Anton Babenko 🇺🇦

While working on @compliancetf, I created a Claude skill called terraform-skill (terraform-best-practices + other trusted sources). In 2026, please stop saying "AI hallucinates with #Terraform". Use HashiCorp MCP + this skill so answers are grounded in real docs and battle-tested patterns. Feedback welcome, and shares appreciated. 🚀 github.com/antonbabenko/t…

tfpolicy (by HashiCorp) ships a policy stage that runs before Terraform downloads a module. At that point a policy sees a source string and a version. It allows or denies a name. Which module that name resolves to is doing a lot of the compliance work. compliance.tf/blog/hashicorp…

Terraform best practices for AI coding agents github.com/antonbabenko/t…

Another open-source tool from building @compliancetf repro-lambda builds AWS Lambda zips outside Terraform: byte-identical on macOS and CI, uploaded to S3 by content hash, then promoted dev -> prod with no rebuild. Terraform reads s3_existing_package instead of rebuilding on every plan. #Terraform #AWS #Lambda #serverless github.com/antonbabenko/r…

no tie-break by design. Convergence is unanimous-APPROVE among responders + zero open criticals + arbiter can't self-approve. A disagreement isn't voted on - it triggers a revision round (arbiter must address each critical, peers re-review), capped at 5. Still split at the cap? It returns non-converged instead of picking a winner.

@antonbabenko @OpenRouter blind panel is smart - removes anchoring bias too. how do you handle tie-breaking when the voices disagree?

Introducing the Fusion API, the smartest compound model in the market. Fusion achieves Fable-level intelligence at half the price. How it works 👇

@Validate_QA @OpenRouter not cut - meant "another peer's opinion." Each voice reviews in isolation, no panelist sees another's verdict. Zero cross-contamination, same way the arbiter is blind to the panel until it commits.

@antonbabenko @OpenRouter ah that makes more sense - fixed rubric eliminates the authoring leak. the message cut off tho, were you gonna say 'whatever the voice is'?

Slightly different mechanism. The criteria aren't authored per-run, so there's nothing to leak - it's a fixed rubric (correctness, security, scope, ambiguity, perf, ops), identical for every voice. What pre-commits is the arbiter's own verdict, recorded before the panel is revealed. Peers vote blind too, none sees another's. And the arbiter can't self-approve: convergence needs the external voices to carry APPROVE, not just the arbiter.

@antonbabenko @OpenRouter pre-commit as in the arbiter locks in its evaluation criteria before seeing the output? curious how you prevent the criteria themselves from leaking context

@Validate_QA @OpenRouter Exactly, blind pre-commit input by the arbiter is already implemented in Deliberation.

@antonbabenko @OpenRouter the trap with arbiter consensus is when the arbiter itself is one of the models you're judging. we've all seen the model that agrees with itself. need a blind panel or the whole thing's theater

"Panels of models which consistently outperforms individual models" - this is exactly the point I was chasing when working on the Deliberation. github.com/antonbabenko/d… Ask Codex, Gemini, Grok, and 400+ OpenRouter models (Qwen, Kimi, DeepSeek) for second opinions or arbiter-mediated consensus. One MCP server for Claude Code, Codex, Cursor, Kiro, OpenCode. Measures which models earn their seat. #openrouter #fusion

@iamlukasniessen @compliancetf Hi Lukas! It's not the case for quiet a while already. Feel free to review it again and update the README in your repository to reflect the reality.

@antonbabenko @compliancetf Only problem with this skill: it puts a HUGE amount of text in the context and burned all my tokens. This is why I created a skill that uses about 7x less tokens. Plus, it uses a failure mode framework, which forces the agent to THINK first. GitHub: github.com/LukasNiessen/t…

While working on @compliancetf, I created a Claude skill called terraform-skill (terraform-best-practices + other trusted sources). In 2026, please stop saying "AI hallucinates with #Terraform". Use HashiCorp MCP + this skill so answers are grounded in real docs and battle-tested patterns. Feedback welcome, and shares appreciated. 🚀 github.com/antonbabenko/t…

#276 - Terragrunt structure secrets, IaC that acts like software, Lambda on your own EC2, AzAPI unlocks Azure Actions, and AI that scans your Terraform weekly.tf/p/issue-276-te…

Was a bit skeptical reading this first but interesting part here is the agent verifying its own fixes against prod instead of trusting CI. Also funny from where I sit - a retry storm and a connection race are the kind of bugs that get provisioned wrong in Terraform on day one and surface as app bugs six months later. So you want this loop for cleanup, and you want your modules making these errors impossible in the first place. Fascinating.

I've maintained terraform-aws-modules for years. They are general-purpose on purpose, and that leaves a gap: the module is fine, the compliant configuration is your problem. This registry is my answer. Same modules, controls already in the code you pull. compliance.tf/blog/complianc… #ComplianceAsCode

Sponsored by Kestra (@kestra_io) #ad Terraform is great at creating infra. It has no opinion about Day 2. IP changes -> DNS is wrong -> cache is stale -> someone has to know. That always ends up in a shell script nobody wants to open. So I ran the follow-up right after apply, in one Git-versioned file: ```yaml tasks: - id: provision type: io.kestra.plugin.terraform.cli.TerraformCLI commands: - terraform apply -auto-approve - terraform output -raw instance_ip > ip.txt outputFiles: [ip.txt] - id: upsert_dns type: io.kestra.plugin.cloudflare.dns.records.Upsert name: "{{ inputs.record_name }}" content: "{{ read(outputs.provision.outputFiles['ip.txt']) | trim }}" ``` Terraform's output feeds the DNS update. Logs + full run history on every run. No glue script. This is a @kestra_io flow - YAML, self-hosted, runs on cloud, on-prem, or air-gapped. Clone this Playbook Automation Blueprint to try it now: fandf.co/4o16nCO

@Bhavani_00007 Why not use both simultaneously to do cross-models verification (using Grok&Gemini as well) - github.com/antonbabenko/d…

I'm a Claude user. Give me one reason to switch to Codex

@rachelnocode @Bhavani_00007 That’s exactly the point I am chasing with cross-model verification - github.com/antonbabenko/d…

@Bhavani_00007 a second opinion. Codex catches stuff Claude misses sometimes (and vice versa)

My recent talk "Replace Terraform Module Forks with Automatic Policy Transformation Rules" from @iac_conf youtube.com/watch?v=at56UP…

@the_mentor Secure what? :) Treat it like every other dependency in your toolchain.

@antonbabenko This project looks very promising I just don't know how I can validate it and check if it's secure 🔐 🤔

terraform-skill now ships as Kiro Powers! Same Terraform/OpenTofu skill, no fork - the Power is generated from the skill file, so Kiro and all other AI coding agents share one source. Module reviews, tests, CI, and state ops, all of it. ⭐️⭐️⭐️ Almost 2000 stars on GitHub! THANK YOU ALL! #terraform #opentofu #kiro #agentic github.com/antonbabenko/t…