opafra, read-only, cloned into your workspace when used.
Collection A folder for organising plans. Independent of which git source a plan came from.
Condition A "run only if" expression on a step or item. A malformed condition fails open, meaning the step runs.
Custody The chain of who asked for a change, what drafted it, and who approved it, kept on the run record.
D#
Dry run A run with every write suppressed, reporting what would happen per host without changing anything.
E#
Environment A named group of servers, and where policy lives: approval, access, and per-environment variable values.
Execution A run. The record of one attempt to execute a plan.
F#
Facts What Opafra observed about a host, such as its OS family, available as
{{ facts.x }} in conditions.
G#
Git source A repository Opafra reads plans, scripts and templates from. Sync is one-way.
Grant Explicit access for one person to one protected environment, optionally with an expiry.
I#
Idempotent Producing the same result whether run once or many times. A property of some tools, and not of raw commands.
Item The smallest unit of work: one tool call with its arguments, inside a phase of a step.
L#
Level 1 / Level 2 The two kinds of dry-run answer. Level 1 shows the resolved command without predicting its effect; level 2 probes the host and returns a verdict.
M#
Managed plan A plan owned by a git source, read-only in the builder.
Module A reusable, parameterised sequence of items that a plan calls as one item and that expands at run time.
O#
Orphaned A synced object whose file vanished from the repository. Flagged rather than deleted.
Organisation A tenant. Servers, plans, environments and secrets belong to one and are invisible to every other.
P#
Phase An ordered group of items within a step.
Plan An ordered list of steps: the unit of work you author, run and approve.
Protected An environment flag requiring an explicit grant to see or use it. Separate from requires-approval.
R#
Revision A plan's version number, incremented on every edit. Pinned when approval is requested and compared at decision time.
Run An execution of a plan.
S#
Secret reference A pointer of the form secret://provider/namespace/key, resolved at
the moment of use. Plans hold references, never values.
Server A host Opafra can reach over SSH.
Step One stage of a plan: a set of targets plus the work to do against them.
T#
Target A host a step runs against. An environment name, a server name, or a variable that resolves to one.
Tier An environment's lifecycle label: Production, Staging, Development or Other. Production defaults to requiring approval.
Tool A named operation with declared arguments, in a namespace, such as
file.lineinfile. See the catalogue.
Typed input A run parameter a plan declares, with a type, whether it is required, and optionally a default and fixed choices.
V#
Variable A value resolved at run time. Precedence is run override, then plan, then environment, and environment values resolve per host.
Verdict A level 2 dry-run result: would create, would change, no change, or
unknown.
Next steps#
- Core concepts for how these relate
- Tool catalogue for every tool by name