@intentius/chant 0.46.0 → 0.50.0

package/src/lint/rules/cor022-receipt-leaf.test.ts

@@ -0,0 +1,116 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import { cor022ReceiptLeafRule, collectReceiptVariables } from "./cor022-receipt-leaf";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("COR022: effect receipt is a leaf (#1833)", () => {
+  test("rule metadata", () => {
+    expect(cor022ReceiptLeafRule.id).toBe("COR022");
+    expect(cor022ReceiptLeafRule.severity).toBe("error");
+    expect(cor022ReceiptLeafRule.category).toBe("correctness");
+  });
+
+  test("flags a property access on a receipt inside another declarable", () => {
+    const ctx = createContext(`
+      export const seeded = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const app = new Service({ marker: seeded.effect });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("COR022");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain('"seeded" is an effect receipt');
+    expect(diags[0].message).toContain('"effect"');
+    expect(diags[0].message).toContain("sole writer");
+  });
+
+  test("const indirection fires: const r = EffectReceipt(...); other.prop = r.something", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("migrated", { effect: "schema-migrate", flavor: "hash" });
+      export const other = new Store({});
+      other.prop = r.something;
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"r" is an effect receipt');
+    expect(diags[0].message).toContain('"something"');
+  });
+
+  test("an alias of a receipt is still the receipt", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("migrated", { effect: "schema-migrate", flavor: "existence" });
+      const alias = r;
+      export const svc = new Service({ tag: alias.name });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"alias"');
+  });
+
+  test("element access fires like property access", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const svc = new Service({ tag: r["effect"] });
+    `);
+    const diags = cor022ReceiptLeafRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('"effect"');
+  });
+
+  test("namespaced factory call is recognized", () => {
+    const ctx = createContext(`
+      const r = chant.EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      export const svc = new Service({ tag: r.effect });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("passes: a receipt that nothing dereferences", () => {
+    const ctx = createContext(`
+      import { EffectReceipt } from "@intentius/chant";
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { schema: "v3" },
+      });
+      export const app = new Service({ image: "app:1" });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: referencing the receipt value itself (no attribute access)", () => {
+    const ctx = createContext(`
+      const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+      registerReceipt(r);
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: property access on a non-receipt declarable", () => {
+    const ctx = createContext(`
+      export const db = new Database({ name: "main" });
+      export const app = new Service({ endpoint: db.endpoint });
+    `);
+    expect(cor022ReceiptLeafRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("collectReceiptVariables resolves aliases declared before the receipt", () => {
+    const sf = ts.createSourceFile(
+      "t.ts",
+      `
+      const early = late;
+      const late = EffectReceipt("r", { effect: "e", flavor: "existence" });
+      `,
+      ts.ScriptTarget.Latest,
+      true,
+    );
+    const vars = collectReceiptVariables(sf);
+    expect(vars.has("late")).toBe(true);
+    expect(vars.has("early")).toBe(true);
+  });
+});

package/src/lint/rules/cor022-receipt-leaf.ts

@@ -0,0 +1,130 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+
+/**
+ * COR022: Effect Receipt Is a Leaf (#1833, epic #1703)
+ *
+ * Nothing may reference an effect receipt's attributes. A receipt is the
+ * declared witness that an out-of-band effect ran — the `effect()` step
+ * (#1834) is its sole writer, on success, last (../../effect-receipt.ts).
+ * Any resource that derives a property from a receipt couples itself to a
+ * value only the effect controls: the coupling is invisible at synthesis,
+ * and the receipt's late write (or its absence after a crash) would ripple
+ * into resources that were supposed to be independent of whether the effect
+ * has fired yet.
+ *
+ * The rule walks the file's reference graph the way COR011 does: it collects
+ * every variable initialized from an `EffectReceipt(...)` call (aliases
+ * included — `const alias = receipt` is still the receipt), then flags every
+ * property or element access rooted at one of them. Const indirection fires:
+ *
+ *   const r = EffectReceipt("seeded", { effect: "db-seed", flavor: "existence" });
+ *   other.prop = r.something;   // COR022
+ *
+ * Referencing the receipt VALUE (passing `r` itself around) is not flagged —
+ * the leaf constraint is about attributes, and lexicon materialization rows
+ * legitimately take the whole declaration.
+ *
+ * Core recognizes the factory call by name; a lexicon-materialized receipt
+ * row (#1835) is recognized at build time by its marker instead — this rule
+ * is the source-level half.
+ */
+
+/** Simple callee name of a call: `EffectReceipt(...)` or `chant.EffectReceipt(...)`. */
+function calleeName(expr: ts.CallExpression): string | undefined {
+  if (ts.isIdentifier(expr.expression)) return expr.expression.text;
+  if (ts.isPropertyAccessExpression(expr.expression)) return expr.expression.name.text;
+  return undefined;
+}
+
+/** A variable declaration's `EffectReceipt(...)` initializer, if that is what it is. */
+export function receiptFactoryCall(decl: ts.VariableDeclaration): ts.CallExpression | undefined {
+  if (!decl.initializer || !ts.isCallExpression(decl.initializer)) return undefined;
+  return calleeName(decl.initializer) === "EffectReceipt" ? decl.initializer : undefined;
+}
+
+/**
+ * Every variable name bound to an effect receipt in this file: direct
+ * `EffectReceipt(...)` initializers plus identifier aliases, resolved to a
+ * fixpoint so declaration order does not matter. Scope-naive by design, the
+ * same trade COR011 makes — a chant source file is flat declarations.
+ */
+export function collectReceiptVariables(sourceFile: ts.SourceFile): Set<string> {
+  const receipts = new Set<string>();
+  const aliases: Array<[string, string]> = [];
+
+  function visit(node: ts.Node): void {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+      if (receiptFactoryCall(node)) {
+        receipts.add(node.name.text);
+      } else if (ts.isIdentifier(node.initializer)) {
+        aliases.push([node.name.text, node.initializer.text]);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const [name, source] of aliases) {
+      if (receipts.has(source) && !receipts.has(name)) {
+        receipts.add(name);
+        grew = true;
+      }
+    }
+  }
+  return receipts;
+}
+
+/** The accessed attribute's name, for the message: `r.something` → "something". */
+function accessedAttribute(node: ts.PropertyAccessExpression | ts.ElementAccessExpression): string {
+  if (ts.isPropertyAccessExpression(node)) return node.name.text;
+  const arg = node.argumentExpression;
+  return ts.isStringLiteralLike(arg) ? arg.text : "<computed>";
+}
+
+export const cor022ReceiptLeafRule: LintRule = {
+  id: "COR022",
+  severity: "error",
+  category: "correctness",
+  description:
+    "An effect receipt is a leaf — nothing may reference its attributes; the effect() step is the receipt's sole writer",
+  check(context: LintContext): LintDiagnostic[] {
+    const receipts = collectReceiptVariables(context.sourceFile);
+    if (receipts.size === 0) return [];
+
+    const diagnostics: LintDiagnostic[] = [];
+
+    function visit(node: ts.Node): void {
+      if (
+        (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) &&
+        ts.isIdentifier(node.expression) &&
+        receipts.has(node.expression.text)
+      ) {
+        const receipt = node.expression.text;
+        const attribute = accessedAttribute(node);
+        const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+          node.getStart(context.sourceFile),
+        );
+        diagnostics.push({
+          file: context.filePath,
+          line: line + 1,
+          column: character + 1,
+          ruleId: "COR022",
+          severity: "error",
+          message:
+            `"${receipt}" is an effect receipt — a receipt is a leaf, and nothing may reference its ` +
+            `attributes ("${attribute}" here). The effect() step is the receipt's sole writer, so a ` +
+            `property derived from it couples this resource to a value only the effect controls. ` +
+            `Reference the effect's inputs (or the resources they come from) directly instead.`,
+        });
+      }
+      ts.forEachChild(node, visit);
+    }
+    visit(context.sourceFile);
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/cor024-receipt-secret-pointer.test.ts

@@ -0,0 +1,121 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer";
+import type { LintContext } from "../rule";
+
+function createContext(code: string, filePath = "test.ts"): LintContext {
+  const sourceFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath, lexicon: undefined };
+}
+
+describe("COR024: receipt inputs reference secrets by pointer (#1833)", () => {
+  test("rule metadata", () => {
+    expect(cor024ReceiptSecretPointerRule.id).toBe("COR024");
+    expect(cor024ReceiptSecretPointerRule.severity).toBe("error");
+    expect(cor024ReceiptSecretPointerRule.category).toBe("correctness");
+  });
+
+  test("flags a receipt input reading a Secret entity's data attribute", () => {
+    const ctx = createContext(`
+      export const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { password: dbSecret.data.password },
+      });
+    `);
+    const diags = cor024ReceiptSecretPointerRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].ruleId).toBe("COR024");
+    expect(diags[0].severity).toBe("error");
+    expect(diags[0].message).toContain("dbSecret.data.password");
+    expect(diags[0].message).toContain("name+version pointer");
+    expect(diags[0].message).toContain("secretVersion");
+  });
+
+  test("flags a .value read on a Secret entity", () => {
+    const ctx = createContext(`
+      const apiToken = new ExternalSecret({ name: "api-token" });
+      export const bootstrapped = EffectReceipt("bootstrapped", {
+        effect: "bootstrap",
+        flavor: "hash",
+        inputs: { token: apiToken.value },
+      });
+    `);
+    const diags = cor024ReceiptSecretPointerRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("apiToken.value");
+  });
+
+  test("const indirection fires: material extracted into a variable first", () => {
+    const ctx = createContext(`
+      const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      const material = dbSecret.data;
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { password: material.password },
+      });
+    `);
+    const diags = cor024ReceiptSecretPointerRule.check(ctx);
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("material");
+  });
+
+  test("bare material variable as an input fires", () => {
+    const ctx = createContext(`
+      const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      const material = dbSecret.stringData;
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { blob: material },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(1);
+  });
+
+  test("passes: the name+version pointer form", () => {
+    const ctx = createContext(`
+      export const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { secretName: dbSecret.name, secretVersion: 3 },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: non-secret entity attributes and static inputs", () => {
+    const ctx = createContext(`
+      export const db = new Database({ name: "main" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { endpoint: db.endpoint, schema: "v3", value: db.port },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes: secret material read OUTSIDE a receipt's inputs is not this rule's concern", () => {
+    const ctx = createContext(`
+      const dbSecret = new SecretManagerSecret({ name: "db-password" });
+      export const app = new Service({ env: { DB_PASSWORD: dbSecret.data.password } });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(0);
+  });
+
+  test("declareSecret provenance declarations are secret-rooted", () => {
+    const ctx = createContext(`
+      const dbSecret = declareSecret("db-password", { provenance: "referenced" });
+      export const seeded = EffectReceipt("seeded", {
+        effect: "db-seed",
+        flavor: "hash",
+        inputs: { v: dbSecret.value },
+      });
+    `);
+    expect(cor024ReceiptSecretPointerRule.check(ctx)).toHaveLength(1);
+  });
+});

package/src/lint/rules/cor024-receipt-secret-pointer.ts

@@ -0,0 +1,218 @@
+import * as ts from "typescript";
+import type { LintRule, LintContext, LintDiagnostic } from "../rule";
+import { receiptFactoryCall } from "./cor022-receipt-leaf";
+
+/**
+ * COR024: Receipt Inputs Reference Secrets by Pointer (#1833, epic #1703;
+ * composes with the secret-provenance work, #1365/#1828)
+ *
+ * A receipt's `inputs` feed its expectation hash (../../effect-receipt.ts) —
+ * whatever lands there is canonicalized, digested, and compared against a
+ * stored value for the rest of the receipt's life. chant's constitutional
+ * line on secrets is that no code path may hold, log, hash, or compare a
+ * secret value (../../secret-provenance.ts), so a receipt input that reads a
+ * Secret-kind entity's material (`.data`, `.value`, `.stringData`, ...)
+ * violates it twice over: the material enters the hash, and the serialized
+ * placeholder ties the receipt to the secret's value rather than its
+ * identity.
+ *
+ * The pointer form is fine — and is the point: reference the secret by name
+ * and version (`{ secretName: dbSecret.name, secretVersion: 3 }`), so a
+ * rotation is an explicit version bump that re-proposes the effect, and the
+ * hash only ever sees the pointer.
+ *
+ * Recognition is the same file-local reference walk COR022 uses (const
+ * indirection included): a variable is Secret-kind when its initializer is a
+ * constructor or factory whose name says so (`new SecretManagerSecret(...)`,
+ * `new ExternalSecret(...)`, `declareSecret(...)`); an input fires when a
+ * property chain rooted at one of those crosses a material field.
+ */
+
+/** Fields that carry secret material. Mirrors secret-provenance.ts's
+ * FORBIDDEN_MATERIAL_FIELDS, plus the provider-attribute spellings
+ * (`secretString`/`secretValue`) a materialized secret exposes. */
+const MATERIAL_FIELDS = new Set([
+  "value",
+  "data",
+  "stringdata",
+  "material",
+  "plaintext",
+  "ciphertext",
+  "secretstring",
+  "secretvalue",
+]);
+
+function isMaterialField(name: string): boolean {
+  return MATERIAL_FIELDS.has(name.toLowerCase());
+}
+
+/** Simple name of a `new X(...)` / `X(...)` / `ns.X(...)` initializer. */
+function initializerName(init: ts.Expression): string | undefined {
+  if (!ts.isNewExpression(init) && !ts.isCallExpression(init)) return undefined;
+  const callee = init.expression;
+  if (ts.isIdentifier(callee)) return callee.text;
+  if (ts.isPropertyAccessExpression(callee)) return callee.name.text;
+  return undefined;
+}
+
+/** Does this constructor/factory name declare a Secret-kind entity? */
+function isSecretKindName(name: string): boolean {
+  return /secret/i.test(name) || name === "declareSecret";
+}
+
+/** One access chain: `sec.data.password` → root "sec", segments ["data","password"]. */
+function decomposeChain(
+  node: ts.Expression,
+): { root: string; segments: string[] } | undefined {
+  const segments: string[] = [];
+  let current: ts.Expression = node;
+  while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+    if (ts.isPropertyAccessExpression(current)) {
+      segments.unshift(current.name.text);
+    } else {
+      const arg = current.argumentExpression;
+      segments.unshift(ts.isStringLiteralLike(arg) ? arg.text : "<computed>");
+    }
+    current = current.expression;
+  }
+  if (!ts.isIdentifier(current)) return undefined;
+  return { root: current.text, segments };
+}
+
+interface SecretVars {
+  /** Variables holding a Secret-kind entity (or an alias of one). */
+  secretRooted: Set<string>;
+  /** Variables that already crossed a material field (`const m = sec.data`). */
+  material: Set<string>;
+}
+
+/** File-local Secret-kind variables, aliases and material extractions, to a fixpoint. */
+function collectSecretVariables(sourceFile: ts.SourceFile): SecretVars {
+  const secretRooted = new Set<string>();
+  const material = new Set<string>();
+  const derived: Array<{ name: string; root: string; crossesMaterial: boolean; isBareAlias: boolean }> = [];
+
+  function visit(node: ts.Node): void {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+      const init = node.initializer;
+      const ctorName = initializerName(init);
+      if (ctorName !== undefined && isSecretKindName(ctorName)) {
+        secretRooted.add(node.name.text);
+      } else if (ts.isIdentifier(init)) {
+        derived.push({ name: node.name.text, root: init.text, crossesMaterial: false, isBareAlias: true });
+      } else if (ts.isPropertyAccessExpression(init) || ts.isElementAccessExpression(init)) {
+        const chain = decomposeChain(init);
+        if (chain) {
+          derived.push({
+            name: node.name.text,
+            root: chain.root,
+            crossesMaterial: chain.segments.some(isMaterialField),
+            isBareAlias: false,
+          });
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const d of derived) {
+      const rootIsSecret = secretRooted.has(d.root);
+      const rootIsMaterial = material.has(d.root);
+      if (!rootIsSecret && !rootIsMaterial) continue;
+      const target = rootIsMaterial || d.crossesMaterial ? material : secretRooted;
+      if (d.isBareAlias && !d.crossesMaterial && rootIsSecret) {
+        if (!secretRooted.has(d.name)) {
+          secretRooted.add(d.name);
+          grew = true;
+        }
+      } else if (!target.has(d.name)) {
+        target.add(d.name);
+        grew = true;
+      }
+    }
+  }
+  return { secretRooted, material };
+}
+
+export const cor024ReceiptSecretPointerRule: LintRule = {
+  id: "COR024",
+  severity: "error",
+  category: "correctness",
+  description:
+    "A receipt's inputs may reference a secret only by name+version pointer, never by value — secret material must not enter the expectation hash",
+  check(context: LintContext): LintDiagnostic[] {
+    const diagnostics: LintDiagnostic[] = [];
+    const secrets = collectSecretVariables(context.sourceFile);
+    if (secrets.secretRooted.size === 0 && secrets.material.size === 0) return diagnostics;
+
+    const report = (node: ts.Node, rendered: string, root: string): void => {
+      const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(
+        node.getStart(context.sourceFile),
+      );
+      diagnostics.push({
+        file: context.filePath,
+        line: line + 1,
+        column: character + 1,
+        ruleId: "COR024",
+        severity: "error",
+        message:
+          `Receipt input reads secret material (${rendered}) from "${root}" — a receipt's inputs may ` +
+          `reference a secret only by name+version pointer, never by value: the inputs are hashed into ` +
+          `the receipt's expectation, and no chant code path may hash or compare secret material. ` +
+          `Use the pointer form instead, e.g. { secretName: ${root}.name, secretVersion: 3 } — ` +
+          `a rotation then re-proposes the effect through an explicit version bump.`,
+      });
+    };
+
+    const checkInputs = (inputs: ts.Expression): void => {
+      const visit = (node: ts.Node): void => {
+        if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
+          const chain = decomposeChain(node);
+          if (chain) {
+            const rootMaterial = secrets.material.has(chain.root);
+            const crossesMaterial = chain.segments.some(isMaterialField);
+            if (rootMaterial || (secrets.secretRooted.has(chain.root) && crossesMaterial)) {
+              report(node, `\`${chain.root}.${chain.segments.join(".")}\``, chain.root);
+              return; // one diagnostic per chain, not one per link
+            }
+          }
+        } else if (ts.isIdentifier(node) && secrets.material.has(node.text)) {
+          const parent = node.parent;
+          const isChainBase =
+            (ts.isPropertyAccessExpression(parent) || ts.isElementAccessExpression(parent)) &&
+            parent.expression === node;
+          const isKey = ts.isPropertyAssignment(parent) && parent.name === node;
+          if (!isChainBase && !isKey) report(node, `\`${node.text}\``, node.text);
+        }
+        ts.forEachChild(node, visit);
+      };
+      visit(inputs);
+    };
+
+    const walk = (node: ts.Node): void => {
+      if (ts.isVariableDeclaration(node)) {
+        const call = receiptFactoryCall(node);
+        const options = call?.arguments[1];
+        if (options && ts.isObjectLiteralExpression(options)) {
+          for (const prop of options.properties) {
+            if (
+              ts.isPropertyAssignment(prop) &&
+              (ts.isIdentifier(prop.name) || ts.isStringLiteral(prop.name)) &&
+              prop.name.text === "inputs"
+            ) {
+              checkInputs(prop.initializer);
+            }
+          }
+        }
+      }
+      ts.forEachChild(node, walk);
+    };
+    walk(context.sourceFile);
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/evl001-non-literal-expression.test.ts

@@ -90,11 +90,16 @@ describe("EVL001: non-literal-expression", () => {
     expect(diags[0].message).toContain("statically evaluable");
   });
 
-  test("flags method call", () => {
+  // chant #1966 — `fold()` widened to fold a method call when its receiver
+  // resolves (`github.actor.toString()`, `[...].join(",")`); `findSubsetViolation`
+  // (./subset.ts) accepts the SHAPE unconditionally, the same way it already
+  // does for `.step` and a nested `new` — whether the receiver actually
+  // resolves is resolution-dependent and out of reach here, so a method call
+  // no longer trips this rule on shape alone.
+  test("does not flag a method call — resolution-dependent, out of scope for a syntax-only rule (chant #1966)", () => {
     const ctx = createContext(`new Bucket({ name: config.getName() });`);
     const diags = evl001NonLiteralExpressionRule.check(ctx);
-    expect(diags).toHaveLength(1);
-    expect(diags[0].ruleId).toBe("EVL001");
+    expect(diags).toHaveLength(0);
   });
 
   test("flags await expression", () => {
@@ -104,6 +109,33 @@ describe("EVL001: non-literal-expression", () => {
     expect(diags[0].ruleId).toBe("EVL001");
   });
 
+  // chant #1544 — the single-action Composite() wrapper idiom
+  // (`Checkout({...}).step`) every lexicon's own docs/examples embed inline
+  // inside a `Job`'s `steps:` array must not trip EVL001.
+  test("allows a composite call's .step access embedded in an array", () => {
+    const ctx = createContext(`new Job({ "runs-on": "ubuntu-latest", steps: [Checkout({}).step] });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("allows a composite call's .step access as a direct property value", () => {
+    const ctx = createContext(`new Job({ step: Checkout({ ref: "main" }).step });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(0);
+  });
+
+  test("still flags a call accessing a non-.step property", () => {
+    const ctx = createContext(`new Job({ steps: [Checkout({}).output] });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(1);
+  });
+
+  test("still flags a bare call (no trailing .step access)", () => {
+    const ctx = createContext(`new Bucket({ name: getName() });`);
+    const diags = evl001NonLiteralExpressionRule.check(ctx);
+    expect(diags).toHaveLength(1);
+  });
+
   test("flags multiple violations", () => {
     const ctx = createContext(`new Bucket({ a: foo(), b: bar() });`);
     const diags = evl001NonLiteralExpressionRule.check(ctx);

package/src/lint/rules/evl001-non-literal-expression.ts

@@ -31,6 +31,13 @@ function checkNode(node: ts.Node, context: LintContext, diagnostics: LintDiagnos
       const firstArg = node.arguments[0];
       if (ts.isObjectLiteralExpression(firstArg)) {
         for (const prop of firstArg.properties) {
+          // `Checkout({...}).step` — the single-action Composite()-wrapper
+          // idiom every lexicon's own docs/examples embed inline inside a
+          // Job's `steps:` array — is shape-valid unconditionally (chant
+          // #1544 introduced this as an EVL-only opt-in while `fold()`
+          // still rejected the shape; chant #1174 closed that divergence by
+          // making `fold()` accept it too, so `findSubsetViolation` no
+          // longer needs a flag to say so).
           const violation = checkObjectMember(prop, context.intrinsics);
           if (violation) {
             const { line, character } = context.sourceFile.getLineAndCharacterOfPosition(

package/src/lint/rules/index.ts

@@ -26,6 +26,8 @@ export { evl010CompositeNoTransformRule } from "./evl010-composite-no-transform"
 export { cor017CompositeNameMatchRule } from "./cor017-composite-name-match";
 export { cor018CompositePreferLexiconTypeRule } from "./cor018-composite-prefer-lexicon-type";
 export { cor021EnvLiteralNameRule } from "./cor021-env-literal-name";
+export { cor022ReceiptLeafRule, collectReceiptVariables, receiptFactoryCall } from "./cor022-receipt-leaf";
+export { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer";
 export { isInsideCompositeFactory } from "./composite-scope";
 
 import { flatDeclarationsRule } from "./flat-declarations";
@@ -50,9 +52,11 @@ import { evl010CompositeNoTransformRule } from "./evl010-composite-no-transform"
 import { cor017CompositeNameMatchRule } from "./cor017-composite-name-match";
 import { cor018CompositePreferLexiconTypeRule } from "./cor018-composite-prefer-lexicon-type";
 import { cor021EnvLiteralNameRule } from "./cor021-env-literal-name";
+import { cor022ReceiptLeafRule } from "./cor022-receipt-leaf";
+import { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer";
 
 /**
- * Load all 22 core lint rules (COR + EVL).
+ * Load all 24 core lint rules (COR + EVL).
  */
 export function loadCoreRules(): LintRule[] {
   return [
@@ -78,5 +82,7 @@ export function loadCoreRules(): LintRule[] {
     cor017CompositeNameMatchRule,
     cor018CompositePreferLexiconTypeRule,
     cor021EnvLiteralNameRule,
+    cor022ReceiptLeafRule,
+    cor024ReceiptSecretPointerRule,
   ];
 }