feat: configure inbound SMS webhooks

[xnoto]

Summary

Configures the existing four twilio_phone_number.agent resources to send incoming messages with POST to the healthy bridge endpoint: https://sms.makeitwork.cloud/twilio/inbound.

The shared endpoint is intentional: the cluster-owned bridge determines the target primary agent from the Twilio destination number. This root continues to own only Twilio phone-number inventory and per-number webhook fields.

Fixes #

None — owner-authorized Twilio integration completion.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — opentofu / test and opentofu / plan succeeded.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — no generated files changed; the resource/input/output schema is unchanged.
• The CI plan confirms the exact expected scope: 0 to add, 4 in-place webhook updates, 0 to destroy.
• Read-only rollout evidence confirmed the bridge Synced/Healthy, its two-container Pod ready with zero restarts, the TunnelBinding present, and GET https://sms.makeitwork.cloud/healthz returning {"status":"ok"}.

No local OpenTofu, SOPS, state, plan, or apply operation was run or claimed. The provider reference was verified against the current RJPearson94/twilio 0.27.1 resource documentation: messaging.url and messaging.method are supported, and POST is valid.

Impact and rollout

Producer / consumer: kustomize-cluster owns the healthy bridge, route, sender allowlist, number-to-agent mapping, and runtime secrets. tfroot-twilio changes only the messaging fields of the four existing Twilio number resources. The bridge image, chart, GitOps desired state, SOPS credential ciphertext, and Cloudflare ownership remain unchanged.

Confirmed apply scope: the environment-gated main apply will update only the inbound messaging URL/method on the four existing phone numbers. It will not purchase, replace, or release a number, nor change credentials, state-backend, or bridge-runtime configuration.

Confirmation-gated live stage: merging invokes the environment-gated main apply, which updates the live Twilio number webhooks. After a successful apply, verify the provider-reported change and then send a representative allowed-source SMS/MMS through the intended number. That functional test must confirm signature validation, queueing, primary-agent routing, and outbound delivery separately.

Rollback: use a reviewed change to remove or replace the messaging block; never alter the numbers, route, or bridge runtime manually in a console. Do not merge if the plan contains a number replacement or any scope beyond the four expected webhook updates.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes

GitHub Advanced Security secret scanning is unavailable for this repository. The three-file diff was manually reviewed; it contains only non-sensitive endpoint configuration and ownership documentation.

AI-assisted change: an OpenCode agent materially produced this change; reviewers should confirm the exact four-resource plan and the canonical ownership boundary before merging.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

  # twilio_phone_number.agent["grillmaster"] will be updated in-place
  ~ resource "twilio_phone_number" "agent" {
        id                     = "PN3db453e0dbbe18e024b609fcbab090a4"
        # (13 unchanged attributes hidden)

      ~ messaging {
          + url             = "https://sms.makeitwork.cloud/twilio/inbound"
            # (2 unchanged attributes hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # twilio_phone_number.agent["homerepair"] will be updated in-place
  ~ resource "twilio_phone_number" "agent" {
        id                     = "PN08b9385d6eb49a52e593f47d568bdc42"
        # (13 unchanged attributes hidden)

      ~ messaging {
          + url             = "https://sms.makeitwork.cloud/twilio/inbound"
            # (2 unchanged attributes hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # twilio_phone_number.agent["homesteader"] will be updated in-place
  ~ resource "twilio_phone_number" "agent" {
        id                     = "PN04710b0ff991f860a1f2685c69f62d38"
        # (13 unchanged attributes hidden)

      ~ messaging {
          + url             = "https://sms.makeitwork.cloud/twilio/inbound"
            # (2 unchanged attributes hidden)
        }

        # (2 unchanged blocks hidden)
    }

  # twilio_phone_number.agent["lawnmowerman"] will be updated in-place
  ~ resource "twilio_phone_number" "agent" {
        id                     = "PNd36f82c80264daef191509d3506acb2c"
        # (13 unchanged attributes hidden)

      ~ messaging {
          + url             = "https://sms.makeitwork.cloud/twilio/inbound"
            # (2 unchanged attributes hidden)
        }

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 4 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.