feat: provision one pilot number per primary agent

[xnoto]

Summary

Owner-approved purchase of exactly four Twilio phone numbers: one US local SMS/MMS-capable number per primary agent (lawnmowerman, grillmaster, homesteader, homerepair), declared with search_criteria purchase in numbers.tf. The account SID reaches OpenTofu only as TF_VAR_account_sid inside the existing SOPS exec-env child. No inbound messaging webhook is configured.

Fixes # N/A — owner approved four-number provisioning on 2026-09-04; area code/number type unspecified, so the purchase defaults to any available US local number with SMS and MMS capability.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan passed on head 01ba0307e3d30758137f379cb4fce32f87e6bb01 (after the workflow's automatic terraform-docs README fix at 1992f8d2). The credentialed plan reports 4 to add, 0 to change, 0 to destroy — exactly the four twilio_phone_number.agent resources and the agent_phone_numbers output; the provider authenticated through the SOPS-injected environment with no other account change.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — the README terraform-docs section was regenerated by the shared workflow's pre-commit auto-fix; the two centrally generated Dependabot files are untouched.

No local OpenTofu, Makefile, SOPS, state, import, plan, or apply operation was run.

Impact and rollout

Producer: merged credential delivery at e325cba5 and provider authentication at a04c7836 supply the validated SOPS-only authentication this change consumes. Consumer: numbers.tf adds four twilio_phone_number.agent resources and one non-sensitive agent_phone_numbers output; the Makefile injects TF_VAR_account_sid from the SOPS child for plan and apply only.

Merging submits the environment-gated main apply, which purchases the four numbers (recurring Twilio charges begin). The PR plan shows the four creations without contacting Twilio beyond provider credential validation. Purchased values land only in remote state and the output, which later feeds the kustomize-cluster routing secret. The messaging webhook block deliberately remains unset until the bridge is deployed, healthy, and separately approved; this PR changes nothing else in the account.

Rollback is a reviewed change removing the resources (releasing the numbers) or a revert before merge. search_criteria resources cannot be imported, so each future replacement forces a fresh purchase.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints — the account SID is referenced only as a process-scoped variable inside sops exec-env.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes — number purchase begins recurring billing at apply time.

GitHub Advanced Security secret scanning is unavailable for this repository; the changed source was manually reviewed. AI agent materially produced this change; reviewers should confirm the four-agent resource set, US local SMS/MMS search criteria, the TF_VAR injection path, and the absence of any webhook or bridge-runtime ownership.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # twilio_phone_number.agent["grillmaster"] will be created
  + resource "twilio_phone_number" "agent" {
      + account_sid            = "ACd4bedd2459ed934014d92be908474ecc"
      + address_requirements   = (known after apply)
      + beta                   = (known after apply)
      + capabilities           = (known after apply)
      + date_created           = (known after apply)
      + date_updated           = (known after apply)
      + emergency_status       = (known after apply)
      + friendly_name          = "opencode-sms grillmaster"
      + id                     = (known after apply)
      + origin                 = (known after apply)
      + phone_number           = (known after apply)
      + sid                    = (known after apply)
      + status                 = (known after apply)
      + status_callback_method = "POST"

      + fax (known after apply)

      + messaging (known after apply)

      + search_criteria {
          + iso_country = "US"
          + type        = "local"

          + capabilities {
              + mms_enabled = true
              + sms_enabled = true
            }
        }

      + voice (known after apply)
    }

  # twilio_phone_number.agent["homerepair"] will be created
  + resource "twilio_phone_number" "agent" {
      + account_sid            = "ACd4bedd2459ed934014d92be908474ecc"
      + address_requirements   = (known after apply)
      + beta                   = (known after apply)
      + capabilities           = (known after apply)
      + date_created           = (known after apply)
      + date_updated           = (known after apply)
      + emergency_status       = (known after apply)
      + friendly_name          = "opencode-sms homerepair"
      + id                     = (known after apply)
      + origin                 = (known after apply)
      + phone_number           = (known after apply)
      + sid                    = (known after apply)
      + status                 = (known after apply)
      + status_callback_method = "POST"

      + fax (known after apply)

      + messaging (known after apply)

      + search_criteria {
          + iso_country = "US"
          + type        = "local"

          + capabilities {
              + mms_enabled = true
              + sms_enabled = true
            }
        }

      + voice (known after apply)
    }

  # twilio_phone_number.agent["homesteader"] will be created
  + resource "twilio_phone_number" "agent" {
      + account_sid            = "ACd4bedd2459ed934014d92be908474ecc"
      + address_requirements   = (known after apply)
      + beta                   = (known after apply)
      + capabilities           = (known after apply)
      + date_created           = (known after apply)
      + date_updated           = (known after apply)
      + emergency_status       = (known after apply)
      + friendly_name          = "opencode-sms homesteader"
      + id                     = (known after apply)
      + origin                 = (known after apply)
      + phone_number           = (known after apply)
      + sid                    = (known after apply)
      + status                 = (known after apply)
      + status_callback_method = "POST"

      + fax (known after apply)

      + messaging (known after apply)

      + search_criteria {
          + iso_country = "US"
          + type        = "local"

          + capabilities {
              + mms_enabled = true
              + sms_enabled = true
            }
        }

      + voice (known after apply)
    }

  # twilio_phone_number.agent["lawnmowerman"] will be created
  + resource "twilio_phone_number" "agent" {
      + account_sid            = "ACd4bedd2459ed934014d92be908474ecc"
      + address_requirements   = (known after apply)
      + beta                   = (known after apply)
      + capabilities           = (known after apply)
      + date_created           = (known after apply)
      + date_updated           = (known after apply)
      + emergency_status       = (known after apply)
      + friendly_name          = "opencode-sms lawnmowerman"
      + id                     = (known after apply)
      + origin                 = (known after apply)
      + phone_number           = (known after apply)
      + sid                    = (known after apply)
      + status                 = (known after apply)
      + status_callback_method = "POST"

      + fax (known after apply)

      + messaging (known after apply)

      + search_criteria {
          + iso_country = "US"
          + type        = "local"

          + capabilities {
              + mms_enabled = true
              + sms_enabled = true
            }
        }

      + voice (known after apply)
    }

Plan: 4 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + agent_phone_numbers = {
      + grillmaster  = (known after apply)
      + homerepair   = (known after apply)
      + homesteader  = (known after apply)
      + lawnmowerman = (known after apply)
    }

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.