Skip to content

test: qualify typography and centered counts in real reports - #4

Merged
soulbah merged 2 commits into
devfrom
qualification/review-typography
Oct 2, 2026
Merged

soulbah merged 2 commits into
devfrom
qualification/review-typography

Conversation

@soulbah

@soulbah soulbah commented Oct 2, 2026 •

Copy link
Copy Markdown
Contributor

Center numeric headings and values with native GFM alignment, preserve known zeros, and render the five requested typographic cues through the public CLI formatters: ? Uncertainty, ± Planned changes, ↺ Reported drift, Δ Net change, and ▦ Planned architecture. The normal report job installs the published candidate, produces its real Form and negative Policy result, then reopens that exact saved evidence with public CLI source 2641dfbb8fd5ed665ace7c23864afba6715cf819.

Form and Policy result bytes must remain identical. The exact merged Action source publishes the generated Markdown to Job Summary and one protected PR comment; no hand-edited gallery or locally copied release binary. Existing native platform and external-cache proofs remain valid and their workflows ignore this presentation-only change.

Validation: workflow lint; local public formatter reopen; byte comparisons for Form/Policy result; five-symbol and hierarchy assertions; derived artifact allowlist. This qualifies source presentation, not a new distributed candidate.

@github-actions

github-actions Bot commented Oct 2, 2026 •

Copy link
Copy Markdown

Rootform

CLI source-2641dfb.

Architecture

76 instances, 18 Relations, 68 Contexts, and 14 Contributions added.

Form loaded. Planned changes compare Refreshed with Planned.

? Uncertainty

Stage Indeterminate closures Unavailable Unknown until apply
Planned 27 26 1

± Planned changes

Change Instances Relations Contexts Contributions
+ Added 76 18 68 14
− Removed 0 0 0 0
Instances: 76 added
  • google_cloud_run_v2_job.legacy_warehouse_sync
  • google_cloud_run_v2_service.enrichment
  • google_cloud_run_v2_service.ingest_api
  • google_cloud_run_v2_service.warehouse_loader
  • google_compute_firewall.allow_health_checks
  • google_compute_firewall.allow_internal
  • google_compute_global_address.private_services
  • google_compute_network.shared
  • google_compute_router.shared
  • google_compute_router_nat.shared
  • google_compute_subnetwork.data
  • google_compute_subnetwork.gke
  • google_compute_subnetwork.serverless
  • google_container_cluster.data
  • google_container_node_pool.workloads
  • google_monitoring_alert_policy.subscription_backlog
  • google_monitoring_service.ingest_api
  • google_monitoring_slo.ingest_api_availability
  • google_project.data
  • google_project.network
  • google_project_iam_member.enrichment_publisher
  • google_project_iam_member.gke_nodes_log_writer
  • google_project_iam_member.gke_nodes_metric_writer
  • google_project_iam_member.ingest_api_publisher
  • google_project_iam_member.pubsub_push_invoker
  • google_project_iam_member.streaming_subscriber
  • google_project_iam_member.warehouse_loader_sql_client
  • google_pubsub_subscription.events_enriched_sessions
  • google_pubsub_subscription.events_enriched_warehouse
  • google_pubsub_subscription.events_raw_enrichment
  • google_pubsub_subscription.events_raw_stream_consumer
  • google_pubsub_topic.events_enriched
  • google_pubsub_topic.events_raw
  • google_redis_instance.data
  • google_secret_manager_secret.ingest_hmac
  • google_secret_manager_secret.legacy_warehouse
  • google_secret_manager_secret.warehouse_db_password
  • google_secret_manager_secret_version.ingest_hmac
  • google_secret_manager_secret_version.legacy_warehouse
  • google_secret_manager_secret_version.warehouse_db_password
  • google_service_account.enrichment
  • google_service_account.gke_nodes
  • google_service_account.ingest_api
  • google_service_account.pubsub_push
  • google_service_account.streaming
  • google_service_account.warehouse_loader
  • google_service_networking_connection.private_services
  • google_sql_database_instance.data
  • google_vpc_access_connector.data
  • kubernetes_daemon_set_v1.otel_collector
  • kubernetes_deployment_v1.analytics_api
  • kubernetes_deployment_v1.feature_builder
  • kubernetes_deployment_v1.session_windower
  • kubernetes_deployment_v1.stream_consumer
  • kubernetes_horizontal_pod_autoscaler_v1.analytics_api
  • kubernetes_ingress_v1.analytics
  • kubernetes_namespace_v1.analytics
  • kubernetes_namespace_v1.batch
  • kubernetes_namespace_v1.observability
  • kubernetes_namespace_v1.streaming
  • kubernetes_network_policy_v1.analytics
  • kubernetes_network_policy_v1.batch
  • kubernetes_network_policy_v1.observability
  • kubernetes_network_policy_v1.streaming
  • kubernetes_service_account_v1.analytics_api
  • kubernetes_service_account_v1.feature_builder
  • kubernetes_service_account_v1.feature_store
  • kubernetes_service_account_v1.otel_collector
  • kubernetes_service_account_v1.prometheus
  • kubernetes_service_account_v1.session_windower
  • kubernetes_service_account_v1.stream_consumer
  • kubernetes_service_v1.analytics_api
  • kubernetes_service_v1.feature_store
  • kubernetes_service_v1.prometheus
  • kubernetes_stateful_set_v1.feature_store
  • kubernetes_stateful_set_v1.prometheus
Relations: 18 added
  • delivers-to from google_pubsub_subscription.events_enriched_warehouse to google_cloud_run_v2_service.warehouse_loader
  • delivers-to from google_pubsub_subscription.events_raw_enrichment to google_cloud_run_v2_service.enrichment
  • routes-to from google_cloud_run_v2_service.enrichment to google_vpc_access_connector.data
  • routes-to from google_cloud_run_v2_service.ingest_api to google_vpc_access_connector.data
  • routes-to from google_cloud_run_v2_service.warehouse_loader to google_vpc_access_connector.data
  • runs-as from google_cloud_run_v2_service.enrichment to google_service_account.enrichment
  • runs-as from google_cloud_run_v2_service.ingest_api to google_service_account.ingest_api
  • runs-as from google_cloud_run_v2_service.warehouse_loader to google_service_account.warehouse_loader
  • subscribes-to from google_pubsub_subscription.events_enriched_sessions to google_pubsub_topic.events_enriched
  • subscribes-to from google_pubsub_subscription.events_enriched_warehouse to google_pubsub_topic.events_enriched
  • subscribes-to from google_pubsub_subscription.events_raw_enrichment to google_pubsub_topic.events_raw
  • subscribes-to from google_pubsub_subscription.events_raw_stream_consumer to google_pubsub_topic.events_raw
  • runs-as from kubernetes_deployment_v1.analytics_api to kubernetes_service_account_v1.analytics_api
  • runs-as from kubernetes_deployment_v1.feature_builder to kubernetes_service_account_v1.feature_builder
  • runs-as from kubernetes_deployment_v1.session_windower to kubernetes_service_account_v1.session_windower
  • runs-as from kubernetes_deployment_v1.stream_consumer to kubernetes_service_account_v1.stream_consumer
  • runs-as from kubernetes_stateful_set_v1.feature_store to kubernetes_service_account_v1.feature_store
  • runs-as from kubernetes_stateful_set_v1.prometheus to kubernetes_service_account_v1.prometheus
Contexts: 68 added
  • ownership: google_cloud_run_v2_job.legacy_warehouse_sync within google_project.data
  • ownership: google_cloud_run_v2_service.enrichment within google_project.data
  • ownership: google_cloud_run_v2_service.ingest_api within google_project.data
  • ownership: google_cloud_run_v2_service.warehouse_loader within google_project.data
  • ownership: google_compute_firewall.allow_health_checks within google_project.network
  • ownership: google_compute_firewall.allow_internal within google_project.network
  • ownership: google_compute_network.shared within google_project.network
  • ownership: google_compute_router.shared within google_project.network
  • ownership: google_compute_router_nat.shared within google_compute_router.shared
  • ownership: google_compute_subnetwork.data within google_project.network
  • ownership: google_compute_subnetwork.gke within google_project.network
  • ownership: google_compute_subnetwork.serverless within google_project.network
  • ownership: google_container_cluster.data within google_project.data
  • ownership: google_monitoring_alert_policy.subscription_backlog within google_project.data
  • ownership: google_monitoring_service.ingest_api within google_project.data
  • ownership: google_monitoring_slo.ingest_api_availability within google_project.data
  • ownership: google_pubsub_subscription.events_enriched_sessions within google_project.data
  • ownership: google_pubsub_subscription.events_enriched_warehouse within google_project.data
  • ownership: google_pubsub_subscription.events_raw_enrichment within google_project.data
  • ownership: google_pubsub_subscription.events_raw_stream_consumer within google_project.data
  • ownership: google_pubsub_topic.events_enriched within google_project.data
  • ownership: google_pubsub_topic.events_raw within google_project.data
  • ownership: google_redis_instance.data within google_project.data
  • ownership: google_secret_manager_secret.ingest_hmac within google_project.data
  • ownership: google_secret_manager_secret.legacy_warehouse within google_project.data
  • ownership: google_secret_manager_secret.warehouse_db_password within google_project.data
  • ownership: google_service_account.enrichment within google_project.data
  • ownership: google_service_account.gke_nodes within google_project.data
  • ownership: google_service_account.ingest_api within google_project.data
  • ownership: google_service_account.pubsub_push within google_project.data
  • ownership: google_service_account.streaming within google_project.data
  • ownership: google_service_account.warehouse_loader within google_project.data
  • ownership: google_sql_database_instance.data within google_project.data
  • ownership: google_vpc_access_connector.data within google_project.data
  • ownership: kubernetes_daemon_set_v1.otel_collector within kubernetes_namespace_v1.observability
  • ownership: kubernetes_deployment_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_deployment_v1.feature_builder within kubernetes_namespace_v1.batch
  • ownership: kubernetes_deployment_v1.session_windower within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_deployment_v1.stream_consumer within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_horizontal_pod_autoscaler_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_ingress_v1.analytics within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_network_policy_v1.analytics within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_network_policy_v1.batch within kubernetes_namespace_v1.batch
  • ownership: kubernetes_network_policy_v1.observability within kubernetes_namespace_v1.observability
  • ownership: kubernetes_network_policy_v1.streaming within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_service_account_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_service_account_v1.feature_builder within kubernetes_namespace_v1.batch
  • ownership: kubernetes_service_account_v1.feature_store within kubernetes_namespace_v1.batch
  • ownership: kubernetes_service_account_v1.otel_collector within kubernetes_namespace_v1.observability
  • ownership: kubernetes_service_account_v1.prometheus within kubernetes_namespace_v1.observability
  • ownership: kubernetes_service_account_v1.session_windower within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_service_account_v1.stream_consumer within kubernetes_namespace_v1.streaming
  • ownership: kubernetes_service_v1.analytics_api within kubernetes_namespace_v1.analytics
  • ownership: kubernetes_service_v1.feature_store within kubernetes_namespace_v1.batch
  • ownership: kubernetes_service_v1.prometheus within kubernetes_namespace_v1.observability
  • ownership: kubernetes_stateful_set_v1.feature_store within kubernetes_namespace_v1.batch
  • ownership: kubernetes_stateful_set_v1.prometheus within kubernetes_namespace_v1.observability
  • network: google_compute_firewall.allow_health_checks within google_compute_network.shared
  • network: google_compute_firewall.allow_internal within google_compute_network.shared
  • network: google_compute_router.shared within google_compute_network.shared
  • network: google_compute_subnetwork.data within google_compute_network.shared
  • network: google_compute_subnetwork.gke within google_compute_network.shared
  • network: google_compute_subnetwork.serverless within google_compute_network.shared
  • network: google_container_cluster.data within google_compute_network.shared
  • network: google_container_cluster.data within google_compute_subnetwork.gke
  • network: google_redis_instance.data within google_compute_network.shared
  • network: google_sql_database_instance.data within google_compute_network.shared
  • network: google_vpc_access_connector.data within google_compute_subnetwork.serverless
Contributions: 14 added
  • google_compute_global_address.private_services contributes to google_compute_network.shared
  • google_container_node_pool.workloads contributes to google_container_cluster.data
  • google_monitoring_slo.ingest_api_availability contributes to google_monitoring_service.ingest_api
  • google_project_iam_member.enrichment_publisher contributes to google_service_account.enrichment
  • google_project_iam_member.gke_nodes_log_writer contributes to google_service_account.gke_nodes
  • google_project_iam_member.gke_nodes_metric_writer contributes to google_service_account.gke_nodes
  • google_project_iam_member.ingest_api_publisher contributes to google_service_account.ingest_api
  • google_project_iam_member.pubsub_push_invoker contributes to google_service_account.pubsub_push
  • google_project_iam_member.streaming_subscriber contributes to google_service_account.streaming
  • google_project_iam_member.warehouse_loader_sql_client contributes to google_service_account.warehouse_loader
  • google_secret_manager_secret_version.ingest_hmac contributes to google_secret_manager_secret.ingest_hmac
  • google_secret_manager_secret_version.legacy_warehouse contributes to google_secret_manager_secret.legacy_warehouse
  • google_secret_manager_secret_version.warehouse_db_password contributes to google_secret_manager_secret.warehouse_db_password
  • google_service_networking_connection.private_services contributes to google_compute_network.shared

↺ Reported drift

No drift reported in this plan. The export does not establish the refresh scope.

Terraform and OpenTofu omit drift records both when refresh finds no drift and when refresh does not run.

Plan JSON does not record whether refresh was limited (-refresh=false, -target); an unrefreshed object reports no drift; data sources and deposed objects are outside drift records.

Δ Net change

Same determined changes as Planned changes.

▦ Planned architecture

  • Instances: 76
  • Interpreted: 76
  • Relations: 18
  • Contexts: 68
  • Contributions: 14
  • Closures: 139 (100 resolved, 12 absent, 27 indeterminate)

Interpreted counts the instances a Rule matched; Relations, Contexts, and Contributions count determined facts; Uncertainty counts what the evidence could not settle.


Policies

Caution

Verdict: VIOLATED

▦ Planned architecture

1 Policy selected. 1 evaluation violated.

qualification.policy.deny-database

Requirement: Synthetic negative qualification policy.

Violated: 1 evaluation

  • google_sql_database_instance.data: The assertion's queries found no fact or closure.

Details

Provenance
  • Input: /home/runner/work/_temp/rootform-results-mxJeXI/form.json

  • Form: Plan, saved by rootform 0.1.0-pr.117.1

  • Producer: Terraform or OpenTofu 1.16.4

  • Plan completeness: Complete, as reported in the plan

  • Enrichment: Saved plan paired with this plan JSON (1 module)

  • Stage: Planned

  • Stages: Recorded (reconstructed from Refreshed; no drift entry to reverse), Refreshed, Planned

  • Semantics: 19 Dialects, 1 RF Vocabulary

  • Input: /home/runner/work/_temp/rootform-results-mxJeXI/form.json

  • Origin: Plan (saved Form)

  • Policy Packs: qualification 0.1.0

Workflow run | Download evidence

@soulbah soulbah changed the title test: qualify typography in actual CLI review reports test: qualify typography and centered counts in real reports Oct 2, 2026
@soulbah
soulbah merged commit 1fdf329 into dev Oct 2, 2026
5 checks passed
@soulbah
soulbah deleted the qualification/review-typography branch October 2, 2026 20:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant