Tighten product-name linting: fix retired-name copy, sharpen the DeprecatedProductNames rule

[workprentice]

Scoping note

Issue #20653 ("Product and feature name linting and validation") is filed as a one-line pointer at a now-closed draft PR that never implemented anything. It is under-specified, so this PR makes an explicit scoping call rather than attempting the whole enhancement: the repo already has a Vale-based product-name linting layer (styles/Pulumi/Nomenclature.yml for canonical casing, styles/Pulumi/DeprecatedProductNames.yml for the retired "Pulumi Service" name). That existing layer just isn't trustworthy enough to promote from a nag (make lint-prose, which always exits 0) to a real gate, because roughly two-thirds of its findings are false positives. This PR fixes the content, sharpens the rule, and reports what it deliberately left alone — treat it as one slice of #20653, not the whole thing.

What changed

Content (13 sites across 12 files): replaced the retired "Pulumi Service" / "Pulumi UI" names with the current product name, chosen per-site from neighboring copy rather than a blanket find/replace:

• Pulumi Cloud for the ESC/Deployments OIDC "grant access to your Pulumi service" family (esc/guides/configuring-oidc/{vault,aws,gcp}.md, deployments/guides/oidc/gcp.md), the SCIM meta_desc, and the OpenSearch admin copy (administration/self-hosting/components/search.md).
• Pulumi Cloud console for idp/concepts/_index.md's "Pulumi UI" (explicitly disallowed by the brand guide) — its sibling phrase "Pulumi services" (the IDP Services concept) is left untouched, it isn't the same thing.
• Pulumi Self-Hosted container images / Pulumi Cloud containers for the self-hosting family (airgapped.md and the five deployment-options/*.md "update the Pulumi Service containers" pages), matching how neighboring lines in the same pages already say "the Pulumi Cloud."

styles/Pulumi/DeprecatedProductNames.yml: the existence rule's token was \bPulumi Service\b with ignorecase: true, which also matched "Pulumi Service Provider" / "Pulumi Service provider" — the still-current name of the pulumi-pulumiservice Terraform/Pulumi provider (its upstream repo, registry package pulumiservice, and this site's own esc/integrations/pulumi-service-provider.md all still use that name; renaming it is a product/IA decision with URL-alias consequences, out of scope here). Added a negative lookahead so the rule stops flagging the provider name: \bPulumi Service\b(?!s\b)(?!\s+provider\b). Verified empirically that Vale 3.14.1 accepts this RE2-syntax lookahead. Also corrected the rule's own header comment, which asserted "the 'Pulumi Service provider' is now the 'Pulumi Cloud provider'" — that's not true; the provider still ships under its historic name.

styles/Pulumi/Nomenclature.yml: added '\bPulumi UI\b': Pulumi Cloud console, grounded in the brand guide's explicit list of canonical product names (which disallows "Pulumi UI").

Measured evidence

Ran Vale 3.14.1 over content/docs/ with a throwaway config (BasedOnStyles = Pulumi) before and after this change:

• Pulumi.DeprecatedProductNames: 54 → 6 findings. The 6 remaining are deliberately out of scope (see below), not oversights.
• Pulumi.Nomenclature: 171 → 171 (the one "Pulumi UI" occurrence in content/docs/ was fixed as a direct content edit, not left for the new rule to catch at review time).
• Zero new findings introduced anywhere in content/docs/ across all rules.
• make lint (markdownlint + prettier) passes; pre-commit hooks (lint-staged) also ran clean on commit.

Deliberately deferred (not fixed here)

• content/docs/support/pulumi-cloud-faq.md:183 — inside PR Add Pulumi Cloud edition markers to docs #20560's ("Add Pulumi Cloud edition markers") active diff hunk (lines 137-205); editing it here would create a merge conflict.
• content/docs/iac/get-started/{aws,azure,gcp,kubernetes}/deploy-stack.md image alt text ("as shown in the Pulumi Service") — inside PR Trim the Getting Started guides and rename the StaticPage component #20360's ("Trim the Getting Started guides") rewrite hunks, same reason.
• content/docs/iac/cli/commands/pulumi_stack_webhook_delivery_redeliver.md — auto-generated from the Pulumi CLI's own help text (github.com/pulumi/pulumi/v3/pkg/cmd/pulumi/markdown); fixable only upstream in the CLI repo, not here.
• content/blog/** — legitimately uses the period-correct "Pulumi Service" name in posts from before the 2022 rename; make lint-prose's default scope is already content/(docs|blog), so leaving these alone is a judgment call, not a gap: rewriting historical blog copy to a name that didn't exist yet would be revisionist.
• content/case-studies/imagine-learning.md — 2 more "Pulumi UI" hits, one of them inside a verbatim customer quote (should never be edited) and neither reachable by prose lint anyway, since lint-prose.sh's default scope is content/(docs|blog), not content/case-studies.

Both deferred content/docs/ cases will surface to whoever lands #20560/#20360, since lint-prose.sh runs against files changed vs. master by default — that's the intended safety net, not something this PR needs to chase down.

Rules considered and rejected (with the evidence)

• Pulumi Copilot → Pulumi Neo substitution: rejected. Only 1 hit in content/docs/ and it's correct as written (describes the legacy Copilot conversation API/VS Code extension while pointing readers to Neo); 28 content/blog/** files also legitimately use the period-correct name. A substitution rule here would be pure false positives.
• CrossGuard as a deprecated/retired term: rejected. 324 live hits across content/ — this is not a dead term in this repo and renaming it is a product decision, not a lint fix.
• First-mention enforcement (e.g., require "Pulumi ESC" before any bare "ESC") as a Vale conditional rule: rejected for v1. 29 files under content/docs/ use bare "ESC" without ever expanding it on that page, and "ESC" collides with unrelated meanings (the Escape key, the retired esc CLI binary). Flagging as a follow-up idea for a maintainer to weigh, with the count, rather than shipping code for it.
• Pulumi Enterprise: not retired, it's a live pricing-tier name — no rule added.
• Additional lowercase-variant substitutions beyond what's already in Nomenclature.yml (e.g. pulumi neo, pulumi insights): the existing rule already covers these, and the remaining raw-text hits are literal CLI syntax (pulumi neo, pulumi insights account scan list) inside code spans that Vale already skips.

What this PR deliberately does not touch

No changes to .vale.ini, STYLE-GUIDE.md, AGENTS.md, styles/Pulumi/HeadingSentenceCase.yml, .claude/**, or any .github/workflows/** file. Two other open PRs are actively working in exactly those files (#20663, tiering Vale findings into pre-merge review blockers; #20664, brand-voice consolidation), and this PR is scoped to stay clear of both. If anything, this PR is complementary to #20663: making Pulumi.DeprecatedProductNames precise (54 → 6, with the 6 remainders explained rather than noise) is a prerequisite for trusting it enough to tier as a blocker.

---

🧠 This PR was created by workprentice.

[github-actions]

Pre-merge Review — Last updated 2026-08-04T14:43:15Z

Tip

Summary: This is a terminology-hygiene PR across 13 docs pages plus two Vale style rules: it replaces the retired "Pulumi Service" / "your Pulumi service" / "Pulumi UI" product names with the current ones ("Pulumi Cloud", "Pulumi Cloud console", "Pulumi Self-Hosted container images"), sharpens DeprecatedProductNames so it stops flagging the legitimately-named pulumi-pulumiservice "Pulumi Service Provider", and adds a Pulumi UI → Pulumi Cloud console substitution to Nomenclature. The wrongness that would matter to a reader here is a rename that changes the meaning of a sentence — e.g. swapping in "Pulumi Cloud" where the text actually refers to the self-hosted service, or renaming a UI element/product that doesn't exist under the new name — and, on the lint side, a regex whose exemption is either broader than intended or silently non-functional. Passes run: fact verification of the touched sentences and their surrounding procedures against the pulumi-self-hosted-installers READMEs and the pages themselves, a Vale-rule regex sanity check (lookaheads are already used elsewhere in styles/, so the negative-lookahead syntax is supported and the "Pulumi Service Provider" exemption behaves as documented), a repo sweep for names the new rules will now match, cross-sibling reads in the three affected page families, frontmatter/alias validation (clean), and Vale.

Review confidence:

Dimension	Level	Notes
mechanics	HIGH
facts	HIGH
cross-sibling consistency	MEDIUM	Read the 3 dispatched siblings; the deployment-options family has 6 peers, of which only eks-hosted.md and quickstart-docker-compose.md were read.
lint rules	HIGH	Both regexes verified by inspection; negative lookaheads are already in use in styles/, so the syntax is supported.

Investigation log

• Cross-sibling reads: 3 of 3 siblings
• External claim verification: 29 of 37 claims verified (1 unverifiable, 0 contradicted) · 4 specialists (numerical, cross-reference, capability, framing); 0 cross-specialist corroborations · routed: 0 inline, 36 Pass 1, 0 Pass 2, 1 Pass 3 (verified 1, contradicted 0, unverifiable 0).
• Cited-claim spot-checks: not run (no cited claims)
• Frontmatter sweep: ran on body + meta_desc
• Temporal-trigger sweep: ran (recency words present in diff; spot-check in-review)
• Code execution: not run (no static/programs/ change)
• Code-examples checks: not run (no fenced code blocks in content files)
• Editorial-balance pass: not run (not under content/blog/)

🚨 Outstanding	⚠️ Low-confidence	💡 Pre-existing	✅ Resolved
0	8	2	0

🔍 Verification trail

37 claims extracted · 29 verified · 1 unverifiable · 0 contradicted

• L3 in content/docs/administration/access-identity/scim/_index.md "This page provides an overview of how to configure any SCIM 2.0 identity provider with Pulumi Cloud." → ➖ not-a-claim (evidence: The claim text is verbatim the page's own meta_desc frontmatter field, describing what the page itself covers ("This page provides an overview of how to configure any SCIM 2.0 identity provider with Pulumi Cloud."). This is a faithful se…; source: repo:content/docs/administration/access-identity/scim/_index.md)
• L64 in content/docs/administration/self-hosting/airgapped.md "A private container registry is required to store Pulumi Self-Hosted container images for deployment in an air-gapped environment." → ➖ not-a-claim (evidence: The line is part of the doc's own list of infrastructure prerequisites for self-hosted air-gapped deployment: "A Private Container Registry: Required to store Pulumi Self-Hosted container images for deployment." This is Pulumi's own docu…; source: repo:content/docs/administration/self-hosting/airgapped.md)
• L53 in content/docs/administration/self-hosting/components/search.md "Pulumi Cloud automatically triggers the OpenSearch cluster to reindex resource search results on a weekly basis." → ✅ verified (evidence: (escalated from pass1) The Pulumi self-hosting docs page for the search component states: "The Pulumi service automatically triggers the OpenSearch cluster to reindex resource search results on a weekly basis."; source: https://www.pulumi.com/docs/administration/self-hosting/components/search/)
• L61-63 in content/docs/administration/self-hosting/components/search.md "It can be useful to run a manual backfill when an OpenSearch cluster is first added to the Pulumi Cloud configuration." → ✅ verified (evidence: The same doc states the service auto-indexes existing resources when first connected to a valid OpenSearch config (L24), and describes a manual "Reindex search cluster" backfill button for admins (L57-59). The claim that running a manual b…; source: repo:content/docs/administration/self-hosting/components/search.md)
• L61-63 in content/docs/administration/self-hosting/components/search.md "Running a manual backfill can help bring things back in sync in case of operational issues." → ➖ not-a-claim (evidence: The claim paraphrases the same doc's own text: "It can be useful to run a manual backfill when an OpenSearch cluster is first added to the Pulumi Cloud configuration, or to bring things back in sync in case of operational issues." This is…; source: repo:content/docs/administration/self-hosting/components/search.md)
• L61-63 in content/docs/administration/self-hosting/components/search.md "The backfill operation iterates over all Pulumi stacks, finds their latest checkpoints, and indexes the resources." → 🤷 unverifiable (evidence: The claim describes internal implementation behavior of Pulumi Cloud's closed-source backfill/reindex service (pulumi-service repo, which is private). The docs page itself states: "The backfill operation iterates over all Pulumi stacks, fi…; source: content/docs/administration/self-hosting/components/search.md)
• L46 in content/docs/administration/self-hosting/deployment-options/aks-hosted.md "The Pulumi self-hosted installer's README file (at https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/aks-hosted/README.md) documents how to s…" → ✅ verified (evidence: The README at pulumi/pulumi-self-hosted-installers/aks-hosted/README.md contains the line: "pulumi config set imageTag {imageTag} - Image tags are available on Docker Hub: pulumi/service",…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/aks-hosted/README.md)
• L46 in content/docs/administration/self-hosting/deployment-options/aks-hosted.md "When deploying the Service, it is recommended to pin the Pulumi Cloud image tag to a specific version." → ✅ verified (evidence: The installer README (pulumi/pulumi-self-hosted-installers, aks-hosted/README.md) requires setting an explicit imageTag config value: "pulumi config set imageTag {imageTag} - Image tags are available on Docker Hub: [pulumi/service](https…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/aks-hosted/README.md)
• L48 in content/docs/administration/self-hosting/deployment-options/aks-hosted.md "To update the Pulumi Cloud containers to use a different version, the documented procedure is to run pulumi login to the DIY backend chosen when installing t…" (also L50-51) → ✅ verified (evidence: The doc at those lines states verbatim: "pulumi login to the DIY backend as chosen above when installing the self-hosted service." and "pulumi config set imageTag {image tag} to set the version you want to use." matching the claim's de…; source: repo:content/docs/administration/self-hosting/deployment-options/aks-hosted.md)
• L50 in content/docs/administration/self-hosting/deployment-options/aks-hosted.md "pulumi login is used to log in to the DIY backend chosen when installing the self-hosted service." → ✅ verified (evidence: The doc itself establishes the DIY backend setup earlier ("use the Pulumi CLI with a DIY backend (e.g., S3) to deploy all services... Login to Azure Blob Storage Backend") and pulumi login is the standard Pulumi CLI command used to authe…; source: repo:content/docs/administration/self-hosting/deployment-options/aks-hosted.md)
• L51 in content/docs/administration/self-hosting/deployment-options/aks-hosted.md "pulumi config set imageTag {image tag} sets the version of the Pulumi Cloud container image to use." → ✅ verified (evidence: The AKS-hosted installer README (pulumi/pulumi-self-hosted-installers, aks-hosted/README.md) instructs: "pulumi config set imageTag {imageTag} - Image tags are available on Docker Hub: pulumi/service", confirming imageTag is the config pro…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/aks-hosted/README.md)
• L46 in content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md "The installer's README file, located at https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/byo-infra/README.md, describes how to set the `imag…" → ✅ verified (evidence: The README at pulumi/pulumi-self-hosted-installers byo-infra/README.md contains the step: "pulumi config set imageTag {imageTag} - use "latest" or find the latest tag to pin to here: https://hub.docker.com/r/pulumi/service", confirming i…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/byo-infra/README.md)
• L46 in content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md "When deploying the Pulumi Cloud, it is recommended to pin the image tag to a specific version." → ✅ verified (framing: README presents pinning as one option (or "latest"); docs page states it as the recommended practice, which is consistent with and supported by the README's gu…; evidence: The installer README (byo-infra/README.md) explicitly instructs: "pulumi config set imageTag {imageTag} - use "latest" or find the latest tag to pin to here: https://hub.docker.com/r/pulumi/service", confirming the doc's recommendation t…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/byo-infra/README.md)
• L48 in content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md "To update the Pulumi Cloud containers to use a different version, you must run pulumi login to the self-managed backend chosen when installing the self-hoste…" → ➖ not-a-claim (evidence: This is a paraphrase of the doc's own instructional step: "pulumi login to the self-managed (not self-hosted) backend as chosen above when installing the self-hosted service." It describes the documented procedure for this installer's ow…; source: repo:content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md L50)
• L50 in content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md "pulumi login is used to log in to the self-managed (not self-hosted) backend as chosen when installing the self-hosted service." → ✅ verified (evidence: The doc itself states: "pulumi login to the self-managed (not self-hosted) backend as chosen above when installing the self-hosted service." This is consistent with the earlier section "Pulumi deploying Pulumi" which explains the install…; source: repo:content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md)
• L51 in content/docs/administration/self-hosting/deployment-options/byo-infra-hosted.md "Running pulumi config set imageTag {image tag} sets the version of the Pulumi Cloud containers you want to use." → ✅ verified (evidence: The pulumi-self-hosted-installers byo-infra README instructs: "pulumi config set imageTag {imageTag} - use "latest" or find the latest tag to pin to here: https://hub.docker.com/r/pulumi/service" as part of deploying the 03-application…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/byo-infra/README.md)
• L66 in content/docs/administration/self-hosting/deployment-options/ecs-hosted.md "The installer's README at https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/ecs-hosted describes how to set the imageTag configuration prop…" → ✅ verified (framing: The claim links to the ecs-hosted directory (which lacks a root README but contains go/ and ts/ subdirectory READMEs); the actual imageTag documentation lives…; evidence: The linked GitHub tree (pulumi/pulumi-self-hosted-installers/tree/master/ecs-hosted) contains ts/README.md and go/README.md, and the go README explicitly documents: "imageTag - Specific Pulumi docker container image tag to be used for depl…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/ecs-hosted/go/README.md)
• L66 in content/docs/administration/self-hosting/deployment-options/ecs-hosted.md "When deploying the Pulumi Cloud, it is recommended to pin the image tag to a specific version." → ✅ verified (evidence: The doc itself describes the imageTag configuration property mechanism ("pulumi config set imageTag {image tag}") used to pin/update the Pulumi Cloud container version, which directly supports the practice of pinning to a specific versio…; source: repo:content/docs/administration/self-hosting/deployment-options/ecs-hosted.md L66-72)
• L68 in content/docs/administration/self-hosting/deployment-options/ecs-hosted.md "To update the Pulumi Cloud containers to use a different version, you must: log in via pulumi login to the self-managed (not self-hosted) backend chosen duri…" (also L70-71) → ✅ verified (evidence: The pulumi-self-hosted-installers ecs-hosted README confirms this exact workflow: it instructs users to pulumi login to their Self-Managed Backend (e.g. pulumi login s3://<bucket-name>), and lists imageTag as a required configuration…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/ecs-hosted/go/README.md)
• L70 in content/docs/administration/self-hosting/deployment-options/ecs-hosted.md "The pulumi login command is used to log in to the self-managed backend as chosen when installing the self-hosted service." → ✅ verified (evidence: The doc itself states: "pulumi login to the self-managed (not self-hosted) backend as chosen above when installing the self-hosted service." This matches standard, well-documented Pulumi CLI behavior where pulumi login <backend-url> lo…; source: repo:content/docs/administration/self-hosting/deployment-options/ecs-hosted.md (L70))
• L71 in content/docs/administration/self-hosting/deployment-options/ecs-hosted.md "The command pulumi config set imageTag {image tag} sets the version of the Pulumi Cloud containers to use." → ✅ verified (evidence: The ECS-hosted installer's README (ecs-hosted/ts/README.md) lists imageTag - Specific Pulumi docker container image tag to be used for deployment. Note: Existing ECR repo w/ Pulumi images (api, ui, migrations) is required. This confirms…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/ecs-hosted/ts/README.md)
• L45 in content/docs/administration/self-hosting/deployment-options/gke-hosted.md "The installer's README file, located at https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/gke-hosted/README.md, documents how to set the ima…" → ✅ verified (evidence: The README at pulumi/pulumi-self-hosted-installers/gke-hosted/README.md (03-application deploy steps) contains the line: 'pulumi config set imageTag {imageTag}` - use "latest" or find the latest tag to pin to here: https://hub.docker.co…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/gke-hosted/README.md)
• L45 in content/docs/administration/self-hosting/deployment-options/gke-hosted.md "When deploying the Pulumi Cloud, it is recommended to pin the image tag to a specific version." → ✅ verified (evidence: The same doc section describes an imageTag configuration property used specifically to set/pin the deployed Pulumi Cloud container version, and gives explicit update steps (pulumi config set imageTag {image tag}) for changing versions…; source: repo:content/docs/administration/self-hosting/deployment-options/gke-hosted.md (lines 43-51))
• L47 in content/docs/administration/self-hosting/deployment-options/gke-hosted.md "To update the Pulumi Cloud containers to use a different version, you must run pulumi login to the self-managed (not self-hosted) backend as chosen when inst…" (also L49-50) → ✅ verified (evidence: The pulumi-self-hosted-installers GKE README confirms this exact workflow: it instructs using a self-managed backend (e.g. GCP storage) via pulumi login, and setting the version with `pulumi config set imageTag {imageTag} - use "latest"…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/gke-hosted/README.md)
• L57 in content/docs/administration/self-hosting/deployment-options/local-docker.md "The installer's README file, located at https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/local-docker/README.md, describes how to set the im…" → ✅ verified (evidence: The README at pulumi/pulumi-self-hosted-installers master/local-docker/README.md contains the line "pulumi config set imageTag {imageTag} - see https://hub.docker.com/orgs/pulumi for the available tags..." in the Setup section, and again…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/local-docker/README.md)
• L57 in content/docs/administration/self-hosting/deployment-options/local-docker.md "When deploying Pulumi Cloud, it is recommended to pin the image tag to a specific version." → ✅ verified (evidence: The linked installer README confirms the imageTag config property requires selecting a specific tag: "pulumi config set imageTag {imageTag} - see https://hub.docker.com/orgs/pulumi for the available tags. Pick the latest tag in the form of…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/local-docker/README.md)
• L59 in content/docs/administration/self-hosting/deployment-options/local-docker.md "Updating the Pulumi Cloud containers to a different version is done by running pulumi login to the self-managed backend and then pulumi config set imageTag…" (also L61-62) → ✅ verified (framing: Source splits setup (pulumi login) and upgrade (config set imageTag + pulumi up) into distinct sections; claim's combined three-step sequence is a valid narrow…; evidence: The pulumi-self-hosted-installers local-docker README confirms this workflow: initial CLI setup requires pulumi login --local(or other self-managed backend) andpulumi config set imageTag {imageTag}`, and the "Upgrades" section states:…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/local-docker/README.md)
• L61 in content/docs/administration/self-hosting/deployment-options/local-docker.md "The pulumi login command is used to log in to the self-managed (not self-hosted) backend as chosen when installing the self-hosted service." → 🤝 matches (evidence: The same doc establishes at line 40: "one uses the Pulumi CLI with a self-managed backend (e.g. an s3-compatible object store) from the Docker environment server to deploy the Service containers" and line 45-46 instructs logging into that…; source: repo:content/docs/administration/self-hosting/deployment-options/local-docker.md)
• L62 in content/docs/administration/self-hosting/deployment-options/local-docker.md "The command pulumi config set imageTag {image tag} sets the version to use for the Pulumi Cloud containers." → ✅ verified (evidence: The pulumi-self-hosted-installers local-docker README confirms: "To upgrade: 1. pulumi config set imageTag {imageTag} 1. pulumi up" and earlier notes the imageTag config sets which Docker image version (tag) to deploy, matching the doc…; source: gh api repos/pulumi/pulumi-self-hosted-installers/contents/local-docker/README.md)
• L68 in content/docs/deployments/guides/oidc/gcp.md "In the Google Cloud service account creation flow, the 'Grant this service account access to project' section is where you select role(s) that provide the rele…" → ➖ not-a-claim (evidence: The doc line reads: "In the Grant this service account access to project section, select the role(s) that provides the relevant access to Pulumi Cloud. Then click Continue." This is a faithful restatement of the guide's own step-by-step in…; source: repo:content/docs/deployments/guides/oidc/gcp.md)
• L44-46 in content/docs/esc/guides/configuring-oidc/aws.md "In the AWS IAM console's Web identity section, you select 'api.pulumi.com/oidc' under Identity provider." → ✅ verified (evidence: The doc itself states: 'In the Web identity section: * Select api.pulumi.com/oidc under Identity provider. * Select the name of your Pulumi organization under Audience.' This matches the claim exactly, and is consistent with the identity…; source: repo:content/docs/esc/guides/configuring-oidc/aws.md)
• L47-48 in content/docs/esc/guides/configuring-oidc/aws.md "In the AWS IAM console's 'Add permissions' page during OIDC role setup, the user selects the permissions they want to grant to Pulumi Cloud, then clicks 'Next'." → ➖ not-a-claim (evidence: Line 47 of the doc reads: "On the Add permissions page, select the permissions that you want to grant to Pulumi Cloud. Then click Next." This is a procedural instruction describing the standard AWS IAM console UI flow (explicitly noted in…; source: repo:content/docs/esc/guides/configuring-oidc/aws.md)
• L53 in content/docs/esc/guides/configuring-oidc/gcp.md "In the Google Cloud service account creation flow, the 'Grant this service account access to project' section is where you select the role(s) that provide the…" → ➖ not-a-claim (evidence: The claim is a paraphrase of the doc's own step-by-step instructions: "In the Grant this service account access to project section, select the role(s) that provides the relevant access to Pulumi Cloud." This is a description of a standard…; source: repo:content/docs/esc/guides/configuring-oidc/gcp.md)
• L57 in content/docs/esc/guides/configuring-oidc/vault.md "The <subject-identifier> placeholder in the Vault OIDC configuration refers to the subject identifier of Pulumi Cloud requesting access." → ✅ verified (evidence: The doc itself states in the "Where:" list: "<subject-identifier> is the subject identifier of Pulumi Cloud requesting access" — this is a direct, accurate transcription of the JWT token field description in the same document (the sub…; source: repo:content/docs/esc/guides/configuring-oidc/vault.md)
• L38 in content/docs/idp/concepts/_index.md "Users can model their infrastructure using Pulumi services, which are logical groupings of Pulumi entities such as stacks and ESC environments." → ✅ verified (evidence: The sibling docs page content/docs/idp/concepts/services.md states verbatim: "Pulumi Services are logical groupings of Pulumi entities such as stacks and ESC environments." This directly corroborates the claim's description of Pulumi servi…; source: repo:content/docs/idp/concepts/services.md)
• L38 in content/docs/idp/concepts/_index.md "Users can adjust configuration and redeploy stacks directly from the Pulumi Cloud console when using no-code workflows." → 🤝 matches (framing: entailed-narrower; evidence: Sibling docs confirm no-code stacks store configuration in Pulumi ESC and are managed via the Pulumi Cloud console's New Project Wizard, which offers a "form-based interface" for "Set individual configuration values" and integrates with Pu…; source: repo:content/docs/idp/concepts/no-code-stacks.md and repo:content/docs/idp/concepts/new-project-wizard.md)
• L40 in content/docs/idp/concepts/_index.md "There is a page documenting no-code workflows located at /docs/idp/concepts/no-code-stacks/." → ✅ verified (evidence: The docs repo contains content/docs/idp/concepts/no-code-stacks.md (confirmed via GitHub API listing of that directory), which resolves via Hugo routing to the URL /docs/idp/concepts/no-code-stacks/ as cited in the claim.; source: gh api repos/pulumi/docs/contents/content/docs/idp/concepts)

🚨 Outstanding in this PR

No outstanding findings in this PR.

⚠️ Low-confidence

Review each and resolve as appropriate — these don't block the PR.

• [L61-63] content/docs/administration/self-hosting/components/search.md — "The backfill operation iterates over all Pulumi stacks, finds their latest checkpoints, and indexes the resources." — verdict: unverifiable; evidence: The claim describes internal implementation behavior of Pulumi Cloud's closed-source backfill/reindex service (pulumi-service repo, which is private). The docs page itself states: "The backfill operation iterates over all Pulumi stacks, fi…; source: content/docs/administration/self-hosting/components/search.md — Not a blocker for this PR: the sentence describing the backfill internals is untouched here (only "Pulumi service configuration" → "Pulumi Cloud configuration" one line above changed), and it describes closed-source Pulumi Cloud behavior that can't be confirmed from a public source. Author question: is "iterates over all Pulumi stacks, finds their latest checkpoints, and indexes the resources" still accurate for the current reindex implementation? If not, it can be corrected in a follow-up rather than here.

• content/docs/idp/concepts/_index.md (line 38) — the edited sentence still reads "using Pulumi services, logical groupings of Pulumi entities", but the canonical spelling of this concept is capitalized: the sibling content/docs/idp/concepts/services.md says "Pulumi Services are logical groupings of Pulumi entities such as stacks and ESC environments", and the link two paragraphs below on this same page already reads "[Pulumi Services]". Since this PR touches the line anyway — and since the sharpened DeprecatedProductNames token deliberately exempts the plural as "the IDP Services concept" — it's worth aligning the casing:

  Users can easily model their infrastructure using Pulumi Services, logical groupings of Pulumi entities, such as stacks and ESC environments. Users can also adjust configuration and redeploy stacks directly from the Pulumi Cloud console when using no-code workflows.
  

  (Note that the rule's lowercase-insensitive plural exemption means "Pulumi services" won't be caught by linting either way, so this one needs a human eye.)

Style findings

Found by pattern-based linting; Findings may be false positives.

_{Click each filename to expand.}

content/docs/deployments/guides/oidc/gcp.md (2 issues: 1 plurals, 1 substitution)

• line 68: [style] plurals — Don't use plurals in parentheses such as in 'role(s)'.
• line 68: [style] substitution — Use 'select' instead of 'click' (STYLE-GUIDE.md).

content/docs/esc/guides/configuring-oidc/aws.md (1 issues: 1 substitution)

• line 47: [style] substitution — Use 'select' instead of 'click' (STYLE-GUIDE.md).

content/docs/esc/guides/configuring-oidc/gcp.md (2 issues: 1 plurals, 1 substitution)

• line 53: [style] plurals — Don't use plurals in parentheses such as in 'role(s)'.
• line 53: [style] substitution — Use 'select' instead of 'click' (STYLE-GUIDE.md).

content/docs/idp/concepts/_index.md (1 issues: 1 difficulty qualifier)

• line 38: [style] difficulty qualifier — Avoid difficulty qualifier 'easily' -- it judges difficulty for the reader (STYLE-GUIDE.md §Inclusive Language).

💡 Pre-existing issues in touched files (optional)

• content/docs/administration/self-hosting/deployment-options/aks-hosted.md (line 45, not touched by this PR) — Pre-existing: three lines above the rename, this page still opens with "When deploying the Service, it is recommended to pin the Pulumi Cloud image tag…". The capitalized bare "the Service" is the same retired product name this PR is cleaning up, and the four sibling installer pages (byo-infra-hosted.md, ecs-hosted.md, gke-hosted.md, local-docker.md) all say "When deploying the Pulumi Cloud" while eks-hosted.md says "When deploying the service" (lowercase). Optional one-word pickup while you're in the file; otherwise a good follow-up to normalize all six pages to one phrasing.
• content/case-studies/imagine-learning.md (lines 84 and 102, not touched by this PR) — Pre-existing: the new Pulumi UI → Pulumi Cloud console substitution in Nomenclature.yml will now fire on this page. Line 84 is site prose and can simply be updated, but line 102 is inside a verbatim customer quote ("I get built-in auditing in the Pulumi UI of changes going on…"), which must not be reworded. Vale substitutions are nags rather than blockers, so nothing breaks — but that quote will nag forever unless the surrounding block is wrapped in <!-- vale off --> / <!-- vale on -->. Worth deciding deliberately rather than leaving it to whoever next reads the Vale output.

✅ Resolved since last review

No items resolved since the last review.

📜 Review history

• 2026-08-04T14:43:15Z — No blockers: the 13 renames read correctly in context and both Vale rule changes behave as documented; flagged a "Pulumi services" casing nit, a residual "the Service" on an untouched aks-hosted line, and a new Pulumi UI nag that lands inside a verbatim customer quote (efb0fe8)

---

• Refresh this review — comment @claude #update-review. Say what you fixed, or which finding you dispute and why; both work in the same mention.
• Ask for anything else — comment @claude with no hashtag (questions, one-off fixes). Leaves this review untouched.

Important

Please don't hide, resolve, or delete this comment! It breaks things!

📖 How pre-merge review works — the full lifecycle, short-circuits, and escape hatches.

[workprentice]

Applied the casing suggestion (Pulumi services -> Pulumi Services) from the pre-merge review. The other two notes (pre-existing "the Service" casing on aks-hosted.md:45, and the Pulumi UI nag landing inside a case-studies customer quote) are left as follow-up items since they're outside this PR's touched scope.

[pulumi-bot]

Your site preview for commit 9291ad4 is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-20689-9291ad43.s3-website.us-west-2.amazonaws.com

Changed pages:

• /docs/administration/access-identity/scim/
• /docs/administration/self-hosting/airgapped/
• /docs/administration/self-hosting/components/search/
• /docs/administration/self-hosting/deployment-options/aks-hosted/
• /docs/administration/self-hosting/deployment-options/byo-infra-hosted/
• /docs/administration/self-hosting/deployment-options/ecs-hosted/
• /docs/administration/self-hosting/deployment-options/gke-hosted/
• /docs/administration/self-hosting/deployment-options/local-docker/
• /docs/deployments/guides/oidc/gcp/
• /docs/esc/guides/configuring-oidc/aws/
• /docs/esc/guides/configuring-oidc/gcp/
• /docs/esc/guides/configuring-oidc/vault/
• /docs/idp/concepts/