# Glossary

Every term Opafra uses, one line each, in alphabetical order.

Source: https://opafra.com/docs/reference/glossary

---

Every term, one line each. [Core concepts](/docs/concepts) explains how they fit together.

## A

**Approval gate** A property of an environment: when set, every run whose targets land in
it pauses before its first step and waits for a person.

**Approver** Someone with Operator or above who can resolve a pending approval.

**Audit log** The append-only record of who did what, when, and to which resource.

## B

**Bastion** A registered server that another host is reached through. Chains up to three
hops are allowed.

## C

**Capture** Storing a step's output into a variable that later steps can read, in `raw`,
`json`, `lines` or `regex` mode.

**Catalog plan** A starter plan shipped with Opafra, read-only, cloned into your workspace
when used.

**Collection** A folder for organising plans. Independent of which git source a plan came
from.

**Condition** A "run only if" expression on a step or item. A malformed condition fails
open, meaning the step runs.

**Custody** The chain of who asked for a change, what drafted it, and who approved it,
kept on the run record.

## D

**Dry run** A run with every write suppressed, reporting what would happen per host
without changing anything.

## E

**Environment** A named group of servers, and where policy lives: approval, access, and
per-environment variable values.

**Execution** A run. The record of one attempt to execute a plan.

## F

**Facts** What Opafra observed about a host, such as its OS family, available as
`{{ facts.x }}` in conditions.

## G

**Git source** A repository Opafra reads plans, scripts and templates from. Sync is
one-way.

**Grant** Explicit access for one person to one protected environment, optionally with an
expiry.

## I

**Idempotent** Producing the same result whether run once or many times. A property of
some tools, and not of raw commands.

**Item** The smallest unit of work: one tool call with its arguments, inside a phase of a
step.

## L

**Level 1 / Level 2** The two kinds of dry-run answer. Level 1 shows the resolved command
without predicting its effect; level 2 probes the host and returns a verdict.

## M

**Managed plan** A plan owned by a git source, read-only in the builder.

**Module** A reusable, parameterised sequence of items that a plan calls as one item and
that expands at run time.

## O

**Orphaned** A synced object whose file vanished from the repository. Flagged rather than
deleted.

**Organisation** A tenant. Servers, plans, environments and secrets belong to one and are
invisible to every other.

## P

**Phase** An ordered group of items within a step.

**Plan** An ordered list of steps: the unit of work you author, run and approve.

**Protected** An environment flag requiring an explicit grant to see or use it. Separate
from requires-approval.

## R

**Revision** A plan's version number, incremented on every edit. Pinned when approval is
requested and compared at decision time.

**Run** An execution of a plan.

## S

**Secret reference** A pointer of the form `secret://provider/namespace/key`, resolved at
the moment of use. Plans hold references, never values.

**Server** A host Opafra can reach over SSH.

**Step** One stage of a plan: a set of targets plus the work to do against them.

## T

**Target** A host a step runs against. An environment name, a server name, or a variable
that resolves to one.

**Tier** An environment's lifecycle label: Production, Staging, Development or Other.
Production defaults to requiring approval.

**Tool** A named operation with declared arguments, in a namespace, such as
`file.lineinfile`. See the [catalogue](/docs/reference/tools).

**Typed input** A run parameter a plan declares, with a type, whether it is required, and
optionally a default and fixed choices.

## V

**Variable** A value resolved at run time. Precedence is run override, then plan, then
environment, and environment values resolve per host.

**Verdict** A level 2 dry-run result: `would create`, `would change`, `no change`, or
`unknown`.

## Next steps

- [Core concepts](/docs/concepts) for how these relate
- [Tool catalogue](/docs/reference/tools) for every tool by name