القائمة
Use when converting HashiCorp Sentinel policies to ORL and you need the state/plan vs source-AST paradigm and conversion limits. No side effects.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when scanning code for security/compliance issues — detect language, load policies, walk AST, report findings and rule coverage. Depends on: gomboc_community_know_gomboc_mcp, gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_walk.
Use when building an ORL rule package — workspace, AST explore, write rule/tests, test loop. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_setup_rule_workspace, gomboc_community_cap_orl_walk, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
Use when running orl test and iterating on a rule package until tests pass or the attempt budget is exhausted. Depends on: gomboc_community_cap_run_orl_test.
Use when authoring the main .orl rule and test.orl for a package using tree-sitter AST queries. Depends on: gomboc_community_know_language_guidance, gomboc_community_cap_orl_walk.
Use when running `orl remediate` (dry-run or apply) against a workspace via Docker, writing a report and submitting it to integrations (non-blocking). Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_gomboc_mcp.
Use when applying a fix with an existing ORL rule or by generating a new one. Does not own save/release — callers (e.g. flow_fix Phase 3) handle enrich and push. Depends on: gomboc_community_know_orl_runtime_resolution, gomboc_community_know_language_guidance, gomboc_community_task_resolve_existing_rules, gomboc_community_cap_orl_remediate, gomboc_community_task_setup_rule_workspace, gomboc_community_task_write_orl_rule, gomboc_community_task_run_orl_test_loop.
| name | gomboc_community_know_sentinel_conversion |
| description | Use when converting HashiCorp Sentinel policies to ORL and you need the state/plan vs source-AST paradigm and conversion limits. No side effects. |
.tf (and related) files before apply.Conversion is not 1:1. Some Sentinel checks have no ORL equivalent (computed outputs, deep cross-module resolution).
| Sentinel intent | ORL approach |
|---|---|
| Fixed attribute / boolean | FULL_REMEDIATION |
| Value depends on org context | AUDIT_ONLY |
| Only visible in plan/state | Document as unconvertible / manual |
Determine what kind of ORL rule(s) to create:
| Sentinel Pattern | ORL Strategy | Reason |
|---|---|---|
Checks a single attribute value (e.g., encryption = true) | Fix rule — replace/insert the correct value | Deterministic, safe to auto-fix |
Checks attribute is present (e.g., tags must exist) | Fix rule — insert default if missing | Deterministic with a known default |
Checks attribute references a specific resource type (e.g., ami must reference data.aws_ami) | Fix rule — replace with data source reference | Deterministic if a canonical pattern exists |
| Checks computed values, cross-module refs, or runtime state | Audit-only rule — flag the pattern, no auto-fix | Cannot determine correct value from source code alone |
| Checks values that depend on user/org context (e.g., allowed VPC IDs, approved AMI owners) | Fix with variables or Audit-only | Needs user input or org-specific config |
Present the strategy to the user before proceeding:
Sentinel policy analysis:
Policy: require-most-recent-ami-version
Severity: hard-mandatory
Target resources: aws_instance, data.aws_ami
Conversion plan:
1. [FIX] aws_instance ami must reference data.aws_ami (replace hardcoded AMIs)
2. [FIX] data.aws_ami must have most_recent = true
3. [FIX] data.aws_ami must have valid owners
4. [AUDIT-ONLY] data.aws_ami must have approved name filter (org-specific)
Proceed? [Y/n]
Be transparent with the user about what cannot be converted:
| Sentinel Capability | ORL Equivalent | Notes |
|---|---|---|
tfplan.resource_changes — checks planned changes | No direct equivalent | ORL works on source code, not plan output |
tfstate — checks current state | No direct equivalent | ORL cannot read remote state |
tfrun — checks workspace metadata | No equivalent | Runtime context not available at source level |
tfconfig.module_calls — checks module composition | Partial — can check .tf files in modules | Cannot resolve remote module sources |
| Cross-resource references (e.g., "security group must reference this VPC") | Audit-only | Cannot validate computed references from source |
Computed values (count.index, each.key) | Skip these | Variables/expressions should not be modified |
print() statements | Omit | Sentinel debugging, no ORL equivalent |
find_resources_being_destroyed() / filter_attribute_was_value(...) — blocks a destroy plan when an attribute was a given value | No direct equivalent | ORL cannot see destroy actions or prior state. Do not invent a substitute mechanism (e.g. lifecycle.prevent_destroy) the policy never references — instead convert the referenced attribute itself into a straightforward fix rule (e.g. deletion_protection must be true), and note in Limitations that the destroy-time enforcement itself isn't reproducible. |
When a Sentinel check cannot be converted, explain why and suggest the closest ORL alternative (usually audit-only). The closest alternative is the attribute the policy actually inspects — never substitute a different, unreferenced Terraform mechanism just because it achieves a similar-sounding outcome.
lifecycle.prevent_destroy for a deletion_protection check) even if it seems like a plausible-sounding proxy.gomboc_community_flow_convert_sentinel for the full pipeline.