Terraform vs Crossplane

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round to Terraform
   Terraform~partialprobed3/10

   Terraform has no llms.txt or docs.md agent-readable file (confirmed 404 by probes), so the specific artifact requested by the story is absent. However, HashiCorp does provide an official MCP server that gives AI models real-time access to Terraform provider documentation, modules, and policies, which is an agent-oriented documentation access mechanism, giving partial credit. Missing for 10: an actual llms.txt/docs.md file, and any evidence the MCP server is a drop-in substitute for llms.txt-style doc consumption.

   • [probe] “PROBE llms.txt: HTTP 404 at https://developer.hashicorp.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://developer.hashicorp.com/terraform/docs.md”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”

   proof ↗⚑ flag

   Crossplane—none0/10

   No evidence of an llms.txt file, agent-oriented documentation format, or any mention of AI-agent-consumable docs; docs-16 mentions AI systems acting on APIs but does not describe agent-oriented documentation discovery. missing for 10: llms.txt file or equivalent, agent-facing documentation format, any explicit reference to AI agents consuming docs directly.

   ⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Terraform
   Terraform✓fullprobed9/10

   Terraform CLI is fully scriptable/headless: non-interactive apply via -auto-approve, machine-readable JSON output (-json flag on show, plan, apply), plan files for two-step CI pipelines, and Terraform tests for CI validation — all well documented and widely used in CI/CD pipelines. missing for 10: independent hands-on report of a specific CI pipeline configuration (e.g., GitHub Actions) rather than just docs.

   • [claimed-docs] “-auto-approve - Skips interactive approval of the plan before applying”
   • [claimed-docs] “You can pass the `-auto-approve` option to instruct Terraform to apply the plan without asking for confirmation.”
   • [claimed-docs] “the -json flag outputs a stream of JSON UI messages”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “You can use the optional `-out=FILE` option to save the generated plan to a file on disk, which you can later execute by passing the file to…”
   • [claimed-docs] “Terraform tests let authors validate that module configuration updates do not introduce breaking changes. Tests run against test-specific, s…”
   • [claimed-docs] “Terraform v1.7.0 introduced the ability to mock data returned by the providers during a `terraform test` execution.”
   • [probe] “official CLI documented at https://developer.hashicorp.com/terraform/cli”

   proof ↗⚑ flag

   Crossplane~partialprobed6/10

   Crossplane is fundamentally a Kubernetes control-plane operator: everything is driven by declarative YAML/CRDs reconciled by controllers, which is inherently automatable via kubectl/GitOps pipelines (ArgoCD/Flux) as community evidence confirms, and the CLI itself is keyless and scriptable. However the probe shows every real operation requires a live Kubernetes cluster with Crossplane installed — there's no standalone local plan/apply loop like other CLI-first tools, meaning 'headless CI' usage requires provisioning/maintaining a cluster as a CI dependency rather than a lightweight headless binary. missing for 10: evidence of a documented CI-specific workflow/example (e.g. official GitHub Action or CI recipe), confirmation of non-interactive apply without cluster bootstrap overhead, and independent hands-on reports of running Crossplane in CI pipelines.

   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”
   • [probe] “official CLI documented at https://docs.crossplane.io/cli/latest/”
   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [community] “Many folks are using GitOps with Flux/ArgoCD to deploy their k8s apps but they can't use Terraform in the same workflow. How does Crossplane…”
   • [community] “Terraform offers small teams a common language for controlling their infrastructure...Crossplane appears to have a clear yaml syntax (easy e…”
   • [claimed-docs] “If your software ever drifts from your desired state, the control plane automatically corrects the drift.”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Terraform
   Terraform✓fullprobed8/10

   Terraform is not itself an agent but an IaC platform, and HashiCorp documents an official Terraform MCP server that gives AI models real-time access to provider docs, modules, and policies, confirmed by both docs and a probe hit. missing for 10: independent/hands-on third-party verification of the MCP server in production use and details on its transport/auth setup.

   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “enhances AI models with real-time access to current Terraform provider documentation, modules, and policies from the Terraform registry”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”
   • [probe] “official MCP server documented at https://developer.hashicorp.com/terraform/mcp-server”

   proof ↗⚑ flag

   Crossplane—none0/10

   Crossplane is a Kubernetes control-plane framework, not an AI agent, so publishing an official MCP server is a plausible ecosystem capability, but no evidence in the pack mentions an MCP server, MCP integration, or agent connectivity of any kind—only marketing language about 'AI systems' acting on APIs, which is not an MCP server claim.

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Terraform
   Terraform✓fullprobed8/10

   Terraform ships an official CLI with extensive documented commands (plan, apply, show, import, state, test) plus machine-readable JSON output modes (-json flags) that make it scriptable/consumable by AI agents, and HashiCorp also documents an official MCP server for AI integration. missing for 10: independent hands-on confirmation of AI-native agentic CLI usage patterns beyond docs, and no evidence of AI-specific CLI enhancements (e.g., natural-language CLI mode) beyond the JSON output and MCP server.

   • [probe] “official CLI documented at https://developer.hashicorp.com/terraform/cli”
   • [claimed-docs] “Add the `-json` command-line flag to generate machine-readable output.”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “the `-json` flag outputs a stream of JSON UI messages. The ouptut messages appear one per line so that you can process the messages”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [probe] “official MCP server documented at https://developer.hashicorp.com/terraform/mcp-server”

   proof ↗⚑ flag

   Crossplane~partialprobed6/10

   Crossplane ships an official CLI (docs and hands-on probe confirm install via brew and working `crossplane version --client`) supporting building/testing/rendering Compositions and managing packages, but it is not framed or evidenced as an AI-native/agentic interface (no MCP integration, no agent-friendly output modes, no natural-language or automation-specific tooling beyond generic CLI usage). missing for 10: explicit AI-native design/marketing for the CLI itself, evidence of agent-friendly structured output or automation hooks, and independent corroboration beyond one hands-on probe.

   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [claimed-docs] “troubleshooting Crossplane Compositions, Composite Resources and Managed Resources”
   • [claimed-docs] “building, installing, updating and pushing Crossplane Packages”
   • [probe] “official CLI documented at https://docs.crossplane.io/cli/latest/”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Crossplane
   Terraform~partialprobed6/10

   Terraform exposes machine-readable interfaces AI agents could drive: JSON output from plan/apply/show, a documented CLI, and an official MCP server built specifically to give AI models access to Terraform docs/modules/policies (terraform-docs-10/23/36/40, terraform-probe-4). However, probes confirm there is no discoverable OpenAPI/REST API spec or llms.txt (terraform-probe-1/2/3), so the 'documented public API' is really CLI+JSON+MCP rather than a conventional API surface. Missing for 10: a formal OpenAPI/REST API specification, an llms.txt or machine-readable docs index, and independent confirmation that AI agents successfully drive Terraform end-to-end via these interfaces.

   • [claimed-docs] “the -json flag outputs a stream of JSON UI messages”
   • [claimed-docs] “Add the `-json` command-line flag to generate machine-readable output.”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “the `-json` flag outputs a stream of JSON UI messages. The ouptut messages appear one per line so that you can process the messages”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “enhances AI models with real-time access to current Terraform provider documentation, modules, and policies from the Terraform registry”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”
   • [probe] “PROBE llms.txt: HTTP 404 at https://developer.hashicorp.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://developer.hashicorp.com/terraform/docs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.hashicorp.com/openapi.json, https://developer.hashicorp.com/swagger.json, https://…”
   • [probe] “official MCP server documented at https://developer.hashicorp.com/terraform/mcp-server”
   • [probe] “official CLI documented at https://developer.hashicorp.com/terraform/cli”

   proof ↗⚑ flag

   Crossplane✓fullprobed7/10

   Crossplane explicitly documents that it exposes 'declarative APIs that humans, automation, and AI systems can safely act on' (docs-16), and its architecture is built on the Kubernetes API server extended via CRDs/Managed Resources (docs-3, docs-13, docs-20, docs-21), which forms a standard, machine-readable, documented API surface. This is reinforced by an official CLI (probe-1, probe-2) for interacting with the control plane programmatically. missing for 10: independent/hands-on evidence of an AI agent actually driving Crossplane via the API, and more detail on API schemas/authentication for agentic use beyond marketing copy.

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”
   • [claimed-docs] “It lets you design the APIs and abstractions that your users use to interact with your control planes.”
   • [claimed-docs] “there’s an RDS instance MR that extends Kubernetes with the ability to manage AWS RDS instances.”
   • [claimed-docs] “Composite Resource Definitions - Define schemas for composite resources”
   • [probe] “official CLI documented at https://docs.crossplane.io/cli/latest/”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Crossplane
   Terraform—none0/10

   No evidence that Terraform (or its MCP server) supports issuing scoped/least-privilege API credentials for an agent; credential/auth scoping is typically delegated to cloud provider IAM, and nothing in the docs describes Terraform generating or managing agent-specific least-privilege credentials.

   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “enhances AI models with real-time access to current Terraform provider documentation, modules, and policies from the Terraform registry”

   proof ↗⚑ flag

   Crossplane~partialclaimed4/10

   Crossplane's own marketing claims it exposes 'declarative APIs that humans, automation, and AI systems can safely act on' and leverages Kubernetes RBAC for security, which implies a path to scoped, least-privilege access control for agentic consumers. However, there is no concrete documentation of an agent-specific credential-issuance mechanism (e.g., token minting, scoped API keys, or short-lived credentials tailored for AI agents) — it relies on generic Kubernetes RBAC rather than a purpose-built agent credentialing feature. Missing for 10: explicit agent-credential issuance workflow, scoping granularity examples, and independent verification that RBAC is actually used this way in practice.

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”
   • [claimed-docs] “extending its battle hardened reliability and security features like Role Based Access Control (RBAC) to orchestrate everything - not just c…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to Terraform
   Terraform~partialclaimed4/10

   Evidence shows Terraform exposes a plugin SDK for writing custom providers (terraform-docs-29) and machine-readable JSON output for programmatic consumption (terraform-docs-4/8/18/22/34), plus an official MCP server for AI models (terraform-docs-10/23/36/40), but there is no documented official SDK (e.g., CDK for Terraform or a language-native SDK) that AI-native builders could target directly. missing for 10: explicit official SDK documentation (e.g., CDKTF), examples of programmatic/AI-driven SDK usage, independent hands-on confirmation of SDK reliability.

   • [claimed-docs] “You can also [write your own](/terraform/plugin).”
   • [claimed-docs] “terraform show -json shows a JSON representation of the plan, configuration, and current state”
   • [claimed-docs] “the -json flag outputs a stream of JSON UI messages”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”

   proof ↗⚑ flag

   Crossplane—none0/10

   Evidence describes Crossplane's function pipeline supporting multiple languages (YAML, KCL, Python, Go) and declarative APIs that 'AI systems can safely act on,' but there is no mention of an official SDK (e.g., function-sdk-go/python) or any AI-native developer tooling for building against Crossplane programmatically.

   ⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   Terraform—none0/10

   No evidence of webhook subscription capability for events in Terraform's core product; while Terraform Cloud has run notifications/webhooks in some contexts, nothing in this evidence pack documents a webhook subscription mechanism for AI-native event consumption. Terraform is fundamentally an IaC provisioning tool, so this axis could apply but is unevidenced.

   ⚑ flag

   Crossplane—none0/10

   No evidence anywhere in the pack of an event/webhook subscription mechanism for AI agents or other consumers; Crossplane's model is Kubernetes-native reconciliation/drift-correction, not webhook-based event push. This is a fair capability to ask of an infrastructure control plane, but nothing in the evidence documents it.

   ⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round drawn
   Terraform—none0/10

   Evidence only shows an MCP server that lets external AI models query Terraform docs/modules/policies for building configurations — this is agentic tool access, not Terraform itself generating insights or suggestions from a user's own infrastructure data. No documentation shows in-product AI analysis (e.g., cost/security recommendations, drift insights) surfaced to users.

   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “enhances AI models with real-time access to current Terraform provider documentation, modules, and policies from the Terraform registry”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”

   proof ↗⚑ flag

   Crossplane—none0/10

   Evidence only shows marketing language about exposing APIs that 'AI systems can safely act on' (crossplane-docs-16), which is about external agents calling Crossplane's API, not the product itself generating AI-driven insights or suggestions from data. No feature, dashboard, or docs describe AI-generated analysis, recommendations, or insights surfaced to users.

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”

   proof ↗⚑ flag

2. ai-native userSet up automations that run autonomously in the background

   weight 2 · round drawn
   Terraform~partialclaimed5/10

   Terraform's CLI supports scripted, non-interactive runs (-auto-approve, machine-readable -json output for plan/apply/show) that can be wired into external schedulers or CI/CD pipelines, and the MCP server exposes provider/module/policy context to AI agents for generating configs (terraform-docs-3, terraform-docs-17, terraform-docs-18, terraform-docs-22, terraform-docs-23/40). However, there is no evidence of a native scheduler, trigger, or always-on autonomous run loop within Terraform itself — automation depends on external orchestration (CI, HCP Terraform runs) not documented here. Missing for 10: native scheduling/trigger mechanism, evidence of unattended background execution loop, and independent confirmation of AI agents autonomously running plan/apply cycles.

   • [claimed-docs] “-auto-approve - Skips interactive approval of the plan before applying”
   • [claimed-docs] “You can pass the `-auto-approve` option to instruct Terraform to apply the plan without asking for confirmation.”
   • [claimed-docs] “Add the `-json` command-line flag to generate machine-readable output.”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”
   • [claimed-docs] “Policies are rules for Terraform runs that let you validate that Terraform plans comply with security rules and best practices.”

   proof ↗⚑ flag

   Crossplane~partialclaimed5/10

   Crossplane's control plane continuously reconciles desired state and self-corrects drift autonomously (crossplane-docs-18), and its declarative APIs are explicitly framed as actionable by automation/AI systems (crossplane-docs-16), which supports background autonomous operation of infrastructure. However, there is no evidence of AI-native 'automations' or agentic workflows being set up specifically for AI systems, scheduled/triggered agent tasks, or any AI-specific orchestration features beyond generic drift-correction and declarative reconciliation. missing for 10: explicit AI-agent-triggered automation examples, scheduling/triggers for autonomous AI tasks, evidence of AI systems actually driving Crossplane resources end-to-end, independent hands-on validation of autonomous background operation.

   • [claimed-docs] “If your software ever drifts from your desired state, the control plane automatically corrects the drift.”
   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”
   • [claimed-docs] “extending its battle hardened reliability and security features like Role Based Access Control (RBAC) to orchestrate everything - not just c…”

   proof ↗⚑ flag

3. ai-native userOperate the product with natural-language commands

   weight 2 · round to Terraform
   Terraform~partialprobed4/10

   Terraform's core interface remains HCL config files and explicit CLI commands (plan/apply/import), not natural language. The official MCP server gives AI models real-time access to provider docs, modules, and policies to help generate more accurate configurations, which is a step toward AI-native operation, but there is no evidence of a natural-language command interface for running Terraform actions directly. Missing for 10: a documented NL-to-command translation layer, evidence of AI agents actually driving terraform plan/apply via natural language, and independent corroboration of the MCP server enabling full operational control rather than just documentation lookup.

   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”
   • [probe] “official MCP server documented at https://developer.hashicorp.com/terraform/mcp-server”

   proof ↗⚑ flag

   Crossplane—none0/10

   Crossplane's interface is entirely declarative YAML/Compositions plus a CLI for build/test/push workflows; the closest hit is marketing copy saying APIs can be 'acted on' by AI systems, but that describes external consumers, not natural-language command input into Crossplane itself. No documentation, CLI feature, or probe shows any natural-language command interface. Missing for 10: any NL command parser, chat/agent interface, or evidence of accepting free-text instructions instead of declarative manifests.

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”
   • [claimed-docs] “With Crossplane you don’t have to write a controller. Instead you configure a pipeline of functions.”
   • [probe] “official CLI documented at https://docs.crossplane.io/cli/latest/”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   Terraform—none0/10

   The evidence pack shows standard static documentation pages and CLI references, but no interactive API reference or runnable code examples; probes explicitly confirm absence of machine-readable docs formats (llms.txt, docs.md, OpenAPI spec all 404).

   • [probe] “PROBE llms.txt: HTTP 404 at https://developer.hashicorp.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://developer.hashicorp.com/terraform/docs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.hashicorp.com/openapi.json, https://developer.hashicorp.com/swagger.json, https://…”

   proof ↗⚑ flag

   Crossplane—none0/10

   No evidence of an interactive API reference with runnable examples exists in the pack; documentation is described only as static pages and CLI docs, with no mention of a live/interactive reference or embedded runnable code snippets.

   ⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Terraform—none0/10

   Explicit probes for llms.txt, docs.md, and multiple OpenAPI/swagger endpoints all returned 404, and no evidence pack item references a downloadable OpenAPI or equivalent machine-readable API spec for Terraform.

   • [probe] “PROBE llms.txt: HTTP 404 at https://developer.hashicorp.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://developer.hashicorp.com/terraform/docs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.hashicorp.com/openapi.json, https://developer.hashicorp.com/swagger.json, https://…”

   proof ↗⚑ flag

   Crossplane—none0/10

   Crossplane's CRD-based schemas (crossplane-docs-13) imply an OpenAPI-compatible structure inherent to Kubernetes, but the evidence pack contains no explicit documentation or feature describing a downloadable OpenAPI or machine-readable API spec for Crossplane's Composite Resources or Providers. Missing for 10: explicit docs on exporting/downloading OpenAPI schema, CLI or API endpoint for spec retrieval, and any community/hands-on confirmation of this capability.

   • [claimed-docs] “Composite Resource Definitions - Define schemas for composite resources”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round to Terraform
   Terraform~partialclaimed6/10

   Terraform's built-in `terraform test` framework explicitly runs against test-specific, short-lived resources to avoid touching real infrastructure/state, and v1.7.0 added provider-response mocking so tests can run without any real cloud calls at all — a genuine sandbox mechanism. However, this is a general IaC testing feature, not something built or documented specifically for 'AI-native' agentic use, and there's no independent/hands-on evidence validating it in an AI-agent context. Missing for 10: explicit AI-agent-oriented sandbox tooling or workflow guidance, and independent corroboration that the test/mock framework reliably isolates AI-driven runs from production.

   • [claimed-docs] “Terraform tests let authors validate that module configuration updates do not introduce breaking changes. Tests run against test-specific, s…”
   • [claimed-docs] “Terraform v1.7.0 introduced the ability to mock data returned by the providers during a `terraform test` execution.”
   • [claimed-docs] “Terraform tests let authors validate that module configuration updates do not introduce breaking changes. Tests run against test-specific, s…”
   • [claimed-docs] “Terraform tests let authors validate that module configuration updates do not introduce breaking changes.”

   proof ↗⚑ flag

   Crossplane~partialprobed4/10

   Crossplane's CLI supports rendering/testing Composition Functions locally without needing a live Kubernetes cluster (crossplane-docs-7), which enables some local, production-safe testing. However, a probe shows that real plan/apply operations still require a running Kubernetes cluster with Crossplane installed, with no built-in local sandbox/preview loop for full resource provisioning — so isolating test workloads from production relies on the user provisioning a separate cluster/cloud account rather than a first-class sandbox feature. missing for 10: dedicated sandbox-mode or dry-run against real cloud providers, evidence of safe multi-tenant test isolation, and confirmation that render-only testing covers full MR/Composition behavior rather than just function outputs.

   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Terraform—none0/10

   While Terraform configurations support versioning (terraform-docs-1, terraform-docs-14) and providers/modules use semantic versioning via the registry (terraform-docs-11, terraform-docs-41), the evidence pack shows no documented API versioning scheme or deprecation policy for Terraform's APIs (e.g., Terraform Cloud API, provider protocol) — probes for openapi specs and machine-readable docs all 404 (terraform-probe-1, terraform-probe-2, terraform-probe-3). This axis applies to an infrastructure automation tool with APIs, but no evidence demonstrates a documented deprecation policy.

   • [probe] “PROBE llms.txt: HTTP 404 at https://developer.hashicorp.com/llms.txt”
   • [probe] “PROBE docs-md: HTTP 404 at https://developer.hashicorp.com/terraform/docs.md”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.hashicorp.com/openapi.json, https://developer.hashicorp.com/swagger.json, https://…”
   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry.”
   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry”

   proof ↗⚑ flag

   Crossplane—none0/10

   While Crossplane exposes CRD-based APIs and has a 'Composition Revisions' feature for managing changes, the evidence pack contains no documentation of a formal API versioning scheme or deprecation policy for its own APIs (e.g., CRD version graduation, deprecation timelines, migration guides). Missing for 10: explicit deprecation policy docs, CRD version stability guarantees, migration/upgrade guidance for deprecated APIs.

   ⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Terraform
   Terraform~partialprobed6/10

   Terraform's graph-based execution parallelizes non-dependent resource changes, and -auto-approve plus -json machine-readable output enable scripted, bulk plan/apply workflows across many resources, with an official MCP server for AI agent integration. However, evidence doesn't show a native 'bulk operation' primitive (e.g., bulk import/move across many items) beyond per-resource state/import commands. missing for 10: documented bulk import/bulk state-move across many resources in one command, independent hands-on evidence of AI agents driving large-scale bulk operations, and any explicit bulk-editing API beyond graph parallelization.

   • [github] “Terraform builds a graph of all your resources, and parallelizes the creation and modification of any non-dependent resources.”
   • [claimed-docs] “You can pass the `-auto-approve` option to instruct Terraform to apply the plan without asking for confirmation.”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “You can use the optional `-out=FILE` option to save the generated plan to a file on disk, which you can later execute by passing the file to…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [probe] “official MCP server documented at https://developer.hashicorp.com/terraform/mcp-server”

   proof ↗⚑ flag

   Crossplane—none0/10

   The evidence describes Crossplane's declarative APIs, Compositions, and controller-based reconciliation, but nothing in the pack documents or demonstrates bulk/batch operations across many resources at once (e.g., batch apply, multi-resource templating at scale, or AI-driven bulk actions).

   ⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round to Crossplane
   Terraform—none0/10

   The evidence shows Terraform's policy enforcement (Sentinel/OPA) validates plans against rules and its plan/apply workflow can be scripted, but there is no evidence of a built-in mechanism to define rules that automatically trigger actions in response to arbitrary events (e.g., event-driven automation, webhooks-to-action rules). Terraform relies on external CI/CD or HCP Terraform triggers, which aren't documented here.

   • [claimed-docs] “Policies are rules for Terraform runs that let you validate that Terraform plans comply with security rules and best practices.”
   • [claimed-docs] “View and override policy enforcement results in the workspace UI.”

   proof ↗⚑ flag

   Crossplane~partialclaimed6/10

   Crossplane's control-plane model is inherently reactive: it continuously watches Kubernetes resource state and automatically corrects drift, and its composition function pipelines process changes to composite resources as they occur, which functions as an implicit event-driven automation model. However, there is no evidence of an explicit rule-authoring interface (e.g., 'on event X do Y' triggers, webhooks, custom event sources) — the automation is confined to declarative reconciliation loops built into the resource model. Missing for 10: explicit event-trigger/rule definition mechanism beyond drift reconciliation, documentation of custom event sources or conditional trigger logic, and independent confirmation of this automation depth.

   • [claimed-docs] “If your software ever drifts from your desired state, the control plane automatically corrects the drift.”
   • [claimed-docs] “With Crossplane you don’t have to write a controller. Instead you configure a pipeline of functions.”
   • [claimed-docs] “There’s already a Crossplane managed resource for that.”
   • [claimed-docs] “Functions - Functions extend Crossplane with new ways to configure composition”

   proof ↗⚑ flag

3. ai-native userVersion, review, and roll back my automations

   weight 1 · round drawn
   Terraform~partialcommunity6/10

   Terraform configs are text files that can be versioned in git (terraform-docs-1/14/37), and `terraform plan`/`show -json` give strong review capabilities before apply (terraform-docs-2/15/26/39). However, there is no first-class 'rollback' command — reverting infrastructure requires reapplying an older config version or manual state manipulation via `terraform state` (terraform-docs-6/20), and HCP remote state storage is only recommended, not a rollback mechanism. Missing for 10: a documented native rollback/undo feature, and hands-on evidence of rollback workflows succeeding in practice.

   • [claimed-docs] “define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share”
   • [claimed-docs] “creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure”
   • [claimed-docs] “Terraform provides the terraform state command to perform basic modifications of the state using the CLI.”
   • [claimed-docs] “Terraform uses your workspace's state to map real world resources to your configuration, keep track of metadata, and to improve performance …”
   • [claimed-docs] “The `terraform show` command provides human-readable output from a state or plan file.”
   • [claimed-docs] “We recommend storing state in HCP Terraform or a remote backend to securely store state and collaborate with team members.”
   • [community] “Terraform has a feature that is critical for safely iterating infrastructure: execution plans. Execution plans show you what changes Terrafo…”

   proof ↗⚑ flag

   Crossplane~partialcommunity6/10

   Crossplane's Composition Revisions explicitly let you manage and track changes to Compositions, and its YAML-based Kubernetes resources are naturally committed to source control and managed via GitOps, as community members note ('clear yaml syntax... easy enough to commit to source control'). Drift correction also provides a form of automatic rollback to desired state. missing for 10: explicit documentation of a review/approval workflow (e.g., PR-gated promotion), and a clear step-by-step rollback procedure using Composition Revisions rather than just their existence.

   • [claimed-docs] “Composition Revisions - Manage changes to Compositions with revisions”
   • [claimed-docs] “If your software ever drifts from your desired state, the control plane automatically corrects the drift.”
   • [community] “Terraform offers small teams a common language for controlling their infrastructure...Crossplane appears to have a clear yaml syntax (easy e…”
   • [community] “Many folks are using GitOps with Flux/ArgoCD to deploy their k8s apps but they can't use Terraform in the same workflow. How does Crossplane…”

   proof ↗⚑ flag

Import

1. platform-engineerImport existing cloud resources under management and generate matching configuration code

   weight 3 · round to Terraform
   Terraform!disputedcontradicted4/10

   Docs confirm `terraform import` can bring existing resources into state (terraform-docs-5/19/32), but the evidence pack has no mention of the newer -generate-config-out feature that produces matching HCL, and a first-hand community report explicitly says there's no good built-in way to import resources created outside Terraform, having to resort to a third-party tool of uncertain maintenance status (terraform-comm-10). This directly contradicts the 'generate matching configuration code' part of the story. Missing for 10: first-party documentation of automatic config-code generation during import, and corroboration that it works reliably in practice.

   • [claimed-docs] “You can import an existing resource to state from the Terraform CLI.”
   • [claimed-docs] “This topic provides an overview of the Terraform commands that let you import existing infrastructure resources so that you can manage them …”
   • [claimed-docs] “import existing infrastructure resources so that you can manage them with Terraform”
   • [community] “I haven't found a good way to handle resources that were created outside TF... They don't exist in TF state or config so TF simply ignores t…”

   proof ↗⚑ flag

   Crossplane—none0/10

   No evidence in the pack shows a Crossplane feature for importing existing/unmanaged cloud resources or auto-generating matching Composition/Claim YAML; the docs cover installation, packages, and compositions but nothing about resource discovery or import tooling. missing for 10: an import/adopt command or workflow, generated MR/Composition code from existing infra, any docs or community reports of migrating pre-existing resources into Crossplane management.

   ⚑ flag

Licensing

1. devops-leadRely on an open license and open governance so the tool cannot be relicensed out from under my company

   weight 3 · round to Terraform
   Terraform!disputedcontradicted3/10

   Terraform is marketed as open (public registry, GitHub repo) but the evidence shows concrete counter-signals to the 'open governance that can't be relicensed' promise: HashiCorp requires a CLA that community members explicitly object to, and users report HashiCorp 'yanked the okta/mfa feature from OSS' calling it 'pretty hostile' — both indicating the vendor retains unilateral control over licensing/features rather than a neutral, foundation-governed open project. missing for 10: any first-party statement on license terms (e.g. MPL/BSL) or a governance body/foundation guaranteeing the license can't change, and independent confirmation that community contributions are protected from relicensing.

   • [community] “Love the tool, hate the fact that they still work with a CLA. If anyone at HashiCorp is reading this, could you guys consider changing to a …”
   • [community] “Particularly when they yanked the okta/mfa feature from OSS, that was pretty hostile.”
   • [community] “My attempts to submit Pull Requests for much wanted features (fully working documentation with new integration tests all passing) often took…”
   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry”

   proof ↗⚑ flag

   Crossplane—none0/10

   The evidence pack contains no mention of Crossplane's license (e.g., Apache 2.0) or its governance model (e.g., CNCF graduation, foundation stewardship) — nothing here addresses licensing-governance at all. missing for 10: license identification, governance/foundation structure, any statement on relicensing protection.

   ⚑ flag

Stability

1. developerRely on documented compatibility promises and upgrade guides between releases

   weight 2 · round drawn
   Terraform—none0/10

   The evidence pack contains no documentation about version compatibility guarantees, semantic versioning policy, or upgrade guides between Terraform releases; it only covers CLI commands, state management, testing, and the MCP server. This axis clearly applies to a widely-used infra-as-code tool, but no supporting citations exist here.

   ⚑ flag

   Crossplane—none0/10

   The evidence pack shows install/config docs, feature flags, and package management, but contains no explicit compatibility promises (e.g., API versioning policy) or dedicated upgrade/migration guides between Crossplane releases. This axis clearly applies to a platform like Crossplane, but no supporting evidence is present.

   ⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Crossplane
   Terraform~partialprobed5/10

   Terraform's CLI/JSON tooling (terraform plan/apply/show -json, machine-readable UI output, state and import commands) lets automation and AI agents drive nearly every core workflow without the UI, and Terraform Cloud exposes policy results in its workspace UI, implying an underlying API layer. However, there is no direct evidence of a documented, comprehensive REST/OpenAPI spec proving true UI/API parity, and probes for an OpenAPI schema and machine-readable docs all 404, suggesting the API surface for Terraform Cloud's UI-specific features (e.g., policy override, workspace management) isn't clearly documented for AI consumption. missing for 10: explicit Terraform Cloud/Enterprise API docs proving 1:1 parity with UI actions, a discoverable OpenAPI/schema for AI tooling, and confirmation that UI-only actions (like policy overrides) are also API-accessible.

   • [claimed-docs] “terraform show -json shows a JSON representation of the plan, configuration, and current state”
   • [claimed-docs] “the -json flag outputs a stream of JSON UI messages”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “View and override policy enforcement results in the workspace UI.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.hashicorp.com/openapi.json, https://developer.hashicorp.com/swagger.json, https://…”
   • [probe] “PROBE llms.txt: HTTP 404 at https://developer.hashicorp.com/llms.txt”

   proof ↗⚑ flag

   Crossplane✓fullclaimed7/10

   Crossplane is fundamentally a Kubernetes control-plane extension: all functionality (Providers, Compositions, Functions, Managed Resources) is exposed as declarative Kubernetes API objects (CRDs) manipulated via kubectl/API, with docs explicitly framing it as exposing 'declarative APIs that humans, automation, and AI systems can safely act on' and letting users 'design the APIs and abstractions' for their control planes — there is no separate UI gating capability. Missing for 10: no evidence pack mention of any Crossplane-native UI/console to explicitly confirm parity claims, and no independent/hands-on corroboration of full UI-API equivalence.

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”
   • [claimed-docs] “It lets you design the APIs and abstractions that your users use to interact with your control planes.”
   • [claimed-docs] “Extend Kubernetes to manage any resource anywhere”
   • [claimed-docs] “Composite Resource Definitions - Define schemas for composite resources”
   • [claimed-docs] “Providers - Providers connect Crossplane to external APIs”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Terraform
   Terraform~partialcommunity6/10

   Terraform's core artifacts are open by design: configurations are plain human-readable HCL files that users own, version, and share (terraform-docs-1/14/37), and state/plan data can be exported to machine-readable JSON via `terraform show -json` or manipulated via `terraform state` commands (terraform-docs-4/6/18/26/39), enabling a user to walk away with all their data in open formats. However there's no explicit 'export everything and migrate away' workflow or tooling documented, and community evidence notes friction around state portability (e.g., resources outside TF state being ignored, terraform-comm-10) and remote/Cloud-hosted state recommendations (terraform-docs-33) that could complicate a clean exit if using HCP Terraform. Missing for 10: an explicit data-export/migration guide, independent confirmation of a smooth 'leave the platform' path, and clarity on exporting HCP Terraform-hosted state without vendor dependency.

   • [claimed-docs] “define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share”
   • [claimed-docs] “HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration …”
   • [claimed-docs] “terraform show -json shows a JSON representation of the plan, configuration, and current state”
   • [claimed-docs] “Terraform provides the terraform state command to perform basic modifications of the state using the CLI.”
   • [claimed-docs] “Add the `-json` command-line flag to generate machine-readable output.”
   • [claimed-docs] “The `terraform show` command provides human-readable output from a state or plan file.”
   • [claimed-docs] “We recommend storing state in HCP Terraform or a remote backend to securely store state and collaborate with team members.”
   • [community] “I haven't found a good way to handle resources that were created outside TF... They don't exist in TF state or config so TF simply ignores t…”

   proof ↗⚑ flag

   Crossplane~partialclaimed5/10

   Crossplane's resources (Compositions, Configurations, Managed Resources) are defined as plain YAML/KCL/etc. stored in Kubernetes, which is inherently portable and inspectable, and packages are designed to be portable across clusters (crossplane-docs-11, crossplane-docs-2). However there is no explicit documented 'export all data' feature or bulk-export/migration tool, and no evidence addressing exporting live state or leaving the platform cleanly. missing for 10: explicit data-export/backup tooling, documentation of exporting full state (not just config) in open formats, and any evidence of migration/exit workflow.

   • [claimed-docs] “Functions allow you to write your configuration in multiple languages, including YAML, KCL, Python, and Go.”
   • [claimed-docs] “Configurations - Portable packages of Crossplane resources”
   • [claimed-docs] “Composite Resource Definitions - Define schemas for composite resources”
   • [claimed-docs] “Composition Revisions - Manage changes to Compositions with revisions”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Terraform
   Terraform~partialcommunity4/10

   Terraform's source is publicly hosted on GitHub (terraform-gh-1), which lets an AI-native user read the code, and community discussion references a CLA-based open-source contribution model (terraform-comm-4). However, the evidence never states or links an explicit open-source license (e.g. MPL/BUSL identifier) for the repo, and community commentary notes HashiCorp "yanked" a feature from OSS (terraform-comm-13), suggesting the openness of the codebase is not unconditional. Missing for 10: explicit license documentation/SPDX reference, confirmation the full CLI source (vs. only some components) remains under an OSI-approved license, and resolution of the OSS-feature-removal concern.

   • [github] “Terraform builds a graph of all your resources, and parallelizes the creation and modification of any non-dependent resources.”
   • [community] “Love the tool, hate the fact that they still work with a CLA. If anyone at HashiCorp is reading this, could you guys consider changing to a …”
   • [community] “Particularly when they yanked the okta/mfa feature from OSS, that was pretty hostile.”

   proof ↗⚑ flag

   Crossplane—none0/10

   No evidence pack item mentions Crossplane's source code license, GitHub repository, or open-source licensing terms (e.g., Apache 2.0) — the pack covers only product docs, community discussion, and CLI probes. Missing for 10: license file/declaration, repository link, any statement about open-source status or license type.

   ⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Crossplane
   Terraform✓fullcommunity8/10

   Terraform CLI itself is open-source, self-hostable software that runs locally without requiring HashiCorp's cloud, and evidence confirms open registry, self-authored providers, and CLI-only workflows (state, plan, apply) that don't require any hosted backend; community comments corroborate long-term self-hosted/open-source usage. missing for 10: no explicit evidence pack statement enumerating self-hosting deployment instructions or license details, and no independent audit confirming full feature parity without HCP/Cloud services.

   • [claimed-docs] “Automate Infrastructure on Any Cloud”
   • [claimed-docs] “HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration …”
   • [claimed-docs] “You can also [write your own](/terraform/plugin).”
   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry”
   • [community] “I've been using Terraform for years, and I'm really glad to see it reach 1.0... thanks to you and your colleagues for consistently making th…”
   • [github] “Terraform builds a graph of all your resources, and parallelizes the creation and modification of any non-dependent resources.”

   proof ↗⚑ flag

   Crossplane✓fullprobed9/10

   Crossplane is an open-source Kubernetes control-plane extension that users install and run themselves via Helm on their own cluster, with full control over feature flags, package installation, and versions (docs-4, docs-5, docs-6, docs-19, docs-22, docs-25). The probe confirms hands-on that the CLI and control plane operate entirely against a self-managed Kubernetes cluster with no forced SaaS dependency (probe-2). Missing for 10: no explicit vendor statement contrasting self-hosting vs. any managed offering, and no independent write-up specifically about self-hosting experience at scale.

   • [claimed-docs] “Install Crossplane using the Helm chart.”
   • [claimed-docs] “Enable support for real time compositions.”
   • [claimed-docs] “Enable automatic protection of Providers from deletion when they have active managed resources.”
   • [claimed-docs] “Crossplane introduces new features behind feature flags. By default alpha features are off.”
   • [claimed-docs] “Installing Crossplane enables the installation of Crossplane Provider, Function, and Configuration resources.”
   • [claimed-docs] “Install pre-release versions of Crossplane from the master Crossplane Helm channel.”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

Agent plan parsing

1. ai-native userGet machine-readable plan output (JSON) that an agent can parse to reason about a proposed change

   weight 3 · round to Terraform
   Terraform✓fullclaimed9/10

   Terraform provides `terraform show -json` to output plan/state/config as JSON, and `-json` on plan/apply/refresh/test streams machine-readable JSON UI messages line-by-line for programmatic processing — both well-documented first-party capabilities directly matching the story. missing for 10: no independent/hands-on third-party corroboration of an agent actually parsing this JSON in practice.

   • [claimed-docs] “terraform show -json shows a JSON representation of the plan, configuration, and current state”
   • [claimed-docs] “Add the `-json` command-line flag to generate machine-readable output.”
   • [claimed-docs] “the -json flag outputs a stream of JSON UI messages”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “the `-json` flag outputs a stream of JSON UI messages. The ouptut messages appear one per line so that you can process the messages”
   • [claimed-docs] “the `terraform show` command provides human-readable output from a state or plan file... Add the `-json` command-line flag to generate machi…”

   proof ↗⚑ flag

   Crossplane—none0/10

   Crossplane's model is continuous reconciliation (drift correction) rather than a discrete plan/apply workflow, and the probe evidence explicitly states no local plan/preview loop exists — every operation requires a live cluster. There is no documented JSON plan output or diff artifact an agent could parse.

   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”
   • [claimed-docs] “If your software ever drifts from your desired state, the control plane automatically corrects the drift.”

   proof ↗⚑ flag

Ai infra ops

1. ai-native userHave an agent author an infrastructure change, run a plan headlessly, and present the diff for my approval

   weight 3 · round to Terraform
   Terraform~partialclaimed6/10

   Terraform's CLI supports the core mechanics: headless plan generation with -out, machine-readable JSON output via show -json and -json streaming, and apply requiring approval unless -auto-approve is passed, plus an official MCP server for AI integration with provider docs/modules/policies. However, there is no first-party documented workflow or tooling that specifically wires an agent to author config, run plan headlessly, and present a diff for human approval as an integrated feature — this is assembled by the user from separate primitives rather than a turnkey agent-approval pipeline. missing for 10: an end-to-end documented agent-authoring-to-approval workflow, evidence of the MCP server itself invoking plan/apply or diff presentation, and independent/hands-on confirmation of this exact human-in-the-loop pattern.

   • [claimed-docs] “The `terraform plan` command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructu…”
   • [claimed-docs] “You can use the optional `-out=FILE` option to save the generated plan to a file on disk, which you can later execute by passing the file to…”
   • [claimed-docs] “Terraform automatically creates a new execution plan as if you had run terraform plan, prompts you to approve that plan, and performs the in…”
   • [claimed-docs] “the `terraform show` command provides human-readable output from a state or plan file... Add the `-json` command-line flag to generate machi…”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “-auto-approve` - Skips interactive approval of the plan before applying”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”

   proof ↗⚑ flag

   Crossplane~partialprobed4/10

   Crossplane's CLI supports rendering/testing Compositions standalone (crossplane-docs-7) which could let an agent preview a change, but the probe explicitly found no headless local plan/preview loop — every real plan/apply requires a live Kubernetes cluster with Crossplane installed (crossplane-probe-2), unlike Terraform-style plan/diff tools. There's no documented diff-and-approve workflow tailored for agent-authored changes. missing for 10: a genuine headless 'plan' command producing a diff against live state, documented agent/approval integration, evidence of an AI agent actually driving this workflow end-to-end.

   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”
   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”

   proof ↗⚑ flag

Automation api

1. developerDrive deployments programmatically from my own application code rather than only through the CLI

   weight 2 · round to Crossplane
   Terraform—none0/10

   Evidence only shows CLI-based workflows (plan/apply/show -json, machine-readable UI output) that can be scripted or wrapped, but nothing indicates an official SDK, REST/HTTP API, or library for driving terraform plan/apply from application code without shelling out to the CLI. No mention of Terraform Cloud API, CDK for Terraform, or any programmatic library in the pack.

   • [claimed-docs] “The `terraform plan` command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructu…”
   • [claimed-docs] “The `terraform apply` command executes the operations proposed in a Terraform plan.”
   • [claimed-docs] “Add the `-json` command-line flag to generate machine-readable output.”
   • [claimed-docs] “For long-running commands such as `plan`, `apply`, `refresh`, and `test`, the `-json` flag outputs a stream of JSON UI messages.”
   • [claimed-docs] “You can use the optional `-out=FILE` option to save the generated plan to a file on disk, which you can later execute by passing the file to…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://developer.hashicorp.com/openapi.json, https://developer.hashicorp.com/swagger.json, https://…”

   proof ↗⚑ flag

   Crossplane~partialprobed5/10

   Crossplane exposes Kubernetes-native declarative APIs and explicitly markets itself as something 'humans, automation, and AI systems can safely act on', implying resources can be created/managed programmatically (e.g., via the Kubernetes API) rather than only via CLI. However, the evidence pack never documents an SDK, client library, or concrete example of driving Crossplane from application code — it only shows CLI tooling and YAML-based composition, and the probe confirms all real plan/apply operations require a running cluster with no programmatic preview path shown. missing for 10: explicit SDK/client-library documentation, a hands-on example of application code creating/managing Crossplane resources, and confirmation that this workflow is idiomatic (not just theoretically possible via raw Kubernetes API).

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”
   • [claimed-docs] “It lets you design the APIs and abstractions that your users use to interact with your control planes.”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”
   • [claimed-docs] “Installing Crossplane enables the installation of Crossplane Provider, Function, and Configuration resources.”

   proof ↗⚑ flag

Plan workflow

1. developerTear down an entire environment cleanly with a destroy operation

   weight 2 · round drawn
   Terraform—none0/10

   The evidence pack documents plan, apply, state, import, and test workflows in detail but never mentions a `terraform destroy` command or any teardown/cleanup operation. Without direct evidence of a destroy capability, this story cannot be credited even though it is a core plan-apply workflow axis for an IaC tool.

   ⚑ flag

   Crossplane—none0/10

   The evidence pack never documents a destroy/teardown operation or workflow for Crossplane; it covers install, packages, functions, and drift-correction, but the only deletion-related item (crossplane-docs-6) is about *protecting* providers from deletion, not enabling clean teardown. No CLI or docs evidence shows a 'crossplane destroy' or cascading delete guarantee for an environment. Missing for 10: any documentation of a destroy/delete command, cascading resource cleanup behavior, or a described teardown workflow.

   • [claimed-docs] “Enable automatic protection of Providers from deletion when they have active managed resources.”
   • [claimed-docs] “building, installing, updating and pushing Crossplane Packages”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

2. devops-leadRun plan and apply non-interactively in CI using saved plan artifacts and approval flags

   weight 3 · round to Terraform
   Terraform✓fullclaimed9/10

   Terraform's docs directly support the CI workflow: `terraform plan -out=FILE` saves a plan artifact, `terraform apply FILE` executes that exact saved plan, and `-auto-approve` skips interactive approval for non-interactive automation. Machine-readable JSON output (`-json` on show/plan/apply) further supports CI pipelines that need to parse results. missing for 10: no independent/hands-on CI pipeline example or third-party corroboration of this exact workflow.

   • [claimed-docs] “You can use the optional `-out=FILE` option to save the generated plan to a file on disk, which you can later execute by passing the file to…”
   • [claimed-docs] “-auto-approve - Skips interactive approval of the plan before applying”
   • [claimed-docs] “-auto-approve` - Skips interactive approval of the plan before applying”
   • [claimed-docs] “-auto-approve - Skips interactive approval of the plan before applying.”
   • [claimed-docs] “The `terraform apply` command executes the operations proposed in a Terraform plan.”
   • [claimed-docs] “Add the `-json` command-line flag to generate machine-readable output.”
   • [claimed-docs] “the `-json` flag outputs a stream of JSON UI messages. The ouptut messages appear one per line so that you can process the messages”

   proof ↗⚑ flag

   Crossplane—none0/10

   Crossplane operates as a continuously-reconciling Kubernetes control plane rather than a plan/apply tool with saved plan artifacts and approval gates; the evidence pack contains no documentation of a CI-oriented plan/apply/approve workflow. The hands-on probe explicitly notes that unlike Terraform-style tools, 'every real plan/apply operation requires a running Kubernetes cluster... no local plan/preview loop exists,' confirming the absence of this capability.

   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”
   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”

   proof ↗⚑ flag

3. platform-engineerPreview exactly what will change — creates, updates, and destroys — before applying

   weight 3 · round to Terraform
   Terraform✓fullcommunity10/10

   terraform plan generates a detailed execution plan previewing creates/updates/destroys before any changes are made, with human-readable and JSON output options, and apply prompts for confirmation unless auto-approved; this core workflow is corroborated by both official docs and independent community testimony praising execution plans as a key safety feature.

   • [claimed-docs] “creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure”
   • [claimed-docs] “The `terraform plan` command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructu…”
   • [claimed-docs] “The `terraform apply` command executes the operations proposed in a Terraform plan.”
   • [claimed-docs] “Terraform automatically creates a new execution plan as if you had run terraform plan, prompts you to approve that plan, and performs the in…”
   • [claimed-docs] “You can use the optional `-out=FILE` option to save the generated plan to a file on disk, which you can later execute by passing the file to…”
   • [claimed-docs] “the `terraform show` command provides human-readable output from a state or plan file... Add the `-json` command-line flag to generate machi…”
   • [community] “Terraform has a feature that is critical for safely iterating infrastructure: execution plans. Execution plans show you what changes Terrafo…”

   proof ↗⚑ flag

   Crossplane—none0/10

   Crossplane operates on a continuous-reconciliation model rather than an explicit plan/apply diff workflow; the CLI's `render` command only tests Composition Function output offline, and probe evidence explicitly states no local plan/preview loop exists — every real change requires a live cluster with the control plane reconciling live, not previewing creates/updates/destroys beforehand. missing for 10: any documented `crossplane plan`/diff command showing pending creates/updates/deletes, first-party guidance on previewing resource changes before applying, and independent confirmation of such a preview workflow.

   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”
   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [claimed-docs] “If your software ever drifts from your desired state, the control plane automatically corrects the drift.”

   proof ↗⚑ flag

4. platform-engineerTarget or exclude specific resources in a plan or apply

   weight 1 · round drawn
   Terraform—none0/10

   The evidence pack documents `terraform plan`/`apply`, `-auto-approve`, `-out`, and JSON output flags, but nowhere mentions the `-target` or `-exclude` flags that let a platform engineer scope plan/apply to specific resources. Without citable evidence for this specific capability, it cannot be credited even though it is plausible for this type of tool.

   ⚑ flag

   Crossplane—none0/10

   Crossplane's docs describe compositions, functions, and CLI rendering/troubleshooting, but nothing in the evidence shows a mechanism to target or exclude specific resources during a plan/apply-like operation; the probe explicitly notes there is no local plan/preview loop at all, only continuous reconciliation via a running cluster. missing for 10: any documented `--target`/`--exclude` style flag or resource-selection mechanism for plan or apply operations.

   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”
   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [claimed-docs] “troubleshooting Crossplane Compositions, Composite Resources and Managed Resources”

   proof ↗⚑ flag

Ai infra ops

1. ai-native userLet an agent plan and apply with least-privilege credentials and review gates so it cannot make unapproved changes

   weight 2 · round to Terraform
   Terraform~partialclaimed7/10

   Terraform's plan/apply workflow provides a clear review gate (plan preview before apply, manual approval unless -auto-approve is used) and policy-as-code enforcement (Sentinel/OPA-style policies) that can block noncompliant changes, plus a dedicated MCP server giving AI agents structured access to docs, modules, and policies — together these support an agent proposing plans that are policy-checked and gated before apply. However, there's no explicit documentation of least-privilege credential scoping specifically for agent-driven runs (e.g., ephemeral/scoped run credentials tied to an agent identity) or of an agent-specific approval workflow beyond the standard CLI/CLOUD run gates. missing for 10: explicit least-privilege credential/service-account guidance for AI agents, documented agent-specific approval/RBAC workflow, independent hands-on evidence of an agent being blocked by policy gates.

   • [claimed-docs] “The `terraform plan` command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructu…”
   • [claimed-docs] “The `terraform apply` command executes the operations proposed in a Terraform plan.”
   • [claimed-docs] “You can pass the `-auto-approve` option to instruct Terraform to apply the plan without asking for confirmation.”
   • [claimed-docs] “Policies are rules for Terraform runs that let you validate that Terraform plans comply with security rules and best practices.”
   • [claimed-docs] “View and override policy enforcement results in the workspace UI.”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”

   proof ↗⚑ flag

   Crossplane~partialcommunity4/10

   Crossplane's RBAC-based control plane and 'developer only given permission to perform operations at the interface' model (comm-8, docs-17) support a least-privilege foundation, and its declarative API design is explicitly pitched as safe for AI systems to act on (docs-16), but there is no documented mechanism for agent-specific credential scoping, plan/approval review gates, or blocking unapproved applies before they take effect. missing for 10: explicit approval/review-gate workflow for AI-driven changes, agent-scoped least-privilege credential issuance, evidence of a 'plan preview' step analogous to Terraform plan, and independent validation that unauthorized changes are actually blocked.

   • [claimed-docs] “Expose declarative APIs that humans, automation, and AI systems can safely act on”
   • [claimed-docs] “extending its battle hardened reliability and security features like Role Based Access Control (RBAC) to orchestrate everything - not just c…”
   • [community] “Terraform (and cloud provider APIs) are not built for developer self-service...Crossplane flips this model by instead saying that the develo…”

   proof ↗⚑ flag

Policy

1. devops-leadEnforce policy-as-code checks that block non-compliant infrastructure changes before apply

   weight 3 · round to Terraform
   Terraform~partialclaimed5/10

   Terraform Cloud/Enterprise documents a policy-enforcement feature (Sentinel/OPA-style) that validates plans against security rules and best practices before allowing an apply, which is the core policy-as-code capability a devops-lead would want. However, evidence is a single thin doc reference with no detail on enforcement levels (advisory vs hard-mandatory), no Sentinel/OPA specifics, and no independent or hands-on confirmation that non-compliant changes are actually blocked. missing for 10: detailed docs on enforcement levels and policy language (Sentinel/OPA), hands-on proof of a blocked apply, independent community corroboration of policy gating in practice.

   • [claimed-docs] “Policies are rules for Terraform runs that let you validate that Terraform plans comply with security rules and best practices.”

   proof ↗⚑ flag

   Crossplane—none0/10

   The evidence pack describes Crossplane's control-plane architecture, RBAC, packages, and CLI tooling, but contains no mention of a policy-as-code engine (e.g., OPA/Gatekeeper/Kyverno integration, admission webhooks, or built-in policy checks) that blocks non-compliant infrastructure changes before apply. RBAC is referenced only as an access-control feature, not as a compliance gate.

   ⚑ flag

Ai authoring

1. ai-native userGenerate infrastructure code from natural language using AI assistance built into the toolchain

   weight 2 · round to Terraform
   Terraform~partialprobed6/10

   Terraform ships an official MCP server that gives AI models real-time access to provider docs, modules, and policies specifically to enable 'more accurate and actionable Terraform configuration generation,' which supports natural-language-to-IaC workflows — but this is an integration layer for external AI assistants/agents rather than a natural-language generation feature built directly into the Terraform CLI/toolchain itself. missing for 10: no evidence of a native in-CLI NL-to-HCL generation feature, no independent/hands-on validation of the MCP server's generation quality, and no confirmation that generation is embedded rather than delegated to third-party AI tools.

   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “The Terraform Model Context Protocol (MCP) server enhances AI models with real-time access to current Terraform provider documentation, modu…”
   • [claimed-docs] “enhances AI models with real-time access to current Terraform provider documentation, modules, and policies from the Terraform registry”
   • [claimed-docs] “AI enhancement: Enables more accurate and actionable Terraform configuration generation.”
   • [probe] “official MCP server documented at https://developer.hashicorp.com/terraform/mcp-server”

   proof ↗⚑ flag

   Crossplane—none0/10

   Evidence shows Crossplane exposes declarative APIs that AI systems could act on, but there is no documented feature for generating infrastructure code from natural language within the Crossplane toolchain itself (CLI, docs, or otherwise).

   ⚑ flag

Languages

1. developerDefine infrastructure in a general-purpose programming language with types, loops, and IDE support

   weight 2 · round to Crossplane
   Terraform—none0/10

   All evidence describes Terraform's native configuration language (HCL) as a 'human-readable configuration file' language, not a general-purpose programming language with types/loops in the sense of Python/TypeScript; there is no CDKTF or similar general-purpose-language authoring mentioned anywhere in the pack. Community feedback even criticizes it as 'the awful half-baked language,' reinforcing that Terraform's core authoring experience is a declarative DSL rather than a GPL with IDE-native type/loop support.

   • [claimed-docs] “define both cloud and on-prem resources in human-readable configuration files that you can version, reuse, and share”
   • [claimed-docs] “HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration …”
   • [community] “I hate Terraform with a passion but it is probably the best tool out there for managing cloud infrastructure... The biggest downsides are th…”
   • [community] “So, v1.0, but still no dynamic providers, resulting in piles of copypasta especially when creating Kubernetes clusters. Secrets are still st…”

   proof ↗⚑ flag

   Crossplane~partialclaimed4/10

   Crossplane's core resource model (Compositions, XRDs) is YAML/CRD-based, but its Functions pipeline explicitly supports writing composition logic in general-purpose languages like Python and Go (as well as KCL), which brings type systems and IDE tooling into play (crossplane-docs-2, crossplane-docs-26). However, this applies only to the Function extension mechanism, not to defining the full infrastructure spec itself, and there's no evidence of dedicated SDKs, typed client libraries, or IDE integration for this workflow. missing for 10: dedicated general-purpose-language SDK for defining infra resources (not just functions), documented IDE/autocomplete support, type-safety examples, loop/programmatic composition examples, independent hands-on validation of this workflow.

   • [claimed-docs] “Functions allow you to write your configuration in multiple languages, including YAML, KCL, Python, and Go.”
   • [claimed-docs] “Functions - Functions extend Crossplane with new ways to configure composition”
   • [claimed-docs] “With Crossplane you don’t have to write a controller. Instead you configure a pipeline of functions.”

   proof ↗⚑ flag

Modules

1. developerConsume and publish reusable modules or components from a public registry

   weight 3 · round to Terraform
   Terraform✓fullclaimed9/10

   Terraform's public Registry explicitly supports publishing and consuming providers, modules, and policies, and modules are a core reusable/versioned configuration primitive documented extensively. missing for 10: independent hands-on evidence of publishing workflow specifics or community friction reports about registry publishing itself.

   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry.”
   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry”
   • [claimed-docs] “Create reusable configurations with modules.”
   • [claimed-docs] “HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration …”

   proof ↗⚑ flag

   Crossplane~partialclaimed6/10

   Crossplane docs describe Providers and Configurations as portable, installable packages and the CLI supports building, installing, updating and pushing Crossplane Packages, plus a 'library of components to assemble your platform faster' — all indicating a publish/consume workflow for reusable modules. However, there is no explicit evidence of a named public registry (e.g., Upbound Marketplace) or details on registry discovery/versioning workflows. Missing for 10: explicit public registry reference/marketplace evidence, developer-facing publish workflow walkthrough, independent confirmation of module reuse via registry.

   • [claimed-docs] “building, installing, updating and pushing Crossplane Packages”
   • [claimed-docs] “Providers - Providers connect Crossplane to external APIs”
   • [claimed-docs] “Configurations - Portable packages of Crossplane resources”
   • [claimed-docs] “Use a library of components to assemble your platform faster”
   • [claimed-docs] “Installing Crossplane enables the installation of Crossplane Provider, Function, and Configuration resources.”

   proof ↗⚑ flag

Providers

1. developerManage resources across all major clouds and SaaS providers through a broad provider ecosystem

   weight 3 · round to Terraform
   Terraform✓fullcommunity9/10

   Terraform's core value proposition is a broad provider ecosystem via the public Terraform Registry, letting anyone publish/consume providers and modules across clouds, on-prem, and SaaS, with community evidence corroborating real-world multi-cloud/cross-account use cases. missing for 10: independent quantitative data on registry breadth (e.g., number of providers) and no direct evidence contradicting ecosystem breadth.

   • [claimed-docs] “Automate Infrastructure on Any Cloud”
   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry.”
   • [claimed-docs] “Anyone can publish and consume providers, modules, and policies on the public Terraform Registry”
   • [claimed-docs] “You can also [write your own](/terraform/plugin).”
   • [community] “I recently had to do a piece of AWS work that required cross-account resources... AWS CDK and CloudFormation can't handle that as one step..…”
   • [claimed-docs] “HashiCorp Terraform is an infrastructure as code tool that lets you define both cloud and on-prem resources in human-readable configuration …”

   proof ↗⚑ flag

   Crossplane~partialcommunity6/10

   Docs confirm a package-based Provider model that connects Crossplane to external APIs (e.g. AWS RDS) and describes a 'library of components' to assemble a platform, and community discussion references AWS/GCP/Azure-style resources being managed this way, supporting a broad multi-cloud provider ecosystem claim. However, the evidence pack never enumerates specific major-cloud or SaaS provider packages (Azure, GCP, Datadog, etc.) beyond AWS RDS, nor cites a provider marketplace/registry size or independent confirmation of breadth. missing for 10: explicit list/marketplace evidence of major cloud providers (Azure, GCP) and SaaS providers, independent verification of ecosystem breadth beyond AWS example.

   • [claimed-docs] “there’s an RDS instance MR that extends Kubernetes with the ability to manage AWS RDS instances.”
   • [claimed-docs] “Providers - Providers connect Crossplane to external APIs”
   • [claimed-docs] “Use a library of components to assemble your platform faster”
   • [community] “When he asks for the DB, is he getting an RDS/CloudSQL/whatever or is it spinning up a DB on an EKS/GKE/whatever? I really don't like the la…”
   • [community] “So how is this different from AWS Operator? ... The AWS operator targets AWS resources. You can't take them, in a general sense, to minikube…”

   proof ↗⚑ flag

Config stacks

1. developerManage per-environment configuration (dev, staging, prod) as separate stacks or workspaces

   weight 2 · round to Terraform
   Terraform~partialclaimed5/10

   Terraform's state and module system (terraform-docs-20, terraform-docs-33, terraform-docs-13) supports separating configuration into reusable modules and remote state per environment, which is the underlying mechanism for dev/staging/prod separation, but the evidence pack never explicitly documents the `terraform workspace` command or a documented pattern for separate environment stacks. Missing for 10: explicit docs on `terraform workspace new/select`, guidance on directory-per-environment or workspace-per-environment patterns, and independent confirmation of how teams structure environments.

   • [claimed-docs] “Terraform uses your workspace's state to map real world resources to your configuration, keep track of metadata, and to improve performance …”
   • [claimed-docs] “We recommend storing state in HCP Terraform or a remote backend to securely store state and collaborate with team members.”
   • [claimed-docs] “Create reusable configurations with modules.”
   • [claimed-docs] “Terraform provides the terraform state command to perform basic modifications of the state using the CLI.”

   proof ↗⚑ flag

   Crossplane~partialclaimed3/10

   Crossplane has 'Environment Configs' (in-memory data stores for Compositions) and 'Configurations' as portable packages, which could be used to parameterize per-environment settings, but there is no documented workspace/stack concept analogous to Terraform workspaces for isolating dev/staging/prod as separate stacks. missing for 10: explicit dev/staging/prod workspace pattern, first-party guidance on structuring multiple environments, independent corroboration of this use case.

   • [claimed-docs] “Environment Configs - In-memory data stores for Compositions”
   • [claimed-docs] “Configurations - Portable packages of Crossplane resources”
   • [claimed-docs] “Composition Revisions - Manage changes to Compositions with revisions”

   proof ↗⚑ flag

Secrets

1. developerPass secrets and sensitive configuration into deployments without exposing them in code or logs

   weight 3 · round drawn
   Terraform—none0/10

   The evidence pack contains no documentation of Terraform's sensitive-variable marking, environment-variable injection, or secret-manager integrations that would let a developer pass secrets without exposing them in code or logs. The only related evidence is a community comment noting secrets are stored unencrypted in state (terraform-comm-3), which points to a gap rather than a documented capability.

   • [community] “So, v1.0, but still no dynamic providers, resulting in piles of copypasta especially when creating Kubernetes clusters. Secrets are still st…”

   proof ↗⚑ flag

   Crossplane—none0/10

   Crossplane orchestrates infrastructure via Kubernetes and secret/credential handling (e.g., Provider credentials, Kubernetes Secrets) is a plausible axis for such a control plane, but the evidence pack contains no mention of secrets management, credential injection, or log redaction mechanisms. missing for 10: any documentation or community evidence of secret injection, secure credential storage, or protection from log exposure.

   ⚑ flag

Drift

1. platform-engineerDetect drift between my declared configuration and the actual cloud resources

   weight 3 · round drawn
   Terraform✓fullcommunity8/10

   Terraform's plan command (and underlying refresh) explicitly compares declared configuration against real infrastructure state to preview differences, which is the core drift-detection mechanism, and terraform show -json / state commands expose that comparison programmatically; community commentary corroborates execution plans as a trusted way to see what will change before applying. Missing for 10: explicit vendor documentation using the term 'drift detection' or a dedicated drift-detection guide, and independent hands-on verification of drift-detection accuracy at scale.

   • [claimed-docs] “creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructure”
   • [claimed-docs] “The `terraform plan` command creates an execution plan, which lets you preview the changes that Terraform plans to make to your infrastructu…”
   • [claimed-docs] “Terraform uses your workspace's state to map real world resources to your configuration, keep track of metadata, and to improve performance …”
   • [claimed-docs] “terraform show -json shows a JSON representation of the plan, configuration, and current state”
   • [claimed-docs] “the `terraform show` command provides human-readable output from a state or plan file... Add the `-json` command-line flag to generate machi…”
   • [community] “Terraform has a feature that is critical for safely iterating infrastructure: execution plans. Execution plans show you what changes Terrafo…”

   proof ↗⚑ flag

   Crossplane✓fullcommunity8/10

   Crossplane's control-plane model continuously reconciles declared desired state against actual cloud resources and self-corrects drift automatically, as documented directly ('If your software ever drifts from your desired state, the control plane automatically corrects the drift'). This is reinforced by its reconciliation-based architecture (managed resources, compositions) rather than one-off plan/apply. Missing for 10: independent hands-on verification/benchmarks of drift-detection behavior in production, and no detail on drift visibility/reporting tooling (e.g., diffing UI) beyond auto-correction.

   • [claimed-docs] “If your software ever drifts from your desired state, the control plane automatically corrects the drift.”
   • [claimed-docs] “There’s already a Crossplane managed resource for that.”
   • [claimed-docs] “there’s an RDS instance MR that extends Kubernetes with the ability to manage AWS RDS instances.”
   • [community] “Terraform is a popular tool for provisioning infrastructure...Unlike Crossplane, Terraform does not support workload portability across clou…”

   proof ↗⚑ flag

State backends

1. devops-leadEncrypt state at rest so credentials and sensitive values are not readable in plaintext state files

   weight 2 · round drawn
   Terraform—none0/10

   The evidence pack contains no documentation of a Terraform state encryption-at-rest feature, and community evidence explicitly states 'Secrets are still stored in the state without encryption when retrieving them from the CLI' (terraform-comm-3), indicating this capability is not delivered per the provided evidence.

   • [community] “So, v1.0, but still no dynamic providers, resulting in piles of copypasta especially when creating Kubernetes clusters. Secrets are still st…”
   • [claimed-docs] “Terraform uses your workspace's state to map real world resources to your configuration, keep track of metadata, and to improve performance …”
   • [claimed-docs] “Terraform provides the terraform state command to perform basic modifications of the state using the CLI.”

   proof ↗⚑ flag

   Crossplane—none0/10

   The evidence pack contains no mention of encryption at rest, state files, secrets handling, or etcd encryption for Crossplane's managed resource state. Crossplane stores its state as Kubernetes custom resources rather than flat state files, but no documentation here addresses how sensitive values are protected from plaintext exposure. missing for 10: any docs on etcd encryption, secret handling for provider credentials, or state-at-rest encryption guarantees.

   ⚑ flag

2. platform-engineerSafely inspect and modify state — moving, removing, or renaming resources — when refactoring

   weight 2 · round to Terraform
   Terraform✓fullclaimed7/10

   Terraform explicitly documents `terraform state` subcommands for basic state modifications (mv/rm/import equivalents) plus `terraform import` for bringing existing resources under management, directly supporting safe state refactoring. missing for 10: no explicit mention of `moved`/`removed` config blocks or `terraform state mv/rm` command details, and no independent/hands-on evidence confirming safe refactoring workflows in practice.

   • [claimed-docs] “Terraform provides the terraform state command to perform basic modifications of the state using the CLI.”
   • [claimed-docs] “Terraform uses your workspace's state to map real world resources to your configuration, keep track of metadata, and to improve performance …”
   • [claimed-docs] “You can import an existing resource to state from the Terraform CLI.”
   • [claimed-docs] “This topic provides an overview of the Terraform commands that let you import existing infrastructure resources so that you can manage them …”
   • [claimed-docs] “We recommend storing state in HCP Terraform or a remote backend to securely store state and collaborate with team members.”

   proof ↗⚑ flag

   Crossplane—none0/10

   The evidence pack shows Crossplane CLI features for troubleshooting and rendering Compositions/Managed Resources, but there is no documentation or community evidence of a safe state-inspection/modification workflow (e.g., moving, renaming, or removing resources from state) analogous to Terraform's state mv/rm/import commands. Refactoring-safety for live infrastructure state is a fair axis for any IaC/control-plane tool, so absence of evidence here yields 'none' rather than 'na'.

   • [claimed-docs] “troubleshooting Crossplane Compositions, Composite Resources and Managed Resources”
   • [probe] “official CLI documented at https://docs.crossplane.io/cli/latest/”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

Testing

1. developerWrite automated tests for my infrastructure code and run them without touching production

   weight 2 · round to Terraform
   Terraform✓fullclaimed8/10

   Terraform has a dedicated `terraform test` framework (terraform-docs-7, -21, -27, -28) that runs tests against test-specific, short-lived resources, explicitly preventing risk to existing infrastructure/state, and even supports mocking provider data so tests can run without touching real infrastructure. This directly satisfies writing automated infra tests without touching production. missing for 10: independent/hands-on evidence of `terraform test` execution (the probes only cover plan/apply/destroy, not the test framework itself), and more detail on CI integration patterns for the test command.

   • [claimed-docs] “Terraform tests let authors validate that module configuration updates do not introduce breaking changes. Tests run against test-specific, s…”
   • [claimed-docs] “Terraform tests let authors validate that module configuration updates do not introduce breaking changes.”
   • [claimed-docs] “Terraform tests let authors validate that module configuration updates do not introduce breaking changes. Tests run against test-specific, s…”
   • [claimed-docs] “Terraform v1.7.0 introduced the ability to mock data returned by the providers during a `terraform test` execution.”

   proof ↗⚑ flag

   Crossplane!disputedcontradicted5/10

   Docs claim the Crossplane CLI supports 'testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane' (crossplane-docs-7), which would let developers test infra code without touching production. However, a hands-on probe explicitly found that 'unlike other tools probed here every real plan/apply operation requires a running Kubernetes cluster with the Crossplane control plane installed — no local plan/preview loop exists' (crossplane-probe-2), directly contradicting the claim of a self-contained local testing workflow. Missing for 10: independent confirmation that `crossplane render` works fully offline for realistic compositions, CI/CD test-suite examples, and reconciliation of the docs/probe discrepancy.

   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag

2. developerValidate and auto-format my configuration before planning

   weight 1 · round to Crossplane
   Terraform—none0/10

   The evidence pack never mentions `terraform validate` or `terraform fmt`, the actual commands for config validation and auto-formatting. Closest evidence (terraform tests, policy enforcement) address post-write module testing and plan compliance, not pre-plan syntax validation/formatting, so the specific story is unevidenced.

   ⚑ flag

   Crossplane~partialprobed3/10

   The Crossplane CLI supports offline testing/rendering of Compositions without a cluster (crossplane-docs-7, crossplane-docs-8), which partially covers 'validate,' but there is no evidence of an auto-format command, and crossplane-probe-2 explicitly notes there is no local plan/preview loop — every real operation requires a live cluster, unlike a typical validate→format→plan workflow. missing for 10: dedicated auto-format tooling, an actual 'plan' equivalent step, and independent confirmation of the validate/render workflow's completeness.

   • [claimed-docs] “testing and rendering standalone Composition Functions without the need to access a Kubernetes cluster running Crossplane”
   • [claimed-docs] “troubleshooting Crossplane Compositions, Composite Resources and Managed Resources”
   • [probe] “PROBE cli-version (local run, macOS): `crossplane version --client` printed "Client Version: v2.5.0" and exited 0 after `brew install crossp…”

   proof ↗⚑ flag