Review infrastructure change before it becomes infrastructure risk.

01 / Frame

Problem

• Terraform plans are dense review objects, and high-impact changes can be easy to miss in an unstructured diff.
• A useful review gate must explain findings without gaining permission to execute the plan it examines.

Constraints

• The public demo accepts bounded sample inputs rather than arbitrary infrastructure execution.
• External comments, checks, and approval writes remain mocked.
• Findings shown publicly come from deterministic Python checks.

05 / Reliability & security

Deterministic review inside a constrained boundary.

Repeatable Python checks evaluate bounded inputs while Terraform execution stays disabled and external writes remain mocked. The threat model documents what the public surface cannot do.

A stalled review recovers without gaining write authority.

If a review remains queued because the worker and execution mode disagree, the runbook checks REVIEW_EXECUTION_MODE, starts the worker or restores the intended safe mode, and keeps external writes mocked throughout the recovery.

06 / Limits

Known limits

• Terraform execution is disabled in the public demo.
• External repository writes are mocked.
• The public path does not execute an external policy engine.

Path to sustained operation

1. Run evaluation inside an isolated worker with bounded time, memory, and input size.
2. Use a narrowly scoped repository installation for checks and comments, with approval required for writes.
3. Version rule packs and retain the rule version with every decision record.