Names, labels and hostnames

Airframe derives almost every name from a product’s place in the catalog, so a name tells you what a thing belongs to without a lookup. This page lists the forms the platform uses for projects, identities, state, repositories and groups, the labels every resource carries, and the hostname a product gets in each environment, with the few hostnames that are public.

How to read the tables

A product is identified by its path, <journey>/<domain>/<context>/<product>. A name is unique only among its siblings, so a name that lives in a wider space than the product’s own projects carries the levels above it. Inside a product’s projects, the bare product name is enough, because the project is the namespace.

<rnd> is four lowercase letters and digits, drawn once when a project or bucket is made and never chosen by hand. <iid> is a merge request’s number. The examples come from a demo organization, a fictional online retailer whose code is lk.

The tables describe the platform at release 2026.10.01-1, as the contracts and the code that makes each name stand on 2026-10-01. Where they differ, the table follows the code. A row marked designed is a form the contracts specify that nothing creates yet.

Names

Product projects

Form

lk-<domain>-<product>-<rnd> and lk-<domain>-<product>-np-<rnd>

Example

lk-billing-invoicing-np-7q2m

Meaning

A product's production and non-production projects, made by its domain's project factory. The journey is not in the id; the labels say which journey. The policy pack denies a project id in any other form.

Source

landing-zone roots/project-factory/; control-plane policy/airframe/naming.rego

Platform projects

Form

lk-<service>-<rnd>, or lk-<service>-np-<rnd>

Example

lk-runtime-np-k3d8

Meaning

The platform's own projects, one per service: network, runtime, observability, ci, catalog, audit, pact, eventcatalog, website or analytics. The platform factory's suffixes are recorded in catalog.yaml.

Source

landing-zone docs/contracts.md 2, roots/project-factory/platform/; control-plane policy/airframe/naming.rego

Playgroundsdesigned

Form

Project lk-play-<name>-<rnd>; repository projectairframe/playground/<name>

Example

lk-play-router-experiment-x1c4

Meaning

A team's short-lived experiment with a budget and an expiry date. The catalog's schema describes playgrounds, but no root creates them yet.

Source

landing-zone docs/contracts.md 2; catalog schema/playground.schema.json

Plan and apply identities

Form

<product>-plan@ in each of the product's projects; <product>-apply@ in production and <product>-np-apply@ in non-production

Example

invoicing-apply@lk-billing-invoicing-7q2m.iam

Meaning

The identities a product's Terraform runs as. The plan identity reads; the apply identity changes the project. The executor may act as every plan identity and every non-production apply identity, and as no production one. The project is the namespace, so the bare product name is enough.

Source

landing-zone roots/project-factory/

Runtime identities

Form

<product>-<name>@ in the environment's project, with -sandbox or -eph-<iid> added in a sandbox or a preview

Example

invoicing-api@

Meaning

One identity per running service, named after the module call, holding exactly what that service uses.

Source

golden-path modules/cloud-run-service/main.tf

Platform root identities

Form

platform-<root>@ in the platform's runtime project; a domain's project factory is factory-<journey>-<domain>@

Example

platform-catalog@

Meaning

One identity per platform root, which only a job of its repository's protected main, in the environment platform/<root>, can obtain.

Source

landing-zone roots/wif/main.tf

State buckets

Form

lk-tfstate-platform-<rnd> and lk-tfstate-prod-<rnd> in the runtime project; lk-tfstate-np-<rnd> in the non-production runtime project

Example

lk-tfstate-platform-ivww

Meaning

Where Terraform keeps state: the platform roots', production's, and non-production's, each bucket encrypted with a key the platform holds.

Source

landing-zone roots/state/main.tf

Product state prefixes

Form

<journey>/<domain>/<context>/<product>/ followed by prod, grafana, np, sandbox or eph/<iid>

Example

settle/billing/invoicing/invoicing/eph/42

Meaning

Where each of a product's roots keeps its state: prod and grafana in the production bucket, the rest in the non-production one. Each apply identity may write its own product's prefixes and no others.

Source

landing-zone roots/project-factory/; golden-path template/.gitlab-ci.yml.jinja

Platform state prefixes

Form

platform/<repository>/<root>

Example

platform/landing-zone/network

Meaning

Each platform root's state, in the platform bucket. Each root's identity reads and writes its own prefix.

Source

landing-zone roots/wif/grants.tf

Product repositories

Form

projectairframe/<journey>/<domain>/<context>/<product>; in a domain's restricted group, projectairframe/<journey>/<domain>/<context>/restricted/<product>

Example

projectairframe/shop/store/ordering/orders

Meaning

Created by the domain's GitLab root, as the domain's factory account. A removed product's path is never reused.

Source

control-plane modules/product-repositories/main.tf; landing-zone roots/project-factory/

Repositories of a product spread over severaldesigned

Form

projectairframe/<journey>/<domain>/<context>/<product>/<repo>

Example

projectairframe/fulfil/shipping/tracking/tracking/api

Meaning

One repository per application, under the product's own group, each with its own state, images and preview hostname.

Source

landing-zone docs/contracts.md 2, docs/adr/0017-multi-repository-products-and-adoption-by-moving-the-group.md

Users group

Form

lk-<journey>-<domain>-<context>-<product>-users@projectairframe.dev

Example

lk-shop-store-ordering-orders-users@

Meaning

The people who may reach the product behind single sign-on: today its team's active members.

Source

landing-zone roots/groups/main.tf

Team group

Form

lk-team-<team>@projectairframe.dev

Example

lk-team-store-core@

Meaning

A team's active members, with viewer access to the team's product projects.

Source

landing-zone roots/groups/main.tf, roots/project-factory/

Leads groups

Form

lk-journey-<journey>-leads@, lk-<journey>-<domain>-leads@ and lk-<journey>-<domain>-<context>-leads@, at projectairframe.dev

Example

lk-shop-store-leads@

Meaning

The leads of each level of the hierarchy, as the catalog names them.

Source

landing-zone roots/groups/main.tf

Platform groups

Form

lk-platform@ and lk-breakglass@, at projectairframe.dev

Example

lk-platform@

Meaning

The platform team, whose members approve every administrative grant, and the break-glass group, whose members may request most of the grants when the normal path is down.

Source

landing-zone roots/pam/main.tf

Secrets

Form

The name the product's secrets file gives it, in the environment's project

Example

secret-key

Meaning

A product's repository lists its secrets by name in its secrets file, never with a value. The golden path's secrets module creates each one, and a maintainer adds the value in Secret Manager.

Source

golden-path modules/secrets/main.tf

Pub/Sub topics and subscriptionsdesigned

Form

Topic <domain>.<product>.<noun>.<verb-past> in the publisher's project; subscription <consumer-product>-<name> in the consumer's

Example

store.orders.order.placed

Meaning

No module creates them yet. The catalog's topics and consumes already use the event names.

Source

landing-zone docs/contracts.md 2; golden-path modules/

A product's Terraform roots

Form

infra/prod, infra/np, infra/sandbox, infra/eph and infra/grafana

Example

infra/eph

Meaning

Production; non-production; the sandbox; a preview, which the executor applies; and the product's own dashboards, applied with the production apply identity in the environment grafana.

Source

golden-path template/infra/, template/.gitlab-ci.yml.jinja

GitLab environments

Form

prod, np and grafana in a product repository; platform/<root> in a platform repository; platform/audit, the drift report's, in both; executor in control-plane

Example

platform/network

Meaning

The environment is one of the facts workload identity federation checks, so a job obtains an identity only in its own environment. A product's own job may declare none.

Source

golden-path template/.gitlab-ci.yml.jinja; control-plane .gitlab-ci.yml, templates/drift-report/template.yml, policy/airframe/pipeline.rego

Module call names

Form

A slug of 2 to 14 characters

Example

api, worker-mail

Meaning

The name of a call to a golden path module. The module derives its resources' names from it, such as the Cloud Run service <product>-<name>, and refuses a name in any other form.

Source

golden-path modules/cloud-run-service/variables.tf, modules/cloud-sql/variables.tf

Raw resources in a product root

Form

<product>-<name>, with -<rnd> added for a name Google keeps global

Example

orders-exports-k3d8

Meaning

A resource a product declares itself, outside the golden path's modules. The policy pack warns on every such resource, and also when its name does not start with the product's.

Source

control-plane policy/airframe/naming.rego

Grafana

Form

A folder for each level of the product's path; dashboards <product> service, <product> SLO and <product> cost in the product's folder; a contact point per team

Example

orders service

Meaning

Created by operations' Grafana root from the catalog.

Source

operations roots/grafana/main.tf, roots/grafana/pack.tf

Google Cloud labels

Every project and resource carries labels that say what it belongs to, set by the project factory on projects and by the golden path’s modules on resources. The policy pack denies a resource that declares labels but lacks any of six: managed_by, tenant, domain, product, env and criticality (enforced, on the code and on the plan). A resource that declares no labels at all passes that rule.

managed_by

Values

airframe

Meaning

The platform manages the resource. Required by the policy pack.

Source

landing-zone docs/contracts.md 7; control-plane policy/airframe/naming.rego

tenant

Values

lk

Meaning

The organization's code. Required by the policy pack.

Source

landing-zone docs/contracts.md 7; control-plane policy/airframe/naming.rego

journey

Values

A journey slug, or platform

Meaning

The product's journey, on its projects and on resources whose module knows the product's path.

Source

landing-zone roots/project-factory/; golden-path modules/airframe-context/main.tf

domain

Values

A domain slug, or platform

Meaning

The product's domain. Required by the policy pack.

Source

golden-path modules/airframe-context/main.tf; control-plane policy/airframe/naming.rego

context

Values

A context slug, or platform

Meaning

The product's context, set like journey.

Source

landing-zone roots/project-factory/; golden-path modules/airframe-context/main.tf

product

Values

A product slug, or platform

Meaning

The product. Required by the policy pack, which also reads it to judge a raw resource's name.

Source

golden-path modules/airframe-context/main.tf; control-plane policy/airframe/naming.rego

component

Values

A component slug, or main

Meaning

The part of the product the resource belongs to.

Source

golden-path modules/airframe-context/main.tf

team

Values

A team slug

Meaning

The team that manages the product.

Source

landing-zone roots/project-factory/; golden-path modules/airframe-context/main.tf

env

Values

prod, np, sandbox, eph-<iid>, platform or play

Meaning

The environment. Required by the policy pack, and read by the pack's rules for previews.

Source

golden-path modules/airframe-context/main.tf; control-plane policy/airframe/naming.rego, cloud_run.rego

criticality

Values

1, 2, 3, or platform

Meaning

The product's criticality. Required by the policy pack.

Source

landing-zone roots/project-factory/; control-plane policy/airframe/naming.rego

data_classification

Values

public, internal, confidential or restricted

Meaning

How sensitive the product's data is, on the resources its modules create.

Source

golden-path modules/airframe-context/main.tf

root

Values

The state prefix with each / replaced by -

Meaning

Which Terraform root manages the resource.

Source

golden-path modules/airframe-context/main.tf

module

Values

The module's name and major version

Meaning

Which golden path module made the resource, such as cloud-run-service-0.

Source

golden-path modules/cloud-run-service/main.tf, modules/secrets/main.tf

expires

Values

A date

Meaning

On a preview's services: the end of its time to live, which the collector reads.

Source

golden-path modules/cloud-run-service/main.tf

GitLab labels

The GitLab root creates these labels at the top-level group, so every repository has them, except lifecycle, which a catalog merge request carries by name. Most are applied by people; the table says where something applies or reads one.

agent

On

Merge requests

Meaning

Authored by a coding agent, whose commits also carry a Generated-by trailer. Applied by the author; nothing checks it.

Source

control-plane roots/gitlab/locals.tf; landing-zone docs/contracts.md 7

lifecycle

On

Catalog merge requests

Meaning

A change of a product's lifecycle status. The gate refuses to judge such a change without it, and the catalog's lifecycle job requires it.

Source

control-plane gate/src/core/ownership.ts; catalog .gitlab-ci.yml, scripts/lifecycle-check.mjs

warndesigned

On

Merge requests

Meaning

A warn-level policy finding that needs the platform's approval. The label exists; nothing applies it, and a warning holds nothing back.

Source

control-plane roots/gitlab/locals.tf, templates/validate/template.yml

exception::open, exception::accepted, exception::expireddesigned

On

Merge requests and issues

Meaning

The exception register's states. The labels exist; the register is not built.

Source

control-plane roots/gitlab/locals.tf; landing-zone docs/contracts.md 7

preview::customdesigned

On

Merge requests

Meaning

A product with its own preview component. Nothing uses it, as nothing reads the catalog's preview field.

Source

control-plane roots/gitlab/locals.tf

console-gap

On

Issues

Meaning

Someone needed the console or a grant: the sign of a missing reconciler. Applied by hand.

Source

control-plane roots/gitlab/locals.tf; landing-zone docs/contracts.md 7

audit::drift

On

Issues

Meaning

A root whose infrastructure differs from its code. The drift report opens, rewrites and closes these issues on each repository's scheduled pipeline.

Source

control-plane templates/drift-report/template.yml

audit::orphan, audit::duplication, audit::misconfiguration, audit::cost, audit::keepdesigned

On

Issues

Meaning

The audit agent's findings and what was decided about them. The labels exist; the audit agent is not built.

Source

control-plane roots/gitlab/locals.tf; landing-zone docs/contracts.md 7

violation::perimeterdesigned

On

Issues

Meaning

A VPC Service Controls violation, with the rule that would allow it. The label exists; nothing opens these issues, and the perimeters run in dry run.

Source

control-plane roots/gitlab/locals.tf; landing-zone roots/perimeters/

postmortem, ops, adr

On

Issues and merge requests

Meaning

Postmortem work; a request for an operational job; a merge request that adds or supersedes a decision record. Applied by hand.

Source

control-plane roots/gitlab/locals.tf; landing-zone docs/contracts.md 7

Hostnames

Each journey has its own DNS zone, <journey>.projectairframe.dev, and the domain is a label inside it. Workers and internal services have no hostname. Every hostname is behind single sign-on, through Identity-Aware Proxy, a product’s for its users group, with three exceptions: a route a product declares public, which is designed; the gate; and this website. Grafana is at the vendor’s own address.

Production, the primary application

Hostname

<product>.<domain>.<journey>.projectairframe.dev

Paths

/ and /api

Environment label

prod

Access

Single sign-on.

Source

landing-zone docs/contracts.md 8, roots/network/modules/publications/main.tf; golden-path template/infra/prod/main.tf.jinja

Production, another application

Hostname

<product>-<app>.<domain>.<journey>.projectairframe.dev

Paths

/

Environment label

prod

Access

Single sign-on. The network root accepts the form; the template renders no second application.

Source

landing-zone roots/network/modules/publications/main.tf

Non-production

Hostname

<product>-np.<domain>.<journey>.projectairframe.dev

Paths

/ and /api

Environment label

np

Access

Single sign-on.

Source

golden-path template/infra/np/main.tf.jinja; landing-zone roots/network/modules/publications/main.tf

Sandbox

Hostname

<product>-sandbox.<domain>.<journey>.projectairframe.dev, or <product>-<app>-sandbox for another application

Paths

/ and /api

Environment label

sandbox

Access

Single sign-on.

Source

golden-path template/infra/sandbox/main.tf.jinja; landing-zone roots/network/modules/publications/main.tf

Preview of merge request <iid>

Hostname

<product>-eph-<iid>.<domain>.<journey>.projectairframe.dev

Paths

As in production

Environment label

eph-<iid>

Access

Single sign-on, through the product's preview router, which reads the merge request's number from the hostname. The domain's wildcard certificate and record cover every preview.

Source

golden-path modules/preview-substrate/main.tf, template/infra/eph/main.tf.jinja; landing-zone docs/contracts.md 8

Preview of one repository of a product spread over severaldesigned

Hostname

<product>-<repo>-eph-<iid>.<domain>.<journey>.projectairframe.dev

Paths

/

Environment label

eph-<iid>

Access

Single sign-on.

Source

landing-zone docs/contracts.md 8, docs/adr/0017-multi-repository-products-and-adoption-by-moving-the-group.md

Alias of an adopted productdesigned

Hostname

Each hostname in the entry's hostnames

Paths

As the product's own route

Environment label

prod

Access

As the product's own route. The catalog does not accept the field yet.

Source

landing-zone docs/contracts.md 8; catalog schema/product.schema.json

A product route declared publicdesigned

Hostname

One of the product's hostnames

Paths

The route's path

Environment label

prod

Access

Public, with no single sign-on, for a route named public on a product whose entry says external_ingress: true. The building block for it is not built: today every product backend has single sign-on, and the policy pack denies one without it.

Source

landing-zone docs/contracts.md 8; golden-path modules/cloud-run-service/main.tf; control-plane policy/airframe/cloud_run.rego

Playgrounddesigned

Hostname

play-<name>.projectairframe.dev

Paths

/

Environment label

play

Access

Single sign-on.

Source

landing-zone docs/contracts.md 8

The architecture catalog

Hostname

catalog.projectairframe.dev

Paths

/

Environment label

platform

Access

Single sign-on, for everyone in the organization.

Source

landing-zone docs/contracts.md 8; operations roots/eventcatalog/edge.tf

The gate

Hostname

gate.projectairframe.dev

Paths

/

Environment label

platform

Access

Public. The gate checks each caller's token itself, and the policy pack lists it as a service that does.

Source

landing-zone docs/contracts.md 8; control-plane policy/airframe/data.json, policy/airframe/cloud_run.rego

This website

Hostname

www.projectairframe.dev; projectairframe.dev redirects to it

Paths

/

Environment label

platform

Access

Public. It is the one service the policy pack lists as a public edge service.

Source

landing-zone docs/contracts.md 8, roots/network/edge.tf; control-plane policy/airframe/data.json

Other platform servicesdesigned

Hostname

pact.projectairframe.dev, argocd.projectairframe.dev and argocd-np.projectairframe.dev

Paths

/

Environment label

platform

Access

Single sign-on. Named in the contracts; none is built.

Source

landing-zone docs/contracts.md 8

The previews page explains how a preview’s hostname reaches its services, and the trust boundaries page what single sign-on protects.

Where it lives

In the landing-zone repository:

• docs/contracts.md: naming in section 2, labels in 7, hostnames in 8
• roots/project-factory/: the projects, identities and state prefixes
• roots/groups/main.tf: the Google groups
• roots/network/: the shared edge and the hostnames it accepts

In the golden-path repository:

• modules/airframe-context/: the labels every module sets