Remove obsolete CrossGuard branding

[jkodroff]

Scrubs residual "CrossGuard" wording from active docs and template pages, routing links to the canonical /docs/insights/policy/ path. Aliases on every moved page are preserved so SEO and external links stay intact.

Note

Depends on #19123. The broken Pulumi Policies tab on /product/pulumi-cloud/ is fixed there by deleting the page entirely. The JS rename that was originally part of this PR has been dropped (commit 2000160 reverts it) so the two PRs don't conflict on merge. Land #19123 first; this PR has no overlap with master after that.

Changes

• 9 docs: rewrite inline /docs/.../crossguard/ links → /docs/insights/policy/; refresh "CrossGuard" → "Pulumi Policies" in SDK reference pages and /why-pulumi/.
• 3 layouts: update superpowers.html relrefs, fix why-pulumi.html prose, remove unreachable /docs/crossguard/ branch from breadcrumb schema partial.
• Deletes: orphan layouts/page/crossguard.html and the 4-image static/images/docs/guides/crossguard/ directory.
• FAQ cleanup: remove obsolete screenshot from content/docs/support/faq/policies.md.

All crossguard URL aliases on moved pages and the product page are preserved.

[pulumi-bot]

Your site preview for commit 2000160 is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-19116-20001604.s3-website.us-west-2.amazonaws.com

[pulumi-bot]

Lighthouse Performance Report

Commit: 2000160 | Metric definitions

Page	Device	Score	FCP	LCP	TBT	CLS	SI
Homepage	Mobile	🔴 30	5.4s	6.8s	2746ms	0.000	9.1s
Homepage	Desktop	🟡 79	0.8s	1.1s	287ms	0.046	2.9s
Install Pulumi	Mobile	🔴 35	5.1s	7.7s	239ms	0.439	8.0s
Install Pulumi	Desktop	🟡 84	1.3s	1.6s	20ms	0.028	3.0s
AWS Get Started	Mobile	🟡 52	5.1s	7.5s	280ms	0.082	7.7s
AWS Get Started	Desktop	🟡 83	1.2s	1.7s	22ms	0.024	2.9s

[github-actions]

Pre-merge Review — Last updated 2026-05-18T18:55:38Z

Tip

Summary: Replaces obsolete CrossGuard branding across the docs and marketing site — swapping legacy /docs/using-pulumi/crossguard/ (and friends) links for /docs/insights/policy/, rewording Policy SDK list entries, deleting the unused layouts/page/crossguard.html template plus four orphaned screenshot assets, and dropping the now-stale CrossGuard breadcrumb branch from the schema collector. The kind of wrongness that would block a reader is a replacement link that 404s or a CrossGuard mention left dangling in a peer page that should have moved together; the verification trail confirms every new /docs/insights/policy/ target resolves, and a fan-out across same-directory peers found no remaining using-pulumi/crossguard or CrossGuard strings. Passes that ran: external claim verification, frontmatter sweep, cross-sibling consistency, Vale style nags.

Review confidence:

Dimension	Level	Notes
mechanics	HIGH
facts	HIGH
cross-sibling consistency	HIGH

Investigation log

• Cross-sibling reads: 21 of 21 siblings — confirmed none retain CrossGuard or /docs/using-pulumi/crossguard/ references after this PR's substitutions
• External claim verification: 24 of 26 claims verified (0 unverifiable, 2 contradicted) · 4 specialists (numerical, cross-reference, capability, framing); 0 cross-specialist corroborations · routed: 0 inline, 26 Pass 1, 0 Pass 2, 0 Pass 3.
• Cited-claim spot-checks: not run (no cited claims)
• Frontmatter sweep: ran on body + meta_desc
• Temporal-trigger sweep: ran (recency words present in diff; spot-check in-review)
• Code execution: not run (no static/programs/ change)
• Code-examples checks: not run (no fenced code blocks in content files)
• Editorial-balance pass: not run (not under content/blog/)

🚨 Outstanding	⚠️ Low-confidence	💡 Pre-existing	✅ Resolved
0	4	2	0

🔍 Verification trail

26 claims extracted · 24 verified · 0 unverifiable · 2 contradicted

• L25 in content/docs/administration/self-hosting/components/deployments.md "The documentation link for policy evaluations points to /docs/insights/policy/." → ✅ verified (evidence: Line 25 of deployments.md reads: "customer-managed workflow runners also support Insights discovery scans and policy evaluations." The target file content/docs/insights/policy/_index.md exis…; source: repo:content/docs/administration/self-hosting/components/deployments.md and repo:content/docs/insights/policy/_index.md)
• L25 in content/docs/administration/self-hosting/components/deployments.md "Pulumi Deployments features can be enabled by configuring a Kubernetes-native workflow runner pool in Pulumi Cloud and installing one or more customer-managed…" → ✅ verified (evidence: The file at L25 states: "you can enable Pulumi Deployments features by configuring a Kubernetes-native workflow runner pool in Pulumi Cloud and installing one or more [customer-managed workflow runners] into your installation's Kubernetes…; source: repo:content/docs/administration/self-hosting/components/deployments.md)
• L38 in content/docs/deployments/deployments/_index.md "Customer-managed workflow runners support running Pulumi operations, Insights discovery scans, and policy evaluations on your own infrastructure." → ✅ verified (evidence: The file at L38 states: "Run Pulumi operations, Insights discovery scans, and policy evaluations on your own infrastructure with [customer-managed workflow runners](/docs/deployments/deployments…; source: repo:content/docs/deployments/deployments/_index.md)
• L17 in content/docs/deployments/deployments/runs/customer-managed-agents.md "Customer-Managed Workflow Runners allow you to self-host workflow runners, bringing the same power and flexibility as Pulumi-hosted workflows." → ✅ verified (evidence: The file at L17 reads verbatim: "Customer-Managed Workflow Runners allow you to self-host workflow runners, bringing the same power and flexibility as Pulumi-hosted workflows." This matches the claim exactly.; source: repo:content/docs/deployments/deployments/runs/customer-managed-agents.md)
• L19-20 in content/docs/deployments/deployments/runs/customer-managed-agents.md "Customer-Managed Workflow Runners can run on any hardware and support configurable environments." → ✅ verified (evidence: The file at lines 19-20 states: "Any hardware, any environment¹: Run the workflow runners on any hardware of your choice and configure the environment that meets your needs", directly confirming that Customer-Managed Workflow Runners c…; source: repo:content/docs/deployments/deployments/runs/customer-managed-agents.md)
• L20 in content/docs/deployments/deployments/runs/customer-managed-agents.md "Customer-Managed Workflow Runners can run on any hardware of the user's choice and can be configured to meet the user's environment needs." → ✅ verified (framing: strengthened — claim paraphrases the bullet point accurately; the source's phrasing "any hardware of your choice and configure the environment that meets your…; evidence: The file at L20 contains the bullet: "Any hardware, any environment¹: Run the workflow runners on any hardware of your choice and configure the environment that meets your needs" — directly confirming the claim.; source: repo:content/docs/deployments/deployments/runs/customer-managed-agents.md)
• L21 in content/docs/deployments/deployments/security-and-operations.md "Customer-managed workflow runners are available as an option for users requiring additional isolation, at the path /docs/deployments/deployments/runs/customer-…" → ✅ verified (evidence: The file content/docs/deployments/deployments/runs/customer-managed-agents.md exists in the repo, and security-and-operations.md L21 reads: "It is also possible to use [customer-managed workflow runners](/docs/deployments/deployments/r…; source: repo:content/docs/deployments/deployments/security-and-operations.md; gh search code --owner pulumi "customer-managed-agents" --extension md)
• L21 in content/docs/deployments/deployments/security-and-operations.md "Policy evaluations are documented at the path /docs/insights/policy/." → ✅ verified (evidence: Line 21 of security-and-operations.md links "policy evaluations" to /docs/insights/policy/, and the file content/docs/insights/policy/_index.md exists as a valid documentation page titled "Policies" covering policy evaluations.; source: repo:content/docs/deployments/deployments/security-and-operations.md and repo:content/docs/insights/policy/_index.md)
• L21 in content/docs/deployments/deployments/security-and-operations.md "The isolation model applies to all workflow types supported by workflow runners, including Insights discovery scans." → ✅ verified (framing: strengthened — claim narrows the source's "including Insights discovery scans and policy evaluations" to just "including Insights discovery scans"; the source'…; evidence: The file at L21 states: "The same isolation applies to all workflow types supported by workflow runners, including Insights discovery scans and policy evaluations." The claim correctly captures…; source: repo:content/docs/deployments/deployments/security-and-operations.md)
• L21 in content/docs/deployments/deployments/security-and-operations.md "OIDC security features allow fine-tuning of credential scope, lifetime, and expiration policies at a per-deployment level in Pulumi Deployments." → ✅ verified (evidence: The file at content/docs/deployments/deployments/security-and-operations.md states: "security features like OIDC allow you to fine tune credential scope, lifetime, and expiration policies at a per-deployment level."; source: repo:content/docs/deployments/deployments/security-and-operations.md)
• L1 in content/docs/deployments/deployments/using/settings.md "If a stack does not have a pool explicitly configured, the deployment uses the organization's default workflow runner pool if one is set, and otherwise falls b…" → ✅ verified (evidence: The exact text appears verbatim in content/docs/deployments/deployments/using/settings.md: "If a stack does not have a pool explicitly configured, the deployment uses the organization's [default workflow runner pool] if one is set, and o…; source: gh search code --owner pulumi "setting-an-organization-default-pool" --extension md)
• L1 in content/docs/deployments/deployments/using/settings.md "The policy evaluations documentation for Customer-Managed Workflow Runners is located at /docs/insights/policy/ (not /docs/using-pulumi/crossguard/)." → ✅ verified (evidence: The file content/docs/deployments/deployments/using/settings.md explicitly links policy evaluations to /docs/insights/policy/: "supporting deployments, Insights discovery scans, and [policy evaluations](/docs/insight…; source: repo:content/docs/deployments/deployments/using/settings.md)
• L53 in content/docs/deployments/deployments/using/settings.md "Pulumi Hosted Pool is managed by Pulumi and available to all Pulumi Cloud customers." → ✅ verified (evidence: The file at content/docs/deployments/deployments/using/settings.md under "Deployment Runner Pools" contains the exact text: "Pulumi Hosted Pool: Managed by Pulumi and available to all Pulumi Cloud customers".; source: repo:content/docs/deployments/deployments/using/settings.md)
• L53-54 in content/docs/deployments/deployments/using/settings.md "The policy evaluations documentation is located at /docs/insights/policy/ (not /docs/using-pulumi/crossguard/)." → ✅ verified (evidence: The file at content/docs/deployments/deployments/using/settings.md (lines 53-54) contains the link [policy evaluations](/docs/insights/policy/), confirming the URL /docs/insights/policy/ is used rather than `/docs/using-pulumi/crossgua…; source: repo:content/docs/deployments/deployments/using/settings.md)
• L56 in content/docs/deployments/deployments/using/settings.md "If a stack does not have a pool explicitly configured, the deployment uses the organization's default workflow runner pool if one is set, and otherwise falls b…" → ✅ verified (evidence: The exact claim text appears verbatim in content/docs/deployments/deployments/using/settings.md: "If a stack does not have a pool explicitly configured, the deployment uses the organization's [default workflow runner pool](/docs/deployme…; source: gh search code --owner pulumi "setting-an-organization-default-pool" --extension md → pulumi/docs:content/docs/deployments/deployments/using/settings.md)
• L900 in content/docs/iac/guides/migration/migrating-to-pulumi/from-serverless.md "Pulumi's Policy as Code documentation is located at the path /docs/insights/policy/." → ✅ verified (evidence: The file content/docs/insights/policy/_index.md exists in the repo with title "Policies" and meta description "Enforce compliance and security across all cloud infrastructure using policy as code with Pulumi Policies", confirming the pat…; source: repo:content/docs/insights/policy/_index.md)
• L7 in content/docs/reference/pkg/nodejs/_index.md "The @pulumi/policy Node.js SDK is for authoring policy packs for Pulumi Policies in TypeScript or JavaScript." → ✅ verified (evidence: The file at content/docs/reference/pkg/nodejs/_index.md line 7 reads: "Pulumi Policy SDK (@pulumi/policy)](/docs/reference/pkg/nodejs/pulumi/policy/) — for authoring policy packs for Pulumi Policies in TypeScript or JavaScript." Th…; source: repo:content/docs/reference/pkg/nodejs/_index.md)
• L9 in content/docs/reference/pkg/python/_index.md "The Pulumi Policy SDK (pulumi_policy) is used for authoring policy packs for Pulumi Policies in Python." → ✅ verified (evidence: The file at content/docs/reference/pkg/python/_index.md contains exactly: "Pulumi Policy SDK (pulumi_policy): for authoring policy packs for Pulumi Policies in Python." — matching the claim verbatim.; source: repo:content/docs/reference/pkg/python/_index.md)
• L10 in content/docs/reference/pkg/python/_index.md "The Pulumi ESC SDK (pulumi_esc_sdk) is used for programmatically interacting with Pulumi ESC (Environments, Secrets, and Configuration)." → ✅ verified (evidence: The file at content/docs/reference/pkg/python/_index.md line 10 states exactly: "Pulumi ESC SDK (pulumi_esc_sdk): for programmatically interacting with Pulumi ESC (Environments, Secrets, and Configuration)."; source: repo:content/docs/reference/pkg/python/_index.md)
• L12 in content/docs/reference/pkg/python/_index.md "The reference documentation for the Pulumi Terraform Bridge Python package has moved to the Terraform on the Pulumi Registry page at /registry/packages/terrafo…" → ✅ verified (evidence: The file at content/docs/reference/pkg/python/_index.md contains exactly: "The reference for the Pulumi Terraform Bridge Python package has moved — see Terraform on the Pulumi Registry." — confir…; source: repo:content/docs/reference/pkg/python/_index.md)
• L42 in content/docs/support/faq/policies.md "Under a stack's 'Settings' tab, users can view the Policy Packs that would be enforced on a preview or update, as well as the Policy Groups that the stack…" → ✅ verified (evidence: The file at line ~42 states: "Under a stack's "Settings" tab you can take a look at the Policy Packs that would be enforced on a preview or update as well as the Policy Groups that the stack belongs to." — which directly matches the cl…; source: repo:content/docs/support/faq/policies.md)
• L46 in content/docs/support/faq/policies.md "During the next update after a pulumi stack import, resources and the state file are updated based on the stack's Pulumi program, which must be in compliance…" → ✅ verified (framing: strengthened — claim narrows "must be in compliance to succeed" to "must be in compliance with Policy Packs to succeed"; the section's Policy as Code context c…; evidence: The source file at L46 states: "During the next update, the resources and state file would be updated based on the stack's Pulumi program, which must be in compliance to succeed." The claim adds "with Policy Packs" as a clarifying qualifie…; source: repo:content/docs/support/faq/policies.md)
• L127 in layouts/page/superpowers.html "<a class='link' href='{{ relref . '/docs/insights/policy/' }}'> Policy " → ✅ verified (evidence: The file content/docs/insights/policy/_index.md exists in the repo with title "Policies", confirming that the URL path /docs/insights/policy/ is a valid, resolvable docs page.; source: repo:content/docs/insights/policy/_index.md)
• L134 in layouts/page/superpowers.html "<a class='link' href='{{ relref . '/docs/insights/policy/' }}'>" → ✅ verified (evidence: The file content/docs/insights/policy/_index.md exists in the repo, confirming that the URL path /docs/insights/policy/ is a valid, resolvable documentation page.; source: repo:content/docs/insights/policy/_index.md)
• L1 in content/docs/iac/guides/migration/migrating-to-pulumi/from-serverless.md "frontmatter menu.iac.parent: iac-guides-migration-from does not exist in the iac menu" → ⚔️ mismatch (evidence: menu=iac parent=iac-guides-migration-from parent_exists_in_menu=false; source: frontmatter-validate.py pre-step)
• L1 in content/docs/support/faq/policies.md "frontmatter alias /docs/iac/packages-and-automation/crossguard/ collides with content/docs/insights/policy/_index.md" → ⚔️ mismatch (evidence: alias=/docs/iac/packages-and-automation/crossguard/ collides_with=content/docs/insights/policy/_index.md; source: frontmatter-validate.py pre-step)

🚨 Outstanding in this PR

No outstanding issues.

⚠️ Low-confidence

Review each and resolve as appropriate — these don't block the PR.

Style findings

Found by pattern-based linting; Findings may be false positives.

• line 25: [style] wordiness — 'In addition' is too wordy.
• line 21: [style] wordiness — 'In addition' is too wordy.
• line 21: [style] wordiness — 'expiration' is too wordy.
• line 21: [style] wordiness — 'It is' is too wordy.

💡 Pre-existing issues in touched files (optional)

• [L1] content/docs/iac/guides/migration/migrating-to-pulumi/from-serverless.md — "frontmatter menu.iac.parent: iac-guides-migration-from does not exist in the iac menu" — verdict: mismatch; evidence: menu=iac parent=iac-guides-migration-from parent_exists_in_menu=false; source: frontmatter-validate.py pre-step. Pre-existing: the menu.iac.parent declaration sits on line 11 of the file's frontmatter, which this PR does not touch (only the URL on line 900 changes). All five sibling migration guides (from-arm.md, from-cdk.md, from-cloudformation.md, from-kubernetes.md, from-terraform.md) declare the same parent identifier — the missing entry is in data/docs_menu_sections.yml and is out of scope for a CrossGuard-rename PR.

• [L1] content/docs/support/faq/policies.md — "frontmatter alias /docs/iac/packages-and-automation/crossguard/ collides with content/docs/insights/policy/_index.md" — verdict: mismatch; evidence: alias=/docs/iac/packages-and-automation/crossguard/ collides_with=content/docs/insights/policy/_index.md; source: frontmatter-validate.py pre-step. Pre-existing: this PR's only edit to support/faq/policies.md is removing a stale screenshot reference at line ~44 — the aliases: block in the frontmatter is untouched. Both pages have been claiming /docs/iac/packages-and-automation/crossguard/ since before this branch; reconciling alias ownership belongs in a follow-up.

✅ Resolved since last review

No items resolved since the last review.

📜 Review history

• 2026-05-18T18:55:38Z — terminology cleanup; verification trail clean, two preflight frontmatter flags both pre-existing and triaged to 💡, cross-sibling fan-out confirms no remaining CrossGuard references (2000160)

---

Need a re-review? Want to dispute a finding? Mention @claude and include #update-review.
(For ad-hoc questions or fixes, just @claude — no hashtag.)

[CamSoper]

@claude #update-review

[github-actions]

🤖 @CamSoper — review errored. Mention @claude #update-review again to retry.

[CamSoper]

@claude #update-review

[github-actions]

🤖 @CamSoper — review errored. Mention @claude #update-review again to retry.