platformforge 0.1.0__py3-none-any.whl

platformforge/ops/envelope.py

@@ -0,0 +1,135 @@
+"""Cycle 4 — ExecutionEnvelope (§65–67, ADR-0021/0025).
+
+The envelope is the *exact* set of authorized actions: executor, typed
+actions, scope, preconditions, policy decisions, approvals, risk,
+expected delta, verification + rollback strategies, idempotency key,
+TTL. It is hash-pinned — after `freeze()` (approval binding) any content
+change produces a different hash and downstream validation refuses.
+Envelopes are minted only when policy allows; they never mint themselves.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import Any
+
+from platformforge.live.models import canonical_hash, now_iso, parse_ts
+from platformforge.ops.actions import validate_action
+
+ENVELOPE_SCHEMA = "platformforge/execution/v1"
+
+
+@dataclass
+class ExecutionEnvelope:
+    execution_id: str = ""
+    intent_id: str = ""
+    change_plan_hash: str = ""
+    executor: str = ""
+    actions: list[dict[str, Any]] = field(default_factory=list)  # {action, params, step_id}
+    scope: list[str] = field(default_factory=list)
+    preconditions: dict[str, Any] = field(default_factory=dict)
+    policy_decisions: list[dict[str, Any]] = field(default_factory=list)
+    approvals: list[str] = field(default_factory=list)   # approval ids
+    risk: dict[str, Any] = field(default_factory=dict)
+    expected_delta: dict[str, Any] = field(default_factory=dict)
+    verification: dict[str, Any] = field(default_factory=dict)
+    rollback: dict[str, Any] = field(default_factory=dict)
+    idempotency_key: str = ""
+    created_at: str = ""
+    expires_at: str = ""
+    _frozen_hash: str = field(default="", repr=False, compare=False)
+
+    def __post_init__(self):
+        if not self.created_at:
+            self.created_at = now_iso()
+        if not self.idempotency_key:
+            self.idempotency_key = "idem-" + canonical_hash(
+                {"intent": self.intent_id, "plan": self.change_plan_hash,
+                 "actions": self.actions})[:24]
+
+    def validate(self) -> list[dict[str, Any]]:
+        v: list[dict[str, Any]] = []
+        if not self.execution_id:
+            v.append({"refusal": "PF-OPS-BAD-EXECUTION-ID",
+                      "unlock": "set execution_id"})
+        if not self.change_plan_hash:
+            v.append({"refusal": "PF-OPS-ENVELOPE-NO-PLAN",
+                      "unlock": "envelope must bind to a change_plan_hash"})
+        if not self.approvals and not self.policy_decisions:
+            v.append({"refusal": "PF-OPS-ENVELOPE-UNGOVERNED",
+                      "unlock": "envelope requires policy decisions and/or "
+                                "approvals — execution is never self-minted"})
+        for a in self.actions:
+            r = validate_action(a.get("action", ""), a.get("params", {}))
+            if r:
+                v.append(r)
+        if self.expires_at and parse_ts(self.expires_at) is None:
+            v.append({"refusal": "PF-OPS-BAD-EXPIRY",
+                      "unlock": "expires_at must be ISO-8601"})
+        return v
+
+    def hash(self) -> str:
+        return "sha256:" + canonical_hash(self.to_dict())
+
+    @property
+    def frozen(self) -> bool:
+        return bool(self._frozen_hash)
+
+    def freeze(self) -> str:
+        """Bind the envelope to its current hash — post-approval the
+        object is treated as immutable (§67)."""
+        self._frozen_hash = self.hash()
+        return self._frozen_hash
+
+    def is_intact(self) -> bool:
+        return not self._frozen_hash or self.hash() == self._frozen_hash
+
+    def is_expired(self, at: str | None = None) -> bool:
+        exp = parse_ts(self.expires_at)
+        ref = parse_ts(at) if at else parse_ts(now_iso())
+        return bool(exp and ref and ref > exp)
+
+    def mutating_actions(self) -> list[dict[str, Any]]:
+        from platformforge.ops.actions import spec_for
+        return [a for a in self.actions
+                if (s := spec_for(a.get("action", ""))) and s.mutating]
+
+    def to_dict(self) -> dict[str, Any]:
+        from platformforge.core.redaction import redact_obj
+        return {"schema": ENVELOPE_SCHEMA,
+                "execution_id": self.execution_id,
+                "intent_id": self.intent_id,
+                "change_plan_hash": self.change_plan_hash,
+                "executor": self.executor,
+                # action params are redacted at the serialization
+                # boundary — an envelope never emits raw secrets
+                "actions": redact_obj(self.actions),
+                "scope": self.scope, "preconditions": self.preconditions,
+                "policy_decisions": self.policy_decisions,
+                "approvals": self.approvals, "risk": self.risk,
+                "expected_delta": self.expected_delta,
+                "verification": self.verification,
+                "rollback": self.rollback,
+                "idempotency_key": self.idempotency_key,
+                "created_at": self.created_at,
+                "expires_at": self.expires_at}
+
+    @classmethod
+    def from_dict(cls, d: dict[str, Any]) -> ExecutionEnvelope:
+        return cls(
+            execution_id=d.get("execution_id", ""),
+            intent_id=d.get("intent_id", ""),
+            change_plan_hash=d.get("change_plan_hash", ""),
+            executor=d.get("executor", ""),
+            actions=list(d.get("actions", [])),
+            scope=list(d.get("scope", [])),
+            preconditions=dict(d.get("preconditions", {})),
+            policy_decisions=list(d.get("policy_decisions", [])),
+            approvals=list(d.get("approvals", [])),
+            risk=dict(d.get("risk", {})),
+            expected_delta=dict(d.get("expected_delta", {})),
+            verification=dict(d.get("verification", {})),
+            rollback=dict(d.get("rollback", {})),
+            idempotency_key=d.get("idempotency_key", ""),
+            created_at=d.get("created_at", ""),
+            expires_at=d.get("expires_at", ""))

platformforge/ops/executors/__init__.py

@@ -0,0 +1 @@
+"""Executors package init."""

platformforge/ops/executors/base.py

@@ -0,0 +1,211 @@
+"""Cycle 4 — executor boundary (§70–71, ADR-0027).
+
+Executors are deterministic host-side adapters. The core builds typed
+steps; transports run them; results come back as ExecutionReceipts.
+An executor NEVER sees LLM context and NEVER receives a raw shell
+string — only `action` + validated `params`.
+
+Transport contract (same shape as collectors):
+    run(argv: list[str], cwd: str|None, timeout_s: int)
+        -> (rc: int, stdout: str, stderr: str)
+Injected per call — tests and fixtures replay deterministic transports.
+"""
+
+from __future__ import annotations
+
+import time
+from collections.abc import Callable
+from dataclasses import dataclass, field
+from typing import Any
+
+from platformforge.live.models import canonical_hash, now_iso
+from platformforge.ops.actions import spec_for, validate_action
+
+Transport = Callable[..., tuple[int, str, str]]
+
+RECEIPT_SCHEMA = "platformforge/execution-receipt/v1"
+
+
+@dataclass
+class ExecutionReceipt:
+    """§94–96 — what happened, hashed, reproducible."""
+
+    step_id: str
+    action: str
+    executor: str
+    ok: bool
+    dry_run: bool = False
+    rc: int = 0
+    started_at: str = ""
+    finished_at: str = ""
+    duration_ms: int = 0
+    outputs: dict[str, Any] = field(default_factory=dict)
+    refusal: dict[str, Any] | None = None
+    error: str = ""
+    argv_hash: str = ""  # hash of the argv (argv may contain paths)
+    side_effects: str = ""
+    receipt_hash: str = ""
+
+    def finalize(self) -> ExecutionReceipt:
+        body = {
+            "step_id": self.step_id,
+            "action": self.action,
+            "executor": self.executor,
+            "ok": self.ok,
+            "dry_run": self.dry_run,
+            "rc": self.rc,
+            "finished_at": self.finished_at,
+            "outputs": self.outputs,
+            "error": self.error,
+            "argv_hash": self.argv_hash,
+            "refusal": self.refusal,
+        }
+        self.receipt_hash = "sha256:" + canonical_hash(body)
+        return self
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "schema": RECEIPT_SCHEMA,
+            "step_id": self.step_id,
+            "action": self.action,
+            "executor": self.executor,
+            "ok": self.ok,
+            "dry_run": self.dry_run,
+            "rc": self.rc,
+            "started_at": self.started_at,
+            "finished_at": self.finished_at,
+            "duration_ms": self.duration_ms,
+            "outputs": self.outputs,
+            "argv_hash": self.argv_hash,
+            "side_effects": self.side_effects,
+            "refusal": self.refusal,
+            "error": self.error,
+            "receipt_hash": self.receipt_hash,
+        }
+
+
+class Executor:
+    """Base: dispatch typed actions to argv builders; wrap in receipts."""
+
+    name = "abstract"
+
+    def supports(self, action: str) -> bool:
+        s = spec_for(action)
+        return bool(s and s.executor == self.name)
+
+    def argv_for(self, action: str, params: dict[str, Any], dry_run: bool) -> list[str] | dict[str, Any]:
+        """Return argv or a refusal dict."""
+        return {"refusal": "PF-OPS-NO-EXECUTOR", "unlock": f"{self.name} has no argv builder for {action}"}
+
+    def run_step(
+        self,
+        step_id: str,
+        action: str,
+        params: dict[str, Any],
+        *,
+        transport: Transport | None = None,
+        dry_run: bool = False,
+        cwd: str | None = None,
+        timeout_s: int | None = None,
+    ) -> ExecutionReceipt:
+        spec = spec_for(action)
+        started = now_iso()
+        t0 = time.monotonic()
+        r = ExecutionReceipt(
+            step_id=step_id, action=action, executor=self.name, ok=False, dry_run=dry_run, started_at=started
+        )
+
+        def finish(ok: bool, **kw) -> ExecutionReceipt:
+            r.ok = ok
+            r.finished_at = now_iso()
+            r.duration_ms = int((time.monotonic() - t0) * 1000)
+            for k, v in kw.items():
+                setattr(r, k, v)
+            return r.finalize()
+
+        if spec is None:
+            return finish(
+                False,
+                refusal={"refusal": "PF-OPS-UNKNOWN-ACTION", "unlock": f"action {action} not in vocabulary"},
+            )
+        if spec.executor != self.name:
+            return finish(
+                False,
+                refusal={
+                    "refusal": "PF-OPS-WRONG-EXECUTOR",
+                    "unlock": f"{action} is owned by {spec.executor}, not {self.name}",
+                },
+            )
+        err = validate_action(action, params)
+        if err:
+            return finish(False, refusal=err)
+        if dry_run and not spec.dry_run:
+            return finish(
+                False, refusal={"refusal": "PF-OPS-NO-DRYRUN", "unlock": f"{action} does not support dry-run"}
+            )
+        if spec.mutating and transport is None:
+            return finish(
+                False,
+                refusal={
+                    "refusal": "PF-OPS-NO-TRANSPORT",
+                    "unlock": "mutating actions require an injected host "
+                    "transport — the core never executes alone",
+                },
+            )
+        argv = self.argv_for(action, params, dry_run)
+        if isinstance(argv, dict):  # refusal from builder
+            return finish(False, refusal=argv)
+        r.argv_hash = "sha256:" + canonical_hash(argv)
+        r.side_effects = spec.side_effects
+        if transport is None:  # non-mutating, no transport
+            return finish(True, outputs={"skipped": "no transport"})
+        try:
+            rc, out, err_s = transport(argv, cwd, timeout_s or spec.timeout_s)
+        except Exception as exc:  # noqa: BLE001 — adapter failure is evidence
+            return finish(False, error=f"transport-error:{exc}")
+        r.rc = rc
+        outputs = self.parse_outputs(action, rc, out, err_s)
+        if rc != 0:
+            return finish(False, outputs=outputs, error=err_s[:2000])
+        return finish(True, outputs=outputs)
+
+    def parse_outputs(self, action: str, rc: int, out: str, err: str) -> dict[str, Any]:
+        return {"stdout_tail": out[-2000:], "stderr_tail": err[-2000:]}
+
+
+class ObserveExecutor(Executor):
+    """Read-only observation steps — dispatch to the live collectors'
+    contract (typed observe actions, never free-form queries)."""
+
+    name = "observe"
+
+    def argv_for(self, action, params, dry_run):
+        import json
+
+        return ["observe", action, json.dumps(params, sort_keys=True)]
+
+
+def host_transport() -> Transport:
+    """Host boundary: argv-only subprocess runner. Executors build the
+    argv; this never sees a shell string (no shell=True)."""
+    import subprocess
+
+    def run(argv: list[str], cwd=None, timeout_s=None):
+        if not argv or not isinstance(argv, list):
+            return 2, "", "bad argv"
+        try:
+            p = subprocess.run(
+                [str(a) for a in argv],
+                cwd=cwd,
+                capture_output=True,
+                text=True,
+                timeout=timeout_s or 300,
+                check=False,
+            )
+            return p.returncode, p.stdout, p.stderr
+        except FileNotFoundError:
+            return 127, "", f"binary not found: {argv[0]}"
+        except subprocess.TimeoutExpired:
+            return 124, "", f"timeout {timeout_s}s"
+
+    return run

platformforge/ops/executors/git.py

@@ -0,0 +1,77 @@
+"""Git executor (§72–74): branch, bounded patch, commit, push, PR.
+
+`git.open_pr` does not shell out to GitHub in the core — it emits the
+PR *spec* (title/body/head/base + plan-hash trailer). The transport may
+be `gh pr create` host-side; the body carries reason, evidence, deltas,
+risk, validation, rollback per §74. Force-push is never generated;
+`--force-with-lease` only on pf/* branches and only when requested.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from platformforge.ops.executors.base import Executor
+
+
+class GitExecutor(Executor):
+    name = "git"
+
+    def argv_for(self, action: str, params: dict[str, Any],
+                 dry_run: bool) -> list[str] | dict[str, Any]:
+        repo = params.get("repo", ".")
+        if action == "git.create_branch":
+            base = params.get("base", "HEAD")
+            return ["git", "-C", repo, "checkout", "-b", params["branch"], base]
+        if action == "git.apply_patch":
+            if params.get("check_only") or dry_run:
+                return ["git", "-C", repo, "apply", "--check", "--index",
+                        "-"]      # patch content via stdin host-side
+            return ["git", "-C", repo, "apply", "--index",
+                    "--whitespace=error-all", "-"]
+        if action == "git.commit":
+            argv = ["git", "-C", repo, "commit", "-m", params["message"]]
+            if params.get("signoff"):
+                argv.append("--signoff")
+            return argv
+        if action == "git.push":
+            remote = params.get("remote", "origin")
+            return ["git", "-C", repo, "push", "-u", remote,
+                    params["branch"]]
+        if action == "git.open_pr":
+            # PR is a host integration — emit spec; transport runs gh/api
+            return ["pr-spec", params["repo"], params["head"],
+                    params["base"], params["title"]]
+        if action == "git.delete_branch":
+            return ["git", "-C", repo, "branch", "-D", params["branch"]]
+        if action == "git.revert_commit":
+            return ["git", "-C", repo, "revert", "--no-edit",
+                    params["commit_sha"]]
+        if action == "git.close_pr":
+            return ["pr-close", params["repo"], str(params["pr"])]
+        return super().argv_for(action, params, dry_run)
+
+
+def pr_body(*, reason: str, evidence: list[str], plan_hash: str,
+            expected_delta: dict[str, Any], risk: dict[str, Any],
+            validation: list[str], rollback: dict[str, Any]) -> str:
+    """§74 — generated PRs carry the full evidence chain."""
+    lines = [f"## Reason\n{reason}", "",
+             "## Evidence",
+             *[f"- {e}" for e in evidence], "",
+             f"Plan hash: `{plan_hash}`", "",
+             "## Expected delta",
+             "```json",
+             _j(expected_delta), "```", "",
+             "## Risk", "```json", _j(risk), "```", "",
+             "## Validation", *[f"- {v}" for v in validation], "",
+             "## Rollback", "```json", _j(rollback), "```", "",
+             "---",
+             "Generated by Platform Forge (governed operations).",
+             f"Plan-Hash: {plan_hash}"]
+    return "\n".join(lines)
+
+
+def _j(obj: Any) -> str:
+    import json
+    return json.dumps(obj, indent=2, sort_keys=True)[:4000]

platformforge/ops/executors/gitops.py

@@ -0,0 +1,134 @@
+"""GitOps executor (§79–81): ArgoCD sync/diff/wait/rollback.
+
+GitOps-first: the default remediation path is a Git change the
+controller reconciles. `argocd.sync` exists for governed cases only —
+it requires application scope, pinned revision, diff evidence, health
+precondition, policy allow and approval. `--prune`, `--replace`,
+`--force` are never generated by the executor: they are distinct,
+higher-risk capabilities requiring their own envelopes.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from platformforge.ops.executors.base import Executor
+
+
+class ArgoCDExecutor(Executor):
+    name = "argocd"
+
+    def argv_for(self, action: str, params: dict[str, Any],
+                 dry_run: bool) -> list[str] | dict[str, Any]:
+        a = action.split(".", 1)[1]
+        app = params.get("app", "")
+        if a == "diff":
+            argv = ["argocd", "app", "diff", app]
+            if params.get("revision"):
+                argv += ["--revision", params["revision"]]
+            argv += ["--hard-refresh"]
+            return argv
+        if a == "sync":
+            argv = ["argocd", "app", "sync", app]
+            if params.get("revision"):
+                argv += ["--revision", params["revision"]]
+            for r in params.get("resource", []) or []:
+                argv += ["--resource", r]
+            if dry_run or params.get("dry_run"):
+                argv += ["--dry-run"]
+            # §81 guards — prune/replace/force are never emitted here
+            return argv
+        if a == "wait":
+            argv = ["argocd", "app", "wait", app, "--health", "--sync"]
+            argv += ["--timeout", str(params.get("timeout_s", 300))]
+            return argv
+        if a == "rollback":
+            argv = ["argocd", "app", "rollback", app]
+            if params.get("history_id"):
+                argv += [str(params["history_id"])]
+            return argv
+        return super().argv_for(action, params, dry_run)
+
+
+class KubernetesExecutor(Executor):
+    """§82–83 — narrow actions only: scale, rollout restart/undo,
+    controlled annotate, rollout status. Every write binds
+    resourceVersion/uid preconditions when supplied; arbitrary object
+    patch does not exist."""
+
+    name = "kubernetes"
+
+    def argv_for(self, action: str, params: dict[str, Any],
+                 dry_run: bool) -> list[str] | dict[str, Any]:
+        a = action.split(".", 1)[1]
+        kind, name = params.get("kind", ""), params.get("name", "")
+        target = f"{kind}/{name}"
+        ns = []
+        if params.get("namespace"):
+            ns = ["-n", params["namespace"]]
+        if params.get("context"):
+            ns += ["--context", params["context"]]
+        dr = ["--dry-run=server"] if dry_run else []
+
+        if a == "scale":
+            argv = ["kubectl", "scale", target,
+                    "--replicas", str(params["replicas"])] + ns
+            if params.get("current_replicas") is not None:
+                argv += ["--current-replicas",
+                         str(params["current_replicas"])]
+            if params.get("resource_version"):
+                argv += ["--resource-version",
+                         str(params["resource_version"])]
+            return argv + dr
+        if a == "rollout_restart":
+            return ["kubectl", "rollout", "restart", target] + ns + dr
+        if a == "rollout_undo":
+            argv = ["kubectl", "rollout", "undo", target] + ns
+            if params.get("to_revision"):
+                argv += ["--to-revision", str(params["to_revision"])]
+            return argv + dr
+        if a == "rollout_status":
+            argv = ["kubectl", "rollout", "status", target] + ns
+            argv += ["--timeout", f"{params.get('timeout_s', 300)}s"]
+            argv += ["--watch=false"]
+            return argv
+        if a == "annotate":
+            anns = params.get("annotations", {})
+            rems = params.get("remove_annotations", []) or []
+            if not isinstance(anns, dict) or (not anns and not rems):
+                return {"refusal": "PF-OPS-ANNOTATE-EMPTY",
+                        "unlock": "annotations or remove_annotations "
+                                  "must be non-empty"}
+            safe = {k: str(v) for k, v in anns.items()
+                    if _annotation_allowed(k)}
+            safe_rems = [k for k in rems if _annotation_allowed(k)]
+            if len(safe) != len(anns) or len(safe_rems) != len(rems):
+                return {"refusal": "PF-OPS-ANNOTATE-UNSAFE",
+                        "unlock": "only platformforge.io/*, "
+                                  "ops.platformforge.io/* annotations "
+                                  "or whitelisted keys are writable"}
+            argv = ["kubectl", "annotate", target] + ns
+            argv += [f"{k}={v}" for k, v in safe.items()]
+            argv += [f"{k}-" for k in safe_rems] + ["--overwrite"]
+            if params.get("resource_version"):
+                # optimistic concurrency via JSON patch precondition
+                argv = ["kubectl", "patch", target, "--type=json",
+                        "-p", '[{"op":"test","path":"/metadata/'
+                              'resourceVersion","value":"'
+                        + str(params["resource_version"]) + '"}]'] + ns
+                return argv + dr
+            return argv + dr
+        return super().argv_for(action, params, dry_run)
+
+
+_ANNOTATION_PREFIXES = ("platformforge.io/", "ops.platformforge.io/",
+                        "pf.io/")
+
+
+def _annotation_allowed(key: str) -> bool:
+    return key.startswith(_ANNOTATION_PREFIXES)
+
+
+EXECUTORS = {"git": "GitExecutor", "terraform": "TerraformExecutor",
+             "tofu": "TofuExecutor", "argocd": "ArgoCDExecutor",
+             "kubernetes": "KubernetesExecutor"}

platformforge/ops/executors/terraform.py

@@ -0,0 +1,84 @@
+"""Terraform / OpenTofu executor (§75–78).
+
+Contract from upstream semantics: `plan -out=<f>` → `apply <f>` where
+the saved plan file IS the approval target (no replanning flags at
+apply). Before apply the executor re-runs a freshness check
+(`plan -refresh-only -detailed-exitcode`; 2 = drift) and verifies the
+plan file hash — stale plans refuse (§77). `terraform` and `tofu` share
+the contract; divergent flags stay per-binary.
+"""
+
+from __future__ import annotations
+
+import hashlib
+from pathlib import Path
+from typing import Any
+
+from platformforge.ops.executors.base import Executor
+
+
+class TerraformExecutor(Executor):
+    name = "terraform"
+    binary = "terraform"
+
+    def argv_for(self, action: str, params: dict[str, Any],
+                 dry_run: bool) -> list[str] | dict[str, Any]:
+        b = self.binary
+        wd = params.get("workdir", ".")
+        a = action.split(".", 1)[1]          # terraform.<verb>
+        if a == "validate":
+            return [b, "-chdir=" + wd, "validate", "-json"]
+        if a == "plan":
+            argv = [b, "-chdir=" + wd, "plan", "-input=false",
+                    "-detailed-exitcode"]
+            if params.get("refresh_only"):
+                argv.append("-refresh-only")
+            if params.get("out"):
+                argv.append("-out=" + params["out"])
+            for t in params.get("target", []) or []:
+                argv.append("-target=" + t)
+            return argv
+        if a == "show":
+            return [b, "-chdir=" + wd, "show", "-json",
+                    params["plan_file"]]
+        if a == "apply_saved_plan":
+            pf = params["plan_file"]
+            want = params.get("plan_hash", "")
+            if want:
+                try:
+                    got = "sha256:" + hashlib.sha256(
+                        Path(wd, pf).read_bytes()).hexdigest()
+                except OSError as e:
+                    return {"refusal": "PF-OPS-PLAN-UNREADABLE",
+                            "unlock": f"plan file unreadable: {e}"}
+                if got != want:
+                    return {"refusal": "PF-OPS-PLAN-HASH-MISMATCH",
+                            "unlock": "saved plan hash differs from "
+                                      "approval — re-plan and re-approve"}
+            return [b, "-chdir=" + wd, "apply", "-input=false",
+                    pf]      # the plan file IS the bound artifact
+        return super().argv_for(action, params, dry_run)
+
+
+class TofuExecutor(TerraformExecutor):
+    name = "tofu"
+    binary = "tofu"
+
+
+def summarize_plan(show_json: dict[str, Any]) -> dict[str, Any]:
+    """Compact plan summary for deltas/receipts (extends iac/plan.py
+    semantics with action_reason/applyable)."""
+    changes: dict[str, int] = {}
+    destructive = []
+    for rc in show_json.get("resource_changes", []) or []:
+        acts = tuple(rc.get("change", {}).get("actions", []))
+        for a in acts:
+            changes[a] = changes.get(a, 0) + 1
+        if "delete" in acts:
+            destructive.append(rc.get("address", "?"))
+    return {"applyable": bool(show_json.get("applyable")),
+            "errored": bool(show_json.get("errored")),
+            "actions": changes,
+            "destructive_addresses": destructive,
+            "drift": [d.get("address") for d in
+                      show_json.get("resource_drift", []) or []]}