Provisioning

Provisioning is an immutable run lifecycle. A plan is evidence for a specific template, input set, workspace, policy context and snapshot binding; it is not a standing permission to apply later.

The gate sequence

request
  -> validate template + inputs
  -> generate config artifact
  -> tofu init / validate / plan
  -> policy decision
  -> cost and impact estimate
  -> PENDING_APPROVAL
  -> approval (15 minute validity)
  -> isolated worker apply
  -> encrypted state persistence
  -> verification
  -> audit

The API checks provisioning.plan for planning and provisioning.apply for approval/apply. Live apply additionally requires cloud.live. The worker repeats the plan, entitlement, policy, approval and snapshot checks before its first side effect. A stale plan fails rather than applying against a changed target.

State	Meaning	Next safe actions
PENDING_APPROVAL	Plan, policy and estimate are available	approve or cancel
APPROVED	Exact plan approved; approval expires after 15 minutes	apply before expiry
RUNNING	Worker is executing the approved run	observe, cancel where supported
SUCCEEDED	Worker verified completion	inspect outputs and artifacts
FAILED	Execution or verification failed	inspect diagnostics; create a new run
CANCELLED	No further execution for this run	create a new plan if intent remains

Destroy is risk 3: an OWNER-level elevated role, DESTROY typed confirmation, a reason of at least 10 characters, policy re-evaluation and full audit trail are required.

Isolation rules

Templates use allowlisted registry modules with pinned checksums. Remote git:// and http:// module sources are rejected. Provider credentials are injected only into the runner environment, never generated files, plan output, state or logs. Runners, state and locks are isolated by organization and workspace; state artifacts use envelope AES-256-GCM encryption.

Mock versus live

The shipped MockTofuRunner produces deterministic plan, apply outputs and state without an OpenTofu binary or cloud credentials. Demo applies must be presented as simulated. A live OpenTofu runner remains an integration boundary and must preserve the same interface, encryption, locking and entitlement gates.