@intentius/chant 0.56.0 → 0.58.0

package/src/lint/rules/comp/comp.test.ts

@@ -247,7 +247,7 @@ describe("COMP003: mutating-no-rollback", () => {
   });
 });
 
-describe("COMP004: gate-needs-temporal", () => {
+describe("COMP004: gate-needs-durable-runtime", () => {
   it("flags a gate step with no disable directive", async () => {
     const diagnostics = await lintFixture("comp004", "fail");
     const hits = diagnostics.filter((d) => d.checkId === "COMP004");

package/src/lint/rules/comp/comp004-gate-needs-durable-runtime.ts

@@ -0,0 +1,74 @@
+/**
+ * COMP004: gate-needs-durable-runtime (the file is renamed in #2116; the
+ * behaviour changed in #2119)
+ *
+ * The file name and the exported symbol keep the old wording on purpose
+ * (#2195): the id is what an author writes in a `chant-disable` comment and
+ * what every import names, and churning both buys nothing. `description`
+ * below is the accurate sentence, and it is what the docs page uses as its
+ * heading — since #2119 the rule has nothing to do with which runtime hosts
+ * the run.
+ *
+ * Flags a `gate` step anywhere in a component's composition — the point where
+ * a run stops and waits for a person. Since #2119 that is not a refusal: the
+ * driver decides the gate against the gate ledger (`../../../op/gate.ts`), and
+ * one nobody has approved ends the run pending `chant approve <component>
+ * <gate>`, to be re-decided next run.
+ *
+ * The rule survives the change because what it flags survives it. The
+ * component contract has no per-component runtime field (the runtime is chosen
+ * per *run*, via `chant run --on`, intentionally not part of the declaration),
+ * so lint cannot tell from the declaration alone that a `gate` is deliberate;
+ * every one is a standing "this component stops for a human" fact worth
+ * surfacing, not a mistake to silently allow. Acknowledge it explicitly with a
+ * **file-level**
+ * disable directive once the human wait is genuinely intended (see
+ * lint-rules/disable-directives.mdx) — a COMP* diagnostic carries no real
+ * line/column (it is reported for the whole component; see
+ * ../../component-checks.ts), so only the file-level `chant-disable` form is
+ * honored for these rules — `-line`/`-next-line` do not suppress a COMP*
+ * diagnostic (see ../../../cli/commands/lint.ts's
+ * `runComponentCheckDiagnostics`):
+ *
+ * ```ts
+ * // chant-disable COMP004 -- the rollout waits on a release manager's approval
+ * ```
+ *
+ * Triggers on: any `gate` step in `deploy`/`rollback` with no matching
+ * file-level disable directive.
+ * OK: a component with no `gate` steps at all, or a `gate` whose file-level
+ * disable directive says who is expected to approve it and why.
+ */
+
+import type { ComponentCheck, ComponentCheckContext, ComponentCheckDiagnostic } from "../../component-checks";
+import { walkComponent } from "./support";
+
+export const comp004GateNeedsDurableRuntimeRule: ComponentCheck = {
+  id: "COMP004",
+  severity: "error",
+  category: "correctness",
+  description: "A gate step ends the run pending approval — acknowledge the human wait explicitly",
+  check(ctx: ComponentCheckContext): ComponentCheckDiagnostic[] {
+    const diagnostics: ComponentCheckDiagnostic[] = [];
+
+    for (const [name, { component, filePath }] of ctx.components) {
+      const { gates } = walkComponent(component);
+      for (const { gate, phaseName } of gates) {
+        diagnostics.push({
+          checkId: "COMP004",
+          severity: "error",
+          component: name,
+          file: filePath,
+          message:
+            `Component "${name}": gate "${gate.signalName}" (phase "${phaseName}") ends the run pending approval — ` +
+            `a run that reaches it records the gate as a fact and stops there until someone runs ` +
+            `"chant approve ${name} ${gate.signalName}", and no later phase runs. If that wait is intended, ` +
+            `suppress with a file-level "// chant-disable COMP004 -- <reason>" comment anywhere in this file to ` +
+            `document who approves it and why.`,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/comp/index.ts

@@ -10,7 +10,7 @@ import type { ComponentCheck } from "../../component-checks";
 import { comp001PublishesNeverAppliesRule } from "./comp001-publishes-never-applies";
 import { comp002DanglingWiringRefRule } from "./comp002-dangling-wiring-ref";
 import { comp003MutatingNoRollbackRule } from "./comp003-mutating-no-rollback";
-import { comp004GateNeedsTemporalRule } from "./comp004-gate-needs-temporal";
+import { comp004GateNeedsDurableRuntimeRule } from "./comp004-gate-needs-durable-runtime";
 import { comp005CapabilityKindIsNounRule } from "./comp005-capability-kind-is-noun";
 import { comp006ShellNeedsReasonRule } from "./comp006-shell-needs-reason";
 import { comp007CompositionSprawlRule } from "./comp007-composition-sprawl";
@@ -18,7 +18,7 @@ import { comp007CompositionSprawlRule } from "./comp007-composition-sprawl";
 export { comp001PublishesNeverAppliesRule } from "./comp001-publishes-never-applies";
 export { comp002DanglingWiringRefRule } from "./comp002-dangling-wiring-ref";
 export { comp003MutatingNoRollbackRule } from "./comp003-mutating-no-rollback";
-export { comp004GateNeedsTemporalRule } from "./comp004-gate-needs-temporal";
+export { comp004GateNeedsDurableRuntimeRule } from "./comp004-gate-needs-durable-runtime";
 export { comp005CapabilityKindIsNounRule } from "./comp005-capability-kind-is-noun";
 export { comp006ShellNeedsReasonRule } from "./comp006-shell-needs-reason";
 export { comp007CompositionSprawlRule } from "./comp007-composition-sprawl";
@@ -29,7 +29,7 @@ export function loadComponentChecks(): ComponentCheck[] {
     comp001PublishesNeverAppliesRule,
     comp002DanglingWiringRefRule,
     comp003MutatingNoRollbackRule,
-    comp004GateNeedsTemporalRule,
+    comp004GateNeedsDurableRuntimeRule,
     comp005CapabilityKindIsNounRule,
     comp006ShellNeedsReasonRule,
     comp007CompositionSprawlRule,

package/src/lint/rules/op/index.ts

@@ -0,0 +1,23 @@
+/**
+ * OPS* Op-model post-synth checks (#2122, epic #2114 sub-issue 6) — ported
+ * from a hosting lexicon's own TMP012/TMP013/TMP014. Registered as core-owned
+ * post-synth checks (`coreOpChecks`, mirroring `../../receipt-checks.ts`'s
+ * `coreReceiptChecks`) so they run over the FULL build result regardless of
+ * which lexicons are configured — an Op is recognized by entity type
+ * (`../../../op/resource.ts`'s `OpResource`), not by which lexicon declared
+ * it.
+ */
+
+import type { PostSynthCheck } from "../../post-synth";
+import { ops012 } from "./ops012-activity-contract";
+import { ops013 } from "./ops013-step-output-ref";
+import { ops014 } from "./ops014-converge-rule-refusals";
+
+export { ops012 } from "./ops012-activity-contract";
+export { ops013 } from "./ops013-step-output-ref";
+export { ops014 } from "./ops014-converge-rule-refusals";
+
+/** Core's own post-synth checks over the Op model — OPS012, OPS013, OPS014. */
+export function coreOpChecks(): PostSynthCheck[] {
+  return [ops012, ops013, ops014];
+}

package/src/lint/rules/op/ops012-activity-contract.test.ts

@@ -0,0 +1,161 @@
+/**
+ * OPS012 tests — ported from a hosting lexicon's own TMP012
+ * (chant #1288 Stage 1, moved to core by #2122).
+ */
+
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "../../post-synth";
+import { DECLARABLE_MARKER } from "../../../declarable";
+import { ops012 } from "./ops012-activity-contract";
+import { activityContract, type ActivityContract } from "../../../op";
+import { z } from "zod";
+
+function makeEntity(entityType: string, props: Record<string, unknown>) {
+  return {
+    [DECLARABLE_MARKER]: true,
+    entityType,
+    lexicon: "chant",
+    kind: "resource",
+    props,
+    attributes: {},
+  };
+}
+
+function makeCtxFromEntities(entities: Map<string, unknown>): PostSynthContext {
+  return {
+    outputs: new Map([["chant", ""]]),
+    entities: entities as Map<string, never>,
+    buildResult: {
+      outputs: new Map([["chant", ""]]),
+      entities: entities as Map<string, never>,
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+function opEntity(name: string, steps: unknown[], entityType = "Chant::Op") {
+  return makeEntity(entityType, { name, overview: "test", phases: [{ name: "Phase", steps }] });
+}
+
+
+// ── Cross-lexicon contracts (chant #2101) ────────────────────────────────
+//
+// An Op step may call an activity any configured lexicon contributes, and
+// this check is core-owned, so it fires on every project that declares one.
+// `ctx.activityContracts` is what `chant build`, `chant lint` and
+// check-lexicon's example harness fill in from `loadActivityContracts`; the
+// check merges it over its own static table.
+
+/** Stand-in for what a lexicon (terraform) declares for its own activities. */
+const foreignContracts = new Map<string, ActivityContract>([
+  [
+    "terraformPlan",
+    activityContract(
+      "terraformPlan",
+      z.strictObject({ root: z.string(), planFile: z.string().optional() }),
+      z.object({ planFile: z.string(), changed: z.boolean(), text: z.string() }),
+    ),
+  ],
+  [
+    "terraformApply",
+    activityContract("terraformApply", z.strictObject({ root: z.string(), planFile: z.string().optional() })),
+  ],
+]);
+
+function withContracts(ctx: PostSynthContext, contracts: ReadonlyMap<string, ActivityContract>): PostSynthContext {
+  return { ...ctx, activityContracts: contracts };
+}
+
+describe("OPS012: activity-contract", () => {
+  test("passes when args match the registered contract exactly", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("deploy", [{ kind: "activity", fn: "lifecycleDiff", args: { env: "prod", live: true } }])],
+    ]));
+    expect(ops012.check(ctx)).toHaveLength(0);
+  });
+
+  test("skips a step whose fn has no registered contract", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("deploy", [{ kind: "activity", fn: "kubectlApply", args: { manifest: "dist/k8s.yaml", anything: "goes" } }])],
+    ]));
+    expect(ops012.check(ctx)).toHaveLength(0);
+  });
+
+  test("errors on an unrecognized args key — lifecycleDiff's `env` typo'd as `environment`", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("deploy", [{ kind: "activity", fn: "lifecycleDiff", args: { environment: "prod" } }])],
+    ]));
+    const diags = ops012.check(ctx);
+    expect(diags.length).toBeGreaterThan(0);
+    expect(diags.every((d) => d.checkId === "OPS012" && d.severity === "error")).toBe(true);
+    expect(diags.some((d) => d.message.includes("environment"))).toBe(true);
+    expect(diags[0].message).toContain('Op "deploy"');
+    expect(diags[0].entity).toBe("op");
+  });
+
+  test("errors on an outcomeAttribute.from path that doesn't exist on the declared return type", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("deploy", [
+        { kind: "activity", fn: "lifecycleDiff", args: { env: "prod" }, outcomeAttribute: { name: "Drift", from: "drifed" } },
+      ])],
+    ]));
+    const diags = ops012.check(ctx);
+    expect(diags.some((d) => d.message.includes('outcomeAttribute.from "drifed"'))).toBe(true);
+  });
+
+  test("errors on an unknown profile", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("deploy", [{ kind: "activity", fn: "shellCmd", args: { cmd: "echo hi" }, profile: "longInfa" }])],
+    ]));
+    const diags = ops012.check(ctx);
+    expect(diags.some((d) => d.message.includes('unknown profile "longInfa"'))).toBe(true);
+  });
+
+  test("ignores non-Op entities", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["bucket", makeEntity("AWS::S3::Bucket", { name: "default" })],
+    ]));
+    expect(ops012.check(ctx)).toHaveLength(0);
+  });
+
+  test("ignores an entity whose entityType isn't Chant::Op", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("deploy", [{ kind: "activity", fn: "lifecycleDiff", args: { environment: "prod" } }], "Legacy::Op")],
+    ]));
+    expect(ops012.check(ctx)).toHaveLength(0);
+  });
+});
+
+describe("OPS012 reads a lexicon's activity contracts (#2101)", () => {
+  const typoedStep = () =>
+    makeCtxFromEntities(new Map([
+      ["op", opEntity("app-plan", [{ kind: "activity", fn: "terraformPlan", args: { root: "app", planfile: "x" } }])],
+    ]));
+
+  test("a step calling an unknown activity is skipped when the context carries no contracts", () => {
+    expect(ops012.check(typoedStep())).toHaveLength(0);
+  });
+
+  test("the same step's misspelled arg is an error once the lexicon's contracts reach the check", () => {
+    const diags = ops012.check(withContracts(typoedStep(), foreignContracts));
+    expect(diags.some((d) => d.message.includes("planfile"))).toBe(true);
+    expect(diags.every((d) => d.checkId === "OPS012" && d.severity === "error")).toBe(true);
+  });
+
+  test("a well-formed foreign step passes", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("app-plan", [{ kind: "activity", fn: "terraformPlan", args: { root: "app", planFile: "x" } }])],
+    ]));
+    expect(ops012.check(withContracts(ctx, foreignContracts))).toHaveLength(0);
+  });
+
+  test("core's own contracts survive the merge", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("deploy", [{ kind: "activity", fn: "lifecycleDiff", args: { environment: "prod" } }])],
+    ]));
+    const diags = ops012.check(withContracts(ctx, foreignContracts));
+    expect(diags.some((d) => d.message.includes("environment"))).toBe(true);
+  });
+});

package/src/lint/rules/op/ops012-activity-contract.ts

@@ -0,0 +1,64 @@
+/**
+ * OPS012: activity step args/outcomeAttribute must match the activity's
+ * declared contract (chant #1288 Stage 1; moved from a hosting lexicon's own
+ * TMP012 to core in #2122, epic #2114 sub-issue 6, so it fires on every
+ * project that declares an Op, not only one with that lexicon configured).
+ *
+ * Validates every Op entity's steps against core's own base-activity
+ * contracts (`../../../op/activities/activity-contracts.ts`, #2117), using
+ * the generic walk in `@intentius/chant/op`'s `validateActivitySteps`. A step
+ * whose `fn` has no registered contract here is skipped — most activities
+ * don't have one yet; see that module's doc for why that's the intended,
+ * non-breaking default.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "../../post-synth";
+import { validateActivitySteps, mergeActivityContracts, type ActivityContract } from "../../../op";
+import type { OpConfig } from "../../../op";
+import * as contracts from "../../../op/activities/activity-contracts";
+import { isOpEntity } from "./support";
+
+const CONTRACTS: Map<string, ActivityContract> = new Map(
+  Object.values(contracts).map((c) => [c.name, c]),
+);
+
+export const ops012: PostSynthCheck = {
+  id: "OPS012",
+  description: "Activity step args and outcomeAttribute.from must match the activity's declared contract",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const activeContracts = mergeActivityContracts(CONTRACTS, ctx.activityContracts);
+
+    for (const [entityKey, entity] of ctx.entities) {
+      if (!isOpEntity(entity)) continue;
+      const rec = entity as unknown as Record<string, unknown>;
+
+      const props = ((entity as { props?: Record<string, unknown> }).props ?? {}) as unknown as OpConfig;
+      if (typeof props.name !== "string" || !Array.isArray(props.phases)) continue;
+
+      for (const issue of validateActivitySteps(props, activeContracts)) {
+        diagnostics.push({
+          checkId: "OPS012",
+          severity: "error",
+          message: `Op "${issue.opName}", phase "${issue.phase}", step "${issue.fn}": ${issue.message}`,
+          entity: entityKey,
+          lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/op/ops013-step-output-ref.test.ts

@@ -0,0 +1,237 @@
+/**
+ * OPS013 tests — ported from a hosting lexicon's own TMP013
+ * (chant #1290, moved to core by #2122).
+ */
+
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "../../post-synth";
+import { DECLARABLE_MARKER } from "../../../declarable";
+import { stepOutput, activityContract, type ActivityContract } from "../../../op";
+import { z } from "zod";
+import { ops013 } from "./ops013-step-output-ref";
+
+function makeEntity(entityType: string, props: Record<string, unknown>) {
+  return {
+    [DECLARABLE_MARKER]: true,
+    entityType,
+    lexicon: "chant",
+    kind: "resource",
+    props,
+    attributes: {},
+  };
+}
+
+function makeCtxFromEntities(entities: Map<string, unknown>): PostSynthContext {
+  return {
+    outputs: new Map([["chant", ""]]),
+    entities: entities as Map<string, never>,
+    buildResult: {
+      outputs: new Map([["chant", ""]]),
+      entities: entities as Map<string, never>,
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+function opEntity(name: string, steps: unknown[], entityType = "Chant::Op") {
+  return makeEntity(entityType, { name, overview: "test", phases: [{ name: "Phase", steps }] });
+}
+
+function opEntityPhases(name: string, phases: Array<{ name: string; steps: unknown[]; parallel?: boolean }>) {
+  return makeEntity("Chant::Op", { name, overview: "test", phases });
+}
+
+
+// ── Cross-lexicon contracts (chant #2101) ────────────────────────────────
+//
+// An Op step may call an activity any configured lexicon contributes, and
+// this check is core-owned, so it fires on every project that declares one.
+// `ctx.activityContracts` is what `chant build`, `chant lint` and
+// check-lexicon's example harness fill in from `loadActivityContracts`; the
+// check merges it over its own static table.
+
+/** Stand-in for what a lexicon (terraform) declares for its own activities. */
+const foreignContracts = new Map<string, ActivityContract>([
+  [
+    "terraformPlan",
+    activityContract(
+      "terraformPlan",
+      z.strictObject({ root: z.string(), planFile: z.string().optional() }),
+      z.object({ planFile: z.string(), changed: z.boolean(), text: z.string() }),
+    ),
+  ],
+  [
+    "terraformApply",
+    activityContract("terraformApply", z.strictObject({ root: z.string(), planFile: z.string().optional() })),
+  ],
+]);
+
+function withContracts(ctx: PostSynthContext, contracts: ReadonlyMap<string, ActivityContract>): PostSynthContext {
+  return { ...ctx, activityContracts: contracts };
+}
+
+describe("OPS013: step-output-ref", () => {
+  test("passes for a valid same-phase reference to a preceding step", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "lifecycleDiff", args: { env: "prod" }, id: "diff" },
+        // "output" (string) into "contains" (string) — a type-compatible reference (#1950-3).
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("diff", "output") } },
+      ])],
+    ]));
+    expect(ops013.check(ctx)).toHaveLength(0);
+  });
+
+  test("errors on a reference to an unknown producer step id", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("nope", "x") } },
+      ])],
+    ]));
+    const diags = ops013.check(ctx);
+    expect(diags.length).toBeGreaterThan(0);
+    expect(diags.every((d) => d.checkId === "OPS013" && d.severity === "error")).toBe(true);
+    expect(diags.some((d) => d.message.includes('unknown step id "nope"'))).toBe(true);
+    expect(diags[0].entity).toBe("op");
+  });
+
+  // No lexicon is configured, and no activity contract is registered for
+  // this step's "fn" either — the dangling reference is still caught
+  // structurally (chant #2122 acceptance: OPS013 fires on a project with no
+  // lexicons configured).
+  test("errors on an unknown producer step id with zero registered contracts", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "someActivity", args: { contains: stepOutput("nope", "x") } },
+      ])],
+    ]));
+    const diags = ops013.check(ctx);
+    expect(diags.some((d) => d.message.includes('unknown step id "nope"'))).toBe(true);
+  });
+
+  test("errors on a path that doesn't exist on the producer's declared return schema", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "lifecycleDiff", args: { env: "prod" }, id: "diff" },
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("diff", "notAField") } },
+      ])],
+    ]));
+    const diags = ops013.check(ctx);
+    expect(diags.some((d) => d.message.includes('path "notAField"') && d.message.includes("does not exist"))).toBe(true);
+  });
+
+  test("errors on a reference to a later step (in a later phase)", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntityPhases("reconcile", [
+        { name: "Check", steps: [{ kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("diff", "drifted") } }] },
+        { name: "Diff", steps: [{ kind: "activity", fn: "lifecycleDiff", args: { env: "prod" }, id: "diff" }] },
+      ])],
+    ]));
+    const diags = ops013.check(ctx);
+    expect(diags.some((d) => d.message.includes("later phase"))).toBe(true);
+  });
+
+  test("errors on a reference into a step whose fn has no registered contract", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "customUnregisteredActivity", args: {}, id: "custom" },
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("custom", "x") } },
+      ])],
+    ]));
+    const diags = ops013.check(ctx);
+    expect(diags.some((d) => d.message.includes("no registered activity contract"))).toBe(true);
+  });
+
+  test("ignores non-Op entities", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["bucket", makeEntity("AWS::S3::Bucket", { name: "default" })],
+    ]));
+    expect(ops013.check(ctx)).toHaveLength(0);
+  });
+
+  test("ignores an entity whose entityType isn't Chant::Op", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("nope", "x") } },
+      ], "Legacy::Op")],
+    ]));
+    expect(ops013.check(ctx)).toHaveLength(0);
+  });
+
+  // ── cross-contract type compatibility (#1950-3) ──────────────────────────
+
+  test("errors when a boolean-returning path feeds a string-typed arg", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "lifecycleDiff", args: { env: "prod" }, id: "diff" },
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("diff", "drifted") } },
+      ])],
+    ]));
+    const diags = ops013.check(ctx);
+    expect(diags.some((d) => d.message.includes("type mismatch") && d.message.includes("boolean") && d.message.includes("string"))).toBe(true);
+  });
+
+  test("a matching type (string into string) passes", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "lifecycleDiff", args: { env: "prod" }, id: "diff" },
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("diff", "output") } },
+      ])],
+    ]));
+    expect(ops013.check(ctx)).toHaveLength(0);
+  });
+});
+
+describe("OPS013 reads a lexicon's activity contracts (#2101)", () => {
+  const terraformOp = () =>
+    makeCtxFromEntities(new Map([
+      ["op", opEntity("app-apply", [
+        { kind: "activity", fn: "terraformPlan", args: { root: "app" }, id: "plan" },
+        { kind: "activity", fn: "terraformApply", args: { root: "app", planFile: stepOutput("plan", "planFile") } },
+      ])],
+    ]));
+
+  test("the foreign producer is flagged when the context carries no contracts — the pre-#2101 behaviour", () => {
+    const diags = ops013.check(terraformOp());
+    expect(diags.some((d) => d.message.includes("no registered activity contract"))).toBe(true);
+  });
+
+  test("it passes once the configured lexicon's contracts reach the check", () => {
+    expect(ops013.check(withContracts(terraformOp(), foreignContracts))).toHaveLength(0);
+  });
+
+  test("a path the foreign contract's return schema does not declare is still caught", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("app-apply", [
+        { kind: "activity", fn: "terraformPlan", args: { root: "app" }, id: "plan" },
+        { kind: "activity", fn: "terraformApply", args: { root: "app", planFile: stepOutput("plan", "planFyle") } },
+      ])],
+    ]));
+    const diags = ops013.check(withContracts(ctx, foreignContracts));
+    expect(diags.some((d) => d.message.includes('path "planFyle"') && d.message.includes("does not exist"))).toBe(true);
+  });
+
+  test("a cross-lexicon type mismatch is still caught", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("app-apply", [
+        { kind: "activity", fn: "terraformPlan", args: { root: "app" }, id: "plan" },
+        { kind: "activity", fn: "terraformApply", args: { root: "app", planFile: stepOutput("plan", "changed") } },
+      ])],
+    ]));
+    const diags = ops013.check(withContracts(ctx, foreignContracts));
+    expect(diags.some((d) => d.message.includes("type mismatch"))).toBe(true);
+  });
+
+  test("core's own contracts survive the merge", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["op", opEntity("reconcile", [
+        { kind: "activity", fn: "lifecycleDiff", args: { env: "prod" }, id: "diff" },
+        { kind: "activity", fn: "httpCheck", args: { url: "http://x", contains: stepOutput("diff", "notAField") } },
+      ])],
+    ]));
+    const diags = ops013.check(withContracts(ctx, foreignContracts));
+    expect(diags.some((d) => d.message.includes('path "notAField"'))).toBe(true);
+  });
+});