Glossary

A – E #

Action

One thing a customer can get done on a website: book a job, ask for a quote, request a callback, send an enquiry, get in touch. In the Action Graph it is a single entry with an identifier, a kind, the page it lives on, the ways in, the fields, the site’s own rules about those fields, what happens when it completes, and whether the owner has approved it.

Action Graph

The written list of what a site can do, in a form a machine can read. It is a versioned contract, currently 0.1, and it is the single interface every part of the system binds to. See /docs/action-graph.

Affordance

One door onto an action. A form is a door; a phone link is a door; an embedded booking widget is a door. One action can have several, which is why the graph records how an action is reached separately from what the action does.

Agent

Software acting on a website on a person’s behalf, an AI assistant told to book a plumber, rather than a person clicking. In the tracker it is one of four verdicts, and it is only assigned on real evidence: a declared user-agent, a signed identity, or at least two independent fingerprint signals. One signal on its own is not enough, that lands as suspected agent instead.

Agent-callable

Whether an agent could call one particular action directly, without driving a browser through it, as opposed to whether the site has a form on it. It is computed from positive evidence only, a declared tool, an advertised endpoint, a published catalogue, a known booking widget, or a form complete enough to fill with no CAPTCHA in front of it, and there is no "nothing looked broken" route to true. It describes an action; the score describes a site, and the two are deliberately separate.

Agent-readiness score

A number out of 100 for how much of what an AI assistant needs is actually present on a website. Five categories worth twenty points each: crawlability and discovery, structured data, action affordances, form quality and agent interface. Three bands: agent-ready at 70 and above, partially ready from 40 to 69, invisible to agents below 40.

AI crawler

A bot that reads websites to train or index a model, rather than to do something for a person. GPTBot, ClaudeBot, PerplexityBot and their kind. The tracker classifies these as bot-other and records the platform, and never counts them as agent traffic, counting them would make every site look busy with agents on day one.

AI referrer

A visit that arrived from an AI answer, somebody read a response in ChatGPT or Perplexity and followed a link. Commercially interesting and not the same thing as an agent: a person is on the site. A referrer never moves the tracker’s verdict off human.

ARD, and the catalogue at /.well-known/ard.json

A small file at /.well-known/ard.json, found via a rel="ard" link, listing what the business offers and how to act on it, so an agent can discover the actions before loading a page, ahead of a call to MCP or WebMCP. Agent Readiness Discovery, published as a discovery standard in June 2026. The predecessor path, /.well-known/ai-catalog.json, was renamed; we still serve it, for older registries. Of the fifteen sites scanned on 25 August 2026, none published one.

Barrier

Something standing between a correctly filled form and a completed action. A CAPTCHA, a login, a payment wall, a one-time code, a queue for human review. It is not a validation, because the form is filled correctly, and it is not a side effect, because nothing has happened yet. Barriers are recorded and reported, and they deliberately do not affect whether a map counts as complete.

Beacon

The small message the tracker sends when a visitor leaves a page. One per page view, roughly 200 bytes, sent on leaving or after twenty seconds, never during loading. The collector treats every beacon as a string a stranger POSTed and trusts nothing in it.

Bot-other

The tracker’s verdict for a bot that is not an agent: search crawlers, SEO tools, uptime monitors, AI training crawlers. Reported on its own line so that nobody can mistake crawler volume for agent demand.

CAPTCHA

The "prove you are not a robot" step. It stops a customer’s AI assistant exactly as well as it stops a bot, and an assistant will not attempt one, it hands back to the person or gives up. Any action behind a CAPTCHA is closed to agents, which is why the scanner penalises it and why it shows up as a barrier in the Action Graph.

Claim

The step by which the owner of a listed business says the listing is theirs, at /claim. It takes a sign-in by email and one proof of control over the domain, a six digit code emailed to an address at the domain (the default; expires in 15 minutes), or, under Advanced, a DNS TXT record, a file at a fixed URL on the site, or a meta tag on the homepage, and it records the domain against that email. A claim is not an approval: at /app an owner switches an action on and, if they route it to email-confirm, the gateway now turns a matching request into a pending attempt and an emailed job card, nothing books or executes until they accept it, and servicem8/cliniko routing is still unwired. Live since 4 September 2026.

Complete

A property of our knowledge, not of anybody’s permission: do we have a full, faithful map of this action? Seven things must all hold, including a drivable door, a usable way to send it, a field an agent may fill, no required field whose meaning is unknown, a way to reach the customer back, stated consequences, and provenance throughout. Kept strictly apart from executable.

Consent record

What the owner was actually shown at the moment they approved an action, stored as data rather than as a tick. It mirrors the whole disclosure, the effects, whether it is reversible, whether the business now owes somebody something, whether personal information is transmitted, whether money moves, whether a real slot is held, and the summary sentence, and it is compared against what the action does every time a decision to execute is made. Any divergence stops the action until a human re-confirms.

Do Not Track and Global Privacy Control

Two ways a browser can say "do not count me". If either is present the tracker stops before it starts: no listeners, no counting, no request. Brave and the DuckDuckGo browser send Global Privacy Control by default, which is the most common reason somebody’s own test of their own install looks like a failure.

Effect, or side effect

What completing an action does in the world, emails the business, creates a record in their software, takes a slot out of their day, opens a ticket, takes payment. It is a fixed list of twelve rather than free text, because a sentence cannot be checked by a machine and an owner’s approval has to be compared against something. An action whose consequences cannot be stated is invalid.

Executable

A property of the owner’s consent, not of our knowledge: may this action fire for real? A perfectly mapped action on a site whose owner has never heard of us is complete and not executable, and that is the normal state of every action ever mapped.

F – P #

Fix list

Everything the scanner found that has a named remedy, in the order the score reads them. Instructions for whoever maintains the site, free, and the whole list, nothing is held back for a paid tier. On a published report the wording is rewritten so that it instructs rather than advertises, and a report in which a first-person claim survives is refused publication.

Fixture

A committed example file used to test something and to keep its behaviour from drifting. The scanner has ten and asserts their exact scores; the Action Graph package has three, one of which is the only verified example in the repository, a hand-written confirmation that exists so the gate can be tested against a positive case, not a record of any real business agreeing to anything.

Gateway, and frontlatch.com/mcp

The one hosted MCP endpoint, POST https://frontlatch.com/mcp, that agents call instead of navigating a business’s website. It answers MCP JSON-RPC with nine tools. Six work over the business index: find_business searches by name, suburb or category; list_actions returns every action detected on one business’s site; describe_action details one of them; do, the only one that would act, refuses every call except two: a claimed business that has switched an action on for email-confirm routing in the console at /app gets a pending, logged attempt and a job card with the customer’s details and Accept and Decline buttons emailed to the owner instead (the agent polls the outcome with request_status, and answers the owner’s quote with respond_to_quote once the user agreed); and action: "signup" creates an account only where the owner switched agent sign-ups on and the user confirmed in their chat. Every other business, including one routed to ServiceM8 or Cliniko, still gets refused: neither can be booked into directly today. The other three work on any website, not only an indexed business: inspect_site crawls it for forms and links, read_page reads one page as markdown, and do_action fills a found form in a headless browser and, by default, never submits it. One gateway over every listed business, and any other site besides, not one MCP per site. Live since 4 September 2026, see the product page at /products/gateway.

Grade

The word under the score. Agent-ready at 70 and above; partially ready from 40 to 69; invisible to agents below 40.

Headless browser

A browser running with no window, driven by software. It is one of the strongest fingerprint signals the tracker uses, and it is weighted 0.70 out of the 1.00 needed to call something an agent, high, but deliberately not high enough on its own.

Indexed

The state of a listed business whose site has been read for agent-callable actions and whose record the gateway now serves: an agent asking list_actions about it gets what was found. For a claimed business that list holds jobs only (plain links, logins and sign-ups are left out, and a repeated form is listed once), each with whether the scan judged an agent able to complete it, so the gateway, the scan report and the console count the same thing. It is a reading, not a permission or a verified action, an indexed business stays refused at do unless its owner has also claimed it and switched an action on for email-confirm routing, in which case a matching request now becomes a pending attempt and a confirm email instead of a flat refusal. The business index shows how many of its businesses are indexed, how many could not be reached, and how many are not yet scanned; those counts are read at build time, never typed.

JSON-LD

A block of machine-readable facts embedded in a page: what kind of business this is, its hours, its phone number, its address, the services it offers. Without it an agent has to guess all of that from the prose. It is what the scanner’s structured-data category measures.

llms.txt

A plain text file at the root of a site describing what the site is and does, written for language models. One of the well-known files the scanner probes, alongside robots.txt, sitemap.xml, the ARD catalogue and the MCP server-card paths.

Locator

How to find a particular element on a page again, a selector, an accessible name, a link target, together with an honest judgement about whether it is likely to survive the next theme update. A fragile locator is a recorded risk rather than a surprise later.

Mappability

The share of a site’s detected actions that yield a complete map. A site with no actions at all scores zero, not one, because the alternative reading would make an empty site our best result. Across a sample it is reported two ways. Over all sites: 40.7% on a stratified sample of 27 service businesses (4 Sep 2026), eleven of 27; an earlier hand-picked set of fifteen sites read 73.3%, and it was not representative. Over door sites, the sites with a form or a booking widget, which is the figure we hold ourselves to from 9 Oct 2026. A site whose only contact is a phone number, or that offers no action at all, is counted apart as needing a hosted action, because there is nothing online to map.

MCP, and a persistent endpoint

A connection an agent can open at any time to ask what a business offers and to act on it, whether or not anybody has the site open in a browser. The Model Context Protocol. It is the route that still works at 2am, and it is the third of the three discovery routes the scanner checks, alongside ARD and WebMCP.

Non-action form

A form that matches action wording but is not an action an agent could call directly: a search box, a newsletter signup, or a form with nothing to submit. These are excluded from both the detected actions and the form-quality score, because scoring a business’s form quality on the strength of its property-search box is a false positive with a number attached.

Provenance

How a thing came to be believed, and how sure we are: parsed from the markup, read from structured data, observed in a real browser session, inferred, or confirmed by a human at the business. Every part of the Action Graph that asserts something carries one, with a confidence and a receipt. Only an owner’s confirmation may ever reach certainty; nothing we work out ourselves is certain.

R – Z #

Redaction

What is removed from a scan report before it is published: the business name and website address, phone numbers and booking-widget URLs, and the raw page markup. It is done by rebuilding the identifying fields from a safe vocabulary rather than by filtering them, and a final check refuses to publish a report in which a hostname, a business-name token or a phone number survives.

robots.txt

A file at the root of a site saying which automated visitors may read which parts of it. The scanner reads it to see whether agents are locked out, either by a blanket disallow or by naming AI agents specifically, and it obeys what it finds.

Sandbox, or test mode

Running an action for real practice without anything reaching the business. It is the default everywhere, and passing in sandbox is deliberately its own state rather than a step towards approval: sandbox success is evidence that an action works, and it is never permission to fire it. Conflating those two is precisely the failure the trust rule exists to prevent.

Schema version

The version of the Action Graph contract a file speaks. Currently 0.1. A reader refuses a file from a newer version outright rather than reading the parts it recognises, because the parts it cannot see might carry a limit or a consequence, and ignoring a constraint is the worst possible way to be forgiving.

Semantic type

What a form field means, as opposed to what the browser thinks it is. Two plain text boxes may be a customer’s name and a property address, and an agent that cannot tell them apart cannot act. There are 29, including three that exist for safety: anti-spam fields an agent must never touch, hidden metadata an executor must echo back exactly, and unknown, which blocks completeness rather than being guessed at.

Suspected agent

The tracker’s verdict when the evidence is real but ambiguous. It exists so that ambiguity is carried rather than rounded up into a confident agent verdict. A single automation signal with nothing else alongside it lands here, and that is intended.

business index, the

Every service business Frontlatch has listed from public OpenStreetMap data, each with its own page under /businesses, searchable by name, suburb and category. Businesses are listed for free and without being asked, read-only, so an agent can find them through the gateway before any owner has heard of Frontlatch; the ones whose sites have been read show what an agent can already do there. It is the same set the gateway’s find_business and list_actions tools search, and the counts in its header are read from the index at build time. The listing data comes from OpenStreetMap contributors under the ODbL licence, credited in the footer. Every listing page links to “Correct or remove this listing”: the owner proves control with a six-digit code emailed to an address at the domain, the page then answers 404, and the gateway stops returning the business (it refreshes its removed list every ten minutes).

Trust invariant

The rule everything else is built around: no code path may ever execute a real action on a business that has not verified that action type, and test mode is the default everywhere. It is expressed as data rather than as a policy, the type will not let an action be marked approved without the approval attached, the validator rejects the same thing arriving as a file, every constructor produces an unapproved action, and the gate re-derives permission from the evidence every time rather than trusting a status.

Unverified, sandbox-tested, verified

The three states an action can be in, in order of what they permit. Unverified is the default and nothing runs. Sandbox-tested means it has been exercised in test mode and still cannot run for real. Verified means the owner confirmed, and the confirmation is present as data: who, when, how, a reference to the audit record, the limits they set and the disclosure they saw. There is no revoked state, revocation moves an action back to unverified, which fails closed.

Verified completed action

The unit that gets charged for. One real outcome, a booked job, a submitted quote, an appointment, that ran through an action the owner had approved and actually completed. Duplicates do not count, attempts do not count. Each one comes with a signed receipt and a seven-day dispute window. See /docs/how-billing-works.

Web Bot Auth

A way for an agent to sign its requests so a site can tell which agent is calling. The tracker detects the signature headers and does not verify the signature, no key fetch, no cryptographic check, so the claim it makes is "this request presented a signed agent identity", not "this is a verified agent", and its confidence is capped below certainty for exactly that reason.

WebMCP

A way for a page to tell the browser what it can do, so an agent using that browser can call those actions by name instead of scraping and guessing. It is a proposal, not a shipped browser feature: it is declared through document.modelContext (navigator.modelContext is a deprecated alias), which browsers have not implemented, so using it today means loading the @mcp-b/global polyfill. It lives and dies with the open tab, which is why a persistent endpoint is a separate thing.

Widget, or booking widget

An embedded scheduler from a third party, ServiceM8, Cliniko, Halaxy, Tradify, Calendly, Jobber. It is a genuine booking action whose fields sit inside a frame nobody outside it can read, so the Action Graph records it as opaque with no inputs, which is a different claim from "this action has no fields". The scanner matches widgets structurally against booking URLs, never against page text, so a "powered by" credit in a footer is not a booking widget.