What would this chart change?

Reconcile a chart against the org without changing anything. Human users only — a chart provisions agents, vaults and access policies, so an agent that could apply one could grant itself access to a vault it cannot currently read.

A POST rather than a GET because the chart is the request body, and a GET carrying a body is one many proxies and clients drop or mangle. Read-only either way.

The plan reports five outcomes per resource:

• create — not present, would be created.
• patch — present, differs only in fields safe to change in place.
• unchanged — present and matching.
• skipped_drifted — changed outside this chart, so left alone. Someone edited it by hand for a reason; overwriting that because a file says otherwise is how a deployment tool destroys an incident fix.
• refused — the chart asks for a change apply will not make. Guardrail fields are never patched here: editing them routes through the guardrail approval flow, and a reconciler writing them directly would be a way around it.

Pass applied_state from .1claw/apply-state.json so drift can be told from a first run — a pre-existing resource is not drifted, it was simply not created by this chart.