Plan review — the d/dt change gate

dxdt plan review annotates an infrastructure change against your live environment: the dependency graph DXDT has mapped, your incident history, open findings, and the facts your team has taught it. It answers the question a staff SRE would: "this change touches the path that caused the March outage — are you sure?"

Read-only, guaranteed. The review only reads your tenant's data and never executes anything. Every response carries "read_only": true, and every concern cites its evidence — an incident, a finding, a graph dependency, or a taught fact. Resources DXDT hasn't mapped are reported as unknown, never guessed at.

CLI

terraform plan -out=plan.out
terraform show -json plan.out | dxdt plan review

# or from a file / diff, with a CI threshold:
dxdt plan review --file plan.json --fail-on high

Exit codes: 0 ok, 1 risk at/above --fail-on (default high) or error. Use --fail-on never for report-only mode and --json for machine output.

GitHub Actions

name: dxdt-plan-review
on: [pull_request]

jobs:
  plan-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - run: terraform init && terraform plan -out=plan.out
      - run: terraform show -json plan.out > plan.json

      - name: DXDT plan review
        run: |
          curl -fsSL https://console.dxdt.ai/install.sh | sh
          dxdt plan review --file plan.json --fail-on high
        env:
          DXDT_TOKEN: ${{ secrets.DXDT_TOKEN }}
          DXDT_HOST: https://console.dxdt.ai

Mint the token in the web app under Settings → CLI & API → Create token (tokens are always created from a browser session — see Authentication) and store it as the DXDT_TOKEN repository secret. Plan review is a mutating call, so the token needs the read_write scope.

Any CI (raw API)

curl -fsS https://console.dxdt.ai/api/v1/plan-review \
  -H "Authorization: Bearer $DXDT_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"plan\": $(jq -Rs . < plan.json)}"

Response shape:

{
  "overall_risk": "high",
  "summary": "...",
  "annotations": [
    {"address": "google_sql_database_instance.replica",
     "severity": "high",
     "concern": "Destroys the replica that serves payments-api reads.",
     "evidence": "Graph: payments-api DEPENDS_ON sql-replica-ew1; incident 'Payments latency' (2026-03-03)."}
  ],
  "read_only": true
}