Intentius

Build in the platform's own terms, and keep its spec readable and predictable before anything runs. Read the full property →

chant Fold to native spec, no run

KCL / CUE / Pkl Folds via its own DSL

Formae Folds via Pkl; source is the truth

ConfigHub Holds the real spec (KRM) as data

CDK Synthesizes a reviewable native template (CloudFormation, or K8s via cdk8s), and a context lookup can shift the output when the program runs

Pulumi Runs the program through its own engine; no static declarative spec, only an engine preview or plan

Terraform / OpenTofu Declarative, but the real plan needs cloud and state

A change proves itself at the keystroke, the same check for a human and an agent. Read the full property →

chant Type and fold diagnostics at the keystroke, human and agent alike

KCL / CUE / Pkl Schema check plus an LSP

Formae Pkl types plus an LSP

ConfigHub Validated in the store, not at an editor keystroke

CDK TS types check, but infra correctness needs a synth and a plan

Pulumi TS types check, but infra correctness needs a preview

Terraform / OpenTofu validate is shallow; the real check is plan

The parts a machine can't infer belong in writing. Read the full property →

chant Typed lexicons, semantic lint, and policy checks

KCL / CUE / Pkl Schemas and constraints encode validity

Formae Pkl schemas and value constraints

ConfigHub KRM schemas encode validity

CDK L2 constructs and cdk-nag encode a lot of validity, and deeper policy is an add-on

Pulumi Types encode shape; policy via CrossGuard

Terraform / OpenTofu Thin types; policy via OPA or Sentinel

Every change arrives as a diff, in one place. Read the full property →

chant Every change is one typed change set against live

KCL / CUE / Pkl Language only; bring your own pipeline

Formae Reconciles Pkl source to the cloud

ConfigHub Actuates from the store via ArgoCD or Crossplane

CDK Deploy through cdk deploy

Pulumi Deploy through pulumi up

Terraform / OpenTofu plan and apply

Access stays scoped and revocable, and secrets are referenced by name rather than held. Read the full property →

chant By reference, never held, with keyless signing

KCL / CUE / Pkl Out of scope

Formae By reference, but an agent datastore sits in the loop

ConfigHub Never holds secrets, but least privilege rides the worker credentials you supply

CDK Refs and IAM, but the program can read secrets at runtime

Pulumi ESC gives references with short-lived OIDC, but core stores secrets encrypted in state

Terraform / OpenTofu Refs, but the state file can capture secrets; OpenTofu encrypts state at rest

One mistake can't take down everything. Read the full property →

chant Owned-only by marker, a per-environment removal cap, and a blast-radius graph view

KCL / CUE / Pkl Out of scope

Formae Reconcile scope, with an agent datastore in the loop

ConfigHub Actuator-scoped, ownership from live markers

CDK Stack and IAM boundaries, but refs can widen reach

Pulumi Stack and IAM boundaries, but refs can widen reach

Terraform / OpenTofu Module boundaries, but shared state couples them

Actions that can be undone run on their own, and the ones that cannot wait for a human. Read the full property →

chant Reversible runs ungated; a destructive one is gated with saga rollback

KCL / CUE / Pkl Out of scope

Formae Reconciles drift, with no reversible or irreversible split

ConfigHub Revert the store record, with no reversible or irreversible split

CDK CloudFormation auto-rollback and cdk rollback recover a failed deploy, though an irreversible change is not gated

Pulumi No auto-rollback; you re-apply a prior state

Terraform / OpenTofu No rollback; you re-apply a prior state by hand

The newcomer executes, and a human owns the call that matters. Read the full property →

chant A durable approval gate that survives a crash

KCL / CUE / Pkl Out of scope

Formae Native drift approve or reject; broader approval rides the pipeline

ConfigHub Apply Gates and named approvals before a change touches a cluster, in the tool

CDK Approval in the CI pipeline, not the tool

Pulumi Approval via Pulumi Deployments, a Cloud add-on

Terraform / OpenTofu Apply confirmation is built-in; role-separated approval needs HCP, a paid add-on

Every change traces to who made it and who approved it. Read the full property →

chant An append-only release ledger, with approval in the workflow history

KCL / CUE / Pkl Out of scope

Formae Pkl in git, plus the reconcile datastore

ConfigHub Each revision records who changed what and who approved, in the tool

CDK CloudTrail or pipeline logs, outside the tool

Pulumi Pulumi Cloud records who applied by default; the approver needs Deployments, an add-on

Terraform / OpenTofu State history or CI logs, outside the tool

Any credential can be rotated as a routine change, from what's written down. Read the full property →

chant By-reference makes rotation an out-of-band routine change

KCL / CUE / Pkl Out of scope

Formae By reference, but the datastore can hold the value

ConfigHub By reference; secrets stay external to the store

CDK Runtime reads or state can pin the value

Pulumi ESC helps, but core state can pin the value

Terraform / OpenTofu A state-captured secret needs state surgery

Truth lives in the running system, never a separate store you host. Read the full property →

chant Truth left in the live system, with no state store

KCL / CUE / Pkl Language only, no state model⁴

Formae Requires an authoritative agent datastore (SQLite, Postgres, or Aurora)

ConfigHub Authoring surface, source of truth, and control plane collapsed into one store

CDK No tool-side state copy: cdk8s emits stateless manifests you can GitOps, and AWS CDK's stack state is CloudFormation's own record of what AWS runs, not a copy the tool keeps

Pulumi Keeps its own authoritative state, whatever the backend

Terraform / OpenTofu The state file is the authority⁵

Existing infrastructure comes under management in place, without conversion to a private format. Read the full property →

chant Imports a template or live estate; the spec stays native

KCL / CUE / Pkl Importers bootstrap from OpenAPI, CRDs, or Terraform, but authoring moves to the DSL

Formae Reconciles an existing estate into Pkl

ConfigHub Imports into the store; leaving means exporting

CDK cdk import, then rewrite as code

Pulumi pulumi import, then rewrite as code

Terraform / OpenTofu Config-driven import blocks preview the import; you still author the HCL

The tool touches only what you declare and deletes only what it owns. Read the full property →

chant Selective by omission; deletes gated on an ownership marker

KCL / CUE / Pkl No apply, so nothing to over-reach

Formae Reconciles the declared, with ownership less explicit

ConfigHub Ownership from live markers, not the store

CDK Stack-scoped, but absence in the template deletes

Pulumi Stack-scoped, but absence in the program deletes

Terraform / OpenTofu Omission deletes by default; removed and prevent_destroy are opt-in guards, not the design

A deployable proves itself before it ships, verified where it is built. Read the full property →

chant SBOM, provenance, and a signature built at synthesis, verified at the deploy gate

KCL / CUE / Pkl No build artifact or gate

Formae Provenance via external tooling

ConfigHub Provenance via external tooling

CDK Provenance via CI add-ons like cosign or SLSA

Pulumi Provenance via CI add-ons like cosign or SLSA

Terraform / OpenTofu Provenance via CI add-ons