- Idempotent — Applying the same config twice does nothing. Unchanged resources are skipped (SHA256 checksum comparison).
- Config-managed tracking — Resources created via config are tagged with
managed_by: "config". The system won’t overwrite resources that were created manually (it warns instead). - Environment variable interpolation — Use
${VAR_NAME}in values (e.g.,apiKey: "${OPENAI_API_KEY}"). - Reference validation — Cross-references (e.g., an agent referencing a function) are validated before applying.
- Dry run — Set
dryRun: trueto preview changes without applying.