reconcile-iac

# Skill: reconcile-iac `plan`-based drift audit → ADR compliance check → proposed disposition → route. Audit and propose; a human (or the `release-loop` consent gate) decides. Never autonomously apply. ## Three triggers — all first-class | Trigger | When | What it does | | --- | --- | --- | | **Before-change preflight** | Before every follow-on infrastructure change (mandatory, not optional) | Runs a `plan` against live state to surface drift *before* the new change lands on top of it — prevents layering change on unknown drift | | **On-demand / scheduled** | On request or on a scheduled cadence | Standalone drift snapshot for quiescent infrastructure; the author-side safety net when `release-loop` is absent | | **ADR compliance check** | When an IaC diff arrives that was NOT authored by `generate-iac` (hand-edit, external PR, CI gate) | Checks the diff against the governance-index ADRs — covers the compliance gap for changes the generation skill didn't author | **Recommended cadence (Triggers 1 and 2):** (1) Before every follow-on change — mandatory preflight; (2) Weekly minimum on a scheduled basis — regular drift snapshot even in quiescent periods; (3) Immediately after a known out-of-band event — break-glass action, console change, provider-managed auto-modification, or a known pipeline failure. **Trigger 3 fires on demand**, not on a cadence — invoke when a diff arrives that did not go through `generate-iac`. ## Known blind spot — document and do not hide `terrafo...