@intentius/chant 0.124.45 → 0.124.48

package/dist/__golden__/wave-loop/op-overridden.json

@@ -340,6 +340,22 @@
     "wave 1 (net) applies vpc under their overrides, which are now spent"
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "dns": {
+          "status": "applied"
+        },
+        "nat": {
+          "status": "applied"
+        },
+        "vpc": {
+          "status": "applied"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/dns.plan.json": {
       "planDigest": "sha256:2222222222222222222222222222222222222222222222222222222222222222"
     },

package/dist/__golden__/wave-loop/op-per-run.json

@@ -418,6 +418,26 @@
     "Nothing in wave 2 or after it ran. Read the plans, then approve: chant approve migrations migrations-wave-2 --plan jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d (with --resume, the approval also starts this job again)"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "dev": {
+          "status": "applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-1/dev.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-point.json

@@ -402,6 +402,19 @@
     "wave 1 (prod): the decision point at base cannot be asked (waves.json at bbbbbbbbbbbb: `point.name` is a decision point's name: lower case letters, digits and hyphens, starting with a letter), so nothing in it was planned or applied"
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "db": {
+          "status": "failed"
+        },
+        "net": {
+          "status": "failed"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/db.hooks.json": {
       "version": 1,
       "opWaves": "tf-apply",

package/dist/__golden__/wave-loop/op-pr-review.json

@@ -330,6 +330,16 @@
     "Nothing in wave 2 or after it ran. Read the plans, then approve: chant approve migrations migrations-wave-2 --plan jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d (with --resume, the approval also starts this job again)"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-sealed.json

@@ -85,6 +85,16 @@
     "Nothing in wave 2 or after it ran. Read the plans, then approve: chant approve migrations migrations-wave-2 --plan jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d --sign (with --resume, the approval also starts this job again)"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.plan.json": {
       "planDigest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
       "destructive": true

package/dist/__golden__/wave-loop/op-spend-change-only.json

@@ -114,6 +114,16 @@
     "wave 2 (staging) applies under the approval by alice at 2026-10-10T00:00:00Z, which is now spent"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "applied"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-spend.json

@@ -278,6 +278,16 @@
     "wave 2 (staging) could not record that it applies under the approval by alice, so nothing applied: this gate ledger cannot record an applied approval"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "staging": {
+          "status": "failed"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-2/staging.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/__golden__/wave-loop/op-wave-commands.json

@@ -1503,6 +1503,22 @@
     "wave 2 (apps): gate never (read at bbbbbbbbbbbb), digest jcs1-sha256:528ae61c94cd24622aade0c3b2acbebe58dfa1789f13f71de15b9d5d7519f0d3: not-required"
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "dns": {
+          "status": "waiting"
+        },
+        "nat": {
+          "status": "waiting"
+        },
+        "vpc": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/dns.plan.json": {
       "planDigest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
       "empty": true
@@ -1810,6 +1826,45 @@
           "outcome": "passed"
         }
       ]
+    },
+    "wide-outcomes/outcome-wave-2-share-1.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "a1": {
+          "status": "applied"
+        },
+        "a2": {
+          "status": "applied"
+        }
+      }
+    },
+    "wide-outcomes/outcome-wave-2-share-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "a3": {
+          "status": "applied"
+        }
+      }
+    },
+    "wide-outcomes/outcome-wave-2.json": {
+      "version": 1,
+      "wave": 2,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "a1": {
+          "status": "decided"
+        },
+        "a2": {
+          "status": "decided"
+        },
+        "a3": {
+          "status": "decided"
+        }
+      }
     }
   }
 }

package/dist/__golden__/wave-loop/op-wide-refused.json

@@ -190,6 +190,32 @@
     "wave 1 (apps) is refused by its policy; nothing applied."
   ],
   "files": {
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1-share-2.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
+    ".chant/op-waves/tf-apply/outcomes/outcome-wave-1.json": {
+      "version": 1,
+      "wave": 1,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "refused"
+        },
+        "t2": {
+          "status": "refused"
+        },
+        "t3": {
+          "status": "refused"
+        }
+      }
+    },
     ".chant/op-waves/tf-apply/wave-1/plans.json": {
       "runs": [
         {

package/dist/__golden__/wave-loop/op-wide-waiting.json

@@ -178,6 +178,35 @@
     "wave 3 (prod) is waiting on migrations-wave-3; nothing applied. chant approve migrations migrations-wave-3 --plan jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "waiting"
+        },
+        "t2": {
+          "status": "waiting"
+        },
+        "t3": {
+          "status": "waiting"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.plan.json": {
       "planDigest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
     },

package/dist/__golden__/wave-loop/op-wide.json

@@ -351,6 +351,45 @@
     "t2: its plan moved since wave 3 was decided, so it was not applied. decided: sha256:2222222222222222222222222222222222222222222222222222222222222222; planned now: sha256:9999999999999999999999999999999999999999999999999999999999999999"
   ],
   "files": {
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-1.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "applied"
+        },
+        "t2": {
+          "status": "not-applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3-share-2.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t3": {
+          "status": "applied"
+        }
+      }
+    },
+    ".chant/op-waves/migrations/outcomes/outcome-wave-3.json": {
+      "version": 1,
+      "wave": 3,
+      "at": "2026-10-11T00:00:00.000Z",
+      "members": {
+        "t1": {
+          "status": "decided"
+        },
+        "t2": {
+          "status": "decided"
+        },
+        "t3": {
+          "status": "decided"
+        }
+      }
+    },
     ".chant/op-waves/migrations/wave-3/t1.hooks.json": {
       "version": 1,
       "opWaves": "migrations",

package/dist/action-pins.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The GitHub Actions the workflows chant generates use, each pinned by commit
+ * SHA (#4403). A tag can move; a SHA cannot. Every generator takes its `uses:`
+ * from here, so an update is one change to this table. Each row is the commit
+ * the named major tag pointed at, with the release that commit carries;
+ * `tagComments` writes that release beside each `uses:` line.
+ *
+ * Forgejo's actions mirror (code.forgejo.org) carries the same commits. The
+ * forgejo lexicon moves `upload-artifact` and `download-artifact` to v3, whose
+ * rows are here too: v4 and later refuse to run on a Forgejo runner (#4008).
+ *
+ * Refresh a row by resolving the major tag to its commit:
+ *
+ *   gh api repos/actions/checkout/commits/v6 --jq .sha
+ */
+export interface ActionPin {
+    /** The action, with its subpath: `actions/cache/restore`. */
+    readonly slug: string;
+    /** The major tag the row follows, such as `v4`. */
+    readonly major: string;
+    readonly sha: string;
+    /** The release at that commit, written beside the `uses:` line. */
+    readonly tag: string;
+}
+export declare const ACTION_PINS: {
+    readonly checkout7: ActionPin;
+    readonly checkout6: ActionPin;
+    readonly checkout4: ActionPin;
+    readonly setupNode6: ActionPin;
+    readonly setupNode4: ActionPin;
+    readonly setupNode7: ActionPin;
+    readonly cache6: ActionPin;
+    readonly uploadArtifact7: ActionPin;
+    readonly downloadArtifact8: ActionPin;
+    readonly setupGo7: ActionPin;
+    readonly setupPython7: ActionPin;
+    readonly setupBun2: ActionPin;
+    readonly golangciLint9: ActionPin;
+    readonly dockerLogin4: ActionPin;
+    readonly dockerSetupBuildx4: ActionPin;
+    readonly dockerMetadata6: ActionPin;
+    readonly dockerBuildPush7: ActionPin;
+    readonly createGithubAppToken2: ActionPin;
+    readonly cacheRestore4: ActionPin;
+    readonly cacheSave4: ActionPin;
+    readonly uploadArtifact4: ActionPin;
+    readonly uploadArtifact3: ActionPin;
+    readonly downloadArtifact4: ActionPin;
+    readonly downloadArtifact3: ActionPin;
+};
+/** The `uses:` value for a pin: `actions/checkout@<sha>`. */
+export declare const usesRef: (p: ActionPin) => string;
+/** Write each pinned `uses:` line's release beside it, as `# v4.4.0`. A line that has a comment, or a SHA not in the table, is left alone. */
+export declare function tagComments(yaml: string): string;
+/** Every `uses:` in a workflow that names an action by a tag or branch, not a 40-character commit SHA. Local actions and docker images are not actions on a forge. */
+export declare function unpinnedActions(yaml: string): string[];
+/** The row for the same action as the one `sha` pins, at `major`. The forgejo lexicon uses it to move a pinned `upload-artifact` v4 to v3. */
+export declare function pinAtMajor(sha: string, major: string): ActionPin | undefined;
+/** The major of the row `sha` belongs to, as a number, when it is in the table. */
+export declare function pinMajor(sha: string): number | undefined;
+//# sourceMappingURL=action-pins.d.ts.map

package/dist/action-pins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-pins.d.ts","sourceRoot":"","sources":["../src/action-pins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,SAAS;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAID,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;CAyBsB,CAAC;AAE/C,6DAA6D;AAC7D,eAAO,MAAM,OAAO,MAAO,SAAS,KAAG,MAA8B,CAAC;AAKtE,8IAA8I;AAC9I,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,sKAAsK;AACtK,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQtD;AAED,8IAA8I;AAC9I,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAI5E;AAED,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxD"}

package/dist/action-pins.js

@@ -0,0 +1,77 @@
+/**
+ * The GitHub Actions the workflows chant generates use, each pinned by commit
+ * SHA (#4403). A tag can move; a SHA cannot. Every generator takes its `uses:`
+ * from here, so an update is one change to this table. Each row is the commit
+ * the named major tag pointed at, with the release that commit carries;
+ * `tagComments` writes that release beside each `uses:` line.
+ *
+ * Forgejo's actions mirror (code.forgejo.org) carries the same commits. The
+ * forgejo lexicon moves `upload-artifact` and `download-artifact` to v3, whose
+ * rows are here too: v4 and later refuse to run on a Forgejo runner (#4008).
+ *
+ * Refresh a row by resolving the major tag to its commit:
+ *
+ *   gh api repos/actions/checkout/commits/v6 --jq .sha
+ */
+const pin = (slug, major, sha, tag) => ({ slug, major, sha, tag });
+export const ACTION_PINS = {
+    checkout7: pin("actions/checkout", "v7", "3d3c42e5aac5ba805825da76410c181273ba90b1", "v7.0.1"),
+    checkout6: pin("actions/checkout", "v6", "d23441a48e516b6c34aea4fa41551a30e30af803", "v6.1.0"),
+    checkout4: pin("actions/checkout", "v4", "11d5960a326750d5838078e36cf38b85af677262", "v4.4.0"),
+    setupNode6: pin("actions/setup-node", "v6", "249970729cb0ef3589644e2896645e5dc5ba9c38", "v6.5.0"),
+    setupNode4: pin("actions/setup-node", "v4", "49933ea5288caeca8642d1e84afbd3f7d6820020", "v4.4.0"),
+    setupNode7: pin("actions/setup-node", "v7", "949feb2413d6458794dcd2491c4babbbce0c15c1", "v7.1.0"),
+    cache6: pin("actions/cache", "v6", "55cc8345863c7cc4c66a329aec7e433d2d1c52a9", "v6.1.0"),
+    uploadArtifact7: pin("actions/upload-artifact", "v7", "cf430e030ddbb5b0abf93d22962f4752f3646cd9", "v7.0.2"),
+    downloadArtifact8: pin("actions/download-artifact", "v8", "9000827ccba6bdab643e8b6fd33ac0654aef8333", "v8.0.2"),
+    setupGo7: pin("actions/setup-go", "v7", "b7ad1dad31e06c5925ef5d2fc7ad053ef454303e", "v7.0.0"),
+    setupPython7: pin("actions/setup-python", "v7", "6d4fd22b20465ccc0f7354476588e8df7c9ca0e0", "v7.1.0"),
+    setupBun2: pin("oven-sh/setup-bun", "v2", "0c5077e51419868618aeaa5fe8019c62421857d6", "v2.2.0"),
+    golangciLint9: pin("golangci/golangci-lint-action", "v9", "ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a", "v9.3.0"),
+    dockerLogin4: pin("docker/login-action", "v4", "81c6f93d4bc991e510b342a00b419b3bb4efc5c6", "v4.7.0"),
+    dockerSetupBuildx4: pin("docker/setup-buildx-action", "v4", "f87e5991a6d7451dcb8d9637bfbc97413f497069", "v4.4.1"),
+    dockerMetadata6: pin("docker/metadata-action", "v6", "dc802804100637a589fabce1cb79ff13a1411302", "v6.2.0"),
+    dockerBuildPush7: pin("docker/build-push-action", "v7", "c3c9e263c25d99ce0380d002d59b67737d91b0dc", "v7.4.0"),
+    createGithubAppToken2: pin("actions/create-github-app-token", "v2", "fee1f7d63c2ff003460e3d139729b119787bc349", "v2.2.2"),
+    cacheRestore4: pin("actions/cache/restore", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+    cacheSave4: pin("actions/cache/save", "v4", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4.3.0"),
+    uploadArtifact4: pin("actions/upload-artifact", "v4", "ea165f8d65b6e75b540449e92b4886f43607fa02", "v4.6.2"),
+    uploadArtifact3: pin("actions/upload-artifact", "v3", "ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5", "v3.2.1"),
+    downloadArtifact4: pin("actions/download-artifact", "v4", "d3f86a106a0bac45b974a628896c90dbdf5c8093", "v4.3.0"),
+    downloadArtifact3: pin("actions/download-artifact", "v3", "9bc31d5ccc31df68ecc42ccf4149144866c47d8a", "v3.0.2"),
+};
+/** The `uses:` value for a pin: `actions/checkout@<sha>`. */
+export const usesRef = (p) => `${p.slug}@${p.sha}`;
+const TAG_BY_SHA = new Map();
+for (const p of Object.values(ACTION_PINS))
+    TAG_BY_SHA.set(p.sha, p.tag);
+/** Write each pinned `uses:` line's release beside it, as `# v4.4.0`. A line that has a comment, or a SHA not in the table, is left alone. */
+export function tagComments(yaml) {
+    return yaml.replace(/^(\s*(?:- )?uses: *["']?[^\s"'#]+@([0-9a-f]{40})["']?)[ \t]*$/gm, (line, head, sha) => {
+        const tag = TAG_BY_SHA.get(sha);
+        return tag ? `${head} # ${tag}` : line;
+    });
+}
+/** Every `uses:` in a workflow that names an action by a tag or branch, not a 40-character commit SHA. Local actions and docker images are not actions on a forge. */
+export function unpinnedActions(yaml) {
+    const out = [];
+    for (const m of yaml.matchAll(/^\s*(?:- )?uses: *["']?([^\s"'#]+)["']?/gm)) {
+        const ref = m[1];
+        if (ref.startsWith("./") || ref.startsWith("../") || ref.startsWith("docker://"))
+            continue;
+        if (!/@[0-9a-f]{40}$/.test(ref))
+            out.push(ref);
+    }
+    return out;
+}
+/** The row for the same action as the one `sha` pins, at `major`. The forgejo lexicon uses it to move a pinned `upload-artifact` v4 to v3. */
+export function pinAtMajor(sha, major) {
+    const rows = Object.values(ACTION_PINS);
+    const from = rows.find((p) => p.sha === sha);
+    return from ? rows.find((p) => p.slug === from.slug && p.major === major) : undefined;
+}
+/** The major of the row `sha` belongs to, as a number, when it is in the table. */
+export function pinMajor(sha) {
+    const row = Object.values(ACTION_PINS).find((p) => p.sha === sha);
+    return row ? Number(row.major.slice(1)) : undefined;
+}

package/dist/capabilities/aws.paths

@@ -0,0 +1,148 @@
+# Capabilities over AWS resources (#4375, ruled on #4361).
+#
+# Rules read the lexicon-neutral view, not the IR. Labels (Instance, Role,
+# SecurityGroup) and edge names (subnet, sg, statement) come from each
+# lexicon's mapping, so this one file serves CloudFormation (the aws lexicon)
+# and Terraform's AWS provider (the terraform lexicon) alike.
+#
+# name(x) is a node set, tested with [@name]. name(a, b) is an edge, followed
+# with ->name. Parameters follow `;`. The language is in language.ts.
+#
+# `## key: value` lines describe the capability that follows them, for the
+# `capabilities` document: meaning, answers (one per line), depth, search,
+# not-evaluated, and a line per parameter (param-<name>). A rule with no
+# `## meaning` is a helper: other rules use it, the catalog doesn't list it.
+
+# ------------------------------------------------------------------ helpers
+
+in-sg(x, g)          := x ->{0,1}template ->sg g:SecurityGroup
+ingress-of(x, r)     := x ->in-sg ->ingress r:IngressRule
+world-open(r)        := r:IngressRule[cidrs in ("0.0.0.0/0", "::/0")]
+allows(r, x; action?) := r:Role <-{0,1}attachedTo ->statement :Statement[doc = "permission", effect = "Allow", actions ~ $action] ->resource x
+                      | r:Role <-principal :Statement[doc = "resource", effect = "Allow", actions ~ $action] ->resource x
+denies(r, x; action?) := r:Role <-{0,1}attachedTo ->statement :Statement[doc = "permission", effect = "Deny", actions ~ $action] ->resource x
+                      | r:Role <-principal :Statement[doc = "resource", effect = "Deny", actions ~ $action] ->resource x
+pivot(a, b)          := a ->(runs-as|can-assume|network) b
+
+# ------------------------------------------------------------------ network
+
+## meaning: its subnet routes 0.0.0.0/0 to an internet gateway
+## answers: which instances are in a public subnet
+## answers: what sits in a subnet that routes to the internet
+## depth: either
+## not-evaluated: a subnet on its VPC's main route table (no explicit association) is not followed
+internet-facing(c)   := c:Instance ->subnet :Subnet <-subnet :RouteTableAssociation ->table :RouteTable <-table :Route[dest in ("0.0.0.0/0", "::/0", null)] ->gateway :InternetGateway
+                      | c:Instance[internetFacing = true]
+
+## meaning: a security group reaching it, directly or through a launch template, admits 0.0.0.0/0 or ::/0
+## param-port: a port the open rule must cover, such as 22
+## param-proto: a protocol the open rule must allow, such as tcp; a rule for every protocol (-1) always does
+## answers: what admits SSH from anywhere
+## answers: which instances have a security group open to the world
+## depth: declared
+## not-evaluated: network ACLs; prefix lists
+open-ingress(c; port?, proto?) := c:Instance|Database|Function|Service ->ingress-of r:IngressRule[@world-open, from <= $port, to >= $port, proto in ($proto, "-1")]
+
+## meaning: internet-facing and open-ingress, or a Lambda function URL with no auth. Load balancers and API gateways come later
+## param-port: a port the open rule must cover, such as 22
+## answers: what in prod can be reached on SSH from the internet
+## answers: which instances are SSH-reachable from the internet
+## depth: either
+## not-evaluated: load balancers; API gateways; network ACLs
+internet-reachable(c; port?) := c[@internet-facing, @open-ingress($port)]
+                      | c:Function <-function :FunctionUrl[authType = "NONE"]
+
+## meaning: no member, attachment or route references it
+## answers: which security groups are unused
+## answers: which subnets have no instances or network interfaces
+## answers: which policies are attached to nothing
+## depth: either
+attached-to-nothing(x) := x:SecurityGroup !<-sg
+                      | x:Subnet !<-subnet
+                      | x:Policy !->attachedTo
+                      | x:InternetGateway !<-gateway
+
+## meaning: in the account's default VPC
+## answers: which instances run in the default VPC
+## answers: which instances are not in the default VPC (negate it: !cap:in-default-vpc)
+## depth: either
+in-default-vpc(x)    := x ->{1,2}(subnet|vpc) :Vpc[isDefault = true]
+
+## meaning: host to host through security-group-to-group ingress
+## answers: what can this instance reach on the network
+## depth: declared
+## not-evaluated: CIDR-to-CIDR reachability inside the VPC; network ACLs
+network(a, y)        := a:Instance|Database|Function|Service ->in-sg <-source :IngressRule <-ingress :SecurityGroup <-in-sg y:Instance|Database|Function|Service
+
+# ------------------------------------------------------------------ data
+
+## meaning: a bucket, table, database, queue, file system or secret
+## answers: where is our data
+## depth: declared
+stores-data(x)       := x:Bucket|Table|Database|Queue|FileSystem|Secret|Parameter
+
+## meaning: a secret, an SSM SecureString, or a data store tagged as restricted (the tag keys are the lexicon mapping's classificationTags)
+## answers: which stores hold secrets or restricted data
+## depth: declared
+holds-secret(x)      := x:Secret
+                      | x:Parameter[paramType = "SecureString"]
+                      | x:Bucket|Table|Database|Queue|FileSystem[classification in ("restricted", "secret", "confidential")]
+
+## meaning: encrypted at rest: a database, file system or volume whose encryption attribute is set; S3 buckets, DynamoDB tables, SQS queues and secrets always are
+## answers: which data stores are not encrypted at rest (negate it: !cap:encrypted-at-rest)
+## depth: declared
+## not-evaluated: account-level EBS encryption by default; which key (AWS-owned, AWS-managed or customer-managed)
+encrypted-at-rest(x) := x:Database|FileSystem|Volume[encrypted = true]
+                      | x:Bucket|Table|Queue|Secret
+
+## meaning: a bucket whose policy allows principal * and no public-access block stops it, or a public ACL
+## answers: what is public
+## answers: which buckets can anyone read
+## depth: declared
+## not-evaluated: IAM Condition keys; account-level public-access blocks
+publicly-readable(x) := x:Bucket[!blockPublicPolicy = true] !<-blocks :PublicAccessBlock[blockPublicPolicy = true] <-policyOf :ResourcePolicy ->statement :Statement[doc = "resource", effect = "Allow", principals in ("*")]
+                      | x:Bucket[acl in ("public-read", "public-read-write")]
+
+# ------------------------------------------------------------------ identity
+
+## meaning: compute to the role it runs as (instance profile, also through a launch template; Lambda role; ECS task role)
+## answers: what identity does this instance run as
+## depth: declared
+runs-as(c, r)        := c:Instance|Function|Service|TaskDefinition ->{0,1}template ->{0,1}(profile|task) ->role r:Role
+
+## meaning: role to role, where both the caller's permission and the target's trust allow sts:AssumeRole
+## answers: which roles can this role become
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; a trust policy that names the account root
+can-assume(a, b)     := a:Role <-{0,1}attachedTo ->statement :Statement[doc = "permission", effect = "Allow", actions ~ "sts:AssumeRole"] ->resource b:Role ->statement :Statement[doc = "trust", actions ~ "sts:AssumeRole"] ->principal a
+
+## meaning: role to resource, by an identity policy or a resource policy, with no explicit Deny on the same pair
+## param-action: an IAM action the grant must cover, such as dynamodb:GetItem
+## answers: what can this role touch
+## answers: what can reach the customer database (read it in reverse: <-[cap=grants])
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; NotAction and NotResource; permission boundaries and SCPs; AWS-managed policies, named by ARN only; resources the graph holds but can't resolve, such as an expression naming nothing declared
+grants(r, x; action?) := r:Role ->allows($action) x !<-denies($action) r
+
+## meaning: can-assume any number of times, then grants
+## param-action: an IAM action the grant must cover, such as s3:GetObject
+## answers: if this role is compromised, what data can it reach
+## answers: what can reach the customer database (read it in reverse: <-[cap=reaches])
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; NotAction and NotResource; permission boundaries and SCPs; AWS-managed policies, named by ARN only; resources the graph holds but can't resolve, such as an expression naming nothing declared
+reaches(r, x; action?) := r:Role ->{0,}can-assume ->grants($action) x
+
+# ------------------------------------------------------------------ paths
+
+## meaning: internet-reachable compute that runs as a role that reaches a store holding a secret
+## answers: is there an exfiltration path from the internet to our data
+## answers: which internet-facing hosts can read restricted data
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; load balancers and API gateways; resources the graph holds but can't resolve, such as an expression naming nothing declared
+exfiltrates(c, x)    := c[@internet-reachable] ->runs-as ->reaches x[@holds-secret]
+
+## meaning: what a compromise of it reaches: runs-as, can-assume and network any number of times, then what each identity is granted
+## answers: what is the blast radius if this host is compromised
+## depth: declared
+## not-evaluated: IAM Condition keys; Resource "*"; CIDR-to-CIDR reachability; resources the graph holds but can't resolve, such as an expression naming nothing declared
+blast(s, x)          := s ->{0,}pivot ->{0,1}grants x