fix(terraform): preserve block attributes and enable attribute queryi…

[shobhitagnihotri69]

Summary

Fixes #3625.

The Terraform / HCL AST extractor previously discarded block attributes during node extraction. As a result, queries regarding attribute names or values (e.g. instance_type, ami, cidr_block) returned unrelated nodes.

Changes

1. Preserved Terraform block attribute key-value pairs as node properties during HCL parsing.
2. Updated semantic search and graph querying to index and match attribute metadata.
3. Added end-to-end regression tests verifying attribute retention and attribute query resolution.

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

Formal verification. 1 change(s) tested, no difference found (not proven).

---

Graphify review — findings

Extracts Terraform resource, local, variable, and nested-block attributes into an attributes dict on each node via _extract_attrs, flattening nested keys as tags.Environment / lifecycle.prevent_destroy and stripping surrounding quotes. Adds _node_attributes_text to fold that dict into the searchable text so attribute names and values feed the trigram index and earn a rationale-tier scoring bonus in _score_query, letting queries match resources by their configured values.

Worth a look

• Repeated nested blocks overwrite earlier attributes — graphify/extractors/terraform.py:288 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1678 functions depend on the 167 functions this change touches.

Health — this change adds coupling hotspots:

• new: extract() — 645 callers, 45 callees
• new: _rebuild_code() — 129 callers, 54 callees
• new: _query_graph_text() — 27 callers, 10 callees
• new: dispatch_command() — 2 callers, 125 callees
• new: extract_terraform() — 14 callers, 8 callees
• new: _score_query() — 15 callers, 7 callees
• new: run_pipeline() — 8 callers, 13 callees
• new: _query_terms() — 20 callers, 3 callees
• …and 22 more — each is listed as a finding

Verification — 1678 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 1034 function(s) in the blast radius were not formally verified this run

Test selection

Test selection

10 of 286 test file(s) selected (3%) via static blast radius.

• tests/test_benchmark.py — impact
• tests/test_benchmark_raw_graph.py — impact
• tests/test_file_label_disambiguation.py — impact
• tests/test_query_induced_edges.py — impact
• tests/test_query_mcp_direction.py — impact
• tests/test_query_names_its_graph.py — impact
• tests/test_serve.py — impact
• tests/test_serve_http.py — impact
• tests/test_terraform.py — impact, changed-test
• tests/test_terraform_modules.py — impact

Selection is safe under the controlled-regression assumption; always-run tests + a periodic full run are the backstops. Advisory — it never changes the check verdict.

Formal verification

Could not verify: Could not verify extract\_terraform.

The verifier did not have enough to check extract\_terraform, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: no capturable inputs from the test suite; property tier: parameter `path` is annotated `Path` — outside the synthesizable primitive/collection set

No difference found (not proven): No behavior difference found in \_node\_search\_text (not a proof).

The verifier ran both versions of \_node\_search\_text on many inputs and saw identical behavior every time. Strong evidence the change is safe, but evidence, not a proof.

Guarantee: Empirical: differential testing (both versions run on many generated inputs). A divergence on an untested input remains possible, so this is 'no counterexample found', not 'proven equivalent'.

Note: An input the sampler did not try could still differ.

Could not verify: Could not verify \_score\_query.

The verifier did not have enough to check \_score\_query, so it is saying so rather than guessing. No false assurance is the whole point.

Guarantee: No guarantee either way, this is an honest abstention, not a pass.

Note: Reason: no capturable inputs from the test suite; property tier: not verifiable: all 45 sampled inputs raised on both versions — the function never executed, so 'no divergence' would be vacuous (mostly TypeError — names the real obstacle, not a sampling gap)

· 1 grounded finding(s) anchored inline below; 29 more finding(s) on lines outside this diff (see the check run).

[graphify-labs]

⚠️ Health regression — _node_search_text()

high coupling complexity (Ca·Ce = 20).

Grounded coupling-delta finding (deterministic), not an LLM guess.