-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
505 lines (482 loc) · 38.9 KB
/
Copy pathindex.html
File metadata and controls
505 lines (482 loc) · 38.9 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Intentius</title>
<style>
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0;}
:root{
--bg:#0f1117;--surface:#1a1d27;--ink:#e6e8ee;--muted:#8b8fa3;--faint:#6a6f80;
--rule:#2a2d3a;--rule-strong:#3a3e4d;--link:#8aa4ff;--accent:#6c8cff;
--panel:#161923;--panel-2:#1a1d27;
--good:#57d6a0;--warn:#e2b558;--bad:#f27676;--na:#6a6f80;
}
html{-webkit-text-size-adjust:100%;}
body{background:radial-gradient(1100px 500px at 80% -10%,rgba(108,140,255,0.10),transparent 60%),var(--bg);color:var(--ink);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif;line-height:1.62;-webkit-font-smoothing:antialiased;}
main{max-width:60rem;margin:0 auto;padding:clamp(2.5rem,6vw,5rem) 1.5rem 4rem;}
a{color:var(--link);text-decoration:none;}
a:hover{text-decoration:underline;}
.hero{text-align:center;margin-bottom:3rem;}
.hero h1{font-size:clamp(2.6rem,7vw,4rem);font-weight:800;letter-spacing:-0.03em;}
.hero .tagline{color:var(--muted);font-size:1.3rem;margin:0.7rem auto 0;}
.hero .tagline a{color:var(--link);}
.hero-links{display:flex;gap:0.85rem;justify-content:center;flex-wrap:wrap;margin-top:1.8rem;}
.btn{display:inline-flex;align-items:center;gap:0.35rem;padding:0.58rem 1.15rem;border-radius:8px;border:1px solid var(--rule-strong);color:var(--ink);font-weight:600;font-size:0.95rem;background:var(--surface);transition:border-color .15s,background .15s;}
.btn:hover{text-decoration:none;border-color:var(--accent);background:#1e2130;}
.btn-primary{background:var(--accent);border-color:var(--accent);color:#0f1117;}
.btn-primary:hover{background:#8aa4ff;border-color:#8aa4ff;}
.pagefooter{margin-top:3rem;padding-top:1.4rem;border-top:1px solid var(--rule);text-align:center;color:var(--faint);font-size:0.9rem;}
.pagefooter a{color:var(--muted);}
/* ---- scorecard ---- */
.scorecard { margin: 1rem 0 0; }
.scorecard h2 { font-size: 0.92rem; letter-spacing: 0; margin: 0 0 0.6rem; }
.sc-bands {
display: grid; grid-template-columns: repeat(3, 1fr); gap: 1px; background: var(--rule);
border: 1px solid var(--rule); border-radius: 8px; overflow: hidden; margin: 0 0 0.9rem;
}
.sc-bands > div { background: var(--bg); padding: 0.45rem 0.6rem; }
.sc-bands h3 { margin: 0 0 0.15rem; font-size: 0.62rem; letter-spacing: 0.11em; text-transform: uppercase; color: var(--link); font-weight: 700; }
.sc-bands p { margin: 0; font-size: 0.69rem; color: var(--muted); line-height: 1.3; }
.sc-legend { display: flex; flex-wrap: wrap; gap: 0.4rem 1.3rem; align-items: baseline; margin: 0 0 1rem; font-size: 0.83rem; color: var(--muted); }
.sc-legend span { display: inline-flex; align-items: baseline; gap: 0.45rem; }
.sc-legend .sc-dot { font-weight: 700; width: 1em; text-align: center; }
.sc-legend .sc-hint { color: var(--faint); font-style: italic; }
.sc-dot.good { color: var(--good); } .sc-dot.warn { color: var(--warn); } .sc-dot.bad { color: var(--bad); } .sc-dot.na { color: var(--na); }
/* heatmap grid */
.sc-grid { margin: 0.2rem 0 0; overflow-x: auto; }
.sc-head, .sc-row > summary {
display: grid;
grid-template-columns: minmax(7.5rem, 1.6fr) repeat(7, minmax(0, 1fr));
align-items: center;
gap: 0.15rem;
min-width: 40rem;
}
.sc-bandhead { min-width: 40rem; }
.sc-fname { min-width: 0; }
.sc-open { color: var(--faint); font-size: 0.82em; margin-left: 0.25rem; text-decoration: none; font-weight: 700; white-space: nowrap; }
.sc-open:hover { color: var(--link); }
.sc-head { align-items: end; padding: 0 0 0.5rem; border-bottom: 2px solid var(--rule-strong); }
.sc-head .sc-tool { font-size: 0.66rem; font-weight: 700; color: var(--ink); text-align: center; line-height: 1.2; padding: 0 0.1rem; }
.sc-bandhead {
margin: 1rem 0 0; padding: 0.45rem 0 0.3rem;
font-size: 0.68rem; letter-spacing: 0.11em; text-transform: uppercase; color: var(--link); font-weight: 700;
}
.sc-row { border-top: 1px solid var(--rule); }
.sc-row > summary { list-style: none; cursor: pointer; padding: 0.5rem 0; }
.sc-row > summary::-webkit-details-marker { display: none; }
.sc-row > summary::marker { content: ""; }
.sc-row > summary:hover { background: var(--panel); }
.sc-row[open] { box-shadow: inset 3px 0 0 var(--link); }
.sc-row[open] > summary { background: var(--panel-2); }
.sc-factor { display: grid; grid-template-columns: auto 1fr; column-gap: 0.4rem; align-items: baseline; font-size: 0.85rem; font-weight: 600; color: var(--ink); line-height: 1.25; padding-right: 0.5rem; }
.sc-factor b { color: var(--link); font-weight: 700; font-variant-numeric: tabular-nums; white-space: nowrap; }
.sc-factor b::before {
content: ""; display: inline-block; width: 0; height: 0;
border-left: 5px solid var(--faint);
border-top: 4px solid transparent; border-bottom: 4px solid transparent;
margin-right: 0.4rem; vertical-align: middle; transition: transform 0.15s ease;
}
.sc-row[open] .sc-factor b::before { transform: rotate(90deg); border-left-color: var(--link); }
@media (prefers-reduced-motion: reduce) { .sc-factor b::before { transition: none; } }
.sc-cell { text-align: center; font-weight: 700; font-family: ui-monospace, Menlo, monospace; font-size: 1rem; }
.sc-cell.good { color: var(--good); }
.sc-cell.warn { color: var(--warn); }
.sc-cell.bad { color: var(--bad); }
.sc-cell.na { color: var(--na); }
.sc-detail { margin: 0.4rem 0 0.7rem 0.9rem; padding: 0.55rem 0.85rem; background: var(--bg); border: 1px solid var(--rule); border-radius: 6px; display: grid; gap: 0.3rem; }
.sc-detail p { margin: 0; font-size: 0.82rem; color: var(--muted); line-height: 1.4; }
.sc-detail p:not(.sc-statement) { display: grid; grid-template-columns: 9.5rem 1fr; column-gap: 0.5rem; }
.sc-detail b { color: var(--ink); font-weight: 600; }
.sc-detail .sc-statement { margin: 0 0 0.6rem; padding: 0 0 0.55rem; border-bottom: 1px solid var(--rule); font-size: 0.9rem; line-height: 1.4; }
.sc-detail .sc-statement a { color: var(--ink); font-weight: 600; }
.sc-detail .sc-statement a:hover { color: var(--link); }
.sc-detail .sc-statement .sc-readmore { color: var(--link); font-weight: 700; font-size: 0.82em; white-space: nowrap; }
.scorecard .mono { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: 0.92em; }
.sc-closing { margin: 1.8rem 0 0; padding: 1.1rem 1.25rem; background: var(--panel); border: 1px solid var(--rule); border-radius: 8px; }
.sc-closing p { margin: 0; color: var(--muted); font-size: 0.94rem; }
.sc-closing p + p { margin-top: 0.65rem; }
.sc-closing .term { color: var(--ink); font-weight: 600; }
.sc-notes { margin: 1.8rem 0 0; }
.sc-notes h4 { font-size: 0.68rem; letter-spacing: 0.13em; text-transform: uppercase; color: var(--faint); margin: 0 0 0.6rem; font-weight: 700; }
.sc-notes ol { margin: 0; padding-left: 1.2rem; display: grid; gap: 0.45rem; }
.sc-notes li { font-size: 0.83rem; color: var(--muted); line-height: 1.5; }
.sc-notes b { color: var(--ink); font-weight: 600; }
</style>
</head>
<body>
<main>
<header class="hero">
<h1>Intentius</h1>
<p class="tagline">We do <a href="https://accessibleops.net/">accessible ops</a>.</p>
<div class="hero-links">
<a class="btn btn-primary" href="/chant/">chant →</a>
<a class="btn" href="/chant-bench/">chant-bench →</a>
<a class="btn" href="https://github.com/orgs/intentius/repositories">GitHub org →</a>
</div>
</header>
<section class="scorecard" aria-label="Scorecard">
<div class="sc-bands">
<div><h3>Synthesis</h3><p>Source becomes the platform's own spec, settled before anything runs.</p></div>
<div><h3>Ops & Lifecycle</h3><p>A change reaches production as one reviewable diff and stays accountable.</p></div>
<div><h3>Truth & trust</h3><p>Truth stays live, adoption stays in place, and the artifact is verified.</p></div>
</div>
<div class="sc-legend" role="note" aria-label="Legend">
<span><b class="sc-dot good">●</b> meets by design</span>
<span><b class="sc-dot warn">◐</b> partial, via add-ons or by hand</span>
<span><b class="sc-dot bad">✗</b> misses</span>
<span><b class="sc-dot na">–</b> out of scope</span>
<span class="sc-hint">Open a row for the detail, or follow ↗ to the full property</span>
</div>
<div class="sc-grid">
<div class="sc-head">
<span></span>
<span class="sc-tool">chant</span>
<span class="sc-tool">KCL / CUE / Pkl</span>
<span class="sc-tool">Formae</span>
<span class="sc-tool">ConfigHub</span>
<span class="sc-tool">CDK</span>
<span class="sc-tool">Pulumi</span>
<span class="sc-tool">Terraform / OpenTofu</span>
</div>
<p class="sc-bandhead">Synthesis</p>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>I</b><span class="sc-fname">Honor the lower layer <a class="sc-open" href="https://accessibleops.net/honor-the-lower-layer/" aria-label="Full text for Honor the lower layer">↗</a></span></span>
<span class="sc-cell good" title="chant: Fold to native spec, no run">●</span>
<span class="sc-cell good" title="KCL/CUE/Pkl: Folds via its own DSL">●</span>
<span class="sc-cell good" title="Formae: Folds via Pkl; source is the truth">●</span>
<span class="sc-cell good" title="ConfigHub: Holds the real spec (KRM) as data">●</span>
<span class="sc-cell warn" title="CDK: Synthesizes a reviewable native template (CFN, or K8s via cdk8s), and a lookup can shift the output when it runs">◐</span>
<span class="sc-cell bad" title="Pulumi: runs the program; no static declarative spec, only an engine preview/plan">✗</span>
<span class="sc-cell warn" title="Terraform: Declarative, but the real plan needs cloud + state">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/honor-the-lower-layer/">Build in the platform's own terms, and keep its spec readable and predictable before anything runs. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Fold to native spec, no run</p>
<p><b>KCL / CUE / Pkl</b> Folds via its own DSL</p>
<p><b>Formae</b> Folds via Pkl; source is the truth</p>
<p><b>ConfigHub</b> Holds the real spec (KRM) as data</p>
<p><b>CDK</b> Synthesizes a reviewable native template (CloudFormation, or K8s via cdk8s), and a context lookup can shift the output when the program runs</p>
<p><b>Pulumi</b> Runs the program through its own engine; no static declarative spec, only an engine preview or plan</p>
<p><b>Terraform / OpenTofu</b> Declarative, but the real plan needs cloud and state</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>II</b><span class="sc-fname">The same check, left of the commit <a class="sc-open" href="https://accessibleops.net/correctness-left-of-the-commit/" aria-label="Full text for The same check, left of the commit">↗</a></span></span>
<span class="sc-cell good" title="chant: Type + fold diagnostics at the keystroke">●</span>
<span class="sc-cell good" title="KCL/CUE/Pkl: Schema check plus an LSP">●</span>
<span class="sc-cell good" title="Formae: Pkl types + LSP">●</span>
<span class="sc-cell warn" title="ConfigHub: Validated in the store, not at an editor keystroke">◐</span>
<span class="sc-cell warn" title="CDK: TS types check; infra correctness needs synth and a plan">◐</span>
<span class="sc-cell warn" title="Pulumi: TS types check; infra correctness needs a preview">◐</span>
<span class="sc-cell warn" title="Terraform: validate is shallow; the real check is plan">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/correctness-left-of-the-commit/">A change proves itself at the keystroke, the same check for a human and an agent. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Type and fold diagnostics at the keystroke, human and agent alike</p>
<p><b>KCL / CUE / Pkl</b> Schema check plus an LSP</p>
<p><b>Formae</b> Pkl types plus an LSP</p>
<p><b>ConfigHub</b> Validated in the store, not at an editor keystroke</p>
<p><b>CDK</b> TS types check, but infra correctness needs a synth and a plan</p>
<p><b>Pulumi</b> TS types check, but infra correctness needs a preview</p>
<p><b>Terraform / OpenTofu</b> <span class="mono">validate</span> is shallow; the real check is <span class="mono">plan</span></p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>III</b><span class="sc-fname">Documentation is Law <a class="sc-open" href="https://accessibleops.net/documentation-is-law/" aria-label="Full text for Documentation is Law">↗</a></span></span>
<span class="sc-cell good" title="chant: Typed lexicons + semantic lint + policy checks">●</span>
<span class="sc-cell good" title="KCL/CUE/Pkl: Schemas and constraints encode validity">●</span>
<span class="sc-cell good" title="Formae: Pkl schemas and value constraints">●</span>
<span class="sc-cell good" title="ConfigHub: KRM schemas encode validity">●</span>
<span class="sc-cell warn" title="CDK: L2 constructs and cdk-nag encode a lot of validity, deeper policy is an add-on">◐</span>
<span class="sc-cell warn" title="Pulumi: Types encode shape; policy via CrossGuard">◐</span>
<span class="sc-cell warn" title="Terraform: Thin types; policy via OPA or Sentinel">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/documentation-is-law/">The parts a machine can't infer belong in writing. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Typed lexicons, semantic lint, and policy checks</p>
<p><b>KCL / CUE / Pkl</b> Schemas and constraints encode validity</p>
<p><b>Formae</b> Pkl schemas and value constraints</p>
<p><b>ConfigHub</b> KRM schemas encode validity</p>
<p><b>CDK</b> L2 constructs and cdk-nag encode a lot of validity, and deeper policy is an add-on</p>
<p><b>Pulumi</b> Types encode shape; policy via CrossGuard</p>
<p><b>Terraform / OpenTofu</b> Thin types; policy via OPA or Sentinel</p>
</div>
</details>
<p class="sc-bandhead">Ops & Lifecycle</p>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>IV</b><span class="sc-fname">One path to prod <a class="sc-open" href="https://accessibleops.net/one-path-to-prod/" aria-label="Full text for One path to prod">↗</a></span></span>
<span class="sc-cell good" title="chant: Every change is one typed change set against live">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Language only; bring your own pipeline">–</span>
<span class="sc-cell good" title="Formae: Reconciles Pkl source to the cloud">●</span>
<span class="sc-cell good" title="ConfigHub: Actuates from the store via ArgoCD / Crossplane">●</span>
<span class="sc-cell good" title="CDK: Deploy through cdk deploy">●</span>
<span class="sc-cell good" title="Pulumi: Deploy through pulumi up">●</span>
<span class="sc-cell good" title="Terraform: plan / apply">●</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/one-path-to-prod/">Every change arrives as a diff, in one place. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Every change is one typed change set against live</p>
<p><b>KCL / CUE / Pkl</b> Language only; bring your own pipeline</p>
<p><b>Formae</b> Reconciles Pkl source to the cloud</p>
<p><b>ConfigHub</b> Actuates from the store via ArgoCD or Crossplane</p>
<p><b>CDK</b> Deploy through <span class="mono">cdk deploy</span></p>
<p><b>Pulumi</b> Deploy through <span class="mono">pulumi up</span></p>
<p><b>Terraform / OpenTofu</b> <span class="mono">plan</span> and <span class="mono">apply</span></p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>V</b><span class="sc-fname">Named secrets, least privilege <a class="sc-open" href="https://accessibleops.net/named-secrets-least-privilege/" aria-label="Full text for Named secrets, least privilege">↗</a></span></span>
<span class="sc-cell good" title="chant: By reference, never held; keyless signing">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Out of scope">–</span>
<span class="sc-cell warn" title="Formae: By reference, but an agent datastore sits in the loop">◐</span>
<span class="sc-cell warn" title="ConfigHub: Never holds secrets, but scoping rides the worker creds you supply">◐</span>
<span class="sc-cell warn" title="CDK: Refs + IAM, but the program can read secrets at runtime">◐</span>
<span class="sc-cell warn" title="Pulumi: ESC refs with OIDC, but core stores secrets in state">◐</span>
<span class="sc-cell warn" title="Terraform: refs, but state can capture secrets; OpenTofu encrypts state at rest">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/named-secrets-least-privilege/">Access stays scoped and revocable, and secrets are referenced by name rather than held. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> By reference, never held, with keyless signing</p>
<p><b>KCL / CUE / Pkl</b> Out of scope</p>
<p><b>Formae</b> By reference, but an agent datastore sits in the loop</p>
<p><b>ConfigHub</b> Never holds secrets, but least privilege rides the worker credentials you supply</p>
<p><b>CDK</b> Refs and IAM, but the program can read secrets at runtime</p>
<p><b>Pulumi</b> ESC gives references with short-lived OIDC, but core stores secrets encrypted in state</p>
<p><b>Terraform / OpenTofu</b> Refs, but the state file can capture secrets; OpenTofu encrypts state at rest</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>VI</b><span class="sc-fname">Bounded blast radius <a class="sc-open" href="https://accessibleops.net/bounded-blast-radius/" aria-label="Full text for Bounded blast radius">↗</a></span></span>
<span class="sc-cell good" title="chant: Owned-only by marker; per-env removal cap; blast-radius graph view">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Out of scope">–</span>
<span class="sc-cell warn" title="Formae: Reconcile scope; an agent datastore in the loop">◐</span>
<span class="sc-cell warn" title="ConfigHub: Actuator-scoped; ownership from live markers">◐</span>
<span class="sc-cell warn" title="CDK: Stack + IAM boundaries; refs can widen reach">◐</span>
<span class="sc-cell warn" title="Pulumi: Stack + IAM boundaries; refs can widen reach">◐</span>
<span class="sc-cell warn" title="Terraform: Module boundaries; shared state couples them">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/bounded-blast-radius/">One mistake can't take down everything. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Owned-only by marker, a per-environment removal cap, and a blast-radius graph view</p>
<p><b>KCL / CUE / Pkl</b> Out of scope</p>
<p><b>Formae</b> Reconcile scope, with an agent datastore in the loop</p>
<p><b>ConfigHub</b> Actuator-scoped, ownership from live markers</p>
<p><b>CDK</b> Stack and IAM boundaries, but refs can widen reach</p>
<p><b>Pulumi</b> Stack and IAM boundaries, but refs can widen reach</p>
<p><b>Terraform / OpenTofu</b> Module boundaries, but shared state couples them</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>VII</b><span class="sc-fname">Reversible before risky <a class="sc-open" href="https://accessibleops.net/reversible-before-risky/" aria-label="Full text for Reversible before risky">↗</a></span></span>
<span class="sc-cell good" title="chant: Reversible runs ungated; destructive gated + saga rollback">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Out of scope">–</span>
<span class="sc-cell warn" title="Formae: Reconciles drift; no reversible / irreversible split">◐</span>
<span class="sc-cell warn" title="ConfigHub: Revert the store record; no reversible / irreversible split">◐</span>
<span class="sc-cell warn" title="CDK: CloudFormation auto-rollback and cdk rollback recover a failed deploy, no gate on an irreversible one">◐</span>
<span class="sc-cell warn" title="Pulumi: No auto-rollback; re-apply a prior state">◐</span>
<span class="sc-cell warn" title="Terraform: No rollback; re-apply a prior state by hand">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/reversible-before-risky/">Actions that can be undone run on their own, and the ones that cannot wait for a human. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Reversible runs ungated; a destructive one is gated with saga rollback</p>
<p><b>KCL / CUE / Pkl</b> Out of scope</p>
<p><b>Formae</b> Reconciles drift, with no reversible or irreversible split</p>
<p><b>ConfigHub</b> Revert the store record, with no reversible or irreversible split</p>
<p><b>CDK</b> CloudFormation auto-rollback and <span class="mono">cdk rollback</span> recover a failed deploy, though an irreversible change is not gated</p>
<p><b>Pulumi</b> No auto-rollback; you re-apply a prior state</p>
<p><b>Terraform / OpenTofu</b> No rollback; you re-apply a prior state by hand</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>VIII</b><span class="sc-fname">Escalate the judgment <a class="sc-open" href="https://accessibleops.net/escalate-the-judgment/" aria-label="Full text for Escalate the judgment">↗</a></span></span>
<span class="sc-cell good" title="chant: Durable approval gate that survives a crash">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Out of scope">–</span>
<span class="sc-cell warn" title="Formae: native drift approve/reject; broader approval rides the pipeline">◐</span>
<span class="sc-cell good" title="ConfigHub: Apply Gates and approvals before a change touches a cluster">●</span>
<span class="sc-cell warn" title="CDK: Approval in the CI pipeline, not the tool">◐</span>
<span class="sc-cell warn" title="Pulumi: Approval via Pulumi Deployments (add-on)">◐</span>
<span class="sc-cell warn" title="Terraform: apply confirmation is built-in; role-separated approval needs HCP (paid)">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/escalate-the-judgment/">The newcomer executes, and a human owns the call that matters. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> A durable approval gate that survives a crash</p>
<p><b>KCL / CUE / Pkl</b> Out of scope</p>
<p><b>Formae</b> Native drift approve or reject; broader approval rides the pipeline</p>
<p><b>ConfigHub</b> Apply Gates and named approvals before a change touches a cluster, in the tool</p>
<p><b>CDK</b> Approval in the CI pipeline, not the tool</p>
<p><b>Pulumi</b> Approval via Pulumi Deployments, a Cloud add-on</p>
<p><b>Terraform / OpenTofu</b> Apply confirmation is built-in; role-separated approval needs HCP, a paid add-on</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>IX</b><span class="sc-fname">Attributable <a class="sc-open" href="https://accessibleops.net/attributable/" aria-label="Full text for Attributable">↗</a></span></span>
<span class="sc-cell good" title="chant: Append-only release ledger + approval in workflow history">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Out of scope">–</span>
<span class="sc-cell warn" title="Formae: Pkl in git, plus the reconcile datastore">◐</span>
<span class="sc-cell good" title="ConfigHub: Each revision records who changed what and who approved">●</span>
<span class="sc-cell warn" title="CDK: CloudTrail / pipeline logs, outside the tool">◐</span>
<span class="sc-cell warn" title="Pulumi: Pulumi Cloud records who applied by default; the approver needs Deployments">◐</span>
<span class="sc-cell warn" title="Terraform: State history / CI logs, outside the tool">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/attributable/">Every change traces to who made it and who approved it. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> An append-only release ledger, with approval in the workflow history</p>
<p><b>KCL / CUE / Pkl</b> Out of scope</p>
<p><b>Formae</b> Pkl in git, plus the reconcile datastore</p>
<p><b>ConfigHub</b> Each revision records who changed what and who approved, in the tool</p>
<p><b>CDK</b> CloudTrail or pipeline logs, outside the tool</p>
<p><b>Pulumi</b> Pulumi Cloud records who applied by default; the approver needs Deployments, an add-on</p>
<p><b>Terraform / OpenTofu</b> State history or CI logs, outside the tool</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>X</b><span class="sc-fname">Secret rotation is cheap <a class="sc-open" href="https://accessibleops.net/secret-rotation-is-cheap/" aria-label="Full text for Secret rotation is cheap">↗</a></span></span>
<span class="sc-cell good" title="chant: By-reference makes rotation an out-of-band routine change">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Out of scope">–</span>
<span class="sc-cell warn" title="Formae: By reference; the datastore can hold the value">◐</span>
<span class="sc-cell warn" title="ConfigHub: By reference; secrets stay external to the store">◐</span>
<span class="sc-cell warn" title="CDK: Runtime reads or state can pin the value">◐</span>
<span class="sc-cell warn" title="Pulumi: ESC helps, but core state can pin the value">◐</span>
<span class="sc-cell warn" title="Terraform: A state-captured secret needs state surgery">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/secret-rotation-is-cheap/">Any credential can be rotated as a routine change, from what's written down. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> By-reference makes rotation an out-of-band routine change</p>
<p><b>KCL / CUE / Pkl</b> Out of scope</p>
<p><b>Formae</b> By reference, but the datastore can hold the value</p>
<p><b>ConfigHub</b> By reference; secrets stay external to the store</p>
<p><b>CDK</b> Runtime reads or state can pin the value</p>
<p><b>Pulumi</b> ESC helps, but core state can pin the value</p>
<p><b>Terraform / OpenTofu</b> A state-captured secret needs state surgery</p>
</div>
</details>
<p class="sc-bandhead">Truth & trust</p>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>XI</b><span class="sc-fname">The live system is the truth <a class="sc-open" href="https://accessibleops.net/truth-lives-live/" aria-label="Full text for The live system is the truth">↗</a></span></span>
<span class="sc-cell good" title="chant: Truth left in the live system; no state store">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: Language only; no state model">–</span>
<span class="sc-cell bad" title="Formae: Requires an authoritative agent datastore (SQLite/Postgres/Aurora)">✗</span>
<span class="sc-cell bad" title="ConfigHub: Authoring surface, source of truth, and control plane in one store">✗</span>
<span class="sc-cell good" title="CDK: no tool-side state copy. cdk8s is stateless, and AWS CDK's stack state is CloudFormation's own record, not a copy the tool keeps">●</span>
<span class="sc-cell bad" title="Pulumi: Keeps its own authoritative state, any backend">✗</span>
<span class="sc-cell bad" title="Terraform: The state file is the authority">✗</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/truth-lives-live/">Truth lives in the running system, never a separate store you host. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Truth left in the live system, with no state store</p>
<p><b>KCL / CUE / Pkl</b> Language only, no state model<sup>4</sup></p>
<p><b>Formae</b> Requires an authoritative agent datastore (SQLite, Postgres, or Aurora)</p>
<p><b>ConfigHub</b> Authoring surface, source of truth, and control plane collapsed into one store</p>
<p><b>CDK</b> No tool-side state copy: cdk8s emits stateless manifests you can GitOps, and AWS CDK's stack state is CloudFormation's own record of what AWS runs, not a copy the tool keeps</p>
<p><b>Pulumi</b> Keeps its own authoritative state, whatever the backend</p>
<p><b>Terraform / OpenTofu</b> The state file is the authority<sup>5</sup></p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>XII</b><span class="sc-fname">Adopt in place <a class="sc-open" href="https://accessibleops.net/adopt-in-place/" aria-label="Full text for Adopt in place">↗</a></span></span>
<span class="sc-cell good" title="chant: Imports a template or live estate; the spec stays native">●</span>
<span class="sc-cell warn" title="KCL/CUE/Pkl: Importers bootstrap from OpenAPI / CRD / Terraform, but authoring moves to the DSL">◐</span>
<span class="sc-cell warn" title="Formae: Reconciles an existing estate into Pkl">◐</span>
<span class="sc-cell warn" title="ConfigHub: Imports into the store; leaving means exporting">◐</span>
<span class="sc-cell warn" title="CDK: cdk import, then rewrite as code">◐</span>
<span class="sc-cell warn" title="Pulumi: pulumi import, then rewrite as code">◐</span>
<span class="sc-cell warn" title="Terraform: config-driven import blocks preview it; you still author the HCL">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/adopt-in-place/">Existing infrastructure comes under management in place, without conversion to a private format. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Imports a template or live estate; the spec stays native</p>
<p><b>KCL / CUE / Pkl</b> Importers bootstrap from OpenAPI, CRDs, or Terraform, but authoring moves to the DSL</p>
<p><b>Formae</b> Reconciles an existing estate into Pkl</p>
<p><b>ConfigHub</b> Imports into the store; leaving means exporting</p>
<p><b>CDK</b> <span class="mono">cdk import</span>, then rewrite as code</p>
<p><b>Pulumi</b> <span class="mono">pulumi import</span>, then rewrite as code</p>
<p><b>Terraform / OpenTofu</b> Config-driven import blocks preview the import; you still author the HCL</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>XIII</b><span class="sc-fname">Manage only what you declare <a class="sc-open" href="https://accessibleops.net/manage-only-what-you-declare/" aria-label="Full text for Manage only what you declare">↗</a></span></span>
<span class="sc-cell good" title="chant: Selective by omission; deletes gated on an ownership marker">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: No apply; nothing to over-reach">–</span>
<span class="sc-cell warn" title="Formae: Reconciles the declared; ownership less explicit">◐</span>
<span class="sc-cell good" title="ConfigHub: Ownership from live markers, not the store">●</span>
<span class="sc-cell warn" title="CDK: Stack-scoped; absence in the template deletes">◐</span>
<span class="sc-cell warn" title="Pulumi: Stack-scoped; absence in the program deletes">◐</span>
<span class="sc-cell warn" title="Terraform: Omission deletes by default; removed / prevent_destroy are opt-in guards">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/manage-only-what-you-declare/">The tool touches only what you declare and deletes only what it owns. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> Selective by omission; deletes gated on an ownership marker</p>
<p><b>KCL / CUE / Pkl</b> No apply, so nothing to over-reach</p>
<p><b>Formae</b> Reconciles the declared, with ownership less explicit</p>
<p><b>ConfigHub</b> Ownership from live markers, not the store</p>
<p><b>CDK</b> Stack-scoped, but absence in the template deletes</p>
<p><b>Pulumi</b> Stack-scoped, but absence in the program deletes</p>
<p><b>Terraform / OpenTofu</b> Omission deletes by default; <span class="mono">removed</span> and <span class="mono">prevent_destroy</span> are opt-in guards, not the design</p>
</div>
</details>
<details class="sc-row">
<summary>
<span class="sc-factor"><b>XIV</b><span class="sc-fname">Verify the artifact <a class="sc-open" href="https://accessibleops.net/verify-the-artifact/" aria-label="Full text for Verify the artifact">↗</a></span></span>
<span class="sc-cell good" title="chant: SBOM, provenance, and a signature built at synthesis, verified at the deploy gate">●</span>
<span class="sc-cell na" title="KCL/CUE/Pkl: No build artifact or gate">–</span>
<span class="sc-cell warn" title="Formae: Provenance via external tooling">◐</span>
<span class="sc-cell warn" title="ConfigHub: Provenance via external tooling">◐</span>
<span class="sc-cell warn" title="CDK: Provenance via CI add-ons (cosign, SLSA)">◐</span>
<span class="sc-cell warn" title="Pulumi: Provenance via CI add-ons (cosign, SLSA)">◐</span>
<span class="sc-cell warn" title="Terraform: Provenance via CI add-ons">◐</span>
</summary>
<div class="sc-detail">
<p class="sc-statement"><a href="https://accessibleops.net/verify-the-artifact/">A deployable proves itself before it ships, verified where it is built. <span class="sc-readmore">Read the full property →</span></a></p>
<p><b>chant</b> SBOM, provenance, and a signature built at synthesis, verified at the deploy gate</p>
<p><b>KCL / CUE / Pkl</b> No build artifact or gate</p>
<p><b>Formae</b> Provenance via external tooling</p>
<p><b>ConfigHub</b> Provenance via external tooling</p>
<p><b>CDK</b> Provenance via CI add-ons like cosign or SLSA</p>
<p><b>Pulumi</b> Provenance via CI add-ons like cosign or SLSA</p>
<p><b>Terraform / OpenTofu</b> Provenance via CI add-ons</p>
</div>
</details>
</div>
<div class="sc-closing">
<p>Read down a column and the shape is a division of labor, not a ranking. The <span class="term">config languages</span> clear synthesis and stop there, so the ops and lifecycle band is out of scope and you assemble it yourself. <span class="term">Formae</span> reconciles Pkl source to the cloud, and <span class="term">ConfigHub</span> holds the spec as data and actuates from a store, with real approval and audit built in. Both read ownership from live markers, and both keep an authoritative datastore. <span class="term">CDK</span> synthesizes a native template, reviewable but produced by running; <span class="term">Pulumi</span> applies through its own engine with no native artifact to keep. <span class="term">Terraform and OpenTofu</span> operate through a state file, and their real check is a cloud plan that lands after the commit.</p>
<p>chant reaches every row because it folds source to the native spec <span class="term">by construction</span>, then carries that same change set through approval, rollback, and a record, with no authoritative state store to keep. It got there first, and nothing here is chant's to keep.</p>
</div>
<div class="sc-notes">
<h4>Notes</h4>
<ol>
<li><b>Scoping and revocation are provider-native</b> (OIDC expiry, IAM). A tool's part is to reference a secret by name and never hold it, and to flag over-broad permissions at author time.</li>
<li><b>Rotation is cheap as a consequence, not a command.</b> When a secret enters only by reference and never lands in source or state, rotating the underlying credential is an out-of-band change the source never sees.</li>
<li><b>“Folds by construction”</b> means synthesis reduces the source to spec with no module execution, so a call-as-value is structurally unrepresentable and the semantic lint is a pre-flight diagnostic rather than the guarantee.</li>
<li>The config languages are rated as languages. A platform built on one, like Kusion over KCL, adds an apply path but keeps an authoritative state store, landing where the runtime tools do on property XI.</li>
<li>Property XI is about a separate authoritative record of live state, a state file, checkpoint, store, or datastore. The declared source in git is an input every tool has, so it does not count against a tool.</li>
</ol>
</div>
</section>
<script>
document.querySelectorAll('.sc-open').forEach(function (a) {
a.addEventListener('click', function (e) { e.stopPropagation(); });
});
</script>
<footer class="pagefooter">
More from Intentius · <a href="https://blacklight.intentius.io">blacklight</a> · <a href="https://spicypath.intentius.workers.dev">spicypath</a> · <a href="https://github.com/intentius">github.com/intentius</a>
</footer>
</main>
<script>
document.querySelectorAll('.sc-open').forEach(function(a){a.addEventListener('click',function(e){e.stopPropagation();});});
</script>
</body>
</html>