@intentius/chant-lexicon-cedar 0.44.8 → 0.44.9

package/src/lint/post-synth/dwde-post-synth.test.ts

@@ -0,0 +1,368 @@
+/**
+ * The CLI-gated DWDE checks (#1659).
+ *
+ * Every case injects a runner, and the absent-binary case forces absence
+ * rather than hoping the machine has none — a developer with `dogwood` built
+ * locally must see the same result as CI. The one test that touches a real
+ * binary is opt-in and skipped by default; nothing in gating depends on it.
+ *
+ * The lowered fixture is adapted from
+ * dogwood-policy/dogwood@5063bcc2d6d6cf5024d1b0498e6cc8ef52cbcf0c (Apache-2.0),
+ * `dogwood-docs/examples/read_after_login` — the same bundle the #1657
+ * verification put through this exact path.
+ */
+import { describe, test, expect, afterEach } from "vitest";
+import { readFileSync } from "fs";
+import { join } from "path";
+import { fileURLToPath } from "url";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { postSynthChecks } from "./index";
+import { dwde010 } from "./dwde010";
+import { dwde011 } from "./dwde011";
+import { looksLikeMacroLibrary, planDogwoodRuns } from "./dogwood-helpers";
+import { cedarAuditCatalog } from "../audit-catalog";
+import { configureDogwoodCli, findDogwoodBinary, resetDogwoodCli, type DogwoodRun } from "../../dogwood/cli";
+
+const TESTDATA = join(fileURLToPath(new URL("../..", import.meta.url)), "dogwood/testdata");
+
+const POLICIES = readFileSync(join(TESTDATA, "read-after-login.dw"), "utf-8");
+const ACTION_SCHEMA = readFileSync(join(TESTDATA, "read-after-login.cedarschema"), "utf-8");
+const EVENT_SCHEMA = readFileSync(join(TESTDATA, "pinned.dwschema"), "utf-8");
+const MACROS = readFileSync(join(TESTDATA, "default-macros.dw"), "utf-8");
+const LOWERED = JSON.parse(readFileSync(join(TESTDATA, "lowered-read-after-login.json"), "utf-8")) as Record<
+  string,
+  unknown
+>;
+
+afterEach(() => resetDogwoodCli());
+
+function ctxOf(files: Record<string, string>): PostSynthContext {
+  const output: SerializerResult = { primary: "", files };
+  const outputs = new Map<string, string | SerializerResult>([["cedar", output]]);
+  return {
+    outputs,
+    entities: new Map(),
+    buildResult: { outputs, entities: new Map(), warnings: [], errors: [], sourceFileCount: 1 },
+  };
+}
+
+/** The shape a real build emits: policies, action schema, event schema, macros. */
+function fullBuild(): PostSynthContext {
+  return ctxOf({
+    "policies.dw": POLICIES,
+    "macros.dw": MACROS,
+    "app.cedarschema": ACTION_SCHEMA,
+    "events.dwschema": EVENT_SCHEMA,
+  });
+}
+
+function run(over: Partial<DogwoodRun>): DogwoodRun {
+  return { status: 0, stdout: "", stderr: "", ...over };
+}
+
+const PASSING = run({
+  status: 0,
+  stdout: JSON.stringify({ passed: true, passed_without_warnings: true, errors: [], warnings: [] }),
+});
+
+/** Answer `validate` one way and `lower` another, from the subcommand argv[0]. */
+function bySubcommand(answers: Record<string, DogwoodRun>) {
+  return (_binary: string, args: string[]): DogwoodRun => answers[args[0]] ?? run({ status: 0, stdout: "" });
+}
+
+// ── The planner ────────────────────────────────────────────────────
+
+describe("planning what to run", () => {
+  test("a macro library is told from a policy set by structure, not by filename", () => {
+    expect(looksLikeMacroLibrary(MACROS)).toBe(true);
+    expect(looksLikeMacroLibrary(POLICIES)).toBe(false);
+    // A library under a non-default filename is still a library.
+    expect(looksLikeMacroLibrary("def temporal once(?w, ?s) { formerly within ?w ?s };")).toBe(true);
+  });
+
+  test("one bundle per policy set, with the macro libraries folded into one --macros file", () => {
+    const plan = planDogwoodRuns(fullBuild());
+    expect(plan.hasPolicies).toBe(true);
+    expect(plan.bundles).toHaveLength(1);
+    const [only] = plan.bundles;
+    expect(only.source).toBe("policies.dw");
+    expect(only.policySchemaSource).toBe("app.cedarschema");
+    expect(only.eventSchemaSource).toBe("events.dwschema");
+    expect(only.bundle.macros).toContain("def temporal");
+  });
+
+  test("several event schemas mean several runs, each naming its own schema", () => {
+    const ctx = ctxOf({
+      "policies.dw": POLICIES,
+      "app.cedarschema": ACTION_SCHEMA,
+      "events.dwschema": EVENT_SCHEMA,
+      "gateway.dwschema": EVENT_SCHEMA,
+    });
+    const plan = planDogwoodRuns(ctx);
+    expect(plan.bundles.map((b) => b.eventSchemaSource)).toEqual(["events.dwschema", "gateway.dwschema"]);
+  });
+
+  test("no .dw policy set means nothing to plan, even with a schema emitted", () => {
+    expect(planDogwoodRuns(ctxOf({ "events.dwschema": EVENT_SCHEMA })).hasPolicies).toBe(false);
+    expect(planDogwoodRuns(ctxOf({ "macros.dw": MACROS })).hasPolicies).toBe(false);
+  });
+
+  test("policies with no action schema are blocked, because --policy-schema is not optional", () => {
+    const plan = planDogwoodRuns(ctxOf({ "policies.dw": POLICIES }));
+    expect(plan.hasPolicies).toBe(true);
+    expect(plan.bundles).toEqual([]);
+    expect(plan.blocked).toContain("--policy-schema");
+  });
+});
+
+// ── DWDE010 ────────────────────────────────────────────────────────
+
+describe("DWDE010 — full .dw validation, when the binary is there", () => {
+  test("a passing validate is silent", () => {
+    configureDogwoodCli({ binary: "/opt/dogwood", runner: () => PASSING });
+    expect(dwde010.check(fullBuild())).toEqual([]);
+  });
+
+  test("a rejection becomes one error per finding, with the code and the byte span", () => {
+    const rejected = run({
+      status: 2,
+      stdout: JSON.stringify({
+        passed: false,
+        passed_without_warnings: false,
+        errors: [
+          {
+            severity: "error",
+            code: "extension",
+            message:
+              'predicate `Drupe::Action::"NoSuchAction"::request` does not name a declared event (no event kind `request` derived for action `NoSuchAction`)',
+            labels: [{ start: 210, len: 46 }],
+            spanned: true,
+          },
+        ],
+        warnings: [],
+      }),
+    });
+    configureDogwoodCli({ binary: "/opt/dogwood", runner: () => rejected });
+
+    const [finding, ...rest] = dwde010.check(fullBuild());
+    expect(rest).toEqual([]);
+    expect(finding.severity).toBe("error");
+    expect(finding.checkId).toBe("DWDE010");
+    expect(finding.message).toContain("[extension]");
+    expect(finding.message).toContain("bytes 210-256");
+    expect(finding.message).toContain('"policies.dw"');
+    expect(finding.message).toContain('against "app.cedarschema"');
+    expect(finding.entity).toBe("policies.dw");
+  });
+
+  test("a fatal parse error comes through the other JSON shape and is still an error", () => {
+    const fatal = run({
+      status: 2,
+      stdout: JSON.stringify({
+        severity: "error",
+        message: "unknown macro `once`",
+        labels: [{ start: 12, len: 4 }],
+        spanned: true,
+        related: [{ severity: "error", message: "a second parse error", spanned: false }],
+      }),
+    });
+    configureDogwoodCli({ binary: "/opt/dogwood", runner: () => fatal });
+
+    const findings = dwde010.check(fullBuild());
+    expect(findings).toHaveLength(2);
+    expect(findings.every((f) => f.severity === "error")).toBe(true);
+    expect(findings[0].message).toContain("could not be parsed or lowered");
+    expect(findings[0].message).toContain("unknown macro `once`");
+  });
+
+  test("upstream's warnings ride along at warning severity and do not fail the build", () => {
+    const warned = run({
+      status: 0,
+      stdout: JSON.stringify({
+        passed: true,
+        passed_without_warnings: false,
+        errors: [],
+        warnings: [{ severity: "warning", message: "policy is impossible", labels: [], spanned: false }],
+      }),
+    });
+    configureDogwoodCli({ binary: "/opt/dogwood", runner: () => warned });
+
+    const [finding] = dwde010.check(fullBuild());
+    expect(finding.severity).toBe("warning");
+    expect(finding.message).toContain("policy is impossible");
+  });
+
+  test("the exit-2 ambiguity is a warning about the run, never an error about the policy", () => {
+    // An unknown flag and a rejected policy set share exit 2. Reading the code
+    // alone would turn a flag rename in an upstream sync into a failed build.
+    const usage = run({
+      status: 2,
+      stdout: "",
+      stderr: "error: unexpected argument '--nosuchflag' found",
+    });
+    configureDogwoodCli({ binary: "/opt/dogwood", runner: () => usage });
+
+    const [finding, ...rest] = dwde010.check(fullBuild());
+    expect(rest).toEqual([]);
+    expect(finding.severity).toBe("warning");
+    expect(finding.message).toContain("neither accepted nor rejected");
+  });
+
+  test("no binary is exactly one info advisory naming the binary and the issue", () => {
+    configureDogwoodCli({ binary: null });
+    const [finding, ...rest] = dwde010.check(fullBuild());
+    expect(rest).toEqual([]);
+    expect(finding.severity).toBe("info");
+    expect(finding.message).toContain("dogwood");
+    expect(finding.message).toContain("chant #1659");
+    expect(finding.message).toContain("CHANT_DOGWOOD_BINARY");
+    expect(finding.lexicon).toBe("cedar");
+  });
+
+  test("the advisory does not fire on a build with no .dw output at all", () => {
+    configureDogwoodCli({ binary: null });
+    expect(dwde010.check(ctxOf({ "policies.cedar.json": "{}" }))).toEqual([]);
+  });
+
+  test("a binary with nothing to validate against says so rather than passing quietly", () => {
+    configureDogwoodCli({ binary: "/opt/dogwood", runner: () => PASSING });
+    const [finding] = dwde010.check(ctxOf({ "policies.dw": POLICIES }));
+    expect(finding.severity).toBe("info");
+    expect(finding.message).toContain("--policy-schema");
+  });
+});
+
+// ── DWDE011 ────────────────────────────────────────────────────────
+
+describe("DWDE011 — the lowered Cedar through Cedar's own validator", () => {
+  test("the lowered read_after_login bundle validates clean end to end", () => {
+    configureDogwoodCli({
+      binary: "/opt/dogwood",
+      runner: bySubcommand({
+        validate: PASSING,
+        lower: run({ status: 0, stdout: JSON.stringify(LOWERED) }),
+      }),
+    });
+    expect(dwde011.check(fullBuild())).toEqual([]);
+  });
+
+  test("a lowered body naming a slot the augmented schema lacks fails Cedar validation", () => {
+    // The same artifacts with the policy pointed at a context field the
+    // augmented schema never grew — what a lowering/schema mismatch looks like
+    // from Cedar's side.
+    const drifted = {
+      ...LOWERED,
+      cedar_policies: (LOWERED.cedar_policies as string).replace(
+        "policy_0__temporal_0",
+        "policy_9__temporal_9",
+      ),
+    };
+    configureDogwoodCli({
+      binary: "/opt/dogwood",
+      runner: bySubcommand({ validate: PASSING, lower: run({ status: 0, stdout: JSON.stringify(drifted) }) }),
+    });
+
+    const findings = dwde011.check(fullBuild());
+    expect(findings.length).toBeGreaterThan(0);
+    expect(findings[0].severity).toBe("error");
+    expect(findings[0].checkId).toBe("DWDE011");
+    expect(findings[0].message).toContain("fails Cedar validation");
+    expect(findings[0].entity).toBe("policies.dw");
+  });
+
+  test("findings are sorted, so a build's output does not shuffle between runs", () => {
+    const twoBad = {
+      ...LOWERED,
+      cedar_policies: `permit (principal, action == Drupe::Action::"Read", resource) when { context.zzz };\npermit (principal, action == Drupe::Action::"Read", resource) when { context.aaa };\n`,
+    };
+    configureDogwoodCli({
+      binary: "/opt/dogwood",
+      runner: bySubcommand({ validate: PASSING, lower: run({ status: 0, stdout: JSON.stringify(twoBad) }) }),
+    });
+
+    const messages = dwde011.check(fullBuild()).map((f) => f.message);
+    expect(messages).toEqual([...messages].sort());
+  });
+
+  test("silent when the binary is absent — DWDE010's advisory covers that once", () => {
+    configureDogwoodCli({ binary: null });
+    expect(dwde011.check(fullBuild())).toEqual([]);
+  });
+
+  test("silent when no action schema was emitted, for the same reason", () => {
+    configureDogwoodCli({ binary: "/opt/dogwood", runner: () => PASSING });
+    expect(dwde011.check(ctxOf({ "policies.dw": POLICIES }))).toEqual([]);
+  });
+
+  test("a fatal lower stays quiet — the validate leg owns the parse/lower channel", () => {
+    configureDogwoodCli({
+      binary: "/opt/dogwood",
+      runner: bySubcommand({
+        validate: PASSING,
+        lower: run({
+          status: 2,
+          stdout: JSON.stringify({ severity: "error", message: "unknown macro `once`", spanned: false }),
+        }),
+      }),
+    });
+    expect(dwde011.check(fullBuild())).toEqual([]);
+  });
+
+  test("a lower that could not be run is a warning about the run", () => {
+    configureDogwoodCli({
+      binary: "/opt/dogwood",
+      runner: bySubcommand({ validate: PASSING, lower: run({ status: 2, stdout: "", stderr: "usage" }) }),
+    });
+    const [finding] = dwde011.check(fullBuild());
+    expect(finding.severity).toBe("warning");
+    expect(finding.message).toContain("not checked by Cedar's validator");
+  });
+});
+
+// ── Registration ───────────────────────────────────────────────────
+
+describe("registration", () => {
+  test("both checks reach the committed barrel", () => {
+    const ids = postSynthChecks.map((c) => c.id);
+    expect(ids).toContain("DWDE010");
+    expect(ids).toContain("DWDE011");
+  });
+
+  test("both are catalogued, so `chant audit` can title them", () => {
+    for (const id of ["DWDE010", "DWDE011"]) {
+      const meta = cedarAuditCatalog[id];
+      expect(meta, `${id} is catalogued`).toBeDefined();
+      expect(meta.title.length).toBeGreaterThan(0);
+      expect(meta.remediation.length).toBeGreaterThan(0);
+    }
+  });
+
+  test("the helper module contributes no check of its own", () => {
+    // `dogwood-helpers.ts` is excluded from discovery by the "helper" filename
+    // filter, the same way `wasm-helpers.ts` is.
+    expect(postSynthChecks.filter((c) => c.id.startsWith("DWD"))).toHaveLength(6);
+  });
+});
+
+// ── Opt-in: a real binary ──────────────────────────────────────────
+
+/**
+ * Runs only when `CHANT_DOGWOOD_E2E=1` *and* a binary resolves. Never gates:
+ * the epic's rule is that nothing in gating CI executes the dogwood binary,
+ * and this exists so someone who has built one can confirm the adapter reads
+ * the real thing the way the fixtures say it does.
+ */
+const haveRealBinary = process.env.CHANT_DOGWOOD_E2E === "1" && findDogwoodBinary() !== undefined;
+
+describe.skipIf(!haveRealBinary)("against a real dogwood binary (opt-in)", () => {
+  test("the upstream read_after_login bundle validates clean", () => {
+    resetDogwoodCli();
+    expect(dwde010.check(fullBuild())).toEqual([]);
+  });
+
+  test("and its lowered Cedar validates clean through cedar-wasm", () => {
+    resetDogwoodCli();
+    expect(dwde011.check(fullBuild())).toEqual([]);
+  });
+});

package/src/lint/post-synth/dwde010.ts

@@ -0,0 +1,130 @@
+/**
+ * DWDE010: the emitted `.dw` set validates clean under `dogwood validate`
+ *
+ * The CLI-gated half of the epic's validation split. Everything the DWDC walls
+ * ask is answerable in TypeScript and gates unconditionally; everything else —
+ * macro expansion, the temporal type checker, the Cedar body checked against
+ * the action schema *through upstream's own frontend* — needs upstream's Rust
+ * frontend, which ships as a binary and nothing else. No npm package, no wasm
+ * build, no bindings.
+ *
+ * So this check has two modes and says which one it is in:
+ *
+ * - **Binary present.** Runs `dogwood validate --format json` over each
+ *   emitted policy set and reports every finding as an error. Byte-offset
+ *   labels come through as byte offsets — see `../../dogwood/cli.ts` for why
+ *   they are not converted to line/column.
+ * - **Binary absent.** Exactly one `info` finding naming the binary, where
+ *   chant looked, and this issue. The epic's words are "an explicit,
+ *   issue-linked exception, not a silent one" — a check that quietly passes
+ *   when it could not run is claiming a guarantee it did not make, which is
+ *   the same failure CEDE010's no-schema advisory exists to avoid.
+ *
+ * A run that could not be made at all — a spawn failure, an unknown flag, JSON
+ * in a shape this adapter does not know — is `warning`, not `error`. Upstream
+ * is a read-only squash-sync mirror with no tags and no changelog, and a flag
+ * rename in a sync would otherwise fail every build that has the binary
+ * installed. The adapter never reads exit 2 as "rejected" on its own for the
+ * same reason: clap spends that code on usage errors too.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import {
+  DOGWOOD_BINARY_NAME,
+  DOGWOOD_SEARCH_ORDER,
+  findDogwoodBinary,
+  formatDogwoodDiagnostic,
+  runDogwoodValidate,
+} from "../../dogwood/cli";
+import { describeBundle, planDogwoodRuns } from "./dogwood-helpers";
+
+export const dwde010: PostSynthCheck = {
+  id: "DWDE010",
+  description: "Emitted dogwood policy sets validate clean under `dogwood validate`, when the binary is available",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const plan = planDogwoodRuns(ctx);
+    if (!plan.hasPolicies) return [];
+
+    const binary = findDogwoodBinary();
+    if (!binary) {
+      return [
+        {
+          checkId: "DWDE010",
+          severity: "info",
+          message: `This build emitted dogwood .dw policies, but no \`${DOGWOOD_BINARY_NAME}\` binary was found, so full .dw validation did not run — the DWDC walls checked what TypeScript can answer and nothing checked macro expansion, the temporal type check, or the Cedar body against the action schema. chant looked at ${DOGWOOD_SEARCH_ORDER}. See chant #1659.`,
+          lexicon: plan.lexicon,
+        },
+      ];
+    }
+
+    if (plan.blocked) {
+      return [
+        {
+          checkId: "DWDE010",
+          severity: "info",
+          message: `This build emitted dogwood .dw policies and \`${DOGWOOD_BINARY_NAME}\` is available, but ${plan.blocked}, so full .dw validation did not run. See chant #1659.`,
+          lexicon: plan.lexicon,
+        },
+      ];
+    }
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const prepared of plan.bundles) {
+      const where = describeBundle(prepared);
+      const result = runDogwoodValidate(binary.path, prepared.bundle);
+
+      if (result.kind === "unusable") {
+        diagnostics.push({
+          checkId: "DWDE010",
+          severity: "warning",
+          message: `Dogwood policy set ${where} could not be validated — ${result.reason}. The policy set was neither accepted nor rejected.`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+        continue;
+      }
+
+      if (result.kind === "fatal") {
+        for (const finding of [result.error, ...result.related]) {
+          diagnostics.push({
+            checkId: "DWDE010",
+            severity: "error",
+            message: `Dogwood policy set ${where} could not be parsed or lowered: ${formatDogwoodDiagnostic(finding)}`,
+            entity: prepared.source,
+            lexicon: prepared.lexicon,
+          });
+        }
+        continue;
+      }
+
+      if (result.kind === "rejected") {
+        for (const finding of result.errors) {
+          diagnostics.push({
+            checkId: "DWDE010",
+            severity: "error",
+            message: `Dogwood policy set ${where} fails \`dogwood validate\`: ${formatDogwoodDiagnostic(finding)}`,
+            entity: prepared.source,
+            lexicon: prepared.lexicon,
+          });
+        }
+      }
+
+      // Upstream's own warnings ride along at warning severity. They do not
+      // fail `dogwood validate` (`passed` ignores them), and they should not
+      // fail a build either — but dropping them would throw away the half of
+      // the report that says a policy is legal and pointless.
+      for (const finding of result.warnings) {
+        diagnostics.push({
+          checkId: "DWDE010",
+          severity: "warning",
+          message: `Dogwood policy set ${where} draws a \`dogwood validate\` warning: ${formatDogwoodDiagnostic(finding)}`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/dwde011.ts

@@ -0,0 +1,108 @@
+/**
+ * DWDE011: the lowered Cedar body validates clean under Cedar's own validator
+ *
+ * The epic's stated design for the non-temporal half: chant does not
+ * re-implement lowering — `dogwood lower` produces the analyzable plain-Cedar
+ * form, and a reimplementation would drift — but once that form exists, Cedar's
+ * own validator is the thing that judges it. The #1657 verification put all 86
+ * upstream example bundles through this exact path and every one parsed and
+ * validated clean in strict mode, which is what makes a finding here mean
+ * something: the lowered output is genuinely plain Cedar, so a validation error
+ * is the policy's, not the pipeline's.
+ *
+ * What this catches that DWDE010 does not is narrow but real. `dogwood
+ * validate` type-checks through upstream's vendored Cedar; this runs the
+ * *published* `@cedar-policy/cedar-wasm` over the same artifacts. A body that
+ * upstream's pinned Cedar accepts and the Cedar the rest of chant validates
+ * against rejects is exactly the drift the pin exists to make visible — and the
+ * augmented schema, with its hoisted `context.*` temporal slots, is the form a
+ * downstream Cedar policy store will actually receive.
+ *
+ * The cedar-wasm traps from #1648 all apply and are handled in
+ * `./wasm-helpers.ts`: `type: "success"` means validation *ran*, not that it
+ * passed; `validationErrors` comes back in a different order almost every call
+ * and is sorted before anything reads it; a malformed call throws rather than
+ * returning a failure answer.
+ *
+ * Silent when `lower` did not run — the binary is absent, or no action schema
+ * was emitted. Both cases are DWDE010's advisory to report, once, rather than
+ * twice in different words.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { findDogwoodBinary, runDogwoodLower } from "../../dogwood/cli";
+import { describeBundle, planDogwoodRuns } from "./dogwood-helpers";
+import { loadWasm, validatePolicySet } from "./wasm-helpers";
+
+export const dwde011: PostSynthCheck = {
+  id: "DWDE011",
+  description: "The Cedar `dogwood lower` produces validates clean against the augmented schema (cedar-wasm validate)",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const plan = planDogwoodRuns(ctx);
+    if (!plan.hasPolicies || plan.blocked || plan.bundles.length === 0) return [];
+
+    const binary = findDogwoodBinary();
+    if (!binary) return [];
+
+    // A missing validator is not this check's finding to report; the cedar leg
+    // says so already through CEDC010.
+    const wasm = loadWasm();
+    if (!wasm) return [];
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const prepared of plan.bundles) {
+      const where = describeBundle(prepared);
+      const lowered = runDogwoodLower(binary.path, prepared.bundle);
+
+      if (lowered.kind === "unusable") {
+        diagnostics.push({
+          checkId: "DWDE011",
+          severity: "warning",
+          message: `Dogwood policy set ${where} could not be lowered to Cedar — ${lowered.reason}. Its non-temporal body was not checked by Cedar's validator.`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+        continue;
+      }
+
+      if (lowered.kind === "fatal") {
+        // The same fatal DWDE010 reports from its own run. Saying it twice
+        // helps nobody, so this arm stays quiet and lets the validate leg own
+        // the parse/lower channel.
+        continue;
+      }
+
+      const { cedarPolicies, cedarSchema } = lowered.value;
+
+      // The lowered policies go in as Cedar text. cedar-wasm synthesizes ids
+      // (`policy0`, `policy1`) for a bare-string set and does not read `@id`
+      // annotations as ids (#1648), so a finding names the .dw file it came
+      // from as well as the id the validator used.
+      const outcome = validatePolicySet(wasm, { staticPolicies: cedarPolicies }, cedarSchema);
+
+      if (outcome.failure) {
+        diagnostics.push({
+          checkId: "DWDE011",
+          severity: "error",
+          message: `The Cedar lowered from dogwood policy set ${where} could not be validated: ${outcome.failure}`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+        continue;
+      }
+
+      for (const finding of outcome.errors) {
+        diagnostics.push({
+          checkId: "DWDE011",
+          severity: "error",
+          message: `The Cedar lowered from dogwood policy set ${where} fails Cedar validation (lowered policy "${finding.policyId}"): ${finding.message}`,
+          entity: prepared.source,
+          lexicon: prepared.lexicon,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/dwds010.ts

@@ -0,0 +1,46 @@
+/**
+ * DWDS010: an emitted event schema with no pinned field widens every predicate
+ *
+ * The #1657 verification is specific about this one. `ServiceSchema::defaults()`
+ * — what runs when nobody passes `--event-schema` — uses
+ * `configuration/event-schemas/pinned.dwschema`, which carries
+ * `pin callerPrincipal: principalType(A) = principal` on every kind. Every
+ * temporal predicate is therefore correlated to the deciding request's
+ * principal, and events from other principals are invisible.
+ *
+ * Supplying any event schema opts out of that default wholesale. So a schema
+ * emitted without a pin does not merely "not add" a correlation: it removes
+ * one the policy author very likely assumed, and every `formerly` in the set
+ * starts matching other principals' events. That is a legitimate design —
+ * cross-principal correlation is the reason to write your own schema — but it
+ * is a decision, and a decision nobody can see in a diff is one nobody made.
+ *
+ * Report-only: chant does not know which the author wanted, only that it
+ * should be said out loud. `defaultEventSchema({ pinCallerPrincipal: false })`
+ * also stamps the reasoning into the emitted file.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { dogwoodSchemaFiles, readEventSchema } from "../../dogwood/scan";
+
+export const dwds010: PostSynthCheck = {
+  id: "DWDS010",
+  description: "An emitted dogwood event schema pins its temporal predicates to a request-side value",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const schema of dogwoodSchemaFiles(ctx)) {
+      const facts = readEventSchema(schema.text);
+      if (facts.kinds.length === 0 || facts.hasPin) continue;
+      diagnostics.push({
+        checkId: "DWDS010",
+        severity: "warning",
+        message: `Dogwood event schema "${schema.source}" declares no pinned field, so temporal predicates correlate across every principal — wider than upstream's default, which pins callerPrincipal to the deciding request's principal. Add a pinned field, or record why cross-principal correlation is wanted.`,
+        entity: schema.source,
+        lexicon: schema.lexicon,
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/index.ts

@@ -10,6 +10,12 @@ import { cede011 } from "./cede011";
 import { ceds010 } from "./ceds010";
 import { ceds011 } from "./ceds011";
 import { ceds012 } from "./ceds012";
+import { dwdc010 } from "./dwdc010";
+import { dwdc011 } from "./dwdc011";
+import { dwdc012 } from "./dwdc012";
+import { dwde010 } from "./dwde010";
+import { dwde011 } from "./dwde011";
+import { dwds010 } from "./dwds010";
 
 export const postSynthChecks: PostSynthCheck[] = [
   cedc010,
@@ -22,4 +28,10 @@ export const postSynthChecks: PostSynthCheck[] = [
   ceds010,
   ceds011,
   ceds012,
+  dwdc010,
+  dwdc011,
+  dwdc012,
+  dwde010,
+  dwde011,
+  dwds010,
 ];