version: "1.0.0" name: web-infra-plan description: Produce a sprint INFRA.md covering Terraform / gcloud changes — dry-run plan, IAM diff, cost estimate, rollback. Coordinator-only — does not apply infra changes. Pauses for user confirmation. Bias toward GCP+Terraform but works with Pulumi / CloudFormation / Serverless / CDK. disable-model-invocation: true

/magi:web-infra-plan — infra elaboration

You are the coordinator. Plan an infrastructure change and capture the analysis in magi/<num>-<slug>/INFRA.md. You never run `terraform apply`, `gcloud ... create`, or any other resource-mutating command. Read references/domain/web/infra.md before starting.

0. Preflight

PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-}"
[[ -z "$PLUGIN_ROOT" ]] && PLUGIN_ROOT="$(cd "$(dirname "$BASH_SOURCE[0]")/../.." 2>/dev/null && pwd)"
USER_CONFIG="$HOME/.config/magi-workflow/config.json"

If config missing → tell user to run /magi:setup.

0.5. State preflight (auto-refuse if not allowed)

STATE_JSON=$(bash "$PLUGIN_ROOT/scripts/shared/detect-state.sh")
blocked=$(jq -r '.disallowed_skills["web-infra-plan"] // empty' <<<"$STATE_JSON")
if [[ -n "$blocked" ]]; then
  reason=$(jq -r '.disallowed_skills["web-infra-plan"].reason' <<<"$STATE_JSON")
  suggest=$(jq -r '.disallowed_skills["web-infra-plan"].suggest' <<<"$STATE_JSON")
  echo "Cannot run /magi:web-infra-plan: $reason"
  echo "Suggested: $suggest"
  exit 1
fi

--force skips preflight (advanced/recovery only).

1. Locate sprint + IaC

Find the sprint folder (default: most recent; or --sprint <num>-<slug>).

Detect IaC tool per references/domain/web/infra.md "Discovery". Check:

• Is there a *.tf / terraform/ / pulumi.yaml / cloudformation/ etc.?
• For Terraform: where is the state? Workspace pattern? Tooling

(terragrunt, tflint, tfsec, checkov)?

If there is NO IaC and the user is asking for non-trivial cloud changes, push back: surface "no IaC = no reproducibility" as a 🔴 risk and recommend introducing a minimal Terraform setup before proceeding.

2. Read the existing spec

Read PLAN/SPEC.md to understand what infra change is implied. If the spec is silent on infra, ask the user to describe the intended change.

3. Generate the dry-run plan

Per references/domain/web/infra.md, run the appropriate dry-run:

Terraform

cd <terraform-dir>
terraform fmt -check -recursive
terraform validate
terraform plan -out=plan.tfplan -detailed-exitcode -input=false
plan_rc=$?     # 0=no changes, 2=changes, 1=error
[[ $plan_rc -eq 1 ]] && abort  # surface the error to the user
terraform show -no-color plan.tfplan > "$sprint_dir/plan.txt"
terraform show -json plan.tfplan > "$sprint_dir/plan.json"

gcloud (no Terraform)

For each gcloud command in the proposed change:

• Add --dry-run or --validate-only if supported.
• If not supported, mark it 🟡 in INFRA.md as "no dry-run available; review carefully before apply".

Pulumi

pulumi preview --diff --json > "$sprint_dir/preview.json"

CloudFormation

aws cloudformation create-change-set ... --change-set-type CREATE
aws cloudformation describe-change-set ... > "$sprint_dir/changeset.json"

If the dry-run cannot be run for any reason (no creds, no state lock, network), abort and tell the user — never make up a fake plan.

4. IAM diff

Build the IAM impact table (per reference). For each binding change, identify principal × resource × role-before × role-after.

Flag as 🔴 Critical anything in the reference's "elevated risks" list:

• roles/owner, roles/editor
• roles/iam.securityAdmin, roles/resourcemanager.projectIamAdmin
• allUsers / allAuthenticatedUsers
• Cross-project bindings without audit-logged SA
• Newly public bucket / firewall rule / Cloud Run service

5. Cost estimate

Pick the cheapest available tool:

# Preferred for Terraform projects:
infracost breakdown --path "$sprint_dir/plan.json" \
  --format table > "$sprint_dir/cost.txt" 2>&1 \
  || echo "infracost unavailable; falling back to manual estimate"

If infracost is missing, do a manual estimate using:

• Resource shape (machine type, region, storage class, retention).
• Public GCP / AWS / Azure pricing.
• Top 3 cost drivers.
• Cost-control levers.

State the methodology in INFRA.md so a reviewer can sanity-check.

6. Rollback plan

For every change, answer:

• Reversible? Can terraform destroy <addr> (or equivalent) restore

prior state without data loss?

• Backup needed first? For DB / GCS / KMS / IAM cascading changes:

yes, document the backup command.

• Blast radius: per-env vs cross-env vs whole project.
• Comm plan: who needs to know before / during / after apply.

For IRREVERSIBLE changes, INFRA.md must include a STOP-checklist the operator runs aloud before applying:

STOP — irreversible apply ahead.
Confirm:
  [ ] Backup taken: <command and verified output>
  [ ] Approver: <name>
  [ ] Rollback path documented and tested
  [ ] Off-hours window: <timestamp>

7. Write INFRA.md

Use the deliverable template from references/domain/web/infra.md. Fields:

• Summary
• Resource changes (link to plan.tfplan / plan.txt)
• IAM diff table
• Cost estimate
• Network & security baseline check (TLS, WAF, secrets, logs)
• Rollback plan (+ STOP checklist if applicable)
• Verification (post-apply smoke commands; drift detection cadence)
• Open questions

Use output_language for prose; keep CLI commands and resource names in English / canonical form.

8. Stop and hand off

Show the user:

• INFRA.md path
• Top 3 risks (especially any 🔴 IAM escalations)
• Cost delta summary
• Whether the change is reversible

Recommend next:

• If risks are 🔴: have user re-run /magi:review-plan so other models

also see the IAM diff.

• If clean: tell user the apply commands they should run themselves

(DO NOT run them).

• If something is missing for a clean apply (creds, backup), surface that.

Never run `terraform apply` or any mutating gcloud command.

Argument parsing

• --sprint <num>-<slug> — explicit sprint folder.
• --iac terraform|pulumi|cloudformation|gcloud — skip detection.
• --terraform-dir <path> — explicit terraform directory if not at sprint root.
• --no-cost — skip cost estimation (rare; usually wanted).
• --no-iam-diff — skip IAM diff (only for changes that don't touch IAM).

Conventions

• Plan, not apply — this skill never mutates state.
• Always dry-run first — even for "trivial" changes; the dry-run is the

artefact reviewers compare against the apply.

• Errors are blocking — terraform plan returning 1 = abort; do not

guess at the missing pieces.

• IAM is rarely "small" — even one role addition can be Critical.

Be paranoid by default.

• Cost methodology must be stated — an unattributed number is worse

than no number.