[Tracker]: Infra fail-closed + artifact boundary hardening

[rahuldass19]

Summary

This tracker groups the main fail-open, model-integrity, and release-boundary hardening work needed in qwed-infra.

The central QWED question here is not only:

• "Is the infrastructure logically correct?"

but also:

• "Is the model complete enough to prove anything at all?"
• "Can an unsafe artifact or deployment surface still ship even when verification appears green?"

QWED principle:
If infrastructure cannot be parsed, modeled, verified, or released safely, it must not pass.

Tracked issues

• Terraform parser must fail closed on parse and normalization errors
• IAM policy extraction must be implemented or blocked fail-closed
• CI and security workflows must not continue after verification failure
• ArtifactBoundaryGuard integration for release and deployment surface verification
• CostGuard must not mutate unknown instance types through defaults
• NetworkGuard must downgrade unsupported topology claims or add strict mode

Why this matters

qwed-infra currently has two major trust boundaries that need to be hardened together:

1. Model integrity

   • If Terraform parsing fails or IAM extraction is incomplete, any later proof can become meaningless.

2. Artifact / deployment integrity

   • Even if logical verification passes, unsafe files or release surfaces can still ship without an explicit boundary gate.

This means the infra system must prove both:

• the infrastructure model is trustworthy
• the release/deployment artifact is trustworthy

Root classes

1. Fail-open model construction

Affected areas:

• Terraform parsing
• resource normalization
• IAM policy extraction

2. Fail-open CI / validation flow

Affected areas:

• security workflows
• publish and scan pipeline behavior
• soft-fail verification steps

3. Release / artifact boundary gaps

Affected areas:

• Python packaging
• future Docker / deployable artifact surfaces
• publish workflow gating

4. Proof-domain mutation

Affected areas:

• CostGuard default assumptions
• NetworkGuard unsupported topology claims presented too strongly

Priority order

P0

• Terraform parser fail-closed
• IAM policy extraction or fail-closed block

P1

• CI fail-open removal
• ArtifactBoundaryGuard integration

P2

• CostGuard default removal
• NetworkGuard strict mode or downgraded claims

Goal

Ensure qwed-infra never allows:

• partial or broken parsing to pass as a valid proof model
• unsupported IAM policy extraction to appear safe
• CI failures to look like successful verification
• release or deployment artifacts to ship without boundary verification
• unknown infra states to silently degrade into defaults or soft claims

[rahuldass19]

Audit cross-check (v0.2.0 qwed-tax audit)

Tracker is comprehensive and correctly prioritized. After auditing the full repo, here's the updated status:

Tracked issues status

Issue	Priority	Audit confirms	Additional findings
#8 (parser fail-closed)	P0	✅ Confirmed	Also: _normalize_resource line 92-93 has same print + continue pattern
#9 (IAM empty statements)	P0	✅ Confirmed	Demo hardcodes IAM policy to work around this — end-to-end is broken
#10 (CI fail-open)	P1	✅ Confirmed	See comment on #10 for specific workflow lines
#6 (ArtifactBoundaryGuard)	P1	Not audited yet — feature request	Boundary check script (scripts/check_boundary.py) is the most mature file in the repo; could be foundation
#11 (CostGuard defaults)	P2	✅ Confirmed	See comment on #11 for additional findings
#12 (NetworkGuard topology)	P0/P1	✅ Confirmed	See comment on #12 — additional P0 CIDR bug found

Additional issues found during audit (not yet tracked)

1. P0 — NetworkGuard internal traffic ignores CIDR rules (false negative security gap) — filed under [Bug]: NetworkGuard presents unsupported topology analysis as deterministic reachability proof #12
2. P2 — CostGuard uses float not Decimal for financial calculations
3. P2 — CostGuard: no fail-closed for unknown volume/storage types (silently zeroes)
4. P2 — IamGuard: IP/Date conditions evaluated in Python, not Z3 (misleading "mathematical proof" claim)
5. P2 — README examples crash (missing port arg, reason string mismatch, instance id vs subnet id)
6. Missing — No audit.py / RuleRef / build_trace() / InfraDiagnosticResult (qwed-tax v0.2.0 has all of these)
7. Missing — No CHANGELOG.md
8. Missing — No npm SDK (README says "coming soon")
9. Config — sonar-project.properties version is 1.0 not 0.1.0; python version mismatch
10. Config — requests dependency declared but never used (dead dependency)

Recommendation

The P0 issues (#8, #9, #12 CIDR bug) should be fixed first — they create false-safe verification. The diagnostic infrastructure (audit.py, InfraDiagnosticResult, to_diagnostic) should follow, mirroring qwed-tax v0.2.0's pattern.