Pacto – OCI-distributed contracts for cloud-native services
Consolidates service specs (OpenAPI, Helm, K8s, env vars) into one OCI-distributed YAML contract.
Pacto (/ˈpak.to/ — from Spanish: pact, agreement) is an open, OCI-distributed contract standard for cloud-native services.
OCI-distributed service contracts beat scattering config across six different files.
Platform engineers managing cloud-native services
Backstage · Open Service Broker API · Crossplane
I work as a platform engineer and kept running into the same issue: the operational behavior of a service is never defined in one place.
Parts of it live across different tools:
APIs in OpenAPI Deployment assumptions in Helm values Runtime details in Kubernetes manifests Configuration in env vars Dependencies in READMEs or tribal knowledge
So platforms end up reverse-engineering how services behave.
Pacto is an attempt to define a machine-readable runtime contract for services.
A contract can describe things like:
interfaces (HTTP, gRPC, events) runtime semantics (stateless, stateful, hybrid) service dependencies configuration schema scaling expectations
All of this lives in a single pacto.yaml file that can be validated, diffed, and distributed as an OCI artifact.
The CLI currently supports: • validating contracts • detecting breaking operational changes (pacto diff) • resolving dependency graphs • packaging contracts as OCI artifacts
One thing I found particularly useful is making state semantics explicit, for example:
runtime.state.type: stateless | stateful | hybrid
This allows platforms to reason about storage, lifecycle and scaling without relying on implicit assumptions.
The project is still early but already usable. Curious to hear feedback from other platform or infrastructure engineers.
Consolidates service specs (OpenAPI, Helm, K8s, env vars) into one OCI-distributed YAML contract.
OCI-based agent skill packaging, but limited adoption and niche audience versus established agent frameworks.
YAML contracts enforce agent behavior where Guardrails and LMQL focus on outputs.
Treats AI agents like microservices with mTLS and attestation, not just scripts.
No-daemon micro-VMs with persistent state beat ephemeral agent sandboxes.
Proves text safety ≠ tool-call safety; catches hidden harmful executions deterministically.