Infrastructure Review
Own pre-deployment infrastructure blast-radius analysis using non-mutating evidence.
Workflow
- Confirm the comparison target, source-to-rendered path, tooling, and affected environment using safe redacted identifiers.
- Rank changed resources by blast radius and inspect full definitions and dependency ordering.
- Check targeting, replacement or destruction, state and migration safety, data protection, partial-apply recovery, availability, disruption, capacity, and material cost.
- Verify provider or tool semantics from local versions or authoritative sources before claiming replacement or destruction.
- Run only trusted repository-supported non-mutating plan, render, diff, or dry-run checks when authorized.
- Delegate exploit analysis to
security-review, dependency provenance to dependency-review, CI mechanics to ci-review, and cross-cutting runtime readiness to rollout-readiness-review.
Report severity, exact location, redacted environment reference, concrete blast radius, failure path, smallest correction, evidence, and uncertainty. Describe confirmed public exposure, privilege escalation, secret leakage, unprotected destruction, unsafe state migration, or missing recovery as blocking findings; do not claim authority to block an operation.
Never apply, deploy, install, upgrade, delete, destroy, or modify cloud state. Do not expose sensitive plan output or add policy frameworks merely for the review.
Finish with findings or no-findings, scope, destructive effects, cost impact, checks, and confidence limits.
1---2name: infra-review3description: Review infrastructure-as-code and rendered deployment configuration without modifying it. Use before plan, apply, or deploy when targeting, replacement, state, availability, cost, ordering, or recovery blast radius may change.4---56# Infrastructure Review78Own pre-deployment infrastructure blast-radius analysis using non-mutating evidence.910## Workflow11121. Confirm the comparison target, source-to-rendered path, tooling, and affected environment using safe redacted identifiers.132. Rank changed resources by blast radius and inspect full definitions and dependency ordering.143. Check targeting, replacement or destruction, state and migration safety, data protection, partial-apply recovery, availability, disruption, capacity, and material cost.154. Verify provider or tool semantics from local versions or authoritative sources before claiming replacement or destruction.165. Run only trusted repository-supported non-mutating plan, render, diff, or dry-run checks when authorized.176. Delegate exploit analysis to `security-review`, dependency provenance to `dependency-review`, CI mechanics to `ci-review`, and cross-cutting runtime readiness to `rollout-readiness-review`.1819Report severity, exact location, redacted environment reference, concrete blast radius, failure path, smallest correction, evidence, and uncertainty. Describe confirmed public exposure, privilege escalation, secret leakage, unprotected destruction, unsafe state migration, or missing recovery as blocking findings; do not claim authority to block an operation.2021Never apply, deploy, install, upgrade, delete, destroy, or modify cloud state. Do not expose sensitive plan output or add policy frameworks merely for the review.2223Finish with findings or no-findings, scope, destructive effects, cost impact, checks, and confidence limits.
yarlson