[cons-tan-tan]

Summary

This prototype adds a Terraform provider that reads an existing secretspec.toml through the Go SDK and Rust resolver. Terraform configurations can reuse the manifest's storage configuration, profiles, scopes and derived values.

SecretSpec can generate and save missing values during resolution, including reads triggered by terraform plan. This provider refuses resolution that requires saving a generated or prompted value, while allowing existing values to be read.

• Add secretspec_secrets as an ephemeral resource and a data source. Both accept path, optional profile, scope and reason, and return a sensitive values map.
• Ephemeral results are omitted from state and saved plans and can be referenced in ephemeral contexts. The data source supports ordinary resource arguments and persists the entire returned map, including unused entries.
• Expose WithReadOnly and WithNoFiles in the Go SDK through strict native requests. Older libraries reject restricted requests before resolution. The provider enables both options; the Rust resolver rejects as_path declarations, including hidden dependencies, before fetching values.
• Move the existing read-only guard before generation so a refused command generator cannot run first. This also applies to serve --read-only; generation without provider storage remains allowed.
• Add local development instructions and examples, and run Terraform acceptance tests in the SDK CI job. The prototype uses development overrides for local testing.

Related to #233. This implements the read side of the SDK-backed provider prototype discussed in the comments. The AWS publication/naming module and broader coexistence guide are outside the scope of this PR.

Testing

Local plan/apply tests passed on Linux with Terraform 1.10.5 and 1.16.1, covering sensitive output, ephemeral omission from saved plans/state, data-source persistence and unchanged stores after refusal. Tests use temporary dotenv stores; live AWS backends were not exercised.

A legacy-ABI shim also confirmed that restricted calls never invoke the legacy resolver, while unrestricted calls still work.

[domenkozar]

The ctx.Err() check above only handles cancellation before resolution starts. builder.Load() does not receive the context, so if Terraform requests cancellation while a backend read or an allowed non-persisting command generator is running, that work continues and this RPC remains blocked until the native call returns. A hanging command can therefore prevent a graceful stop of plan/apply.

Could we propagate cancellation through the Go SDK/native resolver to backend operations and child processes, and add a test that cancels an in-flight resolution? Returning early from a Go goroutine alone would leave the native work running.