@intentius/chant 0.51.0 → 0.52.1

package/src/lint/policy.ts

@@ -7,6 +7,8 @@ import { resolve, dirname } from "node:path";
 import { loadChantConfigUpward, resolveOwnershipEnv, resolveOwnershipMarker } from "../config";
 import { resolveBuildParams } from "../build-params";
 import { resolveProjectLexicons, loadPlugins } from "../cli/plugins";
+import { resolveBuildModes, resolveProjectBuildOptions } from "../cli/build-options";
+import { formatWarning } from "../cli/format";
 import { build } from "../build";
 import { runPostSynthChecks, isPostSynthCheck } from "./post-synth";
 import type { PostSynthCheck, PostSynthDiagnostic } from "./post-synth";
@@ -63,6 +65,15 @@ export interface PolicyEvaluation {
    * of the finding just vanishing.
    */
   suppressed: PostSynthDiagnostic[];
+  /**
+   * chant #2002 — divergences between this evaluation and what `chant build`
+   * would do, named rather than left silent. Today that is a project whose
+   * resolved `build.sandbox` is `true`: the gate builds unsandboxed, because
+   * running it inside the boundary needs the per-execution arming decision
+   * tracked on #1157. Also written to stderr — the gate's caller is an
+   * activity wrapper that surfaces output, not a structured result.
+   */
+  warnings: string[];
 }
 
 /**
@@ -70,6 +81,13 @@ export interface PolicyEvaluation {
  * standalone — used by the `policyGate` Op step to gate an apply on the same
  * organizational policy `chant build` enforces. Loads the project's lexicons,
  * builds, then runs the policy pack with `env` (explicit, else `ownership.env`).
+ *
+ * chant #2002 — "the same organizational policy `chant build` enforces" only
+ * holds if it is the same build. The build options are assembled by
+ * `../cli/build-options.ts`'s `resolveProjectBuildOptions`, the single function
+ * `chant build` also calls, rather than by a second list here; a build option
+ * added for one caller and not the other is what let a gate pass a build
+ * `chant build` fails.
  */
 export async function evaluateProjectPolicies(opts: {
   path: string;
@@ -96,10 +114,37 @@ export async function evaluateProjectPolicies(opts: {
   }
   const env = opts.env ?? resolveOwnershipEnv(config, params.provenance);
 
-  const result = await build(buildPath, serializers, undefined, {
-    ownership: resolveOwnershipMarker(config, params.provenance),
-    buildParams: params.provenance,
-  });
+  // chant #2002 — the build options come from the shared assembler
+  // (`../cli/build-options.ts`), the same one `chant build` uses, so the gate
+  // decides on the project `chant build` produces: folded by default (#1134),
+  // with the project's config reaching the serializers, and with
+  // config-declared build roots contributing their entities. Assembling a
+  // second, shorter list here is what let the two drift apart.
+  const modes = resolveBuildModes(config);
+  const warnings: string[] = [];
+  if (modes.sandbox) {
+    // Resolved, reported, and not yet honoured. Building inside the boundary
+    // needs per-execution arming (#1157) — until that lands, saying so is the
+    // difference between a known gap and a silent one.
+    warnings.push(
+      `build.sandbox is enabled for this project, but the policy gate builds it in this process — the project's source files and its lint.policies modules execute here, unsandboxed (chant #1157). Run \`chant build --sandbox\` for a sandboxed build of the same project.`,
+    );
+  }
+  for (const warning of warnings) console.error(formatWarning({ message: warning }));
+
+  const result = await build(
+    buildPath,
+    serializers,
+    undefined,
+    resolveProjectBuildOptions({
+      config,
+      configDir,
+      plugins,
+      modes: { fold: modes.fold, sandbox: false },
+      ownership: resolveOwnershipMarker(config, params.provenance),
+      buildParams: params.provenance,
+    }),
+  );
   if (result.errors.length > 0) {
     throw new Error("Build failed — cannot evaluate policy on a broken build");
   }
@@ -108,7 +153,7 @@ export async function evaluateProjectPolicies(opts: {
     ? await loadPolicyChecks(config.lint.policies, configDir)
     : [];
   if (checks.length === 0) {
-    return { diagnostics: [], violations: [], env, suppressed: [] };
+    return { diagnostics: [], violations: [], env, suppressed: [], warnings };
   }
 
   const raw = runPostSynthChecks(checks, result, env);
@@ -118,5 +163,5 @@ export async function evaluateProjectPolicies(opts: {
   // fails on it either, and vice versa for a check turned UP to "error".
   const { diagnostics, suppressed } = applyConfiguredSeverity(raw, config.lint?.rules);
   const violations = diagnostics.filter((d) => d.severity === "error");
-  return { diagnostics, violations, env, suppressed };
+  return { diagnostics, violations, env, suppressed, warnings };
 }

package/src/op/local-executor.ts

@@ -136,6 +136,34 @@ export function findGate(config: OpConfig): GateStep | undefined {
   return undefined;
 }
 
+/**
+ * Find the first `policyGate` step anywhere in the Op (phases + `onFailure`,
+ * including steps nested inside effect steps), if any.
+ *
+ * chant #2003 — `--sandbox` is a GLOBAL flag (`../cli/registry.ts`), and
+ * `../cli/main.ts` arms the process-wide policy latch off it for every command,
+ * `chant run` included. A `policyGate` step then reaches `loadPolicyChecks`,
+ * which refuses while armed with a message written for a chant maintainer —
+ * shown to a user who passed a documented flag. The combination cannot be
+ * honoured until the gate can build and load policies inside the boundary
+ * (#1157), so both `chant run` paths pre-flight it with this and refuse before
+ * any phase executes, the same shape as {@link findGate}'s pre-flight.
+ */
+export function findPolicyGateStep(config: OpConfig): ActivityStep | undefined {
+  const all = [...config.phases, ...(config.onFailure ?? [])];
+  const isPolicyGate = (s: StepDefinition): s is ActivityStep => isActivity(s) && s.fn === "policyGate";
+  for (const phase of all) {
+    for (const step of phase.steps) {
+      if (isPolicyGate(step)) return step;
+      if (isEffect(step)) {
+        const nested = step.steps.find(isPolicyGate);
+        if (nested) return nested;
+      }
+    }
+  }
+  return undefined;
+}
+
 const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms));
 
 /**

package/src/ownership.ts

@@ -133,10 +133,11 @@ export function readOwnership(
  * A read path that can resolve an ownership verdict from the marker (#1348).
  *
  * Per-path rather than per-lexicon because the answer genuinely differs by
- * path: aws stamps tags at synthesis and reads them on the deep observation and
- * on live export, but `describeResources` is sourced from
- * `describe-stack-resources`, which returns no tags at all — so an `owned: true`
- * thin read against aws can only answer `unknown`.
+ * path — in granularity as much as in availability. aws stamps tags at
+ * synthesis and reads them per resource on the deep observation and on live
+ * export; its `describeResources` is sourced from `describe-stack-resources`,
+ * which returns no per-resource tags, so it resolves the verdict from the
+ * STACK's own tags instead (#1998).
  */
 export type OwnershipReadPath = "describeResources" | "observeResourcesDeep" | "exportResources";