@intentius/chant 0.46.0 → 0.50.0

package/src/lifecycle/unobserved-gate.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, test } from "vitest";
+import { buildChangeSet } from "./change-set";
+import { evaluateUnobservedGate } from "./unobserved-gate";
+import type { ChangeSet } from "./change-set";
+import type { UnobservedReason } from "../observation";
+
+const cleanChangeSet = (env = "prod"): ChangeSet =>
+  buildChangeSet(env, {
+    declared: new Set(["bucket"]),
+    observedNow: { bucket: { type: "Fake::Bucket", status: "OK" } },
+    observedThen: undefined,
+  });
+
+const unobservedChangeSet = (reason: UnobservedReason, detail?: string): ChangeSet =>
+  buildChangeSet("prod", {
+    declared: new Set(["queue"]),
+    observedNow: {},
+    observedThen: undefined,
+    unobserved: { queue: { reason, ...(detail ? { detail } : {}) } },
+  });
+
+describe("evaluateUnobservedGate (#1568)", () => {
+  test("a clean change set passes under every policy", () => {
+    const cs = cleanChangeSet();
+    expect(evaluateUnobservedGate(cs)).toEqual({ pass: true, escalate: false, findings: [] });
+    expect(evaluateUnobservedGate(cs, "escalate")).toEqual({ pass: true, escalate: false, findings: [] });
+    expect(evaluateUnobservedGate(cs, { allow: [] })).toEqual({ pass: true, escalate: false, findings: [] });
+  });
+
+  test("default policy (no argument) refuses a plan with an unobserved entity", () => {
+    const cs = unobservedChangeSet("no-credentials", "aws sts get-caller-identity: access denied");
+    const verdict = evaluateUnobservedGate(cs);
+    expect(verdict.pass).toBe(false);
+    expect(verdict.escalate).toBe(false);
+    expect(verdict.findings).toEqual([
+      { name: "queue", reason: "no-credentials", detail: "aws sts get-caller-identity: access denied" },
+    ]);
+    expect(verdict.detail).toContain("queue");
+    expect(verdict.detail).toContain("no credentials");
+  });
+
+  test('explicit "refuse" behaves the same as the default', () => {
+    const cs = unobservedChangeSet("read-failed");
+    expect(evaluateUnobservedGate(cs, "refuse").pass).toBe(false);
+  });
+
+  test('"escalate" does not fail the gate but flags escalate with the findings', () => {
+    const cs = unobservedChangeSet("no-binding");
+    const verdict = evaluateUnobservedGate(cs, "escalate");
+    expect(verdict.pass).toBe(true);
+    expect(verdict.escalate).toBe(true);
+    expect(verdict.findings).toHaveLength(1);
+    expect(verdict.findings[0].reason).toBe("no-binding");
+    expect(verdict.detail).toBeDefined();
+  });
+
+  test("an allowed reason passes cleanly and is not counted as a finding", () => {
+    const cs = unobservedChangeSet("filtered");
+    const verdict = evaluateUnobservedGate(cs, { allow: ["filtered"] });
+    expect(verdict).toEqual({ pass: true, escalate: false, findings: [] });
+  });
+
+  test("a reason outside the allow list still refuses", () => {
+    const cs = unobservedChangeSet("no-credentials");
+    const verdict = evaluateUnobservedGate(cs, { allow: ["filtered"] });
+    expect(verdict.pass).toBe(false);
+    expect(verdict.findings[0].reason).toBe("no-credentials");
+  });
+
+  test("a mixed change set with one allowed and one unallowed reason only reports the unallowed one", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(["a", "b"]),
+      observedNow: {},
+      observedThen: undefined,
+      unobserved: {
+        a: { reason: "filtered" },
+        b: { reason: "unsupported-kind" },
+      },
+    });
+    const verdict = evaluateUnobservedGate(cs, { allow: ["filtered"] });
+    expect(verdict.pass).toBe(false);
+    expect(verdict.findings).toEqual([{ name: "b", reason: "unsupported-kind" }]);
+  });
+
+  test("never escalates or refuses on create/update/delete/adopt/noop — only `unobserved` counts", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(["created", "updated"]),
+      observedNow: {
+        updated: { type: "Fake::Resource", status: "DRIFTED" },
+        orphan: { type: "Fake::Resource", status: "OK" },
+      },
+      observedThen: { updated: { type: "Fake::Resource", status: "OK" } },
+    });
+    expect(evaluateUnobservedGate(cs)).toEqual({ pass: true, escalate: false, findings: [] });
+  });
+
+  test("carries type and detail through into the finding when present", () => {
+    const cs = buildChangeSet("prod", {
+      declared: new Set(["disk"]),
+      observedNow: {},
+      observedThen: undefined,
+      unobserved: { disk: { reason: "unsupported-kind", detail: "no describe support for this kind yet", type: "Fake::Disk" } },
+    });
+    const verdict = evaluateUnobservedGate(cs);
+    expect(verdict.findings).toEqual([
+      { name: "disk", type: "Fake::Disk", reason: "unsupported-kind", detail: "no describe support for this kind yet" },
+    ]);
+  });
+});

package/src/lifecycle/unobserved-gate.ts

@@ -0,0 +1,102 @@
+/**
+ * The unobserved gate predicate (#1568): a plan containing unobserved
+ * entities must not pass as clean.
+ *
+ * `buildChangeSet` (./change-set.ts) already refuses to guess when a lexicon
+ * could not look (#1089) — entries land as `action: "unobserved"`, carrying a
+ * total `unobservedReason` (`read-failed`, `no-credentials`, `no-binding`,
+ * `unsupported-kind`, `filtered`; see ../observation.ts). But nothing
+ * downstream is *required* to look: a gate that checks lint-clean,
+ * owned-only, and a blast-radius budget can walk right past a change set
+ * whose live read partially failed and call it clean, because none of those
+ * checks reads `unobserved` at all. A gate over an incomplete read is a gate
+ * over a guess.
+ *
+ * This is a reusable predicate, not a runtime — evaluate a `ChangeSet`
+ * against a policy and get back a verdict; the caller (a `lint.policies`
+ * check routed through `policyGate`, an Op step, #1487's gate-as-fact once it
+ * lands) decides what to do with a refusal (throw, diagnostic, a durable
+ * gated-run fact). Same instinct #1484 already adopts for `unknown` in the
+ * operating loop ("`unknown` never remediates"), surfaced here as something
+ * any gate can declare rather than a property of one runtime.
+ */
+import type { ChangeSet } from "./change-set";
+import { unobservedReasonText, type UnobservedReason } from "../observation";
+
+/**
+ * How the gate treats the change set's unobserved set.
+ *
+ * - `"refuse"` (the default) — any unobserved entry not covered by `allow`
+ *   fails the gate outright. Fail-closed, the right default for a policy set
+ *   aimed at agent-proposed change sets: a hole must never launder into a
+ *   clean verdict just because nobody configured otherwise.
+ * - `"escalate"` — the gate does not fail here; instead the verdict reports
+ *   `escalate: true` so a caller can route the plan to a stricter gate class
+ *   rather than the ordinary path (the same shape of routing decision #1569
+ *   makes for pipeline changes).
+ * - `{ allow: [...] }` — the listed reasons are tolerated (e.g. `"filtered"`,
+ *   intentional in a scoped run) and never fail or escalate the gate; any
+ *   reason NOT in the list still refuses. `no-credentials` — a hole that must
+ *   never launder into a clean verdict — should never appear in an `allow`
+ *   list for a policy aimed at agent-proposed change sets.
+ */
+export type UnobservedGatePolicy = "refuse" | "escalate" | { allow: UnobservedReason[] };
+
+/** One unobserved hole the gate found, carried into the refusal. */
+export interface UnobservedGateFinding {
+  name: string;
+  type?: string;
+  reason: UnobservedReason;
+  detail?: string;
+}
+
+export interface UnobservedGateVerdict {
+  /** False when the policy is `"refuse"` (default) and an unallowed unobserved entry exists. */
+  pass: boolean;
+  /** True when the policy is `"escalate"` and an unallowed unobserved entry exists — route to a stricter gate instead of failing here. */
+  escalate: boolean;
+  /** Every unobserved entry the policy did not allow. Empty when `pass` is true and `escalate` is false. */
+  findings: UnobservedGateFinding[];
+  /** Human-readable summary carrying the reasons into a refusal — the message a caller can surface as-is. Undefined when `findings` is empty. */
+  detail?: string;
+}
+
+/**
+ * Evaluate a `ChangeSet`'s unobserved set against `policy`. Pure — reads only
+ * `cs.entries`, no I/O. Defaults to `"refuse"`.
+ */
+export function evaluateUnobservedGate(
+  cs: ChangeSet,
+  policy: UnobservedGatePolicy = "refuse",
+): UnobservedGateVerdict {
+  const allowed = typeof policy === "object" ? new Set(policy.allow) : undefined;
+
+  const findings: UnobservedGateFinding[] = [];
+  for (const e of cs.entries) {
+    if (e.action !== "unobserved" || e.unobservedReason === undefined) continue;
+    if (allowed?.has(e.unobservedReason)) continue;
+    findings.push({
+      name: e.name,
+      ...(e.type ? { type: e.type } : {}),
+      reason: e.unobservedReason,
+      ...(e.unobservedDetail ? { detail: e.unobservedDetail } : {}),
+    });
+  }
+
+  if (findings.length === 0) {
+    return { pass: true, escalate: false, findings: [] };
+  }
+
+  const detail =
+    `plan contains ${findings.length} unobserved ${findings.length === 1 ? "entity" : "entities"} — ` +
+    findings
+      .map((f) => `${f.name}${f.type ? ` (${f.type})` : ""}: ${unobservedReasonText(f.reason)}${f.detail ? ` (${f.detail})` : ""}`)
+      .join(", ");
+
+  if (policy === "escalate") {
+    return { pass: true, escalate: true, findings, detail };
+  }
+
+  // "refuse" (default) and `{ allow }` both fail closed on anything not allowed.
+  return { pass: false, escalate: false, findings, detail };
+}

package/src/lint/knowledge-checks.test.ts

@@ -0,0 +1,80 @@
+import { describe, test, expect } from "vitest";
+import { coreKnowledgeChecks, STALE_KNOWLEDGE_BINDING_CHECK_ID } from "./knowledge-checks";
+import { runPostSynthChecks } from "./post-synth";
+import { DECLARABLE_MARKER, type Declarable } from "../declarable";
+import type { OkfBundle, OkfConcept } from "../okf-read";
+
+function entity(): Declarable {
+  return { [DECLARABLE_MARKER]: true, lexicon: "aws", entityType: "AWS::S3::Bucket" } as unknown as Declarable;
+}
+
+function concept(overrides: Partial<OkfConcept> = {}): OkfConcept {
+  return {
+    path: "decisions/example.md",
+    type: "decision",
+    binds: [],
+    frontmatter: {},
+    body: "",
+    ...overrides,
+  };
+}
+
+function run(bundle: OkfBundle, entities: Map<string, Declarable>) {
+  return runPostSynthChecks(coreKnowledgeChecks(bundle), {
+    outputs: new Map(),
+    entities,
+    warnings: [],
+    errors: [],
+    sourceFileCount: 1,
+  });
+}
+
+describe("COR026: stale knowledge binding (#1865)", () => {
+  test("check id", () => {
+    expect(STALE_KNOWLEDGE_BINDING_CHECK_ID).toBe("COR026");
+    expect(coreKnowledgeChecks({ concepts: [] }).map((c) => c.id)).toContain("COR026");
+  });
+
+  test("fires once per unresolved binding, naming the concept path and the unresolved name", () => {
+    const bundle: OkfBundle = {
+      concepts: [concept({ path: "decisions/ghost.md", title: "Stale", binds: ["ghostBucket"] })],
+    };
+    const diags = run(bundle, new Map());
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("COR026");
+    expect(diags[0].severity).toBe("warning");
+    expect(diags[0].message).toContain("decisions/ghost.md");
+    expect(diags[0].message).toContain("ghostBucket");
+  });
+
+  test("fires one diagnostic per unresolved name when a concept binds several", () => {
+    const bundle: OkfBundle = {
+      concepts: [concept({ binds: ["ghostOne", "ghostTwo"] })],
+    };
+    const diags = run(bundle, new Map());
+    expect(diags).toHaveLength(2);
+    expect(diags.map((d) => d.message).join("\n")).toContain("ghostOne");
+    expect(diags.map((d) => d.message).join("\n")).toContain("ghostTwo");
+  });
+
+  test("does not fire when the bound name resolves to a discovered entity", () => {
+    const bundle: OkfBundle = { concepts: [concept({ binds: ["realBucket"] })] };
+    const entities = new Map<string, Declarable>([["realBucket", entity()]]);
+    expect(run(bundle, entities)).toHaveLength(0);
+  });
+
+  test("does not fire for a concept with no binds at all — orphaned knowledge is legitimate", () => {
+    const bundle: OkfBundle = { concepts: [concept({ binds: [] })] };
+    expect(run(bundle, new Map())).toHaveLength(0);
+  });
+
+  test("does not fire for an empty bundle (no knowledge directory)", () => {
+    expect(run({ concepts: [] }, new Map())).toHaveLength(0);
+  });
+
+  test("build and synthesis are unaffected — severity is always warning, never error", () => {
+    const bundle: OkfBundle = { concepts: [concept({ binds: ["ghost"] })] };
+    const diags = run(bundle, new Map());
+    expect(diags.every((d) => d.severity === "warning")).toBe(true);
+  });
+});

package/src/lint/knowledge-checks.ts

@@ -0,0 +1,74 @@
+import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth";
+import type { OkfBundle } from "../okf-read";
+import { bindConcepts } from "../okf-read";
+
+/**
+ * COR026: Stale Knowledge Binding (#1865, design #1059, epic #1057)
+ *
+ * A concept's `binds` frontmatter key names a discovered entity's logical
+ * name (#1864, `../okf-read.ts`'s `bindConcepts`). A name that resolves to
+ * nothing is a stale binding — the entity was renamed or removed, or the
+ * concept was authored against a name that never existed — and per #1059's
+ * stated failure posture ("the spec permits broken links, which argues for
+ * warn") that is a warning, never a build failure: knowledge is deliberately
+ * softer than the typed graph it describes, and OKF itself tolerates broken
+ * links (epic #1057).
+ *
+ * The converse is deliberately silent: a concept with no `binds` at all is
+ * orphaned knowledge, not an omission (a runbook, a decision about the
+ * project as a whole), and `bindConcepts` never reports it as unresolved in
+ * the first place — see its own doc comment. A project with no knowledge
+ * bundle loads an empty one (`loadOkfBundle`), so this check produces no
+ * diagnostics either.
+ *
+ * Wired into `chant build` (`../cli/commands/build.ts`) alongside
+ * `coreReceiptChecks` — same reasons COR023/COR024 are build-owned rather
+ * than a per-file `LintRule`: the check needs the full discovered entity map
+ * (`ctx.entities`), not one `ts.SourceFile`, and that map only exists after
+ * discovery has run. Unlike COR023/024 it never reads `ctx.outputs` — the
+ * bundle is loaded once, up front (async — `loadOkfBundle` reads the
+ * filesystem), and closed over here so the check itself stays the same sync
+ * shape every other `PostSynthCheck` has.
+ */
+
+export const STALE_KNOWLEDGE_BINDING_CHECK_ID = "COR026";
+
+/**
+ * Build the COR026 check for one loaded bundle. A factory, not a bare
+ * constant, because — unlike `coreReceiptChecks`, which needs nothing but
+ * `ctx.entities` — this check needs the bundle loaded from disk, and
+ * `loadOkfBundle` is async while `PostSynthCheck#check` is not. The caller
+ * loads the bundle once (`resolveKnowledgeDir` + `loadOkfBundle`) and passes
+ * it in; see `../cli/commands/build.ts`.
+ */
+export function staleKnowledgeBindingCheck(bundle: OkfBundle): PostSynthCheck {
+  return {
+    id: STALE_KNOWLEDGE_BINDING_CHECK_ID,
+    description:
+      "A knowledge concept's `binds` entry must name a discovered entity — a name that resolves to nothing is a stale binding",
+    check(ctx) {
+      const { unresolved } = bindConcepts(bundle, ctx.entities);
+      return unresolved.map(
+        ({ concept, name }): PostSynthDiagnostic => ({
+          checkId: STALE_KNOWLEDGE_BINDING_CHECK_ID,
+          severity: "warning",
+          message:
+            `Knowledge concept "${concept.path}" binds "${name}", but no discovered entity has that name — ` +
+            `a stale binding. The entity may have been renamed or removed, or the concept was authored ` +
+            `against a name that never existed. Update the concept's \`binds\` frontmatter, or remove the ` +
+            `entry if the concept no longer applies.`,
+        }),
+      );
+    },
+  };
+}
+
+/**
+ * Core's own post-synth check over knowledge bindings, run by `chant build`
+ * over the full build result — unscoped, like `coreReceiptChecks`, since a
+ * concept's `binds` can name any discovered entity regardless of which
+ * lexicon owns it.
+ */
+export function coreKnowledgeChecks(bundle: OkfBundle): PostSynthCheck[] {
+  return [staleKnowledgeBindingCheck(bundle)];
+}

package/src/lint/output-checks.test.ts

@@ -0,0 +1,85 @@
+import { describe, test, expect } from "vitest";
+import { coreOutputChecks, STRINGIFIED_REFERENCE_CHECK_ID } from "./output-checks";
+import { runPostSynthChecks } from "./post-synth";
+import type { SerializerResult } from "../serializer";
+import type { Declarable } from "../declarable";
+
+function run(outputs: Map<string, string | SerializerResult>) {
+  return runPostSynthChecks(coreOutputChecks(), {
+    outputs,
+    entities: new Map<string, Declarable>(),
+    warnings: [],
+    errors: [],
+    sourceFileCount: 1,
+  });
+}
+
+describe("COR025: stringified reference in serialized output (#1526)", () => {
+  test("check id", () => {
+    expect(STRINGIFIED_REFERENCE_CHECK_ID).toBe("COR025");
+    expect(coreOutputChecks().map((c) => c.id)).toContain("COR025");
+  });
+
+  test("fires when a string output contains the [object Object] marker", () => {
+    const outputs = new Map<string, string | SerializerResult>([
+      ["aws", '{"Resource": "arn:aws:s3:::bucket-[object Object]/*"}'],
+    ]);
+    const diags = run(outputs);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("COR025");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].lexicon).toBe("aws");
+    expect(diags[0].message).toContain("[object Object]");
+  });
+
+  test("fires when a SerializerResult's primary content contains the marker", () => {
+    const outputs = new Map<string, string | SerializerResult>([
+      ["aws", { primary: 'Resource: "[object Object]/*"' } satisfies SerializerResult],
+    ]);
+    const diags = run(outputs);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('Resource: "[object Object]/*"');
+  });
+
+  test("fires when a SerializerResult's nested file contains the marker, and names the file", () => {
+    const outputs = new Map<string, string | SerializerResult>([
+      [
+        "aws",
+        {
+          primary: "clean template",
+          files: { "network.template.json": '{"Resource": "[object Object]"}' },
+        } satisfies SerializerResult,
+      ],
+    ]);
+    const diags = run(outputs);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("network.template.json");
+    expect(diags[0].message).toContain("[object Object]");
+  });
+
+  test("dedupes repeated occurrences of the same line within a file", () => {
+    const line = 'Resource: "[object Object]/*"';
+    const outputs = new Map<string, string | SerializerResult>([["aws", `${line}\n${line}\n${line}`]]);
+    const diags = run(outputs);
+    expect(diags).toHaveLength(1);
+  });
+
+  test("reports one diagnostic per distinct offending line", () => {
+    const outputs = new Map<string, string | SerializerResult>([
+      ["aws", 'Resource: "[object Object]/*"\nPolicy: "[object Object]"'],
+    ]);
+    const diags = run(outputs);
+    expect(diags).toHaveLength(2);
+  });
+
+  test("passes: output with no stringified reference", () => {
+    const outputs = new Map<string, string | SerializerResult>([
+      ["aws", '{"Resource": "arn:aws:s3:::my-bucket/*"}'],
+    ]);
+    expect(run(outputs)).toHaveLength(0);
+  });
+
+  test("passes: empty outputs", () => {
+    expect(run(new Map())).toHaveLength(0);
+  });
+});

package/src/lint/output-checks.ts

@@ -0,0 +1,99 @@
+import type { SerializerResult } from "../serializer";
+import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth";
+import { getPrimaryOutput } from "./post-synth";
+
+/**
+ * COR025: Stringified Reference in Serialized Output (#1526)
+ *
+ * kubemicrovm-ops composed a bucket policy's resource ARN with a template
+ * literal — `` `${bucket.Arn}/*` `` — over an `AttrRef`, not a string.
+ * JavaScript stringifies any non-primitive interpolated into a template
+ * literal via `Object.prototype.toString`, so the emitted policy carried the
+ * literal substring `"[object Object]/*"` in place of the resolved ARN. That
+ * built clean and linted clean — nothing upstream of serialization sees a
+ * type error, because `AttrRef` IS an object and a template literal accepts
+ * any coercible value — and it deployed clean on floci, which does no
+ * policy validation. It failed the first real deploy with S3 rejecting the
+ * policy's `Resource` and rolling back the stack.
+ *
+ * `[object Object]` (and its array-of-objects sibling `[object Object,object
+ * Object]`) never appears in a serialized template/manifest on purpose: no
+ * lexicon's serializer ever emits it, and no cloud provider's schema ever
+ * expects it as a literal value. Its presence is only ever a reference that
+ * got coerced to a string instead of resolved. That makes this check cheap,
+ * universal across lexicons (it scans the emitted text, not any one
+ * lexicon's schema), and free of false positives worth caring about — see
+ * `stringifiedReferenceCheck` below.
+ *
+ * Scans `ctx.outputs` (the SYNTHESIZED text) rather than `ctx.entities`
+ * because the coercion already happened in the user's own declaration code,
+ * upstream of anything chant's model retains structurally — by the time an
+ * entity reaches `ctx.entities` its prop is already a plain string containing
+ * the marker, indistinguishable from any other string prop. The only place
+ * left to catch it lexicon-independently is the text chant actually emits.
+ */
+
+const MARKER = "[object Object]";
+
+export const STRINGIFIED_REFERENCE_CHECK_ID = "COR025";
+
+/** Trim a matched line down to a readable snippet without truncating mid-marker. */
+const MAX_SNIPPET_LENGTH = 200;
+
+function lineContaining(text: string, index: number): string {
+  const lineStart = text.lastIndexOf("\n", index) + 1;
+  const nextNewline = text.indexOf("\n", index);
+  const lineEnd = nextNewline === -1 ? text.length : nextNewline;
+  const line = text.slice(lineStart, lineEnd).trim();
+  return line.length > MAX_SNIPPET_LENGTH ? `${line.slice(0, MAX_SNIPPET_LENGTH)}…` : line;
+}
+
+/** Every serialized file for one lexicon's output: the primary plus any nested files. */
+function serializedFiles(output: string | SerializerResult): Record<string, string> {
+  const files: Record<string, string> = { primary: getPrimaryOutput(output) };
+  if (typeof output !== "string" && output.files) {
+    Object.assign(files, output.files);
+  }
+  return files;
+}
+
+const stringifiedReferenceCheck: PostSynthCheck = {
+  id: STRINGIFIED_REFERENCE_CHECK_ID,
+  description:
+    'A serialized output contains the literal substring "[object Object]" — a reference that was ' +
+    "stringified (e.g. through a template literal or string concatenation) instead of resolved. " +
+    "Always an authoring error, never intentional output.",
+  check(ctx) {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    for (const [lexicon, output] of ctx.outputs) {
+      for (const [fileLabel, content] of Object.entries(serializedFiles(output))) {
+        const seenLines = new Set<string>();
+        let index = content.indexOf(MARKER);
+        while (index !== -1) {
+          const line = lineContaining(content, index);
+          const dedupeKey = `${fileLabel}::${line}`;
+          if (!seenLines.has(dedupeKey)) {
+            seenLines.add(dedupeKey);
+            const location = fileLabel === "primary" ? "" : ` (${fileLabel})`;
+            diagnostics.push({
+              checkId: STRINGIFIED_REFERENCE_CHECK_ID,
+              severity: "error",
+              lexicon,
+              message:
+                `Serialized output${location} contains "${MARKER}" — a reference was stringified ` +
+                `instead of resolved (a template literal or string concatenation over an object, ` +
+                `not the raw value/ref). Emitted line: ${line}`,
+            });
+          }
+          index = content.indexOf(MARKER, index + MARKER.length);
+        }
+      }
+    }
+    return diagnostics;
+  },
+};
+
+/** Core-owned post-synth checks over serialized output text (#1526). */
+export function coreOutputChecks(): PostSynthCheck[] {
+  return [stringifiedReferenceCheck];
+}