@intentius/behold 0.17.0 → 0.19.0

package/example-argo-estate/package-lock.json

@@ -561,9 +561,9 @@
       }
     },
     "node_modules/@kubernetes/client-node/node_modules/js-yaml": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
-      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz",
+      "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==",
       "funding": [
         {
           "type": "github",
@@ -1113,9 +1113,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",

package/example-carve/app/package-lock.json

@@ -541,9 +541,9 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "funding": [
         {
           "type": "github",

package/example-choudoufu-estate/.behold.json

@@ -0,0 +1,8 @@
+{
+  "members": [
+    { "dir": "monolith", "kind": "choudoufu" },
+    { "dir": "team-a", "kind": "choudoufu" },
+    { "dir": "team-b", "kind": "choudoufu" },
+    { "dir": "team-c", "kind": "choudoufu" }
+  ]
+}

package/example-choudoufu-estate/README.md

@@ -0,0 +1,48 @@
+# choudoufu-estate — behold's tag-owned estate demo (#366)
+
+Four [choudoufu](https://github.com/INTENTIUS/choudoufu) estates served as one
+composed estate. choudoufu is an OpenTofu fork whose ownership lives on the
+resource as two AWS tags, `tofu-estate` and `tofu-address`; the state file is a
+cache that is allowed to be stale, and an estate is split by retagging. The
+estates here are the live-mv workbench's own fixture (`examples/live-mv-workbench`
+in the choudoufu repo), copied:
+
+- **monolith/** — the terralith: three teams' IAM roles, policies, inline
+  policies, attachments and log groups in one estate. `scripts/choudoufu-up.sh`
+  applies it, so every one of its 21 resources is live and marked
+  `tofu-estate = tlmig-sample-monolith`.
+- **team-a/**, **team-b/**, **team-c/** — the estates the teams would own.
+  Each declares its own seven resources, which are the monolith's: served
+  live, every card reads *owned by tlmig-sample-monolith*, with a dashed
+  edge to the monolith's card of the same address. team-a also declares a VPC
+  the monolith does not, and team-b reads it through a data source filtered
+  on team-a's marker tags — the cross-estate reference `live-check -json`
+  states, drawn as an edge between the two boxes.
+- **monolith/carve.json** — the plan: team-a's five taggable resources move to
+  `tlmig-sample-team-a`. The scope panel shows each move with the
+  `choudoufu live-mv` line to run and a link to the morph; behold never runs
+  the write.
+
+```sh
+npx @intentius/behold demo choudoufu-estate      # needs Docker and choudoufu on PATH
+```
+
+What the demo does: boots a scratch floci (`behold-choudoufu-floci` on
+127.0.0.1:4650), runs `choudoufu init` in each estate copy (behold's own copy,
+never a served project), applies the monolith, and serves the four estates
+with `--env live`.
+
+Then, by hand, in `team-a/` (with the same `AWS_ENDPOINT_URL` the demo
+printed):
+
+```sh
+choudoufu live-mv -from-estate=tlmig-sample-monolith aws_iam_role.team_a aws_iam_role.team_a
+```
+
+Reload the overlay: the role and its two followers are green in team-a's box,
+the monolith's card for it reads *owned by tlmig-sample-team-a*, and
+`/api/choudoufu/moves?plan=carve.json&receipt=1` says `moved`. Apply team-a
+afterwards to bring its VPC up, and team-b's read resolves.
+
+`bash scripts/choudoufu-down.sh` removes the container. The `.terraform/`
+directories and the record stores are gitignored.

package/example-choudoufu-estate/monolith/behaviour.live.json

@@ -0,0 +1,495 @@
+{
+  "meta": {
+    "engine": "behold-fixture",
+    "version": "0",
+    "at": {
+      "traffic": "100 rps, p50"
+    }
+  },
+  "entities": {
+    "aws_iam_role.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_a_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.76
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.74
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy_attachment.team_a": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0001,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.72,
+        "latency": 0.58
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.49
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.85
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_a_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.76
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.67
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "degrades",
+        "note": "the trust policy names a zone-scoped service principal, so the assume path is re-established rather than kept"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_b_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.58
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.78,
+        "latency": 0.49
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy_attachment.team_b": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0001,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.72,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.76
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.67
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      },
+      "rightSize": {
+        "suggestion": "retention 1 day -> 7 days",
+        "reason": "the group is read for a week after every deploy and re-ingested when it is not"
+      }
+    },
+    "aws_cloudwatch_log_group.team_b_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.58
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role.team_c": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0004,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.9,
+        "latency": 0.49
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_role_policy.team_c_inline": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.84,
+        "latency": 0.85
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_iam_policy.team_c": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0002,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.78,
+        "latency": 0.76
+      },
+      "errorRate": 0.001,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_c_0": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0416,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.66,
+        "latency": 0.58
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_c_1": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0312,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.6,
+        "latency": 0.49
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    },
+    "aws_cloudwatch_log_group.team_c_2": {
+      "at": {
+        "traffic": "100 rps, p50"
+      },
+      "cost": {
+        "perHour": 0.0208,
+        "currency": "USD"
+      },
+      "headroom": {
+        "cpu": 0.54,
+        "latency": 0.85
+      },
+      "errorRate": 0.0004,
+      "resilience": {
+        "failure": "one zone lost",
+        "verdict": "survives"
+      },
+      "provenance": {
+        "engine": "behold-fixture",
+        "version": "0",
+        "tolerance": "fixture",
+        "basis": "modeled"
+      }
+    }
+  }
+}

package/example-choudoufu-estate/monolith/carve.json

@@ -0,0 +1,12 @@
+{
+  "from": "tlmig-sample-monolith",
+  "estates": ["tlmig-sample-team-a"],
+  "moves": [
+    { "address": "aws_iam_role.team_a", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_iam_policy.team_a", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_cloudwatch_log_group.team_a_0", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_cloudwatch_log_group.team_a_1", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" },
+    { "address": "aws_cloudwatch_log_group.team_a_2", "from": "tlmig-sample-monolith", "to": "tlmig-sample-team-a" }
+  ],
+  "rules": [{ "match": "name", "value": "team_a", "to": "tlmig-sample-team-a" }]
+}