{"uid":"cap_kKfgUWa5cJSfRFFX-abBg","slug":"opentofu-state-encryption-roundtrip-verifier-1b698553","name":"OpenTofu State Encryption Roundtrip Verifier","description":"Takes an OpenTofu state snapshot and a passphrase, encrypts the snapshot through the pinned OpenTofu state-encryption code, then proves the result three ways: the authorized key recovers the state with an identical semantic hash, a wrong key is rejected, and a tampered payload is rejected. What comes back is the encrypted artifact plus those proofs and the resource-instance count, never the plaintext.","url":"https://agent.halowerk.com/v1/oss-tofu-encrypted-state-roundtrip?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"passphrase":{"type":"string","maxLength":1024,"minLength":32},"state_json":{"type":"string","maxLength":2097152,"minLength":1}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.0035","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.0035/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0035","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0035","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Y586slyFD1f2tHuzk0VA3","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0035","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Encrypts an OpenTofu state snapshot with a passphrase using native OpenTofu state-encryption code and returns the encrypted artifact plus three cryptographic proofs: correct key decrypts successfully, wrong key is rejected, and tampered payload is rejected.","exampleAgentPrompt":"Take this OpenTofu state JSON and encrypt it using the passphrase 'correct-horse-battery-staple-42xyz', then run the full roundtrip proof — confirm the right key recovers the state, a wrong key is rejected, and a tampered payload is detected, and tell me the resource instance count.","exampleUseCases":[{"title":"Pre-release state encryption audit","prompt":"Before we cut the v2.3 release, encrypt our production OpenTofu state with passphrase 'prod-infra-release-passphrase-2024-secure' and give me the full roundtrip proof — I need to confirm correct-key recovery works, wrong keys are blocked, and the payload tamper check fires correctly."},{"title":"CI pipeline encryption gate","prompt":"In our CI pipeline we need to verify state encryption is working — take this OpenTofu state snapshot and encrypt it with passphrase 'ci-pipeline-encryption-key-minimum32chars', then return the encrypted artifact and all three proofs so the pipeline can assert they all pass before deploying."},{"title":"Security compliance proof for auditors","prompt":"Our security auditor needs evidence that our OpenTofu state encryption is correctly implemented — encrypt this state JSON with the passphrase 'compliance-audit-key-halowerk-verified-2024' and produce the three proofs showing the right key decrypts it, a wrong key fails, and tampering is caught, plus the resource instance count."}],"resultDescription":"Returns the encrypted state artifact, a semantic hash of the recovered state, proof that the authorized passphrase recovers the state with matching hash, proof that a wrong key is rejected, proof that a tampered payload is rejected, and the resource instance count. Plaintext state is never returned.","failureModes":["Passphrase shorter than 32 characters returns a validation error","state_json exceeding 2MB limit is rejected with a payload-too-large error","Malformed or non-JSON state_json causes a parse error","OpenTofu encryption engine failure returns an internal error with no artifact","Network timeout on large state files may require retry"],"whenToPreferThis":"Choose this endpoint when you need cryptographic proof that OpenTofu state encryption is correctly implemented end-to-end — not just that encryption ran, but that the right key recovers the state, wrong keys fail, and tampered payloads are detected. Prefer this over generic encryption services when working specifically with OpenTofu/Terraform-compatible state format and needing the three-proof guarantee without ever exposing plaintext.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T00:33:35.619Z","isFirstParty":false,"canonicalSlug":"opentofu-state-encryption-roundtrip-verifier-1b698553"}