@intentius/chant-lexicon-k8s 0.44.13 → 0.45.0

package/src/lint/audit-catalog.ts

@@ -36,4 +36,6 @@ export const k8sAuditCatalog: Record<string, RuleMeta> = {
   WK8401: auditRule("WK8401", "merge-worthy", "guidance", "shmSize exceeds the container memory limit", "Lower shmSize or raise the memory limit so the pod can schedule.", { category: "best-practice" }),
   WK8402: auditRule("WK8402", "report-only", "guidance", "RayCluster missing spec.rayVersion", "Set spec.rayVersion so KubeRay picks the right autoscaler image.", { category: "best-practice" }),
   WK8403: auditRule("WK8403", "report-only", "guidance", "rayVersion does not match the head image tag", "Align spec.rayVersion with the Ray version in the head container image.", { category: "best-practice" }),
+  WK8501: auditRule("WK8501", "merge-worthy", "guidance", "Custom resource spec has a field its CRD does not declare", "Fix the field name; the API server prunes unknown fields and the controller never sees them.", { category: "correctness" }),
+  WK8502: auditRule("WK8502", "merge-worthy", "guidance", "Custom resource spec field has the wrong type or enum value", "Match the CRD schema: use the declared scalar type and one of the enum values.", { category: "correctness" }),
 };

package/src/lint/post-synth/crd-schema-helpers.ts

@@ -0,0 +1,228 @@
+/**
+ * Shared helpers for the custom-resource spec checks (WK8501, WK8502) — chant #1372.
+ *
+ * A CRD's constructor takes `spec: Record<string, unknown>`, so a misspelled
+ * or wrong-typed field type-checks, serializes, and is accepted by the API
+ * server (which prunes what the structural schema does not know) — the
+ * controller then runs with a default nobody chose. The generated lexicon JSON
+ * carries each CRD's `spec` field schema (`specSchema`); these helpers walk a
+ * synthesized manifest against it and report what the schema would reject.
+ *
+ * Excluded from check auto-discovery by the "helper" filename filter.
+ */
+
+import { createRequire } from "module";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { CrdFieldSchema } from "../../spec/parse";
+import { getPrimaryOutput, parseK8sManifests, type K8sManifest } from "./k8s-helpers";
+
+export type { CrdFieldSchema };
+
+interface LexiconEntry {
+  kind: "resource" | "property";
+  apiVersion?: string;
+  gvkKind?: string;
+  specSchema?: CrdFieldSchema;
+}
+
+let cachedRegistry: Map<string, CrdFieldSchema> | null = null;
+
+/** Registry key: `<apiVersion>/<kind>`, the pair a manifest carries verbatim. */
+function registryKey(apiVersion: string, kind: string): string {
+  return `${apiVersion}/${kind}`;
+}
+
+/**
+ * Spec schemas of every CRD the lexicon ships, keyed by `apiVersion/kind`.
+ * Built-in kinds carry no `specSchema` and are never in the map.
+ */
+export function getCrdSchemaRegistry(): Map<string, CrdFieldSchema> {
+  if (cachedRegistry) return cachedRegistry;
+  cachedRegistry = new Map();
+  try {
+    // Built lazily so importing this module stays edge-safe: `createRequire`
+    // throws where import.meta.url is undefined (bundled Workers), and there
+    // the registry is simply empty.
+    const require = createRequire(import.meta.url);
+    const lexicon = require("../../generated/lexicon-k8s.json") as Record<string, LexiconEntry>;
+    for (const entry of Object.values(lexicon)) {
+      if (entry.kind === "resource" && entry.apiVersion && entry.gvkKind && entry.specSchema) {
+        cachedRegistry.set(registryKey(entry.apiVersion, entry.gvkKind), entry.specSchema);
+      }
+    }
+  } catch {
+    // Lexicon JSON not yet generated — empty registry, checks pass.
+  }
+  return cachedRegistry;
+}
+
+/** Test seam: replace the registry (pass `null` to reload from the lexicon JSON). */
+export function setCrdSchemaRegistry(registry: Map<string, CrdFieldSchema> | null): void {
+  cachedRegistry = registry;
+}
+
+/** The schema for a manifest's `apiVersion`/`kind`, if the lexicon ships one. */
+export function specSchemaFor(manifest: K8sManifest): CrdFieldSchema | undefined {
+  if (typeof manifest.apiVersion !== "string" || typeof manifest.kind !== "string") return undefined;
+  return getCrdSchemaRegistry().get(registryKey(manifest.apiVersion, manifest.kind));
+}
+
+/** Every manifest in the build that has a shipped spec schema, with that schema. */
+export function customResources(ctx: PostSynthContext): Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> {
+  const out: Array<{ manifest: K8sManifest; schema: CrdFieldSchema }> = [];
+  for (const [, output] of ctx.outputs) {
+    for (const manifest of parseK8sManifests(getPrimaryOutput(output))) {
+      const schema = specSchemaFor(manifest);
+      if (schema) out.push({ manifest, schema });
+    }
+  }
+  return out;
+}
+
+export interface SpecFinding {
+  kind: "unknown-field" | "type-mismatch";
+  /** Dotted path under `spec`, e.g. `spec.source.s3bucket`. Array elements use `[i]`. */
+  path: string;
+  message: string;
+}
+
+/**
+ * Walk `value` against `schema` and report every field the schema does not
+ * list (unless the enclosing object is `open`) and every scalar whose type or
+ * enum membership the schema rejects. Untyped nodes pass anything.
+ */
+export function validateSpec(value: unknown, schema: CrdFieldSchema, path = "spec"): SpecFinding[] {
+  const findings: SpecFinding[] = [];
+  walk(value, schema, path, findings);
+  return findings;
+}
+
+function walk(value: unknown, schema: CrdFieldSchema, path: string, out: SpecFinding[]): void {
+  if (value === null || value === undefined) return;
+
+  // int-or-string and other deliberately untyped nodes accept anything.
+  if (!schema.type) return;
+
+  switch (schema.type) {
+    case "object": {
+      if (typeof value !== "object" || Array.isArray(value)) {
+        out.push(mismatch(path, "an object", value));
+        return;
+      }
+      const obj = value as Record<string, unknown>;
+      for (const [name, child] of Object.entries(obj)) {
+        const childSchema = schema.fields?.[name];
+        if (childSchema) {
+          walk(child, childSchema, `${path}.${name}`, out);
+          continue;
+        }
+        if (schema.open) continue;
+        const known = Object.keys(schema.fields ?? {});
+        const suggestion = suggestField(name, known);
+        const hint = suggestion ? ` (did you mean "${suggestion}"?)` : "";
+        out.push({
+          kind: "unknown-field",
+          path: `${path}.${name}`,
+          message: `unknown field "${path}.${name}"${hint}`,
+        });
+      }
+      return;
+    }
+    case "array": {
+      if (!Array.isArray(value)) {
+        out.push(mismatch(path, "an array", value));
+        return;
+      }
+      if (schema.items) {
+        value.forEach((item, i) => walk(item, schema.items!, `${path}[${i}]`, out));
+      }
+      return;
+    }
+    case "string": {
+      if (typeof value !== "string") {
+        // `x-kubernetes-int-or-string` never reaches here (untyped); a plain
+        // string field given a number is a real mismatch the server coerces
+        // or rejects depending on version, so say so.
+        out.push(mismatch(path, "a string", value));
+        return;
+      }
+      checkEnum(value, schema, path, out);
+      return;
+    }
+    case "integer":
+    case "number": {
+      if (typeof value !== "number" || (schema.type === "integer" && !Number.isInteger(value))) {
+        out.push(mismatch(path, schema.type === "integer" ? "an integer" : "a number", value));
+        return;
+      }
+      checkEnum(value, schema, path, out);
+      return;
+    }
+    case "boolean": {
+      if (typeof value !== "boolean") out.push(mismatch(path, "a boolean", value));
+      return;
+    }
+  }
+}
+
+function checkEnum(value: string | number, schema: CrdFieldSchema, path: string, out: SpecFinding[]): void {
+  if (!schema.enum || schema.enum.length === 0) return;
+  if (schema.enum.includes(String(value))) return;
+  out.push({
+    kind: "type-mismatch",
+    path,
+    message: `"${path}" must be one of ${schema.enum.map((v) => `"${v}"`).join(", ")}, got ${describe(value)}`,
+  });
+}
+
+function mismatch(path: string, expected: string, value: unknown): SpecFinding {
+  return {
+    kind: "type-mismatch",
+    path,
+    message: `"${path}" expects ${expected}, got ${describe(value)}`,
+  };
+}
+
+function describe(value: unknown): string {
+  if (typeof value === "string") return `string "${value}"`;
+  if (typeof value === "number" || typeof value === "boolean") return `${typeof value} ${String(value)}`;
+  if (Array.isArray(value)) return "an array";
+  if (value !== null && typeof value === "object") return "an object";
+  return String(value);
+}
+
+/** Levenshtein distance between two strings. */
+export function levenshtein(a: string, b: string): number {
+  const m = a.length;
+  const n = b.length;
+  const dp: number[][] = Array.from({ length: m + 1 }, () => Array<number>(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    for (let j = 1; j <= n; j++) {
+      dp[i][j] = a[i - 1] === b[j - 1]
+        ? dp[i - 1][j - 1]
+        : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
+    }
+  }
+  return dp[m][n];
+}
+
+/** Closest known field within Levenshtein distance 3 (case-insensitive), if any. */
+export function suggestField(unknown: string, known: string[]): string | undefined {
+  let best: string | undefined;
+  let bestDist = 4;
+  for (const field of known) {
+    const dist = levenshtein(unknown.toLowerCase(), field.toLowerCase());
+    if (dist < bestDist) {
+      bestDist = dist;
+      best = field;
+    }
+  }
+  return best;
+}
+
+/** `metadata.name` or the kind, for diagnostics. */
+export function resourceLabel(manifest: K8sManifest): string {
+  return manifest.metadata?.name ?? manifest.kind ?? "resource";
+}

package/src/lint/post-synth/index.ts

@@ -31,6 +31,8 @@ import { wk8306 } from "./wk8306";
 import { wk8401 } from "./wk8401";
 import { wk8402 } from "./wk8402";
 import { wk8403 } from "./wk8403";
+import { wk8501 } from "./wk8501";
+import { wk8502 } from "./wk8502";
 
 export const postSynthChecks: PostSynthCheck[] = [
   argo002,
@@ -64,4 +66,6 @@ export const postSynthChecks: PostSynthCheck[] = [
   wk8401,
   wk8402,
   wk8403,
+  wk8501,
+  wk8502,
 ];

package/src/lint/post-synth/post-synth.test.ts

@@ -33,6 +33,9 @@ import { argo003 } from "./argo003";
 import { argo005 } from "./argo005";
 import { flux002 } from "./flux002";
 import { flux003 } from "./flux003";
+import { wk8501 } from "./wk8501";
+import { wk8502 } from "./wk8502";
+import { getCrdSchemaRegistry, setCrdSchemaRegistry, validateSpec } from "./crd-schema-helpers";
 
 function makeCtx(yaml: string): PostSynthContext {
   return {
@@ -1791,3 +1794,156 @@ describe("FLUX003: Kustomization dependsOn names declared Kustomizations", () =>
     expect(flux003.check(ctx).length).toBe(0);
   });
 });
+
+// ── WK8501 / WK8502: custom-resource spec against the CRD schema (chant #1372) ──
+
+describe("WK8501/WK8502: custom resource spec validated against the shipped CRD schema", () => {
+  const hasLexicon = getCrdSchemaRegistry().size > 0;
+
+  function microVm(spec: Record<string, unknown>) {
+    return {
+      apiVersion: "lambda.aws.amazon.com/v1alpha1",
+      kind: "MicroVM",
+      metadata: { name: "agent-1", namespace: "vms" },
+      spec,
+    };
+  }
+
+  test("metadata", () => {
+    expect(wk8501.id).toBe("WK8501");
+    expect(wk8502.id).toBe("WK8502");
+  });
+
+  test.skipIf(!hasLexicon)("the lexicon ships a spec schema for every CRD-derived kind", () => {
+    const registry = getCrdSchemaRegistry();
+    for (const key of ["lambda.aws.amazon.com/v1alpha1/MicroVM", "cert-manager.io/v1/Certificate", "ray.io/v1/RayCluster"]) {
+      expect(registry.get(key)?.type, key).toBe("object");
+    }
+    // Built-in kinds are typed by the .d.ts and carry no schema.
+    expect(registry.has("apps/v1/Deployment")).toBe(false);
+  });
+
+  test.skipIf(!hasLexicon)("WK8501 flags a misspelled MicroVM field and suggests the real one", () => {
+    // The kubemicrovm-ops case from #1372: `classname` type-checks, applies
+    // cleanly, and the controller runs the VM with the default class.
+    const ctx = manifestsCtx(microVm({ classname: "large", imageRef: "img" }));
+    const diags = wk8501.check(ctx);
+    expect(diags.length).toBe(1);
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].entity).toBe("agent-1");
+    expect(diags[0].message).toContain('unknown field "spec.classname"');
+    expect(diags[0].message).toContain('did you mean "className"');
+    // WK8502 has nothing to say about a field the schema does not know.
+    expect(wk8502.check(ctx).length).toBe(0);
+  });
+
+  test.skipIf(!hasLexicon)("WK8502 flags a wrong-typed scalar and a value outside its enum", () => {
+    const ctx = manifestsCtx(microVm({
+      className: "large",
+      maxIdleDurationSeconds: "300",
+      desiredState: "Runing",
+      autoResumeEnabled: "yes",
+    }));
+    const diags = wk8502.check(ctx);
+    const messages = diags.map((d) => d.message);
+    expect(messages).toEqual([
+      expect.stringContaining('"spec.maxIdleDurationSeconds" expects an integer, got string "300"'),
+      expect.stringContaining('"spec.desiredState" must be one of "Running", "Suspended", "Terminated", got string "Runing"'),
+      expect.stringContaining('"spec.autoResumeEnabled" expects a boolean, got string "yes"'),
+    ]);
+    expect(diags.every((d) => d.checkId === "WK8502" && d.severity === "error")).toBe(true);
+    expect(wk8501.check(ctx).length).toBe(0);
+  });
+
+  test.skipIf(!hasLexicon)("a well-formed custom resource passes both checks", () => {
+    const ctx = manifestsCtx(
+      microVm({ className: "large", desiredState: "Running", maxIdleDurationSeconds: 300, tags: { team: "ml", any: 1 } }),
+      {
+        apiVersion: "cert-manager.io/v1",
+        kind: "Certificate",
+        metadata: { name: "web-tls" },
+        spec: {
+          secretName: "web-tls",
+          dnsNames: ["example.com"],
+          issuerRef: { name: "letsencrypt", kind: "ClusterIssuer" },
+          privateKey: { algorithm: "ECDSA", size: 256 },
+        },
+      },
+    );
+    expect(wk8501.check(ctx)).toEqual([]);
+    expect(wk8502.check(ctx)).toEqual([]);
+  });
+
+  test.skipIf(!hasLexicon)("walks nested objects and array elements", () => {
+    const ctx = manifestsCtx({
+      apiVersion: "cert-manager.io/v1",
+      kind: "Certificate",
+      metadata: { name: "web-tls" },
+      spec: {
+        secretName: "web-tls",
+        issuerRef: { nmae: "letsencrypt" },
+        additionalOutputFormats: [{ type: "DER" }, { type: "PEM" }],
+        privateKey: { algorithm: "DSA" },
+      },
+    });
+    expect(wk8501.check(ctx).map((d) => d.message)).toEqual([
+      expect.stringContaining('unknown field "spec.issuerRef.nmae" (did you mean "name"?)'),
+    ]);
+    expect(wk8502.check(ctx).map((d) => d.message)).toEqual([
+      expect.stringContaining('"spec.additionalOutputFormats[1].type" must be one of "DER", "CombinedPEM"'),
+      expect.stringContaining('"spec.privateKey.algorithm" must be one of "RSA", "ECDSA", "Ed25519"'),
+    ]);
+  });
+
+  test("built-in kinds and unknown apiVersion/kind pairs are never checked", () => {
+    const ctx = manifestsCtx(
+      { apiVersion: "apps/v1", kind: "Deployment", metadata: { name: "web" }, spec: { replicas: "2", bogus: true } },
+      { apiVersion: "example.com/v1", kind: "Widget", metadata: { name: "w" }, spec: { bogus: true } },
+    );
+    expect(wk8501.check(ctx)).toEqual([]);
+    expect(wk8502.check(ctx)).toEqual([]);
+  });
+
+  test("open objects and int-or-string accept anything (stub registry)", () => {
+    setCrdSchemaRegistry(new Map([[
+      "example.com/v1/Widget",
+      {
+        type: "object",
+        fields: {
+          labels: { type: "object", open: true },
+          port: { open: true },
+          replicas: { type: "integer" },
+          items: { type: "array", items: { type: "string" } },
+        },
+      },
+    ]]));
+    try {
+      const ok = manifestsCtx({
+        apiVersion: "example.com/v1", kind: "Widget", metadata: { name: "w" },
+        spec: { labels: { anything: { nested: true } }, port: "http", replicas: 2, items: ["a"] },
+      });
+      expect(wk8501.check(ok)).toEqual([]);
+      expect(wk8502.check(ok)).toEqual([]);
+
+      const bad = manifestsCtx({
+        apiVersion: "example.com/v1", kind: "Widget", metadata: { name: "w" },
+        spec: { replicas: 2.5, items: "a" },
+      });
+      expect(wk8502.check(bad).map((d) => d.message)).toEqual([
+        expect.stringContaining('"spec.replicas" expects an integer, got number 2.5'),
+        expect.stringContaining('"spec.items" expects an array, got string "a"'),
+      ]);
+    } finally {
+      setCrdSchemaRegistry(null);
+    }
+  });
+
+  test("validateSpec reports unknown fields and type mismatches with dotted paths", () => {
+    const schema = { type: "object" as const, fields: { a: { type: "object" as const, fields: { b: { type: "boolean" as const } } } } };
+    expect(validateSpec({ a: { b: "x", c: 1 }, d: 2 }, schema)).toEqual([
+      { kind: "type-mismatch", path: "spec.a.b", message: expect.stringContaining("expects a boolean") },
+      { kind: "unknown-field", path: "spec.a.c", message: expect.stringContaining('unknown field "spec.a.c"') },
+      { kind: "unknown-field", path: "spec.d", message: expect.stringContaining('unknown field "spec.d"') },
+    ]);
+  });
+});

package/src/lint/post-synth/wk8501.ts

@@ -0,0 +1,40 @@
+/**
+ * WK8501: Custom resource spec has a field its CRD schema does not declare
+ *
+ * A generated CRD class takes `spec: Record<string, unknown>`, so a misspelled
+ * field (`classname` for `className`) type-checks and serializes. The API
+ * server accepts the object and prunes the unknown field, the controller
+ * never sees it, and the resource runs with a default nobody chose. The
+ * lexicon ships each CRD's `spec` schema (chant #1372); this check flags any
+ * field that schema does not list, unless the enclosing object declares
+ * `x-kubernetes-preserve-unknown-fields` or `additionalProperties`.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { customResources, resourceLabel, validateSpec } from "./crd-schema-helpers";
+
+export const wk8501: PostSynthCheck = {
+  id: "WK8501",
+  description: "Custom resource spec contains a field its CRD schema does not declare",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { manifest, schema } of customResources(ctx)) {
+      if (manifest.spec === undefined) continue;
+      const name = resourceLabel(manifest);
+      for (const finding of validateSpec(manifest.spec, schema)) {
+        if (finding.kind !== "unknown-field") continue;
+        diagnostics.push({
+          checkId: "WK8501",
+          severity: "error",
+          message: `${manifest.kind} "${name}": ${finding.message}. The API server prunes it and the controller never sees it.`,
+          entity: name,
+          lexicon: "k8s",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/wk8502.ts

@@ -0,0 +1,39 @@
+/**
+ * WK8502: Custom resource spec field has the wrong type or an invalid enum value
+ *
+ * With `spec: Record<string, unknown>` on every generated CRD class, nothing
+ * at compile time stops `replicas: "2"` or `desiredState: "Runing"`. The API
+ * server rejects the first at apply and the controller ignores the second.
+ * The lexicon ships each CRD's `spec` schema (chant #1372); this check
+ * compares every scalar against its declared type and enum before apply.
+ * `x-kubernetes-int-or-string` and untyped nodes accept anything.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { customResources, resourceLabel, validateSpec } from "./crd-schema-helpers";
+
+export const wk8502: PostSynthCheck = {
+  id: "WK8502",
+  description: "Custom resource spec field has the wrong type or a value outside its enum",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { manifest, schema } of customResources(ctx)) {
+      if (manifest.spec === undefined) continue;
+      const name = resourceLabel(manifest);
+      for (const finding of validateSpec(manifest.spec, schema)) {
+        if (finding.kind !== "type-mismatch") continue;
+        diagnostics.push({
+          checkId: "WK8502",
+          severity: "error",
+          message: `${manifest.kind} "${name}": ${finding.message}`,
+          entity: name,
+          lexicon: "k8s",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/list-map-key-table.test.ts

@@ -0,0 +1,83 @@
+import { describe, test, expect, afterEach, vi } from "vitest";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import {
+  listMapKeyTablePath,
+  loadListMapKeyTable,
+  resetListMapKeyTableCache,
+  schemaListMapOrderKey,
+} from "./deep-observe-hooks";
+import type { DeepArrayElement } from "@intentius/chant/lexicon";
+
+/**
+ * chant #1476 — the generated table is data, not a hard dependency. Present,
+ * it drives list identity; absent, `schemaListMapOrderKey` degrades to the
+ * hand-written conventions with one warning, and never throws.
+ */
+
+function el(pattern: string, element: unknown): DeepArrayElement {
+  return { entityType: "K8s::Apps::Deployment", pattern, path: pattern, element, index: 0, side: "live" };
+}
+
+describe("list-map-keys table loading (#1476)", () => {
+  afterEach(() => {
+    resetListMapKeyTableCache();
+    vi.restoreAllMocks();
+  });
+
+  test("the generated table exists where the loader looks", () => {
+    expect(listMapKeyTablePath()).toMatch(/generated[\\/]list-map-keys\.json$/);
+    expect(existsSync(listMapKeyTablePath())).toBe(true);
+  });
+
+  test("table present: spec-declared keys identify lists the conventions miss", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const table = loadListMapKeyTable();
+    expect(table.conditions).toBeDefined();
+    expect(warn).not.toHaveBeenCalled();
+
+    resetListMapKeyTableCache();
+    expect(schemaListMapOrderKey(el("status.conditions", { type: "Ready", status: "True" }))).toBe("Ready");
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  test("table absent: falls back to the conventions, warns once, never throws", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const missing = join(tmpdir(), "chant-1476-does-not-exist", "list-map-keys.json");
+
+    const table = loadListMapKeyTable(missing);
+    expect(table).toEqual({});
+    expect(warn).toHaveBeenCalledTimes(1);
+    const message = String(warn.mock.calls[0][0]);
+    expect(message).toContain("npm run generate");
+    expect(message).toContain(missing);
+
+    // Seed the cache with the empty table, as the first lookup would have.
+    resetListMapKeyTableCache(table);
+
+    // Hand-written conventions still apply ...
+    expect(schemaListMapOrderKey(el("spec.template.spec.containers", { name: "app" }))).toBe("app");
+    expect(schemaListMapOrderKey(el("spec.template.spec.containers[].env", { name: "FOO" }))).toBe("FOO");
+    // ... and lists only the spec knows about fall through to undefined, not a throw.
+    expect(() => schemaListMapOrderKey(el("status.conditions", { type: "Ready" }))).not.toThrow();
+    expect(schemaListMapOrderKey(el("status.conditions", { type: "Ready" }))).toBeUndefined();
+
+    // The warning was emitted by the load, not per element.
+    expect(warn).toHaveBeenCalledTimes(1);
+  });
+
+  test("table unreadable: treated like absent", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    const dir = mkdtempSync(join(tmpdir(), "chant-1476-"));
+    try {
+      const corrupt = join(dir, "list-map-keys.json");
+      writeFileSync(corrupt, "{ not json");
+      expect(loadListMapKeyTable(corrupt)).toEqual({});
+      expect(warn).toHaveBeenCalledTimes(1);
+      expect(String(warn.mock.calls[0][0])).toContain("unreadable");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/src/op/activities/kubectl.ts

@@ -35,7 +35,7 @@ import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { loadAll } from "js-yaml";
 import { safeHeartbeat } from "@intentius/chant/op";
-import { loadChantConfig, resolveOwnershipMarker } from "@intentius/chant/config";
+import { loadChantConfig, resolveOwnershipStack } from "@intentius/chant/config";
 import {
   hasOwnershipMarker,
   LABEL_OWNERSHIP_KEYS,
@@ -185,7 +185,7 @@ async function resolveApplyIdentity(
   if (stack === undefined) {
     try {
       const { config } = await loadChantConfig(args.cwd ?? process.cwd());
-      stack = resolveOwnershipMarker(config)?.stack;
+      stack = resolveOwnershipStack(config);
     } catch (err) {
       console.warn(
         `[k8s] could not read the project config to derive a field manager ` +

package/src/serializer.test.ts

@@ -348,7 +348,7 @@ describe("k8sSerializer", () => {
       }),
     );
 
-    const result = k8sSerializer.serialize(entities);
+    const result = k8sSerializer.serialize(entities) as string;
     expect(result).toContain("env: prod");
     // Should not contain "dev" since explicit overrides
     const envLines = result.split("\n").filter((l: string) => l.includes("env:"));
@@ -366,7 +366,7 @@ describe("k8sSerializer", () => {
       }),
     );
 
-    const result = k8sSerializer.serialize(entities);
+    const result = k8sSerializer.serialize(entities) as string;
     expect(result).toContain("kind: Deployment");
     // Only one document — property entities should not appear as separate docs
     expect(result.split("---").length).toBeLessThanOrEqual(2);
@@ -406,7 +406,7 @@ describe("k8sSerializer", () => {
       }),
     );
 
-    const result = k8sSerializer.serialize(entities);
+    const result = k8sSerializer.serialize(entities) as string;
     const docs = result.split("---");
     // First document should be the Namespace
     expect(docs[0]).toContain("kind: Namespace");
@@ -449,7 +449,7 @@ describe("k8sSerializer", () => {
       }),
     );
 
-    const result = k8sSerializer.serialize(entities);
+    const result = k8sSerializer.serialize(entities) as string;
     const lines = result.split("\n");
     const keyLines = lines.filter((l: string) => /^\w+:/.test(l));
     const keys = keyLines.map((l: string) => l.split(":")[0]);