feat(playground): plan the scenarios as changes to existing infrastructure

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+- The AWS Dialect presents AWS resources with the official AWS Architecture
+  Icons, and the Azure Dialect presents node pools, blob containers, storage
+  queues, public IP addresses and virtual network peerings with official Azure
+  icons.
+
 ## 0.2.0
 
 - Analyze Terraform and OpenTofu plan and state exports into portable Forms,

README.md

@@ -49,7 +49,9 @@ contain secrets.
 ## Compare and check
 
 Try the synthetic [commerce sample](examples/playground/commerce-platform/)
-from the repository root:
+from the repository root. Its `base` plan reads the existing infrastructure
+with no changes, its `head` plan is the proposed change against the same
+state, and the first command compares the two:
 
 ```bash
 rootform run examples/playground/commerce-platform/base/plan.json \
@@ -60,7 +62,7 @@ rootform run examples/playground/commerce-platform/base/plan.json \
 rootform check comparison.json --policy-pack ./policy-packs/baseline -o results.sarif
 ```
 
-Comparison reports differences between the supplied evidence. Policy checks
+The comparison reports the architectural difference between the two plans. Policy checks
 return `0` on pass, `1` on a violation and `3` for indeterminate evidence or
 no target. See [outputs and exit status](docs/reference/outputs.md),
 [review workflows](docs/workflows/index.md), [evidence limits](docs/limitations.md)

dialects/aws/presentation.json

@@ -1,114 +1,114 @@
 {
   "format_version": "1",
   "rules": {
-    "alb": "generic/load-balancer",
-    "alb-target-group": "generic/load-balancer",
-    "api-gateway-integration": "generic/entity",
-    "api-gateway-model": "generic/entity",
-    "api-gateway-resource": "generic/entity",
-    "api-gateway-rest-api": "generic/entity",
-    "api-gateway-stage": "generic/entity",
-    "apigatewayv2-api": "generic/entity",
-    "apigatewayv2-model": "generic/entity",
-    "appsync-datasource": "generic/entity",
-    "appsync-function": "generic/entity",
-    "appsync-graphql-api": "generic/entity",
-    "appsync-resolver": "generic/entity",
-    "bedrockagent-agent": "generic/entity",
-    "bedrockagent-agent-action-group": "generic/entity",
-    "cloudwatch-event-bus": "generic/entity",
-    "cloudwatch-event-rule": "generic/entity",
-    "cloudwatch-event-target": "generic/entity",
-    "cognito-user-group": "generic/identity",
-    "cognito-user-pool": "generic/scope",
-    "cognito-user-pool-domain": "generic/identity",
-    "connect-contact-flow": "generic/entity",
-    "connect-instance": "generic/entity",
-    "connect-queue": "generic/entity",
-    "connect-routing-profile": "generic/entity",
-    "connect-security-profile": "generic/entity",
-    "connect-user-hierarchy-group": "generic/entity",
-    "dax-cluster": "generic/database",
-    "db-instance": "generic/database",
-    "db-proxy": "generic/database",
-    "db-proxy-default-target-group": "generic/database",
-    "db-proxy-endpoint": "generic/database",
-    "docdb-cluster": "generic/database",
-    "docdb-cluster-instance": "generic/database",
-    "dsql-cluster": "generic/database",
-    "dynamodb-global-secondary-index": "generic/database",
-    "dynamodb-table": "generic/database",
-    "ec2-transit-gateway": "generic/network",
-    "ec2-transit-gateway-vpc-attachment": "generic/network",
-    "ecr-lifecycle-policy": "generic/compute",
-    "ecr-repository": "generic/compute",
-    "ecs-cluster": "generic/compute",
-    "ecs-service": "generic/compute",
-    "efs-file-system": "generic/storage",
-    "eks-cluster": "kubernetes/cluster",
-    "eks-fargate-profile": "generic/compute",
-    "eks-node-group": "generic/compute",
-    "elasticache-cluster": "generic/database",
-    "elasticache-replication-group": "generic/database",
-    "elb": "generic/load-balancer",
-    "emr-cluster": "generic/entity",
-    "emr-instance-fleet": "generic/entity",
-    "emr-instance-group": "generic/entity",
-    "fsx-lustre-file-system": "generic/storage",
-    "fsx-ontap-file-system": "generic/storage",
-    "fsx-openzfs-file-system": "generic/storage",
-    "fsx-windows-file-system": "generic/storage",
-    "globalaccelerator-accelerator": "generic/load-balancer",
-    "globalaccelerator-custom-routing-accelerator": "generic/load-balancer",
-    "globalaccelerator-custom-routing-endpoint-group": "generic/load-balancer",
-    "globalaccelerator-custom-routing-listener": "generic/load-balancer",
-    "globalaccelerator-endpoint-group": "generic/load-balancer",
-    "globalaccelerator-listener": "generic/load-balancer",
-    "iam-group": "generic/identity",
-    "iam-instance-profile": "generic/identity",
-    "iam-role": "generic/identity",
-    "iam-role-policy-attachment": "generic/identity",
-    "identitystore-group": "generic/identity",
-    "instance": "generic/entity",
-    "internet-gateway": "generic/network",
-    "kms-alias": "generic/entity",
-    "kms-key": "generic/entity",
-    "lb": "generic/load-balancer",
-    "lb-listener": "generic/load-balancer",
-    "lb-target-group": "generic/load-balancer",
-    "memorydb-cluster": "generic/database",
-    "nat-gateway": "generic/network",
-    "neptune-cluster": "generic/database",
-    "neptune-cluster-instance": "generic/database",
-    "network-acl": "generic/network",
-    "pinpoint-adm-channel": "generic/entity",
-    "pinpoint-apns-channel": "generic/entity",
-    "pinpoint-apns-sandbox-channel": "generic/entity",
-    "pinpoint-apns-voip-channel": "generic/entity",
-    "pinpoint-apns-voip-sandbox-channel": "generic/entity",
-    "pinpoint-app": "generic/entity",
-    "pinpoint-baidu-channel": "generic/entity",
-    "pinpoint-email-channel": "generic/entity",
-    "pinpoint-event-stream": "generic/entity",
-    "pinpoint-gcm-channel": "generic/entity",
-    "pinpoint-sms-channel": "generic/entity",
-    "rds-cluster": "generic/database",
-    "rds-cluster-activity-stream": "generic/database",
-    "rds-cluster-endpoint": "generic/database",
-    "rds-cluster-instance": "generic/database",
-    "route-table": "generic/network",
-    "s3-bucket": "generic/storage",
-    "s3-bucket-server-side-encryption-configuration": "generic/storage",
-    "s3-bucket-versioning": "generic/storage",
-    "s3-directory-bucket": "generic/storage",
+    "alb": "aws/elastic-load-balancing",
+    "alb-target-group": "aws/elastic-load-balancing",
+    "api-gateway-integration": "aws/api-gateway",
+    "api-gateway-model": "aws/api-gateway",
+    "api-gateway-resource": "aws/api-gateway",
+    "api-gateway-rest-api": "aws/api-gateway",
+    "api-gateway-stage": "aws/api-gateway",
+    "apigatewayv2-api": "aws/api-gateway",
+    "apigatewayv2-model": "aws/api-gateway",
+    "appsync-datasource": "aws/appsync",
+    "appsync-function": "aws/appsync",
+    "appsync-graphql-api": "aws/appsync",
+    "appsync-resolver": "aws/appsync",
+    "bedrockagent-agent": "aws/bedrock",
+    "bedrockagent-agent-action-group": "aws/bedrock",
+    "cloudwatch-event-bus": "aws/eventbridge-custom-event-bus",
+    "cloudwatch-event-rule": "aws/eventbridge-rule",
+    "cloudwatch-event-target": "aws/eventbridge",
+    "cognito-user-group": "aws/cognito",
+    "cognito-user-pool": "aws/cognito",
+    "cognito-user-pool-domain": "aws/cognito",
+    "connect-contact-flow": "aws/connect",
+    "connect-instance": "aws/connect",
+    "connect-queue": "aws/connect",
+    "connect-routing-profile": "aws/connect",
+    "connect-security-profile": "aws/connect",
+    "connect-user-hierarchy-group": "aws/connect",
+    "dax-cluster": "aws/dynamodb-accelerator",
+    "db-instance": "aws/rds-instance",
+    "db-proxy": "aws/rds-proxy",
+    "db-proxy-default-target-group": "aws/rds",
+    "db-proxy-endpoint": "aws/rds-proxy",
+    "docdb-cluster": "aws/documentdb",
+    "docdb-cluster-instance": "aws/documentdb",
+    "dsql-cluster": "aws/aurora",
+    "dynamodb-global-secondary-index": "aws/dynamodb-global-secondary-index",
+    "dynamodb-table": "aws/dynamodb-table",
+    "ec2-transit-gateway": "aws/transit-gateway",
+    "ec2-transit-gateway-vpc-attachment": "aws/transit-gateway-attachment",
+    "ecr-lifecycle-policy": "aws/ecr",
+    "ecr-repository": "aws/ecr",
+    "ecs-cluster": "aws/ecs",
+    "ecs-service": "aws/ecs-service",
+    "efs-file-system": "aws/efs-file-system",
+    "eks-cluster": "aws/eks",
+    "eks-fargate-profile": "aws/fargate",
+    "eks-node-group": "aws/ec2-instances",
+    "elasticache-cluster": "aws/elasticache",
+    "elasticache-replication-group": "aws/elasticache",
+    "elb": "aws/classic-load-balancer",
+    "emr-cluster": "aws/emr-cluster",
+    "emr-instance-fleet": "aws/emr",
+    "emr-instance-group": "aws/emr",
+    "fsx-lustre-file-system": "aws/fsx-lustre",
+    "fsx-ontap-file-system": "aws/fsx-netapp-ontap",
+    "fsx-openzfs-file-system": "aws/fsx-openzfs",
+    "fsx-windows-file-system": "aws/fsx-windows",
+    "globalaccelerator-accelerator": "aws/global-accelerator",
+    "globalaccelerator-custom-routing-accelerator": "aws/global-accelerator",
+    "globalaccelerator-custom-routing-endpoint-group": "aws/global-accelerator",
+    "globalaccelerator-custom-routing-listener": "aws/global-accelerator",
+    "globalaccelerator-endpoint-group": "aws/global-accelerator",
+    "globalaccelerator-listener": "aws/global-accelerator",
+    "iam-group": "aws/iam",
+    "iam-instance-profile": "aws/iam",
+    "iam-role": "aws/iam-role",
+    "iam-role-policy-attachment": "aws/iam-permissions",
+    "identitystore-group": "aws/iam-identity-center",
+    "instance": "aws/ec2-instance",
+    "internet-gateway": "aws/internet-gateway",
+    "kms-alias": "aws/kms",
+    "kms-key": "aws/kms",
+    "lb": "aws/elastic-load-balancing",
+    "lb-listener": "aws/elastic-load-balancing",
+    "lb-target-group": "aws/elastic-load-balancing",
+    "memorydb-cluster": "aws/memorydb",
+    "nat-gateway": "aws/nat-gateway",
+    "neptune-cluster": "aws/neptune",
+    "neptune-cluster-instance": "aws/neptune",
+    "network-acl": "aws/network-acl",
+    "pinpoint-adm-channel": "aws/end-user-messaging",
+    "pinpoint-apns-channel": "aws/end-user-messaging",
+    "pinpoint-apns-sandbox-channel": "aws/end-user-messaging",
+    "pinpoint-apns-voip-channel": "aws/end-user-messaging",
+    "pinpoint-apns-voip-sandbox-channel": "aws/end-user-messaging",
+    "pinpoint-app": "aws/end-user-messaging",
+    "pinpoint-baidu-channel": "aws/end-user-messaging",
+    "pinpoint-email-channel": "aws/end-user-messaging",
+    "pinpoint-event-stream": "aws/end-user-messaging",
+    "pinpoint-gcm-channel": "aws/end-user-messaging",
+    "pinpoint-sms-channel": "aws/end-user-messaging",
+    "rds-cluster": "aws/rds",
+    "rds-cluster-activity-stream": "aws/rds",
+    "rds-cluster-endpoint": "aws/rds",
+    "rds-cluster-instance": "aws/aurora-instance",
+    "route-table": "aws/vpc-router",
+    "s3-bucket": "aws/s3-bucket",
+    "s3-bucket-server-side-encryption-configuration": "aws/s3",
+    "s3-bucket-versioning": "aws/s3",
+    "s3-directory-bucket": "aws/s3-directory-bucket",
     "security-group": "generic/network",
-    "sns-topic": "generic/entity",
-    "sns-topic-subscription": "generic/entity",
+    "sns-topic": "aws/sns-topic",
+    "sns-topic-subscription": "aws/sns",
     "subnet": "generic/subnet",
-    "vpc": "generic/network",
-    "vpc-endpoint": "generic/network",
-    "vpn-connection": "generic/network",
-    "vpn-gateway": "generic/network"
+    "vpc": "aws/vpc",
+    "vpc-endpoint": "aws/vpc-endpoints",
+    "vpn-connection": "aws/vpn-connection",
+    "vpn-gateway": "aws/vpn-gateway"
   },
   "rule_labels": {
     "alb": "Elastic Load Balancing load balancer",
@@ -221,8 +221,66 @@
     "vpn-gateway": "virtual private gateway"
   },
   "concepts": {
-    "encryption-key": "generic/entity",
-    "iam-role": "generic/identity"
+    "ai-inference-endpoint": "aws/sagemaker-ai",
+    "api-component": "aws/api-gateway",
+    "api-gateway": "aws/api-gateway",
+    "appsync-api": "aws/appsync",
+    "appsync-component": "aws/appsync",
+    "backup-plan": "aws/backup-plan",
+    "backup-vault": "aws/backup-vault",
+    "bedrock-agent-component": "aws/bedrock",
+    "bedrockagent-agent": "aws/bedrock",
+    "block-storage-volume": "aws/ebs-volume",
+    "cognito-component": "aws/cognito",
+    "cognito-user-pool": "aws/cognito",
+    "compute-instance": "aws/ec2-instance",
+    "connect-component": "aws/connect",
+    "connect-instance": "aws/connect",
+    "container-repository": "aws/ecr",
+    "db-proxy": "aws/rds-proxy",
+    "db-proxy-component": "aws/rds",
+    "dedicated-interconnect": "aws/direct-connect",
+    "dns-zone": "aws/route-53-hosted-zone",
+    "dynamodb-component": "aws/dynamodb",
+    "dynamodb-table": "aws/dynamodb-table",
+    "ecs-cluster": "aws/ecs",
+    "ecs-service": "aws/ecs-service",
+    "eks-compute-profile": "aws/fargate",
+    "emr-cluster": "aws/emr-cluster",
+    "emr-cluster-component": "aws/emr",
+    "encryption-key": "aws/kms",
+    "event-bus": "aws/eventbridge",
+    "event-component": "aws/eventbridge",
+    "global-accelerator": "aws/global-accelerator",
+    "global-accelerator-component": "aws/global-accelerator",
+    "iam-role": "aws/iam-role",
+    "identity-group": "aws/iam",
+    "instance-profile": "aws/iam",
+    "internet-gateway": "aws/internet-gateway",
+    "key-alias": "aws/kms",
+    "kubernetes-node-pool": "aws/ec2-instances",
+    "load-balancer": "aws/elastic-load-balancing",
+    "load-balancer-component": "aws/elastic-load-balancing",
+    "managed-nat": "aws/nat-gateway",
+    "managed-secret": "aws/secrets-manager",
+    "message-queue": "aws/sqs",
+    "message-subscription": "aws/sns",
+    "message-topic": "aws/sns-topic",
+    "network-acl": "aws/network-acl",
+    "network-peering": "aws/vpc-peering-connection",
+    "pinpoint-app": "aws/end-user-messaging",
+    "pinpoint-component": "aws/end-user-messaging",
+    "private-endpoint": "aws/vpc-endpoints",
+    "repository-configuration": "aws/ecr",
+    "route-table": "aws/vpc-router",
+    "serverless-function": "aws/lambda",
+    "service-identity-binding": "aws/iam-permissions",
+    "storage-configuration": "aws/s3",
+    "transit-gateway": "aws/transit-gateway",
+    "transit-gateway-attachment": "aws/transit-gateway-attachment",
+    "vpn-connection": "aws/vpn-connection",
+    "vpn-gateway": "aws/vpn-gateway",
+    "workflow": "aws/step-functions"
   },
   "concept_labels": {},
   "resources": {

dialects/azure/presentation.json

@@ -9,7 +9,7 @@
     "ai-services-account": "generic/entity",
     "ai-services-project": "azure/ai-foundry",
     "aks-cluster": "azure/aks",
-    "aks-node-pool": "generic/entity",
+    "aks-node-pool": "azure/vm-scale-set",
     "analysis-services-server": "generic/entity",
     "api-connection": "generic/network",
     "api-management": "azure/api-management",
@@ -56,7 +56,7 @@
     "batch-account": "generic/scope",
     "batch-application": "generic/entity",
     "batch-pool": "generic/entity",
-    "blob-container": "generic/storage",
+    "blob-container": "azure/storage-container",
     "bot-channels-registration": "generic/entity",
     "bot-web-app": "generic/entity",
     "capacity-reservation": "generic/entity",
@@ -308,10 +308,10 @@
     "private-endpoint": "azure/private-link",
     "private-link-service": "azure/private-link",
     "proximity-placement-group": "generic/entity",
-    "public-address": "generic/network",
+    "public-address": "azure/public-ip",
     "public-ip-prefix": "generic/network",
     "purview-account": "generic/scope",
-    "queue-storage-queue": "generic/storage",
+    "queue-storage-queue": "azure/storage-queue",
     "qumulo-file-system": "generic/storage",
     "recovery-services-vault": "azure/backup",
     "red-hat-openshift-cluster": "generic/entity",
@@ -397,7 +397,7 @@
     "virtual-network-gateway": "azure/vpn-gateway",
     "virtual-network-gateway-connection": "azure/vpn-gateway",
     "virtual-network-manager": "generic/scope",
-    "virtual-network-peering": "generic/network",
+    "virtual-network-peering": "azure/virtual-network",
     "virtual-wan": "generic/scope",
     "vmware-cluster": "generic/entity",
     "vmware-private-cloud": "generic/scope",

dialects/evidence/aws/icon-license-spike.md

@@ -2,6 +2,7 @@
 
 - Date: 2026-08-29
 - Result: Pass
+- Status: superseded by the decision update of 2026-10-09
 
 ## Question
 
@@ -45,3 +46,19 @@ Official sources:
 
 Written AWS permission or a separate official architecture-icon license that
 expressly permits raw redistribution and required transformations.
+
+## Decision update (2026-10-09)
+
+Rootform now uses the official AWS Architecture Icons in the Explorer and the
+Playground. The renderer icon pack ships 70 SVG files selected from
+`Icon-package_07312026` exactly as published: no optimization, recoloring or
+other transformation. The renderer bundle carries the AWS usage notice and lists
+the icons in its third-party inventory.
+
+The AWS presentation catalog maps 106 of 108 Rules and every mapped Concept to
+these identities. The `subnet` and `security-group` Rules keep a neutral
+symbol: AWS draws a security group as a group border, and its subnet icons
+assert public or private exposure, which these Rules do not establish. Concepts
+shared by several AWS services, such as managed caches, managed database
+components and managed file storage, also stay neutral because no single
+service icon describes them.