# choudoufu

> choudoufu is OpenTofu that tags each resource with its owner. Your cloud's own permissions decide who can change it.

The source, and the reference material the site links to, is at https://github.com/INTENTIUS/choudoufu.

A page with a prompt carries it under "Optional: hand this page to your coding agent", and llms.txt lists it under the page. Every prompt forbids apply, approval and merge; those stay with the person.

## Pages

- [choudoufu](https://intentius.io/choudoufu/): choudoufu is OpenTofu that respects the owner tag on each resource.
- [Start a new estate](https://intentius.io/choudoufu/docs/use/start/): Install choudoufu, add one file, and apply an estate where choudoufu creates every resource.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/use/start/ in this repository. Install choudoufu, create `estate.chdf.hcl` with an estate name I confirm, remove any `backend` or `cloud` block, add `.tofu-records/` to `.gitignore`, then run `choudoufu init` and `choudoufu plan` and show me the plan. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [AWS](https://intentius.io/choudoufu/aws/): Two tags mark each resource. Your IAM decides who changes it.
- [Adopt](https://intentius.io/choudoufu/aws/adopt/): Bring running AWS resources under management with one command.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/aws/adopt/. Run `choudoufu live-import -state=stock.tfstate -estate=<name>` without `-approve` and report its output. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Compatibility](https://intentius.io/choudoufu/aws/compatibility/): What plans on AWS, checked offline by live-check.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/aws/compatibility/. Run `choudoufu live-check` here and report each refusal. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Gate](https://intentius.io/choudoufu/aws/gate/): IAM conditions on the owner tag decide who acts on what.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/aws/gate/. Draft an IAM policy scoping one role to this estate and show it to me. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Operate](https://intentius.io/choudoufu/aws/operate/): Rename, remove, scale, review and apply from CI.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/aws/operate/ for my change. Edit the configuration, run `choudoufu plan -out=plan.bin` and report the plan. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Proof](https://intentius.io/choudoufu/aws/proof/): What is proven on AWS and where the numbers live.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/aws/proof/, run `just smoke roundtrip` and report each verdict line. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Azure](https://intentius.io/choudoufu/azure/): Two tags mark each resource. Resource groups and Policy decide who changes it.
- [Adopt](https://intentius.io/choudoufu/azure/adopt/): One command migrates a state file.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/azure/adopt/. Run `choudoufu live-import -state=stock.tfstate -estate=<name>` without `-approve` and report its output. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Compatibility](https://intentius.io/choudoufu/azure/compatibility/): Stock azurerm and azapi, checked offline by live-check.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/azure/compatibility/. Run `choudoufu live-check` here and report each refusal. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Gate](https://intentius.io/choudoufu/azure/gate/): A role grants resource groups. Policy checks the tag.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/azure/gate/. Draft the two `az deployment sub create` lines for one principal and show them to me. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Operate](https://intentius.io/choudoufu/azure/operate/): Rename, records, remove.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/azure/operate/ for my change. Edit the configuration, run `choudoufu plan -out=plan.bin` and report the plan. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Proof](https://intentius.io/choudoufu/azure/proof/): Where the Azure estates' gauntlet runs are.
- [Tutorial: see markers work](https://intentius.io/choudoufu/docs/tutorial/): Stand up a small estate on a local AWS emulator or a kind cluster, delete its state cache, and watch the next plan find everything by its markers.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/tutorial/ in a checkout of INTENTIUS/choudoufu. Check that `docker info` succeeds, run `bash live/e2e/run.sh --expect 5` for AWS or `just smoke k8s-greenfield` for Kubernetes, and tell me which steps passed and, if it failed, which step it named. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Set up a record store bucket](https://intentius.io/choudoufu/docs/use/bucket/): Create the shared bucket, check it, and render each estate's role policy.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/use/bucket/. Run `choudoufu live-bucket -bucket <name>` on the bucket I name, render this estate's policy with `render-policy.sh`, and show me both. Create nothing. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Running an estate from CI](https://intentius.io/choudoufu/docs/use/cicd/): The six pipeline jobs and the role each needs.
  - Optional agent prompt: Read https://intentius.io/choudoufu/docs/use/cicd/ and propose the `live-check` and `live-plan` jobs for this repository's CI as a diff. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Day-2 operations](https://intentius.io/choudoufu/docs/use/day2/): Sharing values between estates, and the plan, review and apply loop.
  - Optional agent prompt: Read https://intentius.io/choudoufu/docs/use/day2/ and propose, as a diff, a marker-filtered data source for each `terraform_remote_state` here. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Migrate an existing estate](https://intentius.io/choudoufu/docs/use/migrate/): Move a Terraform or OpenTofu configuration with a state file onto markers, and back.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/use/migrate/ for this repository, using the section for my platform. Install choudoufu, run `terraform state pull > stock.tfstate` (or `tofu state pull`), remove the `backend` block, create `estate.chdf.hcl` with an estate name and `record_store` I confirm, then run `choudoufu init`, `choudoufu live-check` and the dry `choudoufu live-import -state=stock.tfstate -estate=<estate>`, and show me each output. Do not pass `-approve`. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Recover an estate](https://intentius.io/choudoufu/docs/use/recover-an-estate/): What to do when the cache or the record store is lost and the live resources remain.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/use/recover-an-estate/: run `choudoufu plan -adoption-only` and give me each instance's class. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Reference](https://intentius.io/choudoufu/docs/use/reference/): The commands choudoufu adds and the live backend's arguments.
  - Optional agent prompt: Use https://intentius.io/choudoufu/docs/use/reference/ to check this repository's `estate.chdf.hcl` or `live` block and list any unknown or misspelled argument or value. Change no files. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Remove a resource](https://intentius.io/choudoufu/docs/use/remove-a-resource/): Destroy a resource by deleting its block, or keep it running unmanaged.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/use/remove-a-resource/ for the resource I name and propose the edit as a diff. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Rename a resource](https://intentius.io/choudoufu/docs/use/rename-a-resource/): Rename a block and its marker, or move a resource to another estate.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/use/rename-a-resource/ to rename the resource I name, then show me `choudoufu live-mv -dry-run` for it. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [What you set up by hand](https://intentius.io/choudoufu/docs/use/setup/): What must exist before the first plan.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/docs/use/setup/ for this repository and tell me what is missing. Create nothing in the cloud. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [GCP](https://intentius.io/choudoufu/gcp/): Labels mark each resource. The estate's project decides who changes it.
- [Adopt](https://intentius.io/choudoufu/gcp/adopt/): Labels mark each resource. One command migrates a stock state file.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/gcp/adopt/. Run `choudoufu live-import -state=stock.tfstate -estate=<name>` without `-approve` and report its output. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Compatibility](https://intentius.io/choudoufu/gcp/compatibility/): Every google and google-beta type with labels and effective_labels carries the marker.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/gcp/compatibility/. Run `choudoufu live-check` here and report each refusal. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Gate](https://intentius.io/choudoufu/gcp/gate/): One estate per project. Project IAM bindings grant it.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/gcp/gate/. Draft the project IAM bindings granting one principal this estate and show them to me. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Operate](https://intentius.io/choudoufu/gcp/operate/): Rename, records, remove.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/gcp/operate/ for my change. Edit the configuration, run `choudoufu plan -out=plan.bin` and report the plan. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Proof](https://intentius.io/choudoufu/gcp/proof/): Where the GCP estates' gauntlet runs are.
- [What it is](https://intentius.io/choudoufu/how-it-works/): How choudoufu keeps ownership on the resources.
  - Optional agent prompt: Read https://intentius.io/choudoufu/how-it-works/ and explain what choudoufu would change for the configuration in this repository. Change no files. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [The cache](https://intentius.io/choudoufu/how-it-works/cache/): The state file as a local cache.
  - Optional agent prompt: Read https://intentius.io/choudoufu/how-it-works/cache/ and check whether this repository's CI uploads `.terraform/`. Change no files. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Identity](https://intentius.io/choudoufu/how-it-works/identity/): How a resource carries the estate that owns it.
  - Optional agent prompt: Read https://intentius.io/choudoufu/how-it-works/identity/ and list the resources here that only a marker can find again. Change no files. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Records](https://intentius.io/choudoufu/how-it-works/values/): Where choudoufu keeps what a run must remember.
  - Optional agent prompt: Read https://intentius.io/choudoufu/how-it-works/values/ and list the record-backed resources here. Change no files. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Kubernetes](https://intentius.io/choudoufu/kubernetes/): One label marks each object. An admission policy decides who changes it.
- [Adopt](https://intentius.io/choudoufu/kubernetes/adopt/): One label marks each object. One command migrates a stock state file.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/kubernetes/adopt/. Run `choudoufu live-import -state=stock.tfstate -estate=<name>` without `-approve` and report its output. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Compatibility](https://intentius.io/choudoufu/kubernetes/compatibility/): Every type with object metadata plans, custom resources included.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/kubernetes/compatibility/. Run `choudoufu live-check` here and report each refusal. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Gate](https://intentius.io/choudoufu/kubernetes/gate/): One admission policy on the label fences writes to labelled objects.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/kubernetes/gate/. Draft the ClusterRole and binding granting one team this estate and show them to me. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Operate](https://intentius.io/choudoufu/kubernetes/operate/): Rename, keep records in-cluster, remove.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/kubernetes/operate/ for my change. Edit the configuration, run `choudoufu plan -out=plan.bin` and report the plan. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.
- [Proof](https://intentius.io/choudoufu/kubernetes/proof/): What is proven on a real cluster and where the numbers live.
  - Optional agent prompt: Follow https://intentius.io/choudoufu/kubernetes/proof/, run `just smoke k8s-greenfield` and report each verdict line. Never apply or destroy (`choudoufu apply`, `choudoufu destroy`, `tofu apply`), approve a saved plan, or merge; never edit or remove an owner tag by hand.

## Full text

- [llms-full.txt](https://intentius.io/choudoufu/llms-full.txt): every page above in one file