StackToIT Migration Intelligence Workspace

Executive lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Architect lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Platform lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Security lens: the sections are in the order this reader usually wants, and Costs and Migration Plan are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Application owner lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Programme lens: the sections are in the order this reader usually wants, and Engineering Evidence is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

FinOps lens: the sections are in the order this reader usually wants, and Architecture and Engineering Evidence are put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering lens: the sections are in the order this reader usually wants, and Costs is put aside. Nothing is removed from the page: choose All to show every section in the order of the navigation, or follow a link into a section that is put aside.

Engineering Evidence

The machine-readable files and the Terraform draft.

Files in this report folder

Every file the run publishes, with what it is for. A name links to the file when it is in this folder and you opened this page from it. The size and the sha256 of every file are in manifest.json: this page is written before the manifest and a file cannot state its own size, so only the files of the Terraform draft show theirs here.

Files in this report folder
File	What it is	In this report	Size in bytes
`assessment.json`	The full assessment: every unit, finding and count, machine-readable. Every number in this workspace is read from it.	Yes	–
`engineering/architect-report.md`	The assessment in words: the run status and its checks, and for each unit the class, the confidence and the STACKIT target proposed.	Yes	–
`engineering/analysis-details.md`	The working behind engineering/architect-report.md: the relations and combinations the engine evaluated for the decisions that depend on them. Nothing here is a second decision.	Yes	–
`architecture/dependencies.mmd`	The source and the target architecture as a diagram in Mermaid text, for tools that draw it. The Architecture section of this page draws the same units itself.	Yes	–
`migration/technical-sequencing.md`	A draft order of work: waves computed from the dependencies between units. A starting point for the architect's plan, not a schedule.	Yes	–
`engineering/review.csv`	One row per unit for spreadsheet review.	Yes	–
`engineering/review-edges.csv`	One row per dependency between units, for the architect to confirm, correct or complete.	Yes	–
`workspace.json`	The compact model the pages show, machine-readable. No page embeds it: the pages are complete without it, and a tool reads the model from this file.	Yes	–
`index.html`	The front page: the header, the navigation and the Overview. The other sections are the pages in pages/.	Yes	–
`pages/applications.html`	The Applications section as a page of its own, with the same header and navigation. Which application each unit belongs to, and each application's migration strategy.	Yes	–
`pages/architecture.html`	The Architecture section as a page of its own, with the same header and navigation. The units of the estate and what the assessment decided for each.	Yes	–
`pages/decisions.html`	The Decisions section as a page of its own, with the same header and navigation. The decisions people must take, aggregated, with their options, owners and deadlines.	Yes	–
`pages/target-fit.html`	The Target Fit section as a page of its own, with the same header and navigation. How well each STACKIT target fits: service, interface, Terraform, region, maturity, quota, lifecycle, operability, support and security.	Yes	–
`pages/migration.html`	The Migration Plan section as a page of its own, with the same header and navigation. Waves, prerequisites, data movement and the order of work.	Yes	–
`pages/security-assurance.html`	The Security & Resilience section as a page of its own, with the same header and navigation. What has been proven about security and resilience, what has not, and what needs evidence from outside; the resilience of each unit, where this run assesses it, is on the Operations page.	Yes	–
`pages/sovereignty.html`	The Sovereignty section as a page of its own, with the same header and navigation. Dependencies, jurisdiction, data placement, key control and exit paths, source against target.	Yes	–
`pages/operations.html`	The Operations section as a page of its own, with the same header and navigation. Whether the target can be run: identity, audit, observability, backup, restore, support and lifecycle.	Yes	–
`pages/cost.html`	The Costs section as a page of its own, with the same header and navigation. Priced and unpriced coverage, and the inputs a cost estimate needs.	Yes	–
`pages/evidence.html`	The Evidence section as a page of its own, with the same header and navigation. The counts, versions and sources behind every statement in this workspace.	Yes	–
`pages/engineering.html`	The Engineering Evidence section as a page of its own, with the same header and navigation. The machine-readable files and the Terraform draft.	Yes	–
`pages/work-board.html`	The Work Board section as a page of its own, with the same header and navigation. Every job of the migration in one list, in four queues: who does it, what it waits for, what closes it and which file it carries out.	Yes	–
`decisions.json`	The decision register, machine-readable, with a template of the decisions file to fill in.	Yes	–
`migration/decisions.csv`	The decision records as rows for a spreadsheet.	Yes	–
`executive/decisions.md`	The decision records in words.	Yes	–
`executive/brief.md`	The five-minute answer as a document: the run summary, what holds the estate back, what people must decide, the shape of the target and what has and has not been established. It restates numbers this file holds and scores nothing.	Yes	–
`migration/applications.csv`	One row per application of the applications file you gave, with the values as you wrote them (a value you did not write is marked not provided), and one row per unit claimed by several applications. Header only without an applications file.	Yes	–
`migration/waves.csv`	The dependency order of the units, one row per unit: the wave, WITHHELD when a part of the source was not read in full, or REFUSED for a unit the partial draft refuses for a missing input (in no wave). An order of work, not a schedule.	Yes	–
`migration/actions.csv`	The register of what a person has to do, decide or establish before the draft is deployed, one typed row per item: gaps in the reading of the source, critical semantics left open, open decisions and manual actions of the plans, workload items that wait for evidence, and validation rows not yet established. Every member of decisions.json is a row; each row names the decision record that holds it. It lists what is open and decides nothing.	Yes	–
`migration/work-board.csv`	The Work Board as a sheet: one row per job of the migration, in one of four queues (provide information, approve a design, perform migration work, verify), with its owner, priority, what it waits for, what closes it, its evidence, the files it carries out and the steps of the execution plan it holds. Every step of the plan is in exactly one job, or listed as not taken; pages/work-board.html shows the same jobs. The rows are in board order (queue by queue); the order to work in is the order of migration/work-items.json and the Start here list of the page. Header only when the run wrote no execution plan.	Yes	–
`migration/work-items.json`	The jobs of the Work Board as data, with the run they belong to: each job's id, kind, queue, owner, state, what it waits for, what closes it, its files and steps and, for a decision, its options and how each is carried out, and the one order in which the report names the jobs (the first job, then the jobs that can start, then the others). It is the file the guided work command reads; it states no state or priority of its own, and a job it lists is not done.	Yes	–
`migration/source-target.csv`	Each source unit beside its STACKIT target, one row per unit (the standing column says what the knowledge base and the run state of the unit's target; the drafted and manual counts of the console and of the draft's README partition what the draft did, and are another count): the target service and its resources (the knowledge base's candidate resource types), the resource types the draft really writes for the unit (drafted_resources: empty when it writes none, marked not assessed when no draft was read), or in words that there is no target, that the unit is refused or that the source switches it off, and how many of its settings are kept (PRESERVED), changed (TRANSFORMED), accepted (ACCEPTED_*) or still to do (everything else, including anything not known). Counted from the rows of assurance/equivalence-ledger.csv; a unit with no ledger row has four zeros, which says nothing was counted, not that nothing is left to do. Header only when the Workspace holds no counts.	Yes	–
`migration/application-chain.csv`	The drill-down from each application of the customer's file and each group the run suggested (PROPOSED: a reading of the source, not confirmed by anyone), one row per member unit: the Google Cloud resource, the STACKIT target in the words of migration/source-target.csv, the ids of the decisions that still ask something about the unit, the steps of the execution plan that carry it with the number an answer leaves not taken, the Kubernetes manifest objects that tie to it by an exact literal match, and what the code scan says of the application. A run that read no plan or built no register marks those cells as not assessed, which is not an empty list. Header only when the Workspace holds none.	Yes	–
`migration/prerequisites.md`	For each unit, the open decisions and manual actions that stand between its draft and its deployment, as its plan states them.	Yes	–
`migration/data-movement.csv`	One row per stateful source unit (a database, a cache, a volume, a file share, an object store): its source and target service, the data class, RPO and downtime tolerance you stated (or marked not provided), the provisioned capacity the source states (not the size of the data) and the cutover dependency. The mechanism of every unit is UNKNOWN: StackToIT never moves data.	Yes	–
`migration/data-movement.md`	The same units in words, with what the source and the plans do and do not state about each. No size, change rate, duration, transfer rate or downtime is ever stated, and no mechanism is chosen.	Yes	–
`migration/data-movement.json`	The data_movement block of workspace.json with every stateful source unit (the facets, the unknowns, the provisioned capacity and where each fact is read from), as a file of its own, with the run it belongs to. workspace.json carries the tally of the units.	Yes	–
`architecture/current.mmd`	The units of the estate and the dependencies among them as a Mermaid flowchart, with the units of each application drawn together.	Yes	–
`architecture/target.mmd`	The same units with the STACKIT service proposed for each, its class and confidence, as a Mermaid flowchart.	Yes	–
`architecture/delta.mmd`	The same units with what the move changes for each: its class, whether it has a target, and how many properties the draft names as not carried.	Yes	–
`architecture/current.svg`	The drawing of the source architecture of the Architecture section, as a file of its own, without the links of the page.	Yes	–
`architecture/target.svg`	The drawing of the proposed STACKIT target of the Architecture section, as a file of its own.	Yes	–
`architecture/delta.svg`	The drawing of what the move changes, as a file of its own.	Yes	–
`assurance/safety.md`	What has and has not been established about the draft, row by row, with the global invariants. It approves nothing and asserts neither equivalence nor that the draft is safe to apply.	Yes	–
`assurance/source-compatibility.md`	How much of the source was read, the source providers the assessment saw and the source types the knowledge base does not know.	Yes	–
`assurance/target-readiness.md`	How the STACKIT targets of the units stand in the capability catalogue and in the pinned provider (maturity, lifecycle), and the readiness dimensions.	Yes	–
`assurance/operational-readiness.md`	The workload readiness of the units (installation, source artifacts, target preconditions, cutover, day 2) and the support options STACKIT evidences. Terraform generated is not workload ready.	Yes	–
`assurance/compliance-evidence.md`	For each STACKIT service of the draft and each framework in scope, the state of the provider's own evidence. It says nothing about the compliance of your workload.	Yes	–
`assurance/compliance-evidence.csv`	The cells of compliance-evidence.md as rows for a spreadsheet.	Yes	–
`assurance/equivalence-ledger.csv`	The equivalence ledger: one row per unit and semantic of the assessment that the source states (workspace.json counts those it does not state), and one row per unit and property for the properties the draft does not carry, no semantic accounts for or that are critical and still open. Each row says how the source states the value, what proves the disposition, where the draft carries it and what stays open. Dispositions are the words the assessment uses today; PRESERVED appears only where the assessment or the draft's plan states it.	Yes	–
`assurance/evidence-ledger.csv`	The evidence the ledger and the other blocks cite, one row per document, with what it backs, the date it was checked, the date after which it is to be checked again and its state. Evidence that states no such dates is UNDATED, never CURRENT.	Yes	–
`assurance/critical-semantics.json`	The open critical semantics, one row per unit and semantic, with the disposition the contract result gives, the cause code, the sentences that say why the semantic is open and what would close it, the instances of a repeated unit and the alarm card where there is one. These are the rows the decision records name as their members; workspace.json carries the tally of them, with the run it belongs to.	Yes	–
`assurance/resilience.md`	The RTO and RPO you stated (or that none was stated) and, for each unit that holds state or states a zone, replication or backup fact, what the source states. No unit is called resilient and no intent is chosen.	Yes	–
`assurance/resilience.json`	The resilience block of workspace.json with every unit that states a failure-domain, replication or backup fact or holds state (the quoted source facts, the state and where each fact is read from), as a file of its own, with the run it belongs to. workspace.json carries the tally of the units.	Yes	–
`assurance/identity-transition.md`	For each unit that runs as an identity or is one: the identities the source names, the static credential the knowledge base reads, the federation facts, the attachment the identity plan holds and its state. It makes no claim that federation is an option; privilege delta, break-glass access and human identity are not assessed.	Yes	–
`assurance/sovereignty.md`	The sovereignty requirement (not provided unless your applications file states one), the dimensions of sovereignty with what the source shows and what the target is proposed to be, the dependencies and the exitability. Sovereignty is not residency; it holds no score and certifies no legal compliance.	Yes	–
`assurance/sovereignty.json`	The sovereignty block of workspace.json as a file of its own, with the run it belongs to.	Yes	–
`financial/price-snapshot.json`	The price_snapshot block of workspace.json as a file of its own, with the run it belongs to: which snapshot of the public STACKIT price list this run cites (source, retrieval date, sha256, currency, net list price) and how many of the drafted resources it priced. It holds list prices only: no quantity is read, no total is built, and no usage and no egress is computed.	Yes	–
`financial/cost-model.json`	The cost model of the run, line by line: for each component of the source (its servers and disks) and of the STACKIT target (servers and volumes) its quantity (a value, a range or unknown, and where it comes from), its price record or the reason there is none, its pricing state and its amount; then the totals of the estate and of each service for each side (full, partial or none), the comparison of source and target with the reason a saving is or is not given, the price sources (the local price cache) and the assumptions the figures rest on. An estimate under one labelled scenario, not a bill.	Yes	–
`financial/priced-resources.csv`	One row for each line of the cost model (financial/cost-model.json), source and target: the quantity with its provenance, the price record (SKU, rate, unit, the date it is valid from, the snapshot it comes from) or the state and the reason there is none, and the amount of a priced line. An empty amount is a line that is not priced, never a zero.	Yes	–
`financial/mapping.csv`	The technical mapping beside the prices: for each server, boot disk, disk and database whose source and target are both in the computed group of the cost model, what each side states about vCPU, memory, CPU model, disk capacity, IOPS, throughput and high availability. The source side is read from the attributes of the source resource, the target side from the catalogue snapshot of the region; a fact a side does not state is the words not stated. A machine type is one of the types of the catalogue with at least the vCPUs and memory of the source (a burstable source may be offered shared types); a storage class is the one the draft names (the customer's answer or the variable's default), shown with the catalogue's own IOPS and throughput. The table states sizes; it is not a statement about the performance of the target against the source (no benchmark was run, and a CPU model that a side does not state is shown as not stated). The last six columns add, for a disk, the fee of the selected performance class (the cost model's own amount) with the assumption behind the class, whether the class covers the IOPS and throughput of the source volume, and the smaller classes of the catalogue that still cover them with their fee and change (an alternative with the same or better figures than the source; not a recommendation), and, for a server, whether the flavor is with or without CPU overprovisioning (the documentation's terms, by the overcommit the catalogue states) and what STACKIT states of its lifecycle (a deprecated type says so, with the sentence of the documentation). The size match columns state the comparison of a server's machine type with the source instance and of a database's PostgreSQL Flex flavor with the database instance of the source (vCPUs, memory and the kind, single node or replica set, against its high-availability setting) as proven, to review, not met or unknown, with the sentence that says what was compared; a basis names a size only where the size match is proven.	Yes	–
`financial/cost-coverage.md`	What the cost model covers: the price sources it looked at, the lines by pricing state for each side, the totals with their state (full, partial or none), the comparison of source and target and why a saving is or is not given, the assumptions, and what the list prices of the STACKIT snapshot cover, with what is known of the terms of reuse of the price data.	Yes	–
`engineering/not-carried.csv`	One row per property the draft names as not carried: the unit, the node and the property, what the assessment states about it (the class and closure of the critical-property gate, the draft's own reason, the contract semantic that reads it, what closes that semantic while it is open) and the place of the node in the source. A cell the assessment states nothing for is empty.	Yes	–
`engineering/not-carried-summary.csv`	The units for which the draft names properties as not carried, with how many, and the units that have no count (their draft block was not accounted, or they need no resource of their own).	Yes	–
`engineering/evidence-index.json`	The reverse table of the evidence index: one entry per block of the draft, with the units it comes from, whether it is an HCL block, a comment or not placed, and its file and line, with the hop table and the checks over the draft. workspace.json carries the tally of the entries and, on each unit, the forward hops; this file is the mirror of them, with the run it belongs to.	Yes	–
`engineering/trace/`	The full comment of each block of the Terraform draft that has one: the draft keeps a one-paragraph comment above the block (where it comes from, why its values are what they are, what is not carried, which decision is open) and a `# trace: TR-...` line, and the section of this folder that line names holds the whole comment the generators wrote, unabridged: the rule and knowledge-base stamp, the references with their digests, the evidence of each chosen value and the reason of each attribute that is not written. One file for each file of the draft that has such a block, named after it with the extension .md, one section for each block under an anchor that is its trace id; the blocks are linked to their file by `trace_file` and their anchor `trace_id` in engineering/evidence-index.json. This run wrote 6 files with 10 sections.	Yes	–
`engineering/trace-index.csv`	One row per block with a trace: the trace id, the block, the draft file, the source units, the lines of the comment as the generators wrote it and the lines the draft keeps, and the pointer of the block (the trace file and the anchor of its section).	Yes	1804
`terraform/`	The STACKIT Terraform draft: architect review is required before any use. Present only when the run produced it.	Yes	–
`terraform/README.md`	How to read the draft: what was generated, what is left to a person, and how to check it with OpenTofu.	Yes	22234
`terraform/data.tf`	The STACKIT resources the draft writes for one area of the target (data).	Yes	2824
`terraform/handover/bucket-media/data-copy.md`	A file of the STACKIT Terraform draft.	Yes	18011
`terraform/handover/cluster-access/kubeconfig.md`	A file of the STACKIT Terraform draft.	Yes	5326
`terraform/handover/database-postgres/data-move.md`	A file of the STACKIT Terraform draft.	Yes	46051
`terraform/identity.tf`	The STACKIT resources the draft writes for one area of the target (identity).	Yes	10383
`terraform/kubernetes.tf`	The STACKIT resources the draft writes for one area of the target (kubernetes).	Yes	3549
`terraform/kubernetes/migrate/manifests.yaml`	A file of the STACKIT Terraform draft.	Yes	5894
`terraform/kubernetes/server/manifests.yaml`	A file of the STACKIT Terraform draft.	Yes	11017
`terraform/messaging.tf`	The STACKIT resources the draft writes for one area of the target (messaging).	Yes	1052
`terraform/proposals.tf`	The switches of the proposed alternatives: each is off, so a plan of the draft does not hold them.	Yes	20819
`terraform/proposals/proposal_activategcb/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	4102
`terraform/proposals/proposal_activategcb/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	431
`terraform/proposals/proposal_activategcb/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/proposals/proposal_automation/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	3117
`terraform/proposals/proposal_automation/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	429
`terraform/proposals/proposal_automation/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/proposals/proposal_client/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	4672
`terraform/proposals/proposal_client/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	1861
`terraform/proposals/proposal_client/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/proposals/proposal_django_admin_password/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	12503
`terraform/proposals/proposal_django_admin_password/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	4058
`terraform/proposals/proposal_django_admin_password/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/proposals/proposal_django_settings/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	12479
`terraform/proposals/proposal_django_settings/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	4058
`terraform/proposals/proposal_django_settings/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/proposals/proposal_init/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	4025
`terraform/proposals/proposal_init/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	431
`terraform/proposals/proposal_init/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/proposals/proposal_placeholder/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	4099
`terraform/proposals/proposal_placeholder/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	431
`terraform/proposals/proposal_placeholder/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/proposals/proposal_server/main.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	3105
`terraform/proposals/proposal_server/variables.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	429
`terraform/proposals/proposal_server/versions.tf`	A proposed alternative, switched off: not equal to the source, and not applied until a person decides on it, gives it its values and switches it on.	Yes	231
`terraform/rabbitmq/apply-topology.sh`	A file of the STACKIT Terraform draft.	Yes	3324
`terraform/rabbitmq/topology.json`	A file of the STACKIT Terraform draft.	Yes	219
`terraform/security.tf`	The STACKIT resources the draft writes for one area of the target (security).	Yes	6073
`terraform/storage.tf`	The STACKIT resources the draft writes for one area of the target (storage).	Yes	1881
`terraform/terraform.tf`	The OpenTofu and provider version requirements of the draft.	Yes	700
`terraform/variables.tf`	The input variables of the draft: the values a person fills in.	Yes	4286
`target-plan.json`	The canonical TargetPlans the draft was generated from, machine-readable: one plan for each family of the draft that is written from a plan (the security groups of each source cloud, routing, identity, log sources, servers), each with how the draft wrote every resource of it (a resource, a comment only, or a statement about a block another generator writes). The run read it back against the draft before it was published: every resource of a plan is, or is not, a block of the draft as the file says. Present only when the run produced the draft.	Yes	–
`execution/`	The execution package: execution/README.md is the entry point for carrying the migration out (the verdict for the resources with a typed plan and the draft files it does not cover, what is created, what is not migrated, the decisions, the credentials, the order of the steps, the OpenTofu and API commands, the manual steps, the checks and the rollback); execution/terraform/apply.md, one request file and one script per STACKIT API call under execution/api/, execution/manual/actions.md and execution/verify/checks.md beside it; execution/deploy.sh, the one entry point that carries the steps out in the order of the plan, up to the verification (no argument: a dry run that prints the order; --run: stops at each step that waits, and resumes from review/progress.yaml), with the template of the remote state (execution/backend.tf.template), one example of a pipeline (execution/ci-pipeline.example.yml) and, when a step sits between OpenTofu blocks, the generated roots of the stages before the draft (execution/stages/); a run whose plan holds checks that are commands, or a load balancer in the network of a cluster, also holds the scripts that run those checks and fill the values of the cluster, this entry names them when the run wrote them. A rendering of execution-plan.json and of the facts of the staged draft (the variables, outputs and manifests the scripts read); nothing in it has been run, and a script stops before it calls anything when its step waits for a decision. Present only when the run produced the draft. This run also wrote the scripts execution/deploy.sh, execution/verify/verify.sh.	Yes	–
`migration/execution-actions.csv`	One row per step of execution-plan.json for a spreadsheet: id, phase, mode, source, target, dependencies, owner, status, file, risks, rollback, whether it is executable and the decisions it waits for. The steps to carry out, not the register of open items (migration/actions.csv). Present only when the run produced the draft.	Yes	–
`migration/work-packages.csv`	One row per work package of the manual steps of execution-plan.json for a spreadsheet: the steps of one phase, one owner role and one kind of work that one person carries out together, with their number, the resources they touch, the decisions they rest on and wait for, the strictest state among them, their success conditions and the ids of the steps. Every manual step is in exactly one package; execution/README.md lists the same packages. Present only when the run produced the draft.	Yes	–
`architecture/network-security.mmd`	The network and security view as a Mermaid flowchart, or, in an estate with more than 120 units in it, the partition map of the files under architecture/partitions/ (one box for each partition, the arrows between partitions counted, every unknown edge accounted for). Drawn from the TargetPlans of the draft and the assessment: the internet, public IPs, load balancers, networks, subnets, servers, databases, security groups and their rules, network ACLs and routing. A path the sources do not state is a dashed edge labelled unknown with its reason, never a connection that was not read. Present only when the run produced the draft.	Yes	–
`architecture/identity.mmd`	The identity view as a Mermaid flowchart (an estate with more principals than a drawing keeps legible gets one sentence that names assurance/identity-transition.md, which lists every identity, instead of a drawing): the Google Cloud principal, the decision the assessment and the plan hold for it, the STACKIT identity it moves to, the role assignment and its scope. A step the typed plan does not hold (the role assignment) is drawn as manual, and a step it leaves open is a dashed edge labelled unknown. Present only when the run produced the draft.	Yes	–
`architecture/data-flows.mmd`	The data flows as a Mermaid flowchart, or, in an estate with more than 120 units in it, the partition map of the files under architecture/partitions/ (one box for each partition, the arrows between partitions counted, every unknown edge accounted for): clients, load balancers, applications, databases, object storage and registries, with the protocol and port of each flow where the source states them, public or private, and the migration effect on the unit that carries it; what the source does not state is written unknown. The flows are the paths the listeners and security group rules permit, not observed traffic. Present only when the run produced the draft.	Yes	–
`architecture/network-security.svg`	The network and security view drawn offline: the same boxes and arrows as architecture/network-security.mmd, each arrow numbered, with a key that gives its two ends in the direction of the arrow and its words (protocol, port and direction of a rule; the attribute of a reference). Source links, target links (what a rule, route or listener of the draft permits), links an answer of the inputs file changed and unknowns are drawn apart and named in the legend. A view that is not drawn whole (a partition map above 120 units) is one sentence. Present only when the run produced the draft.	Yes	–
`architecture/data-flows.svg`	The data flow view drawn offline: the same boxes and arrows as architecture/data-flows.mmd, each flow numbered, with a key that gives its two ends in the direction of the flow, its protocol and port, public or private, and the migration effect. Source links, target links and unknowns are drawn apart and named in the legend. A view that is not drawn whole (a partition map above 120 units) is one sentence. Present only when the run produced the draft.	Yes	–
`migration/roadmap.md`	The execution plan laid out in ten waves: wave 0 the decisions some step waits for, then the landing zone, network and security, data services, platform, workloads, data migration, cutover, verification and decommission. Each step names what it does, the Google Cloud resource, the mode, what it depends on and whether it is ready, blocked by a decision, not ready or refused. It holds the steps of execution-plan.json only. Present only when the run produced the draft.	Yes	–
`migration/landing-zone-requirements.md`	What the STACKIT organization and project have to provide before the first apply: organization and project, network area and region, address ranges, routing, DNS, identity, service enablement, quotas to check, API access, Terraform permissions, external dependencies and the customer decisions. Read from the TargetPlans, the execution plan and the assessment; what they do not state is written as unknown and no limit or role name is invented. Present only when the run produced the draft.	Yes	–
`engineering/explain-index.json`	Where, in this folder's files, the entries and ledger rows of each unit sit, as byte offsets: the explain command (stacktoit explain) reads a unit's chain from it without parsing the whole files. Machine-only: it is not an exchange document and states nothing the files it points into do not state; without it, or when it does not fit the files, explain reads them in full and prints the same answer.	Yes	–
`manifest.json`	The run's identity (run id, source digest) and the list of the files it published, each with its sha256 and size; its status says whether the run is COMPLETE, PARTIAL or FAILED.	Yes	–
`migration/strategies.csv`	Not produced in this build: a migration strategy for each application. No run writes this file, and nothing links to it.	No	–
`assurance/preflight.md`	Not produced in this build: the preflight checks in words. No run writes this file, and nothing links to it.	No	–
`assurance/terraform-operability.md`	Not produced in this build: how the draft is operated with OpenTofu. No run writes this file, and nothing links to it.	No	–
`financial/business-case.md`	Not produced in this build: a business case. No run writes this file, and nothing links to it.	No	–
`financial/finops-readiness.md`	Not produced in this build: the FinOps readiness. No run writes this file, and nothing links to it.	No	–

Evidence traces

Each drawer follows one resource from the source to its STACKIT target: source, evidence, resolution proof, semantic claim, intent, target capability, transformation, render, validation and the differences that remain. A step says what holds, what is open and where its machine artefact is. Nothing here is decided by this page. The expert view of a step lists the identifiers behind it.

google_pubsub_topic.faux — 2 of 5 steps with open items

Source Established

google_pubsub_topic.faux is a resource of the source, declared in postdeployment.tf (lines 32-34). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.

In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /units/1 google_pubsub_topic.faux
- knowledge base case: pubsub
- knowledge base rule: gcp.pubsub_topic
- source type: google_pubsub_topic
- unit: google_pubsub_topic.faux
Evidence Established

The generator that writes this unit's block states, above the block, why its values are what they are. These are the generator's own statements in the draft, not checks of the draft.
- One RabbitMQ instance hosts all migrated topics as exchanges and subscriptions as queues.
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- recorded: finding: source-provider-unverified
- recorded: trace: TR-4a61e547964d
Semantic claim Open items

The engine read 2 statements the source makes about this resource and decided what happens to each; 2 of them are critical settings, 1 of those still open.
- 1 kept in another form
- 1 left to a person to review
- 46 further statements that the source does not make (nothing to carry)
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /kernel/units/1 google_pubsub_topic.faux
- claim: messaging-model = KNOWN, CRITICAL, TRANSFORMED
- claim: tc-name = KNOWN, CRITICAL, REVIEW
Render Established

The draft holds 1 block for this unit, written as active Terraform.
- stackit_rabbitmq_instance.messaging: written as an active resource (terraform/messaging.tf, lines 8-16); the whole comment of the block is in engineering/trace/messaging.md
In terraform/messaging.tf of this report.
Expert: identifiers

Artefact: REPORT_FILE terraform/messaging.tf stackit_rabbitmq_instance.messaging
- block in the draft: stackit_rabbitmq_instance.messaging
- block in the draft: terraform/messaging.tf:8-16
- trace: TR-4a61e547964d
Residual difference Open items

The draft states, for this unit: 1 property it does not carry, 1 finding, 1 open decision of the converter. That is what the draft states, not a proof that the block and the source are equivalent.
- NOT CARRIED (google_pubsub_topic.faux): name — the topic becomes an exchange and its subscriptions queues of the shared RabbitMQ instance, created in RabbitMQ by hand (not by this draft): names, delivery, retention and push settings are not generated.
- warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
- 1 open decision of the converter wait for a person: the unit is not ready to deploy until each is decided
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- decision: DEC-GEN-CONVERT-API-OPT-IN/google_pubsub_topic.faux (alias convert:api:pubsub:v1beta:beta:API_OPT_IN)

google_secret_manager_secret.django_admin_password — 2 of 5 steps with open items

Source Established

google_secret_manager_secret.django_admin_password is a resource of the source, declared in secrets.tf (lines 25-37). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.

In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /units/6 google_secret_manager_secret.django_admin_password
- knowledge base case: secret
- knowledge base rule: gcp.secret
- source type: google_secret_manager_secret
- unit: google_secret_manager_secret.django_admin_password
Evidence Nothing to show

The block stands for several units, so the generator's explanations of its values are not attributed to this unit; the trace file of the block holds them. These are the generator's own statements in the draft, not checks of the draft.

Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- recorded: finding: secret-iam-access
- recorded: finding: source-provider-unverified
- recorded: trace: TR-20eecaf8afaa
- recorded: trace: TR-d46bac8a52a7
Semantic claim Open items

The engine read 4 statements the source makes about this resource and decided what happens to each; 4 of them are critical settings, 3 of those still open.
- 1 kept in another form
- 3 left to a person to review
- 14 further statements that the source does not make (nothing to carry)
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /kernel/units/6 google_secret_manager_secret.django_admin_password
- claim: secret-settings = KNOWN, CRITICAL, REVIEW
- claim: secret-value = KNOWN, CRITICAL, REVIEW
- claim: secret-values = KNOWN, CRITICAL, TRANSFORMED
- claim: tcr-secret-id = KNOWN, CRITICAL, REVIEW
Render Established

The draft holds 2 blocks for this unit, written as active Terraform.
- stackit_secretsmanager_instance.migrated_secrets: written as an active resource (terraform/security.tf, lines 16-19); it also stands for 1 other unit; the whole comment of the block is in engineering/trace/security.md
- stackit_secretsmanager_user.migration: written as an active resource (terraform/security.tf, lines 24-29); it also stands for 1 other unit; the whole comment of the block is in engineering/trace/security.md
In terraform/security.tf of this report.
Expert: identifiers

Artefact: REPORT_FILE terraform/security.tf stackit_secretsmanager_instance.migrated_secrets
- block in the draft: stackit_secretsmanager_instance.migrated_secrets
- block in the draft: stackit_secretsmanager_user.migration
- block in the draft: terraform/security.tf:16-19
- block in the draft: terraform/security.tf:24-29
- trace: TR-20eecaf8afaa
- trace: TR-d46bac8a52a7
Residual difference Open items

The draft states, for this unit: 3 properties it does not carry, 2 findings, 2 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.
- NOT CARRIED (google_secret_manager_secret.django_admin_password): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the … (full text: engineering/trace/security.md)
- NOT CARRIED (google_secret_manager_secret_iam_binding.django_admin_password): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you … (full text: engineering/trace/security.md)
- NOT CARRIED (google_secret_manager_secret_version.django_admin_password): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_admin_password writes it into the Secrets Manager instance from a document you supply (the path is its name when the source … (full text: engineering/trace/security.md)
- warning: The secret has grants for individual principals.
- warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
- 2 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- decision: DEC-GEN-CONVERT-API-OPT-IN/google_secret_manager_secret.django_admin_password (alias convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN)
- decision: DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_secret_manager_secret_iam_binding.django_admin_password (alias convert:google_secret_manager_secret_iam_binding.django_admin_password:proposal:PROPOSED_ALTERNATIVE)

google_secret_manager_secret.django_settings — 2 of 5 steps with open items

Source Established

google_secret_manager_secret.django_settings is a resource of the source, declared in secrets.tf (lines 56-68). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.

In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /units/8 google_secret_manager_secret.django_settings
- knowledge base case: secret
- knowledge base rule: gcp.secret
- source type: google_secret_manager_secret
- unit: google_secret_manager_secret.django_settings
Evidence Nothing to show

The block stands for several units, so the generator's explanations of its values are not attributed to this unit; the trace file of the block holds them. These are the generator's own statements in the draft, not checks of the draft.

Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- recorded: finding: secret-iam-access
- recorded: finding: source-provider-unverified
- recorded: trace: TR-20eecaf8afaa
- recorded: trace: TR-d46bac8a52a7
Semantic claim Open items

The engine read 4 statements the source makes about this resource and decided what happens to each; 4 of them are critical settings, 3 of those still open.
- 1 kept in another form
- 3 left to a person to review
- 14 further statements that the source does not make (nothing to carry)
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /kernel/units/8 google_secret_manager_secret.django_settings
- claim: secret-settings = KNOWN, CRITICAL, REVIEW
- claim: secret-value = KNOWN, CRITICAL, REVIEW
- claim: secret-values = KNOWN, CRITICAL, TRANSFORMED
- claim: tcr-secret-id = KNOWN, CRITICAL, REVIEW
Render Established

The draft holds 2 blocks for this unit, written as active Terraform.
- stackit_secretsmanager_instance.migrated_secrets: written as an active resource (terraform/security.tf, lines 16-19); it also stands for 1 other unit; the whole comment of the block is in engineering/trace/security.md
- stackit_secretsmanager_user.migration: written as an active resource (terraform/security.tf, lines 24-29); it also stands for 1 other unit; the whole comment of the block is in engineering/trace/security.md
In terraform/security.tf of this report.
Expert: identifiers

Artefact: REPORT_FILE terraform/security.tf stackit_secretsmanager_instance.migrated_secrets
- block in the draft: stackit_secretsmanager_instance.migrated_secrets
- block in the draft: stackit_secretsmanager_user.migration
- block in the draft: terraform/security.tf:16-19
- block in the draft: terraform/security.tf:24-29
- trace: TR-20eecaf8afaa
- trace: TR-d46bac8a52a7
Residual difference Open items

The draft states, for this unit: 3 properties it does not carry, 2 findings, 2 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.
- NOT CARRIED (google_secret_manager_secret.django_settings): replication, secret_id — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it … (full text: engineering/trace/security.md)
- NOT CARRIED (google_secret_manager_secret_iam_binding.django_settings): members, role = roles/secretmanager.secretAccessor — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the … (full text: engineering/trace/security.md)
- NOT CARRIED (google_secret_manager_secret_version.django_settings): secret_data — the API step API/secrets-manager-vault/WriteSecret/google_secret_manager_secret.django_settings writes it into the Secrets Manager instance from a document you supply (the path is its name when the source states it as … (full text: engineering/trace/security.md)
- warning: The secret has grants for individual principals.
- warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
- 2 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- decision: DEC-GEN-CONVERT-API-OPT-IN/google_secret_manager_secret.django_admin_password (alias convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN)
- decision: DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_secret_manager_secret_iam_binding.django_settings (alias convert:google_secret_manager_secret_iam_binding.django_settings:proposal:PROPOSED_ALTERNATIVE)

google_service_account.client — 2 of 5 steps with open items

Source Established

google_service_account.client is a resource of the source, declared in iam.tf (lines 48-52). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.
- from google_service_account.client (iam.tf:48) — RECONFIGURE / MEDIUM
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /units/3 google_service_account.client
- knowledge base case: service-account
- knowledge base rule: gcp.service_account
- source type: google_service_account
- unit: google_service_account.client
Evidence Established

The generator that writes this unit's block states, above the block, why its values are what they are. These are the generator's own statements in the draft, not checks of the draft.
- Grant the permissions of the source policies as STACKIT role assignments (provider experiment "iam").
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- recorded: finding: source-provider-unverified
- recorded: rule line: rule gcp.service_account/service-account · KB 0.394.0 · target maturity EXPERIMENTAL · lifecycle active · evidence internal · review required
- recorded: trace: TR-5ca70ac9e6fa
Semantic claim Open items

The engine read 3 statements the source makes about this resource and decided what happens to each; 3 of them are critical settings, 2 of those still open.
- 1 kept in another form
- 2 left to a person to review
- 9 further statements that the source does not make (nothing to carry)
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /kernel/units/3 google_service_account.client
- claim: account-name = UNKNOWN, CRITICAL, REVIEW
- claim: role-bindings = KNOWN, CRITICAL, REVIEW
- claim: workload-identity = KNOWN, CRITICAL, TRANSFORMED
Render Established

The draft holds 1 block for this unit, written as active Terraform.
- stackit_service_account.client: written as an active resource (terraform/identity.tf, lines 24-27); the whole comment of the block is in engineering/trace/identity.md
In terraform/identity.tf of this report.
Expert: identifiers

Artefact: REPORT_FILE terraform/identity.tf stackit_service_account.client
- block in the draft: stackit_service_account.client
- block in the draft: terraform/identity.tf:24-27
- trace: TR-5ca70ac9e6fa
Residual difference Open items

The draft states, for this unit: 2 properties it does not carry, 1 finding. That is what the draft states, not a proof that the block and the source are equivalent.
- NOT CARRIED (google_service_account.client): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.
- NOT CARRIED (google_service_account.client): display_name = Client Frontend service account — stackit_service_account has no display name, only a name besides project_id (pinned provider).
- warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
Held in memory in this build; no file contains it.

Expert: identifiers

Artefact: IN_MEMORY

No identifiers.

google_service_account.init — 2 of 5 steps with open items

Source Established

google_service_account.init is a resource of the source, declared in iam.tf (lines 61-66). Whether it exists is decided only when OpenTofu plans. The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.
- from google_service_account.init (iam.tf:61) — RECONFIGURE / MEDIUM
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /units/15 google_service_account.init
- knowledge base case: service-account
- knowledge base rule: gcp.service_account
- source type: google_service_account
- unit: google_service_account.init
Evidence Established

The generator that writes this unit's block states, above the block, why its values are what they are. These are the generator's own statements in the draft, not checks of the draft.
- Grant the permissions of the source policies as STACKIT role assignments (provider experiment "iam").
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- recorded: finding: source-provider-unverified
- recorded: rule line: rule gcp.service_account/service-account · KB 0.394.0 · target maturity EXPERIMENTAL · lifecycle active · evidence internal · review required
- recorded: trace: TR-82b9a11ffa8d
Semantic claim Open items

The engine read 3 statements the source makes about this resource and decided what happens to each; 3 of them are critical settings, 2 of those still open.
- 1 kept in another form
- 2 left to a person to review
- 9 further statements that the source does not make (nothing to carry)
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /kernel/units/15 google_service_account.init
- claim: account-name = UNKNOWN, CRITICAL, REVIEW
- claim: role-bindings = KNOWN, CRITICAL, REVIEW
- claim: workload-identity = KNOWN, CRITICAL, TRANSFORMED
Render Established

The draft holds 1 block for this unit, written as active Terraform.
- stackit_service_account.init: written as an active resource (terraform/identity.tf, lines 36-39); the whole comment of the block is in engineering/trace/identity.md
In terraform/identity.tf of this report.
Expert: identifiers

Artefact: REPORT_FILE terraform/identity.tf stackit_service_account.init
- block in the draft: stackit_service_account.init
- block in the draft: terraform/identity.tf:36-39
- trace: TR-82b9a11ffa8d
Residual difference Open items

The draft states, for this unit: 2 properties it does not carry, 1 finding, 1 open item. That is what the draft states, not a proof that the block and the source are equivalent.
- NOT CARRIED (google_service_account.init): account_id — the account ID is not visible statically, or the account is declared several times: the STACKIT account is named after the source address.
- NOT CARRIED (google_service_account.init): display_name = Jump Start App Init SA — stackit_service_account has no display name, only a name besides project_id (pinned provider).
- warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
- Open: how many instances google_service_account.init creates is not visible statically (its count/for_each reads a variable that can be set when the source is planned, so the variable's default is not a fact of the source and is not used); this block drafts one instance — repeat it (count/for_each) for … (full text: engineering/trace/identity.md)
Held in memory in this build; no file contains it.

Expert: identifiers

Artefact: IN_MEMORY

No identifiers.

google_sql_database_instance.postgres — 2 of 5 steps with open items

Source Established

google_sql_database_instance.postgres is a resource of the source, declared in database.tf (lines 25-38). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.
- from google_sql_database_instance.postgres (database.tf:25) — REPLATFORM / MEDIUM
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /units/5 google_sql_database_instance.postgres
- knowledge base case: sql-postgres
- knowledge base rule: gcp.sql_instance
- source type: google_sql_database_instance
- unit: google_sql_database_instance.postgres
Evidence Established

The generator that writes this unit's block states, above the block, why its values are what they are. These are the generator's own statements in the draft, not checks of the draft.
- flavor_id 2.4 = 2 vCPU / 4 GiB, single-node (eu01 catalogue 2026-10-18).
- REVIEW: the source disk grows by itself (disk_autoresize is on, the Cloud SQL default), so its disk_size is the size the Terraform file asks for and not necessarily the size of the data today — read the current disk size of the instance before the move and give PostgreSQL Flex at least that much; a … (full text: engineering/trace/data.md)
- backup_schedule is a default (02:00 daily): the source states no backup start time (Cloud SQL then picks one of its own).
- PITR on PostgreSQL Flex restores into a new cloned instance; backups are kept 32–90 days.
- retention_days: the source backup retention is not visible statically; 32 days is the STACKIT minimum (32–90).
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- recorded: finding: source-provider-unverified
- recorded: rule line: rule gcp.sql_instance/sql-postgres · KB 0.394.0 · target maturity GA · lifecycle active · evidence internal · review required
- recorded: trace: TR-97904614ad56
Semantic claim Open items

The engine read 11 statements the source makes about this resource and decided what happens to each; 11 of them are critical settings, 7 of those still open.
- 2 kept as it is
- 1 kept in another form
- 7 left to a person to review
- 1 carried into the draft and listed in the ledger
- 60 further statements that the source does not make (nothing to carry)
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /kernel/units/5 google_sql_database_instance.postgres
- claim: database-users = UNKNOWN, CRITICAL, REVIEW
- claim: engine = KNOWN, CRITICAL, TRANSFORMED
- claim: engine-version = KNOWN, CRITICAL, PRESERVED
- claim: network-exposure = KNOWN, CRITICAL, LEDGER
- claim: project-scope = KNOWN, CRITICAL, REVIEW
- claim: region-residency = KNOWN, CRITICAL, REVIEW
- claim: tc-name = KNOWN, CRITICAL, REVIEW
- claim: tcf-sql-database--name = KNOWN, CRITICAL, REVIEW
- claim: tcfp-sql-user--name = KNOWN, CRITICAL, REVIEW
- claim: terraform-destroy-guard-off = KNOWN, CRITICAL, PRESERVED
- claim: user-and-database-settings = KNOWN, CRITICAL, REVIEW
Render Established

The draft holds 1 block for this unit, written as active Terraform.
- stackit_postgresflex_instance.postgres: written as an active resource (terraform/data.tf, lines 18-32); the whole comment of the block is in engineering/trace/data.md
In terraform/data.tf of this report.
Expert: identifiers

Artefact: REPORT_FILE terraform/data.tf stackit_postgresflex_instance.postgres
- block in the draft: stackit_postgresflex_instance.postgres
- block in the draft: terraform/data.tf:18-32
- trace: TR-97904614ad56
Residual difference Open items

The draft states, for this unit: 6 properties it does not carry, 1 finding, 3 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.
- NOT CARRIED (google_sql_database_instance.postgres): settings.user_labels — labels are metadata and the draft carries none.
- NOT CARRIED (google_sql_user.django): password — the source password is not copied: STACKIT generates the user's password (stackit_postgresflex_user.password is computed, pinned provider) — hand the new one to the application.
- NOT CARRIED (google_sql_user.django): deletion_policy — stackit_postgresflex_user is deleted directly (pinned provider): ABANDON (keep the Cloud SQL user, drop it from state only) has no counterpart.
- NOT CARRIED (google_sql_user.django): name — a user name is not visible statically: create that user with stackit_postgresflex_user.
- NOT CARRIED (google_sql_database.database): deletion_policy — stackit_postgresflex_database is deleted directly (pinned provider): ABANDON (keep the Cloud SQL database, drop it from state only) has no counterpart.
- NOT CARRIED (google_sql_database.database): name — a database name (or the number of databases) is not visible statically: create that database with stackit_postgresflex_database.
- warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
- 3 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- decision: DEC-GEN-CONVERT-SOURCE-REGION-MAPPING (alias convert:estate:source_location:SOURCE_REGION_MAPPING)
- decision: DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING (alias convert:estate:source_project:SOURCE_PROJECT_MAPPING)
- decision: DEC-GEN-CONVERT-DATA-MOVEMENT (alias convert:google_sql_database_instance.postgres:data:DATA_MOVEMENT)

google_storage_bucket.media — 2 of 5 steps with open items

Source Established

google_storage_bucket.media is a resource of the source, declared in storage.tf (lines 17-25). The block that stands for it in the draft is written by a generator that records no intent and no plan, so this trace is made from the lines the draft records for it, not from a typed plan: it holds the stages those lines support and none of the others.
- from google_storage_bucket.media (storage.tf:17) — RECONFIGURE / MEDIUM
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /units/7 google_storage_bucket.media
- knowledge base case: gcs
- knowledge base rule: gcp.storage_bucket
- source type: google_storage_bucket
- unit: google_storage_bucket.media
Evidence Nothing to show

The generator records no explanation of the values of this unit's block and no source attribute for them. These are the generator's own statements in the draft, not checks of the draft.

Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- recorded: finding: gcs-force-destroy
- recorded: finding: source-provider-unverified
- recorded: rule line: rule gcp.storage_bucket/gcs · KB 0.394.0 · target maturity GA · lifecycle active · evidence internal · review required
- recorded: trace: TR-03d7fb936653
Semantic claim Open items

The engine read 7 statements the source makes about this resource and decided what happens to each; 7 of them are critical settings, 7 of those still open.
- 1 not supported on STACKIT
- 6 left to a person to review
- 56 further statements that the source does not make (nothing to carry)
In assessment.json of this report.
Expert: identifiers

Artefact: REPORT_FILE assessment.json /kernel/units/7 google_storage_bucket.media
- claim: bucket-region = KNOWN, CRITICAL, REVIEW
- claim: force-destroy = KNOWN, CRITICAL, UNSUPPORTED
- claim: geo-replication = UNKNOWN, CRITICAL, REVIEW
- claim: iam-access = KNOWN, CRITICAL, REVIEW
- claim: iam-grant = KNOWN, CRITICAL, REVIEW
- claim: public-access = UNKNOWN, CRITICAL, REVIEW
- claim: tc-storage-bucket-name = KNOWN, CRITICAL, REVIEW
Render Established

The draft holds 1 block for this unit, written as active Terraform.
- stackit_objectstorage_bucket.media: written as an active resource (terraform/storage.tf, lines 11-14); the whole comment of the block is in engineering/trace/storage.md
In terraform/storage.tf of this report.
Expert: identifiers

Artefact: REPORT_FILE terraform/storage.tf stackit_objectstorage_bucket.media
- block in the draft: stackit_objectstorage_bucket.media
- block in the draft: terraform/storage.tf:11-14
- trace: TR-03d7fb936653
Residual difference Open items

The draft states, for this unit: 4 properties it does not carry, 2 findings, 3 open decisions of the converter. That is what the draft states, not a proof that the block and the source are equivalent.
- NOT CARRIED (google_storage_bucket.media): storage_class = REGIONAL — stackit_objectstorage_bucket has a name and object_lock only (pinned provider): the bucket's storage class, Autoclass, hierarchical-namespace and requester-pays settings are not generated.
- NOT CARRIED (google_storage_bucket.media): force_destroy = true — stackit_objectstorage_bucket has no force-destroy override (pinned provider): deleting a bucket that still holds objects behaves as STACKIT's Object Storage API defines it — empty the bucket (or migrate its objects) before it is … (full text: engineering/trace/storage.md)
- NOT CARRIED (google_storage_bucket_iam_member.automation): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_automation, switch … (full text: engineering/trace/storage.md)
- NOT CARRIED (google_storage_bucket_iam_member.server): member, role = roles/storage.admin — the draft of google_storage_bucket.media does not carry this one member's role on the Cloud Storage bucket. Proposed, switched off until it is decided: proposals/proposal_server, switch … (full text: engineering/trace/storage.md)
- warning: force_destroy lets Terraform delete the bucket together with its objects.
- warning: no lock file records the version of registry.terraform.io/hashicorp/google, and the constraint ">= 6, < 8" excludes it (pinned 8.4.0) (stated once for the whole estate)
- 3 open decisions of the converter wait for a person: the unit is not ready to deploy until each is decided
Held in memory in this build; no file contains it.
Expert: identifiers

Artefact: IN_MEMORY
- decision: DEC-GEN-CONVERT-SOURCE-REGION-MAPPING (alias convert:estate:source_location:SOURCE_REGION_MAPPING)
- decision: DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_storage_bucket_iam_member.automation (alias convert:google_storage_bucket_iam_member.automation:proposal:PROPOSED_ALTERNATIVE)
- decision: DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_storage_bucket_iam_member.server (alias convert:google_storage_bucket_iam_member.server:proposal:PROPOSED_ALTERNATIVE)