{
  "provider": "terraform",
  "domains": {
    "engine-compatibility": {
      "keywords": [
        "upgrade",
        "version",
        "compatibility",
        "migration",
        "deprecated",
        "breaking change",
        "provider major",
        "core version",
        "fork",
        "engine choice",
        "version lag",
        "engine",
        "versus-OpenTofu"
      ],
      "agent": "terraform-engine-compatibility-agent"
    },
    "estate-reconciliation": {
      "keywords": [
        "drift",
        "import",
        "brownfield",
        "moved",
        "removed",
        "refresh",
        "adopt",
        "unmanaged",
        "generate-config-out",
        "refactor",
        "rename",
        "reconcile",
        "clickops",
        "estate",
        "reconciliation"
      ],
      "agent": "terraform-estate-reconciliation-agent"
    },
    "execution-governance": {
      "keywords": [
        "pipeline",
        "ci",
        "runner",
        "oidc",
        "credentials",
        "approval",
        "remote execution",
        "atlantis",
        "workspace agent",
        "plan artifact",
        "apply gate",
        "unattended apply",
        "self-hosted runner",
        "execution",
        "governance"
      ],
      "agent": "terraform-execution-governance-agent"
    },
    "plan-blast-radius": {
      "keywords": [
        "plan",
        "replace",
        "destroy",
        "forces replacement",
        "blast radius",
        "target",
        "lifecycle",
        "prevent_destroy",
        "create_before_destroy",
        "replace_triggered_by",
        "recreate",
        "decommission",
        "blast",
        "radius",
        "Engine"
      ],
      "agent": "terraform-plan-blast-radius-agent"
    },
    "policy-evidence": {
      "keywords": [
        "policy",
        "compliance",
        "guardrail",
        "sentinel",
        "opa",
        "rego",
        "conftest",
        "audit",
        "evidence",
        "exception",
        "control",
        "attestation",
        "soc2",
        "pci"
      ],
      "agent": "terraform-policy-evidence-agent"
    },
    "reviewer": {
      "keywords": [
        "module",
        "variable",
        "output",
        "validation",
        "golden path",
        "reusable",
        "module registry",
        "interface",
        "self-service",
        "scaffold",
        "reviewer",
        "one-off"
      ],
      "agent": "terraform-reviewer"
    },
    "state-reliability": {
      "keywords": [
        "state",
        "tfstate",
        "backend",
        "remote state",
        "locking",
        "force-unlock",
        "state rm",
        "state mv",
        "recovery",
        "backup",
        "encryption",
        "workspace",
        "state surgery",
        "reliability",
        "engine-specific"
      ],
      "agent": "terraform-state-reliability-agent"
    },
    "supply-chain-integrity": {
      "keywords": [
        "provider source",
        "required_providers",
        "registry",
        "lock file",
        "terraform.lock.hcl",
        "checksum",
        "mirror",
        "provenance",
        "module source",
        "typosquat",
        "signing",
        "namespace",
        "supply",
        "chain",
        "integrity",
        "network-restricted",
        "CLI"
      ],
      "agent": "terraform-supply-chain-integrity-agent"
    }
  },
  "live_guards": [],
  "gate_mode": "live-guard-gate",
  "live_guard_intent": "((terraform|tofu)\\s+(apply|destroy|import|taint|force-unlock|state\\s+(rm|mv|push|replace-provider))|run\\s+(the\\s+)?(apply|destroy)\\b|(apply|destroy)\\s+(this|these|it|that|the)\\b|live\\s+(apply|push|deploy)|force[- ]unlock|auto[-\\s]?approve|promote.*to\\s+(?:prod|production)|rollout to prod(uction)?|approve.*production)",
  "parallel_threshold": 0.8
}