forms.takoform.com/v1alpha1 · pre-release

Portable Service Forms for Terraform & OpenTofu.

Declare typed, vendor-neutral service resources once. Any conforming host selects and operates the concrete backend — your state stays clean, exact, and portable.

View on GitHub Read the specification
  • MIT-licensed spec & provider
  • Ten statically typed resources
  • Data-only Form Packages
main.tf
terraform {
  required_providers {
    takoform = {
      source = "registry.terraform.io/tako0614/takoform"
    }
  }
}

provider "takoform" {
  endpoint = "https://forms.example.com"
  space    = "prod"
}

resource "takoform_object_bucket" "assets" {
  name       = "assets"
  interfaces = ["s3_api"]
}

One form. Any host.

Takoform separates what a service should be from who runs it. The provider is deliberately thin; the host owns every operational decision.

01

Declare

Ten statically typed takoform_* resources describe the service you want — an object bucket, a queue, a SQL database — never which vendor runs it.

02

Send

The provider negotiates capabilities with any conforming host over the forms.takoform.com/v1alpha1 contract and submits desired state. No plan-time remote mutation.

03

The host operates

The host selects backends, holds credentials, and performs the operations. Provider state carries only canonical identity, generation fences, drift status, and sanitized public outputs.

The ten forms

An all-or-nothing standard set. Each resource pins an exact, digest-verified 1.0.0 / standard definition candidate.

takoform_edge_workerPrebuilt edge Worker artifact
takoform_object_bucketObject storage
takoform_kv_storeKey/value storage
takoform_queueMessage queue
takoform_sql_databaseSQL database
takoform_container_serviceOCI container service
takoform_vector_indexVector index
takoform_durable_workflowDurable workflow
takoform_stateful_actor_namespaceStateful actor namespace
takoform_scheduleCron-triggered invocation

Deliberately absent: target pools, backends, credentials, prices, quotas, billing, and operator policy. Those belong to the host.

Built fail-closed

Data-only packages

Form definitions and fixtures are strict UTF-8 I-JSON, canonicalized with RFC 8785 and digest-pinned. No remotely executable code, ever.

Fail-closed trust

Keyless Sigstore signing with transparency bundles, SPDX 2.3 and SLSA v1 evidence, and hash-chained revocation checkpoints. Anything unproven is rejected.

Host-owned operations

Backend placement, admission, and credentials are host responsibilities. The provider never becomes a control plane.

Exact identity

Exact FormRefs, package digests, and provider FQNs are never interchangeable. Terraform and OpenTofu lifecycles are proven independently, as a matrix.

The portable specification

Four committed surfaces, one vendor-neutral contract. A conforming Takosumi host is one consumer of this contract — not its owner.

  • spec/host-api Discovery, capability negotiation, preview, apply, observe, and delete.
  • spec/form-definition Exact FormRef identity and the data-only Form Definition contract.
  • spec/form-package Package-index identity, closed payload rules, and the local verifier boundary.
  • spec/trust The provider / Form Package trust decision and its machine-readable fail-closed profile.

Where the project stands

This page claims nothing beyond signed, committed evidence in the repository.

Implemented today

  • FormRef, Form Definition, package-index, and revocation-checkpoint schemas
  • RFC 8785 / I-JSON library and a closed, offline package verifier
  • Ten typed provider resources with full CRUD, import, and drift lifecycle
  • OpenTofu + Terraform lifecycle conformance run as one fail-closed matrix
  • Protected keyless release lane and append-only revocation checkpoints

Not yet claimed

  • No Form Package has been published
  • The provider is not yet released on the Terraform Registry or OpenTofu Registry
  • Standard definitions are structural-candidate, not portable-standard
  • Host-side fetch, install, activation, and revocation enforcement remain consumer / operator work

Try it locally

shell
# clone and run the full local evidence suite
git clone https://github.com/tako0614/terraform-provider-takoform
cd terraform-provider-takoform

go test ./...
go run ./cmd/conformance verify
go run ./cmd/form-package conformance
go run ./cmd/provider-lifecycle-conformance matrix --opentofu tofu --terraform terraform