OpenTofu apply: 14 resources, 0 drift.
17.90 joules.

The OpenTofu language server (terraform-ls 0.34 via LSP 3.17) flags `nem_tier = "2.0"` as a deprecated enum at column 14 — NEM 3.0 took effect 2023-04-15. Autocomplete suggests `"3.0"` and surfaces the CPUC decision D.22-12-056 as the citation in hover.

Plan covers a PG&E utility account, a NEM 3.0 interconnection record, a 60A EV charger circuit on subpanel B, smart-meter registration, and 10 supporting resources. Planfile is serialized to HCL2 + JSON form (RFC 8259-shaped) and hashed: blake3:88ee2c47…001a. No provider drift detected during refresh.

cosign 2.4 fetches a Fulcio cert via GitHub OIDC, signs the planfile, and writes the signature + Rekor transparency-log entry (index 17,420,338). The plan_hash is now anchored — any tampering between plan and apply breaks the cosign verify gate.

Per MCP 2025-11 draft, the agent issues `tools/call` with name="tofu/apply" and the planfile URI. A Cedar predicate evaluates principal.role=="site-reliability" && resource.cost_estimate_usd < 200 — both true — and returns admit:true. The call's audit_id is sealed before invocation.

Apply executes serially against the PG&E provider (rate-limited to 4 rps) and the utility's smart-meter API. All 14 resources reach state=created in 6m12s; the state file is encrypted at rest with AES-256-GCM and uploaded to the backend with `lock_id` 9a4c-...-c0e2. Apply_hash matches plan_hash byte-for-byte.

Predicate type `https://in-toto.io/Statement/v1` with subject = state file sha256, materials = {planfile hash, provider versions, git commit}, products = {14 resource IDs}. Signed and pushed to the Rekor log alongside the cosign signature.

FOCUS 1.1 spec tags applied: `cost_center=cc-9241`, `service=interconnect-residential`, `joule_budget_per_day=240`. Cloud-cost API will roll up the spend by these dimensions; the joule_budget is read by Insights to alarm when daily energy crosses threshold.

A background loop re-runs `tofu plan -refresh-only` against the state and diffs the result. 96 checks per day; if drift ≠ 0, a `eng.drift.detected` receipt fires and the on-call channel gets the resource path. Last 30-day median drift: 0.