FROM RULE DIAGNOSTICS TO GUARDED COMPILA- TION FOR INFRASTRUCTURE-AS-CODE REPAIR

Repairing an infrastructure rule violation can require constructing a resource that is itself subject to further rules. We use this rule structure to compile reusable resource obligations and execute them under a structural guard before model revision. Our diagnostic study shows why both steps matter: adding resource locations to feedback raises scanner acceptance by $8.8$ percentage points, concentrated on bucket-bearing templates, while joint scanner-and-lint acceptance stays flat. The intervention study evaluates a frozen compiler on $153$ matched CloudFormation tasks. With Haiku 4.5 and a six-call refinement cap, guarded compilation reaches $88.2\%$ joint acceptance versus Reflexion's $80.4\%$, using $1.78$ versus $3.42$ calls and $120.4$k versus $230.1$k input tokens per task. Executing the library adds $4.6$ points over supplying it as context. Rule diagnostics thus motivate a concrete intervention: resolve supported obligations with checked code and reserve model revision for the residual failures. The benchmark was used during development, and the acceptance advantage does not persist with the tested stronger runtimes.