@intentius/chant 0.57.0 → 0.58.0

package/src/lint/rules/op/ops013-step-output-ref.ts

@@ -0,0 +1,98 @@
+/**
+ * OPS013: a step-output reference (`stepOutput()`/`activity().out`, chant
+ * #1290) must name a step that precedes it, in scope (main `phases`, not
+ * `onFailure` or nested inside an `EffectStep`), with a registered
+ * `ActivityContract` whose `returns` schema the referenced path resolves
+ * against. Moved from a hosting lexicon's own TMP013 to core in #2122 (epic
+ * #2114 sub-issue 6), so it fires on every project that declares an Op — a
+ * project on the local runtime with no lexicons configured included.
+ *
+ * Same shape as OPS012 (`./ops012-activity-contract.ts`): the generic walk
+ * lives in `@intentius/chant/op`'s `validateStepOutputRefs`, over the same
+ * contract map this file builds from core's own base-activity contracts
+ * (`../../../op/activities/activity-contracts.ts`, #2117). A producer
+ * step whose `fn` has no registered contract is flagged (unlike OPS012's
+ * args/outcomeAttribute checks, which skip an unregistered `fn` — a
+ * reference has nothing to validate against without one, so it can't be
+ * silently allowed the way an unchecked arg can). The purely structural half
+ * of this check (an unknown step id, or a reference into a later phase) is
+ * independent of the contract map's contents entirely — no lexicon needs to
+ * be configured, and no activity needs a registered contract at all, for it
+ * to fire.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ *
+ * That merge is what makes this rule usable at all on an Op whose steps are
+ * a lexicon's: before it, `terraformPlan` feeding `terraformApply` failed
+ * `chant build` for the absence of a contract the terraform lexicon does in
+ * fact declare, which is why both terraform examples carrying an Op kept it
+ * outside `src/` where the example-build harness could not see it.
+ *
+ * This check is what makes it safe for a lexicon's own serializer to compile
+ * every reference it finds unconditionally: `chant build` blocks file output
+ * while an error-severity post-synth finding stands, so generated code
+ * referencing an unresolved step never reaches disk (a lexicon's own Op
+ * serializer also runs the scope-only subset of this check directly —
+ * `validateStepOutputRefScope` — as defense-in-depth, chant #1950 pre-merge
+ * review finding 2).
+ *
+ * Cross-contract type compatibility (chant #1950 pre-merge review, finding
+ * 3): this rule also compares a producer's declared return type at `path`
+ * against the consumer's declared arg type at the same position
+ * (`string`/`number`/`boolean`/`object`/`array` only) and flags a mismatch —
+ * a string-returning path feeding a number-typed arg, for example.
+ * Deliberately shallow: a union, enum, literal, `z.any()`/`z.unknown()`, a
+ * transform, or a reference sitting inside an array in `args` all bail
+ * silently rather than being reasoned about. See `@intentius/chant/op`'s
+ * `step-output-ref.ts` module doc for the full writeup of what this catches
+ * and what it defers (to #1288 Stage 2).
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "../../post-synth";
+import { validateStepOutputRefs, mergeActivityContracts, type ActivityContract } from "../../../op";
+import type { OpConfig } from "../../../op";
+import * as contracts from "../../../op/activities/activity-contracts";
+import { isOpEntity } from "./support";
+
+const CONTRACTS: Map<string, ActivityContract> = new Map(
+  Object.values(contracts).map((c) => [c.name, c]),
+);
+
+export const ops013: PostSynthCheck = {
+  id: "OPS013",
+  description: "A step-output reference must name an in-scope, preceding, contract-validated producer step",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const activeContracts = mergeActivityContracts(CONTRACTS, ctx.activityContracts);
+
+    for (const [entityKey, entity] of ctx.entities) {
+      if (!isOpEntity(entity)) continue;
+      const rec = entity as unknown as Record<string, unknown>;
+
+      const props = ((entity as { props?: Record<string, unknown> }).props ?? {}) as unknown as OpConfig;
+      if (typeof props.name !== "string" || !Array.isArray(props.phases)) continue;
+
+      for (const issue of validateStepOutputRefs(props, activeContracts)) {
+        diagnostics.push({
+          checkId: "OPS013",
+          severity: "error",
+          message: `Op "${issue.opName}", phase "${issue.phase}", step "${issue.fn}": ${issue.message}`,
+          entity: entityKey,
+          lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/op/ops014-converge-rule-refusals.test.ts

@@ -0,0 +1,263 @@
+/**
+ * OPS014 tests — ported from a hosting lexicon's own TMP014
+ * (#1484, moved to core by #2122).
+ */
+
+import { describe, test, expect } from "vitest";
+import type { PostSynthContext } from "../../post-synth";
+import { DECLARABLE_MARKER } from "../../../declarable";
+import { when, eq, gt, allOf, run, report } from "../../../op";
+import type { ConvergeRule } from "../../../op";
+import type { ConvergeSymptom } from "../../../lifecycle/symptoms";
+import { ops014 } from "./ops014-converge-rule-refusals";
+
+function makeEntity(entityType: string, props: Record<string, unknown>) {
+  return {
+    [DECLARABLE_MARKER]: true,
+    entityType,
+    lexicon: "chant",
+    kind: "resource",
+    props,
+    attributes: {},
+  };
+}
+
+function makeCtxFromEntities(entities: Map<string, unknown>): PostSynthContext {
+  return {
+    outputs: new Map([["chant", ""]]),
+    entities: entities as Map<string, never>,
+    buildResult: {
+      outputs: new Map([["chant", ""]]),
+      entities: entities as Map<string, never>,
+      warnings: [],
+      errors: [],
+      sourceFileCount: 1,
+    },
+  };
+}
+
+function opEntity(name: string, steps: unknown[], entityType = "Chant::Op") {
+  return makeEntity(entityType, { name, overview: "test", phases: [{ name: "Phase", steps }] });
+}
+
+function convergeOpEntity(
+  name: string,
+  rules: ConvergeRule<ConvergeSymptom>[],
+  opts?: { dial?: "observe" | "reconcile" | "apply"; entityType?: string },
+) {
+  return makeEntity(opts?.entityType ?? "Chant::Op", {
+    name,
+    overview: "test",
+    labels: { Converge: "true", Env: "staging", Dial: opts?.dial ?? "observe" },
+    phases: [
+      { name: "Observe", steps: [{ kind: "activity", fn: "lifecycleDiff", args: { env: "staging" }, id: "diff" }] },
+      { name: "Converge", steps: [{ kind: "activity", fn: "convergeTick", args: { rules } }] },
+    ],
+  });
+}
+
+function readOnlyOpEntity(name: string) {
+  return opEntity(name, [{ kind: "activity", fn: "lifecycleDiff", args: { env: "staging" } }]);
+}
+
+function mutatingOpEntity(name: string) {
+  return opEntity(name, [
+    { kind: "activity", fn: "nativeApply", args: { target: "kubectl", env: "staging", output: "dist", deleteMode: "never" } },
+  ]);
+}
+
+function destructiveOpEntity(name: string, opts?: { gated?: boolean }) {
+  const steps: unknown[] = [
+    { kind: "activity", fn: "nativeApply", args: { target: "kubectl", env: "staging", output: "dist", deleteMode: "gated" } },
+  ];
+  const phases = opts?.gated
+    ? [
+        { name: "Approve", steps: [{ kind: "gate", signalName: "approve-x" }] },
+        { name: "Apply", steps },
+      ]
+    : [{ name: "Apply", steps }];
+  return makeEntity("Chant::Op", { name, overview: "test", phases });
+}
+
+describe("OPS014: converge-rule-refusals", () => {
+  test("passes a well-formed rule table dispatching a read-only op under observe", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("watch"), {
+      id: "drift-watch",
+      why: "Re-check drift with a read-only observation.",
+    });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "observe" })],
+      ["watch", readOnlyOpEntity("watch")],
+    ]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes a report-only rule table with no dispatch at all", () => {
+    const rule = when<ConvergeSymptom>(gt("adoptCount", 0), report("unowned resources present"), {
+      id: "adopt-report",
+      why: "Unowned resources are reported, never auto-claimed.",
+    });
+    const ctx = makeCtxFromEntities(new Map([["converge", convergeOpEntity("converge", [rule])]]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+
+  test("errors when a rule has a blank why", () => {
+    const badRule = {
+      id: "no-why",
+      when: { kind: "field-comparison", field: "status", op: "eq", value: "drifted" },
+      then: { kind: "report", reason: "x" },
+      why: "",
+    } as unknown as ConvergeRule<ConvergeSymptom>;
+    const ctx = makeCtxFromEntities(new Map([["converge", convergeOpEntity("converge", [badRule])]]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.checkId === "OPS014" && d.message.includes("must carry its why"))).toBe(true);
+  });
+
+  test("errors when a rule's predicate is malformed (outside the evaluable subset)", () => {
+    const badRule = {
+      id: "bad-predicate",
+      when: { kind: "not-a-real-predicate-kind" },
+      then: { kind: "report", reason: "x" },
+      why: "some reason",
+    } as unknown as ConvergeRule<ConvergeSymptom>;
+    const ctx = makeCtxFromEntities(new Map([["converge", convergeOpEntity("converge", [badRule])]]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes("outside the evaluable subset"))).toBe(true);
+  });
+
+  test("errors when run() names an op that doesn't exist", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("does-not-exist"), { id: "drift-apply", why: "Re-apply on drift." });
+    const ctx = makeCtxFromEntities(new Map([["converge", convergeOpEntity("converge", [rule], { dial: "apply" })]]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes('unknown op "does-not-exist"'))).toBe(true);
+  });
+
+  test("errors when a mutating op is dispatched under an observe dial", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("apply-staging"), { id: "drift-apply", why: "Re-apply on drift." });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "observe" })],
+      ["apply-staging", mutatingOpEntity("apply-staging")],
+    ]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes("mutating") && d.message.includes('dial "observe"'))).toBe(true);
+  });
+
+  // Finding A (#1954 pre-merge review): issue #1484's own Autonomy table
+  // gives `reconcile` × mutating "open PR", not "run directly" — v1 doesn't
+  // build the PR-opening channel, so this is refused rather than silently
+  // escalated to match `apply`'s authority.
+  test("errors when a mutating op is dispatched under a reconcile dial — reconcile's table answer is \"open PR\", not implemented in v1", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("apply-staging"), { id: "drift-apply", why: "Re-apply on drift." });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "reconcile" })],
+      ["apply-staging", mutatingOpEntity("apply-staging")],
+    ]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes("mutating") && d.message.includes('dial "reconcile"') && d.message.includes("open PR"))).toBe(true);
+  });
+
+  test("passes a mutating dispatch under an apply dial", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("apply-staging"), { id: "drift-apply", why: "Re-apply on drift." });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "apply" })],
+      ["apply-staging", mutatingOpEntity("apply-staging")],
+    ]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+
+  // Finding B (#1954 pre-merge review): a destructive dispatch target is
+  // refused under every dial, `apply` included — a converge tick is
+  // unattended, so a destructive target needs a human's approval before
+  // it's attempted, not a gate the tick consults after already committing to
+  // running it.
+  test("errors when a destructive op is dispatched under a reconcile dial", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("prune-staging"), { id: "drift-prune", why: "Prune drifted resources." });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "reconcile" })],
+      ["prune-staging", destructiveOpEntity("prune-staging", { gated: true })],
+    ]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes("destructive") && d.message.includes("refused in v1"))).toBe(true);
+  });
+
+  test("errors when a destructive op is dispatched under apply and has no gate", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("prune-staging"), { id: "drift-prune", why: "Prune drifted resources." });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "apply" })],
+      ["prune-staging", destructiveOpEntity("prune-staging", { gated: false })],
+    ]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes("destructive") && d.message.includes("refused in v1"))).toBe(true);
+  });
+
+  test("errors when a destructive op is dispatched under apply even when the target is gated — approval must come before dispatch, not after", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("prune-staging"), { id: "drift-prune", why: "Prune drifted resources." });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "apply" })],
+      ["prune-staging", destructiveOpEntity("prune-staging", { gated: true })],
+    ]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes("destructive") && d.message.includes("refused in v1"))).toBe(true);
+  });
+
+  // Finding C (#1954 pre-merge review): adopt safety — "an unowned resource
+  // is reported, never auto-claimed" — is enforced, not just documented.
+  test("errors when a rule reads adoptCount and dispatches a mutating op", () => {
+    const rule = when<ConvergeSymptom>(gt("adoptCount", 0), run("apply-staging"), { id: "adopt-apply", why: "test" });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "apply" })],
+      ["apply-staging", mutatingOpEntity("apply-staging")],
+    ]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes('reads "adoptCount"') && d.message.includes("mutating"))).toBe(true);
+  });
+
+  test("errors when adoptCount is read inside a nested allOf/anyOf predicate that dispatches a mutating op", () => {
+    const rule = when<ConvergeSymptom>(
+      allOf(eq("status", "drifted"), gt("adoptCount", 0)),
+      run("apply-staging"),
+      { id: "nested-adopt-apply", why: "test" },
+    );
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "apply" })],
+      ["apply-staging", mutatingOpEntity("apply-staging")],
+    ]));
+    const diags = ops014.check(ctx);
+    expect(diags.some((d) => d.message.includes('reads "adoptCount"'))).toBe(true);
+  });
+
+  test("passes a rule that reads adoptCount and dispatches a read-only op", () => {
+    const rule = when<ConvergeSymptom>(gt("adoptCount", 0), run("watch"), { id: "adopt-watch", why: "test" });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "apply" })],
+      ["watch", readOnlyOpEntity("watch")],
+    ]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+
+  test("passes a rule that reads adoptCount and only reports (no dispatch at all)", () => {
+    const rule = when<ConvergeSymptom>(gt("adoptCount", 0), report("unowned resources present"), { id: "adopt-report", why: "test" });
+    const ctx = makeCtxFromEntities(new Map([["converge", convergeOpEntity("converge", [rule], { dial: "apply" })]]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+
+  test("ignores an Op with no Converge label", () => {
+    const ctx = makeCtxFromEntities(new Map([["op", readOnlyOpEntity("op")]]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+
+  test("ignores non-Op entities", () => {
+    const ctx = makeCtxFromEntities(new Map([
+      ["bucket", makeEntity("AWS::S3::Bucket", { name: "default" })],
+    ]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+
+  test("ignores an entity whose entityType isn't Chant::Op", () => {
+    const rule = when<ConvergeSymptom>(eq("status", "drifted"), run("does-not-exist"), { id: "drift-apply", why: "Re-apply on drift." });
+    const ctx = makeCtxFromEntities(new Map([
+      ["converge", convergeOpEntity("converge", [rule], { dial: "apply", entityType: "Legacy::Op" })],
+    ]));
+    expect(ops014.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/rules/op/ops014-converge-rule-refusals.ts

@@ -0,0 +1,179 @@
+/**
+ * OPS014: converge-rule-refusals (#1484). Moved from a hosting lexicon's own
+ * TMP014 to core in #2122 (epic #2114 sub-issue 6), so it fires on every
+ * project that declares a `ConvergeOp`-shaped Op, not only one with that
+ * lexicon configured.
+ *
+ * Cross-Op build-time refusals for a `ConvergeOp`'s rule table — the checks
+ * `../../../op/composites/converge-op.ts`'s factory can't make on its own,
+ * since they need the *whole* discovered graph of `Chant::Op` entities
+ * (`PostSynthContext.entities`), not just the ConvergeOp instance under
+ * construction: a sibling `*.op.ts` file's Op may not exist yet at the
+ * moment a composite factory runs, the same reason OPS012/OPS013 exist as
+ * post-synth checks rather than builder-time throws.
+ *
+ * A `ConvergeOp`-produced Op is identified by its own
+ * `labels.Converge === "true"` marker (mirroring `ApplyOp`'s
+ * `{ Apply: "true" }` / `WatchOp`'s `{ Watch: "true" }`); its rule table is
+ * read back off the `convergeTick` activity step's `args.rules` (there is no
+ * dedicated `OpConfig` field for it — see `../../../op/composites/
+ * converge-op.ts`'s doc on why the rule table travels as a step's args
+ * instead of a bespoke config field).
+ *
+ * Flags (pre-merge review of #1954 tightened the last three to match issue
+ * #1484's own Autonomy table — see `converge-op.ts`'s module doc):
+ *  - a rule with no (or a blank) `why` — every rule must carry its
+ *    rationale (Accessible Ops factor III),
+ *  - a rule whose predicate isn't in the evaluable subset
+ *    (`isWellFormedPredicate`, re-validated here as the runtime backstop
+ *    over a rule table not authored through `when()`),
+ *  - a `run()` action naming an Op no declared Op entity has as its `name`,
+ *  - a `run()` action dispatching a `mutating` Op under any dial other than
+ *    `"apply"` — the issue's Autonomy table gives `reconcile` "open PR", not
+ *    "run directly"; opening a PR is out of v1 scope (epic #1487's
+ *    `onDrift`-channel open question), so `reconcile` refuses the mutating
+ *    dispatch rather than silently escalating it to "run directly",
+ *  - a `run()` action dispatching a `destructive` Op under any dial,
+ *    unconditionally — a converge tick runs unattended, on a schedule, with
+ *    no one watching it fire. A destructive dispatch needs a human's
+ *    approval *before* it is attempted, not a gate the tick consults after
+ *    it has already committed to running the op — and `run()` has no way to
+ *    ask first. (This used to be argued from the local executor's inability
+ *    to honor a gate at all; as of #2119 a gated op ends the run `gated`
+ *    rather than being refused, so that argument no longer holds — the
+ *    refusal stands on the unattended-approval ground instead.) Durable,
+ *    pre-approved destructive dispatch from a tick is a future design's to
+ *    own; v1 refuses the target rather than shipping a path that dispatches
+ *    a destructive op with no human in the loop,
+ *  - a rule whose predicate reads `adoptCount` while its action is `run()`
+ *    against a `mutating` Op — adopt safety (never auto-claiming an unowned
+ *    resource) is enforced here, not merely documented: a rule that reads
+ *    the adopt signal has no business dispatching a mutation.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "../../post-synth";
+import { classifyOpVerbClass, isWellFormedPredicate, predicateReferencesField } from "../../../op";
+import type { ConvergeRule, OpConfig } from "../../../op";
+import { CONVERGE_SYMPTOM_FIELDS, type ConvergeSymptom } from "../../../lifecycle/symptoms";
+import { isOpEntity } from "./support";
+
+function looksLikeOpProps(props: Record<string, unknown>): boolean {
+  return typeof props.name === "string" && Array.isArray(props.phases);
+}
+
+/** Read a ConvergeOp's rule table back off its `convergeTick` step's `args.rules`. `undefined` if this doesn't look like a ConvergeOp-shaped Op (defensive — never crashes the build over an unexpected shape). */
+function findConvergeRules(props: OpConfig): ConvergeRule<ConvergeSymptom>[] | undefined {
+  for (const phase of props.phases) {
+    for (const step of phase.steps) {
+      if (step.kind === "activity" && step.fn === "convergeTick") {
+        const rules = step.args?.rules;
+        return Array.isArray(rules) ? (rules as ConvergeRule<ConvergeSymptom>[]) : undefined;
+      }
+    }
+  }
+  return undefined;
+}
+
+export const ops014: PostSynthCheck = {
+  id: "OPS014",
+  description:
+    "A ConvergeOp rule table: run() must name a declared Op, a mutating dispatch requires dial apply (reconcile opens a PR in a future version, not implemented in v1), a destructive dispatch is refused outright in v1 (a converge tick is unattended and a destructive dispatch needs approval before it's attempted, not a gate consulted after the tick already committed to it), an adoptCount-reading rule may not dispatch a mutation, and every rule must carry its why",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    const opsByName = new Map<string, OpConfig>();
+    for (const entity of ctx.entities.values()) {
+      if (!isOpEntity(entity)) continue;
+      const rawProps = ((entity as { props?: Record<string, unknown> }).props ?? {}) as Record<string, unknown>;
+      if (!looksLikeOpProps(rawProps)) continue;
+      const opProps = rawProps as unknown as OpConfig;
+      opsByName.set(opProps.name, opProps);
+    }
+
+    for (const [entityKey, entity] of ctx.entities) {
+      if (!isOpEntity(entity)) continue;
+      const rec = entity as unknown as Record<string, unknown>;
+
+      const rawProps = ((entity as { props?: Record<string, unknown> }).props ?? {}) as Record<string, unknown>;
+      if (!looksLikeOpProps(rawProps)) continue;
+      const props = rawProps as unknown as OpConfig;
+      if (props.labels?.Converge !== "true") continue;
+
+      const dial = props.labels?.Dial ?? "observe";
+      const rules = findConvergeRules(props);
+      if (!rules) continue;
+
+      for (const rule of rules) {
+        const label = typeof rule?.id === "string" ? rule.id : "(unnamed rule)";
+        const push = (message: string): void => {
+          diagnostics.push({
+            checkId: "OPS014",
+            severity: "error",
+            message: `ConvergeOp "${props.name}", rule "${label}": ${message}`,
+            entity: entityKey,
+            lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+          });
+        };
+
+        if (typeof rule?.why !== "string" || rule.why.trim().length === 0) {
+          push("every rule must carry its why — refused at build");
+          continue;
+        }
+        if (!isWellFormedPredicate(rule.when, CONVERGE_SYMPTOM_FIELDS)) {
+          push("predicate is outside the evaluable subset (build it from eq/neq/gt/gte/lt/lte/truthy/falsy/allOf/anyOf over a known symptom field)");
+          continue;
+        }
+        if (!rule.then || rule.then.kind !== "run") continue;
+
+        const targetName = rule.then.op;
+        const target = opsByName.get(targetName);
+        if (!target) {
+          push(`references unknown op "${targetName}" — no declared Op has that name`);
+          continue;
+        }
+
+        const verbClass = classifyOpVerbClass(target);
+
+        // Mutating: the issue's Autonomy table gives `reconcile` "open PR",
+        // not "run directly" — building that channel is out of v1 scope
+        // (epic #1487's onDrift-channel open question), so only `apply`
+        // (the dial the issue's table marks "run, gated per op") may free-run
+        // a mutating dispatch. Refusing this at build is the honest
+        // alternative to silently escalating `reconcile`'s authority to
+        // match `apply`.
+        if (verbClass === "mutating" && dial !== "apply") {
+          const escalationNote =
+            dial === "reconcile"
+              ? ` — the issue's table answer for "reconcile" is "open PR", which v1 does not implement (see epic #1487's onDrift-channel open question); this Op would otherwise silently run a mutation "reconcile" was never granted`
+              : "";
+          push(`dispatches "${targetName}" (mutating), but dial "${dial}" only permits a mutating dispatch under "apply"${escalationNote} — report instead, or raise the dial to "apply"`);
+        }
+
+        // Destructive: refused outright, regardless of dial or gate. A
+        // converge tick runs unattended on a schedule — nothing is watching
+        // it fire — so a destructive dispatch needs a human's approval
+        // *before* it is attempted, not a gate the tick consults only after
+        // it has already committed to running the op. `run()` has no way to
+        // ask first, so the target is refused rather than dispatched.
+        if (verbClass === "destructive") {
+          push(
+            `dispatches "${targetName}" (destructive) — destructive run() targets are refused in v1 under any dial: a converge tick is unattended, and a destructive dispatch needs a human's approval before it is attempted, not a gate consulted after the tick has already committed to running it. Destructive remediation via ConvergeOp arrives once a tick can ask for that approval before it dispatches — until then, remediate manually via a gated ApplyOp/ReconcileOp run.`,
+          );
+        }
+
+        // Adopt safety: enforced, not just documented. A rule that reads
+        // `adoptCount` — the "unowned resource" signal — has no honest
+        // reason to dispatch a mutation; the only sanctioned action for that
+        // signal is `report()`. (A destructive target already gets refused
+        // above regardless of what its predicate reads.)
+        if (verbClass === "mutating" && predicateReferencesField(rule.when, "adoptCount")) {
+          push(
+            `predicate reads "adoptCount" but dispatches "${targetName}" (mutating) — an unowned resource is reported, never auto-claimed by a dispatched mutation; use report() for a rule that reads the adopt signal`,
+          );
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/rules/op/support.ts

@@ -0,0 +1,11 @@
+/**
+ * Shared support for the OPS* Op-model post-synth checks (#2122, epic #2114
+ * sub-issue 6) — OPS012 (`./ops012-activity-contract.ts`), OPS013
+ * (`./ops013-step-output-ref.ts`) and OPS014
+ * (`./ops014-converge-rule-refusals.ts`), ported here from a hosting
+ * lexicon's own TMP012/TMP013/TMP014.
+ *
+ * Op-entity recognition is core's own `isOpEntity` (`../../../op/resource.ts`,
+ * #2118) — re-exported here so every OPS* check imports it from one place.
+ */
+export { isOpEntity } from "../../../op/resource";