Skip to main content

Infrastructure change assessment and calibration

Score 0 missing/incorrect, 1 prompted/incomplete, 2 independently supported with limits, 3 justified fresh transfer. Every IA1–IA6 category requires at least 2.

  • IA1 — Review binding: trace source/inputs/tool versions/environment to a protected plan artifact, review and execution. Explain substitution, stale assumptions and sensitive-file handling.
  • IA2 — State model: independently implement the archive, predict competing plans and add same-owner reacquisition, wrong lineage and ABA cases. Explain atomicity and model limitations.
  • IA3 — Concurrency/recovery: retain original backend or explicitly simulated contention/recovery evidence; identify what establishes writer ownership and why force-unlock needs more than elapsed time. A model is not a backend verification claim.
  • IA4 — Actual plan pipeline: retain real format/validate and selected lint/security/policy outputs, reviewed plan and destructive/exposure/cost cases from guided Lab 1. Bind the selected artifact; if Terraform is absent, this gate remains pending.
  • IA5 — Drift/import: retain original controlled drift, reasoned accept/revert/import decision, object identity and a new clean plan. Explain the difference between refresh-only state reconciliation and configuration convergence. Actual-tool evidence remains required.
  • IA6 — Upgrade and interruption: retain module upgrade with address/ID continuity and no unintended replacement. Add a partial-success recovery packet with unknown observations preserved. Restore/import/moved choices must fit the problem, not merely clear an error.

Calibration​

Two plans from serial 0 cannot both succeed unchanged under this model. After the first, the second is stale even with a newly acquired lock and identical proposed value. Replan and review. A token from an earlier acquisition cannot release or apply under a later one with the same owner name. Matching serial but wrong lineage also fails. Every rejected model operation leaves state unchanged.

The model does not implement cryptographic approval, Terraform file formats or cloud rollback. Restoring a state snapshot does not remove resources created afterwards. Unknown provider observations cannot be treated as absence. A moved block addresses an address refactor; it cannot cure an unrelated destructive attribute change.

For terraform plan -detailed-exitcode, distinguish 0 (successful empty diff), 1 (error), and 2 (successful nonempty diff). An error is not clean drift evidence. Read the current CLI documentation and record tool/provider versions.

Delayed transfer​

After at least 48 hours, solve a fresh contention scenario with a same-owner restart, foreign lineage and one out-of-band change. Explain which failures the model detects and which require observation of the real resource. Preserve mistakes, assistance and repairs. Author reference runs do not satisfy learner actual-tool gates.