Cohesive.Adapters.Aspire.Pulumi 0.1.0-alpha.87

Cohesive.Adapters.Aspire.Pulumi

This optional adapter connects a completed Cohesive.Infra target-deployment plan to Aspire's deployment pipeline and Pulumi's official Automation API.

It has deliberately narrow ownership:

• Cohesive declares requirements, selects target facilities, proves capability discharge, lowers readiness obligations, and retains lifecycle intent and provenance.
• Aspire owns the user-facing publish, deploy, destroy, and do pipeline, including progress and summaries.
• Pulumi owns provider reconciliation, stack state, previews/updates, resource outputs, and destruction.

The adapter does not translate every Cohesive node into provider resources, implement an IaC state engine, or reproduce Aspire's pipeline. It hands the exact compiled Cohesive realization to an existing Pulumi program. This is useful while Aspire has no built-in Pulumi deployment target, and leaves a clean replacement seam if one is added later.

AppHost usage

using Cohesive.Adapters.Aspire.Pulumi;

var builder = DistributedApplication.CreateBuilder(args);
var deploymentPlan = AriRemoteInfrastructure.Compile("production");
var repositoryRoot = AriRepository.RootDirectory;

builder.AddCohesivePulumiDeployment(
    name: "ari-production",
    plan: deploymentPlan,
    environmentName: "production",
    pulumiProjectName: "cohesive-ari-infra",
    pulumiStackName: "ari-prod",
    programDirectory: new("infra"),
    options: new(repositoryRoot));

builder.Build().Run();

The resource contributes four named Aspire pipeline steps:

• handoff materialization, required by Aspire publish, deploy, and destroy;
• Pulumi preview, available through aspire do cohesive-pulumi-{resource-name}-preview;
• Pulumi up, required by Aspire deploy;
• Pulumi destroy, required by Aspire destroy.

aspire publish writes cohesive.infra.pulumi.json as a deterministic one-way artifact. The named preview step performs a refresh-backed Pulumi preview without applying changes. aspire deploy and aspire destroy materialize the same artifact and invoke the existing Pulumi program through Automation API with refresh enabled. The Pulumi project name is validated before a stack is selected or created. The Pulumi lifecycle authority is derived from the selected target's managed resource bindings; the bridge rejects plans with no managed authority or more than one instead of asking the AppHost to restate canonical ownership.

Pulumi program contract

The Pulumi process receives these non-secret environment variables:

• COHESIVE_INFRA_HANDOFF_PATH: absolute path to the complete serialized handoff;
• COHESIVE_INFRA_HANDOFF_FINGERPRINT: exact handoff fingerprint;
• COHESIVE_INFRA_ENVIRONMENT: selected Cohesive/Aspire environment profile.

The Pulumi program can deserialize the handoff and lower the retained manifest and realization into provider resources. During incremental adoption it can also validate the handoff while existing resource declarations remain in place. Provider configuration and secrets continue to use Pulumi's normal configuration and secrets facilities.

Use AspirePulumiDeploymentHandoff.TryLoadFromEnvironment() in an existing Pulumi program. It returns null only when the complete bridge contract is absent for a temporary direct-Pulumi compatibility path; partially configured, invalid, or mismatched contracts fail. RequireExactPlan verifies a freshly compiled provider-configured plan against the persisted handoff without introducing an application-specific serialization protocol.

Pulumi output is forwarded to Aspire with Pulumi secret display disabled. Stack outputs are not copied into a second state model; applications should expose only intentionally selected values through explicit integration code.

Failure behavior

Handoff creation fails before Aspire registers the target when capability witnessing, readiness-obligation lowering, or target deployment diagnostics contain an error. It also rejects exact-fence mismatches and selected-target resources whose lifecycle authority differs from the declared Pulumi stack authority. Existing Cohesive diagnostics remain available on the input InfrastructureTargetDeploymentPlan and are retained in successful handoffs.

If Pulumi cannot complete an operation, its native output remains the provider-owned detailed diagnosis. The adapter also reports infra.aspire.pulumi.execution.failed and throws AspirePulumiDeploymentException; its structured, non-secret diagnostic attributes the failure to the requested operation, lifecycle authority, and exact handoff. The adapter does not parse provider messages into a parallel error model. Cancellation remains cancellation and is not reclassified as an execution failure.

The Aspire pipeline APIs used by version 13.5 are still marked for evaluation by Aspire. This package isolates that dependency from Cohesive.Infra and Cohesive.Adapters.Aspire; future Aspire pipeline changes or a native Pulumi deployment target can therefore be absorbed in this adapter without changing the canonical infrastructure IR.