@intentius/behold 0.17.0 → 0.18.0

package/example-choudoufu-estate/.behold.json

@@ -0,0 +1,8 @@
+{
+  "members": [
+    { "dir": "monolith", "kind": "choudoufu" },
+    { "dir": "team-a", "kind": "choudoufu" },
+    { "dir": "team-b", "kind": "choudoufu" },
+    { "dir": "team-c", "kind": "choudoufu" }
+  ]
+}

package/example-choudoufu-estate/README.md

@@ -0,0 +1,48 @@
+# choudoufu-estate — behold's tag-owned estate demo (#366)
+
+Four [choudoufu](https://github.com/INTENTIUS/choudoufu) estates served as one
+composed estate. choudoufu is an OpenTofu fork whose ownership lives on the
+resource as two AWS tags, `tofu-estate` and `tofu-address`; the state file is a
+cache that is allowed to be stale, and an estate is split by retagging. The
+estates here are the live-mv workbench's own fixture (`examples/live-mv-workbench`
+in the choudoufu repo), copied:
+
+- **monolith/** — the terralith: three teams' IAM roles, policies, inline
+  policies, attachments and log groups in one estate. `scripts/choudoufu-up.sh`
+  applies it, so every one of its 21 resources is live and marked
+  `tofu-estate = tlmig-sample-monolith`.
+- **team-a/**, **team-b/**, **team-c/** — the estates the teams would own.
+  Each declares its own seven resources, which are the monolith's: served
+  live, every card reads *owned by tlmig-sample-monolith*, with a dashed
+  edge to the monolith's card of the same address. team-a also declares a VPC
+  the monolith does not, and team-b reads it through a data source filtered
+  on team-a's marker tags — the cross-estate reference `live-check -json`
+  states, drawn as an edge between the two boxes.
+- **monolith/carve.json** — the plan: team-a's five taggable resources move to
+  `tlmig-sample-team-a`. The scope panel shows each move with the
+  `choudoufu live-mv` line to run and a link to the morph; behold never runs
+  the write.
+
+```sh
+npx @intentius/behold demo choudoufu-estate      # needs Docker and choudoufu on PATH
+```
+
+What the demo does: boots a scratch floci (`behold-choudoufu-floci` on
+127.0.0.1:4650), runs `choudoufu init` in each estate copy (behold's own copy,
+never a served project), applies the monolith, and serves the four estates
+with `--env live`.
+
+Then, by hand, in `team-a/` (with the same `AWS_ENDPOINT_URL` the demo
+printed):
+
+```sh
+choudoufu live-mv -from-estate=tlmig-sample-monolith aws_iam_role.team_a aws_iam_role.team_a
+```
+
+Reload the overlay: the role and its two followers are green in team-a's box,
+the monolith's card for it reads *owned by tlmig-sample-team-a*, and
+`/api/choudoufu/moves?plan=carve.json&receipt=1` says `moved`. Apply team-a
+afterwards to bring its VPC up, and team-b's read resolves.
+
+`bash scripts/choudoufu-down.sh` removes the container. The `.terraform/`
+directories and the record stores are gitignored.

package/example-choudoufu-estate/monolith/behaviour.live.json

@@ -0,0 +1,495 @@
+{
+  "meta": {
+    "engine": "behold-fixture",
+    "version": "0",
+    "at": {
+      "traffic": "100 rps, p50"
+    }
+  },
+  "entities": {
+    "aws_iam_role.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_a_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.76
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.74
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy_attachment.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0001,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.72,
+        "latency": 0.58
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.49
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.85
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.76
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.67
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "degrades",
+        "note": "the trust policy names a zone-scoped service principal, so the assume path is re-established rather than kept"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_b_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.58
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.78,
+        "latency": 0.49
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy_attachment.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0001,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.72,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.76
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.67
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      },
+      "rightSize": {
+        "suggestion": "retention 1 day -> 7 days",
+        "reason": "the group is read for a week after every deploy and re-ingested when it is not"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.58
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role.team_c": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.49
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_c_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_c": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.78,
+        "latency": 0.76
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_c_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.58
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_c_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.49
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_c_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.85
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    }
+  }
+}

package/example-choudoufu-estate/monolith/carve.json

@@ -0,0 +1,12 @@
+{
+  "from": "tlmig-sample-monolith",
+  "estates": ["tlmig-sample-team-a"],
+  "moves": [
+    { "address": "aws_iam_role.team_a", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_iam_policy.team_a", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_cloudwatch_log_group.team_a_0", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_cloudwatch_log_group.team_a_1", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_cloudwatch_log_group.team_a_2", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" }
+  ],
+  "rules": [{ "match": "name", "value": "team_a", "to": "tlmig-sample-team-a" }]
+}

package/example-choudoufu-estate/monolith/main.tf

@@ -0,0 +1,127 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 6.58.0"
+    }
+  }
+  live {
+    estate = "tlmig-sample-monolith"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+
+# ---- team-a ----
+resource "aws_iam_role" "team_a" {
+  name               = "tlmig-sample-team-a-role"
+  assume_role_policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Principal = { Service = "ec2.amazonaws.com" }, Action = "sts:AssumeRole" }] })
+}
+
+resource "aws_iam_role_policy" "team_a_inline" {
+  name   = "tlmig-sample-team-a-inline"
+  role   = aws_iam_role.team_a.id
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:CreateLogStream"], Resource = "*" }] })
+}
+
+resource "aws_iam_policy" "team_a" {
+  name   = "tlmig-sample-team-a-policy"
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:PutLogEvents"], Resource = "*" }] })
+}
+
+resource "aws_iam_role_policy_attachment" "team_a" {
+  role       = aws_iam_role.team_a.name
+  policy_arn = aws_iam_policy.team_a.arn
+}
+
+resource "aws_cloudwatch_log_group" "team_a_0" {
+  name              = "/tlmig-sample/team-a/svc-0"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_a_1" {
+  name              = "/tlmig-sample/team-a/svc-1"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_a_2" {
+  name              = "/tlmig-sample/team-a/svc-2"
+  retention_in_days = 1
+}
+
+# ---- team-b ----
+resource "aws_iam_role" "team_b" {
+  name               = "tlmig-sample-team-b-role"
+  assume_role_policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Principal = { Service = "ec2.amazonaws.com" }, Action = "sts:AssumeRole" }] })
+}
+
+resource "aws_iam_role_policy" "team_b_inline" {
+  name   = "tlmig-sample-team-b-inline"
+  role   = aws_iam_role.team_b.id
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:CreateLogStream"], Resource = "*" }] })
+}
+
+resource "aws_iam_policy" "team_b" {
+  name   = "tlmig-sample-team-b-policy"
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:PutLogEvents"], Resource = "*" }] })
+}
+
+resource "aws_iam_role_policy_attachment" "team_b" {
+  role       = aws_iam_role.team_b.name
+  policy_arn = aws_iam_policy.team_b.arn
+}
+
+resource "aws_cloudwatch_log_group" "team_b_0" {
+  name              = "/tlmig-sample/team-b/svc-0"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_b_1" {
+  name              = "/tlmig-sample/team-b/svc-1"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_b_2" {
+  name              = "/tlmig-sample/team-b/svc-2"
+  retention_in_days = 1
+}
+
+# ---- team-c ----
+resource "aws_iam_role" "team_c" {
+  name               = "tlmig-sample-team-c-role"
+  assume_role_policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Principal = { Service = "ec2.amazonaws.com" }, Action = "sts:AssumeRole" }] })
+}
+
+resource "aws_iam_role_policy" "team_c_inline" {
+  name   = "tlmig-sample-team-c-inline"
+  role   = aws_iam_role.team_c.id
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:CreateLogStream"], Resource = "*" }] })
+}
+
+resource "aws_iam_policy" "team_c" {
+  name   = "tlmig-sample-team-c-policy"
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:PutLogEvents"], Resource = "*" }] })
+}
+
+resource "aws_iam_role_policy_attachment" "team_c" {
+  role       = aws_iam_role.team_c.name
+  policy_arn = aws_iam_policy.team_c.arn
+}
+
+resource "aws_cloudwatch_log_group" "team_c_0" {
+  name              = "/tlmig-sample/team-c/svc-0"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_c_1" {
+  name              = "/tlmig-sample/team-c/svc-1"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_c_2" {
+  name              = "/tlmig-sample/team-c/svc-2"
+  retention_in_days = 1
+}

package/example-choudoufu-estate/scripts/choudoufu-down.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# Tear down the choudoufu-estate demo: remove OUR floci container, by its name
+# and no other (behold's scratch discipline, src/scratch.ts). The estate
+# copies stay — they are yours to edit; the next choudoufu-up.sh re-applies.
+set -euo pipefail
+CONTAINER=behold-choudoufu-floci
+docker rm -f "$CONTAINER" >/dev/null 2>&1 || true
+echo "choudoufu-estate demo: ${CONTAINER} removed."