skilldrop-cli 0.16.3__py3-none-any.whl

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/evals/evals.json

@@ -0,0 +1,30 @@
+{
+  "skill_name": "terraform-plan-review",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Here's the plan for Acme's billing stack. The change is only supposed to add a tag to the API load balancer. Is it safe to apply?\n\nTerraform will perform the following actions:\n\n  # aws_lb.api will be updated in-place\n  ~ resource \"aws_lb\" \"api\" {\n        id   = \"arn:aws:elasticloadbalancing:eu-west-1:111111111111:loadbalancer/app/acme-billing-api/0123456789abcdef\"\n      ~ tags = {\n          + \"cost-centre\" = \"billing\"\n        }\n    }\n\n  # aws_db_instance.billing must be replaced\n-/+ resource \"aws_db_instance\" \"billing\" {\n      ~ id                  = \"db-EXAMPLE1234567890\" -> (known after apply)\n      ~ identifier          = \"acme-billing\" -> \"acme-billing-v2\" # forces replacement\n        skip_final_snapshot = true\n        deletion_protection = false\n    }\n\n  # aws_security_group_rule.api_https will be created\n  + resource \"aws_security_group_rule\" \"api_https\" {\n      + type        = \"ingress\"\n      + from_port   = 443\n      + to_port     = 443\n      + cidr_blocks = [\"0.0.0.0/0\"]\n    }\n\nPlan: 2 to add, 1 to change, 1 to destroy.",
+      "assertions": [
+        "Gives exactly one verdict, and it is DO NOT APPLY",
+        "Names aws_db_instance.billing as a replacement and identifies identifier as the attribute forcing replacement",
+        "States that skip_final_snapshot = true and deletion_protection = false mean the database data is lost on apply",
+        "Flags the new 0.0.0.0/0 ingress rule on 443 and asks whether the load balancer is meant to be public, rather than silently accepting or rejecting it",
+        "Lists the database replacement and the security group rule as outside the stated scope of adding a tag",
+        "Ends with a numbered list of concrete actions to take before applying",
+        "Does not invent resources, attributes or values that are not in the plan"
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "CI gate for Northwind's network repo: review this terraform show -json output before apply. Intent: add one private subnet in module.vpc. File: plan.json (resource_changes includes module.vpc.aws_subnet.private[\"c\"] create, aws_iam_role_policy.ci update where the policy goes from ec2:Describe* on * to * on *, and resource_drift shows aws_route_table.private changed outside Terraform).",
+      "assertions": [
+        "Runs or describes running scripts/plan_summary.py with --scope module.vpc",
+        "Flags aws_iam_role_policy.ci as access widening and quotes the before and after actions",
+        "Reports the aws_route_table.private drift separately from the intended change",
+        "Lists the IAM change as outside the stated scope",
+        "Gives a DO NOT APPLY verdict because of the wildcard action on all resources",
+        "Does not echo any secret or sensitive value from the plan"
+      ]
+    }
+  ]
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/evals/files/2/plan.json

@@ -0,0 +1,133 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.5",
+  "resource_drift": [
+    {
+      "address": "aws_route_table.private",
+      "mode": "managed",
+      "type": "aws_route_table",
+      "name": "private",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "update"
+        ],
+        "before": {
+          "id": "rtb-0aa11bb22cc33dd44",
+          "route": [
+            {
+              "cidr_block": "0.0.0.0/0",
+              "nat_gateway_id": "nat-0123456789abcdef0"
+            }
+          ],
+          "tags": {
+            "Name": "northwind-private"
+          }
+        },
+        "after": {
+          "id": "rtb-0aa11bb22cc33dd44",
+          "route": [
+            {
+              "cidr_block": "0.0.0.0/0",
+              "nat_gateway_id": "nat-0123456789abcdef0"
+            },
+            {
+              "cidr_block": "10.99.0.0/16",
+              "vpc_peering_connection_id": "pcx-0fedcba9876543210"
+            }
+          ],
+          "tags": {
+            "Name": "northwind-private"
+          }
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "resource_changes": [
+    {
+      "address": "module.vpc.aws_subnet.private[\"c\"]",
+      "mode": "managed",
+      "type": "aws_subnet",
+      "name": "private",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "availability_zone": "eu-west-1c",
+          "cidr_block": "10.20.12.0/24",
+          "map_public_ip_on_launch": false,
+          "tags": {
+            "Name": "northwind-private-c"
+          },
+          "vpc_id": "vpc-0123456789abcdef0"
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      },
+      "module_address": "module.vpc"
+    },
+    {
+      "address": "aws_iam_role_policy.ci",
+      "mode": "managed",
+      "type": "aws_iam_role_policy",
+      "name": "ci",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "update"
+        ],
+        "before": {
+          "id": "northwind-ci:deploy",
+          "name": "deploy",
+          "role": "northwind-ci",
+          "policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Action\": \"ec2:Describe*\", \"Resource\": \"*\"}]}"
+        },
+        "after": {
+          "id": "northwind-ci:deploy",
+          "name": "deploy",
+          "role": "northwind-ci",
+          "policy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Action\": \"*\", \"Resource\": \"*\"}]}"
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "module.vpc.aws_subnet.private[\"a\"]",
+      "mode": "managed",
+      "type": "aws_subnet",
+      "name": "private",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": [
+          "no-op"
+        ],
+        "before": {
+          "availability_zone": "eu-west-1a",
+          "cidr_block": "10.20.10.0/24"
+        },
+        "after": {
+          "availability_zone": "eu-west-1a",
+          "cidr_block": "10.20.10.0/24"
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      },
+      "module_address": "module.vpc"
+    }
+  ],
+  "output_changes": {},
+  "applyable": true,
+  "complete": true,
+  "errored": false,
+  "timestamp": "2026-09-30T10:12:00Z"
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/examples/northwind-orders-plan.json

@@ -0,0 +1,174 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.5",
+  "planned_values": {
+    "root_module": {}
+  },
+  "resource_drift": [
+    {
+      "address": "aws_security_group.db",
+      "mode": "managed",
+      "type": "aws_security_group",
+      "name": "db",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["update"],
+        "before": {
+          "id": "sg-0a1b2c3d4e5f60001",
+          "name": "northwind-orders-db",
+          "description": "Postgres from app tier",
+          "ingress": [
+            {"from_port": 5432, "to_port": 5432, "protocol": "tcp", "cidr_blocks": [], "security_groups": ["sg-0a1b2c3d4e5f60002"], "description": "app tier", "ipv6_cidr_blocks": [], "prefix_list_ids": [], "self": false}
+          ],
+          "tags": {"service": "orders"}
+        },
+        "after": {
+          "id": "sg-0a1b2c3d4e5f60001",
+          "name": "northwind-orders-db",
+          "description": "Postgres from app tier",
+          "ingress": [
+            {"from_port": 5432, "to_port": 5432, "protocol": "tcp", "cidr_blocks": [], "security_groups": ["sg-0a1b2c3d4e5f60002"], "description": "app tier", "ipv6_cidr_blocks": [], "prefix_list_ids": [], "self": false},
+            {"from_port": 5432, "to_port": 5432, "protocol": "tcp", "cidr_blocks": ["10.20.0.0/16"], "security_groups": [], "description": "temp debug", "ipv6_cidr_blocks": [], "prefix_list_ids": [], "self": false}
+          ],
+          "tags": {"service": "orders"}
+        },
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "resource_changes": [
+    {
+      "address": "aws_launch_template.app",
+      "mode": "managed",
+      "type": "aws_launch_template",
+      "name": "app",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["update"],
+        "before": {"id": "lt-0123456789abcdef0", "name": "northwind-orders-app", "instance_type": "m6i.large", "image_id": "ami-0aaa1111bbbb2222c", "latest_version": 7, "tags": {"service": "orders"}},
+        "after": {"id": "lt-0123456789abcdef0", "name": "northwind-orders-app", "instance_type": "m6i.xlarge", "image_id": "ami-0aaa1111bbbb2222c", "tags": {"service": "orders"}},
+        "after_unknown": {"latest_version": true},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "aws_autoscaling_group.app",
+      "mode": "managed",
+      "type": "aws_autoscaling_group",
+      "name": "app",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["update"],
+        "before": {"id": "northwind-orders-app", "name": "northwind-orders-app", "min_size": 2, "max_size": 6, "desired_capacity": 2, "launch_template": [{"id": "lt-0123456789abcdef0", "version": "7"}]},
+        "after": {"id": "northwind-orders-app", "name": "northwind-orders-app", "min_size": 2, "max_size": 6, "desired_capacity": 2, "launch_template": [{"id": "lt-0123456789abcdef0"}]},
+        "after_unknown": {"launch_template": [{"version": true}]},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "aws_db_instance.orders",
+      "mode": "managed",
+      "type": "aws_db_instance",
+      "name": "orders",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["delete", "create"],
+        "before": {"id": "db-ABCDEFGHIJKLMNOPQRSTUVWXY", "identifier": "northwind-orders", "engine": "postgres", "engine_version": "15.7", "instance_class": "db.r6g.large", "allocated_storage": 200, "storage_encrypted": false, "deletion_protection": false, "skip_final_snapshot": true, "username": "orders_admin", "password": "REDACTED-EXAMPLE", "tags": {"service": "orders"}},
+        "after": {"identifier": "northwind-orders", "engine": "postgres", "engine_version": "15.7", "instance_class": "db.r6g.large", "allocated_storage": 200, "storage_encrypted": true, "deletion_protection": false, "skip_final_snapshot": true, "username": "orders_admin", "password": "REDACTED-EXAMPLE", "tags": {"service": "orders"}},
+        "after_unknown": {"id": true, "arn": true, "endpoint": true, "kms_key_id": true},
+        "before_sensitive": {"password": true},
+        "after_sensitive": {"password": true},
+        "replace_paths": [["storage_encrypted"]]
+      },
+      "action_reason": "replace_because_cannot_update"
+    },
+    {
+      "address": "aws_security_group_rule.app_ssh",
+      "mode": "managed",
+      "type": "aws_security_group_rule",
+      "name": "app_ssh",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["create"],
+        "before": null,
+        "after": {"type": "ingress", "from_port": 22, "to_port": 22, "protocol": "tcp", "cidr_blocks": ["0.0.0.0/0"], "security_group_id": "sg-0a1b2c3d4e5f60002", "description": "ssh"},
+        "after_unknown": {"id": true, "security_group_rule_id": true},
+        "before_sensitive": false,
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "aws_iam_role_policy.app",
+      "mode": "managed",
+      "type": "aws_iam_role_policy",
+      "name": "app",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["update"],
+        "before": {"id": "northwind-orders-app:app", "name": "app", "role": "northwind-orders-app", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:GetObject\",\"s3:PutObject\"],\"Resource\":\"arn:aws:s3:::northwind-orders-exports/*\"}]}"},
+        "after": {"id": "northwind-orders-app:app", "name": "app", "role": "northwind-orders-app", "policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[\"s3:*\"],\"Resource\":\"*\"}]}"},
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "aws_instance.bastion",
+      "mode": "managed",
+      "type": "aws_instance",
+      "name": "bastion",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["create", "delete"],
+        "before": {"id": "i-0fedcba9876543210", "ami": "ami-0ccc3333dddd4444e", "instance_type": "t3.micro", "tags": {"Name": "northwind-bastion"}},
+        "after": {"ami": "ami-0eee5555ffff6666a", "instance_type": "t3.micro", "tags": {"Name": "northwind-bastion"}},
+        "after_unknown": {"id": true, "public_ip": true, "private_ip": true},
+        "before_sensitive": {},
+        "after_sensitive": {},
+        "replace_paths": [["ami"]]
+      },
+      "action_reason": "replace_because_cannot_update"
+    },
+    {
+      "address": "module.monitoring.aws_cloudwatch_metric_alarm.cpu_high",
+      "module_address": "module.monitoring",
+      "mode": "managed",
+      "type": "aws_cloudwatch_metric_alarm",
+      "name": "cpu_high",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["update"],
+        "before": {"id": "northwind-orders-cpu-high", "alarm_name": "northwind-orders-cpu-high", "threshold": 80, "evaluation_periods": 3},
+        "after": {"id": "northwind-orders-cpu-high", "alarm_name": "northwind-orders-cpu-high", "threshold": 95, "evaluation_periods": 3},
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    },
+    {
+      "address": "aws_s3_bucket.exports",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "exports",
+      "provider_name": "registry.terraform.io/hashicorp/aws",
+      "change": {
+        "actions": ["no-op"],
+        "before": {"id": "northwind-orders-exports", "bucket": "northwind-orders-exports"},
+        "after": {"id": "northwind-orders-exports", "bucket": "northwind-orders-exports"},
+        "after_unknown": {},
+        "before_sensitive": {},
+        "after_sensitive": {}
+      }
+    }
+  ],
+  "output_changes": {},
+  "configuration": {},
+  "timestamp": "2026-09-30T14:02:11Z",
+  "applyable": true,
+  "complete": true,
+  "errored": false
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/examples/northwind-orders.md

@@ -0,0 +1,87 @@
+# Worked example: Northwind orders, "resize the app tier"
+
+## Input
+
+The user says: *"This plan is meant to move the orders app from m6i.large to m6i.xlarge. Can I apply it?"* and supplies `plan.json` from `terraform show -json tfplan`. The file is [`northwind-orders-plan.json`](northwind-orders-plan.json), a hand-built plan in Terraform's documented JSON format (`format_version` 1.2). Placeholder IDs only.
+
+The stated intent maps to two addresses, so the agent runs:
+
+```bash
+python3 scripts/plan_summary.py examples/northwind-orders-plan.json \
+  --scope aws_launch_template.app --scope aws_autoscaling_group.app
+```
+
+## Script output (real, unedited)
+
+```markdown
+# Terraform plan summary
+
+Terraform 1.9.5, JSON format 1.2.
+
+**Floor verdict: DO NOT APPLY** (mechanical; the reviewer reads every flagged change)
+
+| create | update | replace | destroy | read | forget | no-op |
+|---|---|---|---|---|---|---|
+| 1 | 4 | 2 | 0 | 0 | 0 | 1 |
+
+Scope: aws_launch_template.app, aws_autoscaling_group.app
+
+## Changes to review
+
+- [DO NOT APPLY] `aws_db_instance.orders` (replace (destroy then create))
+  - will be replaced; replacement forced by: storage_encrypted (action_reason: replace_because_cannot_update)
+  - stateful resource: data is lost unless a backup or snapshot exists
+  - outside the stated scope
+- [DO NOT APPLY] `aws_iam_role_policy.app` (update)
+  - access widened: policy allows Resource "*"; policy allows wildcard action s3:*
+  - outside the stated scope
+  - changed attributes: policy
+- [DO NOT APPLY] `aws_security_group_rule.app_ssh` (create)
+  - access widened: open CIDR 0.0.0.0/0
+  - outside the stated scope
+- [CARE] `aws_instance.bastion` (replace (create then destroy))
+  - will be replaced; replacement forced by: ami (action_reason: replace_because_cannot_update)
+  - outside the stated scope
+- [CARE] `module.monitoring.aws_cloudwatch_metric_alarm.cpu_high` (update)
+  - outside the stated scope
+  - changed attributes: threshold
+
+## Drift (changed outside Terraform)
+
+- `aws_security_group.db` (update): ingress
+```
+
+The two in-scope updates (`aws_launch_template.app`, `aws_autoscaling_group.app`) are counted but not flagged, because they are in scope and touch nothing risky.
+
+## Review (what the agent hands back)
+
+**Verdict: DO NOT APPLY.** The plan resizes the app tier as intended, but it would also replace the orders database with an empty one, open SSH to the internet, and give the app role full S3 access on every bucket. None of that is part of "resize the app tier".
+
+Counts: 1 create, 4 update, 2 replace, 0 destroy, 1 no-op.
+
+### Flagged changes
+
+- 🟥 `aws_db_instance.orders`: destroy then create, forced by `storage_encrypted` (`false` to `true`, `action_reason: replace_because_cannot_update`). The plan also shows `skip_final_snapshot = true` and `deletion_protection = false`, so applying deletes the database without a final snapshot and creates a new, empty one. RDS cannot turn on encryption for an existing instance in place; the usual route is snapshot, copy the snapshot with encryption, restore from it, and cut over. That is a migration, not a resize.
+- 🟥 `aws_security_group_rule.app_ssh`: new ingress rule, port 22 from `0.0.0.0/0` on the app security group. Before: no such rule. After: `cidr_blocks = ["0.0.0.0/0"]`, `from_port = 22`, `to_port = 22`.
+- 🟥 `aws_iam_role_policy.app`: policy widened. Before: `Allow s3:GetObject, s3:PutObject on arn:aws:s3:::northwind-orders-exports/*`. After: `Allow s3:* on *`. The app role can now read, write and delete every bucket in the account.
+- 🟧 `aws_instance.bastion`: create then destroy, forced by `ami`. A new bastion gets a new instance ID and new IPs (`private_ip`, `public_ip` are known after apply). Anything allow-listing the old bastion IP breaks. Out of scope.
+- 🟧 `module.monitoring.aws_cloudwatch_metric_alarm.cpu_high`: `threshold` 80 to 95. Out of scope, and it loosens an alert at the same moment the instance size changes.
+
+### Drift
+
+- `aws_security_group.db`: someone added an ingress rule outside Terraform, port 5432 from `10.20.0.0/16`, description "temp debug". This plan does not list `aws_security_group.db` in `resource_changes`, so it neither reverts nor adopts the rule. The rule stays open and untracked until someone decides.
+
+### Out of scope
+
+All five flagged changes fall outside `aws_launch_template.app` and `aws_autoscaling_group.app`. The pattern (an encryption change, an SSH rule, a wider policy, a new AMI, a looser alarm) looks like a branch that picked up unrelated commits, or a shared root module with several people's work in it.
+
+### Before you apply
+
+1. Split the change. Re-plan with only the launch template and autoscaling group changes; that plan should show 2 updates and nothing else.
+2. Take the `storage_encrypted` change out of this branch and plan it as a migration (snapshot, encrypted copy, restore, cutover). Set `deletion_protection = true` and `skip_final_snapshot = false` on `aws_db_instance.orders` first, and add `lifecycle { prevent_destroy = true }`.
+3. Remove the `0.0.0.0/0` SSH rule. If bastion access is needed, use a session manager or a specific source CIDR.
+4. Revert the IAM policy to the named actions on `northwind-orders-exports/*`.
+5. Ask who changed the alarm threshold and the bastion AMI, and why, before either goes in.
+6. Decide about the "temp debug" rule on `aws_security_group.db`: remove it in the console, or add it to code if it is needed.
+
+Hand-offs: the database encryption change goes to `migration-plan`; the resize itself is small enough not to need a runbook.

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/manifest.json

@@ -0,0 +1,48 @@
+{
+  "name": "terraform-plan-review",
+  "version": "0.1.0",
+  "description": "Review a terraform plan before apply, from the plan text or terraform show -json output. Flags every destroy and replace with the attribute forcing it, changes to stateful resources such as databases, buckets and volumes, IAM and security-group widening, drift nobody made in code, and changes outside the intended scope, then gives a SAFE TO APPLY, APPLY WITH CARE or DO NOT APPLY verdict with reasons. Use when the user pastes a plan, says \"review this terraform plan\", \"is this plan safe to apply\", \"why is terraform replacing my database\", or \"check the plan before I apply\".",
+  "entrypoint": "SKILL.md",
+  "deps": {
+    "npm": [],
+    "pip": []
+  },
+  "env": {
+    "required": [],
+    "optional": []
+  },
+  "related": [
+    "capacity-cost-model",
+    "migration-plan",
+    "pre-merge-review",
+    "runbook-generator",
+    "terraform-module"
+  ],
+  "handoff": [
+    {
+      "to": "migration-plan",
+      "when": "a stateful resource must be replaced and its data moved",
+      "purpose": "Plan the snapshot, copy, restore and cutover instead of letting apply destroy the data.",
+      "fallback": "If migration-plan is absent, list the backup, restore, cutover and rollback steps inline and keep the verdict at DO NOT APPLY until they exist."
+    },
+    {
+      "to": "runbook-generator",
+      "when": "the plan is approved and the apply needs a step-by-step procedure",
+      "purpose": "Write the apply, verify and rollback steps the operator follows.",
+      "fallback": "If runbook-generator is absent, add a numbered apply, verify and rollback list to the review."
+    }
+  ],
+  "tags": [
+    "terraform",
+    "infrastructure-as-code",
+    "plan-review",
+    "change-safety",
+    "iam",
+    "drift"
+  ],
+  "permissions": {"network": [], "commands": [], "files": "named-paths", "notes": "Reads a plan JSON, which can hold secrets in clear text; the script never prints attribute values."},
+  "model": {
+    "tier": "heavy",
+    "rationale": "Adversarial review of a destructive change: judging which replacements lose data, which access changes widen exposure, and what is out of scope needs careful reasoning; a missed destroy costs far more than the model."
+  }
+}

skilldrop_cli/data/packs/infra-as-code/skills/terraform-plan-review/reference.md

@@ -0,0 +1,77 @@
+# terraform-plan-review reference
+
+## Text plan symbols
+
+| Symbol | Header line in the plan | Meaning |
+|---|---|---|
+| `+` | `will be created` | New object |
+| `~` | `will be updated in-place` | Same object, changed attributes |
+| `-` | `will be destroyed` | Object deleted |
+| `-/+` | `must be replaced` | Destroy the old object, then create the new one (the default order) |
+| `+/-` | `must be replaced` | Create the new object first, then destroy the old one (`create_before_destroy = true` in `lifecycle`) |
+| `<=` | `will be read during apply` | Data source read deferred to apply because an input is unknown at plan time |
+
+Inside a resource block:
+- `# forces replacement` beside an attribute is the cause of a replacement.
+- `(known after apply)` is a value Terraform cannot know until apply. On a replaced resource, the ID, ARN and endpoint all show this, so anything referencing them also changes.
+- `(sensitive value)` hides a value marked sensitive. The JSON plan still contains it.
+- `# (N unchanged attributes hidden)` is normal and not a finding.
+- A `has moved to` line comes from a `moved` block or a refactor. It is not a destroy, but check that nothing else changes on the moved address.
+
+Drift appears before the plan under **Objects have changed outside of Terraform**. Terraform only shows the drift it considers relevant to the planned changes. To see all of it, run `terraform plan -refresh-only`.
+
+## JSON plan fields this skill reads
+
+From `terraform show -json tfplan` (the documented JSON output format; `format_version` is a top-level key):
+
+| Field | What it tells you |
+|---|---|
+| `resource_changes[]` | One entry per resource instance with a planned action, including `no-op` |
+| `resource_changes[].address` | Full address, including module path and index: `module.api.aws_lb.public[0]` |
+| `resource_changes[].change.actions` | The action list: `["no-op"]`, `["create"]`, `["read"]`, `["update"]`, `["delete"]`, `["delete","create"]` (replace, destroy first), `["create","delete"]` (replace, create first). Newer versions add `["forget"]` for objects removed from state without being destroyed |
+| `resource_changes[].change.before` / `after` | Attribute values before and after. `before` is `null` on create, `after` is `null` on delete |
+| `resource_changes[].change.after_unknown` | Attributes whose value is only known after apply |
+| `resource_changes[].change.before_sensitive` / `after_sensitive` | Which attributes are sensitive. The values themselves are still in `before` / `after` in clear text |
+| `resource_changes[].change.replace_paths` | For a replace, the attribute paths that forced it, each a list of steps (`[["storage_encrypted"]]`, `[["ebs_block_device", 0, "volume_size"]]`) |
+| `resource_changes[].change.importing` | Present when the plan imports an existing object |
+| `resource_changes[].action_reason` | Why an action was chosen, when Terraform records one, e.g. `replace_because_tainted`, `replace_because_cannot_update`, `replace_by_request`, `delete_because_no_resource_config` |
+| `resource_changes[].deposed` | Set when the entry refers to a deposed object left over from an interrupted create-before-destroy |
+| `resource_drift[]` | Same shape as `resource_changes`, for objects that changed outside Terraform |
+| `errored` | `true` if planning failed; the plan is incomplete |
+
+`terraform show -json` with no plan file prints the **state**, which has `values` but no `resource_changes`. The script rejects it.
+
+## Stateful resources
+
+Destroying or replacing one of these loses data or identity that the new object does not have. The script matches resource types by substring; this is the human version.
+
+| Class | Examples (AWS / Google Cloud / Azure) | What recovers it |
+|---|---|---|
+| Relational databases | `aws_db_instance`, `aws_rds_cluster`, `google_sql_database_instance`, `azurerm_postgresql_flexible_server` | Final snapshot or point-in-time restore; check `skip_final_snapshot`, `deletion_protection` |
+| Key-value and document stores | `aws_dynamodb_table`, `azurerm_cosmosdb_account`, `google_bigtable_instance` | Backups or point-in-time recovery, if enabled |
+| Object storage | `aws_s3_bucket`, `google_storage_bucket`, `azurerm_storage_account` | Nothing, once deleted. Bucket names can also be taken by someone else |
+| Block and file storage | `aws_ebs_volume`, `aws_efs_file_system`, `google_compute_disk`, `azurerm_managed_disk` | Snapshots |
+| Caches and queues | `aws_elasticache_*`, `aws_sqs_queue`, `aws_msk_cluster`, `google_pubsub_topic` | In-flight messages and cache contents are gone |
+| Keys and secrets | `aws_kms_key`, `aws_secretsmanager_secret`, `google_kms_crypto_key`, `azurerm_key_vault` | Data encrypted with a destroyed key cannot be decrypted |
+
+## Access widening
+
+| Signal | Severity |
+|---|---|
+| New ingress from `0.0.0.0/0` or `::/0` | 🟥 unless the resource is meant to be public (a public load balancer on 443) and the user says so |
+| `Principal: "*"` in an Allow statement | 🟥 |
+| Wildcard `Action` together with `Resource: "*"` | 🟥 |
+| Wildcard `Action` on a scoped resource, or a scoped action on `Resource: "*"` | 🟧 |
+| Public access block setting turned from `true` to `false` | 🟥 |
+| New role trust relationship or role assignment | 🟧 |
+| Open egress to `0.0.0.0/0` | Note only |
+
+## Verdict rules
+
+| Verdict | When |
+|---|---|
+| **SAFE TO APPLY** | All changes in scope; no destroy or replace of stateful resources; no access widening; no drift the plan reverts |
+| **APPLY WITH CARE** | Stateless replacements, in-place changes to stateful resources, protection flags turned off, drift the plan overwrites, imports, `forget`, or explained out-of-scope changes. Give the checks |
+| **DO NOT APPLY** | Stateful destroy or replace without a confirmed recovery path, 🟥 access widening, an errored or truncated plan, or an unexplained out-of-scope change touching production |
+
+The script's floor verdict follows these rules mechanically. A reviewer may lower it only on the user's confirmation that the change is intended and recoverable.