arn-infra-execute-change

Arness Infra Execute Change

Orchestrate the phased execution of a structured infrastructure change plan. For each phase, this skill runs a 7-step dispatch loop: rollback checkpoint, IaC generation, security gate, cost gate, deployment, verification, and review gate. It tracks progress in PROGRESS_TRACKER.json and produces per-phase INFRA_CHANGE_REPORT_PHASE_N.json reports.

This skill consumes the structured project created by arn-infra-save-plan and coordinates all existing infrastructure agents (specialist, security-auditor, cost-analyst, verifier) plus the new change-reviewer agent.

Pipeline position:

arn-infra-init -> arn-infra-change-spec -> arn-infra-change-plan -> arn-infra-save-plan -> **arn-infra-execute-change** -> arn-infra-review-change -> arn-infra-document-change

Prerequisites

Read ## Arness from the project's CLAUDE.md. If no ## Arness section exists or Arness Infra fields are missing, inform the user: "Arness Infra is not configured for this project yet. Run /arn-infra-wizard to get started — it will set everything up automatically." Do not proceed without it.

Check the Deferred field. If Deferred: yes, inform the user: "Infrastructure is in deferred mode. Change execution is not available until infrastructure is fully configured. Run /arn-infra-assess to un-defer." Stop.

Extract:

• Infra plans directory -- where structured plan projects live (default: .arness/infra-plans)
• Providers -- cloud providers configured
• Providers config -- path to providers.md
• Environments -- environment names in promotion order
• Environments config -- path to environments.md
• Experience level -- derived from user profile. Read ~/.arness/user-profile.yaml (or .claude/arness-profile.local.md if it exists — project override takes precedence). Apply the experience derivation mapping from ${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-ensure-config/references/experience-derivation.md. If no profile exists, check for legacy Experience level in ## Arness as fallback.
• Cost threshold -- monthly budget limit for cost gate warnings (default: 100)
• Default IaC tool -- default IaC tool
• Tooling manifest -- path to tooling-manifest.json
• Resource manifest -- path to active-resources.json

Locate the Structured Plan Project

Search for structured plan projects in the Infra plans directory:

Glob <infra-plans-dir>/*/PROGRESS_TRACKER.json

If one project found: Auto-select it. If multiple projects found: Present the list with project names and overall status from each PROGRESS_TRACKER.json. Ask the user to select. If no project found: Inform the user: "No structured plan project found. Run /arn-infra-save-plan to create one from a plan preview."

Read PROGRESS_TRACKER.json to determine current phase and execution state. If a phase is in_progress, offer to resume from the last completed step.

Workflow

Step 1: Present Execution Plan

Read the project's INTRODUCTION.md and present an execution summary:

"Infrastructure Change Execution:

• Project: [project name]
• Phases: [total] ([completed] completed, [remaining] remaining)
• Current phase: [N] -- [title] (targeting [environment])
• Blast radius: [classification for current phase]
• Cost budget remaining: $[amount]

Proceed with Phase [N]?"

Token consumption warning: If the project has 5+ phases or 20+ resources, warn: "This is a large change with [N] phases and [M] resources. Execution will consume significant context. Consider executing one phase at a time."

Step 2: Per-Phase Dispatch Loop

Read ${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-execute-change/references/dispatch-loop.md for the detailed dispatch loop logic.

For the current phase, execute the 7-step dispatch loop:

Step 2.1: Create Rollback Checkpoint

Before making any changes, create a rollback checkpoint:

• Backup IaC state files (state pull/export)
• Record the current resource manifest state
• Note the checkpoint path in the phase report

Update PROGRESS_TRACKER.json: set phase execution status to in_progress.

Step 2.2: Invoke IaC Generation (arn-infra-specialist)

Read the phase plan (PHASE_N_PLAN.md) and invoke the arn-infra-specialist agent with structured context:

--- PHASE PLAN ---
[full content of PHASE_N_PLAN.md]
--- END PHASE PLAN ---

--- PROVIDER CONFIG ---
[provider configuration from providers.md]
--- END PROVIDER CONFIG ---

--- INFRASTRUCTURE CONTEXT ---
Project: [project name]
Phase: [N] of [total]
Environment: [target environment]
IaC Tool: [tool]
Blast Radius: [classification]
--- END INFRASTRUCTURE CONTEXT ---

--- GENERATION INSTRUCTIONS ---
Generate the IaC configurations for all resources listed in the phase plan.
Follow the resource specifications exactly. Use the configured IaC tool.
Generate environment-specific variable files. Include resource tagging.
--- END GENERATION INSTRUCTIONS ---

Step 2.3: Security Gate (arn-infra-security-auditor)

Read ${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-execute-change/references/gate-policies.md for security gate enforcement rules.

Invoke the arn-infra-security-auditor agent via the Task tool to scan the generated IaC, passing the model from .arness/agent-models/infra.md as the model parameter (see plugins/arn-infra/skills/arn-infra-ensure-config/references/ensure-config.md "Dispatch convention" for fallback). Context:

--- IaC ARTIFACTS ---
[list of generated files with content]
--- END IaC ARTIFACTS ---

--- SECURITY CONTEXT ---
Environment: [target environment]
Blast radius: [classification]
Security requirements: [from phase plan]
--- END SECURITY CONTEXT ---

--- SCAN INSTRUCTIONS ---
Scan the generated IaC for security issues. Report findings by severity
(CRITICAL, HIGH, MEDIUM, LOW). Check for: exposed ports, public access,
missing encryption, overly permissive IAM, hardcoded secrets.
--- END SCAN INSTRUCTIONS ---

Gate evaluation (per gate-policies.md):

• CRITICAL findings: block execution, present findings, require fix-and-retry or abort
• HIGH findings: present findings with risk assessment, require explicit acknowledgment
• MEDIUM/LOW findings: log in phase report, proceed

Update PROGRESS_TRACKER.json: set securityGate.status.

Step 2.4: Cost Gate (arn-infra-cost-analyst)

Invoke the arn-infra-cost-analyst agent via the Task tool to estimate costs, passing the model from .arness/agent-models/infra.md as the model parameter (see plugins/arn-infra/skills/arn-infra-ensure-config/references/ensure-config.md "Dispatch convention" for fallback). Context:

--- IaC ARTIFACTS ---
[generated IaC content]
--- END IaC ARTIFACTS ---

--- COST CONTEXT ---
Cost threshold: [from config]
Cumulative cost so far: [from previous phases]
Budget remaining: [total budget - cumulative]
--- END COST CONTEXT ---

--- ESTIMATION INSTRUCTIONS ---
Estimate the monthly cost for all resources in this phase.
Break down costs per resource. Compare against the threshold.
Suggest cost optimizations if threshold is exceeded.
--- END ESTIMATION INSTRUCTIONS ---

Gate evaluation (per gate-policies.md):

• Exceeds threshold: present detailed breakdown, require acknowledgment, suggest alternatives
• Within threshold: log estimate, proceed

Update PROGRESS_TRACKER.json: set costGate.status.

Step 2.5: Execute Deployment

Read ${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-execute-change/references/deploy-procedures.md for per-tool deployment commands.

Execute the deployment using the procedures from deploy-procedures.md. Follow the same deployment flow as arn-infra-deploy:

• Run plan/preview command
• Present changes to user for confirmation
• Execute apply/deploy command
• Monitor deployment progress
• Update resource manifest on success

User confirmation is required before every apply/deploy command.

Step 2.6: Verification (arn-inf