Reference
Glossary
Updated
On this page
The words these docs use, each defined once. Terms are grouped by topic and listed A–Z inside each group.
Decisions
Approval
A GitHub pull request review that approves the change. Zof counts it only when the reviewer is a release approver for the change's owner, can write to the repository, didn't write the change, and approved the latest commit after Verification reported. See Evidence and approvals are tied to a commit.
Change
A pull request, as Zof sees it. Zof decides about the pull request's latest commit, also called its head.
Decision
Zof's result for one commit of a change, with every reason behind it. Decisions are never edited: a new decision replaces the old one. See How Zof decides.
Evidence
Test, check and review results that Verification reports for one exact commit. A required rule names the evidence it needs.
Fail closed
When Zof is missing information, or can't read it, it never counts that as a pass. The change is blocked, usually as Needs evidence, and an unknown state is treated as blocked.
Reason code
A short code for one reason behind a decision, such as missing_blocking_evidence. The Zof / Control check lists one sentence per reason under "Why". See Reason codes.
Result
One of Zof's four outcomes for a commit: Release authorized, Awaiting approval, Needs evidence or Denied. Also called the verdict. See Check results and statuses.
Stored copy
A system map a company admin accepted in the Zof console, kept by the System Graph with every earlier version. While one is in use, it wins over the repository's own zof.yaml. See Set up your system map.
System Graph
The Zof service that works out what a change touches: its services, their tier and their owners.
System map
A repository's zof.yaml: each service's tier, owner, domains and tags, and the links the code doesn't show. It comes from a stored copy or the repository's own file. See How Zof understands your system.
Verification
The Zof service that runs the tests and checks your rules ask for, against the exact commit, and reports the evidence.
Policy and people
Accountable person
The person who answers for an agent's change. See Agents and accountable people.
Agent
A GitHub bot or App account that opens or pushes changes on its own, or an account an admin marked as an automation account. A person using AI tools isn't an agent.
Baseline rule
The required rule in every policy that applies to every change and asks for at least one check. Zof refuses a policy without one.
Draft
Your saved, unpublished edits to the release policy. The draft is shared by every admin, and nothing in it applies until it is published.
Environment
Where a branch's changes go, production or staging. You map branches to environments in Branches & environments in Release policies.
Grant
What an agent may do on its own: which actions, in which environments, up to which tier. Grants are set in the Agents tab of Release policies.
Live policy
The one version of your release policy that Zof uses for every decision. A published draft becomes live once Zof serves it. A new company has no live policy until its first publication is served.
Owner
A team that owns services in your code, with an ID such as owner:team-payments. When a rule needs an approval, Zof asks the owners of the services the change touches. See Choose who can approve.
Release approver
A person listed in Release approvers for an owner, by name or through a GitHub team. See Who can do what.
Release policy
Your company's rules that every pull request must meet before it can merge. See Change your release policy.
Required and optional
Every rule is required unless it is marked optional. Required: must pass to release. Optional: reported, doesn't stop the release. The check and the console tag only optional checks, and each check shows one result: Passed, Failed, Not run yet, Running, Couldn't run or Couldn't check. See Required or optional.
Rule
One requirement in the release policy. A required rule holds the change until it passes. An optional rule is reported on the check, but never stops the release. See Required and optional.
Tier
How critical a service is. Tier 0 is the most critical, and the strictest rules usually apply to it. A service with an unknown tier is treated as tier 0.
GitHub and enforcement
Advisory branch
A branch where GitHub doesn't require the Zof / Control check. Zof still decides, but anyone with write access can merge. See Advisory and enforced.
Bypass
A way to merge without Zof's approval: a ruleset's bypass list, or admins on classic branch protection. See Bypass Zof in an emergency.
Delivery
A webhook GitHub sends to Zof, or an event Zof sends to its other services. A delivery that keeps failing shows as Failed. See Retry a failed delivery.
Enforced
A branch where an active ruleset or branch protection requires Zof / Control from the Zof GitHub App. See Enforcement statuses.
Ruleset
A GitHub setting that protects branches, for example by requiring a status check to pass before merging. See Make Zof block merges.
Zof / Control check
The check Zof posts on every pull request. Its title is Zof's result, and its summary explains why.
Zof / Review check
The check a posted Zof code review adds to a pull request. It is always neutral and never blocks a merge.
Zof GitHub App
Zof's GitHub App. You install it from Integrations, and it posts the Zof / Control check. On GitHub it appears under the name it was registered with, which is Zof AI on Zof's hosted service.
Testing
Load test
A test that sends many users to one page at once and checks that answers stay fast and error-free. On the Run page it's the Load test card. It needs a verified address only while address proof is on; it's off for now. See What each test checks.
Smoke test
A quick check that each page loads and answers. On the Run page it's the Smoke test card. On a site that answers every address with the same page, it only proves the server is up. See What each test checks.
User journey
A flow through your site that Zof runs step by step in a real browser, written in a short step language. On the Run page it's the End-to-end test card. See Write a user journey.
Verified address
An address proven to belong to your company: reported by your repo's GitHub deployments, or proven with a one-time file on the site or a DNS record. While address proof is on, Zof only sends load or attack traffic, such as load tests and SQL injection scans, to a verified address. It's turned off for now, so these tests run on any address you enter, and Zof will turn it back on. See Verify your address.