infraweaver 0.3.10 → 0.3.12

package/src/mcp/terraform/azurePrices.ts

@@ -9,30 +9,30 @@ export const AZURE_PRICE_REGION = "westeurope";
 /** Currency of every price below. */
 export const AZURE_PRICE_CURRENCY = "EUR";
 /** ISO date the snapshot was captured — surfaced in cost.md so staleness is visible. */
-export const AZURE_PRICE_FETCHED_AT = "2026-09-03";
+export const AZURE_PRICE_FETCHED_AT = "2026-10-03";
 
 /** meter key → list price per HOUR. */
 export const AZURE_HOURLY_PRICES: Record<string, number> = {
-  "app-service-p0v3": 0.0764,
-  "app-service-p1v3": 0.1528,
-  "app-service-p2v3": 0.3057,
-  "app-service-p3v3": 0.6114,
-  "bastion-basic": 0.1631,
-  "bastion-premium": 0.3864,
-  "bastion-standard": 0.249,
-  "firewall-basic": 0.3392,
-  "firewall-premium": 1.5027,
-  "firewall-standard": 1.0733,
-  "redis-c0": 0.0236,
-  "redis-c1": 0.0592,
-  "redis-c2": 0.0962,
-  "redis-c3": 0.1932,
-  "redis-p1": 0.2378,
-  "redis-p2": 0.4766,
-  "redis-p3": 0.9523,
-  "vpn-gateway-vpngw1": 0.1631,
-  "vpn-gateway-vpngw2": 0.4207,
-  "vpn-gateway-vpngw3": 1.0733,
-  "vpn-gateway-vpngw4": 1.8032,
-  "vpn-gateway-vpngw5": 3.1341,
+  "app-service-p0v3": 0.0783,
+  "app-service-p1v3": 0.1566,
+  "app-service-p2v3": 0.3133,
+  "app-service-p3v3": 0.6265,
+  "bastion-basic": 0.1672,
+  "bastion-premium": 0.396,
+  "bastion-standard": 0.2552,
+  "firewall-basic": 0.3476,
+  "firewall-premium": 1.54,
+  "firewall-standard": 1.1,
+  "redis-c0": 0.0242,
+  "redis-c1": 0.0607,
+  "redis-c2": 0.0986,
+  "redis-c3": 0.198,
+  "redis-p1": 0.2438,
+  "redis-p2": 0.4884,
+  "redis-p3": 0.9759,
+  "vpn-gateway-vpngw1": 0.1672,
+  "vpn-gateway-vpngw2": 0.4312,
+  "vpn-gateway-vpngw3": 1.1,
+  "vpn-gateway-vpngw4": 1.8479,
+  "vpn-gateway-vpngw5": 3.2119,
 };

package/src/mcp/terraform/concernResult.ts

@@ -1,4 +1,5 @@
 import type { LocalToolContext } from "#app/mcp/localContext";
+import { remediationBranchSuffix } from "#app/mcp/staleFix";
 import {
   capSeededConcerns,
   type PrioritySignals,
@@ -24,6 +25,7 @@ import {
   type Severity,
   sortConcerns,
 } from "#app/mcp/terraform/types";
+import { recordConcernSites } from "#app/mcp/terraform/verifySites";
 
 export interface ConcernResult {
   /** non-suppressed concerns ≥ threshold, sorted */
@@ -65,6 +67,18 @@ export function annotateConcerns(
   );
 }
 
+/** The branch this run's PRs target, as `create_pull_request` resolves it: the
+ *  `base_branch` input, else the branch the run started on, else the default. */
+function remediationBaseOf(ctx: LocalToolContext): string | undefined {
+  const head = ctx.toolState.initialHead;
+  return (
+    ctx.payload.baseBranch?.trim() ||
+    (head?.kind === "branch" ? head.name : undefined) ||
+    ctx.repo?.data.default_branch?.trim() ||
+    undefined
+  );
+}
+
 /**
  * The shared concerns→result pipeline behind `terraform_scan` and `read_findings`:
  * capture the line-pinned + line-independent baseline (so verify's regression diff
@@ -115,6 +129,7 @@ export function buildConcernResult(
     fullBaseline.map((c) => concernKeyOf(c)),
   );
   recordConcernKeys(session, fullBaseline);
+  recordConcernSites(session, fullBaseline, opts.cwd);
   // the files already unformatted at this (pre-fix) scan. terraform_validate
   // subtracts these so PRE-EXISTING `terraform fmt` drift can't force a
   // whole-file reformat into a scoped fix. Captured from the raw set (fmt
@@ -141,10 +156,17 @@ export function buildConcernResult(
     active,
     opts.autonomyThreshold,
   );
-  const groups = opts.priority
-    ? prioritizeGroups(annotatedGroups, active, opts.priority)
-    : annotatedGroups;
-  const batchPlan = planBatches(groups);
+  const suffix = remediationBranchSuffix(
+    remediationBaseOf(ctx),
+    ctx.repo?.data.default_branch?.trim() || undefined,
+  );
+  const groups = (
+    opts.priority ? prioritizeGroups(annotatedGroups, active, opts.priority) : annotatedGroups
+  ).map((g) => ({ ...g, branch: `remediate/${g.id}${suffix}` }));
+  const planned = planBatches(groups);
+  const batchPlan = planned.batch_branch
+    ? { ...planned, batch_branch: `${planned.batch_branch}${suffix}` }
+    : planned;
 
   const bySeverity: Record<string, number> = {};
   for (const c of active) bySeverity[c.severity] = (bySeverity[c.severity] ?? 0) + 1;

package/src/mcp/terraform/hardcodedSecrets.ts

@@ -0,0 +1,202 @@
+/**
+ * A credential written into the configuration as a string literal, by the
+ * name of the argument that holds it.
+ *
+ * WHY BY NAME. The secret scanners look at the VALUE — a known key format, or a
+ * string with enough entropy — so a hand-made password (`"cg-flagshop-Pr0d!…"`)
+ * slips past all of them. Terraform says more than a text scanner can see: the
+ * value sits in an argument, a map key or a variable whose name says what it
+ * holds. A literal in `password`, `client_secret` or a Lambda environment
+ * variable called `auth` is in the repository whatever it looks like.
+ *
+ * WHAT IS READ. Every `name = "…"` line inside a `resource`, `data`,
+ * `provider`, `module` or `locals` block, at any depth, so
+ * `environment { variables = { auth = "…" } }` and `jsonencode({ … })` objects
+ * are reached; and the `default` of a `variable` whose name is a secret's. Not
+ * read: comments, heredoc bodies, a name/value pair split across two keys
+ * (`[{ name = "PASSWORD", value = "…" }]`), and a value that starts on a later
+ * line than its name.
+ *
+ * WHAT IS NOT A FINDING. A reference, a function call, an interpolation, an
+ * empty string, or a placeholder made only of `*` / `x` / `<…>`. Neither is an
+ * argument whose name only mentions a secret (`password_length`, `secret_name`,
+ * `token_validity_units`, `creation_token`): the last word of the name decides.
+ *
+ * Arguments the provider can take write-only (`aws_db_instance.password`) may
+ * also be reported by `secret-persisted-to-state`, which says something else:
+ * that the value reaches state. This one says it is in git.
+ */
+
+import { isStringLiteral, stripTrailingComment } from "#app/mcp/terraform/hcl";
+import { HARDCODED_SECRET_ARGUMENT, NATIVE_SOURCE } from "#app/mcp/terraform/nativeRules";
+import type { SourceFile } from "#app/mcp/terraform/tree";
+import { buildConcern, type Concern } from "#app/mcp/terraform/types";
+
+/** a name's last word, alone, says it holds a secret. */
+const SECRET_WORDS = new Set([
+  "password",
+  "passwd",
+  "pwd",
+  "passphrase",
+  "secret",
+  "token",
+  "auth",
+  "apikey",
+  "credential",
+  "credentials",
+]);
+/** `<word>_key` names that hold a secret (`api_key`, `secret_key`, …). */
+const SECRET_KEY_PREFIXES = new Set(["api", "secret", "private", "signing"]);
+/** `<word>_token` names that are identifiers, not credentials. */
+const NOT_SECRET_TOKENS = new Set(["creation", "idempotency", "client", "request", "continuation"]);
+
+function words(name: string): string[] {
+  return name
+    .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+    .toLowerCase()
+    .split(/[_-]+/)
+    .filter(Boolean);
+}
+
+/** True when an argument, map key or variable called `name` holds a secret. */
+export function isSecretName(name: string): boolean {
+  const w = words(name);
+  const last = w.at(-1);
+  const prev = w.at(-2);
+  if (last === undefined) return false;
+  if (last === "key") return prev !== undefined && SECRET_KEY_PREFIXES.has(prev);
+  if (last === "token" && prev !== undefined && NOT_SECRET_TOKENS.has(prev)) return false;
+  return SECRET_WORDS.has(last);
+}
+
+/** A literal that says it is not a real value: empty, masked, or `<…>`. */
+function isPlaceholder(inner: string): boolean {
+  return (
+    inner.trim() === "" ||
+    /^[*xX.]+$/.test(inner) ||
+    /^<[^>]*>$/.test(inner) ||
+    // the dummy credentials offline plans and LocalStack are given (`secret_key = "test"`)
+    /^(?:test|mock|fake|dummy|fixture|example|placeholder|sample)(?:[_-].*)?$/i.test(inner) ||
+    // a token's lifetime unit: `token_validity_units { access_token = "hours" }`
+    /^(?:seconds|minutes|hours|days)$/.test(inner)
+  );
+}
+
+export interface HardcodedSecret {
+  /** the argument, map key or variable name. */
+  name: string;
+  /** what holds it: `resource "aws_lambda_function" "x"`, `variable "db_password"`, … */
+  holder: string;
+  line: number;
+}
+
+/** a top-level block header: `resource "aws_db_instance" "db" {`, `locals {` */
+const HEADER = /^(resource|data|provider|module|locals|variable|output|terraform)\b([^{]*)\{\s*$/;
+/** `name = value`, the name bare or quoted */
+const ASSIGNMENT = /^\s*(?:"([A-Za-z_][\w-]*)"|([A-Za-z_][\w-]*))\s*=(?!=)\s*(.*)$/;
+const HEREDOC = /<<-?([A-Za-z_]\w*)\s*$/;
+/** a `key = "string"` pair inside a one-line object */
+const INLINE_PAIR = /(?:"([A-Za-z_][\w-]*)"|\b([A-Za-z_][\w-]*))\s*=(?!=)\s*("(?:[^"\\]|\\.)*")/g;
+
+function literalValue(raw: string): boolean {
+  const value = stripTrailingComment(raw).replace(/,$/, "").trim();
+  return isStringLiteral(value) && !isPlaceholder(value.slice(1, -1));
+}
+
+/**
+ * Every secret-named literal in one file. Pure.
+ *
+ * One pass over the lines rather than a block parse: every assignment line is
+ * the same question whatever block it sits in, and the native pack's block
+ * parser is shared by every scanner and budgeted (see nativeScan.perf.test).
+ */
+export function findHardcodedSecrets(hcl: string): HardcodedSecret[] {
+  const out: HardcodedSecret[] = [];
+  let holder: string | null = null;
+  let heredoc: string | null = null;
+  let inComment = false;
+  const lines = hcl.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = (lines[i] as string).replace(/\r$/, "");
+    if (heredoc !== null) {
+      if (line.trim() === heredoc) heredoc = null;
+      continue;
+    }
+    if (inComment) {
+      if (line.includes("*/")) inComment = false;
+      continue;
+    }
+    const trimmed = line.trimStart();
+    if (trimmed.startsWith("/*")) {
+      inComment = !trimmed.includes("*/");
+      continue;
+    }
+    if (trimmed.startsWith("#") || trimmed.startsWith("//")) continue;
+    const header = HEADER.exec(line);
+    if (header) {
+      holder = `${header[1]}${(header[2] as string).trimEnd() ? ` ${(header[2] as string).trim()}` : ""}`;
+      continue;
+    }
+    if (line.startsWith("}")) {
+      holder = null;
+      continue;
+    }
+    const opens = HEREDOC.exec(line);
+    if (opens) heredoc = opens[1] as string;
+    if (holder === null || opens) continue;
+    const m = ASSIGNMENT.exec(line);
+    if (!m) continue;
+    const name = (m[1] ?? m[2]) as string;
+    const value = m[3] as string;
+    if (holder.startsWith("variable ")) {
+      // a variable's literal is its default, and the variable's name says what it holds
+      const variable = /^variable\s+"?([\w-]+)"?/.exec(holder)?.[1] ?? "";
+      if (name === "default" && isSecretName(variable) && literalValue(value)) {
+        out.push({ name: variable, holder, line: i + 1 });
+      }
+      continue;
+    }
+    if (holder.startsWith("output ") || holder.startsWith("terraform")) continue;
+    if (isSecretName(name) && literalValue(value)) {
+      out.push({ name, holder, line: i + 1 });
+      continue;
+    }
+    // an object written on one line holds its own pairs: `{ "DB_PASSWORD" = "…" }`
+    for (const pair of value.matchAll(INLINE_PAIR)) {
+      const key = (pair[1] ?? pair[2]) as string;
+      if (isSecretName(key) && literalValue(pair[3] as string)) {
+        out.push({ name: key, holder, line: i + 1 });
+      }
+    }
+  }
+  return out;
+}
+
+/** Scan an already-read tree into native concerns. Pure; no I/O of its own. */
+export function scanHardcodedSecrets(files: readonly SourceFile[]): Concern[] {
+  const concerns: Concern[] = [];
+  for (const { path, hcl } of files) {
+    for (const hit of findHardcodedSecrets(hcl)) {
+      concerns.push(
+        buildConcern({
+          source: NATIVE_SOURCE,
+          rule: HARDCODED_SECRET_ARGUMENT,
+          file: path,
+          line: hit.line,
+          // a credential in the repository is readable by everyone who can read
+          // it, and stays in the history after it is edited out
+          severity: "high",
+          category: "security",
+          evidence:
+            `\`${hit.name}\` in \`${hit.holder}\` is a string literal, so the credential it holds is ` +
+            "committed to the repository (value not quoted here)",
+          remediation_hint:
+            "Rotate the credential first — it stays in the branch history after the line is changed. " +
+            "Then pass it in at run time: a `sensitive` variable with no default, or a read from a " +
+            "secret store (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager).",
+        }),
+      );
+    }
+  }
+  return concerns;
+}

package/src/mcp/terraform/nativeRuleScanners.ts

@@ -26,6 +26,7 @@
 
 import { scanDialect } from "#app/mcp/terraform/dialect";
 import { scanGovernanceFile } from "#app/mcp/terraform/governance";
+import { scanHardcodedSecrets } from "#app/mcp/terraform/hardcodedSecrets";
 import { scanInterfaceHygiene } from "#app/mcp/terraform/moduleInterfaceRules";
 import { scanUnpinnedModules } from "#app/mcp/terraform/moduleVersionConstraints";
 import {
@@ -34,6 +35,7 @@ import {
   DEPRECATED_S3_BUCKET_ARGUMENT,
   DEPRECATED_STATE_LOCKING,
   DYNAMIC_DESTROY_PROTECTION,
+  HARDCODED_SECRET_ARGUMENT,
   IMPERATIVE_ACTION_TRIGGER,
   LEGACY_BLOCK_ASSIGNMENT,
   LEGACY_INTERPOLATION,
@@ -125,6 +127,12 @@ export const NATIVE_RULE_SCANNERS: readonly NativeRuleScanner[] = [
     // one. See [[stateFiles]].
     scan: (ctx) => scanCommittedStateFiles(ctx.cwd),
   },
+  {
+    name: "hardcoded-secrets",
+    rules: [HARDCODED_SECRET_ARGUMENT],
+    // Per file: the argument's name and its literal are both on the line itself.
+    scan: (ctx) => ({ concerns: scanHardcodedSecrets(ctx.files) }),
+  },
   {
     name: "write-only",
     rules: [SECRET_PERSISTED_TO_STATE],

package/src/mcp/terraform/nativeRules.ts

@@ -59,6 +59,7 @@ export interface NativeRule {
 
 export const SECRET_PERSISTED_TO_STATE = "secret-persisted-to-state";
 export const COMMITTED_STATE_FILE = "committed-state-file";
+export const HARDCODED_SECRET_ARGUMENT = "hardcoded-secret-argument";
 export const IMPERATIVE_ACTION_TRIGGER = "imperative-action-trigger";
 export const DYNAMIC_DESTROY_PROTECTION = "dynamic-destroy-protection";
 export const DEPRECATED_STATE_LOCKING = "deprecated-state-locking";
@@ -103,6 +104,19 @@ export const NATIVE_RULES: readonly NativeRule[] = [
       "that the state contains a live credential, or that anyone has read it — the file is never opened; " +
       "the finding is that state is under version control, and what it recorded is for the owner to say",
   },
+  {
+    id: HARDCODED_SECRET_ARGUMENT,
+    title: "Credential written into the configuration as a literal",
+    band: "verified",
+    category: "security",
+    asserts:
+      "an argument, map key or variable whose name says it holds a credential (`password`, `token`, " +
+      "`client_secret`, `api_key`, …) is assigned a string literal, so the value is in the repository " +
+      "and in its history",
+    doesNotAssert:
+      "that the value is a live credential — it may be a test value; the finding is that a credential " +
+      "slot is filled from the code rather than at run time",
+  },
   {
     id: IMPERATIVE_ACTION_TRIGGER,
     title: "Imperative side-effect invoked from declarative IaC (action / action_trigger)",

package/src/mcp/terraform/refactorScope.ts

@@ -0,0 +1,86 @@
+/**
+ * What a Refactor run may propose, beyond what the detectors find.
+ *
+ * EXAMPLES ARE NOT REFACTORED BY DEFAULT. An `examples/` root is documentation
+ * that happens to plan: its resources exist to show a caller how to use the
+ * module, so they repeat on purpose, and a PR that consolidates or extracts them
+ * rewrites the docs to save nobody anything. The `refactor_examples` input opts
+ * back in.
+ *
+ * A REUSABLE MODULE IS REPORTED, NOT RESTRUCTURED. A repository whose root
+ * configures no provider and no backend, and ships `examples/`, is a module other
+ * people call (terraform-aws-vpc, say). Moving its resources into a submodule is
+ * provably equivalent, and still churn for every consumer: their plans gain a
+ * wall of `moved` addresses for no change in what they get. There, extraction
+ * and normalisation candidates come back marked `report_only` — named in the
+ * run's summary, never opened as a PR. Consolidating roots that duplicate each
+ * other is unaffected: that removes real duplication, not style.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+
+/** true for a path inside an `examples/` (or `example/`) directory, at any depth. */
+export function isExamplePath(path: string): boolean {
+  return /(?:^|\/)examples?\//.test(path.replace(/\\/g, "/"));
+}
+
+const PROVIDER_OR_BACKEND = /^\s*(?:provider\s+"|backend\s+")/m;
+
+/** whether some directory under `dir` (to a small depth) holds a `.tf` file. */
+function holdsTerraform(dir: string, depth: number): boolean {
+  let entries: string[];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return false;
+  }
+  for (const name of entries) {
+    const path = join(dir, name);
+    if (name.endsWith(".tf")) return true;
+    if (
+      depth > 0 &&
+      !name.startsWith(".") &&
+      statSync(path, { throwIfNoEntry: false })?.isDirectory()
+    ) {
+      if (holdsTerraform(path, depth - 1)) return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Why the repository at `cwd` reads as a reusable module rather than a
+ * deployment, or null when it does not.
+ */
+export function libraryRepoReason(cwd: string): string | null {
+  let rootFiles: string[];
+  try {
+    rootFiles = readdirSync(cwd).filter((f) => f.endsWith(".tf"));
+  } catch {
+    return null;
+  }
+  if (rootFiles.length === 0) return null;
+  for (const f of rootFiles) {
+    let text: string;
+    try {
+      text = readFileSync(join(cwd, f), "utf8");
+    } catch {
+      continue;
+    }
+    if (PROVIDER_OR_BACKEND.test(text)) return null;
+  }
+  const examples = ["examples", "example"].find((d) => existsSync(join(cwd, d)));
+  if (examples === undefined || !holdsTerraform(join(cwd, examples), 2)) return null;
+  return (
+    `the repository root configures no provider and no backend, and ships \`${examples}/\`: it is a ` +
+    "module other configurations call, so restructuring it is churn for every caller"
+  );
+}
+
+/** what a detector tool adds to its result when the repository is a library. */
+export function reportOnly(reason: string | null): {
+  report_only?: true;
+  report_only_reason?: string;
+} {
+  return reason === null ? {} : { report_only: true, report_only_reason: reason };
+}

package/src/mcp/terraform/scanSession.ts

@@ -77,6 +77,12 @@ export interface ScanSession {
   // agent took from the FIRST scan (`concernKeyOf`), or it falls back to
   // matching ids exactly and calls every line-shifted finding resolved.
   concernsById?: Map<string, Concern>;
+  // the resource each reported concern sat in when it was reported (by id), and
+  // per (scanner, rule, file) key the resources the rule fired on the first time
+  // the run saw that key. terraform_verify_remediation reads both to count a fix
+  // on one resource while the rule still fires on another (see verifySites).
+  siteById?: Map<string, string | null>;
+  firstSitesByKey?: Map<string, Set<string | null>>;
   // the findings gate's concern set: scanned by the engine itself before the
   // agent starts, on the tree the run was invoked on, at the CONFIGURED
   // threshold and scope. read at end-of-run by finalizeSuccessRun for the

package/src/mcp/terraform/standardsReport.ts

@@ -364,6 +364,8 @@ const SUBJECT: Record<string, RegExp> = {
   // rule's silence a real statement. Whether git could answer is handled one
   // level up by the blind set: a run that could not ask is never conforming.
   "committed-state-file": ANY_BLOCK,
+  // any block may hold a credential argument, a map of them, or a variable default
+  "hardcoded-secret-argument": ANY_BLOCK,
   "deprecated-s3-bucket-argument": /(?:^|\n)\s*resource\s+"?aws_s3_bucket(?:"|\s)/,
   "superseded-resource-type":
     /(?:^|\n)\s*(?:resource\s+"?(?:aws_launch_configuration|aws_elb)(?:"|\s)|data\s+"?template_file(?:"|\s))/,

package/src/mcp/terraform/tools/consolidationCandidates.ts

@@ -3,6 +3,7 @@ import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
 import { findConsolidationGroups } from "#app/mcp/terraform/consolidation";
 import { readWorkingTree } from "#app/mcp/terraform/refactor/workspace";
+import { isExamplePath } from "#app/mcp/terraform/refactorScope";
 import { log } from "#app/utils/cli";
 
 const ConsolidationCandidatesParams = type({});
@@ -37,7 +38,10 @@ export function ConsolidationCandidatesTool(ctx: LocalToolContext) {
     parameters: ConsolidationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const result = findConsolidationGroups(readWorkingTree(cwd));
+      const tree = readWorkingTree(cwd);
+      const result = findConsolidationGroups(
+        ctx.payload.refactorExamples ? tree : tree.filter((f) => !isExamplePath(f.path)),
+      );
       log.info(
         `» terraform_consolidation_candidates: ${result.groups.length} group(s), ` +
           `${result.near_groups.length} near-group(s), ${result.declined_groups.length} declined`,

package/src/mcp/terraform/tools/normalizationCandidates.ts

@@ -2,6 +2,7 @@ import { type } from "arktype";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
 import { findNormalizationCandidates } from "#app/mcp/terraform/normalization";
+import { isExamplePath, libraryRepoReason, reportOnly } from "#app/mcp/terraform/refactorScope";
 import { log } from "#app/utils/cli";
 
 // --- the tool ----------------------------------------------------------------
@@ -28,12 +29,15 @@ export function NormalizationCandidatesTool(ctx: LocalToolContext) {
     parameters: NormalizationCandidatesParams,
     execute: execute(async () => {
       const cwd = ctx.payload.cwd ?? process.cwd();
-      const files = findNormalizationCandidates(cwd);
+      const files = findNormalizationCandidates(cwd).filter(
+        (f) => ctx.payload.refactorExamples || !isExamplePath(f.file),
+      );
       const total = files.reduce((n, f) => n + f.count, 0);
       log.info(
         `» terraform_normalization_candidates: ${total} site(s) across ${files.length} file(s)`,
       );
       return toolOk({
+        ...reportOnly(libraryRepoReason(cwd)),
         file_count: files.length,
         total,
         files,

package/src/mcp/terraform/tools/verifyRemediation.ts

@@ -3,6 +3,7 @@ import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
 import { computeConfidence } from "#app/mcp/terraform/decisions";
 import { captureProvenFix } from "#app/mcp/terraform/fixMemory";
+import { declaredAddresses } from "#app/mcp/terraform/scanDelta";
 import {
   computeRegressions,
   computeRemediationVerdict,
@@ -12,6 +13,7 @@ import {
 } from "#app/mcp/terraform/scanners";
 import { hasBaseline, scanSessionOf } from "#app/mcp/terraform/scanSession";
 import { concernKeyOf, dedupe } from "#app/mcp/terraform/types";
+import { fileReader, resolvedAtSite, siteOf } from "#app/mcp/terraform/verifySites";
 import { log } from "#app/utils/cli";
 import { resolveToolSelection } from "#app/utils/prompt/toolSelection";
 import { resolveModuleCredentialEnv } from "#app/utils/setup/registryAuth";
@@ -82,7 +84,27 @@ export async function runVerifyRemediation(
     if (key !== undefined) keyed.push({ id, key });
     else unkeyed.push(id);
   }
-  const keyedVerdict = partitionByKey(keyed, currentKeys);
+  const byKey = partitionByKey(keyed, currentKeys);
+  // a rule still firing in the file may have been fixed on THIS finding's
+  // resource; count it only under the conditions verifySites spells out
+  const read = fileReader(cwd);
+  const remainingKeyed = keyed.filter((k) => byKey.remaining.includes(k.id));
+  const atSite = new Set(
+    resolvedAtSite({
+      requested: remainingKeyed.map((k) => ({
+        ...k,
+        site: session.siteById?.get(k.id) ?? null,
+        file: reported.get(k.id)?.location.file,
+      })),
+      current: currentConcerns.map((c) => ({ key: concernKeyOf(c), site: siteOf(c, read) })),
+      firstSites: session.firstSitesByKey ?? new Map(),
+      declared: (file) => new Set(declaredAddresses(read(file) ?? "")),
+    }),
+  );
+  const keyedVerdict = {
+    resolved: [...byKey.resolved, ...byKey.remaining.filter((id) => atSite.has(id))],
+    remaining: byKey.remaining.filter((id) => !atSite.has(id)),
+  };
   const fallbackVerdict = computeRemediationVerdict(unkeyed, new Set(currentIds));
   const resolved = [...keyedVerdict.resolved, ...fallbackVerdict.resolved];
   const remaining = [...keyedVerdict.remaining, ...fallbackVerdict.remaining];

package/src/mcp/terraform/types.ts

@@ -398,6 +398,9 @@ export interface ConcernGroup {
   /** stable id — the remediation branch/PR key (`remediate/<id>`). Derived from
    * the file (by-file grouping) or the rule (by-rule grouping). */
   id: string;
+  /** the branch its fix is pushed to: `remediate/<id>`, plus `--<base>` when the
+   * PR targets a branch other than the repository default. */
+  branch?: string;
   /** the group's primary file (by-file) or a human label like "3 files"
    * (by-rule); `files` carries the full list for by-rule groups. */
   file: string;