# Skill: Infrastructure as Code

> **Atelier source:** `domains/infrastructure-as-code/` (first-principles +
> terraform, opentofu, state, modules)
> **Core principles:** C1 Correctness, C5 Reversibility, C8 Economy
> **BA.A mapping:** static asset
> **Consumer:** read this before authoring a contract that declares
> infrastructure.

## First Principles (citizen-developer-relevant subset)

- **Configuration is declarative, not scripted.** The contract declares
  what; Terraform reconciles how. No imperative scripts in the contract.
- **Provider versions are pinned, never `latest`.** The contract's
  infrastructure map may pin module versions (semver); the platform pins
  provider versions.
- **State is remote with locking; never committed.** Nova manages state
  in S3 + DynamoDB; the citizen developer never touches state files.
- **`plan` is reviewed before every `apply`.** The confidence signal
  gates the apply; the HITL gate (qa/prod/dr) requires human attestation
  before the apply proceeds.
- **No secrets in HCL; secrets via providers/stores.** Secrets live in
  SSM SecureString / Secrets Manager, not in the contract or HCL.

## Agent-Checklist Triggers (§ Infrastructure as Code)

- Configuration is declarative, not scripted (P1)
- Provider versions are pinned, never `latest` (P5)
- State is remote with locking; never committed (P3, P8)
- `plan` is reviewed before every `apply` (P4)
- No secrets in HCL; secrets via providers/stores (P10)

## How Nova Uses This

Nova IS the infrastructure-as-code platform. The citizen developer
declares intent in the contract; Nova's adapter (stateless assembler,
v1.11) translates to Terraform modules; the pipeline runs plan → policy →
confidence → (HITL) → apply. The IaC skill tells you what the platform
expects from your contract: declarative inputs (not scripts), pinned
versions (not `latest`), no secrets in the contract (secrets via SSM),
and acceptance that the platform owns state + the apply path.