@intentius/chant-lexicon-prometheus 0.101.0 → 0.104.0

package/src/lint/audit-lineage.test.ts

@@ -0,0 +1,74 @@
+import { describe, test, expect } from "vitest";
+import { prometheusAuditCatalog } from "./audit-catalog";
+
+describe("prometheus audit lineage (#2916, #3136)", () => {
+  const credits = (id: string) => (prometheusAuditCatalog[id].lineage ?? []).map((l) => `${l.tool}:${l.rule ?? ""}:${l.relation}`);
+
+  test("credits promtool where rulefmt rejects the same file", () => {
+    for (const id of ["PROM101", "PROM103", "PROM104", "PROM105"]) {
+      expect(credits(id), id).toContain("promtool::equivalent");
+    }
+    expect(credits("PROM002")).toContain("promtool::equivalent");
+  });
+
+  test("credits pint's named checks", () => {
+    expect(credits("PROM002")).toEqual(["promtool::equivalent", "pint:promql/syntax:equivalent"]);
+    expect(credits("PROM102")).toEqual(["pint:rule/duplicate:overlaps"]);
+    expect(credits("PROM103")).toEqual(["promtool::equivalent", "pint:alerts/for:overlaps"]);
+    expect(credits("PROM104")).toEqual(["promtool::equivalent", "pint:promql/syntax:equivalent"]);
+    expect(credits("PROM106")).toEqual(["pint:rule/label:overlaps"]);
+    expect(credits("PROM107")).toEqual(["pint:alerts/annotation:overlaps"]);
+    expect(credits("PROM211")).toEqual(["pint:rule/for:overlaps"]);
+    expect(credits("PROM212")).toEqual(["pint:alerts/annotation:overlaps"]);
+    expect(credits("PROM213")).toEqual(["pint:alerts/comparison:equivalent"]);
+    expect(credits("PROM214")).toEqual(["pint:alerts/template:overlaps"]);
+    expect(credits("PROM215")).toEqual(["pint:promql/rate:overlaps"]);
+    expect(credits("PROM217")).toEqual(["pint:rule/name:overlaps"]);
+    expect(credits("PROM218")).toEqual(["pint:promql/regexp:equivalent"]);
+  });
+
+  test("credits amtool check-config where Alertmanager rejects the same config", () => {
+    for (const id of ["PROM201", "PROM203", "PROM204", "PROM205", "PROM206", "PROM208"]) {
+      expect(credits(id), id).toEqual(["amtool::equivalent"]);
+    }
+    expect(credits("PROM209")).toEqual(["amtool::overlaps"]);
+    expect(credits("PROM210")).toEqual(["amtool::overlaps"]);
+  });
+
+  test("rules no upstream tool checks carry no credit", () => {
+    for (const id of ["PROM001", "PROM003", "PROM202", "PROM207", "PROM216", "PROM219", "PROM220", "PROM221", "PROM222", "PROM223", "PROM224", "PROM301"]) {
+      expect(prometheusAuditCatalog[id].lineage, id).toBeUndefined();
+    }
+  });
+
+  test("every rule is either credited above or deliberately left uncredited", () => {
+    const credited = Object.keys(prometheusAuditCatalog).filter((id) => prometheusAuditCatalog[id].lineage !== undefined);
+    expect(credited.sort()).toEqual(
+      [
+        "PROM002",
+        "PROM101",
+        "PROM102",
+        "PROM103",
+        "PROM104",
+        "PROM105",
+        "PROM106",
+        "PROM107",
+        "PROM201",
+        "PROM203",
+        "PROM204",
+        "PROM205",
+        "PROM206",
+        "PROM208",
+        "PROM209",
+        "PROM210",
+        "PROM211",
+        "PROM212",
+        "PROM213",
+        "PROM214",
+        "PROM215",
+        "PROM217",
+        "PROM218",
+      ].sort(),
+    );
+  });
+});

package/src/lint/audit-lineage.ts

@@ -0,0 +1,97 @@
+/**
+ * Prior art for the prometheus lexicon's audit rules: the tools whose checks
+ * cover the same condition, credited per rule. See
+ * packages/core/src/audit/prior-art.ts for the registry, the relation
+ * vocabulary, and why this is credit rather than authority. Kept by hand.
+ *
+ * Mapped against each tool's own check list (#2916):
+ *
+ * - promtool check rules parses a rule file with Prometheus's rulefmt
+ *   package (model/rulefmt/rulefmt.go): repeated group names, record/alert
+ *   exclusivity, annotations/for/keep_firing_for on recording rules, durations,
+ *   and PromQL syntax. It has no per-rule ids, so those credits omit `rule`.
+ * - amtool check-config loads an Alertmanager config with the same code the
+ *   server uses (config/config.go): undefined receivers and time intervals,
+ *   non-unique names, a root route that is missing, has no receiver or has
+ *   matchers, matcher syntax, durations, missing integration destinations and
+ *   credentials, and "at most one of X and X_file". No per-rule ids either.
+ * - pint (cloudflare/pint, docs/checks/) is a rule linter with named checks.
+ *   promql/syntax, rule/duplicate, rule/label, alerts/annotation and
+ *   alerts/for map onto chant rules. rule/label and alerts/annotation are
+ *   configurable "this label or annotation must exist" checks that pint ships
+ *   with nothing enabled, so they overlap PROM106 and PROM107 and no more.
+ *
+ * The PROM211-PROM219 rule-file checks (#3363), against the same list:
+ * - alerts/comparison and promql/regexp are the same checks as PROM213 and
+ *   PROM218, so those are equivalent.
+ * - rule/for enforces a configured minimum `for`, and alerts/annotation a
+ *   configured annotation; with `for` required and runbook_url named they
+ *   are PROM211 and PROM212. alerts/for is not credited: it rejects bad
+ *   values and a redundant `for: 0s`, not a missing `for`.
+ * - alerts/template covers PROM214's dropped label and checks template
+ *   syntax besides. promql/rate reads the metric type from a live
+ *   Prometheus's metadata; PROM215 has only the name to go on. rule/name
+ *   is a configured name regex; PROM217 fixes it to level:metric:operations.
+ *   All three overlap.
+ *
+ * Deliberately without a credit from these tools:
+ * - PROM001 and PROM003: a literal credential in TypeScript source, and the
+ *   Slo objective/window model. Neither tool reads either.
+ * - PROM202 (severity not routed) and PROM207 (receiver never routed to):
+ *   check-config accepts both, and `amtool config routes test` answers a
+ *   different question (where one given label set goes).
+ * - PROM216 (histogram_quantile without _bucket or le) and PROM219
+ *   (alertname set by hand): no pint check reports either, and promtool's
+ *   rulefmt accepts both.
+ * - PROM220-PROM224: check-config accepts insecure_skip_verify, SMTP auth
+ *   without TLS, credentials over http://, a repeat_interval under
+ *   group_interval, and an inhibit rule without equal.
+ * - PROM301: no tool here reads a rule file together with the collector
+ *   config that produces its metrics.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+const RULEFMT = "https://github.com/prometheus/prometheus/blob/main/model/rulefmt/rulefmt.go";
+const AM_CONFIG = "https://github.com/prometheus/alertmanager/blob/main/config/config.go";
+const PINT = "https://github.com/cloudflare/pint/blob/main/docs/checks";
+
+const amtool = (relation: Lineage["relation"]): Lineage => ({
+  tool: "amtool",
+  url: AM_CONFIG,
+  relation,
+});
+
+export const prometheusAuditLineage: Record<string, Lineage[]> = {
+  PROM002: [
+    { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+    { tool: "pint", rule: "promql/syntax", url: `${PINT}/promql/syntax.md`, relation: "equivalent" },
+  ],
+  PROM101: [{ tool: "promtool", url: RULEFMT, relation: "equivalent" }],
+  PROM102: [{ tool: "pint", rule: "rule/duplicate", url: `${PINT}/rule/duplicate.md`, relation: "overlaps" }],
+  PROM103: [
+    { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+    { tool: "pint", rule: "alerts/for", url: `${PINT}/alerts/for.md`, relation: "overlaps" },
+  ],
+  PROM104: [
+    { tool: "promtool", url: RULEFMT, relation: "equivalent" },
+    { tool: "pint", rule: "promql/syntax", url: `${PINT}/promql/syntax.md`, relation: "equivalent" },
+  ],
+  PROM105: [{ tool: "promtool", url: RULEFMT, relation: "equivalent" }],
+  PROM106: [{ tool: "pint", rule: "rule/label", url: `${PINT}/rule/label.md`, relation: "overlaps" }],
+  PROM107: [{ tool: "pint", rule: "alerts/annotation", url: `${PINT}/alerts/annotation.md`, relation: "overlaps" }],
+  PROM201: [amtool("equivalent")],
+  PROM203: [amtool("equivalent")],
+  PROM204: [amtool("equivalent")],
+  PROM205: [amtool("equivalent")],
+  PROM206: [amtool("equivalent")],
+  PROM208: [amtool("equivalent")],
+  PROM209: [amtool("overlaps")],
+  PROM210: [amtool("overlaps")],
+  PROM211: [{ tool: "pint", rule: "rule/for", url: `${PINT}/rule/for.md`, relation: "overlaps" }],
+  PROM212: [{ tool: "pint", rule: "alerts/annotation", url: `${PINT}/alerts/annotation.md`, relation: "overlaps" }],
+  PROM213: [{ tool: "pint", rule: "alerts/comparison", url: `${PINT}/alerts/comparison.md`, relation: "equivalent" }],
+  PROM214: [{ tool: "pint", rule: "alerts/template", url: `${PINT}/alerts/template.md`, relation: "overlaps" }],
+  PROM215: [{ tool: "pint", rule: "promql/rate", url: `${PINT}/promql/rate.md`, relation: "overlaps" }],
+  PROM217: [{ tool: "pint", rule: "rule/name", url: `${PINT}/rule/name.md`, relation: "overlaps" }],
+  PROM218: [{ tool: "pint", rule: "promql/regexp", url: `${PINT}/promql/regexp.md`, relation: "equivalent" }],
+};

package/src/lint/post-synth/checks.test.ts

@@ -0,0 +1,257 @@
+/**
+ * PROM211-PROM224 (#3363): one failing and one passing case each, and the
+ * lexicon's own composites, init templates and examples reporting none.
+ */
+import { describe, expect, test } from "vitest";
+import { join } from "path";
+import { readdirSync } from "fs";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
+import { build } from "@intentius/chant/build";
+import { runPostSynthChecks } from "@intentius/chant/lint/post-synth";
+import { genAiMetrics } from "@intentius/chant-lexicon-otel/genai";
+import { postSynthChecks } from "./index";
+import { OPT_IN_CHECKS } from "../audit-catalog";
+import { prometheusSerializer } from "../../serializer";
+import { emitYaml } from "../../build";
+import { ruleGroupConfig } from "../../rules";
+import { GenAiRules, type GenAiAlerting } from "../../composites/genai";
+import { Slo } from "../../composites/slo";
+import type { RuleGroupConfig } from "../../model";
+
+const NEW_CHECKS = postSynthChecks.filter((c) => c.id >= "PROM211" && c.id <= "PROM224");
+
+/** The PROM211-PROM224 findings on a document, by check id. */
+function found(text: string, ids?: string[]): string[] {
+  const ctx = makePostSynthCtx("prometheus", text);
+  return NEW_CHECKS.filter((c) => !ids || ids.includes(c.id))
+    .flatMap((c) => c.check(ctx))
+    .map((d) => d.checkId);
+}
+
+/** A rule file of one group holding `rule`, as YAML. */
+function rules(rule: Record<string, unknown>, groupLabels?: Record<string, string>): string {
+  return JSON.stringify({ groups: [{ name: "g", ...(groupLabels ? { labels: groupLabels } : {}), rules: [rule] }] });
+}
+
+/** An alert that passes every check but the one a case varies. */
+function alert(over: Record<string, unknown> = {}): string {
+  return rules({
+    alert: "A",
+    expr: "sum by (job) (rate(errors_total[5m])) > 1",
+    for: "5m",
+    labels: { severity: "page" },
+    annotations: { summary: "errors on {{ $labels.job }}", runbook_url: "https://runbooks/a" },
+    ...over,
+  });
+}
+
+const record = (name: string, expr: string) => rules({ record: name, expr });
+
+const am = (over: Record<string, unknown> = {}) =>
+  JSON.stringify({ route: { receiver: "r" }, receivers: [{ name: "r", webhook_configs: [{ url: "https://hook" }] }], ...over });
+
+describe("the rule-file checks", () => {
+  test("the baseline alert and recording rule report nothing", () => {
+    expect(found(alert())).toEqual([]);
+    expect(found(record("job:errors:rate5m", "sum by (job) (rate(errors_total[5m]))"))).toEqual([]);
+  });
+
+  test("PROM211 no for, or for: 0s", () => {
+    expect(found(alert({ for: undefined }))).toEqual(["PROM211"]);
+    expect(found(alert({ for: "0s" }))).toEqual(["PROM211"]);
+    expect(found(alert({ for: "1m" }))).toEqual([]);
+  });
+
+  test("PROM211 leaves alone an expression over a window, a multi-window and, and a heartbeat", () => {
+    expect(found(alert({ for: undefined, expr: "avg_over_time(job:errors:rate5m[1h]) > 1" }))).toEqual([]);
+    expect(found(alert({ for: undefined, expr: "(job:errors:rate1h > 1) and (job:errors:rate5m > 1)" }))).toEqual([]);
+    expect(found(alert({ for: undefined, expr: "vector(1)" }), ["PROM211", "PROM213"])).toEqual([]);
+    // A for that is not a duration is PROM103's alone.
+    expect(found(alert({ for: "1.5h" }))).toEqual([]);
+  });
+
+  test("PROM212 is the only finding on an alert with no runbook_url", () => {
+    expect(found(alert({ annotations: { summary: "x" } }))).toEqual(["PROM212"]);
+    expect(found(record("job:errors:rate5m", "sum by (job) (rate(errors_total[5m]))"), ["PROM212"])).toEqual([]);
+  });
+
+  test("PROM213 no comparison", () => {
+    expect(found(alert({ expr: "sum by (job) (rate(errors_total[5m]))" }))).toEqual(["PROM213"]);
+    expect(found(alert({ expr: "sum by (job) (rate(errors_total[5m])) > bool 1" }))).toEqual(["PROM213"]);
+    expect(found(alert({ expr: "job:errors:rate5m > 1 or job:errors:rate1h" }))).toEqual(["PROM213"]);
+    expect(found(alert({ expr: "absent(up{job=\"api\"})" }))).toEqual([]);
+    expect(found(alert({ expr: "up{job=\"api\"} unless on (instance) maintenance" }))).toEqual([]);
+    expect(found(alert({ expr: "sum by (job) (up == 0)" }))).toEqual([]);
+  });
+
+  test("PROM214 a template label the aggregation drops", () => {
+    const reads = (expr: string) => alert({ expr, annotations: { summary: "{{ $labels.instance }} on {{ .Labels.job }}", runbook_url: "u" } });
+    expect(found(reads("sum by (job) (up) == 0"))).toEqual(["PROM214"]);
+    expect(found(reads("sum without (instance) (up) == 0"))).toEqual(["PROM214"]);
+    expect(found(reads("sum by (job, instance) (up) == 0"))).toEqual([]);
+    expect(found(reads("up == 0"))).toEqual([]);
+    expect(found(reads("sum without (pod) (up) == 0"))).toEqual([]);
+    // One-to-one matching on (job) keeps only job.
+    expect(found(reads("sum by (job, instance) (up) / on (job) sum by (job) (up) < 0.5"))).toEqual(["PROM214"]);
+    // A label the rule sets itself is left alone.
+    expect(found(alert({ expr: "sum(up) == 0", labels: { severity: "page", instance: "all" }, annotations: { summary: "{{ $labels.instance }}", runbook_url: "u" } }))).toEqual([]);
+  });
+
+  test("PROM215 rate over a name that is not a counter's", () => {
+    expect(found(record("job:mem:rate5m", "sum by (job) (rate(process_resident_memory_bytes[5m]))"))).toEqual(["PROM215"]);
+    expect(found(record("job:mem:rate5m", "sum by (job) (increase(queue_depth[5m]))"))).toEqual(["PROM215"]);
+    for (const name of ["errors_total", "req_seconds_count", "req_seconds_sum", "req_seconds_bucket"]) {
+      expect(found(record("job:x:rate5m", `sum by (job) (rate(${name}[5m]))`))).toEqual([]);
+    }
+    expect(found(record("job:mem:deriv5m", "sum by (job) (deriv(process_resident_memory_bytes[5m]))"))).toEqual([]);
+  });
+
+  test("PROM216 histogram_quantile without _bucket or without le", () => {
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum by (job) (rate(req_seconds_bucket[5m])))"))).toEqual(["PROM216"]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum without (le) (rate(req_seconds_bucket[5m])))"))).toEqual(["PROM216"]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum by (job, le) (rate(req_seconds_count[5m])))"))).toEqual(["PROM216"]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, sum by (job, le) (rate(req_seconds_bucket[5m])))"))).toEqual([]);
+    expect(found(record("job:lat:p95", "histogram_quantile(0.95, rate(req_seconds_bucket[5m]))"))).toEqual([]);
+  });
+
+  test("PROM217 recording rule names", () => {
+    expect(found(record("errors_rate", "sum(rate(errors_total[5m]))"))).toEqual(["PROM217"]);
+    expect(found(record("job:errors", "sum by (job) (rate(errors_total[5m]))"))).toEqual(["PROM217"]);
+    expect(found(record("job::rate5m", "sum by (job) (rate(errors_total[5m]))"))).toEqual(["PROM217"]);
+    expect(found(record("instance_path:requests:rate5m", "sum by (instance, path) (rate(requests_total[5m]))"))).toEqual([]);
+  });
+
+  test("PROM218 a regex that needs none, or is anchored", () => {
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"api"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job!~"api"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"^api.*"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"api.*$"}[5m]))'))).toEqual(["PROM218"]);
+    expect(found(record("job:e:rate5m", 'sum by (job) (rate(errors_total{job=~"api|web", code=~"5.."}[5m]))'))).toEqual([]);
+  });
+
+  test("PROM219 alertname set on the rule or the group", () => {
+    expect(found(alert({ labels: { severity: "page", alertname: "B" } }))).toEqual(["PROM219"]);
+    expect(found(rules(JSON.parse(alert()).groups[0].rules[0], { alertname: "B" }))).toEqual(["PROM219"]);
+  });
+
+  test("an expression that does not parse is PROM104's alone", () => {
+    expect(found(alert({ expr: "sum by (job) (rate(x[5m]) >" }))).toEqual([]);
+  });
+});
+
+describe("the alertmanager.yml checks", () => {
+  test("the baseline config reports nothing", () => {
+    expect(found(am())).toEqual([]);
+  });
+
+  test("PROM220 insecure_skip_verify on a receiver or in global", () => {
+    const insecure = { url: "https://hook", http_config: { tls_config: { insecure_skip_verify: true } } };
+    expect(found(am({ receivers: [{ name: "r", webhook_configs: [insecure] }] }))).toEqual(["PROM220"]);
+    expect(found(am({ global: { http_config: { tls_config: { insecure_skip_verify: true } } } }))).toEqual(["PROM220"]);
+    expect(found(am({ receivers: [{ name: "r", email_configs: [{ to: "a@b.c", smarthost: "s:25", from: "x@b.c", tls_config: { insecure_skip_verify: true } }] }] }))).toEqual(["PROM220"]);
+    expect(found(am({ receivers: [{ name: "r", webhook_configs: [{ url: "https://hook", http_config: { tls_config: { insecure_skip_verify: false } } }] }] }))).toEqual([]);
+  });
+
+  test("PROM221 SMTP auth with require_tls false", () => {
+    const email = (entry: Record<string, unknown>, global: Record<string, unknown> = {}) =>
+      am({ global, receivers: [{ name: "r", email_configs: [{ to: "a@b.c", smarthost: "s:25", from: "x@b.c", ...entry }] }] });
+    expect(found(email({ require_tls: false, auth_username: "u", auth_password_file: "/p" }))).toEqual(["PROM221"]);
+    expect(found(email({ auth_username: "u" }, { smtp_require_tls: false, smtp_auth_password_file: "/p" }))).toEqual(["PROM221"]);
+    expect(found(email({ require_tls: false }))).toEqual([]);
+    expect(found(email({ auth_password_file: "/p" }))).toEqual([]);
+    expect(found(email({ require_tls: false, auth_password_file: "/p", force_implicit_tls: true }))).toEqual([]);
+  });
+
+  test("PROM222 credentials sent to an http:// URL", () => {
+    const hook = (entry: Record<string, unknown>, global: Record<string, unknown> = {}) => am({ global, receivers: [{ name: "r", webhook_configs: [entry] }] });
+    expect(found(hook({ url: "http://user:pass@hook/" }))).toEqual(["PROM222"]);
+    expect(found(hook({ url: "http://hook/", http_config: { bearer_token_file: "/t" } }))).toEqual(["PROM222"]);
+    expect(found(hook({ url: "http://hook/" }, { http_config: { basic_auth: { username: "u", password_file: "/p" } } }))).toEqual(["PROM222"]);
+    expect(found(hook({ url: "http://hook/" }))).toEqual([]);
+    expect(found(hook({ url: "https://hook/", http_config: { bearer_token_file: "/t" } }))).toEqual([]);
+    const opsgenie = (global: Record<string, unknown>) => am({ global, receivers: [{ name: "r", opsgenie_configs: [{ api_key_file: "/k" }] }] });
+    expect(found(opsgenie({ opsgenie_api_url: "http://opsgenie.internal/" }))).toEqual(["PROM222"]);
+    expect(found(opsgenie({}))).toEqual([]);
+  });
+
+  test("PROM223 repeat_interval under group_interval, inherited down the tree", () => {
+    expect(found(am({ route: { receiver: "r", group_interval: "10m", repeat_interval: "5m" } }))).toEqual(["PROM223"]);
+    expect(found(am({ route: { receiver: "r", repeat_interval: "1m" } }))).toEqual(["PROM223"]);
+    expect(found(am({ route: { receiver: "r", group_interval: "1h", routes: [{ receiver: "r", repeat_interval: "30m" }] } }))).toEqual(["PROM223"]);
+    expect(found(am({ route: { receiver: "r", group_interval: "5m", repeat_interval: "1h" } }))).toEqual([]);
+  });
+
+  test("PROM224 an inhibit rule whose sides can match one alert, with no equal", () => {
+    const inhibit = (rule: Record<string, unknown>) => am({ inhibit_rules: [rule] });
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['team="db"'] }))).toEqual(["PROM224"]);
+    expect(found(inhibit({ source_matchers: ['severity=~"page|ticket"'], target_matchers: ['severity="ticket"'] }))).toEqual(["PROM224"]);
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['team="db"'], equal: ["alertname"] }))).toEqual([]);
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['severity="ticket"'] }))).toEqual([]);
+    expect(found(inhibit({ source_matchers: ['severity=~"critical"'], target_matchers: ['severity=~"warning|info"'] }))).toEqual([]);
+    expect(found(inhibit({ source_matchers: ['severity="page"'], target_matchers: ['severity!="page"'] }))).toEqual([]);
+  });
+});
+
+/** Every finding the `recommended` preset reports (PROM212, opt-in, is left out). */
+function recommended(text: string): string[] {
+  const ctx = makePostSynthCtx("prometheus", text);
+  return postSynthChecks
+    .filter((c) => !OPT_IN_CHECKS.has(c.id))
+    .flatMap((c) => c.check(ctx))
+    .map((d) => `${d.checkId} ${d.message}`);
+}
+
+const groupYaml = (group: RuleGroupConfig) => emitYaml({ groups: [group] });
+
+describe("the lexicon's own rules report none of the checks", () => {
+  const prices = [{ provider: "anthropic", model: "m1", inputPerMTok: 3, outputPerMTok: 15, currency: "USD", source: "https://example.com", asOf: "2026-09-29" }];
+  const alerts: GenAiAlerting = {
+    errorRatio: true,
+    latency: true,
+    toolErrorRatio: true,
+    budgets: [
+      { amount: 5, currency: "USD", per: "hour" },
+      { amount: 50, currency: "USD", per: "day" },
+    ],
+  };
+
+  test.each([
+    ["spans", genAiMetrics()],
+    ["client", genAiMetrics({ clientMetrics: "derive" })],
+  ] as const)("GenAiRules over the %s metrics, with and without its alerts", (_label, genAi) => {
+    expect(recommended(groupYaml(ruleGroupConfig(GenAiRules({ genAi, prices }).rules)))).toEqual([]);
+    expect(recommended(groupYaml(ruleGroupConfig(GenAiRules({ genAi, prices, alerts }).rules)))).toEqual([]);
+  });
+
+  test("Slo, with each SLI form and with tickets off", () => {
+    const calls = "traces_span_metrics_calls_total";
+    const slos = [
+      Slo({
+        name: "a",
+        objective: 0.995,
+        window: "28d",
+        sli: { good: `sum(rate(${calls}{status_code!="STATUS_CODE_ERROR"}[{{window}}]))`, total: `sum(rate(${calls}[{{window}}]))` },
+      }),
+      Slo({
+        name: "b",
+        objective: 0.999,
+        window: "30d",
+        sli: { errors: `sum(rate(${calls}{status_code="STATUS_CODE_ERROR"}[{{window}}]))`, total: `sum(rate(${calls}[{{window}}]))` },
+        alerting: { ticket: false },
+      }),
+    ];
+    for (const slo of slos) expect(recommended(groupYaml(ruleGroupConfig(slo.rules)))).toEqual([]);
+  });
+
+  const examplesDir = join(import.meta.dirname, "..", "..", "..", "examples");
+  const examples = readdirSync(examplesDir, { withFileTypes: true })
+    .filter((d) => d.isDirectory())
+    .map((d) => d.name);
+
+  test.each(examples)("the %s example", async (name) => {
+    const result = await build(join(examplesDir, name, "src"), [prometheusSerializer]);
+    expect(result.errors).toEqual([]);
+    const diags = runPostSynthChecks(postSynthChecks, result).filter((d) => !OPT_IN_CHECKS.has(d.checkId));
+    expect(diags).toEqual([]);
+  });
+});

package/src/lint/post-synth/index.ts

@@ -16,6 +16,22 @@ import { prom206 } from "./prom206";
 import { prom207 } from "./prom207";
 import { prom208 } from "./prom208";
 import { prom209 } from "./prom209";
+import { prom210 } from "./prom210";
+import { prom211 } from "./prom211";
+import { prom212 } from "./prom212";
+import { prom213 } from "./prom213";
+import { prom214 } from "./prom214";
+import { prom215 } from "./prom215";
+import { prom216 } from "./prom216";
+import { prom217 } from "./prom217";
+import { prom218 } from "./prom218";
+import { prom219 } from "./prom219";
+import { prom220 } from "./prom220";
+import { prom221 } from "./prom221";
+import { prom222 } from "./prom222";
+import { prom223 } from "./prom223";
+import { prom224 } from "./prom224";
+import { prom301 } from "./prom301";
 
 export const postSynthChecks: PostSynthCheck[] = [
   prom101,
@@ -34,4 +50,20 @@ export const postSynthChecks: PostSynthCheck[] = [
   prom207,
   prom208,
   prom209,
+  prom210,
+  prom211,
+  prom212,
+  prom213,
+  prom214,
+  prom215,
+  prom216,
+  prom217,
+  prom218,
+  prom219,
+  prom220,
+  prom221,
+  prom222,
+  prom223,
+  prom224,
+  prom301,
 ];

package/src/lint/post-synth/post-synth.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, test } from "vitest";
 import { makePostSynthCtx, makePostSynthCtxFromFiles } from "@intentius/chant-test-utils";
 import { postSynthChecks } from "./index";
+import { OPT_IN_CHECKS } from "../audit-catalog";
+import { RECEIVER_INTEGRATION_TYPES } from "../../integrations";
+import { INTEGRATION_CASES, SLACK_APP_URL, amWith } from "../../testdata/integration-cases";
 import { prom101 } from "./prom101";
 import { prom102 } from "./prom102";
 import { prom103 } from "./prom103";
@@ -17,6 +20,7 @@ import { prom206 } from "./prom206";
 import { prom207 } from "./prom207";
 import { prom208 } from "./prom208";
 import { prom209 } from "./prom209";
+import { prom210 } from "./prom210";
 
 const RULES = `groups:
   - name: api
@@ -73,7 +77,8 @@ const rulesOnly = (rules: string) => makePostSynthCtx("prometheus", rules);
 const amOnly = (am: string) => makePostSynthCtx("prometheus", am);
 
 describe("a clean rule file and alertmanager.yml", () => {
-  test.each(postSynthChecks.map((c) => [c.id, c] as const))("%s finds nothing", (_id, check) => {
+  // PROM212 (no runbook_url) is opt-in and RULES carries none; see checks.test.ts.
+  test.each(postSynthChecks.filter((c) => !OPT_IN_CHECKS.has(c.id)).map((c) => [c.id, c] as const))("%s finds nothing", (_id, check) => {
     expect(check.check(both())).toEqual([]);
   });
 });
@@ -245,6 +250,37 @@ receivers:
   });
 });
 
+const integrationCodes = (text: string) =>
+  [prom208, prom209, prom210].flatMap((c) => c.check(amOnly(text))).map((d) => d.checkId).sort();
+
+describe("PROM208-PROM210 on every Alertmanager integration", () => {
+  test.each(INTEGRATION_CASES)("%s", (_label, key, entry, global, codes) => {
+    expect(integrationCodes(amWith(key, entry, global))).toEqual(codes);
+  });
+
+  test("every integration has a passing and a failing case", () => {
+    for (const key of Object.keys(RECEIVER_INTEGRATION_TYPES)) {
+      const cases = INTEGRATION_CASES.filter((c) => c[1] === key);
+      expect(cases.some((c) => c[4].length === 0), `${key} passing`).toBe(true);
+      expect(cases.some((c) => c[4].length > 0), `${key} failing`).toBe(true);
+    }
+  });
+
+  test("findings name the receiver and the entry", () => {
+    const [d] = prom209.check(amOnly(amWith("opsgenie_configs", {})));
+    expect(d).toMatchObject({ checkId: "PROM209", severity: "error", entity: "r" });
+    expect(d.message).toContain('receiver "r" opsgenie_configs[0] has no api_key');
+  });
+
+  test("PROM210 and PROM208 in global", () => {
+    const am = (global: Record<string, unknown>) => JSON.stringify({ global, route: { receiver: "r" }, receivers: [{ name: "r" }] });
+    expect(integrationCodes(am({ slack_app_token_file: "/t", slack_api_url: "https://hooks.slack.com/x" }))).toEqual(["PROM210"]);
+    expect(integrationCodes(am({ slack_app_token_file: "/t", slack_api_url: SLACK_APP_URL }))).toEqual([]);
+    expect(integrationCodes(am({ smtp_auth_password: "x", smtp_auth_password_file: "/p", smtp_smarthost: "smtp" }))).toEqual(["PROM210", "PROM210"]);
+    expect(integrationCodes(am({ resolve_timeout: "1.5m" }))).toEqual(["PROM208"]);
+  });
+});
+
 describe("documents from other lexicons", () => {
   test("a k8s manifest and a collector config are not read as ours", () => {
     const ctx = makePostSynthCtx(

package/src/lint/post-synth/prom-helpers.ts

@@ -13,10 +13,12 @@
 import type { PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
 import type { SerializerResult } from "@intentius/chant/serializer";
 import { loadAll } from "js-yaml";
+import { buildCollectorConfigs, collectorMetricIssues, collectorMetrics } from "../../collector-metrics";
 import { looksLikeAlertmanagerConfig, looksLikeRuleFile, type AlertmanagerConfig, type RuleFileConfig } from "../../model";
 import {
   validateAlertmanagerConfig,
   validateRuleFile,
+  validateRunbookUrls,
   validateSeverityRouting,
   type PrometheusIssue,
   type PrometheusIssueCode,
@@ -62,7 +64,7 @@ function toDiagnostic(issue: PrometheusIssue, source: string): PostSynthDiagnost
   };
 }
 
-/** Diagnostics for one rule-file code (PROM101-PROM107) across every rule file in the output. */
+/** Diagnostics for one rule-file code (PROM101-PROM107, PROM211, PROM213-PROM219) across every rule file in the output. */
 export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) =>
     validateRuleFile(config)
@@ -71,7 +73,7 @@ export function ruleFileDiagnostics(ctx: PostSynthContext, code: PrometheusIssue
   );
 }
 
-/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM209) across every `alertmanager.yml` in the output. */
+/** Diagnostics for one Alertmanager code (PROM201, PROM203-PROM210, PROM220-PROM224) across every `alertmanager.yml` in the output. */
 export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusIssueCode): PostSynthDiagnostic[] {
   return prometheusDocs(ctx).alertmanager.flatMap(({ source, config }) =>
     validateAlertmanagerConfig(config)
@@ -80,6 +82,43 @@ export function alertmanagerDiagnostics(ctx: PostSynthContext, code: PrometheusI
   );
 }
 
+/** PROM212 across every rule file in the output. Opt-in: the lexicon's `recommended` lint preset leaves it out (see ../../plugin.ts). */
+export function runbookDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  return prometheusDocs(ctx).ruleFiles.flatMap(({ source, config }) => validateRunbookUrls(config).map((i) => toDiagnostic(i, source)));
+}
+
+/**
+ * PROM301: every rule expression in the output against the metrics the
+ * build's collector configs emit. Silent when the build has none.
+ */
+export function collectorMetricDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
+  const { ruleFiles } = prometheusDocs(ctx);
+  if (ruleFiles.length === 0) return [];
+  const emitted = collectorMetrics(buildCollectorConfigs(ctx));
+  if (!emitted) return [];
+  const out: PostSynthDiagnostic[] = [];
+  for (const { source, config } of ruleFiles) {
+    for (const group of Array.isArray(config?.groups) ? config.groups : []) {
+      for (const rule of Array.isArray(group?.rules) ? group.rules : []) {
+        const r = rule as unknown as Record<string, unknown>;
+        if (typeof r.expr !== "string") continue;
+        const subject = `${group.name}/${typeof r.record === "string" ? r.record : String(r.alert ?? "")}`;
+        for (const issue of collectorMetricIssues(r.expr, emitted)) {
+          const message = `rule ${subject} ${issue.message}`;
+          out.push({
+            checkId: "PROM301",
+            severity: "warning",
+            message: source && source !== "prometheus" ? `${source}: ${message}` : message,
+            entity: subject,
+            lexicon: "prometheus",
+          });
+        }
+      }
+    }
+  }
+  return out;
+}
+
 /** PROM202: joins every rule file in the output against every Alertmanager config in it. Silent when either is absent. */
 export function routingDiagnostics(ctx: PostSynthContext): PostSynthDiagnostic[] {
   const { ruleFiles, alertmanager } = prometheusDocs(ctx);

package/src/lint/post-synth/prom208.ts

@@ -1,7 +1,7 @@
 /**
  * PROM208: An Alertmanager duration is not a duration
  *
- * group_wait, group_interval, repeat_interval, resolve_timeout and webhook timeout take durations such as 30s or 4h.
+ * group_wait, group_interval, repeat_interval, resolve_timeout and Jira reopen_duration take Prometheus durations (30s, 4h, 1d); the timeout of webhook, Slack, PagerDuty and incident.io, and Pushover retry, expire and ttl take Go durations (10s, 1m30s, 500ms).
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";

package/src/lint/post-synth/prom209.ts

@@ -1,7 +1,7 @@
 /**
  * PROM209: A receiver integration is missing its destination or credential
  *
- * A webhook needs url or url_file, Slack an api_url (or the global one), PagerDuty a routing_key or service_key, and email a to address, a smarthost and a from address (or their global defaults).
+ * Every one of Alertmanager's 18 integrations is checked for the destination, credential and required fields its config validation asks for, with the global defaults it falls back to: e.g. a webhook url, an Opsgenie api_key (or global.opsgenie_api_key), a Telegram chat_id and bot token, a Webex room_id and authorization, an SNS target, a Jira project and issue_type.
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";

package/src/lint/post-synth/prom210.ts

@@ -0,0 +1,17 @@
+/**
+ * PROM210: A receiver integration or global setting is one Alertmanager rejects
+ *
+ * Two settings that exclude each other (a value and its *_file, a Slack api_url and app_token, Pushover html and monospace, two SNS targets), or a value outside the allowed set (WeChat message_type, Telegram parse_mode, Jira api_type, an Opsgenie responder type, a VictorOps reserved custom field, a smarthost that is not host:port, a Slack or Mattermost field without title and value).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { alertmanagerDiagnostics } from "./prom-helpers";
+
+export const prom210: PostSynthCheck = {
+  id: "PROM210",
+  description: "A receiver integration or global setting is one Alertmanager rejects",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return alertmanagerDiagnostics(ctx, "PROM210");
+  },
+};