@intentius/behold 0.17.0 → 0.18.0

package/example-choudoufu-estate/scripts/choudoufu-up.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Stand up the choudoufu-estate demo (behold#372, M4 of #366): a scratch floci
+# (the AWS emulator), provider schemas in each estate copy, and the terralith
+# applied — one estate with three teams' worth of IAM and log groups in it,
+# the shape the live-mv workbench splits. The team estates start empty: their
+# declared resources are the monolith's, and the plan in monolith/carve.json
+# says which move where.
+#
+# Scratch discipline (behold's src/scratch.ts): the container is named
+# behold-*, this script refuses to adopt an existing one, and only
+# choudoufu-down.sh removes it — by this name and no other. The port is not
+# the shared emulator's (:4566); nothing here can reach a floci that another
+# tool runs.
+#
+# `choudoufu init` runs here, in behold's OWN copy of the estates (the demo
+# target), never in a served project: that is #366's decision, and this is
+# the one place it holds.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+CONTAINER=behold-choudoufu-floci
+PORT=4650
+# The image the live-mv workbench measures against (choudoufu's live/floci-image).
+IMAGE="ghcr.io/lex00/floci@sha256:a39185cc3971d0188663d61043cb038dff1260d8a975b1aa72c4e2bb1feac3cb"
+
+if ! docker info >/dev/null 2>&1; then
+  echo "choudoufu-estate demo: Docker is not running — start Docker and re-run." >&2
+  exit 1
+fi
+# behold#388: the same binary behold itself spawns — the Homebrew release is
+# below the 0.16.0 floor, so a build from main is named by CHOUDOUFU_BIN and
+# every script that runs choudoufu has to honour it or the demo's `init` and
+# behold's own reads would be two different tools.
+CHOUDOUFU="${CHOUDOUFU_BIN:-choudoufu}"
+if ! command -v "$CHOUDOUFU" >/dev/null 2>&1; then
+  echo "choudoufu-estate demo: ${CHOUDOUFU} is not on PATH — https://github.com/INTENTIUS/choudoufu (0.16.0 or newer), or set CHOUDOUFU_BIN." >&2
+  exit 1
+fi
+
+if docker ps -a --format '{{.Names}}' | grep -qx "$CONTAINER"; then
+  echo "choudoufu-estate demo: container ${CONTAINER} already exists — a previous run didn't tear down. \`bash scripts/choudoufu-down.sh\` and re-run." >&2
+  exit 1
+fi
+echo "→ floci on 127.0.0.1:${PORT} (${CONTAINER})"
+docker run -d --name "$CONTAINER" -p "127.0.0.1:${PORT}:4566" "$IMAGE" >/dev/null
+for _ in $(seq 1 40); do
+  curl -fs -o /dev/null "http://127.0.0.1:${PORT}/" && break
+  sleep 1
+done
+
+export AWS_ENDPOINT_URL="http://127.0.0.1:${PORT}"
+export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test AWS_REGION=us-east-1
+
+for estate in monolith team-a team-b team-c; do
+  echo "→ choudoufu init in ${estate} (provider schemas — what makes the rungs real)"
+  (cd "$estate" && "$CHOUDOUFU" init -input=false -no-color >/dev/null)
+done
+
+echo "→ choudoufu apply in monolith (the terralith: 21 resources, three teams in one estate)"
+(cd monolith && "$CHOUDOUFU" apply -auto-approve -input=false -no-color | tail -1)
+
+echo "choudoufu-estate demo: up. behold serves it next; the plan in monolith/carve.json moves team-a's resources out."

package/example-choudoufu-estate/team-a/behaviour.live.json

@@ -0,0 +1,179 @@
+{
+  "meta": {
+    "engine": "behold-fixture",
+    "version": "0",
+    "at": {
+      "traffic": "100 rps, p50"
+    }
+  },
+  "entities": {
+    "aws_iam_role.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_a_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.76
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.78,
+        "latency": 0.67
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy_attachment.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0001,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.72,
+        "latency": 0.58
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.49
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.85
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.76
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    }
+  }
+}

package/example-choudoufu-estate/team-a/main.tf

@@ -0,0 +1,58 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 6.58.0"
+    }
+  }
+  live {
+    estate = "tlmig-sample-team-a"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_iam_role" "team_a" {
+  name               = "tlmig-sample-team-a-role"
+  assume_role_policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Principal = { Service = "ec2.amazonaws.com" }, Action = "sts:AssumeRole" }] })
+}
+
+resource "aws_iam_role_policy" "team_a_inline" {
+  name   = "tlmig-sample-team-a-inline"
+  role   = aws_iam_role.team_a.id
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:CreateLogStream"], Resource = "*" }] })
+}
+
+resource "aws_iam_policy" "team_a" {
+  name   = "tlmig-sample-team-a-policy"
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:PutLogEvents"], Resource = "*" }] })
+}
+
+resource "aws_iam_role_policy_attachment" "team_a" {
+  role       = aws_iam_role.team_a.name
+  policy_arn = aws_iam_policy.team_a.arn
+}
+
+resource "aws_cloudwatch_log_group" "team_a_0" {
+  name              = "/tlmig-sample/team-a/svc-0"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_a_1" {
+  name              = "/tlmig-sample/team-a/svc-1"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_a_2" {
+  name              = "/tlmig-sample/team-a/svc-2"
+  retention_in_days = 1
+}
+
+# The producer half of the cross-estate read below. team-b reaches this VPC
+# by its markers, so moving it out of this estate is not free: see the data
+# source in tlmig-sample-team-b.
+resource "aws_vpc" "main" {
+  cidr_block = "10.77.0.0/16"
+}

package/example-choudoufu-estate/team-b/behaviour.live.json

@@ -0,0 +1,179 @@
+{
+  "meta": {
+    "engine": "behold-fixture",
+    "version": "0",
+    "at": {
+      "traffic": "100 rps, p50"
+    }
+  },
+  "entities": {
+    "aws_iam_role.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_b_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.76
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.78,
+        "latency": 0.67
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy_attachment.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0001,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.72,
+        "latency": 0.58
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.49
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.85
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.76
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    }
+  }
+}

package/example-choudoufu-estate/team-b/main.tf

@@ -0,0 +1,73 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 6.58.0"
+    }
+  }
+  live {
+    estate = "tlmig-sample-team-b"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+resource "aws_iam_role" "team_b" {
+  name               = "tlmig-sample-team-b-role"
+  assume_role_policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Principal = { Service = "ec2.amazonaws.com" }, Action = "sts:AssumeRole" }] })
+}
+
+resource "aws_iam_role_policy" "team_b_inline" {
+  name   = "tlmig-sample-team-b-inline"
+  role   = aws_iam_role.team_b.id
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:CreateLogStream"], Resource = "*" }] })
+}
+
+resource "aws_iam_policy" "team_b" {
+  name   = "tlmig-sample-team-b-policy"
+  policy = jsonencode({ Version = "2012-10-17", Statement = [{ Effect = "Allow", Action = ["logs:PutLogEvents"], Resource = "*" }] })
+}
+
+resource "aws_iam_role_policy_attachment" "team_b" {
+  role       = aws_iam_role.team_b.name
+  policy_arn = aws_iam_policy.team_b.arn
+}
+
+resource "aws_cloudwatch_log_group" "team_b_0" {
+  name              = "/tlmig-sample/team-b/svc-0"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_b_1" {
+  name              = "/tlmig-sample/team-b/svc-1"
+  retention_in_days = 1
+}
+
+resource "aws_cloudwatch_log_group" "team_b_2" {
+  name              = "/tlmig-sample/team-b/svc-2"
+  retention_in_days = 1
+}
+
+# ---- read across the estate boundary ----
+# live/OUTPUTS.md's pattern, which replaces the banned terraform_remote_state:
+# a data source filtered on the producer's two marker tags. This is what
+# `choudoufu live-check -json` reports as references[], with read_by naming
+# aws_subnet.app below - and what the planner prices, because moving
+# aws_vpc.main out of tlmig-sample-team-a means rewriting this filter.
+data "aws_vpc" "team_a_network" {
+  filter {
+    name   = "tag:tofu-estate"
+    values = ["tlmig-sample-team-a"]
+  }
+  filter {
+    name   = "tag:tofu-address"
+    values = ["aws_vpc.main"]
+  }
+}
+
+resource "aws_subnet" "app" {
+  vpc_id     = data.aws_vpc.team_a_network.id
+  cidr_block = "10.77.1.0/24"
+}