v0.3.0
choudoufu v0.3.0, built on OpenTofu 1.13.0 (fork point 03743ce6e8).
Everything outside live resource markers is stock OpenTofu 1.13.0. Binaries below are macOS, Linux and Windows, amd64 and arm64; macOS and Linux are .tar.gz, Windows is .zip; verify with SHA256SUMS.
Highlights
The gauntlet - real terraform-aws-modules and OpenTofu-native estates run side by side with stock against the pinned emulator - moved from 16/24 core estates clear at v0.2.0's close to 20 of 25 core clear (21 of 26 overall), with terraform-aws-modules/ec2-instance (the registry's most-downloaded module) newly added to the core set and clearing all five active stages. Snapshot: live/history/v0.3.0.json.
Record-primary identity (#364). Every managed instance now has one record: a single per-instance envelope (identity, the arguments the provider never echoes back, sensitivity, provisioner taint, managing provider), written by live-import and by every apply, and read FIRST on the next plan - verified against the ownership marker, with a stale record falling back loudly rather than binding wrong. A migrated estate no longer re-derives from configuration what its state file already said. terraform { live {} } alone implies a local record store, the way stock implies local state.
Schema-first identity (#387). Where the provider's own resource identity schema reproduces a hand-ratified table row (134 of 161 rows with a schema at aws 6.59.0), the schema now wins at runtime; live/rowgen-convergence.json carries the measurement.
The plan-node seam (#388), experimental. Behind CHOUDOUFU_NODE_RESOLVE=1, identity is resolved during the plan walk - record, then marker index, then the identity table over the instance's real evaluated values - which resolves configuration shapes the static pass must refuse. Off by default; the flag's open edges are tracked on the issue.
Strict toggles (#365). strict { secrets } now governs aws_iam_access_key/aws_iot_certificate (stored by default, the way stock stores them; refused under the toggle), and the new strict { no_source_create } picks refuse-or-create for an instance with no record, no marker, and no derivable identity (default: refuse).
Day-2 rename evidence (#357). The planned day2_rename stage passes on two estates: a moved block and choudoufu live-mv both rename with zero churn, the marker rewritten in place, stock's plan as the oracle.
Emulator. The pinned floci image is now built from the fork's own main (four merge rounds landed the previously-unmerged fix branches), and the pin (sha256:a9dc5342) adds EC2 launch-template/metadata, autoscaling-policy, CloudWatch-alarm, SSM public-AMI-parameter and RDS fixes. Remaining walls on the five not-yet-clear estates are all named and filed (lex00/floci#110/#112/#119/#120, choudoufu#392/#393).
Process. Every session now starts from bash scripts/pickup.sh; the foundation order and its rulings are committed as rfc/20260823-foundation-order-ruling.md.
What's Changed
- gauntlet: nightly verdicts by @lex00 in #367
- [gauntlet:corpus-autoscaling-complete/test_plan] IAM name_prefix bind fixed generically; three floci gaps fixed on a branch, two new walls found and filed (verdict still fail) by @lex00 in #386
Full Changelog: https://github.com/INTENTIUS/choudoufu/commits/v0.3.0
