Both loadouts work with OpenTofu and Terraform alike. One gates module changes: tofu test with mock_provider, a committed lock file used read-only, Checkov with no soft-fail, and a root example with OpenTofu's native state and plan encryption enforced. The other keeps agents to planning: apply, destroy and state commands are blocked by a hook, and a plan summary fails on deletes and replaces.
Every one installs for Claude Code, Codex CLI, Cursor, Gemini CLI, Antigravity CLI and GitHub Copilot unless its card says otherwise.
Agents write OpenTofu modules that pass a local gate: fmt, a read-only lock file, tofu test with a mocked AWS provider, and Checkov with reasoned skips only.
Let agents write Terraform and produce plans but never apply: a guard hook for apply, destroy and state changes, a plan summary that flags deletes, pinned providers.
Looking for something narrower? Search within OpenTofu or filter everything.