@intentius/chant 0.31.0 → 0.32.0

package/src/lifecycle/live-diff.test.ts

@@ -19,6 +19,7 @@ describe("diffLive", () => {
     expect(result).toEqual({
       missing: [],
       orphan: [],
+      runtimeChildren: [],
       disappeared: [],
       newlyObserved: [],
       driftedSinceSnapshot: [],
@@ -114,6 +115,93 @@ describe("diffLive", () => {
     expect(result.unchanged).toEqual(["b"]);
   });
 
+  // ── Owner-reference chain classification (#1077) ──────────────────────────
+
+  describe("runtime children vs orphans", () => {
+    test("undeclared, chain reaches a declared entity → runtimeChildren, never orphan", () => {
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: {
+          web: meta({ type: "K8s::Apps::Deployment" }),
+          "prod/web-abc123": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+        },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual([]);
+      expect(result.runtimeChildren).toEqual([
+        { name: "prod/web-abc123", type: "K8s::Core::Pod", owner: "web" },
+      ]);
+    });
+
+    test("undeclared, no owner reference at all → orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/standalone": meta({ ownerChain: { root: "unowned" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/standalone"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("undeclared, chain resolves to a foreign (non-declared) root → orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/other-app-pod": meta({ ownerChain: { root: "foreign" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/other-app-pod"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("undeclared, chain could not be resolved (unreadable owner/cycle/depth) → conservative orphan, not runtime", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { "prod/mystery-pod": meta({ ownerChain: { root: "unknown" } }) },
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["prod/mystery-pod"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("a lexicon that never sets ownerChain is unaffected — undeclared stays orphan", () => {
+      const result = diffLive({
+        declared: new Set(),
+        observedNow: { legacy: meta() }, // no ownerChain at all
+        observedThen: undefined,
+      });
+      expect(result.orphan).toEqual(["legacy"]);
+      expect(result.runtimeChildren).toEqual([]);
+    });
+
+    test("a runtime child rolling to a new name between snapshots is not `disappeared`", () => {
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: {
+          web: meta({ type: "K8s::Apps::Deployment" }),
+          "prod/web-newname": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }),
+        },
+        observedThen: { "prod/web-oldname": meta({ type: "K8s::Core::Pod", ownerChain: { root: "declared", entity: "web" } }) },
+      });
+      expect(result.disappeared).toEqual([]);
+      expect(result.runtimeChildren).toEqual([
+        { name: "prod/web-newname", type: "K8s::Core::Pod", owner: "web" },
+      ]);
+    });
+
+    test("a runtime child's own status change between snapshots is not driftedSinceSnapshot", () => {
+      const podThen = meta({ type: "K8s::Core::Pod", status: "PROGRESSING", ownerChain: { root: "declared", entity: "web" } });
+      const podNow = meta({ type: "K8s::Core::Pod", status: "READY", ownerChain: { root: "declared", entity: "web" } });
+      const result = diffLive({
+        declared: new Set(["web"]),
+        observedNow: { web: meta({ type: "K8s::Apps::Deployment" }), "prod/web-stable-0": podNow },
+        observedThen: { "prod/web-stable-0": podThen },
+      });
+      expect(result.driftedSinceSnapshot).toEqual([]);
+      expect(result.unchanged).not.toContain("prod/web-stable-0");
+      expect(result.runtimeChildren.map((r) => r.name)).toEqual(["prod/web-stable-0"]);
+    });
+  });
+
   // ── The observation tri-state (#1089) ─────────────────────────────────────
 
   test("declared and not observed → unobserved, not missing", () => {

package/src/lifecycle/live-diff.ts

@@ -36,6 +36,19 @@ export interface UnobservedResource {
   detail?: string;
 }
 
+/**
+ * A live, undeclared resource whose owner-reference chain reaches a declared
+ * entity (#1077) — a Pod a declared Deployment's controller created, for
+ * instance. Reported separately from `orphan`: it is expected runtime, not a
+ * delete/adopt candidate, and is never counted as drift.
+ */
+export interface RuntimeChildResource {
+  name: string;
+  type: string;
+  /** The declared chant entity this resource's owner chain resolves to. */
+  owner: string;
+}
+
 export interface LiveDiffResult {
   /**
    * Declared in current build, and the provider reported it absent. Entities
@@ -43,8 +56,20 @@ export interface LiveDiffResult {
    * (#1089), so "missing" keeps meaning "confirmed not there".
    */
   missing: string[];
-  /** Observed in cloud right now, but not declared. */
+  /**
+   * Observed in cloud right now, not declared, and either carries no owner
+   * chain, or the chain does not reach a declared entity (unowned, foreign,
+   * or unresolvable — #1077 never escalates an incomplete chain read to
+   * `runtimeChildren`). A resource whose chain *does* reach a declared entity
+   * is in `runtimeChildren` instead.
+   */
   orphan: string[];
+  /**
+   * Observed in cloud right now, not declared, whose owner-reference chain
+   * reaches a declared entity (#1077) — expected runtime, not drift. Never a
+   * delete/adopt candidate; excluded from `orphan` and from drift counts.
+   */
+  runtimeChildren: RuntimeChildResource[];
   /** Was in last snapshot but isn't observed now. */
   disappeared: string[];
   /** Observed now and declared, but not in the previous snapshot. */
@@ -169,6 +194,7 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
 
   const missing: string[] = [];
   const orphan: string[] = [];
+  const runtimeChildren: RuntimeChildResource[] = [];
   const disappeared: string[] = [];
   const newlyObserved: string[] = [];
   const driftedSinceSnapshot: ResourceDrift[] = [];
@@ -194,23 +220,43 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
     }
   }
 
-  // In cloud right now but not declared → orphan
+  // In cloud right now but not declared → orphan, unless its owner-reference
+  // chain reaches a declared entity (#1077), in which case it is expected
+  // runtime rather than drift. An `unknown` chain (unreadable hop, cycle, or
+  // depth bound) is deliberately NOT escalated to runtime — it stays orphan,
+  // same as `unowned`/`foreign` — composing with #1168's tri-state precedent:
+  // an incomplete read never earns the more confident classification.
+  const runtimeChildNames = new Set<string>();
   for (const name of observedNowNames) {
-    if (!declared.has(name)) {
+    if (declared.has(name)) continue;
+    const chain = observedNow[name]?.ownerChain;
+    if (chain?.root === "declared") {
+      runtimeChildNames.add(name);
+      runtimeChildren.push({ name, type: observedNow[name].type, owner: chain.entity });
+    } else {
       orphan.push(name);
     }
   }
 
   // In previous snapshot but not observed now → disappeared. An entity nobody
-  // could look at has not disappeared; it is unobserved.
+  // could look at has not disappeared; it is unobserved. A resource the
+  // *previous* snapshot recorded as a runtime child (#1077) rolling to a new
+  // name (a Pod replaced by its controller) is not disappearance either — it
+  // is the same expected churn `runtimeChildren` excludes above, and counting
+  // it here would recreate the drift noise this module exists to remove.
   for (const name of observedThenNames) {
-    if (!observedNowNames.has(name) && !unobservedNames.has(name)) {
-      disappeared.push(name);
-    }
+    if (observedNowNames.has(name) || unobservedNames.has(name)) continue;
+    if (!declared.has(name) && observedThenMap[name]?.ownerChain?.root === "declared") continue;
+    disappeared.push(name);
   }
 
-  // Observed now: classify drift relative to previous snapshot
+  // Observed now: classify drift relative to previous snapshot. Runtime
+  // children (#1077) are excluded entirely — a controller-owned object's
+  // transient status is not drift chant should surface, and a snapshot that
+  // happened to record the same name (e.g. a StatefulSet's stable pod
+  // identity) must not turn its ordinary churn into `driftedSinceSnapshot`.
   for (const name of observedNowNames) {
+    if (runtimeChildNames.has(name)) continue;
     const now = observedNow[name];
     const then = observedThenMap[name];
     if (!then) {
@@ -235,6 +281,7 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
   return {
     missing: missing.sort(),
     orphan: orphan.sort(),
+    runtimeChildren: runtimeChildren.sort((a, b) => a.name.localeCompare(b.name)),
     disappeared: disappeared.sort(),
     newlyObserved: newlyObserved.sort(),
     driftedSinceSnapshot: driftedSinceSnapshot.sort((a, b) => a.name.localeCompare(b.name)),

package/src/managed-fields.test.ts

@@ -0,0 +1,179 @@
+import { describe, test, expect } from "vitest";
+import {
+  K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS,
+  k8sListMapOrderKey,
+  buildOwnershipSets,
+  pruneByOwnership,
+  type OwnershipSets,
+} from "./managed-fields";
+import { normalizeDeepProperties, type DeepNode } from "./deep-observation";
+
+/** The naming scheme both the k8s lexicon (via `@intentius/chant-k8s-client`'s `isChantFieldManager`) and gcp restate use in their own tests. */
+function isChantManager(manager: string | undefined): boolean {
+  return !!manager && (manager === "chant" || manager.startsWith("chant:"));
+}
+
+function node(partial: Partial<DeepNode> & Pick<DeepNode, "path" | "pattern">): DeepNode {
+  return {
+    entityType: "Test::Entity",
+    key: partial.pattern,
+    value: undefined,
+    side: "live",
+    counterpart: "unknown",
+    ...partial,
+  };
+}
+
+describe("K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS — the generic Kubernetes object envelope", () => {
+  test("covers status and the server-minted metadata fields", () => {
+    for (const p of [
+      "status",
+      "metadata.uid",
+      "metadata.resourceVersion",
+      "metadata.generation",
+      "metadata.creationTimestamp",
+      "metadata.managedFields",
+      "metadata.selfLink",
+    ]) {
+      expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has(p)).toBe(true);
+    }
+  });
+
+  test("does not cover a declared field with a similar name", () => {
+    expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has("metadata.labels")).toBe(false);
+    expect(K8S_OBJECT_ENVELOPE_PRUNE_PATTERNS.has("spec.status")).toBe(false);
+  });
+});
+
+describe("k8sListMapOrderKey — Kubernetes' own list-map-key conventions", () => {
+  test("orders containers, env and volumes by name", () => {
+    const out = normalizeDeepProperties(
+      {
+        containers: [{ name: "sidecar" }, { name: "app" }],
+        env: [{ name: "Z" }, { name: "A" }],
+      },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((out.containers as Array<{ name: string }>).map((c) => c.name)).toEqual(["app", "sidecar"]);
+    expect((out.env as Array<{ name: string }>).map((e) => e.name)).toEqual(["A", "Z"]);
+  });
+
+  test("orders container ports by containerPort+protocol and service ports by port+protocol", () => {
+    const containerPorts = normalizeDeepProperties(
+      { ports: [{ containerPort: 9090, protocol: "TCP" }, { containerPort: 8080, protocol: "TCP" }] },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((containerPorts.ports as Array<{ containerPort: number }>).map((p) => p.containerPort)).toEqual([8080, 9090]);
+
+    const servicePorts = normalizeDeepProperties(
+      { ports: [{ port: 443, protocol: "TCP" }, { port: 80, protocol: "TCP" }] },
+      { entityType: "Any::Type", side: "live", hooks: { orderKey: k8sListMapOrderKey } },
+    );
+    expect((servicePorts.ports as Array<{ port: number }>).map((p) => p.port)).toEqual([80, 443]);
+  });
+
+  test("leaves an unrecognized array's order alone", () => {
+    expect(k8sListMapOrderKey({ entityType: "Any", path: "widgets", pattern: "widgets", element: { z: 1 }, index: 0, side: "live" })).toBeUndefined();
+  });
+});
+
+describe("buildOwnershipSets — resolving managedFields against live and declared trees", () => {
+  test("a scalar owned by chant is chant-owned regardless of the declared tree", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "chant:web", operation: "Apply", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 3 } },
+      {},
+      isChantManager,
+    );
+    expect(sets.chantOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(false);
+  });
+
+  test("a scalar owned by a foreign manager and undeclared is foreign-owned, not contested", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kube-controller-manager", operation: "Update", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 7 } },
+      { spec: {} },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignContested.has("spec.replicas")).toBe(false);
+  });
+
+  test("a scalar owned by a foreign manager AND declared is contested", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kubectl-client-side-apply", operation: "Update", fieldsV1: { "f:spec": { "f:replicas": {} } } }],
+      { spec: { replicas: 9 } },
+      { spec: { replicas: 5 } },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.replicas")).toBe(true);
+    expect(sets.foreignContested.has("spec.replicas")).toBe(true);
+  });
+
+  test("a keyed list item resolves to its live index, independent of position in the declared array", () => {
+    const sets = buildOwnershipSets(
+      [
+        {
+          manager: "istio-sidecar-injector",
+          operation: "Update",
+          fieldsV1: { "f:spec": { "f:containers": { 'k:{"name":"istio-proxy"}': { ".": {}, "f:name": {} } } } },
+        },
+      ],
+      { spec: { containers: [{ name: "istio-proxy" }, { name: "app" }] } },
+      { spec: { containers: [{ name: "app" }] } },
+      isChantManager,
+    );
+    expect(sets.foreignOwned.has("spec.containers[0]")).toBe(true);
+    expect(sets.foreignContested.has("spec.containers[0]")).toBe(false);
+  });
+
+  test("a subresource entry (status) is excluded", () => {
+    const sets = buildOwnershipSets(
+      [{ manager: "kube-controller-manager", operation: "Update", subresource: "status", fieldsV1: { "f:status": { "f:readyReplicas": {} } } }],
+      { status: { readyReplicas: 3 } },
+      {},
+      isChantManager,
+    );
+    expect(sets.foreignOwned.size).toBe(0);
+  });
+
+  test("an entry with no manager name is skipped", () => {
+    const sets = buildOwnershipSets(
+      [{ operation: "Update", fieldsV1: { "f:spec": {} } }],
+      { spec: {} },
+      {},
+      isChantManager,
+    );
+    expect(sets.chantOwned.size).toBe(0);
+    expect(sets.foreignOwned.size).toBe(0);
+  });
+});
+
+describe("pruneByOwnership — the shared three-question rule", () => {
+  const sets: OwnershipSets = {
+    chantOwned: new Set(["metadata.labels.tier"]),
+    foreignOwned: new Set(["spec.replicas", "metadata.annotations.noise"]),
+    foreignContested: new Set(["spec.replicas"]),
+  };
+
+  test("never prunes the declared side", () => {
+    expect(pruneByOwnership(node({ path: "spec.replicas", pattern: "spec.replicas", side: "declared" }), sets)).toBe(false);
+  });
+
+  test("never prunes a chant-owned path", () => {
+    expect(pruneByOwnership(node({ path: "metadata.labels.tier", pattern: "metadata.labels.tier" }), sets)).toBe(false);
+  });
+
+  test("prunes a foreign-owned, uncontested (undeclared) path", () => {
+    expect(pruneByOwnership(node({ path: "metadata.annotations.noise", pattern: "metadata.annotations.noise" }), sets)).toBe(true);
+  });
+
+  test("keeps a foreign-owned, contested (declared) path", () => {
+    expect(pruneByOwnership(node({ path: "spec.replicas", pattern: "spec.replicas" }), sets)).toBe(false);
+  });
+
+  test("leaves a path with no ownership information alone (never pruned by this rule)", () => {
+    expect(pruneByOwnership(node({ path: "spec.selector", pattern: "spec.selector" }), sets)).toBe(false);
+  });
+});