Add "What Is Infrastructure Drift?" explainer

[alexleventer]

Proposed changes

Adds a new /what-is/ explainer, What Is Infrastructure Drift?, filling a conspicuous gap: drift is a top-of-funnel concept and a core Pulumi differentiator, but nothing in /what-is/ covered it despite dedicated docs and three blog posts on the topic.

The page walks a reader from definition to action:

• The three-state model — desired (code) vs. current (state file) vs. actual (cloud), and where drift lives.
• Causes — human out-of-band changes vs. automated cloud-side changes, and why the distinction drives the response.
• Why it matters — code stops being reliable documentation, routine deploys become hazards, security/compliance regressions hide, and drift compounds.
• Detection — preview-only refresh, --expect-no-changes as a CI signal, and scheduled/managed detection.
• Reconciliation — the remediation (cloud→code) vs. adoption (code→cloud) decision, with the risk profiles of each.
• Prevention — ignoreChanges, protect, components/IDP golden paths, policy that survives adoption, and continuous GitOps reconciliation with its real limits.
• How Pulumi handles it end to end, including Neo-assisted adoption.
• FAQ section for common questions.

Everything is grounded in the existing Detecting and reconciling drift docs, with links out to the relevant CLI, Deployments, resource-option, and policy pages.

It also adds two reciprocal links — from the policy-as-code and agentic-infrastructure explainers — so the four related pages interlink instead of the new one sitting orphaned.

Related issues (optional)

None.

[pulumi-bot]

Your site preview for commit 896f60f is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-20098-896f60f1.s3-website.us-west-2.amazonaws.com

[github-actions]

Pre-merge Review — Last updated 2026-07-06T23:46:25Z

Tip

Summary: This PR adds a new what-is explainer, "What Is Infrastructure Drift?" (content/what-is/what-is-infrastructure-drift.md), paralleling the existing what-is pages (agentic-infrastructure, policy-as-code, infrastructure-as-code) in structure — definition lede, causes/why/detect/reconcile/prevent sections, an FAQ, and a "Learn more" block. It also adds one cross-link into the drift page from what-is-agentic-infrastructure.md (line 69) and one into the "Related reading" list of what-is-policy-as-code.md. The kind of wrongness that would block a reader here is a wrong CLI command, a broken doc link, or a misdescribed drift/remediation behavior; the verification pass confirmed the new page's Pulumi-specific claims (pulumi refresh --preview-only, --expect-no-changes exit behavior, ignoreChanges/protect, GitOps/Deployments/Neo drift handling) against Pulumi docs, and all internal links resolve. Fact-check, frontmatter, and internal-link passes ran; Hugo build was skipped (content-only PR, no template paths touched). The three ❌ contradictions the fact-check surfaced all sit in what-is-agentic-infrastructure.md on lines this PR did not touch (its only edit is the one-line drift link on L69), so they are pre-existing and don't block this PR — see 💡 Pre-existing.

Review confidence:

Dimension	Level	Notes
mechanics	HIGH
facts	HIGH	New drift page's Pulumi claims verified against docs; contradictions are pre-existing in an untouched file.
coherence	HIGH
code correctness	HIGH	Only inline bash CLI snippets; commands match the pulumi refresh/--expect-no-changes docs.

Investigation log

• Cross-sibling reads: not run (not in a templated section)
• External claim verification: 86 of 96 claims verified (2 unverifiable, 3 contradicted) · 4 specialists (numerical, cross-reference, capability, framing); 0 cross-specialist corroborations · routed: 0 inline, 71 Pass 1, 0 Pass 2, 25 Pass 3 (verified 21, contradicted 1, unverifiable 3).
• Cited-claim spot-checks: not run (no cited claims)
• Frontmatter sweep: ran on body + meta_desc
• Temporal-trigger sweep: ran (recency words present in diff; spot-check in-review)
• Code execution: not run (no static/programs/ change)
• Code-examples checks: ran (3 specialists: structural, existence, body-code-coverage); 0 findings
• Editorial-balance pass: not run (not under content/blog/)

🚨 Outstanding	⚠️ Low-confidence	💡 Pre-existing	✅ Resolved
0	9	3	0

🔍 Verification trail

96 claims extracted · 86 verified · 2 unverifiable · 3 contradicted

• L9 in content/what-is/what-is-agentic-infrastructure.md "Agentic infrastructure is cloud infrastructure that AI agents provision, govern, and operate autonomously, including writing code, running deployments, enforci…" → ✅ verified (framing: strengthened — claim synthesizes several Pulumi statements (provisioning/governing/operating, PR-based proposals, human review) into one composite definition;…; evidence: Pulumi's own materials describe agentic infrastructure in matching terms: "Pulumi gives both engineering teams and AI agents a single substrate for provisioning, governing, and operating infrastructure across every cloud and Saa[S]" and de…; source: https://www.prnewswire.com/news-releases/pulumi-closes-the-ai-deployment-gap-with-agent-native-infrastructure-and-superintelligence-partnerships-302776114.html)
• L15 in content/what-is/what-is-agentic-infrastructure.md "The word 'agentic' refers to an AI system that takes sequences of actions to reach a goal, observing state, making decisions, and executing steps, rather than…" → ✅ verified (evidence: Multiple authoritative sources confirm this framing: an AI agent is "a computational entity that perceives its environment, reasons about observations, and executes actions in pursuit of explicit goals," operating via a perceive-reason-act…; source: https://arxiv.org/pdf/2604.05589)
• L17 in content/what-is/what-is-agentic-infrastructure.md "If CI/CD feedback comes back (e.g., a failed security scan or policy violation), the agent reads it, pushes a fix, and iterates." → 🤝 matches (evidence: The claim in L17 is echoed verbatim in the same doc's later step-by-step section (L67): "Handle CI/CD feedback. If a pipeline check fails (a security scan, a policy violation, a test), Neo reads the output, pushes a corrective fix to the s…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L17 in content/what-is/what-is-agentic-infrastructure.md "An agentic infrastructure AI agent can receive a goal in natural language, query deployed state, write or modify infrastructure code, preview impact against th…" → ✅ verified (evidence: The claim is a near-verbatim restatement of the source document itself: "it means an AI agent that can receive a goal in natural language, query your actual deployed state to understand the environment, write or modify infrastructure code,…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L21 in content/what-is/what-is-agentic-infrastructure.md "Agentic systems are meaningfully different from earlier waves of infrastructure automation (scripts, pipelines, runbooks) because those automate procedures hum…" → ✅ verified (framing: strengthened — the claim's general assertion (agentic systems reason about novel situations vs. scripted automation) is a widely-corroborated industry framing,…; evidence: Industry sources broadly support this framing: "Automated runbooks execute scripts. They do not make decisions" while "An agentic runbook is an AI agent that continuously observes... reasons about which remediation applies... and escalates…; source: https://cast.ai/automation-academy/agentic-runbooks/ ; https://galileo.ai/blog/agentic-vs-non-agentic-ai-guide)
• L23-25 in content/what-is/what-is-agentic-infrastructure.md "Joe Duffy, described as Pulumi's CEO, said in 'The Agentic Infrastructure Era': 'Agentic infrastructure is a super exciting one-way door for our industry.'" → ✅ verified (evidence: The Pulumi blog post "The Agentic Infrastructure Era," authored by Joe Duffy (confirmed elsewhere as Pulumi's CEO), states verbatim: "Agentic infrastructure is a super exciting one-way door for our industry."; source: https://www.pulumi.com/blog/the-agentic-infrastructure-era/)
• L27 in content/what-is/what-is-agentic-infrastructure.md "Pulumi is tracking LLMs doing over 20% of infrastructure deployments today, up from nearly zero a year ago." → ✅ verified (evidence: Pulumi's official blog states: "LLMs are now doing over 20% of the infrastructure deployments, up from virtually zero a year ago," attributed to CEO Joe Duffy and corroborated by Pulumi's release notes and The New Stack's coverage.; source: https://www.pulumi.com/blog/the-agentic-infrastructure-era/)
• L27 in content/what-is/what-is-agentic-infrastructure.md "Pulumi expects the share of infrastructure deployments done by LLMs to grow past 50% by the end of 2026." → ✅ verified (framing: exact-match — "before the end of this year" (article dated May 2026) is equivalent to "by the end of 2026" as claimed.; evidence: Pulumi's blog states: "LLMs are now doing over 20% of the infrastructure deployments, up from virtually zero a year ago. We expect this to grow to over 50% before the end of this year and well beyond afterwards" (published May 2026, so "th…; source: https://www.pulumi.com/blog/the-agentic-infrastructure-era/)
• L33 in content/what-is/what-is-agentic-infrastructure.md "Frontier models score 86% on SWE-bench Verified today, up from 33% in August 2024." → ❌ contradicted (framing: shifted — the claim's "86% today" no longer matches current leaderboard standings, which have moved past that figure to ~88-95% for top frontier models as of m…; evidence: The 33% August 2024 baseline is confirmed (OpenAI reported GPT-4o at "33.2% on SWE-bench Verified" at the benchmark's August 2024 launch), but "86% today" is stale: current leaderboards (mid-2026) show frontier models like Claude Fable 5/C…; source: https://openai.com/index/introducing-swe-bench-verified/; https://www.vals.ai/benchmarks/swebench; intuition: 86% reads like a stale snapshot (matches roughly early-2026 top scores) rather than the current frontier max, which has…)
• L35 in content/what-is/what-is-agentic-infrastructure.md "Andrej Karpathy said: 'The reality of building web apps in 2025 is that it's a bit like assembling IKEA furniture.'" → ✅ verified (evidence: Andrej Karpathy's X post states: "The reality of building web apps in 2025 is that it's a bit like assembling IKEA furniture."; source: https://x.com/karpathy/status/1905051558783418370)
• L37 in content/what-is/what-is-agentic-infrastructure.md "Infrastructure as code involves expressing cloud resources in real programming languages." → ➖ not-a-claim (evidence: This is a general positioning/definitional statement reflecting Pulumi's own established framing of infrastructure as code (using real/general-purpose programming languages), not a falsifiable third-party factual assertion requiring extern…; source: Pulumi's general product positioning (IaC using general-purpose programming languages))
• L39 in content/what-is/what-is-agentic-infrastructure.md "Joe Duffy said: 'It is a happy accident that the combination of this plus the verifiability of every change is the exact combination that empowers agents to do…" → ✅ verified (evidence: The Pulumi blog post "The Agentic Infrastructure Era" contains the exact quote: "It is a happy accident that the combination of this plus the verifiability of every change is the exact combination that empowers agents to do infrastructure.…; source: https://www.pulumi.com/blog/the-agentic-infrastructure-era/)
• L47 in content/what-is/what-is-agentic-infrastructure.md "pulumi preview maps code changes to a concrete, auditable list of resource operations (what will be created, updated, or deleted) before anything in the clou…" → ✅ verified (evidence: The official pulumi preview CLI docs state: "These allocations are then compared against the existing state to determine what operations must take place to achieve the desired state. No changes to the stack will actually take place," and…; source: repo:content/docs/iac/cli/commands/pulumi_preview.md)
• L47 in content/what-is/what-is-agentic-infrastructure.md "Joe Duffy said: 'Just as we wouldn't vibe code without git showing us the source changes, we shouldn't vibe infrastructure without a tool that shows what it wi…" → ✅ verified (evidence: The Pulumi blog post "The Agentic Infrastructure Era" contains the exact quote: "Just as we wouldn't vibe code without git showing us the source changes, we shouldn't vibe infrastructure without a tool that shows what it will do before it…; source: https://www.pulumi.com/blog/the-agentic-infrastructure-era/)
• L49 in content/what-is/what-is-agentic-infrastructure.md "The CodeAct paper (Wang et al., ICML 2024) found that agents consistently perform better when they act by writing executable code rather than emitting JSON or…" → ✅ verified (evidence: The ICML 2024 paper by Wang, Chen, Yuan, Zhang, Li, Peng, and Ji found that "CodeAct outperforms widely used alternatives like Text and JSON (up to 20% higher success rate)," confirming agents perform better writing executable code vs. JSO…; source: https://proceedings.mlr.press/v235/wang24h.html; https://github.com/xingyaoww/code-act)
• L53 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo is an AI infrastructure engineering agent built into Pulumi Cloud." → ✅ verified (evidence: pulumi/docs content/product/neo.md title is "Pulumi Neo - Your AI Infrastructure Agent" / "Pulumi Neo - Your AI Platform Engineer", and content/docs/ai/_index.md describes "Pulumi Neo provides AI-powered infrastructure automation... for pl…; source: gh search code --owner pulumi "Pulumi Neo" (pulumi/docs:content/product/neo.md, content/docs/ai/_index.md, content/blog/pulumi-neo-cli/index.md))
• L57 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo creates a task to track the work when a user states an intent." → ✅ verified (evidence: The official Neo docs describe tasks as "Neo's primary unit of work. Each task is a conversation where you describe what you want to accomplish, and Neo handles the infrastructure changes," directly supporting that stating an intent result…; source: repo:content/docs/ai/tasks/_index.md)
• L57 in content/what-is/what-is-agentic-infrastructure.md "A user can send a goal to Pulumi Neo in natural language through Pulumi Cloud, the CLI, or the Slack integration." → ✅ verified (evidence: The pulumi/docs Slack integration page confirms: "Mention @Neo in any channel where Neo has been added to start a Neo task without leaving Slack," and contrasts this with "the Pulumi Cloud console," consistent with the CLI also being a d…; source: gh api repos/pulumi/docs/contents/content/docs/ai/integrations/slack/_index.md)
• L59 in content/what-is/what-is-agentic-infrastructure.md "In Plan Mode, Pulumi Neo queries the user's actual Pulumi state graph." → ✅ verified (framing: strengthened — claim narrows the source's general "investigates your environment / existing infrastructure" to the more specific "queries your actual Pulumi st…; evidence: The docs page (content/docs/ai/tasks/_index.md) states Plan Mode makes Neo "investigate your environment by examining existing infrastructure, reading relevant code, checking dependencies... referencing specific things it discovered like s…; source: repo:content/docs/ai/tasks/_index.md)
• L59 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo's plan is presented for human review before anything changes." → ✅ verified (evidence: Pulumi's official Neo docs (content/docs/ai/tasks/_index.md) state that in Plan Mode Neo "iterates with you through normal conversation" and "waits for your explicit approval before any execution begins," synthesizing "a grounded plan expl…; source: repo:content/docs/ai/tasks/_index.md)
• L61 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo proceeds within the RBAC entitlements of the user who initiated the task." → ✅ verified (evidence: The same document restates this at line 99: "Neo operates within the Pulumi Cloud RBAC entitlements of the user who initiated the task. It cannot escalate privilege. If a developer cannot delete a production database, Neo cannot either, re…; source: repo:content/what-is/what-is-agentic-infrastructure.md (L99); repo:content/product/neo.md)
• L61 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo cannot do anything the initiating user themselves could not do." → ✅ verified (evidence: The same document states this directly: "Neo proceeds within the RBAC entitlements of the user who initiated the task. It cannot do anything the user themselves could not do," and reiterates later, "Neo operates within the Pulumi Cloud RBA…; source: repo:content/what-is/what-is-agentic-infrastructure.md (lines 61, 99))
• L61 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo offers three task modes: Review (step-by-step human approval), Balanced (approval before pulumi up), and Auto (fully automated)." → ✅ verified (evidence: content/docs/ai/tasks/_index.md confirms: "Review mode (default): Running pulumi preview, running pulumi up, and opening a PR all require approval. Balanced mode: Neo will only request approval before running pulumi up. Auto mode: Neo will…; source: repo:content/docs/ai/tasks/_index.md)
• L63 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo runs pulumi preview to validate generated code, shows exactly which resources will be created, updated, or deleted, and runs Pulumi Policies befor…" → ✅ verified (evidence: Official Pulumi docs (content/docs/ai/running-previews/_index.md) state Neo uses preview to "1. Validate proposed changes... 2. Show impact analysis: Display what resources will be created, updated, or deleted 3. Check policy compliance: V…; source: gh api repos/pulumi/docs/contents/content/docs/ai/running-previews/_index.md)
• L65 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo creates a pull request with a problem description, a list of modified resources, and the preview summary." → ✅ verified (evidence: The Pulumi docs page /docs/ai/pull-requests/ states Neo opens a PR with: "Description of what problem it solves", "List of modified resources", and "Preview output summary" — matching the claim's "problem description, a list of modified re…; source: repo:content/docs/ai/pull-requests/_index.md)
• L65 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo's PR flows through the user's existing GitHub, GitLab, or Bitbucket CI/CD pipeline." → ❌ contradicted (framing: shifted — claim says Neo PRs flow through "GitHub, GitLab, or Bitbucket" but the canonical Neo docs list supported VCS integrations as GitHub, Azure DevOps, an…; evidence: The official Neo pull-requests doc states: "Neo requires a version control integration to read code from and create pull requests. Pulumi supports GitHub, Azure DevOps, and GitLab... Without a VCS integration, Neo will not be able to view…; source: repo:content/docs/ai/pull-requests/_index.md)
• L67 in content/what-is/what-is-agentic-infrastructure.md "If a pipeline check fails (a security scan, a policy violation, a test), Pulumi Neo reads the output, pushes a corrective fix to the same PR, and iterates." → ✅ verified (evidence: Official Pulumi docs (content/docs/ai/pull-requests/_index.md) state: "your Pulumi previews, security scans, policy checks, and tests will run automatically on Neo's PRs, just like any other pull request. If a workflow fails, you can ask N…; source: gh api repos/pulumi/docs/contents/content/docs/ai/pull-requests/_index.md)
• L69 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo can turn any task into a recurring scheduled job that opens a PR whenever a scheduled run detects infrastructure drift or produces changes." → ✅ verified (evidence: Pulumi docs confirm Pulumi Cloud's scheduled drift detection/remediation capability (e.g. content/docs/iac/operations/stack-management/drift.md: "Pulumi Deployments runs scheduled drift jobs against your stacks and can either stop at detec…; source: repo:content/docs/iac/operations/stack-management/drift.md; repo:content/what-is/what-is-infrastructure-drift.md)
• L71 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo is 'grounded AI' that reasons over the user's actual state graph and deployment history rather than generating code from internet patterns." → ✅ verified (evidence: The cited blog post states: "It queries your actual deployment history... it reasons from your program graph, not generic examples" and "It's generating code from patterns it learned on the internet, not from understanding your environment…; source: repo:content/blog/grounded-ai-why-neo-knows-your-infrastructure/index.md)
• L75 in content/what-is/what-is-agentic-infrastructure.md "The phrase 'agentic infrastructure' is also used to describe the compute, networking, and data infrastructure that AI agents themselves run on." → ✅ verified (framing: strengthened — the term is used broadly across the industry (compute, networking, storage, security stacks for running agents); the claim's narrower descriptio…; evidence: Multiple third-party sources use "agentic infrastructure" to mean the compute/networking/data infrastructure AI agents run on, e.g. Augment Code's guide: "Agentic infrastructure is the set of runtime systems, orchestration layers, state ma…; source: https://www.augmentcode.com/guides/agentic-infrastructure-stack)
• L82 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo provisions and updates a user's AWS environment." → ✅ verified (evidence: The Neo product page states "Neo provisions, governs, and optimizes your cloud infrastructure — with enterprise controls built in" and confirms "Neo has visibility across AWS, Azure, Google Cloud, and hundreds of other providers." The clai…; source: gh search code --owner pulumi "Neo provisions" (pulumi/docs:content/product/neo.md))
• L91-93 in content/what-is/what-is-agentic-infrastructure.md "Joe Duffy said: 'The smartest agent in the world still needs guardrails, audit trails, and policy enforcement to be trusted with production systems at scale, a…" → ✅ verified (evidence: The Pulumi blog post "The Agentic Infrastructure Era," authored by Joe Duffy (Posted on May 19th, 2026), contains the exact sentence: "The smartest agent in the world still needs guardrails, audit trails, and policy enforcement to be trust…; source: https://www.pulumi.com/blog/the-agentic-infrastructure-era/)
• L97 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Policies lets teams define organizational rules as code (e.g., no unencrypted storage, required tags, allowed instance types) that run on every pulumi…" → ✅ verified (framing: strengthened — claim gives specific example rules (unencrypted storage, tags, instance types) as illustrative examples of the broader policy-as-code capability…; evidence: Pulumi CrossGuard (Pulumi Policy as Code) allows teams to define policy packs in general-purpose languages that enforce rules such as required tags or disallowed unencrypted resources, and these policies run automatically during pulumi pr…; source: gh_query search across pulumi org (docs page for CrossGuard not directly retrievable in this pass; based on well-established Pulumi Policy as Code / CrossGuard feature behavior))
• L97 in content/what-is/what-is-agentic-infrastructure.md "Non-compliant changes are blocked by Pulumi Policies before they reach the cloud." → ✅ verified (evidence: The linked /docs/iac/crossguard/ page documents that Pulumi Policies (CrossGuard) enforce mandatory policies at pulumi preview/pulumi up time, and a resource violating a "mandatory" enforcement-level policy causes the operation to fail…; source: repo:content/what-is/what-is-agentic-infrastructure.md (cites /docs/iac/crossguard/))
• L97 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Policies run on the preview output, so they apply whether a human or an agent proposed the change." → ✅ verified (evidence: Pulumi's CrossGuard/Policy as Code docs confirm policies "apply policies at deployment-time" and "run on every pulumi preview," validating the resource plan itself (the preview output) rather than the actor that generated it — e.g. "Poli…; source: pulumi/docs:content/what-is/what-is-agentic-infrastructure.md and pulumi/docs:content/blog/pulumi-2-0/index.md ("CrossGuard...lets you define policies using familiar languages and then apply those policies at deployment-time"))
• L99 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo operates within the Pulumi Cloud RBAC entitlements of the user who initiated the task and cannot escalate privilege." → 🤝 matches (evidence: The claim at L99 ("Neo operates within the Pulumi Cloud RBAC entitlements of the user who initiated the task. It cannot escalate privilege.") is consistent with the identical assertion earlier in the same document at L61: "Neo proceeds wit…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L101 in content/what-is/what-is-agentic-infrastructure.md "In Pulumi Neo's Review mode (the default), human approval is required at every step." → ✅ verified (evidence: content/docs/ai/tasks/_index.md states: "Task modes control how much autonomy Neo has during execution... - Review mode (default): Running pulumi preview, running pulumi up, and opening a PR all require approval." This directly con…; source: repo:content/docs/ai/tasks/_index.md)
• L103 in content/what-is/what-is-agentic-infrastructure.md "Every Pulumi Neo agent action (every preview, every deployment, every PR) is logged with timestamps, the initiating user, and the full resource diff." → ✅ verified (framing: strengthened — claim's specific "full resource diff" detail is drawn from Neo's PR/preview output rather than the audit-log entry itself, but the overall behav…; evidence: Pulumi Cloud audit logs record "the UNIX timestamp of the event, the user who invoked the action, the event that took place" for all user (including agent-initiated) actions, and Neo's PRs include "List of modified resources" and "Preview…; source: repo:content/docs/administration/security-compliance/audit-logs/_index.md and repo:content/docs/ai/pull-requests/_index.md)
• L103 in content/what-is/what-is-agentic-infrastructure.md "The audit trail that applies to Pulumi Neo agent actions is the same audit trail that applies to human-initiated changes." → ✅ verified (evidence: The source text explicitly states: "Every agent action (every preview, every deployment, every PR) is logged with timestamps, the initiating user, and the full resource diff. This is the same audit trail that applies to human-initiated cha…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L105 in content/what-is/what-is-agentic-infrastructure.md "Agents reference secrets through Pulumi ESC without ever handling raw values, and credentials are rotated, scoped, and auditable." → ✅ verified (evidence: Pulumi ESC docs confirm all three properties: short-lived/dynamic credentials via login providers ("Issue short-lived OIDC credentials for AWS, Azure, GCP, GitHub, and more"), automated rotation via rotation connectors ("the aws-lambda rot…; source: repo:content/docs/esc/_index.md, repo:content/docs/esc/concepts/rotators.md, gh search code --owner pulumi "ESC rotation")
• L105 in content/what-is/what-is-agentic-infrastructure.md "Credentials managed via Pulumi ESC are rotated, scoped, and auditable." → ✅ verified (evidence: Pulumi ESC docs confirm all three properties: rotation via rotators/fn::rotate ("Rotators are first-party Pulumi ESC plugins that enable the automated, periodic updating of sensitive credentials"), scoping via environments/RBAC composition…; source: gh search code --owner pulumi "rotate esc"; content/docs/esc/concepts/rotators.md; content/docs/esc/concepts/_index.md)
• L113 in content/what-is/what-is-agentic-infrastructure.md "Wiz manages over 1 million cloud resources with Pulumi." → ✅ verified (evidence: Pulumi's official Wiz case study states: "Wiz uses Pulumi's Automation API to manage thousands of Kubernetes clusters across hundreds of data centers worldwide, handling hundreds of thousands of infrastructure updates daily while maintaini…; source: https://www.pulumi.com/case-studies/wiz/)
• L113 in content/what-is/what-is-agentic-infrastructure.md "Wiz handles hundreds of thousands of infrastructure updates daily with Pulumi." → ✅ verified (evidence: Pulumi's official Wiz case study states: "Wiz uses Pulumi's Automation API to manage thousands of Kubernetes clusters across hundreds of data centers worldwide, handling hundreds of thousands of infrastructure updates daily while maintaini…; source: https://www.pulumi.com/case-studies/wiz/)
• L115 in content/what-is/what-is-agentic-infrastructure.md "BMW manages 20,000+ cloud resources with Python-based IaC." → ✅ verified (evidence: Pulumi's official BMW case study states: "Software Factory manages over 20,000 cloud resources using Python-based infrastructure code integrated with existing CI/CD workflows."; source: https://www.pulumi.com/case-studies/bmw/)
• L117 in content/what-is/what-is-agentic-infrastructure.md "Werner Enterprises reduced infrastructure provisioning time from 3 days to 4 hours after adopting Pulumi Neo for provisioning workflows." → 🤝 matches (evidence: Sibling pages in the same repo repeat this figure: content/product/neo.md states "Werner Enterprises reduced provisioning time from 3 days to 4 hours" and content/blog/ai-infrastructure-tools/index.md states "Werner Enterprises reduced inf…; source: repo:content/product/neo.md, repo:content/blog/ai-infrastructure-tools/index.md)
• L119 in content/what-is/what-is-agentic-infrastructure.md "Mysten Labs described their goal as 'minimizing the time it takes an engineer to go from an idea to an experiment in production.'" → ✅ verified (evidence: Pulumi's official Neo product page quotes a Mysten Labs speaker: "Our goal has always been to minimize the time it takes an engineer to go from an idea to an experiment in production."; source: https://www.pulumi.com/product/neo/)
• L127 in content/what-is/what-is-agentic-infrastructure.md "Pulumi provides conversion documentation for teams migrating from other IaC tools to Pulumi." → ✅ verified (evidence: content/docs/iac/comparisons/terraform/_index.md exists and states "For a complete walkthrough including bulk conversion and state migration, see [Migrating from Terraform to Pulumi](/docs/iac/guides/migration/migrating-to-pulumi/from-terr…; source: gh search code repo:pulumi/docs "comparisons/terraform"; content/docs/iac/comparisons/terraform/_index.md)
• L127 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo works with Pulumi programs." → ✅ verified (evidence: Pulumi docs describe Neo as reasoning over the actual state graph and generating/validating Pulumi code: "Neo validates the generated code, shows exactly which resources will be created, updated, or deleted, and runs your Pulumi Policies"…; source: repo:content/what-is/what-is-agentic-infrastructure.md (lines 59-71), cross-checked with pulumi/docs content/docs/ai/_index.md and content/product/neo.md)
• L131 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo's default task mode requires human approval at every step." → ✅ verified (evidence: The same document states: "Configurable human-in-the-loop. Review mode, the default, requires human approval at every step. Balanced mode gates specifically on pulumi up, and Auto mode runs completely unattended..." This directly confirm…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L133 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Policies run on every preview and block non-compliant changes automatically." → ✅ verified (evidence: Pulumi Policy (CrossGuard) supports enforcementLevel "mandatory" which blocks non-compliant resource changes during preview/update, consistent with the doc's own statement: "[Pulumi Policies] run on every pulumi preview. Non-compliant chan…; source: gh search code --owner pulumi "enforcementLevel" repo:pulumi/pulumi-policy; content/what-is/what-is-agentic-infrastructure.md line 97)
• L135 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo opens pull requests that flow through existing GitHub, GitLab, or Bitbucket workflows." → 🤷 unverifiable (evidence: verification did not converge within 8 turns)
• L135 in content/what-is/what-is-agentic-infrastructure.md "No changes to a team's pipeline are required to connect it with Pulumi Neo." → ✅ verified (evidence: The source doc itself states verbatim at L135: "Step 5: Connect your CI/CD pipeline. Neo opens pull requests that flow through your existing GitHub, GitLab, or Bitbucket workflows. No changes to your pipeline are required." This is consist…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L151 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo writes and modifies infrastructure in Python, TypeScript, Go, C#, Java, and YAML." → ✅ verified (framing: strengthened — product page only explicitly names "TypeScript, Python, Go, and more" for Neo's code generation; the claim's full six-language list matches Pulu…; evidence: The docs repo consistently lists Python, TypeScript, Go, C#/.NET, Java, and YAML as Pulumi's supported IaC languages (e.g., data/header_nav.yaml: "IaC for any cloud, in any language — Node.js, Python, Go, .NET, Java, and YAML"; from-arm.md…; source: repo:pulumi/docs data/header_nav.yaml, content/docs/iac/guides/migration/migrating-to-pulumi/from-arm.md, content/product/neo.md)
• L155 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo runs pulumi preview before every deployment, enforces Pulumi Policies on every change, operates within the initiating user's RBAC entitlements, lo…" → ✅ verified (evidence: Pulumi docs confirm each element: "Task modes... Review mode (default): Running pulumi preview, running pulumi up, and opening a PR all require approval"; running-previews doc states preview "Check policy compliance" against org polici…; source: content/docs/ai/tasks/_index.md; content/docs/ai/running-previews/_index.md; content/what-is/what-is-agentic-infrastructure.md)
• L155 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo operates within the initiating user's RBAC entitlements." → ✅ verified (evidence: Sibling doc content/docs/ai/get-started/_index.md states: "Neo operates within the conversing user's RBAC entitlements and cannot perform actions that the user couldn't perform themselves," matching the claim exactly (initiating vs convers…; source: pulumi/docs:content/docs/ai/get-started/_index.md)
• L155 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo defaults to requiring human approval at each step." → ✅ verified (evidence: The same document states: "Configurable human-in-the-loop. Review mode, the default, requires human approval at every step." This directly confirms Neo defaults to requiring human approval at each step.; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L159 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo accepts natural-language tasks, reasons over the user's actual infrastructure state graph, writes and modifies infrastructure code, runs previews, e…" → ✅ verified (evidence: The same doc describes Neo's workflow in detail: "A user sends the goal in natural language... Neo queries your actual Pulumi state graph... Run pulumi preview... runs your Pulumi Policies... Open a pull request." This matches pulumi/docs'…; source: repo:content/what-is/what-is-agentic-infrastructure.md (lines 57-65); pulumi/docs:content/docs/ai/_index.md and content/partner/aws.md)
• L159 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo works across Amazon Web Services (AWS), Azure, Google Cloud, and hundreds of other providers." → ✅ verified (framing: strengthened — claim narrows Pulumi's general "hundreds of providers" platform claim to Neo specifically; since Neo runs on the same provider ecosystem, the br…; evidence: Pulumi's own docs consistently describe the platform as supporting "hundreds of providers" including AWS, Azure, Google Cloud (e.g. content/product/infrastructure-as-code.md: "Access AWS, Azure, Google Cloud, Kubernetes, and hundreds of pr…; source: gh search code --owner pulumi "hundreds of providers" (pulumi/docs:content/product/infrastructure-as-code.md))
• L167 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo's provider support matches the full scope of the Pulumi IaC platform." → 🤝 matches (evidence: The same doc states elsewhere: "Pulumi Neo supports Amazon Web Services (AWS), Microsoft Azure, Google Cloud, Kubernetes, and hundreds of other providers, matching the full scope of the Pulumi IaC platform" (L167) and "opens pull requests…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L167 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo supports Amazon Web Services (AWS), Microsoft Azure, Google Cloud, Kubernetes, and hundreds of other providers." → ✅ verified (evidence: content/product/neo.md states: "Neo has visibility across AWS, Azure, Google Cloud, and hundreds of other providers, all in one place," and the page's hero image is captioned "Neo AI infrastructure agent diagram showing Kubernetes cluster…; source: repo:content/product/neo.md (pulumi/docs))
• L171 in content/what-is/what-is-agentic-infrastructure.md "Pulumi provides migration documentation for teams moving from HashiCorp Terraform and other tools." → ✅ verified (evidence: The docs repo confirms content/docs/iac/comparisons/terraform/_index.md exists (a Terraform comparison/migration guide), along with sibling terraform/opentofu.md and terraform/terminology.md pages, matching the claim that Pulumi provides m…; source: gh api repos/pulumi/docs/contents/content/docs/iac/comparisons/terraform)
• L179 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo queries the user's Pulumi state graph, resource relationships, and deployment history." → ✅ verified (evidence: The same document states elsewhere: "In Plan Mode, Neo queries your actual Pulumi state graph. It identifies every Lambda function running Node 16, checks dependencies..." and "it reasons over your actual state graph and deployment history…; source: repo:content/what-is/what-is-agentic-infrastructure.md (lines 59, 71))
• L179 in content/what-is/what-is-agentic-infrastructure.md "Pulumi Neo does not generate code from generic internet patterns; it reasons from the user's actual environment." → 🤝 matches (evidence: The same document states elsewhere (line 71): "Neo is grounded AI: it reasons over your actual state graph and deployment history rather than generating code from internet patterns," and this exact framing ("does not generate code from gen…; source: repo:content/what-is/what-is-agentic-infrastructure.md and gh search code --owner pulumi "grounded-ai-why-neo-knows-your-infrastructure")
• L183 in content/what-is/what-is-agentic-infrastructure.md "Joe Duffy delivered a keynote titled 'The Last Mile Is Code' at CascadiaJS 2026, covering the in-distribution argument and the CodeAct research, with a live de…" → ✅ verified (framing: strengthened — source confirms title/speaker/event; specific talk-content details (CodeAct, in-distribution argument, live AWS demo) are unverifiable from the…; evidence: Official CascadiaJS 2026 schedule confirms: "Keynote · The Last Mile Is Code · Joe Duffy · 5:10pm · Closing Day One." The specific content details (in-distribution argument, CodeAct research, live Neo demo deploying to AWS) could not be in…; source: https://cascadiajs.com/2026/schedule)
• L185 in content/what-is/what-is-agentic-infrastructure.md "The embedded YouTube video (ID SOMEfFNPsew) corresponds to Joe Duffy's CascadiaJS 2026 keynote described in the surrounding text." → ❌ contradicted (evidence: CascadiaJS 2026 is a future event (sortable_date: 2026-06-01) whose own event page (content/events/cascadiajs-2026/index.md) has an empty youtube_url field, meaning no keynote recording exists yet. The embedded video ID "SOMEfFNPsew" con…; source: repo:content/events/cascadiajs-2026/index.md and gh search code --owner pulumi "SOMEfFNPsew"; intuition: Video ID literally spells out "SOME" as a substring — classic placeholder pattern, and the referenced event is dated Ju…)
• L187 in content/what-is/what-is-agentic-infrastructure.md "'The Agentic Infrastructure Era' is Duffy's companion essay on where infrastructure is headed." → ✅ verified (evidence: The blog post at pulumi.com/blog/the-agentic-infrastructure-era/ exists, is written in first person by Joe Duffy (CEO), and states: "In this post, I'll share our point of view, what we've built, what we're launching today, and why all infr…; source: https://www.pulumi.com/blog/the-agentic-infrastructure-era/)
• L187 in content/what-is/what-is-agentic-infrastructure.md "'Grounded AI: Why Neo Knows Your Infrastructure' explains the context lake approach that makes Neo reliable for production." → ✅ verified (evidence: The blog post at the cited URL discusses exactly this: "When you combine observability data, infrastructure-as-code programs, and deployment history into a context lake, the AI doesn't just predict what might happen."</c…; source: https://www.pulumi.com/blog/grounded-ai-why-neo-knows-your-infrastructure/)
• L187 in content/what-is/what-is-agentic-infrastructure.md "'10 things you can do with Neo' walks through concrete examples of using Pulumi Neo." → ✅ verified (evidence: The blog post /blog/10-things-you-can-do-with-neo/ is referenced consistently across multiple docs/blog pages (e.g., pulumi-neo-cli/index.md: "10 things you can do with Neo is a good starting point f…; source: gh search code --owner pulumi "10 things you can do with neo")
• L9 in content/what-is/what-is-infrastructure-drift.md "**Infrastructure drift is the gap that opens when the cloud resources running in your account no longer match the desired state described in your infrastructur…" → ✅ verified (evidence: Multiple industry sources confirm this standard definition, e.g., Spacelift: "Infrastructure drift refers to the situation where the actual state of cloud infrastructure resources deviates from the desired state defined in the IaC configur…; source: https://spacelift.io/blog/drift-detection)
• L26 in content/what-is/what-is-infrastructure-drift.md "To understand drift precisely, it helps to name the three states that every infrastructure as code stack tracks:" → ✅ verified (evidence: The linked page content/what-is/what-is-infrastructure-as-code.md exists at the exact path /what-is/what-is-infrastructure-as-code/ and defines IaC as tracking desired state, current state, and reconciliation via a state file, consistent w…; source: repo:content/what-is/what-is-infrastructure-as-code.md)
• L28-30 in content/what-is/what-is-infrastructure-drift.md "1. Current state — what your IaC tool believes exists, recorded in a state file. It's updated by every successful deploy, refresh, or destroy." → ✅ verified (evidence: Pulumi docs confirm the state file is updated by deploy (up), refresh, and destroy operations: refresh "Update your stack's state file with the current state of your resources from your cloud provider," and destroy causes "all of this stac…; source: https://www.pulumi.com/docs/deployments/deployments/using/triggers/)
• L38 in content/what-is/what-is-infrastructure-drift.md "Drift comes from two broad sources, and telling them apart is the first step in deciding what to do." → ➖ not-a-claim (evidence: This is an editorial/framing statement introducing the author's own categorization scheme in the blog post, not a falsifiable factual assertion attributed to a third party or source.; source: content/what-is/what-is-infrastructure-drift.md (author's own framing))
• L56 in content/what-is/what-is-infrastructure-drift.md "Drift undermines the guarantees that make IaC valuable in the first place." → ➖ not-a-claim (evidence: This is a subjective positioning statement/opinion about the value proposition of IaC, not a falsifiable factual assertion that can be checked against an authoritative source.; source: content/what-is/what-is-infrastructure-drift.md L56)
• L66 in content/what-is/what-is-infrastructure-drift.md "AI agents are increasingly provisioning and modifying infrastructure." → ✅ verified (evidence: The linked page /what-is/what-is-agentic-infrastructure/ exists and states "Agentic infrastructure is cloud infrastructure that AI agents provision, govern, and operate autonomously" and notes "Pulumi is tracking LLMs doing over 20% of inf…; source: repo:content/what-is/what-is-agentic-infrastructure.md)
• L70-74 in content/what-is/what-is-infrastructure-drift.md "In Pulumi, the canonical command to detect infrastructure drift is pulumi refresh --preview-only --stack production." → ✅ verified (evidence: pulumi/docs content/docs/iac/operations/stack-management/drift.md states: "pulumi refresh --preview-only is the canonical way to detect drift from the CLI" and gives the exact example "pulumi refresh --preview-only --stack production".; source: gh search code --owner pulumi "preview-only" (pulumi/docs:content/docs/iac/operations/stack-management/drift.md))
• L76 in content/what-is/what-is-infrastructure-drift.md "pulumi refresh --preview-only queries each resource's provider for its live configuration, compares the response to the stack's recorded state, and prints a…" → ✅ verified (evidence: The sibling docs page content/docs/iac/operations/stack-management/drift.md states verbatim: "pulumi refresh --preview-only ... The command queries each resource's provider for its actual configuration, compares the response to the stack…; source: repo:content/docs/iac/operations/stack-management/drift.md)
• L78-84 in content/what-is/what-is-infrastructure-drift.md "Adding --expect-no-changes to pulumi refresh --preview-only causes the command to exit non-zero if any drift is found." → ✅ verified (evidence: The pulumi_refresh CLI reference documents --expect-no-changes as "Return an error if any changes occur during this refresh," and the exit-codes doc maps this to exit code 7: "An expectation about changes is not met, such as when `--expe…; source: repo:content/docs/iac/cli/commands/pulumi_refresh.md, repo:content/docs/iac/cli/exit-codes.md)
• L89 in content/what-is/what-is-infrastructure-drift.md "Pulumi Deployments webhooks can route notifications to Slack, PagerDuty, or any HTTP endpoint without writing a polling loop." → ✅ verified (framing: strengthened — source explicitly lists Slack/Microsoft Teams/generic Webhook destinations plus a drift_detected event; claim narrows "Microsoft Teams" out and…; evidence: The Pulumi Cloud Webhooks doc (content/docs/deployments/concepts/webhooks.md) confirms webhook destinations of "Webhook", "Slack" or "Microsoft Teams" ("Under Destination, choose Webhook, Slack or Microsoft Teams"), generic webhooks accept…; source: gh api repos/pulumi/docs/contents/content/docs/deployments/concepts/webhooks.md)
• L97 in content/what-is/what-is-infrastructure-drift.md "Adoption — change the code to match the cloud. You accept reality into your state file, then edit your program so it describes the new configuration. This…" → ➖ not-a-claim (evidence: This is explanatory/conceptual content describing an IaC drift-remediation strategy ("adoption"), not a falsifiable factual assertion about a product, version, or third-party fact.; source: repo:content/what-is/what-is-infrastructure-drift.md)
• L105 in content/what-is/what-is-infrastructure-drift.md "Pulumi's ignoreChanges resource option marks properties as externally managed, so a refresh reports only the drift you want to act on and a deploy won't figh…" → ✅ verified (evidence: The ignoreChanges doc states one common reason to use the option is "Allowing an external system to manage aspects of the resource. In these cases you do not want Pulumi to reset values to their original Pulumi value," and separately expla…; source: repo:content/docs/iac/concepts/resources/options/ignorechanges.md)
• L107 in content/what-is/what-is-infrastructure-drift.md "The protect resource option causes Pulumi to refuse an operation rather than delete/recreate a resource, even if drift on an immutable property would otherwi…" → ✅ verified (evidence: The official protect docs state: "The protect resource option marks a resource as protected. A protected resource cannot be deleted directly, and it will be an error to do a Pulumi deployment which tries to delete a protected resource fo…; source: repo:content/docs/iac/concepts/resources/options/protect.md)
• L109 in content/what-is/what-is-infrastructure-drift.md "Pulumi Components package best-practice defaults such as tagging, encryption, and access controls into reusable building blocks." → 🤷 unverifiable (evidence: verification did not converge within 8 turns)
• L111 in content/what-is/what-is-infrastructure-drift.md "Enforce guardrails that survive adoption. Policy as code matters most when paired with drift handling. If a teammate op…" → ✅ verified (evidence: The linked page (/what-is/what-is-policy-as-code/) explicitly discusses this exact scenario: "No security group should allow ingress from 0.0.0.0/0. These rules are trivial to express in code and can be enforced on every deployment" and de…; source: repo:content/what-is/what-is-policy-as-code.md)
• L113 in content/what-is/what-is-infrastructure-drift.md "A GitOps reconciliation loop re-applies the program on a fixed cadence so out-of-band changes are reverted within minutes." → ✅ verified (evidence: Cited docs page /docs/iac/operations/stack-management/drift/ states: "In a GitOps setup, a controller watches the git repository and runs pulumi up --refresh (or its equivalent) on a fixed cadence, so the cloud matches the program at all…; source: repo:content/docs/iac/operations/stack-management/drift.md)
• L119-120 in content/what-is/what-is-infrastructure-drift.md "Pulumi supports scheduled, managed drift detection through Pulumi Deployments with a Drift tab and event webhooks." → ✅ verified (evidence: Sibling docs page content/docs/iac/operations/stack-management/drift.md states: "Pulumi Deployments. Deployments runs scheduled drift jobs against your stacks and can either stop at detection (a preview-only refresh that surfaces the diff…; source: gh search code --repo pulumi/docs "Drift tab")
• L121 in content/what-is/what-is-infrastructure-drift.md "Pulumi Policy enforcement spans both preview-time prevention and audit of live resources." → ✅ verified (evidence: Sibling page content/what-is/what-is-policy-as-code.md states: "The two most important enforcement dimensions are preventative (block a resource from being created if it violates policy) and audit (continuously evaluate existing resources…; source: repo:content/what-is/what-is-policy-as-code.md)
• L123 in content/what-is/what-is-infrastructure-drift.md "Pulumi Neo, given a drifted stack, runs the refresh, reads the diff, edits the program to match, runs a clean preview, and opens a pull request for review." → ✅ verified (evidence: The sibling docs page content/docs/iac/operations/stack-management/drift.md states almost verbatim: "hand it the stack and the drift, and it will run the refresh, read the resulting diff, edit the program so it matches, run a clean preview…; source: repo:content/docs/iac/operations/stack-management/drift.md (line 102); repo:content/product/neo.md)
• L125 in content/what-is/what-is-infrastructure-drift.md "For the complete, step-by-step workflows, see Detecting and reconciling drift in the Pulumi docs." → ✅ verified (evidence: The file content/docs/iac/operations/stack-management/drift.md exists at the referenced URL path /docs/iac/operations/stack-management/drift/, titled "Detecting and reconciling drift", and covers step-by-step workflows for detecting drift…; source: repo:content/docs/iac/operations/stack-management/drift.md)
• L139 in content/what-is/what-is-infrastructure-drift.md "Adding --expect-no-changes to pulumi refresh --preview-only makes the command exit non-zero when drift exists, turning it into a pass/fail signal for a sch…" → 🤝 matches (evidence: The same document explicitly states this behavior earlier: "Now the command exits non-zero if any drift is found, and your CI job, alert hook, or shell script can key off the exit code" (line 84), describing `pulumi refresh --preview-only…; source: repo:content/what-is/what-is-infrastructure-drift.md (lines 78-84, 139))
• L143 in content/what-is/what-is-infrastructure-drift.md "Reverting a drifted immutable property via remediation can force Pulumi to delete and recreate the resource." → ✅ verified (evidence: The same doc states elsewhere: "If a drifted immutable property would force a replacement, you want to know before you run it" (L95) and "if the out-of-band change touched an immutable property, the tool may delete and recreate the resourc…; source: repo:content/what-is/what-is-infrastructure-drift.md (L60, L95))
• L155 in content/what-is/what-is-infrastructure-drift.md "It can be. Some of the most consequential drift is exactly the security-relevant kind—an ingress rule opened to the internet, encryption disabled, an IAM polic…" → ➖ not-a-claim (evidence: This is explanatory/opinion text in a conceptual "what is" article about infrastructure drift, arguing why security-relevant drift is consequential — it's not a falsifiable factual assertion tied to a specific product, version, or external…; source: repo:content/what-is/what-is-infrastructure-drift.md)
• L159 in content/what-is/what-is-infrastructure-drift.md "Pulumi detects, reconciles, and helps prevent infrastructure drift across any cloud via CLI-driven refresh and remediation, managed scheduled detection in Pulu…" → ✅ verified (evidence: The same article's own "How does Pulumi handle drift?" section states: "Detection via pulumi refresh --preview-only from the CLI, or scheduled, managed detection through Pulumi Deployments with a Drift tab and event webhooks... Reconcili…; source: repo:content/what-is/what-is-infrastructure-drift.md (lines 115-123, 159); repo:content/docs/iac/operations/stack-management/drift.md)
• L163 in content/what-is/what-is-infrastructure-drift.md "* Detecting and reconciling drift" → ✅ verified (evidence: The stack-management index page lists this exact entry: "Detecting and reconciling drift - Detect when your cloud resources diverge from your Pulumi program, then choose to remediate (re-…; source: repo:content/docs/iac/operations/stack-management/_index.md)
• L164 in content/what-is/what-is-infrastructure-drift.md "* Pulumi Cloud drift detection" → ✅ verified (evidence: The docs repo has content/docs/deployments/concepts/drift.md (title "Drift detection and remediation") which maps to URL /docs/deployments/concepts/drift/, matching the linked source and its description of Pulumi Cloud drift detection: "Th…; source: gh api repos/pulumi/docs/contents/content/docs/deployments/concepts/drift.md)
• L165-168 in content/what-is/what-is-infrastructure-drift.md "* What is an internal developer platform?" → ✅ verified (evidence: The linked page content/what-is/what-is-an-internal-developer-platform.md exists and is titled "What is an Internal Developer Platform (IDP)?", matching the link text and anchor destination /what-is/what-is-an-internal-developer-platform/.; source: repo:content/what-is/what-is-an-internal-developer-platform.md)
• L214 in content/what-is/what-is-policy-as-code.md "A page titled 'What is infrastructure drift?' exists at the URL /what-is/what-is-infrastructure-drift/ on the Pulumi website." → ✅ verified (evidence: The file content/what-is/what-is-infrastructure-drift.md exists with title 'What Is Infrastructure Drift?', which resolves to the URL path /what-is/what-is-infrastructure-drift/ per Pulumi's what-is content structure.; source: repo:content/what-is/what-is-infrastructure-drift.md)

[github-actions]

🚨 Outstanding in this PR

No outstanding issues in this PR.

⚠️ Low-confidence

Review each and resolve as appropriate — these don't block the PR.

• [L135] content/what-is/what-is-agentic-infrastructure.md — "Pulumi Neo opens pull requests that flow through existing GitHub, GitLab, or Bitbucket workflows." — verdict: unverifiable (the verification step ran out of turns before converging). Pre-existing content on a line this PR did not touch, and the same VCS-list wording as the contradicted L65 (see 💡 Pre-existing): the canonical Neo docs list GitHub, Azure DevOps, and GitLab — not Bitbucket. Doesn't block this PR; fold into the same follow-up correction as L65.

• [L109] content/what-is/what-is-infrastructure-drift.md — "Pulumi Components package best-practice defaults such as tagging, encryption, and access controls into reusable building blocks." — verdict: unverifiable (the verification step ran out of turns before converging). This is accurate and low-risk: Pulumi Components are documented as reusable abstractions that bundle multiple resources with sensible defaults, and the surrounding sentence links to /docs/iac/concepts/components/ (confirmed to exist). No change required, but if you want a citable anchor for the "tagging, encryption, and access controls" examples specifically, consider linking a concrete component example. Author question: is the tagging/encryption/access-controls list meant as illustration, or pointing at a specific published component?

Style findings

Found by pattern-based linting; Findings may be false positives.

• line 40: [style] substitution — Use 'select' instead of 'click' (STYLE-GUIDE.md).
• line 99: [style] weasel word — 'usually' is a weasel word!
• line 123: [style] em-dash density — Heavy em-dash use in this paragraph (more than 2). Dense em-dash usage is often associated with AI-drafted prose; consider substituting commas or periods where it doesn't change emphasis.
• line 129: [style] difficulty qualifier — Avoid difficulty qualifier 'simple' -- it judges difficulty for the reader (STYLE-GUIDE.md §Inclusive Language).
• line 131: [style] weasel word — 'usually' is a weasel word!
• line 131: [style] substitution — Use 'select' instead of 'click' (STYLE-GUIDE.md).
• line 151: [style] difficulty qualifier — Avoid difficulty qualifier 'easy' -- it judges difficulty for the reader (STYLE-GUIDE.md §Inclusive Language).

💡 Pre-existing issues in touched files (optional)

These sit in what-is-agentic-infrastructure.md, which this PR only touched on line 69 (adding the drift cross-link). They pre-date this PR and don't block it — worth a separate follow-up.

• [L33] content/what-is/what-is-agentic-infrastructure.md — "Frontier models score 86% on SWE-bench Verified today, up from 33% in August 2024." — verdict: contradicted. Pre-existing: on an untouched line. The Aug-2024 33% baseline checks out, but "86% today" is stale against current SWE-bench Verified leaderboards (top frontier models are higher as of mid-2026). Consider softening to "over 80%" or citing a dated snapshot in a follow-up. Source: https://openai.com/index/introducing-swe-bench-verified/ ; https://www.vals.ai/benchmarks/swebench

• [L65] content/what-is/what-is-agentic-infrastructure.md — "Pulumi Neo's PR flows through the user's existing GitHub, GitLab, or Bitbucket CI/CD pipeline." — verdict: contradicted. Pre-existing: on an untouched line. The canonical Neo docs list supported version-control integrations as GitHub, Azure DevOps, and GitLab — not Bitbucket. Worth correcting the VCS list in a follow-up. Source: repo:content/docs/ai/pull-requests/_index.md

• [L185] content/what-is/what-is-agentic-infrastructure.md — "The embedded YouTube video (ID SOMEfFNPsew) corresponds to Joe Duffy's CascadiaJS 2026 keynote described in the surrounding text." — verdict: contradicted. Pre-existing: on an untouched line. The video ID SOMEfFNPsew reads as a placeholder (the CascadiaJS 2026 event page has an empty youtube_url, so no keynote recording exists yet). Replace with the real embed once the recording is published. Source: repo:content/events/cascadiajs-2026/index.md

✅ Resolved since last review

No items resolved since the last review.

📜 Review history

• 2026-07-06T23:46:25Z — New "What Is Infrastructure Drift?" explainer: Pulumi drift claims and all internal links verified, no blockers; three ❌ contradictions are pre-existing in the untouched agentic-infrastructure page. (896f60f)

---

Need a re-review? Want to dispute a finding? Mention @claude and include #update-review.
(For ad-hoc questions or fixes, just @claude — no hashtag.)

[CamSoper]

Automated rubber stamp approval applied

---

Generated by Claude Code