@intentius/chant 0.56.0 → 0.58.0

package/src/cli/commands/audit.ts

@@ -7,12 +7,13 @@
 
 import { existsSync, readFileSync, statSync, writeFileSync } from "fs";
 import { join } from "path";
-import { auditFiles, type AuditInput, type AuditFinding, type ChecksProvider } from "../../audit/core";
+import { auditFiles, type AuditInput, type AuditFinding, type ChecksProvider, type SuppressionStats } from "../../audit/core";
 import { AUDIT_LEXICONS, classifyFiles, collectCandidates, loadAuditPlugins, unclaimedFiles, type DetectPlugin, type RepoFile, type UnclaimedFile } from "../../audit/discover";
 import { RULE_CATALOG, resolveAuditCatalog, type RuleMeta } from "../../audit/catalog";
 import { scanForSecrets, parseSecretsConfig, type SecretsScanOptions } from "../../audit/secrets";
 import { auditWranglerConfigs } from "../../audit/wrangler";
 import { auditNginxConfigs } from "../../audit/nginx";
+import { auditTerraformState } from "../../audit/terraform-state";
 import { renderMarkdown } from "../../audit/report";
 import { renderHtml, type ReportTheme } from "../../audit/report-html";
 import { buildReportJson, REPORT_SCHEMA_VERSION, type AuditSnapshot } from "../../audit/report-model";
@@ -23,7 +24,17 @@ import type { Severity } from "../../lint/rule";
 
 export type AuditFormat = "stylish" | "json" | "sarif" | "markdown" | "html";
 export type AuditTier = "merge-worthy" | "all";
-export type AuditFailOn = "merge-worthy" | "warning" | "none";
+/**
+ * `"error"` (chant #2113) is the minimum-failure-severity floor tflint's
+ * `--minimum-failure-severity` maps onto (`error | warning | notice`): unlike
+ * `"merge-worthy"`/`"warning"` above (which key off a rule's catalog `tier`
+ * or a finding's severity being at-or-above warning), `"error"` fails only on
+ * an `error`-severity finding, decoupling what CI fails a build over from
+ * what a rule ships reporting by default. It's the lever that lets a new
+ * rule ship at `warning` and be promoted to `error` later without a pipeline
+ * pinned to `--fail-on error` breaking the moment the rule starts firing.
+ */
+export type AuditFailOn = "merge-worthy" | "warning" | "error" | "none";
 
 export interface AuditCommandOptions {
   /** Repo root/dir to scan, or an https:// repo URL to fetch and audit. */
@@ -79,6 +90,12 @@ export interface AuditCommandResult {
   unclaimed?: UnclaimedFile[];
   /** Where `output` belongs; diagnostics go to stderr, reports to stdout (default). */
   stream?: "stdout" | "stderr";
+  /**
+   * Findings an inline `# chant-ignore*` comment suppressed (chant #2111),
+   * counted, never dropped silently, mirroring `chant build`'s equivalent
+   * summary line.
+   */
+  suppressedCount?: number;
 }
 
 /** Exit code when the audit had no lexicons to look with. Distinct from 1 (findings / failure). */
@@ -89,9 +106,9 @@ function lexiconPackage(name: string): string {
   return `@intentius/chant-lexicon-${name}`;
 }
 
-/** Missing audit lexicons the unclaimed files pointed at, in first-seen order. `terraform` is not installable. */
+/** Missing audit lexicons the unclaimed files pointed at, in first-seen order. */
 function wantedLexicons(unclaimed: UnclaimedFile[]): string[] {
-  return [...new Set(unclaimed.map((u) => u.lexicon))].filter((l) => l !== "terraform");
+  return [...new Set(unclaimed.map((u) => u.lexicon))];
 }
 
 /**
@@ -107,17 +124,10 @@ export function installLine(lexicons: string[], target: string): string {
 /** One-line coverage hint for the partial case: some lexicons loaded, others wanted by files on disk. */
 function missingLexiconHint(unclaimed: UnclaimedFile[]): string | undefined {
   const wanted = wantedLexicons(unclaimed);
-  const tf = unclaimed.filter((u) => u.lexicon === "terraform").length;
-  const parts: string[] = [];
-  if (wanted.length > 0) {
-    const n = unclaimed.length - tf;
-    parts.push(
-      `${n} file${n === 1 ? " looks" : "s look"} like ${wanted.join("/")} but ${wanted.length === 1 ? "that lexicon is" : "those lexicons are"} not installed, so ${n === 1 ? "it was" : "they were"} skipped` +
-        ` (npm i ${wanted.map(lexiconPackage).join(" ")}).`,
-    );
-  }
-  if (tf > 0) parts.push(`${tf} Terraform file${tf === 1 ? "" : "s"} skipped; the audit does not read HCL (see chant carve).`);
-  return parts.length > 0 ? parts.join(" ") : undefined;
+  if (wanted.length === 0) return undefined;
+  const n = unclaimed.length;
+  return `${n} file${n === 1 ? " looks" : "s look"} like ${wanted.join("/")} but ${wanted.length === 1 ? "that lexicon is" : "those lexicons are"} not installed, so ${n === 1 ? "it was" : "they were"} skipped` +
+    ` (npm i ${wanted.map(lexiconPackage).join(" ")}).`;
 }
 
 /** Human-readable diagnostic for the zero-lexicon case. */
@@ -129,11 +139,10 @@ function renderNoLexicons(target: string, unclaimed: UnclaimedFile[]): string {
   if (unclaimed.length > 0) {
     lines.push("", "Files that wanted a lexicon:");
     for (const u of unclaimed) {
-      const note = u.lexicon === "terraform" ? "terraform (not audited; see chant carve)" : u.lexicon;
-      lines.push(`  ${u.path}  ->  ${note}`);
+      lines.push(`  ${u.path}  ->  ${u.lexicon}`);
     }
   } else {
-    lines.push("", "No file under the target looked like CI, Kubernetes, Helm, Docker, CloudFormation, ARM, Config Connector, or fountain either.");
+    lines.push("", "No file under the target looked like CI, Kubernetes, Helm, Docker, CloudFormation, ARM, Config Connector, fountain, or Terraform either.");
   }
   lines.push("", "Run it with the lexicons those files need:");
   lines.push(`  ${installLine(wanted.length > 0 ? wanted : [...AUDIT_LEXICONS], target)}`);
@@ -197,6 +206,7 @@ function exitCodeFor(findings: AuditFinding[], failOn: AuditFailOn, catalog: Rec
   if (failOn === "warning") {
     return findings.some((f) => f.severity === "error" || f.severity === "warning") ? 1 : 0;
   }
+  if (failOn === "error") return findings.some((f) => f.severity === "error") ? 1 : 0;
   return 0;
 }
 
@@ -252,7 +262,15 @@ function renderStylish(findings: AuditFinding[], scanned: string[], notes: strin
     lines.push("", title);
     for (const f of list) {
       const loc = f.line ? `${f.file}:${f.line}` : f.file;
-      const where = f.entity ? `${loc} (${f.entity})` : loc;
+      // A `missing` finding (chant #2113) has nothing present to anchor
+      // `entity` to. The whole point is that `f.missing.kind` does not
+      // exist in `f.missing.scope`, so it renders that absence directly
+      // instead of falling back to `entity` (which such a check rarely sets).
+      const where = f.missing
+        ? `${loc} (missing ${f.missing.kind} in ${f.missing.scope})`
+        : f.entity
+          ? `${loc} (${f.entity})`
+          : loc;
       const title = catalog[f.checkId]?.title ?? f.checkId;
       lines.push(`  [${f.checkId}] ${f.severity}  ${where}  — ${title}`);
     }
@@ -280,11 +298,21 @@ function renderSarif(findings: AuditFinding[], catalog: Record<string, RuleMeta>
       shortDescription: { text: m?.title ?? id },
       ...(m?.remediation ? { help: { text: m.remediation } } : {}),
       helpUri: m?.authority?.[0]?.url,
-      ...(m?.category ? { properties: { category: m.category, dimension: m.category } } : {}),
+      // `priorArt` credits the upstream tools whose rules check the same thing
+      // (audit/prior-art.ts) — tool key, upstream rule id, doc URL, relation.
+      ...(m?.category || m?.lineage?.length
+        ? {
+            properties: {
+              ...(m?.category ? { category: m.category, dimension: m.category } : {}),
+              ...(m?.lineage?.length ? { priorArt: m.lineage } : {}),
+            },
+          }
+        : {}),
     };
   });
   const results = findings.map((f) => {
     const tier = catalog[f.checkId]?.tier;
+    const properties = { ...(tier ? { tier } : {}), ...(f.missing ? { missing: f.missing } : {}) };
     return {
       ruleId: f.checkId,
       level: sarifLevel(f.severity),
@@ -297,7 +325,12 @@ function renderSarif(findings: AuditFinding[], catalog: Record<string, RuleMeta>
           },
         },
       ],
-      ...(tier ? { properties: { tier } } : {}),
+      // `f.missing` (chant #2113) is Snyk policy-engine's "missing-resource"
+      // archetype: nothing at `f.file` actually declares the absent thing, so
+      // there is no line to point SARIF's region at either. `missing` rides
+      // in the property bag (SARIF's core schema has no dedicated slot for an
+      // absence finding) rather than pretending a region exists.
+      ...(Object.keys(properties).length > 0 ? { properties } : {}),
     };
   });
   return JSON.stringify(
@@ -395,29 +428,37 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
   // its own path detector plus a parsed-content marker check (a `.conf` in a
   // shared directory name like conf.d/ only counts once it parses as nginx).
   const nginxFindings = auditNginxConfigs(candidates);
+  // TF023 (#2110) — committed Terraform state. Lexicon-independent for the
+  // same reason the three above are: it reads the discovered paths, not a
+  // parsed root module, so it fires with or without the terraform lexicon.
+  const terraformStateFindings = auditTerraformState(candidates);
 
   if (plugins.length === 0) {
     const output = format === "json" ? renderNoLexiconsJson(options.path, unclaimed) : renderNoLexicons(options.path, unclaimed);
-    return { success: true, status: "no-lexicons", output, findings: [...secretsFindings, ...wranglerFindings, ...nginxFindings], scanned: [], unclaimed, exitCode: NO_LEXICONS_EXIT_CODE, stream: format === "json" ? "stdout" : "stderr" };
+    return { success: true, status: "no-lexicons", output, findings: [...secretsFindings, ...wranglerFindings, ...nginxFindings, ...terraformStateFindings], scanned: [], unclaimed, exitCode: NO_LEXICONS_EXIT_CODE, stream: format === "json" ? "stdout" : "stderr" };
   }
 
   const missingLexiconNote = missingLexiconHint(unclaimed);
 
-  if (inputs.length === 0 && secretsFindings.length === 0 && wranglerFindings.length === 0 && nginxFindings.length === 0) {
+  if (inputs.length === 0 && secretsFindings.length === 0 && wranglerFindings.length === 0 && nginxFindings.length === 0 && terraformStateFindings.length === 0) {
     const output = `No auditable files found under ${options.path}.${missingLexiconNote ? ` ${missingLexiconNote}` : ""}`;
     return { success: true, status: "ok", output, findings: [], scanned: [], unclaimed, exitCode: 0 };
   }
 
   let findings: AuditFinding[] = [];
+  // chant #2111: mutated in place by `auditFiles` so its inline (`# chant-
+  // ignore*`) suppressed count reaches the summary without changing
+  // `auditFiles`'s `AuditFinding[]` return type; see `SuppressionStats`'s doc.
+  const suppressionStats: SuppressionStats = { count: 0 };
   if (inputs.length > 0) {
     try {
-      findings = await auditFiles(inputs, { checksProvider: options.checksProvider });
+      findings = await auditFiles(inputs, { checksProvider: options.checksProvider, suppressionStats });
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       return { success: false, output: "", findings: [], scanned, exitCode: 1, error: msg };
     }
   }
-  findings = [...findings, ...secretsFindings, ...wranglerFindings, ...nginxFindings];
+  findings = [...findings, ...secretsFindings, ...wranglerFindings, ...nginxFindings, ...terraformStateFindings];
   // Resolve the audit catalog once, aggregating the audited lexicons' own
   // metadata over core's static catalog (#687). The lexicons are already loaded
   // by `auditFiles` above, so this is cheap. Core's static catalog (always
@@ -428,6 +469,11 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
   if (tier === "merge-worthy") findings = findings.filter((f) => isMergeWorthy(f, catalog));
   const notes = coverageNotes(inputs);
   if (missingLexiconNote) notes.push(missingLexiconNote);
+  if (suppressionStats.count > 0) {
+    notes.push(
+      `${suppressionStats.count} finding${suppressionStats.count === 1 ? "" : "s"} suppressed via inline chant-ignore comments.`,
+    );
+  }
 
   // Diff-bearing renderers (markdown, html) need action SHAs / image digests
   // resolved up front (sync maps so rendering stays synchronous).
@@ -495,10 +541,10 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     } catch (err) {
       return { success: false, output, findings, scanned, exitCode: 1, error: `Failed to write ${options.output}: ${err instanceof Error ? err.message : String(err)}` };
     }
-    return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode, wroteTo: options.output };
+    return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode, wroteTo: options.output, suppressedCount: suppressionStats.count };
   }
 
-  return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode };
+  return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode, suppressedCount: suppressionStats.count };
 }
 
 /** Print an audit result to stdout. */

package/src/cli/commands/build.test.ts

@@ -950,19 +950,21 @@ export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexi
     });
   });
 
-  test("op worker files go to <project>/dist/ops even with no --output (#878)", async () => {
-    // The generated Op worker must land where `chant run <op> --temporal` reads it
-    // (`<project>/dist/ops/<name>/worker.ts`) even when the build has no --output
-    // (a Temporal Op project often has no primary resource manifest to route).
+  test("serializer files under ops/ go to <project>/dist/ops even with no --output (#878)", async () => {
+    // Whatever a serializer emits under `ops/` must land in
+    // `<project>/dist/ops/<name>/`, beside the `op.json` core writes there,
+    // even when the build has no --output (an Op-only project often has no
+    // primary resource manifest to route). The routing is on the `ops/`
+    // prefix alone — it does not know or care what the files are.
     const opSerializer: Serializer = {
       name: "multi",
       rulePrefix: "MULTI",
       serialize: () => ({
         primary: "{}",
         files: {
-          "ops/durable-hello/workflow.ts": "// workflow\n",
-          "ops/durable-hello/worker.ts": "// worker\n",
-          "ops/durable-hello/activities.ts": "// activities\n",
+          "ops/nightly-report/steps.json": "{}\n",
+          "ops/nightly-report/notes.md": "# notes\n",
+          "ops/nightly-report/nested/extra.txt": "extra\n",
         },
       }),
     };
@@ -979,8 +981,31 @@ export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexi
     } as BuildOptions);
 
     expect(result.errors).toEqual([]);
-    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "worker.ts"))).toBe(true);
-    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "workflow.ts"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "nightly-report", "steps.json"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "nightly-report", "notes.md"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "nightly-report", "nested", "extra.txt"))).toBe(true);
+  });
+
+  test("an Op entity emits dist/ops/<name>/op.json from core, with no serializer involved (#2118)", async () => {
+    await writeFile(
+      join(testDir, "deploy.op.ts"),
+      `export default { [Symbol.for("chant.declarable")]: true, entityType: "Chant::Op", lexicon: "chant", kind: "resource", attributes: {},` +
+        ` props: { name: "deploy", overview: "Deploy the thing", labels: { Env: "staging" },` +
+        ` phases: [{ name: "Apply", steps: [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }] }] } };`,
+    );
+
+    const result = await buildCommand({ path: testDir, format: "json", serializers: [] } as BuildOptions);
+
+    expect(result.errors).toEqual([]);
+    const ir = JSON.parse(readFileSync(join(testDir, "dist", "ops", "deploy", "op.json"), "utf-8"));
+    expect(ir.formatVersion).toBe("2.0");
+    expect(ir.name).toBe("deploy");
+    expect(ir.labels).toEqual({ Env: "staging" });
+    expect(ir).not.toHaveProperty("taskQueue");
+    expect(ir.phases[0].steps[0]).toMatchObject({ kind: "activity", fn: "shellCmd", profile: "fastIdempotent" });
+    // Ops are held out of `partitionByLexicon` (they have no serializer and
+    // need none), so core's own `chant` lexicon never trips the warning.
+    expect(result.warnings.filter((w) => w.includes("No serializer"))).toEqual([]);
   });
 
   // ── #284 bug 2: array-of-objects must serialize to valid YAML ──────────
@@ -1219,6 +1244,264 @@ export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexi
       30_000,
     );
   });
+
+  describe("post-synth findings honor inline chant-ignore comments (chant #2111)", () => {
+    /**
+     * A discovered entity carrying a `suppressions` directive by hand, the
+     * generic, duck-typed field `applyInlineSuppressions` reads (see
+     * `../../lint/suppressions.ts`'s module doc). The terraform lexicon
+     * populates this from real `# chant-ignore*` HCL comments
+     * (`lexicons/terraform/src/hcl/suppressions.ts`); this test proves the
+     * core wiring, that `chant build` applies it to ANY lexicon's entities,
+     * without needing a real HCL parse.
+     */
+    async function writeSuppressibleEntity(ids: string): Promise<void> {
+      await writeFile(
+        join(testDir, "main.ts"),
+        `export const e = {\n` +
+          `  lexicon: "test",\n` +
+          `  entityType: "TestEntity",\n` +
+          `  [Symbol.for("chant.declarable")]: true,\n` +
+          `  suppressions: [{ form: "chant-ignore", ids: new Set(${JSON.stringify(ids.split(","))}), file: "main.ts", line: 1, key: "main.ts:1:chant-ignore" }],\n` +
+          `};\n`,
+      );
+    }
+
+    /** Same shape as `fakePostSynthPlugin` above, except its check attaches `entity` to whatever entity the build discovered, so a suppression directive on that entity has something to match against. */
+    function fakeEntitySuppressionPlugin(checkId: string, severity: "error" | "warning" | "info"): LexiconPlugin {
+      return {
+        name: "fake",
+        serializer: { name: "fake", rulePrefix: "FAKE", serialize: () => "{}" },
+        generate: async () => {},
+        validate: async () => {},
+        coverage: async () => {},
+        package: async () => {},
+        postSynthChecks: () => [
+          {
+            id: checkId,
+            description: "test check",
+            check: (ctx) => {
+              const [key] = [...ctx.entities.keys()];
+              return key ? [{ checkId, severity, message: `${checkId} triggered`, entity: key }] : [];
+            },
+          },
+        ],
+      };
+    }
+
+    test("an inline chant-ignore naming the finding's checkId suppresses it and reports a suppressed count", async () => {
+      await writeSuppressibleEntity("FAKE005");
+      await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakeEntitySuppressionPlugin("FAKE005", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed via inline chant-ignore comments"))).toBe(true);
+    });
+
+    test("an inline chant-ignore naming a different id has no effect", async () => {
+      await writeSuppressibleEntity("FAKE006");
+      await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakeEntitySuppressionPlugin("FAKE007", "error")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE007 triggered"))).toBe(true);
+      expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+    });
+
+    test("ignorable: false in lint.rules denies the ignore and reports the attempt, keeping the finding active", async () => {
+      await writeSuppressibleEntity("FAKE008");
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE008": ["error", { ignorable: false }] } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakeEntitySuppressionPlugin("FAKE008", "error")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE008 triggered"))).toBe(true);
+      expect(result.warnings.some((w) => w.includes("SUPP003") && w.includes("ignorable: false"))).toBe(true);
+    });
+  });
+
+  /**
+   * chant #2113: `lint.presets` filters WHICH post-synth check ids are
+   * reported at all, ahead of `lint.rules`' severity overrides (proven
+   * above). A plugin with no `lintPresets()` is unaffected (the common case
+   * today); one that ships presets defaults to `recommended` and is
+   * overridden per-lexicon via `lint.presets: { <name>: "<preset>" }`.
+   */
+  describe("post-synth findings honor lint.presets (chant #2113)", () => {
+    async function writeTrivialEntity(): Promise<void> {
+      await writeFile(
+        join(testDir, "main.ts"),
+        `export const e = { lexicon: "test", entityType: "TestEntity", [Symbol.for("chant.declarable")]: true };\n`,
+      );
+    }
+
+    /** A `LexiconPlugin` whose one post-synth check always fires, with `recommended`/`all` presets. `recommended` excludes the check's own id, `all` includes it. */
+    function fakePresetPlugin(): LexiconPlugin {
+      return {
+        name: "fakepreset",
+        serializer: { name: "fakepreset", rulePrefix: "FP", serialize: () => "{}" },
+        generate: async () => {},
+        validate: async () => {},
+        coverage: async () => {},
+        package: async () => {},
+        postSynthChecks: () => [
+          {
+            id: "FP001",
+            description: "a report-only check, always fires",
+            check: () => [{ checkId: "FP001", severity: "warning" as const, message: "FP001 triggered" }],
+          },
+        ],
+        lintPresets: () => ({ recommended: [], all: ["FP001"] }),
+      };
+    }
+
+    test("with no lint.presets config, the default preset (recommended) excludes the finding", async () => {
+      await writeTrivialEntity();
+      const result = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [fakePresetPlugin()] });
+      expect(result.warnings.join("\n")).not.toContain("FP001 triggered");
+      expect(result.warnings.some((w) => w.includes("not reported: excluded by the active lint.presets preset"))).toBe(true);
+    });
+
+    test('lint.presets: { fakepreset: "all" } includes the finding', async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { presets: { fakepreset: "all" } } };\n`,
+      );
+      const result = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [fakePresetPlugin()] });
+      expect(result.warnings.join("\n")).toContain("FP001 triggered");
+    });
+
+    test("an explicit lint.rules entry re-enables the rule even under the excluding (recommended) preset", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FP001": "warning" } } };\n`,
+      );
+      const result = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [fakePresetPlugin()] });
+      expect(result.warnings.join("\n")).toContain("FP001 triggered");
+    });
+  });
+});
+
+// #2122 (epic #2114 sub-issue 6) — OPS012/OPS013/OPS014 are core-owned
+// post-synth checks over the Op model, run unscoped by `coreOpChecks()`
+// regardless of which plugins/lexicons are configured. This is the
+// end-to-end path acceptance criterion 3 needs: `chant build` over a real
+// ConvergeOp-shaped fixture with a destructive gated dispatch rule fails
+// with the OPS014 refusal, with zero plugins/lexicons loaded.
+describe("buildCommand — OPS014 (op-model post-synth checks, #2122)", () => {
+  let testDir: string;
+
+  const mockSerializer: Serializer = {
+    name: "test",
+    rulePrefix: "TEST",
+    serialize: (entities) => JSON.stringify({ resources: [...entities.keys()] }, null, 2),
+  };
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-ops014-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  test("fails build with the OPS014 refusal on a ConvergeOp dispatching a destructive, gated op", async () => {
+    // The destructive dispatch target: a gated `nativeApply` with
+    // `deleteMode: "gated"` — classified destructive by
+    // `../../op/op-verb-class.ts`, gate or not.
+    await writeFile(
+      join(testDir, "prune-staging.op.ts"),
+      `
+export const pruneStaging = {
+  [Symbol.for("chant.declarable")]: true,
+  entityType: "Chant::Op",
+  lexicon: "chant",
+  kind: "resource",
+  props: {
+    name: "prune-staging",
+    overview: "test",
+    phases: [
+      { name: "Approve", steps: [{ kind: "gate", signalName: "approve-x" }] },
+      { name: "Apply", steps: [
+        { kind: "activity", fn: "nativeApply", args: { target: "kubectl", env: "staging", output: "dist", deleteMode: "gated" } },
+      ] },
+    ],
+  },
+};
+      `,
+    );
+
+    // The ConvergeOp-shaped Op: dial "apply", one rule dispatching the
+    // destructive target above.
+    await writeFile(
+      join(testDir, "converge.op.ts"),
+      `
+export const converge = {
+  [Symbol.for("chant.declarable")]: true,
+  entityType: "Chant::Op",
+  lexicon: "chant",
+  kind: "resource",
+  props: {
+    name: "converge",
+    overview: "test",
+    labels: { Converge: "true", Env: "staging", Dial: "apply" },
+    phases: [
+      { name: "Observe", steps: [{ kind: "activity", fn: "lifecycleDiff", args: { env: "staging" }, id: "diff" }] },
+      { name: "Converge", steps: [{ kind: "activity", fn: "convergeTick", args: { rules: [
+        {
+          id: "drift-prune",
+          when: { kind: "field-comparison", field: "status", op: "eq", value: "drifted" },
+          then: { kind: "run", op: "prune-staging" },
+          why: "Prune drifted resources.",
+        },
+      ] } }] },
+    ],
+  },
+};
+      `,
+    );
+
+    const result = await buildCommand({
+      path: testDir,
+      format: "json",
+      serializers: [mockSerializer],
+      plugins: [],
+    });
+
+    expect(result.success).toBe(false);
+    // build.ts's plain error strings carry the diagnostic's message text, not
+    // its checkId — OPS014's own message names what it refused and why (see
+    // ../../lint/rules/op/ops014-converge-rule-refusals.ts).
+    expect(
+      result.errors.some(
+        (e) => e.includes("destructive") && e.includes("prune-staging") && e.includes("refused in v1"),
+      ),
+    ).toBe(true);
+  });
 });
 
 // ── #284 bug 1: -o extension drives format when --format is absent ────────