infraweaver 0.3.7 → 0.3.8

package/src/mcp/terraform/secretScan.ts

@@ -0,0 +1,131 @@
+/**
+ * The secrets a pull request adds, found by betterleaks — opt-in, by naming
+ * `betterleaks` in `tools_enabled`.
+ *
+ * WHAT IS SCANNED. Only the lines the PR's commits add (`git` mode over
+ * `<merge base>..HEAD`), so every hit is introduced by the PR by construction.
+ * A secret added and then deleted in a later commit is still reported: it
+ * stays in the branch history, readable by anyone who can read the repository.
+ *
+ * NOTHING LEAVES THE RUNNER. betterleaks v2 can check a found credential
+ * against its provider; that sends the secret over the network, so it is
+ * switched off explicitly (flags and environment both), and the report is
+ * written redacted, so the secret is never in a file, a log or a comment.
+ *
+ * v2 ONLY. v2 changed the command line and the report format. A v1 binary is
+ * reported as not run rather than parsed wrongly.
+ */
+import { readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { run, runAsync } from "#app/mcp/terraform/subprocess";
+import { buildConcern, type Concern } from "#app/mcp/terraform/types";
+
+export interface SecretScan {
+  ran: boolean;
+  /** why it did not run */
+  reason?: string;
+  concerns: Concern[];
+}
+
+interface BetterleaksFinding {
+  rule_id?: string;
+  description?: string;
+  confidence?: string;
+  location?: { path?: string; start_line?: number };
+  attributes?: Record<string, string>;
+}
+
+/**
+ * Parse a betterleaks v2 JSON report into concerns, paths made relative to the
+ * scan directory (`prefix` is its path in the repository), and whether the
+ * scan completed: an incomplete one keeps the findings it made before it
+ * stopped. Throws on a report that is not v2's.
+ */
+export function parseBetterleaksReport(
+  json: string,
+  prefix = "",
+): { concerns: Concern[]; complete: boolean } {
+  const doc = JSON.parse(json) as unknown;
+  if (Array.isArray(doc) || !doc || typeof doc !== "object" || !("findings" in doc)) {
+    throw new Error("not a betterleaks v2 report — betterleaks v2 is required");
+  }
+  const { findings = [], scan } = doc as {
+    findings?: BetterleaksFinding[];
+    scan?: { state?: string };
+  };
+  const concerns: Concern[] = [];
+  for (const f of findings) {
+    const path = (f.location?.path ?? "").replace(/\\/g, "/").replace(/^\.\//, "");
+    if (!path.startsWith(prefix)) continue;
+    const rule = f.rule_id ?? "secret";
+    const commit = f.attributes?.["git.sha"]?.slice(0, 7);
+    concerns.push(
+      buildConcern({
+        source: "betterleaks",
+        rule,
+        file: path.slice(prefix.length),
+        line: f.location?.start_line ?? null,
+        // a secret in the repository is exposed to everyone who can read it; a
+        // match betterleaks itself rates low-confidence is reported, not gated
+        severity: f.confidence === "low" ? "medium" : "critical",
+        category: "security",
+        evidence:
+          `${f.description ?? rule}: a secret is added` +
+          `${commit ? ` in commit ${commit}` : ""} (value redacted)`,
+        remediation_hint:
+          "Remove the secret from the change and from the branch history, and rotate it — " +
+          "it is readable by everyone who can read the repository. Read it at run time from a " +
+          "secret store or a sensitive variable instead.",
+      }),
+    );
+  }
+  return { concerns, complete: scan?.state === "complete" };
+}
+
+/** Scan the lines the commits after `mergeBase` add, from the scan directory `cwd`. */
+export async function scanAddedSecrets(
+  cwd: string,
+  mergeBase: string,
+  tmp: string,
+): Promise<SecretScan> {
+  const top = run("git", ["rev-parse", "--show-toplevel"], cwd).stdout.trim();
+  const prefix = run("git", ["rev-parse", "--show-prefix"], cwd).stdout.trim();
+  if (!top) return { ran: false, reason: "not a git checkout", concerns: [] };
+  const report = join(tmp, `betterleaks-${process.pid}.json`);
+  try {
+    const r = await runAsync(
+      "betterleaks",
+      [
+        "git",
+        top,
+        `--log-opts=${mergeBase}..HEAD`,
+        "--validate=false",
+        "--analyze=false",
+        "--redact",
+        "--silent",
+        "--exit-code=0",
+        "-o",
+        report,
+      ],
+      top,
+      { BETTERLEAKS_VALIDATE: "false", BETTERLEAKS_ANALYZE: "false" },
+    );
+    if (r.missing) return { ran: false, reason: "betterleaks not installed", concerns: [] };
+    // an incomplete scan exits 1 even with --exit-code=0, and still writes the
+    // findings it made: keep those, and say the scan did not finish
+    const why = (r.stderr || r.stdout).trim().split("\n").pop() ?? "";
+    let parsed: ReturnType<typeof parseBetterleaksReport>;
+    try {
+      parsed = parseBetterleaksReport(readFileSync(report, "utf-8"), prefix);
+    } catch (error) {
+      const reason = r.status !== 0 ? `betterleaks exited ${r.status}: ${why}` : `${error}`;
+      return { ran: false, reason, concerns: [] };
+    }
+    if (!parsed.complete || r.status !== 0) {
+      return { ran: false, reason: `the scan did not complete: ${why}`, concerns: parsed.concerns };
+    }
+    return { ran: true, concerns: parsed.concerns };
+  } finally {
+    rmSync(report, { force: true });
+  }
+}

package/src/mcp/terraform/standardsReport.ts

@@ -66,6 +66,7 @@ import {
 import type { Concern, ScannerOutcome } from "#app/mcp/terraform/types";
 import { spansMajors } from "#app/mcp/terraform/versionGuard";
 import { pushInto } from "#app/utils/collect";
+import { tableCell } from "#app/utils/markdownTable";
 
 /**
  * How consistently the repository follows one convention.
@@ -351,8 +352,8 @@ export function conformingRules(
 const ANY_BLOCK = /(?:^|\n)\s*(?:resource|module|data|variable|output|locals|provider)\s*[">{]/;
 
 const SUBJECT: Record<string, RegExp> = {
-  "secret-persisted-to-state": /(?:^|\n)\s*resource\s+"/,
-  "imperative-action-trigger": /(?:^|\n)\s*resource\s+"/,
+  "secret-persisted-to-state": /(?:^|\n)\s*resource\s+(?:"|[A-Za-z_])/,
+  "imperative-action-trigger": /(?:^|\n)\s*resource\s+(?:"|[A-Za-z_])/,
   "dynamic-destroy-protection": /(?:^|\n)\s*lifecycle\s*\{/,
   "deprecated-state-locking": /(?:^|\n)\s*backend\s+"s3"/,
   "cross-dialect-syntax": ANY_BLOCK,
@@ -363,22 +364,22 @@ const SUBJECT: Record<string, RegExp> = {
   // rule's silence a real statement. Whether git could answer is handled one
   // level up by the blind set: a run that could not ask is never conforming.
   "committed-state-file": ANY_BLOCK,
-  "deprecated-s3-bucket-argument": /(?:^|\n)\s*resource\s+"aws_s3_bucket"/,
+  "deprecated-s3-bucket-argument": /(?:^|\n)\s*resource\s+"?aws_s3_bucket(?:"|\s)/,
   "superseded-resource-type":
-    /(?:^|\n)\s*(?:resource\s+"(?:aws_launch_configuration|aws_elb)"|data\s+"template_file")/,
+    /(?:^|\n)\s*(?:resource\s+"?(?:aws_launch_configuration|aws_elb)(?:"|\s)|data\s+"?template_file(?:"|\s))/,
   "missing-required-version": /(?:^|\n)\s*(?:resource|module|provider)\s+"/,
   "missing-required-providers": /(?:^|\n)\s*(?:resource|module|provider)\s+"/,
   "unpinned-provider-version": /required_providers/,
   "unpinned-required-version": /required_version/,
   // a tree with no `module` call has no module constraint to pin, so the rule
   // is not applicable rather than passing.
-  "unpinned-module-version": /(?:^|\n)\s*module\s+"/,
+  "unpinned-module-version": /(?:^|\n)\s*module\s+(?:"|[A-Za-z_])/,
   // both read every string in the tree, so any block is subject enough.
   "legacy-interpolation": ANY_BLOCK,
   "legacy-block-assignment": ANY_BLOCK,
-  "untyped-variable": /(?:^|\n)\s*variable\s+"/,
-  "undocumented-variable": /(?:^|\n)\s*variable\s+"/,
-  "undocumented-output": /(?:^|\n)\s*output\s+"/,
+  "untyped-variable": /(?:^|\n)\s*variable\s+(?:"|[A-Za-z_])/,
+  "undocumented-variable": /(?:^|\n)\s*variable\s+(?:"|[A-Za-z_])/,
+  "undocumented-output": /(?:^|\n)\s*output\s+(?:"|[A-Za-z_])/,
   "repeated-literal": ANY_BLOCK,
 };
 
@@ -568,7 +569,7 @@ export function buildStandardsReport(
  * offered — `buildStandardsReport` is the pure seam for a caller that already
  * holds both.
  */
-export function standardsReport(cwd: string): StandardsReport {
+export async function standardsReport(cwd: string): Promise<StandardsReport> {
   const tree = readTfTree(cwd);
   // The scan re-derives its findings from the SAME tree this report counts its
   // conventions off, so it is handed the one already in memory. Reading it
@@ -590,7 +591,7 @@ export function standardsReport(cwd: string): StandardsReport {
     // the only convention here the CLI adjudicates rather than the native pack.
     // It degrades to `ran: false` (→ `inconclusive`) with no terraform or tofu
     // installed, which is the ordinary case on a plain CI runner.
-    formatting: scanFmt(cwd),
+    formatting: await scanFmt(cwd),
     // The tree the conventions were counted off is the same one the scan saw,
     // so if it was cut short BOTH halves of this report describe a fraction of
     // the estate. Saying so is the whole point of the file's discipline.
@@ -641,7 +642,7 @@ export function renderStandardsReportMarkdown(report: StandardsReport): string {
   lines.push("### Conventions detected", "");
   lines.push("| Convention | State | Observed |", "| --- | --- | --- |");
   for (const c of report.conventions) {
-    lines.push(`| ${c.title} | ${VERDICT_MARK[c.verdict]} | ${c.evidence} |`);
+    lines.push(`| ${c.title} | ${VERDICT_MARK[c.verdict]} | ${tableCell(c.evidence)} |`);
   }
   lines.push("");
   lines.push(
@@ -655,7 +656,7 @@ export function renderStandardsReportMarkdown(report: StandardsReport): string {
     lines.push("| Rule | Count | First | Claim |", "| --- | --- | --- | --- |");
     for (const v of report.violations) {
       lines.push(
-        `| \`${v.rule}\` | ${v.count} | ${v.first.file}${v.first.line ? `:${v.first.line}` : ""} | ${BAND_NOTE[v.band]} |`,
+        `| \`${v.rule}\` | ${v.count} | ${tableCell(`${v.first.file}${v.first.line ? `:${v.first.line}` : ""}`)} | ${BAND_NOTE[v.band]} |`,
       );
     }
     lines.push("");
@@ -666,7 +667,7 @@ export function renderStandardsReportMarkdown(report: StandardsReport): string {
     lines.push("| Rule | Count | First |", "| --- | --- | --- |");
     for (const d of report.convention_departures) {
       lines.push(
-        `| \`${d.rule}\` | ${d.count} | ${d.first.file}${d.first.line ? `:${d.first.line}` : ""} |`,
+        `| \`${d.rule}\` | ${d.count} | ${tableCell(`${d.first.file}${d.first.line ? `:${d.first.line}` : ""}`)} |`,
       );
     }
     lines.push("");

package/src/mcp/terraform/tools/consolidationCandidates.ts

@@ -18,6 +18,9 @@ export function ConsolidationCandidatesTool(ctx: LocalToolContext) {
       "member dirs, the shared resource set, `module_body_values` (attributes IDENTICAL in every " +
       "member — these go in the module verbatim), `variables` (attributes that DIFFER, each with " +
       "`per_member` values), and `expected_moves_by_member` (the `moved {}` blocks each root needs). " +
+      "A root's call of a LOCAL module can be part of the shape: it is listed in `resources` as " +
+      "`module.<name>`, moves into the new module keeping its name (one `moved {}` block for the " +
+      "call), and writes the `source` given in `wrapped_calls` — relative to the new module. " +
       "ONE module, N call sites — never merge the roots themselves: two roots are two state files. " +
       "COPY EACH `per_member.value` INTO THAT MEMBER'S CALL VERBATIM — swapping two environments' " +
       "values produces a tree that still proves `equivalent: true` and destroys the wrong " +

package/src/mcp/terraform/tools/emitEvidence.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { errorMessage } from "@infraweaver-io/core/errors";
 import { resolveWithinCwd } from "@infraweaver-io/sandbox/pathSafety";
@@ -7,12 +7,14 @@ import { PRODUCT_NAME } from "#app/brand";
 import { runAssessmentPipeline } from "#app/mcp/assess";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { writeEmittedArtefact } from "#app/mcp/terraform/emittedArtefacts";
 import {
   buildCostStatement,
   buildEgressStatement,
   buildEvidenceBundle,
   buildRefactorStatement,
   DEFAULT_EVIDENCE_PATH,
+  proposedChangeOf,
 } from "#app/mcp/terraform/evidence";
 import {
   buildInTotoStatement,
@@ -36,7 +38,7 @@ const TerraformEmitEvidenceParams = type({
     "minimum severity to include (default: the run's configured threshold, else low).",
   ),
   "proposed_unproven?": type("boolean").describe(
-    "refactor b.4 only: set true when emitting evidence for a third-party-module adoption shipped WITHOUT a plan, so the bundle records the unmissable `proposed — unproven` marker (it asserts nothing about runtime behaviour). Ignored when a keys-free equivalence proof was already recorded this run.",
+    "set true when emitting evidence for a behaviour-altering change shipped WITHOUT a plan (a refactor b.4 third-party-module adoption, a module or provider-major bump, a deprecated-pattern migration), so the bundle records the unmissable `proposed — unproven` marker (it asserts nothing about runtime behaviour). Ignored when a keys-free equivalence proof was already recorded this run.",
   ),
   "reviewed_plan?": type("boolean").describe(
     "refactor b.4 with credentials only: set true when the adoption ships with a REVIEWED PLAN DELTA — terraform_plan must have run this session (refused otherwise), and the bundle records that the claim rests on a human reviewing that plan. This is the marker the push gate accepts in place of an equivalence proof for a behaviour-altering adoption.",
@@ -83,6 +85,7 @@ export function TerraformEmitEvidenceTool(ctx: LocalToolContext) {
           proposedUnproven: proposed_unproven ?? false,
           planTotals: session.lastPlanTotals,
           reviewedPlan: reviewed_plan ?? false,
+          change: proposedChangeOf(ctx.toolState.selectedMode),
         });
         // surface the proposed-unproven verdict to the Cloud report (cloudReport.ts):
         // an equivalence proof, when present, takes precedence, so only record the
@@ -147,10 +150,11 @@ export function TerraformEmitEvidenceTool(ctx: LocalToolContext) {
         const bytes = `${JSON.stringify(bundle, null, 2)}\n`;
         // the default compliance/ dir may not exist yet on a first run.
         mkdirSync(dirname(target), { recursive: true });
-        writeFileSync(target, bytes);
+        writeEmittedArtefact(ctx.toolState, target, bytes);
         // detached signature over the EXACT bytes written (builder is deterministic,
         // so no canonicaliser) — verify with `infraweaver verify-evidence`.
-        if (signingKey) writeFileSync(sigPath, `${signBytes(bytes, signingKey)}\n`);
+        if (signingKey)
+          writeEmittedArtefact(ctx.toolState, sigPath, `${signBytes(bytes, signingKey)}\n`);
 
         // Second tier: keyless Sigstore attestation (opt-in via INFRAWEAVER_KEYLESS_SIGNING,
         // CI-only). Best-effort — a Fulcio/Rekor failure logs and leaves the evidence
@@ -174,7 +178,11 @@ export function TerraformEmitEvidenceTool(ctx: LocalToolContext) {
             });
             const sigstoreBundle = await keylessSignStatement(statement);
             keylessBundleFile = keylessBundlePath(target);
-            writeFileSync(keylessBundleFile, `${JSON.stringify(sigstoreBundle, null, 2)}\n`);
+            writeEmittedArtefact(
+              ctx.toolState,
+              keylessBundleFile,
+              `${JSON.stringify(sigstoreBundle, null, 2)}\n`,
+            );
             log.info(
               `» terraform_emit_evidence: keyless Sigstore attestation → ${keylessBundleFile}`,
             );

package/src/mcp/terraform/tools/emitOscal.ts

@@ -1,10 +1,11 @@
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { resolveWithinCwd } from "@infraweaver-io/sandbox/pathSafety";
 import { type } from "arktype";
 import { runAssessmentPipeline } from "#app/mcp/assess";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { writeEmittedArtefact } from "#app/mcp/terraform/emittedArtefacts";
 import {
   buildOscalAssessmentResults,
   DEFAULT_OSCAL_PATH,
@@ -58,7 +59,7 @@ export function TerraformEmitOscalTool(ctx: LocalToolContext) {
       });
       // the default compliance/ dir may not exist yet on a first run.
       mkdirSync(dirname(target), { recursive: true });
-      writeFileSync(target, `${JSON.stringify(doc, null, 2)}\n`);
+      writeEmittedArtefact(ctx.toolState, target, `${JSON.stringify(doc, null, 2)}\n`);
       const result = doc["assessment-results"].results[0];
       const findings = result?.findings.length ?? 0;
       log.info(

package/src/mcp/terraform/tools/emitVex.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdirSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { errorMessage } from "@infraweaver-io/core/errors";
 import { resolveWithinCwd } from "@infraweaver-io/sandbox/pathSafety";
@@ -7,6 +7,7 @@ import { PRODUCT_NAME } from "#app/brand";
 import { runAssessmentPipeline } from "#app/mcp/assess";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk } from "#app/mcp/shared";
+import { writeEmittedArtefact } from "#app/mcp/terraform/emittedArtefacts";
 import {
   buildInTotoStatement,
   keylessBundlePath,
@@ -77,10 +78,11 @@ export function TerraformEmitVexTool(ctx: LocalToolContext) {
       const bytes = `${JSON.stringify(doc, null, 2)}\n`;
       // the default compliance/ dir may not exist yet on a first run.
       mkdirSync(dirname(target), { recursive: true });
-      writeFileSync(target, bytes);
+      writeEmittedArtefact(ctx.toolState, target, bytes);
       // same signing contract as the evidence bundle: detached signature over
       // the exact bytes the artefact holds on disk.
-      if (signingKey) writeFileSync(sigPath, `${signBytes(bytes, signingKey)}\n`);
+      if (signingKey)
+        writeEmittedArtefact(ctx.toolState, sigPath, `${signBytes(bytes, signingKey)}\n`);
 
       // Second tier: keyless Sigstore attestation of the VEX (opt-in, CI-only,
       // best-effort — same contract as terraform_emit_evidence). Binds the exact
@@ -100,7 +102,11 @@ export function TerraformEmitVexTool(ctx: LocalToolContext) {
           });
           const sigstoreBundle = await keylessSignStatement(statement);
           keylessBundleFile = keylessBundlePath(target);
-          writeFileSync(keylessBundleFile, `${JSON.stringify(sigstoreBundle, null, 2)}\n`);
+          writeEmittedArtefact(
+            ctx.toolState,
+            keylessBundleFile,
+            `${JSON.stringify(sigstoreBundle, null, 2)}\n`,
+          );
           log.info(`» terraform_emit_vex: keyless Sigstore attestation → ${keylessBundleFile}`);
         } catch (e) {
           log.warning(

package/src/mcp/terraform/tools/equivalenceCheck.ts

@@ -1,9 +1,14 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { type } from "arktype";
 import { REMEDIATE_AND_REFACTOR_MODE } from "#app/mcp/guardrails";
 import type { LocalToolContext } from "#app/mcp/localContext";
 import { execute, tool, toolOk, toolSkip } from "#app/mcp/shared";
+import { initArtefacts, removeNewInitArtefacts } from "#app/mcp/terraform/initArtefacts";
 import { attributePair } from "#app/mcp/terraform/refactor/attribution";
 import { computeEquivalence } from "#app/mcp/terraform/refactor/equivalence";
+import { staleReferenceReason, staleReferences } from "#app/mcp/terraform/refactor/references";
 import { verifyParameterSubstitution } from "#app/mcp/terraform/refactor/substitution";
 import {
   changedFilesSinceBase,
@@ -13,9 +18,10 @@ import {
   resolveBaseSha,
   workingTreeFingerprint,
 } from "#app/mcp/terraform/refactor/workspace";
-import { scanFmt, scanValidate } from "#app/mcp/terraform/scanners";
+import { initFailedRoots, initFailures, scanFmt, scanValidate } from "#app/mcp/terraform/scanners";
 import { scanSessionOf } from "#app/mcp/terraform/scanSession";
-import type { EquivalenceVerdict } from "#app/mcp/terraform/types";
+import { run } from "#app/mcp/terraform/subprocess";
+import type { Concern, EquivalenceVerdict } from "#app/mcp/terraform/types";
 import { log } from "#app/utils/cli";
 import { resolveModuleCredentialEnv } from "#app/utils/setup/registryAuth";
 
@@ -87,8 +93,9 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
       const terraformEnv = resolveModuleCredentialEnv(ctx.payload, {
         sshKeyDir: ctx.tmpdir,
       });
-      const fmtOutcome = scanFmt(cwd);
-      const validateOutcome = scanValidate(cwd, terraformEnv);
+      const artefactsBefore = initArtefacts(cwd);
+      const fmtOutcome = await scanFmt(cwd);
+      const validateOutcome = await scanValidate(cwd, terraformEnv);
 
       // Attributed as a PAIR: whether a directory is a module or a root is a
       // property of the change, not of one snapshot. See [[attributePair]].
@@ -128,10 +135,16 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
       // compares argument NAMES, so a consolidation that hands prod's bucket
       // name to dev passes every check above — and the plan too, since each root
       // still declares exactly one bucket. Driven by `expected_moves` so it
-      // speaks about exactly the relocations the proof established.
+      // speaks about exactly the relocations the proof established. The fetched
+      // module code goes into BOTH trees, as [[attributePair]] does, so a git
+      // module called before and after is compared rather than skipped.
+      const withFetched = (files: typeof afterFiles) => [
+        ...files,
+        ...fetched.files.filter((f) => !files.some((a) => a.path === f.path)),
+      ];
       const substitution = verifyParameterSubstitution(
-        beforeFiles,
-        [...afterFiles, ...fetched.files.filter((f) => !afterFiles.some((a) => a.path === f.path))],
+        withFetched(beforeFiles),
+        withFetched(afterFiles),
         result.expected_moves,
         { fetchedBySource: fetched.bySource },
       );
@@ -139,10 +152,28 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
         substitution.value_substitutions?.filter((s) => s.match === true).length ?? 0;
 
       const validateRan = validateOutcome.ran;
-      const validatePassed =
+      const validateFailed =
         validateRan &&
-        validateOutcome.concerns.length === 0 &&
-        (validateOutcome.unvalidated ?? 0) === 0;
+        (validateOutcome.concerns.length > 0 || (validateOutcome.unvalidated ?? 0) > 0);
+      // a root whose init failed validated without its modules or providers, so
+      // its clean result checked almost nothing — it is not a pass
+      const shallowRoots = validateRan ? initFailedRoots(cwd) : [];
+      // the fetched module code is read and the init outcome known, so what
+      // validate's init wrote can go: left behind, it blocks the push
+      removeNewInitArtefacts(cwd, artefactsBefore, "terraform_equivalence_check");
+      const validatePassed = validateRan && !validateFailed && shallowRoots.length === 0;
+      // A repository that does not validate at the run-start commit cannot be
+      // proven equivalent by any change made to it — but saying "declined" for
+      // errors the change did not introduce sends the editor re-proving forever
+      // (a real repository ran its whole token budget that way). Every error
+      // inherited is `unverifiable` and a stop; one the change added is its own.
+      const inherited =
+        validateFailed && !validateOutcome.unvalidated && validateOutcome.concerns.length > 0
+          ? await baselineValidateErrors(cwd, base, terraformEnv, scanSessionOf(ctx.toolState))
+          : null;
+      const onlyInherited =
+        inherited !== null &&
+        validateOutcome.concerns.every((c) => inherited.has(validateErrorKey(c)));
       // fmt-clean is scoped to the files this run changed — pre-existing drift in
       // untouched files is not the refactor's to fix and must not fail its proof.
       const changed = new Set(changedFilesSinceBase(cwd, base));
@@ -155,12 +186,44 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
       ];
       const fmtClean = fmtOutcome.ran && fmtDriftFiles.length === 0;
 
-      const reasons = [...result.reasons, ...substitution.reasons];
-      if (!validatePassed)
+      // references the change left naming an address it relocated — validate
+      // reports them only after an init that installed every module
+      const stale = staleReferences(afterFiles, result.expected_moves);
+      const staleReason = staleReferenceReason(stale);
+      const reasons = [
+        ...result.reasons,
+        ...substitution.reasons,
+        ...(staleReason ? [staleReason] : []),
+      ];
+      if (onlyInherited)
+        reasons.push(
+          `\`terraform validate\` fails at the run-start commit too, with the same ` +
+            `${validateOutcome.concerns.length} error(s) — they predate this change, but a tree that does not ` +
+            "validate cannot be proven equivalent. STOP: report them as the blocker; re-running this check " +
+            "cannot change its answer until they are fixed.\n- " +
+            validateOutcome.concerns.slice(0, 5).map(validateErrorKey).join("\n- "),
+        );
+      else if (!validatePassed)
         reasons.push(
-          validateRan
-            ? "`terraform validate` did not pass"
-            : "`terraform validate` did not run (terraform not installed) — the equivalence proof is incomplete",
+          !validateFailed && shallowRoots.length > 0
+            ? `\`terraform init\` did not complete in ${shallowRoots.join(", ")}, so \`terraform validate\` ` +
+                "could not check the configuration there — the equivalence proof is incomplete" +
+                initFailures(cwd)
+                  .map((f) => `\n- ${f.root}: ${f.error}`)
+                  .join("")
+            : validateRan
+              ? // the errors themselves: "did not pass" alone sends the editor
+                // hunting for a fault in the proof rather than in its tree
+                [
+                  "`terraform validate` did not pass",
+                  ...validateOutcome.concerns
+                    .slice(0, 5)
+                    .map(
+                      (c) =>
+                        `${c.location.file}${c.location.line ? `:${c.location.line}` : ""}: ${c.evidence}`,
+                    ),
+                ].join("\n- ")
+              : "`terraform validate` did not run (terraform not installed) — the equivalence proof is incomplete",
         );
       if (!fmtClean && fmtOutcome.ran && fmtDriftFiles.length > 0)
         reasons.push(
@@ -168,7 +231,13 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
         );
 
       const valuesPreserved = substitution.value_mismatches.length === 0;
-      const equivalent = result.equivalent && validatePassed && fmtClean && valuesPreserved;
+      const equivalent =
+        result.equivalent &&
+        validatePassed &&
+        fmtClean &&
+        valuesPreserved &&
+        stale.length === 0 &&
+        substitution.opaque_module_changes.length === 0;
 
       // The wrapper's own verdict, which the static core cannot reach: a
       // validate that RAN and failed is an established defect (`declined`), but a
@@ -182,10 +251,16 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
       const toolVerdict: EquivalenceVerdict =
         result.verdict === "declined" ||
         !valuesPreserved ||
-        (validateRan && !validatePassed) ||
+        stale.length > 0 ||
+        (validateFailed && !onlyInherited) ||
         (fmtOutcome.ran && !fmtClean)
           ? "declined"
-          : result.verdict === "unverifiable" || !validateRan || !fmtOutcome.ran
+          : result.verdict === "unverifiable" ||
+              onlyInherited ||
+              substitution.opaque_module_changes.length > 0 ||
+              !validateRan ||
+              shallowRoots.length > 0 ||
+              !fmtOutcome.ran
             ? "unverifiable"
             : "proven";
 
@@ -216,6 +291,7 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
           result.unsettled_only_keyed_relevel &&
           toolVerdict === "unverifiable" &&
           validateRan &&
+          shallowRoots.length === 0 &&
           fmtOutcome.ran,
       };
 
@@ -232,6 +308,7 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
         values_preserved: valuesPreserved,
         value_substitutions: substitution.value_substitutions,
         value_mismatches: substitution.value_mismatches,
+        stale_references: stale,
         validate_passed: validatePassed,
         validate_ran: validateRan,
         fmt_clean: fmtClean,
@@ -249,10 +326,51 @@ export function TerraformEquivalenceCheckTool(ctx: LocalToolContext) {
         reasons,
         note: equivalent
           ? "behaviour-preserving refactor PROVEN (keys-free). For the stronger proof, run terraform_plan — refactor_safe:true corroborates it."
-          : valuesPreserved
-            ? "NOT equivalent — the push will be blocked. Fix the issues in `reasons` (an uncovered move is the dangerous one — add the missing `moved {}` block)."
-            : "NOT equivalent — a relocated argument's VALUE changed. See `value_mismatches`: each root must receive its OWN value at its OWN call site. Copy the values from the before tree verbatim; do not retype them.",
+          : onlyInherited
+            ? "NOT provable here — the repository already fails `terraform validate` at the run-start commit. Do not re-run this check or edit around it: stop, and report the inherited errors in `reasons` as what blocks any refactor of this tree."
+            : substitution.opaque_module_changes.length > 0 && valuesPreserved
+              ? "NOT a proof — a module whose code is outside this tree was added, removed, renamed without a `moved` block, or changed source or version, so what it now creates or destroys is unknown here. Prove it with terraform_plan, or ship it proposed-unproven; never as an equivalence claim."
+              : valuesPreserved
+                ? "NOT equivalent — the push will be blocked. Fix the issues in `reasons` (an uncovered move is the dangerous one — add the missing `moved {}` block)."
+                : "NOT equivalent — a VALUE changed. See `value_mismatches`: each root must receive its OWN value at its OWN call site, and a shared module's body must keep what every caller had. Copy the values from the before tree verbatim; do not retype them.",
       });
     }),
   });
 }
+
+/** `file: message` — what an error is, not where: an edit above it moves its line. */
+function validateErrorKey(c: Concern): string {
+  return `${c.location.file}: ${c.evidence}`;
+}
+
+/**
+ * The validate errors the run-start commit already has, from a throwaway
+ * worktree at `base`. Null when that could not be done — every error then reads
+ * as the change's own, the safe direction.
+ */
+async function baselineValidateErrors(
+  cwd: string,
+  base: string,
+  env: Record<string, string> | undefined,
+  session: ReturnType<typeof scanSessionOf>,
+): Promise<Set<string> | null> {
+  if (session.baselineValidateErrors?.base === base) {
+    return new Set(session.baselineValidateErrors.errors);
+  }
+  const prefix = run("git", ["rev-parse", "--show-prefix"], cwd);
+  if (prefix.status !== 0) return null;
+  const tree = mkdtempSync(join(tmpdir(), "iw-baseline-"));
+  try {
+    if (run("git", ["worktree", "add", "--detach", "--quiet", tree, base], cwd).status !== 0) {
+      return null;
+    }
+    const outcome = await scanValidate(join(tree, prefix.stdout.trim()), env);
+    if (!outcome.ran || outcome.unvalidated) return null;
+    const errors = outcome.concerns.map(validateErrorKey);
+    session.baselineValidateErrors = { base, errors };
+    return new Set(errors);
+  } finally {
+    run("git", ["worktree", "remove", "--force", tree], cwd);
+    rmSync(tree, { recursive: true, force: true });
+  }
+}

package/src/mcp/terraform/tools/infracostDiff.ts

@@ -32,7 +32,7 @@ export async function runInfracostDiff(
   if (!key) {
     return skipResult("infracost_key_unset", "INFRACOST_API_KEY not set — cost analysis is opt-in");
   }
-  const cur = runners.runInfracostBreakdown(cwd, key);
+  const cur = await runners.runInfracostBreakdown(cwd, key);
   if (cur.missing) return skipResult("infracost_not_installed", "infracost not installed");
   if (cur.status !== 0) {
     return skipResult(
@@ -46,7 +46,7 @@ export async function runInfracostDiff(
   } catch {
     return skipResult("infracost_parse_error", "could not parse infracost json output");
   }
-  const baseline = runners.infracostBaseline(cwd, key, ctx.tmpdir);
+  const baseline = await runners.infracostBaseline(cwd, key, ctx.tmpdir);
   const delta = computeCostDelta(baseline, current);
   // per-resource breakdown (top drivers) for a collapsed <details> in the PR.
   const topResources = parseInfracostResources(cur.stdout).slice(0, 10);