# Safety — what has and has not been established

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

What has been established about this draft, row by row, and what has not. Nothing here approves the draft, asserts that it is equivalent to the source, or says it is safe to apply.

Run status: COMPLETE (report published); source status RUNTIME TOPOLOGY PARTIAL; draft GENERATED.

## The validation matrix

| Row | State | Detail | What the state is about | Recorded in |
|---|---|---|---|---|
| Source completeness | PARTIAL | source status RUNTIME_TOPOLOGY_PARTIAL | how much of the source configuration StackToIT read; not whether what it read is correct | assessment.json /summary/source_status |
| Draft generation | GENERATED | the draft is in terraform/ | whether a STACKIT draft was written for this run | manifest.json /draft |
| StackToIT draft checks | PASSED | 20 checks, none found a violation | StackToIT's own checks of the plan and the rendered text of the families it writes from a plan; not what OpenTofu or STACKIT would say | workspace.json /units |
| Global invariants | PASSED | 12 of 12 invariants PASS; vacuous, they checked nothing: NO_SECURITY_WIDENING, VARIABLE_IDENTITY_PRESERVED, APPLICATION_READY_IMPLIES_REQUIRED_ENV_SECRETS_DEPENDENCIES | eight consistency checks over the files of the draft and the plans, ALL_OUTPUTS_SAME_RUN among them, and one product check that no meaningful source property is left without a stated fate (ALL_UNACCOUNTED_PROPERTIES_EXPLICIT); not a check of target behaviour | manifest.json /verification |
| OpenTofu validation | PASSED | tofu init -backend=false and tofu validate accepted the draft; tofu 1.13.1 | static validation of the draft against the pinned provider schema — not target behaviour, not approval | manifest.json /validation/tofu_validate |
| Output schema validation | PASSED | verified at publish: every JSON file that has a schema is validated against it (see run_verification in manifest.json) | the machine-readable output files that have a schema, against the schemas recorded in manifest.json | manifest.json /run_verification |
| STACKIT plan | NOT RUN | this build runs no plan against a STACKIT project | a plan of the draft against a live STACKIT project: whether the provider accepts the values and what it would create |  |
| Architect approval | NOT PROVIDED | no review decision is recorded for this run | a named architect's decision on the draft; StackToIT records none |  |
| Semantic equivalence | NOT ASSESSED | this build has no measure for it | whether the target behaves like the source; StackToIT assesses units and settings one by one and makes no statement about the whole |  |
| Safe to apply | NOT ASSERTED | StackToIT never asserts it | whether the draft can be applied to a live project without harm; StackToIT never asserts this |  |

tofu validate: PASSED. static validation of the draft against the pinned provider schema — not target behaviour, not approval

## The global invariants of the draft

Eight consistency checks over the files of the draft and the plans of the families it is written from, and one product check over the property accounting (ALL_UNACCOUNTED_PROPERTIES_EXPLICIT: no meaningful source property is left without a stated fate). A pass that checked nothing is vacuous and the column says so; none of them is a check of target behaviour.

| Invariant | Status | Checked | Detail |
|---|---|---|---|
| GLOBAL_RESOURCE_UNIQUENESS | PASS | 55 | 55 addressable blocks in the final files and 0 resources of the plans, every address once |
| NO_UNPLANNED_RESOURCE | PASS | 10 | 10 resource blocks: 0 resources of a plan, 10 written by a registered legacy generator, none unplanned |
| NO_UNPLANNED_REFERENCE | PASS | 9 | 9 references between resources: every one is written, and the references of plan resources are stated by their plan (legacy to legacy: 9) |
| NO_UNRESOLVED_REQUIRED_FIELD | PASS | 28 | 28 required arguments of the resources written: every one is written (a value, a reference or a declared variable) or declared as a target gap |
| NO_SECURITY_WIDENING | PASS | 0 | 0 grant-defining attributes of the rules and routes written, each equal to the plan, none added (files against the plan; whether the plan carries everything the source allows is said by the unit findings and the NOT CARRIED lines, not by this check) |
| ALL_OUTPUTS_SAME_RUN | PASS | 48 | 48 artefacts carry the run id that manifest.json carries |
| VARIABLE_IDENTITY_PRESERVED | PASS | 0 | 0 variable references are exactly the variable the plan states, and the 0 variables read are declared as the plan declares them (type and description) |
| NO_ORPHAN_MANUAL_ACTION | PASS | 4 | 4 manual actions and decisions, each naming a unit of the assessment |
| SOURCE_PROVIDER_MATCHES_SCHEMA_OR_IS_UNVERIFIED | PASS | 16 | 16 units of a source provider: 0 verified against a compatibility record, 16 explicitly not verified through a root record, 0 stated by their provider row |
| APPLICATION_READY_IMPLIES_REQUIRED_ENV_SECRETS_DEPENDENCIES | PASS | 0 | the draft holds no application compatibility contract (no container service is drafted as Kubernetes manifests), so no workload is stated ready |
| ALL_EMITTED_TARGET_TYPES_CLASSIFIED | PASS | 10 | 10 resource and data blocks of 7 type(s) in the final files, every STACKIT type classified by the target catalogue |
| ALL_UNACCOUNTED_PROPERTIES_EXPLICIT | PASS | 69 | 69 meaningful properties of 11 generated units each end as accounted by a contract, consumed, a wired reference, a placement decision or named NOT CARRIED; none is UNACCOUNTED |