Glossary
This glossary defines the key terms and concepts specific to the Infrastream v2 platform.
A
apiVersion
: The schema version for a manifest file. For all current Infrastream manifests, this value should be lowops.manifests.v1.
ApplicationSet
: A manifest that groups multiple Application or ExternalApplication manifests into a single releaseable unit. All applications within an ApplicationSet are promoted through the ReleaseTrack stages together as a single atomic bundle. Owned by Product or Release Managers.
Agent
: A manifest kind (kind: Agent) that declares an AI agent to be deployed on Vertex AI Agent Engine. The spec names a buildDefinition (a BuildDefinition with type: AGENT), a target project, and an accessControl block that enforces least-privilege access to databases, secrets, and Pub/Sub topics. The engine separately, automatically provisions the agent's runtime identity — see Managed Authentication. See Agent Manifest Reference.
AgentDeploymentConfig
: A manifest kind that pins an Agent to a specific version per environment (development, integration, production). Follows the same versioning strategy as standard DeploymentConfig manifests. See Agent Deployment Config.
Agent Infrastructure as Code (AIaC) : The practice of managing the substrate an AI agent depends on — identity, context, capability, execution, evaluation, security, and observability — as declarative, version-controlled configuration rather than hand-rolled plumbing. In Infrastream, this substrate is delivered through manifest fields and automatic engine behavior. See The Agentic Development Platform.
Agentic Development Platform (ADP) : A platform, built and run by platform engineering, that provides the paths, interfaces, and guardrails allowing both humans and AI agents to work reliably at the autonomy levels the organization sets. An evolution of the Internal Developer Platform (IDP), it treats an agent as simply another type of user. Infrastream is an ADP built on Google Cloud. See The Agentic Development Platform.
Agentic Governance : Infrastream's framework for governing AI agent infrastructure and identity using the same manifest-driven workflow as every other GCP resource. Agents declare their capabilities and access boundaries in typed manifests; Git PRs enforce human oversight; managed identity and 3-legged authorization control who the agent acts as; the engine provisions and audits everything deterministically. The governance layer of Infrastream's ADP. See Agentic Governance.
B
BuildDefinition
: A manifest that defines how to build a container image from source code. Specifies the project type (e.g., Go, Java, Node.js), containerization settings, and build parameters. The platform uses this to auto-generate CI workflows (GitHub Actions) for building, testing, and publishing the application.
C
Conventional Commits
: A standardized commit message format (e.g., feat:, fix:, docs:) used by the platform's automatic versioning system. The commit prefix determines the version bump type: feat → minor, fix → patch, feat! → major.
Core Project : A special, singleton Google Cloud project within an Infrastream organization that acts as the central hub for shared services. It hosts the core Infrastream Engine execution environment, the Spanner State Ledger, manages the Shared VPC network hub, and contains platform-level resources like central Artifact Registries. It is opaque to end-users to allow for rapid rehydration and disaster recovery.
D
Declarative Configuration : The core philosophy of Infrastream, where users define the desired state of their infrastructure in Manifests (the "what"), rather than writing procedural scripts to achieve that state (the "how").
DeploymentConfig
: A manifest that provides environment-specific runtime settings for an Application or ExternalApplication. Contains the version to deploy, environment variables, scaling parameters, and health check configuration. The metadata.name must match the parent application's name.
E
Embedded FinOps : Treating cloud and AI cost as a provisioning-time primitive enforced by design — per-environment budgets, model and quota ceilings, usage attribution, and hibernation declared alongside the infrastructure — rather than a quarterly report. One of the five pillars of Platform Engineering 2.0. See Business Impact.
Engine (The Engine) : Pvotal's own core, high-performance execution runtime (written in Go). It reads Manifests, resolves dependencies in memory, and translates them directly into Cloud Provider API calls — with no intermediate provisioning tool or external state engine.
ExternalApplication
: A manifest that defines an application whose container image is built and stored externally (outside the platform's CI system). Unlike Application, which references a BuildDefinition, an ExternalApplication references an ExternalRegistry for its image source.
H
harness : The surrounding structure that determines an AI agent's reliability — rule files, sandboxes, guardrails, identity, and evaluation — as distinct from the model itself. The central insight is that agent quality is set by the harness, not the model. Infrastream is the infrastructure harness: typed manifests, managed identity, PR-gated review, and deterministic execution. See Agentic Governance.
High Privilege Access Management (HPAM)
: A core governance benefit of Infrastream. The platform replaces traditional, manual, and often opaque HPAM systems with a declarative, GitOps-based workflow. All requests for privileged access (e.g., adding a project administrator) are handled via version-controlled pull requests, which are subject to a formal, auditable approval process driven by CODEOWNERS rules.
J
JIT Graph Resolution
: Just-In-Time resolution. The process where the Engine parses all user Manifests, builds a directed acyclic graph (DAG) in memory using gonum/graph, and uses Promises to pass output variables (like an IP address or a generated ID) directly from one executing resource to another in a single pass.
M
Manifest : A declarative YAML file that represents the desired state of a resource or a logical component within the Infrastream platform. Manifests are the primary interface for all platform users.
Managed Authentication
: Infrastream's automatic provisioning and upkeep of an AI agent's runtime identity: scoped IAM grants (e.g. registry discovery, network egress) and proactively refreshed, audience-scoped ID tokens. Unlike manifest fields, this is engine behavior performed for every Agent resource — no team configures it by hand. See Authentication, Managed by Default.
Manifest Driven Secure Execution (MDSE) : The official term for the Infrastream workflow. It describes the end-to-end process of users defining their desired state in Manifests, which then drives a secure and automated execution pipeline to realize that state in the cloud.
McpConfig
: A manifest kind (kind: McpConfig) that declares an MCP (Model Context Protocol) server deployed on Cloud Run, under the same typed governance as Agent. References a BuildDefinition by name (spec.buildDefinition, required) for its container image, and an ApplicationAccessControlConfig for its permissions. See MCP Config Reference.
McpDeploymentConfig
: A manifest kind that pins an McpConfig to a specific version per environment. See Mcp Deployment Config.
MCP (Model Context Protocol)
: An open standard that provides a structured interface for AI agents to invoke tools. Infrastream governs MCP server deployment via the McpConfig/McpDeploymentConfig manifest kinds.
metadata Block
: A top-level block in every manifest that defines the resource's identity and its location within the organizational hierarchy. It contains fields like name and the names of parent manifests (e.g., project, organization). The fields use kebab-case.
MetaGroup : A virtual logic node inside the execution graph. MetaGroups enforce strict execution boundaries (transparent gating) by ensuring that an entire group of resources (like an Organizational Unit) finishes provisioning before any of its children (like Projects) begin.
P
Path : The unit of operation in an Agentic Development Platform. A path is deterministic (pipeline-driven and repeatable — the Infrastream engine), probabilistic (agent/LLM-driven — an agent generating manifests from intent), or hybrid (a probabilistic step followed by a deterministic gate, looped until it passes — an agent's manifest passing schema validation, PR review, and engine reconciliation). See The Agentic Development Platform.
Platform Engineering 2.0 : The purposeful evolution of platform foundations to serve AI-era demands, organized around five pillars: AI-Native Platform, Multipersona Experience, Embedded FinOps, Security Shifts Down, and Composable By Design. Infrastream is its concrete embodiment on Google Cloud. See Platform Engineering 2.0.
PreRelease
: A deployment track that validates individual application changes in isolation. Triggered automatically when a CI build publishes a new version. PreRelease deployments are per-application (not bundled) and deploy through the preReleaseStages defined in the ReleaseTrack.
Promises / Inputs : The strongly-typed concurrency mechanism used by the Engine to manage dependencies. When a downstream resource needs data from an upstream resource that hasn't been created yet, the Engine injects a Promise. The downstream resource waits for the Promise to resolve before executing.
R
Release
: A deployment track that promotes a complete, bundled set of applications through the releaseStages defined in the ReleaseTrack. Initiated manually by a Release Manager. All applications in the ApplicationSet are version-locked using immutable Release Candidate tags.
Release Candidate (RC)
: An immutable container tag created in Artifact Registry when a Release is initiated. The RC tag points to a specific image digest, ensuring that every environment in the pipeline deploys the exact same binary. Format: <appSet>-<bundle>-rc.<N> (e.g., infrastream-cloud-2026.11-rc.0).
ReleaseTrack
: A manifest that defines the complete multi-stage deployment and promotion strategy for an ApplicationSet. Specifies preReleaseStages, releaseStages, and optional hotfixStages, each listing the environments that code must pass through. Owned by the Platform/SRE team.
Runner
: A Go struct that implements the plugin.Runnable interface. A Runner encapsulates the complete lifecycle (Plan, Create, Update, Delete) of a specific physical cloud resource and handles the direct API interactions with the cloud provider.
S
Secure Agent Sandbox
: The combination of Agent manifest accessControl blocks, Managed Authentication, CODEOWNERS-enforced PR review, and the deterministic engine that creates an isolated execution boundary for AI agents. Agents can only access the databases, secrets, and Pub/Sub topics explicitly declared in their manifest, can only act with the identity the engine grants them, and can only act as a specific person with that person's 3-legged consent.
Shared VPC : The networking model used by Infrastream. The Core Project hosts the central VPC network (the "hub"), and all other service projects (the "spokes") are granted access to dedicated subnets within this central VPC. This allows for centralized network control, security policy enforcement, and traffic auditing.
Spanner State Ledger : The Google Cloud Spanner database used by Infrastream to store infrastructure state. Rather than a single flat state file, the Spanner Ledger is an append-only, temporally-aware database that records every change with millisecond precision, enabling immediate rollbacks and preventing write-hotspotting at scale.
spec Block
: A top-level block in a manifest that contains the user-configurable settings for the resource. The fields within this block use camelCase.
StorableNode : The core data contract for any element in the execution graph (Manifests, Runners, MetaGroups) that can be serialized and persisted to the Spanner State Ledger.
T
Three-Legged (3-Legged) Authorization : An authorization pattern in which an AI agent acts on behalf of a specific, consenting end user rather than under its own service identity or a shared bot credential. Built on Google's Agent Development Kit (ADK) credential-request flow, the agent pauses at the point of action, requests the user's consent scoped to that one action, and receives a short-lived token — never a standing credential. Distinct from Managed Authentication, which governs the agent's own identity. See Authentication, Managed by Default.
Trunk-Based Development
: A branching strategy where all development merges directly into main (the "trunk"), with long-lived release branches that snapshot a tag for post-release maintenance. Infrastream supports this as one of three branching strategies (GITHUB_FLOW, GIT_FLOW, TRUNK_BASED), sitting as a middle-ground between GitHub Flow and Git Flow.
V
Vertex AI Agent Engine
: A Google Cloud managed runtime (also referred to as the Reasoning Engine) for deploying and executing AI agents, paired with Agent Registry for discovery. One of the most recent additions to Vertex AI. Infrastream provisions agents to this runtime via the Agent manifest kind, with the engine handling scaling, lifecycle, and Managed Authentication — Pvotal migrated its own production agents to this runtime before offering it as a manifest field.