README
¶
choudoufu
OpenTofu with one permission model. 
Each resource carries its own ownership record as ordinary cloud tags. AWS can tell you what an estate contains, and your IAM already decides who may read or change it. Nothing else to permission, and no lock to manage. Experimental, AWS only.
Three things have to survive between runs, and each lives somewhere AWS
already has. Which real resource an address refers to is a tag on the
resource. Values AWS has nowhere to put go in a record_store, backed by
Parameter Store, S3, or a local directory. Effects that leave nothing behind
to read back get a receipt, which tracks their staleness.
Tag-based IAM scoping is a feature AWS already has. What it needs is tags
that are reliably present and correct. A marker is derived from the
configuration address and written as part of the create call, so a resource
that exists carries one. Not a convention someone has to remember, and not a
default_tags block that drifts.
Three things follow. Your IAM is the whole permission model, with no bucket policy or lock table to keep in step with it. There is no lock to manage or force open, because concurrent runs settle at the API. And an estate is legible without the binary, so whoever inherits one can list what they got with any cloud tool before running anything.
Handover is granting a role. Splitting an estate in two is rewriting tags. Adoption is a tag you write. A rename is a tag you rewrite.
The name is stinky tofu, fermented and famously an acquired taste, a fit for an OpenTofu counterpart whose state is allowed to be stale. The FAQ has the longer answer.
Built on OpenTofu (fork point
03743ce6e8). The
exact upstream version lives in version/VERSION, and
each release's notes name
both. Everything outside live markers is stock OpenTofu.
Where this stands
Most commonly used AWS resource types are admitted. The gap that hurts is the
connective tissue between them, such as aws_ecs_service and
aws_lambda_permission.
Type coverage is rarely what stops a configuration. A backend "s3" block, a
CI pipeline that saves a plan file (-out plus apply <planfile>), a
non-default workspace, a count.index in a resource name, a for_each keyed
by CIDRs, or an identity argument read from a data source will each stop one
first. Run
choudoufu live-check
in your configuration directory for a verdict on your own code, with no cloud
credentials. Will my config work?
covers the same ground, and live/LIMITATIONS.md has
every limit with its reasoning.
See it prove itself
The demo is also the test suite. It stands up a real estate against a local AWS emulator, hands it over to its markers partway through, and shows the plans stay exact across the handover. Docker, about two minutes, and the exit code is the verdict.
bash live/e2e/run.sh --expect 5
Or paste this to a coding agent (Claude Code or similar) and let it run the demo end to end.
Clone https://github.com/INTENTIUS/choudoufu, then do the following.
1. Confirm Docker is running (`docker info` must succeed).
2. If Go is installed, skip this step. Otherwise download the latest
release tarball for this platform from
https://github.com/INTENTIUS/choudoufu/releases, extract it, and
export TOFU_BIN=<absolute path to the extracted choudoufu binary>.
3. From the repo root, run: bash live/e2e/run.sh --expect 5
4. Report each step's result as the script prints it, and the final exit code.
Exit code 0 means every claim the script makes about live resource markers
held. Non-zero means one of them did not. Report which step failed.
Install
Every tagged release publishes prebuilt binaries for macOS, Linux and Windows
(amd64 and arm64) with a SHA256SUMS file, on the
releases page. To fetch the
latest for macOS or Linux, run
os=$(uname -s | tr '[:upper:]' '[:lower:]')
arch=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')
gh release download -R INTENTIUS/choudoufu --pattern "*_${os}_${arch}.tar.gz"
tar xzf choudoufu_*_"${os}"_"${arch}".tar.gz # unpacks ./choudoufu
Windows ships as .zip, which Explorer opens without extra tooling.
gh release download -R INTENTIUS/choudoufu --pattern "*_windows_amd64.zip"
Expand-Archive choudoufu_*_windows_amd64.zip . # unpacks .\choudoufu.exe
(use *_windows_arm64.zip on ARM64 Windows).
Which path is yours
You have an estate already. Adoption is a deliberate tag write. Until a resource's markers are on it, it is not yours, and applying too early creates a duplicate beside the real thing. Migrate an existing estate has the steps, which types adopt automatically, and which need a hand-written tag.
You are starting fresh. A greenfield estate is a live block and an
apply. Start a new estate walks
it end to end.
Building and testing
go build ./cmd/choudoufu
go test ./...
The integration tier needs Docker and TF_FLOCI_TEST=1.
Docs
The two user paths and the compatibility answer live on the docs site at https://intentius.io/choudoufu/. The repository carries the normative specs and the contributor material.
live/MARKERS.mdis the marker tag spec, the one integration surface external tooling relies on.live/LIMITATIONS.mdlists every construct the mode bounds or rejects, each with its lint rule and fixture.live/RECEIPTS.mdcovers receipts, the record that tracks staleness for an effect with nothing in the live system to read back.live/e2e/README.mddocuments the demo harness and how to read its output.
All stock OpenTofu documentation lives at opentofu.org.
License
MPL-2.0. Forked from opentofu/opentofu
at 03743ce6e8. LICENSE and all copyright headers are unchanged from
upstream.
choudoufu is not affiliated with or endorsed by OpenTofu or the Linux Foundation. OpenTofu is a registered trademark of the Linux Foundation.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
choudoufu
command
|
|
|
internal
|
|
|
addrs
Package addrs contains types that represent "addresses", which are references to specific objects within a OpenTofu configuration or state.
|
Package addrs contains types that represent "addresses", which are references to specific objects within a OpenTofu configuration or state. |
|
backend
Package backend provides interfaces that the CLI uses to interact with OpenTofu.
|
Package backend provides interfaces that the CLI uses to interact with OpenTofu. |
|
backend/init
Package init contains the list of backends that can be initialized and basic helper functions for initializing those backends.
|
Package init contains the list of backends that can be initialized and basic helper functions for initializing those backends. |
|
backend/remote-state/gcs
Package gcs implements remote storage of state on Google Cloud Storage (GCS).
|
Package gcs implements remote storage of state on Google Cloud Storage (GCS). |
|
checks
Package checks contains the models for representing various kinds of declarative condition checks that can be defined in a OpenTofu module and then evaluated and reported by OpenTofu Core during plan and apply operations.
|
Package checks contains the models for representing various kinds of declarative condition checks that can be defined in a OpenTofu module and then evaluated and reported by OpenTofu Core during plan and apply operations. |
|
command/cliconfig
Package cliconfig has the types representing and the logic to load CLI-level configuration settings.
|
Package cliconfig has the types representing and the logic to load CLI-level configuration settings. |
|
command/cliconfig/ociauthconfig
Package ociauthconfig contains types used for describing OCI authentication settings, and helpers for discovering such settings from container engine configuration files as described in https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md .
|
Package ociauthconfig contains types used for describing OCI authentication settings, and helpers for discovering such settings from container engine configuration files as described in https://github.com/containers/image/blob/main/docs/containers-auth.json.5.md . |
|
command/cliconfig/svcauthconfig
Package svcauthconfig contains some helper functions and types to support the cliconfig package's use of github.com/opentofu/svchost/svcauth, which is our mechanism for representing the policy for authenticating to OpenTofu-native services such as implementations OpenTofu's provider registry protocol.
|
Package svcauthconfig contains some helper functions and types to support the cliconfig package's use of github.com/opentofu/svchost/svcauth, which is our mechanism for representing the policy for authenticating to OpenTofu-native services such as implementations OpenTofu's provider registry protocol. |
|
command/clistate
Package state exposes common helpers for working with state from the CLI.
|
Package state exposes common helpers for working with state from the CLI. |
|
command/e2etest
Package e2etest contains a set of tests that run against a real OpenTofu binary, compiled on the fly at the start of the test run.
|
Package e2etest contains a set of tests that run against a real OpenTofu binary, compiled on the fly at the start of the test run. |
|
command/e2etest/fakeocireg
Package fakeocireg provides a minimal, read-only implementation of the OCI Distribution protocol that interacts with a local filesystem directory.
|
Package fakeocireg provides a minimal, read-only implementation of the OCI Distribution protocol that interacts with a local filesystem directory. |
|
command/format
Package format contains helpers for formatting various OpenTofu structures for human-readable output.
|
Package format contains helpers for formatting various OpenTofu structures for human-readable output. |
|
command/jsonchecks
Package jsonchecks implements the common JSON representation of check results/statuses that we use across both the JSON plan and JSON state representations.
|
Package jsonchecks implements the common JSON representation of check results/statuses that we use across both the JSON plan and JSON state representations. |
|
command/jsonconfig
Package jsonconfig implements methods for outputting a configuration snapshot in machine-readable json format
|
Package jsonconfig implements methods for outputting a configuration snapshot in machine-readable json format |
|
command/jsonentities
Package jsonentities contains the entities for representing a few common resources used around the json* packages.
|
Package jsonentities contains the entities for representing a few common resources used around the json* packages. |
|
command/jsonformat/computed
Package computed contains types that represent the computed diffs for OpenTofu blocks, attributes, and outputs.
|
Package computed contains types that represent the computed diffs for OpenTofu blocks, attributes, and outputs. |
|
command/jsonformat/structured
Package structured contains the structured representation of the JSON changes returned by the jsonplan package.
|
Package structured contains the structured representation of the JSON changes returned by the jsonplan package. |
|
command/jsonplan
Package jsonplan implements methods for outputting a plan in a machine-readable json format
|
Package jsonplan implements methods for outputting a plan in a machine-readable json format |
|
command/jsonprovider
Package jsonprovider contains types and functions to marshal OpenTofu provider schemas into a json formatted output.
|
Package jsonprovider contains types and functions to marshal OpenTofu provider schemas into a json formatted output. |
|
command/jsonstate
Package jsonstate implements methods for outputting a state in a machine-readable json format
|
Package jsonstate implements methods for outputting a state in a machine-readable json format |
|
command/workdir
Package workdir models the various local artifacts and state we keep inside a OpenTofu "working directory".
|
Package workdir models the various local artifacts and state we keep inside a OpenTofu "working directory". |
|
configs
Package configs contains types that represent OpenTofu configurations and the different elements thereof.
|
Package configs contains types that represent OpenTofu configurations and the different elements thereof. |
|
configs/configload
Package configload knows how to install modules into the .terraform/modules directory and to load modules from those installed locations.
|
Package configload knows how to install modules into the .terraform/modules directory and to load modules from those installed locations. |
|
configs/configschema
Package configschema contains types for describing the expected structure of a configuration block whose shape is not known until runtime.
|
Package configschema contains types for describing the expected structure of a configuration block whose shape is not known until runtime. |
|
depsfile
Package depsfile contains the logic for reading and writing OpenTofu's dependency lock and development override configuration files.
|
Package depsfile contains the logic for reading and writing OpenTofu's dependency lock and development override configuration files. |
|
encryption/keyprovider/pbkdf2
Package pbkdf2 contains a key provider that takes a passphrase and emits a PBKDF2 hash of the configured length.
|
Package pbkdf2 contains a key provider that takes a passphrase and emits a PBKDF2 hash of the configured length. |
|
encryption/keyprovider/static
Package static contains a key provider that emits a static key.
|
Package static contains a key provider that emits a static key. |
|
encryption/keyprovider/xor
Package xor contains a key provider that combines two other keys.
|
Package xor contains a key provider that combines two other keys. |
|
engine/internal/exec
Package exec contains the models and main interface used for apply phase execution.
|
Package exec contains the models and main interface used for apply phase execution. |
|
engine/internal/execgraph/execgraphproto
Package execgraphproto contains just the protocol buffers models we use for marshaling and unmarshaling execution graphs.
|
Package execgraphproto contains just the protocol buffers models we use for marshaling and unmarshaling execution graphs. |
|
engine/planning
Package planning implements a planning engine for OpenTofu, which takes a prior state and a configuration instance (which can be evaluated to produce a desired state) and proposes a set of changes to make to bring the remote system closer to convergence with the desired state.
|
Package planning implements a planning engine for OpenTofu, which takes a prior state and a configuration instance (which can be evaluated to produce a desired state) and proposes a set of changes to make to bring the remote system closer to convergence with the desired state. |
|
experiments
Package experiments contains the models and logic for opt-in experiments that can be activated for a particular OpenTofu module.
|
Package experiments contains the models and logic for opt-in experiments that can be activated for a particular OpenTofu module. |
|
genconfig
Package genconfig implements config generation from provided state values.
|
Package genconfig implements config generation from provided state values. |
|
getmodules
Package getmodules contains the low-level functionality for fetching remote module packages.
|
Package getmodules contains the low-level functionality for fetching remote module packages. |
|
getproviders
Package getproviders is the lowest-level provider automatic installation functionality.
|
Package getproviders is the lowest-level provider automatic installation functionality. |
|
initwd
Package initwd contains various helper functions used by the "tofu init" command to initialize a working directory.
|
Package initwd contains various helper functions used by the "tofu init" command to initialize a working directory. |
|
ipaddr
Package ipaddr is a fork of a subset of the Go standard "net" package which retains parsing behaviors from Go 1.16 or earlier.
|
Package ipaddr is a fork of a subset of the Go standard "net" package which retains parsing behaviors from Go 1.16 or earlier. |
|
lang
Package lang deals with the runtime aspects of OpenTofu's configuration language, with concerns such as expression evaluation.
|
Package lang deals with the runtime aspects of OpenTofu's configuration language, with concerns such as expression evaluation. |
|
lang/blocktoattr
Package blocktoattr includes some helper functions that can perform preprocessing on a HCL body where a configschema.Block schema is available in order to allow list and set attributes defined in the schema to be optionally written by the user as block syntax.
|
Package blocktoattr includes some helper functions that can perform preprocessing on a HCL body where a configschema.Block schema is available in order to allow list and set attributes defined in the schema to be optionally written by the user as block syntax. |
|
lang/eval
Package eval aims to encapsulate the details of evaluating the objects in an overall configuration, including all of the expressions written inside their declarations, in a way that can be reused across various different phases of execution.
|
Package eval aims to encapsulate the details of evaluating the objects in an overall configuration, including all of the expressions written inside their declarations, in a way that can be reused across various different phases of execution. |
|
lang/eval/internal/tofu2024
Package tofu2024 contains the "module compiler" implementation for the first edition of the OpenTofu language, established with OpenTofu v1.6 in 2024 and then gradually evolved in backward-compatible ways.
|
Package tofu2024 contains the "module compiler" implementation for the first edition of the OpenTofu language, established with OpenTofu v1.6 in 2024 and then gradually evolved in backward-compatible ways. |
|
lang/exprs
Package exprs contains supporting code for expression evaluation.
|
Package exprs contains supporting code for expression evaluation. |
|
lang/globalref
Package globalref is home to some analysis algorithms that aim to answer questions about references between objects and object attributes across an entire configuration.
|
Package globalref is home to some analysis algorithms that aim to answer questions about references between objects and object attributes across an entire configuration. |
|
lang/grapheval
Package grapheval contains some low-level helpers for coordinating interdependent work happening across different parts of the system, including detection and reporting of self-dependency problems that would otherwise cause a deadlock.
|
Package grapheval contains some low-level helpers for coordinating interdependent work happening across different parts of the system, including detection and reporting of self-dependency problems that would otherwise cause a deadlock. |
|
lang/lint
Package lint contains a collection of helpers for performing "lint-like" checks to try to detect configuration constructs that are valid but nonetheless very likely to be a mistake.
|
Package lint contains a collection of helpers for performing "lint-like" checks to try to detect configuration constructs that are valid but nonetheless very likely to be a mistake. |
|
lang/types
Package types contains non-standard cty types used only within OpenTofu.
|
Package types contains non-standard cty types used only within OpenTofu. |
|
legacy/hcl2shim
Package hcl2shim contains a small number of "shimming" utilities that the other packages under internal/legacy use to adapt from HCL 2 concepts to legacy concepts.
|
Package hcl2shim contains a small number of "shimming" utilities that the other packages under internal/legacy use to adapt from HCL 2 concepts to legacy concepts. |
|
legacy/helper/acctest
Package acctest contains for OpenTofu Acceptance Tests
|
Package acctest contains for OpenTofu Acceptance Tests |
|
legacy/helper/schema
Package schema is a legacy package that used to represent the SDK, which is now its own library external to OpenTofu Core https://github.com/hashicorp/terraform-plugin-sdk Some of it is still used by OpenTofu's remote state backends, but this entire package should be removed in the future.
|
Package schema is a legacy package that used to represent the SDK, which is now its own library external to OpenTofu Core https://github.com/hashicorp/terraform-plugin-sdk Some of it is still used by OpenTofu's remote state backends, but this entire package should be removed in the future. |
|
live
Package stateless implements OpenTofu's stateless mode: a run mode with no authoritative state file, no backend, and no lock.
|
Package stateless implements OpenTofu's stateless mode: a run mode with no authoritative state file, no backend, and no lock. |
|
live/acceptance
Package acceptance is GitHub issue #108's tier: every cohort estate under live/e2e/estates is applied against the floci emulator, its state file is deleted, and the plan rebuilt from ownership markers alone is asserted empty - the definition of done a user can check for themselves, run per cohort as a measurement.
|
Package acceptance is GitHub issue #108's tier: every cohort estate under live/e2e/estates is applied against the floci emulator, its state file is deleted, and the plan rebuilt from ownership markers alone is asserted empty - the definition of done a user can check for themselves, run per cohort as a measurement. |
|
live/check
Package check answers "would this configuration move under live resource markers, and if not, what stops it" using only the configuration: no backend, no state, no cloud reads, and no provider process beyond reading schemas.
|
Package check answers "would this configuration move under live resource markers, and if not, what stops it" using only the configuration: no backend, no state, no cloud reads, and no provider process beyond reading schemas. |
|
live/cloudcontrol
Package cloudcontrol is a client for AWS's Cloud Control API: the transport the registry-backed discovery plane (#40) reads live resources through.
|
Package cloudcontrol is a client for AWS's Cloud Control API: the transport the registry-backed discovery plane (#40) reads live resources through. |
|
live/dataread
Package dataread is issue #179's pre-resolution data-read phase: provider data sources whose values identity resolution needs, read before resolution runs instead of refused as non-static.
|
Package dataread is issue #179's pre-resolution data-read phase: provider data sources whose values identity resolution needs, read before resolution runs instead of refused as non-static. |
|
live/discovery
The parent-scoped Cloud Control leg.
|
The parent-scoped Cloud Control leg. |
|
live/docsref
Package docsref parses and resolves the documentation references the live path's refusals carry.
|
Package docsref parses and resolves the documentation references the live path's refusals carry. |
|
live/flocitest
Package flocitest holds the gate, the fixture paths and the container bookkeeping that the floci integration tests share.
|
Package flocitest holds the gate, the fixture paths and the container bookkeeping that the floci integration tests share. |
|
live/foreign
Package foreign classifies the live resources an estate does not own, and is the safety property of stateless mode: a live resource nobody claims is surfaced, and is never a deletion candidate.
|
Package foreign classifies the live resources an estate does not own, and is the safety property of stateless mode: a live resource nobody claims is surfaced, and is never a deletion candidate. |
|
live/harness
Package harness holds the two registries this repository's numbers live in: what it is driving down (the burndown), and what it believes while it does (the assumptions).
|
Package harness holds the two registries this repository's numbers live in: what it is driving down (the burndown), and what it believes while it does (the assumptions). |
|
live/identity
Package identity classifies the identity of every managed resource instance in a configuration, using nothing but the configuration itself.
|
Package identity classifies the identity of every managed resource instance in a configuration, using nothing but the configuration itself. |
|
live/lifecycle
Package lifecycle holds five integration tests and nothing else: the lifecycle test itself (P4.1), the guided-discovery hint test (issue #109), the exactness test (P5.1), the crash-mid-apply test (the concurrency taxonomy's crash row, run rather than argued), and the existence-flavor receipt test (RA.6).
|
Package lifecycle holds five integration tests and nothing else: the lifecycle test itself (P4.1), the guided-discovery hint test (issue #109), the exactness test (P5.1), the crash-mid-apply test (the concurrency taxonomy's crash row, run rather than argued), and the existence-flavor receipt test (RA.6). |
|
live/lint
Package lint is the stateless-mode subset check: the pass that decides whether a configuration can be planned with no authoritative state at all.
|
Package lint is the stateless-mode subset check: the pass that decides whether a configuration can be planned with no authoritative state at all. |
|
live/listclient
Package listclient is stateless mode's client for the provider list protocol: the ListResource server-streaming RPC and the list resource schemas that parameterize it.
|
Package listclient is stateless mode's client for the provider list protocol: the ListResource server-streaming RPC and the list resource schemas that parameterize it. |
|
live/liveimport
Package liveimport is the bulk migration path from a state-backed estate to ownership markers (issue #61): read an existing tfstate file once, verify every resource it names against the live system, and - only when the operator says so a second time - stamp this estate's markers onto everything that verified.
|
Package liveimport is the bulk migration path from a state-backed estate to ownership markers (issue #61): read an existing tfstate file once, verify every resource it names against the live system, and - only when the operator says so a second time - stamp this estate's markers onto everything that verified. |
|
live/markerkey
Package markerkey holds the for_each instance key rule that lint and identity both enforce.
|
Package markerkey holds the for_each instance key rule that lint and identity both enforce. |
|
live/markers
Package markers is live/MARKERS.md in code: the ownership tag keys, the escaping rule that lets a resource address live in a tag value, and the reading of those tags off a live object.
|
Package markers is live/MARKERS.md in code: the ownership tag keys, the escaping rule that lets a resource address live in a tag value, and the reading of those tags off a live object. |
|
live/markers/markerstest
Package markerstest holds the two resource schemas every package that decides "may a marker be written here" has to agree about, so that the packages asserting it do not each rebuild the block and thereby rebuild the disagreement the assertion exists to catch.
|
Package markerstest holds the two resource schemas every package that decides "may a marker be written here" has to agree about, so that the packages asserting it do not each rebuild the block and thereby rebuild the disagreement the assertion exists to catch. |
|
live/marksafe
Package marksafe is the lockstep check behind GitHub issue #240: a cty.Value accessor that panics on a marked value cannot be called in a live package on a value nothing proves is unmarked.
|
Package marksafe is the lockstep check behind GitHub issue #240: a cty.Value accessor that panics on a marked value cannot be called in a live package on a value nothing proves is unmarked. |
|
live/mdspan
Package mdspan rewrites named regions of a committed markdown document in place.
|
Package mdspan rewrites named regions of a committed markdown document in place. |
|
live/moved
Package moved carries a configuration's `moved` blocks into the live-marker world, where there is no state entry to rewrite.
|
Package moved carries a configuration's `moved` blocks into the live-marker world, where there is no state entry to rewrite. |
|
live/mv
Package mv performs the rename operation stateless mode has instead of `moved` blocks and state surgery: it rewrites the tofu-address ownership marker on one live resource.
|
Package mv performs the rename operation stateless mode has instead of `moved` blocks and state surgery: it rewrites the tofu-address ownership marker on one live resource. |
|
live/onboard
Package onboard computes the source edit that turns a state-backed module into a live one, from the module's own text and from nothing else.
|
Package onboard computes the source edit that turns a state-backed module into a live one, from the module's own text and from nothing else. |
|
live/passthrough
Package passthrough is the registry of refusals the live path shows a user without having written them.
|
Package passthrough is the registry of refusals the live path shows a user without having written them. |
|
live/pins
Package pins holds the provider release the measurement instruments pin, as one constant instead of one per tool.
|
Package pins holds the provider release the measurement instruments pin, as one constant instead of one per tool. |
|
live/pluginschema
Package pluginschema reads a provider's schemas by launching its plugin in-process, with no cloud calls and no provider configuration.
|
Package pluginschema reads a provider's schemas by launching its plugin in-process, with no cloud calls and no provider configuration. |
|
live/policy
Package policy is GitHub issue #67's ownership-policy matrix, given a settled shape: a verb per quadrant (declared-in-source x carries-the-tag), the tag those quadrants read, and the delete quadrant's safety rails.
|
Package policy is GitHub issue #67's ownership-policy matrix, given a settled shape: a verb per quadrant (declared-in-source x carries-the-tag), the tag those quadrants read, and the delete quadrant's safety rails. |
|
live/projection
Package projection materializes an ephemeral prior state by reading the live system.
|
Package projection materializes an ephemeral prior state by reading the live system. |
|
live/providerscope
Package providerscope resolves a resource's true root-level provider configuration address by walking every ancestor module call's `providers = { ...
|
Package providerscope resolves a resource's true root-level provider configuration address by walking every ancestor module call's `providers = { ... |
|
live/providerversion
Package providerversion answers issue #63: a configuration's provider pin and the admission table's evidence basis are two independent facts that can drift apart with nobody told.
|
Package providerversion answers issue #63: a configuration's provider pin and the admission table's evidence basis are two independent facts that can drift apart with nobody told. |
|
live/refusalscan
Package refusalscan is the lockstep check behind GitHub issue #110's first acceptance criterion: a refusal cannot exist in a live package without an entry in that package's registry.
|
Package refusalscan is the lockstep check behind GitHub issue #110's first acceptance criterion: a refusal cannot exist in a live package without an entry in that package's registry. |
|
live/registry
Package registry loads the two committed join artifacts - live/mapping.json (issue #43, the TF-to-CFN type join) and live/registry.json (issue #42, the CloudFormation Registry's per-type roster) - and answers the one question discovery's Cloud Control fallback (#47) needs of them: given a TF resource type with no native provider list resource, is there a mapped CFN type that Cloud Control can enumerate on its own, with no per-call parsing of either file?
|
Package registry loads the two committed join artifacts - live/mapping.json (issue #43, the TF-to-CFN type join) and live/registry.json (issue #42, the CloudFormation Registry's per-type roster) - and answers the one question discovery's Cloud Control fallback (#47) needs of them: given a TF resource type with no native provider list resource, is there a mapped CFN type that Cloud Control can enumerate on its own, with no per-call parsing of either file? |
|
live/slots
Package slots is the set matcher for count instances: the rule that turns "N declared instances and M live resources" into a binding, without any index participating in identity.
|
Package slots is the set matcher for count instances: the rule that turns "N declared instances and M live resources" into a binding, without any index participating in identity. |
|
live/stamp
Package stamp makes ownership markers something the tool guarantees rather than something the configuration author remembered to write.
|
Package stamp makes ownership markers something the tool guarantees rather than something the configuration author remembered to write. |
|
live/staterecord
Package staterecord is a small, versioned key/value Store with first-class conditional writes: Get, PutIfVersion, PutIfAbsent, Delete, List — nothing else.
|
Package staterecord is a small, versioned key/value Store with first-class conditional writes: Get, PutIfVersion, PutIfAbsent, Delete, List — nothing else. |
|
live/strict
Package strict holds the vocabulary of the live block's "strict" block: HANDOFF.md's principles, each expressed as a toggle with a default that is today's behavior.
|
Package strict holds the vocabulary of the live block's "strict" block: HANDOFF.md's principles, each expressed as a toggle with a default that is today's behavior. |
|
live/uniquename
Package uniquename reads one claim out of a piece of API documentation: that the name the CLIENT supplies for a resource is unique within the account and region the run is pointed at.
|
Package uniquename reads one claim out of a piece of API documentation: that the name the CLIENT supplies for a resource is unique within the account and region the run is pointed at. |
|
live/untag
Package untag is GitHub issue #67's apply-time half of the undeclared_tagged = "untag" verb: releasing one tag key from a live resource this estate owns but no configuration declares.
|
Package untag is GitHub issue #67's apply-time half of the undeclared_tagged = "untag" verb: releasing one tag key from a live resource this estate owns but no configuration declares. |
|
modsdir
Package modsdir is an internal package containing the model types used to represent the manifest of modules in a local modules cache directory.
|
Package modsdir is an internal package containing the model types used to represent the manifest of modules in a local modules cache directory. |
|
plans
Package plans contains the types that are used to represent OpenTofu plans.
|
Package plans contains the types that are used to represent OpenTofu plans. |
|
plans/internal/planproto
Package planproto is home to the Go stubs generated from the tfplan protobuf schema.
|
Package planproto is home to the Go stubs generated from the tfplan protobuf schema. |
|
plans/objchange
Package objchange deals with the business logic of taking a prior state value and a config value and producing a proposed new merged value, along with other related rules in this domain.
|
Package objchange deals with the business logic of taking a prior state value and a config value and producing a proposed new merged value, along with other related rules in this domain. |
|
plans/planfile
Package planfile deals with the file format used to serialize plans to disk and then deserialize them back into memory later.
|
Package planfile deals with the file format used to serialize plans to disk and then deserialize them back into memory later. |
|
plugin/mock_proto
Package mock_tfplugin5 is a generated GoMock package.
|
Package mock_tfplugin5 is a generated GoMock package. |
|
plugin6/mock_proto
Package mock_tfplugin6 is a generated GoMock package.
|
Package mock_tfplugin6 is a generated GoMock package. |
|
provider-simple
simple provider a minimal provider implementation for testing
|
simple provider a minimal provider implementation for testing |
|
provider-simple-v6
simple provider a minimal provider implementation for testing
|
simple provider a minimal provider implementation for testing |
|
provider-simple-v6/main
command
|
|
|
provider-simple/main
command
|
|
|
providercache
Package providercache contains the logic for auto-installing providers from packages obtained elsewhere, and for managing the local directories that serve as global or single-configuration caches of those auto-installed providers.
|
Package providercache contains the logic for auto-installing providers from packages obtained elsewhere, and for managing the local directories that serve as global or single-configuration caches of those auto-installed providers. |
|
providers
Package providers contains the interface and primary types required to implement a OpenTofu resource provider.
|
Package providers contains the interface and primary types required to implement a OpenTofu resource provider. |
|
provisioner-local-exec/main
command
|
|
|
provisioners
Package provisioners contains the interface and primary types to implement a OpenTofu resource provisioner.
|
Package provisioners contains the interface and primary types to implement a OpenTofu resource provisioner. |
|
repl
Package repl provides the structs and functions necessary to run REPL for OpenTofu.
|
Package repl provides the structs and functions necessary to run REPL for OpenTofu. |
|
replacefile
Package replacefile is a small helper package focused directly at the problem of atomically "renaming" one file over another one.
|
Package replacefile is a small helper package focused directly at the problem of atomically "renaming" one file over another one. |
|
resources
Package resources contains helpers that encapsulate the main interactions OpenTofu has with resource instance objects, wrapping the raw provider client calls with certain preprocessing, postprocessing, and validation logic that ought to happen regardless of why OpenTofu is asking each of these questions.
|
Package resources contains helpers that encapsulate the main interactions OpenTofu has with resource instance objects, wrapping the raw provider client calls with certain preprocessing, postprocessing, and validation logic that ought to happen regardless of why OpenTofu is asking each of these questions. |
|
states
Package states contains the types that are used to represent OpenTofu states.
|
Package states contains the types that are used to represent OpenTofu states. |
|
states/statefile
Package statefile deals with the file format used to serialize states for persistent storage and then deserialize them into memory again later.
|
Package statefile deals with the file format used to serialize states for persistent storage and then deserialize them into memory again later. |
|
states/statemgr
Package statemgr defines the interfaces and some supporting functionality for "state managers", which are components responsible for writing state to some persistent storage and then later retrieving it.
|
Package statemgr defines the interfaces and some supporting functionality for "state managers", which are components responsible for writing state to some persistent storage and then later retrieving it. |
|
terminal
Package terminal encapsulates some platform-specific logic for detecting if we're running in a terminal and, if so, properly configuring that terminal to meet the assumptions that the rest of OpenTofu makes.
|
Package terminal encapsulates some platform-specific logic for detecting if we're running in a terminal and, if so, properly configuring that terminal to meet the assumptions that the rest of OpenTofu makes. |
|
tfdiags
Package tfdiags is a utility package for representing errors and warnings in a manner that allows us to produce good messages for the user.
|
Package tfdiags is a utility package for representing errors and warnings in a manner that allows us to produce good messages for the user. |
|
This file (package residue, colocated with residue.go and tagverbs.go for the same go:embed reason: an embed directive can only name files in its own package's directory, and live/floci-capabilities.json lives here) is the floci capability manifest: which AWS services and resource types the floci emulator this checkout pins actually implements, keyed by the image's content digest rather than its mutable tag.
|
This file (package residue, colocated with residue.go and tagverbs.go for the same go:embed reason: an embed directive can only name files in its own package's directory, and live/floci-capabilities.json lives here) is the floci capability manifest: which AWS services and resource types the floci emulator this checkout pins actually implements, keyed by the image's content digest rather than its mutable tag. |
|
tools
|
|
|
admission-pipeline
command
admission-pipeline orchestrates issue #55's admission chain end to end: one command that notices when the pinned AWS provider or the pinned CloudFormation Registry schema moved, regenerates every derived artifact from source, verifies the result builds and tests green, writes a markdown report, and - with -pr - turns that into a pull request.
|
admission-pipeline orchestrates issue #55's admission chain end to end: one command that notices when the pinned AWS provider or the pinned CloudFormation Registry schema moved, regenerates every derived artifact from source, verifies the result builds and tests green, writes a markdown report, and - with -pr - turns that into a pull request. |
|
cloudcontrol-probe
command
cloudcontrol-probe is a manual smoke test for internal/live/cloudcontrol, not shipped in any binary.
|
cloudcontrol-probe is a manual smoke test for internal/live/cloudcontrol, not shipped in any binary. |
|
corpus-fetch
command
Command corpus-fetch materializes the external configurations live/corpus-manifest.json pins, so that tools/corpus-gen can measure them.
|
Command corpus-fetch materializes the external configurations live/corpus-manifest.json pins, so that tools/corpus-gen can measure them. |
|
corpus-gen
command
Command corpus-gen measures which live-path refusals actually fire on real OpenTofu configurations, and writes the ranked table as a generated artifact.
|
Command corpus-gen measures which live-path refusals actually fire on real OpenTofu configurations, and writes the ranked table as a generated artifact. |
|
estate-gen
command
estate-gen generates live/e2e/estates/<cohort>/, the minimal-HCL per-cohort verification estate internal/live/flocitest.FixtureDirs picks up through the #48 union pin (issue #56).
|
estate-gen generates live/e2e/estates/<cohort>/, the minimal-HCL per-cohort verification estate internal/live/flocitest.FixtureDirs picks up through the #48 union pin (issue #56). |
|
estate-plan
command
Command estate-plan turns a refusal-probe sweep into an ordered work plan, one estate at a time.
|
Command estate-plan turns a refusal-probe sweep into an ordered work plan, one estate at a time. |
|
find-dep-upgrades
command
find-dep-upgrades is a utility for finding the available upgrades for our Go module dependencies and proposing an order to upgrade them in so that as far as possible each upgrade touches only one upstream module at a time.
|
find-dep-upgrades is a utility for finding the available upgrades for our Go module dependencies and proposing an order to upgrade them in so that as far as possible each upgrade touches only one upstream module at a time. |
|
find-pkg-importer
command
find-pkg-importer is a utility for finding which packages in our dependency graph import a given package path.
|
find-pkg-importer is a utility for finding which packages in our dependency graph import a given package path. |
|
floci-capability-gen
command
floci-capability-gen (re)generates live/floci-capabilities.json's entry for one floci image digest by probing a running instance of that image, closing the loop live/flocicap.go's package doc names: a bumped floci image should never have to wait for the next batch of e2e work to rediscover, by trial and error, which services and types it still does not implement.
|
floci-capability-gen (re)generates live/floci-capabilities.json's entry for one floci image digest by probing a running instance of that image, closing the loop live/flocicap.go's package doc names: a bumped floci image should never have to wait for the next batch of e2e work to rediscover, by trial and error, which services and types it still does not implement. |
|
gauntlet
command
gauntlet runs choudoufu's real-estate test suite against stock OpenTofu and renders everything the project says about its own progress from the result.
|
gauntlet runs choudoufu's real-estate test suite against stock OpenTofu and renders everything the project says about its own progress from the result. |
|
harness-gen
command
Command harness-gen renders live/HARNESS.md's generated spans from the burndown and assumptions registries in internal/live/harness.
|
Command harness-gen renders live/HARNESS.md's generated spans from the burndown and assumptions registries in internal/live/harness. |
|
iamref-gen
command
iamref-gen reads AWS's Service Authorization Reference - published as JSON at servicereference.us-east-1.amazonaws.com - and writes live/iam-reference.json: per service, whether the tagging action this fork performs can be scoped by aws:ResourceTag and aws:TagKeys.
|
iamref-gen reads AWS's Service Authorization Reference - published as JSON at servicereference.us-east-1.amazonaws.com - and writes live/iam-reference.json: per service, whether the tagging action this fork performs can be scoped by aws:ResourceTag and aws:TagKeys. |
|
importdocs-gen
command
importdocs-gen generates live/import-grammar.json, one row per TF resource type parsed from the provider's own Import documentation (issue #52, dispatched from #55: the source that kills both the 114 hand-authored composite separators and the manual "rule-1" check the Lambda pilot paid by hand - see internal/live/identity/table.go's "Registry-ratified" comment for what that check found by hand, aws_lambda_alias and aws_lambda_layer_version_permission).
|
importdocs-gen generates live/import-grammar.json, one row per TF resource type parsed from the provider's own Import documentation (issue #52, dispatched from #55: the source that kills both the 114 hand-authored composite separators and the manual "rule-1" check the Lambda pilot paid by hand - see internal/live/identity/table.go's "Registry-ratified" comment for what that check found by hand, aws_lambda_alias and aws_lambda_layer_version_permission). |
|
importer-probe
command
Command importer-probe asks a real provider plugin, over the plugin protocol, whether a resource type has an Importer at all.
|
Command importer-probe asks a real provider plugin, over the plugin protocol, whether a resource type has an Importer at all. |
|
limits-gen
command
Command limits-gen writes live/LIMITATIONS.md's per-refusal content from the registries that define the refusals, instead of from someone's memory of them.
|
Command limits-gen writes live/LIMITATIONS.md's per-refusal content from the registries that define the refusals, instead of from someone's memory of them. |
|
loggraphdiff
command
|
|
|
mapping-gen
command
Package main (former2.go): the second of issue #52's two authoritative sources, iann0036/former2 - a community-maintained CloudFormation generator that, per resource type it supports, already carries both the CFN type it emits and the Terraform type the same live object would import as.
|
Package main (former2.go): the second of issue #52's two authoritative sources, iann0036/former2 - a community-maintained CloudFormation generator that, per resource type it supports, already carries both the CFN type it emits and the Terraform type the same live object would import as. |
|
merge-guard
command
merge-guard detects silent content loss in merge commits (issue #92).
|
merge-guard detects silent content loss in merge commits (issue #92). |
|
protobuf-compile
command
protobuf-compile is a helper tool for running protoc against all of the .proto files in this repository using specific versions of protoc and protoc-gen-go, to ensure consistent results across all development environments.
|
protobuf-compile is a helper tool for running protoc against all of the .proto files in this repository using specific versions of protoc and protoc-gen-go, to ensure consistent results across all development environments. |
|
refusal-probe
command
Command refusal-probe measures the corpus's refusals without regenerating it, and diffs two such measurements.
|
Command refusal-probe measures the corpus's refusals without regenerating it, and diffs two such measurements. |
|
registry-gen
command
registry-gen generates live/registry.json, the machine-derived roster of per-type signals from the CloudFormation Registry schema bundle (issue #42, the registry side of #40).
|
registry-gen generates live/registry.json, the machine-derived roster of per-type signals from the CloudFormation Registry schema bundle (issue #42, the registry side of #40). |
|
row-gen
command
row-gen turns registry evidence into pastable, ratifiable admission rows (issue #44, #40's phase 4, #37's increment 2).
|
row-gen turns registry evidence into pastable, ratifiable admission rows (issue #44, #40's phase 4, #37's increment 2). |
|
selected-go-version
command
selected-go-version determines which version of Go is currently selected in the go.mod file.
|
selected-go-version determines which version of Go is currently selected in the go.mod file. |
|
survey-gen
command
The Contract render (issue #54): live/COVERAGE.md's "The admitted set" section both counts and enumerates the admitted types.
|
The Contract render (issue #54): live/COVERAGE.md's "The admitted set" section both counts and enumerates the admitted types. |
|
tagverbs-gen
command
tagverbs-gen generates live/tag-verbs.json, the machine-derived join that replaces internal/live/foreign/classify.go's hand-written ec2Types table (issue #52, the botocore side): which AWS API operation tags a resource of a given service, extracted from botocore's own service models rather than stated by hand.
|
tagverbs-gen generates live/tag-verbs.json, the machine-derived join that replaces internal/live/foreign/classify.go's hand-written ec2Types table (issue #52, the botocore side): which AWS API operation tags a resource of a given service, extracted from botocore's own service models rather than stated by hand. |
|
wo-sweep
command
wo-sweep is issue #126's measurement probe, and nothing more: it sizes the attribute-level record-less-residue class across the admitted types.
|
wo-sweep is issue #126's measurement probe, and nothing more: it sizes the attribute-level record-less-residue class across the admitted types. |
|
The version package provides a location to set the release versions for all packages to consume, without creating import cycles.
|
The version package provides a location to set the release versions for all packages to consume, without creating import cycles. |
|
website
|
|
Click to show internal directories.
Click to hide internal directories.