Intentius

INTENTIUS

What's free here, against each vendor's top tier

IntentiusPulumi Cloud

Resource-level concurrencyTwo changes to one stack or root, on different resources, apply at the same time.Terraform with choudoufu, both apply at onceintentius.ioPulumi with plunge, both apply at onceintentius.io✗ second queuesdeveloper.hashicorp.com✗ second queuespulumi.com✗ second waitsdocs.spacelift.io

No stack lockA change locks only the resources it touches, never the whole stack or root.Terraform with choudoufu, each resource locks aloneintentius.ioPulumi with plunge, each resource locks aloneintentius.io✗ locks the whole workspacedeveloper.hashicorp.com✗ locks the whole stackpulumi.com✗ locks the whole stackdocs.spacelift.io

Every terragucci and plywood feature on one tierall 32 of terragucci's and all 25 of plywood's, freeintentius.io/terragucciintentius.io/plywood✗ Enterprise still lacks 8 of terragucci's 32hashicorp.com✗ Enterprise still lacks 10 of plywood's 25pulumi.comTerraform ✗ Enterprise still lacks 5 of terragucci's 32spacelift.ioPulumi ✗ Enterprise still lacks 5 of plywood's 25spacelift.io

No licence or usage feesnothing; Apache-2.0intentius.io✗ per resource-hourdeveloper.hashicorp.com✗ per resource-hourpulumi.com✗ per workerspacelift.io

Runs on runners you controlyour CI runnersintentius.io/terragucciintentius.io/plywood✓ developer.hashicorp.com✓ Enterprisepulumi.com✓ Businessdocs.spacelift.io/conceptsspacelift.io/pricing

State stays in your own backendState: the record of what Terraform or Pulumi created.Terraform stays in your own backendintentius.ioPulumi your own bucket, or Pulumi Cloud if you keep itintentius.io✗ hosted, below Enterprisedeveloper.hashicorp.com/terraformhashicorp.com/pricing✗ hosted, below Enterprisepulumi.com/docspulumi.com/docsTerraform ✓ docs.spacelift.ioPulumi ✓ docs.spacelift.io

Terraform and Pulumi on three clouds, in one graphbehold: choudoufu and plunge projects drawn together across AWS, Azure and GCP, linked by shared outputsintentius.io✓ Standard, US onlydeveloper.hashicorp.com/hcphashicorp.com/blog✓ Propulumi.com✗ list onlydocs.spacelift.io

Runs without calling the vendorTerraform none past your CI and cloudintentius.ioPulumi none past your CI, cloud and backendintentius.io✗ below Enterprisedeveloper.hashicorp.com/terraformhashicorp.com/pricing✗ below Enterprisepulumi.com/docspulumi.com/docs✗ below Enterprisedocs.spacelift.io/conceptsspacelift.io/pricing

Sources read 2026-10-28 for Terraform, 2026-10-29 for Pulumi.

Skip to Terraform in detail or Pulumi in detail if you run one engine.

The control plane

behold against the HCP Terraform, Pulumi Cloud and Spacelift consoles, across both engines.

One graph, every engine

behold is free. It reads Terraform through choudoufu and Pulumi through plunge.

beholdPulumi Cloud

Terraform and Pulumi on three clouds, in one graphchoudoufu and plunge projects drawn together across AWS, Azure and GCP, linked by shared outputsintentius.io✓ Standard, US onlydeveloper.hashicorp.com/hcphashicorp.com/blog✓ Propulumi.com✗ list onlydocs.spacelift.io

Drift, shown on the graph from each engine's own readDrift: a change made outside your code.live, from each engine's own read: plunge drift for Pulumi, choudoufu's plan for Terraform, chant's live read for chantintentius.io/beholdintentius.io/behold✗ not on a graphdeveloper.hashicorp.com✗ not on a graphpulumi.com✗ not on a graphdocs.spacelift.io

Finds cloud resources no code manageschant search --ambient reports those of a kind you manageintentius.io/chantintentius.io/chant✓ tier not publisheddeveloper.hashicorp.com✓ Essentialspulumi.comTerraform ✓ tier not publisheddocs.spacelift.ioPulumi ✗ not for Pulumidocs.spacelift.io

Shows which run deployed each resourcecommit, run, digest, actor and approver, from chant's release ledgerintentius.io–✓ pulumi.com✓ docs.spacelift.io

Sources read 2026-10-28 for Terraform, 2026-10-29 for Pulumi.

Terraform in detail

terragucci and choudoufu against HCP Terraform and Spacelift.

Two changes at once

terragucci

One apply locks less than a whole rootone resource only with choudoufu; terragucci alone locks the rootintentius.io✗ whole workspacedeveloper.hashicorp.com✗ whole stackdocs.spacelift.io

Two applies in different roots run side by sideside by side, up to your CI's capacityintentius.io✓ limit by tierdeveloper.hashicorp.com✓ one per workerdocs.spacelift.io

The engine underneath

choudoufu is free. terragucci runs it with binary: choudoufu.

choudoufu

Two applies to one root, on different resources, run side by sideboth apply; neither waits for a lockintentius.io✗ second queuesdeveloper.hashicorp.com✗ second waitsdocs.spacelift.io

Drift read for one resource alonethat resource and what it reads, no root-wide sweepintentius.io✗ whole workspacedeveloper.hashicorp.com✗ whole stackdocs.spacelift.io

Ownership recorded on the resource itselftofu-estate and tofu-address tags on the resource itselfintentius.io✗ developer.hashicorp.com✗ docs.spacelift.io

What's included

Tick what you need. These are terragucci's features.

terragucci

Plans and applies on pull requestsIncludedintentius.ioFreedeveloper.hashicorp.comFreespacelift.io An approval before an applyIncludedbound to the saved planintentius.ioFreemanual applydeveloper.hashicorp.comStarterspacelift.io Policy as codeIncludedOPA, conftestintentius.ioStandarddeveloper.hashicorp.comStarterspacelift.io Drift detectionDrift: a change made outside your code.Includedfixes by pull requestintentius.ioStandarddeveloper.hashicorp.comBusinessprivate workers onlyspacelift.io Cost estimatesIncludedyour Infracost keyintentius.ioStandarddeveloper.hashicorp.comFreespacelift.io Audit trailIncludedin your bucket, kept as long as you likeintentius.ioStandard14 daysdeveloper.hashicorp.comEnterprise30 daysdocs.spacelift.io SSOIncludedyour forge'sintentius.ioFreedeveloper.hashicorp.comEnterprisespacelift.io Runs on runners you controlIncludedyour CIintentius.ioFreedeveloper.hashicorp.comBusinessspacelift.io Nothing hosted by the vendorIncludednothing to hostintentius.ioEnterprisehashicorp.comEnterpriseon requestspacelift.io AI on failed runs and driftIncludedyour model keyintentius.io✗ Nonehashicorp.comFreesummaries onlydocs.spacelift.io Applies dependent roots in order, with an approval between wavesWave: a group of roots applied together, after the ones they depend on.Includedorder from remote state reads; each wave behind its gateintentius.ioPremiumHCP Stacks onlydeveloper.hashicorp.com✗ Noneno gate between wavesdocs.spacelift.io One pull request comment for every root a change touchesRoot: a folder Terraform plans and applies as one unit. HCP Terraform calls it a workspace.Includedidentical changes grouped, every destroy namedintentius.io✗ Nonedeveloper.hashicorp.com✗ Nonedocs.spacelift.io Short-lived environments, deleted after a set timeIncludeda copy per pull request, deleted when it closes or after a set timeintentius.ioStandarddeveloper.hashicorp.comBusinessprivate workers onlydocs.spacelift.io Private module registry with testsIncludedin your bucket; tofu test before releaseintentius.ioEssentialshashicorp.comStarterspacelift.io Signed module releasesIncludedeach release signed with cosignintentius.io✗ Nonedeveloper.hashicorp.com✗ Nonedocs.spacelift.io Hold or deny a change on its costIncludedyour Infracost key; a threshold holds the waveintentius.ioStandardlegacy checks onlydeveloper.hashicorp.comStarterdocs.spacelift.io Approve from Slack or TeamsIncludeda relay you run in your cloudintentius.io✗ Nonenotifications onlydeveloper.hashicorp.comStarterSlack onlydocs.spacelift.io Slack, Teams and webhook notificationsIncludedsigned webhook, Slack or Teamsintentius.io✓ Tier not publisheddeveloper.hashicorp.comStarterspacelift.io Short-lived cloud credentials (OIDC)Includeda plan role and an apply role, never the sameintentius.io✓ Tier not publisheddeveloper.hashicorp.comStarterspacelift.io Plan or apply from a pull request commentIncluded/terragucci plan, /terragucci apply before mergeintentius.io✗ Nonedeveloper.hashicorp.comStarterdocs.spacelift.io Apply only the plan that was approvedIncludedif the plan changed after approval, nothing is appliedintentius.io✓ Tier not publisheddeveloper.hashicorp.comFreedocs.spacelift.io Policy overrides by named peopleIncludedonly people listed in policy.override; each override recordedintentius.ioStandarddeveloper.hashicorp.com✗ Nonedenies are finaldocs.spacelift.io Traces and metrics to your collectorIncludedOpenTelemetry over OTLP; your collectorintentius.ioFreedeveloper.hashicorp.comStarterdocs.spacelift.io DORA delivery metricsIncludedper project and for the estateintentius.io✗ Nonedeveloper.hashicorp.com✓ Tier not publisheddocs.spacelift.io One view across every projectIncludeda page in your bucket; SQL over the reportsintentius.io✓ Tier not publisheddeveloper.hashicorp.comStarterspacelift.io Your commands before and after plan and applyIncludeda failing hook stops the wave or holds itintentius.ioFreeone on Freedeveloper.hashicorp.comStarterdocs.spacelift.io Roll a module version out to its usersIncludedone pull request per wave, across reposintentius.ioStandarddeveloper.hashicorp.comStarterspacelift.io Request an app from a templateIncludedfrom a template or add-on; a yanked version is refusedintentius.ioStandardno-code modules; a version can be deprecated on Standard, revoked on Premiumdeveloper.hashicorp.comBusinessBlueprints and Templates; no yank documenteddocs.spacelift.io Day-2 actions behind a second person's approvalIncludeda changed input is gated againintentius.ioStandardTerraform 1.14 actions run as a run; approver not documenteddeveloper.hashicorp.comStarterTasks; an approval policy can require two approvalsspacelift.io Import from another platformIncludedHCP, OTF, Scalr, Spacelift, env zero, Atlantisintentius.io✗ NoneCommunity Edition state onlydeveloper.hashicorp.com✓ Tier not publisheddocs.spacelift.io An MCP server for your coding agentIncludedagents read recent applies, audit and delivery metrics, and can open pull requestsintentius.io✓ Tier not publisheddeveloper.hashicorp.comFreedocs.spacelift.io A model reviews each pull requestIncludedyour model key; approves nothingintentius.io✗ Nonedeveloper.hashicorp.com✗ Nonedocs.spacelift.ioShow all 32 features

The tier you'd needIncludedPremiumand still missing 1 of the features you tickedEnterpriseand still missing 2 of the features you ticked

The basics

terragucci

No licence or usage feesnothing; Apache-2.0intentius.io✗ per resource-hourdeveloper.hashicorp.com✗ per workerspacelift.io

Runs on runners you controlyour CI runnersintentius.io✓ developer.hashicorp.com✓ Businessdocs.spacelift.io/conceptsspacelift.io/pricing

Where your things live

terragucci

State stays in your own backendState: the record of what Terraform created.stays in your own backendintentius.io✗ hosted, below Enterprisedeveloper.hashicorp.com/terraformhashicorp.com/pricing✓ docs.spacelift.io

Plans and run logs stay in your forgeyour forgeintentius.io✗ developer.hashicorp.com✗ docs.spacelift.io

Audit trail in your own storageyour bucket, as JSON linesintentius.io✗ 14 daysdeveloper.hashicorp.com✗ 30 daysdocs.spacelift.io

Runs without calling the vendornone past your CI and cloudintentius.io✗ below Enterprisedeveloper.hashicorp.com/terraformhashicorp.com/pricing✗ below Enterprisedocs.spacelift.io/conceptsspacelift.io/pricing

Who owns what

terragucci

Your cloud IAM decides who may change each resourceyour cloud IAM, reading that tagintentius.io✗ developer.hashicorp.com✗ docs.spacelift.io

One root reads another without the vendorwith choudoufu, the live resource, found by its tagsintentius.io✗ developer.hashicorp.com✗ docs.spacelift.io

Leaving

terragucci

Your state stays put when you leavenever movedintentius.io✗ API downloaddeveloper.hashicorp.com✓ if in your backenddocs.spacelift.io/vendorsdocs.spacelift.io/vendors

Your pipeline leaves with youplain CI files in your repointentius.io✗ developer.hashicorp.com✗ docs.spacelift.io

Your policies run anywhereRego, run by OPA anywhereintentius.io✓ OPA ones; Sentinel notdeveloper.hashicorp.com✗ Spacelift fieldsdocs.spacelift.io

Cancel at any timenothing to cancel; Apache-2.0intentius.io✓ usage billingdeveloper.hashicorp.com✗ annual plansspacelift.io

What the attestation covers

A vendor's SOC 2 covers its own service, not your estate.

terragucci

No third party added to your audit scopenoneintentius.io✗ hashicorp.com✗ docs.spacelift.io

AI that does the work

terragucci

AI writes changes and fixes driftwrites the change, fixes drift, reviews plans, summarises a refused waveintentius.io✗ hashicorp.com✗ summaries onlydocs.spacelift.io

AI runs in your CI with your model keyyour CI, your model key, behind your approvalsintentius.io✗ hashicorp.com✗ docs.spacelift.io

AI on every tierevery install, no tierintentius.io✓ hashicorp.com✓ docs.spacelift.io

Sources read 2026-10-28.

Pulumi in detail

plywood and plunge against Pulumi Cloud, and against Spacelift where it runs Pulumi. Pulumi calls a plan a preview, and an apply an update.

Two changes at once

plywoodPulumi Cloud

One update locks less than a whole stackone resource only with plunge; stock Pulumi locks the stackintentius.io✗ whole stackpulumi.com✗ whole stackdocs.spacelift.io

Updates to different stacks run side by sideside by side, up to your CI's capacityintentius.io✓ Essentialspulumi.com✓ one per workerdocs.spacelift.io

The engine underneath

plunge is free. plywood runs it with engine: plunge.

plungePulumi Cloud

Two updates to one stack, on different resources, run side by sideboth apply; neither waits for a lockintentius.io✗ second queuespulumi.com✗ second waitsdocs.spacelift.io

Drift read for one resource aloneone provider read, no stack refreshintentius.io✗ whole stackpulumi.com✗ whole stackdocs.spacelift.io

Ownership recorded on the resource itselfplunge-stack and plunge-urn tags on the resource itselfintentius.io✗ pulumi.com✗ docs.spacelift.io

What's included

Tick what you need. These are plywood's features.

plywoodPulumi Cloud

Previews and updates from pull requestsIncludedGitHub, GitLab or Forgejointentius.ioFreepulumi.comFreefeature previewdocs.spacelift.io An approval before an updateIncludedbound to one preview digestintentius.io✗ Nonenone built in; ESC approvals gate credentials onlypulumi.comStarterspacelift.io Policy as code on every previewIncludedRego, and your CrossGuard packsintentius.ioPropulumi.comStarterspacelift.io Drift detectionDrift: a change made outside your code.Includedone issue per stackintentius.ioPropulumi.comBusinessprivate workers onlyspacelift.io A stack per pull request, deleted after a set timeStack: one deployment of a Pulumi program, such as dev or prod.Includeddeleted when the pull request closes or after a set timeintentius.ioPropulumi.comBusinessprivate workers onlydocs.spacelift.io Audit trailIncludedrows in your repository, kept as long as you likeintentius.ioPropulumi.comEnterprise30 daysdocs.spacelift.io SSOIncludedyour forge'sintentius.ioPropulumi.comEnterprisespacelift.io Runs on runners you controlIncludedyour CIintentius.ioEnterprisepulumi.comBusinessspacelift.io Nothing hosted by the vendorIncludednothing to hostintentius.ioEnterprisepulumi.comEnterpriseon requestspacelift.io AI on failed updates and driftIncludedfixes drift by pull request; your model keyintentius.ioProan agent can start on a failed operationpulumi.comFreesummaries onlydocs.spacelift.io Updates dependent stacks in order, with an approval between wavesWave: a group of stacks updated together, after the ones they depend on.Includedorder from StackReference reads; each wave behind its gateintentius.io✗ Noneno gate between stackspulumi.com✗ Noneno gate between wavesdocs.spacelift.io One pull request comment for every stack a change touchesIncludedidentical changes grouped, one approval for the setintentius.io✗ Nonepulumi.com✗ Nonedocs.spacelift.io Update from a pull request commentIncluded/plywood up before mergeintentius.io✗ Nonepulumi.comStarterdocs.spacelift.io Update only the preview that was approvedIncludedif the preview changed after approval, nothing is updatedintentius.io✗ Noneno approval for a preview to matchpulumi.comFreedocs.spacelift.io Slack, Teams and webhook notificationsIncludedsigned webhook, Slack or Teamsintentius.ioEssentialspulumi.comStarterspacelift.io Short-lived cloud credentials (OIDC)Includeda preview identity and an up identity, never the sameintentius.ioFreepulumi.comStarterspacelift.io A model reviews each pull requestIncludedyour model key; approves nothingintentius.ioEssentialsGitHub.com onlypulumi.com✗ Nonedocs.spacelift.io One view across every stackIncludedone page for all stacks, flagging overdue drift checksintentius.ioEssentialspulumi.comStarterspacelift.io Approve from Slack or TeamsIncludeda relay you run; plywood notify relay records itintentius.io✗ Nonenotifications onlypulumi.comStarterSlack onlydocs.spacelift.io Policy overrides by named peopleIncludedonly people listed in .chant/overriders; each override recordedintentius.io✗ Nonepolicy levels onlypulumi.com✗ Nonedenies are finaldocs.spacelift.io Traces and metrics to your collectorIncludedOpenTelemetry over OTLP; your collectorintentius.ioFreeCLI traces onlypulumi.comStarterdocs.spacelift.io DORA delivery metricsIncludedon the estate pageintentius.io✗ Noneexport and compute them yourselfpulumi.com✓ Tier not publisheddocs.spacelift.io Day-2 actions behind a second person's approvalIncludeda second person approves the one-resource previewintentius.io✗ Noneno approval step; ESC approvals gate credentials onlypulumi.comStarterTasks; an approval policy can require two approvalsspacelift.io Import from another platformIncludedPulumi Deployments, pulumi/actions, Spacelift, env zerointentius.io✗ Nonepulumi.com✗ NoneHCP Terraform onlydocs.spacelift.io An MCP server for your coding agentIncludedread-only: stacks, runs and reportsintentius.ioEssentialsstack toolspulumi.comFreedocs.spacelift.ioShow all 25 features

The tier you'd needIncludedEnterpriseand still missing 1 of the features you tickedEnterprise

The basics

plywoodPulumi Cloud

No licence or usage feesnothing; Apache-2.0intentius.io✗ per resource-hourpulumi.com✗ per workerspacelift.io

Runs on runners you controlyour CI runnersintentius.io✓ Enterprisepulumi.com✓ Businessdocs.spacelift.io/conceptsspacelift.io/pricing

Where your things live

plywoodPulumi Cloud

State stays in your own backendState: the record of what Pulumi created.your own bucket, or Pulumi Cloud if you keep itintentius.io✗ hosted, below Enterprisepulumi.com/docspulumi.com/docs✓ docs.spacelift.io

Previews and run logs stay in your forgeyour forgeintentius.io✗ pulumi.com✗ docs.spacelift.io

Audit trail in your own storageyour repository, as rows in its git historyintentius.io✓ export, Enterprisepulumi.com✗ 30 daysdocs.spacelift.io

Runs without calling the vendornone past your CI, cloud and backendintentius.io✗ below Enterprisepulumi.com/docspulumi.com/docs✗ below Enterprisedocs.spacelift.io/conceptsspacelift.io/pricing

Who owns what

plywoodPulumi Cloud

Your cloud IAM decides who may change each resourceAWS IAM and Azure Policy can read the plunge-stack tag; on Google Cloud the project is the fenceintentius.io/plungeintentius.io/plungeintentius.io/plunge✗ its own roles, on stackspulumi.com✗ its own spacesdocs.spacelift.io

Leaving

plywoodPulumi Cloud

Your state stays put when you leavenever movedintentius.io✗ stack migratepulumi.com✓ docs.spacelift.io

Your pipeline leaves with youplain CI files in your repointentius.io✗ pulumi.com✗ docs.spacelift.io

Your policies run anywhereRego and CrossGuard packs, run anywhereintentius.io✓ pulumi.com✗ Spacelift fieldsdocs.spacelift.io

Cancel at any timenothing to cancel; Apache-2.0intentius.io✓ monthly tierspulumi.com✗ annual plansspacelift.io

What the attestation covers

A vendor's SOC 2 covers its own service, not your estate.

plywoodPulumi Cloud

No third party added to your audit scopenoneintentius.io✗ pulumi.com✗ docs.spacelift.io

AI that does the work

plywoodPulumi Cloud

AI writes changes and fixes driftwrites the change from /plywood agent, fixes drift, reviews pull requestsintentius.io/plywoodintentius.io/plywood✗ changes only, Essentialspulumi.com✗ summaries onlydocs.spacelift.io

AI runs in your CI with your model keyyour CI, your model key, behind your approvalsintentius.io✗ Pulumi Cloud; your key on Enterprisepulumi.com✗ docs.spacelift.io

AI on every tierevery install, no tierintentius.io✗ Essentials and uppulumi.com✓ docs.spacelift.io

Sources read 2026-10-29.

behold across both engines

Clusters, sharing and approvals

behold is free. Kubernetes, Helm, Argo CD and Flux need chant.

beholdPulumi Cloud

One approval over every engine's planone approval covers the Pulumi and Terraform plans together; if any part changes, nothing appliesintentius.io–✗ no approval steppulumi.com✗ per stackdocs.spacelift.io

A graph of your Terraform estatedrawn from your repo; no state, cloud account or terraform binaryintentius.io✓ Standard, US onlyhashicorp.com–✗ list onlydocs.spacelift.io

A cluster and the pods running on it, in one graphwith chantintentius.io✗ developer.hashicorp.com–✗ docs.spacelift.io

Who changed a Kubernetes field outside your codenames the source, such as a kubectl edit or an autoscalerintentius.io✗ developer.hashicorp.com–✗ docs.spacelift.io

Pods and ReplicaSets under their Deploymentdrawn live, with chantintentius.io✗ developer.hashicorp.com–✗ docs.spacelift.io

Your Argo CD or Flux apps, mappedeach app in its namespace, with chantintentius.io✗ developer.hashicorp.com–✗ docs.spacelift.io

A read-only view you can share with anyoneexport one folder to any static hostintentius.io✗ sign-in requireddeveloper.hashicorp.com–✗ account onlydocs.spacelift.io

Sources read 2026-10-28 for Terraform, 2026-10-29 for Pulumi. HashiCorp, Terraform and HCP Terraform are trademarks of HashiCorp, an IBM Company. Spacelift and the Spacelift logo are trademarks of Spacelift, Inc. Logos are used to identify each product and are shown unaltered. Pulumi and the Pulumi logo are trademarks of Pulumi Corporation, and plywood and plunge have no tie to it.

Help me

Help me carve up a large estateHundreds of roots, or one state file shared by too many teamsHelp me move off another runnerAtlantis, Terraform Cloud or SpaceliftHelp me roll out terragucciApprovals, policy and traces, across your reposHelp me run agents on real infrastructureApproval gates, and the credential kept off the boxHelp me generate deploys and pipelinesCompiled from one description of the service

What I do

• Same HCL, same providers, same plan. choudoufu is a build of OpenTofu.
• Ownership moves out of the state file and onto each resource, where your IAM policies can read it.
• Runs on the three big clouds and Kubernetes. A read-only check reports anything it would refuse before you commit.

First step

Tell me what you run today and what you want to change. I will reply saying whether this is a fit.

Get in touch

Read more, and see what you can check before you write

Open source

The tools are free, and the docs for each are on its own site.

• beholdVisualize and control.
• chantCloud native ops and governance.
• choudoufuPer-resource locking for OpenTofu.
• plungePer-resource locking for Pulumi.
• plywoodPulumi ops and governance.
• terragucciTerraform ops and governance.

All the tools, or what I do with them.