Glossary

The Tend vocabulary, defined once and used everywhere. Terms are alphabetical; each links to the page that covers it in depth.

App CR / App CRD

The single source of truth for one app: a custom resource of kind App in API group tendtech.io/v1alpha1 (CRD apps.tendtech.io) carrying owner, expiry, declared data scopes, purpose classification, environment state, and references to the app's git repo and attestation chain. All platform behavior reconciles from it (Principle IV). See App CRD.

attestation chain

The verifiable record from prompt to production — prompt hash, model identity and version, artifact versions, test results — emitted as in-toto/SLSA attestations, cosign-signed, and stored beside the image in Harbor (Principle III). See the evidence chain.

boundary tier

The customer-chosen inference boundary. Tier 1 (cloud-private): model inference runs against a managed endpoint in the customer's own cloud tenancy and region, reached over public-internet TLS rather than private interconnect. Provider training and response caching are disabled; the provider's abuse-logging retention exemption is a separate manual filing and is recorded as not yet requested. The shipped posture is recorded field by field in deploy/inference/tier1-posture.yaml, and every change to it is a reviewable diff. Tier 2 (self-hosted) is reserved and not exercised: the design is that all inference would run on customer-operated infrastructure with no external model calls, but the tier has never been selected on any installation and no self-hosted serving exists. Only Tier 1 has run. See boundary tiers.

builder adapter

The CLI that turns a prompt into a committed app: it calls the inference gateway, generates the app, and commits to the per-app repo. The builder's only contracts with Tend are: talk to the inference gateway, commit to the app repo, never deploy (Principle VII). Lives in builder/adapter/.

Cilium

The CNI that enforces Tend's network policies, including L7 DNS rules. kindnet and other non-enforcing CNIs cannot substitute for it. The generated-perimeter decision is ADR-0007.

contract-not-code

Principle II: security and governance are enforced at the platform layer — admission policy, network policy, the data gateway — never by reviewing or trusting generated application code. See the governance model.

cost cap

The per-app spending ceiling declared on the App CR (spec.costCap: amount, currency, period; defaulted to 50.00 EUR monthly). The operator drives normal → warning-75 → warning-90 → suspended from OpenCost telemetry; missing telemetry never enforces. See respond to a cost-cap suspension.

data gateway

The sole data path for every app: all data access goes through it, where the declared scope is checked and every access logged. Undeclared access is denied. Runs in tend-system on TCP 8080. See data gateway API.

data scope

One declared data access on the App CR: a name, a source type (synthetic, postgres, or s3 in the v1 baseline; REST and warehouse connectors are follow-ups), and an access level (read or readwrite). See declare and change data scopes.

decisions-about-people flag

The EU AI Act triage marker captured in the app's purpose classification at promotion and surfaced in the estate view. Tend records and surfaces it; it does not adjudicate conformance. Also called the AI Act triage marker. See App CRD.

default-deny

The network floor of every app namespace: with both an ingress and an egress section present, Cilium drops every flow not explicitly allowed — in both directions. Rendered per namespace by the operator (ADR-0007).

estate

The totality of governed apps, answerable at any time: what apps exist, who built them, what data they touch, what they cost — and any of them retirable in one action.

estate portal

The Backstage instance whose software catalog and estate plugin are fed entirely by the estate API (never the Kubernetes API directly): one row/entity per app, single-action suspend/resume/retire/restore, zero external egress. See estate portal & revoked scopes.

estate viewer

The minimal, standalone UI over the estate from the walking skeleton: apps, states, scopes, costs, and evidence. Lives in estate-viewer/ and remains the fallback of the same UI-agnostic contract the estate portal consumes (risk 5). See evidence & estate API.

evidence index

The 003 query surface over all evidence: a single per-app query returns every history category — prompts, models, tests, approvals, deployments, scopes, classification, and data access — with honest degradation when a category has no data. See evidence & estate API.

evidence record

An app's accumulated, queryable history entry set — the material attached to its promotion PR and served by the evidence index. See query an app's evidence.

fail closed

The posture of every non-negotiable gate: when verification cannot complete (for example the registry is unreachable), the request is refused rather than waved through. The attestation gate sets failurePolicy: Fail for exactly this. The single-admission-engine decision is ADR-0006.

frozen

The App lifecycle state for an app whose owner is deactivated past the grace period, whose expiry passed without renewal, or that was just restored from its archive: stopped but not yet archived (Principle V). Causes compose and are recorded on status.lifecycle.freeze; the app unfreezes only once every cause clears. See lifecycle.

gateway-only egress

The complete egress contract of an app namespace: beyond DNS and intra-namespace traffic, exactly three destinations are reachable — the data gateway, the inference gateway, and Keycloak's token endpoint, where an app exchanges its platform-provisioned client credentials for the token it presents to the inference gateway. All three are in tend-system on TCP 8080. No per-source holes, no free-form egress (ADR-0007).

generated perimeter

The per-app network policies the operator renders from the App record at reconcile. Every rendered object carries tendtech.io/generated-by=tend-operator; a hand-written per-app policy is an SC-006 violation: the operator is the only writer of a per-app policy object (ADR-0007).

GitOps

Principle VI: all changes — app code, promotion, platform and policy-baseline updates — flow through git and Argo CD. The builder and end users never deploy directly. See the governance model.

governance depth (003)

The second feature to ship (specs/003-governance-depth/; 002 is a drafted, unbuilt docs-site spec): real enforcement on the 001 spine — the policy baseline, the gateway-only perimeter, the data gateway as sole data path, the evidence index, and cost cap enforcement.

in-toto

The attestation format the evidence chain uses: a signed statement binding a subject (the image digest) to a predicate (the SLSA provenance), checkable with cosign verify-attestation against the image digest.

inference gateway

The builder's only model endpoint: it keeps model I/O in-boundary and attributable, routing to the configured tier. Runs in tend-system on TCP 8080. See inference gateway.

Kyverno

The admission policy engine enforcing the policy baseline — validate, mutate, and verifyImages rules at admission (ADR-0006).

managed operating model

The commercial track where PGT operates Tend inside the customer's boundary. Planned, not built. The intent is one artifact for both models — the distinction being access control and release delivery, never a code fork — with managed operation adding no egress beyond the configured tier (Principles I and VII). Those are the acceptance criteria of unstarted roadmap work; nothing in the platform differs between the two models today.

once per crossing

The cost-warning semantics: the 75% and 90% notifications fire once per threshold crossing per period, not repeatedly while cost oscillates around a threshold. Implemented as warning75At / warning90At timestamps on the App status.

PGT

The 100% Swedish-owned company building Tend, and the operator of record under the managed operating model. Platform and data jurisdiction is customer-controlled; model-endpoint jurisdiction is tier-dependent.

platform-approver group

The Keycloak group (platform-approvers, realm role platform-approver) whose members may approve or reject promotion requests. Approval is the merge of the promotion PR. See promote an app to production.

policy baseline

The versioned, GitOps-delivered set of admission and network policies every app runs under. Every rule ships with a violating manifest rejected in CI (SC-001) — for the admission baseline and for the generated network perimeter alike (ADR-0006, ADR-0007).

Principles I–VII

The constitution's binding invariants: I boundary integrity (NON-NEGOTIABLE), II contract-not-code, III evidence chain (NON-NEGOTIABLE), IV App CRD as single source of truth, V platform-enforced lifecycle, VI GitOps delivery, VII replaceable builder. See the constitution.

projected ServiceAccount token

The app's credential to the data gateway: a short-lived, audience-bound token (tend-data-gateway) mounted by the app pod template. The app never holds a data-source credential. See data gateway API.

promotion PR

The platform-raised pull request that promotes an app from sandbox to production, with the evidence record attached. The user never touches git; approval is the merge by a platform approver, captured in git history and the attestation chain. See promote an app to production.

retired

The App lifecycle state after retirement: stopped, definition and complete evidence record archived into the app's own git repo, resources released. The App CR survives as a tombstone with an archiveRef, restorable by a platform engineer (which re-enters the lifecycle frozen, never running, until an owner-validated renewal). An app frozen past its retention period (the duration of the current uninterrupted freeze) is retired automatically, or immediately via the tendtech.io/retire annotation (Principle V). See lifecycle.

revoked scope

A data-scope name withdrawn platform-wide by a merge to the revoked-scopes GitOps policy baseline — the merge is the single revocation action, git history is the audit trail (Principle VI). The data gateway denies it, Kyverno rejects new declarations of it, and the operator projects it onto every declaring app's status.lifecycle.revokedScopes — no app is redeployed. See estate portal & revoked scopes.

sandbox

The isolated environment every app starts in: synthetic or masked data only, no network route to production, and the same admission gates as production — the attestation gate holds in sandbox too. See lifecycle.

SLSA

Supply-chain Levels for Software Artifacts — the provenance predicate format (https://slsa.dev/provenance/v1) the attestation chain emits and the admission gate verifies, including the Tend promptHash and model fields, checked by the verifyImages rule at admission (ADR-0006).

synthetic data

Generated, non-real data. Sandbox apps use synthetic or masked data exclusively; every new App is admission-defaulted to a single synthetic scope, served through the data gateway.

Tend operator

The Kubernetes operator (operator/) that reconciles everything from the App CR: namespace provisioning, the generated perimeter, resource quotas, discovery config, lifecycle state, and cost enforcement.

Tier 1 / Tier 2

The two boundary tiers — cloud-private and self-hosted. Tier 1 is the default and the only tier that has ever run; Tier 2 is reserved and not exercised. See boundary tier above and boundary tiers.

TokenReview

The Kubernetes API the data gateway uses to validate an app's projected ServiceAccount token, establishing which app is calling before evaluating its scopes. See data gateway API.

verifyImages

The Kyverno rule type behind the attestation gate: it verifies image signatures and attestations at admission and pins images to their verified digest, resolved by the verifyImages rule at admission (ADR-0006).

walking skeleton (001)

The first feature (specs/001-walking-skeleton/): the minimal end-to-end spine — prompt → running sandbox app — with a real version of every component, proven before governance depth was added.