meshcloud · JohannesRudolph · Aug 18, 2026 · Aug 18, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -202,6 +202,37 @@ The `availability` field controls publication state and access restrictions. mes
 
 ---
 
+<!-- scorecard-checks: provider_floor -->
+## Provider Version Floor
+
+A `>=` constraint says "not older than this"; the floor says **how old is still acceptable
+anywhere in the hub**. It is declared in exactly one place — the `PROVIDER_FLOOR` map at the top of
+[`tools/scorecard/scorecard.mjs`](tools/scorecard/scorecard.mjs) — and the `provider_floor`
+scorecard check enforces it across every tier a module owns: `meshstack_integration.tf`,
+`backplane/`, `buildingblock/` and `e2e/` (including nested submodules).
+
+Two things fail the check:
+
+- a `required_providers` entry for a floor-managed provider with **no** `version` at all — that is
+  unbounded, so `tofu init` may resolve an arbitrarily old release
+- a constraint whose lower bound is **below** the floor (`>= 0.21.0` against a 0.23.0 floor, or a
+  constraint with no lower bound at all such as `< 1.0.0`)
+
+**To raise the floor for the whole hub**: edit the one value in `PROVIDER_FLOOR`, then run
+`node tools/scorecard/scorecard.mjs --category=core`. Every module still declaring less turns red
+and the failure detail names the file and the current constraint — that list is the bump work item.
+The check verifies rather than rewrites, because HCL `required_providers` `version` must be a string
+literal (no interpolation), so there is nothing a module could reference; and because the constraint
+is a deliberate, reviewable statement about what a module needs.
+
+Why the floor is load-bearing even though nothing pins in CI: the hub commits no
+`.terraform.lock.hcl` (root configurations own locking), and the smoke-test workflow injects a
+provider built from `main` through Terraform `dev_overrides`, which bypasses both
+`required_providers` and any lockfile. The floor is therefore what protects **local** runs
+(`task e2e:run`, `terraform validate`) from silently resolving a stale provider.
+
+---
+
 ## Scorecard
 
 The repository includes a scorecard tool that checks module maturity across four categories:

diff --git a/modules/aks/github-connector/meshstack_integration.tf b/modules/aks/github-connector/meshstack_integration.tf
@@ -232,7 +232,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/aks/meshstack_integration.tf b/modules/aks/meshstack_integration.tf
@@ -183,7 +183,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     azuread = {
       source  = "hashicorp/azuread"

diff --git a/modules/aws/agentic-coding-sandbox/buildingblock/README.md b/modules/aws/agentic-coding-sandbox/buildingblock/README.md
@@ -77,7 +77,7 @@ End users provide:
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.7.1 |
+| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.23.0 |
 
 ## Modules
 

diff --git a/modules/aws/agentic-coding-sandbox/buildingblock/versions.tf b/modules/aws/agentic-coding-sandbox/buildingblock/versions.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.7.1"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/aws/route53-dns-alias-record/meshstack_integration.tf b/modules/aws/route53-dns-alias-record/meshstack_integration.tf
@@ -239,7 +239,7 @@ terraform {
     }
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/aws/route53-dns-record/meshstack_integration.tf b/modules/aws/route53-dns-record/meshstack_integration.tf
@@ -233,7 +233,7 @@ terraform {
     }
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/aws/s3_bucket/meshstack_integration.tf b/modules/aws/s3_bucket/meshstack_integration.tf
@@ -191,7 +191,7 @@ terraform {
     }
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/azure/budget-alert/e2e/terraform.tf b/modules/azure/budget-alert/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source = "hashicorp/azurerm"

diff --git a/modules/azure/budget-alert/meshstack_integration.tf b/modules/azure/budget-alert/meshstack_integration.tf
@@ -230,7 +230,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source  = "hashicorp/azurerm"

diff --git a/modules/azure/entra-id-groups/meshstack_integration.tf b/modules/azure/entra-id-groups/meshstack_integration.tf
@@ -255,7 +255,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source  = "hashicorp/azurerm"

diff --git a/modules/azure/meshstack_integration.tf b/modules/azure/meshstack_integration.tf
@@ -249,7 +249,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source  = "hashicorp/azurerm"

diff --git a/modules/azure/resource-group/e2e/terraform.tf b/modules/azure/resource-group/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source = "hashicorp/azurerm"

diff --git a/modules/azure/resource-group/meshstack_integration.tf b/modules/azure/resource-group/meshstack_integration.tf
@@ -226,7 +226,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source  = "hashicorp/azurerm"

diff --git a/modules/azure/service-principal/meshstack_integration.tf b/modules/azure/service-principal/meshstack_integration.tf
@@ -258,7 +258,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source  = "hashicorp/azurerm"

diff --git a/modules/azure/storage-account/e2e/terraform.tf b/modules/azure/storage-account/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source = "hashicorp/azurerm"

diff --git a/modules/azure/storage-account/meshstack_integration.tf b/modules/azure/storage-account/meshstack_integration.tf
@@ -223,7 +223,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     azurerm = {
       source  = "hashicorp/azurerm"

diff --git a/modules/gcp/storage-bucket/meshstack_integration.tf b/modules/gcp/storage-bucket/meshstack_integration.tf
@@ -203,7 +203,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     google = {
       source  = "hashicorp/google"

diff --git a/modules/github/repository/meshstack_integration.tf b/modules/github/repository/meshstack_integration.tf
@@ -255,7 +255,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/kubernetes/manifest/meshstack_integration.tf b/modules/kubernetes/manifest/meshstack_integration.tf
@@ -205,7 +205,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/github-workflow/e2e/terraform.tf b/modules/meshstack/github-workflow/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/github-workflow/meshstack_integration.tf b/modules/meshstack/github-workflow/meshstack_integration.tf
@@ -219,7 +219,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/link/e2e/terraform.tf b/modules/meshstack/link/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/link/meshstack_integration.tf b/modules/meshstack/link/meshstack_integration.tf
@@ -222,7 +222,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/manual/e2e/terraform.tf b/modules/meshstack/manual/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/manual/meshstack_integration.tf b/modules/meshstack/manual/meshstack_integration.tf
@@ -110,7 +110,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/noop/backplane/versions.tf b/modules/meshstack/noop/backplane/versions.tf
@@ -12,7 +12,7 @@ terraform {
     }
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     time = {
       source  = "hashicorp/time"

diff --git a/modules/meshstack/noop/e2e/env-audit/terraform.tf b/modules/meshstack/noop/e2e/env-audit/terraform.tf
@@ -2,7 +2,8 @@ terraform {
   required_version = ">= 1.0"
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/noop/e2e/runner/terraform.tf b/modules/meshstack/noop/e2e/runner/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
     google = {
       source  = "hashicorp/google"

diff --git a/modules/meshstack/noop/e2e/terraform.tf b/modules/meshstack/noop/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/noop/meshstack_integration.tf b/modules/meshstack/noop/meshstack_integration.tf
@@ -239,7 +239,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/meshstack/payment-method/buildingblock/README.md b/modules/meshstack/payment-method/buildingblock/README.md
@@ -63,7 +63,7 @@ module "payment_method" {
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
-| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.14.0 |
+| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.23.0 |
 
 ## Modules
 

diff --git a/modules/meshstack/payment-method/buildingblock/versions.tf b/modules/meshstack/payment-method/buildingblock/versions.tf
@@ -4,7 +4,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.14.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/oci/application-compartment/buildingblock/README.md b/modules/oci/application-compartment/buildingblock/README.md
@@ -161,7 +161,7 @@ The module automatically:
 
 | Name | Version |
 |------|---------|
-| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.21.0 |
+| <a name="requirement_meshstack"></a> [meshstack](#requirement\_meshstack) | >= 0.23.0 |
 | <a name="requirement_oci"></a> [oci](#requirement\_oci) | 7.32.0 |
 
 ## Modules

diff --git a/modules/oci/application-compartment/buildingblock/provider.tf b/modules/oci/application-compartment/buildingblock/provider.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
     oci = {
       source  = "oracle/oci"

diff --git a/modules/ske/forgejo-connector/meshstack_integration.tf b/modules/ske/forgejo-connector/meshstack_integration.tf
@@ -269,7 +269,7 @@ terraform {
   required_providers {
     meshstack = {
       source  = "meshcloud/meshstack"
-      version = ">= 0.21.0"
+      version = ">= 0.23.0"
     }
   }
 }
diff --git a/modules/ske/ske-starterkit/e2e/meshstack_kubernetes_platform/terraform.tf b/modules/ske/ske-starterkit/e2e/meshstack_kubernetes_platform/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/modules/ske/ske-starterkit/e2e/terraform.tf b/modules/ske/ske-starterkit/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
     kubernetes = {
       source = "hashicorp/kubernetes"

diff --git a/modules/stackit/git-repository/e2e/terraform.tf b/modules/stackit/git-repository/e2e/terraform.tf
@@ -3,7 +3,8 @@ terraform {
 
   required_providers {
     meshstack = {
-      source = "meshcloud/meshstack"
+      source  = "meshcloud/meshstack"
+      version = ">= 0.23.0"
     }
   }
 }