synthesis: add terraform state secret examples

Author: geroldsteiner67

rust/modality/src/cmds/synthesize.rs

@@ -499,6 +499,8 @@ const FORMULA_EXAMPLE_GROUPS: &[FormulaExampleGroup] = &[
             r#"always([+ROTATE_PACKAGE_SIGNING_KEY] true -> eventually(<+NOTIFY_RELEASE_OWNER> true))"#,
             r#"always([+CLOUD_ACCESS_KEY_LEAKED] true -> (<+ROTATE_CLOUD_ACCESS_KEY> true | <+DISABLE_CLOUD_ACCOUNT> true))"#,
             r#"always([+ROTATE_CLOUD_ACCESS_KEY] true -> eventually(<+NOTIFY_CLOUD_ACCOUNT_OWNER> true))"#,
+            r#"always([+TERRAFORM_STATE_SECRET_EXPOSED] true -> (<+ROTATE_STATE_SECRETS> true | <+LOCK_TERRAFORM_BACKEND> true))"#,
+            r#"always([+ROTATE_STATE_SECRETS] true -> eventually(<+NOTIFY_INFRA_OWNER> true))"#,
             r#"next(<+APPROVE> true)"#,
             r#"next((<+APPROVE> true | [<+REJECT>] true))"#,
             r#"<+WAIT> true until <+APPROVE> true"#,
@@ -5047,6 +5049,18 @@ F2: formula generated_2 {
         ));
     }
 
+    #[test]
+    fn synthesis_list_includes_terraform_state_secret_exposure_prompt_examples() {
+        let output = synthesis_list_text();
+
+        assert!(output.contains(
+            "always([+TERRAFORM_STATE_SECRET_EXPOSED] true -> (<+ROTATE_STATE_SECRETS> true | <+LOCK_TERRAFORM_BACKEND> true))"
+        ));
+        assert!(output.contains(
+            "always([+ROTATE_STATE_SECRETS] true -> eventually(<+NOTIFY_INFRA_OWNER> true))"
+        ));
+    }
+
     #[test]
     fn synthesis_list_includes_escrow_progression_prompt_examples() {
         let output = synthesis_list_text();
@@ -15038,6 +15052,22 @@ gfp(X, []((X)) & ([<+ARCHIVE>] true))
         verify_synthesized_model(&model, &formulas).unwrap();
     }
 
+    #[test]
+    fn verify_synthesized_model_accepts_terraform_state_secret_exposure_prompt_examples() {
+        let formulas = parse_formula_strings(&[
+            "always([+TERRAFORM_STATE_SECRET_EXPOSED] true -> (<+ROTATE_STATE_SECRETS> true | <+LOCK_TERRAFORM_BACKEND> true))"
+                .to_string(),
+            "always([+ROTATE_STATE_SECRETS] true -> eventually(<+NOTIFY_INFRA_OWNER> true))"
+                .to_string(),
+        ]);
+        let model = modality_lang::formula_synthesis::synthesize_from_formulas(
+            "TerraformStateSecretExposure",
+            &formulas,
+        );
+
+        verify_synthesized_model(&model, &formulas).unwrap();
+    }
+
     #[test]
     fn verify_synthesized_model_accepts_mixed_alternatives_with_signer_requirement() {
         let formulas = parse_formula_strings(&[