groundhold — used technologies

A dependency-light Go tool that verifies infrastructure contracts deterministically and executes them across five providers and Kubernetes.

Core

GoSingle binary, near-zero third-party dependencies by design.
YAML contractsProvider-agnostic intent documents, verified before anything runs.
Deterministic verifierNo LLM, no network, no heuristics — four-valued verdicts: satisfied, violated, unknown, unverifiable.

Providers

AWS, GCP, AzureAll three closed the execution loop against real accounts.
Hetzner, Cloudflare, UpstashAdditional first-class providers.
KubernetesExercised against a real k3s/k8s cluster.

Interfaces

CLIverify, plan, converge, observe, explain.
MCP serverModel Context Protocol — usable directly by AI agents, with the deterministic verifier still deciding.

Supply chain security

SLSA provenanceKeyless build-provenance attestation on every published asset.
CycloneDX SBOMShipped with every release.
Reproducible buildsChecksummed releases with build info.

CI/CD

GitHub ActionsCI, lint and release pipelines.
CodeQLStatic analysis security scanning.
Dedicated security workflowRuns alongside CI on every change.
DCO enforcementDeveloper Certificate of Origin required on every commit.

Licensing

Apache-2.0 / MPL-2.0Dual-licensed, open source.