HCL AST Compilation¶

CEL policies compile to an AST at load time. This is why hot-reload works without a restart and why malformed rules fail fast at parse, not at evaluation.

The Interrogation Limitation¶

Reconciling physical cloud IDs (e.g., i-0abc123) to source Git commits via grep fails: i-0abc123 never appears as a literal string inside main.tf. The author wrote an aws_instance block.

Standard parsing also can't resolve variable interpolations. If an author writes instance_type = var.env_type, naive string matching can't find the final compiled value without structural simulation.

Tokenization¶

and Pass 1

We invoke the official hcl.v2 tokenizer for lexical analysis across the repository filesystem, compiling a structural graph of dependencies:

// pkg/engine/rosetta/ast.go
func (p *Parser) Tokenize(dir string) (*hcl.File, hcl.Diagnostics) {
    parser := hclparse.NewParser()
    // Resolving variable maps natively
    file, diags := parser.ParseHCLFile(dir + "/main.tf")
    return file, diags
}

Pass 1 processes the state JSON index alongside the tokenized AST. Rosetta maps id, name, and indices. If a block uses count = 3, the AST tracks exactly which instantiation maps to the index = 0 AWS resource.

SSA¶

Static Single Assignment

flowchart LR
    AST["HCL Tokenizer"] --> S["State JSON"]
    S --> P1["Pass 1 (Node Mapping)"]
    P1 --> SSA["SSA Block Resolution"]
    SSA --> O["Git Blame Call"]

To eliminate nested interpolation recursion, we run a pass converting block variables to Static Single Assignment (SSA) form: every variable is assigned exactly once.

If var.size differs across environments (dev.tfvars, prod.tfvars), the SSA structure binds the physical crn:devi:... graph node to the evaluated output string that matches the API response.

Rosetta then runs native go-git library routines against the exact file and line coordinates from the SSA evaluation. The git blame author trace is encoded into the s.a.u audit ledger immutably.