Tools

behold

Visualize and control. It reads what chant records for terragucci, and Pulumi from stack exports. On a chant project you can act from the graph, through Ops and their approvals.

Docs · Source

chant

Cloud native ops and governance. terragucci and plywood are built on it. The deploy pipeline is generated from that same code, so adding a service does not mean writing another one.

Docs · Source

Audit

Point it at a repository that has never heard of chant and it runs a few hundred security and correctness checks over whatever it finds. The fixes that are safe to make come back ready to apply. blacklight is the same thing, hosted.

Agents

An agent can build the project and check it, then compare what is written against what is running. Starting or approving a deployment works the same way for an agent as for a person, and neither can hurry an approval.

Fountain

Declares an agent’s sandbox, its secrets and its schedule as ordinary infrastructure, then compares them against what is really running.

choudoufu

Per-resource locking for OpenTofu, and the engine terragucci can run with binary: choudoufu. Every resource records who owns it on the resource itself, as tags or labels on the three big clouds and Kubernetes. The state file becomes a copy you are allowed to lose.

Docs · Source · Compare

plunge

Per-resource locking for Pulumi, and the engine plywood can run with engine: plunge. This fork of Pulumi has a drop-in CLI that runs your programs as they are. plunge keeps one record per resource in place of one state file per stack and writes two ownership tags on each cloud object, so two runs that change different resources of one stack do not wait for each other.

Docs · Source · Compare

plywood

Pulumi ops and governance, built on chant, that can run plunge as its engine. Previews and updates run from pull requests on GitHub, GitLab or Forgejo, as jobs in your own CI. A change gets one preview note for every stack it reaches, and each approval binds the preview digest it was shown.

Docs · Source · Compare

terragucci

Terraform ops and governance. Under it sits chant, and choudoufu can stand in for the terraform binary. Plan, approve and apply Terraform, OpenTofu and Terragrunt from pull requests, as jobs in your own CI.

Docs · Source

Wardens

An org and its repositories kept in the state you declared, with drift corrected. GitHubGitLabForgejo

Emulators

Local stand-ins so the tools run without a cloud account. mudflaps and spritzer for Fly, m80 for KubeMicroVM, floci for AWS.

Also

pinhole draws the picture. spicypath inspects a profile in the browser.

Questions

What has been checked, and how?

The evidence pages live in each tool’s repository and are updated with every release. See choudoufu and plunge for the two forks, and plywood with terragucci for the two CI tools.