/arn-infra-execute-change

name: arn-infra-execute-change
description: >-
  This skill should be used when the user says "execute infra change",
  "run infra plan", "apply infrastructure change", "execute change",
  "arn infra execute", "deploy infra plan", "execute infrastructure plan",
  "run infrastructure change", "apply infra plan", "infra execute",
  "arn-infra-execute-change", or wants to orchestrate the phased execution
  of a structured infrastructure change plan, invoking agents for IaC
  generation, security gates, cost gates, deployment, verification, and review.
version: 1.0.0

Arness Infra Execute Change

Orchestrate the phased execution of a structured infrastructure change plan. For each phase, this skill runs a 7-step dispatch loop: rollback checkpoint, IaC generation, security gate, cost gate, deployment, verification, and review gate. It tracks progress in PROGRESS_TRACKER.json and produces per-phase INFRA_CHANGE_REPORT_PHASE_N.json reports.

This skill consumes the structured project created by `arn-infra-save-plan` and coordinates all existing infrastructure agents (specialist, security-auditor, cost-analyst, verifier) plus the new change-reviewer agent.

Pipeline position:

arn-infra-init -> arn-infra-change-spec -> arn-infra-change-plan -> arn-infra-save-plan -> **arn-infra-execute-change** -> arn-infra-review-change -> arn-infra-document-change

Prerequisites

Read `## Arness` from the project's CLAUDE.md. If no `## Arness` section exists or Arness Infra fields are missing, inform the user: "Arness Infra is not configured for this project yet. Run `/arn-infra-wizard` to get started — it will set everything up automatically." Do not proceed without it.

Check the **Deferred** field. If `Deferred: yes`, inform the user: "Infrastructure is in deferred mode. Change execution is not available until infrastructure is fully configured. Run `/arn-infra-assess` to un-defer." Stop.

Extract:

• **Infra plans directory** -- where structured plan projects live (default: `.arness/infra-plans`)
• **Providers** -- cloud providers configured
• **Providers config** -- path to `providers.md`
• **Environments** -- environment names in promotion order
• **Environments config** -- path to `environments.md`
• **Experience level** -- derived from user profile. Read `~/.arness/user-profile.yaml` (or `.claude/arness-profile.local.md` if it exists — project override takes precedence). Apply the experience derivation mapping from `${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-ensure-config/references/experience-derivation.md`. If no profile exists, check for legacy `Experience level` in `## Arness` as fallback.
• **Cost threshold** -- monthly budget limit for cost gate warnings (default: `100`)
• **Default IaC tool** -- default IaC tool
• **Tooling manifest** -- path to `tooling-manifest.json`
• **Resource manifest** -- path to `active-resources.json`

Locate the Structured Plan Project

Search for structured plan projects in the **Infra plans directory**:

Glob <infra-plans-dir>/*/PROGRESS_TRACKER.json

**If one project found:** Auto-select it. **If multiple projects found:** Present the list with project names and overall status from each PROGRESS_TRACKER.json. Ask the user to select. **If no project found:** Inform the user: "No structured plan project found. Run `/arn-infra-save-plan` to create one from a plan preview."

Read `PROGRESS_TRACKER.json` to determine current phase and execution state. If a phase is `in_progress`, offer to resume from the last completed step.

---

Workflow

Step 1: Present Execution Plan

Read the project's INTRODUCTION.md and present an execution summary:

"**Infrastructure Change Execution:**

• **Project:** [project name]
• **Phases:** [total] ([completed] completed, [remaining] remaining)
• **Current phase:** [N] -- [title] (targeting [environment])
• **Blast radius:** [classification for current phase]
• **Cost budget remaining:** $[amount]

Proceed with Phase [N]?"

**Token consumption warning:** If the project has 5+ phases or 20+ resources, warn: "This is a large change with [N] phases and [M] resources. Execution will consume significant context. Consider executing one phase at a time."

---

Step 2: Per-Phase Dispatch Loop

> Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-execute-change/references/dispatch-loop.md` for the detailed dispatch loop logic.

For the current phase, execute the 7-step dispatch loop:

Step 2.1: Create Rollback Checkpoint

Before making any changes, create a rollback checkpoint:

• Backup IaC state files (state pull/export)
• Record the current resource manifest state
• Note the checkpoint path in the phase report

Update PROGRESS_TRACKER.json: set phase execution status to `in_progress`.

Step 2.2: Invoke IaC Generation (arn-infra-specialist)

Read the phase plan (`PHASE_N_PLAN.md`) and invoke the `arn-infra-specialist` agent with structured context:

--- PHASE PLAN ---
[full content of PHASE_N_PLAN.md]
--- END PHASE PLAN ---

--- PROVIDER CONFIG ---
[provider configuration from providers.md]
--- END PROVIDER CONFIG ---

--- INFRASTRUCTURE CONTEXT ---
Project: [project name]
Phase: [N] of [total]
Environment: [target environment]
IaC Tool: [tool]
Blast Radius: [classification]
--- END INFRASTRUCTURE CONTEXT ---

--- GENERATION INSTRUCTIONS ---
Generate the IaC configurations for all resources listed in the phase plan.
Follow the resource specifications exactly. Use the configured IaC tool.
Generate environment-specific variable files. Include resource tagging.
--- END GENERATION INSTRUCTIONS ---

Step 2.3: Security Gate (arn-infra-security-auditor)

> Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-infra-execute-change/references/gate-policies.md` for security gate enforcement rules.

Invoke the `arn-infra-security-auditor` agent via the Task tool to scan the generated IaC, passing the model from `.arness/agent-models/infra.md` as the `model` parameter (see `plugins/arn-infra/skills/arn-infra-ensure-c