External-diff replay evaluation

CHG-2340 — Scale up the checkout worker instance

Ready to evaluateREADY

Choose Run replay to evaluate this bundled Terraform plan.

Deterministic findings

Policy, reversibility, and context evidence

Policy, reversibility, and untrusted-context evidence appear only after replay evaluation.

Evaluated proposal

Replay result only

No evaluated proposal is available yet.

Supplied Terraform plan

2 actionable resource changes

Module, provider resource type, address, and before/after values are read from the bundled plan. No result is declared before the deterministic evaluation runs.

Structured diff

Resources and actions

Deterministic evaluation always covers all 2 changes; search and paging bound only the rendered evidence table.

Search all Terraform changes

Showing 1–2 of 2 changes.

Page 1 of 1

Terraform resource changes
Module	Type / address	Action	Before / after
module.compute	aws_instance module.compute.aws_instance.checkout_worker	update	Inspect values for module.compute.aws_instance.checkout_worker instance_type: "m6i.large" → "m6i.xlarge" { removed: "instance_type": "m6i.large", added: "instance_type": "m6i.xlarge", "tags": { "service": "checkout" } }
module.compute	aws_cloudwatch_metric_alarm module.compute.aws_cloudwatch_metric_alarm.checkout_cpu_high	create	Inspect values for module.compute.aws_cloudwatch_metric_alarm.checkout_cpu_high removed: null added: { added: "threshold": 80, added: "tags": { added: "service": "checkout" added: } added: }

Untrusted context

Bundled plan context

No untrusted context was supplied with this plan.

Policy coverage

Registered, loaded, and evaluated evidence

Registry metadata identifies the domain without loading its adapter. Loaded coverage comes from the deterministic runtime. A policy is marked evaluated only when the current review returned its finding.

Registered metadata

Domain: Terraform · terraform
Contract: 2.0.0
Shape: external-diff
Declared capabilities: graph no · structured diff yes · untrusted context yes

Loaded deterministic coverage

Policy version: core-v0.2.0+terraform-v0.2.1
Baseline pack: terraform-defaults · domain-default
Blast radius: warn at 15 · block above 60
Verification: precondition required · postcheck required

Ordered deterministic policy coverage for Terraform
Order	Policy	Current review
1	PATCH_SCHEMA	loaded · not yet evaluated
2	DESTRUCTIVE_OP	loaded · not yet evaluated
3	PROTECTED_RESOURCE	loaded · not yet evaluated
4	REVERSIBILITY	loaded · not yet evaluated
5	PLAN_CONTEXT_REQUIRED	loaded · not yet evaluated
6	BLAST_RADIUS	loaded · not yet evaluated
7	UNTRUSTED_INSTRUCTION	loaded · not yet evaluated

Explicit policy skips

ROLLBACK_COMPLETE — a Terraform plan carries no inverse operations to verify; reverting means reverting the code, not replaying a patch Replacement: REVERSIBILITY.
VERIFICATION_REQUIRED — the proposal is derived mechanically from the plan with no model involved, so it can never declare its own precondition or postcheck steps; verification in this workflow happens through the pull request review instead Replacement: PLAN_CONTEXT_REQUIRED.

Source provenance

Source ID: scenario-k-capacity-scale-up
Source: authored-fixture
Analysis mode: replay
Provenance: authored-synthetic
Artifact input: bundled authored fixture
External read: unavailable
Model generation: not run
Infrastructure write: unavailable

Simulation and limitations

Sandbox simulation capability: unavailable.

Terraform is external-diff only. ChangeSafe evaluates the supplied plan and never claims to simulate it.

• Consumes a supplied Terraform plan as an external diff; Terraform execution is outside this runtime and unsupported.
• Sandbox simulation is unavailable because the domain has no mutable declarative state inside ChangeSafe.