Description
Every Terraform object assumes Touchline exists (locals.agent_teams, team_checks, chart_values, dashboards, rules, evaluators, KG config). Opt-in cannot work until Touchline objects are individually gated and the default plan is provably unchanged. This is the frozen seam the other subtasks build on: it owns terraform/variables.tf use_cases, regulatory_name and regulatory_namespace, terraform/locals.tf and the gating of existing resources.
Acceptance Criteria
- #1 use_cases is a set(string) of touchline|regulatory, default [touchline], validated non-empty
- #2 tofu plan with the default against the current state shows no resource changes or address moves
- #3 tofu validate passes for [touchline], [regulatory] and both, with Touchline-only objects absent when touchline is not selected
- #4 team_checks and Bedrock team profiles cover the union of enabled use-case teams plus agent-host developer teams
- #5 use_cases is a set(string) of touchline|regulatory, default [touchline], validated non-empty; regulatory_name, regulatory_namespace, regulatory_agent_models and regulatory_requests_per_minute exist with the doc-0003 validations (names and namespaces differ, no prefix overlap)
- #6 doc-0003 gains the object classification table (touchline-only, always-on, regulatory-only) before any code changes, and mixed objects (folder, dashboards, rule groups, shared evaluators) are filtered per item, not gated whole
- #7 Default plan is 0 to add, 0 to change, 0 to destroy against the base commit; any address change goes through a permanent moved block; docs/teardown.md state rm addresses are updated
- #8 terraform/tests/*.tftest.hcl with mock_provider run a plan per use_cases combination and assert which resources exist; just lint runs them
- #9 local.service_names, local.team_models, local.agent_teams, var.teams and the shared bedrock_invoke policy are unchanged, and images_digests_json passes only gateway and dev-workstation digests so a regulatory pin cannot replace the host
Definition of Done
- #1 just check
Implementation Plan
- Classify every existing Terraform object in the design before code edits. 2. Add validated use-case inputs and isolated regulatory locals; gate only Touchline resources/items with permanent address moves and safe outputs. 3. Add offline mocked plans for all combinations and compare the default planned resource addresses/values with the pre-change commit. 4. Update teardown and host digest caveat, run just check, review the final candidate with CodeRabbit, then commit and push the completed foundation.
Implementation Notes
Implemented the gated Touchline resources and mixed Grafana filtering, including links to the absent agents dashboard. Initial regression failed against unchanged code because regulatory-only retained that dashboard; all ten initial combination/validation cases now pass. Cross-input checks are conditional preconditions on the existing team_checks object, preserving the declared 1.8 interface and customized Touchline model keys. Reserved regulatory seams are explicitly annotated for lint until their provisioning/app consumers land. Offline baseline compatibility proof is being completed before the final gate and review.
Validation: uv run –no-project –with pyyaml just check passed (11 offline use-case/validation plans; full existing Node/Python suites; format, Terraform validation, tflint, Helm and shell checks). Plain local just check initially stopped at missing PyYAML; the isolated environment supplies it without source changes. Default deterministic plan matches base 8be4a4c82e337a9388d2070ae06c3d030a997dab across 140 resource entries and 12 outputs with permanent move mappings. Helper red proof rejected a mutated namespace; explicit scratch refresh and restored original fixture both passed. Adding a regulatory digest leaves actual planned host user_data_base64 unchanged. CodeRabbit completed coverage of all 24 changed files with zero findings. Local private scrub skipped because no denylist is configured; CI owns the secret-backed check. Earlier live-state/union criteria are interpreted through the binding design corrections: no live baseline exists, and regulatory team/profile locals remain separate from the byte-unchanged host/gateway matrices and invoke policy.
Final Summary
Completed the Terraform foundation for opt-in regulatory document authoring. Touchline resources and mixed Grafana items are gated, shared coding-agent objects remain, independent regulatory inputs/maps are validated, permanent state moves preserve upgrades, and host/chart digest maps are isolated. Offline combination and compatibility tests are wired into just lint. Updated operator reference and teardown addresses, including the one-time host replacement caveat for deployments with non-host digest pins. Full local gate and CodeRabbit review passed; no live deployment or regulatory app provisioning was performed.