@intentius/chant-lexicon-terraform 0.58.0 → 0.60.0

package/src/lint/post-synth/tf001.ts

@@ -1,12 +1,25 @@
 /**
  * TF001: a root module keeps its state on local disk.
  *
- * A `terraform` block with no `backend "<type>"` and no `cloud {}` falls back
- * to the local backend, which puts `terraform.tfstate` in the working
- * directory. That file holds every attribute of every managed resource,
- * secrets included, and it is not shared, not locked, and not versioned. The
- * first apply from a second machine or a CI runner starts from an empty state
- * and proposes to create the estate again.
+ * Two ways a root gets there, and this reports both (#2218). A `terraform`
+ * block with no `backend "<type>"` and no `cloud {}` falls back to the local
+ * backend implicitly. A `backend "local"` block asks for the same backend by
+ * name. Either way `terraform.tfstate` lands in the working directory, and
+ * that file holds every attribute of every managed resource, secrets
+ * included, and it is not shared, not locked, and not versioned. The first
+ * apply from a second machine or a CI runner starts from an empty state and
+ * proposes to create the estate again.
+ *
+ * So the rule reads the backend block's TYPE LABEL rather than its presence:
+ * the id means "no remote backend", which is what its name, its message and
+ * its page have always argued. `cloud {}` counts as remote (it is Terraform
+ * Cloud / HCP state, held off the machine and locked). Every other backend
+ * type is taken as remote without a list to maintain, since `local` is the
+ * only backend Terraform ships that writes to the working directory.
+ *
+ * A root that keeps local state on purpose says so with a
+ * `# chant-ignore-block: TF001` on the line above its `terraform` block
+ * (chant #2111), which is what the three shipped examples do.
  *
  * One diagnostic per root, fired from the root's `terraform` block. A root
  * with no `terraform` block at all is not flagged: it declares no version
@@ -46,6 +59,39 @@ export function hasBlock(body: BlockBody, key: string): boolean {
   return typeof a.value === "object" && a.value !== null ? Object.keys(a.value).length > 0 : true;
 }
 
+/** The one backend type that writes state to the working directory. */
+export const LOCAL_BACKEND = "local";
+
+/**
+ * The type labels of the `backend` blocks in a `terraform` block body.
+ *
+ * `backend` takes one label, so hcl2json nests it one level deeper than an
+ * unlabelled block: `backend "s3" { bucket = "b" }` is
+ * `{ backend: { s3: [{ bucket: "b" }] } }`, where `cloud { ... }` is just
+ * `{ cloud: [{ ... }] }`. The keys of that inner object are the labels, which
+ * is the only place the type survives the parse. A malformed body that puts
+ * an array or a scalar under `backend` yields no labels, and the caller then
+ * treats the root as having no remote backend, the same verdict a missing
+ * block gets.
+ */
+export function backendTypes(body: BlockBody): string[] {
+  const a = attr(body, "backend");
+  if (a.kind === "absent") return [];
+  const value = a.value;
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return [];
+  return Object.keys(value);
+}
+
+/**
+ * Whether the body configures state somewhere other than the working
+ * directory: any `backend` block whose type is not `local`, or a `cloud`
+ * block.
+ */
+export function hasRemoteBackend(body: BlockBody): boolean {
+  if (hasBlock(body, "cloud")) return true;
+  return backendTypes(body).some((type) => type !== LOCAL_BACKEND);
+}
+
 export const tf001: PostSynthCheck = {
   id: "TF001",
   description: "Root module declares no remote backend",
@@ -64,23 +110,33 @@ export const tf001: PostSynthCheck = {
       if (flagged.has(root)) continue;
 
       const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
-      if (hasBlock(body, "backend") || hasBlock(body, "cloud")) continue;
+      if (hasRemoteBackend(body)) continue;
+
+      // What the root actually declares, so the message names it rather than
+      // saying "no remote backend" over a block the reader can see.
+      const found = backendTypes(body).includes(LOCAL_BACKEND)
+        ? 'the backend it declares is `backend "local"`'
+        : "there is no backend block at all";
 
       flagged.add(root);
       diagnostics.push({
         checkId: "TF001",
         severity: "warning",
         message:
-          `Root module "${root}" declares no remote backend. State falls back to a local ` +
-          "terraform.tfstate, which is unshared, unlocked and holds every resource attribute in " +
-          'plaintext. Add a `backend "<type>"` or a `cloud {}` block to the terraform block.',
+          `Root module "${root}" declares no remote backend: ${found}. State is a ` +
+          "terraform.tfstate in the working directory, which is unshared, unlocked and holds every " +
+          'resource attribute in plaintext. Declare a `backend "<type>"` naming a remote type (`s3`, ' +
+          "`gcs`, `azurerm`, `http`) or a `cloud {}` block, or keep the local state on purpose with a " +
+          "`# chant-ignore-block: TF001` above the terraform block.",
         entity: name,
         lexicon: "terraform",
-        // The missing-resource shape (chant #2113): there is no `backend`/
-        // `cloud` block to point at, only the root that lacks one. `entity`
-        // above still names the `terraform` block this fired from (by
+        // The missing-resource shape (chant #2113): there is no remote
+        // `backend`/`cloud` block to point at, only the root that lacks one.
+        // `entity` above still names the `terraform` block this fired from (by
         // convenience, not because that block is what's wrong), so `missing`
-        // is what a suppression should key on instead.
+        // is what a suppression should key on instead. `kind` stays `backend`
+        // in both cases: what is absent is a remote backend, whether or not a
+        // `backend "local"` block is sitting where one should be.
         missing: { kind: "backend", scope: root },
       });
     }

package/src/lint/post-synth/tf015.ts

@@ -2,8 +2,9 @@
  * TF015: a `backend` or `cloud` block inside a child module.
  *
  * Scope: child modules only. This is TF001's mirror image. TF001 wants a root
- * module to declare a backend, because a root without one keeps its state on
- * local disk. A child module must declare neither: state belongs to the root,
+ * module to declare a REMOTE backend, because a root without one keeps its
+ * state on local disk. A child module must declare neither: state belongs to
+ * the root,
  * one state per root however many modules it calls, and Terraform says so
  * directly, "A backend block can only appear in the root module" and the
  * same for `cloud`. Depending on the version, the block is ignored with a
@@ -15,6 +16,14 @@
  * along. The rest of that block is fine to keep: `required_version` and
  * `required_providers` are meaningful in a child module and are not reported
  * here.
+ *
+ * Label-blind on purpose (#2218). TF001 had to start reading the backend
+ * block's type label, since `local` is the state placement it warns about
+ * rather than a cure for it. Nothing of the sort applies here: what a child
+ * module may not do is name a backend at all, `local` included, and
+ * Terraform's own refusal ("A backend block can only appear in the root
+ * module") does not read the label either. `hasBlock` is the right test, and
+ * the `positive` fixture's child declares `backend "local"` for that reason.
  */
 
 import type {

package/src/lint/post-synth/tf026.ts

@@ -28,8 +28,12 @@ import { LIVE_TYPE, type BlockBody } from "../../hcl/parse";
 /** Verbs that satisfy `delete: "never"` for the `undeclared_tagged` quadrant. */
 const SATISFIES_NEVER = new Set(["keep", "untag", "report"]);
 
-/** The `policy { }` block nested in a `live { }` block's body, hcl2json's own "one block, wrapped in an array" shape. */
-function policyBlockOf(liveBody: BlockBody): BlockBody | undefined {
+/**
+ * The `policy { }` block nested in a `live { }` block's body, hcl2json's own
+ * "one block, wrapped in an array" shape. Exported for TF027 (`./tf027.ts`),
+ * which reads the other quadrant of the same block.
+ */
+export function policyBlockOf(liveBody: BlockBody): BlockBody | undefined {
   const policy = liveBody["policy"];
   return Array.isArray(policy) && policy.length > 0 && typeof policy[0] === "object" && policy[0] !== null
     ? (policy[0] as BlockBody)

package/src/lint/post-synth/tf027.test.ts

@@ -0,0 +1,62 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf027 } from "./tf027";
+import { parseTerraformRootDir } from "../../hcl/parse";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF027");
+
+async function ctxFor(
+  fixture: string,
+  opts: { binary?: string } = {},
+  root = "estate",
+): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, {
+    binary: opts.binary ?? "choudoufu",
+  });
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe('TF027: undeclared_untagged = "delete" on a live root', () => {
+  test("fires on a policy block that sets it, naming the root and the setting", async () => {
+    const diags = tf027.check(await ctxFor("live-untagged-delete"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF027");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].lexicon).toBe("terraform");
+    expect(diags[0].message).toContain('Root module "estate"');
+    expect(diags[0].message).toContain('undeclared_untagged = "delete"');
+  });
+
+  test("fires even when a scope block narrows the account reconciliation", async () => {
+    const diags = tf027.check(await ctxFor("live-untagged-delete-scoped"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF027");
+  });
+
+  test('passes when the quadrant is set to something else ("report")', async () => {
+    expect(tf027.check(await ctxFor("live-untagged-report"))).toEqual([]);
+  });
+
+  test("passes when the root declares no policy block at all", async () => {
+    expect(tf027.check(await ctxFor("live-default"))).toEqual([]);
+  });
+
+  test("does not fire on a stock root: the policy block is inert off choudoufu", async () => {
+    expect(tf027.check(await ctxFor("live-untagged-delete", { binary: "terraform" }))).toEqual([]);
+  });
+
+  test("fires once per root, not once per live entity", async () => {
+    const a = await parseTerraformRootDir(join(fixtures, "live-untagged-delete"), "estate", undefined, {
+      binary: "choudoufu",
+    });
+    const b = await parseTerraformRootDir(join(fixtures, "live-untagged-delete"), "other", undefined, {
+      binary: "choudoufu",
+    });
+    const entities = new Map([...a, ...b]);
+    const diags = tf027.check({ outputs: new Map(), entities } as unknown as PostSynthContext);
+    expect(diags).toHaveLength(2);
+    expect(diags.map((d) => d.message.match(/Root module "([^"]+)"/)?.[1]).sort()).toEqual(["estate", "other"]);
+  });
+});

package/src/lint/post-synth/tf027.ts

@@ -0,0 +1,74 @@
+/**
+ * TF027: a live root's `policy` block sets `undeclared_untagged = "delete"`.
+ *
+ * The `undeclared_untagged` quadrant covers a live resource this estate never
+ * marked and the configuration does not declare, a resource chant does not
+ * own. `"delete"` there is account-scoped reconciliation: choudoufu compares
+ * the configuration against everything a `scope` block reaches and removes
+ * what is not in it. chant never proposes deleting a resource it does not
+ * own, and neither does an Op it generates, so the setting is refused on any
+ * live root the project builds, scoped or not. Narrowing the estate's own
+ * ownership answer (`undeclared_tagged`, which TF026 checks against
+ * `delete: "never"`) is the setting to reach for instead.
+ *
+ * `TerraformApplyOp` (`../../composites/terraform-apply-op.ts`) makes the
+ * same refusal when it builds, but only for a project on a `chant.config.json`
+ * whose root it can resolve synchronously (#2216): a `chant.config.ts` is
+ * project-authored code that `resolveRootModeSync` will not evaluate, so the
+ * composite reads the root as stock and never asks the policy question. This
+ * check reads `props.mode` off the parsed HCL instead, which the build stamps
+ * on every entity whatever the config file is written in, so it is the
+ * refusal that actually fires. It also fires for a live root with no apply Op
+ * at all, since the setting is a statement about the estate rather than about
+ * one Op.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity,
+ * the same entity TF024, TF025 and TF026 fire from.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, type BlockBody } from "../../hcl/parse";
+import { policyBlockOf } from "./tf026";
+
+export const tf027: PostSynthCheck = {
+  id: "TF027",
+  description: "Live root's policy block sets undeclared_untagged = \"delete\", which deletes resources chant does not own",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== LIVE_TYPE) continue;
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const policy = policyBlockOf(body);
+      if (!policy || policy["undeclared_untagged"] !== "delete") continue;
+
+      flagged.add(root);
+      diagnostics.push({
+        checkId: "TF027",
+        severity: "error",
+        message:
+          `Root module "${root}"'s policy block sets undeclared_untagged = "delete" (account-scoped ` +
+          "reconciliation, scoped by a `scope` block). chant never proposes deleting a resource it does " +
+          "not own, and neither does an Op it generates. Remove that setting from the policy block, or " +
+          "narrow the estate's ownership answer (undeclared_tagged) instead of the account's.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf028.test.ts

@@ -0,0 +1,92 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { Declarable } from "@intentius/chant/declarable";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf028 } from "./tf028";
+import { parseTerraformRootDir } from "../../hcl/parse";
+import { TerraformWatchOp, type TerraformWatchOpConfig } from "../../composites/terraform-watch-op";
+import { TerraformApplyOp } from "../../composites/terraform-apply-op";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF028");
+
+/** The entities of one fixture root, parsed the way `buildRoots` parses a configured root. */
+async function rootEntities(fixture: string, root: string, binary = "choudoufu"): Promise<Map<string, Declarable>> {
+  return parseTerraformRootDir(join(fixtures, fixture), root, undefined, { binary });
+}
+
+/** A `Chant::Op` entity from the real composite, keyed the way a discovered Op is. */
+function watchOp(config: TerraformWatchOpConfig): [string, Declarable] {
+  const { op } = TerraformWatchOp(config);
+  return [config.name, op as unknown as Declarable];
+}
+
+function ctxOf(...maps: Array<Map<string, Declarable> | [string, Declarable]>): PostSynthContext {
+  const entities = new Map<string, Declarable>();
+  for (const m of maps) {
+    if (Array.isArray(m)) entities.set(m[0], m[1]);
+    else for (const [k, v] of m) entities.set(k, v);
+  }
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF028: a live root planned by a stock terraformPlan step", () => {
+  test("fires on a TerraformWatchOp built without live: true", async () => {
+    const diags = tf028.check(
+      ctxOf(await rootEntities("live", "estate"), watchOp({ name: "estate-watch", root: "estate" })),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF028");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].lexicon).toBe("terraform");
+    expect(diags[0].entity).toBe("estate-watch");
+    expect(diags[0].message).toContain('Op "estate-watch"');
+    expect(diags[0].message).toContain('root module "estate"');
+    expect(diags[0].message).toContain("live: true");
+  });
+
+  test("passes when the same Op is built with live: true", async () => {
+    const diags = tf028.check(
+      ctxOf(
+        await rootEntities("live", "estate"),
+        watchOp({ name: "estate-watch", root: "estate", live: true }),
+      ),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("passes on a stock root, which is what terraformPlan is for", async () => {
+    const diags = tf028.check(
+      ctxOf(await rootEntities("stock", "app", "terraform"), watchOp({ name: "app-watch", root: "app" })),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("names the Op that plans the live root, not a sibling Op on another root", async () => {
+    const diags = tf028.check(
+      ctxOf(
+        await rootEntities("live", "estate"),
+        await rootEntities("stock", "app", "terraform"),
+        watchOp({ name: "estate-watch", root: "estate" }),
+        watchOp({ name: "app-watch", root: "app" }),
+      ),
+    );
+    expect(diags).toHaveLength(1);
+    expect(diags[0].entity).toBe("estate-watch");
+  });
+
+  test("does not fire on a TerraformApplyOp, whose stock plan step is correct on a live root", async () => {
+    const { op } = TerraformApplyOp({ name: "estate-apply", root: "estate" });
+    const diags = tf028.check(
+      ctxOf(await rootEntities("live", "estate"), ["estate-apply", op as unknown as Declarable]),
+    );
+    expect(diags).toEqual([]);
+  });
+
+  test("ignores a build with no live root at all", async () => {
+    const diags = tf028.check(
+      ctxOf(await rootEntities("stock", "estate", "terraform"), watchOp({ name: "estate-watch", root: "estate" })),
+    );
+    expect(diags).toEqual([]);
+  });
+});

package/src/lint/post-synth/tf028.ts

@@ -0,0 +1,96 @@
+/**
+ * TF028: a live root is watched by a `TerraformWatchOp` built in stock mode.
+ *
+ * `TerraformWatchOp`'s `live` flag is declared, not detected: a composite is
+ * built by `chant build` without reading a root module's `.tf` files, so the
+ * Op author says which shape the Plan phase takes and, until #2216, nothing
+ * checked the answer against the root. Leaving it off a live root is silent
+ * and lossy. `live: true` swaps the Plan step for `choudoufuLivePlan`, whose
+ * single read of the live system answers three questions (drift, how many
+ * live resources sit at a declared identity carrying no marker, and how many
+ * of those an exact content match makes claimable); a stock `terraformPlan`
+ * step answers the first alone, so the watch reports drift and stays quiet
+ * about every unowned and adoptable resource in the estate.
+ *
+ * The check runs over the whole built graph because that is where both halves
+ * of the question are: the root's mode is stamped on every parsed entity by
+ * the build (`props.mode`, #2103), and the Op is a `Chant::Op` entity carrying
+ * the composite's own labels. `TerraformWatchOp` itself cross-checks the flag
+ * where it can (`../../op/resolve-root-mode.ts`), but that read is a
+ * `chant.config.json`-only one, so on a `chant.config.ts` project, which is
+ * every project in this repository, this check is what actually fires.
+ *
+ * Read off the labels the composite stamps rather than off the emitted step,
+ * since a stock `terraformPlan -out` step against a live root is correct in
+ * `TerraformApplyOp`: choudoufu v0.13.0 accepts `plan -out` and re-plans
+ * against the file at apply (#2157), so the apply Op builds one shape for
+ * both kinds of root and the step alone says nothing about a mistake.
+ *
+ * One diagnostic per Op, fired from the Op's entity.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isOpEntity } from "@intentius/chant/op/resource";
+
+/** The labels `TerraformWatchOp` stamps on the Op it builds (`../../composites/terraform-watch-op.ts`). */
+interface WatchOpLabels {
+  Watch?: unknown;
+  TerraformRoot?: unknown;
+  TerraformMode?: unknown;
+}
+
+/** Every root name the build parsed as live: `terraform.binary: "choudoufu"` plus a declared estate. */
+function liveRootsOf(ctx: PostSynthContext): Set<string> {
+  const roots = new Set<string>();
+  for (const entity of ctx.entities.values()) {
+    if (!isResourceDeclarable(entity)) continue;
+    const props = entity.props as { root?: unknown; mode?: unknown };
+    if (props.mode !== "live" || typeof props.root !== "string") continue;
+    roots.add(props.root);
+  }
+  return roots;
+}
+
+export const tf028: PostSynthCheck = {
+  id: "TF028",
+  description: "A live root is watched by a TerraformWatchOp built without live: true",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const liveRoots = liveRootsOf(ctx);
+    if (liveRoots.size === 0) return [];
+
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isOpEntity(entity)) continue;
+      const props = (entity as { props?: Record<string, unknown> }).props;
+      if (!props || typeof props.name !== "string") continue;
+      const labels = (typeof props.labels === "object" && props.labels !== null
+        ? props.labels
+        : {}) as WatchOpLabels;
+      if (labels.Watch !== "true") continue;
+      if (labels.TerraformMode === "live") continue;
+      const root = labels.TerraformRoot;
+      if (typeof root !== "string" || !liveRoots.has(root)) continue;
+
+      diagnostics.push({
+        checkId: "TF028",
+        severity: "error",
+        message:
+          `Op "${props.name}" watches root module "${root}" in stock mode, but that root runs choudoufu ` +
+          "with a declared estate. A stock plan reports drift alone and stays quiet about every unowned " +
+          `and adoptable resource in the estate. Set live: true on this TerraformWatchOp, or drop the ` +
+          "root's estate if it is not a live root.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lsp/option-keys.ts

@@ -30,11 +30,12 @@ export const ROOT_ENTRY_KEYS: OptionKey[] = [
 
 /** `TerraformApplyOpConfig`'s keys (`TerraformApplyOp({ <here> })`). */
 export const APPLY_OP_KEYS: OptionKey[] = [
-  { key: "name", detail: "Op name (kebab-case). `signalName` defaults to `approve-<name>`." },
+  { key: "name", detail: "Op name (kebab-case). `gateName` defaults to `approve-<name>`." },
   { key: "root", detail: "Key into the project's `terraform.roots`." },
   { key: "planFile", detail: "Plan file written by Plan and consumed by Apply. Default: `chant.tfplan`." },
   { key: "gate", detail: '"on-destroy" | "always" | "never" — when to emit the approval gate. Default: "on-destroy".' },
-  { key: "signalName", detail: "Gate signal name. Default: `approve-<name>`." },
+  { key: "gateName", detail: "The gate's name. Default: `approve-<name>`." },
+  { key: "signalName", detail: "Deprecated spelling of `gateName` (#2202). Accepted through 0.59.0, removed in 0.60.0." },
   { key: "gateTimeout", detail: "How long a recorded pending gate stays valid, as a duration string. Default: core's own (48h)." },
   { key: "gateDescription", detail: "Override the gate description shown to the approver." },
   { key: "upgrade", detail: "`-upgrade` on the Init step: re-resolve provider and module versions." },

package/src/op/activities/choudoufu.acceptance.test.ts

@@ -22,22 +22,16 @@
  *     port; `http://localhost:<port>` is this variable's value) and export
  *     it before running this suite.
  *
- * ## Why this skips today even with both present
- *
- * choudoufu#894: `live-plan -json` is reachable only through the `-estate`
- * form, and that form is refused on a configuration that names its own estate
- * ("Estate named by both the live block and -estate"), while the same root
- * without `-estate` refuses with "Machine-readable output is not available
- * under live resource markers yet". `__fixtures__/live` is exactly that
- * shape, so `choudoufuLivePlan` throws here on any real binary. Found by
- * chant #2104; `../../composites/terraform-adopt-op.acceptance.test.ts`
- * carries the same gate for the same reason. When #894 ships, drop
- * `CHOUDOUFU_894_OPEN` from both and the suites run as written.
- *
  * Gating copied from `../../composites/terraform-apply-op.acceptance.test.ts`
  * (`onPath`), which in turn copies `lexicons/k3s/src/serializer.acceptance.
  * test.ts`'s pattern of skipping with the reason named in the describe title
  * rather than failing when the real dependency is absent.
+ *
+ * `../../__fixtures__/ACCEPTANCE.md` records what this block has last passed
+ * against. The `live-plan` half was gated shut on choudoufu#894 until
+ * v0.14.0, which made the `-json` document reachable on a configuration that
+ * names its own estate and kept stdout to it (choudoufu PR 915); chant #2168
+ * dropped the gate and recorded the first run.
  */
 
 import { execSync } from "node:child_process";
@@ -59,21 +53,11 @@ function onPath(cmd: string): boolean {
 const hasChoudoufu = onPath("choudoufu");
 const emulatorEndpoint = process.env.CHOUDOUFU_EMULATOR_ENDPOINT;
 
-/**
- * https://github.com/INTENTIUS/choudoufu/issues/894. Flip to `false` when the
- * `-json` document becomes reachable on a root that declares its own estate.
- * chant #2168 tracks this and the other four reversals that unblock together.
- */
-const CHOUDOUFU_894_OPEN = true;
-
 const skipReason = !hasChoudoufu
   ? "no choudoufu binary on PATH"
   : !emulatorEndpoint
     ? "CHOUDOUFU_EMULATOR_ENDPOINT is not set (bring up choudoufu's `just smoke` emulator stack and export it)"
-    : CHOUDOUFU_894_OPEN
-      ? "choudoufu#894: live-plan -json is refused on a configuration that declares its own estate, " +
-        "so the fixture's live plan cannot produce the #788 document yet"
-      : "";
+    : "";
 
 const FIXTURE = join(import.meta.dirname, "..", "..", "__fixtures__", "live");
 const workspaces: string[] = [];