Reference

Sprinkle YAML reference.

The exact contract Yarrow accepts from the editor. The render in YAML reflects what the sprinkles form uses under the hood — every field here is a field on SprinkleCreate.

Schema

Field	Type	Required	Notes
provider	enum	required	AWS / AZURE / GCP / K8S. The sprinkle runs on this provider only.
resourceKind	string	required	Free-form, ≤80 chars. Maps to the AWS/Azure/GCP/K8S resource type.
desiredState	string	required	One-sentence intent. The agent reconciles to this string literally.
allowedActions	enum[]	required	1–5 actions from the closed catalogue. Anything else is rejected.
approvalMode	enum	required	AUTO heals silently. NOTIFY pings on heal. MANUAL waits for a human.
name	string	optional	Optional human label, ≤120 chars.

Allowed enum values

provider

AWS

AZURE

GCP

K8S

approvalMode

AUTO

NOTIFY

MANUAL

allowedActions

reboot

rotate-keys

patch

scale

rollback

Worked examples

Each example maps a marketing sprinkle name from the home page onto a real SprinkleCreate payload. The sprinkles form accepts the same shape.

rotate-stale-key

Rotate a stale IAM key

Mirrors the first sprinkle tile on the home page. Forces regular rotation on AWS IAM access keys older than 30 days.

provider: AWS
resourceKind: EC2 instance
desiredState: "IAM access keys for any instance older than 30 days get rotated within 24h."
allowedActions:
  - rotate-keys
approvalMode: AUTO
name: "rotate-stale-key"

gate-misbehaving-deploy

Gate a misbehaving deploy

Mirrors the second sprinkle tile. Enforces a canary SLO + automatic rollback on Kubernetes.

provider: K8S
resourceKind: Deployment
desiredState: "A canary that misses its SLO for two consecutive 5-minute windows rolls back automatically."
allowedActions:
  - rollback
  - scale
approvalMode: AUTO
name: "gate-misbehaving-deploy"

rescind-public-read

Rescind a public-read bucket

Mirrors the third sprinkle tile. Closes the door on any GCP storage bucket that drifts open to world-readable.

provider: GCP
resourceKind: Storage bucket
desiredState: "No storage bucket is world-readable at rest. allUsers is removed within 60 seconds of drift."
allowedActions:
  - patch
approvalMode: NOTIFY
name: "rescind-public-read"

Source of truth

The schema above is exactly src/lib/contracts/sprinkles.ts in this codebase. When you add an enum, edit it there first — the sprinkles form and these docs inherit it.

Try it

Write your own sprinkle

Signed-in users land directly on the new-sprinkle form. New here? Re-run the live demo first.

Try writing one →