Makes this repository the home of did.bot's OpenTofu stacks: pds/, site/, policy-site/ and sidecar/. Each stack that runs didbot now pins a didbot commit: its didbot/ directory is a byte-for-byte copy of didbot's deploy/<stack>/ at that commit, and didbot/REVISION names it. The pin sets the pds image tag and each site's release tree, which used to be the container_image_tag and release_sha variables. scripts/sync-didbot.sh writes a pin, and scripts/check-didbot-pin.sh refuses a copy that differs. sidecar/ runs no didbot code and has no pin; its host still pulls the sidecar image from ECR Public.
scripts/deploy-pds.sh and scripts/release-site.sh deploy from the pin and commit it, so a deploy is one commit here. prek checks formatting, tofu validate in every stack, the pins and commit messages. The README, AGENTS.md, bring-up, zone handoff and sidecar pages document the stacks. Every backend.tf and backend.hcl is byte-identical to didbot's, so the existing states resolve unchanged.
Before the first apply from here, a human runs tofu plan -lock=false in each stack. The pins name didbot's deploy/ commit, which has no published image or uploaded tree yet, so re-pin pds/, site/ and policy-site/ with scripts/deploy-pds.sh <rev> and scripts/release-site.sh <stack> <rev> once that commit is merged and published, rather than applying the pins as they are. sidecar/ should plan no changes.
🤖 Generated with Claude Code