@intentius/chant-lexicon-terraform 0.124.31 → 0.124.32

package/dist/lint/post-synth/tf020.js

@@ -0,0 +1,103 @@
+/**
+ * TF020: a `variable`, a `locals` entry, a `data` source or an aliased
+ * `provider` that nothing in its module scope references.
+ *
+ * Scope: root and child modules, each judged on its own. Terraform's
+ * namespaces are per module, so `var.region` inside `module.cdn` is the child
+ * module's variable and a reference to it in the root proves nothing about
+ * the child's. The reference index (`hcl/references.ts`) is keyed the same
+ * way, one scope per module, and this check never looks outside the scope the
+ * declaration is in.
+ *
+ * An unused declaration is dead weight rather than a defect, which is why
+ * this is report-only. It still earns a finding: a variable nobody reads is
+ * usually the leftover of a refactor, and the next reader has to prove that
+ * before deleting it. A data source is worse than dead weight, since it is
+ * read from the provider's API on every plan whether or not anything uses the
+ * result.
+ *
+ * Two deliberate gaps, both from the index being a string scan rather than an
+ * expression tree (see its module doc), and both the reason the credit to
+ * tflint's `terraform_unused_declarations` is `overlaps`:
+ *
+ * - A name mentioned in a string that is not an expression (a `description`
+ *   that says "overrides var.region") reads as a reference, so the
+ *   declaration is not reported. Quiet, and wrong in the safe direction.
+ * - A value reached only dynamically (`lookup(local.by_env, ...)` where the
+ *   map is built elsewhere) is a real reference the scan does see, since the
+ *   local is still named; but a variable consumed only through
+ *   `TF_VAR_`-style external input is not, and a root's variables are
+ *   frequently exactly that. Report-only keeps that from failing a build.
+ *
+ * A `provider` block with no `alias` is never reported: it is the default
+ * configuration for its type, used by every resource of that type without
+ * naming it. Only an aliased one has to be asked for by name.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { DATA_TYPE, LOCALS_TYPE, PROVIDER_TYPE, VARIABLE_TYPE, scopeOfKey, } from "../../hcl/parse.js";
+import { buildReferenceIndex, isReferenced } from "../../hcl/references.js";
+/** What a reader is being told to do about each kind of unused declaration. */
+const ADVICE = {
+    variable: "Delete it, or reference it where it was meant to be used.",
+    local: "Delete it, or reference it where it was meant to be used.",
+    data: "Delete it. A data source is read from the provider on every plan, so an unused one costs an API " +
+        "call and a permission for a value nothing consumes.",
+    provider: "Delete it, or pass it to the resources or modules that were meant to use it.",
+};
+export const tf020 = {
+    id: "TF020",
+    description: "Declaration is never referenced in its module scope",
+    check(ctx) {
+        const diagnostics = [];
+        const index = buildReferenceIndex(ctx.entities);
+        const report = (key, kind, what) => {
+            diagnostics.push({
+                checkId: "TF020",
+                severity: "warning",
+                message: `${what} is declared and never referenced in its module. ${ADVICE[kind]}`,
+                entity: key,
+                lexicon: "terraform",
+            });
+        };
+        for (const [key, entity] of ctx.entities) {
+            if (!isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const address = typeof props.address === "string" ? props.address : key;
+            const scope = scopeOfKey(key);
+            if (entity.entityType === VARIABLE_TYPE) {
+                // Excluding the variable's own key matters here: a `validation` block
+                // reads `var.<self>` in its condition, which would otherwise make
+                // every validated variable look used.
+                if (!isReferenced(index, scope, address, key))
+                    report(key, "variable", `Variable "${address}"`);
+                continue;
+            }
+            if (entity.entityType === LOCALS_TYPE) {
+                for (const name of Object.keys(body)) {
+                    // No self-exclusion: one `locals` block is many declarations, and a
+                    // local reading another local of the same block is a real use.
+                    if (!isReferenced(index, scope, `local.${name}`))
+                        report(key, "local", `Local value "local.${name}"`);
+                }
+                continue;
+            }
+            if (entity.entityType === DATA_TYPE) {
+                if (!isReferenced(index, scope, address, key))
+                    report(key, "data", `Data source "${address}"`);
+                continue;
+            }
+            if (entity.entityType === PROVIDER_TYPE) {
+                const alias = typeof body.alias === "string" ? body.alias : undefined;
+                if (alias === undefined || alias.trim() === "")
+                    continue;
+                const type = address.startsWith("provider.") ? address.slice("provider.".length) : address;
+                if (!isReferenced(index, scope, `provider.${type}.${alias}`, key)) {
+                    report(key, "provider", `Aliased provider "${type}.${alias}"`);
+                }
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf021.js

@@ -0,0 +1,117 @@
+/**
+ * TF021: `count` used where `for_each` is safer, judged narrowly.
+ *
+ * Scope: root and child modules. A resource is a resource wherever it is
+ * declared, and the failure mode below does not depend on the scope.
+ *
+ * `count` addresses its instances by position: `aws_instance.web[0]`,
+ * `[1]`, `[2]`. Delete the middle element of the list the count was derived
+ * from and every instance after it shifts down one, so Terraform plans to
+ * destroy and recreate them all, in order, to move each one's identity onto
+ * the next index. `for_each` addresses by key instead, and removing one
+ * element removes exactly one instance.
+ *
+ * The narrow part is which counts get reported. Two conditions must both
+ * hold:
+ *
+ * 1. The count is plural and derived, not a switch. A numeric literal of two
+ *    or more, or `length(var.x)` / `length(local.x)`. `count = 0`, `count =
+ *    1` and `count = var.enabled ? 1 : 0` are the conditional-resource idiom,
+ *    which `for_each` does not replace, and they are never reported.
+ * 2. The resource uses `count.index` to build something that carries the
+ *    instance's identity: a name, a bucket, a key, a `tags.Name`. That is what
+ *    makes a shift destructive; a `count.index` used only to pick a subnet out
+ *    of a list is reindexed silently and harmlessly.
+ *
+ * Redeploy's `terraform_prefer_for_each` reports every `count` over a
+ * collection, which is a broader rule and a noisier one, so the credit is
+ * `overlaps` rather than `equivalent`. choudoufu's `RuleCountIndex`
+ * (`internal/live/lint/count_index.go`) is the survey's deepest treatment of
+ * the identity-bearing question, and it is credited the same way. Report-only
+ * either way: a `count` with a stable list behind it is fine forever, and
+ * only the person who knows whether that list is stable can say.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { RESOURCE_TYPE } from "../../hcl/parse.js";
+import { walkAttributes } from "./blocks.js";
+/** `length(var.x)` or `length(local.x)`, as hcl2json renders the expression. */
+const LENGTH_OF = /^\$\{?\s*length\(\s*(var|local)\.[A-Za-z_][A-Za-z0-9_-]*\s*\)\s*\}?$/;
+/**
+ * Attribute names whose value IS the instance's identity to the provider: a
+ * rename destroys and recreates. Matched on the last path segment, so
+ * `tags.Name` and `labels.name` are covered without listing every container.
+ */
+const IDENTITY_ATTRIBUTES = new Set([
+    "name",
+    "bucket",
+    "key",
+    "identifier",
+    "hostname",
+    "domain",
+    "domain_name",
+    "display_name",
+    "resource_name",
+    "alias",
+    "prefix",
+    "path",
+    "topic",
+    "queue_name",
+    "function_name",
+    "db_name",
+    "repository",
+]);
+/** The `count` value, when it is one this rule reports on. */
+export function pluralCount(body) {
+    const count = body.count;
+    if (typeof count === "number")
+        return count >= 2 ? String(count) : undefined;
+    if (typeof count !== "string")
+        return undefined;
+    if (LENGTH_OF.test(count.trim()))
+        return count.replace(/^\$\{?/, "").replace(/\}$/, "");
+    const literal = /^\$\{?\s*(\d+)\s*\}?$/.exec(count.trim());
+    return literal && Number(literal[1]) >= 2 ? literal[1] : undefined;
+}
+/** Identity-bearing attributes of this body whose value is built from `count.index`. */
+export function identityUsesOfCountIndex(body) {
+    const out = [];
+    for (const attr of walkAttributes(body)) {
+        if (typeof attr.value !== "string" || !attr.value.includes("count.index"))
+            continue;
+        if (!IDENTITY_ATTRIBUTES.has(attr.name.toLowerCase()))
+            continue;
+        out.push(attr.path);
+    }
+    return out;
+}
+export const tf021 = {
+    id: "TF021",
+    description: "count builds instance identities from count.index where for_each is safer",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== RESOURCE_TYPE || !isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const count = pluralCount(body);
+            if (count === undefined)
+                continue;
+            const uses = identityUsesOfCountIndex(body);
+            if (uses.length === 0)
+                continue;
+            const address = typeof props.address === "string" ? props.address : key;
+            diagnostics.push({
+                checkId: "TF021",
+                severity: "warning",
+                message: `Resource "${address}" has \`count = ${count}\` and builds ${uses.sort().join(", ")} from ` +
+                    "`count.index`, so each instance's identity is its position in the list. Removing an element " +
+                    "shifts every later instance down one index, and Terraform destroys and recreates all of them " +
+                    "to match. Use `for_each` over a map or set so each instance is addressed by a stable key.",
+                entity: key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf022.js

@@ -0,0 +1,51 @@
+/**
+ * TF022: a credential-named attribute of a resource or data source holds a
+ * literal.
+ *
+ * tfsec's `general-secrets-sensitive-in-attribute`, consolidated in its v1
+ * line as `no-plaintext-exposure`, and KICS's `Passwords And Secrets` query.
+ * Broader and noisier than TF007, because a resource body has far more
+ * attributes than a variable has defaults, so the name heuristic does the
+ * gating: an attribute has to read like a credential AND hold a committed
+ * literal before it is reported.
+ *
+ * The value is in git history, in state, and in every plan output, and the
+ * blast radius is whatever the resource is: an RDS master password, a
+ * provider API token, a Kubernetes secret's data. The fix is always the same
+ * shape, a reference rather than a constant, which is what the message says
+ * rather than "remove this".
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+import { DATA_TYPE, RESOURCE_TYPE } from "../../hcl/parse.js";
+import { isSecretName, secretShapedAssignment } from "../secret-shape.js";
+import { blocksOfTypes, walkAttributes } from "./blocks.js";
+export const tf022 = {
+    id: "TF022",
+    description: "Credential-named resource attribute holds a plaintext literal",
+    check(ctx) {
+        const diagnostics = [];
+        for (const block of blocksOfTypes(ctx, [RESOURCE_TYPE, DATA_TYPE])) {
+            for (const attr of walkAttributes(block.body)) {
+                if (!isSecretName(attr.name))
+                    continue;
+                const shape = secretShapedAssignment(attr.name, attr.value);
+                if (!shape)
+                    continue;
+                diagnostics.push({
+                    checkId: "TF022",
+                    severity: "error",
+                    message: `"${block.address}" sets \`${attr.path}\` to a plaintext literal (${shape.length} ` +
+                        "characters, redacted here). The value is in git history, in state, and in plan output. " +
+                        "Replace it with a reference: a `sensitive` variable, or a data source that reads the " +
+                        "value from a secret manager at apply time.",
+                    entity: block.key,
+                    lexicon: "terraform",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf024.js

@@ -0,0 +1,62 @@
+/**
+ * TF024: a live root declares a `backend` or `cloud` block.
+ *
+ * choudoufu refuses this combination at `init`, before any command runs,
+ * naming both blocks that collide: "Both a backend and a live configuration
+ * are present" (a `backend` block) or "Both a cloud and a live configuration
+ * are present" (a `cloud` block). A live root keeps no state to store, since
+ * prior state is a projection rebuilt from the live system every run, so
+ * either block is a contradiction about where the truth lives, not a
+ * redundant setting.
+ *
+ * TF001 is the equivalent check for a stock root (no remote backend is
+ * configured); it explicitly does not fire on a live root, and this check is
+ * why: the two are mutually exclusive by construction; a root is flagged by
+ * at most one of them.
+ *
+ * Scope: root modules only (#2112). A child module's backend or cloud block
+ * is TF015's finding, whatever binary the root runs.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { TERRAFORM_TYPE } from "../../hcl/parse.js";
+import { hasBlock } from "./tf001.js";
+import { isRootScoped } from "./scope.js";
+export const tf024 = {
+    id: "TF024",
+    description: "Live root declares a backend or cloud block, which choudoufu refuses",
+    check(ctx) {
+        const diagnostics = [];
+        const flagged = new Set();
+        for (const [name, entity] of ctx.entities) {
+            if (entity.entityType !== TERRAFORM_TYPE)
+                continue;
+            if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+                continue;
+            const props = entity.props;
+            if (props.mode !== "live")
+                continue;
+            const root = typeof props.root === "string" ? props.root : "";
+            if (flagged.has(root))
+                continue;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const hasBackend = hasBlock(body, "backend");
+            const hasCloud = hasBlock(body, "cloud");
+            if (!hasBackend && !hasCloud)
+                continue;
+            flagged.add(root);
+            const blockKind = hasBackend ? "backend" : "cloud";
+            diagnostics.push({
+                checkId: "TF024",
+                severity: "error",
+                message: `Root module "${root}" runs choudoufu with a declared estate and also declares a ` +
+                    `${blockKind} block. choudoufu refuses this at init: "Both a ${blockKind} and a live ` +
+                    `configuration are present." Remove the ${blockKind} block; a live root keeps no state to store.`,
+                entity: name,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf025.js

@@ -0,0 +1,83 @@
+/**
+ * TF025: a live root reads a non-default `terraform.workspace`, or configures
+ * one through `terraform.roots`.
+ *
+ * choudoufu refuses any workspace but `default` on a live root, and refuses
+ * `workspace new`/`workspace select` outright: only the default workspace
+ * exists there ("How you run it" in choudoufu's compatibility reference).
+ * Two independent ways a configuration ends up asking for one:
+ *
+ *   - `terraform.roots.<name>.workspace` in `chant.config.*` selects a
+ *     workspace via `TF_WORKSPACE` before any HCL is even read, chant's own
+ *     equivalent of `workspace select`, so it is flagged the same way.
+ *   - A `"${terraform.workspace}"` interpolation anywhere in a block's body
+ *     reads the (necessarily `"default"`) workspace name in configuration,
+ *     which is not itself refused by choudoufu but is dead code on a live
+ *     root and a sign the configuration was written for a workspace-per-
+ *     environment layout that live mode does not support.
+ *
+ * The first fires once per root (it names a root-level config field, not a
+ * particular block); the second fires once per block that contains the
+ * reference, since each is its own thing to fix.
+ *
+ * Scope: the config half is root-only, since it reads a root-level config
+ * field; the reference half reads any block of a live root, a descended child
+ * module's included, and names the call chain that reached it (#2112).
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isRootScoped } from "./scope.js";
+/** Recursively search a parsed HCL body for a `terraform.workspace` reference, un-evaluated interpolations included. */
+function containsWorkspaceRef(value) {
+    if (typeof value === "string")
+        return /\bterraform\.workspace\b/.test(value);
+    if (Array.isArray(value))
+        return value.some(containsWorkspaceRef);
+    if (value !== null && typeof value === "object")
+        return Object.values(value).some(containsWorkspaceRef);
+    return false;
+}
+export const tf025 = {
+    id: "TF025",
+    description: "Live root references a non-default terraform.workspace, which choudoufu refuses",
+    check(ctx) {
+        const diagnostics = [];
+        const flaggedRootWorkspace = new Set();
+        for (const [name, entity] of ctx.entities) {
+            if (!isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            if (props.mode !== "live")
+                continue;
+            const root = typeof props.root === "string" ? props.root : "";
+            if (typeof props.workspace === "string" &&
+                props.workspace !== "" &&
+                props.workspace !== "default" &&
+                isRootScoped(entity) &&
+                !flaggedRootWorkspace.has(root)) {
+                flaggedRootWorkspace.add(root);
+                diagnostics.push({
+                    checkId: "TF025",
+                    severity: "error",
+                    message: `Root module "${root}" runs choudoufu with a declared estate and configures workspace ` +
+                        `"${props.workspace}" in terraform.roots.${root}. choudoufu refuses any workspace but ` +
+                        '"default" on a live root. Remove `workspace` from this root\'s config (or set it to "default").',
+                    entity: name,
+                    lexicon: "terraform",
+                });
+            }
+            if (containsWorkspaceRef(props.body)) {
+                const address = typeof props.address === "string" ? props.address : name;
+                diagnostics.push({
+                    checkId: "TF025",
+                    severity: "error",
+                    message: `"${address}" in root module "${root}" references \`terraform.workspace\`. choudoufu refuses ` +
+                        'any workspace but "default" on a live root, so this always resolves to "default" there. ' +
+                        "Remove the reference.",
+                    entity: name,
+                    lexicon: "terraform",
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf026.js

@@ -0,0 +1,74 @@
+/**
+ * TF026: a live root declares `delete: "never"` but its `policy` block still
+ * deletes an orphaned marked resource.
+ *
+ * chant's cross-lexicon delete-mode vocabulary (`terraform.roots.<name>.delete`,
+ * `../../config.ts`'s `TerraformDeleteMode`) maps onto choudoufu's `policy`
+ * block: `undeclared_tagged` governs what happens to a resource this estate
+ * marked that the configuration no longer declares, and defaults to
+ * `"delete"` when the `policy` block omits it, or the root declares no
+ * `policy` block at all. `delete: "never"` promises that `TerraformApplyOp`
+ * never proposes deleting a resource it owns, so a root making that promise
+ * has to have actually turned the quadrant's default off — `"keep"`,
+ * `"untag"` or `"report"` all satisfy it; anything else (the unset default,
+ * or an explicit `"delete"`) does not.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity —
+ * the same entity TF024 and TF025 fire from.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE } from "../../hcl/parse.js";
+/** Verbs that satisfy `delete: "never"` for the `undeclared_tagged` quadrant. */
+const SATISFIES_NEVER = new Set(["keep", "untag", "report"]);
+/**
+ * The `policy { }` block nested in a `live { }` block's body, hcl2json's own
+ * "one block, wrapped in an array" shape. Exported for TF027 (`./tf027.ts`),
+ * which reads the other quadrant of the same block.
+ */
+export function policyBlockOf(liveBody) {
+    const policy = liveBody["policy"];
+    return Array.isArray(policy) && policy.length > 0 && typeof policy[0] === "object" && policy[0] !== null
+        ? policy[0]
+        : undefined;
+}
+export const tf026 = {
+    id: "TF026",
+    description: "Live root declares delete: \"never\" but its policy leaves undeclared_tagged at \"delete\"",
+    check(ctx) {
+        const diagnostics = [];
+        const flagged = new Set();
+        for (const [name, entity] of ctx.entities) {
+            if (entity.entityType !== LIVE_TYPE)
+                continue;
+            if (!isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            if (props.mode !== "live")
+                continue;
+            if (props.delete !== "never")
+                continue;
+            const root = typeof props.root === "string" ? props.root : "";
+            if (flagged.has(root))
+                continue;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const policy = policyBlockOf(body);
+            const undeclaredTagged = policy && typeof policy["undeclared_tagged"] === "string" ? policy["undeclared_tagged"] : undefined;
+            if (undeclaredTagged !== undefined && SATISFIES_NEVER.has(undeclaredTagged))
+                continue;
+            flagged.add(root);
+            const found = undeclaredTagged === undefined
+                ? "leaves undeclared_tagged unset, which defaults to \"delete\""
+                : `sets undeclared_tagged = "${undeclaredTagged}"`;
+            diagnostics.push({
+                checkId: "TF026",
+                severity: "error",
+                message: `Root module "${root}" declares delete: "never" (terraform.roots.${root}.delete), but its ` +
+                    `policy block ${found}. Add undeclared_tagged = "keep" (or "untag" or "report") to the live ` +
+                    "block's policy block, or change this root's delete mode.",
+                entity: name,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf027.js

@@ -0,0 +1,66 @@
+/**
+ * TF027: a live root's `policy` block sets `undeclared_untagged = "delete"`.
+ *
+ * The `undeclared_untagged` quadrant covers a live resource this estate never
+ * marked and the configuration does not declare, a resource chant does not
+ * own. `"delete"` there is account-scoped reconciliation: choudoufu compares
+ * the configuration against everything a `scope` block reaches and removes
+ * what is not in it. chant never proposes deleting a resource it does not
+ * own, and neither does an Op it generates, so the setting is refused on any
+ * live root the project builds, scoped or not. Narrowing the estate's own
+ * ownership answer (`undeclared_tagged`, which TF026 checks against
+ * `delete: "never"`) is the setting to reach for instead.
+ *
+ * `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`) makes the
+ * same refusal when it builds, but only for a project on a `chant.config.json`
+ * whose root it can resolve synchronously (#2216): a `chant.config.ts` is
+ * project-authored code that `resolveRootModeSync` will not evaluate, so the
+ * composite reads the root as stock and never asks the policy question. This
+ * check reads `props.mode` off the parsed HCL instead, which the build stamps
+ * on every entity whatever the config file is written in, so it is the
+ * refusal that actually fires. It also fires for a live root with no apply Op
+ * at all, since the setting is a statement about the estate rather than about
+ * one Op.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity,
+ * the same entity TF024, TF025 and TF026 fire from.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE } from "../../hcl/parse.js";
+import { policyBlockOf } from "./tf026.js";
+export const tf027 = {
+    id: "TF027",
+    description: "Live root's policy block sets undeclared_untagged = \"delete\", which deletes resources chant does not own",
+    check(ctx) {
+        const diagnostics = [];
+        const flagged = new Set();
+        for (const [name, entity] of ctx.entities) {
+            if (entity.entityType !== LIVE_TYPE)
+                continue;
+            if (!isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            if (props.mode !== "live")
+                continue;
+            const root = typeof props.root === "string" ? props.root : "";
+            if (flagged.has(root))
+                continue;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const policy = policyBlockOf(body);
+            if (!policy || policy["undeclared_untagged"] !== "delete")
+                continue;
+            flagged.add(root);
+            diagnostics.push({
+                checkId: "TF027",
+                severity: "error",
+                message: `Root module "${root}"'s policy block sets undeclared_untagged = "delete" (account-scoped ` +
+                    "reconciliation, scoped by a `scope` block). chant never proposes deleting a resource it does " +
+                    "not own, and neither does an Op it generates. Remove that setting from the policy block, or " +
+                    "narrow the estate's ownership answer (undeclared_tagged) instead of the account's.",
+                entity: name,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/post-synth/tf028.js

@@ -0,0 +1,83 @@
+/**
+ * TF028: a live root is watched by a `TerraformWatchOp` built in stock mode.
+ *
+ * `TerraformWatchOp`'s `live` flag is declared, not detected: a composite is
+ * built by `chant build` without reading a root module's `.tf` files, so the
+ * Op author says which shape the Plan phase takes and, until #2216, nothing
+ * checked the answer against the root. Leaving it off a live root is silent
+ * and lossy. `live: true` swaps the Plan step for `choudoufuLivePlan`, whose
+ * single read of the live system answers three questions (drift, how many
+ * live resources sit at a declared identity carrying no marker, and how many
+ * of those an exact content match makes claimable); a stock `terraformPlan`
+ * step answers the first alone, so the watch reports drift and stays quiet
+ * about every unowned and adoptable resource in the estate.
+ *
+ * The check runs over the whole built graph because that is where both halves
+ * of the question are: the root's mode is stamped on every parsed entity by
+ * the build (`props.mode`, #2103), and the Op is a `Chant::Op` entity carrying
+ * the composite's own labels. `TerraformWatchOp` itself cross-checks the flag
+ * where it can (`../../op/resolve-root-mode.ts`), but that read is a
+ * `chant.config.json`-only one, so on a `chant.config.ts` project, which is
+ * every project in this repository, this check is what actually fires.
+ *
+ * Read off the labels the composite stamps rather than off the emitted step,
+ * since a stock `terraformPlan -out` step against a live root is correct in
+ * `TerraformApplyOp`: choudoufu v0.13.0 accepts `plan -out` and re-plans
+ * against the file at apply (#2157), so the apply Op builds one shape for
+ * both kinds of root and the step alone says nothing about a mistake.
+ *
+ * One diagnostic per Op, fired from the Op's entity.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isOpEntity } from "@intentius/chant/op/resource";
+/** Every root name the build parsed as live: `terraform.binary: "choudoufu"` plus a declared estate. */
+function liveRootsOf(ctx) {
+    const roots = new Set();
+    for (const entity of ctx.entities.values()) {
+        if (!isResourceDeclarable(entity))
+            continue;
+        const props = entity.props;
+        if (props.mode !== "live" || typeof props.root !== "string")
+            continue;
+        roots.add(props.root);
+    }
+    return roots;
+}
+export const tf028 = {
+    id: "TF028",
+    description: "A live root is watched by a TerraformWatchOp built without live: true",
+    check(ctx) {
+        const liveRoots = liveRootsOf(ctx);
+        if (liveRoots.size === 0)
+            return [];
+        const diagnostics = [];
+        for (const [name, entity] of ctx.entities) {
+            if (!isOpEntity(entity))
+                continue;
+            const props = entity.props;
+            if (!props || typeof props.name !== "string")
+                continue;
+            const labels = (typeof props.labels === "object" && props.labels !== null
+                ? props.labels
+                : {});
+            if (labels.Watch !== "true")
+                continue;
+            if (labels.TerraformMode === "live")
+                continue;
+            const root = labels.TerraformRoot;
+            if (typeof root !== "string" || !liveRoots.has(root))
+                continue;
+            diagnostics.push({
+                checkId: "TF028",
+                severity: "error",
+                message: `Op "${props.name}" watches root module "${root}" in stock mode, but that root runs choudoufu ` +
+                    "with a declared estate. A stock plan reports drift alone and stays quiet about every unowned " +
+                    `and adoptable resource in the estate. Set live: true on this TerraformWatchOp, or drop the ` +
+                    "root's estate if it is not a live root.",
+                entity: name,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};