Have an Agent Do It

1. Finds places in your Terraform that need one of your decisions: the install’s domain, the region, names that must be unique per install, who supplies each secret, endpoints that must stay public, and blocks only your own environments need. It consults its common Terraform mistakes library and shared external-service considerations, then follows relevant application consumers rather than treating a service name as a decision.
2. Asks you each decision, one at a time, showing the file, the line, the block and the options. It never guesses an answer and never invents a label, description or reason.
3. Writes the annotations you choose. It leaves compiler automation to the compiler. Adding a namespace variable and name prefixes requires your agreement. For a common-mistake finding, it traces the resource’s absence condition and its consumers, then shows a proposed repair for your review before applying it. Feature configuration and source repairs are separate edits.
4. Reports annotations, configuration choices, common-mistake findings and accepted or deferred repairs, existing annotations, and open decisions. It identifies the consideration-data source, version and digest used. Source findings and catalog suggestions are separate from compiler diagnostics, your decisions and verified application behavior.

​

Install

tensor9-byoc-onboarding/
  SKILL.md
  scripts/load_considerations.py
  references/common-terraform-mistakes.md
  references/considerations-usage.md
  references/considerations/
    index.md
    latest.json
    1.0.0/catalog.json

• Claude Code package
• Codex package

tar -tzf "$HOME/Downloads/tensor9-byoc-onboarding-claude-considerations-1.0.0-source-098190675f.tar.gz"
mkdir -p "$HOME/.claude/skills"
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-claude-considerations-1.0.0-source-098190675f.tar.gz" -C "$HOME/.claude/skills"

mkdir -p .claude/skills
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-claude-considerations-1.0.0-source-098190675f.tar.gz" -C .claude/skills

tar -tzf "$HOME/Downloads/tensor9-byoc-onboarding-codex-considerations-1.0.0-source-098190675f.tar.gz"
mkdir -p "$HOME/.agents/skills"
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-codex-considerations-1.0.0-source-098190675f.tar.gz" -C "$HOME/.agents/skills"

mkdir -p .agents/skills
tar -xzf "$HOME/Downloads/tensor9-byoc-onboarding-codex-considerations-1.0.0-source-098190675f.tar.gz" -C .agents/skills

​

Run it

/tensor9-byoc-onboarding ./terraform

$tensor9-byoc-onboarding ./terraform

​

Refresh and look up considerations

tensor9 prepare considerations -profile my-vendor -json
tensor9 prepare considerations -profile my-vendor -id stripe -json
tensor9 prepare considerations -profile my-vendor -id metronome -json
tensor9 prepare considerations -profile my-vendor -search billing -json

SKILL_DIR="$HOME/.agents/skills/tensor9-byoc-onboarding"
python3 "$SKILL_DIR/scripts/load_considerations.py" --refresh --profile my-vendor --index
python3 "$SKILL_DIR/scripts/load_considerations.py" --no-refresh --profile my-vendor --id stripe
python3 "$SKILL_DIR/scripts/load_considerations.py" --no-refresh --profile my-vendor --id metronome

​

What a session looks like

terraform/variables.tf:42  variable "domain_name"

Each install serves its own domain. Which variable holds that domain?
Every host the install exposes should derive from it.

  1. domain_name (this variable)
  2. A different variable
  3. Not sure - leave it open

#@vanity_domain_root()
variable "domain_name" {
  description = "Domain the application is served from"
  type        = string
}

Annotations added
  terraform/variables.tf:42   #@vanity_domain_root()     on var.domain_name
  terraform/variables.tf:6     #@region(cloud='aws')      on var.aws_region
  terraform/secrets.tf:12      #@secret(ownership='buyer', ...)  on data.aws_secretsmanager_secret.stripe_key
Configuration choices accepted
  terraform/terraform.tfvars:220   ClickHouse PrivateLink disabled with an empty service name
Common-mistake findings and repairs
  terraform/dashboard.tf:18   optional-resource consumer assumes clickhouse[0] exists
    accepted repair: guard ClickHouse widgets with the endpoint creation condition
Open decisions
  terraform/cognito.tf:32   confirm the email sender and required cloud setup

​

After the agent finishes

1. Review the diff. Check annotations separately from accepted name prefixes, feature settings and common-mistake repairs. For external services, review your behavior/ownership decisions and the full application, data, job and callback changes. Review deferred findings before installing.
2. Run terraform validate and terraform plan against an appropriate environment. Annotations alone leave the plan unchanged; configuration and repair effects need their own review.
3. Resolve any open decisions, by hand or by running the skill again.
4. Continue with compile and install.