@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/src/lint/post-synth/tf022.ts

@@ -0,0 +1,61 @@
+/**
+ * TF022: a credential-named attribute of a resource or data source holds a
+ * literal.
+ *
+ * tfsec's `general-secrets-sensitive-in-attribute`, consolidated in its v1
+ * line as `no-plaintext-exposure`, and KICS's `Passwords And Secrets` query.
+ * Broader and noisier than TF007, because a resource body has far more
+ * attributes than a variable has defaults, so the name heuristic does the
+ * gating: an attribute has to read like a credential AND hold a committed
+ * literal before it is reported.
+ *
+ * The value is in git history, in state, and in every plan output, and the
+ * blast radius is whatever the resource is: an RDS master password, a
+ * provider API token, a Kubernetes secret's data. The fix is always the same
+ * shape, a reference rather than a constant, which is what the message says
+ * rather than "remove this".
+ *
+ * Scope: root and child modules alike (#2112). The condition is a property
+ * of the block itself, so a descended module's block is read exactly as a
+ * root's is.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { DATA_TYPE, RESOURCE_TYPE } from "../../hcl/parse";
+import { isSecretName, secretShapedAssignment } from "../secret-shape";
+import { blocksOfTypes, walkAttributes } from "./blocks";
+
+export const tf022: PostSynthCheck = {
+  id: "TF022",
+  description: "Credential-named resource attribute holds a plaintext literal",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const block of blocksOfTypes(ctx, [RESOURCE_TYPE, DATA_TYPE])) {
+      for (const attr of walkAttributes(block.body)) {
+        if (!isSecretName(attr.name)) continue;
+        const shape = secretShapedAssignment(attr.name, attr.value);
+        if (!shape) continue;
+
+        diagnostics.push({
+          checkId: "TF022",
+          severity: "error",
+          message:
+            `"${block.address}" sets \`${attr.path}\` to a plaintext literal (${shape.length} ` +
+            "characters, redacted here). The value is in git history, in state, and in plan output. " +
+            "Replace it with a reference: a `sensitive` variable, or a data source that reads the " +
+            "value from a secret manager at apply time.",
+          entity: `${block.key}.${attr.path}`,
+          lexicon: "terraform",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf024.test.ts

@@ -0,0 +1,42 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf024 } from "./tf024";
+import { parseTerraformRootDir } from "../../hcl/parse";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF024");
+
+async function ctxFor(fixture: string, root = "estate"): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, { binary: "choudoufu" });
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF024: live root declares a backend or cloud block", () => {
+  test("flags a live root with a backend block", async () => {
+    const diags = tf024.check(await ctxFor("live-with-backend"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF024");
+    expect(diags[0].message).toContain("backend");
+    expect(diags[0].message).toContain("Both a backend and a live");
+  });
+
+  test("flags a live root with a cloud block", async () => {
+    const diags = tf024.check(await ctxFor("live-with-cloud"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("cloud");
+  });
+
+  test("passes a live root with neither block", async () => {
+    const diags = tf024.check(await ctxFor("live-clean"));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not fire on a stock root with a backend block (that is TF001's territory)", async () => {
+    const entities = await parseTerraformRootDir(join(fixtures, "live-with-backend"), "estate", undefined, {
+      binary: "terraform", // no estate takes effect: this root stays state mode
+    });
+    const ctx = { outputs: new Map(), entities } as unknown as PostSynthContext;
+    expect(tf024.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/tf024.ts

@@ -0,0 +1,70 @@
+/**
+ * TF024: a live root declares a `backend` or `cloud` block.
+ *
+ * choudoufu refuses this combination at `init`, before any command runs,
+ * naming both blocks that collide: "Both a backend and a live configuration
+ * are present" (a `backend` block) or "Both a cloud and a live configuration
+ * are present" (a `cloud` block). A live root keeps no state to store, since
+ * prior state is a projection rebuilt from the live system every run, so
+ * either block is a contradiction about where the truth lives, not a
+ * redundant setting.
+ *
+ * TF001 is the equivalent check for a stock root (no remote backend is
+ * configured); it explicitly does not fire on a live root, and this check is
+ * why: the two are mutually exclusive by construction; a root is flagged by
+ * at most one of them.
+ *
+ * Scope: root modules only (#2112). A child module's backend or cloud block
+ * is TF015's finding, whatever binary the root runs.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { TERRAFORM_TYPE, type BlockBody } from "../../hcl/parse";
+import { hasBlock } from "./tf001";
+import { isRootScoped } from "./scope";
+
+export const tf024: PostSynthCheck = {
+  id: "TF024",
+  description: "Live root declares a backend or cloud block, which choudoufu refuses",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== TERRAFORM_TYPE) continue;
+      if (!isResourceDeclarable(entity) || !isRootScoped(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const hasBackend = hasBlock(body, "backend");
+      const hasCloud = hasBlock(body, "cloud");
+      if (!hasBackend && !hasCloud) continue;
+
+      flagged.add(root);
+      const blockKind = hasBackend ? "backend" : "cloud";
+      diagnostics.push({
+        checkId: "TF024",
+        severity: "error",
+        message:
+          `Root module "${root}" runs choudoufu with a declared estate and also declares a ` +
+          `${blockKind} block. choudoufu refuses this at init: "Both a ${blockKind} and a live ` +
+          `configuration are present." Remove the ${blockKind} block; a live root keeps no state to store.`,
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf025.test.ts

@@ -0,0 +1,46 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf025 } from "./tf025";
+import { parseTerraformRootDir, type TerraformRootModeOptions } from "../../hcl/parse";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF025");
+
+async function ctxFor(
+  fixture: string,
+  modeOptions: TerraformRootModeOptions = { binary: "choudoufu" },
+  root = "estate",
+): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, modeOptions);
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF025: live root references a non-default terraform.workspace", () => {
+  test("flags a `${terraform.workspace}` reference in a live root's HCL", async () => {
+    const diags = tf025.check(await ctxFor("live-with-workspace-ref"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF025");
+    expect(diags[0].message).toContain("terraform.workspace");
+  });
+
+  test("passes a live root with no reference and no configured workspace", async () => {
+    expect(tf025.check(await ctxFor("live-clean"))).toHaveLength(0);
+  });
+
+  test("flags a live root whose terraform.roots entry configures a non-default workspace", async () => {
+    const diags = tf025.check(await ctxFor("live-clean", { binary: "choudoufu", workspace: "prod" }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('workspace "prod"');
+  });
+
+  test("a workspace of \"default\" is not flagged", async () => {
+    const diags = tf025.check(await ctxFor("live-clean", { binary: "choudoufu", workspace: "default" }));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not fire on a stock root (no estate takes effect under a non-choudoufu binary)", async () => {
+    const diags = tf025.check(await ctxFor("live-with-workspace-ref", { binary: "terraform", workspace: "prod" }));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/tf025.ts

@@ -0,0 +1,101 @@
+/**
+ * TF025: a live root reads a non-default `terraform.workspace`, or configures
+ * one through `terraform.roots`.
+ *
+ * choudoufu refuses any workspace but `default` on a live root, and refuses
+ * `workspace new`/`workspace select` outright: only the default workspace
+ * exists there ("How you run it" in choudoufu's compatibility reference).
+ * Two independent ways a configuration ends up asking for one:
+ *
+ *   - `terraform.roots.<name>.workspace` in `chant.config.*` selects a
+ *     workspace via `TF_WORKSPACE` before any HCL is even read, chant's own
+ *     equivalent of `workspace select`, so it is flagged the same way.
+ *   - A `"${terraform.workspace}"` interpolation anywhere in a block's body
+ *     reads the (necessarily `"default"`) workspace name in configuration,
+ *     which is not itself refused by choudoufu but is dead code on a live
+ *     root and a sign the configuration was written for a workspace-per-
+ *     environment layout that live mode does not support.
+ *
+ * The first fires once per root (it names a root-level config field, not a
+ * particular block); the second fires once per block that contains the
+ * reference, since each is its own thing to fix.
+ *
+ * Scope: the config half is root-only, since it reads a root-level config
+ * field; the reference half reads any block of a live root, a descended child
+ * module's included, and names the call chain that reached it (#2112).
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isRootScoped } from "./scope";
+
+/** Recursively search a parsed HCL body for a `terraform.workspace` reference, un-evaluated interpolations included. */
+function containsWorkspaceRef(value: unknown): boolean {
+  if (typeof value === "string") return /\bterraform\.workspace\b/.test(value);
+  if (Array.isArray(value)) return value.some(containsWorkspaceRef);
+  if (value !== null && typeof value === "object") return Object.values(value).some(containsWorkspaceRef);
+  return false;
+}
+
+export const tf025: PostSynthCheck = {
+  id: "TF025",
+  description: "Live root references a non-default terraform.workspace, which choudoufu refuses",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flaggedRootWorkspace = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as {
+        root?: unknown;
+        body?: unknown;
+        mode?: unknown;
+        workspace?: unknown;
+        address?: unknown;
+      };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+
+      if (
+        typeof props.workspace === "string" &&
+        props.workspace !== "" &&
+        props.workspace !== "default" &&
+        isRootScoped(entity) &&
+        !flaggedRootWorkspace.has(root)
+      ) {
+        flaggedRootWorkspace.add(root);
+        diagnostics.push({
+          checkId: "TF025",
+          severity: "error",
+          message:
+            `Root module "${root}" runs choudoufu with a declared estate and configures workspace ` +
+            `"${props.workspace}" in terraform.roots.${root}. choudoufu refuses any workspace but ` +
+            '"default" on a live root. Remove `workspace` from this root\'s config (or set it to "default").',
+          entity: name,
+          lexicon: "terraform",
+        });
+      }
+
+      if (containsWorkspaceRef(props.body)) {
+        const address = typeof props.address === "string" ? props.address : name;
+        diagnostics.push({
+          checkId: "TF025",
+          severity: "error",
+          message:
+            `"${address}" in root module "${root}" references \`terraform.workspace\`. choudoufu refuses ` +
+            'any workspace but "default" on a live root, so this always resolves to "default" there. ' +
+            "Remove the reference.",
+          entity: name,
+          lexicon: "terraform",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf026.test.ts

@@ -0,0 +1,56 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf026 } from "./tf026";
+import { parseTerraformRootDir } from "../../hcl/parse";
+import type { TerraformDeleteMode } from "../../config";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF026");
+
+async function ctxFor(
+  fixture: string,
+  opts: { binary?: string; delete?: TerraformDeleteMode } = {},
+  root = "estate",
+): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, {
+    binary: opts.binary ?? "choudoufu",
+    delete: opts.delete,
+  });
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF026: delete: \"never\" onto the policy block", () => {
+  test('fires when the policy block is absent (undeclared_tagged defaults to "delete")', async () => {
+    const diags = tf026.check(await ctxFor("live-default", { delete: "never" }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF026");
+    expect(diags[0].message).toContain("unset");
+    expect(diags[0].message).toContain("undeclared_tagged");
+  });
+
+  test('fires when undeclared_tagged is explicitly "delete"', async () => {
+    const diags = tf026.check(await ctxFor("live-explicit-delete", { delete: "never" }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('undeclared_tagged = "delete"');
+  });
+
+  test('passes when undeclared_tagged is "keep"', async () => {
+    const diags = tf026.check(await ctxFor("live-keep", { delete: "never" }));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("passes when delete is not \"never\" at all", async () => {
+    const diags = tf026.check(await ctxFor("live-default", { delete: "owned-only" }));
+    expect(diags).toHaveLength(0);
+    const diagsGated = tf026.check(await ctxFor("live-default", { delete: "gated" }));
+    expect(diagsGated).toHaveLength(0);
+    const diagsUnset = tf026.check(await ctxFor("live-default", {}));
+    expect(diagsUnset).toHaveLength(0);
+  });
+
+  test("does not fire on a stock root even with delete: \"never\" recorded (inert off choudoufu)", async () => {
+    const diags = tf026.check(await ctxFor("live-default", { binary: "terraform", delete: "never" }));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/tf026.ts

@@ -0,0 +1,84 @@
+/**
+ * TF026: a live root declares `delete: "never"` but its `policy` block still
+ * deletes an orphaned marked resource.
+ *
+ * chant's cross-lexicon delete-mode vocabulary (`terraform.roots.<name>.delete`,
+ * `../../config.ts`'s `TerraformDeleteMode`) maps onto choudoufu's `policy`
+ * block: `undeclared_tagged` governs what happens to a resource this estate
+ * marked that the configuration no longer declares, and defaults to
+ * `"delete"` when the `policy` block omits it, or the root declares no
+ * `policy` block at all. `delete: "never"` promises that `TerraformApplyOp`
+ * never proposes deleting a resource it owns, so a root making that promise
+ * has to have actually turned the quadrant's default off — `"keep"`,
+ * `"untag"` or `"report"` all satisfy it; anything else (the unset default,
+ * or an explicit `"delete"`) does not.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity —
+ * the same entity TF024 and TF025 fire from.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, type BlockBody } from "../../hcl/parse";
+
+/** Verbs that satisfy `delete: "never"` for the `undeclared_tagged` quadrant. */
+const SATISFIES_NEVER = new Set(["keep", "untag", "report"]);
+
+/**
+ * The `policy { }` block nested in a `live { }` block's body, hcl2json's own
+ * "one block, wrapped in an array" shape. Exported for TF027 (`./tf027.ts`),
+ * which reads the other quadrant of the same block.
+ */
+export function policyBlockOf(liveBody: BlockBody): BlockBody | undefined {
+  const policy = liveBody["policy"];
+  return Array.isArray(policy) && policy.length > 0 && typeof policy[0] === "object" && policy[0] !== null
+    ? (policy[0] as BlockBody)
+    : undefined;
+}
+
+export const tf026: PostSynthCheck = {
+  id: "TF026",
+  description: "Live root declares delete: \"never\" but its policy leaves undeclared_tagged at \"delete\"",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== LIVE_TYPE) continue;
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown; delete?: unknown };
+      if (props.mode !== "live") continue;
+      if (props.delete !== "never") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const policy = policyBlockOf(body);
+      const undeclaredTagged = policy && typeof policy["undeclared_tagged"] === "string" ? (policy["undeclared_tagged"] as string) : undefined;
+      if (undeclaredTagged !== undefined && SATISFIES_NEVER.has(undeclaredTagged)) continue;
+
+      flagged.add(root);
+      const found =
+        undeclaredTagged === undefined
+          ? "leaves undeclared_tagged unset, which defaults to \"delete\""
+          : `sets undeclared_tagged = "${undeclaredTagged}"`;
+      diagnostics.push({
+        checkId: "TF026",
+        severity: "error",
+        message:
+          `Root module "${root}" declares delete: "never" (terraform.roots.${root}.delete), but its ` +
+          `policy block ${found}. Add undeclared_tagged = "keep" (or "untag" or "report") to the live ` +
+          "block's policy block, or change this root's delete mode.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf027.test.ts

@@ -0,0 +1,62 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf027 } from "./tf027";
+import { parseTerraformRootDir } from "../../hcl/parse";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF027");
+
+async function ctxFor(
+  fixture: string,
+  opts: { binary?: string } = {},
+  root = "estate",
+): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, {
+    binary: opts.binary ?? "choudoufu",
+  });
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe('TF027: undeclared_untagged = "delete" on a live root', () => {
+  test("fires on a policy block that sets it, naming the root and the setting", async () => {
+    const diags = tf027.check(await ctxFor("live-untagged-delete"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF027");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].lexicon).toBe("terraform");
+    expect(diags[0].message).toContain('Root module "estate"');
+    expect(diags[0].message).toContain('undeclared_untagged = "delete"');
+  });
+
+  test("fires even when a scope block narrows the account reconciliation", async () => {
+    const diags = tf027.check(await ctxFor("live-untagged-delete-scoped"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF027");
+  });
+
+  test('passes when the quadrant is set to something else ("report")', async () => {
+    expect(tf027.check(await ctxFor("live-untagged-report"))).toEqual([]);
+  });
+
+  test("passes when the root declares no policy block at all", async () => {
+    expect(tf027.check(await ctxFor("live-default"))).toEqual([]);
+  });
+
+  test("does not fire on a stock root: the policy block is inert off choudoufu", async () => {
+    expect(tf027.check(await ctxFor("live-untagged-delete", { binary: "terraform" }))).toEqual([]);
+  });
+
+  test("fires once per root, not once per live entity", async () => {
+    const a = await parseTerraformRootDir(join(fixtures, "live-untagged-delete"), "estate", undefined, {
+      binary: "choudoufu",
+    });
+    const b = await parseTerraformRootDir(join(fixtures, "live-untagged-delete"), "other", undefined, {
+      binary: "choudoufu",
+    });
+    const entities = new Map([...a, ...b]);
+    const diags = tf027.check({ outputs: new Map(), entities } as unknown as PostSynthContext);
+    expect(diags).toHaveLength(2);
+    expect(diags.map((d) => d.message.match(/Root module "([^"]+)"/)?.[1]).sort()).toEqual(["estate", "other"]);
+  });
+});

package/src/lint/post-synth/tf027.ts

@@ -0,0 +1,74 @@
+/**
+ * TF027: a live root's `policy` block sets `undeclared_untagged = "delete"`.
+ *
+ * The `undeclared_untagged` quadrant covers a live resource this estate never
+ * marked and the configuration does not declare, a resource chant does not
+ * own. `"delete"` there is account-scoped reconciliation: choudoufu compares
+ * the configuration against everything a `scope` block reaches and removes
+ * what is not in it. chant never proposes deleting a resource it does not
+ * own, and neither does an Op it generates, so the setting is refused on any
+ * live root the project builds, scoped or not. Narrowing the estate's own
+ * ownership answer (`undeclared_tagged`, which TF026 checks against
+ * `delete: "never"`) is the setting to reach for instead.
+ *
+ * `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`) makes the
+ * same refusal when it builds, but only for a project on a `chant.config.json`
+ * whose root it can resolve synchronously (#2216): a `chant.config.ts` is
+ * project-authored code that `resolveRootModeSync` will not evaluate, so the
+ * composite reads the root as stock and never asks the policy question. This
+ * check reads `props.mode` off the parsed HCL instead, which the build stamps
+ * on every entity whatever the config file is written in, so it is the
+ * refusal that actually fires. It also fires for a live root with no apply Op
+ * at all, since the setting is a statement about the estate rather than about
+ * one Op.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity,
+ * the same entity TF024, TF025 and TF026 fire from.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, type BlockBody } from "../../hcl/parse";
+import { policyBlockOf } from "./tf026";
+
+export const tf027: PostSynthCheck = {
+  id: "TF027",
+  description: "Live root's policy block sets undeclared_untagged = \"delete\", which deletes resources chant does not own",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== LIVE_TYPE) continue;
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const policy = policyBlockOf(body);
+      if (!policy || policy["undeclared_untagged"] !== "delete") continue;
+
+      flagged.add(root);
+      diagnostics.push({
+        checkId: "TF027",
+        severity: "error",
+        message:
+          `Root module "${root}"'s policy block sets undeclared_untagged = "delete" (account-scoped ` +
+          "reconciliation, scoped by a `scope` block). chant never proposes deleting a resource it does " +
+          "not own, and neither does an Op it generates. Remove that setting from the policy block, or " +
+          "narrow the estate's ownership answer (undeclared_tagged) instead of the account's.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};