Approve the change, not the diff

Properties: VIII Escalate the judgment, XIV Verify the artifact, VII Reversible before risky
Goal: TODO
Done when: TODO
Restart from: lesson 6 (the lesson whose checkpoint to reload if this one breaks)
Mode: self-paced or live · about 20 min

closes P14

Watch

TODO: video

hands-on self-paced live

The reviewer approves the plan block. It holds the access delta, the proof verdicts and a digest over the saved plan file. The apply job replans and refuses if the digest or the estate moved. Terraform refuses a saved plan whose state has moved on its own, so the check and the applier agree.
The saved plan is the manifest. terraform show -json tfplan is its native form. The E1 schema is the cross-backend version of the same object (decision 23).
A change that replaces a resource rather than updating it waits for a person. Terraform names these in the plan, and on IAM a replacement means an ARN changes underneath whatever trusts it.
Provenance is a stated gap. The digest proves the plan did not move, not who produced it. An OIDC-attested build checked before apply is the follow-on lesson, and property XIV is only half closed until then.

TODO: Video script or link. Optional.

TODO: Numbered steps. Imperative. One job.

TODO: What Floci or your own machine can and cannot show.

TODO: What the room sees. Timing. The line to say.