‹ Thread {{ crumbTitle }} {{ crumbId }} {{ crumbState }}

Est. monthly

${{ monthly }}

Traffic flows top to bottom; every tier below the edge is private and reachable only from the tier above it.

Threat score

{{ threatAvg }} / 10 · {{ threatBand }} · {{ threatAbove }} items at 6 or above

Per-item risk, scored the way the OWASP threat modelling process asks for it: decompose the system, classify each item's threats with STRIDE, then rank by damage and exploitability. Lower is safer. Enabling a control moves the number, so the score argues back.

layeritemstride classeswhat drives the scorescore

Module dependency view — what each module consumes and what consumes it, derived from the composed HCL itself, so the graph and the code cannot drift apart.

modulesourcedepends onfeedssize

layers this turn

· {{ layerNote }}

next The agent adds a layer here only when a decision creates one — e.g. picking multi-region emits a Failover layer. Layers are data, not layout.

main.tf {{ hclFilesNote }}

{{ hclText }}

# {{ hclNote }}

# composed from your registry: {{ registryGlob }}
# every value below traces to a decision or a live API lookup

locals {
  name_prefix = "{{ namePrefix }}"   # {{ patternLabel }}
  tags = {
    HelixProjectId = "{{ helixId }}"   # maps this stack back to the Helix project
    Application = "{{ appName }}"
    Environment = "prod"
    CostCenter  = "CC-4471"
    Owner       = "platform-oncall"
    ManagedBy   = "terraform/helm"
    DataClass   = "{{ dataClass }}"
  }
}

module "{{ netName }}" {
  source  = "{{ netSource }}"
  version = "{{ netVersion }}"
  name    = "${local.name_prefix}-net"
  {{ netArg1Key }} = {{ netArg1 }}  # {{ netArg1Note }}
  {{ netArg2Key }} = {{ netArg2 }}
  tags = local.tags
}

module "{{ primaryModuleName }}" {
  source  = "{{ primaryModuleSource }}"
  version = "{{ primaryModuleVersion }}"
  name    = "${local.name_prefix}-{{ primaryAbbr }}"
  {{ primaryKey }} = {{ primaryValue }}
  tags = local.tags
}

module "{{ kmsName }}" {
  source  = "{{ kmsSource }}"
  version = "{{ kmsVersion }}"
  count   = {{ kmsCount }}
  description = "Customer key for {{ appName }} at rest"
  {{ keyArg1Key }} = {{ keyArg1 }}
  {{ keyArg2Key }} = {{ keyArg2 }}
  tags = local.tags
}

Resources

Attribute-level changes

{{ a.before }} → {{ a.after }} {{ a.risk }}

What this request will cost

tools/cost.py · reviewer "cost" · unavailable is not a pass

{{ c.label }} ${{ c.amount }}

line itemquantityratemonthly

What drives this bill

Who this is billed to

Evaluated against acme/policy@v14 — OPA bundle run with conftest test against the plan JSON, re-run on every emit. Enforcement level decides whether an exception is even possible.

{{ relaxTotal }} available without touching a hard rule

How the workaround works

Advisory findings are informational. Soft-mandatory findings accept a time-boxed exception: justification, approver group, expiry, and a linked ticket, all written into the run record and re-checked on expiry. Hard-mandatory findings have no exception path at all — the agent instead offers the smallest plan change that clears them.

Questions people actually ask

If your question is not here, ask it in the thread — the agent answers questions about its own reasoning as readily as it answers questions about infrastructure.

What the agent enforces, and who enforces it

Best practice only means something if something checks it. Every line below names the reviewer, policy rule or tool that would catch it — none of this is advice you have to remember.

Onboard a project

A Helix project the console does not know yet: say which account it lands in, its environments and its data class, and its service.yaml goes up as a draft pull request under your name. Requests for it can be raised once that is merged.

Project

{{ onboardNote }}

Drafts

Compare AWS architectures Review existing Terraform

Requests you started and have not raised. Newest first; open one to carry on, discard what you will not raise. Tick several to discard them together.

Architects' queue

Priority, then what is on you, then the last change. Unassigned requests are on every architect until someone takes one.

Background work{{ jobsWorkers }}

A queued job knows its place in line. Reviewer panels and estate refreshes run here, two at a time.

‹ Home

Describe what you need. The agent writes the Terraform.

Compare AWS architecture options Already have Terraform? Review an existing plan

One or two sentences is enough: what it is, what it is for, anything it must survive. The agent drafts every resource and asks only what it cannot infer.

Helix project

{{ cc.id }} {{ cc.kind }} {{ cc.name }} Remove

Asked first: it decides tagging, backend and who approves. Type a name; every Helix project autocompletes.

Priority

⌘K

{{ m.shape }} → {{ m.module }} {{ m.confidence }}

2 shapes unresolved — the agent asks about them below instead of guessing.

try

Start from a pattern

1 · drafts

Every resource from the reviewed catalogue, named to the standard, tagged, priced. Usually under a minute.

2 · asks

Only what changes the shape of the plan. Two or three questions is normal.

3 · reviews

Automated reviewers, then an architect. Nothing applies without a named human.

{{ a.headline }} high

Background work

Nothing running. Reviewer panels and estate refreshes queue here.

This week

Requests

Every request, newest change first within its priority. A chip carries the count it will show; press it again to clear it.

{{ bulkSelectLabel }} {{ bulkCount }} clear

{{ r.stage }} {{ r.when }} Withdraw Delete

Access · how each thing is reached

Dry run · in the local emulator, never an account

Estate

Every taggable resource each account holds, from a read-only scout. Governed means it carries all the mandatory tags; eligible for preflight means the catalogue has a matching module. Tags do not establish Terraform ownership, so adoption stays held until account, region, repository and state ownership are verified.

spend, last 30 days

Accounts and access {{ acctAccessLine }} {{ acctAccessHint }}

alias (lower-case, hyphens; it names state paths)

{{ ar.handoutText }}

Layout · drawn from the scan · {{ estateLayoutRegion }}

Networks

{{ v.name }} {{ v.cidr }} · {{ v.id }}

Load balancers and DNS

{{ z.name }} · {{ z.records }} records{{ z.priv }}

Compute · ECS clusters

Registries: {{ estateRegistries }}

Data stores and certificates

Certificates: {{ estateCerts }}

drawing…

Members

{{ kg.kind }} · {{ kg.names }}

How they are linked

Cross-environment links {{ estateCrossLine }} stacks above keep environments apart; these are the links that cross

Linked to nothing the scan can see: {{ estateAlone }}

resourceservicemanaged bytags

{{ r.type }} · {{ r.region }}

Settings

Three scopes. Org-locked settings are the platform's contract and no project can override them. Project settings are yours to set. Inherited values come from the Helix project record and change there, not here.

architect & admin only

Every change here is versioned and shows up in History as a settings event. Changing a project setting re-emits the surface and re-runs the reviewers, so you see the consequence before you sign anything off.

Where the numbers come from

The model does not invent CIDRs, RTOs, node counts or control mappings. Each is a deterministic tool call, and every figure in this surface is traceable to one — which is what makes a reviewer able to argue with it.

toolreturnsappears incalled

What forces a replacement

Changing {{ forceRepl }} forces destroy-then-create. The agent flags these before you answer a decision, not after the plan.

Standing protections

The agent has no destroy permission

Its execution role carries an explicit deny on every Delete* action, and the runner rejects any plan containing a destroy. A teardown is a human's job, run from the CLI with this analysis as the runbook.

Reviews

Exceptions

Needs a look {{ reviewLookCount }}

{{ r.name }} · {{ r.summary }}

Cleared {{ reviewClearedCount }}{{ reviewPlanLine }}

{{ a.step }} · {{ a.short }}

History

Every event on this request, newest first, read from the record and the live repo.

What the front end has to fetch

Every dynamic value in this surface, the call behind it, and how long it may be cached. Nothing on this page is hard-coded except copy.

fieldbackend endpointupstreamcache

Streaming channel

POST /v1/sessions/:id/messages → SSE of surface patches. The client applies JSON-Patch ops to the current surface, so a decision answer never reloads the page.

Auth & blast radius

Read calls use a scoped read-only role per account (sts:AssumeRole, 15 min). Apply runs server-side in a job runner — the browser never holds AWS credentials.

The agent emits this, not HTML

An A2UI-style component tree over the agent-to-UI channel. The client owns a renderer registry — the model may only pick from registered component types and bind them to data paths, so it can restructure the page (add a layer, add a decision) without shipping markup.

surface.v{{ surfaceVersion }}.json a2ui/0.3 · streaming

{
  "surface": "terraform.build",
  "version": {{ surfaceVersion }},
  "layers": {{ specLayers }},
  "nodes": [
    { "type": "DecisionCard",
      "id": "{{ specDecisionId }}",
      "bind": "$.decisions.{{ specDecisionId }}",
      "emits": "answer" },
    { "type": "LayerStack",
      "bind": "$.blueprint.layers[*]",
      "child": "ResourceTile",
      "source": "aws.live" },
    { "type": "PolicyList",
      "bind": "$.policy.findings[*]",
      "actions": ["fix", "request_exception"] },
    { "type": "ApplyGate",
      "bind": "$.readiness",
      "blocked_by": {{ specBlockers }} }
  ]
}

Registry, not free-form

11 component types: DecisionCard, ChipSet, LayerStack, ResourceTile, DiffList, CostBars, PolicyList, ApplyGate, CodePane, NamingPicker, AssumptionList. Unknown type → the client drops the node and logs it.

Why it survives

Layout stays with the design system; the model only chooses which registered pieces appear and what they bind to. New infra pattern → new layer data, no front-end release.

Guardrail

The apply gate is client-enforced and re-checked server-side. A model-emitted spec can never mark itself ready.

Describe the infrastructure. The agent writes the Terraform.

{{ blueprintTitle }}