@intentius/behold 0.8.0 → 0.9.1

package/example-carve/legacy-tf/terraform.tfstate

@@ -0,0 +1,602 @@
+{
+  "version": 4,
+  "terraform_version": "1.9.8",
+  "serial": 17,
+  "lineage": "00000000-0000-4000-8000-000000000000",
+  "outputs": {
+    "_fixture_note": {
+      "value": "SYNTHETIC. Hand-written for behold's carve demo estate (#254) — never produced by a real terraform apply. The account id is 000000000000 and every ARN, id and hostname in this file is fake. `chant carve advise --state` and `chant carve emit --state` read it as plain JSON, so no terraform binary and no cloud call is involved. The --live tier of the walkthrough replaces it with a state terraform really wrote, by applying legacy-tf into a scratch Floci (see floci-override.tf.disabled).",
+      "type": "string"
+    },
+    "api_function_name": {
+      "value": "acme-platform-api",
+      "type": "string"
+    },
+    "vpc_id": {
+      "value": "vpc-0a1b2c3d4e5f60718",
+      "type": "string"
+    },
+    "private_subnet_ids": {
+      "value": ["subnet-0a1b2c3d4e5f60719", "subnet-0a1b2c3d4e5f6071a"],
+      "type": ["list", "string"]
+    }
+  },
+  "resources": [
+    {
+      "mode": "data",
+      "type": "aws_availability_zones",
+      "name": "available",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "us-east-2",
+            "names": ["us-east-2a", "us-east-2b", "us-east-2c"],
+            "state": "available",
+            "zone_ids": ["use2-az1", "use2-az2", "use2-az3"]
+          }
+        }
+      ]
+    },
+    {
+      "mode": "data",
+      "type": "aws_prefix_list",
+      "name": "s3",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "cidr_blocks": ["52.219.0.0/16"],
+            "id": "pl-0000000000000000a",
+            "name": "com.amazonaws.us-east-2.s3"
+          }
+        }
+      ]
+    },
+    {
+      "mode": "data",
+      "type": "aws_ssm_parameter",
+      "name": "assets_cdn_domain",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "arn": "arn:aws:ssm:us-east-2:000000000000:parameter/acme/platform/prod/assets-cdn-domain",
+            "id": "/acme/platform/prod/assets-cdn-domain",
+            "name": "/acme/platform/prod/assets-cdn-domain",
+            "type": "String",
+            "value": "cdn.acme-platform.example.com",
+            "with_decryption": true
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_cloudwatch_log_group",
+      "name": "worker",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "arn": "arn:aws:logs:us-east-2:000000000000:log-group:/acme/platform/worker",
+            "id": "/acme/platform/worker",
+            "kms_key_id": "",
+            "log_group_class": "STANDARD",
+            "name": "/acme/platform/worker",
+            "name_prefix": "",
+            "retention_in_days": 30,
+            "skip_destroy": false,
+            "tags": {
+              "Component": "worker",
+              "Name": "acme-platform-worker"
+            },
+            "tags_all": {
+              "Component": "worker",
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-worker",
+              "Team": "platform"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_iam_role",
+      "name": "api",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["random_pet.suffix"],
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "arn": "arn:aws:iam::000000000000:role/acme-platform-api-gently-mutt",
+            "assume_role_policy": "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"lambda.amazonaws.com\"}}],\"Version\":\"2012-10-17\"}",
+            "create_date": "2026-06-14T09:12:44Z",
+            "description": "",
+            "force_detach_policies": false,
+            "id": "acme-platform-api-gently-mutt",
+            "managed_policy_arns": [
+              "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
+              "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
+            ],
+            "max_session_duration": 3600,
+            "name": "acme-platform-api-gently-mutt",
+            "name_prefix": "",
+            "path": "/",
+            "tags": {
+              "Component": "api"
+            },
+            "tags_all": {
+              "Component": "api",
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Team": "platform"
+            },
+            "unique_id": "AROA00000000000000001"
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_lambda_function",
+      "name": "api",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": [
+        "aws_iam_role.api",
+        "aws_s3_bucket.assets",
+        "aws_security_group.lambda",
+        "aws_subnet.private_a",
+        "aws_subnet.private_b",
+        "aws_vpc.main",
+        "random_pet.suffix"
+      ],
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "architectures": ["x86_64"],
+            "arn": "arn:aws:lambda:us-east-2:000000000000:function:acme-platform-api",
+            "environment": [
+              {
+                "variables": {
+                  "ASSETS_BUCKET": "acme-platform-assets-prod",
+                  "LOG_LEVEL": "info"
+                }
+              }
+            ],
+            "filename": "build/api.zip",
+            "function_name": "acme-platform-api",
+            "handler": "index.handler",
+            "id": "acme-platform-api",
+            "last_modified": "2026-06-14T09:13:02.184+0000",
+            "memory_size": 512,
+            "package_type": "Zip",
+            "publish": false,
+            "role": "arn:aws:iam::000000000000:role/acme-platform-api-gently-mutt",
+            "runtime": "nodejs22.x",
+            "source_code_size": 1048576,
+            "tags": {
+              "Component": "api"
+            },
+            "tags_all": {
+              "Component": "api",
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Team": "platform"
+            },
+            "timeout": 15,
+            "version": "$LATEST",
+            "vpc_config": [
+              {
+                "ipv6_allowed_for_dual_stack": false,
+                "security_group_ids": ["sg-0a1b2c3d4e5f6071b"],
+                "subnet_ids": ["subnet-0a1b2c3d4e5f60719", "subnet-0a1b2c3d4e5f6071a"],
+                "vpc_id": "vpc-0a1b2c3d4e5f60718"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_network_acl",
+      "name": "private",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["aws_subnet.private_a", "aws_subnet.private_b", "aws_vpc.main"],
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "arn": "arn:aws:ec2:us-east-2:000000000000:network-acl/acl-0a1b2c3d4e5f6071c",
+            "egress": [
+              {
+                "action": "allow",
+                "cidr_block": "0.0.0.0/0",
+                "from_port": 0,
+                "protocol": "-1",
+                "rule_no": 100,
+                "to_port": 0
+              }
+            ],
+            "id": "acl-0a1b2c3d4e5f6071c",
+            "ingress": [
+              {
+                "action": "allow",
+                "cidr_block": "10.42.0.0/16",
+                "from_port": 0,
+                "protocol": "tcp",
+                "rule_no": 100,
+                "to_port": 65535
+              }
+            ],
+            "owner_id": "000000000000",
+            "subnet_ids": ["subnet-0a1b2c3d4e5f60719", "subnet-0a1b2c3d4e5f6071a"],
+            "tags": {
+              "Name": "acme-platform-private"
+            },
+            "tags_all": {
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-private",
+              "Team": "platform"
+            },
+            "vpc_id": "vpc-0a1b2c3d4e5f60718"
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "assets",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "acceleration_status": "",
+            "arn": "arn:aws:s3:::acme-platform-assets-prod",
+            "bucket": "acme-platform-assets-prod",
+            "bucket_domain_name": "acme-platform-assets-prod.s3.amazonaws.com",
+            "bucket_prefix": "",
+            "bucket_regional_domain_name": "acme-platform-assets-prod.s3.us-east-2.amazonaws.com",
+            "cors_rule": [],
+            "force_destroy": false,
+            "hosted_zone_id": "Z2O1EMRO9K5GLX",
+            "id": "acme-platform-assets-prod",
+            "object_lock_enabled": false,
+            "region": "us-east-2",
+            "request_payer": "BucketOwner",
+            "server_side_encryption_configuration": [
+              {
+                "rule": [
+                  {
+                    "apply_server_side_encryption_by_default": [
+                      {
+                        "kms_master_key_id": "",
+                        "sse_algorithm": "AES256"
+                      }
+                    ],
+                    "bucket_key_enabled": false
+                  }
+                ]
+              }
+            ],
+            "tags": {
+              "Name": "acme-platform-assets",
+              "Purpose": "static-assets"
+            },
+            "tags_all": {
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-assets",
+              "Purpose": "static-assets",
+              "Team": "platform"
+            },
+            "versioning": [
+              {
+                "enabled": true,
+                "mfa_delete": false
+              }
+            ],
+            "website": []
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_s3_bucket_public_access_block",
+      "name": "assets",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["aws_s3_bucket.assets"],
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "block_public_acls": true,
+            "block_public_policy": true,
+            "bucket": "acme-platform-assets-prod",
+            "id": "acme-platform-assets-prod",
+            "ignore_public_acls": true,
+            "restrict_public_buckets": true
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_s3_bucket_versioning",
+      "name": "assets",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["aws_s3_bucket.assets"],
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "bucket": "acme-platform-assets-prod",
+            "expected_bucket_owner": "",
+            "id": "acme-platform-assets-prod",
+            "mfa": null,
+            "versioning_configuration": [
+              {
+                "mfa_delete": "",
+                "status": "Enabled"
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_security_group",
+      "name": "lambda",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["aws_vpc.main", "random_pet.suffix"],
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "arn": "arn:aws:ec2:us-east-2:000000000000:security-group/sg-0a1b2c3d4e5f6071b",
+            "description": "Egress-only group for the acme-platform API lambda",
+            "egress": [
+              {
+                "cidr_blocks": [],
+                "description": "S3 via the regional gateway prefix list",
+                "from_port": 443,
+                "prefix_list_ids": ["pl-0000000000000000a"],
+                "protocol": "tcp",
+                "security_groups": [],
+                "self": false,
+                "to_port": 443
+              },
+              {
+                "cidr_blocks": ["10.42.0.0/16"],
+                "description": "SSM interface endpoint, inside the VPC",
+                "from_port": 443,
+                "prefix_list_ids": [],
+                "protocol": "tcp",
+                "security_groups": [],
+                "self": false,
+                "to_port": 443
+              }
+            ],
+            "id": "sg-0a1b2c3d4e5f6071b",
+            "ingress": [],
+            "name": "acme-platform-lambda-gently-mutt",
+            "name_prefix": "",
+            "owner_id": "000000000000",
+            "revoke_rules_on_delete": false,
+            "tags": {
+              "Name": "acme-platform-lambda"
+            },
+            "tags_all": {
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-lambda",
+              "Team": "platform"
+            },
+            "vpc_id": "vpc-0a1b2c3d4e5f60718"
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_subnet",
+      "name": "private_a",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["aws_vpc.main", "random_pet.suffix"],
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "arn": "arn:aws:ec2:us-east-2:000000000000:subnet/subnet-0a1b2c3d4e5f60719",
+            "assign_ipv6_address_on_creation": false,
+            "availability_zone": "us-east-2a",
+            "availability_zone_id": "use2-az1",
+            "cidr_block": "10.42.1.0/24",
+            "id": "subnet-0a1b2c3d4e5f60719",
+            "map_public_ip_on_launch": false,
+            "owner_id": "000000000000",
+            "tags": {
+              "Name": "acme-platform-private-a-gently-mutt",
+              "Tier": "private"
+            },
+            "tags_all": {
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-private-a-gently-mutt",
+              "Team": "platform",
+              "Tier": "private"
+            },
+            "vpc_id": "vpc-0a1b2c3d4e5f60718"
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_subnet",
+      "name": "private_b",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["aws_vpc.main", "random_pet.suffix"],
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "arn": "arn:aws:ec2:us-east-2:000000000000:subnet/subnet-0a1b2c3d4e5f6071a",
+            "assign_ipv6_address_on_creation": false,
+            "availability_zone": "us-east-2b",
+            "availability_zone_id": "use2-az2",
+            "cidr_block": "10.42.2.0/24",
+            "id": "subnet-0a1b2c3d4e5f6071a",
+            "map_public_ip_on_launch": false,
+            "owner_id": "000000000000",
+            "tags": {
+              "Name": "acme-platform-private-b-gently-mutt",
+              "Tier": "private"
+            },
+            "tags_all": {
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-private-b-gently-mutt",
+              "Team": "platform",
+              "Tier": "private"
+            },
+            "vpc_id": "vpc-0a1b2c3d4e5f60718"
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_vpc",
+      "name": "main",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": ["random_pet.suffix"],
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "arn": "arn:aws:ec2:us-east-2:000000000000:vpc/vpc-0a1b2c3d4e5f60718",
+            "cidr_block": "10.42.0.0/16",
+            "default_network_acl_id": "acl-0a1b2c3d4e5f6071d",
+            "default_route_table_id": "rtb-0a1b2c3d4e5f6071e",
+            "default_security_group_id": "sg-0a1b2c3d4e5f6071f",
+            "dhcp_options_id": "dopt-0a1b2c3d4e5f60720",
+            "enable_dns_hostnames": true,
+            "enable_dns_support": true,
+            "id": "vpc-0a1b2c3d4e5f60718",
+            "instance_tenancy": "default",
+            "main_route_table_id": "rtb-0a1b2c3d4e5f6071e",
+            "owner_id": "000000000000",
+            "tags": {
+              "Name": "acme-platform-gently-mutt"
+            },
+            "tags_all": {
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-gently-mutt",
+              "Team": "platform"
+            }
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "aws_vpc_endpoint",
+      "name": "ssm",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "dependencies": [
+        "aws_security_group.lambda",
+        "aws_subnet.private_a",
+        "aws_subnet.private_b",
+        "aws_vpc.main",
+        "random_pet.suffix"
+      ],
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "arn": "arn:aws:ec2:us-east-2:000000000000:vpc-endpoint/vpce-0a1b2c3d4e5f60721",
+            "id": "vpce-0a1b2c3d4e5f60721",
+            "ip_address_type": "ipv4",
+            "owner_id": "000000000000",
+            "private_dns_enabled": true,
+            "requester_managed": false,
+            "route_table_ids": [],
+            "security_group_ids": ["sg-0a1b2c3d4e5f6071b"],
+            "service_name": "com.amazonaws.us-east-2.ssm",
+            "state": "available",
+            "subnet_ids": ["subnet-0a1b2c3d4e5f60719", "subnet-0a1b2c3d4e5f6071a"],
+            "tags": {
+              "Name": "acme-platform-ssm"
+            },
+            "tags_all": {
+              "Environment": "prod",
+              "ManagedBy": "terraform",
+              "Name": "acme-platform-ssm",
+              "Team": "platform"
+            },
+            "vpc_endpoint_type": "Interface",
+            "vpc_id": "vpc-0a1b2c3d4e5f60718"
+          }
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "random_pet",
+      "name": "suffix",
+      "provider": "provider[\"registry.terraform.io/hashicorp/random\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "gently-mutt",
+            "keepers": null,
+            "length": 2,
+            "prefix": null,
+            "separator": "-"
+          }
+        }
+      ]
+    },
+    {
+      "module": "module.cdn",
+      "mode": "managed",
+      "type": "aws_cloudfront_distribution",
+      "name": "this",
+      "provider": "provider[\"registry.terraform.io/hashicorp/aws\"]",
+      "instances": [
+        {
+          "schema_version": 1,
+          "attributes": {
+            "aliases": ["cdn.acme-platform.example.com"],
+            "arn": "arn:aws:cloudfront::000000000000:distribution/E00000000000AA",
+            "comment": "acme-platform-assets-gently-mutt",
+            "domain_name": "d000000000000a.cloudfront.net",
+            "enabled": true,
+            "hosted_zone_id": "Z2FDTNDATAQYW2",
+            "id": "E00000000000AA",
+            "price_class": "PriceClass_100",
+            "status": "Deployed"
+          }
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}

package/example-carve/legacy-tf/versions.tf

@@ -0,0 +1,40 @@
+# The Terraform half of behold's carve demo estate (#254).
+#
+# Everything in this directory is still Terraform-owned. The chant half lives in
+# ../app — the log group and the SSM parameter that came out of here last month.
+#
+# Nothing here has ever been applied to a real AWS account. The committed
+# terraform.tfstate is synthetic (see its `_fixture_note` output and README.md),
+# the account id in it is 000000000000, and every ARN is fake. Values are
+# boring-realistic on purpose: the walkthrough video pauses on the inspect pane.
+#
+# `chant carve advise` parses these files with @cdktf/hcl2json — no terraform
+# binary, no provider download, no network. See ../README.md for the scores this
+# estate is tuned to produce and why each one lands where it does.
+
+terraform {
+  required_version = ">= 1.6"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.6"
+    }
+  }
+}
+
+provider "aws" {
+  region = "us-east-2"
+
+  default_tags {
+    tags = {
+      Environment = "prod"
+      ManagedBy   = "terraform"
+      Team        = "platform"
+    }
+  }
+}

package/example-flux-estate/README.md

@@ -10,9 +10,12 @@ Three chant projects served as one composed estate:
   every object: the fully-resolved half.
 - **app-b/** — the same workload with **no** namespace anywhere: the control
   plane's `targetNamespace` stamps it at apply time. Idiomatic Flux, and the
-  deliberate exhibit of behold's namespace-mismatch note (behold#192) — a
-  plain live read scopes to `default`, finds nothing, and behold explains the
-  all-pending paint instead of letting it read as "not deployed".
+  deliberate exhibit of the estate namespace join (behold#221). Served alone,
+  app-b's live read scopes to `default`, finds nothing, and behold explains
+  the all-pending paint with the namespace-mismatch note (behold#192) instead
+  of letting it read as "not deployed". Served composed, the estate reads the
+  binding off the control plane's own `Kustomization` and scopes app-b's read
+  to `app-b` — the answer neither project holds by itself.
 
 ```sh
 npx @intentius/behold demo flux-estate
@@ -27,7 +30,9 @@ this repo, and serves the three projects composed. What to look at:
   Kustomization → GitRepository across stacks, and the `dependsOn` edge from
   app-b's Kustomization to app-a's — the estate's reconcile ordering.
 - The **overlay** (env `local`): app-a green, the control plane's CRs green,
-  app-b pending **with the note explaining why**.
+  and app-b green too — read in the namespace the control plane binds it to,
+  with a note naming where it looked. Serve `app-b` on its own to see the
+  same objects go pending, which is what the join is worth.
 - The **runtime tier** (zoom: runtime), on the estate itself since behold#224:
   the workloads Flux deployed, attributed back to the declaring Kustomization
   via its labels (chant#1549) and boxed under it.

package/example-flux-estate/app-a/package.json

@@ -7,7 +7,7 @@
     "build": "chant build src -o manifests/app.yaml --format yaml"
   },
   "dependencies": {
-    "@intentius/chant": "^0.44.3",
-    "@intentius/chant-lexicon-k8s": "^0.44.3"
+    "@intentius/chant": "^0.44.7",
+    "@intentius/chant-lexicon-k8s": "^0.44.7"
   }
 }