v1.3: fail-on-findings + in-band suppressions + first calibrated Terraform shape

[Born14]

Summary

v1.3 adds three coupled features in response to engineering critique on v1.0-1.2 plus the first calibrated Terraform shape:

1. fail-on-findings Action input (default false). Opt-in CI failure on non-suppressed findings. The receipt's calibrated severity stays at warning; the failure is the team's policy, not the methodology's claim.
2. In-band suppression syntax (# verify:ignore <SHAPE-ID> reason:"<text>"). Trailing-only scope. Strict shape-ID matching (typos surface as warnings, not silent no-ops). Suppressions go in their own receipt block and are part of the packet digest.
3. First calibrated Terraform shape (TF-SG-WORLD-OPEN-INGRESS-01): AWS security-group ingress opening sensitive ports to the world. Calibrated/warning under the v1.1 same-module Terraform resolver, promoted via strong-single-corpus on the devops-in-the-cloud corpus (32 TP / 0 FP / 16 AMB / 100% precision / 33.33% ambiguity).

Discipline reminder on the Terraform shape

Narrow but real: one shape, warning-only, single-corpus. The receipt's Not-Checked block names the rest of the Terraform surface as still uncovered. Not "Terraform solved", not blocking-tier, not two-corpus. Future Terraform shapes ship when each one earns its own ledger row.

Receipt schema (verify-receipt/v1) extended

Two new arrays, both part of the digest:

• suppressions: SuppressedFinding[]
• suppression_warnings: SuppressionWarning[]

Empty arrays when no suppressions are declared.

Surface extended to include terraform. CalibratedIaCShapeId extended to include TF-SG-WORLD-OPEN-INGRESS-01.

New canonical demo digest

sha256:0d7d9d941a672e37f2a31e0d8db8b20ce7ca416d57cf989c89deac7ca958b0e4

(Was sha256:bceed6d3... at v1.2; superseded the pre-Terraform v1.3 digest sha256:2040419... once TF-SG landed.)

Behaviour preserved on prior shapes

• Same calibrated detectors for K8s/Dockerfile/GHA, same detection logic, same precision numbers, same ledger row provenance.
• Receipt severity for the prior seven shapes unchanged.
• Born14/verify@v1 install line unchanged.

What changed at the runtime

• Eight calibrated checks shipping (was seven).
• Bundle entry: src/action-v2/index-receipt.ts (the receipt entry, not the legacy migration entry).
• New file detection: *.tf files now classify as the new terraform surface.
• TF-SG runs extractTerraformSurface -> resolveSurface -> runTfSgWorldOpenIngress01 -> classifyFindings. Only TP findings appear as receipt findings; AMB findings are dropped (the substrate's resolution boundaries are named in the Not-Checked block).
• Slim shipped calibration files (dist/action/calibration/{shapes.json,attempts.jsonl}) now contain 8 shapes / 11 ratified attempts.
• Not-Checked Terraform line narrowed: "Terraform coverage is limited to TF-SG-WORLD-OPEN-INGRESS-01 ... Other Terraform shapes are not parsed or checked. Cross-module variables, expression evaluation, data sources, file()/templatefile(), and dynamic block expansion are out of scope."

Test plan

• CI on this branch is green.
• README.md on GitHub renders the eight-shape calibrated-checks table including the TF-SG row.
• dist/action/index.cjs on GitHub contains TF-SG-WORLD-OPEN-INGRESS-01.
• dist/action/index.cjs on GitHub does not contain the stale Terraform .tf files are not parsed.
• Canonical demo digest in the release notes matches the rebuilt bundle/demo output.
• Confirm a fixture with a real # verify:ignore comment routes the finding to suppressions and reduces non-suppressed count.
• Confirm a fixture with a typo'd shape ID routes to suppression_warnings.
• Smoke-test on Born14/verify-smoke once merged: install branch's bundle, observe receipt with eight checks and Terraform surface inspected.

Decisions locked in this release

• Comment-walk scope: trailing-only.
• Mismatched SHAPE-ID: strict match + warn-on-no-op.
• fail-on-findings: true and suppressions: counts non-suppressed findings only.
• Block ordering: position 5 (suppressions), between Not Checked and Reproduction.
• TF-SG: ship TP findings only; drop AMB; preserve resolved_from provenance in evidence when same-module resolution backed the literal.
• TF-SG severity: warning (first-promotion lock applies).

Not in this release (banked for later)

• Full per-detector line-number plumbing.
• Cryptographically-signed suppression comments.
• Shape-specific suppression for CONTAINER-ROOT-01.
• Second-corpus Terraform calibration (would unlock standard two-corpus path; deferred to a future release).
• Cross-module Terraform variable resolution.
• Other Terraform shapes (RDS hygiene, S3 versioning, etc.).

Tag move

The v1 tag is not moved by this PR. After merge, tag move requires explicit operator confirmation.

🤖 Generated with Claude Code

[github-actions]

VERIFY CHANGE RECEIPT
Kubernetes / Dockerfile / GitHub Actions
----------------------------------------------------------------
scope:   K8s 0 / Dockerfile 0 / GHA 0
checks:  8 calibrated
result:  CLEAR
digest:  sha256:1405d520aee006ea09afbf48d9b790114fa27edfaacce3f6a58130d9747770eb

Checks with no findings

• [CLEAR] CONTAINER-ROOT-01
• [CLEAR] K8S-MISSING-LIMITS-01
• [CLEAR] K8S-MISSING-PROBES-01
• [CLEAR] K8S-MISSING-SECURITY-CONTEXT-01
• [CLEAR] K8S-IMAGE-TAG-LATEST-01
• [CLEAR] GHA-SHA-PIN-01
• [CLEAR] DOCKERFILE-BASE-IMAGE-DIGEST-UNPINNED-01
• [CLEAR] TF-SG-WORLD-OPEN-INGRESS-01

Not checked

Terraform, CloudFormation, Helm-templated YAML, Kustomize overlays, runtime cloud state, business logic, intent, recall, uncalibrated shapes.

Receipt artifacts: verify-receipt.md, verify-receipt.json. Digest: sha256:1405d520aee006ea09afbf48d9b790114fa27edfaacce3f6a58130d9747770eb.