Glossary

Terms in monospace are the exact identifiers Marolum uses in the API, the console, or a configuration file.

A

Account: A local user with exactly one fixed role. Accounts are disabled, never deleted, so attribution always resolves. Users and permissions

Administrator: The fixed role holding every catalog permission except operations:evidence:write, operations:transcripts:read and observations:properties:read. Resource-property access requires a separate grant or entitled custom role and the applicable feature entitlement.

Assertion: One source's statement about one operation (a backend record, a runner announce or finalize). An operation may have several; they are appended, never edited.

Attention: The Needs attention view over cancelled, conflict, failed, and incomplete outcomes. A view, not a work queue.

Authority kind: What an integration token asserts about its submitter: deployment-runner or developer-workflow. Credential provenance, not human identity.

B

Backend: One named, validated record describing a state namespace Marolum observes: id, bucket, optional prefix, region, engine, and for Pulumi a layout. Connect a backend

Backend identity: The installation-scoped identity from a record's configured id. Retention fences, token scopes and coverage key on it. Re-adding the same id preserves that identity; choosing a new id starts a separate history. Never reuse an id for different state. Changing your backends

Backends file: The JSON document named by MAROLUM_BACKENDS_FILE, read once at startup.

Bootstrap administrator: The first account, created from MAROLUM_LOCAL_ADMIN_PASSWORD_FILE on first startup only.

C

Change (resource change): A normalized planned or actual change with a closed action vocabulary: create, update, delete, replace, same, read, refresh, import, and their replacement variants. Counts are baseline; names appear when the evidence carries them.

Checkpoint: Pulumi's current state document for a stack, read on the configured observation cadence. Whole-state retention is off by default; when explicitly enabled with the required entitlement and external key, Marolum retains an encrypted body that can include secrets. Checkpoint retention boundaries

Cold backup: A copy of marolum.db taken while the replica is stopped. The only supported SQLite backup. Backup and disaster recovery

Community: The edition an installation runs as with no license. Complete, not a trial.

Comparison (planned versus actual): The panel lining a preview's planned counts against an apply's actual counts, shown only for a trusted, explicit correlation.

Compatibility manifest: Each release's declaration of the oldest schema revision it upgrades from directly. Upgrades and versioning

Composition record: The machine-derived account of what a release image contains: source commit, base image, dependency versions, SBOM and provenance references, and verifiedAgainst.

Conflict: The outcome when retained assertions for one operation disagree. Marolum keeps both and refuses to pick a winner.

Connected license: A Business or Enterprise license that renews through the licensing service with a purchased installation allowance. Each activated installation binds a durable random identity; replicas sharing its database share one slot.

Correlation: A trusted, explicit pairing of a preview with an actual operation, made by marolum exec --correlate or the ingestion API. Never inferred from time or counts.

Coverage: The interval for which Marolum has evidence for a scope: observed sources, earliest retained and latest accepted evidence, retention cutoff, and known gaps. Reading the operation timeline

Custom role: A Business role composed from the permission catalog, never including operations:evidence:write, assigned over local accounts.

D

Destructive: The badge shown when a retained change count is positive for delete, delete-replaced, or replace.

Digest: The sha256:… identity of an image, and the coordinate to deploy by. Tags such as latest can move; a digest cannot.

Deletion history: The durable audit of every completed purge, forget, and retroactive retention action, written by the same transaction that deletes.

E

Edition: Community, Business, Enterprise, or Enterprise Advanced Security. Same image; server-side entitlements differ. Introduction

Engine: The tool that wrote the state a backend holds: pulumi (default), terraform, or opentofu. State observation is verified against Terraform 1.15.9 and OpenTofu 1.12.6; other builds are unverified. Terraform and OpenTofu can write native S3 lock files when locking is enabled, but Marolum does not currently observe them. Backend-native update history remains unavailable for those engines, so lock and update-history observation are Pulumi-only and these backends answer engine-unsupported for both rather than showing empty results.

engine-unsupported: The closed reason a non-Pulumi backend returns for lock and update-history observation.

Evidence: What Marolum retains about operations: assertions from backends and runners, with digests, acceptance times, and the policy revision each was accepted under.

Evidence coverage: The Operations page panel that reports coverage and its banners.

Execution role / task role: On ECS, the role ECS uses to start the task versus the role Marolum runs as. IAM setup on AWS

Export: The versioned evidence document for one stack and one accepted-time window (marolum-operation-history-export, schema version 6). Requires operations:export.

F

Fence: See replay fence.

Finalize: The runner call that ends an operation with succeeded, failed, or cancelled. Runner integration

First-run readiness: The Installation setup panel on Administration → Backends, with seven checks: backend access, persistent storage, backup, evidence coverage, retention, deployment security, runner integration. Your first hour

Forget: The explicit action that retires a disabled backend's replay fences after payload has expired. Previewed, confirmed with a backup attestation, audited.

G

Gated migration: A schema migration classified major, destructive, or long-running. It never runs on an ordinary restart; it needs MAROLUM_SCHEMA_UPGRADE_APPLY and a verified recovery point. Database integration

Gap (continuity gap): A stated break in a resource's transition history, with a closed reason: stack-missing, last-good-only, duplicate-urn, bound-exceeded, projection-diverged, or continuity-expired.

H

Heartbeat: A runner event that extends an operation's five-minute activity lease.

Hold: See legal hold.

I

in progress: The outcome of a runner-announced operation whose lease is live.

incomplete: The outcome when a runner-announced operation's lease expired without a finalize. Marolum never learned how it ended and says so.

Ingestion API: /api/v1/ingestion/…, the bearer-token surface runners submit evidence to. Browser sessions cannot reach it.

Installation: One Marolum deployment sharing one database: a single replica, or Enterprise replicas on PostgreSQL.

Installation ID: The durable random identity a connected license binds to. Shown on Licensing; safe to share; not a credential.

Integration token: A named, scoped, write-only credential (marolum_it_…) carrying exactly operations:evidence:write. Shown once at issuance.

Issuer key: Your permanent 1–64-character name for a federated identity provider registration; appears in URLs and variable names. Federated identity

L

Layout: How Pulumi arranges checkpoints beneath the prefix: project-scoped (.pulumi/stacks/<project>/<stack>.json) or legacy (.pulumi/stacks/<stack>.json). Marolum never guesses. Find your backend details

Lease (activity lease): The five-minute window a runner keeps an operation in progress by heartbeating.

Lease (license lease): The signed, time-bounded document a connected license renews; it can remain valid for up to 21 days (Business) or 67 days (Enterprise) after transfer or reset.

Legal hold: An Enterprise placement that exempts one exact evidence record from expiry, retroactive shortening, purge, and forget. Release requires retention and purge permissions.

Liveness: GET /api/v1/health: the process is up. Use it to restart, not to route.

Lock: An active Pulumi lock on a stack, observed every 60 seconds (every 5 while active). Pulumi-only.

marolum exec: The CLI wrapper that runs a Pulumi command and reports it to Marolum without changing its exit code.

MAROLUM_ALLOW_HTTP: The loopback-only exception that lets a browser keep the session cookie over http://127.0.0.1. Never set off the loopback interface.

M

Marker: The [marolum:v1:<uuid>] token marolum exec appends to an update message so the runner's assertion and the backend record can be joined. The only byte of a message Marolum reads.

Migration: A forward-only, transactional schema change applied at startup. See gated migration and startup-safe.

O

Observation: One immutable, timestamped read of a backend by one of three schedulers: checkpoints (60 s), locks (60 s / 5 s), update history (5 min).

Offline site license: The Enterprise Advanced Security license document (MAROLUM_OFFLINE_SITE_LICENSE_FILE): organization-wide, no outbound calls.

Operation: The source-neutral event a person recognizes as a preview, update, destroy, refresh, import, rename, or resource-import, with an immutable Marolum id and exactly one outcome.

Outcome: succeeded, failed, cancelled, conflict, in progress, or incomplete. unknown exists in the vocabulary but no source produces it. Empty outcomes are invalid.

Ownership lock: The exclusive lock on marolum.db.owner that stops a second SQLite replica from starting (ownership-conflict).

P

Permission: The unit controllers check: backends:read, backends:manage, observations:read, observations:properties:read, operations:read, operations:transcripts:read, operations:export, operations:retention:manage, operations:purge, accounts:manage, integrations:admin, backends:diagnostics:read, storage:health:read, operations:evidence:write. Users and permissions

Prefix: The object-key namespace before an engine's state keys (team/platform puts Pulumi's directory at team/platform/.pulumi/).

Project-scoped: See layout.

Provenance: Where an assertion came from: Pulumi backend, Runner (deployment runner), or Runner (developer workflow). An update with an exact retained Marolum marker joins a runner row to its backend row; both stay listed under their own provenance.

Provisioning mode: How a federated provider maps subjects to accounts: administered (pre-linked) or on-first-login (creates a viewer).

Purge (exact-stack purge): Explicit deletion of one stack's evidence through an accepted-time boundary. Previewed, confirmed, audited.

R

Readiness: GET /api/v1/readiness: 200 after a bounded database query succeeds. Use it to route traffic. It never contacts a backend.

Recovery point: The verified copy of the database Marolum writes beside it before applying a gated migration.

Redaction: Removal of Pulumi-marked secrets from outputs before they reach a browser model, and of recognized patterns from transcripts on the runner and the server. Never claimed to be complete.

Release record: The immutable release.json at https://www.dekglas.com/downloads/marolum/v<version>/release.json: image/platform digests, matching CLI archive, verification metadata and frozen documentation revision. Separate tester and supported-status records distinguish availability without replacing that composition.

Replay fence: The compact, payload-free record left when evidence expires so a pruned source cannot be replayed into history as new. Keyed on backend identity; removed only by forget.

Replica: One running Marolum process. SQLite allows exactly one; Enterprise PostgreSQL allows a declared ceiling. PostgreSQL operations

Resource: One entry in a stack's checkpoint, by URN, type, and logical name.

Resource history: Retained transitions for one resource across observations.

Retention policy: Two installation-wide windows (operation summaries and resource changes), 1–365 days on Community, up to 3,650 on paid editions, defaulting to 90 on a new installation. Changes append a revision and apply prospectively; existing policies are preserved across upgrades.

Role: administrator, viewer, or transcript-reader; or a Business custom role.

Runner: The service or machine that submits evidence with an integration token; the marolum exec wrapper or a direct client.

S

SCIM: Enterprise provisioning of accounts by an identity provider through /api/v1/scim/v2/<issuerKey>, using its own token. Creates viewers only.

Snapshot (stack snapshot): The current, revision-fenced projection of a stack shown in the explorer; a failed read keeps the last available one, labelled.

Stack: The unit of inventory and history. Identity is backend, layout, project (for project-scoped), and stack name.

Stack read scope: A Business grant that narrows one user's retained-history reads to named stacks. Live observation pages stay installation-wide; not tenant isolation.

Startup-safe: The migration class that applies on an ordinary restart and permits a rolling deployment.

Storage health: GET /api/v1/storage-health: write probe, free space, database file sizes, last durable write. Never affects readiness.

Subject (immutable subject): The provider-issued identifier a federated identity is keyed on: OIDC sub, persistent SAML NameID, or the trusted-proxy header. Never an email.

T

Temporal: The label on Operations near this change: an overlap in time between an operation and a resource transition. Never a causal claim.

Tombstone: The bounded record left by an expiry or purge that proves what was deleted and when, without the payload.

Transcript: An optional, encrypted, redacted, bounded capture of a runner's stdout and stderr. Off by default; three opt-ins; read requires transcript-reader.

Transcript-reader: The fixed role adding operations:transcripts:read to the viewer's reads. Administrators do not implicitly hold it.

Transition: One change in a resource's history: baseline, appeared, changed, removed, or reappeared.

Trusted proxy: An Enterprise sign-in path where a proxy you operate authenticates users and forwards an immutable subject with a shared secret.

U

Update history: Pulumi's per-stack record of past updates in the backend. Marolum copies each record it observes into its own store every five minutes; the durable timeline survives the backend's pruning.

V

verifiedAgainst: The part of a composition record listing only the surfaces a release was actually tested against. A test record, not a compatibility promise.

Viewer: The fixed role holding backends:read, observations:read, and operations:read, and nothing administrative.

W

WAL: SQLite's write-ahead log mode, which Marolum uses and which requires host-local locking: the reason network filesystems are unsupported for /data.

Whole-state retention: An opt-in that keeps exact observed state bytes, encrypted with MAROLUM_STATE_KEY_FILE, for separately granted recovery. Turning it on for a backend requires a Business or Enterprise license that includes it. Off by default; can include secrets.