Gated applies for Terraform and OpenTofu, with nothing held hostage.

sluice runs terragucci for your repository: a grouped plan note on every pull request, applies in waves on merge, a gate that stops a destroying wave until a person approves it, and a nightly drift run that keeps one issue updated. No CI configuration in your repository.

Approvals are records on your own chant/lifecycle branch. Plans and reports land in a bucket, yours or ours. State stays in your backend. Every run executes in a disposable Firecracker microVM that holds a five-minute OIDC token for its own identity and nothing else. The AI writes the plan; something else holds the keys.