chore(terraform): remove numeric file prefixes

[NWarila]

Summary

• Renames the six numbered Terraform implementation files to the plain filenames used by the checked reference implementation. Terraform loads all .tf files in the directory, so this is a semantic no-op; no executable HCL from the numbered source files changes, and the only removed placeholder HCL is the empty locals {} block.
• Updates the deny-all .gitignore allowlist by replacing the numbered Terraform entries with the required plain-path entries and allowlisting the already tracked tools/test_detector_mode.py. This keeps intended deliverables visible to ordinary future git add operations under ADR 0003.
• Corrects a false security claim in DESIGN.md: canonical deployment state uses the partial S3 backend, Terraform sensitivity markings do not encrypt or omit values from state, duplicated non-sensitive outputs remain displayable, and detector-mode local state is only a temporary exception.
• Updates the README link, detector test path, and filename comments associated with the renames.

History

On main at the squash commit, git show --format= --name-status --find-renames=20% --break-rewrites=20% HEAD -- terraform records all six rename pairs; for a particular file, git log --find-renames=20% --break-rewrites=20% --name-status -- <old-path> <new-path> includes its numbered-path commits and git blame -C -C -M -s -- <new-path> recovers surviving-line ancestry, while a one-new-path git log does not traverse a replaced placeholder and, on this commit, git log --follow crosses only backend.tf and providers.tf, whose destinations were absent from the parent.

Follow-on

The comment-only references to 30-locals.tf and 11-variables.github.tf in nwarila-platform/github-terraform-runner/terraform/public/talos-cluster.yml:66,69 remain an out-of-scope runner-repository follow-on.

Complete acceptance transcripts (items 1–6)

Item 1 — authoritative Terraform diff

Result: PASS (exit 0).

$ export PATH=/home/hellbomb/bin-tf1154:$PATH
$ git diff --break-rewrites=20% --find-renames=20% origin/main -- terraform
diff --git a/terraform/00-providers.tf b/terraform/backend.tf
similarity index 87%
rename from terraform/00-providers.tf
rename to terraform/backend.tf
index dda7b43..aeacbba 100644
--- a/terraform/00-providers.tf
+++ b/terraform/backend.tf
@@ -1,5 +1,5 @@
 #% ========================================================================================== %#
-#% = File: 00-providers.tf                                      | Category: Providers (00-09) %#
+#% = File: backend.tf                                                                         %#
 #% ----- [ Description ] -------------------------------------------------------------------- %#
 #% Backend declaration. Terraform required_version and required_providers live in versions.tf
 #% per the golden template contract.
diff --git a/terraform/30-locals.tf b/terraform/locals.tf
similarity index 99%
rename from terraform/30-locals.tf
rename to terraform/locals.tf
index 7f424d3..16ecde7 100644
--- a/terraform/30-locals.tf
+++ b/terraform/locals.tf
@@ -1,5 +1,5 @@
 #% ========================================================================================== %#
-#% = File: 30-locals.tf                                                                       %#
+#% = File: locals.tf                                                                          %#
 #% ------------------------------------------------------------------------------------------ %#
 #% The locals files is where the real heavy lifting for building the working objects used by  %#
 #%    resources blocks is done. within "locals", all objects defined elsewhere (i.e. data,    %#
@@ -134,7 +134,7 @@ locals {
 #% Global validation error aggregation.                                                        %#
 #% ------------------------------------------------------------------------------------------ %#
 #% These locals walk the decoded YAML and produce a flat list of error strings. The list is    %#
-#% consumed by terraform_data.framework_validation (see 41-resources-github.tf), whose          %#
+#% consumed by terraform_data.framework_validation (see resources.tf), whose                    %#
 #% precondition fails plan when the list is non-empty. Per-resource checks (visibility,        %#
 #% ruleset enforcement, env wait_timer, etc.) stay on their respective resources so error      %#
 #% messages point at specific resource addresses.                                              %#
@@ -1129,7 +1129,7 @@ locals {
 #%                                                                                             %#
 #%   Global invariants (duplicate keys, unknown nested keys, unsupported push rulesets,        %#
 #%     auth config, capability gaps) live in local.global_validation_errors and are enforced  %#
-#%     by a precondition on terraform_data.framework_validation (41-resources-github.tf).     %#
+#%     by a precondition on terraform_data.framework_validation (resources.tf).               %#
 #%                                                                                             %#
 #%   Per-resource invariants (visibility enum, ruleset enforcement, env wait_timer, actions   %#
 #%     allowed_actions enum, CODEOWNERS present when require_code_owner_review is true) live  %#
diff --git a/terraform/60-outputs-github.tf b/terraform/outputs.tf
similarity index 100%
rename from terraform/60-outputs-github.tf
rename to terraform/outputs.tf
diff --git a/terraform/01-providers-github.tf b/terraform/providers.tf
similarity index 93%
rename from terraform/01-providers-github.tf
rename to terraform/providers.tf
index 4eb13c8..f276ec3 100644
--- a/terraform/01-providers-github.tf
+++ b/terraform/providers.tf
@@ -1,5 +1,5 @@
 #% =========================================================================================== %#
-#% = File: 01-providers-github.tf                                | Category: Providers (00-09) %#
+#% = File: providers.tf                                                                        %#
 #% ----- [ Description ] --------------------------------------------------------------------- %#
 #% GitHub provider configuration. Supports two authentication modes, selected by                %#
 #%   var.github_auth_mode:                                                                      %#
diff --git a/terraform/41-resources-github.tf b/terraform/resources.tf
similarity index 99%
rename from terraform/41-resources-github.tf
rename to terraform/resources.tf
index ecb0569..21f3083 100644
--- a/terraform/41-resources-github.tf
+++ b/terraform/resources.tf
@@ -1,5 +1,5 @@
 #% ========================================================================================== %#
-#% = File: 41-resources-github.tf                                                             %#
+#% = File: resources.tf                                                                       %#
 #% ------------------------------------------------------------------------------------------ %#
 #% Resources driven by locals computed in locals.tf                                            %#
 #% ========================================================================================== %#
diff --git a/terraform/11-variables.github.tf b/terraform/variables.tf
similarity index 100%
rename from terraform/11-variables.github.tf
rename to terraform/variables.tf

Item 2 — declaration-header inventory

Result: PASS (exit 0; empty diff).

$ export PATH=/home/hellbomb/bin-tf1154:$PATH
$ pattern='^(resource|data|variable|output|locals|provider|terraform|check|moved|removed|import|module|ephemeral|action) '
diff -u \
  <(git grep -h -E "$pattern" origin/main -- 'terraform/*.tf' | sort) \
  <( { grep -hE "$pattern" terraform/*.tf; printf '%s\n' 'locals {}'; } | sort )

Item 3 — Terraform 1.15.4 and make ci

Result: PASS (exit 0).

$ export PATH=/home/hellbomb/bin-tf1154:$PATH
$ export TF_CLI_ARGS=-no-color
$ export TF_CLI_ARGS_test=-compact-warnings
$ terraform version
Terraform v1.15.4
on linux_amd64
$ make ci
make fmt-check
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
terraform -chdir=terraform fmt -check -recursive
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make init
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
terraform -chdir=terraform init -backend=false -input=false
Initializing provider plugins found in the configuration...
- terraform.io/builtin/terraform is built in to Terraform
- Reusing previous version of integrations/github from the dependency lock file
- Reusing previous version of hashicorp/time from the dependency lock file
- Using previously-installed integrations/github v6.12.1
- Using previously-installed hashicorp/time v0.12.1




Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make validate
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
terraform -chdir=terraform validate

Warning: Argument is deprecated

  with github_actions_environment_secret.env_secret,
  on resources.tf line 606, in resource "github_actions_environment_secret" "env_secret":
 606:   plaintext_value = ""

Use value.
Success! The configuration is valid, but there were some validation warnings
as shown above.

make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make test
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
terraform -chdir=terraform test
tests/capability_defaults.tftest.hcl... in progress
  run "default_capability_and_baseline_matrices_are_free_only"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

tests/capability_defaults.tftest.hcl... tearing down
tests/capability_defaults.tftest.hcl... pass
tests/forking.tftest.hcl... in progress
  run "F1_public_omitted_defaults_true"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "F2_org_private_omitted_defaults_false"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 2 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "F3_internal_omitted_defaults_false"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 2 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "F4_org_private_explicit_true_passes_through"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "F5_public_explicit_false_fails"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "F6_personal_private_omitted_defaults_null"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 2 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "F7_personal_private_explicit_true_passes_through"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

tests/forking.tftest.hcl... tearing down
tests/forking.tftest.hcl... pass
tests/normalization.tftest.hcl... in progress
  run "pattern_blocks_with_only_pattern_field_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "merge_queue_with_partial_fields_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "pull_request_with_only_merge_methods_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "pages_partial_fields_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 79 (and 2 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "repo_with_environments_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 3 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "custom_environment_branch_policy_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "archived_repo_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "empty_repo_set_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "org_mode_uses_global_codeowners_default"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "org_mode_per_repo_codeowners_overrides_global_default"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "personal_mode_uses_global_codeowners_default"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "org_mode_explicit_codeowners_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "personal_mode_synthesizes_codeowners"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "personal_mode_empty_codeowners_default_synthesizes"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "org_mode_whitespace_codeowners_default_is_rejected"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "push_ruleset_on_private_when_supported_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "license_template_defaults_null_not_MIT"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "good_minimal_produces_expected_resource_counts"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "good_minimal_carries_expected_defaults"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "archived_repo_filters_out_downstream_locals"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "empty_repo_set_exercises_every_filter_on_zero_input"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "good_minimal_produces_zero_environments_zero_codeowners"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "explicit_security_and_analysis_overrides_baseline"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "multi_branch_sources_all_from_default_not_serially"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "fork_repo_passes_through_source_fields"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "actions_config_omitted_fields_take_failclosed_defaults"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 3 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "actions_config_explicit_verified_true_is_preserved"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 3 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "actions_config_explicit_false_values_are_preserved"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 3 more)

To see the full warning notes, run Terraform without -compact-warnings.

tests/normalization.tftest.hcl... tearing down
tests/normalization.tftest.hcl... pass
tests/org_settings.tftest.hcl... in progress
  run "default_org_settings_are_unmanaged"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "minimal_opt_in_plans_every_safe_default"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "non_default_opt_in_plans_every_managed_attribute"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "personal_account_rejects_org_settings"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "managed_org_requires_billing_email"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "managed_org_rejects_whitespace_billing_email"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "managed_org_rejects_whitespace_name"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "unmanaged_org_rejects_dangling_billing_email"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "advanced_security_explicit_opt_in_plans_true"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "invalid_default_repository_permission_fails"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "omitted_description_plans_empty"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

tests/org_settings.tftest.hcl... tearing down
tests/org_settings.tftest.hcl... pass
tests/preconditions.tftest.hcl... in progress
  run "rejects_invalid_visibility_enum"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_public_repo_without_description"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_invalid_ruleset_enforcement"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_org_mode_codeowners_required_but_missing"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_env_wait_timer_out_of_range"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_env_branch_policy_mutually_exclusive"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_actions_allowed_actions_enum"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_actions_selected_without_config"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

tests/preconditions.tftest.hcl... tearing down
tests/preconditions.tftest.hcl... pass
tests/security.tftest.hcl... in progress
  run "strict_mode_no_gap_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "compatibility_mode_no_gap_plans_clean_with_empty_preview"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "strict_mode_reports_gaps_across_multiple_visibilities"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "no_baseline_no_yaml_collapses_security_to_null"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "unmanaged_secret_features_collapse_security_to_null"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "baseline_feature_enabled_when_capability_matches"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "disabled_fallback_manages_unspecified_features"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "precedence_collisions_and_explicit_capability_bypass"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "explicit_true_bypasses_private_capability_false"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "pin_exclude_omits_code_security"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "all_features_excluded_collapses_whole_block"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "invalid_pin_exclude_blocks_plan"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "explicit_vulnerability_alerts_opt_in_is_honoured"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "explicit_false_beats_enabled_baseline"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "capability_gap_disabled_falls_back_false_and_preview_fires"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "capability_gap_unmanaged_falls_back_null"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

tests/security.tftest.hcl... tearing down
tests/security.tftest.hcl... pass
tests/validation.tftest.hcl... in progress
  run "good_minimal_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_unknown_top_level_key"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_unknown_nested_key"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_duplicate_repo_keys"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_unsupported_push_ruleset"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_code_scanning_tool_typo"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_multiple_nested_typos_in_one_repo"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_secrets_written_as_map"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_token_mode_missing_token"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_app_mode_missing_app_auth"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_token_mode_with_app_auth_also_set"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_app_mode_with_token_also_set"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "valid_app_auth_plans_clean"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "strict_mode_fails_on_capability_gap"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "compatibility_mode_tolerates_capability_gap"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "push_ruleset_public_supports_true_still_fails"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "push_ruleset_private_supports_false_fails"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "push_ruleset_internal_supports_true_passes"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 129 (and 1 more)

To see the full warning notes, run Terraform without -compact-warnings.

  run "push_ruleset_internal_supports_false_fails"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_invalid_github_owner_regex"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_invalid_auth_mode_enum"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

  run "rejects_invalid_baseline_mode_enum"... pass

Warnings:

- Argument is deprecated
  on resources.tf line 606

To see the full warning notes, run Terraform without -compact-warnings.

tests/validation.tftest.hcl... tearing down
tests/validation.tftest.hcl... pass

Success! 93 passed, 0 failed.
python3 tools/test_detector_mode.py
test_exact_toolchain_and_all_four_affected_declared_types (__main__.ETagEvidenceTests.test_exact_toolchain_and_all_four_affected_declared_types) ... ok
test_pinned_provider_returns_304_then_200_and_exposes_false_clean (__main__.ETagEvidenceTests.test_pinned_provider_returns_304_then_200_and_exposes_false_clean) ... ok
test_stripping_is_action_neutral_but_not_refresh_drift_neutral (__main__.ETagEvidenceTests.test_stripping_is_action_neutral_but_not_refresh_drift_neutral) ... ok
test_clean_plan_closes_existing_issue_and_ignores_refresh_drift (__main__.ReporterTests.test_clean_plan_closes_existing_issue_and_ignores_refresh_drift) ... ok
test_clean_plan_without_issue_is_a_noop (__main__.ReporterTests.test_clean_plan_without_issue_is_a_noop) ... ok
test_create_only_is_indeterminate_and_opens (__main__.ReporterTests.test_create_only_is_indeterminate_and_opens) ... ok
test_delete_and_both_replacement_orders_are_drift (__main__.ReporterTests.test_delete_and_both_replacement_orders_are_drift) ... ok
test_mixed_plan_prints_both_classes (__main__.ReporterTests.test_mixed_plan_prints_both_classes) ... ok
test_refused_delete_still_reaches_reporter_in_detector_mode (__main__.ReporterTests.test_refused_delete_still_reaches_reporter_in_detector_mode) ... ok
test_update_only_is_drift_and_migrates_existing_issue_title (__main__.ReporterTests.test_update_only_is_drift_and_migrates_existing_issue_title) ... ok
test_shipped_init_strips_state_and_uses_bare_local_backend_init (__main__.ShippedInitTests.test_shipped_init_strips_state_and_uses_bare_local_backend_init) ... ok
test_strip_postcondition_rejects_a_remaining_etag_and_invalid_json (__main__.ShippedInitTests.test_strip_postcondition_rejects_a_remaining_etag_and_invalid_json) ... ok
test_all_eight_mode_rows_from_shipped_predicates (__main__.WorkflowPredicateTests.test_all_eight_mode_rows_from_shipped_predicates) ... ok
test_named_steps_have_exact_predicates (__main__.WorkflowPredicateTests.test_named_steps_have_exact_predicates) ... ok

----------------------------------------------------------------------
Ran 14 tests in 3.781s

OK
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make tflint
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
tflint --config "/home/hellbomb/wt/f4-denumber/.tflint.hcl" --chdir terraform
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make docs-diff
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
terraform-docs --config .terraform-docs.yml --output-check terraform
docs/reference/terraform.md is up to date
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make docs-check
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
python3 tools/check_docs_layout.py
docs layout check passed
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make opa-test
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
no OPA policies to test
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make assemble-guard-test
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
bash tools/test_assemble_guard.sh
guard in use (ls -A):
  PASS  directory containing only .github.yml -> non-empty
  PASS  directory containing example.yml -> non-empty
  PASS  genuinely empty directory -> empty

previous guard (compgen -G), for contrast:
  OK    old guard could NOT see .github.yml — the bug this test pins
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'
make destroy-guard-test
make[1]: Entering directory '/home/hellbomb/wt/f4-denumber'
python3 tools/test_destroy_guard.py
test_already_archived_repository_may_leave_management (__main__.DeliberateRetirementTests.test_already_archived_repository_may_leave_management) ... ok
test_mixed_plan_blocks_only_the_premature_one (__main__.DeliberateRetirementTests.test_mixed_plan_blocks_only_the_premature_one) ... ok
test_missing_archive_on_destroy_is_treated_as_the_provider_default (__main__.EdgeCaseTests.test_missing_archive_on_destroy_is_treated_as_the_provider_default) ... ok
test_null_before_state_is_not_treated_as_permission (__main__.EdgeCaseTests.test_null_before_state_is_not_treated_as_permission) ... ok
test_replace_counts_as_a_destroy (__main__.EdgeCaseTests.test_replace_counts_as_a_destroy) ... ok
test_archive_on_destroy_false_is_refused (__main__.GenuineDeletionTests.test_archive_on_destroy_false_is_refused) ... ok
test_refused_even_when_repository_is_already_archived (__main__.GenuineDeletionTests.test_refused_even_when_repository_is_already_archived) ... ok
test_clean_plan_passes (__main__.OtherResourceTests.test_clean_plan_passes) ... ok
test_dependent_resource_destroys_are_reported_not_blocked (__main__.OtherResourceTests.test_dependent_resource_destroys_are_reported_not_blocked) ... ok
test_error_points_at_the_likely_cause (__main__.PrematureArchiveTests.test_error_points_at_the_likely_cause) ... ok
test_the_real_incident_plan_is_blocked (__main__.PrematureArchiveTests.test_the_real_incident_plan_is_blocked) ... ok
test_there_is_no_override_environment_variable (__main__.PrematureArchiveTests.test_there_is_no_override_environment_variable) ... ok

----------------------------------------------------------------------
Ran 12 tests in 0.310s

OK
make[1]: Leaving directory '/home/hellbomb/wt/f4-denumber'

Item 4 — explicit docs diff

Result: PASS (exit 0; no generated diff).

$ export PATH=/home/hellbomb/bin-tf1154:$PATH
$ make docs-diff
terraform-docs --config .terraform-docs.yml --output-check terraform
docs/reference/terraform.md is up to date

Item 5 — deny-all/index proofs and comment widths

Result: PASS (all exits 0; the three proofs were silent and all six widths matched).

$ export PATH=/home/hellbomb/bin-tf1154:$PATH
$ ignored="$(git check-ignore --no-index terraform/backend.tf terraform/providers.tf tools/test_detector_mode.py || true)"
test -z "$ignored"
$ test -z "$(git ls-files -ci --exclude-standard)"
$ diff -u \
  <(printf '%s\n' terraform/backend.tf terraform/locals.tf terraform/outputs.tf terraform/providers.tf terraform/resources.tf terraform/variables.tf terraform/versions.tf) \
  <(git ls-files 'terraform/*.tf')
$ LC_ALL=C awk 'FNR==2 || (FILENAME=="terraform/locals.tf" && (FNR==137 || FNR==1132)) { print FILENAME ":" FNR ":" length($0) }' terraform/backend.tf terraform/providers.tf terraform/locals.tf terraform/resources.tf
terraform/backend.tf:2:96
terraform/providers.tf:2:97
terraform/locals.tf:2:96
terraform/locals.tf:137:98
terraform/locals.tf:1132:96
terraform/resources.tf:2:96

Item 6 — clean status and commit-level rename records

Result: PASS (both exits 0; exactly the six required rename rows).

$ export PATH=/home/hellbomb/bin-tf1154:$PATH
$ test -z "$(git status --porcelain)"
$ git show --format= --name-status --find-renames=20% --break-rewrites=20% HEAD -- terraform
R087	terraform/00-providers.tf	terraform/backend.tf
R099	terraform/30-locals.tf	terraform/locals.tf
R100	terraform/60-outputs-github.tf	terraform/outputs.tf
R093	terraform/01-providers-github.tf	terraform/providers.tf
R099	terraform/41-resources-github.tf	terraform/resources.tf
R100	terraform/11-variables.github.tf	terraform/variables.tf