Move the code and terraform audits into the reviews plugin

Copy the standalone code-review and terraform-review skills into
plugins/reviews as audit-code and audit-terraform. The rename separates the
automated, linter-driven audits from the guided review-pr walkthrough that
already lived here.

Resolve bundled script paths through ${SKILL_DIR}, exported in a new step 0.
CLAUDE_PLUGIN_ROOT is not set in the Bash tool environment, so the obvious
substitution would have expanded to nothing and broken every collection
script invocation.

Replace the PLAN and DESIGN docs with READMEs written from the current
SKILL.md and scripts. The old docs had drifted badly: they named semgrep
where the code calls opengrep, scoped five review agents where there are
now eight, and predated Lua, PowerShell, and GitHub Actions support.

Add CONSISTENCY_NORMS to the audit-terraform agent inputs. The collection
script writes consistency_norms.json and the agent prompt declares it, but
SKILL.md never listed it, leaving the variable unsubstituted.

Drop the --ingest-verdicts instruction from both skills. review_stats.py
parses no arguments, so the ref-mode verdict template it told users to feed
back could never be read.

Point audit-terraform's smoke test at README.md and resolve its fixture
paths relative to the test file rather than an absolute home directory.

Tests: 197 passing (audit-code), 106 passing (audit-terraform).

plugins/reviews/skills/audit-terraform/tests/conftest.py

@@ -0,0 +1,5 @@
+import sys
+from pathlib import Path
+
+_root = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(_root))

plugins/reviews/skills/audit-terraform/tests/fixtures/cis_sample.html

@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html><body>
+<h2>CIS AWS Foundations Benchmark version 5.0.0</h2>
+<table>
+<tr>
+  <th>Control ID and title</th>
+  <th>CIS v5.0.0 requirement</th>
+  <th>CIS v3.0.0 requirement</th>
+  <th>CIS v1.4.0 requirement</th>
+  <th>CIS v1.2.0 requirement</th>
+</tr>
+<tr>
+  <td>[Account.1] Security contact information should be provided for an AWS account</td>
+  <td>1.2</td>
+  <td>1.2</td>
+  <td>1.2</td>
+  <td>1.18</td>
+</tr>
+<tr>
+  <td>[CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail</td>
+  <td>3.1</td>
+  <td>3.1</td>
+  <td>3.1</td>
+  <td>2.1</td>
+</tr>
+<tr>
+  <td>[IAM.5] MFA should be enabled for all IAM users that have a console password</td>
+  <td>1.10</td>
+  <td>1.10</td>
+  <td></td>
+  <td>1.2</td>
+</tr>
+<tr>
+  <td>[S3.5] S3 general purpose buckets should require requests to use SSL</td>
+  <td>2.1.2</td>
+  <td>2.1.2</td>
+  <td>2.1.2</td>
+  <td></td>
+</tr>
+</table>
+</body></html>

plugins/reviews/skills/audit-terraform/tests/fixtures/fsbp_index_sample.html

@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html><body>
+<h1>AWS Foundational Security Best Practices standard</h1>
+
+<h3>S3 controls</h3>
+<p>
+    <a href="./s3-controls.html#s3-1">[S3.1] S3 general purpose buckets should have block public access settings enabled</a>
+</p>
+<p>
+    <a href="./s3-controls.html#s3-5">[S3.5] S3 general purpose buckets should require requests to use SSL</a>
+</p>
+
+<h3>IAM controls</h3>
+<p>
+    <a href="./iam-controls.html#iam-5">[IAM.5] MFA should be enabled for all IAM users that have a console password</a>
+</p>
+
+<h3>Other</h3>
+<p>
+    <a href="./account-controls.html#account-1">[Account.1] Security contact information should be provided for an AWS account</a>
+</p>
+</body></html>

plugins/reviews/skills/audit-terraform/tests/fixtures/plan_output_tofu.txt

@@ -0,0 +1,35 @@
+OpenTofu used the selected providers to generate the following execution
+plan. Resource actions are indicated with the following symbols:
+  + create
+  ~ update in-place
+  - destroy
+  -/+ destroy and then create replacement
+
+OpenTofu will perform the following actions:
+
+  # aws_s3_bucket.audit_logs will be created
+  + resource "aws_s3_bucket" "audit_logs" {
+      + bucket = "audit-logs-prod"
+    }
+
+  # module.app_role.aws_iam_role.this will be updated in-place
+  ~ resource "aws_iam_role" "this" {
+        name = "app-role"
+      ~ assume_role_policy = jsonencode(
+            ~ {
+              ...
+            }
+        )
+    }
+
+  # aws_security_group.legacy will be destroyed
+  - resource "aws_security_group" "legacy" {
+      - id = "sg-123" -> null
+    }
+
+  # aws_iam_user.svc must be replaced
+-/+ resource "aws_iam_user" "svc" {
+      ~ name = "old" -> "new" # forces replacement
+    }
+
+Plan: 2 to add, 1 to change, 1 to destroy.

plugins/reviews/skills/audit-terraform/tests/fixtures/tofu-sample/main.tf

@@ -0,0 +1,22 @@
+terraform {
+  required_version = ">= 1.5"
+  backend "local" {}
+  required_providers {
+    null   = { source = "hashicorp/null",   version = "~> 3.2" }
+    random = { source = "hashicorp/random", version = "~> 3.6" }
+  }
+}
+
+module "widget_a" {
+  source = "./modules/widget"
+  name   = "alpha"
+}
+
+module "widget_b" {
+  source = "./modules/widget"
+  name   = "beta"
+}
+
+resource "null_resource" "top" {
+  triggers = { ts = "1" }
+}

plugins/reviews/skills/audit-terraform/tests/fixtures/tofu-sample/modules/widget/main.tf

@@ -0,0 +1,8 @@
+resource "null_resource" "thing" {
+  triggers = { name = var.name }
+}
+
+resource "random_string" "id" {
+  length  = 8
+  special = false
+}

plugins/reviews/skills/audit-terraform/tests/fixtures/tofu-sample/modules/widget/variables.tf

@@ -0,0 +1,3 @@
+variable "name" {
+  type = string
+}

plugins/reviews/skills/audit-terraform/tests/test_agent_prompts.py

@@ -0,0 +1,24 @@
+from pathlib import Path
+
+SKILL_ROOT = Path(__file__).resolve().parent.parent
+
+
+def test_tf_hygiene_agent_prompt_exists():
+    p = SKILL_ROOT / "agents" / "tf-hygiene-reviewer.md"
+    assert p.exists(), f"missing agent prompt at {p}"
+    text = p.read_text()
+    assert "tf-hygiene-reviewer" in text
+    assert "OUTPUT" in text
+    assert "MANIFEST" in text
+    assert "tflint_findings" in text
+
+
+def test_tf_hygiene_agent_disclaims_security_lane():
+    text = (SKILL_ROOT / "agents" / "tf-hygiene-reviewer.md").read_text().lower()
+    assert "security" in text
+    assert "aws-bp" in text or "not security" in text
+
+
+def test_tf_hygiene_agent_disclaims_consistency_lane():
+    text = (SKILL_ROOT / "agents" / "tf-hygiene-reviewer.md").read_text().lower()
+    assert "consistency" in text

plugins/reviews/skills/audit-terraform/tests/test_catalog.py

@@ -0,0 +1,153 @@
+from scripts.catalog import build_catalog, PlanHit, DiffHit
+from scripts.manifest import ModuleGraphEntry
+
+
+def test_plan_and_diff_match_yields_both():
+    plan_hits = {
+        "live/prod/app": [
+            PlanHit(address="aws_s3_bucket.x", type="aws_s3_bucket", action="create"),
+        ],
+    }
+    diff_hits = [
+        DiffHit(source_dir="live/prod/app",
+                local_address="aws_s3_bucket.x", type="aws_s3_bucket"),
+    ]
+    entries = build_catalog(plan_hits, diff_hits, module_graph={})
+    assert len(entries) == 1
+    e = entries[0]
+    assert e.source == "both"
+    assert e.source_dir == "live/prod/app"
+    assert e.local_address == "aws_s3_bucket.x"
+    assert len(e.instances) == 1
+    assert e.instances[0].plan_dir == "live/prod/app"
+    assert e.instances[0].address_at_plan == "aws_s3_bucket.x"
+
+
+def test_plan_only_is_drift():
+    plan_hits = {
+        "live/prod/app": [
+            PlanHit(address="aws_s3_bucket.x", type="aws_s3_bucket", action="update"),
+        ],
+    }
+    entries = build_catalog(plan_hits, diff_hits=[], module_graph={})
+    assert len(entries) == 1
+    assert entries[0].source == "plan"
+    assert entries[0].instances[0].action == "update"
+
+
+def test_module_callsites_collapse_to_single_entry():
+    graph = {
+        "modules/app-role": ModuleGraphEntry(
+            callsites=["live/prod/app", "live/staging/app"],
+        )
+    }
+    plan_hits = {
+        "live/prod/app": [
+            PlanHit(address="module.role.aws_iam_role.this",
+                    type="aws_iam_role", action="update"),
+        ],
+        "live/staging/app": [
+            PlanHit(address="module.role.aws_iam_role.this",
+                    type="aws_iam_role", action="update"),
+        ],
+    }
+    entries = build_catalog(plan_hits, diff_hits=[], module_graph=graph)
+    assert len(entries) == 1
+    e = entries[0]
+    assert e.source_dir == "modules/app-role"
+    assert e.local_address == "aws_iam_role.this"
+    assert {i.plan_dir for i in e.instances} == {"live/prod/app", "live/staging/app"}
+
+
+def test_plan_module_addresses_resolve_to_matching_local_module():
+    graph = {
+        "modules/app-policy": ModuleGraphEntry(
+            callsites=["live/prod/app"],
+            callsite_local_names={
+                "live/prod/app": {
+                    "policy": "modules/app-policy",
+                    "role": "modules/app-role",
+                }
+            },
+        ),
+        "modules/app-role": ModuleGraphEntry(
+            callsites=["live/prod/app"],
+            callsite_local_names={
+                "live/prod/app": {
+                    "policy": "modules/app-policy",
+                    "role": "modules/app-role",
+                }
+            },
+        ),
+    }
+    plan_hits = {
+        "live/prod/app": [
+            PlanHit(address="module.role.aws_iam_role.this",
+                    type="aws_iam_role", action="update"),
+            PlanHit(address="module.policy.aws_iam_policy.this",
+                    type="aws_iam_policy", action="create"),
+        ],
+    }
+
+    entries = build_catalog(plan_hits, diff_hits=[], module_graph=graph)
+
+    by_key = {(e.source_dir, e.local_address): e for e in entries}
+    assert ("modules/app-role", "aws_iam_role.this") in by_key
+    assert ("modules/app-policy", "aws_iam_policy.this") in by_key
+    assert ("modules/app-role", "aws_iam_policy.this") not in by_key
+    assert ("modules/app-policy", "aws_iam_role.this") not in by_key
+
+
+def test_plan_module_resolution_does_not_guess_when_local_name_missing():
+    graph = {
+        "modules/app-role": ModuleGraphEntry(
+            callsites=["live/prod/app"],
+            callsite_local_names={
+                "live/prod/app": {
+                    "role": "modules/app-role",
+                }
+            },
+        ),
+    }
+    plan_hits = {
+        "live/prod/app": [
+            PlanHit(address="module.policy.aws_iam_policy.this",
+                    type="aws_iam_policy", action="create"),
+        ],
+    }
+
+    entries = build_catalog(plan_hits, diff_hits=[], module_graph=graph)
+
+    assert len(entries) == 1
+    assert entries[0].source_dir == "live/prod/app"
+    assert entries[0].local_address == "aws_iam_policy.this"
+
+
+def test_diff_only_module_fans_out_instances_to_callsites():
+    graph = {
+        "modules/app-role": ModuleGraphEntry(
+            callsites=["live/prod/app", "live/staging/app"],
+        )
+    }
+    diff_hits = [
+        DiffHit(source_dir="modules/app-role",
+                local_address="aws_iam_role.this", type="aws_iam_role"),
+    ]
+    entries = build_catalog(plan_hits={}, diff_hits=diff_hits, module_graph=graph)
+    assert len(entries) == 1
+    e = entries[0]
+    assert e.source == "diff"
+    assert {i.plan_dir for i in e.instances} == {"live/prod/app", "live/staging/app"}
+
+
+def test_diff_only_module_with_no_callsites_emits_one_instance():
+    diff_hits = [
+        DiffHit(source_dir="modules/lonely",
+                local_address="aws_iam_role.this", type="aws_iam_role"),
+    ]
+    entries = build_catalog(plan_hits={}, diff_hits=diff_hits, module_graph={})
+    assert len(entries) == 1
+    e = entries[0]
+    assert e.source == "diff"
+    assert len(e.instances) == 1
+    assert e.instances[0].plan_dir == "modules/lonely"

plugins/reviews/skills/audit-terraform/tests/test_cli.py

@@ -0,0 +1,421 @@
+import importlib.util
+import json
+import shutil
+import subprocess
+from pathlib import Path
+from unittest.mock import patch, MagicMock
+
+import pytest
+
+
+_SKILL_ROOT = Path(__file__).resolve().parent.parent
+
+
+def _load_cli():
+    spec = importlib.util.spec_from_file_location(
+        "collect_changes", _SKILL_ROOT / "scripts" / "collect-changes.py"
+    )
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+def _stage_fixture(dest: Path) -> Path:
+    src = _SKILL_ROOT / "tests" / "fixtures" / "tofu-sample"
+    shutil.copytree(src, dest)
+    return dest
+
+
+def _fake_subprocess(cmd, **kwargs):
+    if cmd[:2] == ["git", "-C"]:
+        sub = cmd[2:]
+    else:
+        sub = cmd
+
+    if "symbolic-ref" in sub:
+        return MagicMock(returncode=0, stdout="refs/remotes/origin/main\n", stderr="")
+    if "fetch" in sub:
+        return MagicMock(returncode=0, stdout="", stderr="")
+    if "rev-parse" in sub and "--verify" in sub:
+        return MagicMock(returncode=0, stdout="abc123\n", stderr="")
+    if cmd[:1] == ["git"] and "diff" in cmd:
+        diff = (
+            "diff --git a/main.tf b/main.tf\n"
+            "index 1..2 100644\n"
+            "--- a/main.tf\n"
+            "+++ b/main.tf\n"
+            "@@ -20,0 +21,1 @@\n"
+            "+  bucket_prefix = \"x\"\n"
+            "diff --git a/modules/widget/main.tf b/modules/widget/main.tf\n"
+            "index 3..4 100644\n"
+            "--- a/modules/widget/main.tf\n"
+            "+++ b/modules/widget/main.tf\n"
+            "@@ -1,0 +2,1 @@\n"
+            "+  # touched\n"
+        )
+        return MagicMock(returncode=0, stdout=diff, stderr="")
+    if cmd[0] == "tofu" and "init" in cmd:
+        return MagicMock(returncode=0, stdout="initialized\n", stderr="")
+    if cmd[0] == "tofu" and "plan" in cmd:
+        plan = (
+            "OpenTofu will perform the following actions:\n\n"
+            "  # null_resource.top will be updated in-place\n"
+            "  ~ resource \"null_resource\" \"top\" {}\n\n"
+            "  # module.widget_a.null_resource.thing will be updated in-place\n"
+            "  ~ resource \"null_resource\" \"thing\" {}\n\n"
+            "  # module.widget_b.null_resource.thing will be updated in-place\n"
+            "  ~ resource \"null_resource\" \"thing\" {}\n\n"
+            "Plan: 0 to add, 3 to change, 0 to destroy.\n"
+        )
+        return MagicMock(returncode=0, stdout=plan, stderr="")
+    if cmd[:3] == ["trivy", "config", "--quiet"]:
+        trivy = {
+            "SchemaVersion": 2,
+            "Results": [
+                {
+                    "Target": "main.tf",
+                    "Class": "config",
+                    "Type": "terraform",
+                    "Misconfigurations": [
+                        {
+                            "ID": "AVD-AWS-0089",
+                            "AVDID": "AVD-AWS-0089",
+                            "Title": "S3 bucket allows public ACL",
+                            "Description": "Buckets should not allow public ACLs.",
+                            "Message": "Bucket ACL allows public access.",
+                            "Severity": "HIGH",
+                            "CauseMetadata": {
+                                "Resource": "aws_s3_bucket.audit_logs",
+                                "StartLine": 21,
+                                "EndLine": 30,
+                            },
+                        }
+                    ],
+                }
+            ],
+        }
+        return MagicMock(returncode=0, stdout=json.dumps(trivy), stderr="")
+    return MagicMock(returncode=0, stdout="", stderr="")
+
+
+def test_cli_happy_path(tmp_path):
+    repo = _stage_fixture(tmp_path / "repo")
+    out_dir = tmp_path / "out"
+    mod = _load_cli()
+
+    with patch("subprocess.run", side_effect=_fake_subprocess):
+        rc = mod.main([
+            "--repo", str(repo),
+            "--base", "main",
+            "--head", "HEAD",
+            "--output-dir", str(out_dir),
+            "--mode", "local",
+        ])
+
+    assert rc == 0, (out_dir / "manifest.json").read_text()
+    manifest = json.loads((out_dir / "manifest.json").read_text())
+    assert manifest["mode"] == "local"
+    assert manifest["base_ref"] == "main"
+    assert set(manifest["changed_source_dirs"]) == {".", "modules/widget"}
+    plan_dirs = {pu["plan_dir"] for pu in manifest["plan_units"]}
+    assert plan_dirs == {"."}
+    pu = manifest["plan_units"][0]
+    assert pu["tool"] == "tofu"
+    assert pu["plan"]["summary"] == "0 to add, 3 to change, 0 to destroy"
+    catalog = manifest["catalog"]
+    keys = {(e["source_dir"], e["local_address"]) for e in catalog}
+    assert (".", "null_resource.top") in keys
+    assert ("modules/widget", "null_resource.thing") in keys
+    module_entries = [e for e in catalog if e["source_dir"] == "modules/widget"]
+    for e in module_entries:
+        plan_dirs = {i["plan_dir"] for i in e["instances"]}
+        assert plan_dirs == {"."}, e
+        addrs = {i["address_at_plan"] for i in e["instances"]}
+        assert any(a.startswith("module.widget_a") for a in addrs)
+        assert any(a.startswith("module.widget_b") for a in addrs)
+    for e in module_entries:
+        assert e["block_header"], f"missing block_header on {e}"
+        assert e["evidence_line"], f"missing evidence_line on {e}"
+        assert isinstance(e["key_attributes"], dict)
+        assert "review_context" in e
+        assert set(e["review_context"]) == {"variables", "locals", "related_blocks"}
+        assert e["block_file"].endswith(".tf")
+        assert e["block_start"] >= 1
+        assert "block_text" not in e
+    assert (out_dir / "trivy-findings.json").is_file()
+    assert manifest["trivy_findings"] == [
+        {
+            "check_id": "AVD-AWS-0089",
+            "title": "S3 bucket allows public ACL",
+            "severity": "high",
+            "message": "Bucket ACL allows public access.",
+            "file": "main.tf",
+            "start_line": 21,
+            "end_line": 30,
+            "resource_type": "aws_s3_bucket",
+            "source": "trivy",
+        }
+    ]
+    refs = json.loads((out_dir / "reference_sets.json").read_text())
+    assert "." in refs or "modules/widget" in refs
+
+
+def test_cli_writes_per_agent_slices(tmp_path):
+    repo = _stage_fixture(tmp_path / "repo")
+    out_dir = tmp_path / "out"
+    mod = _load_cli()
+    with patch("subprocess.run", side_effect=_fake_subprocess):
+        rc = mod.main([
+            "--repo", str(repo), "--base", "main", "--head", "HEAD",
+            "--output-dir", str(out_dir), "--mode", "local",
+        ])
+    assert rc == 0
+    full = json.loads((out_dir / "manifest.json").read_text())
+    for agent in ("fsbp", "cis", "aws-bp", "consistency"):
+        sliced = json.loads((out_dir / f"manifest-{agent}.json").read_text())
+        assert sliced["base_ref"] == full["base_ref"]
+        if agent in ("fsbp", "cis", "aws-bp"):
+            for entry in sliced["catalog"]:
+                assert entry["type"].startswith("aws_"), (
+                    f"non-aws type leaked into {agent}: {entry['type']}"
+                )
+            assert sliced["catalog"] == []
+            assert sliced["trivy_findings"] == full["trivy_findings"]
+        if agent == "consistency":
+            assert sliced["changed_source_dirs"] == full["changed_source_dirs"]
+            assert len(sliced["catalog"]) == len(full["catalog"])
+            assert sliced["trivy_findings"] == full["trivy_findings"]
+
+
+def test_cli_preserves_terragrunt_only_change_context(tmp_path):
+    repo = _stage_fixture(tmp_path / "repo")
+    terragrunt_dir = repo / "live" / "prod" / "app"
+    terragrunt_dir.mkdir(parents=True)
+    (terragrunt_dir / "terragrunt.hcl").write_text("inputs = { instance_count = 2 }\n")
+    out_dir = tmp_path / "out"
+    mod = _load_cli()
+
+    def _fake(cmd, **kw):
+        if cmd[:1] == ["git"] and "diff" in cmd:
+            diff = (
+                "diff --git a/live/prod/app/terragrunt.hcl b/live/prod/app/terragrunt.hcl\n"
+                "index 1..2 100644\n"
+                "--- a/live/prod/app/terragrunt.hcl\n"
+                "+++ b/live/prod/app/terragrunt.hcl\n"
+                "@@ -1 +1 @@\n"
+                "-inputs = { instance_count = 1 }\n"
+                "+inputs = { instance_count = 2 }\n"
+            )
+            return MagicMock(returncode=0, stdout=diff, stderr="")
+        if cmd[0] == "terragrunt" and "init" in cmd:
+            return MagicMock(returncode=0, stdout="initialized\n", stderr="")
+        if cmd[0] == "terragrunt" and "plan" in cmd:
+            plan = (
+                "OpenTofu will perform the following actions:\n\n"
+                "Plan: 0 to add, 0 to change, 0 to destroy.\n"
+            )
+            return MagicMock(returncode=0, stdout=plan, stderr="")
+        return _fake_subprocess(cmd, **kw)
+
+    with patch("subprocess.run", side_effect=_fake):
+        rc = mod.main([
+            "--repo", str(repo),
+            "--base", "main",
+            "--head", "HEAD",
+            "--output-dir", str(out_dir),
+            "--mode", "local",
+        ])
+
+    assert rc == 0, (out_dir / "manifest.json").read_text()
+    manifest = json.loads((out_dir / "manifest.json").read_text())
+    assert "live/prod/app" in manifest["changed_source_dirs"]
+    assert manifest["catalog"] == []
+    assert manifest["plan_units"] == [{
+        "plan_dir": "live/prod/app",
+        "tool": "terragrunt",
+        "init": {"ok": True, "stdout_tail": "initialized\n", "stderr_tail": ""},
+        "plan": {
+            "ok": True,
+            "stdout_path": str(out_dir / "plans" / "live_prod_app.txt"),
+            "exit_code": 0,
+            "summary": "0 to add, 0 to change, 0 to destroy",
+        },
+        "triggered_by": ["live/prod/app"],
+        "terragrunt_changed": True,
+        "changed_files": ["live/prod/app/terragrunt.hcl"],
+    }]
+    fsbp = json.loads((out_dir / "manifest-fsbp.json").read_text())
+    assert fsbp["plan_units"] == [{
+        "plan_dir": "live/prod/app",
+        "tool": "terragrunt",
+        "plan_ok": True,
+        "summary": "0 to add, 0 to change, 0 to destroy",
+        "terragrunt_changed": True,
+        "changed_files": ["live/prod/app/terragrunt.hcl"],
+    }]
+    consistency = json.loads((out_dir / "manifest-consistency.json").read_text())
+    assert consistency["plan_units"] == manifest["plan_units"]
+
+
+def test_cli_aborts_when_plan_fails(tmp_path):
+    repo = _stage_fixture(tmp_path / "repo")
+    out_dir = tmp_path / "out"
+    mod = _load_cli()
+
+    def _fake(cmd, **kw):
+        if cmd[0] == "tofu" and "plan" in cmd:
+            return MagicMock(
+                returncode=1,
+                stdout="Error: syntax error in main.tf\n",
+                stderr="",
+            )
+        return _fake_subprocess(cmd, **kw)
+
+    with patch("subprocess.run", side_effect=_fake):
+        rc = mod.main([
+            "--repo", str(repo),
+            "--base", "main",
+            "--head", "HEAD",
+            "--output-dir", str(out_dir),
+            "--mode", "local",
+        ])
+
+    assert rc == 1
+    manifest = json.loads((out_dir / "manifest.json").read_text())
+    assert any("syntax error" in e for e in manifest["errors"])
+
+
+def test_cli_records_git_diff_failure_in_manifest(tmp_path):
+    repo = _stage_fixture(tmp_path / "repo")
+    out_dir = tmp_path / "out"
+    mod = _load_cli()
+
+    def _fake(cmd, **kw):
+        if cmd[:1] == ["git"] and "diff" in cmd:
+            return MagicMock(returncode=128, stdout="",
+                             stderr="fatal: bad revision 'main...HEAD'\n")
+        return _fake_subprocess(cmd, **kw)
+
+    with patch("subprocess.run", side_effect=_fake):
+        rc = mod.main([
+            "--repo", str(repo),
+            "--base", "main",
+            "--head", "HEAD",
+            "--output-dir", str(out_dir),
+            "--mode", "local",
+        ])
+
+    assert rc == 1
+    manifest = json.loads((out_dir / "manifest.json").read_text())
+    assert any("bad revision" in e for e in manifest["errors"])
+
+
+def test_cli_auto_resolves_base_to_origin(tmp_path):
+    """With no --base, the CLI fetches and diffs against origin/<default>."""
+    repo = _stage_fixture(tmp_path / "repo")
+    out_dir = tmp_path / "out"
+    mod = _load_cli()
+
+    captured_diff_base: list[str] = []
+
+    def _fake(cmd, **kw):
+        if cmd[:1] == ["git"] and "diff" in cmd:
+            for arg in cmd:
+                if "..." in arg:
+                    captured_diff_base.append(arg)
+        return _fake_subprocess(cmd, **kw)
+
+    with patch("subprocess.run", side_effect=_fake):
+        rc = mod.main([
+            "--repo", str(repo),
+            "--head", "HEAD",
+            "--output-dir", str(out_dir),
+            "--mode", "local",
+        ])
+
+    assert rc == 0
+    assert captured_diff_base, "git diff was never invoked"
+    assert captured_diff_base[0].startswith("origin/main..."), (
+        f"diff base should be origin/<default>, got: {captured_diff_base[0]}"
+    )
+    manifest = json.loads((out_dir / "manifest.json").read_text())
+    assert manifest["base_ref"] == "origin/main"
+
+
+def test_cli_falls_back_to_local_branch_when_origin_missing(tmp_path):
+    """If origin/<default> doesn't exist (no remote, fetch fails), fall back."""
+    repo = _stage_fixture(tmp_path / "repo")
+    out_dir = tmp_path / "out"
+    mod = _load_cli()
+
+    def _fake(cmd, **kw):
+        if cmd[:2] == ["git", "-C"]:
+            sub = cmd[2:]
+        else:
+            sub = cmd
+        if "rev-parse" in sub and "--verify" in sub:
+            return MagicMock(returncode=1, stdout="", stderr="fatal: unknown revision\n")
+        return _fake_subprocess(cmd, **kw)
+
+    with patch("subprocess.run", side_effect=_fake):
+        rc = mod.main([
+            "--repo", str(repo),
+            "--head", "HEAD",
+            "--output-dir", str(out_dir),
+            "--mode", "local",
+        ])
+
+    assert rc == 0
+    manifest = json.loads((out_dir / "manifest.json").read_text())
+    assert manifest["base_ref"] == "main"
+
+
+def _has_tofu() -> bool:
+    from shutil import which
+    return which("tofu") is not None
+
+
+@pytest.mark.integration
+@pytest.mark.skipif(not _has_tofu(), reason="tofu not installed")
+def test_cli_real_tofu_plan(tmp_path, monkeypatch):
+    repo = _stage_fixture(tmp_path / "repo")
+    subprocess.run(["git", "init", "-q", str(repo)], check=True)
+    subprocess.run(["git", "-C", str(repo), "checkout", "-qb", "main"], check=True)
+    subprocess.run(["git", "-C", str(repo), "add", "-A"], check=True)
+    subprocess.run(
+        ["git", "-C", str(repo), "-c", "user.email=t@t", "-c", "user.name=t",
+         "commit", "-qm", "init"], check=True,
+    )
+    subprocess.run(["git", "-C", str(repo), "checkout", "-qb", "feature"], check=True)
+    main_tf = repo / "main.tf"
+    main_tf.write_text(main_tf.read_text() + "\n# touched\n")
+    subprocess.run(["git", "-C", str(repo), "add", "-A"], check=True)
+    subprocess.run(
+        ["git", "-C", str(repo), "-c", "user.email=t@t", "-c", "user.name=t",
+         "commit", "-qm", "touch"], check=True,
+    )
+
+    out_dir = tmp_path / "out"
+    plugin_cache = tmp_path / "plugin-cache"
+    plugin_cache.mkdir()
+    monkeypatch.setenv("TF_PLUGIN_CACHE_DIR", str(plugin_cache))
+    monkeypatch.setenv("TF_IN_AUTOMATION", "1")
+
+    mod = _load_cli()
+    rc = mod.main([
+        "--repo", str(repo),
+        "--base", "main",
+        "--head", "HEAD",
+        "--output-dir", str(out_dir),
+        "--mode", "local",
+    ])
+
+    manifest = json.loads((out_dir / "manifest.json").read_text())
+    assert manifest["plan_units"], (
+        f"no plan unit recorded; errors={manifest.get('errors')}"
+    )
+    pu = manifest["plan_units"][0]
+    assert pu["tool"] == "tofu"
+    assert pu["init"]["ok"] is True, pu["init"]
+    assert pu["plan"]["ok"] is True, pu["plan"]
+    assert rc == 0

plugins/reviews/skills/audit-terraform/tests/test_consistency_norms.py

@@ -0,0 +1,56 @@
+from pathlib import Path
+
+from scripts.reference_set import compute_consistency_norms
+
+
+def _write(path: Path, body: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(body)
+
+
+def test_norms_capture_repeated_attribute_presence(tmp_path):
+    _write(tmp_path / "live/prod/app/main.tf", "")
+    _write(tmp_path / "live/staging/app/main.tf", 'kms_key_arn = "a"\n')
+    _write(tmp_path / "live/dev/app/main.tf", 'kms_key_arn = "b"\n')
+    _write(tmp_path / "live/qa/app/main.tf", 'kms_key_arn = "c"\n')
+
+    norms = compute_consistency_norms(tmp_path, {
+        "live/prod/app": ["live/staging/app", "live/dev/app", "live/qa/app"],
+    })
+
+    assert norms["live/prod/app"]["attribute_norms"] == [
+        {
+            "attribute": "kms_key_arn",
+            "peer_dirs": ["live/dev/app", "live/qa/app", "live/staging/app"],
+        }
+    ]
+
+
+def test_norms_ignore_one_off_patterns(tmp_path):
+    _write(tmp_path / "envs/prod/main.tf", "")
+    _write(tmp_path / "envs/staging/main.tf", 'bucket_key_enabled = true\n')
+    _write(tmp_path / "envs/dev/main.tf", 'kms_key_arn = "b"\n')
+
+    norms = compute_consistency_norms(tmp_path, {
+        "envs/prod": ["envs/staging", "envs/dev"],
+    })
+
+    assert norms["envs/prod"]["attribute_norms"] == []
+
+
+def test_norms_capture_repeated_module_wrappers(tmp_path):
+    _write(tmp_path / "modules/app-role/main.tf", "")
+    _write(tmp_path / "refs/one/main.tf", 'module "iam-policy-doc" {\n  source = "../../modules/iam-policy-doc"\n}\n')
+    _write(tmp_path / "refs/two/main.tf", 'module "iam-policy-doc" {\n  source = "../../modules/iam-policy-doc"\n}\n')
+    _write(tmp_path / "refs/three/main.tf", 'module "other" {\n  source = "../../modules/other"\n}\n')
+
+    norms = compute_consistency_norms(tmp_path, {
+        "modules/app-role": ["refs/one", "refs/two", "refs/three"],
+    })
+
+    assert norms["modules/app-role"]["module_wrapper_norms"] == [
+        {
+            "module": "iam-policy-doc",
+            "peer_dirs": ["refs/one", "refs/two"],
+        }
+    ]

plugins/reviews/skills/audit-terraform/tests/test_controls_schema.py

@@ -0,0 +1,58 @@
+import json
+from datetime import datetime, timezone
+
+from scripts.controls_schema import Control, ControlsFile
+
+
+def test_controls_file_serializes_with_resource_type_index():
+    a = Control(
+        control_id="FSBP S3.5",
+        title="S3 buckets should require requests to use SSL",
+        severity="medium",
+        resource_types=["aws_s3_bucket"],
+        requirement="The bucket policy must include a deny statement for "
+                    "non-TLS access (aws:SecureTransport = false).",
+        source_url="https://docs.aws.amazon.com/securityhub/.../S3.5",
+    )
+    b = Control(
+        control_id="FSBP IAM.5",
+        title="MFA should be enabled for IAM users",
+        severity="medium",
+        resource_types=["aws_iam_user"],
+        requirement="IAM users with console access must have MFA.",
+        source_url="https://docs.aws.amazon.com/securityhub/.../IAM.5",
+    )
+    cf = ControlsFile(
+        source="fsbp",
+        fetched_at=datetime(2026, 5, 12, 9, 0, 0, tzinfo=timezone.utc),
+        controls=[a, b],
+    )
+    payload = json.loads(cf.to_json())
+    assert payload["source"] == "fsbp"
+    assert payload["fetched_at"].endswith("+00:00") or payload["fetched_at"].endswith("Z")
+
+    by_rtype = payload["by_resource_type"]
+    assert "aws_s3_bucket" in by_rtype
+    assert by_rtype["aws_s3_bucket"] == ["FSBP S3.5"]
+    assert "aws_iam_user" in by_rtype
+    assert by_rtype["aws_iam_user"] == ["FSBP IAM.5"]
+
+    ids = {c["control_id"] for c in payload["controls"]}
+    assert ids == {"FSBP S3.5", "FSBP IAM.5"}
+
+
+def test_control_appears_under_every_resource_type():
+    c = Control(
+        control_id="FSBP X.1",
+        title="t", severity="low",
+        resource_types=["aws_s3_bucket", "aws_s3_bucket_policy"],
+        requirement="r", source_url="u",
+    )
+    cf = ControlsFile(
+        source="fsbp",
+        fetched_at=datetime(2026, 5, 12, tzinfo=timezone.utc),
+        controls=[c],
+    )
+    payload = json.loads(cf.to_json())
+    assert payload["by_resource_type"]["aws_s3_bucket"] == ["FSBP X.1"]
+    assert payload["by_resource_type"]["aws_s3_bucket_policy"] == ["FSBP X.1"]

plugins/reviews/skills/audit-terraform/tests/test_effective_context.py

@@ -0,0 +1,71 @@
+from pathlib import Path
+
+from scripts.source_lookup import find_block
+
+
+def _write(path: Path, body: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(body)
+
+
+def test_review_context_collects_variables_and_locals(tmp_path):
+    _write(tmp_path / "main.tf", """
+resource "aws_s3_bucket" "logs" {
+  kms_key_id = var.kms_key_id
+  acl        = local.bucket_acl
+}
+""".strip() + "\n")
+    _write(tmp_path / "variables.tf", """
+variable "kms_key_id" {
+  default = "alias/logs"
+}
+""".strip() + "\n")
+    _write(tmp_path / "locals.tf", """
+locals {
+  bucket_acl = "private"
+}
+""".strip() + "\n")
+
+    block = find_block(tmp_path, "aws_s3_bucket.logs")
+    assert block is not None
+    assert block.review_context["variables"] == {"kms_key_id": "alias/logs"}
+    assert block.review_context["locals"] == {"bucket_acl": "private"}
+
+
+def test_review_context_collects_related_policy_docs(tmp_path):
+    _write(tmp_path / "main.tf", """
+data "aws_iam_policy_document" "bucket" {
+  statement {
+    actions = ["s3:GetObject"]
+  }
+}
+
+resource "aws_iam_policy" "bucket" {
+  policy = data.aws_iam_policy_document.bucket.json
+}
+""".strip() + "\n")
+
+    block = find_block(tmp_path, "aws_iam_policy.bucket")
+    assert block is not None
+    assert block.review_context["related_blocks"] == [
+        'data "aws_iam_policy_document" "bucket" {'
+    ]
+
+
+def test_review_context_collects_related_security_group_rules(tmp_path):
+    _write(tmp_path / "main.tf", """
+resource "aws_security_group" "app" {
+  name = "app"
+}
+
+resource "aws_security_group_rule" "ingress_https" {
+  type              = "ingress"
+  security_group_id = aws_security_group.app.id
+}
+""".strip() + "\n")
+
+    block = find_block(tmp_path, "aws_security_group.app")
+    assert block is not None
+    assert block.review_context["related_blocks"] == [
+        'resource "aws_security_group_rule" "ingress_https" {'
+    ]

plugins/reviews/skills/audit-terraform/tests/test_git_diff.py

@@ -0,0 +1,63 @@
+from unittest.mock import patch
+from scripts.git_diff import changed_files, changed_dirs, changed_line_ranges
+
+
+_DIFF = """\
+diff --git a/live/prod/app/main.tf b/live/prod/app/main.tf
+index abc..def 100644
+--- a/live/prod/app/main.tf
++++ b/live/prod/app/main.tf
+@@ -12 +12,2 @@
+-  acl = "old"
++  acl = "new"
++  versioning = true
+diff --git a/modules/app-role/main.tf b/modules/app-role/main.tf
+index 111..222 100644
+--- a/modules/app-role/main.tf
++++ b/modules/app-role/main.tf
+@@ -5,0 +6,2 @@
++  name = "x"
++  assume_role_policy = "..."
+diff --git a/README.md b/README.md
+index 333..444 100644
+--- a/README.md
++++ b/README.md
+@@ -1 +1 @@
+-old
++new
+"""
+
+
+def _fake_run(args, **kwargs):
+    class R:
+        returncode = 0
+        stdout = _DIFF
+        stderr = ""
+    return R()
+
+
+def test_changed_files_filters_tf_hcl():
+    with patch("subprocess.run", side_effect=_fake_run):
+        files = changed_files("/repo", "main", "HEAD")
+    assert "live/prod/app/main.tf" in files
+    assert "modules/app-role/main.tf" in files
+    assert "README.md" not in files
+
+
+def test_changed_dirs_dedupes():
+    with patch("subprocess.run", side_effect=_fake_run):
+        dirs = changed_dirs("/repo", "main", "HEAD")
+    assert dirs == {"live/prod/app", "modules/app-role"}
+
+
+def test_changed_line_ranges_parses_hunks():
+    with patch("subprocess.run", side_effect=_fake_run):
+        ranges = changed_line_ranges("/repo", "main", "HEAD",
+                                     "live/prod/app/main.tf")
+    assert ranges == [(12, 13)]
+
+
+def test_changed_line_ranges_unknown_file():
+    with patch("subprocess.run", side_effect=_fake_run):
+        ranges = changed_line_ranges("/repo", "main", "HEAD", "no/such.tf")
+    assert ranges == []

plugins/reviews/skills/audit-terraform/tests/test_hcl_diff.py

@@ -0,0 +1,65 @@
+import textwrap
+
+from scripts.hcl_diff import find_resource_blocks, touched_resources
+
+
+def test_finds_resource_block_spans(tmp_path):
+    body = textwrap.dedent("""\
+    variable "x" { default = 1 }
+
+    resource "aws_s3_bucket" "a" {
+      bucket = "x"
+    }
+
+    resource "aws_iam_role" "b" {
+      name = "y"
+      assume_role_policy = "..."
+    }
+    """)
+    f = tmp_path / "main.tf"
+    f.write_text(body)
+    blocks = find_resource_blocks(f)
+    by_name = {b.name: b for b in blocks}
+    assert by_name["a"].type == "aws_s3_bucket"
+    assert by_name["a"].start <= 3 <= by_name["a"].end
+    assert by_name["b"].type == "aws_iam_role"
+    assert by_name["b"].start <= 7 <= by_name["b"].end
+
+
+def test_touched_resources_intersects(tmp_path):
+    body = textwrap.dedent("""\
+    resource "aws_s3_bucket" "a" {
+      bucket = "x"
+    }
+
+    resource "aws_iam_role" "b" {
+      name = "y"
+    }
+    """)
+    f = tmp_path / "main.tf"
+    f.write_text(body)
+    hits = touched_resources(f, added_ranges=[(6, 6)])
+    assert len(hits) == 1
+    assert hits[0].type == "aws_iam_role"
+    assert hits[0].name == "b"
+
+
+def test_touched_resources_ignores_data_blocks(tmp_path):
+    body = textwrap.dedent("""\
+    data "aws_caller_identity" "current" {}
+    """)
+    f = tmp_path / "main.tf"
+    f.write_text(body)
+    hits = touched_resources(f, added_ranges=[(1, 1)])
+    assert hits == []
+
+
+def test_touched_resources_empty_when_no_overlap(tmp_path):
+    body = textwrap.dedent("""\
+    resource "aws_s3_bucket" "a" {
+      bucket = "x"
+    }
+    """)
+    f = tmp_path / "main.tf"
+    f.write_text(body)
+    assert touched_resources(f, added_ranges=[(10, 12)]) == []

plugins/reviews/skills/audit-terraform/tests/test_log_run.py

@@ -0,0 +1,93 @@
+"""Tests for scripts/log-run.py."""
+from __future__ import annotations
+
+import importlib.util
+import json
+from pathlib import Path
+
+_SPEC = importlib.util.spec_from_file_location(
+    "log_run",
+    Path(__file__).parent.parent / "scripts" / "log-run.py",
+)
+log_run = importlib.util.module_from_spec(_SPEC)
+_SPEC.loader.exec_module(log_run)
+
+
+def _write_usage(tmp_path: Path, usage: dict) -> Path:
+    p = tmp_path / "usage.json"
+    p.write_text(json.dumps(usage), encoding="utf-8")
+    return p
+
+
+def _read_log(log: Path) -> list[dict]:
+    return [json.loads(line) for line in log.read_text(encoding="utf-8").splitlines() if line.strip()]
+
+
+def test_writes_one_row_per_agent_with_finding_counts(tmp_path: Path) -> None:
+    output = tmp_path / "out"
+    output.mkdir()
+    (output / "findings-aws-bp-reviewer.json").write_text(
+        json.dumps({"findings": [{"resource": "r1", "control": "c1"}]}),
+        encoding="utf-8",
+    )
+    (output / "findings-walkthrough-reviewer.json").write_text(
+        json.dumps({"overview": "x", "plan_units": []}),
+        encoding="utf-8",
+    )
+
+    log = tmp_path / "runs.jsonl"
+    usage = _write_usage(tmp_path, {
+        "aws-bp-reviewer":     {"model": "sonnet", "input_tokens": 100,
+                                "output_tokens": 50, "duration_ms": 1234},
+        "walkthrough-reviewer": {"model": "sonnet", "input_tokens": 200,
+                                "output_tokens": 80, "duration_ms": 4321},
+    })
+
+    rc = log_run.main([
+        "--output-dir", str(output), "--run-id", "abc",
+        "--repo", "/tmp/repo", "--mode", "local",
+        "--log-path", str(log), "--usage-json", str(usage),
+    ])
+    assert rc == 0
+
+    rows = _read_log(log)
+    assert len(rows) == 2
+
+    by_agent = {r["agent"]: r for r in rows}
+    assert by_agent["aws-bp-reviewer"]["finding_count"] == 1
+    assert by_agent["walkthrough-reviewer"]["finding_count"] == 0
+
+
+def test_missing_findings_file_counts_zero(tmp_path: Path) -> None:
+    output = tmp_path / "out"
+    output.mkdir()
+    log = tmp_path / "runs.jsonl"
+    usage = _write_usage(tmp_path, {
+        "phantom-reviewer": {"model": "sonnet", "input_tokens": 0,
+                             "output_tokens": 0, "duration_ms": 0},
+    })
+
+    rc = log_run.main([
+        "--output-dir", str(output), "--run-id", "x", "--repo", "/r",
+        "--mode", "ref", "--log-path", str(log), "--usage-json", str(usage),
+    ])
+    assert rc == 0
+    assert _read_log(log)[0]["finding_count"] == 0
+
+
+def test_malformed_findings_file_counts_zero(tmp_path: Path) -> None:
+    output = tmp_path / "out"
+    output.mkdir()
+    (output / "findings-broken-reviewer.json").write_text("{bad", encoding="utf-8")
+    log = tmp_path / "runs.jsonl"
+    usage = _write_usage(tmp_path, {
+        "broken-reviewer": {"model": "haiku", "input_tokens": 10,
+                            "output_tokens": 5, "duration_ms": 100},
+    })
+
+    rc = log_run.main([
+        "--output-dir", str(output), "--run-id", "x", "--repo", "/r",
+        "--mode", "local", "--log-path", str(log), "--usage-json", str(usage),
+    ])
+    assert rc == 0
+    assert _read_log(log)[0]["finding_count"] == 0

plugins/reviews/skills/audit-terraform/tests/test_manifest.py

@@ -0,0 +1,127 @@
+import json
+from scripts.manifest import (
+    Manifest, PlanUnit, PlanResult, InitResult, CatalogEntry, ModuleGraphEntry,
+    TrivyFinding,
+)
+
+
+def test_roundtrip_minimal():
+    m = Manifest(
+        base_ref="main",
+        head_ref="feat/x",
+        mode="local",
+        default_branch="main",
+        changed_source_dirs=[],
+        plan_units=[],
+        catalog=[],
+        trivy_findings=[],
+        module_graph={},
+        errors=[],
+    )
+    payload = json.loads(m.to_json())
+    assert payload["base_ref"] == "main"
+    assert payload["mode"] == "local"
+    assert payload["plan_units"] == []
+
+
+def test_catalog_entry_required_fields():
+    from scripts.manifest import CatalogInstance
+    entry = CatalogEntry(
+        source_dir="live/prod/audit",
+        local_address="aws_s3_bucket.audit_logs",
+        type="aws_s3_bucket",
+        source="both",
+        instances=[CatalogInstance(
+            plan_dir="live/prod/audit",
+            address_at_plan="aws_s3_bucket.audit_logs",
+            action="create",
+        )],
+        block_header='resource "aws_s3_bucket" "audit_logs" {',
+        evidence_line='acl = "private"',
+        key_attributes={"acl": "private"},
+        review_context={"variables": {}, "locals": {}, "related_blocks": []},
+        block_file="main.tf",
+        block_start=1,
+        block_end=3,
+    )
+    d = entry.to_dict()
+    assert d["source"] == "both"
+    assert d["type"] == "aws_s3_bucket"
+    assert d["instances"][0]["plan_dir"] == "live/prod/audit"
+    assert d["block_header"].startswith('resource')
+    assert d["evidence_line"] == 'acl = "private"'
+    assert d["key_attributes"] == {"acl": "private"}
+    assert d["review_context"] == {"variables": {}, "locals": {}, "related_blocks": []}
+
+
+def test_plan_unit_serializes_triggered_by():
+    pu = PlanUnit(
+        plan_dir="live/prod/app",
+        tool="terragrunt",
+        init=InitResult(ok=True, stdout_tail="ok", stderr_tail=""),
+        plan=PlanResult(ok=True, stdout_path="/tmp/x", exit_code=0,
+                        summary="1 to add, 0 to change, 0 to destroy"),
+        triggered_by=["modules/app-role"],
+        terragrunt_changed=True,
+        changed_files=["live/prod/app/terragrunt.hcl"],
+    )
+    d = pu.to_dict()
+    assert d["tool"] == "terragrunt"
+    assert d["triggered_by"] == ["modules/app-role"]
+    assert d["init"]["ok"] is True
+    assert d["plan"]["exit_code"] == 0
+    assert d["terragrunt_changed"] is True
+    assert d["changed_files"] == ["live/prod/app/terragrunt.hcl"]
+
+
+def test_trivy_findings_serialize():
+    finding = TrivyFinding(
+        check_id="AVD-AWS-0089",
+        title="S3 bucket allows public ACL",
+        severity="high",
+        message="Bucket ACL allows public access.",
+        file="main.tf",
+        start_line=21,
+        end_line=30,
+        resource_type="aws_s3_bucket",
+    )
+    assert finding.to_dict() == {
+        "check_id": "AVD-AWS-0089",
+        "title": "S3 bucket allows public ACL",
+        "severity": "high",
+        "message": "Bucket ACL allows public access.",
+        "file": "main.tf",
+        "start_line": 21,
+        "end_line": 30,
+        "resource_type": "aws_s3_bucket",
+        "source": "trivy",
+    }
+
+
+def test_module_graph_serializes():
+    g = {
+        "modules/app-role": ModuleGraphEntry(
+            callsites=["live/prod/app", "live/staging/app"],
+            sibling_modules_at_callsites=["modules/iam-policy-doc"],
+        )
+    }
+    findings = [
+        TrivyFinding(
+            check_id="AVD-AWS-0089",
+            title="S3 bucket allows public ACL",
+            severity="high",
+            message="Bucket ACL allows public access.",
+            file="main.tf",
+            resource_type="aws_s3_bucket",
+        )
+    ]
+    m = Manifest(
+        base_ref="main", head_ref="x", mode="local", default_branch="main",
+        changed_source_dirs=[], plan_units=[], catalog=[], trivy_findings=findings,
+        module_graph=g, errors=[],
+    )
+    payload = json.loads(m.to_json())
+    assert payload["module_graph"]["modules/app-role"]["callsites"] == [
+        "live/prod/app", "live/staging/app",
+    ]
+    assert payload["trivy_findings"][0]["check_id"] == "AVD-AWS-0089"

plugins/reviews/skills/audit-terraform/tests/test_manifest_tflint.py

@@ -0,0 +1,33 @@
+from scripts.manifest import Manifest, TflintFinding
+
+
+def test_tflint_finding_to_dict():
+    f = TflintFinding(
+        rule="terraform_unused_declarations",
+        severity="warning",
+        message="variable \"foo\" is declared but not used",
+        file="modules/vpc/variables.tf",
+        start_line=12,
+        end_line=12,
+        link="https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.14.1/docs/rules/terraform_unused_declarations.md",
+    )
+    d = f.to_dict()
+    assert d["rule"] == "terraform_unused_declarations"
+    assert d["source"] == "tflint"
+
+
+def test_manifest_carries_tflint_findings():
+    m = Manifest(
+        base_ref="main", head_ref="HEAD", mode="local",
+        default_branch="main", changed_source_dirs=[],
+        plan_units=[], catalog=[], trivy_findings=[],
+        tflint_findings=[TflintFinding(
+            rule="terraform_required_version", severity="warning",
+            message="missing required_version", file="main.tf",
+        )],
+        module_graph={}, errors=[],
+    )
+    d = m.to_dict()
+    assert len(d["tflint_findings"]) == 1
+    assert d["tflint_findings"][0]["rule"] == "terraform_required_version"
+    assert d["tflint_findings"][0]["source"] == "tflint"

plugins/reviews/skills/audit-terraform/tests/test_module_graph.py

@@ -0,0 +1,84 @@
+from pathlib import Path
+
+from scripts.module_graph import build_module_graph
+
+
+def _write(p: Path, body: str) -> None:
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(body)
+
+
+def test_resolves_relative_source(tmp_path):
+    _write(tmp_path / "modules/app-role/main.tf",
+           'resource "aws_iam_role" "this" {}\n')
+    _write(tmp_path / "live/prod/app/main.tf", '''
+module "app_role" {
+  source = "../../../modules/app-role"
+}
+''')
+    g = build_module_graph(tmp_path)
+    assert g["modules/app-role"].callsites == ["live/prod/app"]
+
+
+def test_multiple_callsites_sorted(tmp_path):
+    _write(tmp_path / "modules/app-role/main.tf", "resource \"x\" \"y\" {}\n")
+    _write(tmp_path / "live/staging/app/main.tf",
+           'module "r" { source = "../../../modules/app-role" }\n')
+    _write(tmp_path / "live/prod/app/main.tf",
+           'module "r" { source = "../../../modules/app-role" }\n')
+    g = build_module_graph(tmp_path)
+    assert g["modules/app-role"].callsites == [
+        "live/prod/app", "live/staging/app",
+    ]
+
+
+def test_ignores_registry_and_git_sources(tmp_path):
+    _write(tmp_path / "live/prod/app/main.tf", '''
+module "vpc"   { source = "terraform-aws-modules/vpc/aws" }
+module "other" { source = "git::https://example.com/x.git" }
+''')
+    g = build_module_graph(tmp_path)
+    assert g == {}
+
+
+def test_siblings_at_callsites_collected(tmp_path):
+    _write(tmp_path / "modules/app-role/main.tf", "resource \"x\" \"y\" {}\n")
+    _write(tmp_path / "modules/iam-policy-doc/main.tf",
+           "resource \"x\" \"y\" {}\n")
+    _write(tmp_path / "live/prod/app/main.tf", '''
+module "role"   { source = "../../../modules/app-role" }
+module "policy" { source = "../../../modules/iam-policy-doc" }
+''')
+    g = build_module_graph(tmp_path)
+    assert g["modules/app-role"].callsites == ["live/prod/app"]
+    assert "modules/iam-policy-doc" in g["modules/app-role"].sibling_modules_at_callsites
+
+
+def test_callsite_local_names_track_sibling_modules(tmp_path):
+    _write(tmp_path / "modules/app-role/main.tf", 'resource "aws_iam_role" "this" {}\n')
+    _write(tmp_path / "modules/app-policy/main.tf",
+           'resource "aws_iam_policy" "this" {}\n')
+    _write(tmp_path / "live/prod/app/main.tf", '''
+module "role" {
+  source = "../../../modules/app-role"
+}
+
+module "policy" {
+  source = "../../../modules/app-policy"
+}
+''')
+
+    g = build_module_graph(tmp_path)
+
+    assert g["modules/app-role"].callsite_local_names == {
+        "live/prod/app": {
+            "policy": "modules/app-policy",
+            "role": "modules/app-role",
+        }
+    }
+    assert g["modules/app-policy"].callsite_local_names == {
+        "live/prod/app": {
+            "policy": "modules/app-policy",
+            "role": "modules/app-role",
+        }
+    }

plugins/reviews/skills/audit-terraform/tests/test_plan_output.py

@@ -0,0 +1,39 @@
+from pathlib import Path
+
+from scripts.plan_output import parse_plan_resources
+
+
+FIXTURE = Path(__file__).parent / "fixtures" / "plan_output_tofu.txt"
+
+
+def test_parses_create_update_destroy_replace():
+    txt = FIXTURE.read_text()
+    resources = parse_plan_resources(txt)
+    by_addr = {r.address: r for r in resources}
+
+    assert by_addr["aws_s3_bucket.audit_logs"].action == "create"
+    assert by_addr["aws_s3_bucket.audit_logs"].type == "aws_s3_bucket"
+
+    assert by_addr["module.app_role.aws_iam_role.this"].action == "update"
+    assert by_addr["module.app_role.aws_iam_role.this"].type == "aws_iam_role"
+
+    assert by_addr["aws_security_group.legacy"].action == "delete"
+    assert by_addr["aws_iam_user.svc"].action == "replace"
+
+
+def test_empty_when_no_changes():
+    txt = "No changes. Your infrastructure matches the configuration.\n"
+    assert parse_plan_resources(txt) == []
+
+
+def test_type_for_data_source():
+    txt = """\
+  # data.aws_caller_identity.current will be read during apply
+ <= data "aws_caller_identity" "current" {
+    }
+"""
+    out = parse_plan_resources(txt)
+    assert len(out) == 1
+    assert out[0].action == "read"
+    assert out[0].type == "aws_caller_identity"
+    assert out[0].address == "data.aws_caller_identity.current"

plugins/reviews/skills/audit-terraform/tests/test_plan_runner.py

@@ -0,0 +1,67 @@
+from unittest.mock import patch, MagicMock
+
+from scripts.plan_runner import detect_tool, run_init, run_plan, extract_summary
+
+
+def test_detect_tool_terragrunt(tmp_path):
+    (tmp_path / "terragrunt.hcl").write_text("# tg\n")
+    assert detect_tool(tmp_path) == "terragrunt"
+
+
+def test_detect_tool_tofu(tmp_path):
+    (tmp_path / "main.tf").write_text("# tf\n")
+    assert detect_tool(tmp_path) == "tofu"
+
+
+def test_extract_summary_finds_plan_line():
+    output = """\
+Terraform will perform the following actions:
+
+  # aws_s3_bucket.x will be created
+  + resource "aws_s3_bucket" "x" {
+      bucket = "y"
+    }
+
+Plan: 1 to add, 0 to change, 0 to destroy.
+"""
+    assert extract_summary(output) == "1 to add, 0 to change, 0 to destroy"
+
+
+def test_extract_summary_no_changes():
+    output = "No changes. Your infrastructure matches the configuration.\n"
+    assert extract_summary(output) == "no changes"
+
+
+def test_run_init_ok(tmp_path):
+    (tmp_path / "main.tf").write_text("# tf\n")
+    fake = MagicMock(returncode=0, stdout="Initializing...\nok\n", stderr="")
+    with patch("subprocess.run", return_value=fake) as p:
+        result = run_init(tmp_path, "tofu")
+    assert result.ok is True
+    assert "ok" in result.stdout_tail
+    p.assert_called_once()
+    args = p.call_args[0][0]
+    assert args[0] == "tofu"
+    assert "init" in args
+
+
+def test_run_init_failure_records_stderr(tmp_path):
+    (tmp_path / "main.tf").write_text("# tf\n")
+    fake = MagicMock(returncode=1, stdout="", stderr="provider not found\n")
+    with patch("subprocess.run", return_value=fake):
+        result = run_init(tmp_path, "tofu")
+    assert result.ok is False
+    assert "provider not found" in result.stderr_tail
+
+
+def test_run_plan_streams_to_file(tmp_path):
+    out_path = tmp_path / "plan.txt"
+    fake = MagicMock(returncode=0,
+                     stdout="Plan: 2 to add, 0 to change, 0 to destroy.\n",
+                     stderr="")
+    with patch("subprocess.run", return_value=fake):
+        result = run_plan(tmp_path, "tofu", out_path)
+    assert result.ok is True
+    assert result.exit_code == 0
+    assert result.summary == "2 to add, 0 to change, 0 to destroy"
+    assert out_path.read_text().endswith("0 to destroy.\n")

plugins/reviews/skills/audit-terraform/tests/test_plan_unit.py

@@ -0,0 +1,49 @@
+from pathlib import Path
+import pytest
+
+from scripts.plan_unit import classify_dir, DirKind
+
+
+def _write(p: Path, body: str) -> None:
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(body)
+
+
+def test_terragrunt_hcl_marks_plan_unit(tmp_path):
+    _write(tmp_path / "live/prod/app/terragrunt.hcl", 'include "root" { path = "x" }\n')
+    assert classify_dir(tmp_path, "live/prod/app") == DirKind.PLAN_UNIT
+
+
+def test_tf_with_backend_block_marks_plan_unit(tmp_path):
+    body = '''
+terraform {
+  required_version = ">= 1.5"
+  backend "s3" {
+    bucket = "x"
+    key    = "y"
+    region = "us-east-1"
+  }
+}
+'''
+    _write(tmp_path / "live/prod/app/main.tf", body)
+    assert classify_dir(tmp_path, "live/prod/app") == DirKind.PLAN_UNIT
+
+
+def test_tf_without_backend_marks_module(tmp_path):
+    body = '''
+resource "aws_iam_role" "this" {
+  name = var.name
+}
+'''
+    _write(tmp_path / "modules/app-role/main.tf", body)
+    assert classify_dir(tmp_path, "modules/app-role") == DirKind.MODULE
+
+
+def test_no_hcl_files_marks_unknown(tmp_path):
+    _write(tmp_path / "docs/readme.md", "hi")
+    assert classify_dir(tmp_path, "docs") == DirKind.UNKNOWN
+
+
+def test_missing_dir_raises(tmp_path):
+    with pytest.raises(FileNotFoundError):
+        classify_dir(tmp_path, "nope")

plugins/reviews/skills/audit-terraform/tests/test_reference_set.py

@@ -0,0 +1,72 @@
+from pathlib import Path
+
+from scripts.reference_set import compute_consistency_norms, compute_reference_sets
+from scripts.manifest import ModuleGraphEntry
+
+
+def _touch(p: Path) -> None:
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text("")
+
+
+def test_module_change_uses_sibling_modules(tmp_path):
+    _touch(tmp_path / "modules/app-role/main.tf")
+    _touch(tmp_path / "modules/iam-policy-doc/main.tf")
+    _touch(tmp_path / "modules/eks-cluster/main.tf")
+    graph = {
+        "modules/app-role": ModuleGraphEntry(
+            callsites=["live/prod/app"],
+            sibling_modules_at_callsites=["modules/eks-cluster",
+                                          "modules/iam-policy-doc"],
+        )
+    }
+    refs = compute_reference_sets(
+        tmp_path, changed_dirs={"modules/app-role"}, module_graph=graph,
+    )
+    assert refs["modules/app-role"] == [
+        "modules/eks-cluster", "modules/iam-policy-doc",
+    ]
+
+
+def test_terragrunt_component_uses_region_and_cross_env(tmp_path):
+    _touch(tmp_path / "live/prod/us-east-1/eks/terragrunt.hcl")
+    _touch(tmp_path / "live/prod/us-east-1/audit/terragrunt.hcl")
+    _touch(tmp_path / "live/prod/us-east-1/app/terragrunt.hcl")
+    _touch(tmp_path / "live/staging/us-east-1/eks/terragrunt.hcl")
+    _touch(tmp_path / "live/prod/us-west-2/eks/terragrunt.hcl")
+
+    refs = compute_reference_sets(
+        tmp_path, changed_dirs={"live/prod/us-east-1/eks"}, module_graph={},
+    )
+    ref = set(refs["live/prod/us-east-1/eks"])
+    assert "live/prod/us-east-1/audit" in ref
+    assert "live/prod/us-east-1/app" in ref
+    assert "live/staging/us-east-1/eks" in ref
+    assert "live/prod/us-west-2/eks" in ref
+    assert "live/prod/us-east-1/eks" not in ref
+
+
+def test_plain_terraform_uses_sibling_dirs(tmp_path):
+    _touch(tmp_path / "envs/prod/main.tf")
+    _touch(tmp_path / "envs/staging/main.tf")
+    _touch(tmp_path / "envs/dev/main.tf")
+    refs = compute_reference_sets(
+        tmp_path, changed_dirs={"envs/prod"}, module_graph={},
+    )
+    assert set(refs["envs/prod"]) == {"envs/staging", "envs/dev"}
+
+
+def test_compute_consistency_norms_ignores_single_peer_drift(tmp_path):
+    (tmp_path / "envs/prod").mkdir(parents=True, exist_ok=True)
+    (tmp_path / "envs/staging").mkdir(parents=True, exist_ok=True)
+    (tmp_path / "envs/dev").mkdir(parents=True, exist_ok=True)
+    (tmp_path / "envs/qa").mkdir(parents=True, exist_ok=True)
+    (tmp_path / "envs/staging/main.tf").write_text('kms_key_arn = "a"\n')
+    (tmp_path / "envs/dev/main.tf").write_text('kms_key_arn = "b"\n')
+    (tmp_path / "envs/qa/main.tf").write_text('bucket_key_enabled = true\n')
+
+    refs = {"envs/prod": ["envs/staging", "envs/dev", "envs/qa"]}
+    norms = compute_consistency_norms(tmp_path, refs)
+    attr_norms = norms["envs/prod"]["attribute_norms"]
+    assert {"attribute": "kms_key_arn", "peer_dirs": ["envs/dev", "envs/staging"]} in attr_norms
+    assert not any(norm["attribute"] == "bucket_key_enabled" for norm in attr_norms)

plugins/reviews/skills/audit-terraform/tests/test_refresh_controls.py

@@ -0,0 +1,59 @@
+import importlib.util
+import json
+from pathlib import Path
+from unittest.mock import patch
+
+
+_SKILL_ROOT = Path(__file__).resolve().parent.parent
+
+
+def _load_cli():
+    spec = importlib.util.spec_from_file_location(
+        "refresh_controls", _SKILL_ROOT / "scripts" / "refresh-controls.py"
+    )
+    mod = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(mod)
+    return mod
+
+
+_FSBP_HTML = (_SKILL_ROOT / "tests" / "fixtures" / "fsbp_index_sample.html").read_text()
+_CIS_HTML = (_SKILL_ROOT / "tests" / "fixtures" / "cis_sample.html").read_text()
+
+
+class _FakeResponse:
+    def __init__(self, text: str, status_code: int = 200):
+        self.text = text
+        self.status_code = status_code
+    def raise_for_status(self):
+        if self.status_code >= 400:
+            raise RuntimeError(f"HTTP {self.status_code}")
+
+
+def _fake_get(url, **kw):
+    if "fsbp" in url or "foundational-security-best-practices" in url:
+        return _FakeResponse(_FSBP_HTML)
+    if "cis" in url:
+        return _FakeResponse(_CIS_HTML)
+    return _FakeResponse("<html></html>")
+
+
+def test_refresh_writes_three_json_files(tmp_path):
+    mod = _load_cli()
+    out_dir = tmp_path / "data" / "controls"
+    with patch("requests.get", side_effect=_fake_get):
+        rc = mod.main(["--output-dir", str(out_dir)])
+    assert rc == 0
+    fsbp = json.loads((out_dir / "fsbp.json").read_text())
+    cis = json.loads((out_dir / "cis.json").read_text())
+    meta = json.loads((out_dir / "meta.json").read_text())
+
+    assert fsbp["source"] == "fsbp"
+    assert "aws_s3_bucket" in fsbp["by_resource_type"]
+    assert any(c["control_id"] == "FSBP S3.5" for c in fsbp["controls"])
+
+    assert cis["source"] == "cis"
+    assert any(c["control_id"] == "CIS Account.1" for c in cis["controls"])
+
+    assert meta["fsbp"]["url"]
+    assert meta["fsbp"]["fetched_at"]
+    assert meta["cis"]["url"]

plugins/reviews/skills/audit-terraform/tests/test_resolve_plan_units.py

@@ -0,0 +1,92 @@
+from pathlib import Path
+
+from scripts.resolve_plan_units import resolve_plan_units
+from scripts.manifest import ModuleGraphEntry
+
+
+def _mk(tmp_path: Path, rel: str, has_backend: bool = False, terragrunt: bool = False):
+    d = tmp_path / rel
+    d.mkdir(parents=True, exist_ok=True)
+    if terragrunt:
+        (d / "terragrunt.hcl").write_text("# tg\n")
+    if has_backend:
+        (d / "main.tf").write_text(
+            'terraform { backend "local" {} }\n'
+            'resource "null_resource" "x" {}\n'
+        )
+
+
+def test_plan_unit_dir_planned_directly(tmp_path):
+    _mk(tmp_path, "live/prod/app", has_backend=True)
+    plan_units, orphans = resolve_plan_units(
+        repo_root=tmp_path,
+        changed_dirs={"live/prod/app"},
+        module_graph={},
+    )
+    assert plan_units == {"live/prod/app": ["live/prod/app"]}
+    assert orphans == []
+
+
+def test_terragrunt_dir_planned_directly(tmp_path):
+    _mk(tmp_path, "live/prod/app", terragrunt=True)
+    plan_units, orphans = resolve_plan_units(
+        repo_root=tmp_path,
+        changed_dirs={"live/prod/app"},
+        module_graph={},
+    )
+    assert plan_units == {"live/prod/app": ["live/prod/app"]}
+    assert orphans == []
+
+
+def test_module_change_expands_to_callsites(tmp_path):
+    _mk(tmp_path, "live/prod/app", has_backend=True)
+    _mk(tmp_path, "live/staging/app", has_backend=True)
+    _mk(tmp_path, "modules/app-role")
+    (tmp_path / "modules/app-role/main.tf").write_text(
+        'resource "null_resource" "x" {}\n')
+    graph = {
+        "modules/app-role": ModuleGraphEntry(
+            callsites=["live/prod/app", "live/staging/app"],
+        )
+    }
+    plan_units, orphans = resolve_plan_units(
+        repo_root=tmp_path,
+        changed_dirs={"modules/app-role"},
+        module_graph=graph,
+    )
+    assert plan_units == {
+        "live/prod/app": ["modules/app-role"],
+        "live/staging/app": ["modules/app-role"],
+    }
+    assert orphans == []
+
+
+def test_module_with_no_callsites_is_orphan(tmp_path):
+    _mk(tmp_path, "modules/lonely")
+    (tmp_path / "modules/lonely/main.tf").write_text(
+        'resource "null_resource" "x" {}\n')
+    plan_units, orphans = resolve_plan_units(
+        repo_root=tmp_path,
+        changed_dirs={"modules/lonely"},
+        module_graph={},
+    )
+    assert plan_units == {}
+    assert orphans == ["modules/lonely"]
+
+
+def test_triggered_by_merges_when_both_dir_and_module_change(tmp_path):
+    _mk(tmp_path, "live/prod/app", has_backend=True)
+    _mk(tmp_path, "modules/app-role")
+    (tmp_path / "modules/app-role/main.tf").write_text(
+        'resource "null_resource" "x" {}\n')
+    graph = {
+        "modules/app-role": ModuleGraphEntry(callsites=["live/prod/app"]),
+    }
+    plan_units, _ = resolve_plan_units(
+        repo_root=tmp_path,
+        changed_dirs={"live/prod/app", "modules/app-role"},
+        module_graph=graph,
+    )
+    assert plan_units == {
+        "live/prod/app": ["live/prod/app", "modules/app-role"],
+    }

plugins/reviews/skills/audit-terraform/tests/test_review_stats.py

@@ -0,0 +1,50 @@
+import pytest
+from pathlib import Path
+
+from scripts.review_stats import compute_stats
+from scripts.telemetry import append_subagent_run, append_verdict
+
+
+def _seed(log: Path):
+    append_subagent_run(
+        log, run_id="r1", repo="/r", mode="local",
+        agent="aws-bp-reviewer", model="claude-sonnet-4-6",
+        input_tokens=1000, output_tokens=200, duration_ms=5000, finding_count=3,
+    )
+    append_verdict(log, run_id="r1", agent="aws-bp-reviewer",
+                   rule_id="TRIVY AVD-AWS-0089", file="a.tf", line=1, verdict="kept")
+    append_verdict(log, run_id="r1", agent="aws-bp-reviewer",
+                   rule_id="TRIVY AVD-AWS-0089", file="b.tf", line=2, verdict="dismissed")
+    append_verdict(log, run_id="r1", agent="aws-bp-reviewer",
+                   rule_id="TRIVY AVD-AWS-0089", file="c.tf", line=3, verdict="false_positive")
+
+
+def test_compute_stats_precision_and_tokens(tmp_path):
+    log = tmp_path / "runs.jsonl"
+    _seed(log)
+    stats = compute_stats(log)
+    assert stats["runs"] == 1
+    a = stats["by_agent"]["aws-bp-reviewer"]
+    assert a["total"] == 3
+    assert a["kept"] == 1
+    assert a["dismissed"] == 1
+    assert a["false_positive"] == 1
+    assert a["precision"] == pytest.approx(1 / 3)
+    assert a["tokens"] == 1200
+    assert a["tokens_per_kept"] == 1200
+
+
+def test_compute_stats_empty(tmp_path):
+    stats = compute_stats(tmp_path / "missing.jsonl")
+    assert stats == {"by_agent": {}, "by_rule": {}, "runs": 0}
+
+
+def test_compute_stats_per_rule(tmp_path):
+    log = tmp_path / "runs.jsonl"
+    _seed(log)
+    stats = compute_stats(log)
+    rule_key = "aws-bp-reviewer/TRIVY AVD-AWS-0089"
+    r = stats["by_rule"][rule_key]
+    assert r["total"] == 3
+    assert r["kept"] == 1
+    assert r["precision"] == pytest.approx(1 / 3)

plugins/reviews/skills/audit-terraform/tests/test_scanners_tflint.py

@@ -0,0 +1,109 @@
+
+from scripts.scanners import (
+    _normalize_tflint_findings,
+    _run_tflint,
+)
+
+
+def test_normalize_tflint_findings_parses_issues():
+    payload = {
+        "issues": [
+            {
+                "rule": {
+                    "name": "terraform_unused_declarations",
+                    "severity": "warning",
+                    "link": "https://example.com/rule",
+                },
+                "message": "variable \"foo\" is declared but not used",
+                "range": {
+                    "filename": "variables.tf",
+                    "start": {"line": 12},
+                    "end": {"line": 12},
+                },
+            }
+        ],
+        "errors": [],
+    }
+    findings = _normalize_tflint_findings(payload, scanned_dir="modules/vpc")
+    assert len(findings) == 1
+    f = findings[0]
+    assert f.rule == "terraform_unused_declarations"
+    assert f.file == "modules/vpc/variables.tf"
+    assert f.start_line == 12
+    assert f.severity == "warning"
+    assert f.source == "tflint"
+
+
+def test_normalize_tflint_findings_preserves_absolute_filename():
+    payload = {
+        "issues": [
+            {
+                "rule": {"name": "r", "severity": "warning"},
+                "message": "m",
+                "range": {"filename": "modules/vpc/variables.tf",
+                          "start": {"line": 1}, "end": {"line": 1}},
+            }
+        ]
+    }
+    findings = _normalize_tflint_findings(payload, scanned_dir="modules/vpc")
+    assert findings[0].file == "modules/vpc/variables.tf"
+
+
+def test_normalize_tflint_findings_empty():
+    assert _normalize_tflint_findings({"issues": []}, scanned_dir=".") == []
+
+
+def test_run_tflint_handles_missing_binary(tmp_path, monkeypatch):
+    monkeypatch.setenv("PATH", "/nonexistent")
+    payload, findings, err = _run_tflint(tmp_path, ["main.tf"])
+    assert findings == []
+    assert payload == {}
+    assert err is None
+
+
+def test_run_tflint_skips_when_no_terraform_files(tmp_path):
+    payload, findings, err = _run_tflint(tmp_path, ["README.md", "Makefile"])
+    assert findings == []
+    assert err is None
+
+
+def test_normalize_tflint_findings_collapses_dot_scanned_dir():
+    payload = {
+        "issues": [
+            {
+                "rule": {"name": "r", "severity": "warning"},
+                "message": "m",
+                "range": {"filename": "main.tf",
+                          "start": {"line": 1}, "end": {"line": 1}},
+            }
+        ]
+    }
+    findings = _normalize_tflint_findings(payload, scanned_dir=".")
+    assert findings[0].file == "main.tf"
+
+
+def test_run_tflint_aggregates_errors_from_multiple_dirs(tmp_path, monkeypatch):
+    (tmp_path / "modules" / "a").mkdir(parents=True)
+    (tmp_path / "modules" / "b").mkdir(parents=True)
+    (tmp_path / "modules" / "a" / "main.tf").write_text("")
+    (tmp_path / "modules" / "b" / "main.tf").write_text("")
+
+    from scripts import scanners
+
+    def fake_run(cmd, **_):
+        class R:
+            returncode = 1
+            stdout = ""
+            stderr = "boom"
+        return R()
+
+    monkeypatch.setattr(scanners.subprocess, "run", fake_run)
+    monkeypatch.setattr(scanners.shutil, "which", lambda _: "/usr/bin/tflint")
+
+    payload, findings, err = scanners._run_tflint(
+        tmp_path, ["modules/a/main.tf", "modules/b/main.tf"]
+    )
+    assert findings == []
+    assert err is not None
+    assert "modules/a" in err
+    assert "modules/b" in err

plugins/reviews/skills/audit-terraform/tests/test_scrape_cis.py

@@ -0,0 +1,37 @@
+from pathlib import Path
+
+from scripts.scrape_cis import parse_cis_page
+
+
+_FIXTURES = Path(__file__).parent / "fixtures"
+
+
+def test_parses_cis_unified_controls():
+    html = (_FIXTURES / "cis_sample.html").read_text()
+    rows = parse_cis_page(html, source_url="https://docs.aws.amazon.com/.../cis.html")
+    by_id = {r.control_id: r for r in rows}
+    assert "CIS Account.1" in by_id
+    a = by_id["CIS Account.1"]
+    assert "Security contact" in a.title
+    assert "v5.0.0 §1.2" in a.requirement
+    assert "v1.2.0 §1.18" in a.requirement
+    assert a.severity == "medium"
+
+
+def test_skips_empty_version_cells():
+    html = (_FIXTURES / "cis_sample.html").read_text()
+    rows = parse_cis_page(html, source_url="https://docs.aws.amazon.com/.../cis.html")
+    by_id = {r.control_id: r for r in rows}
+    iam5 = by_id["CIS IAM.5"]
+    assert "v1.4.0" not in iam5.requirement
+    assert "v5.0.0 §1.10" in iam5.requirement
+    assert "v1.2.0 §1.2" in iam5.requirement
+
+
+def test_resource_types_via_prefix_map():
+    html = (_FIXTURES / "cis_sample.html").read_text()
+    rows = parse_cis_page(html, source_url="https://docs.aws.amazon.com/.../cis.html")
+    by_id = {r.control_id: r for r in rows}
+    assert "aws_s3_bucket" in by_id["CIS S3.5"].resource_types
+    assert "aws_iam_user" in by_id["CIS IAM.5"].resource_types
+    assert "aws_cloudtrail" in by_id["CIS CloudTrail.1"].resource_types

plugins/reviews/skills/audit-terraform/tests/test_scrape_fsbp.py

@@ -0,0 +1,38 @@
+from pathlib import Path
+
+from scripts.scrape_fsbp import parse_fsbp_index
+
+
+_FIXTURES = Path(__file__).parent / "fixtures"
+
+
+def test_parses_fsbp_index_rows():
+    html = (_FIXTURES / "fsbp_index_sample.html").read_text()
+    rows = parse_fsbp_index(html, base_url="https://docs.aws.amazon.com")
+    by_id = {r.control_id: r for r in rows}
+    assert "S3.5" in by_id
+    assert by_id["S3.5"].title == "S3 general purpose buckets should require requests to use SSL"
+    assert by_id["S3.5"].severity == "medium"
+    assert by_id["S3.5"].detail_url.endswith("s3-controls.html#s3-5")
+    assert "IAM.5" in by_id
+    assert "Account.1" in by_id
+
+
+def test_resource_types_attached_via_prefix_map():
+    html = (_FIXTURES / "fsbp_index_sample.html").read_text()
+    rows = parse_fsbp_index(html, base_url="https://docs.aws.amazon.com")
+    by_id = {r.control_id: r for r in rows}
+    assert "aws_s3_bucket" in by_id["S3.5"].resource_types
+    assert "aws_iam_user" in by_id["IAM.5"].resource_types
+    assert "aws_account_alternate_contact" in by_id["Account.1"].resource_types
+
+
+def test_dedups_repeat_control_ids():
+    """A control linked multiple times on the page should appear once."""
+    html = """\
+<html><body>
+<p><a href="./s3-controls.html#s3-1">[S3.1] First link</a></p>
+<p><a href="./s3-controls.html#s3-1">[S3.1] Second link to same control</a></p>
+</body></html>"""
+    rows = parse_fsbp_index(html, base_url="https://docs.aws.amazon.com")
+    assert len([r for r in rows if r.control_id == "S3.1"]) == 1

plugins/reviews/skills/audit-terraform/tests/test_slice_tflint.py

@@ -0,0 +1,52 @@
+from scripts.slicing import _slice_for_agent
+
+
+def _sample_manifest():
+    return {
+        "base_ref": "main", "head_ref": "HEAD", "mode": "local",
+        "default_branch": "main", "errors": [], "changed_source_dirs": [],
+        "catalog": [{"type": "aws_s3_bucket"}],
+        "plan_units": [],
+        "module_graph": {},
+        "trivy_findings": [{"rule": "AVD-1"}],
+        "tflint_findings": [{"rule": "terraform_required_version"}],
+    }
+
+
+def test_aws_bp_slice_includes_tflint():
+    sliced = _slice_for_agent(_sample_manifest(), "aws-bp")
+    assert sliced["tflint_findings"][0]["rule"] == "terraform_required_version"
+
+
+def test_fsbp_slice_includes_tflint():
+    sliced = _slice_for_agent(_sample_manifest(), "fsbp")
+    assert sliced["tflint_findings"][0]["rule"] == "terraform_required_version"
+
+
+def test_cis_slice_includes_tflint():
+    sliced = _slice_for_agent(_sample_manifest(), "cis")
+    assert sliced["tflint_findings"][0]["rule"] == "terraform_required_version"
+
+
+def test_aws_bp_slice_still_includes_trivy():
+    sliced = _slice_for_agent(_sample_manifest(), "aws-bp")
+    assert sliced["trivy_findings"][0]["rule"] == "AVD-1"
+
+
+def test_consistency_slice_includes_tflint():
+    sliced = _slice_for_agent(_sample_manifest(), "consistency")
+    assert sliced["tflint_findings"][0]["rule"] == "terraform_required_version"
+
+
+def test_hygiene_slice_includes_tflint_and_omits_trivy():
+    sliced = _slice_for_agent(_sample_manifest(), "tf-hygiene")
+    assert sliced["tflint_findings"][0]["rule"] == "terraform_required_version"
+    assert "trivy_findings" not in sliced
+    assert "plan_units" in sliced
+    assert "catalog" in sliced
+    assert "changed_source_dirs" in sliced
+
+
+def test_unknown_agent_returns_full_manifest():
+    sliced = _slice_for_agent(_sample_manifest(), "unknown-agent")
+    assert sliced == _sample_manifest()

plugins/reviews/skills/audit-terraform/tests/test_smoke.py

@@ -0,0 +1,22 @@
+from pathlib import Path
+
+SKILL_DIR = Path(__file__).resolve().parent.parent
+
+
+def test_imports():
+    from scripts import manifest  # noqa: F401
+
+
+def test_skill_documents_trivy_first_flow():
+    skill = (SKILL_DIR / "SKILL.md").read_text()
+    aws_bp = (SKILL_DIR / "agents/aws-bp-reviewer.md").read_text()
+    consistency = (SKILL_DIR / "agents/consistency-reviewer.md").read_text()
+    design = (SKILL_DIR / "README.md").read_text()
+
+    assert "trivy-findings.json" in skill
+    assert "Agents: `walkthrough-reviewer`, `aws-bp-reviewer`, `consistency-reviewer`,\n`tf-hygiene-reviewer`." in skill
+    assert "Trivy as the first-pass scanner" in aws_bp
+    assert "`trivy config` first-pass scan" in design
+    assert "CONSISTENCY_NORMS" in consistency
+    assert "consistency_norms.json" in design
+    assert "block_text" not in design

plugins/reviews/skills/audit-terraform/tests/test_source_lookup.py

@@ -0,0 +1,57 @@
+import textwrap
+
+from scripts.source_lookup import find_block
+
+
+def test_finds_block_in_single_file(tmp_path):
+    main_tf = tmp_path / "main.tf"
+    main_tf.write_text(textwrap.dedent("""\
+    resource "aws_s3_bucket" "logs" {
+      bucket = "logs"
+    }
+
+    resource "aws_iam_role" "svc" {
+      name = "svc"
+    }
+    """))
+    loc = find_block(tmp_path, "aws_iam_role.svc")
+    assert loc is not None
+    assert loc.file.name == "main.tf"
+    assert loc.start_line == 5
+    assert loc.end_line == 7
+    assert 'resource "aws_iam_role" "svc"' in loc.text
+    assert loc.text.rstrip().endswith("}")
+
+
+def test_searches_multiple_tf_files(tmp_path):
+    (tmp_path / "a.tf").write_text(
+        'resource "aws_s3_bucket" "a" { bucket = "a" }\n'
+    )
+    (tmp_path / "b.tf").write_text(
+        'resource "aws_s3_bucket" "b" { bucket = "b" }\n'
+    )
+    loc = find_block(tmp_path, "aws_s3_bucket.b")
+    assert loc is not None
+    assert loc.file.name == "b.tf"
+    assert 'bucket = "b"' in loc.text
+
+
+def test_returns_none_when_missing(tmp_path):
+    (tmp_path / "main.tf").write_text(
+        'resource "aws_s3_bucket" "logs" { bucket = "x" }\n'
+    )
+    assert find_block(tmp_path, "aws_iam_role.svc") is None
+
+
+def test_ignores_data_blocks(tmp_path):
+    (tmp_path / "main.tf").write_text(textwrap.dedent("""\
+    data "aws_caller_identity" "current" {}
+
+    resource "aws_iam_role" "real" {
+      name = "x"
+    }
+    """))
+    loc = find_block(tmp_path, "aws_caller_identity.current")
+    assert loc is None
+    loc2 = find_block(tmp_path, "aws_iam_role.real")
+    assert loc2 is not None

plugins/reviews/skills/audit-terraform/tests/test_telemetry.py

@@ -0,0 +1,43 @@
+import pytest
+
+from scripts.telemetry import append_subagent_run, append_verdict, read_runs
+
+
+def test_round_trip(tmp_path):
+    log = tmp_path / "runs.jsonl"
+    append_subagent_run(
+        log, run_id="r1", repo="/r", mode="local",
+        agent="aws-bp-reviewer", model="claude-sonnet-4-6",
+        input_tokens=100, output_tokens=20, duration_ms=1000, finding_count=3,
+    )
+    append_verdict(
+        log, run_id="r1", agent="aws-bp-reviewer",
+        rule_id="TRIVY AVD-AWS-0089", file="vpc.tf", line=12,
+        verdict="kept", notes="real",
+    )
+    records = read_runs(log)
+    assert len(records) == 2
+    assert records[0]["kind"] == "subagent_run"
+    assert records[0]["input_tokens"] == 100
+    assert records[1]["kind"] == "verdict"
+    assert records[1]["verdict"] == "kept"
+
+
+def test_append_creates_parent_dir(tmp_path):
+    log = tmp_path / "deep" / "nested" / "runs.jsonl"
+    append_subagent_run(
+        log, run_id="r2", repo="/r", mode="local",
+        agent="x", model="y", input_tokens=0, output_tokens=0,
+        duration_ms=0, finding_count=0,
+    )
+    assert log.exists()
+
+
+def test_invalid_verdict_raises(tmp_path):
+    log = tmp_path / "runs.jsonl"
+    with pytest.raises(ValueError, match="invalid verdict"):
+        append_verdict(
+            log, run_id="r3", agent="aws-bp-reviewer",
+            rule_id="TRIVY AVD-AWS-0089", file="a.tf", line=5,
+            verdict="maybe", notes="",
+        )