A provisioner performs lifecycle actions for an Automator (Terraform, Pulumi, etc.). An external daemon will execute a provisioner binary. The daemon and provisioner will communicate using gRPC over stdin/stdout.

Terraform's provider system displays prior art on this architecture.

Package structure:

└── provisioner
    ├── provisioner.go
    ├── provisioner_test.go
    └── terraform
        ├── terraform.go
        └── terraform_test.go

The terraform provisioner would be bundled into its own CLI, executed by provisionerd (once that exists).