See and fix Terraform variable drift across every workspace

Build me a variable hygiene console for HCP Terraform. Config differences between environments are what break our applies, and nobody can see them in one place today because HCP Terraform only lets you edit variables one workspace at a time. This is an internal app my platform team opens to compare variables across workspaces and carefully close the gaps.

The main view is a parity matrix. Use List Workspaces for my organization to get the rows and List Workspace Variables for each workspace to fill the cells. The columns are the union of variable keys across the selected workspaces, grouped by category so Terraform variables and environment variables are visually separate. Each cell shows one of: value agrees with the rest of the row group, value disagrees, key missing on this workspace, or key set but sensitive. Highlight whole columns where a key exists in some workspaces and is missing in others, and highlight individual cells where non-sensitive values disagree. Badge every entry that is marked sensitive and every entry marked HCL, and treat a key that is HCL in one workspace but plain in another as a difference worth flagging. Let me filter rows by workspace name or tag and search columns by key so the grid stays usable with dozens of workspaces. Use Show Workspace to enrich each row header with the workspace's tags, Terraform version, and current run state.

Sensitive values are never displayed anywhere in this app, and never written into any output. HCP Terraform does not return them and the app must not try to infer or reconstruct them. For a sensitive key, show only whether it is set on that workspace, so the comparison is presence only. Put a short line in the legend that says plainly that secret values are never shown.

The second tab is variable sets. Use List Variable Sets for the organization, List Variables in Variable Set for each set's contents, and Show Variable Set for its scope and attached workspaces. Render each set with its variables, following the same sensitive rule, alongside the workspaces it is applied to and whether it is global. Flag workspaces that look like they should be inheriting a set but are not, for example a workspace whose peers in the same environment group all have that set attached. From this tab I can attach a set to selected workspaces with Apply Variable Set to Workspaces, or detach it with Remove Variable Set from Workspaces, each behind a confirmation dialog that names exactly which workspaces will be affected.

Let me pick one workspace as the reference, meaning the environment I treat as the source of truth, then pick any other workspace as the target and see the two side by side. The diff groups keys into: only in the reference, only in the target, in both but with different values, in both with differing sensitive or HCL flags, and in agreement. Remember my reference workspace choice per user so the console reopens where I left it.

On the diff view there is a Reconcile button that starts a background agent for that reference and target pair. The agent re-reads both workspaces with List Workspace Variables and Show Workspace, checks the relevant variable sets, and produces a proposed plan: a list of discrete changes where each one is a single add, update, or delete, with the key, its category, the current state on the target, the proposed state, and a one line rationale. Where the right fix is inheriting a shared variable set rather than copying values workspace by workspace, the agent should propose attaching that set instead. The agent writes the plan back into the app so the diff view renders it as a review queue, and it never applies anything itself.

Approval is per change. Each proposed line has its own Approve and Skip, there is no approve all, and nothing happens in bulk. When I approve one line the app performs exactly that change with Create Workspace Variable, Update Workspace Variable, or Delete Workspace Variable, or Apply Variable Set to Workspaces for an inheritance fix, then shows the result inline as applied or failed with the error and refreshes the affected row in the matrix. For any change touching a sensitive variable the agent may only propose an add or a delete, and for an add I have to type the value into the approval dialog myself, because the platform never returns the existing one.

Persist the reconcile plans, every approve or skip decision, who made it, when, and the outcome, so the console keeps a running audit trail per workspace pair. Show recent activity on the diff view and a small last reconciled indicator on each workspace row in the matrix.

Anywhere a difference appears, whether a matrix cell, a diff row, or a proposed change, give me a Raise a ticket button that files a GitHub issue with Create an Issue in a repository I configure in settings. Prefill the title with the variable key and the two workspace names, and the body with the category, the nature of the difference, and a pointer back to this view. Never put a sensitive value in the issue body. This is the escalation path for differences that need a change in our Terraform code rather than a console edit, and the resulting issue link should be stored next to that difference so the app shows a ticket already exists.

The people using this are platform engineers making careful edits to production configuration, so bias everything toward safety: read only until I explicitly act, one change at a time, always name the workspace being modified, and make write actions visually distinct from browsing.