Operate Infrastructure

Boundary

• Work from files, plans, logs, and read-only commands before changing anything.
• Do not run apply, delete, destroy, or rollback until identity, exact resources, blast radius, and plan/diff/inventory are shown and the user confirms.
• If the task is deployment, rollout, rollback, or production apply, use deploying-infra.
• If the task is only shell scripts or generic command pipelines, use writing-shell.

Role behavior

• Write-capable: make minimal file changes and run safe validation. Stop before live mutation unless the user confirmed exact resources.
• Read-only: apply nothing; return proposed file changes, evidence, and validation commands.

Load references

Load every matching reference: