@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/infrastructure-change/plan.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.materialNormalizedSstDiffResources = materialNormalizedSstDiffResources;
 exports.computeMaterialPlanDigest = computeMaterialPlanDigest;
 exports.createInfrastructurePlan = createInfrastructurePlan;
 exports.validateInfrastructurePlanForApply = validateInfrastructurePlanForApply;
+exports.validateInfrastructurePlanForProtectedApply = validateInfrastructurePlanForProtectedApply;
 const deterministic_order_js_1 = require("../deterministic-order.js");
 const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
 const model_js_1 = require("./model.js");
@@ -85,15 +87,63 @@ function sortedFindings(findings) {
         (0, deterministic_order_js_1.compareUtf16)(left.code, right.code) ||
         (0, deterministic_order_js_1.compareUtf16)(left.class, right.class));
 }
+const SST_BUCKET_FILES_RESOURCE_TYPE = 'pulumi-nodejs:dynamic:Resource';
+const SST_BUCKET_FILES_LOGICAL_ID_SUFFIX = '.sst.aws.BucketFiles';
+const SST_BUCKET_FILES_ENTRY_PATH = /^files\[(?:0|[1-9]\d*)\]\.(?:contentType|hash|key|source)$/u;
+function materialChangedProperties(resource) {
+    const isSstBucketFilesUpdate = resource.logicalId.endsWith(SST_BUCKET_FILES_LOGICAL_ID_SUFFIX) &&
+        resource.operation === 'update' &&
+        resource.providerOperation === 'update' &&
+        !resource.replacement &&
+        resource.resourceType === SST_BUCKET_FILES_RESOURCE_TYPE;
+    const properties = resource.changedProperties.map((property) => isSstBucketFilesUpdate && SST_BUCKET_FILES_ENTRY_PATH.test(property.path)
+        ? { ...property, path: 'files[*]' }
+        : property);
+    return [
+        ...new Map(properties.map((property) => [
+            JSON.stringify([
+                property.inputDiff,
+                property.kind,
+                property.path,
+                property.sensitive,
+            ]),
+            property,
+        ])).values(),
+    ].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(JSON.stringify(left), JSON.stringify(right)));
+}
+/**
+ * Returns the value-free resource projection used by plan and drift digests.
+ * SST's BucketFiles dynamic provider reports rebuilt file arrays by ephemeral
+ * list index. The committed source and release-candidate authorities bind the
+ * bytes; the plan binds the mutation kind without turning array scheduling
+ * into a new approval identity. Every unrecognized path remains exact.
+ *
+ * @internal
+ */
+function materialNormalizedSstDiffResources(diff) {
+    return diff.resources.map((resource) => ({
+        ...Object.fromEntries(Object.entries(resource).filter(([key]) => key !== 'sourceIndex')),
+        changedProperties: materialChangedProperties(resource),
+    }));
+}
+function materialDiff(diff) {
+    const withoutSourceIndex = (value) => Object.fromEntries(Object.entries(value).filter(([key]) => key !== 'sourceIndex'));
+    return {
+        ...diff,
+        failures: diff.failures.map(withoutSourceIndex),
+        resources: materialNormalizedSstDiffResources(diff),
+    };
+}
+function materialState(state) {
+    return Object.fromEntries(Object.entries(state).filter(([key]) => key !== 'expiresAt' && key !== 'observedAt'));
+}
 function planMaterial(plan) {
     return {
         action: plan.action,
         aggregateRisk: plan.aggregateRisk,
         configurationMetadataDigest: plan.configurationMetadataDigest,
-        diff: plan.diff,
+        diff: materialDiff(plan.diff),
         driftEvidenceDigest: plan.driftEvidenceDigest,
-        driftEvidenceExpiresAt: plan.driftEvidenceExpiresAt,
-        driftEvidenceGeneratedAt: plan.driftEvidenceGeneratedAt,
         driftStatus: plan.driftStatus,
         frameworkVersion: plan.frameworkVersion,
         kind: plan.kind,
@@ -102,16 +152,18 @@ function planMaterial(plan) {
         requiredApprovals: plan.requiredApprovals,
         resourceFindings: plan.resourceFindings,
         schemaVersion: plan.schemaVersion,
-        state: plan.state,
+        state: materialState(plan.state),
         target: plan.target,
         tool: plan.tool,
         versions: plan.versions,
     };
 }
 /**
- * Hashes the material plan contract. generatedAt, expiresAt, repository,
- * sourceCommit, and approval-record contents are intentionally excluded and
- * validated independently immediately before apply.
+ * Hashes the material plan contract. Diagnostic source positions, observation
+ * timestamps, generatedAt, expiresAt, repository, sourceCommit, and
+ * approval-record contents are intentionally excluded. Freshness, repository,
+ * source, and approval authority are validated independently immediately
+ * before apply.
  */
 function computeMaterialPlanDigest(plan) {
     return (0, canonical_json_1.canonicalJsonSha256)(planMaterial(plan), {
@@ -120,8 +172,13 @@ function computeMaterialPlanDigest(plan) {
 }
 function createInfrastructurePlan(input) {
     validateCreationInput(input);
+    const action = input.action ?? 'deploy';
+    const requiredApprovals = new Set(input.risk.requiredApprovals);
+    if (action === 'refresh') {
+        requiredApprovals.add('deployment-review');
+    }
     const withoutDigest = {
-        action: input.action ?? 'deploy',
+        action,
         aggregateRisk: input.risk.aggregate,
         configurationMetadataDigest: input.configurationMetadataDigest,
         diff: input.diff,
@@ -136,7 +193,7 @@ function createInfrastructurePlan(input) {
         policyProfileDigest: input.policyProfileDigest,
         projects: [...input.projects],
         repository: input.repository,
-        requiredApprovals: [...input.risk.requiredApprovals].sort(),
+        requiredApprovals: [...requiredApprovals].sort(),
         resourceFindings: sortedFindings(input.risk.findings),
         schemaVersion: model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION,
         sourceCommit: input.sourceCommit,
@@ -157,7 +214,7 @@ function validDate(value) {
     const timestamp = Date.parse(value);
     return Number.isFinite(timestamp) ? timestamp : undefined;
 }
-function approvalFindings(plan, approval, now, plannedGeneratedAt) {
+function approvalFindings(plan, approval, now, plannedGeneratedAt, allowInvocationLocalOperatorAcknowledgement) {
     if (approval === undefined) {
         return [
             {
@@ -193,10 +250,17 @@ function approvalFindings(plan, approval, now, plannedGeneratedAt) {
     }
     else if (approval.mode === 'standing-policy' ||
         approval.author === approval.approver ||
-        !approval.codeownerReviewed) {
+        (approval.mode !== 'operator-acknowledgement' &&
+            !approval.codeownerReviewed) ||
+        (approval.mode === 'operator-acknowledgement' &&
+            (!allowInvocationLocalOperatorAcknowledgement ||
+                approval.codeownerReviewed ||
+                approval.recordPath !== undefined ||
+                approval.author !== 'ebk-infrastructure-plan' ||
+                !/^local-federated:[a-f0-9]{64}$/u.test(approval.approver)))) {
         findings.push({
             code: 'approval-invalid',
-            detail: 'Additional approval requires a non-author CODEOWNER-reviewed decision.',
+            detail: 'Additional approval requires either an honest active-operator acknowledgement or a non-author CODEOWNER-reviewed decision.',
         });
     }
     for (const requirement of plan.requiredApprovals) {
@@ -335,13 +399,259 @@ function validateInfrastructurePlanForApply(input) {
             detail: 'Source changed beyond the exact approval-record file after planning.',
         });
     }
-    findings.push(...approvalFindings(input.recomputed, input.approval, now, input.planned.generatedAt));
+    findings.push(...approvalFindings(input.recomputed, input.approval, now, input.planned.generatedAt, true));
+    const codes = new Set(findings.map(({ code }) => code));
+    const outcome = codes.has('state-locked')
+        ? 'state-locked'
+        : codes.has('state-lock-unverified')
+            ? 'state-lock-unverified'
+            : [...codes].some((code) => [
+                'material-plan-changed',
+                'plan-expired',
+                'plan-schema-invalid',
+                'plan-tool-version-invalid',
+                'source-change-invalid',
+            ].includes(code))
+                ? 'plan-stale'
+                : findings.length > 0
+                    ? 'plan-risk-blocked'
+                    : 'plan-clean';
+    return {
+        allowed: findings.length === 0,
+        findings,
+        outcome,
+    };
+}
+function protectedAuthorityEnvelope(plan) {
+    return {
+        action: plan.action,
+        configurationMetadataDigest: plan.configurationMetadataDigest,
+        frameworkVersion: plan.frameworkVersion,
+        kind: plan.kind,
+        policyProfileDigest: plan.policyProfileDigest,
+        projects: plan.projects,
+        schemaVersion: plan.schemaVersion,
+        state: materialState(plan.state),
+        target: plan.target,
+        tool: plan.tool,
+        versions: plan.versions,
+    };
+}
+function isProviderObservation(resource) {
+    return (resource.changedProperties.length === 0 &&
+        !resource.replacement &&
+        ((resource.operation === 'read' && resource.providerOperation === 'read') ||
+            (resource.operation === 'discard' &&
+                resource.providerOperation === 'discard') ||
+            (resource.operation === 'delete' &&
+                resource.providerOperation === 'delete' &&
+                resource.resourceType.startsWith('pulumi:providers:'))));
+}
+function approvalRequiredPlanEntries(plan) {
+    const resourceIds = new Set(plan.diff.resources.map(({ logicalId }) => logicalId));
+    const findingsByResource = new Map();
+    for (const finding of plan.resourceFindings) {
+        if (!finding.resourceId)
+            continue;
+        findingsByResource.set(finding.resourceId, [
+            ...(findingsByResource.get(finding.resourceId) ?? []),
+            finding,
+        ]);
+    }
+    const entries = plan.diff.resources
+        .filter((resource) => {
+        if (isProviderObservation(resource))
+            return false;
+        const findings = findingsByResource.get(resource.logicalId) ?? [];
+        return (resource.operation === 'delete' ||
+            resource.operation === 'replace' ||
+            resource.operation === 'import' ||
+            resource.operation === 'unknown' ||
+            resource.resourceType.startsWith('aws:iam/') ||
+            findings.some(({ disposition }) => disposition !== 'allow-standing-policy'));
+    })
+        .map((resource) => (0, canonical_json_1.canonicalJsonSha256)({
+        changedProperties: materialChangedProperties(resource),
+        findings: (findingsByResource.get(resource.logicalId) ?? []).map(({ class: riskClass, code, disposition, propertyPath }) => ({
+            class: riskClass,
+            code,
+            disposition,
+            ...(propertyPath === undefined ? {} : { propertyPath }),
+        })),
+        logicalId: resource.logicalId,
+        operation: resource.operation,
+        replacement: resource.replacement,
+        replacementStrategy: resource.replacementStrategy,
+        resourceType: resource.resourceType,
+    }, { omitUndefinedObjectValues: true }));
+    for (const finding of plan.resourceFindings) {
+        if ((finding.resourceId && resourceIds.has(finding.resourceId)) ||
+            finding.disposition === 'allow-standing-policy') {
+            continue;
+        }
+        entries.push((0, canonical_json_1.canonicalJsonSha256)({
+            class: finding.class,
+            code: finding.code,
+            disposition: finding.disposition,
+            ...(finding.resourceId === undefined
+                ? {}
+                : { resourceId: finding.resourceId }),
+            ...(finding.propertyPath === undefined
+                ? {}
+                : { propertyPath: finding.propertyPath }),
+        }, { omitUndefinedObjectValues: true }));
+    }
+    return [...new Set(entries)].sort(deterministic_order_js_1.compareUtf16);
+}
+/**
+ * Validates a fresh protected-workflow plan against source-bound deployment
+ * authority. The retained provider preview remains review evidence, but
+ * provider observations are not treated as a replayable transaction. Every
+ * approval-required resource and operation in the fresh plan must have been
+ * present in the reviewed plan.
+ */
+function validateInfrastructurePlanForProtectedApply(input) {
+    const findings = [];
+    const now = validDate(input.now);
+    if (now === undefined) {
+        throw new TypeError('now must be an ISO date-time.');
+    }
+    for (const [label, plan] of [
+        ['planned', input.planned],
+        ['recomputed', input.recomputed],
+    ]) {
+        if (plan.kind !== model_js_1.INFRASTRUCTURE_PLAN_KIND ||
+            plan.schemaVersion !== model_js_1.INFRASTRUCTURE_CHANGE_SCHEMA_VERSION) {
+            findings.push({
+                code: 'plan-schema-invalid',
+                detail: `${label} plan is not an infrastructure plan v1.`,
+            });
+        }
+        if (!SOURCE_COMMIT.test(plan.sourceCommit)) {
+            findings.push({
+                code: 'source-change-invalid',
+                detail: `${label} plan source commit is not a full Git object identifier.`,
+            });
+        }
+        if (plan.tool.name !== model_js_1.SST_DIFF_TOOL_NAME ||
+            plan.tool.version !== model_js_1.SST_DIFF_TOOL_VERSION) {
+            findings.push({
+                code: 'plan-tool-version-invalid',
+                detail: `${label} plan was not produced by SST ${model_js_1.SST_DIFF_TOOL_VERSION}.`,
+            });
+        }
+        if (computeMaterialPlanDigest(plan) !== plan.materialDigest) {
+            findings.push({
+                code: 'material-plan-changed',
+                detail: `${label} plan digest does not match its material contents.`,
+            });
+        }
+        if (!plan.diff.complete) {
+            findings.push({
+                code: 'diff-incomplete',
+                detail: `${label} plan contains an incomplete cloud-backed diff.`,
+            });
+        }
+    }
+    if ((0, canonical_json_1.canonicalJsonSha256)(protectedAuthorityEnvelope(input.planned)) !==
+        (0, canonical_json_1.canonicalJsonSha256)(protectedAuthorityEnvelope(input.recomputed))) {
+        findings.push({
+            code: 'authority-envelope-changed',
+            detail: 'The fresh plan changed the exact state, environment, tool, configuration, policy, or framework authority envelope.',
+        });
+    }
+    if (input.planned.repository !== input.recomputed.repository) {
+        findings.push({
+            code: 'source-change-invalid',
+            detail: 'The fresh plan targets a different repository.',
+        });
+    }
+    const reviewedEntries = new Set(approvalRequiredPlanEntries(input.planned));
+    const newApprovalRequiredEntries = approvalRequiredPlanEntries(input.recomputed).filter((entry) => !reviewedEntries.has(entry));
+    if (newApprovalRequiredEntries.length > 0) {
+        findings.push({
+            code: 'approval-required-change',
+            detail: `The fresh plan introduced ${newApprovalRequiredEntries.length} approval-required resource or operation not present in the reviewed preview.`,
+        });
+    }
+    const planExpiry = validDate(input.planned.expiresAt);
+    if (planExpiry === undefined || planExpiry <= now) {
+        findings.push({
+            code: 'plan-expired',
+            detail: 'The reviewed source-bound authority has expired.',
+        });
+    }
+    if (input.recomputed.state.locked === true) {
+        findings.push({
+            code: 'state-locked',
+            detail: 'The target state is locked.',
+        });
+    }
+    else if (input.recomputed.state.locked === 'unknown') {
+        findings.push({
+            code: 'state-lock-unverified',
+            detail: 'The read-only observer could not prove that the target state is unlocked.',
+        });
+    }
+    if (input.recomputed.aggregateRisk === 'unknown') {
+        findings.push({
+            code: 'unknown-risk',
+            detail: 'Unknown infrastructure risk blocks apply.',
+        });
+    }
+    const driftPermitted = input.recomputed.action === 'refresh'
+        ? input.recomputed.driftStatus === 'no-drift' ||
+            input.recomputed.driftStatus === 'drift-detected'
+        : input.recomputed.driftStatus === 'no-drift';
+    if (!driftPermitted) {
+        findings.push({
+            code: 'drift-unresolved',
+            detail: input.recomputed.action === 'refresh'
+                ? 'Protected refresh requires bounded no-drift or drift-detected evidence.'
+                : 'Protected apply requires a bounded read-only no-drift result.',
+        });
+    }
+    const recordPath = input.approval?.recordPath;
+    const allowedSourceChanges = input.approval?.mode === 'human-record' &&
+        recordPath !== undefined &&
+        input.planned.sourceCommit !== input.recomputed.sourceCommit
+        ? [recordPath]
+        : [];
+    const actualSourceChanges = [...new Set(input.sourceChangesSincePlan)].sort(deterministic_order_js_1.compareUtf16);
+    if (input.planned.sourceCommit !== input.recomputed.sourceCommit &&
+        actualSourceChanges.length === 0) {
+        findings.push({
+            code: 'source-change-invalid',
+            detail: 'Source commit changed without a declared path delta.',
+        });
+    }
+    if (actualSourceChanges.length !== allowedSourceChanges.length ||
+        actualSourceChanges.some((path, index) => path !== [...allowedSourceChanges].sort(deterministic_order_js_1.compareUtf16)[index])) {
+        findings.push({
+            code: 'source-change-invalid',
+            detail: 'Source changed beyond the exact approval-record file after planning.',
+        });
+    }
+    if (input.environmentReviewerApproved === true) {
+        if (input.approval !== undefined ||
+            input.planned.requiredApprovals.length === 0) {
+            findings.push({
+                code: 'approval-invalid',
+                detail: 'Environment reviewer admission is only valid for a reviewed plan awaiting external approval.',
+            });
+        }
+    }
+    else {
+        findings.push(...approvalFindings(input.planned, input.approval, now, input.planned.generatedAt, false));
+    }
     const codes = new Set(findings.map(({ code }) => code));
     const outcome = codes.has('state-locked')
         ? 'state-locked'
         : codes.has('state-lock-unverified')
             ? 'state-lock-unverified'
             : [...codes].some((code) => [
+                'approval-required-change',
+                'authority-envelope-changed',
                 'material-plan-changed',
                 'plan-expired',
                 'plan-schema-invalid',

package/src/infrastructure-change/risk.d.ts

@@ -1,4 +1,6 @@
-import type { IamAccessAnalyzerValidationV1, InfrastructurePolicySignalV1, InfrastructureRiskAssessmentV1, InfrastructureRiskPolicyV1, NormalizedSstDiffV1 } from './model.js';
+import type { IamAccessAnalyzerValidationV1, InfrastructurePolicySignalV1, InfrastructureRiskAssessmentV1, InfrastructureRiskPolicyV1, NormalizedInfrastructureResourceV1, NormalizedSstDiffV1 } from './model.js';
+/** @internal */
+export declare function requiresIamPolicyAnalysis(resource: NormalizedInfrastructureResourceV1): boolean;
 export declare function classifyInfrastructureRisk(input: {
     diff: NormalizedSstDiffV1;
     iamValidations?: readonly IamAccessAnalyzerValidationV1[];

package/src/infrastructure-change/risk.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.requiresIamPolicyAnalysis = requiresIamPolicyAnalysis;
 exports.classifyInfrastructureRisk = classifyInfrastructureRisk;
 const deterministic_order_js_1 = require("../deterministic-order.js");
 const RISK_PRECEDENCE = {
@@ -26,6 +27,23 @@ const DISPOSITIONS = {
 };
 const SENSITIVE_POLICY_PATH = /(?:iam|policy|principal|trust|assumeRole|public|ingress|egress|cidr|deletionProtection|retain|retention|backup|encrypt|kms|keyPolicy|objectLock|versioning|waf)/i;
 const COST_POLICY_PATH = /(?:desiredCount|instance|natGateway|provisionedConcurrency|retentionInDays|schedule|capacity|throughput|quota)/i;
+const OPAQUE_POLICY_DIGEST_TAG_PATH = /^(?:tags|tagsAll)\["ebk:(?:policy-digest|cost-policy-digest|account-cost-policy-digest)"\]$/u;
+const SECURITY_EXPANSION_CREATE_TYPES = new Map([
+    [
+        'aws:lambda/eventSourceMapping:EventSourceMapping',
+        {
+            code: 'lambda-event-source-addition',
+            message: 'A Lambda event source mapping adds a new invocation path and requires explicit security review.',
+        },
+    ],
+    [
+        'aws:lambda/functionUrl:FunctionUrl',
+        {
+            code: 'lambda-function-url-addition',
+            message: 'A Lambda Function URL adds a new ingress surface and requires explicit security review.',
+        },
+    ],
+]);
 function finding(riskClass, code, message, resource, propertyPath) {
     return {
         class: riskClass,
@@ -65,17 +83,38 @@ function riskForResource(resource, policy) {
             finding('stateful-or-destructive', 'stateful-delete-or-replacement', 'A durable resource is deleted or replaced.', resource),
         ];
     }
+    if (resource.operation === 'delete' &&
+        resource.resourceType.startsWith('pulumi:providers:')) {
+        return [
+            finding('in-place-reviewed', 'provider-bookkeeping-delete', 'A stale Pulumi provider registration is removed from deployment state without deleting a provider-managed cloud resource.', resource),
+        ];
+    }
     if (resource.operation === 'delete' || resource.operation === 'import') {
+        const adoptedImport = resource.operation === 'import' &&
+            policy.adoptedImports.some(({ logicalId, resourceType }) => logicalId === resource.logicalId &&
+                resourceType === resource.resourceType);
+        return [
+            finding(adoptedImport ? 'in-place-reviewed' : 'stateful-or-destructive', resource.operation === 'delete'
+                ? 'resource-delete'
+                : adoptedImport
+                    ? 'adopted-resource-import'
+                    : 'resource-import', adoptedImport
+                ? 'The exact import is bound to committed ownership, identity, retention, and recovery authority.'
+                : 'Deletion and import require an explicit ownership and recovery path.', resource),
+        ];
+    }
+    if (resource.operation === 'read') {
+        return [
+            finding('in-place-reviewed', 'provider-read', 'A provider read must be verified as intentional and non-mutating.', resource),
+        ];
+    }
+    if (resource.operation === 'discard') {
         return [
-            finding('stateful-or-destructive', resource.operation === 'delete' ? 'resource-delete' : 'resource-import', 'Deletion and import require an explicit ownership and recovery path.', resource),
+            finding('in-place-reviewed', 'provider-read-discard', 'A provider read is removed from deployment state without deleting the external resource.', resource),
         ];
     }
     if (resource.resourceType.startsWith('aws:iam/')) {
-        const policyBearing = [
-            'aws:iam/policy:Policy',
-            'aws:iam/role:Role',
-            'aws:iam/rolePolicy:RolePolicy',
-        ].includes(resource.resourceType);
+        const policyBearing = requiresIamPolicyAnalysis(resource);
         return [
             finding('security-expansion', policyBearing
                 ? 'iam-policy-document-change'
@@ -99,7 +138,18 @@ function riskForResource(resource, policy) {
             finding('stateless-replacement', 'stateless-replacement', 'A resource replacement requires rollout and recovery review.', resource),
         ];
     }
+    const securityExpansionCreate = resource.operation === 'create'
+        ? SECURITY_EXPANSION_CREATE_TYPES.get(resource.resourceType)
+        : undefined;
+    if (securityExpansionCreate) {
+        return [
+            finding('security-expansion', securityExpansionCreate.code, securityExpansionCreate.message, resource),
+        ];
+    }
     const propertyFindings = resource.changedProperties.flatMap((property) => {
+        if (OPAQUE_POLICY_DIGEST_TAG_PATH.test(property.path)) {
+            return [];
+        }
         if (property.sensitive) {
             return [
                 finding('unknown', 'sensitive-property-change', 'A sensitive property changed; its value remains redacted.', resource, property.path),
@@ -110,6 +160,12 @@ function riskForResource(resource, policy) {
                 finding('unknown', 'policy-direction-unproven', 'A security or protection property changed, but the value-free diff cannot prove its direction.', resource, property.path),
             ];
         }
+        if (resource.resourceType === 'aws:wafv2/webAcl:WebAcl' &&
+            /^(?:rules|defaultAction)(?:\[|\.|$)/u.test(property.path)) {
+            return [
+                finding('security-expansion', 'waf-access-policy-change', 'A WAF access-policy change requires explicit security review.', resource, property.path),
+            ];
+        }
         if (COST_POLICY_PATH.test(property.path)) {
             return [
                 finding('material-cost-or-quota', 'cost-or-quota-shape-change', 'A property that can affect cost or quota changed.', resource, property.path),
@@ -132,14 +188,21 @@ function riskForResource(resource, policy) {
             finding('material-cost-or-quota', 'cost-or-quota-resource-change', 'The resource type can materially affect cost or quota.', resource),
         ];
     }
-    if (resource.operation === 'update') {
+    if (resource.operation === 'create' &&
+        policy.statefulTypes.includes(resource.resourceType)) {
         return [
-            finding('in-place-reviewed', 'in-place-update', 'An in-place resource update requires review and post-apply proof.', resource),
+            finding('in-place-reviewed', 'stateful-resource-addition', 'A policy-declared durable resource is added and requires explicit ownership and recovery review.', resource),
         ];
     }
-    if (resource.operation === 'read') {
+    if (resource.operation === 'create' &&
+        policy.additiveReviewedTypes.includes(resource.resourceType)) {
         return [
-            finding('in-place-reviewed', 'provider-read', 'A provider read must be verified as intentional and non-mutating.', resource),
+            finding('in-place-reviewed', 'reviewed-material-addition', 'A policy-declared material resource is added and requires explicit deployment review.', resource),
+        ];
+    }
+    if (resource.operation === 'update') {
+        return [
+            finding('in-place-reviewed', 'in-place-update', 'An in-place resource update requires review and post-apply proof.', resource),
         ];
     }
     return [
@@ -190,6 +253,25 @@ function iamFindings(validation) {
     }
     return findings;
 }
+/** @internal */
+function requiresIamPolicyAnalysis(resource) {
+    if (resource.operation === 'delete' ||
+        resource.operation === 'discard' ||
+        resource.operation === 'read' ||
+        ![
+            'aws:iam/policy:Policy',
+            'aws:iam/role:Role',
+            'aws:iam/rolePolicy:RolePolicy',
+        ].includes(resource.resourceType)) {
+        return false;
+    }
+    if (resource.operation !== 'update' ||
+        resource.resourceType !== 'aws:iam/role:Role' ||
+        resource.changedProperties.length === 0) {
+        return true;
+    }
+    return resource.changedProperties.some(({ path }) => /(?:^|[./])(?:assumeRolePolicy|inlinePolicies|managedPolicyArns|permissionsBoundary|policy|trust)(?:[./]|$)/iu.test(path));
+}
 function classifyInfrastructureRisk(input) {
     const findings = [];
     if (!input.diff.complete) {
@@ -214,12 +296,7 @@ function classifyInfrastructureRisk(input) {
         findings.push(...iamFindings(validation));
     }
     const validations = input.iamValidations ?? [];
-    for (const resource of input.diff.resources.filter(({ operation, resourceType }) => operation !== 'delete' &&
-        [
-            'aws:iam/policy:Policy',
-            'aws:iam/role:Role',
-            'aws:iam/rolePolicy:RolePolicy',
-        ].includes(resourceType))) {
+    for (const resource of input.diff.resources.filter(requiresIamPolicyAnalysis)) {
         if (!validations.some(({ policyResourceId }) => policyResourceId === resource.logicalId)) {
             findings.push(finding('unknown', 'iam-access-analyzer-evidence-missing', 'An IAM change lacks resource-bound Access Analyzer evidence.', resource));
         }
@@ -251,6 +328,9 @@ function classifyInfrastructureRisk(input) {
             requiredApprovals.add('data-owner-and-recovery');
             requiredApprovals.add('point-of-no-return');
         }
+        if (item.code === 'stateful-resource-addition') {
+            requiredApprovals.add('data-owner-and-recovery');
+        }
         if (item.class === 'protection-reduction') {
             requiredApprovals.add('protection-exception');
         }

package/src/local-dev/browser-verification.d.ts

@@ -0,0 +1,37 @@
+export interface LocalBrowserTarget {
+    fleetId: string;
+    origin: string;
+    routePrefix: string;
+    healthPath: string;
+    sessionGeneration: string;
+    slice: string;
+    stage: string;
+    spkiSha256: string;
+}
+/** Validate authenticated IPC state against independently resolved worktree coordinates. */
+export declare function validateLocalBrowserTarget(input: {
+    certificatePem: string;
+    fleetId: string;
+    healthPath: string;
+    routePrefix: string;
+    sessionGeneration: string;
+    slice: string;
+    stage: string;
+    state: unknown;
+    workspaceRealpath: string;
+    now?: number;
+}): LocalBrowserTarget;
+export declare function resolveLocalBrowserTarget(input: {
+    workspaceRoot: string;
+    slice: string;
+}): Promise<LocalBrowserTarget>;
+/** Trust only the private leaf key in this disposable Chromium process, never the host. */
+export declare function localBrowserLaunchArguments(target: LocalBrowserTarget): string[];
+export declare function localBrowserRequestAllowed(origin: string, requested: string, websocket?: boolean): boolean;
+export declare function validateLocalBrowserReport(value: unknown): number;
+export declare function runLocalBrowserVerification(input: {
+    workspaceRoot: string;
+    slice: string;
+}): Promise<void>;
+/** @internal Only classify a known prerequisite; never echo test output or local paths. */
+export declare function localBrowserFailureGuidance(error: unknown): string;