Plans and hand-back
Bring the change you already have, whether a Terraform plan, a CloudFormation change set, AWS API calls, or AWS CLI commands, and get back a verdict bound to that exact change.
Four ways in, one change model
Your agent does not have to translate its plan into Emfirge’s format. emfirge_plan_verdict accepts the change in the form it already exists, normalizes it into the same typed changes the branch uses, and returns the verdict.
Because every format becomes the same change model, an equivalent change gets the same verdict whichever way it arrives. This is enforced by tests for Terraform, CloudFormation, AWS API, and AWS CLI inputs.
| format | What to pass as plan |
|---|---|
| terraform | The JSON from terraform show -json <planfile> |
| cloudformation | A change-set document |
| aws-api | A list of AWS API calls |
| aws-cli | A list of AWS CLI command strings |
Check a plan
Emfirge never runs the plan. It applies the changes to the branch model, evaluates every lens, and reports which changes were applied, rejected, unmodeled, or had unknown fields.
emfirge_plan_verdict({
branch_id: "<branch_id>",
format: "aws-cli",
plan: [
"aws ec2 authorize-security-group-ingress --group-id <sg_id> --protocol tcp --port 22 --cidr 0.0.0.0/0"
]
})
Unknown or unsupported values never pass silently. Changes Emfirge cannot model are listed and make the verdict stricter, and a change against a snapshot from a different region is rejected.
The hand-back
When a branch or plan is approved, the hand-back gives you the exact change to apply. For a branch, emfirge_branch_handback returns the exact AWS API calls. For a plan, the hand-back is the exact input you submitted.
Each hand-back is bound by input_sha256, the base snapshot, the branch revision, and a verdict_id. Emfirge never applies it: you or your pipeline do.
emfirge_branch_handback({ branch_id: "<branch_id>", verify: true })
Verify before you apply
With verify: true, the backend recomputes the calls and checks that nothing changed since the verdict. A mismatch is reported with a reason instead of a stale approval.
| Reason | Meaning |
|---|---|
| input_hash_mismatch | The calls are not the ones that were judged |
| base_snapshot_changed | The branch is now based on a different snapshot |
| branch_revision_changed | The branch changed after the verdict |
| verdict_changed | Re-evaluating produced a different verdict |
Changes that cannot be expressed as AWS API calls come back as gaps (unmappable_changes), never as partial calls. Hand-back calls are tested by applying them to a simulated AWS (Moto) and re-reading the result.