infrastructure

status → amber

ci → green (protected run 29406137267: Terraform fmt/validate, three-environment plan smoke, tflint, compose validation, coverage gate, and devops notification all passed)

deploy → Docker target verified through clean apply, service health, idempotent plan, and complete destroy; cloud target remains human-gated

Closed: INFRA-1

The Docker target now provisions Postgres, SpiceDB, BetterAuth, Jaeger, the shared network, generated secrets, and persistent storage as real Terraform-managed resources.

Postgres credentials are URL-encoded and consumers use the container-network endpoint; initialization SQL is uploaded through the Docker API so worktrees and remote Docker contexts behave consistently.

Live verification proved four expected databases, a successful SpiceDB migration, SERVING gRPC health, host-correct OIDC discovery, HTTP 200 metrics and Jaeger probes, and a zero-change detailed-exitcode plan.

Final destroy removed all 13 resources; no managed container, network, volume, or Terraform state entry remained. Infrastructure master ef49038 contains the implementation and evidence checklist.