@intentius/chant-lexicon-otel 0.102.0 → 0.104.1

package/src/lint/post-synth/index.ts

@@ -15,6 +15,16 @@ import { otel114 } from "./otel114";
 import { otel115 } from "./otel115";
 import { otel116 } from "./otel116";
 import { otel117 } from "./otel117";
+import { otel118 } from "./otel118";
+import { otel119 } from "./otel119";
+import { otel120 } from "./otel120";
+import { otel121 } from "./otel121";
+import { otel122 } from "./otel122";
+import { otel123 } from "./otel123";
+import { otel124 } from "./otel124";
+import { otel125 } from "./otel125";
+import { otel126 } from "./otel126";
+import { otel127 } from "./otel127";
 
 export const postSynthChecks: PostSynthCheck[] = [
   otel101,
@@ -32,4 +42,14 @@ export const postSynthChecks: PostSynthCheck[] = [
   otel115,
   otel116,
   otel117,
+  otel118,
+  otel119,
+  otel120,
+  otel121,
+  otel122,
+  otel123,
+  otel124,
+  otel125,
+  otel126,
+  otel127,
 ];

package/src/lint/post-synth/otel-helpers.ts

@@ -10,6 +10,7 @@ import type { Declarable } from "@intentius/chant/declarable";
 import { looksLikeCollectorConfig, type CollectorConfig } from "../../model";
 import { configMapCollectorConfigs, describeConfigMapConfig } from "../../configmap";
 import { validateCollectorConfig, validateCollectorEntities, type CollectorIssueCode, type CollectorIssue } from "../../validate-config";
+import { attributionIssues } from "../../attribution";
 
 /** Where a collector config was found in the build output. */
 export interface FoundCollectorConfig {
@@ -74,20 +75,30 @@ function toDiagnostic(issue: CollectorIssue, found?: Omit<FoundCollectorConfig,
 }
 
 /**
- * Every config-level diagnostic (OTEL101-OTEL106, OTEL112-OTEL117 and any later
+ * The config-level issues for one config. OTEL118 joins them only when the
+ * build stamps the telemetry attribution (`ctx.telemetry`), so a level-0
+ * project never sees it.
+ */
+function configIssues(ctx: PostSynthContext, config: CollectorConfig): CollectorIssue[] {
+  const issues = validateCollectorConfig(config);
+  return ctx.telemetry ? [...issues, ...attributionIssues(config)] : issues;
+}
+
+/**
+ * Every config-level diagnostic (OTEL101-OTEL106, OTEL112-OTEL127 and any later
  * config check) over the collector configs in the output. `configMapsOnly`
  * keeps the configs held in ConfigMaps, which is what WK8604 reads.
  */
 export function collectorConfigDiagnostics(ctx: PostSynthContext, opts: { configMapsOnly?: boolean } = {}): PostSynthDiagnostic[] {
   return collectorConfigs(ctx)
     .filter((found) => !opts.configMapsOnly || found.configMap)
-    .flatMap(({ config, ...found }) => validateCollectorConfig(config).map((i) => toDiagnostic(i, found)));
+    .flatMap(({ config, ...found }) => configIssues(ctx, config).map((i) => toDiagnostic(i, found)));
 }
 
-/** Diagnostics for one config-level code (OTEL101-OTEL106, OTEL112-OTEL117) across every collector config in the output. */
+/** Diagnostics for one config-level code (OTEL101-OTEL106, OTEL112-OTEL127) across every collector config in the output. */
 export function configDiagnostics(ctx: PostSynthContext, code: CollectorIssueCode): PostSynthDiagnostic[] {
   return collectorConfigs(ctx).flatMap(({ config, ...found }) =>
-    validateCollectorConfig(config)
+    configIssues(ctx, config)
       .filter((i) => i.code === code)
       .map((i) => toDiagnostic(i, found)),
   );

package/src/lint/post-synth/otel118.test.ts

@@ -0,0 +1,308 @@
+import { describe, expect, test } from "vitest";
+import { dump } from "js-yaml";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import type { TelemetryAttribution } from "@intentius/chant/telemetry-attribution";
+import { otel118 } from "./otel118";
+import { collectorConfigDiagnostics } from "./otel-helpers";
+import { isProtectedResourceAttribute, PROTECTED_RESOURCE_ATTRIBUTES } from "../../attribution";
+import type { Declarable } from "@intentius/chant/declarable";
+import { NodeAgent } from "../../composites";
+import { OtlpExporter } from "../../components/exporters";
+import { collectorYaml } from "../../collector";
+import { genAiPipeline } from "../../genai";
+
+/** A collector with one processor in a traces pipeline. */
+function withProcessor(id: string, body: unknown): Record<string, unknown> {
+  return {
+    receivers: { otlp: { protocols: { grpc: {} } } },
+    processors: { [id]: body },
+    exporters: { debug: {} },
+    service: { pipelines: { traces: { receivers: ["otlp"], processors: [id], exporters: ["debug"] } } },
+  };
+}
+
+function ctxOf(config: unknown, telemetry: TelemetryAttribution | null = { workspace: "acme" }, lexicon = "otel"): PostSynthContext {
+  const ctx = makePostSynthCtx(lexicon, dump(config, { lineWidth: -1 }));
+  return telemetry ? { ...ctx, telemetry } : ctx;
+}
+
+const run = (config: unknown, telemetry?: TelemetryAttribution | null) => otel118.check(ctxOf(config, telemetry));
+const messages = (config: unknown) => run(config).map((d) => d.message);
+
+describe("OTEL118 protected keys", () => {
+  test("come from TELEMETRY_ATTRIBUTES, plus any chant.* key", () => {
+    expect(PROTECTED_RESOURCE_ATTRIBUTES).toEqual([
+      "service.name",
+      "service.version",
+      "deployment.environment.name",
+      "vcs.ref.head.revision",
+      "chant.workspace",
+      "chant.member",
+      "chant.decl",
+    ]);
+    expect(isProtectedResourceAttribute("chant.team")).toBe(true);
+    expect(isProtectedResourceAttribute("service.namespace")).toBe(false);
+    expect(isProtectedResourceAttribute("chantx")).toBe(false);
+  });
+});
+
+describe("OTEL118 gate", () => {
+  const upsert = withProcessor("resource", { attributes: [{ key: "service.name", value: "x", action: "upsert" }] });
+
+  test("a build outside a workspace without telemetry.attribution gets no diagnostics", () => {
+    expect(otel118.check(ctxOf(upsert, null))).toEqual([]);
+    expect(collectorConfigDiagnostics(ctxOf(upsert, null))).toEqual([]);
+  });
+
+  test("a build with telemetry.attribution: true outside a workspace is checked", () => {
+    expect(run(upsert, {})).toHaveLength(1);
+  });
+
+  test("reports a warning naming the processor and its pipelines", () => {
+    const [d] = run(upsert);
+    expect(d).toMatchObject({ checkId: "OTEL118", severity: "warning", entity: "resource", lexicon: "otel" });
+    expect(d.message).toMatch(/^processor "resource" \(pipelines traces\): its upsert action replaces "service\.name"\. /);
+  });
+
+  test("a processor no pipeline lists is not checked", () => {
+    const config = { ...upsert, service: { pipelines: { traces: { receivers: ["otlp"], exporters: ["debug"] } } } };
+    expect(run(config)).toEqual([]);
+  });
+
+  test("WK8604's entry point reports it for a config in a ConfigMap", () => {
+    const configMap = { apiVersion: "v1", kind: "ConfigMap", metadata: { name: "otel-agent-config", namespace: "observability" }, data: { "config.yaml": dump(upsert) } };
+    const diags = collectorConfigDiagnostics(ctxOf(configMap, { workspace: "acme" }, "k8s"), { configMapsOnly: true }).filter((d) => d.checkId === "OTEL118");
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toMatch(/^ConfigMap observability\/otel-agent-config, key config\.yaml: processor "resource"/);
+    expect(collectorConfigDiagnostics(ctxOf(configMap, null, "k8s"), { configMapsOnly: true })).toEqual([]);
+  });
+});
+
+describe("OTEL118 resource processor", () => {
+  test.each(["delete", "update", "upsert", "hash"])("%s on a protected key is reported", (action) => {
+    expect(messages(withProcessor("resource/x", { attributes: [{ key: "deployment.environment.name", value: "prod", action }] }))).toHaveLength(1);
+  });
+
+  test("a chant.* key is protected", () => {
+    expect(messages(withProcessor("resource", { attributes: [{ key: "chant.team", action: "delete" }] }))[0]).toContain('its delete action removes "chant.team"');
+  });
+
+  test("a delete pattern that matches a protected key is reported", () => {
+    expect(messages(withProcessor("resource", { attributes: [{ pattern: "^chant\\..*", action: "delete" }] }))[0]).toContain(
+      'pattern "^chant\\..*" matches "chant.workspace", "chant.member", "chant.decl"',
+    );
+  });
+
+  test("insert, extract and unrelated keys pass", () => {
+    expect(
+      run(
+        withProcessor("resource", {
+          attributes: [
+            { key: "service.name", value: "x", action: "insert" },
+            { key: "service.name", pattern: "^(?P<svc>.*)$", action: "extract" },
+            { key: "k8s.cluster.name", value: "prod", action: "upsert" },
+            { key: "service.namespace", action: "delete" },
+            { pattern: "^k8s\\.", action: "delete" },
+          ],
+        }),
+      ),
+    ).toEqual([]);
+  });
+});
+
+describe("OTEL118 transform processor", () => {
+  const transform = (trace_statements: unknown[]) => withProcessor("transform/attrs", { trace_statements });
+
+  test("set on a protected key in the resource context, and on resource.attributes from another", () => {
+    const msgs = messages(
+      transform([
+        { context: "resource", statements: ['set(attributes["service.version"], "1")'] },
+        { context: "span", statements: ['set(resource.attributes["vcs.ref.head.revision"], "abc")'] },
+      ]),
+    );
+    expect(msgs).toHaveLength(2);
+    expect(msgs[0]).toContain('the OTTL text `set(attributes["service.version"], "1")` matches a call where set replaces "service.version"');
+    expect(msgs[1]).toContain('set replaces "vcs.ref.head.revision"');
+  });
+
+  test("delete_key and delete_matching_keys", () => {
+    const msgs = messages(
+      transform([
+        'delete_key(resource.attributes, "chant.decl")',
+        { context: "resource", statements: ['delete_matching_keys(attributes, "^service\\\\..*")'] },
+      ]),
+    );
+    expect(msgs).toHaveLength(2);
+    expect(msgs[0]).toContain('delete_key removes "chant.decl"');
+    expect(msgs[1]).toContain('removes "service.name", "service.version"');
+  });
+
+  test("keep_keys and keep_matching_keys that leave a protected key out", () => {
+    const msgs = messages(
+      transform([
+        { context: "resource", statements: ['keep_keys(attributes, ["service.name", "k8s.pod.name"])'] },
+        'keep_matching_keys(resource.attributes, "^(service|deployment)\\\\.")',
+      ]),
+    );
+    expect(msgs).toHaveLength(2);
+    expect(msgs[0]).toContain('keep_keys drops "service.version", "deployment.environment.name", "vcs.ref.head.revision", "chant.workspace", "chant.member", "chant.decl"');
+    expect(msgs[1]).toContain('drops "vcs.ref.head.revision", "chant.workspace", "chant.member", "chant.decl"');
+  });
+
+  test("keep_keys that keeps every protected key passes", () => {
+    const keep = `keep_keys(resource.attributes, [${PROTECTED_RESOURCE_ATTRIBUTES.map((k) => `"${k}"`).join(", ")}])`;
+    expect(run(transform([keep]))).toEqual([]);
+  });
+
+  test("span attributes, unrelated keys and other functions pass", () => {
+    expect(
+      run(
+        transform([
+          'set(attributes["service.name"], "x")',
+          { context: "span", statements: ['delete_key(attributes, "service.name")', 'set(attributes["chant.decl"], "x")'] },
+          { context: "resource", statements: ['set(attributes["k8s.cluster.name"], "prod")', 'delete_key(attributes, "host.name")', 'replace_pattern(attributes["service.name"], "a", "b")'] },
+        ]),
+      ),
+    ).toEqual([]);
+  });
+});
+
+describe("OTEL118 resourcedetection processor", () => {
+  test("override defaults to true, and detectors to [env], at contrib v0.130.0", () => {
+    expect(messages(withProcessor("resourcedetection", {}))[0]).toContain("with override on by default, the env detector writes any key in the collector's own OTEL_RESOURCE_ATTRIBUTES");
+    expect(messages(withProcessor("resourcedetection", { detectors: ["env", "system"] }))).toHaveLength(1);
+  });
+
+  test("override: true with a detector that writes a protected key", () => {
+    const msgs = messages(withProcessor("resourcedetection", { detectors: ["env", "heroku", "elastic_beanstalk", "gcp"], override: true }));
+    expect(msgs).toHaveLength(3);
+    expect(msgs[1]).toContain('with override: true, the heroku detector writes "service.name" and "service.version"');
+  });
+
+  test("the renamed type resource_detection is read as resourcedetection", () => {
+    expect(messages(withProcessor("resource_detection/env", { detectors: ["env"] }))[0]).toMatch(/^processor "resource_detection\/env" .*the env detector/);
+  });
+
+  test("override: false, or detectors that write no protected key, pass", () => {
+    expect(run(withProcessor("resourcedetection", { detectors: ["env"], override: false }))).toEqual([]);
+    expect(run(withProcessor("resourcedetection", { detectors: ["system", "gcp", "k8snode"] }))).toEqual([]);
+  });
+});
+
+describe("OTEL118 groupbyattrs processor", () => {
+  test("a protected key in keys is reported; other keys pass", () => {
+    expect(messages(withProcessor("groupbyattrs", { keys: ["host.name", "service.name"] }))[0]).toContain(
+      'it groups by "service.name", so a record attribute with that key is copied over the resource\'s value',
+    );
+    expect(run(withProcessor("groupbyattrs", { keys: ["host.name"] }))).toEqual([]);
+  });
+});
+
+describe("OTEL118 redaction processor", () => {
+  test("allow_all_keys off, its default, deletes protected keys not allowed or ignored", () => {
+    const msgs = messages(withProcessor("redaction", { allowed_keys: ["service.name", "service.version"], ignored_keys: ["chant.decl"] }));
+    expect(msgs).toHaveLength(1);
+    expect(msgs[0]).toContain(
+      'with allow_all_keys off by default, it deletes resource keys missing from allowed_keys and ignored_keys: "deployment.environment.name", "vcs.ref.head.revision", "chant.workspace", "chant.member"',
+    );
+  });
+
+  test("a blocked key pattern matching a protected key masks it unless ignored", () => {
+    const msgs = messages(withProcessor("redaction", { allow_all_keys: true, blocked_key_patterns: ["^service\\."], ignored_keys: ["service.version"] }));
+    expect(msgs).toEqual([expect.stringContaining('its blocked_key_patterns entry "^service\\." masks the value of "service.name"')]);
+  });
+
+  test("allow_all_keys with unrelated patterns passes", () => {
+    expect(run(withProcessor("redaction", { allow_all_keys: true, blocked_key_patterns: ["^gen_ai\\.input"], blocked_values: ["\\d{16}"] }))).toEqual([]);
+  });
+});
+
+describe("OTEL118 sumologic processor", () => {
+  test("translate_attributes is on by default and renames service.name", () => {
+    expect(messages(withProcessor("sumologic", {}))[0]).toContain('translate_attributes (on by default) renames "service.name" to "service"');
+    expect(run(withProcessor("sumologic", { translate_attributes: false }))).toEqual([]);
+  });
+
+  test("nest_attributes and aggregate_attributes over protected keys", () => {
+    const msgs = messages(
+      withProcessor("sumologic", {
+        translate_attributes: false,
+        nest_attributes: { enabled: true, include: ["chant."], exclude: ["chant.decl"] },
+        aggregate_attributes: [{ attribute: "svc", prefixes: ["service."] }, { attribute: "k8s", prefixes: ["k8s.pod."] }],
+      }),
+    );
+    expect(msgs).toHaveLength(2);
+    expect(msgs[0]).toContain('nest_attributes turns "chant.workspace", "chant.member" into nested maps');
+    expect(msgs[1]).toContain('move "service.name", "service.version"');
+  });
+});
+
+describe("OTEL118 schema processor", () => {
+  test("a target below 1.29.0 reverts vcs.ref.head.revision, below 1.27.0 deployment.environment.name too", () => {
+    expect(messages(withProcessor("schema", { targets: ["https://opentelemetry.io/schemas/1.28.0"] }))).toEqual([
+      expect.stringContaining('renames "vcs.ref.head.revision" back to "vcs.repository.ref.revision"'),
+    ]);
+    expect(messages(withProcessor("schema", { targets: ["https://opentelemetry.io/schemas/1.26.0"] }))).toHaveLength(2);
+  });
+
+  test("a target at 1.29.0 or later, or another family, passes", () => {
+    expect(run(withProcessor("schema", { targets: ["https://opentelemetry.io/schemas/1.29.0", "https://example.com/schemas/1.0.0"] }))).toEqual([]);
+  });
+});
+
+describe("OTEL118 metricstransform processor", () => {
+  test("group_resource_labels setting a protected key is reported", () => {
+    const transforms = [
+      { include: "^x", match_type: "regexp", action: "group", group_resource_labels: { "deployment.environment.name": "prod", team: "a" } },
+      { include: "y", action: "update", new_name: "z" },
+    ];
+    expect(messages(withProcessor("metricstransform", { transforms }))[0]).toContain('group_resource_labels sets "deployment.environment.name"');
+    expect(run(withProcessor("metricstransform", { transforms: [{ include: "^x", action: "group", group_resource_labels: { team: "a" } }] }))).toEqual([]);
+  });
+});
+
+describe("OTEL118 logstransform processor", () => {
+  test("operators on protected resource fields, a narrowing retain, and parse_to: resource", () => {
+    const msgs = messages(
+      withProcessor("logstransform", {
+        operators: [
+          { type: "remove", field: 'resource["chant.member"]' },
+          { type: "move", from: 'attributes["svc"]', to: 'resource["service.name"]' },
+          { type: "retain", fields: ['resource["service.name"]'] },
+          { type: "json_parser", parse_to: "resource" },
+        ],
+      }),
+    );
+    expect(msgs).toHaveLength(4);
+    expect(msgs[0]).toContain('its remove operator writes or removes "chant.member"');
+    expect(msgs[2]).toContain("its retain operator keeps only the resource fields it lists");
+  });
+
+  test("operators on other fields pass", () => {
+    const operators = [
+      { type: "add", field: 'resource["team"]', value: "a" },
+      { type: "retain", fields: ['attributes["x"]'] },
+      { type: "json_parser", parse_to: "attributes" },
+    ];
+    expect(run(withProcessor("logstransform", { operators }))).toEqual([]);
+  });
+});
+
+describe("OTEL118 processors that don't replace resource keys", () => {
+  test("attributes acts on span, log and metric attributes", () => {
+    expect(run(withProcessor("attributes", { actions: [{ key: "service.name", action: "delete" }] }))).toEqual([]);
+  });
+
+  test("k8sattributes only fills service.name and service.version where they are absent", () => {
+    expect(run(withProcessor("k8sattributes", { extract: { metadata: ["service.name", "service.version"], otel_annotations: true } }))).toEqual([]);
+  });
+
+  test("NodeAgent, with every option on, and genAiPipeline report nothing", () => {
+    const gateway = new OtlpExporter({ name: "gateway", endpoint: "gw:4317", tls: { insecure: true } });
+    const agent = NodeAgent({ exporters: [gateway], clusterName: "prod", kubeletStats: true });
+    for (const yaml of [collectorYaml(Object.values(agent.members) as Declarable[]), collectorYaml(genAiPipeline())]) {
+      expect(otel118.check({ ...makePostSynthCtx("otel", yaml), telemetry: { workspace: "acme" } })).toEqual([]);
+    }
+  });
+});

package/src/lint/post-synth/otel118.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL118: A pipeline processor can remove or replace a resource attribute chant's telemetry attribution stamps
+ *
+ * A workload built in a workspace, or with `telemetry.attribution: true`, carries `service.name`, `service.version`, `deployment.environment.name`, `vcs.ref.head.revision` and `chant.*` resource attributes. A `resource` processor that deletes, updates, upserts or hashes one, a `transform` statement that sets, deletes or fails to keep one, or a `resourcedetection` processor with `override` on and a detector that writes one undoes that. The `transform` case matches OTTL text. The check runs only when the build stamps the attribution, so a level-0 project sees nothing.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel118: PostSynthCheck = {
+  id: "OTEL118",
+  description: "A pipeline processor can remove or replace a resource attribute chant's telemetry attribution stamps",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL118");
+  },
+};

package/src/lint/post-synth/otel119.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL119: A collector config sets a field deprecated at or before the pinned release
+ *
+ * `invert_match: true` in a `tail_sampling` policy (inverted decisions are deprecated in collector-contrib v0.126.0 for a `drop` policy), `service.telemetry.metrics.address` (deprecated in collector v0.111.0 for `readers`), and `dimensions_cache_size` on `spanmetrics` (deprecated in collector-contrib v0.125.0 for `aggregation_cardinality_limit`). The collector still reads each at v0.130.0, and a later release drops it.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel119: PostSynthCheck = {
+  id: "OTEL119",
+  description: "A collector config sets a field deprecated at or before the pinned release",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL119");
+  },
+};

package/src/lint/post-synth/otel120.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL120: A component in the collector config holds a literal credential
+ *
+ * OTEL002's check over the emitted or imported config, with the same key pattern (`authorization`, `api-key`, `api_key`, `token`, `password`, `secret`, `key_pem`, `x-honeycomb-team`). A value containing `${` is a reference the collector expands at start-up, and a key ending in `_file` names a path. This catches what OTEL002 can't see: a config brought in by `chant import`, or one inside a ConfigMap.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel120: PostSynthCheck = {
+  id: "OTEL120",
+  description: "A component in the collector config holds a literal credential",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL120");
+  },
+};

package/src/lint/post-synth/otel121.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL121: An exporter sends a credential over plaintext
+ *
+ * A started exporter sends a credential header (`authorization`, `api-key` and the other OTEL002 keys) or a credential key such as `api_key` or `token` to a non-loopback endpoint that is `http://`, or that has `tls.insecure: true` and isn't `https://`.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel121: PostSynthCheck = {
+  id: "OTEL121",
+  description: "An exporter sends a credential over plaintext",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL121");
+  },
+};

package/src/lint/post-synth/otel122.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL122: zpages or pprof listens on a non-loopback address
+ *
+ * zpages serves span samples and pipeline internals, and pprof serves profiles, with no authentication. A started one bound to anything but loopback (`0.0.0.0`, a pod IP, an `${env:...}` host) is reachable by whoever reaches that address. `health_check` is not reported: it serves only a status, and a kubelet probe needs it on the pod IP.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel122: PostSynthCheck = {
+  id: "OTEL122",
+  description: "zpages or pprof listens on a non-loopback address",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL122");
+  },
+};

package/src/lint/post-synth/otel123.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL123: A debug exporter at verbosity detailed shares a pipeline with a real exporter
+ *
+ * `verbosity: detailed` writes every record, attributes and bodies included, to the collector's log. In a pipeline that also sends to a backend, that copies the backend's data, sensitive values included, to wherever the collector's logs go.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel123: PostSynthCheck = {
+  id: "OTEL123",
+  description: "A debug exporter at verbosity detailed shares a pipeline with a real exporter",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL123");
+  },
+};

package/src/lint/post-synth/otel124.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL124: A remote exporter has its sending queue or retries turned off
+ *
+ * A started exporter with a non-loopback endpoint and `sending_queue.enabled: false` blocks the pipeline when the backend is slow; with `retry_on_failure.enabled: false` it drops a failed request's data.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel124: PostSynthCheck = {
+  id: "OTEL124",
+  description: "A remote exporter has its sending queue or retries turned off",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL124");
+  },
+};

package/src/lint/post-synth/otel125.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL125: A pipeline sends to a remote otlp or otlphttp exporter without batching
+ *
+ * No `batch` processor in the pipeline, and the `otlp` or `otlphttp` exporter (non-loopback endpoint) sets no `sending_queue.batch`. At v0.130.0 neither exporter batches by default, so each small request goes out on its own. Other exporters may batch themselves and are not checked.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel125: PostSynthCheck = {
+  id: "OTEL125",
+  description: "A pipeline sends to a remote otlp or otlphttp exporter without batching",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL125");
+  },
+};

package/src/lint/post-synth/otel126.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL126: k8sattributes extracts a metadata field it does not support
+ *
+ * Each name in a `k8sattributes` processor's `extract.metadata` must be one `Config.Validate` accepts at collector-contrib v0.130.0 (`K8S_ATTRIBUTES_METADATA`); the collector refuses any other.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel126: PostSynthCheck = {
+  id: "OTEL126",
+  description: "k8sattributes extracts a metadata field it does not support",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL126");
+  },
+};

package/src/lint/post-synth/otel127.ts

@@ -0,0 +1,17 @@
+/**
+ * OTEL127: resourcedetection lists a detector that does not exist
+ *
+ * Each name in a started `resourcedetection` processor's `detectors` must be one the processor registers at collector-contrib v0.130.0 (`RESOURCE_DETECTORS`); any other fails the processor's build and the collector exits.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { configDiagnostics } from "./otel-helpers";
+
+export const otel127: PostSynthCheck = {
+  id: "OTEL127",
+  description: "resourcedetection lists a detector that does not exist",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return configDiagnostics(ctx, "OTEL127");
+  },
+};

package/src/lint/post-synth/post-synth.test.ts

@@ -275,6 +275,13 @@ describe("OTEL116 high-cardinality GenAI attributes as metric attributes", () =>
   ];
   const run = (config: object, lexicon = "otel") => otel116.check(makePostSynthCtx(lexicon, dump(config, { lineWidth: -1 })));
 
+  test("reads span_metrics, service_graph and signal_to_metrics, the collector's newer names, as the built-ins", () => {
+    const rename = (s: string) => s.replace(/spanmetrics/g, "span_metrics").replace(/servicegraph/g, "service_graph").replace(/signaltometrics/g, "signal_to_metrics");
+    const key = GENAI_HIGH_CARDINALITY_ATTRIBUTES[0];
+    const config = JSON.parse(rename(JSON.stringify(connectorsSplitBy(key))));
+    expect(run(config).map((d) => [d.entity, d.message.match(/\((.+)\);/)?.[1]])).toEqual(FIELDS.map(([id, field]) => [rename(id), field]));
+  });
+
   test.each(GENAI_HIGH_CARDINALITY_ATTRIBUTES.map((k) => [k]))("reports %s in every connector field", (key) => {
     const diags = run(connectorsSplitBy(key));
     expect(diags.map((d) => [d.entity, d.message.match(/\((.+)\);/)?.[1]])).toEqual(FIELDS);
@@ -349,6 +356,17 @@ describe("OTEL117 two started components on one address", () => {
     ]);
   });
 
+  test("knows the contrib push receivers' defaults: carbon and wavefront both take localhost:2003 (#3122)", () => {
+    const diags = run({
+      receivers: { carbon: {}, wavefront: {}, "carbon/udp": { transport: "udp" } },
+      exporters: { debug: {} },
+      service: { pipelines: { metrics: { receivers: ["carbon", "wavefront", "carbon/udp"], exporters: ["debug"] } } },
+    });
+    expect(diags.map((d) => d.message)).toEqual([
+      expect.stringMatching(/^receiver "carbon" \(endpoint\) listens on localhost:2003 and receiver "wavefront" \(endpoint\) on localhost:2003/),
+    ]);
+  });
+
   test("a wildcard host overlaps a specific host on the same port, and an extension counts", () => {
     const diags = run({
       receivers: { zipkin: { endpoint: "127.0.0.1:13133" } },

package/src/lint/rules/literal-credential.ts

@@ -1,9 +1,8 @@
 import * as ts from "typescript";
 import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
 import { calleeName, COMPONENT_CLASS, literalText, position, propertyName } from "./otel-ast";
-
-/** Keys whose value is a credential. `*_file` keys name a path, which is fine. */
-const SECRET_KEY = /(authorization|api[-_]?key|password|passwd|secret|token|key_pem|x-honeycomb-team)/i;
+// Shared with OTEL120, which applies the same check to the emitted YAML.
+import { SECRET_KEY } from "../../config-hygiene";
 
 /**
  * OTEL002: a credential written as a literal in a component's config.