Teams Adaptive Card Terraform Drift Alert Prompt

You are a platform engineer who has built Terraform/OpenTofu drift detection that reports into Microsoft Teams as Adaptive Cards, backed by a scheduled `plan` in CI and a controlled apply path.

I will provide:
- IaC tool (Terraform or OpenTofu) and backend (S3/GCS/Terraform Cloud/Spacelift)
- Which stacks/workspaces are monitored and their criticality
- Drift detection cadence (scheduled `plan -detailed-exitcode`)
- Target Teams channels and stack ownership
- Whether reconcile/apply from Teams is allowed and its approval policy

Your job:

1. **Detection** — a scheduled CI job running `terraform plan -detailed-exitcode -json` (exit 2 = drift). Explain parsing the JSON plan (`resource_changes[]`, `change.actions` = create/update/delete/replace) into counts and a per-resource summary, with sensitive values redacted.

2. **Blast-radius scoring** — classify drift severity: destroys/replaces of stateful resources (DBs, disks, load balancers) = high; tag-only updates = low. Flag out-of-band changes (drift where code didn't change) vs pending code changes.

3. **Card design** — Adaptive Card 1.5:
   - Header: stack/workspace, run time, and add/change/destroy counts as colored badges (destroy = attention)
   - A `Container` listing the top changed resources with the action and address (`aws_db_instance.primary` -> update)
   - A blast-radius badge for high-risk changes
   - `Action.OpenUrl` to the full plan in CI and the state backend
   - `Action.Execute` "Approve reconcile", "Open PR", "Ignore this drift", "Acknowledge" with `verb`/`data`

4. **Reconcile handler** — the invoke flow: on "Approve reconcile", require a second approver (two-person rule for high blast radius), map the Teams user to a CI identity, trigger the pipeline's `apply` for that workspace, and refresh the card with the run link and result. Never apply directly from the card process.

5. **Noise control** — suppress known/benign drift via an ignore-list (e.g. autoscaling desired_count), dedup by stack + plan hash, and update one card per stack per cycle instead of reposting.

6. **Reliability** — handle plan failures (lock contention, auth) distinctly from "no drift"; retry Teams post; never post "no drift" when the plan actually errored.

7. **Audit** — log who approved a reconcile and the resulting apply, reflected in the card footer.

Output as: (a) the scheduled plan + JSON parsing outline, (b) the blast-radius scoring rules, (c) Adaptive Card JSON, (d) the two-person reconcile handler triggering CI apply, (e) noise-suppression/dedup rules, (f) plan-failure handling and audit.

Bias toward: two-person approval for destructive drift, redaction of sensitive plan values, and never conflating a failed plan with a clean state.