@intentius/chant 0.57.0 → 0.59.0

package/src/cli/commands/__snapshots__/init-lexicon.test.ts.snap

@@ -97,6 +97,7 @@ export async function packageLexicon(options?: { verbose?: boolean; force?: bool
     buildManifest: (genResult) => ({
       name: "fixture",
       version: "0.0.1",
+      chantVersion: ">=0.1.0",
     }),
     srcDir,
     collectSkills: () => new Map(),

package/src/cli/commands/audit.test.ts

@@ -221,6 +221,35 @@ describe("auditCommand", () => {
     expect(none.exitCode).toBe(0);
   });
 
+  test("--fail-on error is a severity floor, decoupled from tier: a warning-severity finding does not fail it, an error-severity one does (chant #2113)", async () => {
+    const onlyWarning = await auditCommand({
+      path: REPO,
+      failOn: "error",
+      checksProvider: async () => [
+        {
+          id: "TEST900",
+          description: "always fires a warning, for the --fail-on error floor test",
+          check: () => [{ checkId: "TEST900", severity: "warning" as const, message: "a new rule shipped at warning" }],
+        },
+      ],
+    });
+    expect(onlyWarning.findings.some((f) => f.checkId === "TEST900")).toBe(true);
+    expect(onlyWarning.exitCode).toBe(0);
+
+    const withAnError = await auditCommand({
+      path: REPO,
+      failOn: "error",
+      checksProvider: async () => [
+        {
+          id: "TEST901",
+          description: "always fires an error, for the --fail-on error floor test",
+          check: () => [{ checkId: "TEST901", severity: "error" as const, message: "an actual error" }],
+        },
+      ],
+    });
+    expect(withAnError.exitCode).toBe(1);
+  });
+
   test("--tier merge-worthy filters out report-only findings", async () => {
     const all = await auditCommand({ path: REPO, tier: "all" });
     const mw = await auditCommand({ path: REPO, tier: "merge-worthy" });
@@ -267,12 +296,11 @@ describe("auditCommand", () => {
       expect(result.output).toContain("k8s/deploy.yaml  ->  k8s");
       expect(result.output).toContain("infra/stack.json  ->  aws");
       expect(result.output).toContain("Dockerfile  ->  docker");
-      expect(result.output).toContain("infra/main.tf  ->  terraform (not audited; see chant carve)");
-      // The install line names only the lexicons the files wanted, never terraform.
+      expect(result.output).toContain("infra/main.tf  ->  terraform");
+      // The install line names every lexicon the files wanted, terraform included.
       expect(result.output).toContain(
-        `npx -p @intentius/chant -p @intentius/chant-lexicon-github -p @intentius/chant-lexicon-docker -p @intentius/chant-lexicon-aws -p @intentius/chant-lexicon-k8s chant audit ${MIXED}`,
+        `npx -p @intentius/chant -p @intentius/chant-lexicon-github -p @intentius/chant-lexicon-docker -p @intentius/chant-lexicon-terraform -p @intentius/chant-lexicon-aws -p @intentius/chant-lexicon-k8s chant audit ${MIXED}`,
       );
-      expect(result.output).not.toContain("chant-lexicon-terraform");
     });
 
     test("zero lexicons with --json: status no-lexicons plus the unclaimed list and install line", async () => {
@@ -282,7 +310,7 @@ describe("auditCommand", () => {
       const json = JSON.parse(result.output);
       expect(json.status).toBe("no-lexicons");
       expect(json.findings).toEqual([]);
-      expect(json.missingLexicons).toEqual(["github", "docker", "aws", "k8s"]);
+      expect(json.missingLexicons).toEqual(["github", "docker", "terraform", "aws", "k8s"]);
       expect(json.unclaimed).toContainEqual({ path: "k8s/deploy.yaml", lexicon: "k8s" });
       expect(json.unclaimed).toContainEqual({ path: "infra/main.tf", lexicon: "terraform" });
       expect(json.install).toMatch(/^npx -p @intentius\/chant /);
@@ -307,9 +335,9 @@ describe("auditCommand", () => {
       expect(result.status).toBe("ok");
       expect(result.exitCode).toBe(0);
       expect(result.scanned).toEqual([".github/workflows/ci.yml"]);
-      expect(result.output).toMatch(/^Note: 3 files look like docker\/aws\/k8s but those lexicons are not installed, so they were skipped \(npm i @intentius\/chant-lexicon-docker @intentius\/chant-lexicon-aws @intentius\/chant-lexicon-k8s\)\./);
-      expect(result.output).toContain("1 Terraform file skipped; the audit does not read HCL (see chant carve).");
+      expect(result.output).toMatch(/^Note: 4 files look like docker\/terraform\/aws\/k8s but those lexicons are not installed, so they were skipped \(npm i @intentius\/chant-lexicon-docker @intentius\/chant-lexicon-terraform @intentius\/chant-lexicon-aws @intentius\/chant-lexicon-k8s\)\./);
       expect(result.unclaimed).toContainEqual({ path: "k8s/deploy.yaml", lexicon: "k8s" });
+      expect(result.unclaimed).toContainEqual({ path: "infra/main.tf", lexicon: "terraform" });
     });
 
     test("partial with --json: status ok and the unclaimed files ride along", async () => {
@@ -320,12 +348,13 @@ describe("auditCommand", () => {
       expect(json.unclaimed.map((u: { lexicon: string }) => u.lexicon).sort()).toEqual(["aws", "docker", "k8s", "terraform"]);
     });
 
-    test("all lexicons loaded: no coverage note, no unclaimed (terraform aside)", async () => {
+    test("every installable lexicon loaded: nothing is unclaimed, and the terraform root is scanned as one bundle (#2083)", async () => {
       const result = await auditCommand({ path: MIXED, plugins: await loadAuditPlugins() });
       expect(result.status).toBe("ok");
-      expect(result.unclaimed).toEqual([{ path: "infra/main.tf", lexicon: "terraform" }]);
-      expect(result.output).not.toContain("not installed");
-      expect(result.scanned.sort()).toEqual([".github/workflows/ci.yml", "Dockerfile", "infra/stack.json", "k8s/deploy.yaml"]);
+      expect(result.unclaimed).toEqual([]);
+      expect(result.output).not.toContain("looks like terraform");
+      // `infra` is the terraform root-module bundle (one input per directory of `.tf` files).
+      expect(result.scanned.sort()).toEqual([".github/workflows/ci.yml", "Dockerfile", "infra", "infra/stack.json", "k8s/deploy.yaml"]);
     });
 
     test("installLine puts every lexicon on the same npx -p path", () => {
@@ -441,6 +470,53 @@ describe("auditCommand", () => {
     expect(valid).toBe(true);
   });
 
+  // The scope is the discovered root module's own directory (`infra`), which
+  // is what the terraform plugin names an audited scope after since #2217.
+  describe("TF001's missing-resource shape renders in all three reporters (chant #2113)", () => {
+    const dir = join(tmpdir(), `chant-audit-tf-missing-${process.pid}`);
+
+    function setup(): void {
+      mkdirSync(join(dir, "infra"), { recursive: true });
+      writeFileSync(join(dir, "infra/main.tf"), 'terraform {\n  required_version = ">= 1.5.0"\n}\n');
+    }
+    function teardown(): void {
+      rmSync(dir, { recursive: true, force: true });
+    }
+
+    test("stylish names the missing kind and scope instead of falling back to entity", async () => {
+      setup();
+      const result = await auditCommand({ path: dir, format: "stylish" });
+      expect(result.output).toContain("(missing backend in infra)");
+      teardown();
+    });
+
+    test("json carries `missing` on the finding", async () => {
+      setup();
+      const result = await auditCommand({ path: dir, format: "json" });
+      const doc = JSON.parse(result.output) as { findings: Array<{ checkId: string; missing?: { kind: string; scope: string } }> };
+      const tf001 = doc.findings.find((f) => f.checkId === "TF001");
+      expect(tf001?.missing).toEqual({ kind: "backend", scope: "infra" });
+      teardown();
+    });
+
+    test("sarif carries `missing` in the result's properties, and still validates against the SARIF schema", async () => {
+      setup();
+      const result = await auditCommand({ path: dir, format: "sarif" });
+      const doc = JSON.parse(result.output) as {
+        runs: Array<{ results: Array<{ ruleId: string; properties?: { missing?: { kind: string; scope: string } } }> }>;
+      };
+      const tf001 = doc.runs[0].results.find((r) => r.ruleId === "TF001");
+      expect(tf001?.properties?.missing).toEqual({ kind: "backend", scope: "infra" });
+
+      const ajv = new Ajv({ strict: false, allErrors: true });
+      const validate = ajv.compile(loadSarifSchema() as object);
+      const valid = validate(doc);
+      if (!valid) throw new Error(ajv.errorsText(validate.errors));
+      expect(valid).toBe(true);
+      teardown();
+    });
+  });
+
   test("sarif schema validation also holds for the empty-result case (no findings)", async () => {
     const repo = fileURLToPath(new URL("./__fixtures__/audit-fountain-clean", import.meta.url));
     const result = await auditCommand({ path: repo, format: "sarif" });
@@ -555,6 +631,82 @@ describe("secrets detection (#443)", () => {
   });
 });
 
+describe("Terraform HCL suppression (chant #2111)", () => {
+  function tmpRepo(): string {
+    const dir = join(tmpdir(), `chant-audit-tf-suppress-${process.pid}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(dir, { recursive: true });
+    mkdirSync(join(dir, "infra"), { recursive: true });
+    return dir;
+  }
+
+  const BACKENDLESS = 'terraform {\n  required_version = ">= 1.5.0"\n}\n';
+
+  async function auditTerraform(dir: string): Promise<Awaited<ReturnType<typeof auditCommand>>> {
+    const all = await loadAuditPlugins();
+    return auditCommand({ path: dir, plugins: all.filter((p) => p.name === "terraform"), format: "json" });
+  }
+
+  test("chant-ignore-block suppresses TF001 through chant audit", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "infra", "main.tf"), `# chant-ignore-block: TF001\n${BACKENDLESS}`);
+    const result = await auditTerraform(dir);
+    expect(result.findings.map((f) => f.checkId)).not.toContain("TF001");
+    expect(result.suppressedCount).toBe(1);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("a plain chant-ignore on the same block also suppresses TF001 through chant audit", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "infra", "main.tf"), `# chant-ignore: TF001\n${BACKENDLESS}`);
+    const result = await auditTerraform(dir);
+    expect(result.findings.map((f) => f.checkId)).not.toContain("TF001");
+    expect(result.suppressedCount).toBe(1);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test('"all" suppresses TF001 through chant audit', async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "infra", "main.tf"), `# chant-ignore-block: all\n${BACKENDLESS}`);
+    const result = await auditTerraform(dir);
+    expect(result.findings.map((f) => f.checkId)).not.toContain("TF001");
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("chant-ignore-file at the top of the file suppresses TF001 through chant audit", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "infra", "main.tf"), `# chant-ignore-file: TF001\n${BACKENDLESS}`);
+    const result = await auditTerraform(dir);
+    expect(result.findings.map((f) => f.checkId)).not.toContain("TF001");
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("a chant-ignore-file NOT at the top has no effect and is reported through chant audit", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "infra", "main.tf"), `# a header\n# chant-ignore-file: TF001\n${BACKENDLESS}`);
+    const result = await auditTerraform(dir);
+    expect(result.findings.map((f) => f.checkId)).toContain("TF001"); // still fires
+    expect(result.findings.map((f) => f.checkId)).toContain("SUPP002");
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("a directive naming a different rule id does not suppress TF001 through chant audit", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "infra", "main.tf"), `# chant-ignore-block: TF010\n${BACKENDLESS}`);
+    const result = await auditTerraform(dir);
+    expect(result.findings.map((f) => f.checkId)).toContain("TF001");
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("an already-expired suppression no longer suppresses TF001 and is reported through chant audit", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "infra", "main.tf"), `# chant-ignore-block: TF001 exp:2020-01-01\n${BACKENDLESS}`);
+    const result = await auditTerraform(dir);
+    expect(result.findings.map((f) => f.checkId)).toContain("TF001"); // still fires: expired
+    expect(result.findings.map((f) => f.checkId)).toContain("SUPP001");
+    rmSync(dir, { recursive: true, force: true });
+  });
+});
+
 describe("Wrangler config audit (#446)", () => {
   function tmpRepo(): string {
     const dir = join(tmpdir(), `chant-audit-wrangler-${process.pid}-${Math.random().toString(36).slice(2)}`);
@@ -649,3 +801,31 @@ describe("nginx config audit (#1979)", () => {
     rmSync(dir, { recursive: true, force: true });
   });
 });
+
+describe("committed Terraform state (TF023, #2110)", () => {
+  function tmpRepo(): string {
+    const dir = join(tmpdir(), `chant-audit-tfstate-${process.pid}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(dir, { recursive: true });
+    return dir;
+  }
+
+  test("fires end to end on a directory with a tracked state file, with no lexicon installed", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, "main.tf"), 'resource "null_resource" "a" {}\n');
+    writeFileSync(join(dir, "terraform.tfstate"), JSON.stringify({ version: 4, resources: [] }));
+    const result = await auditCommand({ path: dir, plugins: [] });
+    expect(result.findings.map((f) => f.checkId)).toContain("TF023");
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("says nothing when the state is ignored rather than committed", async () => {
+    const dir = tmpRepo();
+    writeFileSync(join(dir, ".gitignore"), "*.tfstate\n.terraform/\n");
+    writeFileSync(join(dir, "main.tf"), 'resource "null_resource" "a" {}\n');
+    writeFileSync(join(dir, "terraform.tfstate"), JSON.stringify({ version: 4, resources: [] }));
+    mkdirSync(join(dir, ".terraform"), { recursive: true });
+    const result = await auditCommand({ path: dir, plugins: [] });
+    expect(result.findings.map((f) => f.checkId)).not.toContain("TF023");
+    rmSync(dir, { recursive: true, force: true });
+  });
+});

package/src/cli/commands/audit.ts

@@ -7,12 +7,13 @@
 
 import { existsSync, readFileSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
-import { auditFiles, type AuditInput, type AuditFinding, type ChecksProvider } from "../../audit/core";
+import { auditFiles, type AuditInput, type AuditFinding, type ChecksProvider, type SuppressionStats } from "../../audit/core";
 import { AUDIT_LEXICONS, classifyFiles, collectCandidates, loadAuditPlugins, unclaimedFiles, type DetectPlugin, type RepoFile, type UnclaimedFile } from "../../audit/discover";
 import { RULE_CATALOG, resolveAuditCatalog, type RuleMeta } from "../../audit/catalog";
 import { scanForSecrets, parseSecretsConfig, type SecretsScanOptions } from "../../audit/secrets";
 import { auditWranglerConfigs } from "../../audit/wrangler";
 import { auditNginxConfigs } from "../../audit/nginx";
+import { auditTerraformState } from "../../audit/terraform-state";
 import { renderMarkdown } from "../../audit/report";
 import { renderHtml, type ReportTheme } from "../../audit/report-html";
 import { buildReportJson, REPORT_SCHEMA_VERSION, type AuditSnapshot } from "../../audit/report-model";
@@ -23,7 +24,17 @@ import type { Severity } from "../../lint/rule";
 
 export type AuditFormat = "stylish" | "json" | "sarif" | "markdown" | "html";
 export type AuditTier = "merge-worthy" | "all";
-export type AuditFailOn = "merge-worthy" | "warning" | "none";
+/**
+ * `"error"` (chant #2113) is the minimum-failure-severity floor tflint's
+ * `--minimum-failure-severity` maps onto (`error | warning | notice`): unlike
+ * `"merge-worthy"`/`"warning"` above (which key off a rule's catalog `tier`
+ * or a finding's severity being at-or-above warning), `"error"` fails only on
+ * an `error`-severity finding, decoupling what CI fails a build over from
+ * what a rule ships reporting by default. It's the lever that lets a new
+ * rule ship at `warning` and be promoted to `error` later without a pipeline
+ * pinned to `--fail-on error` breaking the moment the rule starts firing.
+ */
+export type AuditFailOn = "merge-worthy" | "warning" | "error" | "none";
 
 export interface AuditCommandOptions {
   /** Repo root/dir to scan, or an https:// repo URL to fetch and audit. */
@@ -79,6 +90,12 @@ export interface AuditCommandResult {
   unclaimed?: UnclaimedFile[];
   /** Where `output` belongs; diagnostics go to stderr, reports to stdout (default). */
   stream?: "stdout" | "stderr";
+  /**
+   * Findings an inline `# chant-ignore*` comment suppressed (chant #2111),
+   * counted, never dropped silently, mirroring `chant build`'s equivalent
+   * summary line.
+   */
+  suppressedCount?: number;
 }
 
 /** Exit code when the audit had no lexicons to look with. Distinct from 1 (findings / failure). */
@@ -89,9 +106,9 @@ function lexiconPackage(name: string): string {
   return `@intentius/chant-lexicon-${name}`;
 }
 
-/** Missing audit lexicons the unclaimed files pointed at, in first-seen order. `terraform` is not installable. */
+/** Missing audit lexicons the unclaimed files pointed at, in first-seen order. */
 function wantedLexicons(unclaimed: UnclaimedFile[]): string[] {
-  return [...new Set(unclaimed.map((u) => u.lexicon))].filter((l) => l !== "terraform");
+  return [...new Set(unclaimed.map((u) => u.lexicon))];
 }
 
 /**
@@ -107,17 +124,10 @@ export function installLine(lexicons: string[], target: string): string {
 /** One-line coverage hint for the partial case: some lexicons loaded, others wanted by files on disk. */
 function missingLexiconHint(unclaimed: UnclaimedFile[]): string | undefined {
   const wanted = wantedLexicons(unclaimed);
-  const tf = unclaimed.filter((u) => u.lexicon === "terraform").length;
-  const parts: string[] = [];
-  if (wanted.length > 0) {
-    const n = unclaimed.length - tf;
-    parts.push(
-      `${n} file${n === 1 ? " looks" : "s look"} like ${wanted.join("/")} but ${wanted.length === 1 ? "that lexicon is" : "those lexicons are"} not installed, so ${n === 1 ? "it was" : "they were"} skipped` +
-        ` (npm i ${wanted.map(lexiconPackage).join(" ")}).`,
-    );
-  }
-  if (tf > 0) parts.push(`${tf} Terraform file${tf === 1 ? "" : "s"} skipped; the audit does not read HCL (see chant carve).`);
-  return parts.length > 0 ? parts.join(" ") : undefined;
+  if (wanted.length === 0) return undefined;
+  const n = unclaimed.length;
+  return `${n} file${n === 1 ? " looks" : "s look"} like ${wanted.join("/")} but ${wanted.length === 1 ? "that lexicon is" : "those lexicons are"} not installed, so ${n === 1 ? "it was" : "they were"} skipped` +
+    ` (npm i ${wanted.map(lexiconPackage).join(" ")}).`;
 }
 
 /** Human-readable diagnostic for the zero-lexicon case. */
@@ -129,11 +139,10 @@ function renderNoLexicons(target: string, unclaimed: UnclaimedFile[]): string {
   if (unclaimed.length > 0) {
     lines.push("", "Files that wanted a lexicon:");
     for (const u of unclaimed) {
-      const note = u.lexicon === "terraform" ? "terraform (not audited; see chant carve)" : u.lexicon;
-      lines.push(`  ${u.path}  ->  ${note}`);
+      lines.push(`  ${u.path}  ->  ${u.lexicon}`);
     }
   } else {
-    lines.push("", "No file under the target looked like CI, Kubernetes, Helm, Docker, CloudFormation, ARM, Config Connector, or fountain either.");
+    lines.push("", "No file under the target looked like CI, Kubernetes, Helm, Docker, CloudFormation, ARM, Config Connector, fountain, or Terraform either.");
   }
   lines.push("", "Run it with the lexicons those files need:");
   lines.push(`  ${installLine(wanted.length > 0 ? wanted : [...AUDIT_LEXICONS], target)}`);
@@ -197,6 +206,7 @@ function exitCodeFor(findings: AuditFinding[], failOn: AuditFailOn, catalog: Rec
   if (failOn === "warning") {
     return findings.some((f) => f.severity === "error" || f.severity === "warning") ? 1 : 0;
   }
+  if (failOn === "error") return findings.some((f) => f.severity === "error") ? 1 : 0;
   return 0;
 }
 
@@ -252,7 +262,15 @@ function renderStylish(findings: AuditFinding[], scanned: string[], notes: strin
     lines.push("", title);
     for (const f of list) {
       const loc = f.line ? `${f.file}:${f.line}` : f.file;
-      const where = f.entity ? `${loc} (${f.entity})` : loc;
+      // A `missing` finding (chant #2113) has nothing present to anchor
+      // `entity` to. The whole point is that `f.missing.kind` does not
+      // exist in `f.missing.scope`, so it renders that absence directly
+      // instead of falling back to `entity` (which such a check rarely sets).
+      const where = f.missing
+        ? `${loc} (missing ${f.missing.kind} in ${f.missing.scope})`
+        : f.entity
+          ? `${loc} (${f.entity})`
+          : loc;
       const title = catalog[f.checkId]?.title ?? f.checkId;
       lines.push(`  [${f.checkId}] ${f.severity}  ${where}  — ${title}`);
     }
@@ -280,11 +298,21 @@ function renderSarif(findings: AuditFinding[], catalog: Record<string, RuleMeta>
       shortDescription: { text: m?.title ?? id },
       ...(m?.remediation ? { help: { text: m.remediation } } : {}),
       helpUri: m?.authority?.[0]?.url,
-      ...(m?.category ? { properties: { category: m.category, dimension: m.category } } : {}),
+      // `priorArt` credits the upstream tools whose rules check the same thing
+      // (audit/prior-art.ts) — tool key, upstream rule id, doc URL, relation.
+      ...(m?.category || m?.lineage?.length
+        ? {
+            properties: {
+              ...(m?.category ? { category: m.category, dimension: m.category } : {}),
+              ...(m?.lineage?.length ? { priorArt: m.lineage } : {}),
+            },
+          }
+        : {}),
     };
   });
   const results = findings.map((f) => {
     const tier = catalog[f.checkId]?.tier;
+    const properties = { ...(tier ? { tier } : {}), ...(f.missing ? { missing: f.missing } : {}) };
     return {
       ruleId: f.checkId,
       level: sarifLevel(f.severity),
@@ -297,7 +325,12 @@ function renderSarif(findings: AuditFinding[], catalog: Record<string, RuleMeta>
           },
         },
       ],
-      ...(tier ? { properties: { tier } } : {}),
+      // `f.missing` (chant #2113) is Snyk policy-engine's "missing-resource"
+      // archetype: nothing at `f.file` actually declares the absent thing, so
+      // there is no line to point SARIF's region at either. `missing` rides
+      // in the property bag (SARIF's core schema has no dedicated slot for an
+      // absence finding) rather than pretending a region exists.
+      ...(Object.keys(properties).length > 0 ? { properties } : {}),
     };
   });
   return JSON.stringify(
@@ -375,7 +408,11 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     // shape alone can't disambiguate them.
     candidates = collectCandidates(options.path);
   }
-  const inputs = classifyFiles(candidates, plugins);
+  // A local target hands its directory to the classifier, so an input whose
+  // path names a directory carries the directory itself (#2217): terraform's
+  // parse-to-graph follows a root module's local `module` calls from there. A
+  // URL target has no local tree, and never fetches `.tf` in the first place.
+  const inputs = classifyFiles(candidates, plugins, isUrl ? {} : { baseDir: options.path });
   const unclaimed = unclaimedFiles(candidates, inputs, plugins);
   const scanned = inputs.map((i) => i.path);
 
@@ -395,29 +432,37 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
   // its own path detector plus a parsed-content marker check (a `.conf` in a
   // shared directory name like conf.d/ only counts once it parses as nginx).
   const nginxFindings = auditNginxConfigs(candidates);
+  // TF023 (#2110) — committed Terraform state. Lexicon-independent for the
+  // same reason the three above are: it reads the discovered paths, not a
+  // parsed root module, so it fires with or without the terraform lexicon.
+  const terraformStateFindings = auditTerraformState(candidates);
 
   if (plugins.length === 0) {
     const output = format === "json" ? renderNoLexiconsJson(options.path, unclaimed) : renderNoLexicons(options.path, unclaimed);
-    return { success: true, status: "no-lexicons", output, findings: [...secretsFindings, ...wranglerFindings, ...nginxFindings], scanned: [], unclaimed, exitCode: NO_LEXICONS_EXIT_CODE, stream: format === "json" ? "stdout" : "stderr" };
+    return { success: true, status: "no-lexicons", output, findings: [...secretsFindings, ...wranglerFindings, ...nginxFindings, ...terraformStateFindings], scanned: [], unclaimed, exitCode: NO_LEXICONS_EXIT_CODE, stream: format === "json" ? "stdout" : "stderr" };
   }
 
   const missingLexiconNote = missingLexiconHint(unclaimed);
 
-  if (inputs.length === 0 && secretsFindings.length === 0 && wranglerFindings.length === 0 && nginxFindings.length === 0) {
+  if (inputs.length === 0 && secretsFindings.length === 0 && wranglerFindings.length === 0 && nginxFindings.length === 0 && terraformStateFindings.length === 0) {
     const output = `No auditable files found under ${options.path}.${missingLexiconNote ? ` ${missingLexiconNote}` : ""}`;
     return { success: true, status: "ok", output, findings: [], scanned: [], unclaimed, exitCode: 0 };
   }
 
   let findings: AuditFinding[] = [];
+  // chant #2111: mutated in place by `auditFiles` so its inline (`# chant-
+  // ignore*`) suppressed count reaches the summary without changing
+  // `auditFiles`'s `AuditFinding[]` return type; see `SuppressionStats`'s doc.
+  const suppressionStats: SuppressionStats = { count: 0 };
   if (inputs.length > 0) {
     try {
-      findings = await auditFiles(inputs, { checksProvider: options.checksProvider });
+      findings = await auditFiles(inputs, { checksProvider: options.checksProvider, suppressionStats });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       return { success: false, output: "", findings: [], scanned, exitCode: 1, error: msg };
     }
   }
-  findings = [...findings, ...secretsFindings, ...wranglerFindings, ...nginxFindings];
+  findings = [...findings, ...secretsFindings, ...wranglerFindings, ...nginxFindings, ...terraformStateFindings];
   // Resolve the audit catalog once, aggregating the audited lexicons' own
   // metadata over core's static catalog (#687). The lexicons are already loaded
   // by `auditFiles` above, so this is cheap. Core's static catalog (always
@@ -428,6 +473,11 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
   if (tier === "merge-worthy") findings = findings.filter((f) => isMergeWorthy(f, catalog));
   const notes = coverageNotes(inputs);
   if (missingLexiconNote) notes.push(missingLexiconNote);
+  if (suppressionStats.count > 0) {
+    notes.push(
+      `${suppressionStats.count} finding${suppressionStats.count === 1 ? "" : "s"} suppressed via inline chant-ignore comments.`,
+    );
+  }
 
   // Diff-bearing renderers (markdown, html) need action SHAs / image digests
   // resolved up front (sync maps so rendering stays synchronous).
@@ -495,10 +545,10 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     } catch (err) {
       return { success: false, output, findings, scanned, exitCode: 1, error: `Failed to write ${options.output}: ${err instanceof Error ? err.message : String(err)}` };
     }
-    return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode, wroteTo: options.output };
+    return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode, wroteTo: options.output, suppressedCount: suppressionStats.count };
   }
 
-  return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode };
+  return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode, suppressedCount: suppressionStats.count };
 }
 
 /** Print an audit result to stdout. */