# Target readiness

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

Target profile: Stable network model: the experimental STACKIT VPC resources are not used. STACKIT provider 0.121.0, knowledge base 0.394.0.

## The catalogue

15 units state a target and 1 unit state none. Of those that state one, 13 are matched by a capability row of the catalogue, 1 partly, 1 by no row although the STACKIT provider has every one of their resource types (the capability metadata is incomplete), 0 by no row with a type the provider schema does not have, and 0 need no STACKIT resource. No row is a gap in the catalogue, not an unsupported target.

- KNOWN_PRESENT: 10 state a target (9 matched, 0 partly, 1 metadata incomplete, 0 type not in the provider schema, 0 need no STACKIT resource), 1 state none
- CONDITIONAL: 5 state a target (4 matched, 1 partly, 0 metadata incomplete, 0 type not in the provider schema, 0 need no STACKIT resource), 0 state none
- KNOWN_ABSENT: 0 state a target (0 matched, 0 partly, 0 metadata incomplete, 0 type not in the provider schema, 0 need no STACKIT resource), 0 state none

STACKIT resource types of the targets that no capability row lists:

- `stackit_objectstorage_bucket`: 2 units, RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED: The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Functional parity NOT_ASSESSED.
- `stackit_objectstorage_credential`: 1 unit, RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED: The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Functional parity NOT_ASSESSED.
- `stackit_objectstorage_credentials_group`: 1 unit, RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED: The pinned STACKIT provider has this resource; StackToIT's capability metadata for it is incomplete. Functional parity NOT_ASSESSED.

## The targets of the units

| Unit | STACKIT service | Resources | Maturity | Lifecycle | Lifecycle state | Catalogue | Regions |
|---|---|---|---|---|---|---|---|
| google_cloud_run_v2_job.migrate | Kubernetes Job/CronJob on SKE | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| google_cloud_run_v2_service.server | SKE workload (or Cloud Foundry Docker app) | stackit_ske_cluster | ga | active | GA | MATCHED | eu01, eu02 |
| google_cloudbuild_trigger.activategcb | a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD | stackit_git | beta | active |  | MATCHED | eu01, eu02 |
| google_cloudbuild_trigger.init | a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD | stackit_git | beta | active |  | MATCHED | eu01, eu02 |
| google_cloudbuild_trigger.placeholder | a workflow in STACKIT Git Pipelines (GitHub Actions syntax, STACKIT-managed or custom runners) or the customer's CI/CD | stackit_git | beta | active |  | MATCHED | eu01, eu02 |
| google_firebase_hosting_site.client | STACKIT Object Storage as origin of a STACKIT CDN distribution, with a custom domain | stackit_objectstorage_bucket, stackit_cdn_distribution, stackit_cdn_custom_domain | beta | active |  | PARTIAL |  |
| google_pubsub_topic.faux | STACKIT RabbitMQ | stackit_rabbitmq_instance, stackit_rabbitmq_credential | ga | active |  | MATCHED | eu01, eu02 |
| google_secret_manager_secret.django_admin_password | STACKIT Secrets Manager | stackit_secretsmanager_instance, stackit_secretsmanager_user | ga | active |  | MATCHED |  |
| google_secret_manager_secret.django_settings | STACKIT Secrets Manager | stackit_secretsmanager_instance, stackit_secretsmanager_user | ga | active |  | MATCHED |  |
| google_service_account.automation | STACKIT service account | stackit_service_account, stackit_authorization_project_role_assignment, stackit_authorization_folder_role_assignment, stackit_authorization_organization_role_assignment, stackit_authorization_service_account_role_assignment | experimental | active |  | MATCHED |  |
| google_service_account.client | STACKIT service account | stackit_service_account, stackit_authorization_project_role_assignment, stackit_authorization_folder_role_assignment, stackit_authorization_organization_role_assignment, stackit_authorization_service_account_role_assignment | experimental | active |  | MATCHED |  |
| google_service_account.init | STACKIT service account | stackit_service_account, stackit_authorization_project_role_assignment, stackit_authorization_folder_role_assignment, stackit_authorization_organization_role_assignment, stackit_authorization_service_account_role_assignment | experimental | active |  | MATCHED |  |
| google_service_account.server | STACKIT service account | stackit_service_account, stackit_authorization_project_role_assignment, stackit_authorization_folder_role_assignment, stackit_authorization_organization_role_assignment, stackit_authorization_service_account_role_assignment | experimental | active |  | MATCHED |  |
| google_sql_database_instance.postgres | STACKIT PostgreSQL Flex | stackit_postgresflex_instance, stackit_postgresflex_database, stackit_postgresflex_user | ga | active |  | MATCHED | eu01, eu02 |
| google_storage_bucket.media | STACKIT Object Storage | stackit_objectstorage_bucket, stackit_objectstorage_credentials_group, stackit_objectstorage_credential | ga | active |  | RESOURCE_EXISTS_BUT_CAPABILITY_UNLINKED |  |

## Readiness dimensions

| Dimension | Coverage state | Migration decisions | Target validation | Blockers | Open decisions | Detail |
|---|---|---|---|---|---|---|
| Source Fidelity | PARTLY COVERED | BLOCKERS OPEN | NOT APPLICABLE | 1 | n/a | For some units, whether and how many times they exist is decided only when OpenTofu plans. |
| Semantic Accounting | COVERED | BLOCKERS OPEN | NOT APPLICABLE | 11 | n/a | Accounted for is not decided. Covered means every unit has a semantic contract and no critical setting is unaccounted; it does not mean the settings are decided, so the blockers still count the 11 units that leave one for a person. 0 units have no semantic contract; 0 units leave a critical setting unaccounted; 11 units leave one for a person to review (accounted for, not decided). A blocker here is a unit that does either of the last two. |
| Critical Resolution | PARTLY COVERED | BLOCKERS OPEN | NOT APPLICABLE | 11 | n/a | 12 of 62 critical settings are resolved; 11 units hold an open one (accounted for, not decided); 0 units have no semantic contract. A blocker here is a unit that does either. |
| Target Functional Fit | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Target Operability | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Terraform Draft Accounting | NOT COVERED | BLOCKERS OPEN | STATIC CHECKS PASSED | 11 | n/a | Not a validation. This counts only whether each unit's critical settings are accounted for in the draft; it does not mean the draft validates, plans or applies against STACKIT, and even the coverage state Covered would not mean it. |
| Security | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Reliability / Resilience | NOT COVERED | BLOCKERS OPEN | NOT VALIDATED | 2 | 0 | 2 units state a failure-domain, replication or backup fact or hold state. 2 units have no RTO or RPO the customer wrote to decide against, and 0 units have one and wait for a person to choose its resilience intent. No unit is called resilient and no intent is chosen: the source states none, and the availability-zone and metro facts of the target are not assessed. |
| Operational Readiness | NOT COVERED | NO OPEN ITEMS | NOT VALIDATED | 0 | 0 | Terraform generated is not workload ready: 0 of 11 units carry open workload items. 0 units need a decision or evidence from a person (0 of them a decision; 0 block a readiness claim, a cutover decision being a migration operation and not a blocker); 2 compute units have no workload evidence in this build. The 20 dimensions of the amendment's operational readiness (identity, logs, backup, DR, support and the rest) are not assessed. A generated Terraform resource does not mark any of them ready. |
| Sovereignty & Exitability | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | No state is derived for this dimension: this build rates neither sovereignty nor exitability. What it does state (the thirteen dimensions, the source dependencies and the exitability entries, each with its own state) is in assurance/sovereignty.md and on the Sovereignty page. |
| Cost Confidence | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |
| Evidence Freshness | NOT ASSESSED | NOT ASSESSED | NOT ASSESSED | n/a | n/a | Not assessed in this build. |

There is no overall score: a dimension is a state of its own, and one this build cannot support reads NOT ASSESSED. The coverage state says how much of what the dimension counts is covered; COVERED is not decided, not validated and not ready. The migration decision state is read from the Blockers and Open decisions of the same row. The target validation state is what StackToIT's own checks established about the generated target (no STACKIT plan is run).