Repository navigation
feat(search): verify exact speculative import plans (6/6) - #591
Open
sowju-hashicorp wants to merge 1 commit into
Open
sowju-hashicorp wants to merge 1 commit into
sowju-hashicorp wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved verifier issues affect numeric identity preservation, valid address handling, and the completeness and consistency of Plan findings.
5 open issues
What changed in this PR
Completes the Search-to-import workflow with read-only verification of an exact speculative Run and its backend-associated Plan across both MCP SDKs.
Changes:
- Adds Run association, lifecycle, preparation-context, and binding checks before Plan classification.
- Reports selected actions, object identity, and other Plan effects with structured and JSON-text results.
- Extends registration, guard, transport-parity, logging, and workflow tests and documentation.
| File | Description |
|---|---|
| README.md | Revises scope defaults and workflow documentation. |
| pkg/toolsets/toolsets.go | Updates the Search toolset description. |
| pkg/toolsets/toolsets_test.go | Expands Search filtering and known-tool coverage. |
| pkg/toolsets/search.go | Adds verifier tool metadata. |
| pkg/toolsets/search_test.go | Checks verifier credential gating. |
| pkg/tools/search/verify_import_plan.go | Implements exact-Run verification and Plan classification. |
| pkg/tools/search/provider_validation_test.go | Renames foundation tests to avoid collisions. |
| pkg/tools/search/import_tools.go | Adds the legacy verifier adapter and description. |
| pkg/tools/search/import_tools_test.go | Tests classification, output safety, and legacy responses. |
| pkg/tools/search/import_preflight_test.go | Tests context integrity, guards, polling, and cancellation. |
| pkg/tools/search/diagnostic_codes.go | Adds verification diagnostics and reorganizes shared codes. |
| pkg/tools/search/diagnostic_codes_test.go | Renames a foundation diagnostic test. |
| pkg/tools/search/descriptions_test.go | Checks tool descriptions and workflow boundaries. |
| pkg/tools/factories.go | Registers the legacy verifier factory. |
| pkg/tools/factories_test.go | Extends credential-based registration tests. |
| pkg/mcp-official/tools/verify_flow_test.go | Tests full-workflow transport parity and guards. |
| pkg/mcp-official/tools/tools.go | Registers the official SDK verifier. |
| pkg/mcp-official/tools/tools_test.go | Extends registration and credential tests. |
| pkg/mcp-official/tools/source_registration_test.go | Adds registration and workflow regression coverage. |
| pkg/mcp-official/tools/search/verify_test.go | Tests verifier schemas and target confirmation. |
| pkg/mcp-official/tools/search/search.go | Adds the official SDK verifier adapter. |
| pkg/mcp-official/tools/search/search_test.go | Extends schema, description, and annotation tests. |
| pkg/mcp-official/tools/middleware/tool_logging_test.go | Checks verifier argument and error logging protection. |
| pkg/instructions/instructions.md | Documents separately approved planning and verification. |
| pkg/instructions/instructions_test.go | Checks updated Search/import workflow boundaries. |
| pkg/client/tool_logging_middleware_test.go | Checks legacy verifier argument logging protection. |
| CHANGELOG.md | Records verification capabilities and read-only boundaries. |
Review effort: Balanced
| ImportContext *ImportContext `json:"import_context,omitempty" jsonschema:"Unchanged context returned by prepare_import; required for finished Plan classification"` | ||
| Bindings []ImportBinding `json:"bindings,omitempty" jsonschema:"One query result marker to exact target address binding per selection"` | ||
| DetailAddresses []string `json:"detail_addresses,omitempty" jsonschema:"Optional selected target addresses to inspect without values"` | ||
| } |
| return verifyImportPollConfig{wait: verifyImportWait, interval: verifyImportInterval} | ||
| } | ||
|
|
||
| var importAddressPattern = regexp.MustCompile(`^[a-zA-Z0-9_\[\]".:-]+$`) |
| if err := collectImportPlanVersions(plan.PlannedValues.RootModule, versions, 0); err != nil { | ||
| return nil, nil, err | ||
| } | ||
| return byAddress, versions, nil |
Comment on lines
+647
to
+649
| if !jsonPresent(resource.Change.Importing) { | ||
| item.Change, item.IdentityReason = "import_missing", "no_import_marker" | ||
| return item, detail, nil |
|
|
||
| func compareImportPlanIdentity(selection ImportContextSelection, versions map[string]uint64, address string, raw json.RawMessage, terraformVersion, support string) (string, string) { | ||
| if !jsonPresent(raw) { | ||
| if old, known := terraformImportSyntaxVersion(terraformVersion); known && old { |
mjyocca
added this pull request to stack #593
October 22, 2026 16:45
mjyocca
force-pushed
the
sowju/search-06-verify-plan
branch
from
October 22, 2026 18:54
e22fe21 to
004bfdf
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR 6 of 6 in the Terraform Search stack.
Branch:
sowju/search-06-verify-planBase:
sowju/search-05-prepare-importAdds read-only
verify_import_planon both MCP SDKs, completing the Search-to-import assistance workflow with verification of one exact speculative Run and its associated Plan.Changes
plan-only=true/auto-apply=falseevidence.Security and evidence boundaries
Read-only boundary
verify_import_plandoes not create Runs, upload configuration, modify workspaces, execute imports, write state, or apply changes.The workflow ends at reviewed configuration and Plan findings. Full Plan review and any subsequent action remain separate user decisions.
Validation
Reviewer focus
Stack scope
Depends on PR 5 for explicitly selected evidence and stateless import context. Set this PR's base to
sowju/search-05-prepare-importso the diff shows only verification and final workflow coverage.This completes the six-layer stack:
Configuration upload, Run creation for import planning, import execution, and apply remain out of scope.
Rollback
Revert this PR to remove Plan verification while retaining the preceding Search and preparation capabilities.
The verifier performs no remote mutations, so no data migration or infrastructure rollback is required. Existing Runs and Plans remain unchanged; any separately performed user actions must be assessed independently.
PCI review checklist
I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.