@intentius/chant-lexicon-cpln 0.53.0

package/dist/plugin.d.ts

@@ -0,0 +1,3 @@
+import type { LexiconPlugin } from "@intentius/chant/lexicon";
+export declare const cplnPlugin: LexiconPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAId,MAAM,0BAA0B,CAAC;AAsClC,eAAO,MAAM,UAAU,EAAE,aA+IxB,CAAC"}

package/dist/reference-catalog.d.ts

@@ -0,0 +1,24 @@
+/**
+ * How observed cpln resources reference each other, so `chant graph --live` can
+ * rebuild the topology from a bag of nodes.
+ *
+ * Control Plane addresses resources by **link string**
+ * (`//gvc/prod/identity/api`), and edge reconstruction matches identifiers
+ * exactly, so a raw link never equals the `name` it points at. Rather than add
+ * an enrichment pass, `describeResources` resolves each link down to the bare
+ * name it ends in and files it under a stable attribute — `refs.identity`,
+ * `refs.gvc`, `refs.pullSecrets` — and the rules below read those. See
+ * {@link referenceAttributes} in `describe-resources.ts`.
+ *
+ * Names are unique per kind within an org (per GVC for the GVC-scoped kinds),
+ * so `name` is the identity for every kind and `targetKind` disambiguates the
+ * cases where two kinds could hold the same name.
+ *
+ * Containment vs reference matters for the picture: "this workload is in this
+ * GVC" is a boundary the renderer draws as a box, not a line from every
+ * resource to its GVC. It still declares `viaAttr` so a traversal can walk it —
+ * "which GVCs have no workloads" is a containment question.
+ */
+import type { ReferenceCatalog } from "@intentius/chant/lexicon";
+export declare const cplnReferenceCatalog: ReferenceCatalog;
+//# sourceMappingURL=reference-catalog.d.ts.map

package/dist/reference-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-catalog.d.ts","sourceRoot":"","sources":["../src/reference-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAKjE,eAAO,MAAM,oBAAoB,EAAE,gBAkFlC,CAAC"}

package/dist/rules/cpl001-no-secret-literals.ts

@@ -0,0 +1,83 @@
+import ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+
+/**
+ * CPL001: no literal credential material in a cpln declaration.
+ *
+ * This is a source-level rule rather than a post-synth check on purpose. By
+ * the time the manifest exists, a literal is just a string in a `data` block
+ * and there is nothing left to point at; here there is a file and a line, which
+ * is what makes the finding actionable — and, more to the point, this is the
+ * form the credential is in when it enters git history.
+ *
+ * `Secret` is the obvious carrier, but a credential pasted into a workload's
+ * env or an identity's cloud config is the same leak, so the rule fires
+ * anywhere inside a `new <cpln kind>(…)`.
+ *
+ * Complementary to CPL012, which catches the shape this cannot see — a
+ * plausible-looking value in a credential-named env var — from the model.
+ */
+
+const CPLN_KINDS = new Set(["Gvc", "Workload", "Identity", "VolumeSet", "Secret", "Policy", "Domain", "IpSet"]);
+
+const CREDENTIAL_SHAPES: Array<{ pattern: RegExp; label: string }> = [
+  { pattern: /^-----BEGIN [A-Z ]*PRIVATE KEY-----/, label: "private key material" },
+  { pattern: /^AKIA[0-9A-Z]{16}$/, label: "AWS access key id" },
+  { pattern: /^(ghp|gho|ghs|ghu)_[A-Za-z0-9]{20,}$/, label: "GitHub token" },
+  { pattern: /^github_pat_[A-Za-z0-9_]{20,}$/, label: "GitHub fine-grained token" },
+  { pattern: /^sk-[A-Za-z0-9_-]{20,}$/, label: "secret API key (sk-)" },
+  { pattern: /^xox[baprs]-[A-Za-z0-9-]{10,}$/, label: "Slack token" },
+  { pattern: /^ya29\.[A-Za-z0-9_-]{20,}$/, label: "Google OAuth access token" },
+  { pattern: /^eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}$/, label: "JWT" },
+  {
+    pattern: /^postgres(ql)?:\/\/[^:@/\s]+:[^@/\s]+@/,
+    label: "database URL with an inline password",
+  },
+  { pattern: /^mysql:\/\/[^:@/\s]+:[^@/\s]+@/, label: "database URL with an inline password" },
+  { pattern: /^mongodb(\+srv)?:\/\/[^:@/\s]+:[^@/\s]+@/, label: "database URL with an inline password" },
+];
+
+export const noSecretLiteralsRule: LintRule = {
+  id: "CPL001",
+  severity: "error",
+  category: "security",
+  description: "No literal credential material in cpln declarations — reference a secret instead",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+
+    const visit = (node: ts.Node, insideCplnNew: boolean): void => {
+      let inside = insideCplnNew;
+
+      if (ts.isNewExpression(node)) {
+        const name = node.expression.getText(source);
+        const short = name.split(".").pop() ?? name;
+        if (CPLN_KINDS.has(short)) inside = true;
+      }
+
+      if (inside && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))) {
+        for (const { pattern, label } of CREDENTIAL_SHAPES) {
+          if (!pattern.test(node.text)) continue;
+          const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+          diagnostics.push({
+            ruleId: "CPL001",
+            severity: "error",
+            message:
+              `Literal ${label} in a cpln declaration. Store it as a Secret and reference it as ` +
+              `\`cpln://secret/NAME.FIELD\` — a literal here is a credential in git history.`,
+            file: context.filePath,
+            line: line + 1,
+            column: character + 1,
+          });
+          break;
+        }
+      }
+
+      ts.forEachChild(node, (child) => visit(child, inside));
+    };
+
+    visit(source, false);
+    return diagnostics;
+  },
+};

package/dist/rules/cpl002-prefer-resource-reference.ts

@@ -0,0 +1,71 @@
+import ts from "typescript";
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+
+/**
+ * CPL002: prefer a resource reference over a hand-written link.
+ *
+ * The cpln serializer resolves a declared resource passed where a link is
+ * expected into the correct link for its kind — including the GVC qualifier
+ * that the identity form needs and that is silently ignored when missing. A
+ * hand-spelled `"//gvc/prod/identity/api"` gets none of that: it does not
+ * follow a rename, it is not checked against anything at author time, and
+ * getting the shape subtly wrong fails at runtime rather than at apply.
+ *
+ * This is a style rule, not a correctness one — the literal form is valid, and
+ * is the only option for a resource this stack does not declare. It fires on
+ * the link syntax specifically, so ordinary strings are untouched.
+ *
+ * Not flagged: `cpln://secret/…` and `cpln://volumeset/…`. Those are runtime
+ * *resolution* URIs read by the container, not links between resources, and
+ * they have no reference form to prefer.
+ */
+
+const CPLN_KINDS = new Set(["Gvc", "Workload", "Identity", "VolumeSet", "Secret", "Policy", "Domain", "IpSet"]);
+
+/** `//gvc/prod/identity/api` or `//secret/db-password`. */
+const LINK = /^\/\/(?:gvc\/[^/\s]+\/)?(gvc|workload|identity|volumeset|secret|policy|domain|ipset)\/[^/\s]+$/;
+
+export const preferResourceReferenceRule: LintRule = {
+  id: "CPL002",
+  severity: "info",
+  category: "style",
+  description: "Prefer passing a declared resource over a hand-written Control Plane link",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const source = context.sourceFile;
+
+    const visit = (node: ts.Node, insideCplnNew: boolean): void => {
+      let inside = insideCplnNew;
+
+      if (ts.isNewExpression(node)) {
+        const name = node.expression.getText(source);
+        const short = name.split(".").pop() ?? name;
+        if (CPLN_KINDS.has(short)) inside = true;
+      }
+
+      if (inside && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))) {
+        const match = LINK.exec(node.text);
+        if (match) {
+          const { line, character } = source.getLineAndCharacterOfPosition(node.getStart(source));
+          diagnostics.push({
+            ruleId: "CPL002",
+            severity: "info",
+            message:
+              `Hand-written link "${node.text}". If the ${match[1]} is declared in this stack, pass the ` +
+              `resource itself — the serializer emits the correct link, including the GVC qualifier, and ` +
+              `the reference follows a rename.`,
+            file: context.filePath,
+            line: line + 1,
+            column: character + 1,
+          });
+        }
+      }
+
+      ts.forEachChild(node, (child) => visit(child, inside));
+    };
+
+    visit(source, false);
+    return diagnostics;
+  },
+};

package/dist/rules/cpl010-unrestricted-outbound.ts

@@ -0,0 +1,41 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readArray } from "../../entity-props";
+import { WORKLOAD, entitiesOfType } from "./helpers";
+
+const ANY_ADDRESS = "0.0.0.0/0";
+
+/**
+ * CPL010: a workload that may call out to the entire internet.
+ *
+ * Inbound `0.0.0.0/0` is how a public service is *supposed* to be written, so
+ * it is not flagged. Outbound `0.0.0.0/0` is different: it is rarely required,
+ * it is the egress path for anything that gets a foothold in the container,
+ * and Control Plane supports hostname rules (with wildcards) precisely so it
+ * does not have to be all-or-nothing.
+ */
+export const unrestrictedOutboundCheck: PostSynthCheck = {
+  id: "CPL010",
+  description: "Workloads should not allow outbound traffic to every address",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      const outbound = readArray(entity, "spec", "firewallConfig", "external", "outboundAllowCIDR");
+      if (!outbound.includes(ANY_ADDRESS)) continue;
+
+      diagnostics.push({
+        checkId: "CPL010",
+        severity: "warning",
+        message:
+          `Workload "${name}" allows outbound traffic to ${ANY_ADDRESS}. Narrow it to the CIDRs it ` +
+          `actually calls, or use \`outboundAllowHostname\` (wildcards like "*.amazonaws.com" are ` +
+          `supported) so egress is bounded.`,
+        entity: name,
+        lexicon: "cpln",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cpl011-internal-firewall-scope.ts

@@ -0,0 +1,38 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readString } from "../../entity-props";
+import { GVC, WORKLOAD, entitiesOfType } from "./helpers";
+
+/**
+ * CPL011: internal firewall opened to the whole org.
+ *
+ * `same-org` lets every workload in every GVC reach this one, which crosses the
+ * boundary a GVC exists to draw. `same-gvc` and `workload-list` cover almost
+ * every real case, and `workload-list` works cross-GVC when that is genuinely
+ * needed.
+ */
+export const internalFirewallScopeCheck: PostSynthCheck = {
+  id: "CPL011",
+  description: "Internal firewall should not be opened to the entire org",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      const allowType = readString(entity, "spec", "firewallConfig", "internal", "inboundAllowType");
+      if (allowType !== "same-org") continue;
+
+      diagnostics.push({
+        checkId: "CPL011",
+        severity: "warning",
+        message:
+          `Workload "${name}" sets internal inboundAllowType "same-org", so every workload in the org — ` +
+          `including other GVCs — can reach it. Prefer "same-gvc", or "workload-list" with the specific ` +
+          `workloads (which also works across GVCs).`,
+        entity: name,
+        lexicon: "cpln",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cpl012-no-literal-credential-env.ts

@@ -0,0 +1,58 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readArray, readString } from "../../entity-props";
+import { WORKLOAD, entitiesOfType } from "./helpers";
+
+/** `cpln://secret/NAME.FIELD` — the field qualifier is the part that matters. */
+const SECRET_REF = /^cpln:\/\/secret\/([^/.\s]+)(?:\.([^/\s]+))?$/;
+
+/** Env var names that read as credentials. */
+const CREDENTIAL_NAME = /(password|passwd|secret|token|apikey|api_key|access_key|private_key|credential)/i;
+
+/**
+ * Values that look like a deliberate non-secret rather than a leaked one: an
+ * empty string, an obvious placeholder, or another `cpln://` reference.
+ */
+const PLACEHOLDER = /^(|changeme|placeholder|todo|xxx+|\*+|<[^>]*>|\$\{[^}]*\})$/i;
+
+/**
+ * CPL012: a credential-shaped env var carrying a literal value.
+ *
+ * The alternative is one string change — `cpln://secret/db.password` — so a
+ * literal here is almost always an oversight rather than a decision. Env values
+ * end up in the workload spec, which is readable by anyone with `get` on the
+ * workload, and in every diff of the manifest.
+ */
+export const noLiteralCredentialEnvCheck: PostSynthCheck = {
+  id: "CPL012",
+  description: "Credential-shaped environment variables must reference a secret, not a literal",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      for (const container of readArray(entity, "spec", "containers")) {
+        const containerName = readString(container, "name") ?? "?";
+        for (const env of readArray(container, "env")) {
+          const envName = readString(env, "name");
+          const value = readString(env, "value");
+          if (!envName || value === undefined) continue;
+          if (!CREDENTIAL_NAME.test(envName)) continue;
+          if (value.startsWith("cpln://") || PLACEHOLDER.test(value)) continue;
+
+          diagnostics.push({
+            checkId: "CPL012",
+            severity: "error",
+            message:
+              `Workload "${name}" container "${containerName}" sets env "${envName}" to a literal value. ` +
+              `Reference a secret instead — \`cpln://secret/NAME.FIELD\` — so the value is not stored in ` +
+              `the workload spec or its diffs.`,
+            entity: name,
+            lexicon: "cpln",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cpl013-qualified-identity-principal.ts

@@ -0,0 +1,45 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { propsOf, readArray } from "../../entity-props";
+import { GVC, POLICY, entitiesOfType } from "./helpers";
+
+/**
+ * CPL013: an identity principal link that Control Plane will ignore.
+ *
+ * `//identity/NAME` is accepted by the policy API and then has no effect. Only
+ * the GVC-qualified `//gvc/GVC/identity/NAME` grants anything. Nothing reports
+ * this — the policy exists, the binding exists, and the permission is simply
+ * never granted.
+ */
+export const qualifiedIdentityPrincipalCheck: PostSynthCheck = {
+  id: "CPL013",
+  description: "Policy bindings must name identities by their GVC-qualified link",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, POLICY)) {
+      for (const binding of readArray(entity, "bindings")) {
+        const links = propsOf(binding).principalLinks;
+        if (!Array.isArray(links)) continue;
+
+        for (const link of links) {
+          if (typeof link !== "string") continue;
+          if (!/^\/\/identity\/[^/]+$/.test(link)) continue;
+
+          diagnostics.push({
+            checkId: "CPL013",
+            severity: "error",
+            message:
+              `Policy "${name}" binds the principal "${link}". Control Plane silently ignores the bare ` +
+              `//identity/NAME form — use //gvc/<gvc>/identity/${link.slice("//identity/".length)} instead. ` +
+              `The policy will apply cleanly and grant nothing as written.`,
+            entity: name,
+            lexicon: "cpln",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cpl014-qualified-secret-ref.ts

@@ -0,0 +1,54 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readArray, readString } from "../../entity-props";
+import { WORKLOAD, entitiesOfType } from "./helpers";
+
+/** `cpln://secret/NAME.FIELD` — the field qualifier is the part that matters. */
+const SECRET_REF = /^cpln:\/\/secret\/([^/.\s]+)(?:\.([^/\s]+))?$/;
+
+/**
+ * CPL014: a secret reference with no field qualifier.
+ *
+ * `cpln://secret/db` resolves to nothing for every secret type except `gcp`,
+ * which is conventionally mounted as a whole JSON file. The field name is not
+ * optional: `opaque` needs `.payload`, `userpass` needs `.username`/`.password`,
+ * `tls` needs `.cert`/`.key`, and a `dictionary` needs one of its keys.
+ *
+ * Volume mounts are exempt — mounting a secret as a directory is the documented
+ * way to consume a `dictionary` or a `gcp` credential file.
+ */
+export const qualifiedSecretRefCheck: PostSynthCheck = {
+  id: "CPL014",
+  description: "Secret references in environment variables must name a field",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      for (const container of readArray(entity, "spec", "containers")) {
+        const containerName = readString(container, "name") ?? "?";
+        for (const env of readArray(container, "env")) {
+          const envName = readString(env, "name") ?? "?";
+          const value = readString(env, "value");
+          if (!value) continue;
+
+          const match = SECRET_REF.exec(value);
+          if (!match || match[2]) continue;
+
+          diagnostics.push({
+            checkId: "CPL014",
+            severity: "error",
+            message:
+              `Workload "${name}" container "${containerName}" sets env "${envName}" to "${value}", which ` +
+              `names no field. Use \`cpln://secret/${match[1]}.FIELD\` — \`.payload\` for opaque, ` +
+              `\`.username\`/\`.password\` for userpass, \`.cert\`/\`.key\` for tls, a key name for a ` +
+              `dictionary. An unqualified reference resolves to nothing at runtime.`,
+            entity: name,
+            lexicon: "cpln",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cpl020-serverless-single-port.ts

@@ -0,0 +1,58 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readArray, readString } from "../../entity-props";
+import { WORKLOAD, entitiesOfType, exposedPorts, workloadType } from "./helpers";
+
+/**
+ * CPL020: a serverless workload must expose exactly one HTTP port.
+ *
+ * Not "at least one" and not "any number" — exactly one, and it must be HTTP.
+ * Zero is the more common mistake and the more confusing one, because the
+ * workload deploys and reports healthy while serving nothing.
+ */
+export const serverlessSinglePortCheck: PostSynthCheck = {
+  id: "CPL020",
+  description: "Serverless workloads must expose exactly one HTTP port",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      if (workloadType(entity) !== "serverless") continue;
+
+      const ports = exposedPorts(entity);
+      if (ports.length !== 1) {
+        diagnostics.push({
+          checkId: "CPL020",
+          severity: "error",
+          message:
+            `Serverless workload "${name}" exposes ${ports.length} ports; exactly one HTTP port is required. ` +
+            (ports.length === 0
+              ? `It will deploy and serve nothing.`
+              : `Use a standard workload if it genuinely needs several.`),
+          entity: name,
+          lexicon: "cpln",
+        });
+        continue;
+      }
+
+      // The single port must be HTTP. `tcp` and `grpc` need a standard workload.
+      for (const container of readArray(entity, "spec", "containers")) {
+        for (const port of readArray(container, "ports")) {
+          const protocol = readString(port, "protocol") ?? "http";
+          if (protocol === "http" || protocol === "http2") continue;
+          diagnostics.push({
+            checkId: "CPL020",
+            severity: "error",
+            message:
+              `Serverless workload "${name}" exposes a "${protocol}" port. Serverless supports only http ` +
+              `and http2 — use a standard workload for ${protocol}.`,
+            entity: name,
+            lexicon: "cpln",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cpl021-cron-job-shape.ts

@@ -0,0 +1,64 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readPath, readString } from "../../entity-props";
+import { WORKLOAD, entitiesOfType, exposedPorts, workloadType } from "./helpers";
+
+/**
+ * CPL021: a cron workload needs a schedule and must expose no ports.
+ *
+ * Cron cannot serve traffic, so a port on one is always a misunderstanding —
+ * usually a workload converted from serverless with the ports left behind. A
+ * missing `spec.job.schedule` is the other half: `spec.job` is *required* for
+ * cron and forbidden for every other type.
+ */
+export const cronJobShapeCheck: PostSynthCheck = {
+  id: "CPL021",
+  description: "Cron workloads must declare a schedule and expose no ports",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      const type = workloadType(entity);
+      const job = readPath(entity, "spec", "job");
+      const schedule = readString(entity, "spec", "job", "schedule");
+
+      if (type === "cron") {
+        if (!schedule) {
+          diagnostics.push({
+            checkId: "CPL021",
+            severity: "error",
+            message: `Cron workload "${name}" has no spec.job.schedule. A cron workload requires one.`,
+            entity: name,
+            lexicon: "cpln",
+          });
+        }
+
+        const ports = exposedPorts(entity);
+        if (ports.length > 0) {
+          diagnostics.push({
+            checkId: "CPL021",
+            severity: "error",
+            message:
+              `Cron workload "${name}" exposes ${ports.length} port(s) (${ports.join(", ")}). Cron workloads ` +
+              `cannot serve traffic — remove the ports, or use a standard workload.`,
+            entity: name,
+            lexicon: "cpln",
+          });
+        }
+        continue;
+      }
+
+      if (job !== undefined) {
+        diagnostics.push({
+          checkId: "CPL021",
+          severity: "error",
+          message: `Workload "${name}" is type "${type}" but sets spec.job. Only cron workloads may declare one.`,
+          entity: name,
+          lexicon: "cpln",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cpl022-container-ports.ts

@@ -0,0 +1,64 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { readArray, readNumber, readString } from "../../entity-props";
+import { WORKLOAD, entitiesOfType } from "./helpers";
+
+/**
+ * CPL022: `port` and `ports` are mutually exclusive, and port numbers must be
+ * unique across every container in a workload.
+ *
+ * The duplicate case is the one worth catching: two containers each binding
+ * 8080 is accepted at author time, rejected at apply, and reads as correct.
+ */
+export const containerPortsCheck: PostSynthCheck = {
+  id: "CPL022",
+  description: "Container ports must not mix `port` and `ports`, and must be unique across containers",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of entitiesOfType(ctx.entities, WORKLOAD)) {
+      const seen = new Map<number, string>();
+
+      for (const container of readArray(entity, "spec", "containers")) {
+        const containerName = readString(container, "name") ?? "?";
+        const single = readNumber(container, "port");
+        const list = readArray(container, "ports");
+
+        if (single !== undefined && list.length > 0) {
+          diagnostics.push({
+            checkId: "CPL022",
+            severity: "error",
+            message:
+              `Workload "${name}" container "${containerName}" sets both \`port\` and \`ports\`. ` +
+              `They are mutually exclusive — keep \`ports\`.`,
+            entity: name,
+            lexicon: "cpln",
+          });
+        }
+
+        const numbers = [
+          ...(single !== undefined ? [single] : []),
+          ...list.map((port) => readNumber(port, "number")).filter((n): n is number => n !== undefined),
+        ];
+
+        for (const number of numbers) {
+          const owner = seen.get(number);
+          if (owner !== undefined && owner !== containerName) {
+            diagnostics.push({
+              checkId: "CPL022",
+              severity: "error",
+              message:
+                `Workload "${name}" exposes port ${number} from both "${owner}" and "${containerName}". ` +
+                `Port numbers must be unique across the containers of one workload.`,
+              entity: name,
+              lexicon: "cpln",
+            });
+          }
+          seen.set(number, containerName);
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};