civiltekk-opentofu-skill

Consolidates opentofu-provider-setup-skill + opentofu-provisioning-workflow-skill

• opentofu-aws-explorer-skill + opentofu-kubernetes-explorer-skill +
  opentofu-neon-explorer-skill + opentofu-keycloak-explorer-skill +
  opentofu-ecr-provision-skill (#604). Alias: formerly those seven skills.

What I do

OpenTofu/Terraform infrastructure as code across five routes — provider
bootstrap, provisioning workflow, per-platform resource exploration, ECR
provisioning, and shared-module organization. OpenTofu/Terraform are interchangeable (OpenTofu is
provider-compatible); house commands use tofu.

1. Detect the route (§Routes) — explicit > inferred > ask-once.
   Explicit: the request names the activity ("set up providers", "state
   backend" → first-time-setup; "plan and apply", "update infrastructure",
   "state drift" → plan-apply; "AWS/Kubernetes/Neon/Keycloak resources"
   → explore; "ECR repo", "GitHub OIDC" → ecr-provision; "shared
   module", "split the module", "provision once", "which module owns X" →
   shared-infra-split). Inferred:
   the artifact shape (a bootstrap versions.tf → first-time-setup; a
   reviewed change → plan-apply; platform resource work → explore;
   container registry + CI → ecr-provision; a singleton resource
   claimed by multiple env stacks → shared-infra-split). Ambiguous →
   ask once per run, then proceed on the answer.
2. Load the route's reference file (§Side files) and apply its pins,
   conventions, and rules — do not improvise provider versions or backend
   shapes.
3. Follow the route's workflow discipline — canonical commands in
   references/workflow.md apply to every route; route-specific workflows
   live in the reference files.

Route chain (stated once)

first-time-setup precedes everything — provider authentication and the
remote state backend must exist before any plan-apply, explore, or
ecr-provision work. The former per-skill prerequisite chain
("Complete opentofu-provider-setup-skill first") is this internal ordering:
when a request assumes infrastructure that has not been bootstrapped, run
first-time-setup (or verify its outputs) first. ecr-provision and every
explore platform additionally flow through plan-apply discipline for any
change they make.

Routes

Side files (load rules)

Side files carry VALUES only; this file carries the METHOD — route
detection, the chain, and the workflow discipline pointer.

Boundaries

• AWS IaC safety review (pre-apply blast radius, destructive-change triage)
  is aws-iac-safety-skill's space — this skill provisions; that skill
  audits.
• Container image building and composition is
  docker-containerization-skill's space; ecr-provision only creates the
  registry + CI trust.
• Provider schemas and per-resource HCL are model knowledge — side files
  carry house pins and conventions only; do not expect full resource
  walkthroughs.
• opentofu-explorer-subagent is the agent that runs this skill by route
  (delegated IaC work keeps tofu output out of the primary context).

Agent behavior rules

• Never bare tofu apply — always plan -out then apply tfplan
  (full rule in references/workflow.md).
• Ask once on ambiguity — then proceed; headless/CI: no asks, read the
  route from the delegation prompt and use the documented default.
• Verify before success — a change is successful only after tofu apply of the reviewed plan and tofu state list shows the expected
  resources.
• tofu CLI commands need bash (git-bash/WSL on Windows).

Return Contract

**Status:** [success | partial | failed]
**Output:** [resources/modules changed + route used — one line]
**Summary:** [2–3 sentences max]
**Issues:** [blockers, warnings, uninspected consumers, or "None"]