CS-03 add offline sanitized IaC map extraction and explicit push

[maximelb]

Add cloudsec code iac-map extract and push plus CloudSec.push_iac_map. Extraction invokes the locally installed scanner iac-map-extract binary without SDK credentials/environment or authentication; upload is a separate explicit action accepting only bounded sanitized lc-iac-map/v1 JSON. Raw Terraform, duplicate/unknown fields, unsafe desired attributes and caller tenant fields are refused before HTTP.

The CLI documents limits and partial evidence, and discoverability includes both commands. Golden bytes/hash match the scanner contract. Tests cover offline token isolation, cross-tenant route stamping, secret redaction, raw input refusal and SDK forwarding.

Validation: required Python unit and microbenchmark suite passed: 4383 passed, 6 skipped, 17 existing warnings in 16.54 seconds. Focused command/discovery checks: 87 passed. Server rollout remains gated; a successful push reports reconciliation, not deployed or verified remediation.

[maximelb]

Pristine-checkout review completed at 67b7c4b: audited SDK refusal before network, fixed-binary argument list/no shell, credential-free extractor environment, bounded output and static exception text, canonical golden parity, explicit tenant URL, closed desired-boolean allowlist, and discovery registration. Required Python suite: 4383 passed, 6 skipped; Python 3.10–3.14 CI jobs are green. This review does not claim independent security review or live server rollout.

[maximelb]

Pristine review caught a missing S3 entry in the local preflight allowlist (the type name contains a digit). Fixed the allowlist and added state identity-only / plan desired S3 coverage. Full required suite rerun: 4384 passed, 6 skipped, 17 warnings in 18.02s. Server remains authoritative.

[maximelb]

Final pristine git-archive review at b5d2198 confirms the S3 correction preserves identity-only state and accepts only force_destroy boolean for plans. All22 resource type/provider/desired-control allowlist entries match the offline extractor vocabulary; canonical golden parity is unchanged. Python3.10–3.14 and Cloud Build dea2db60 are green; full required local suite4384passed,6skipped. No automatic extraction upload or credential inheritance; public API remains authoritative.

[maximelb]

Integrated current master by merge873a3f1. Append-only SDK, discovery and CLI documentation conflicts preserve both IaC map and build-provenance commands; no shared semantics changed. Required local suite now4393passed,6skipped,17warnings in16.48s. Full Python matrix and Cloud Build rerun on composed head; no live API request or upload performed.

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/python-limacharlie f54d308…7e23eb7 — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.

[maximelb]

Final composed head7e23eb7: Python3.10–3.14 CI all green; full Cloud Build1d819c41-793b-4dee-a531-6a0d620c5470 succeeded. Local complete suite:4,466 passed,6 skipped,17 warnings in14.10s. Self-reviewed public-repository composition preserves both CS-02 selectors and CS-03 sanitized push/offline extraction. Merge remains ordered behind graph writer dependencies; endpoint availability/security gates are not inferred from client code.