@intentius/chant 0.26.0 → 0.28.0

package/src/discovery/sandbox/fork.ts

@@ -11,6 +11,11 @@ import { fork } from "node:child_process";
  * one function is the cheapest way to make "same profile" a fact rather than
  * a claim.
  *
+ * chant #1148 — this is also the one place chant forwards a sandboxed
+ * child's own stdout/stderr, so `./run.ts`, `./config-run.ts` and
+ * `./policy-run.ts` cannot drift on whether project output vanishes. See
+ * {@link SandboxForkOptions.outputPrefix}.
+ *
  * Isolation mechanics (verified on Node v24.13.1 — see the chant#1045 PR
  * description for the full write-up):
  *  - `--permission --allow-fs-read=<bundle dir>,<project dir>[,<trusted
@@ -45,6 +50,26 @@ export interface SandboxForkOptions {
   timeoutMs: number;
   /** What timed out / exited early, for the error message (e.g. `"sandboxed run"`). */
   label: string;
+  /**
+   * chant #1148 — prepended to every line the child writes on EITHER stdout
+   * or stderr before it is relayed, line-buffered, to this process's own
+   * stderr (e.g. `"[sandbox:run]"`, `"[sandbox:config]"`,
+   * `"[policy:org.ts]"`).
+   *
+   * A sandboxed child's `console.log`/`console.error` used to go nowhere: its
+   * stdout was piped but never read, and its stderr was captured only into
+   * {@link stderrBuf}'s error-message use, never surfaced on a successful
+   * run. Diagnostics crossing as data (the whole point of the boundary) is
+   * not the same thing as incidental output being silently dropped — chant's
+   * stance is that nothing the project prints vanishes, sandboxed or not.
+   *
+   * This is forwarding, not a second capture: {@link stderrBuf} still
+   * accumulates the child's raw stderr for `classifyChildError`/the
+   * exited-before-reporting message exactly as before. Both read the same
+   * `data` events; one buffers for classification, this one relays for a
+   * human to see.
+   */
+  outputPrefix: string;
   /**
    * chant #1131 — an optional payload sent to the child over the SAME IPC
    * channel its response comes back on, immediately after the fork.
@@ -65,6 +90,36 @@ export interface SandboxForkOptions {
   send?: Record<string, unknown>;
 }
 
+/**
+ * chant #1148 — buffers arbitrary chunks and calls `emit` once per complete
+ * line, never on a chunk boundary that happens to split a line in two (a
+ * pipe makes no promise that one `write()` on the child's side arrives as one
+ * `data` event on ours). `flush()` emits whatever partial line never got a
+ * trailing newline, so the last unterminated write doesn't silently vanish
+ * when the stream ends — the same no-dropping stance this whole feature
+ * exists for.
+ */
+function lineBuffered(emit: (line: string) => void) {
+  let pending = "";
+  return {
+    push(chunk: Buffer | string): void {
+      pending += chunk.toString();
+      let newlineAt = pending.indexOf("\n");
+      while (newlineAt !== -1) {
+        emit(pending.slice(0, newlineAt));
+        pending = pending.slice(newlineAt + 1);
+        newlineAt = pending.indexOf("\n");
+      }
+    },
+    flush(): void {
+      if (pending.length > 0) {
+        emit(pending);
+        pending = "";
+      }
+    },
+  };
+}
+
 /**
  * Fork `bundlePath` under `--permission` with a scrubbed environment, and
  * resolve with the first IPC message that satisfies `isResponse` (or reject
@@ -74,7 +129,8 @@ export function forkSandboxed<T>(
   options: SandboxForkOptions,
   isResponse: (value: unknown) => value is T,
 ): Promise<T> {
-  const { bundlePath, bundleDir, projectRealpath, externalReadPaths, env, timeoutMs, label, send } = options;
+  const { bundlePath, bundleDir, projectRealpath, externalReadPaths, env, timeoutMs, label, send, outputPrefix } =
+    options;
 
   return new Promise((resolvePromise, reject) => {
     const readAllowances = [bundleDir, projectRealpath, ...externalReadPaths].map(
@@ -106,9 +162,27 @@ export function forkSandboxed<T>(
       });
     }
 
+    // chant #1148 — forward, don't just capture. Both streams write to THIS
+    // process's stderr, prefixed and line-buffered, independent of
+    // `stderrBuf` below (which keeps accumulating raw stderr for
+    // `classifyChildError`'s use — forwarded and captured are not mutually
+    // exclusive, the same bytes feed both).
+    const forwardLine = (line: string): void => {
+      process.stderr.write(`${outputPrefix} ${line}\n`);
+    };
+    const stdoutForwarder = lineBuffered(forwardLine);
+    const stderrForwarder = lineBuffered(forwardLine);
+
+    child.stdout?.on("data", (chunk: Buffer) => {
+      stdoutForwarder.push(chunk);
+    });
+    child.stdout?.on("end", () => stdoutForwarder.flush());
+
     child.stderr?.on("data", (chunk: Buffer) => {
       stderrBuf += chunk.toString();
+      stderrForwarder.push(chunk);
     });
+    child.stderr?.on("end", () => stderrForwarder.flush());
 
     child.on("message", (msg: unknown) => {
       if (settled || !isResponse(msg)) return;

package/src/discovery/sandbox/policy-boundary.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { mkdir, writeFile, rm, realpath, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
@@ -281,6 +281,61 @@ describe("lint.policies execution under --sandbox (chant #1131)", () => {
     expect(await run([])).toEqual([]);
   });
 
+  /**
+   * chant #1148 — a policy's own `console.log`/`console.error` used to go
+   * nowhere under `--sandbox` (noted as a residual when #1131 shipped). Same
+   * relay as the run-fallback and config children, keyed to the policy
+   * module's own basename rather than a generic tag.
+   */
+  describe("console output forwarding (chant #1148)", () => {
+    beforeEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    afterEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    /** Spies on `process.stderr.write` and returns the lines captured so far — same shape as `../../cli/handlers/emulator.test.ts`'s `stdout()`/`stderr()` helpers. */
+    function captureStderr(): string[] {
+      const lines: string[] = [];
+      vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
+        lines.push(String(chunk));
+        return true;
+      });
+      return lines;
+    }
+
+    // See ./run.test.ts's identical helper doc: the IPC "message" the
+    // awaited call resolves on and the child's stdout/stderr pipe data are
+    // independent channels, so polling briefly avoids a flaky assertion.
+    async function waitFor(lines: string[], matcher: RegExp, timeoutMs = 5000): Promise<void> {
+      const start = Date.now();
+      while (Date.now() - start < timeoutMs) {
+        if (matcher.test(lines.join(""))) return;
+        await new Promise((r) => setTimeout(r, 10));
+      }
+      throw new Error(`stderr never matched ${matcher}. Captured so far:\n${lines.join("")}`);
+    }
+
+    test("a policy's console.log/console.error are forwarded, prefixed with [policy:<module-basename>]", async () => {
+      const stderr = captureStderr();
+      await writeMarkerPolicy(
+        "org.ts",
+        `console.log("hello from policy stdout");\n` +
+          `console.error("hello from policy stderr");\n` +
+          `export const c = { id: "X", description: "d", check: () => [] };\n`,
+      );
+      armSandboxPolicyExecution();
+
+      const diags = await run(["org.ts"]);
+
+      expect(diags).toEqual([]);
+      await waitFor(stderr, /^\[policy:org\.ts\] hello from policy stdout$/m);
+      await waitFor(stderr, /^\[policy:org\.ts\] hello from policy stderr$/m);
+    });
+  });
+
   test("a program that runs a policy child EXITS — the child is not left holding the event loop", async () => {
     // Found the hard way while measuring #1131's cost: unlike the run and
     // config drivers, the policy driver keeps a `message` listener registered

package/src/discovery/sandbox/policy-run.ts

@@ -1,5 +1,5 @@
 import { realpathSync, rmSync } from "node:fs";
-import { resolve } from "node:path";
+import { basename, resolve } from "node:path";
 import type { PostSynthDiagnostic } from "../../lint/post-synth";
 import { bundleDriver } from "./bundle";
 import { generatePolicyDriverSource } from "./driver";
@@ -79,6 +79,17 @@ interface PolicyChildResponse {
   error?: { name: string; file: string; message: string; type: string };
 }
 
+/**
+ * chant #1148 — `[policy:<module-basename>]`, joined when a project declares
+ * more than one policy module (all of them share the one child — see the
+ * module doc above). One policy module is the only shape this repo's own
+ * corpus exercises (`lexicons/k8s/examples/org-policy`), so this is the
+ * common case, not a hypothetical.
+ */
+function policyOutputPrefix(policyPaths: readonly string[]): string {
+  return `[policy:${policyPaths.map((p) => basename(p)).join(",")}]`;
+}
+
 function isPolicyChildResponse(value: unknown): value is PolicyChildResponse {
   return (
     typeof value === "object" &&
@@ -158,6 +169,9 @@ export async function runPoliciesSandboxed(options: SandboxPolicyOptions): Promi
         timeoutMs: POLICY_CHILD_TIMEOUT_MS,
         label: `sandboxed evaluation of lint.policies (${policyPaths.length} module(s))`,
         send: payload,
+        // chant #1148 — a policy's own console.log/error no longer goes
+        // nowhere; see `./fork.ts`'s `outputPrefix` doc.
+        outputPrefix: policyOutputPrefix(policyPaths),
       },
       isPolicyChildResponse,
     );

package/src/discovery/sandbox/run.test.ts

@@ -1,4 +1,4 @@
-import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { describe, test, expect, beforeEach, afterEach, vi } from "vitest";
 import { mkdir, writeFile, rm, realpath } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { join, dirname, resolve } from "node:path";
@@ -176,4 +176,88 @@ describe("runFallbackFilesSandboxed — isolation", () => {
     expect(ref.getLogicalName?.()).toBe("dataBucket");
     expect(ref.attribute).toBe("Arn");
   });
+
+  /**
+   * chant #1148 — a run-fallback file's own `console.log`/`console.error`
+   * used to go nowhere: the child's stdout was piped but never read, and its
+   * stderr was captured only for `classifyChildError`'s use, never surfaced
+   * on a successful run. `./fork.ts` now relays both, line-buffered and
+   * prefixed, to THIS process's stderr — diagnostics crossing as data was
+   * never meant to mean incidental output vanishes.
+   */
+  describe("console output forwarding (chant #1148)", () => {
+    beforeEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    afterEach(() => {
+      vi.restoreAllMocks();
+    });
+
+    /** Spies on `process.stderr.write` and returns the lines captured so far — same shape as `../../cli/handlers/emulator.test.ts`'s `stdout()`/`stderr()` helpers. */
+    function captureStderr(): string[] {
+      const lines: string[] = [];
+      vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
+        lines.push(String(chunk));
+        return true;
+      });
+      return lines;
+    }
+
+    // The child's IPC "message" (what the awaited call resolves on) and its
+    // stdout/stderr pipe data are two independent channels — nothing orders
+    // one ahead of the other, and #1147 deliberately keeps it that way (see
+    // the hang-regression test in policy-boundary.test.ts). Polling briefly
+    // rather than asserting immediately avoids a flaky test without giving
+    // the production path anything to wait for.
+    async function waitFor(lines: string[], matcher: RegExp, timeoutMs = 5000): Promise<void> {
+      const start = Date.now();
+      while (Date.now() - start < timeoutMs) {
+        if (matcher.test(lines.join(""))) return;
+        await new Promise((r) => setTimeout(r, 10));
+      }
+      throw new Error(`stderr never matched ${matcher}. Captured so far:\n${lines.join("")}`);
+    }
+
+    test("both console.log and console.error are forwarded, prefixed with [sandbox:run]", async () => {
+      const stderr = captureStderr();
+      const file = join(testDir, "noisy.ts");
+      await writeFile(
+        file,
+        `
+          console.log("hello from run-fallback stdout");
+          console.error("hello from run-fallback stderr");
+          export const value = "ok";
+        `,
+      );
+
+      const result = await runFallbackFilesSandboxed([file], testDir);
+
+      expect(result.errors).toEqual([]);
+      await waitFor(stderr, /^\[sandbox:run\] hello from run-fallback stdout$/m);
+      await waitFor(stderr, /^\[sandbox:run\] hello from run-fallback stderr$/m);
+    });
+
+    test("a file that exits hard still has its stderr in the classified error (forwarding doesn't replace capture)", async () => {
+      const stderr = captureStderr();
+      const file = join(testDir, "crashes.ts");
+      await writeFile(
+        file,
+        `
+          console.error("about to exit hard");
+          process.exit(1);
+        `,
+      );
+
+      const result = await runFallbackFilesSandboxed([file], testDir);
+
+      // A hard process.exit() takes the whole bundled child with it — this is
+      // fork.ts's pre-existing "child exited before reporting results" path,
+      // fed by the SAME stderrBuf that now also feeds forwarding.
+      expect(result.errors).toHaveLength(1);
+      expect(result.errors[0].message).toMatch(/about to exit hard/);
+
+      await waitFor(stderr, /^\[sandbox:run\] about to exit hard$/m);
+    });
+  });
 });

package/src/discovery/sandbox/run.ts

@@ -112,6 +112,9 @@ export async function runFallbackFilesSandboxed(
         env: { PATH: process.env.PATH ?? "" },
         timeoutMs: CHILD_TIMEOUT_MS,
         label: "sandboxed run",
+        // chant #1148 — a run-fallback file's own console.log/error no
+        // longer goes nowhere; see `./fork.ts`'s `outputPrefix` doc.
+        outputPrefix: "[sandbox:run]",
       },
       isChildResponse,
     );

package/src/kubectl-context.test.ts

@@ -0,0 +1,94 @@
+import { describe, test, expect, vi, beforeEach } from "vitest";
+
+const execMock = vi.fn();
+vi.mock("node:child_process", async () => {
+  const actual = await vi.importActual<typeof import("node:child_process")>("node:child_process");
+  return {
+    ...actual,
+    exec: (cmd: string, cb: (err: Error | null, out: { stdout: string; stderr: string }) => void) => {
+      Promise.resolve(execMock(cmd)).then(
+        (out) => cb(null, out as { stdout: string; stderr: string }),
+        (err) => cb(err as Error, { stdout: "", stderr: "" }),
+      );
+    },
+  };
+});
+
+const { resolveClusterTarget, ClusterBindingMismatchError } = await import("./kubectl-context");
+
+describe("resolveClusterTarget (chant #1100)", () => {
+  beforeEach(() => {
+    execMock.mockReset();
+  });
+
+  test("no binding declared: returns ambient source, warns visibly, never probes kubectl", async () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const target = await resolveClusterTarget({}, "prod", "k8s");
+
+    expect(target).toEqual({ source: "ambient" });
+    expect(execMock).not.toHaveBeenCalled();
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringMatching(/\[k8s\].*environment "prod".*k8s\.profiles\.prod\.context/s),
+    );
+    warnSpy.mockRestore();
+  });
+
+  test("bound and ambient context matches: returns the bound context", async () => {
+    execMock.mockResolvedValue({ stdout: "prod-eks\n", stderr: "" });
+
+    const target = await resolveClusterTarget(
+      { k8s: { profiles: { prod: { context: "prod-eks" } } } },
+      "prod",
+      "k8s",
+    );
+
+    expect(target).toEqual({ context: "prod-eks", source: "bound" });
+    expect(execMock).toHaveBeenCalledWith(expect.stringContaining("current-context"));
+  });
+
+  test("bound and ambient context cannot be determined: proceeds with the bound context anyway", async () => {
+    execMock.mockRejectedValue(new Error("no kubeconfig"));
+
+    const target = await resolveClusterTarget(
+      { k8s: { profiles: { prod: { context: "prod-eks" } } } },
+      "prod",
+      "k8s",
+    );
+
+    expect(target).toEqual({ context: "prod-eks", source: "bound" });
+  });
+
+  test("bound and ambient context mismatches: refuses loudly, naming env/expected/ambient", async () => {
+    execMock.mockResolvedValue({ stdout: "staging-eks\n", stderr: "" });
+
+    const err: unknown = await resolveClusterTarget(
+      { k8s: { profiles: { prod: { context: "prod-eks" } } } },
+      "prod",
+      "k8s",
+    ).catch((e: unknown) => e);
+
+    expect(err).toBeInstanceOf(ClusterBindingMismatchError);
+    const mismatch = err as InstanceType<typeof ClusterBindingMismatchError>;
+    expect(mismatch.environment).toBe("prod");
+    expect(mismatch.expectedContext).toBe("prod-eks");
+    expect(mismatch.ambientContext).toBe("staging-eks");
+    expect(mismatch.message).toContain('environment "prod"');
+    expect(mismatch.message).toContain('"prod-eks"');
+    expect(mismatch.message).toContain('"staging-eks"');
+  });
+
+  test("bound for a different environment than the one requested: treated as unbound for this environment", async () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const target = await resolveClusterTarget(
+      { k8s: { profiles: { staging: { context: "staging-eks" } } } },
+      "prod",
+      "k8s",
+    );
+
+    expect(target).toEqual({ source: "ambient" });
+    expect(execMock).not.toHaveBeenCalled();
+    warnSpy.mockRestore();
+  });
+});

package/src/kubectl-context.ts

@@ -0,0 +1,126 @@
+/**
+ * K8s environment→cluster binding — chant #1100.
+ *
+ * Every cloud lexicon binds an environment to a scope: AWS resolves `<env>`
+ * to a CloudFormation stack, Azure treats `<env>` as the resource group,
+ * Temporal looks up `temporal.profiles.<env>` in `chant.config.ts`. K8s (and
+ * GCP-via-Config-Connector, which observes through the same kubectl path)
+ * bound nothing — `describeResources` shelled out to `kubectl get` with no
+ * `--context`, so it read whatever cluster `kubectl config current-context`
+ * happened to point at. Point `prod` at a dev cluster and every declared
+ * resource reads as missing — a wrong-cluster diff that looks like a
+ * confident list of deletions.
+ *
+ * This module is the shared resolver both the k8s and gcp lexicons'
+ * `describeResources` call, so they resolve a cluster identity the same way
+ * (see `lexicons/k8s/src/config.ts`'s `K8sChantConfig` for the declared
+ * shape). It is intentionally provider-agnostic and lives in core (like
+ * `./ownership.ts`) rather than in the k8s lexicon package, since gcp's
+ * Config Connector observation needs it too without taking a dependency on
+ * the k8s lexicon.
+ */
+
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+
+const execAsync = promisify(exec);
+
+/** A single environment's cluster binding — see `K8sChantConfig` in the k8s lexicon. */
+export interface K8sClusterProfile {
+  /** kubectl context name this environment is bound to. */
+  context: string;
+}
+
+/** Shape of the `k8s` passthrough key in `chant.config.ts` that this resolver reads. */
+export interface K8sConfigShape {
+  profiles?: Record<string, K8sClusterProfile>;
+}
+
+/**
+ * Thrown when an environment declares a cluster binding but the ambient
+ * kubectl context disagrees with it. Refusing here — instead of silently
+ * observing whichever cluster is ambient — is the fix for #1100: a
+ * wrong-cluster read reports every declared resource as missing, which #1089
+ * then classifies as a confident (and wrong) list of `create` actions.
+ */
+export class ClusterBindingMismatchError extends Error {
+  constructor(
+    public readonly environment: string,
+    public readonly expectedContext: string,
+    public readonly ambientContext: string,
+  ) {
+    super(
+      `k8s: environment "${environment}" is bound to cluster context "${expectedContext}" ` +
+        `(k8s.profiles.${environment}.context), but the ambient kubectl context is ` +
+        `"${ambientContext}". Refusing to observe — reading the wrong cluster would misreport ` +
+        `every declared resource as missing. Run \`kubectl config use-context ${expectedContext}\` ` +
+        `to switch, or update the binding in chant.config.ts if "${ambientContext}" is actually correct.`,
+    );
+    this.name = "ClusterBindingMismatchError";
+  }
+}
+
+export interface ResolvedClusterTarget {
+  /**
+   * Explicit `--context` value to pass to every kubectl invocation. Present
+   * only when the environment has a declared binding — undefined means
+   * "no binding, keep today's ambient-context behavior".
+   */
+  context?: string;
+  /** Where the target came from. */
+  source: "bound" | "ambient";
+}
+
+/** Reads `kubectl config current-context`. Returns undefined if unset or kubectl fails. */
+async function currentAmbientContext(): Promise<string | undefined> {
+  try {
+    const { stdout } = await execAsync("kubectl config current-context");
+    const trimmed = stdout.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Resolve the kubectl context an environment should be observed/applied
+ * against, reading `k8s.profiles.<environment>.context` from `chant.config.ts`
+ * (the `config` passed in is the passthrough `ChantConfig`, cast loosely since
+ * the `k8s` key isn't declared on the core schema — same pattern as
+ * `temporal.profiles`).
+ *
+ * - No binding declared: returns `{ source: "ambient" }` — unchanged
+ *   behavior — but logs a visible warning identifying the caller and
+ *   environment, so the fallback is never silent (#1100 acceptance).
+ * - Binding declared and the ambient context agrees (or ambient can't be
+ *   determined): returns `{ context: bound, source: "bound" }`. Callers
+ *   should pass this context explicitly on every kubectl invocation rather
+ *   than relying on it also being ambient.
+ * - Binding declared and the ambient context disagrees: throws
+ *   {@link ClusterBindingMismatchError} — a loud refusal instead of quietly
+ *   reading the wrong cluster.
+ */
+export async function resolveClusterTarget(
+  config: Record<string, unknown>,
+  environment: string,
+  lexiconName: string,
+): Promise<ResolvedClusterTarget> {
+  const k8sConfig = config.k8s as K8sConfigShape | undefined;
+  const bound = k8sConfig?.profiles?.[environment]?.context;
+
+  if (!bound) {
+    console.warn(
+      `[${lexiconName}] no cluster binding for environment "${environment}" ` +
+        `(k8s.profiles.${environment}.context in chant.config.ts) — observing whatever kubectl ` +
+        `context is ambient. Add a binding to pin this environment to a specific cluster (chant #1100).`,
+    );
+    return { source: "ambient" };
+  }
+
+  const ambient = await currentAmbientContext();
+  if (ambient && ambient !== bound) {
+    throw new ClusterBindingMismatchError(environment, bound, ambient);
+  }
+
+  return { context: bound, source: "bound" };
+}

package/src/lint/config.test.ts

@@ -1,5 +1,6 @@
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
-import { loadConfig, DEFAULT_CONFIG, findProjectRoot } from "./config";
+import { loadConfig, DEFAULT_CONFIG, findProjectRoot, resolveConfiguredSeverity, applyConfiguredSeverity } from "./config";
+import type { PostSynthDiagnostic } from "./post-synth";
 import { writeFileSync, mkdirSync, rmSync } from "fs";
 import { join, resolve } from "path";
 
@@ -717,3 +718,94 @@ describe("findProjectRoot", () => {
     expect(findProjectRoot(sub)).toBe(packageRoot);
   });
 });
+
+/**
+ * chant #1138 — the one severity-resolution path AST lint rules
+ * (`../cli/commands/lint.ts`'s `getDefaultRules`), COMP* checks
+ * (`runComponentCheckDiagnostics`), and post-synth checks/policies
+ * (`applyConfiguredSeverity`, below) all now call, keyed by whichever id the
+ * caller has (a `LintRule.id`, a `ComponentCheck.id`, or a
+ * `PostSynthDiagnostic.checkId`) — a rule id behaves the same regardless of
+ * which phase produced it.
+ */
+describe("resolveConfiguredSeverity", () => {
+  test("an id with no config entry falls back to the caller's default severity, with no options", () => {
+    expect(resolveConfiguredSeverity(undefined, "COR001", "error")).toEqual({ severity: "error" });
+    expect(resolveConfiguredSeverity({}, "COR001", "warning")).toEqual({ severity: "warning" });
+    expect(resolveConfiguredSeverity({ OTHER: "off" }, "COR001", "error")).toEqual({ severity: "error" });
+  });
+
+  test("a bare severity string overrides the default", () => {
+    expect(resolveConfiguredSeverity({ COR001: "warning" }, "COR001", "error")).toEqual({ severity: "warning" });
+  });
+
+  test('"off" suppresses regardless of the default severity', () => {
+    expect(resolveConfiguredSeverity({ WAW019: "off" }, "WAW019", "error")).toEqual({ severity: "off" });
+  });
+
+  test("a [severity, options] tuple carries options through", () => {
+    expect(resolveConfiguredSeverity({ COR009: ["warning", { max: 12 }] }, "COR009", "error")).toEqual({
+      severity: "warning",
+      options: { max: 12 },
+    });
+  });
+
+  test("an invalid severity in a [severity, options] tuple throws, naming the bad value", () => {
+    expect(() =>
+      resolveConfiguredSeverity({ COR009: ["fatal" as never, { max: 12 }] }, "COR009", "error"),
+    ).toThrow(/severity "fatal"/);
+  });
+});
+
+/**
+ * chant #1138 — `lint.rules` severity overrides apply to a post-synth check
+ * id (`diag.checkId`) through the identical `resolveConfiguredSeverity` an
+ * AST rule id or a COMP* check id goes through, so
+ * `lint.rules: { WAW019: "off" }` suppresses a post-synth finding just like a
+ * pre-synth one — the bug this issue reports.
+ */
+describe("applyConfiguredSeverity", () => {
+  function diag(overrides: Partial<PostSynthDiagnostic> = {}): PostSynthDiagnostic {
+    return { checkId: "WAW019", severity: "error", message: "open ingress", ...overrides };
+  }
+
+  test("an unconfigured check id passes through unchanged — no drift for the common case", () => {
+    const result = applyConfiguredSeverity([diag()], undefined);
+    expect(result.diagnostics).toEqual([diag()]);
+    expect(result.suppressed).toEqual([]);
+  });
+
+  test('"off" suppresses the finding — moved to `suppressed`, not dropped, so it stays countable', () => {
+    const result = applyConfiguredSeverity([diag()], { WAW019: "off" });
+    expect(result.diagnostics).toEqual([]);
+    expect(result.suppressed).toEqual([diag()]);
+  });
+
+  test('"warning" downgrades an error-severity finding', () => {
+    const result = applyConfiguredSeverity([diag({ severity: "error" })], { WAW019: "warning" });
+    expect(result.diagnostics).toEqual([diag({ severity: "warning" })]);
+    expect(result.suppressed).toEqual([]);
+  });
+
+  test('"error" upgrades a warning-severity finding', () => {
+    const result = applyConfiguredSeverity([diag({ severity: "warning" })], { WAW019: "error" });
+    expect(result.diagnostics).toEqual([diag({ severity: "error" })]);
+  });
+
+  test("resolves each diagnostic by its own checkId — one config, independent ids", () => {
+    const diags = [
+      diag({ checkId: "WAW019" }),
+      diag({ checkId: "WAW049", message: "no logging" }),
+      diag({ checkId: "WAW099", message: "untouched" }),
+    ];
+    const result = applyConfiguredSeverity(diags, { WAW019: "off", WAW049: "warning" });
+    expect(result.suppressed.map((d) => d.checkId)).toEqual(["WAW019"]);
+    expect(result.diagnostics.map((d) => d.checkId)).toEqual(["WAW049", "WAW099"]);
+    expect(result.diagnostics.find((d) => d.checkId === "WAW049")?.severity).toBe("warning");
+    expect(result.diagnostics.find((d) => d.checkId === "WAW099")?.severity).toBe("error");
+  });
+
+  test("an empty diagnostics list is a no-op", () => {
+    expect(applyConfiguredSeverity([], { WAW019: "off" })).toEqual({ diagnostics: [], suppressed: [] });
+  });
+});