tools/

admission-pipeline orchestrates issue #55's admission chain end to end: one command that notices when the pinned AWS provider or the pinned CloudFormation Registry schema moved, regenerates every derived artifact from source, verifies the result builds and tests green, writes a markdown report, and - with -pr - turns that into a pull request.

cloudcontrol-probe is a manual smoke test for internal/live/cloudcontrol, not shipped in any binary.

Command corpus-fetch materializes the external configurations live/corpus-manifest.json pins, so that tools/corpus-gen can measure them.

Command corpus-gen measures which live-path refusals actually fire on real OpenTofu configurations, and writes the ranked table as a generated artifact.

estate-gen generates live/e2e/estates/<cohort>/, the minimal-HCL per-cohort verification estate internal/live/flocitest.FixtureDirs picks up through the #48 union pin (issue #56).

Command estate-plan turns a refusal-probe sweep into an ordered work plan, one estate at a time.

find-dep-upgrades is a utility for finding the available upgrades for our Go module dependencies and proposing an order to upgrade them in so that as far as possible each upgrade touches only one upstream module at a time.

find-pkg-importer is a utility for finding which packages in our dependency graph import a given package path.

floci-capability-gen (re)generates live/floci-capabilities.json's entry for one floci image digest by probing a running instance of that image, closing the loop live/flocicap.go's package doc names: a bumped floci image should never have to wait for the next batch of e2e work to rediscover, by trial and error, which services and types it still does not implement.

gauntlet runs choudoufu's real-estate test suite against stock OpenTofu and renders everything the project says about its own progress from the result.

Command harness-gen renders live/HARNESS.md's generated spans from the burndown and assumptions registries in internal/live/harness.

iamref-gen reads AWS's Service Authorization Reference - published as JSON at servicereference.us-east-1.amazonaws.com - and writes live/iam-reference.json: per service, whether the tagging action this fork performs can be scoped by aws:ResourceTag and aws:TagKeys.

importdocs-gen generates live/import-grammar.json, one row per TF resource type parsed from the provider's own Import documentation (issue #52, dispatched from #55: the source that kills both the 114 hand-authored composite separators and the manual "rule-1" check the Lambda pilot paid by hand - see internal/live/identity/table.go's "Registry-ratified" comment for what that check found by hand, aws_lambda_alias and aws_lambda_layer_version_permission).

Command importer-probe asks a real provider plugin, over the plugin protocol, whether a resource type has an Importer at all.

Command limits-gen writes live/LIMITATIONS.md's per-refusal content from the registries that define the refusals, instead of from someone's memory of them.

Package main (former2.go): the second of issue #52's two authoritative sources, iann0036/former2 - a community-maintained CloudFormation generator that, per resource type it supports, already carries both the CFN type it emits and the Terraform type the same live object would import as.

merge-guard detects silent content loss in merge commits (issue #92).

protobuf-compile is a helper tool for running protoc against all of the .proto files in this repository using specific versions of protoc and protoc-gen-go, to ensure consistent results across all development environments.

Command refusal-probe measures the corpus's refusals without regenerating it, and diffs two such measurements.

registry-gen generates live/registry.json, the machine-derived roster of per-type signals from the CloudFormation Registry schema bundle (issue #42, the registry side of #40).

row-gen turns registry evidence into pastable, ratifiable admission rows (issue #44, #40's phase 4, #37's increment 2).

selected-go-version determines which version of Go is currently selected in the go.mod file.

The Contract render (issue #54): live/COVERAGE.md's "The admitted set" section both counts and enumerates the admitted types.

tagverbs-gen generates live/tag-verbs.json, the machine-derived join that replaces internal/live/foreign/classify.go's hand-written ec2Types table (issue #52, the botocore side): which AWS API operation tags a resource of a given service, extracted from botocore's own service models rather than stated by hand.

wo-sweep is issue #126's measurement probe, and nothing more: it sizes the attribute-level record-less-residue class across the admitted types.