Glossary

Terms in monospace are the exact identifiers Lumaft uses in the API, the console, or a configuration file.

A

Account — A local user with exactly one fixed role. Accounts are disabled, never deleted, so attribution always resolves. Users and permissions

Administrator — The fixed role holding every permission except operations:evidence:write and operations:transcripts:read.

Assertion — One source's statement about one operation (a backend record, a runner announce or finalize). An operation may have several; they are appended, never edited.

Attention — The Needs attention view over cancelled, conflict, failed, and incomplete outcomes. A view, not a work queue.

Authority kind — What an integration token asserts about its submitter: deployment-runner or developer-workflow. Credential provenance, not human identity.

B

Backend — One named, validated record describing a state namespace Lumaft observes: id, bucket, optional prefix, region, engine, and for Pulumi a layout. Connect a backend

Backend identity — The installation-scoped identity Lumaft assigns from a record's id. Retention fences, token scopes, and coverage key on it; re-adding a backend creates a new one. Changing your backends

Backends file — The JSON document named by LUMAFT_BACKENDS_FILE, read once at startup.

Bootstrap administrator — The first account, created from LUMAFT_LOCAL_ADMIN_PASSWORD_FILE on first startup only.

C

Change (resource change) — A normalized planned or actual change with a closed action vocabulary: create, update, delete, replace, same, read, refresh, import, and their replacement variants. Counts are baseline; names appear when the evidence carries them.

Checkpoint — Pulumi's current state document for a stack. Lumaft reads it every 60 seconds and never retains it raw.

Cold backup — A copy of lumaft.db taken while the replica is stopped. The only supported SQLite backup. Backup and disaster recovery

Community — The edition an installation runs as with no license. Complete, not a trial.

Comparison (planned versus actual) — The panel lining a preview's planned counts against an apply's actual counts, shown only for a trusted, explicit correlation.

Compatibility manifest — Each release's declaration of the oldest schema revision it upgrades from directly. Upgrades and versioning

Composition record — The machine-derived account of what a release image contains: source commit, base image, dependency versions, SBOM and provenance references, and verifiedAgainst.

Conflict — The outcome when retained assertions for one operation disagree. Lumaft keeps both and refuses to pick a winner.

Connected license — A Business or Enterprise license that renews through the licensing service and binds to one installation identity.

Correlation — A trusted, explicit pairing of a preview with an actual operation, made by lumaft exec --correlate or the ingestion API. Never inferred from time or counts.

Coverage — The interval for which Lumaft has evidence for a scope: observed sources, earliest retained and latest accepted evidence, retention cutoff, and known gaps. Reading the operation timeline

Custom role — A Business role composed from the permission catalog, never including operations:evidence:write, assigned over local accounts.

D

Destructive — The badge shown when a retained change count is positive for delete, delete-replaced, or replace.

Digest — The sha256:… identity of an image. The only coordinate to deploy by; there is no latest tag.

Deletion history — The durable audit of every completed purge, forget, and retroactive retention action, written by the same transaction that deletes.

E

Edition — Community, Business, Enterprise, or Enterprise Advanced Security. Same image; server-side entitlements differ. Introduction

Engine — The tool that wrote the state a backend holds: pulumi (default), terraform, or opentofu. State observation is verified against Terraform 1.15.9 and OpenTofu 1.12.6; other builds are unverified. Terraform and OpenTofu can write native S3 lock files when locking is enabled, but Lumaft does not currently observe them. Backend-native update history remains unavailable for those engines, so lock and update-history observation are Pulumi-only and these backends answer engine-unsupported for both rather than showing empty results.

engine-unsupported — The closed reason a non-Pulumi backend returns for lock and update-history observation.

Evidence — What Lumaft retains about operations: assertions from backends and runners, with digests, acceptance times, and the policy revision each was accepted under.

Evidence coverage — The Operations page panel that reports coverage and its banners.

Execution role / task role — On ECS, the role ECS uses to start the task versus the role Lumaft runs as. IAM setup on AWS

Export — The versioned evidence document for one stack and one accepted-time window (lumaft-operation-history-export, schema version 6). Requires operations:export.

F

Fence — See replay fence.

Finalize — The runner call that ends an operation with succeeded, failed, or cancelled. Runner integration

First-run readiness — The seven-check panel on Backends: backend access, persistent storage, backup, evidence coverage, retention, deployment security, runner integration. Your first hour

Forget — The explicit action that retires a disabled backend's replay fences after payload has expired. Previewed, confirmed with a backup attestation, audited.

G

Gated migration — A schema migration classified major, destructive, or long-running. It never runs on an ordinary restart; it needs LUMAFT_SCHEMA_UPGRADE_APPLY and a verified recovery point. Database integration

Gap (continuity gap) — A stated break in a resource's transition history, with a closed reason: stack-missing, last-good-only, duplicate-urn, bound-exceeded, projection-diverged, or continuity-expired.

H

Heartbeat — A runner event that extends an operation's five-minute activity lease.

Hold — See legal hold.

I

in progress — The outcome of a runner-announced operation whose lease is live.

incomplete — The outcome when a runner-announced operation's lease expired without a finalize. Lumaft never learned how it ended and says so.

Ingestion API — /api/v1/ingestion/…, the bearer-token surface runners submit evidence to. Browser sessions cannot reach it.

Installation — One Lumaft deployment sharing one database: a single replica, or Enterprise replicas on PostgreSQL.

Installation ID — The durable random identity a connected license binds to. Shown on Licensing; safe to share; not a credential.

Integration token — A named, scoped, write-only credential (lumaft_it_…) carrying exactly operations:evidence:write. Shown once at issuance.

Issuer key — Your permanent 1–64-character name for a federated identity provider registration; appears in URLs and variable names. Federated identity

L

Layout — How Pulumi arranges checkpoints beneath the prefix: project-scoped (.pulumi/stacks/<project>/<stack>.json) or legacy (.pulumi/stacks/<stack>.json). Lumaft never guesses. Find your backend details

Lease (activity lease) — The five-minute window a runner keeps an operation in progress by heartbeating.

Lease (license lease) — The signed, time-bounded document a connected license renews; it can remain valid for up to 21 days (Business) or 67 days (Enterprise) after transfer or reset.

Legal hold — An Enterprise placement that exempts one exact evidence record from expiry, retroactive shortening, purge, and forget. Release requires retention and purge permissions.

Liveness — GET /api/v1/health: the process is up. Use it to restart, not to route.

Lock — An active Pulumi lock on a stack, observed every 60 seconds (every 5 while active). Pulumi-only.

lumaft exec — The CLI wrapper that runs a Pulumi command and reports it to Lumaft without changing its exit code.

LUMAFT_ALLOW_HTTP — The loopback-only exception that lets a browser keep the session cookie over http://127.0.0.1. Never set off the loopback interface.

M

Marker — The [lumaft:v1:<uuid>] token lumaft exec appends to an update message so the runner's assertion and the backend record can be joined. The only byte of a message Lumaft reads.

Migration — A forward-only, transactional schema change applied at startup. See gated migration and startup-safe.

O

Observation — One immutable, timestamped read of a backend by one of three schedulers: checkpoints (60 s), locks (60 s / 5 s), update history (5 min).

Offline site license — The Enterprise Advanced Security license document (LUMAFT_OFFLINE_SITE_LICENSE_FILE): organization-wide, no outbound calls.

Operation — The source-neutral event a person recognizes as a preview, update, destroy, refresh, import, rename, or resource-import, with an immutable Lumaft id and exactly one outcome.

Outcome — succeeded, failed, cancelled, conflict, in progress, or incomplete. unknown exists in the vocabulary but no source produces it. Empty outcomes are invalid.

Ownership lock — The exclusive lock on lumaft.db.owner that stops a second SQLite replica from starting (ownership-conflict).

P

Permission — The unit controllers check: backends:read, observations:read, operations:read, operations:transcripts:read, operations:export, operations:retention:manage, operations:purge, accounts:manage, integrations:admin, backends:diagnostics:read, storage:health:read, operations:evidence:write. Users and permissions

Prefix — The object-key namespace before an engine's state keys (team/platform puts Pulumi's directory at team/platform/.pulumi/).

Project-scoped — See layout.

Provenance — Where an assertion came from: Pulumi backend, Runner (deployment runner), or Runner (developer workflow). Always shown, never merged.

Provisioning mode — How a federated provider maps subjects to accounts: administered (pre-linked) or on-first-login (creates a viewer).

Purge (exact-stack purge) — Explicit deletion of one stack's evidence through an accepted-time boundary. Previewed, confirmed, audited.

R

Readiness — GET /api/v1/readiness: 200 after a bounded database query succeeds. Use it to route traffic. It never contacts a backend.

Recovery point — The verified copy of the database Lumaft writes beside it before applying a gated migration.

Redaction — Removal of Pulumi-marked secrets from outputs before they reach a browser model, and of recognized patterns from transcripts on the runner and the server. Never claimed to be complete.

Release record — releases/<version>/release.json in the distribution repository: the digest, coordinates, composition record, and CLI archive descriptor for one release.

Replay fence — The compact, payload-free record left when evidence expires so a pruned source cannot be replayed into history as new. Keyed on backend identity; removed only by forget.

Replica — One running Lumaft process. SQLite allows exactly one; Enterprise PostgreSQL allows a declared ceiling. PostgreSQL operations

Resource — One entry in a stack's checkpoint, by URN, type, and logical name.

Resource history — Retained transitions for one resource across observations.

Retention policy — Two installation-wide windows — operation summaries and resource changes — 1–365 days on Community, up to 3,650 on paid editions, defaulting to 90 on a new installation. Changes append a revision and apply prospectively; existing policies are preserved across upgrades.

Role — administrator, viewer, or transcript-reader; or a Business custom role.

Runner — The service or machine that submits evidence with an integration token; the lumaft exec wrapper or a direct client.

S

SCIM — Enterprise provisioning of accounts by an identity provider through /api/v1/scim/v2/<issuerKey>, using its own token. Creates viewers only.

Snapshot (stack snapshot) — The current, revision-fenced projection of a stack shown in the explorer; a failed read keeps the last available one, labelled.

Stack — The unit of inventory and history. Identity is backend, layout, project (for project-scoped), and stack name.

Stack read scope — An Enterprise grant that narrows one user's retained-history reads to named stacks. Live observation pages stay installation-wide; not tenant isolation.

Startup-safe — The migration class that applies on an ordinary restart and permits a rolling deployment.

Storage health — GET /api/v1/storage-health: write probe, free space, database file sizes, last durable write. Never affects readiness.

Subject (immutable subject) — The provider-issued identifier a federated identity is keyed on: OIDC sub, persistent SAML NameID, or the trusted-proxy header. Never an email.

T

Temporal — The label on Operations near this change: an overlap in time between an operation and a resource transition. Never a causal claim.

Tombstone — The bounded record left by an expiry or purge that proves what was deleted and when, without the payload.

Transcript — An optional, encrypted, redacted, bounded capture of a runner's stdout and stderr. Off by default; three opt-ins; read requires transcript-reader.

Transcript-reader — The fixed role adding operations:transcripts:read to the viewer's reads. Administrators do not implicitly hold it.

Transition — One change in a resource's history: baseline, appeared, changed, removed, or reappeared.

Trusted proxy — An Enterprise sign-in path where a proxy you operate authenticates users and forwards an immutable subject with a shared secret.

U

Update history — Pulumi's per-stack record of past updates in the backend. Lumaft copies each record it observes into its own store every five minutes; the durable timeline survives the backend's pruning.

V

verifiedAgainst — The part of a composition record listing only the surfaces a release was actually tested against. A test record, not a compatibility promise.

Viewer — The fixed role holding backends:read, observations:read, and operations:read, and nothing administrative.

W

WAL — SQLite's write-ahead log mode, which Lumaft uses and which requires host-local locking — the reason network filesystems are unsupported for /data.

Whole-state retention — An Enterprise opt-in that keeps exact observed state bytes, encrypted with LUMAFT_STATE_KEY_FILE, for separately granted recovery. Off by default; can include secrets.