What problem does it solve? Terraform and OpenTofu work fails in predictable ways — identity churn after refactors, secrets leaking into state, oversized blast radius, CI drift, and state corruption — and generic advice often ignores the runtime version, causing destroy/recreate surprises or invalid plans. ## Core Features & Use Cases - Diagnose-first routing: A failure-category table maps symptoms (identity churn, secret exposure, destroy cascades, CI drift, testing blind spots) to the exact reference file needed, so only relevant depth is loaded. - Version-aware guards: Feature floors for moved blocks (1.1+), native tests (1.6+), mock providers (1.7+), S3 native locking (1.10+), and write_only arguments (1.11+) prevent emitting code the runtime cannot run. - Response contract: Every answer includes assumptions, risk category, remediation tradeoffs, a validation plan, and rollback notes; destructive operations require a reviewed plan -destroy first. - Use Case: When a count-to-for_each refactor threatens to recreate production subnets, the skill generates moved blocks and a verification plan showing zero destroy operations. ## Quick Start Ask the assistant to review your Terraform module for state and security risks, mentioning your Terraform or OpenTofu version and backend.
