@intentius/chant-lexicon-otel 0.102.0 → 0.104.0

package/src/import/parser.ts

@@ -21,11 +21,13 @@
 
 import * as jsYaml from "js-yaml";
 import type { TemplateIR, TemplateParser } from "@intentius/chant/import/parser";
-import { GENAI_SEMCONV_PIN, type SchemaPin } from "../define";
+import type { SchemaPin } from "../define";
+import { SEMCONV_VOCABULARIES } from "../semconv";
 import {
   COMPONENT_KINDS,
   SECTION_OF,
   SIGNALS,
+  canonicalComponentType,
   parseComponentId,
   pipelineSignal,
   type CollectorConfig,
@@ -104,10 +106,11 @@ function readHeader(content: string, warnings: string[]): { pins: HeaderPin[]; s
     if (sc) {
       const [, namespace, source, version, digest] = sc;
       semconv.push({ namespace, pin: digest ? { source, version, digest } : { source, version } });
-      if (namespace === "gen_ai" && (source !== GENAI_SEMCONV_PIN.source || version !== GENAI_SEMCONV_PIN.version)) {
+      const ours = SEMCONV_VOCABULARIES.find((v) => v.namespace === namespace)?.pin;
+      if (ours && (source !== ours.source || version !== ours.version)) {
         warnings.push(
           `the config was built against ${namespace} semantic conventions ${source}@${version}; ` +
-            `this lexicon follows ${GENAI_SEMCONV_PIN.source}@${GENAI_SEMCONV_PIN.version}, which the rebuilt config will name`,
+            `this lexicon follows ${ours.source}@${ours.version}, which the rebuilt config will name`,
         );
       }
       continue;
@@ -141,7 +144,16 @@ export function parseCollectorYaml(content: string): ParsedCollector {
     if (key === "service") continue;
     const section: Record<string, Record<string, unknown> | null> = {};
     for (const [id, cfg] of Object.entries(value)) {
-      if (!parseComponentId(id)) warnings.push(`${key}: "${id}" is not a type[/name] component id`);
+      const parsed = parseComponentId(id);
+      if (!parsed) warnings.push(`${key}: "${id}" is not a type[/name] component id`);
+      const builtin = parsed && canonicalComponentType(KIND_OF_SECTION[key], parsed.type);
+      if (parsed && builtin && builtin !== parsed.type) {
+        warnings.push(
+          `${key}.${id} uses "${parsed.type}", the collector's newer name for "${builtin}"; it imports as the built-in, which writes "${builtin}"`,
+        );
+        const renamed = parsed.name === undefined ? builtin : `${builtin}/${parsed.name}`;
+        if (renamed in value) warnings.push(`${key}.${id} and ${key}.${renamed} become the same id "${renamed}"; rename one of them`);
+      }
       if (cfg !== null && cfg !== undefined && !isPlainObject(cfg)) {
         warnings.push(`${key}.${id} is not a mapping; it is carried as an empty config`);
         section[id] = null;

package/src/import/roundtrip.test.ts

@@ -21,7 +21,7 @@ import { spawnSync } from "child_process";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
 import { tmpdir } from "os";
 import { join } from "path";
-import { load } from "js-yaml";
+import { dump, load } from "js-yaml";
 import { build } from "@intentius/chant/build";
 import { lintCommand } from "@intentius/chant/cli/commands/lint";
 import { importCommand, importFromContent } from "@intentius/chant/cli/commands/import";
@@ -29,7 +29,7 @@ import { otelSerializer } from "../serializer";
 import { collectorYaml } from "../collector";
 import { registeredDefinitions } from "../define";
 import { genAiPipeline } from "../genai";
-import { SECTION_OF, type CollectorConfig, type ComponentKind } from "../model";
+import { COMPONENT_TYPE_ALIASES, SECTION_OF, type CollectorConfig, type ComponentKind } from "../model";
 import * as c from "../components";
 import { OtelCollectorParser } from "./parser";
 import { OtelCollectorGenerator } from "./generator";
@@ -230,23 +230,99 @@ describe("YAML -> TypeScript -> YAML", () => {
   }
 
   test.skipIf(!OTELCOL)("otelcol validate accepts every re-emitted config", async () => {
-    // Not the agent-observability agent: its k8s resolver needs a cluster to build (that example's own tests swap it for dns).
-    const yamls: Array<[string, string]> = [
+    // file_storage and hostmetrics need their directories to exist, so fault-tolerant-logs gets temp ones in place of /var/lib/otelcol.
+    const storage = mkdtempSync(join(tmpdir(), "chant-otelcol-storage-"));
+    try {
+      for (const d of ["receiver", "output"]) mkdirSync(join(storage, d));
+      // Not the agent-observability agent: its k8s resolver needs a cluster to build (that example's own tests swap it for dns).
+      const yamls: Array<[string, string]> = [
+        ["gateway.yaml", read("gateway.yaml")],
+        ["signaltometrics.yaml", read("signaltometrics.yaml")],
+        ["agent-observability-gateway.yaml", read("agent-observability-gateway.yaml")],
+        ["genAiPipeline()", collectorYaml(genAiPipeline())],
+        ...[...UPSTREAM_BUILTIN_ONLY, "loadbalancing-agent.yaml", "servicegraph-nop.yaml"].map((f): [string, string] => [f, read("upstream", f)]),
+        ["fault-tolerant-logs.yaml", read("upstream", "fault-tolerant-logs.yaml").replaceAll("/var/lib/otelcol/file_storage", storage)],
+        // hostmetrics' root_path is accepted on linux only, which is where the node agent runs.
+        // It must exist, so the node agent's /hostfs becomes the temp dir.
+        ...(await exampleOutputs())
+          .filter(([n]) => n !== "k8s-node-agent" || process.platform === "linux")
+          .map(([n, y]): [string, string] => [n, y.replaceAll("/hostfs", storage)]),
+      ];
+      for (const [name, yaml] of yamls) {
+        const { yaml: rebuilt } = await importAndBuild(yaml);
+        const { ok, output } = otelcolValidate(rebuilt);
+        expect(ok, `${name}: ${output}`).toBe(true);
+      }
+    } finally {
+      rmSync(storage, { recursive: true, force: true });
+    }
+  });
+
+  // couchbase fails validate upstream at the pinned release; a pin bump that fixes it shows here.
+  test.skipIf(!OTELCOL)("otelcol validate rejects couchbase.yaml as it does upstream", async () => {
+    const { yaml: rebuilt } = await importAndBuild(read("upstream", "couchbase.yaml"));
+    const { ok, output } = otelcolValidate(rebuilt);
+    expect(ok).toBe(false);
+    expect(output).toContain('undefined function "convert_gauge_to_sum"');
+  });
+
+});
+
+/** `yaml` with every renamed built-in written under the collector's newer name (`spanmetrics` as `span_metrics`). */
+function withNewNames(yaml: string): string {
+  const doc = (load(yaml) ?? {}) as CollectorConfig;
+  const renamed = new Map<string, string>();
+  for (const kind of Object.keys(SECTION_OF) as ComponentKind[]) {
+    const section = doc[SECTION_OF[kind]];
+    if (!section) continue;
+    const out: Record<string, unknown> = {};
+    for (const [id, cfg] of Object.entries(section)) {
+      const slash = id.indexOf("/");
+      const type = slash === -1 ? id : id.slice(0, slash);
+      const alias = COMPONENT_TYPE_ALIASES.find((a) => a.kind === kind && a.builtin === type);
+      const next = alias ? `${alias.type}${slash === -1 ? "" : id.slice(slash)}` : id;
+      if (alias) renamed.set(`${kind}:${id}`, next);
+      out[next] = cfg;
+    }
+    (doc as Record<string, unknown>)[SECTION_OF[kind]] = out;
+  }
+  // A receiver and an exporter may share an id (`otlp`), so each list renames only its own kinds.
+  const kindsOf = { receivers: ["receiver", "connector"], processors: ["processor"], exporters: ["exporter", "connector"] } as const;
+  for (const p of Object.values(doc.service?.pipelines ?? {})) {
+    for (const list of ["receivers", "processors", "exporters"] as const) {
+      p[list] = p[list]?.map((id) => kindsOf[list].map((k) => renamed.get(`${k}:${id}`)).find(Boolean) ?? id);
+    }
+  }
+  return dump(doc, { lineWidth: -1 });
+}
+
+describe("the collector's newer names for renamed built-ins", () => {
+  test("import to the same classes as the old names, and build back to the old names", async () => {
+    const fixtures: Array<[string, string]> = [
+      ["every built-in", collectorYaml(everyBuiltin())],
       ["gateway.yaml", read("gateway.yaml")],
       ["signaltometrics.yaml", read("signaltometrics.yaml")],
-      ["agent-observability-gateway.yaml", read("agent-observability-gateway.yaml")],
-      ["genAiPipeline()", collectorYaml(genAiPipeline())],
-      ...UPSTREAM_BUILTIN_ONLY.map((f): [string, string] => [f, read("upstream", f)]),
-      // hostmetrics' root_path is accepted on linux only, which is where the node agent runs.
-      ...(await exampleOutputs()).filter(([n]) => n !== "k8s-node-agent" || process.platform === "linux"),
     ];
-    for (const [name, yaml] of yamls) {
-      const { yaml: rebuilt } = await importAndBuild(yaml);
-      const { ok, output } = otelcolValidate(rebuilt);
-      expect(ok, `${name}: ${output}`).toBe(true);
+    const used = new Set<string>();
+    for (const [name, yaml] of fixtures) {
+      const renamedYaml = withNewNames(yaml);
+      if (renamedYaml === dump(load(yaml), { lineWidth: -1 })) continue;
+      const before = await importAndBuild(yaml);
+      const after = await importAndBuild(renamedYaml);
+      expect(after.buildErrors, name).toEqual([]);
+      const classes = (src: string) => [...src.matchAll(/new ([A-Z]\w+)\(/g)].map((m) => m[1]).sort();
+      expect(classes(after.source), name).toEqual(classes(before.source));
+      expect(after.source, name).not.toContain("defineComponent<");
+      // Emitted names stay the ones the pinned collector knows.
+      expect(normalize(after.yaml), name).toEqual(normalize(yaml));
+      for (const w of after.warnings) {
+        const m = /uses "(\w+)", the collector's newer name for "(\w+)"/.exec(w);
+        if (m) used.add(m[1]);
+      }
     }
+    // The every-built-in fixture uses all twelve renamed types.
+    expect([...used].sort()).toEqual(COMPONENT_TYPE_ALIASES.map((a) => a.type).sort());
   });
-
 });
 
 describe("components chant does not ship", () => {

package/src/index.ts

@@ -32,6 +32,7 @@ export {
   componentEntityType,
   isOTelComponent,
   COLLECTOR_PIN,
+  SEMCONV_PIN,
   GENAI_SEMCONV_PIN,
   type SchemaPin,
   type SafeParseSchema,
@@ -54,6 +55,7 @@ export {
   type CollectorIssue,
   type CollectorIssueCode,
 } from "./validate-config";
+export { K8S_ATTRIBUTES_METADATA, RESOURCE_DETECTORS } from "./config-hygiene";
 export {
   collectorTopology,
   collectorTopologyOf,
@@ -65,6 +67,7 @@ export {
   type SemconvUsage,
 } from "./topology";
 export { semconvUsage, SEMCONV_VOCABULARIES, type SemconvVocabulary } from "./semconv";
+export { attributionIssues, isProtectedResourceAttribute, PROTECTED_RESOURCE_ATTRIBUTES } from "./attribution";
 
 // Composites
 export { NodeAgent, nodeAgentPropsProblem, type NodeAgentProps, type NodeAgentMembers, type NodeAgentInstance } from "./composites";
@@ -121,6 +124,10 @@ export {
   SPANMETRICS_DEFAULT_DIMENSIONS,
   SPANMETRICS_DEFAULT_NAMESPACE,
   SPAN_STATUS_ERROR,
+  SERVICEGRAPH_NAMESPACE,
+  serviceGraphNames,
+  type ServiceGraphNames,
+  type ServiceGraphNamingConfig,
   type CollectorMetric,
   type SpanMetricsNames,
   type SpanMetricsNamingConfig,

package/src/lint/audit-catalog.ts

@@ -2,8 +2,9 @@
  * The otel lexicon's chant audit catalog, contributed via
  * `otelPlugin.auditCatalog()` (#687, #1346).
  *
- * OTEL101-OTEL106 and OTEL112-OTEL117 read the emitted collector YAML, so they are
- * `yamlBased`.
+ * OTEL101-OTEL106, OTEL112-OTEL117 and OTEL119-OTEL127 read the emitted collector YAML, so they are
+ * `yamlBased`. OTEL118 reads it too, but only in a build that stamps
+ * telemetry attribution, so it is not.
  * OTEL107-OTEL109 read the declared entities (a component's definition, its
  * schema pin), which a standalone YAML file does not carry, so they are
  * constructed with `yamlBased: false`. The two source-level lint rules are
@@ -148,4 +149,88 @@ export const otelAuditCatalog: Record<string, RuleMeta> = {
     "Give one of them another port, or a specific host that doesn't overlap the other's. The collector's own metrics listen on localhost:8888 unless service.telemetry.metrics sets a reader or level none.",
     { category: "correctness" },
   ),
+  // Runs only in a build that stamps telemetry attribution, which a standalone YAML file never is.
+  OTEL118: {
+    ...auditRule(
+      "OTEL118",
+      "report-only",
+      "guidance",
+      "Pipeline processor can remove or replace a telemetry attribution key",
+      "Leave service.name, service.version, deployment.environment.name, vcs.ref.head.revision and chant.* keys alone: use insert rather than upsert or update, keep them in keep_keys and in redaction's allowed_keys, and set override: false on resourcedetection.",
+      { category: "correctness" },
+    ),
+    yamlBased: false,
+  },
+  OTEL119: auditRule(
+    "OTEL119",
+    "report-only",
+    "guidance",
+    "Collector config sets a field deprecated before the pinned release",
+    "Replace invert_match with a drop policy, service.telemetry.metrics.address with readers, and spanmetrics dimensions_cache_size with aggregation_cardinality_limit.",
+    { category: "best-practice" },
+  ),
+  OTEL120: auditRule(
+    "OTEL120",
+    "merge-worthy",
+    "guidance",
+    "Collector credential written as a literal in the config",
+    'Replace the value with `${env:NAME}` or `${file:/path}` so the collector reads it at start-up.',
+    { category: "security" },
+  ),
+  OTEL121: auditRule(
+    "OTEL121",
+    "merge-worthy",
+    "guidance",
+    "Exporter sends a credential over plaintext",
+    "Use an https:// endpoint, or drop tls.insecure, for an exporter that sends an authorization header or API key.",
+    { category: "security" },
+  ),
+  OTEL122: auditRule(
+    "OTEL122",
+    "merge-worthy",
+    "guidance",
+    "zpages or pprof listens on a non-loopback address",
+    "Bind zpages and pprof to localhost and reach them with a port-forward.",
+    { category: "security" },
+  ),
+  OTEL123: auditRule(
+    "OTEL123",
+    "report-only",
+    "guidance",
+    "debug exporter at verbosity detailed beside a real exporter",
+    "Set the debug exporter to verbosity basic, or keep detailed output to a pipeline that exports nowhere else.",
+    { category: "security" },
+  ),
+  OTEL124: auditRule(
+    "OTEL124",
+    "report-only",
+    "guidance",
+    "Remote exporter has its sending queue or retries turned off",
+    "Remove sending_queue.enabled: false and retry_on_failure.enabled: false from exporters that send over the network.",
+    { category: "best-practice" },
+  ),
+  OTEL125: auditRule(
+    "OTEL125",
+    "report-only",
+    "guidance",
+    "Pipeline sends to a remote otlp or otlphttp exporter without batching",
+    "Add a batch processor to the pipeline, or set sending_queue.batch on the exporter.",
+    { category: "best-practice" },
+  ),
+  OTEL126: auditRule(
+    "OTEL126",
+    "merge-worthy",
+    "guidance",
+    "k8sattributes extracts an unsupported metadata field",
+    "Use a field from the k8sattributes list at the pinned release, or extract it as a label or annotation.",
+    { category: "correctness" },
+  ),
+  OTEL127: auditRule(
+    "OTEL127",
+    "merge-worthy",
+    "guidance",
+    "resourcedetection lists an unknown detector",
+    "Name detectors as the processor registers them (elastic_beanstalk, not elasticbeanstalk), or remove the entry.",
+    { category: "correctness" },
+  ),
 };

package/src/lint/post-synth/hygiene.test.ts

@@ -0,0 +1,334 @@
+import { describe, expect, test } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
+import { dump, load } from "js-yaml";
+import type { Declarable } from "@intentius/chant/declarable";
+import { otel119 } from "./otel119";
+import { otel120 } from "./otel120";
+import { otel121 } from "./otel121";
+import { otel122 } from "./otel122";
+import { otel123 } from "./otel123";
+import { otel124 } from "./otel124";
+import { otel125 } from "./otel125";
+import { otel126 } from "./otel126";
+import { otel127 } from "./otel127";
+import { collectorConfigDiagnostics } from "./otel-helpers";
+import { collectorYaml } from "../../collector";
+import { otlpCollector } from "../../platform";
+import { genAiPipeline } from "../../genai";
+import { NodeAgent } from "../../composites";
+import { OtlpExporter, OtlpHttpExporter, PrometheusExporter } from "../../components";
+import { validateCollectorConfig } from "../../validate-config";
+import type { CollectorConfig } from "../../model";
+
+const run = (check: { check: typeof otel119.check }, config: object) => check.check(makePostSynthCtx("otel", dump(config, { lineWidth: -1 })));
+const HYGIENE = ["OTEL119", "OTEL120", "OTEL121", "OTEL122", "OTEL123", "OTEL124", "OTEL125", "OTEL126", "OTEL127"];
+
+/** A started otlp receiver and the given exporters, all in one traces pipeline with batch. */
+function withExporters(exporters: Record<string, object>, extra: { processors?: string[] } = {}) {
+  return {
+    receivers: { otlp: { protocols: { grpc: {} } } },
+    processors: { batch: {} },
+    exporters,
+    service: { pipelines: { traces: { receivers: ["otlp"], processors: extra.processors ?? ["batch"], exporters: Object.keys(exporters) } } },
+  };
+}
+
+describe("OTEL119 deprecated fields", () => {
+  const tailSampling = (policies: object[]) => ({
+    receivers: { otlp: { protocols: { grpc: {} } } },
+    processors: { tail_sampling: { policies } },
+    exporters: { debug: {} },
+    service: { pipelines: { traces: { receivers: ["otlp"], processors: ["tail_sampling"], exporters: ["debug"] } } },
+  });
+
+  test("reports invert_match: true in a policy and in a sub-policy", () => {
+    const diags = run(
+      otel119,
+      tailSampling([
+        { name: "not-health", type: "string_attribute", string_attribute: { key: "http.route", values: ["/health"], invert_match: true } },
+        { name: "and", type: "and", and: { and_sub_policy: [{ name: "n", type: "numeric_attribute", numeric_attribute: { key: "k", min_value: 1, invert_match: true } }] } },
+      ]),
+    );
+    expect(diags.map((d) => d.message)).toEqual([
+      expect.stringContaining('policy "not-health" sets string_attribute.invert_match; inverted decisions are deprecated since collector-contrib v0.126.0'),
+      expect.stringContaining('policy "and" sets and.and_sub_policy[0].numeric_attribute.invert_match'),
+    ]);
+    expect(diags.every((d) => d.checkId === "OTEL119" && d.severity === "warning" && d.entity === "tail_sampling")).toBe(true);
+  });
+
+  test("passes invert_match: false and a drop policy", () => {
+    expect(
+      run(
+        otel119,
+        tailSampling([
+          { name: "a", type: "boolean_attribute", boolean_attribute: { key: "k", value: true, invert_match: false } },
+          { name: "drop-health", type: "drop", drop: { drop_sub_policy: [{ name: "h", type: "string_attribute", string_attribute: { key: "http.route", values: ["/health"] } }] } },
+        ]),
+      ),
+    ).toEqual([]);
+  });
+
+  test("reports service.telemetry.metrics.address and passes readers", () => {
+    const base = withExporters({ debug: {} });
+    const address = run(otel119, { ...base, service: { ...base.service, telemetry: { metrics: { address: "localhost:8889" } } } });
+    expect(address).toHaveLength(1);
+    expect(address[0].message).toContain("deprecated since collector v0.111.0");
+    const readers = { readers: [{ pull: { exporter: { prometheus: { host: "localhost", port: 8889 } } } }] };
+    expect(run(otel119, { ...base, service: { ...base.service, telemetry: { metrics: readers } } })).toEqual([]);
+  });
+
+  test("reports spanmetrics dimensions_cache_size", () => {
+    const config = {
+      receivers: { otlp: { protocols: { grpc: {} } } },
+      exporters: { debug: {} },
+      connectors: { "spanmetrics/a": { dimensions_cache_size: 1000 }, "spanmetrics/b": { aggregation_cardinality_limit: 1000 } },
+      service: {
+        pipelines: {
+          traces: { receivers: ["otlp"], exporters: ["spanmetrics/a", "spanmetrics/b"] },
+          metrics: { receivers: ["spanmetrics/a", "spanmetrics/b"], exporters: ["debug"] },
+        },
+      },
+    };
+    const diags = run(otel119, config);
+    expect(diags.map((d) => d.entity)).toEqual(["spanmetrics/a"]);
+    expect(diags[0].message).toContain("aggregation_cardinality_limit");
+  });
+});
+
+describe("OTEL120 literal credential in the config", () => {
+  test("reports a literal header, key and nested password, as an error", () => {
+    const diags = run(
+      otel120,
+      withExporters({
+        "otlphttp/vendor": { endpoint: "https://api.vendor.example", headers: { authorization: "Bearer abc123" } },
+        "splunk_hec/x": { endpoint: "https://splunk.example:8088", token: "00000000-0000" },
+      }),
+    );
+    expect(diags.map((d) => [d.entity, d.message.match(/at (\S+);/)?.[1]])).toEqual([
+      ["otlphttp/vendor", "headers.authorization"],
+      ["splunk_hec/x", "token"],
+    ]);
+    expect(diags[0]).toMatchObject({ checkId: "OTEL120", severity: "error" });
+  });
+
+  test("looks in every section and inside lists", () => {
+    const config = {
+      receivers: { prometheus: { config: { scrape_configs: [{ job_name: "x", basic_auth: { username: "u", password: "hunter2" } }] } } },
+      exporters: { debug: {} },
+      extensions: { bearertokenauth: { token: "literal" } },
+      service: { extensions: ["bearertokenauth"], pipelines: { metrics: { receivers: ["prometheus"], exporters: ["debug"] } } },
+    };
+    expect(run(otel120, config).map((d) => d.message.match(/at (\S+);/)?.[1])).toEqual(["config.scrape_configs.basic_auth.password", "token"]);
+  });
+
+  test("passes ${env:...} and ${file:...} references, _file keys, and empty values", () => {
+    expect(
+      run(
+        otel120,
+        withExporters({
+          "otlphttp/vendor": { endpoint: "https://api.vendor.example", headers: { authorization: "Bearer ${env:TOKEN}", "api-key": "${file:/secrets/key}" } },
+          "otlp/b": { endpoint: "backend:4317", tls: { ca_file: "/ca.pem", key_file: "/key.pem" }, headers: { "x-api-key": "" } },
+        }),
+      ),
+    ).toEqual([]);
+  });
+
+  test("WK8604's entry point reports it for a config in a ConfigMap", () => {
+    const config = withExporters({ "otlphttp/vendor": { endpoint: "https://api.vendor.example", headers: { "api-key": "abc" } } });
+    const configMap = { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "otel-config", namespace: "observability" }, data: { "config.yaml": dump(config) } };
+    const diags = collectorConfigDiagnostics(makePostSynthCtx("k8s", dump(configMap, { lineWidth: -1 })), { configMapsOnly: true }).filter((d) => d.checkId === "OTEL120");
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toMatch(/^ConfigMap observability\/otel-config, key config\.yaml: exporter "otlphttp\/vendor" has a literal credential at headers\.api-key/);
+  });
+});
+
+describe("OTEL121 credential over plaintext", () => {
+  test("reports an auth header over tls.insecure and an api key over http://", () => {
+    const diags = run(
+      otel121,
+      withExporters({
+        "otlp/gw": { endpoint: "gateway.observability.svc:4317", tls: { insecure: true }, headers: { authorization: "Bearer ${env:TOKEN}" } },
+        "otlphttp/v": { endpoint: "http://vendor.example:4318", headers: { "x-api-key": "${env:KEY}" } },
+      }),
+    );
+    expect(diags.map((d) => [d.entity, d.severity])).toEqual([
+      ["otlp/gw", "warning"],
+      ["otlphttp/v", "warning"],
+    ]);
+    expect(diags[0].message).toContain("sends headers.authorization to gateway.observability.svc:4317 over tls.insecure: true");
+    expect(diags[1].message).toContain("over an http:// endpoint");
+  });
+
+  test("passes TLS, a credential-free plaintext exporter, loopback, and https with tls.insecure", () => {
+    expect(
+      run(
+        otel121,
+        withExporters({
+          "otlp/tls": { endpoint: "backend:4317", headers: { authorization: "Bearer ${env:T}" } },
+          "otlp/plain": { endpoint: "tempo:4317", tls: { insecure: true } },
+          "otlphttp/local": { endpoint: "http://localhost:4318", headers: { authorization: "Bearer ${env:T}" } },
+          "otlphttp/https": { endpoint: "https://vendor.example", tls: { insecure: true }, headers: { authorization: "Bearer ${env:T}" } },
+        }),
+      ),
+    ).toEqual([]);
+  });
+});
+
+describe("OTEL122 zpages and pprof off loopback", () => {
+  const withExtensions = (extensions: Record<string, object>, enabled = Object.keys(extensions)) => ({
+    ...withExporters({ debug: {} }),
+    extensions,
+    service: { extensions: enabled, pipelines: { traces: { receivers: ["otlp"], processors: ["batch"], exporters: ["debug"] } } },
+  });
+
+  test("reports zpages on 0.0.0.0 and pprof on a pod IP", () => {
+    const diags = run(otel122, withExtensions({ zpages: { endpoint: "0.0.0.0:55679" }, "pprof/x": { endpoint: "${env:POD_IP}:1777" } }));
+    expect(diags.map((d) => [d.entity, d.severity])).toEqual([
+      ["zpages", "warning"],
+      ["pprof/x", "warning"],
+    ]);
+    expect(diags[0].message).toContain("listens on 0.0.0.0:55679");
+  });
+
+  test("passes the localhost defaults, 127.0.0.1, an extension that never starts, and health_check on 0.0.0.0", () => {
+    expect(
+      run(
+        otel122,
+        withExtensions(
+          { zpages: {}, pprof: { endpoint: "127.0.0.1:1777" }, "zpages/off": { endpoint: "0.0.0.0:55680" }, health_check: { endpoint: "0.0.0.0:13133" } },
+          ["zpages", "pprof", "health_check"],
+        ),
+      ),
+    ).toEqual([]);
+  });
+});
+
+describe("OTEL123 detailed debug beside a real exporter", () => {
+  test("reports debug at detailed in a pipeline that also sends to a backend", () => {
+    const diags = run(otel123, withExporters({ debug: { verbosity: "detailed" }, "otlp/b": { endpoint: "backend:4317" } }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ checkId: "OTEL123", severity: "warning", entity: "debug" });
+    expect(diags[0].message).toContain('exports to "otlp/b" and to "debug" at verbosity: detailed');
+  });
+
+  test("passes detailed debug on its own, and basic debug beside a backend", () => {
+    expect(run(otel123, withExporters({ debug: { verbosity: "detailed" } }))).toEqual([]);
+    expect(run(otel123, withExporters({ debug: { verbosity: "basic" }, "otlp/b": { endpoint: "backend:4317" } }))).toEqual([]);
+  });
+});
+
+describe("OTEL124 queue or retry off for a remote exporter", () => {
+  test("reports each one turned off", () => {
+    const diags = run(otel124, withExporters({ "otlp/b": { endpoint: "backend:4317", sending_queue: { enabled: false }, retry_on_failure: { enabled: false } } }));
+    expect(diags.map((d) => d.message)).toEqual([
+      expect.stringContaining("sending_queue.enabled: false"),
+      expect.stringContaining("retry_on_failure.enabled: false"),
+    ]);
+    expect(diags.every((d) => d.severity === "warning")).toBe(true);
+  });
+
+  test("passes a loopback endpoint, a prometheus exporter, and the defaults", () => {
+    expect(
+      run(
+        otel124,
+        withExporters({
+          "otlp/sidecar": { endpoint: "localhost:4317", sending_queue: { enabled: false } },
+          prometheus: { endpoint: "0.0.0.0:8889", sending_queue: { enabled: false } },
+          "otlp/b": { endpoint: "backend:4317", sending_queue: { enabled: true, queue_size: 5000 } },
+        }),
+      ),
+    ).toEqual([]);
+  });
+});
+
+describe("OTEL125 no batching before a remote otlp exporter", () => {
+  test("reports otlp and otlphttp in a pipeline with no batch processor", () => {
+    const diags = run(otel125, withExporters({ "otlp/b": { endpoint: "backend:4317" }, otlphttp: { endpoint: "${env:OTLP_ENDPOINT}" } }, { processors: [] }));
+    expect(diags.map((d) => [d.entity, d.severity])).toEqual([
+      ["otlp/b", "warning"],
+      ["otlphttp", "warning"],
+    ]);
+    expect(diags[0].message).toContain('pipeline "traces" sends to "otlp/b" (backend:4317) with no batch processor');
+  });
+
+  test("passes a batch processor, named or not, sending_queue.batch, loopback, and other exporters", () => {
+    expect(run(otel125, withExporters({ "otlp/b": { endpoint: "backend:4317" } }))).toEqual([]);
+    const named = withExporters({ "otlp/b": { endpoint: "backend:4317" } }, { processors: ["batch/big"] });
+    expect(run(otel125, { ...named, processors: { "batch/big": {} } })).toEqual([]);
+    expect(
+      run(
+        otel125,
+        withExporters(
+          {
+            "otlp/q": { endpoint: "backend:4317", sending_queue: { batch: { flush_timeout: "1s" } } },
+            "otlp/local": { endpoint: "127.0.0.1:4317" },
+            "splunk_hec/x": { endpoint: "https://splunk.example:8088" },
+          },
+          { processors: [] },
+        ),
+      ),
+    ).toEqual([]);
+  });
+});
+
+describe("OTEL126 k8sattributes metadata fields", () => {
+  const k8s = (metadata: string[]) => ({
+    ...withExporters({ debug: {} }),
+    processors: { k8sattributes: { extract: { metadata } } },
+    service: { pipelines: { traces: { receivers: ["otlp"], processors: ["k8sattributes"], exporters: ["debug"] } } },
+  });
+
+  test("reports a field k8sattributes can't extract, as an error", () => {
+    const diags = run(otel126, k8s(["k8s.pod.name", "k8s.pod.labels", "k8s.namespace.uid"]));
+    expect(diags.map((d) => d.message.match(/extracts "([^"]+)"/)?.[1])).toEqual(["k8s.pod.labels", "k8s.namespace.uid"]);
+    expect(diags[0]).toMatchObject({ checkId: "OTEL126", severity: "error", entity: "k8sattributes" });
+  });
+
+  test("passes every supported field", async () => {
+    const { K8S_ATTRIBUTES_METADATA } = await import("../../config-hygiene");
+    expect(run(otel126, k8s([...K8S_ATTRIBUTES_METADATA]))).toEqual([]);
+  });
+});
+
+describe("OTEL127 resourcedetection detectors", () => {
+  const rd = (detectors: string[], started = true) => ({
+    ...withExporters({ debug: {} }),
+    processors: { resourcedetection: { detectors } },
+    service: { pipelines: { traces: { receivers: ["otlp"], processors: started ? ["resourcedetection"] : [], exporters: ["debug"] } } },
+  });
+
+  test("reports an unknown detector, with a hint for elasticbeanstalk", () => {
+    const diags = run(otel127, rd(["env", "elasticbeanstalk", "k8s"]));
+    expect(diags.map((d) => d.message.match(/detector "([^"]+)"/)?.[1])).toEqual(["elasticbeanstalk", "k8s"]);
+    expect(diags[0].message).toContain('(the detector is "elastic_beanstalk")');
+    expect(diags[0]).toMatchObject({ checkId: "OTEL127", severity: "error" });
+  });
+
+  test("passes every registered detector, an ${env:...} entry, and a processor nothing starts", async () => {
+    const { RESOURCE_DETECTORS } = await import("../../config-hygiene");
+    expect(run(otel127, rd([...RESOURCE_DETECTORS, "${env:DETECTORS}"]))).toEqual([]);
+    expect(run(otel127, rd(["nope"], false))).toEqual([]);
+  });
+});
+
+// The issue's acceptance bar: what chant itself produces reports none of these.
+// The init templates and examples are covered by init-templates.test.ts and
+// examples/examples.test.ts, which require every check to pass.
+describe("OTEL119-OTEL127 on chant's own collector configs", () => {
+  const backend = () => new OtlpExporter({ name: "backend", endpoint: "tempo:4317", tls: { insecure: true } });
+  const configs: Array<[string, () => Declarable[]]> = [
+    ["otlpCollector()", () => otlpCollector()],
+    ["otlpCollector() to an otlp backend", () => otlpCollector({ exporters: [backend()] })],
+    ["genAiPipeline()", () => genAiPipeline()],
+    [
+      "genAiPipeline() to otlp backends",
+      () => genAiPipeline({ traceExporters: [backend()], metricExporters: [new OtlpHttpExporter({ name: "metrics", endpoint: "https://metrics.example" })], logExporters: [backend()] }),
+    ],
+    ["NodeAgent", () => Object.values(NodeAgent({ exporters: [backend()], metricExporters: [new PrometheusExporter({ endpoint: "0.0.0.0:8889" })], clusterName: "c" }).members) as Declarable[]],
+  ];
+
+  test.each(configs)("%s reports none", (_name, entities) => {
+    const config = load(collectorYaml(entities())) as CollectorConfig;
+    expect(validateCollectorConfig(config).filter((i) => HYGIENE.includes(i.code))).toEqual([]);
+  });
+});