The Promise None of Them Kept
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
Mark Burgess formalized promise theory in 2005, describing autonomous agents that observe their environment locally, reason independently, and make voluntary commitments about their own behavior. Terraform, Ansible, Chef, and Puppet all borrowed the vocabulary but none implemented the model: Terraform diffs files against files and is blind between applies, Ansible pushes tasks from a central controller with no agent autonomy on targets, and Chef/Puppet approximate the loop only within their declared scope. CFEngine is the only tool that actually kept the promise, running a local agent on every host every five minutes — but it never stored what it observed, making historical assessment impossible. The post argues that LLMs finally supply the missing reasoning agent, and introduces Swamp as a framework built around observation-first infrastructure: model methods observe live systems, results are stored as versioned, schema-validated snapshots, and workflows decide whether to act based on queried diffs between reality at T and T-1. Idempotency moves from per-resource logic up to workflow-level guards. The post includes comparison tables for Terraform and Ansible users, CLI examples, and an honest acknowledgment that Swamp shares Ansible's availability problem when its scheduler is down.
Table of contents
The promise theory control loop #Terraform: diffing files against files #Ansible: imposition from a center #CFEngine: the one that kept it #Chef and Puppet: the loop inside a declaration #What the agent actually needs #Swamp: observation first, action second #How the properties map #The practical difference for a Terraform user #The practical difference for an Ansible user #The observer has an availability problem too #Idempotency moves up #Our thinking moves up with it #Where declarations still matter #The 30-year gap #Built for the reasoning agent #Getting started #The concepts outlive the tools #Questions this post answers
Why does Terraform not implement true desired-state convergence like CFEngine?
Terraform diffs a desired-state HCL file against a cached state file — it does not observe live infrastructure. Between applies it is completely blind: drift goes undetected until a human runs terraform plan. CFEngine, by contrast, runs a local agent every five minutes that directly observes the host, reasons locally, and repairs only what is out of compliance. Terraform's model is closer to a batch script with a diffing preamble than a convergent control loop. Teams managing infrastructure drift between Terraform applies track convergence approaches like these on daily.dev.
What is ansible-pull and how does it differ from the default Ansible push model?
ansible-pull runs from cron on the target node itself, cloning a playbook repository and evaluating conditions locally with no central controller involved. This gives the target autonomous, scheduled convergence — the promise-theoretic mode — in contrast to Ansible's default where a control node pushes tasks via SSH and the target has no agency, no local reasoning, and no convergence between runs. Almost nobody deploys ansible-pull in practice. Developers weighing Ansible deployment models against convergence requirements find the trade-offs covered on daily.dev.
What did CFEngine get right about promise theory that later infrastructure tools missed?
CFEngine runs a cf-agent on every host at a short interval (five minutes by default), observing local state, deciding locally which promises are unkept, and repairing only those — with no central controller issuing orders. The agent pulls policy voluntarily from a policy server. Its limitation is that it never stored observations as queryable data, so historical drift analysis and trust accumulation across time were impossible. Later tools inherited the scope bound without the autonomous agent. Infrastructure engineers revisiting foundational IaC concepts like these keep up with the field on daily.dev.