Stand up the synthkit-terraform repository and freeze its module shape

Description

Stand up synthkit-terraform as a dedicated repository for synthkit’s capture environments, modelled on the structure of rkps-awsinfra but scoped to synthkit alone.

rkps-awsinfra is the worked example to copy from, not to extend: it is Rob’s AWS lab and already carries an unrelated estate. synthkit’s capture environments have a different lifecycle — created to capture, destroyed immediately after — and mixing them into a long-lived lab is what makes a forgotten managed control plane possible.

Structure to establish before any provider work: a per-provider module layout, remote state, a documented apply and destroy path per environment, and a cost guard that makes an orphaned environment loud rather than silent. Whatever provider goes first sets the shape the other two follow, so freeze the module interface here rather than discovering it three times.

The repository visibility decision belongs to Rob and must be asked before creation, not assumed.

Acceptance Criteria

• #1 The repository exists with visibility Rob explicitly chose
• #2 A per-provider module layout, remote state and a documented apply/destroy path are established
• #3 The module interface every provider implements is frozen before the second provider is written
• #4 An orphaned environment is detectable rather than silent

Definition of Done

• #1 terraform validate and fmt -check pass for every module
• #2 A full apply then destroy cycle completes for at least one environment, verified post-destroy

Implementation Notes

2026-08-29, decided by Rob: private, initially, while the environments are built out, so no credential or secret can leak while the shape is still moving. Revisit visibility later; synthkit itself is public AGPLv3, so this may follow once the repository provably holds nothing sensitive.

Created at github.com/rknightion/synthkit-terraform, owner rknightion to match its namesake rather than m7kni where rkps-awsinfra lives. Transferable if that turns out to be the wrong home.

Scaffolded 2026-08-29 with secret hygiene first, before any provider module:

• .gitignore covering *.tfvars, *.tfvars.json, *.pem, *.key, kubeconfigs, cloud CLI credential material and a captures/ directory. The *.tfvars and *.pem entries carry the reason they exist inline — their absence in rkps-awsinfra committed a GitHub App private key, a Forgejo token and three Grafana Cloud tokens, tracked there as EKS-0038. Do not tidy those comments away.
• .github/workflows/secret-scan.yml running gitleaks over full history on push and PR.
• AGENTS.md carrying the non-negotiables: no credential in the repository, every environment tears down completely and is verified after the fact, captures are never committed, one frozen module interface implemented by every provider, and capture at collector egress only.
• A justfile with the seven mandatory recipes; just check is the gate. just orphans is stubbed and is this task’s cost guard.

Still to do for this task: remote state, the per-provider module layout, and implementing just orphans so an environment left standing is loud rather than silent.

2026-09-06 reconciliation: AC1 is proven by the recorded private-visibility decision and current repository visibility PRIVATE. AC2 and AC3 are established by RKSY-0001, the frozen AGENTS.md contract, per-provider roots and encrypted remote state, and docs/sweep.md. AC4 is supported by RKSY-0006 live verification and this run: just orphans returned exit 1 with explicit UNKNOWN checks, never an all-clear. The apply/destroy DoD remains unproven: the reviewed historical RKSY notes contain no complete post-destroy sweep. Task remains To Do pending that evidence and the current validation gate.

Final reconciliation supersedes the earlier pending-validation note: synthkit-terraform just check passed at 04a228971deef87c11235ff3caddf38d64f1b86d, with hosted validate run 34028703857 successful. Validation DoD is now checked. The historical clean apply/destroy and post-destroy-sweep boundary remains open.

2026-09-06 DoD 2: the 2026-09-07 wave ran a full apply then destroy of the Rancher environment in synthkit-terraform (Destroy complete, 15 resources; scoped AWS orphan sweep standing=0 unknown=0), which is the at-least-one-environment lifecycle this item asks for. Recorded in RKSY-0031 and the wave report.

Final Summary

2026-09-06 reconciliation supersedes earlier source-work gaps: remote state, provider roots and orphan tooling are present. Historical complete apply/destroy proof remains unproven; checked source criteria do not imply lifecycle completion.

2026-09-06: Done at 4/4 with both DoD items proven: the repository, frozen module shape, remote state, orphan detection and one verified apply/destroy cycle all exist.