service-discovery

Service Discovery

Scan a service's infrastructure-as-code repo and produce a troubleshooting-oriented inventory: a resource catalog, naming/tagging patterns, a dependency map, and per-symptom investigation runbooks. The output must be accurate enough that an on-caller who has never seen the service can use it to diagnose a live incident.

The Iron Law

NO ASSUMPTIONS. IF UNCLEAR, ASK THE HUMAN.
NO OUT-OF-SCOPE ACTIONS WITHOUT HUMAN APPROVAL.
ONLY READ INFRASTRUCTURE-AS-CODE AND DOCUMENTATION FILES. NEVER READ SECRETS.

Real-discovery extension (when no IaC is found):

NO WRITE API CALLS. EVER.
ALL CLOUD QUERIES ARE READ-ONLY. NO EXCEPTIONS.

Constraints (Non-Negotiable)

1. The IaC code is the source of truth. Every claim in the catalog must trace back to a specific file and line in the repo. Do not invent resources, dependencies, or thresholds from outside knowledge of "what services usually look like." If the code does not say it, the catalog does not say it.
2. No assumptions. If anything is unclear during discovery — a resource's purpose, a naming token, a dependency, an unresolved parameter, whether a conditional resource is enabled in the target instance — STOP and ask the human. An incomplete catalog with explicit questions is better than a complete catalog with wrong claims.
3. Stop at the stack boundary. A "stack" is the deploy unit (Terraform root module, CloudFormation stack, Pulumi project, Helm release, Bicep deployment). Read everything inside the in-scope stack(s); do NOT follow references into other stacks. Cross-stack references get recorded as dependencies, not chased.
4. Strict scope. Anything outside the named repo paths — running cloud CLIs, modifying infrastructure, reading other repos, calling external APIs — requires explicit human approval before you do it.
5. No secrets, ever. Do not read files that are likely to contain secrets (anything matching common patterns: *.enc.*, *.secret.*, secrets/, .env*, *.pem, *.key, id_rsa*, files inside vault/, files referenced by tools like SOPS / sealed-secrets / Doppler / 1Password CLI). When the IaC declares a secret reference (e.g., aws_secretsmanager_secret_version, data.vault_generic_secret, azurerm_key_vault_secret), record the reference, not any value.
6. Resolve to a single, named instance. A repo is a template; the catalog is about a specific instance (one environment, one region, one tenant — whatever the smallest deploy-target unit is in this repo). Confirm with the human which instance is being cataloged before scanning.
7. User confirmation at every gate. Five workflow gates exist. None are optional.