`maqpna infra`

Govern Terraform/OpenTofu changes: plan diff and blast-radius tier, policy, approval-gated apply

Govern-o json | yaml

Synopsis#

maqpna infra plan check PLAN.json [--policy FILE]... [--namespace NS] [--agent NAME] [--tiers FILE] [--values] [--fail-on deny|approval|never] [-o json]
maqpna infra apply [--gateway URL] [--session S] [--token-file F] [--wait 30m] [--poll 5s] [--heartbeat 10s] -- terraform|tofu [-chdir=DIR] apply [OPTIONS] PLANFILE

Description#

plan check reads the JSON of a saved plan (terraform show -json PLANFILE > plan.json; "-" reads stdin) and prints each resource change with the attribute paths it touches, the blast-radius tier (0 no change, 1 creates, 2 in-place updates, 3 replaces, deletes and identity/network/DNS/database types, 4 deletes of data-bearing resources or more than 50 changes) and the resources that drove it. Values are shown only with --values, and values the plan marks sensitive never are. With --policy it evaluates infra__apply (server maqpna-infra) against the ToolPolicies as the gateway would, including its default floor (tier 3 and above need approval). Exit code 3 when the decision is deny (or, with --fail-on approval, needs an approval).

apply runs a saved plan under the gateway's governance (gateway.json infra.enabled; token scope tools:maqpna-infra). The plan file is copied to a private directory and hashed; show -json and apply both run on the copy, so the plan that was approved is the plan that is applied. An approval is bound to the plan's SHA-256: re-planning needs a new one. The wrapper refuses an apply without a plan file, planning options (-target, -replace, -var, -destroy, ...) and other subcommands. While the apply runs it polls the gateway every --heartbeat; when the session is revoked (maqpna kill) it interrupts the apply (SIGINT: Terraform stops after the operations in flight). A gateway that cannot be reached blocks the apply before it starts; once started, an unreachable gateway is logged and the apply continues. Exit code 3 when the gateway denies or the kill switch interrupts; otherwise the exit code of the apply.

Gateway, session and token default to $MAQPNA_GATEWAY_URL, $MAQPNA_SESSION and $MAQPNA_TOKEN (or $MAQPNA_TOKEN_FILE).

Subcommands#

maqpna infra planCheck Terraform/OpenTofu plans: diff, blast-radius tier and policy decision maqpna infra applyRun terraform or tofu apply only once the gateway has approved that exact plan file

Examples#

# Check a saved plan offline (terraform show -json tfplan > plan.json): diff, tier, policy
$ maqpna infra plan check plan.json --values
$ maqpna infra plan check plan.json --policy policies/ --namespace team-a --agent sre-bot --fail-on approval

# Apply a saved plan once the gateway allows it (waits for an approval, honours the kill switch)
$ maqpna infra apply --session sre-1 --token-file .maqpna/token -- terraform apply tfplan
$ maqpna infra apply -- tofu -chdir=envs/prod apply -auto-approve tfplan

What happens when you run it#

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna infra