@intentius/chant 0.100.0 → 0.102.0

package/src/workspace/changes.ts

@@ -40,17 +40,19 @@ import { execFileSync } from "node:child_process";
 import { relative, resolve, sep } from "node:path";
 // @ts-ignore — picomatch has no types declaration
 import picomatch from "picomatch";
-import { declaredRecordKinds, readDeclaration, readerVersion, WORKSPACE_ERROR_CODES, WorkspaceReadError, type ChangeSeverity } from "./declaration";
+import { declaredRecordKinds, readDeclaration, readerVersion, WORKSPACE_ERROR_CODES, WorkspaceReadError, type ChangeSeverity, type Declaration } from "./declaration";
 import { declaredKindFile } from "./declared-kinds";
 import { isGeneratedPath } from "./generated-files";
 import { parseRegion } from "./intent";
+import { loadClassRegistry } from "./principal-classes";
 import { constraintCovers, isWorkspacePath, memberHolding } from "./record-assets";
-import { RecordReadError, type LoadedRecordKind, type RecordEntry } from "./records";
+import { loadRecordKind, RecordReadError, type LoadedRecordKind, type RecordEntry } from "./records";
 import { readRecordsFor } from "./records-cli";
 import type { ReasonCode } from "./reason-codes";
 import { joinPath } from "./tree";
 import { locateWorkspace } from "./which-chant";
 import { idList, isDecided } from "./work";
+import { checkWriteScope, type CheckKind, type ScopeReport } from "./write-scope";
 
 /** The version of the `changes` document this chant writes. */
 export const CHANGES_CONTRACT_VERSION = 1;
@@ -172,7 +174,13 @@ export type ChangesDocument =
       paths: ChangedPath[];
       findings: ChangeFinding[];
       summary: { paths: number; covered: number; uncovered: number; outOfScope: number; ignored: number; records: number };
-      /** False only when severity is fail and there are findings. */
+      /**
+       * The write scope check (#2548): each commit in the range judged
+       * against the writeScope and agents the declaration at base gives,
+       * or null when that declaration restricts no one.
+       */
+      scope: ScopeReport | null;
+      /** False when severity is fail and there are findings, or when a commit writes outside its writer's scope. */
       ok: boolean;
     })
   | (Head & { error: { code: ChangesErrorCode; message: string } });
@@ -463,6 +471,7 @@ async function run(query: ChangesQuery, head: Head): Promise<Exclude<ChangesDocu
     }
   }
   const count = (s: ChangeStatus) => paths.filter((p) => p.status === s).length;
+  const scope = await writeScopeAtBase(query, top, range, workspacePrefix);
   return {
     ...head,
     workspace: { name: declaration.name, root: located.root },
@@ -474,10 +483,58 @@ async function run(query: ChangesQuery, head: Head): Promise<Exclude<ChangesDocu
     paths,
     findings,
     summary: { paths: paths.length, covered: count("covered"), uncovered: count("uncovered"), outOfScope: count("out-of-scope"), ignored: count("ignored"), records: count("record") },
-    ok: !(severity === "fail" && findings.length > 0),
+    scope,
+    ok: !(severity === "fail" && findings.length > 0) && (scope === null || scope.findings.length === 0),
   };
 }
 
+/**
+ * The write scope check over the range (#2548), with the declaration, its
+ * record kinds and the trust policy read at the range's base, so a change
+ * can't widen its own scope. Null when the base has no declaration, or one
+ * that restricts no one. The base is read without the root-chant rule: a
+ * change may move the chant pin, and the scope is data either chant reads.
+ */
+async function writeScopeAtBase(query: ChangesQuery, top: string, range: { base: string; head: string }, prefix: string): Promise<ScopeReport | null> {
+  let located: ReturnType<typeof locateWorkspace>;
+  let declaration: Declaration;
+  try {
+    located = locateWorkspace(query.cwd, range.base);
+    declaration = readDeclaration(located.tree);
+  } catch (err) {
+    if (err instanceof WorkspaceReadError && err.code === "declaration-missing") return null;
+    throw err;
+  }
+  if (declaration.writeScope === null && declaration.agents.length === 0) return null;
+  const kinds: CheckKind[] = [];
+  for (const d of declaredRecordKinds(declaration)) {
+    let loaded: LoadedRecordKind;
+    try {
+      loaded = await loadRecordKind(declaredKindFile(d, located.rootOnDisk), query.cwd);
+    } catch (err) {
+      // A kind that doesn't load here: its files are judged as plain paths.
+      if (err instanceof RecordReadError) continue;
+      throw err;
+    }
+    const { kind } = loaded;
+    const session = kind.session;
+    kinds.push({
+      scoped: { name: kind.name, declaredName: d.name, member: d.member, declared: true },
+      dir: toPosix(relative(top, loaded.dir)) || ".",
+      match: new RegExp(kind.location.match),
+      reviewFields: [kind.reviews?.field, session?.verdicts].filter((f): f is string => typeof f === "string"),
+      session:
+        session && kind.stateField !== undefined
+          ? { stateField: kind.stateField, closed: kind.closedStates ?? [], fills: [session.openedRev].filter((f): f is string => typeof f === "string") }
+          : null,
+      format: kind.format,
+    });
+  }
+  // The principal classes the pins supply, a path pin read at the base too (#3080).
+  const classes = loadClassRegistry(declaration.pins, located.rootOnDisk, { tree: located.tree }).registry;
+  return checkWriteScope({ top, base: range.base, head: range.head, prefix, declaration, kinds, classes });
+}
+
 function finding(code: ChangesFindingCode, p: ChangedPath, severity: "warn" | "fail", message: string, records: string[]): ChangeFinding {
   return { id: `finding:${code}:${p.path}`, code, path: p.path, message, severity, records, triage: changeFindingSource({ code, path: p.path }) };
 }

package/src/workspace/check-live.test.ts

@@ -0,0 +1,192 @@
+/**
+ * `chant workspace check --live --env <env>` (#2549, ws-062): declared member
+ * links resolved against the live graph of each producer. A fake chant stands
+ * in for the member's own toolchain: it prints ir.json for a source read and
+ * live.json for `--live`, and records its command line in argv.txt.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterAll, afterEach, describe, expect, test, vi } from "vitest";
+import { cleanScratch, contract, declaration, repo } from "./__fixtures__/contract-repo";
+import { parseArgs } from "../cli/main";
+import schema from "./check.schema.json";
+import { workspaceGraph } from "./graph-cli";
+import { runChecks, runWorkspaceCheck } from "./lineage-check";
+import type { CheckDocument } from "./lineage-check";
+
+const { expectValid } = contract(schema);
+
+afterAll(() => cleanScratch());
+afterEach(() => vi.restoreAllMocks());
+
+const FAKE_CHANT = `#!/bin/sh
+[ "$1" = graph ] || { echo "Error: Unknown command: $1" >&2; exit 1; }
+printf '%s\\n' "$*" > ../argv.txt
+case " $* " in
+  *" --live "*) cat live.json ;;
+  *) cat ir.json ;;
+esac
+`;
+
+const graph = (exports: { name: string; value?: unknown }[]) => JSON.stringify({ version: 1, nodes: [], edges: [], groups: {}, exports });
+
+function workspace(live: { name: string; value?: unknown }[], links: unknown[], producerKind: "chant" | "other" = "chant", extra: Record<string, unknown> = {}) {
+  return repo({
+    "chant.workspace.json": declaration([
+      producerKind === "chant" ? { name: "api", dir: "api", kind: "chant" } : { name: "api", dir: "api", kind: "other", because: "a queue made by hand", outputs: ["QueueUrl"] },
+      { name: "web", dir: "web", kind: "other", because: "a static site", links },
+    ], extra),
+    "api/chant.config.ts": "export default {};\n",
+    "api/ir.json": graph([{ name: "QueueUrl" }, { name: "TopicArn" }]),
+    "api/live.json": graph(live),
+    "web/index.html": "",
+    ".gitignore": "node_modules\n",
+    "node_modules/.bin/chant": { text: FAKE_CHANT, mode: 0o755 },
+  });
+}
+
+async function live(root: string, env = "prod") {
+  const doc = (await runChecks(root, undefined, { live: { env } })) as Extract<CheckDocument, { workspace: unknown }>;
+  const diagnostics = doc.declaration!.diagnostics.filter((d) => d.ruleId === "WSP141" || d.ruleId === "WSP142");
+  return { doc, diagnostics, rows: doc.declaration!.live?.links ?? [] };
+}
+
+describe("check --live (#2549)", () => {
+  test("a link to an output the live graph publishes resolves, and the row says it resolved live", async () => {
+    const root = workspace([{ name: "QueueUrl", value: "https://q" }], [{ member: "api", output: "QueueUrl" }]);
+    const { doc, diagnostics, rows } = await live(root);
+    expect(diagnostics).toEqual([]);
+    expectValid(doc);
+    expect(doc.declaration!.live!.env).toBe("prod");
+    expect(rows).toMatchObject([{ consumer: "web", producer: "api", output: "QueueUrl", resolves: "live", status: "resolved", reason: null }]);
+    // The member ran as `chant graph --live --env prod`.
+    expect(readFileSync(join(root, "argv.txt"), "utf-8")).toContain("--env prod --live");
+  });
+
+  test("an output the producer declares but its estate does not publish is WSP141, a warning", async () => {
+    const root = workspace([{ name: "TopicArn", value: "arn" }], [{ member: "api", output: "QueueUrl" }]);
+    const { diagnostics, rows } = await live(root);
+    expect(rows[0]).toMatchObject({ status: "missing", resolves: "live" });
+    expect(diagnostics).toHaveLength(1);
+    expect(diagnostics[0]).toMatchObject({ ruleId: "WSP141", severity: "warning", entity: "web" });
+    expect(diagnostics[0].message).toContain("does not resolve live in prod");
+    expect(diagnostics[0].message).toContain("TopicArn");
+  });
+
+  test("a live read that returned no outputs at all leaves the link unresolved, not missing", async () => {
+    const root = workspace([], [{ member: "api", output: "QueueUrl" }]);
+    const { diagnostics, rows } = await live(root);
+    expect(rows[0].status).toBe("unresolved");
+    expect(diagnostics).toMatchObject([{ ruleId: "WSP142", severity: "info" }]);
+    expect(diagnostics[0].message).toContain("returned no outputs");
+  });
+
+  test("a producer of a kind chant does not read live is kept unresolved, with the reason", async () => {
+    const root = workspace([], [{ member: "api", output: "QueueUrl" }], "other");
+    const { diagnostics, rows } = await live(root);
+    expect(rows[0]).toMatchObject({ status: "unresolved", resolves: "live" });
+    expect(diagnostics).toMatchObject([{ ruleId: "WSP142" }]);
+    expect(diagnostics[0].message).toContain("kind other");
+  });
+
+  test("a telemetry link is not resolved live", async () => {
+    const root = workspace([{ name: "QueueUrl" }], [{ member: "api", output: "traces", kind: "telemetry" }]);
+    const { rows } = await live(root);
+    expect(rows).toEqual([]);
+  });
+
+  test("severity settings apply to the live checks like any other", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration(
+        [
+          { name: "api", dir: "api", kind: "chant" },
+          { name: "web", dir: "web", kind: "other", because: "a static site", links: [{ member: "api", output: "QueueUrl" }], suppress: [{ check: "WSP141", because: "deployed next week" }] },
+        ],
+        { checks: { WSP141: "error" } },
+      ),
+      "api/chant.config.ts": "export default {};\n",
+      "api/ir.json": graph([{ name: "QueueUrl" }]),
+      "api/live.json": graph([{ name: "Other" }]),
+      "web/index.html": "",
+      ".gitignore": "node_modules\n",
+      "node_modules/.bin/chant": { text: FAKE_CHANT, mode: 0o755 },
+    });
+    const { doc, diagnostics } = await live(root);
+    expect(diagnostics).toEqual([]);
+    expect(doc.declaration!.suppressed.map((s) => s.ruleId)).toContain("WSP141");
+  });
+
+  test("without --live no member runs and the report has no live section", async () => {
+    const root = workspace([{ name: "QueueUrl" }], [{ member: "api", output: "QueueUrl" }]);
+    const doc = (await runChecks(root)) as Extract<CheckDocument, { workspace: unknown }>;
+    expect(doc.declaration!.live).toBeUndefined();
+    expect(existsSync(join(root, "argv.txt"))).toBe(false);
+  });
+});
+
+describe("the command (#2549)", () => {
+  async function run(root: string, argv: string[]) {
+    const out: string[] = [];
+    const err: string[] = [];
+    vi.spyOn(console, "log").mockImplementation((...a: unknown[]) => void out.push(a.join(" ")));
+    vi.spyOn(console, "error").mockImplementation((...a: unknown[]) => void err.push(a.join(" ")));
+    vi.spyOn(process, "cwd").mockReturnValue(root);
+    const code = await runWorkspaceCheck({ args: parseArgs(["workspace", "check", ...argv]), plugins: [] } as never);
+    return { code, out: out.join("\n"), err: err.join("\n") };
+  }
+
+  test("--live needs --env, and takes no --at, and runs no member when it refuses", async () => {
+    const root = workspace([{ name: "QueueUrl" }], [{ member: "api", output: "QueueUrl" }]);
+    const noEnv = await run(root, ["--live"]);
+    expect(noEnv.code).toBe(1);
+    expect(noEnv.err).toContain("--live needs an environment");
+    const atRev = await run(root, ["--live", "--env", "prod", "--at", "HEAD"]);
+    expect(atRev.code).toBe(1);
+    expect(atRev.err).toContain("--at");
+    expect(existsSync(join(root, "argv.txt"))).toBe(false);
+  });
+
+  test("--live --json prints the live section, and a WSP141 warning leaves the exit code 0", async () => {
+    // The fake producer's source lists no outputs, so the source check WSP093 is turned off; the live warning is the one under test.
+    const root = workspace([{ name: "TopicArn" }], [{ member: "api", output: "QueueUrl" }], "chant", { checks: { WSP093: "off" } });
+    const { code, out } = await run(root, ["--live", "--env", "prod", "--json"]);
+    const report = JSON.parse(out) as { declaration: { live: { env: string; links: { status: string }[] }; diagnostics: { ruleId: string }[] } };
+    expect(report.declaration.live).toMatchObject({ env: "prod", links: [{ status: "missing" }] });
+    expect(report.declaration.diagnostics.map((d) => d.ruleId)).toContain("WSP141");
+    expect(code).toBe(0);
+  });
+});
+
+describe("the design member kind (#2549, ws-062)", () => {
+  const designWorkspace = (extra: Record<string, unknown> = {}) =>
+    repo({
+      "chant.workspace.json": declaration([
+        { name: "design", dir: "design", kind: "design", outputs: ["screens/home.json"], ...extra },
+        { name: "web", dir: "web", kind: "other", because: "a static site", links: [{ member: "design", output: "screens/home.json" }] },
+      ]),
+      "design/screens/home.json": "{}\n",
+      "web/index.html": "",
+    });
+
+  test("is a declared kind: no WSP003, no WSP009, no `because` needed, and its listed outputs are link targets", async () => {
+    const doc = (await runChecks(designWorkspace())) as Extract<CheckDocument, { workspace: unknown }>;
+    const ids = doc.declaration!.diagnostics.map((d) => d.ruleId);
+    expect(ids).not.toContain("WSP003");
+    expect(doc.declaration!.diagnostics.filter((d) => d.entity === "design")).toEqual([]);
+    expect(doc.declaration!.links).toMatchObject([{ consumer: "web", producer: "design", output: "screens/home.json", status: "resolved" }]);
+  });
+
+  test("a data member: workspace graph reads it and builds nothing, saying so", async () => {
+    const { doc } = await workspaceGraph({ cwd: designWorkspace() });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.members.find((m) => m.name === "design")).toMatchObject({ kind: "design", status: "skipped", reason: { code: "kind-not-run" } });
+    expect(doc.members.find((m) => m.name === "design")!.reason!.message).toContain("data");
+  });
+
+  test("a design member's link is not resolved live: its files are not an estate", async () => {
+    const { rows, diagnostics } = await live(designWorkspace());
+    expect(rows[0]).toMatchObject({ status: "unresolved", resolves: "live" });
+    expect(diagnostics).toMatchObject([{ ruleId: "WSP142" }]);
+  });
+});

package/src/workspace/check.schema.json

@@ -146,6 +146,70 @@
         "ok": {
           "type": "boolean"
         },
+        "live": {
+          "description": "Present with --live --env (#2549, ws-062): the declared output links resolved against the live graph of the environment. Each member of kind chant ran chant graph --live. Added by chant 0.101.0.",
+          "type": "object",
+          "required": [
+            "env",
+            "links"
+          ],
+          "properties": {
+            "env": {
+              "type": "string"
+            },
+            "links": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": [
+                  "consumer",
+                  "producer",
+                  "output",
+                  "resolves",
+                  "status",
+                  "reason"
+                ],
+                "properties": {
+                  "consumer": {
+                    "type": "string"
+                  },
+                  "producer": {
+                    "type": "string"
+                  },
+                  "output": {
+                    "type": "string"
+                  },
+                  "kind": {
+                    "type": "string"
+                  },
+                  "origin": {
+                    "const": "declared"
+                  },
+                  "resolves": {
+                    "const": "live"
+                  },
+                  "status": {
+                    "enum": [
+                      "resolved",
+                      "missing",
+                      "unresolved",
+                      "invalid"
+                    ]
+                  },
+                  "reason": {
+                    "type": [
+                      "string",
+                      "null"
+                    ]
+                  },
+                  "pointer": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
         "diagnostics": {
           "description": "Active findings, in the shape `chant lint --format json` prints, sorted by position.",
           "type": "array",

package/src/workspace/checks/boxes.test.ts

@@ -158,6 +158,8 @@ describe("the box block in the declaration", () => {
       isolation: null,
       intent: null,
       services: [],
+      factory: null,
+      listing: null,
       capabilities: [
         { name: "fountain", broker: "lobby", scope: ["agent", "vault"], pointer: "/members/0/box/capabilities/0" },
         { name: "inference", broker: null, scope: [], pointer: "/members/0/box/capabilities/1" },

package/src/workspace/checks/links.ts

@@ -16,12 +16,13 @@
  * | WSP095 | an inferred join is ambiguous: a parameter matches two or more outputs |
  * | WSP096 | a consumer states the same link twice |
  * | WSP097 | an entry lists `outputs` for a kind that doesn't take them from the entry |
+ * | WSP098 | a link states a `protocol` and its kind is not `telemetry` (#2558) |
  */
 
 import type { WorkspaceCheck, WorkspaceCheckContext, WorkspaceDiagnostic } from "../checks";
 import type { Member } from "../declaration";
 import { sourceMemberHandles } from "../member-handles";
-import { DEFAULT_LINK_KIND, LINK_KINDS, linkTargetProblem, resolveLinks, type AmbiguousRow, type LinkRow, type LinkTableRow } from "../links";
+import { DEFAULT_LINK_KIND, LINK_KINDS, TELEMETRY_LINK_KIND, linkTargetProblem, resolveLinks, type AmbiguousRow, type LinkRow, type LinkTableRow } from "../links";
 
 const tables = new WeakMap<WorkspaceCheckContext, LinkTableRow[]>();
 
@@ -62,7 +63,7 @@ export const LINK_CHECKS: readonly WorkspaceCheck[] = [
   {
     id: "WSP092",
     name: "link-kind-unknown",
-    description: `Every member link's kind is one chant knows. Unknown link kinds fail closed; ${DEFAULT_LINK_KIND} is the default and the only one so far.`,
+    description: `Every member link's kind is one chant knows. Unknown link kinds fail closed; ${DEFAULT_LINK_KIND} is the default, and ${LINK_KINDS.filter((k) => k !== DEFAULT_LINK_KIND).join(", ")} is the other.`,
     severity: "error",
     configurable: false,
     check(ctx) {
@@ -180,4 +181,24 @@ export const LINK_CHECKS: readonly WorkspaceCheck[] = [
         });
     },
   },
+  {
+    id: "WSP098",
+    name: "link-protocol-misplaced",
+    description: "A link states a protocol only when it is a telemetry link: protocol is the OTLP protocol the consumer sends to the producer's collector, and no other link kind has one.",
+    severity: "error",
+    configurable: true,
+    check(ctx) {
+      return ctx.declaration.members.flatMap((m) =>
+        m.links
+          .filter((l) => l.protocol !== null && (l.kind ?? DEFAULT_LINK_KIND) !== TELEMETRY_LINK_KIND)
+          .map((l) => ({
+            checkId: this.id,
+            severity: this.severity,
+            message: `member ${m.name}'s link to ${l.member} output ${l.output} states protocol ${l.protocol}, and its kind is ${l.kind ?? DEFAULT_LINK_KIND}; protocol belongs to a ${TELEMETRY_LINK_KIND} link`,
+            entity: m.name,
+            pointer: `${l.pointer}/protocol`,
+          })),
+      );
+    },
+  },
 ];

package/src/workspace/checks/live.ts

@@ -0,0 +1,113 @@
+/**
+ * The live link checks, WSP141 and WSP142 (#2549; #2524 D6, ws-062).
+ *
+ * `chant workspace check --live --env <env>` resolves each declared member
+ * link against what its producer's estate publishes now. It reads the live
+ * graph the way `chant workspace graph --live --env <env>` does: each `chant`
+ * member runs `chant graph --live` under its own toolchain, and the outputs of
+ * the live graph (the stack outputs a lexicon's live read reports) are the
+ * names a link may match, exactly. That is the one place this command reaches
+ * a network, through the member's own chant, with the member's own
+ * credentials. Without `--live` none of this runs, and the source checks
+ * (`./links.ts`) stay offline.
+ *
+ * | Id | Fails when |
+ * |---|---|
+ * | WSP141 | the producer was read live and publishes no output of that name |
+ * | WSP142 | the link could not be resolved live: the producer's kind is not read live, its read failed, or the read returned no outputs at all |
+ *
+ * Only declared links of kind `output` are resolved live. A `telemetry` link
+ * names a collector's pipeline or exporter, which the graph reports from the
+ * member's source, so it is not part of this check.
+ */
+
+import type { WorkspaceCheck, WorkspaceDiagnostic } from "../checks";
+import type { Declaration } from "../declaration";
+import type { KindRegistry } from "../kinds";
+import { DEFAULT_LINK_KIND, irMemberHandles, resolveLinks, type LinkRow } from "../links";
+
+/** What a live read of the workspace found, for the live link checks. */
+export interface LiveLinkFacts {
+  env: string;
+  /** Every declared `output` link, resolved against the live outputs. */
+  rows: LinkRow[];
+}
+
+const describeLink = (row: LinkRow) => `${row.consumer}'s link to ${row.producer} output ${row.output}`;
+
+/**
+ * Read the live graph of the workspace at `cwd` for `env` and resolve the
+ * declared links against it. `onStderr` gets each member's stderr, which is
+ * where a lexicon's live read reports an account it could not reach.
+ */
+export async function gatherLiveLinkFacts(cwd: string, declaration: Declaration, kinds: KindRegistry, env: string, onStderr?: (text: string) => void): Promise<LiveLinkFacts> {
+  const { workspaceGraph } = await import("../graph-cli");
+  const { doc } = await workspaceGraph({ cwd, args: { live: true, env }, noCache: true, ...(onStderr ? { onStderr } : {}) });
+  if ("error" in doc) {
+    return { env, rows: unreadRows(declaration, `the live graph could not be read: ${doc.error.code}: ${doc.error.message}`) };
+  }
+  const read = new Map(doc.members.map((m) => [m.name, m]));
+  const composed = doc.members.filter((m) => m.status === "composed").map((m) => m.name);
+  const handles = irMemberHandles({ composed, exports: doc.exports, imports: doc.imports });
+  const table = resolveLinks(declaration, handles);
+  const rows: LinkRow[] = [];
+  for (const r of table) {
+    if (r.status === "ambiguous" || r.origin !== "declared" || r.kind !== DEFAULT_LINK_KIND) continue;
+    const row: LinkRow = { ...r, resolves: "live" };
+    if (row.status !== "invalid") {
+      const producer = read.get(row.producer);
+      const kind = kinds.get(declaration.members.find((m) => m.name === row.producer)?.kind ?? "");
+      if (!producer || producer.status !== "composed") {
+        row.status = "unresolved";
+        row.reason =
+          producer?.reason?.message ??
+          (kind ? `${row.producer} is kind ${kind.name}, which chant does not read live` : `${row.producer} was not read live`);
+      } else if (row.status === "missing" && !doc.exports.some((e) => e.member === row.producer)) {
+        row.status = "unresolved";
+        row.reason = `the live read of ${row.producer} returned no outputs: the account may be unreachable, or its lexicon reports none`;
+      } else if (row.status === "missing") {
+        row.reason = row.reason?.replace(/^(\S+) has no output/, "$1 publishes no output") ?? row.reason;
+      }
+    }
+    rows.push(row);
+  }
+  return { env, rows };
+}
+
+/** Every declared output link as unresolved, when the live graph could not be read at all. */
+function unreadRows(declaration: Declaration, reason: string): LinkRow[] {
+  return resolveLinks(declaration, new Map())
+    .filter((r): r is LinkRow => r.status !== "ambiguous" && r.origin === "declared" && r.kind === DEFAULT_LINK_KIND)
+    .map((r) => ({ ...r, resolves: "live", ...(r.status === "invalid" ? {} : { status: "unresolved" as const, reason }) }));
+}
+
+function liveFinding(check: WorkspaceCheck, row: LinkRow, message: string): WorkspaceDiagnostic {
+  return { checkId: check.id, severity: check.severity, message, entity: row.consumer, pointer: `${row.pointer}/output` };
+}
+
+export const LIVE_CHECKS: readonly WorkspaceCheck[] = [
+  {
+    id: "WSP141",
+    name: "link-live-missing",
+    description: "With --live, a member link names an output its producer's estate publishes now, matched exactly. A producer whose declared output isn't deployed yet, or was renamed in the estate, fails this for every consumer.",
+    severity: "warning",
+    configurable: true,
+    check(ctx) {
+      return (ctx.facts?.live?.rows ?? [])
+        .filter((r) => r.status === "missing")
+        .map((r) => liveFinding(this, r, `${describeLink(r)} does not resolve live in ${ctx.facts!.live!.env}: ${r.reason}`));
+    },
+  },
+  {
+    id: "WSP142",
+    name: "link-live-unresolved",
+    description: "With --live, a member link that could not be resolved against a live read is kept, unresolved, and reported: the producer's kind is not read live, its read failed, or the read returned no outputs.",
+    severity: "info",
+    configurable: true,
+    check(ctx) {
+      return (ctx.facts?.live?.rows ?? [])
+        .filter((r) => r.status === "unresolved")
+        .map((r) => liveFinding(this, r, `${describeLink(r)} is kept unresolved in ${ctx.facts!.live!.env}: ${r.reason}`));
+    },
+  },
+];

package/src/workspace/checks.test.ts

@@ -75,7 +75,7 @@ describe("the WSP catalog", () => {
     expect(list.filter((id) => /^WSP(07|08|09|10)\d$/.test(id))).toEqual([
       "WSP071", "WSP072", "WSP073",
       "WSP081", "WSP082", "WSP083",
-      "WSP091", "WSP092", "WSP093", "WSP094", "WSP095", "WSP096", "WSP097",
+      "WSP091", "WSP092", "WSP093", "WSP094", "WSP095", "WSP096", "WSP097", "WSP098",
       "WSP101", "WSP102", "WSP103", "WSP104", "WSP105", "WSP106",
     ]);
   });
@@ -111,7 +111,7 @@ describe("declaration checks (#2535)", () => {
         column: 15,
         ruleId: "WSP003",
         severity: "error",
-        message: "member infra has kind terraform, which no built-in kind or pinned package supplies; known kinds: chant, other, workspace",
+        message: "member infra has kind terraform, which no built-in kind or pinned package supplies; known kinds: chant, design, other, workspace",
         entity: "infra",
       },
     ]);