infraweaver 0.1.0

package/src/mcp/terraform/policyAuthor.ts

@@ -0,0 +1,886 @@
+/**
+ * §5.2 — plain-language standard → REVIEWED policy-as-code.
+ *
+ * The feature a compliance officer asks for is "paste our internal standard, get
+ * a policy". The feature that is safe to ship is narrower, and the difference is
+ * the whole design.
+ *
+ * WHY NOT "MODEL WRITES REGO". Rego's worst failure mode is silent: a rule that
+ * references a field name the plan JSON does not have is not an error, it is
+ * *vacuously satisfied* — it never denies. A generated policy that looks
+ * enforced and passes everything is strictly worse than no policy, because a
+ * control owner will tick the box. Free-form generation cannot rule that out,
+ * and neither can reading the diff.
+ *
+ * WHAT THIS DOES INSTEAD. The model's job is reduced to filling in a CLOSED
+ * intermediate representation ([[PolicyRuleSpec]]) — one resource type, one
+ * attribute path, one operator drawn from a fixed set. Everything downstream is
+ * deterministic:
+ *
+ *   1. `emitRego` / `emitPolicyHcl` / `emitPolicyTestHcl` are pure functions of
+ *      the spec. The same spec always produces the same bytes.
+ *   2. `selfTestSpec` evaluates the spec IN PROCESS against three generated
+ *      fixtures — violating, compliant, and attribute-absent — and REJECTS a
+ *      spec that does not deny the violating case. That is the vacuous-rule
+ *      check, and it runs before a human is ever shown the policy.
+ *   3. The crosswalk mapping is not generated at all: the spec names one of the
+ *      existing themes, so the control citation comes from the reviewed
+ *      [[crosswalk]] table by the same mechanical hop every other finding uses.
+ *
+ * WHAT IT DELIBERATELY DOES NOT CLAIM. We do not ship OPA or tfpolicy, so this
+ * module cannot assert that the EMITTED text behaves like the spec — only that
+ * the spec itself is non-vacuous and that the emission is deterministic. The
+ * caller reports that distinction (`rego_verified`, `policy_hcl_fidelity`)
+ * rather than papering over it; `policy_check` (conftest) and the customer's own
+ * `tfpolicy validate`/`test` are where the emitted artifacts get executed. The
+ * `.policytest.hcl` exists precisely so that step is one command, not a project.
+ *
+ * ONE MORE HONESTY POINT, AND IT IS THE SUBTLE ONE. "The attribute is missing"
+ * is not a verdict a policy engine can guess. `acl != "public-read"` on a bucket
+ * with no `acl` is compliant (the default is private); `sse_algorithm == "AES256"`
+ * on a bucket with no encryption block is a violation. Same shape, opposite
+ * answer. So `when_absent` is a REQUIRED field with no default — the author
+ * states it, the self-test exercises it, and the reviewing human sees it.
+ */
+import { PRODUCT_NAME } from "#app/brand";
+import { THEME_TO_NIST } from "#app/mcp/crosswalk";
+import { SEVERITY_RANK, type Severity } from "#app/mcp/terraform/types";
+
+/**
+ * The namespace an authored rule's id carries. Deliberately NOT the `infraweaver:`
+ * native-source prefix: these findings are produced by the customer's conftest
+ * running the customer's committed policy. We helped write it; we did not find
+ * it, and the label should not imply otherwise.
+ */
+export const AUTHORED_RULE_PREFIX = "policy";
+
+/** The fully-qualified rule id for an authored spec. */
+export function authoredRuleId(id: string): string {
+  return `${AUTHORED_RULE_PREFIX}:${id}`;
+}
+
+/** The closed predicate set. Anything not expressible here is not authorable —
+ *  which is the point: an operator we cannot evaluate in process is an operator
+ *  whose generated policy we cannot self-test. */
+export const POLICY_OPERATORS = [
+  "equals",
+  "not_equals",
+  "in",
+  "not_in",
+  "present",
+  "absent",
+  "is_true",
+  "is_false",
+  "matches",
+  "gte",
+  "lte",
+  "non_empty",
+] as const;
+
+export type PolicyOperator = (typeof POLICY_OPERATORS)[number];
+
+/** Operators that compare against a scalar operand. */
+const SCALAR_OPERAND: ReadonlySet<PolicyOperator> = new Set([
+  "equals",
+  "not_equals",
+  "matches",
+  "gte",
+  "lte",
+]);
+
+/** Operators that compare against a list operand. */
+const LIST_OPERAND: ReadonlySet<PolicyOperator> = new Set(["in", "not_in"]);
+
+/** Operators that take no operand at all. */
+const NO_OPERAND: ReadonlySet<PolicyOperator> = new Set([
+  "present",
+  "absent",
+  "is_true",
+  "is_false",
+  "non_empty",
+]);
+
+/** Operators whose operand must be numeric. */
+const NUMERIC_OPERAND: ReadonlySet<PolicyOperator> = new Set(["gte", "lte"]);
+
+export type PolicyScalar = string | number | boolean;
+
+/**
+ * What the rule concludes when the attribute path resolves to nothing.
+ * Required, and deliberately not defaulted — see the module note.
+ */
+export type WhenAbsent = "violation" | "compliant";
+
+/**
+ * The reviewed intermediate representation. This — not Rego — is what the model
+ * produces from prose, and what a human reviews.
+ */
+export interface PolicyRuleSpec {
+  /** kebab-case, unique within the authored pack. Becomes the rule id in every emitted artifact. */
+  id: string;
+  /** one-line human title. */
+  title: string;
+  /** the sentence of the SOURCE STANDARD this rule was derived from, quoted. The
+   *  audit trail from prose to policy; carried into every emitted artifact. */
+  source_requirement: string;
+  /** the Terraform resource type the rule applies to, e.g. `aws_s3_bucket`. */
+  resource_type: string;
+  /** dotted path into the resource's planned values, e.g.
+   *  `server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm`.
+   *  A segment that resolves to an array is flattened — every element contributes
+   *  a candidate value, and the rule must hold for ALL of them. */
+  attribute: string;
+  operator: PolicyOperator;
+  /** the operand. Scalar for equals/not_equals/matches/gte/lte, a list for
+   *  in/not_in, omitted for the rest. */
+  value?: PolicyScalar | PolicyScalar[];
+  when_absent: WhenAbsent;
+  severity: Severity;
+  /** one of the reviewed crosswalk themes — this is what earns the control citation. */
+  theme: string;
+  /** the violation message a reviewer and an engineer both read. */
+  message: string;
+  /** a compliant value for the generated fixtures. REQUIRED for `matches`, where
+   *  no value can be synthesised from the pattern; optional elsewhere. */
+  example_compliant?: PolicyScalar;
+  /** a violating value for the generated fixtures. REQUIRED for `matches`. */
+  example_violating?: PolicyScalar;
+}
+
+// ── validation ───────────────────────────────────────────────────────────────
+
+const ID_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
+const RESOURCE_TYPE_RE = /^[a-z][a-z0-9]*(_[a-z0-9]+)+$/;
+const ATTRIBUTE_RE = /^[a-z_][a-z0-9_]*(\.[a-z_][a-z0-9_]*)*$/;
+
+/**
+ * Structural validation of a spec. Returns the list of problems — empty means
+ * valid. Kept separate from the self-test: this catches "the spec is malformed",
+ * the self-test catches "the spec is well-formed but says nothing".
+ */
+export function validateSpec(spec: PolicyRuleSpec): string[] {
+  const errs: string[] = [];
+  if (!ID_RE.test(spec.id))
+    errs.push(`id '${spec.id}' must be kebab-case (a-z, 0-9, hyphens)`);
+  if (!spec.title.trim()) errs.push("title is empty");
+  if (!spec.source_requirement.trim())
+    errs.push(
+      "source_requirement is empty — every rule must cite the prose it came from",
+    );
+  if (!spec.message.trim()) errs.push("message is empty");
+  if (!RESOURCE_TYPE_RE.test(spec.resource_type))
+    errs.push(
+      `resource_type '${spec.resource_type}' is not a Terraform resource type`,
+    );
+  if (!ATTRIBUTE_RE.test(spec.attribute))
+    errs.push(`attribute '${spec.attribute}' is not a dotted attribute path`);
+  if (!(spec.theme in THEME_TO_NIST))
+    errs.push(
+      `theme '${spec.theme}' is not a crosswalk theme — pick one of: ${Object.keys(THEME_TO_NIST).sort().join(", ")}`,
+    );
+  if (!(spec.severity in SEVERITY_RANK))
+    errs.push(`severity '${spec.severity}' is not a severity`);
+
+  const op = spec.operator;
+  if (!POLICY_OPERATORS.includes(op)) {
+    errs.push(`operator '${op}' is not supported`);
+    return errs;
+  }
+  const v = spec.value;
+  if (NO_OPERAND.has(op)) {
+    if (v !== undefined) errs.push(`operator '${op}' takes no value`);
+  } else if (LIST_OPERAND.has(op)) {
+    if (!Array.isArray(v) || v.length === 0)
+      errs.push(`operator '${op}' needs a non-empty list value`);
+  } else if (SCALAR_OPERAND.has(op)) {
+    if (v === undefined || Array.isArray(v))
+      errs.push(`operator '${op}' needs a scalar value`);
+    else if (NUMERIC_OPERAND.has(op) && typeof v !== "number")
+      errs.push(`operator '${op}' needs a numeric value`);
+    else if (op === "matches") {
+      if (typeof v !== "string")
+        errs.push("operator 'matches' needs a string regex");
+      else {
+        try {
+          new RegExp(v);
+        } catch (e) {
+          errs.push(
+            `operator 'matches' regex does not compile: ${(e as Error).message}`,
+          );
+        }
+      }
+      // No value can be synthesised from an arbitrary pattern, so the author
+      // supplies both sides. Without them the fixtures — and therefore the
+      // vacuity check — would be guesswork.
+      if (
+        spec.example_compliant === undefined ||
+        spec.example_violating === undefined
+      )
+        errs.push(
+          "operator 'matches' requires both example_compliant and example_violating (a fixture value cannot be derived from a regex)",
+        );
+    }
+  }
+  return errs;
+}
+
+// ── evaluation (the semantics every emitter mirrors) ─────────────────────────
+
+/**
+ * Resolve a dotted path against a planned-values object, flattening arrays: at
+ * each segment, an array contributes each of its elements as a candidate parent.
+ * Returns every leaf value the path reaches. An empty array means the path
+ * resolved to nothing — which is what `when_absent` decides on.
+ *
+ * `null` leaves are dropped: Terraform writes an unset optional argument as
+ * `null`, and "present but null" is the same fact as "absent" to a reader.
+ */
+export function resolvePath(root: unknown, path: string): unknown[] {
+  let level: unknown[] = [root];
+  for (const segment of path.split(".")) {
+    const next: unknown[] = [];
+    for (const node of level) {
+      for (const member of node !== null && Array.isArray(node)
+        ? node
+        : [node]) {
+        if (member === null || typeof member !== "object") continue;
+        const child = (member as Record<string, unknown>)[segment];
+        if (child === undefined) continue;
+        next.push(child);
+      }
+    }
+    level = next;
+  }
+  // flatten a terminal array (e.g. a list attribute) into its elements, and drop nulls
+  const out: unknown[] = [];
+  for (const node of level) {
+    for (const member of Array.isArray(node) ? node : [node]) {
+      if (member === null) continue;
+      out.push(member);
+    }
+  }
+  return out;
+}
+
+/** Does one resolved value satisfy the rule? Pure; mirrored by the emitted Rego. */
+export function valueSatisfies(spec: PolicyRuleSpec, value: unknown): boolean {
+  const v = spec.value;
+  switch (spec.operator) {
+    case "equals":
+      return value === v;
+    case "not_equals":
+      return value !== v;
+    case "in":
+      return Array.isArray(v) && v.some((x) => x === value);
+    case "not_in":
+      return Array.isArray(v) && !v.some((x) => x === value);
+    // `present` is satisfied by any resolved value — `resolvePath` has already
+    // dropped nulls, so reaching here means something real is there.
+    case "present":
+      return true;
+    // ...and `absent` is therefore violated by any resolved value.
+    case "absent":
+      return false;
+    case "is_true":
+      return value === true;
+    case "is_false":
+      return value === false;
+    case "matches":
+      return (
+        typeof value === "string" &&
+        typeof v === "string" &&
+        new RegExp(v).test(value)
+      );
+    case "gte":
+      return typeof value === "number" && typeof v === "number" && value >= v;
+    case "lte":
+      return typeof value === "number" && typeof v === "number" && value <= v;
+    case "non_empty":
+      if (typeof value === "string" || Array.isArray(value))
+        return value.length > 0;
+      if (value !== null && typeof value === "object")
+        return Object.keys(value as object).length > 0;
+      return false;
+  }
+}
+
+export interface SpecVerdict {
+  violates: boolean;
+  /** why — the sentence a test failure prints. */
+  reason: string;
+}
+
+/**
+ * Evaluate a spec against ONE resource's planned values. Universal over the
+ * resolved values: every matched value must satisfy the rule, so a list where
+ * one element is wrong is a violation.
+ */
+export function evaluateSpec(
+  spec: PolicyRuleSpec,
+  values: unknown,
+): SpecVerdict {
+  const resolved = resolvePath(values, spec.attribute);
+  if (resolved.length === 0) {
+    return spec.when_absent === "violation"
+      ? {
+          violates: true,
+          reason: `${spec.attribute} is absent and when_absent=violation`,
+        }
+      : {
+          violates: false,
+          reason: `${spec.attribute} is absent and when_absent=compliant`,
+        };
+  }
+  const bad = resolved.filter((v) => !valueSatisfies(spec, v));
+  if (bad.length === 0)
+    return {
+      violates: false,
+      reason: `all ${resolved.length} value(s) satisfy ${spec.operator}`,
+    };
+  return {
+    violates: true,
+    reason: `${bad.length} of ${resolved.length} value(s) fail ${spec.operator}: ${bad
+      .map((v) => JSON.stringify(v))
+      .join(", ")}`,
+  };
+}
+
+// ── fixtures ─────────────────────────────────────────────────────────────────
+
+/** A sentinel that no real configuration produces, used where any non-matching
+ *  value will do. Distinctive on purpose: if it ever shows up in a customer's
+ *  plan output, something generated has leaked into real config. */
+const SENTINEL = "__infraweaver_fixture_noncompliant__";
+
+/** A compliant value for the spec's operator, or the author's override. */
+function compliantValue(spec: PolicyRuleSpec): PolicyScalar {
+  if (spec.example_compliant !== undefined) return spec.example_compliant;
+  const v = spec.value;
+  switch (spec.operator) {
+    case "equals":
+      return v as PolicyScalar;
+    case "not_equals":
+      return SENTINEL;
+    case "in":
+      return (v as PolicyScalar[])[0] as PolicyScalar;
+    case "not_in":
+      return SENTINEL;
+    case "present":
+    case "non_empty":
+      return "infraweaver-fixture-value";
+    case "is_true":
+      return true;
+    case "is_false":
+      return false;
+    case "gte":
+      return v as number;
+    case "lte":
+      return v as number;
+    // `absent` has no compliant *value* — the compliant fixture is the empty one.
+    // `matches` is unreachable: validateSpec requires the author's example.
+    default:
+      return SENTINEL;
+  }
+}
+
+/** A violating value for the spec's operator, or the author's override. */
+function violatingValue(spec: PolicyRuleSpec): PolicyScalar {
+  if (spec.example_violating !== undefined) return spec.example_violating;
+  const v = spec.value;
+  switch (spec.operator) {
+    case "equals":
+      return SENTINEL;
+    case "not_equals":
+      return v as PolicyScalar;
+    case "in":
+      return SENTINEL;
+    case "not_in":
+      return (v as PolicyScalar[])[0] as PolicyScalar;
+    case "present":
+      // handled by the absent fixture; keep the shape total
+      return SENTINEL;
+    case "absent":
+      return "infraweaver-fixture-value";
+    case "is_true":
+      return false;
+    case "is_false":
+      return true;
+    case "gte":
+      return (v as number) - 1;
+    case "lte":
+      return (v as number) + 1;
+    case "non_empty":
+      return "";
+    default:
+      return SENTINEL;
+  }
+}
+
+/** Build the nested object a dotted path implies, with `leaf` at the end. */
+export function nestValue(
+  path: string,
+  leaf: unknown,
+): Record<string, unknown> {
+  const segs = path.split(".");
+  let node: unknown = leaf;
+  for (let i = segs.length - 1; i >= 0; i--)
+    node = { [segs[i] as string]: node };
+  return node as Record<string, unknown>;
+}
+
+export interface PolicyFixture {
+  /** `compliant` | `violating` | `absent` — the mock's role in the self-test. */
+  kind: "compliant" | "violating" | "absent";
+  /** the resource's planned values. */
+  values: Record<string, unknown>;
+  /** what the rule MUST conclude about it. */
+  expect_violation: boolean;
+}
+
+/**
+ * The three fixtures every authored rule is tested against. The `absent` case is
+ * the one that matters most: it is both the commonest real shape (an optional
+ * block simply not written) and the case a hand-written policy most often gets
+ * wrong.
+ */
+export function buildFixtures(spec: PolicyRuleSpec): PolicyFixture[] {
+  const fixtures: PolicyFixture[] = [];
+  // `absent` as an OPERATOR means "this must not be set" — no present value can
+  // satisfy it, so there is no compliant-value fixture to build.
+  if (spec.operator !== "absent") {
+    fixtures.push({
+      kind: "compliant",
+      values: nestValue(spec.attribute, compliantValue(spec)),
+      expect_violation: false,
+    });
+  }
+  // Symmetrically, `present` is satisfied by ANY value, so no violating-value
+  // fixture exists — its only failure mode is the absent case below.
+  if (spec.operator !== "present") {
+    fixtures.push({
+      kind: "violating",
+      values: nestValue(spec.attribute, violatingValue(spec)),
+      expect_violation: true,
+    });
+  }
+  fixtures.push({
+    kind: "absent",
+    values: {},
+    expect_violation: spec.when_absent === "violation",
+  });
+  return fixtures;
+}
+
+export interface SelfTestCase {
+  kind: PolicyFixture["kind"];
+  expected: boolean;
+  actual: boolean;
+  passed: boolean;
+  reason: string;
+}
+
+export interface SelfTestReport {
+  /** every case behaved as its fixture demanded AND the rule denies something.
+   *  Both, deliberately: a rule that agrees with all three fixtures by never
+   *  firing has passed nothing. */
+  passed: boolean;
+  cases: SelfTestCase[];
+  /** true when the rule denied at least one fixture — the vacuity check. A rule
+   *  that denies nothing is not a rule. */
+  denies_something: boolean;
+}
+
+/**
+ * Run the spec against its own fixtures. A spec that fails here is never
+ * emitted: the caller refuses it rather than hand a human a policy that does
+ * not do what its own description says.
+ */
+export function selfTestSpec(spec: PolicyRuleSpec): SelfTestReport {
+  const cases: SelfTestCase[] = [];
+  for (const fixture of buildFixtures(spec)) {
+    const verdict = evaluateSpec(spec, fixture.values);
+    cases.push({
+      kind: fixture.kind,
+      expected: fixture.expect_violation,
+      actual: verdict.violates,
+      passed: verdict.violates === fixture.expect_violation,
+      reason: verdict.reason,
+    });
+  }
+  const denies_something = cases.some((c) => c.actual);
+  return {
+    passed: cases.every((c) => c.passed) && denies_something,
+    cases,
+    denies_something,
+  };
+}
+
+// ── Rego emission ────────────────────────────────────────────────────────────
+
+/** A Rego identifier derived from the rule id. */
+function regoIdent(id: string): string {
+  return id.replace(/-/g, "_");
+}
+
+/** A Rego (JSON-compatible) literal. */
+function lit(v: unknown): string {
+  return JSON.stringify(v);
+}
+
+/**
+ * The shared helper every emitted policy imports by inclusion. Kept as ONE
+ * reviewed block rather than inlined per rule, because the array-flattening
+ * semantics are the part a reader must check — and they should only have to
+ * check it once.
+ *
+ * Rego forbids recursion, so per-rule path traversal is unrolled at generation
+ * time (see `pathComprehension`); `_members` is the non-recursive primitive that
+ * makes each step uniform.
+ */
+export const REGO_PRELUDE = `# Shared helpers for ${PRODUCT_NAME}-authored policies. Reviewed once, used by every rule.
+# _members normalises a node to a list so an array-valued block and a single
+# block traverse identically — the same rule ${PRODUCT_NAME}'s own evaluator applies.
+_members(x) := x if is_array(x)
+_members(x) := [x] if not is_array(x)
+
+# Only plan actions that produce or change configuration are judged. A delete
+# leaves no "after" to assert on, and a no-op has already been judged.
+_relevant(rc) if {
+	some action in rc.change.actions
+	action in {"create", "update"}
+}
+`;
+
+/** The unrolled comprehension resolving `path` against `root`, mirroring `resolvePath`. */
+function pathComprehension(path: string, root: string): string {
+  const segs = path.split(".");
+  const lines: string[] = [];
+  let cur = root;
+  for (let i = 0; i < segs.length; i++) {
+    const parent = `p${i}`;
+    lines.push(`\tsome ${parent} in _members(${cur})`);
+    lines.push(`\tis_object(${parent})`);
+    const child = `c${i}`;
+    lines.push(`\t${child} := ${parent}[${lit(segs[i])}]`);
+    cur = child;
+  }
+  // terminal flatten + null drop, matching resolvePath's tail
+  lines.push(`\tsome leaf in _members(${cur})`);
+  lines.push(`\tleaf != null`);
+  return `[leaf |\n${lines.join("\n")}\n]`;
+}
+
+/**
+ * The alternative bodies of the per-value predicate, each a list of Rego
+ * expressions ANDed together. Multiple bodies become multiple definitions of the
+ * same function, which Rego ORs.
+ *
+ * The TYPE GUARDS are not decoration. Rego's comparison operators order ACROSS
+ * types rather than erroring — `"5" >= 1` is true, because numbers sort before
+ * strings — so an unguarded `gte` would pass a string where the in-process
+ * evaluator (and any reasonable reading of the rule) fails it. Every operator
+ * whose meaning depends on the operand's type states that type explicitly, so
+ * the emitted Rego and `valueSatisfies` cannot disagree.
+ */
+function regoPredicateBodies(spec: PolicyRuleSpec, v: string): string[][] {
+  const val = spec.value;
+  switch (spec.operator) {
+    case "equals":
+      return [[`${v} == ${lit(val)}`]];
+    case "not_equals":
+      return [[`${v} != ${lit(val)}`]];
+    case "in":
+      return [[`${v} in ${lit(val)}`]];
+    case "not_in":
+      return [[`not ${v} in ${lit(val)}`]];
+    case "present":
+      return [[`${v} != null`]];
+    case "absent":
+      return [[`${v} == null`]];
+    case "is_true":
+      return [[`${v} == true`]];
+    case "is_false":
+      return [[`${v} == false`]];
+    case "matches":
+      return [[`is_string(${v})`, `regex.match(${lit(val)}, ${v})`]];
+    case "gte":
+      return [[`is_number(${v})`, `${v} >= ${lit(val)}`]];
+    case "lte":
+      return [[`is_number(${v})`, `${v} <= ${lit(val)}`]];
+    // `count` accepts strings, arrays and objects and errors on anything else;
+    // one body per accepted type keeps a number or a boolean from being "empty".
+    case "non_empty":
+      return [
+        [`is_string(${v})`, `count(${v}) > 0`],
+        [`is_array(${v})`, `count(${v}) > 0`],
+        [`is_object(${v})`, `count(${v}) > 0`],
+      ];
+  }
+}
+
+/**
+ * Emit conftest-ready Rego for one spec. Pure and byte-stable — the same spec
+ * always yields the same file, so a re-run produces no diff and a diff means the
+ * spec changed.
+ *
+ * Targets `terraform show -json` output (`input.resource_changes`), which is what
+ * `policy_check` already feeds conftest.
+ */
+export function emitRego(
+  spec: PolicyRuleSpec,
+  opts: { packageName?: string } = {},
+): string {
+  const pkg = opts.packageName ?? "main";
+  const ident = regoIdent(spec.id);
+  const ruleId = authoredRuleId(spec.id);
+  const header = [
+    `# ${spec.title}`,
+    `# rule: ${ruleId}   severity: ${spec.severity}   theme: ${spec.theme}`,
+    `# source requirement: ${spec.source_requirement.replace(/\s+/g, " ").trim()}`,
+    "#",
+    "# GENERATED BY INFRAWEAVER — review before committing. The generator self-tested",
+    "# this rule's SEMANTICS against violating/compliant/absent fixtures; it did not",
+    `# execute this Rego. Run \`conftest test\` (or ${PRODUCT_NAME}'s policy_check) to do that.`,
+  ].join("\n");
+
+  const okRule = regoPredicateBodies(spec, "v")
+    .map(
+      (body) =>
+        `_ok_${ident}(v) if {\n${body.map((line) => `\t${line}`).join("\n")}\n}`,
+    )
+    .join("\n\n");
+  const valsRule = `_vals_${ident}(root) := ${pathComprehension(spec.attribute, "root")}`;
+
+  const msg = `sprintf("[%s] %s: %s", [${lit(ruleId)}, rc.address, ${lit(spec.message)}])`;
+
+  const denyValue = [
+    "deny contains msg if {",
+    "\tsome rc in input.resource_changes",
+    `\trc.type == ${lit(spec.resource_type)}`,
+    "\t_relevant(rc)",
+    `\tvals := _vals_${ident}(rc.change.after)`,
+    "\tcount(vals) > 0",
+    "\tsome v in vals",
+    `\tnot _ok_${ident}(v)`,
+    `\tmsg := ${msg}`,
+    "}",
+  ].join("\n");
+
+  const denyAbsent =
+    spec.when_absent === "violation"
+      ? [
+          "",
+          "# when_absent = violation: nothing to assert on is itself the finding.",
+          "deny contains msg if {",
+          "\tsome rc in input.resource_changes",
+          `\trc.type == ${lit(spec.resource_type)}`,
+          "\t_relevant(rc)",
+          `\tcount(_vals_${ident}(rc.change.after)) == 0`,
+          `\tmsg := ${msg}`,
+          "}",
+        ].join("\n")
+      : "";
+
+  return `${header}\n\npackage ${pkg}\n\nimport rego.v1\n\n${REGO_PRELUDE}\n${valsRule}\n\n${okRule}\n\n${denyValue}\n${denyAbsent}\n`;
+}
+
+// ── tfpolicy (.policy.hcl) emission ──────────────────────────────────────────
+
+/**
+ * How faithful the `.policy.hcl` translation is to the spec.
+ *
+ * `exact` — a single-segment attribute path, where `attrs.<name>` means exactly
+ * what our resolver means.
+ * `approximate` — a nested path. tfpolicy's `attrs` traversal does not flatten
+ * arrays the way our resolver does, so a nested block that Terraform represents
+ * as a list needs `[0]` indexing and the translation asserts on the FIRST
+ * element rather than all of them. We emit it, we say so in the file, and the
+ * generated `.policytest.hcl` is how the customer confirms it before relying
+ * on it.
+ *
+ * This axis is about PATH SHAPE only. A second, unavoidable difference applies
+ * to every rule and is stated in the emitted header instead: HCL converts
+ * between types where it can, so a comparison there can succeed on an operand
+ * the Rego — which is explicitly type-guarded — rejects.
+ */
+export type PolicyHclFidelity = "exact" | "approximate";
+
+export function policyHclFidelity(spec: PolicyRuleSpec): PolicyHclFidelity {
+  return spec.attribute.includes(".") ? "approximate" : "exact";
+}
+
+/** An HCL literal for a scalar or list operand. */
+function hcl(v: unknown): string {
+  if (Array.isArray(v)) return `[${v.map(hcl).join(", ")}]`;
+  return JSON.stringify(v);
+}
+
+/** The tfpolicy accessor for the spec's path — `core::try` guarded, single line. */
+function hclAccessor(spec: PolicyRuleSpec): string {
+  return `core::try(attrs.${spec.attribute}, null)`;
+}
+
+/** The tfpolicy predicate over the accessor, as a single-line boolean expression. */
+function hclPredicate(spec: PolicyRuleSpec, acc: string): string {
+  const v = spec.value;
+  switch (spec.operator) {
+    case "equals":
+      return `${acc} == ${hcl(v)}`;
+    case "not_equals":
+      return `${acc} != ${hcl(v)}`;
+    case "in":
+      return `core::contains(${hcl(v)}, ${acc})`;
+    case "not_in":
+      return `!core::contains(${hcl(v)}, ${acc})`;
+    case "present":
+      return `${acc} != null`;
+    case "absent":
+      return `${acc} == null`;
+    case "is_true":
+      return `${acc} == true`;
+    case "is_false":
+      return `${acc} == false`;
+    case "matches":
+      return `core::try(core::regex(${hcl(v)}, ${acc}) != null, false)`;
+    case "gte":
+      return `${acc} >= ${hcl(v)}`;
+    case "lte":
+      return `${acc} <= ${hcl(v)}`;
+    case "non_empty":
+      return `core::length(core::try(${acc}, [])) > 0`;
+  }
+}
+
+/** Severity → tfpolicy enforcement level. Only a code-verified `critical`/`high`
+ *  earns `mandatory`; the rest advise, matching the band doctrine in
+ *  [[nativeRules]] — a generated rule does not get to hard-block on day one. */
+function enforcementLevel(severity: Severity): "mandatory" | "advisory" {
+  return severity === "critical" || severity === "high"
+    ? "mandatory"
+    : "advisory";
+}
+
+/**
+ * Emit a HashiCorp tfpolicy `.policy.hcl` for one spec.
+ *
+ * We AUTHOR this dialect; we do not enforce it. `tfpolicy` has no
+ * credential-free local plan evaluation and its binary is source-closed, so it
+ * cannot replace the OPA gate — the value is that an HCP customer gets a native
+ * artifact they can validate and run in their own pipeline.
+ */
+export function emitPolicyHcl(spec: PolicyRuleSpec): string {
+  const acc = hclAccessor(spec);
+  const predicate = hclPredicate(spec, acc);
+  // `when_absent` is expressed structurally rather than left to core::try's
+  // default, so the absent case reads the same way it does in the spec.
+  const condition =
+    spec.when_absent === "compliant"
+      ? `${acc} == null || (${predicate})`
+      : `${acc} != null && (${predicate})`;
+  const fidelity = policyHclFidelity(spec);
+  const caveat =
+    fidelity === "approximate"
+      ? [
+          "# FIDELITY: approximate. This rule's attribute path is nested, and tfpolicy's",
+          `# attrs traversal does not flatten list-shaped blocks the way ${PRODUCT_NAME}'s`,
+          "# resolver does — a block Terraform represents as a list may need [0] indexing,",
+          "# and this condition then asserts on the first element only. Run the generated",
+          "# .policytest.hcl with `tfpolicy test` before relying on it.",
+        ].join("\n")
+      : "# FIDELITY: exact. Single-segment attribute path — no traversal ambiguity.";
+
+  return `# ${spec.title}
+# rule: ${authoredRuleId(spec.id)}   severity: ${spec.severity}   theme: ${spec.theme}
+# source requirement: ${spec.source_requirement.replace(/\s+/g, " ").trim()}
+#
+# GENERATED BY INFRAWEAVER — review before committing. ${PRODUCT_NAME} authors this
+# dialect but does not execute it: validate with \`tfpolicy validate\` and run the
+# generated .policytest.hcl with \`tfpolicy test\`.
+#
+# TYPES: HCL converts between types where it can, so this condition may accept an
+# operand the companion Rego rejects — that one is explicitly type-guarded. Where
+# the two must agree exactly, the Rego is the reference.
+${caveat}
+
+resource_policy ${hcl(spec.resource_type)} ${hcl(regoIdent(spec.id))} {
+  enforcement_level = ${hcl(enforcementLevel(spec.severity))}
+
+  enforce {
+    condition     = ${condition}
+    error_message = ${hcl(spec.message)}
+  }
+}
+`;
+}
+
+/** Render a fixture's values as a tfpolicy `attrs = { … }` body. */
+function hclAttrs(values: Record<string, unknown>, indent: string): string {
+  const entries = Object.entries(values);
+  if (entries.length === 0) return "{}";
+  const inner = entries
+    .map(([k, v]) => {
+      const rendered =
+        v !== null && typeof v === "object" && !Array.isArray(v)
+          ? hclAttrs(v as Record<string, unknown>, `${indent}  `)
+          : hcl(v);
+      return `${indent}  ${k} = ${rendered}`;
+    })
+    .join("\n");
+  return `{\n${inner}\n${indent}}`;
+}
+
+/**
+ * Emit the `.policytest.hcl` companion — the same three fixtures the in-process
+ * self-test used, expressed as tfpolicy mocks. This is what turns "we authored
+ * it" into something the customer can verify in one command.
+ */
+export function emitPolicyTestHcl(spec: PolicyRuleSpec): string {
+  const blocks = buildFixtures(spec).map((f) => {
+    const expect = f.expect_violation ? "\n  expect_failure = true" : "";
+    return `resource ${hcl(spec.resource_type)} ${hcl(f.kind)} {${expect}\n  attrs = ${hclAttrs(f.values, "  ")}\n}`;
+  });
+  return `# Fixtures for ${authoredRuleId(spec.id)} — the same violating / compliant / absent
+# cases ${PRODUCT_NAME} self-tested the rule's semantics against. Run with:
+#   tfpolicy test --policies=. --tests=.
+
+policytest {
+  targets = [${hcl(policyFileName(spec))}]
+}
+
+${blocks.join("\n\n")}
+`;
+}
+
+// ── plan-JSON fixture (for conftest / policy_check) ──────────────────────────
+
+/**
+ * The generated fixtures as a `terraform show -json`-shaped document, so the
+ * emitted Rego can be executed against them by conftest without a real plan.
+ * One resource per fixture, named for its role.
+ */
+export function emitPlanFixture(spec: PolicyRuleSpec): string {
+  const resource_changes = buildFixtures(spec).map((f) => ({
+    address: `${spec.resource_type}.${f.kind}`,
+    mode: "managed",
+    type: spec.resource_type,
+    name: f.kind,
+    provider_name: `registry.terraform.io/hashicorp/${spec.resource_type.split("_")[0]}`,
+    change: { actions: ["create"], before: null, after: f.values },
+  }));
+  return `${JSON.stringify({ format_version: "1.2", resource_changes }, null, 2)}\n`;
+}
+
+// ── file naming ──────────────────────────────────────────────────────────────
+
+export function regoFileName(spec: PolicyRuleSpec): string {
+  return `${spec.id}.rego`;
+}
+export function policyFileName(spec: PolicyRuleSpec): string {
+  return `${spec.id}.policy.hcl`;
+}
+export function policyTestFileName(spec: PolicyRuleSpec): string {
+  return `${spec.id}.policytest.hcl`;
+}
+export function planFixtureFileName(spec: PolicyRuleSpec): string {
+  return `${spec.id}.fixture.plan.json`;
+}