@intentius/chant-lexicon-temporal 0.1.5

package/src/example.test.ts

@@ -0,0 +1,59 @@
+/**
+ * Integration test for the temporal-self-hosted example project.
+ *
+ * Builds the example from source using the temporal serializer and
+ * verifies all expected output files are produced.
+ */
+
+import { describe, test, expect } from "vitest";
+import { resolve } from "path";
+import { fileURLToPath } from "url";
+import { build } from "@intentius/chant/build";
+import { lintCommand } from "@intentius/chant/cli/commands/lint";
+import { temporalSerializer } from "./serializer";
+
+const examplesRoot = resolve(fileURLToPath(import.meta.url), "../../../../examples");
+const srcDir = resolve(examplesRoot, "temporal-self-hosted", "src");
+
+describe("temporal-self-hosted example", () => {
+  test("passes lint", async () => {
+    const result = await lintCommand({ path: srcDir, format: "stylish", fix: true });
+    if (!result.success || result.errorCount > 0) console.log(result.output);
+    expect(result.success).toBe(true);
+    expect(result.errorCount).toBe(0);
+  });
+
+  test("build produces docker-compose.yml primary output", async () => {
+    const result = await build(srcDir, [temporalSerializer]);
+    expect(result.errors).toHaveLength(0);
+    const output = result.outputs.get("temporal")!;
+    const primary = typeof output === "string" ? output : (output as { primary: string }).primary;
+    expect(primary).toContain("temporalio/admin-tools");
+    expect(primary).toContain("temporal server start-dev");
+    expect(primary).toContain("7233");
+  });
+
+  test("build produces temporal-setup.sh with namespace and search attributes", async () => {
+    const result = await build(srcDir, [temporalSerializer]);
+    const output = result.outputs.get("temporal")!;
+    const files =
+      typeof output === "string" ? {} : (output as { files: Record<string, string> }).files ?? {};
+    expect(files["temporal-setup.sh"]).toBeDefined();
+    expect(files["temporal-setup.sh"]).toContain("temporal operator namespace create");
+    expect(files["temporal-setup.sh"]).toContain('--namespace "my-app"');
+    expect(files["temporal-setup.sh"]).toContain("temporal operator search-attribute create");
+    expect(files["temporal-setup.sh"]).toContain('"JobType"');
+    expect(files["temporal-setup.sh"]).toContain('"Priority"');
+  });
+
+  test("build produces schedules/daily-sync.ts", async () => {
+    const result = await build(srcDir, [temporalSerializer]);
+    const output = result.outputs.get("temporal")!;
+    const files =
+      typeof output === "string" ? {} : (output as { files: Record<string, string> }).files ?? {};
+    expect(files["schedules/daily-sync.ts"]).toBeDefined();
+    expect(files["schedules/daily-sync.ts"]).toContain("daily-sync");
+    expect(files["schedules/daily-sync.ts"]).toContain("syncWorkflow");
+    expect(files["schedules/daily-sync.ts"]).toContain("client.schedule.create");
+  });
+});

package/src/generated/lexicon-temporal.json

@@ -0,0 +1,26 @@
+{
+  "TemporalServer": {
+    "resourceType": "Temporal::Server",
+    "kind": "resource",
+    "lexicon": "temporal",
+    "description": "Temporal server deployment — emits docker-compose.yml and Helm values"
+  },
+  "TemporalNamespace": {
+    "resourceType": "Temporal::Namespace",
+    "kind": "resource",
+    "lexicon": "temporal",
+    "description": "Temporal namespace — emits namespace create command in temporal-setup.sh"
+  },
+  "SearchAttribute": {
+    "resourceType": "Temporal::SearchAttribute",
+    "kind": "resource",
+    "lexicon": "temporal",
+    "description": "Temporal search attribute — emits search-attribute create command in temporal-setup.sh"
+  },
+  "TemporalSchedule": {
+    "resourceType": "Temporal::Schedule",
+    "kind": "resource",
+    "lexicon": "temporal",
+    "description": "Temporal schedule — emits SDK schedule creation TypeScript to schedules/<id>.ts"
+  }
+}

package/src/index.ts

@@ -0,0 +1,29 @@
+// Plugin
+export { temporalPlugin } from "./plugin";
+
+// Serializer
+export { temporalSerializer } from "./serializer";
+
+// Resources (hand-written)
+export {
+  TemporalServer,
+  TemporalNamespace,
+  SearchAttribute,
+  TemporalSchedule,
+} from "./resources";
+export type {
+  TemporalServerProps,
+  TemporalNamespaceProps,
+  SearchAttributeProps,
+  TemporalScheduleProps,
+} from "./resources";
+
+// Worker profile config shape + activity profiles
+export type { TemporalWorkerProfile, TemporalChantConfig, TemporalActivityProfile } from "./config";
+export { TEMPORAL_ACTIVITY_PROFILES } from "./config";
+
+// Composites
+export { TemporalDevStack } from "./composites/dev-stack";
+export type { TemporalDevStackConfig, TemporalDevStackResources } from "./composites/dev-stack";
+export { TemporalCloudStack } from "./composites/cloud-stack";
+export type { TemporalCloudStackConfig, TemporalCloudStackResources } from "./composites/cloud-stack";

package/src/lint/post-synth/post-synth.test.ts

@@ -0,0 +1,152 @@
+/**
+ * Post-synth check tests — TMP010, TMP011.
+ */
+
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { tmp010 } from "./tmp010-cron-syntax";
+import { tmp011 } from "./tmp011-namespace-reference";
+
+// ── Helpers ─────────────────────────────────────────────────────────
+
+function makeCtxFromOutput(output: string | { primary: string; files: Record<string, string> }): PostSynthContext {
+  return {
+    outputs: new Map([["temporal", output]]),
+    entities: new Map(),
+    buildResult: {
+      outputs: new Map([["temporal", output]]),
+      entities: new Map(),
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+function makeEntity(entityType: string, props: Record<string, unknown>) {
+  return {
+    [DECLARABLE_MARKER]: true,
+    entityType,
+    lexicon: "temporal",
+    kind: "resource",
+    props,
+    attributes: {},
+  };
+}
+
+function makeCtxFromEntities(entities: Map<string, unknown>): PostSynthContext {
+  return {
+    outputs: new Map([["temporal", ""]]),
+    entities: entities as Map<string, never>,
+    buildResult: {
+      outputs: new Map([["temporal", ""]]),
+      entities: entities as Map<string, never>,
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+// ── TMP010: cron-syntax ──────────────────────────────────────────────
+
+describe("TMP010: cron-syntax", () => {
+  test("warns for invalid cron with only 4 fields", () => {
+    const content = `cronExpressions: ["0 3 * *"]`;
+    const ctx = makeCtxFromOutput({
+      primary: "# docker-compose",
+      files: { "schedules/daily.ts": content },
+    });
+    const diags = tmp010.check(ctx);
+    expect(diags.length).toBeGreaterThanOrEqual(1);
+    expect(diags[0].checkId).toBe("TMP010");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("passes for valid 5-field cron", () => {
+    const content = `cronExpressions: ["0 3 * * *"]`;
+    const ctx = makeCtxFromOutput({
+      primary: "# docker-compose",
+      files: { "schedules/daily.ts": content },
+    });
+    expect(tmp010.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes for valid 6-field cron (with seconds)", () => {
+    const content = `cronExpressions: ["0 0 3 * * *"]`;
+    const ctx = makeCtxFromOutput({
+      primary: "# docker-compose",
+      files: { "schedules/daily.ts": content },
+    });
+    expect(tmp010.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips non-temporal lexicons", () => {
+    const ctx: PostSynthContext = {
+      outputs: new Map([["aws", `cronExpressions: ["invalid"]`]]),
+      entities: new Map(),
+      buildResult: {
+        outputs: new Map([["aws", ""]]),
+        entities: new Map(),
+        warnings: [],
+        errors: [],
+        sourceFileCount: 1,
+      },
+    };
+    expect(tmp010.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips non-schedule files", () => {
+    const content = `cronExpressions: ["bad"]`;
+    const ctx = makeCtxFromOutput({
+      primary: content,
+      files: { "temporal-setup.sh": content },
+    });
+    expect(tmp010.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when output is plain string (no schedule files)", () => {
+    const ctx = makeCtxFromOutput("# docker-compose.yml\nservices:\n  temporal:\n");
+    expect(tmp010.check(ctx)).toHaveLength(0);
+  });
+});
+
+// ── TMP011: namespace-reference ──────────────────────────────────────
+
+describe("TMP011: namespace-reference", () => {
+  test("errors when SearchAttribute references undeclared namespace", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["attr", makeEntity("Temporal::SearchAttribute", { name: "Project", type: "Keyword", namespace: "prod" })],
+    ]));
+    const diags = tmp011.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TMP011");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("prod");
+  });
+
+  test("passes when SearchAttribute namespace is declared", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "prod", retention: "30d" })],
+      ["attr", makeEntity("Temporal::SearchAttribute", { name: "Project", type: "Keyword", namespace: "prod" })],
+    ]));
+    expect(tmp011.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when SearchAttribute has no namespace (global)", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["attr", makeEntity("Temporal::SearchAttribute", { name: "Project", type: "Keyword" })],
+    ]));
+    expect(tmp011.check(ctx)).toHaveLength(0);
+  });
+
+  test("flags each attribute with a missing namespace independently", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["attr1", makeEntity("Temporal::SearchAttribute", { name: "A", type: "Keyword", namespace: "missing1" })],
+      ["attr2", makeEntity("Temporal::SearchAttribute", { name: "B", type: "Keyword", namespace: "missing2" })],
+    ]));
+    const diags = tmp011.check(ctx);
+    expect(diags).toHaveLength(2);
+  });
+});

package/src/lint/post-synth/tmp010-cron-syntax.ts

@@ -0,0 +1,64 @@
+/**
+ * TMP010: TemporalSchedule cron expression syntax
+ *
+ * Validates that cron expressions in TemporalSchedule.spec.cronExpressions
+ * are valid 5- or 6-field cron syntax. Malformed crons are silently ignored
+ * by Temporal's scheduler, leading to schedules that never fire.
+ *
+ * This is a pre-submission guard — final validation is Temporal's own parser.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+
+/** Very permissive cron field pattern — catches obvious syntax errors. */
+const CRON_FIELD = /^[0-9*,/\-?LW#]+$/;
+
+function isValidCronExpression(expr: string): boolean {
+  const fields = expr.trim().split(/\s+/);
+  if (fields.length < 5 || fields.length > 6) return false;
+  return fields.every((f) => CRON_FIELD.test(f));
+}
+
+export const tmp010: PostSynthCheck = {
+  id: "TMP010",
+  description: "TemporalSchedule cron expressions must be valid 5- or 6-field cron syntax",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [lexicon, output] of ctx.outputs) {
+      if (lexicon !== "temporal") continue;
+
+      // Schedules emit individual TypeScript files — check the schedules/ files.
+      const files =
+        typeof output === "string"
+          ? new Map<string, string>()
+          : (output as { primary: string; files?: Record<string, string> }).files
+            ? new Map(Object.entries((output as { files: Record<string, string> }).files))
+            : new Map<string, string>();
+
+      for (const [filename, content] of files) {
+        if (!filename.startsWith("schedules/")) continue;
+
+        // Extract cron expressions from the generated TypeScript:
+        // cronExpressions: ["0 3 * * *"]
+        const cronMatches = [...content.matchAll(/cronExpressions:\s*\[([^\]]+)\]/g)];
+        for (const match of cronMatches) {
+          const exprs = [...match[1].matchAll(/"([^"]+)"/g)].map((m) => m[1]);
+          for (const expr of exprs) {
+            if (!isValidCronExpression(expr)) {
+              diagnostics.push({
+                checkId: "TMP010",
+                severity: "warning",
+                message: `${filename}: cron expression "${expr}" does not look like valid 5- or 6-field cron syntax`,
+                lexicon: "temporal",
+              });
+            }
+          }
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tmp011-namespace-reference.ts

@@ -0,0 +1,49 @@
+/**
+ * TMP011: SearchAttribute references an undeclared namespace
+ *
+ * If SearchAttribute.namespace is set to a value X, there must be a
+ * TemporalNamespace entity with name === X in the project. A missing
+ * namespace means the search attribute create command will fail at runtime.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+
+export const tmp011: PostSynthCheck = {
+  id: "TMP011",
+  description: "SearchAttribute.namespace must reference a declared TemporalNamespace entity",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    // Collect declared namespace names
+    const declaredNamespaces = new Set<string>();
+    for (const [, entity] of ctx.entities) {
+      const et = (entity as Record<string, unknown>).entityType as string;
+      if (et !== "Temporal::Namespace") continue;
+      const props = (entity as { props?: Record<string, unknown> }).props ?? {};
+      const name = props.name as string | undefined;
+      if (name) declaredNamespaces.add(name);
+    }
+
+    // Check each SearchAttribute that specifies a namespace
+    for (const [entityKey, entity] of ctx.entities) {
+      const et = (entity as Record<string, unknown>).entityType as string;
+      if (et !== "Temporal::SearchAttribute") continue;
+
+      const props = (entity as { props?: Record<string, unknown> }).props ?? {};
+      const ns = props.namespace as string | undefined;
+      if (!ns) continue; // no namespace specified — applies globally, OK
+
+      if (!declaredNamespaces.has(ns)) {
+        diagnostics.push({
+          checkId: "TMP011",
+          severity: "error",
+          message: `SearchAttribute "${entityKey}" references namespace "${ns}" which is not declared — add a TemporalNamespace with name "${ns}"`,
+          lexicon: "temporal",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/index.ts

@@ -0,0 +1,2 @@
+export { tmp001 } from "./tmp001";
+export { tmp002 } from "./tmp002";

package/src/lint/rules/lint-rules.test.ts

@@ -0,0 +1,150 @@
+/**
+ * Lint rule tests — TMP001, TMP002.
+ */
+
+import { describe, test, expect } from "vitest";
+import type { LintContext } from "@intentius/chant/lint/rule";
+import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
+import { tmp001 } from "./tmp001";
+import { tmp002 } from "./tmp002";
+
+// ── Helpers ─────────────────────────────────────────────────────────
+
+function makeEntity(entityType: string, props: Record<string, unknown>) {
+  return {
+    [DECLARABLE_MARKER]: true,
+    entityType,
+    lexicon: "temporal",
+    kind: "resource",
+    props,
+    attributes: {},
+  };
+}
+
+function makeCtx(entities: Map<string, unknown>): LintContext {
+  return {
+    entities: entities as Map<string, never>,
+    project: { name: "test" } as never,
+  };
+}
+
+// ── TMP001: retention-too-short ──────────────────────────────────────
+
+describe("TMP001: retention-too-short", () => {
+  test("flags namespace with 1d retention", () => {
+    const ctx = makeCtx(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "default", retention: "1d" })],
+    ]));
+    const diags = tmp001.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("TMP001");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("1d");
+  });
+
+  test("flags namespace with 48h retention", () => {
+    const ctx = makeCtx(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "default", retention: "48h" })],
+    ]));
+    const diags = tmp001.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("TMP001");
+  });
+
+  test("passes with 3d retention (exactly at threshold)", () => {
+    const ctx = makeCtx(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "default", retention: "3d" })],
+    ]));
+    expect(tmp001.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes with 7d retention", () => {
+    const ctx = makeCtx(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "default", retention: "7d" })],
+    ]));
+    expect(tmp001.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when retention is unset (defaults to 7d)", () => {
+    const ctx = makeCtx(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "default" })],
+    ]));
+    expect(tmp001.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips non-namespace entities", () => {
+    const ctx = makeCtx(new Map([
+      ["s", makeEntity("Temporal::Server", { mode: "dev" })],
+    ]));
+    expect(tmp001.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips unrecognised retention format", () => {
+    const ctx = makeCtx(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "default", retention: "1week" })],
+    ]));
+    expect(tmp001.check(ctx)).toHaveLength(0);
+  });
+});
+
+// ── TMP002: allowall-without-note ────────────────────────────────────
+
+describe("TMP002: allowall-without-note", () => {
+  test("warns for AllowAll overlap without state.note", () => {
+    const ctx = makeCtx(new Map([
+      ["sched", makeEntity("Temporal::Schedule", {
+        scheduleId: "heavy-job",
+        spec: { cronExpressions: ["0 * * * *"] },
+        action: { workflowType: "heavyWorkflow", taskQueue: "heavy" },
+        policies: { overlap: "AllowAll" },
+      })],
+    ]));
+    const diags = tmp002.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("TMP002");
+    expect(diags[0].severity).toBe("warning");
+  });
+
+  test("passes when AllowAll has a note", () => {
+    const ctx = makeCtx(new Map([
+      ["sched", makeEntity("Temporal::Schedule", {
+        scheduleId: "heavy-job",
+        spec: { cronExpressions: ["0 * * * *"] },
+        action: { workflowType: "heavyWorkflow", taskQueue: "heavy" },
+        policies: { overlap: "AllowAll" },
+        state: { note: "Workflow is idempotent — concurrent runs are safe" },
+      })],
+    ]));
+    expect(tmp002.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes for Skip overlap (no note needed)", () => {
+    const ctx = makeCtx(new Map([
+      ["sched", makeEntity("Temporal::Schedule", {
+        scheduleId: "daily",
+        spec: { cronExpressions: ["0 3 * * *"] },
+        action: { workflowType: "dailyWorkflow", taskQueue: "daily" },
+        policies: { overlap: "Skip" },
+      })],
+    ]));
+    expect(tmp002.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes when no policies set", () => {
+    const ctx = makeCtx(new Map([
+      ["sched", makeEntity("Temporal::Schedule", {
+        scheduleId: "daily",
+        spec: { cronExpressions: ["0 3 * * *"] },
+        action: { workflowType: "dailyWorkflow", taskQueue: "daily" },
+      })],
+    ]));
+    expect(tmp002.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips non-schedule entities", () => {
+    const ctx = makeCtx(new Map([
+      ["ns", makeEntity("Temporal::Namespace", { name: "default" })],
+    ]));
+    expect(tmp002.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/rules/tmp001.ts

@@ -0,0 +1,53 @@
+/**
+ * TMP001: TemporalNamespace retention too short
+ *
+ * Workflow history older than the retention period is permanently deleted.
+ * Retentions shorter than 3 days leave very little time for debugging
+ * failures or running ad-hoc queries against closed workflow executions.
+ */
+
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+
+/** Parse a retention string like "1d", "12h", "3d" → total hours. Returns NaN on unrecognised format. */
+function retentionHours(retention: string): number {
+  const days = /^(\d+)d$/i.exec(retention);
+  if (days) return Number(days[1]) * 24;
+  const hours = /^(\d+)h$/i.exec(retention);
+  if (hours) return Number(hours[1]);
+  return NaN;
+}
+
+export const tmp001: LintRule = {
+  id: "TMP001",
+  severity: "error",
+  category: "correctness",
+  description: "TemporalNamespace retention should be at least 3 days to preserve workflow history for debugging",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+
+    for (const [name, entity] of context.entities) {
+      const et = (entity as Record<string, unknown>).entityType as string;
+      if (et !== "Temporal::Namespace") continue;
+
+      const props = (entity as { props?: Record<string, unknown> }).props ?? {};
+      const retention = props.retention as string | undefined;
+      if (!retention) continue; // default "7d" — not an error
+
+      const hours = retentionHours(retention);
+      if (isNaN(hours)) continue; // unrecognised format — skip
+
+      if (hours < 72) {
+        diagnostics.push({
+          ruleId: "TMP001",
+          severity: "error",
+          message: `Namespace "${name}" has retention "${retention}" — minimum recommended is 3d (72h) to preserve workflow history`,
+          entity: name,
+          fix: 'Set retention to at least "3d" — e.g. retention: "7d"',
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/tmp002.ts

@@ -0,0 +1,45 @@
+/**
+ * TMP002: TemporalSchedule AllowAll overlap without explanatory note
+ *
+ * AllowAll allows any number of concurrent schedule runs. This is safe for
+ * idempotent, read-only workflows, but can cause resource exhaustion or
+ * duplicate side-effects if not explicitly intended. Requiring a note forces
+ * the author to document the intent.
+ */
+
+import type { LintRule, LintDiagnostic, LintContext } from "@intentius/chant/lint/rule";
+
+export const tmp002: LintRule = {
+  id: "TMP002",
+  severity: "warning",
+  category: "best-practices",
+  description: "TemporalSchedule with overlap AllowAll should include state.note explaining the intent",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+
+    for (const [name, entity] of context.entities) {
+      const et = (entity as Record<string, unknown>).entityType as string;
+      if (et !== "Temporal::Schedule") continue;
+
+      const props = (entity as { props?: Record<string, unknown> }).props ?? {};
+      const policies = props.policies as Record<string, unknown> | undefined;
+      if (policies?.overlap !== "AllowAll") continue;
+
+      const state = props.state as Record<string, unknown> | undefined;
+      const note = state?.note as string | undefined;
+
+      if (!note || note.trim() === "") {
+        diagnostics.push({
+          ruleId: "TMP002",
+          severity: "warning",
+          message: `Schedule "${name}" uses overlap "AllowAll" — add state.note explaining why concurrent runs are safe`,
+          entity: name,
+          fix: 'Add state: { note: "Workflow is idempotent — concurrent runs are safe" }',
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};