v0.3.0

choudoufu v0.3.0, built on OpenTofu 1.13.0 (fork point 03743ce6e8).

Everything outside live resource markers is stock OpenTofu 1.13.0. Binaries below are macOS, Linux and Windows, amd64 and arm64; macOS and Linux are .tar.gz, Windows is .zip; verify with SHA256SUMS.

Highlights

The gauntlet - real terraform-aws-modules and OpenTofu-native estates run side by side with stock against the pinned emulator - moved from 16/24 core estates clear at v0.2.0's close to 20 of 25 core clear (21 of 26 overall), with terraform-aws-modules/ec2-instance (the registry's most-downloaded module) newly added to the core set and clearing all five active stages. Snapshot: live/history/v0.3.0.json.

Record-primary identity (#364). Every managed instance now has one record: a single per-instance envelope (identity, the arguments the provider never echoes back, sensitivity, provisioner taint, managing provider), written by live-import and by every apply, and read FIRST on the next plan - verified against the ownership marker, with a stale record falling back loudly rather than binding wrong. A migrated estate no longer re-derives from configuration what its state file already said. terraform { live {} } alone implies a local record store, the way stock implies local state.

Schema-first identity (#387). Where the provider's own resource identity schema reproduces a hand-ratified table row (134 of 161 rows with a schema at aws 6.59.0), the schema now wins at runtime; live/rowgen-convergence.json carries the measurement.

The plan-node seam (#388), experimental. Behind CHOUDOUFU_NODE_RESOLVE=1, identity is resolved during the plan walk - record, then marker index, then the identity table over the instance's real evaluated values - which resolves configuration shapes the static pass must refuse. Off by default; the flag's open edges are tracked on the issue.

Strict toggles (#365). strict { secrets } now governs aws_iam_access_key/aws_iot_certificate (stored by default, the way stock stores them; refused under the toggle), and the new strict { no_source_create } picks refuse-or-create for an instance with no record, no marker, and no derivable identity (default: refuse).

Day-2 rename evidence (#357). The planned day2_rename stage passes on two estates: a moved block and choudoufu live-mv both rename with zero churn, the marker rewritten in place, stock's plan as the oracle.

Emulator. The pinned floci image is now built from the fork's own main (four merge rounds landed the previously-unmerged fix branches), and the pin (sha256:a9dc5342) adds EC2 launch-template/metadata, autoscaling-policy, CloudWatch-alarm, SSM public-AMI-parameter and RDS fixes. Remaining walls on the five not-yet-clear estates are all named and filed (lex00/floci#110/#112/#119/#120, choudoufu#392/#393).

Process. Every session now starts from bash scripts/pickup.sh; the foundation order and its rulings are committed as rfc/20260823-foundation-order-ruling.md.

What's Changed

• gauntlet: nightly verdicts by @lex00 in #367
• [gauntlet:corpus-autoscaling-complete/test_plan] IAM name_prefix bind fixed generically; three floci gaps fixed on a branch, two new walls found and filed (verdict still fail) by @lex00 in #386

Full Changelog: https://github.com/INTENTIUS/choudoufu/commits/v0.3.0

v0.2.0

choudoufu v0.2.0, built on OpenTofu 1.13.0 (fork point 03743ce6e8).

Everything outside live resource markers is stock OpenTofu 1.13.0. Binaries below are macOS and Linux, amd64 and arm64; verify with SHA256SUMS.

What's Changed

• Add choudoufu logo, wire it into the docs site, swap the tagline by @lex00 in #27
• Tagline: "Ownership on the resource." by @lex00 in #28
• docs: concrete install path now that tagged releases publish binaries by @lex00 in #30
• docs: fix LIMITATIONS drift, pin its derivable claims, surface both versions by @lex00 in #32
• release: embed the release tag so binaries identify themselves by @lex00 in #33
• docs: put the migration sequence where a new reader lands by @lex00 in #34

New Contributors

• @lex00 made their first contribution in #27

Full Changelog: v0.1.0...v0.2.0

v0.1.0

Full Changelog: https://github.com/INTENTIUS/choudoufu/commits/v0.1.0