@intentius/chant 0.124.44 → 0.124.46

package/src/cli/handlers/declared-graph.ts

@@ -0,0 +1,99 @@
+import { dirname } from "node:path";
+import { mergeBuildRootEntities } from "../../build";
+import { loadChantConfigUpward, type ChantConfig } from "../../config";
+import type { Declarable } from "../../declarable";
+import { applyLexiconGraphEdges, type GraphIR, type LexiconGraphEdges } from "../../graph-ir";
+import type { BuildRootContributor, LexiconPlugin } from "../../lexicon";
+import { formatError, formatWarning } from "../format";
+import { collectBuildRootContributors, loadPlugins, resolveProjectLexicons } from "../plugins";
+import type { CommandContext } from "../registry";
+
+/**
+ * The pieces of the declared graph that `chant graph` and `chant search` both
+ * read (#1626, #4365, #4368). They live here, once, so the two commands answer
+ * over the same entity set and the same edges: search drifted from graph once
+ * already, answering `(no matches)` over a `terraform.roots` project graph drew
+ * in full, because it never ran the build-root contributors.
+ */
+
+/**
+ * The build-root contributors this invocation's project configures (#1626):
+ * a `terraform.roots` root's blocks, a `k8s.kustomize.roots` root's rendered
+ * objects. The same closures `chant build` and the lifecycle handlers hand to
+ * `BuildOptions.buildRoots`, bound here for the discover-based paths, which
+ * never run `build()` and so never ran the hook.
+ *
+ * Neither command is `requiresPlugins` (Op/source-graph modes must work
+ * without a lexicon), so plugins are loaded here when `ctx.plugins` is empty.
+ * Rooted at the config's own directory, like `cli/commands/build.ts`: a
+ * relative root resolves against where it was declared, not against a
+ * sourceDir-scoped path. A project that fails to load plugins degrades to no
+ * contributors with a warning rather than failing modes that never needed
+ * plugins at all.
+ */
+export async function declaredBuildRootContributors(
+  ctx: CommandContext,
+  projectPath: string,
+): Promise<BuildRootContributor[]> {
+  const { config, configPath } = await loadChantConfigUpward(projectPath).catch(
+    () => ({ config: {} as ChantConfig, configPath: undefined }),
+  );
+  let plugins = ctx.plugins;
+  if (plugins.length === 0) {
+    try {
+      plugins = await loadPlugins(await resolveProjectLexicons(projectPath));
+    } catch (err) {
+      console.error(formatWarning({
+        message: `could not load the project's lexicons — build-root entities (terraform and kustomize roots) will be missing from the graph (${err instanceof Error ? err.message : String(err)})`,
+      }));
+      return [];
+    }
+  }
+  return collectBuildRootContributors(
+    plugins,
+    config as unknown as Record<string, unknown>,
+    configPath ? dirname(configPath) : projectPath,
+  );
+}
+
+/**
+ * Merge build-root contributions into a discovered entity set: the exact
+ * merge `build()` performs (one implementation: `mergeBuildRootEntities`,
+ * ../../build.ts), with its warnings and errors printed. Returns false when a
+ * contributor failed or a name collided; the caller stops, because a graph
+ * missing the entities the build would refuse over must not be answered from
+ * as if complete.
+ */
+export async function mergeDeclaredBuildRoots(
+  entities: Map<string, Declarable>,
+  contributors: BuildRootContributor[],
+): Promise<boolean> {
+  if (contributors.length === 0) return true;
+  const merged = await mergeBuildRootEntities(entities, contributors);
+  for (const w of merged.warnings) console.error(formatWarning({ message: w }));
+  if (merged.errors.length > 0) {
+    for (const message of merged.errors) console.error(formatError({ message }));
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Add the edges the lexicons' `graphEdges` hooks resolve (#3910): CI
+ * dependencies written as strings (`needs`, `uses:`, `trigger:`, `include:`,
+ * `extends`), which the AttrRef walk in `buildGraphIr` cannot see. A hook that
+ * throws costs its own edges and a warning, not the graph.
+ */
+export function withLexiconEdges(ir: GraphIR, plugins: readonly LexiconPlugin[], entities: Map<string, Declarable>): GraphIR {
+  const reports: LexiconGraphEdges[] = [];
+  for (const p of plugins) {
+    if (!p.graphEdges) continue;
+    try {
+      const report = p.graphEdges(entities);
+      if (report) reports.push(report);
+    } catch (err) {
+      console.error(formatWarning({ message: `the ${p.name} lexicon's graphEdges failed (${err instanceof Error ? err.message : String(err)}); its edges are left out` }));
+    }
+  }
+  return reports.length === 0 ? ir : applyLexiconGraphEdges(ir, reports);
+}

package/src/cli/handlers/graph.test.ts

@@ -75,9 +75,10 @@ vi.mock("../../lifecycle/replay", () => ({
   hasSnapshot: (...a: unknown[]) => hasSnapshotMock(...a),
 }));
 
-vi.mock("../../lifecycle/observe", () => ({
-  observeResources: (...a: unknown[]) => observeMock(...a),
-}));
+vi.mock("../../lifecycle/observe", async () => {
+  const actual = await vi.importActual<typeof import("../../lifecycle/observe")>("../../lifecycle/observe");
+  return { carryAnnotations: actual.carryAnnotations, observeResources: (...a: unknown[]) => observeMock(...a) };
+});
 // `runGraphLive` resolves each component's `cfn-deploy` stack(s) (#57) so a
 // multi-stack, per-component project observes the right stacks; default to
 // "no components" (empty map, no errors) so the existing single-stack --live
@@ -544,6 +545,66 @@ describe("runGraph", () => {
       });
     });
 
+    // behold#919: a project that reads source it did not author (a workspace
+    // reader project, behold's scratch project for a bare Terraform folder)
+    // sets `graph.lint: "report"`, and a lint error is a finding about the
+    // estate, carried on meta.lint, not a reason to draw nothing.
+    describe('graph.lint: "report" (behold#919)', () => {
+      const finding = { file: "/abs/estate/db.tf", line: 4, column: 3, ruleId: "TF033", severity: "error", message: "[estate/aws_db_instance.orders] storage_encrypted is false", entity: "estate/aws_db_instance.orders" };
+      const warning = { file: "/abs/estate/net.tf", line: 9, column: 1, ruleId: "TF010", severity: "warning", message: "a warning" };
+      const reportMode = (): void => {
+        loadChantConfigUpwardMock.mockResolvedValue({ config: { graph: { lint: "report" } } });
+      };
+
+      test("emits the graph with lint errors, every finding on meta.lint", async () => {
+        reportMode(); discovered();
+        lintMock.mockResolvedValue({ success: false, diagnostics: [finding, warning] });
+        const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+        expect(exit).toBe(0);
+        const ir = JSON.parse(stdoutBuf.join("\n"));
+        expect(ir.nodes.map((n: { id: string }) => n.id).sort()).toEqual(["pod", "subnet", "vpc"]);
+        expect(ir.meta.lint).toEqual({
+          errors: 1,
+          warnings: 1,
+          findings: [
+            { ruleId: "TF033", severity: "error", message: "[estate/aws_db_instance.orders] storage_encrypted is false", file: "/abs/estate/db.tf", line: 4, column: 3, entity: "estate/aws_db_instance.orders" },
+            { ruleId: "TF010", severity: "warning", message: "a warning", file: "/abs/estate/net.tf", line: 9, column: 1 },
+          ],
+        });
+        expect(stderrBuf.join("\n")).toMatch(/with 1 lint error: graph\.lint is "report"/);
+      });
+
+      test("a clean read still carries meta.lint, so a reader can tell clean from not looked", async () => {
+        reportMode(); lintClean(); discovered();
+        const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+        expect(exit).toBe(0);
+        expect(JSON.parse(stdoutBuf.join("\n")).meta.lint).toEqual({ errors: 0, warnings: 0, findings: [] });
+      });
+
+      test("the default gate is unchanged, and adds no meta.lint", async () => {
+        lintClean(); discovered();
+        await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+        expect(JSON.parse(stdoutBuf.join("\n")).meta?.lint).toBeUndefined();
+      });
+
+      test("an uninstalled dependency still refuses: there is no source to read", async () => {
+        const project = realpathSync(mkdtempSync(join(tmpdir(), "chant-919-graph-")));
+        try {
+          reportMode(); discovered();
+          lintMock.mockResolvedValue({
+            success: false,
+            diagnostics: [{ file: join(project, "a.ts"), line: 1, column: 1, ruleId: "LEX002", severity: "error", message: `Cannot find package '@intentius/chant-lexicon-aws' imported from ${join(project, "a.ts")}` }],
+          });
+          const exit = await runGraph({ args: makeArgs({ format: "ir", path: project }), plugins: [], serializers: [] });
+          expect(exit).toBe(1);
+          expect(stdoutBuf.join("\n")).toBe("");
+          expect(stderrBuf.join("\n")).toContain("dependencies not installed");
+        } finally {
+          rmSync(project, { recursive: true, force: true });
+        }
+      });
+    });
+
     test("--format mermaid emits a flowchart", async () => {
       lintClean(); discovered();
       const exit = await runGraph({ args: makeArgs({ format: "mermaid" }), plugins: [], serializers: [] });
@@ -872,6 +933,36 @@ describe("runGraph", () => {
       expect(out).toContain("web-vpc");
     });
 
+    // #4372 — a planned create is absent, and its plan attributes ride beside
+    // the verdict as annotations. `--overlay` puts them on the declared node,
+    // which keeps its pending paint: behold's plan cards read this IR.
+    test("--overlay carries an absent entity's annotations onto its declared node, still pending", async () => {
+      resolveLexMock.mockResolvedValue(["terraform"]);
+      loadPluginsMock.mockResolvedValue([
+        { name: "terraform", serializer: {}, describeResources: () => Promise.resolve({}) },
+      ]);
+      discoverMock.mockResolvedValue({
+        entities: new Map([
+          ["app/terraform_data.created", decl({ lexicon: "terraform", entityType: "Terraform::Resource", props: {} })],
+        ]),
+        errors: [],
+        sourceFiles: [],
+      });
+      observeMock.mockResolvedValue({
+        observations: [],
+        errors: [],
+        warnings: [],
+        annotations: { "app/terraform_data.created": { planAction: "create", planAfterUnknown: ["id"] } },
+      });
+      // `--detail 3`, as behold asks: lower tiers thin list attributes.
+      const exit = await runGraph({ args: makeArgs({ format: "ir", live: true, overlay: true, env: "prod", detail: 3 }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      const ir = JSON.parse(stdoutBuf.join("\n")) as { nodes: Array<{ id: string; physicalId?: string; attrs: Record<string, unknown> }> };
+      const node = ir.nodes.find((n) => n.id === "app/terraform_data.created");
+      expect(node?.attrs).toMatchObject({ _status: "accent", planAction: "create", planAfterUnknown: ["id"] });
+      expect(node?.physicalId).toBeUndefined();
+    });
+
     // #2377 — the overlay carries the prediction. behold's reader takes
     // `attrs._behaviour` per node and `meta._behaviour` on the graph, and
     // reads the absence of both as "not looked" rather than as a refusal, so

package/src/cli/handlers/graph.ts

@@ -1,15 +1,15 @@
-import { dirname, resolve } from "node:path";
+import { isAbsolute, relative, resolve } from "node:path";
 import { discoverOps } from "../../op/discover";
 import { discover } from "../../discovery/index";
-import { partitionByLexicon, computeStackGraph, build, mergeBuildRootEntities } from "../../build";
-import { applyLexiconGraphEdges, applyLexiconOutputs, buildGraphIr, buildLiveGraphIr, collectUnobserved, overlayGraphs, sourceOverlayGraphs, GRAPH_IR_VERSION, type GraphIR, type IRPipeline, type LexiconGraphEdges, type LexiconWorkspaceOutputs, type LiveObservation } from "../../graph-ir";
+import { partitionByLexicon, computeStackGraph, build } from "../../build";
+import { applyLexiconOutputs, buildGraphIr, buildLiveGraphIr, collectUnobserved, overlayGraphs, sourceOverlayGraphs, GRAPH_IR_VERSION, type GraphIR, type IRPipeline, type LexiconWorkspaceOutputs, type LiveObservation } from "../../graph-ir";
 import { behaviourOverlay } from "../../behaviour-overlay";
 import type { SerializerResult } from "../../serializer";
 import { applyBehaviourOverlay, behaviourRequestFromIr } from "../../behaviour-graph";
 import { buildDeclaredPerStack } from "../../graph-declared";
 import { mergeProjectOps } from "../../graph-ops";
 import { reconstructEdges, mergeCatalogs, containmentGroups, type ReferenceCatalog, type ContainmentPair } from "../../graph-refs";
-import { observeResources } from "../../lifecycle/observe";
+import { carryAnnotations, observeResources } from "../../lifecycle/observe";
 import { withLiveReadSession } from "../../live-read-session";
 import { replaySnapshots, hasSnapshot } from "../../lifecycle/replay";
 import { loadChantConfig, environmentNames, matchesDeclaredEnvironment, loadChantConfigUpward, type ChantConfig } from "../../config";
@@ -22,6 +22,12 @@ import { getLayoutEngine, toLayoutInput, type NodeSize } from "../../graph-layou
 import { lintCommand, type LintResult } from "../commands/lint";
 import { reportUninstalledDependencies } from "../dependencies";
 import { loadPlugins, resolveProjectLexicons, collectBuildRootContributors } from "../plugins";
+// One copy for graph and search (#4365): the build-root join and the lexicon edges.
+import {
+  declaredBuildRootContributors as graphBuildRootContributors,
+  mergeDeclaredBuildRoots as mergeGraphBuildRoots,
+  withLexiconEdges,
+} from "./declared-graph";
 import { isNoLexiconDetected } from "../../detectLexicon";
 import { readFileSync } from "node:fs";
 import { formatError, formatWarning, formatBold } from "../format";
@@ -78,69 +84,6 @@ async function graphBuildParams(
   return resolution.provenance;
 }
 
-/**
- * The build-root contributors this invocation's project configures (#1626) —
- * the same closures `chant build` and the lifecycle handlers hand to
- * `BuildOptions.buildRoots`, bound here for the graph command's
- * discover-based paths, which never run `build()` and so never ran the hook:
- * a `k8s.kustomize.roots` estate graphed only its typed source while its
- * built (and deployed) output carried the rendered manifests too.
- *
- * `graph` is not `requiresPlugins` (Op/source-graph modes must work without a
- * lexicon), so plugins are loaded here when `ctx.plugins` is empty, mirroring
- * `runGraphLive`. Rooted at the config's own directory, like
- * `cli/commands/build.ts` — a relative kustomize root resolves against where
- * it was declared, not against a sourceDir-scoped graph path. A project that
- * fails to load plugins degrades to no contributors with a warning rather
- * than failing modes that never needed plugins at all.
- */
-async function graphBuildRootContributors(
-  ctx: CommandContext,
-  projectPath: string,
-): Promise<Array<import("../../lexicon").BuildRootContributor>> {
-  const { config, configPath } = await loadChantConfigUpward(projectPath).catch(
-    () => ({ config: {} as ChantConfig, configPath: undefined }),
-  );
-  let plugins = ctx.plugins;
-  if (plugins.length === 0) {
-    try {
-      plugins = await loadPlugins(await resolveProjectLexicons(projectPath));
-    } catch (err) {
-      console.error(formatWarning({
-        message: `could not load the project's lexicons — build-root entities (kustomize roots) will be missing from the graph (${err instanceof Error ? err.message : String(err)})`,
-      }));
-      return [];
-    }
-  }
-  return collectBuildRootContributors(
-    plugins,
-    config as unknown as Record<string, unknown>,
-    configPath ? dirname(configPath) : projectPath,
-  );
-}
-
-/**
- * Merge build-root contributions into a discovered entity set — the exact
- * merge `build()` performs (one implementation: `mergeBuildRootEntities`,
- * ../../build.ts), surfaced in the graph command's error style. Returns false
- * when a contributor failed or a name collided; the caller stops, matching
- * how the discover-based paths treat discovery errors — a graph missing the
- * entities the build would refuse over must not be emitted as if complete.
- */
-async function mergeGraphBuildRoots(
-  entities: Map<string, import("../../declarable").Declarable>,
-  contributors: Array<import("../../lexicon").BuildRootContributor>,
-): Promise<boolean> {
-  if (contributors.length === 0) return true;
-  const merged = await mergeBuildRootEntities(entities, contributors);
-  for (const w of merged.warnings) console.error(formatWarning({ message: w }));
-  if (merged.errors.length > 0) {
-    for (const message of merged.errors) console.error(formatError({ message }));
-    return false;
-  }
-  return true;
-}
-
 /** #1675 — join git-root ops into a discovered entity map; op-discovery
  * errors are warnings here (the lint gate never saw those files). */
 async function mergeGraphOps(
@@ -187,6 +130,15 @@ async function runGraphCommand(ctx: CommandContext): Promise<number> {
     }));
     return 1;
   }
+  // The capability view (#4378) is built from the declared entity graph's IR,
+  // the read `chant workspace graph --capability-view` asks each member for.
+  if (ctx.args.capabilityView && (ctx.args.format !== "ir" || ctx.args.components || ctx.args.live || ctx.args.at)) {
+    console.error(formatError({
+      message: "--capability-view adds the capability view to the declared graph's IR, so it needs --format ir and takes no --components, --live or --at",
+      hint: "chant graph --format ir --detail 3 --capability-view",
+    }));
+    return 1;
+  }
   // `--at` graphs a recorded observation instead of reading the estate (#1279).
   // Two different observations with no rule for which wins, so not both.
   if (ctx.args.at && ctx.args.live) {
@@ -325,6 +277,8 @@ async function runGraphLive(
 
     let ir: GraphIR;
     let observations: LiveObservation[];
+    // Facts about absent entities (#4372), carried onto the overlay's nodes.
+    let annotations: Record<string, Record<string, unknown>> | undefined;
     // A replay is a graph of what was recorded, so it must not reach the provider
     // at all — not for observation and not for enrichment. Anything that quietly
     // called out would make `--at` a live read with an older label on it.
@@ -353,6 +307,7 @@ async function runGraphLive(
         ...(args.namespace ? { namespace: args.namespace } : {}),
       });
       observations = observeResult.observations;
+      annotations = observeResult.annotations;
       const { errors, warnings, notes = [] } = observeResult;
       for (const e of errors) console.error(formatWarning({ message: e }));
       // Unobserved entities (#1089) arrive as warnings — a node missing from the
@@ -465,6 +420,10 @@ async function runGraphLive(
             : sourceOverlayGraphs(declaredIr, ir, overlayOpts);
       }
     }
+    // What a read learned about an entity it found absent (#4372), on the
+    // declared node beside the overlay's `_status`. A planned create keeps its
+    // pending paint and carries the plan's attributes.
+    ir = { ...ir, nodes: carryAnnotations(ir.nodes, annotations) };
   }
 
   // Behaviour overlay (#2377, epic #2355): carry a prediction on the graph.
@@ -574,6 +533,82 @@ function refuseLintGate(lint: LintResult, projectPath: string): void {
   );
 }
 
+/** One lint finding as `meta.lint` carries it (INTENTIUS/behold#919). */
+export interface GraphLintFinding {
+  ruleId: string;
+  severity: string;
+  message: string;
+  /** Relative to the project when inside it, else as lint reported it. */
+  file: string;
+  line: number;
+  column: number;
+  /** The entity a post-synth check named, which is the graph node's id. Absent for a source-file rule. */
+  entity?: string;
+}
+
+/**
+ * What a `graph.lint: "report"` project's entity graph carries on `meta.lint`:
+ * the counts `chant lint` would print and every finding behind them, warnings
+ * included. Present on every graph such a project emits, findings or none, so
+ * a reader can tell "linted, clean" from "not looked" (no key).
+ */
+export interface GraphLintReport {
+  errors: number;
+  warnings: number;
+  findings: GraphLintFinding[];
+}
+
+/** The project's `graph.lint`: `"report"` only when it says so (#919). */
+async function graphLintMode(projectPath: string): Promise<"gate" | "report"> {
+  const { config } = await loadChantConfigUpward(projectPath).catch(() => ({ config: {} as ChantConfig }));
+  return config.graph?.lint === "report" ? "report" : "gate";
+}
+
+export function graphLintReport(lint: LintResult, projectPath: string): GraphLintReport {
+  const rel = (file: string) => {
+    if (!isAbsolute(file)) return file;
+    const r = relative(projectPath, file);
+    return r.startsWith("..") ? file : r;
+  };
+  const findings = (lint.diagnostics ?? []).map((d) => ({
+    ruleId: d.ruleId,
+    severity: d.severity,
+    message: d.message,
+    file: rel(d.file),
+    line: d.line,
+    column: d.column,
+    ...(d.entity ? { entity: d.entity } : {}),
+  }));
+  return {
+    errors: findings.filter((f) => f.severity === "error").length,
+    warnings: findings.filter((f) => f.severity === "warning").length,
+    findings,
+  };
+}
+
+/**
+ * The lint gate for the entity graph. Returns false when the graph must not be
+ * emitted, having printed why. A `graph.lint: "report"` project passes with
+ * lint errors and says so on stderr, unless an error is an uninstalled
+ * dependency: then there is no source to read, and it refuses as the gate does.
+ */
+function passLintGate(lint: LintResult, projectPath: string, mode: "gate" | "report"): boolean {
+  if (lint.success) return true;
+  if (mode === "gate") {
+    refuseLintGate(lint, projectPath);
+    return false;
+  }
+  const errors = (lint.diagnostics ?? []).filter((d) => d.severity === "error").map((d) => d.message);
+  if (reportUninstalledDependencies(errors, projectPath)) return false;
+  const n = errors.length;
+  console.error(
+    formatWarning({
+      message: `Emitting the graph with ${n} lint error${n === 1 ? "" : "s"}: graph.lint is "report", so every finding is on the IR's meta.lint. Run \`chant lint\` to see them.`,
+    }),
+  );
+  return true;
+}
+
 /**
  * `chant graph --components --format ir|mermaid|dot|layout` — the component DAG
  * projected into the renderable IR (nodes = components, `groups.byWave` = the
@@ -718,7 +753,9 @@ async function buildPipelineProjection(
  * `--node-sizes` so spacing fits real node footprints, and defaults to the dagre
  * engine (no native dependency); `--layout-engine graphviz` opts into `dot`.
  * Lint-gated: the IR represents valid infra, so we refuse to emit for source that
- * does not pass lint. Non-zero on discovery errors or a layout-engine failure.
+ * does not pass lint, unless the project's config sets `graph.lint: "report"`
+ * (#919): then the graph is emitted and the findings ride on `meta.lint`.
+ * Non-zero on discovery errors or a layout-engine failure.
  */
 /**
  * Add what the lexicons' `graphMeta` hooks report to `ir.meta` (#2559). A
@@ -741,26 +778,6 @@ function withGraphMeta(ir: GraphIR, plugins: LexiconPlugin[], entities: Map<stri
   return Object.keys(added).length === 0 ? ir : { ...ir, meta: { ...(ir.meta ?? {}), ...added } };
 }
 
-/**
- * Add the edges the lexicons' `graphEdges` hooks resolve (#3910): CI
- * dependencies written as strings (`needs`, `uses:`, `trigger:`, `include:`,
- * `extends`), which the AttrRef walk in `buildGraphIr` cannot see. A hook that
- * throws costs its own edges and a warning, not the graph.
- */
-function withLexiconEdges(ir: GraphIR, plugins: LexiconPlugin[], entities: Map<string, import("../../declarable").Declarable>): GraphIR {
-  const reports: LexiconGraphEdges[] = [];
-  for (const p of plugins) {
-    if (!p.graphEdges) continue;
-    try {
-      const report = p.graphEdges(entities);
-      if (report) reports.push(report);
-    } catch (err) {
-      console.error(formatWarning({ message: `the ${p.name} lexicon's graphEdges failed (${err instanceof Error ? err.message : String(err)}); its edges are left out` }));
-    }
-  }
-  return reports.length === 0 ? ir : applyLexiconGraphEdges(ir, reports);
-}
-
 /**
  * Add the outputs the lexicons' `workspaceOutputs` hooks report (#3931) to
  * the IR's `exports`: a sql table and each of its columns, which `chant
@@ -876,17 +893,16 @@ async function runGraphView(
   const buildParams = await graphBuildParams(ctx, projectPath);
   if (!buildParams) return 1;
 
-  // Gate: only emit for lint-clean source.
+  // Gate: only emit for lint-clean source, unless the project reads source it
+  // did not author and asks for the findings instead (`graph.lint`, #919).
   const lint = await lintCommand({
     path: ctx.args.path,
     format: "stylish",
     sandbox: ctx.args.sandbox,
     buildParams,
   });
-  if (!lint.success) {
-    refuseLintGate(lint, projectPath);
-    return 1;
-  }
+  const lintMode = await graphLintMode(projectPath);
+  if (!passLintGate(lint, projectPath, lintMode)) return 1;
 
   const result = await discover(projectPath, { buildParams });
   if (result.errors.length > 0) {
@@ -913,10 +929,10 @@ async function runGraphView(
   // The declared half of the epic's delta (#2355): this path predicts the
   // file, the live path predicts the account. Same helper, so the two shapes
   // reach the engine by one route and stay comparable.
+  const plugins = ctx.plugins.length > 0
+    ? ctx.plugins
+    : await loadPlugins(await projectLexiconsOrNone(projectPath));
   {
-    const plugins = ctx.plugins.length > 0
-      ? ctx.plugins
-      : await loadPlugins(await projectLexiconsOrNone(projectPath));
     ir = withLexiconEdges(ir, plugins as LexiconPlugin[], result.entities);
     ir = withLexiconOutputs(ir, plugins as LexiconPlugin[], result.entities);
     const predicted = await predictOntoIr(ir, plugins as LexiconPlugin[], ctx.args, {
@@ -951,6 +967,17 @@ async function runGraphView(
       if (notice) console.error(formatWarning({ message: notice }));
     }
   }
+  // Last, so no lens or detail pass can drop it: the findings are about the
+  // whole source read, not about the nodes this view kept.
+  if (lintMode === "report") ir = { ...ir, meta: { ...ir.meta, lint: graphLintReport(lint, projectPath) } };
+  // The view capability rules read (#4378), mapped by this project's own
+  // lexicons, so a workspace's rules read each member as its chant maps it.
+  if (ctx.args.capabilityView) {
+    const { buildView, serializeView } = await import("../../capabilities/view");
+    const { resolvePacks } = await import("../../capabilities/catalog");
+    const packs = (plugins as LexiconPlugin[]).map((p) => p.capabilityPack).filter((p): p is NonNullable<typeof p> => !!p);
+    ir = { ...ir, capabilityView: serializeView(buildView(ir, resolvePacks(packs))) };
+  }
   return emitIr(ir, ctx, format);
 }