@intentius/chant-lexicon-azure 0.44.1 → 0.44.2

package/dist/composites/landing-zone.d.ts

@@ -1,12 +1,12 @@
 /**
- * Landing-zone bootstrap composites (#791, epic #787 C1) — the Azure slice.
+ * Landing-zone bootstrap composites — the Azure slice.
  *
  * Fixed-shape resources for greenfield creation of the recommended
  * governance foundation. The evaluability rules (EVL002/004) require
  * composites to declare a fixed set of resources, so these carry the
  * foundation only; arbitrary management-group/subscription trees are
  * authored as config with `landingZoneConfig()` (../governance.ts) and
- * reconciled by the Azure cloud warden, and further groups/subscriptions
+ * reconciled by an external governance reconciler, and further groups/subscriptions
  * are declared as ordinary resources.
  *
  * A single ARM template cannot mix deployment scopes (AZR030, #1545), so

package/dist/governance.d.ts

@@ -1,6 +1,6 @@
 /**
- * Azure governance authoring (#791, epic #787 C1): the desired-state config
- * shape the Azure cloud warden reconciles, and `landingZoneConfig()` — the
+ * Azure governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
  * typed authoring layer that emits it.
  *
  * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
@@ -9,7 +9,7 @@
  * the AWS/GCP slices (lexicons/{aws,gcp}/src/governance.ts): authoring emits
  * config (this module, arbitrary cardinality); resources for greenfield
  * bootstrap are the fixed-shape composites in `composites/landing-zone.ts`;
- * the warden consumes only the config.
+ * the reconciler consumes only the config.
  *
  * Azure has no OrganizationRoot analog — the tenant and its root management
  * group come from Entra ID, never from the resource API. Subscriptions the
@@ -31,9 +31,9 @@ export interface PolicyConfig {
 /** A subscription declared inside a management group. */
 export interface SubscriptionConfig {
     name: string;
-    /** An existing subscription to place. Omitted: the warden creates one via a tenant-scope alias. */
+    /** An existing subscription to place. Omitted: the reconciler creates one via a tenant-scope alias. */
     subscriptionId?: string;
-    /** Billing scope for subscriptions the warden creates. */
+    /** Billing scope for subscriptions the reconciler creates. */
     billingScope?: string;
     workload?: "Production" | "DevTest";
 }
@@ -48,9 +48,9 @@ export interface ManagementGroupConfig {
 }
 /**
  * The desired-state governance tree for one Azure tenant. This is the shape
- * the Azure cloud warden loads as config — the Azure counterpart of
+ * an external governance reconciler loads as config — the Azure counterpart of
  * `AwsGovernanceConfig`/`GcpGovernanceConfig`. Cycles map onto the
- * governance verbs (#790): the management-group/subscription tree is
+ * governance verbs: the management-group/subscription tree is
  * `org-unit`, policy assignments are `policy-guardrail`, the activity-log
  * sink is `audit-sink`.
  */
@@ -110,7 +110,7 @@ export interface LandingZoneConfigProps {
     activityLogWorkspaceId?: string;
 }
 /**
- * Author the desired-state tree the Azure cloud warden reconciles. Pure.
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
  * Throws when the tree assigns a policy name with no definition; only
  * policies the tree actually assigns are included in the output.
  */

package/dist/governance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACrC;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QACN,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,qFAAqF;QACrF,+BAA+B,CAAC,EAAE,OAAO,CAAC;KAC3C,CAAC;IACF,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACxD,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,kCAAkC;IAClC,UAAU,CAAC,EAAE;QACX,WAAW,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;KACvC,CAAC;CACH;AAMD,eAAO,MAAM,sBAAsB,EAAE,YAQpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,YA4BlC,CAAC;AAEF,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAe9E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2CAA2C,8FACqC,CAAC;AAE9F;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAK9E,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,2IAA2I;IAC3I,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxC,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mGAAmG;IACnG,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,GAAG,qBAAqB,CA2C3F"}
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAMH,qFAAqF;AACrF,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,uGAAuG;IACvG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACrC;AAED,4FAA4F;AAC5F,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAClD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE;QACN,iEAAiE;QACjE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,qFAAqF;QACrF,+BAA+B,CAAC,EAAE,OAAO,CAAC;KAC3C,CAAC;IACF,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACxD,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvC,kCAAkC;IAClC,UAAU,CAAC,EAAE;QACX,WAAW,CAAC,EAAE;YAAE,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;KACvC,CAAC;CACH;AAMD,eAAO,MAAM,sBAAsB,EAAE,YAQpC,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,YA4BlC,CAAC;AAEF,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAe9E;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2CAA2C,8FACqC,CAAC;AAE9F;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAK9E,CAAC;AAMF,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,2IAA2I;IAC3I,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzD,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACxC,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mGAAmG;IACnG,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,sBAA2B,GAAG,qBAAqB,CA2C3F"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "f770263394af1084f4898fa1eab75808c183729510a0b6dc9b8a2dde440b10dd",
+    "manifest.json": "2145b0e429f811b3dd11e55f7bc68a9668976e280d1d8c6e7d520c10eacc2ccb",
     "meta.json": "760a8d2e359be71f29a990339cb075701fe668e6275dfa923b9d112474ba660a",
     "types/index.d.ts": "c5a8a3e107b07a11ac992fa7d6d136fe1a71c99a89c57921b3e4bc86361adb3f",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
@@ -29,13 +29,13 @@
     "rules/azr028.ts": "cbb0b780f62478b3cf26261e28a41f231f202d6bb8905c96b84a1e4080df9a1a",
     "rules/azr029.ts": "18e6cef437207239aa8c8f1b382e0f95661cb0bca0de83ca293f66f0db446ee0",
     "rules/azr030.ts": "81ede36e17290b860d51d1a0d20769383f903c5cc84036168f1d74b9befe065e",
-    "rules/azr031.ts": "07e2fb24ebb5f006351a4417f877e3230600141e3091e12d1a346982e8678076",
-    "rules/azr032.ts": "cbf23c9b22aeb51a18c77ea410502f5fc0584870f723aa3c8e0b0a87fd7cce4b",
-    "rules/azr033.ts": "54c628f21b45f0de0639807baf025d8477a8b352326b3ff7d1f3f9f80db43506",
+    "rules/azr031.ts": "7f0654c9dce1e3a1a86818d8b4d0201fb4600021f7a4a757c36b1513fe16e0fd",
+    "rules/azr032.ts": "ea94cc7fdece0812c43898c76c4b8a115a306157b741fe3b76fe726335f6c2d2",
+    "rules/azr033.ts": "d440ec79a1563160bb7c8cc29c81880da71997c872215f14ec3be18f05a07ed3",
     "skills/chant-azure.md": "86399e4fafd35cdf56670b32dbff5db42a4bfa1453b25231c4ee15eea9a2a1b9",
     "skills/chant-azure-security.md": "95ab789202662f60b43cf2fce1ae549cbcf5b689306481dabb656847281879ff",
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "ef0be6524c75d7bdb8422478c3f72445f976bf855ce9b610638b2d35af5bd0f1"
+  "composite": "7f758770238b4b502b32ce21b88475570a479cf95306ee84a899fc1838c9a2a2"
 }

package/dist/lint/post-synth/azr031.d.ts

@@ -1,5 +1,5 @@
 /**
- * AZR031: Policy Assignment Not Enforced (#793, epic #787 C3)
+ * AZR031: Policy Assignment Not Enforced
  *
  * Flags Microsoft.Authorization/policyAssignments with enforcementMode
  * DoNotEnforce. The assignment stays visible in the tree while denying

package/dist/lint/post-synth/azr032.d.ts

@@ -1,5 +1,5 @@
 /**
- * AZR032: Policy Definition Assigned Nowhere (#793, epic #787 C3)
+ * AZR032: Policy Definition Assigned Nowhere
  *
  * Flags custom Microsoft.Authorization/policyDefinitions with no
  * policyAssignments referencing them in the same template. The

package/dist/lint/post-synth/azr033.d.ts

@@ -1,5 +1,5 @@
 /**
- * AZR033: Subscriptions May Leave the Tenant (#793, epic #787 C3)
+ * AZR033: Subscriptions May Leave the Tenant
  *
  * Flags a Microsoft.Subscription/policies resource that sets
  * blockSubscriptionsLeavingTenant to false — the tenant-level leave-block

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.44.1",
+  "version": "0.44.2",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/rules/azr031.ts

@@ -1,5 +1,5 @@
 /**
- * AZR031: Policy Assignment Not Enforced (#793, epic #787 C3)
+ * AZR031: Policy Assignment Not Enforced 
  *
  * Flags Microsoft.Authorization/policyAssignments with enforcementMode
  * DoNotEnforce. The assignment stays visible in the tree while denying

package/dist/rules/azr032.ts

@@ -1,5 +1,5 @@
 /**
- * AZR032: Policy Definition Assigned Nowhere (#793, epic #787 C3)
+ * AZR032: Policy Definition Assigned Nowhere 
  *
  * Flags custom Microsoft.Authorization/policyDefinitions with no
  * policyAssignments referencing them in the same template. The

package/dist/rules/azr033.ts

@@ -1,5 +1,5 @@
 /**
- * AZR033: Subscriptions May Leave the Tenant (#793, epic #787 C3)
+ * AZR033: Subscriptions May Leave the Tenant 
  *
  * Flags a Microsoft.Subscription/policies resource that sets
  * blockSubscriptionsLeavingTenant to false — the tenant-level leave-block

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.44.1",
+  "version": "0.44.2",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,7 +74,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.1",
+    "@intentius/chant": "^0.44.2",
     "typescript": "^5.9.3"
   }
 }

package/src/composites/landing-zone.test.ts

@@ -8,7 +8,7 @@ function p(member: unknown): Record<string, any> {
   return (member as any).props;
 }
 
-describe("GovernanceFoundation (#791)", () => {
+describe("GovernanceFoundation", () => {
   test("declares the foundation management groups and the subscription tenant policy", () => {
     const lz = GovernanceFoundation({});
     expect(Object.keys(lz.members)).toEqual([
@@ -47,7 +47,7 @@ describe("GovernanceFoundation (#791)", () => {
   });
 });
 
-describe("GovernanceBaseline (#791)", () => {
+describe("GovernanceBaseline", () => {
   test("defines and assigns the two baseline policies", () => {
     const gb = GovernanceBaseline({});
     expect(Object.keys(gb.members)).toEqual([
@@ -76,7 +76,7 @@ describe("GovernanceBaseline (#791)", () => {
   });
 });
 
-describe("LocationRestriction and ActivityLogSink (#791)", () => {
+describe("LocationRestriction and ActivityLogSink", () => {
   test("LocationRestriction defines and assigns the allowed-locations policy", () => {
     const lr = LocationRestriction({ locations: ["westeurope"] });
     const def = p(lr.definitionLocationRestriction);

package/src/composites/landing-zone.ts

@@ -1,12 +1,12 @@
 /**
- * Landing-zone bootstrap composites (#791, epic #787 C1) — the Azure slice.
+ * Landing-zone bootstrap composites — the Azure slice.
  *
  * Fixed-shape resources for greenfield creation of the recommended
  * governance foundation. The evaluability rules (EVL002/004) require
  * composites to declare a fixed set of resources, so these carry the
  * foundation only; arbitrary management-group/subscription trees are
  * authored as config with `landingZoneConfig()` (../governance.ts) and
- * reconciled by the Azure cloud warden, and further groups/subscriptions
+ * reconciled by an external governance reconciler, and further groups/subscriptions
  * are declared as ordinary resources.
  *
  * A single ARM template cannot mix deployment scopes (AZR030, #1545), so

package/src/governance.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, test } from "vitest";
 import { landingZoneConfig, FOUNDATION_MANAGEMENT_GROUPS } from "./governance";
 
-describe("landingZoneConfig (#791)", () => {
+describe("landingZoneConfig", () => {
   test("the default is the recommended foundation", () => {
     const cfg = landingZoneConfig();
     expect(Object.keys(cfg.managementGroups)).toEqual(["Security", "Infrastructure", "Sandbox", "Workloads"]);

package/src/governance.ts

@@ -1,6 +1,6 @@
 /**
- * Azure governance authoring (#791, epic #787 C1): the desired-state config
- * shape the Azure cloud warden reconciles, and `landingZoneConfig()` — the
+ * Azure governance authoring: the desired-state config
+ * shape an external governance reconciler reconciles, and `landingZoneConfig()` — the
  * typed authoring layer that emits it.
  *
  * This is deliberately NOT a composite. The evaluability rules (EVL002/004,
@@ -9,7 +9,7 @@
  * the AWS/GCP slices (lexicons/{aws,gcp}/src/governance.ts): authoring emits
  * config (this module, arbitrary cardinality); resources for greenfield
  * bootstrap are the fixed-shape composites in `composites/landing-zone.ts`;
- * the warden consumes only the config.
+ * the reconciler consumes only the config.
  *
  * Azure has no OrganizationRoot analog — the tenant and its root management
  * group come from Entra ID, never from the resource API. Subscriptions the
@@ -19,7 +19,7 @@
  */
 
 // ---------------------------------------------------------------------------
-// The desired-state config shape the Azure cloud warden consumes
+// The desired-state config shape an external governance reconciler consumes
 // ---------------------------------------------------------------------------
 
 /** A custom policy definition, keyed by name in `AzureGovernanceConfig.policies`. */
@@ -37,9 +37,9 @@ export interface PolicyConfig {
 /** A subscription declared inside a management group. */
 export interface SubscriptionConfig {
   name: string;
-  /** An existing subscription to place. Omitted: the warden creates one via a tenant-scope alias. */
+  /** An existing subscription to place. Omitted: the reconciler creates one via a tenant-scope alias. */
   subscriptionId?: string;
-  /** Billing scope for subscriptions the warden creates. */
+  /** Billing scope for subscriptions the reconciler creates. */
   billingScope?: string;
   workload?: "Production" | "DevTest";
 }
@@ -56,9 +56,9 @@ export interface ManagementGroupConfig {
 
 /**
  * The desired-state governance tree for one Azure tenant. This is the shape
- * the Azure cloud warden loads as config — the Azure counterpart of
+ * an external governance reconciler loads as config — the Azure counterpart of
  * `AwsGovernanceConfig`/`GcpGovernanceConfig`. Cycles map onto the
- * governance verbs (#790): the management-group/subscription tree is
+ * governance verbs: the management-group/subscription tree is
  * `org-unit`, policy assignments are `policy-guardrail`, the activity-log
  * sink is `audit-sink`.
  */
@@ -188,7 +188,7 @@ export interface LandingZoneConfigProps {
 }
 
 /**
- * Author the desired-state tree the Azure cloud warden reconciles. Pure.
+ * Author the desired-state tree an external governance reconciler reconciles. Pure.
  * Throws when the tree assigns a policy name with no definition; only
  * policies the tree actually assigns are included in the output.
  */

package/src/index.ts

@@ -76,8 +76,8 @@ export {
   ActivityLogSink, type ActivityLogSinkProps, type ActivityLogSinkResult,
 } from "./composites/index";
 
-// Azure governance authoring (#791): the desired-state config the Azure
-// cloud warden reconciles, and the typed landing-zone authoring layer.
+// Azure governance authoring: the desired-state config the Azure
+// external governance reconciler applies, and the typed landing-zone authoring layer.
 export {
   landingZoneConfig, locationRestriction,
   DENY_CLASSIC_RESOURCES, DENY_UNMANAGED_DISKS,

package/src/lint/audit-catalog.ts

@@ -29,7 +29,7 @@ export const azureAuditCatalog: Record<string, RuleMeta> = {
   AZR029: auditRule("AZR029", "merge-worthy", "guidance", "Managed disk missing encryption", "Enable encryption for data at rest.", { authority: [AZ_SEC] }),
   AZR030: auditRule("AZR030", "merge-worthy", "guidance", "Resource at unsupported template scope", "Move the resource to a project deployed at a scope its schema supports.", { category: "correctness" }),
 
-  // #793 — governance posture regressions (epic #787 C3).
+  // governance posture regressions.
   AZR031: auditRule("AZR031", "merge-worthy", "guidance", "Policy assignment not enforced (DoNotEnforce)", "Set enforcementMode to Default so the assigned guardrail applies.", { authority: [AZ_SEC] }),
   AZR032: auditRule("AZR032", "merge-worthy", "guidance", "Custom policy definition assigned nowhere", "Pair the policy definition with a policy assignment — unassigned it enforces nothing.", { authority: [AZ_SEC] }),
   AZR033: auditRule("AZR033", "merge-worthy", "guidance", "Subscriptions may leave the tenant", "Set blockSubscriptionsLeavingTenant: true on the Microsoft.Subscription/policies resource.", { authority: [AZ_SEC] }),

package/src/lint/post-synth/azr031.ts

@@ -1,5 +1,5 @@
 /**
- * AZR031: Policy Assignment Not Enforced (#793, epic #787 C3)
+ * AZR031: Policy Assignment Not Enforced 
  *
  * Flags Microsoft.Authorization/policyAssignments with enforcementMode
  * DoNotEnforce. The assignment stays visible in the tree while denying

package/src/lint/post-synth/azr032.ts

@@ -1,5 +1,5 @@
 /**
- * AZR032: Policy Definition Assigned Nowhere (#793, epic #787 C3)
+ * AZR032: Policy Definition Assigned Nowhere 
  *
  * Flags custom Microsoft.Authorization/policyDefinitions with no
  * policyAssignments referencing them in the same template. The

package/src/lint/post-synth/azr033.ts

@@ -1,5 +1,5 @@
 /**
- * AZR033: Subscriptions May Leave the Tenant (#793, epic #787 C3)
+ * AZR033: Subscriptions May Leave the Tenant 
  *
  * Flags a Microsoft.Subscription/policies resource that sets
  * blockSubscriptionsLeavingTenant to false — the tenant-level leave-block

package/src/serializer.ts

@@ -187,7 +187,7 @@ function serializeToTemplate(
   // pin overrides the inference — policy definitions and assignments
   // deploy at several scopes, so a management-group guardrail project
   // cannot be told from a subscription one by its resource set alone
-  // (#791); AZR030 still flags resources the pinned scope cannot hold.
+  //; AZR030 still flags resources the pinned scope cannot hold.
   let pinnedScope: DeployScope | undefined;
   const emittedTypes: string[] = [];
   for (const [, entity] of entities) {

package/src/validate.ts

@@ -25,7 +25,7 @@ const REQUIRED_NAMES = [
   "SqlServer", "SqlDatabase",
   // Security & Identity
   "KeyVault", "ManagedIdentity",
-  // Governance — org hierarchy + policy primitives (#1545). #787 once claimed
+  // Governance — org hierarchy + policy primitives (#1545).  once claimed
   // these existed when they did not; this gate keeps them from vanishing again.
   "ManagementGroup", "SubscriptionAlias", "PolicyDefinition", "PolicyAssignment",
   // DNS & Traffic