- providers.tf / variables.tf / versions.tf: bpg/proxmox ~> 0.84, endpoint and
credentials from TF_VAR_* (set by the Makefile tofu-* targets from the
repo-root .env). Two auth modes: root@pam by password (privileged: features
beyond nesting, device passthrough, datastore mount points) or the
ansible@pve token.
- README.md: pilot results on VMID 199 - what the token can and cannot do,
why a root token still fails the literal `$authuser eq 'root@pam'` check,
the cmode/console drift finding, and the chosen root@pam-by-password mode.
- pilot.tf.example: reference resource shape (features, device_passthrough,
mount_point), not loaded (.example).
- .terraform.lock.hcl: pin the provider.
State has no backend yet; tofu/*.tfstate stays local and git-ignored.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
