@intentius/chant 0.27.0 → 0.29.0

package/src/lifecycle/status.test.ts

@@ -32,8 +32,8 @@ describe("status", () => {
       const cs: ChangeSet = {
         env: "prod",
         entries: [
-          { name: "search-service", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true }, ownership: "owned" },
-          { name: "orphan-thing", type: "T", action: "adopt", evidence: { declared: false, inSnapshot: false, live: true }, ownership: "foreign" },
+          { name: "search-service", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true, observed: true }, ownership: "owned" },
+          { name: "orphan-thing", type: "T", action: "adopt", evidence: { declared: false, inSnapshot: false, live: true, observed: true }, ownership: "foreign" },
         ],
       };
       const evidence = liveEvidenceFromChangeSet(cs);
@@ -49,7 +49,7 @@ describe("status", () => {
         const cs: ChangeSet = {
           env: "prod",
           entries: [
-            { name: "search-service-v2", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true }, ownership: "owned" },
+            { name: "search-service-v2", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true, observed: true }, ownership: "owned" },
           ],
         };
         const mapping: LiveNameMapping = new Map([["search-svc", ["search-service-v2"]]]);
@@ -63,7 +63,7 @@ describe("status", () => {
         const cs: ChangeSet = {
           env: "prod",
           entries: [
-            { name: "search-service", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true }, ownership: "owned" },
+            { name: "search-service", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true, observed: true }, ownership: "owned" },
           ],
         };
         const mapping: LiveNameMapping = new Map([["some-other-component", ["renamed-thing"]]]);
@@ -75,8 +75,8 @@ describe("status", () => {
         const cs: ChangeSet = {
           env: "prod",
           entries: [
-            { name: "cluster-node-1", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true }, ownership: "owned" },
-            { name: "cluster-node-2", type: "T", action: "update", evidence: { declared: true, inSnapshot: true, live: true }, ownership: "owned" },
+            { name: "cluster-node-1", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true, observed: true }, ownership: "owned" },
+            { name: "cluster-node-2", type: "T", action: "update", evidence: { declared: true, inSnapshot: true, live: true, observed: true }, ownership: "owned" },
           ],
         };
         const mapping: LiveNameMapping = new Map([["neo4j-cluster", ["cluster-node-1", "cluster-node-2"]]]);
@@ -297,7 +297,7 @@ describe("status", () => {
       const cs: ChangeSet = {
         env: "prod",
         entries: [
-          { name: "search-service-v2", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true }, ownership: "owned" },
+          { name: "search-service-v2", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true, observed: true }, ownership: "owned" },
         ],
       };
       const mapping: LiveNameMapping = new Map([["search-svc", ["search-service-v2"]]]);
@@ -311,7 +311,7 @@ describe("status", () => {
       const cs: ChangeSet = {
         env: "prod",
         entries: [
-          { name: "search-service", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true }, ownership: "owned" },
+          { name: "search-service", type: "T", action: "noop", evidence: { declared: true, inSnapshot: true, live: true, observed: true }, ownership: "owned" },
         ],
       };
       const liveEvidence = liveEvidenceFromChangeSet(cs);
@@ -381,5 +381,86 @@ describe("status", () => {
       const merged = mergeLiveEvidence(undefined, supplement);
       expect(merged.get("c")).toEqual({ live: true, ownership: "owned", action: undefined });
     });
+
+    test("a direct stack observation clears an inherited hole; a failing one keeps it (#1089)", () => {
+      const base = new Map<string, LiveComponentEvidence>([
+        ["a", { live: false, unobserved: { reason: "read-failed" } }],
+        ["b", { live: false, unobserved: { reason: "read-failed" } }],
+      ]);
+      const supplement = new Map<string, LiveComponentEvidence>([
+        ["a", { live: true, ownership: "owned" }],
+        ["b", { live: false, unobserved: { reason: "read-failed", detail: "no determinate status" } }],
+      ]);
+      const merged = mergeLiveEvidence(base, supplement);
+      expect(merged.get("a")!.unobserved).toBeUndefined();
+      expect(merged.get("b")!.unobserved?.reason).toBe("read-failed");
+    });
+  });
+
+  // ── The observation tri-state reaches the status join (#1089) ─────────────
+
+  describe("not-observed never becomes 'stale' (#1089)", () => {
+    const record = {
+      version: 1,
+      component: "search-svc",
+      env: "prod",
+      digest: "sha256:abc",
+      gitSha: "g",
+      runId: "r",
+      timestamp: "2026-01-01T00:00:00Z",
+      actor: "ci",
+    } as const;
+
+    test("a recorded component whose live state could not be read reports unknown", () => {
+      const rows = reconcileStatus("prod", [record], {
+        liveEvidence: new Map<string, LiveComponentEvidence>([
+          ["search-svc", { live: false, unobserved: { reason: "no-binding", detail: "no kubectl context" } }],
+        ]),
+      });
+      expect(rows[0].reconciliation).toBe("unknown");
+      expect(rows[0].detail).toContain("could not be observed");
+      expect(rows[0].detail).toContain("no kubectl context");
+      // `live` is omitted entirely — `false` would read as "not deployed".
+      expect(rows[0].live).toBeUndefined();
+      expect(rows[0].unobserved).toEqual({ reason: "no-binding", detail: "no kubectl context" });
+    });
+
+    test("the same component, actually observed absent, still reports stale", () => {
+      const rows = reconcileStatus("prod", [record], {
+        liveEvidence: new Map<string, LiveComponentEvidence>([["search-svc", { live: false }]]),
+      });
+      expect(rows[0].reconciliation).toBe("stale");
+      expect(rows[0].live).toBe(false);
+    });
+
+    test("an unrecorded component that could not be read is unknown, not unrecorded", () => {
+      const rows = reconcileStatus("prod", [], {
+        allComponents: ["search-svc"],
+        liveEvidence: new Map<string, LiveComponentEvidence>([
+          ["search-svc", { live: false, unobserved: { reason: "read-failed" } }],
+        ]),
+      });
+      expect(rows[0].reconciliation).toBe("unknown");
+    });
+
+    test("liveEvidenceFromChangeSet carries the plan's unobserved verdict", () => {
+      const evidence = liveEvidenceFromChangeSet({
+        env: "prod",
+        entries: [
+          {
+            name: "search-svc",
+            action: "unobserved",
+            evidence: { declared: true, inSnapshot: false, live: false, observed: false },
+            ownership: "unknown",
+            unobservedReason: "unsupported-kind",
+            unobservedDetail: "no reader",
+          },
+        ],
+      });
+      expect(evidence.get("search-svc")!.unobserved).toEqual({
+        reason: "unsupported-kind",
+        detail: "no reader",
+      });
+    });
   });
 });

package/src/lifecycle/status.ts

@@ -21,6 +21,9 @@
  *    lower-confidence signal rather than silently treated as "reconciled".
  *  - **reconciled** — a release record exists and live evidence (via
  *    ownership) confirms the component is present and owned by chant.
+ *  - **unknown** — live evidence was requested and could not be read (#1089),
+ *    or was not requested at all. A component chant could not observe is never
+ *    reported `stale`: "the read failed" and "it is gone" are different facts.
  *
  * This is deliberately a light-touch reconciliation: chant's lexicons report
  * resource-level status (`ResourceMetadata`), not "the digest currently
@@ -36,6 +39,7 @@
 import type { ChangeSet, ChangeAction } from "./change-set";
 import { latestPerComponent, type ReleaseRecord } from "./release-ledger";
 import type { BuildLedgerEntry, ComponentBomSummary } from "./build-ledger";
+import { unobservedReasonText, type UnobservedReason } from "../observation";
 
 /** One row of `chant components status [env]` — the per-component join of recorded vs live. */
 export interface ComponentStatusRow {
@@ -63,9 +67,18 @@ export interface ComponentStatusRow {
   /**
    * Machine-readable "observed live", when live evidence was gathered (`--live`).
    * A consumer joining this row onto a graph node should read this rather than
-   * string-matching `detail`. Absent when `--live` was not requested.
+   * string-matching `detail`. Absent when `--live` was not requested — and, since
+   * #1089, also absent when live state could not be read at all: `false` means
+   * "looked, not there", never "did not look". Read {@link unobserved} for that
+   * case; a consumer that treats absent as "unknown" already handles it.
    */
   live?: boolean;
+  /**
+   * Set when `--live` was requested and the observation could not read this
+   * component (#1089). `live` is absent alongside it and `reconciliation` is
+   * `unknown` — the row reports a hole rather than a verdict.
+   */
+  unobserved?: { reason: UnobservedReason; detail?: string };
   /**
    * The owning deploy unit's raw status, when a lexicon reported it (AWS: the
    * component's own CFN stack via `describeStackStatus`). Lets a renderer paint a
@@ -103,6 +116,12 @@ export interface ComponentStatusResult {
 export interface LiveComponentEvidence {
   /** True if this component name was observed live at all (declared+live, or orphan+live). */
   live: boolean;
+  /**
+   * Set when the observation could not read this component (#1089). `live` is
+   * `false` alongside it, but only because the boolean has nowhere else to go —
+   * every consumer must branch on this field before believing `live: false`.
+   */
+  unobserved?: { reason: UnobservedReason; detail?: string };
   /** The `ChangeSet` action chant's existing plan logic assigned, when the component maps to a tracked entity/resource name. */
   action?: ChangeAction;
   /** Ownership verdict, when known. */
@@ -132,6 +151,10 @@ export function mergeLiveEvidence(
     const b = merged.get(component);
     merged.set(component, {
       live: sup.live,
+      // A direct stack observation that succeeded answers the question the
+      // change-set axis could not — so it clears an inherited "not observed".
+      // A supplement that itself could not read keeps the hole.
+      ...(sup.unobserved ? { unobserved: sup.unobserved } : {}),
       ownership: sup.ownership ?? b?.ownership,
       action: b?.action,
       stack: sup.stack ?? b?.stack,
@@ -178,8 +201,12 @@ function mergeEvidence(entries: LiveComponentEvidence[]): LiveComponentEvidence
   const action = entries.some((e) => e.action === "update")
     ? "update"
     : entries.find((e) => e.action !== undefined)?.action;
+  // A component whose entities were partly readable is still partly unknown, so
+  // any unobserved entity keeps the hole — unless something under it was
+  // actually seen live, which already answers "is this deployed".
+  const unobserved = live ? undefined : entries.find((e) => e.unobserved)?.unobserved;
 
-  return { live, ownership, action };
+  return { live, ownership, action, ...(unobserved ? { unobserved } : {}) };
 }
 
 /**
@@ -204,6 +231,16 @@ export function liveEvidenceFromChangeSet(
       live: entry.evidence.live,
       action: entry.action,
       ownership: entry.ownership,
+      // Carry the plan's "could not look" verdict through so the status join
+      // reports a hole instead of reading `live: false` as "gone" (#1089).
+      ...(entry.action === "unobserved" && entry.unobservedReason
+        ? {
+            unobserved: {
+              reason: entry.unobservedReason,
+              ...(entry.unobservedDetail ? { detail: entry.unobservedDetail } : {}),
+            },
+          }
+        : {}),
     });
   }
 
@@ -275,6 +312,15 @@ export function reconcileStatus(
       detail = recorded
         ? "recorded; live status not queried (pass --live to reconcile)"
         : "no release record found";
+    } else if (evidence?.unobserved) {
+      // Live evidence was requested and could not be read (#1089). Neither
+      // `stale` (which claims the component is gone) nor `reconciled` is
+      // supportable — the honest verdict is that nothing is known.
+      reconciliation = "unknown";
+      const why = `${unobservedReasonText(evidence.unobserved.reason)}${evidence.unobserved.detail ? `: ${evidence.unobserved.detail}` : ""}`;
+      detail = recorded
+        ? `recorded ${recorded.timestamp} (digest ${recorded.digest}), but live state could not be observed — ${why}`
+        : `no release record, and live state could not be observed — ${why}`;
     } else if (!recorded && evidence?.live) {
       reconciliation = "unrecorded";
       detail = `live${evidence.ownership === "owned" ? " and chant-owned" : ""}, but no release record exists — deployed outside the recorded path`;
@@ -300,7 +346,11 @@ export function reconcileStatus(
       componentBom,
       reconciliation,
       detail,
-      ...(liveEvidence ? { live: !!evidence?.live } : {}),
+      // `live` is only emitted when it is a real answer: requested AND read.
+      // An unread component leaves it absent (= unknown to every consumer)
+      // rather than reporting `false`, which would read as "not deployed".
+      ...(liveEvidence && !evidence?.unobserved ? { live: !!evidence?.live } : {}),
+      ...(evidence?.unobserved ? { unobserved: evidence.unobserved } : {}),
       ...(evidence?.stack ? { stack: evidence.stack } : {}),
     });
   }

package/src/lifecycle/types.ts

@@ -1,4 +1,5 @@
 import type { ResourceMetadata, ArtifactMetadata } from "../lexicon";
+import type { UnobservedEntity } from "../observation";
 
 export type { ResourceMetadata, ArtifactMetadata } from "../lexicon";
 
@@ -18,6 +19,13 @@ export interface LifecycleSnapshot {
   timestamp: string;
   /** Resource metadata keyed by logical name */
   resources: Record<string, ResourceMetadata>;
+  /**
+   * Declared entities this observation could not read (#1089), keyed by logical
+   * name. Additive and optional: a snapshot without it observed everything it
+   * was asked about. Present so a later diff can tell "was not there when the
+   * snapshot was taken" from "was never looked at".
+   */
+  unobserved?: Record<string, UnobservedEntity>;
   /** Artifact metadata keyed by server-side identifier (lexicon-specific). */
   artifacts?: Record<string, ArtifactMetadata>;
   /** Build digest at snapshot time — what was declared when this snapshot was taken */

package/src/lint/config.test.ts

@@ -1,5 +1,6 @@
 import { describe, test, expect, beforeEach, afterEach } from "vitest";
-import { loadConfig, DEFAULT_CONFIG, findProjectRoot } from "./config";
+import { loadConfig, DEFAULT_CONFIG, findProjectRoot, resolveConfiguredSeverity, applyConfiguredSeverity } from "./config";
+import type { PostSynthDiagnostic } from "./post-synth";
 import { writeFileSync, mkdirSync, rmSync } from "fs";
 import { join, resolve } from "path";
 
@@ -717,3 +718,94 @@ describe("findProjectRoot", () => {
     expect(findProjectRoot(sub)).toBe(packageRoot);
   });
 });
+
+/**
+ * chant #1138 — the one severity-resolution path AST lint rules
+ * (`../cli/commands/lint.ts`'s `getDefaultRules`), COMP* checks
+ * (`runComponentCheckDiagnostics`), and post-synth checks/policies
+ * (`applyConfiguredSeverity`, below) all now call, keyed by whichever id the
+ * caller has (a `LintRule.id`, a `ComponentCheck.id`, or a
+ * `PostSynthDiagnostic.checkId`) — a rule id behaves the same regardless of
+ * which phase produced it.
+ */
+describe("resolveConfiguredSeverity", () => {
+  test("an id with no config entry falls back to the caller's default severity, with no options", () => {
+    expect(resolveConfiguredSeverity(undefined, "COR001", "error")).toEqual({ severity: "error" });
+    expect(resolveConfiguredSeverity({}, "COR001", "warning")).toEqual({ severity: "warning" });
+    expect(resolveConfiguredSeverity({ OTHER: "off" }, "COR001", "error")).toEqual({ severity: "error" });
+  });
+
+  test("a bare severity string overrides the default", () => {
+    expect(resolveConfiguredSeverity({ COR001: "warning" }, "COR001", "error")).toEqual({ severity: "warning" });
+  });
+
+  test('"off" suppresses regardless of the default severity', () => {
+    expect(resolveConfiguredSeverity({ WAW019: "off" }, "WAW019", "error")).toEqual({ severity: "off" });
+  });
+
+  test("a [severity, options] tuple carries options through", () => {
+    expect(resolveConfiguredSeverity({ COR009: ["warning", { max: 12 }] }, "COR009", "error")).toEqual({
+      severity: "warning",
+      options: { max: 12 },
+    });
+  });
+
+  test("an invalid severity in a [severity, options] tuple throws, naming the bad value", () => {
+    expect(() =>
+      resolveConfiguredSeverity({ COR009: ["fatal" as never, { max: 12 }] }, "COR009", "error"),
+    ).toThrow(/severity "fatal"/);
+  });
+});
+
+/**
+ * chant #1138 — `lint.rules` severity overrides apply to a post-synth check
+ * id (`diag.checkId`) through the identical `resolveConfiguredSeverity` an
+ * AST rule id or a COMP* check id goes through, so
+ * `lint.rules: { WAW019: "off" }` suppresses a post-synth finding just like a
+ * pre-synth one — the bug this issue reports.
+ */
+describe("applyConfiguredSeverity", () => {
+  function diag(overrides: Partial<PostSynthDiagnostic> = {}): PostSynthDiagnostic {
+    return { checkId: "WAW019", severity: "error", message: "open ingress", ...overrides };
+  }
+
+  test("an unconfigured check id passes through unchanged — no drift for the common case", () => {
+    const result = applyConfiguredSeverity([diag()], undefined);
+    expect(result.diagnostics).toEqual([diag()]);
+    expect(result.suppressed).toEqual([]);
+  });
+
+  test('"off" suppresses the finding — moved to `suppressed`, not dropped, so it stays countable', () => {
+    const result = applyConfiguredSeverity([diag()], { WAW019: "off" });
+    expect(result.diagnostics).toEqual([]);
+    expect(result.suppressed).toEqual([diag()]);
+  });
+
+  test('"warning" downgrades an error-severity finding', () => {
+    const result = applyConfiguredSeverity([diag({ severity: "error" })], { WAW019: "warning" });
+    expect(result.diagnostics).toEqual([diag({ severity: "warning" })]);
+    expect(result.suppressed).toEqual([]);
+  });
+
+  test('"error" upgrades a warning-severity finding', () => {
+    const result = applyConfiguredSeverity([diag({ severity: "warning" })], { WAW019: "error" });
+    expect(result.diagnostics).toEqual([diag({ severity: "error" })]);
+  });
+
+  test("resolves each diagnostic by its own checkId — one config, independent ids", () => {
+    const diags = [
+      diag({ checkId: "WAW019" }),
+      diag({ checkId: "WAW049", message: "no logging" }),
+      diag({ checkId: "WAW099", message: "untouched" }),
+    ];
+    const result = applyConfiguredSeverity(diags, { WAW019: "off", WAW049: "warning" });
+    expect(result.suppressed.map((d) => d.checkId)).toEqual(["WAW019"]);
+    expect(result.diagnostics.map((d) => d.checkId)).toEqual(["WAW049", "WAW099"]);
+    expect(result.diagnostics.find((d) => d.checkId === "WAW049")?.severity).toBe("warning");
+    expect(result.diagnostics.find((d) => d.checkId === "WAW099")?.severity).toBe("error");
+  });
+
+  test("an empty diagnostics list is a no-op", () => {
+    expect(applyConfiguredSeverity([], { WAW019: "off" })).toEqual({ diagnostics: [], suppressed: [] });
+  });
+});

package/src/lint/config.ts

@@ -3,6 +3,7 @@ import { join, dirname, resolve } from "path";
 import { z } from "zod";
 import { evaluateProjectConfigSync } from "../config-sandbox";
 import type { Severity, RuleConfig } from "./rule";
+import type { PostSynthDiagnostic } from "./post-synth";
 import { moduleDir, getRuntime } from "../runtime-adapter";
 import strictPreset from "./presets/strict.json";
 
@@ -202,6 +203,40 @@ export function parseRuleConfig(value: RuleConfig): ParsedRuleConfig {
   return { severity, options };
 }
 
+/**
+ * Resolve one check/rule id's effective severity (and options) against an
+ * already-resolved `lint.rules` map — the ONE place `"off"`/severity-override
+ * resolution happens, so a rule id behaves identically regardless of which
+ * phase produced it.
+ *
+ * chant #1138 — before this, the same `lint.rules: { ID: "off" }` config was
+ * resolved by two independent call sites that had grown their own copy of
+ * this logic (`../cli/commands/lint.ts`'s `getDefaultRules` for AST COR/EVL
+ * rules, and its `runComponentCheckDiagnostics` for whole-component COMP*
+ * checks) — identical in effect, but a rule id's suppression having two
+ * places to (potentially, eventually) diverge is itself the bug class #1138
+ * is about. Both were converted to call this instead, and post-synth checks/
+ * policies (`./post-synth.ts`'s `applyConfiguredSeverity`) now go through it
+ * too, closing the gap the issue reports: a post-synth check id honors
+ * `lint.rules` exactly like an AST rule id does.
+ *
+ * `rules` takes the already-resolved map (`config.rules`, or
+ * `resolveRulesForFile`'s per-file merge) rather than a whole `LintConfig` —
+ * callers that need per-file `overrides` resolve that first; post-synth
+ * checks have no per-file scope to begin with (see {@link
+ * ./post-synth.ts!PostSynthDiagnostic}'s doc for why), so they always pass
+ * `config.rules` directly.
+ */
+export function resolveConfiguredSeverity(
+  rules: Record<string, RuleConfig> | undefined,
+  id: string,
+  defaultSeverity: Severity,
+): ParsedRuleConfig {
+  const configValue = rules?.[id];
+  if (configValue === undefined) return { severity: defaultSeverity };
+  return parseRuleConfig(configValue);
+}
+
 /**
  * Default configuration with all rules enabled at strict preset severities
  */
@@ -411,3 +446,76 @@ export function resolveRulesForFile(config: LintConfig, filePath: string): Recor
 
   return rules;
 }
+
+/** Result of applying `lint.rules` to a set of post-synth diagnostics. */
+export interface PostSynthSeverityResult {
+  /** Diagnostics after config resolution — `"off"`-suppressed ones removed, everything else at its resolved severity. */
+  diagnostics: PostSynthDiagnostic[];
+  /**
+   * Diagnostics `lint.rules` turned `"off"`, unaltered — present so a caller
+   * can report a count (chant #1138) rather than the finding simply
+   * vanishing, mirroring `../lint/engine.ts`'s `LintRunResult.suppressed` for
+   * AST rules.
+   */
+  suppressed: PostSynthDiagnostic[];
+}
+
+/**
+ * Apply `lint.rules` severity overrides to already-produced post-synth
+ * diagnostics — one lexicon-shipped check's findings, or one project's
+ * `lint.policies` findings, it doesn't matter which: both are plain
+ * `PostSynthDiagnostic[]` by the time they reach this function, so both go
+ * through the identical resolution an AST rule id or a COMP* check id gets
+ * (`resolveConfiguredSeverity`, above), keyed by `diag.checkId` instead of
+ * `LintRule.id`/`ComponentCheck.id`. `"off"` suppresses (moved to
+ * `suppressed`); any other configured severity replaces `diag.severity`,
+ * exactly as a config override changes an AST diagnostic's reported level.
+ *
+ * Lives here rather than in `./post-synth.ts` (where `PostSynthDiagnostic` is
+ * declared) on purpose: `post-synth.ts` is a leaf every lexicon's checks
+ * import as a real runtime module, and this file resolves built-in preset
+ * paths via the runtime adapter at module scope — pulling that into every
+ * lexicon's check barrel merely to share one filter function would be the
+ * wrong trade. Only this file's TYPE (`PostSynthDiagnostic`) crosses back,
+ * which costs nothing at runtime.
+ *
+ * chant #1138 — deliberately does NOT also honor `chant-disable` source
+ * comments. `PostSynthDiagnostic` has no source anchor to disable AT — see
+ * its doc comment (`./post-synth.ts`) for why `entity` doesn't supply one —
+ * so there is no coherent site to check for a directive. Even in the one case
+ * a real anchor sometimes exists (a live, in-process `ctx.entities` value
+ * stamped with build provenance, `../provenance.ts`'s `getProvenance`), it
+ * would not generalize: not every check sets `entity`, `entity` isn't
+ * guaranteed to be an entities-map key (it's a name in the synthesized
+ * OUTPUT — a CFN logical id, a k8s `metadata.name` — which a serializer is
+ * free to have derived, prefixed, or renamed from the source-level entity
+ * name), and that provenance never crosses the `--sandbox` policy child's
+ * JSON wire (`../discovery/entity-wire-codec.ts` doesn't carry it, and
+ * re-deriving it on the far side would mean sending source file paths into a
+ * channel that's supposed to carry only the resolved build). Building
+ * directive suppression on a sometimes-present, sometimes-not anchor would
+ * make `chant build` and `chant build --sandbox` disagree about the
+ * identical finding depending on which path happened to still have the
+ * entity object around — precisely the kind of inconsistency #1138 exists to
+ * remove. Config severity (`"off"`) is the one suppression surface this can
+ * offer uniformly; a check that wants a per-instance escape hatch can read
+ * `ctx.env`/its own options to decide not to emit a diagnostic at all.
+ */
+export function applyConfiguredSeverity(
+  diagnostics: readonly PostSynthDiagnostic[],
+  rules: Record<string, RuleConfig> | undefined,
+): PostSynthSeverityResult {
+  const kept: PostSynthDiagnostic[] = [];
+  const suppressed: PostSynthDiagnostic[] = [];
+
+  for (const diag of diagnostics) {
+    const resolved = resolveConfiguredSeverity(rules, diag.checkId, diag.severity);
+    if (resolved.severity === "off") {
+      suppressed.push(diag);
+      continue;
+    }
+    kept.push(resolved.severity === diag.severity ? diag : { ...diag, severity: resolved.severity });
+  }
+
+  return { diagnostics: kept, suppressed };
+}

package/src/lint/policy.test.ts

@@ -0,0 +1,90 @@
+/**
+ * chant #1138 — `evaluateProjectPolicies` (the `policyGate` Op step's entry
+ * point, ../../lexicons/temporal/src/op/activities/policy.ts) applies
+ * `lint.rules` severity overrides to policy diagnostics the same way `chant
+ * build` does (`../cli/commands/build.ts`), so a check `lint.rules` turns
+ * "off" no longer gates an apply either — before this fix, only `chant
+ * build`'s own error list was affected (and, before #1138, not even that).
+ *
+ * No lexicon is declared: the fixture project has no source files, so
+ * `resolveProjectLexicons` detects none and `build()` succeeds trivially with
+ * zero entities — the policy pack is the only thing under test.
+ */
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { evaluateProjectPolicies } from "./policy";
+
+describe("evaluateProjectPolicies honors lint.rules (chant #1138)", () => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-policy-eval-test-${Date.now()}-${Math.random()}`);
+    await mkdir(join(testDir, "policies"), { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  async function writePolicyProject(checkId: string, severity: "error" | "warning", rules: Record<string, string>): Promise<void> {
+    await writeFile(
+      join(testDir, "policies", "org.ts"),
+      `export const check = {\n` +
+        `  id: ${JSON.stringify(checkId)},\n` +
+        `  description: "test policy",\n` +
+        `  check: () => [{ checkId: ${JSON.stringify(checkId)}, severity: ${JSON.stringify(severity)}, message: ${JSON.stringify(`${checkId} triggered`)} }],\n` +
+        `};\n`,
+    );
+    await writeFile(
+      join(testDir, "chant.config.ts"),
+      // `lexicons: ["k8s"]` avoids `resolveProjectLexicons`'s source-import
+      // auto-detection, which throws on a project with no lexicon-importing
+      // source file at all (this fixture has none — the policy pack is the
+      // only thing under test).
+      `export default { lexicons: ["k8s"], lint: { policies: ["policies/org.ts"], rules: ${JSON.stringify(rules)} } };\n`,
+    );
+  }
+
+  test('lint.rules "off" removes a check from violations and reports it as suppressed', async () => {
+    await writePolicyProject("ORG-OFF", "error", { "ORG-OFF": "off" });
+
+    const evaluation = await evaluateProjectPolicies({ path: testDir });
+
+    expect(evaluation.violations).toEqual([]);
+    expect(evaluation.diagnostics).toEqual([]);
+    expect(evaluation.suppressed).toHaveLength(1);
+    expect(evaluation.suppressed[0].checkId).toBe("ORG-OFF");
+  });
+
+  test('lint.rules "warning" downgrades an error-severity check out of violations', async () => {
+    await writePolicyProject("ORG-DOWN", "error", { "ORG-DOWN": "warning" });
+
+    const evaluation = await evaluateProjectPolicies({ path: testDir });
+
+    expect(evaluation.violations).toEqual([]);
+    expect(evaluation.diagnostics).toHaveLength(1);
+    expect(evaluation.diagnostics[0].severity).toBe("warning");
+    expect(evaluation.suppressed).toEqual([]);
+  });
+
+  test('lint.rules "error" upgrades a warning-severity check INTO violations', async () => {
+    await writePolicyProject("ORG-UP", "warning", { "ORG-UP": "error" });
+
+    const evaluation = await evaluateProjectPolicies({ path: testDir });
+
+    expect(evaluation.violations).toHaveLength(1);
+    expect(evaluation.violations[0].checkId).toBe("ORG-UP");
+    expect(evaluation.violations[0].severity).toBe("error");
+  });
+
+  test("an unconfigured check id is unaffected — no drift for the common case", async () => {
+    await writePolicyProject("ORG-PLAIN", "error", {});
+
+    const evaluation = await evaluateProjectPolicies({ path: testDir });
+
+    expect(evaluation.violations).toHaveLength(1);
+    expect(evaluation.suppressed).toEqual([]);
+  });
+});

package/src/lint/policy.ts

@@ -9,6 +9,7 @@ import { resolveProjectLexicons, loadPlugins } from "../cli/plugins";
 import { build } from "../build";
 import { runPostSynthChecks, isPostSynthCheck } from "./post-synth";
 import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth";
+import { applyConfiguredSeverity } from "./config";
 import { importPolicyModule, isSandboxPolicyExecutionArmed } from "./policy-import";
 
 /**
@@ -49,12 +50,18 @@ export async function loadPolicyChecks(paths: string[], configDir: string): Prom
 }
 
 export interface PolicyEvaluation {
-  /** All policy diagnostics (errors + warnings). */
+  /** All policy diagnostics (errors + warnings), after `lint.rules` severity overrides. */
   diagnostics: PostSynthDiagnostic[];
-  /** The error-severity subset — these are policy *violations* that gate. */
+  /** The error-severity subset (post-override) — these are policy *violations* that gate. */
   violations: PostSynthDiagnostic[];
   /** The environment policies were evaluated against (if any). */
   env?: string;
+  /**
+   * chant #1138 — diagnostics `lint.rules` turned `"off"`, present here rather
+   * than dropped so a caller (`policyGate`, below) can report a count instead
+   * of the finding just vanishing.
+   */
+  suppressed: PostSynthDiagnostic[];
 }
 
 /**
@@ -90,10 +97,15 @@ export async function evaluateProjectPolicies(opts: {
     ? await loadPolicyChecks(config.lint.policies, configDir)
     : [];
   if (checks.length === 0) {
-    return { diagnostics: [], violations: [], env };
+    return { diagnostics: [], violations: [], env, suppressed: [] };
   }
 
-  const diagnostics = runPostSynthChecks(checks, result, env);
+  const raw = runPostSynthChecks(checks, result, env);
+  // chant #1138 — same `lint.rules` resolution `chant build` applies
+  // (`../cli/commands/build.ts`), so a check `lint.rules` turned "off"/
+  // "warning" doesn't gate an apply here even though `chant build` no longer
+  // fails on it either, and vice versa for a check turned UP to "error".
+  const { diagnostics, suppressed } = applyConfiguredSeverity(raw, config.lint?.rules);
   const violations = diagnostics.filter((d) => d.severity === "error");
-  return { diagnostics, violations, env };
+  return { diagnostics, violations, env, suppressed };
 }

package/src/lint/post-synth.test.ts

@@ -141,3 +141,7 @@ describe("isPostSynthCheck", () => {
     expect(isPostSynthCheck("nope")).toBe(false);
   });
 });
+
+// chant #1138 — `applyConfiguredSeverity` (the `lint.rules` severity-override
+// pass over `PostSynthDiagnostic`s) is tested in `./config.test.ts`, where the
+// function itself now lives — see `./config.ts`'s doc comment for why.