@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/composites/terraform-watch-op.test.ts

@@ -4,7 +4,10 @@
  * only the `-no-color` plan text can reach an issue or PR body.
  */
 
-import { describe, test, expect } from "vitest";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, test, expect } from "vitest";
 import {
   isStepOutputRef,
   collectStepOutputRefs,
@@ -45,7 +48,7 @@ describe("TerraformWatchOp phases (#2087)", () => {
     }
   });
 
-  test("the Plan step reports drift as a search attribute", () => {
+  test("the Plan step reports drift as a run outcome", () => {
     const plan = props({ name: "app-watch", root: "app" }).phases[1].steps[0] as ActivityStep;
     expect(plan.fn).toBe("terraformPlan");
     expect(plan.id).toBe("plan");
@@ -71,7 +74,7 @@ describe("TerraformWatchOp phases (#2087)", () => {
 });
 
 describe("TerraformWatchOp finding modes (#2087)", () => {
-  const findingStep = (mode: "issue" | "pull-request"): ActivityStep => {
+  const findingStep = (mode: "issue" | "comment" | "pull-request"): ActivityStep => {
     const op = props({ name: "app-watch", root: "app", findingMode: mode });
     expect(phaseNames(op)).toEqual(["Init", "Plan", "Report"]);
     return op.phases[2].steps[0] as ActivityStep;
@@ -92,6 +95,14 @@ describe("TerraformWatchOp finding modes (#2087)", () => {
     expect(step.outcomeAttribute).toEqual({ name: "PR", from: "prUrl" });
   });
 
+  test("comment mode posts on the triggering pull request and surfaces the comment URL (#2231)", () => {
+    const step = findingStep("comment");
+    expect(step.fn).toBe("reconcilePr");
+    expect(step.args?.mode).toBe("comment");
+    expect(step.args?.env).toBe("app");
+    expect(step.outcomeAttribute).toEqual({ name: "Comment", from: "commentUrl" });
+  });
+
   test("the finding step derives no plan of its own", () => {
     // `entries: []` is what stops reconcilePr shelling to `chant lifecycle
     // plan --json`: the finding is already written by the time it runs.
@@ -114,7 +125,7 @@ describe("TerraformWatchOp finding modes (#2087)", () => {
 });
 
 describe("TerraformWatchOp posts the human plan and never the plan JSON (#2087)", () => {
-  for (const mode of ["issue", "pull-request"] as const) {
+  for (const mode of ["issue", "comment", "pull-request"] as const) {
     test(`${mode}: the body is a reference to the Plan step's -no-color text`, () => {
       const op = props({ name: "app-watch", root: "app", findingMode: mode });
       const report = op.phases[2].steps[0] as ActivityStep;
@@ -145,40 +156,169 @@ describe("TerraformWatchOp posts the human plan and never the plan JSON (#2087)"
   });
 });
 
-describe("TerraformWatchOp schedule (#2087)", () => {
-  test("omitting `schedule` returns no schedule", () => {
-    const result = TerraformWatchOp({ name: "app-watch", root: "app" });
-    expect(result.schedule).toBeUndefined();
-    expect(Object.prototype.hasOwnProperty.call(result, "schedule")).toBe(false);
+describe("TerraformWatchOp on a live root (#2105)", () => {
+  const live = (over: Partial<Parameters<typeof TerraformWatchOp>[0]> = {}): OpConfig =>
+    props({ name: "estate-watch", root: "estate", live: true, ...over });
+
+  test("the Plan step is choudoufuLivePlan, and Init is unchanged", () => {
+    const op = live();
+    expect(phaseNames(op)).toEqual(["Init", "Plan"]);
+    expect(steps(op).map((s) => s.fn)).toEqual(["terraformInit", "choudoufuLivePlan"]);
   });
 
-  test("a cron returns a Temporal::Schedule beside the Op", () => {
-    const { op, schedule } = TerraformWatchOp({
-      name: "app-watch",
-      root: "app",
-      schedule: "0 6 * * *",
+  test("one live read publishes Drift, Unowned and Adoptable", () => {
+    const plan = live().phases[1].steps[0] as ActivityStep;
+    expect(plan.id).toBe("plan");
+    // `drift` off `-detailed-exitcode`, `unowned`/`adoptable` off the same
+    // run's #788 document: three answers, one estate-wide sweep.
+    expect(plan.outcomeAttribute).toEqual([
+      { name: "Drift", from: "drift" },
+      { name: "Unowned", from: "unowned" },
+      { name: "Adoptable", from: "adoptable" },
+    ]);
+  });
+
+  test("the Op is marked live, and no plan file is named anywhere", () => {
+    const op = live();
+    expect(op.labels).toMatchObject({ TerraformMode: "live" });
+    expect(JSON.stringify(op)).not.toContain("chant.tfplan");
+  });
+
+  test("planFile on a live root is refused at build time, quoting choudoufu", () => {
+    expect(() => live({ planFile: "estate.tfplan" })).toThrow(/planFile is refused on a live root/);
+  });
+
+  test("estate off a live root is refused: there is no live plan to name one for", () => {
+    expect(() => props({ name: "app-watch", root: "app", estate: "prod" })).toThrow(/not on a live root/);
+  });
+
+  test("an explicit estate rides the Plan step", () => {
+    const plan = live({ estate: "prod-networking" }).phases[1].steps[0] as ActivityStep;
+    expect(plan.args?.estate).toBe("prod-networking");
+  });
+
+  test("a stock root is untouched: still terraformPlan, still one Drift attribute", () => {
+    const plan = props({ name: "app-watch", root: "app" }).phases[1].steps[0] as ActivityStep;
+    expect(plan.fn).toBe("terraformPlan");
+    expect(plan.outcomeAttribute).toEqual({ name: "Drift", from: "changed" });
+  });
+
+  for (const mode of ["issue", "comment", "pull-request"] as const) {
+    test(`${mode}: the body is the plan text plus the adoption ledger, as one field`, () => {
+      const op = live({ findingMode: mode });
+      expect(phaseNames(op)).toEqual(["Init", "Plan", "Report"]);
+      const report = op.phases[2].steps[0] as ActivityStep;
+      expect(report.fn).toBe("reconcilePr");
+      expect(isStepOutputRef(report.args?.body)).toBe(true);
+      expect(report.args?.body).toMatchObject({ step: "plan", path: "finding" });
     });
-    expect(schedule).toBeDefined();
-    expect(schedule!.entityType).toBe("Temporal::Schedule");
-    expect(schedule!.lexicon).toBe("temporal");
-    expect((schedule as unknown as { props: Record<string, unknown> }).props).toEqual({
-      scheduleId: "app-watch-schedule",
-      spec: { cronExpressions: ["0 6 * * *"] },
-      action: { workflowType: "appWatchWorkflow", taskQueue: "app-watch" },
+
+    test(`${mode}: no reference to the live-plan document reaches the body`, () => {
+      // On a live root the JSON is choudoufu's bound/omissions/unowned
+      // document: live identities and tag values for every resource the
+      // estate touched. Same rule as the stock plan's JSON, same test.
+      const op = live({ findingMode: mode });
+      const report = op.phases[2].steps[0] as ActivityStep;
+      const paths = collectStepOutputRefs(report.args).map((r) => r.path);
+      expect(paths).toEqual(["finding"]);
+      expect(paths).not.toContain("json");
+      expect(JSON.stringify(report.args)).not.toContain("json");
     });
-    expect((op as unknown as { props: OpConfig }).props.taskQueue).toBe("app-watch");
+  }
+
+  test("the whole live Op references exactly one field of the plan", () => {
+    const op = live({ findingMode: "issue" });
+    const refs = op.phases.flatMap((p) => p.steps.filter(isActivity)).flatMap((s) => collectStepOutputRefs(s.args));
+    expect(refs).toHaveLength(1);
+    expect(refs[0]).toMatchObject({ step: "plan", path: "finding" });
+  });
+});
+
+describe("TerraformWatchOp schedule (#2087, #2120)", () => {
+  test("omitting `schedule` leaves the Op with no cadence", () => {
+    const { op } = TerraformWatchOp({ name: "app-watch", root: "app" });
+    expect((op as unknown as { props: OpConfig }).props).not.toHaveProperty("schedule");
   });
 
-  test("an explicit taskQueue reaches both the Op and the schedule action", () => {
-    const { op, schedule } = TerraformWatchOp({
+  test("a cron lands on the Op itself", () => {
+    const { op } = TerraformWatchOp({
       name: "app-watch",
       root: "app",
       schedule: "0 6 * * *",
-      taskQueue: "infra",
     });
-    expect((op as unknown as { props: OpConfig }).props.taskQueue).toBe("infra");
-    expect(
-      ((schedule as unknown as { props: { action: { taskQueue: string } } }).props.action).taskQueue,
-    ).toBe("infra");
+    expect((op as unknown as { props: OpConfig }).props.schedule).toEqual({
+      cron: "0 6 * * *",
+      overlap: "skip",
+    });
+  });
+});
+
+/**
+ * The `live` flag against the root it names (#2216). Best-effort: the mode
+ * resolves from a `chant.config.json` only, so these projects are written in
+ * that format. TF028 (`../lint/post-synth/tf028.ts`) is what reports the same
+ * mismatch on a `chant.config.ts` project, where the mode does not resolve
+ * here at all.
+ */
+describe("TerraformWatchOp cross-checks live against the root's mode (#2216)", () => {
+  const dirs: string[] = [];
+
+  afterEach(() => {
+    for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+  });
+
+  const LIVE_ROOT = [
+    "terraform {",
+    "  live {",
+    '    estate = "prod-estate"',
+    "  }",
+    "}",
+    "",
+  ].join("\n");
+
+  /** A project on a `chant.config.json` whose root `estate` is `mainTf`, run on `binary`. */
+  function project(binary: string, mainTf: string): string {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf-watch-mode-"));
+    dirs.push(dir);
+    mkdirSync(join(dir, "estate"), { recursive: true });
+    writeFileSync(join(dir, "estate", "main.tf"), mainTf);
+    writeFileSync(
+      join(dir, "chant.config.json"),
+      JSON.stringify({ terraform: { binary, roots: { estate: { dir: "./estate" } } } }),
+    );
+    return dir;
+  }
+
+  test("refuses a live root watched in stock mode, naming the Op and the root", () => {
+    const cwd = project("choudoufu", LIVE_ROOT);
+    expect(() => TerraformWatchOp({ name: "estate-watch", root: "estate", cwd })).toThrow(
+      /TerraformWatchOp "estate-watch": root "estate" runs choudoufu with a declared estate/,
+    );
+  });
+
+  test("accepts the same root with live: true", () => {
+    const cwd = project("choudoufu", LIVE_ROOT);
+    expect(() => TerraformWatchOp({ name: "estate-watch", root: "estate", live: true, cwd })).not.toThrow();
+  });
+
+  test("refuses live: true on a root that declares no estate", () => {
+    const cwd = project("choudoufu", 'resource "null_resource" "first" {}\n');
+    expect(() => TerraformWatchOp({ name: "app-watch", root: "estate", live: true, cwd })).toThrow(
+      /declares no estate/,
+    );
+  });
+
+  test("refuses live: true when the binary is not choudoufu, whatever the root declares", () => {
+    const cwd = project("terraform", LIVE_ROOT);
+    expect(() => TerraformWatchOp({ name: "app-watch", root: "estate", live: true, cwd })).toThrow(
+      /declares no estate/,
+    );
+  });
+
+  test("says nothing when the mode does not resolve: no config to read", () => {
+    const dir = mkdtempSync(join(tmpdir(), "chant-tf-watch-mode-"));
+    dirs.push(dir);
+    expect(() => TerraformWatchOp({ name: "app-watch", root: "estate", cwd: dir })).not.toThrow();
+    expect(() => TerraformWatchOp({ name: "app-watch", root: "estate", live: true, cwd: dir })).not.toThrow();
   });
 });

package/src/composites/terraform-watch-op.ts

@@ -7,7 +7,7 @@
  * the plan found. `terraform plan -detailed-exitcode` is the whole mechanism.
  * Exit 0 is "the world matches the configuration", exit 2 is drift, and
  * `terraformPlan` turns that into the boolean `changed`, which rides out of
- * the Op as the `Drift` search attribute.
+ * the Op as the run's `Drift` outcome.
  *
  * Phases: Init, Plan, and (for a finding mode that opens something) Report.
  *
@@ -23,37 +23,59 @@
  * post the JSON, and `terraform-watch-op.test.ts` asserts no reference to it
  * reaches the finding step.
  *
+ * The same rule holds on a live root, where the JSON is choudoufu's own
+ * bound/omissions/unowned document rather than a plan representation, and
+ * carries live identities and tag values for every resource the estate
+ * touched. `choudoufuLivePlan` composes the plan text and the adoption ledger
+ * into one `finding` string for exactly this reason: the body is one
+ * reference to one text field, so there is no arrangement of the args in
+ * which the document reaches a body.
+ *
+ * ## A live root reports three things, not one (#2105)
+ *
+ * `live: true` swaps the Plan step for `choudoufuLivePlan`. On a choudoufu
+ * root ownership is a pair of tags on the resource rather than an entry in a
+ * state file, so a plan against the live system can answer three questions
+ * where a stock plan answers one: whether the estate drifted (the
+ * `-detailed-exitcode` exit, `Drift` as before), how many live resources sit
+ * at a declared identity carrying no marker (`Unowned`), and how many of those
+ * an exact content match makes claimable (`Adoptable`). All three come off a
+ * single live read, published as three run outcomes from the one step.
+ *
+ * The finding modes then carry the adoption ledger under the plan text: one
+ * line per adoptable match with its address, its live identity and the
+ * `tofu-estate`/`tofu-address` values that claim it, in the row form
+ * `live-plan -adoption-only` prints, followed by any contested address. That
+ * is a report, not an action. `TerraformAdoptOp` next door is what writes the
+ * markers, and it gates first.
+ *
  * ## Findings reuse `reconcilePr`
  *
- * `issue` and `pull-request` call the temporal lexicon's `reconcilePr`
- * activity, the one place in chant that shells to `gh issue create` /
- * `gh pr create`, rather than growing a second copy of those calls here.
+ * `issue`, `comment` and `pull-request` call core's `reconcilePr` activity,
+ * the one place in chant that shells to `gh`, rather than growing a second
+ * copy of those calls here.
  * That activity built its own change-set summary and had no way to be handed
  * one, so #2087 added a single field to it (`ReconcilePrArgs.body`), which is
  * what carries the `-no-color` plan through. Note that the pull-request mode
  * of `reconcilePr` regenerates chant TypeScript via `chant import`; a
- * terraform-native regeneration of HCL from live state is #2089, so until
- * then `findingMode: "issue"` is the mode with an end-to-end answer and
- * `"pull-request"` opens a PR whose body is the plan.
+ * terraform-native regeneration of HCL from live state is #2089, so
+ * `findingMode: "issue"` is the mode with an end-to-end answer and
+ * `"pull-request"` opens a PR whose body is the plan. `"comment"` (#2231) is
+ * the mode for the plan-on-pull-request shape: the plan is posted onto the
+ * pull request that triggered the run and re-edited there on the next push,
+ * which is where a reviewer is already looking. It needs that trigger; a run
+ * without one fails the Report step by name rather than posting elsewhere. On a live root #2089's
+ * question has a different answer rather than a pending one, and it is not
+ * regeneration: see `TerraformAdoptOp`.
  *
  * ## The schedule
  *
- * A cron makes this a `{ op, schedule }` pair, the shape
- * `lexicons/temporal/src/composites/workflow-audit-op.ts` and
- * `reconcile-op.ts` return. The schedule resource is `Temporal::Schedule`,
- * built here through core's own `createResource` rather than imported from
- * `@intentius/chant-lexicon-temporal`: no lexicon in this repo imports
- * another lexicon's package at runtime, and a static import would mean a
- * project that installs terraform and runs `chant run` on the local executor
- * could not load `@intentius/chant-lexicon-terraform` at all without also
- * installing temporal. The declarable is the same one temporal's
- * `TemporalSchedule` produces (`createResource("Temporal::Schedule",
- * "temporal", {})`, `lexicons/temporal/src/resources.ts`), so temporal's
- * serializer renders it unchanged when a project has both.
- *
- * A project with no Temporal at all runs the same Op on a CI cron instead:
- * `generateOpsPipeline` against the github lexicon turns the Op plus its cron
- * into a workflow. `examples/scheduled-watch/` is that recipe.
+ * A cron lands on the Op itself as `schedule` (#2120), the same field
+ * `WatchOp` and `ConvergeOp` set. It is runtime-neutral data: `chant
+ * operator` reads it as this Op's tick cadence, `generateOpsPipeline` against
+ * the github lexicon renders it as a CI cron, and a hosting lexicon hands it
+ * to its own scheduler. The one-shot `chant run app-watch` path ignores it.
+ * `examples/scheduled-watch/` is the CI recipe.
  *
  * @example
  * ```typescript
@@ -62,59 +84,100 @@
  * // one-shot, local executor: chant run app-watch
  * export const { op } = TerraformWatchOp({ name: "app-watch", root: "app" });
  *
+ * // the plan as a sticky comment on the pull request that triggered the run
+ * export const { op } = TerraformWatchOp({
+ *   name: "app-plan",
+ *   root: "app",
+ *   findingMode: "comment",
+ * });
+ *
  * // nightly, opening an issue when the plan is non-empty
- * export const { op, schedule } = TerraformWatchOp({
+ * export const { op } = TerraformWatchOp({
  *   name: "app-watch",
  *   root: "app",
  *   schedule: "0 6 * * *",
  *   findingMode: "issue",
  * });
+ *
+ * // a choudoufu estate: drift, unowned and adoptable, with the ledger in the issue
+ * export const { op } = TerraformWatchOp({
+ *   name: "estate-watch",
+ *   root: "estate",
+ *   live: true,
+ *   findingMode: "issue",
+ * });
  * ```
  */
 
 import { Op, phase, OpResource, type ActivityStep } from "@intentius/chant/op";
-import { createResource } from "@intentius/chant/runtime";
-import type { Declarable } from "@intentius/chant/declarable";
-import { DEFAULT_PLAN_FILE } from "../op/activities/terraform";
-import { terraformInit as initStep, terraformPlan as planStep } from "../op/builders";
+import { resolveRootModeSync } from "../op/resolve-root-mode";
+import { CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, DEFAULT_PLAN_FILE } from "../op/activities/terraform";
+import {
+  terraformInit as initStep,
+  terraformPlan as planStep,
+  choudoufuLivePlan as livePlanStep,
+} from "../op/builders";
 
 /**
  * What to do with a non-empty plan. A subset of core's `OpFindingMode`
  * (`packages/core/src/lexicon.ts`): `merge-request` is GitLab's spelling of
  * `pull-request` and is produced by the CI generator, not chosen here.
+ *
+ * `comment` (#2231) is the mode a plan-on-pull-request Op wants: the plan
+ * lands as one comment on the pull request that triggered the run and the
+ * next push edits that same comment. It needs a `pull_request` trigger on the
+ * `ScheduledOpSpec` the workflow is generated from, and the github generator
+ * refuses it by name on any other trigger.
  */
-export type TerraformFindingMode = "report" | "issue" | "pull-request";
-
-/**
- * `Temporal::Schedule`, built without importing the temporal lexicon. See the
- * module doc for why. Identical to `TemporalSchedule` in
- * `lexicons/temporal/src/resources.ts`.
- */
-const ScheduleResource = createResource("Temporal::Schedule", "temporal", {});
-
-/** `app-watch` becomes `appWatchWorkflow`, matching the temporal serializer's naming. */
-function kebabToCamel(s: string): string {
-  return s.replace(/-([a-z])/g, (_, c: string) => c.toUpperCase());
-}
+export type TerraformFindingMode = "report" | "issue" | "comment" | "pull-request";
 
 export interface TerraformWatchOpConfig {
-  /** Op name (kebab-case). Also the default task queue and schedule id base. */
+  /** Op name (kebab-case). */
   name: string;
   /** Key into the project's `terraform.roots`. The root carries dir, workspace, var files and backend config. */
   root: string;
   /**
-   * Cron expression. When set, a `Temporal::Schedule` is returned alongside
-   * the Op; omit for one-shot `chant run` on the local executor, or for a CI
-   * cron built by `generateOpsPipeline`.
+   * Cron expression. When set, it lands on the Op as `schedule` — the cadence
+   * `chant operator` ticks on and `generateOpsPipeline` renders as a CI cron.
+   * Omit for one-shot `chant run` on the local executor.
    */
   schedule?: string;
   /**
    * What to do when the plan proposes changes. Default: `"report"`, which
-   * opens nothing. The `Drift` search attribute and the run's own log are
+   * opens nothing. The `Drift` run outcome and the run's own log are
    * the report.
    */
   findingMode?: TerraformFindingMode;
-  /** Plan file the Plan step writes, relative to the root dir. Default: `chant.tfplan`. */
+  /**
+   * Watch a live root (#2105): the root runs `terraform.binary: "choudoufu"`
+   * and declares an estate, so the Plan phase is `choudoufuLivePlan` rather
+   * than `terraformPlan`. See the module doc for what changes.
+   *
+   * Declared here rather than detected, because a composite is built by
+   * `chant build` without reading a root module's `.tf` files. The activities
+   * detect the estate at run time (`op/activities/live-detect.ts`), but by then
+   * the phases are already serialized.
+   *
+   * Two things check the answer against the root's real mode, since a wrong
+   * one is otherwise silent (#2216). This function refuses a mismatch outright
+   * when it can resolve the mode synchronously, which is a
+   * `chant.config.json` project (`op/resolve-root-mode.ts`); TF028
+   * (`lint/post-synth/tf028.ts`) reports the same mismatch off the parsed HCL
+   * for every project, `chant.config.ts` included.
+   */
+  live?: boolean;
+  /**
+   * The estate to plan against, for a live root whose estate this Op should
+   * name explicitly. Omitted, `choudoufuLivePlan` auto-detects it from the
+   * root's own `live` block or `estate.chdf.hcl` sidecar, which is the usual
+   * case. Refused on a stock root.
+   */
+  estate?: string;
+  /**
+   * Plan file the Plan step writes, relative to the root dir. Default:
+   * `chant.tfplan`. Refused on a live root, where choudoufu takes no plan file
+   * at all.
+   */
   planFile?: string;
   /** `-upgrade` on the Init step: re-resolve provider and module versions. */
   upgrade?: boolean;
@@ -129,27 +192,72 @@ export interface TerraformWatchOpConfig {
   title?: string;
   /** Branch the pull-request mode opens from. Default: `reconcilePr`'s own. */
   branch?: string;
-  /** Override the task queue. Defaults to `name`. */
-  taskQueue?: string;
 }
 
 export interface TerraformWatchOpResources {
-  /** Op resource. Generates the Init/Plan/[Report] workflow. */
+  /** Op resource. Generates the Init/Plan/[Report] phases. */
   op: InstanceType<typeof OpResource>;
-  /** `Temporal::Schedule`, present only when `schedule` was given. */
-  schedule?: Declarable;
 }
 
 export function TerraformWatchOp(config: TerraformWatchOpConfig): TerraformWatchOpResources {
-  const taskQueue = config.taskQueue ?? config.name;
-  const planFile = config.planFile ?? DEFAULT_PLAN_FILE;
   const findingMode: TerraformFindingMode = config.findingMode ?? "report";
   const where = config.cwd ? { cwd: config.cwd } : {};
 
-  // `id` is what makes `plan.out` legal, and `plan.out.text` is the only
-  // channel by which any part of the plan leaves this Op.
-  const plan = planStep(config.root, { planFile, ...where, id: "plan" });
-  plan.outcomeAttribute = { name: "Drift", from: "changed" };
+  if (config.live && config.planFile !== undefined) {
+    throw new Error(
+      `TerraformWatchOp "${config.name}": planFile is refused on a live root. choudoufu: ` +
+        `"${CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL}". A live plan writes no saved plan, so there is no file to name; ` +
+        "drop planFile, or drop live if this root runs stock.",
+    );
+  }
+  if (!config.live && config.estate !== undefined) {
+    throw new Error(
+      `TerraformWatchOp "${config.name}": estate names the estate a live plan looks for markers of, and ` +
+        "this Op is not on a live root. Set live: true, or drop estate.",
+    );
+  }
+
+  // The `live` flag against the root it names. Best-effort and synchronous:
+  // `resolveRootModeSync` reads a `chant.config.json` only and returns
+  // undefined for anything else, so a `chant.config.ts` project reaches
+  // neither branch and TF028 is what reports the mismatch there. Where the
+  // mode does resolve, refusing at build time names the Op, which a
+  // post-synth diagnostic does too but a run-time failure at the first step
+  // does not.
+  const resolvedMode = resolveRootModeSync(config.root, config.cwd)?.mode;
+  if (resolvedMode === "live" && !config.live) {
+    throw new Error(
+      `TerraformWatchOp "${config.name}": root "${config.root}" runs choudoufu with a declared estate, ` +
+        "but this Op watches it in stock mode. A stock plan reports drift alone and stays quiet about " +
+        "every unowned and adoptable resource in the estate. Set live: true.",
+    );
+  }
+  if (resolvedMode === "state" && config.live) {
+    throw new Error(
+      `TerraformWatchOp "${config.name}": live: true, but root "${config.root}" declares no estate (or ` +
+        "terraform.binary is not \"choudoufu\"), so there is no live system to plan against. Drop " +
+        "live, or declare the root's estate.",
+    );
+  }
+
+  // `id` is what makes `plan.out` legal, and one field of `plan.out` is the
+  // only channel by which any part of the plan leaves this Op.
+  //
+  // A live root reads the live system instead of a state file, so the three
+  // things a watch reports come off one `choudoufuLivePlan`: `drift` from
+  // `-detailed-exitcode`, and `unowned`/`adoptable` from the `-json` document
+  // the same run wrote. Three attributes, one live read: see
+  // `ActivityStep.outcomeAttribute`'s array form (#2105).
+  const plan = config.live
+    ? livePlanStep(config.root, { ...where, ...(config.estate ? { estate: config.estate } : {}), id: "plan" })
+    : planStep(config.root, { planFile: config.planFile ?? DEFAULT_PLAN_FILE, ...where, id: "plan" });
+  plan.outcomeAttribute = config.live
+    ? [
+        { name: "Drift", from: "drift" },
+        { name: "Unowned", from: "unowned" },
+        { name: "Adoptable", from: "adoptable" },
+      ]
+    : { name: "Drift", from: "changed" };
 
   const phases = [
     phase("Init", [initStep(config.root, { ...where, ...(config.upgrade ? { upgrade: true } : {}) })]),
@@ -169,36 +277,36 @@ export function TerraformWatchOp(config: TerraformWatchOpConfig): TerraformWatch
         mode: findingMode,
         entries: [],
         title: config.title ?? `Terraform drift in root "${config.root}"`,
-        body: plan.out.text,
+        // Stock: the `-no-color` plan. Live: the same plan text with the
+        // adoption ledger under it, which `choudoufuLivePlan` composes into
+        // one `finding` field precisely so that a body is one reference and
+        // the `-json` document has no path into one at all.
+        body: config.live ? plan.out.finding : plan.out.text,
         ...(config.branch ? { branch: config.branch } : {}),
       },
       outcomeAttribute:
-        findingMode === "pull-request" ? { name: "PR", from: "prUrl" } : { name: "Issue", from: "issueUrl" },
+        findingMode === "pull-request"
+          ? { name: "PR", from: "prUrl" }
+          : findingMode === "comment"
+            ? { name: "Comment", from: "commentUrl" }
+            : { name: "Issue", from: "issueUrl" },
     };
     phases.push(phase("Report", [report]));
   }
 
   const op = Op({
     name: config.name,
-    overview: `Plan the "${config.root}" terraform root and report drift`,
-    taskQueue,
-    searchAttributes: {
+    overview: config.live
+      ? `Live-plan the "${config.root}" choudoufu estate and report drift, unowned and adoptable resources`
+      : `Plan the "${config.root}" terraform root and report drift`,
+    labels: {
       Watch: "true",
       TerraformRoot: config.root,
+      ...(config.live ? { TerraformMode: "live" } : {}),
     },
+    ...(config.schedule ? { schedule: { cron: config.schedule, overlap: "skip" as const } } : {}),
     phases,
   });
 
-  if (!config.schedule) return { op };
-
-  const schedule = new ScheduleResource({
-    scheduleId: `${config.name}-schedule`,
-    spec: { cronExpressions: [config.schedule] },
-    action: {
-      workflowType: kebabToCamel(config.name) + "Workflow",
-      taskQueue,
-    },
-  });
-
-  return { op, schedule };
+  return { op };
 }

package/src/config.ts

@@ -25,6 +25,20 @@
 import { z } from "zod";
 import type { ChantConfig } from "@intentius/chant/config";
 
+/**
+ * chant's cross-lexicon delete-mode vocabulary (`lexicons/k8s/src/op/
+ * activities/kubectl.ts`'s `ApplyDeleteMode`, `packages/core/src/op/
+ * activities/apply.ts`'s `DeleteMode`), read here for a live root and mapped
+ * onto choudoufu's `policy` block (#2106): `"never"` requires the root's
+ * `policy` to set `undeclared_tagged` to `"keep"`, `"untag"` or `"report"`
+ * (TF026 enforces this at build time); `"owned-only"` is choudoufu's own
+ * default verb for that quadrant (`delete`) and needs nothing; `"gated"`
+ * needs nothing beyond `TerraformApplyOp`'s own approval gate. Inert on a
+ * stock root: choudoufu's `policy` block does not exist there.
+ */
+export const terraformDeleteModeSchema = z.enum(["never", "owned-only", "gated"]);
+export type TerraformDeleteMode = z.infer<typeof terraformDeleteModeSchema>;
+
 /**
  * One Terraform root module chant reads. `dir` is the only required field:
  * everything else names how the root is invoked rather than what it declares.
@@ -43,14 +57,29 @@ export const terraformRootSchema = z.strictObject({
   varFiles: z.array(z.string()).optional(),
   /** `-backend-config` key/value pairs handed to `init`. */
   backendConfig: z.record(z.string(), z.string()).optional(),
+  /** This root's declared delete mode. See {@link terraformDeleteModeSchema}. */
+  delete: terraformDeleteModeSchema.optional(),
 });
 
 export const terraformConfigSchema = z.strictObject({
   /**
-   * Which CLI drives the roots. The two are wire-compatible for everything
-   * this lexicon does, so the choice is recorded rather than inferred.
+   * Which CLI drives the roots. `terraform` and `tofu` are wire-compatible
+   * for everything this lexicon does, so the choice is recorded rather than
+   * inferred. `choudoufu` (#2103) is an OpenTofu fork: a root running it also
+   * needs a declared estate (a `live` block or an `estate.chdf.hcl` sidecar,
+   * seen by the shared HCL parse) before it counts as live. Declaring the
+   * binary alone runs the root stock, exactly as `terraform`/`tofu` do.
+   */
+  binary: z.enum(["terraform", "tofu", "choudoufu"]).optional(),
+  /**
+   * How far a root's parse follows its `module` calls (#2112), spelled the
+   * way tflint spells it. `local` (the default) reads modules sourced from a
+   * relative path, so TF014, TF015 and TF020 see inside them; `none` reads
+   * only each root's own directory; `all` is reserved for fetching registry
+   * and git modules and is refused with a message, since chant fetches
+   * nothing. See `hcl/descend.ts`.
    */
-  binary: z.enum(["terraform", "tofu"]).optional(),
+  callModuleType: z.enum(["local", "none", "all"]).optional(),
   /** Named root modules. The name is the entity-key prefix, so keep it stable. */
   roots: z.record(z.string(), terraformRootSchema),
 });