M3: seed the workbench — chant in place, the live-mv estates, estate-gen cohorts, terralith at scale 1 and 4, terralith adopted by hand (#386)

[lex00]

Child of #386, M3. Needs M1 (sidecar probe) and M2 (the local source). Everything here lives in workbench.json and workbench/<entry>/ (scripts), nothing in src/.

The intentius checkouts are siblings of this repo: ../choudoufu, ../chant, ../fountain-ops. Paths in workbench.json are relative to the repo root.

Entries

In place, chant.

• chant-getting-started — ../chant/examples/getting-started, no setup, source graph.
• chant-local-cloud-trio — ../chant/examples/local-cloud-trio, no setup.
• fountain-ops — ../fountain-ops, inPlace, setup just up, serve env local, requires docker k3d kubectl jq just. Same shape as the git fountain demo, on the working checkout.

Copied, choudoufu.

• choudoufu-workbench — the live-mv workbench's own estates, ../choudoufu/examples/live-mv-workbench/tests/fixtures/sample-run/estates (four tlmig-sample-* dirs), setup: scratch floci, init in each, apply the monolith; serve the four dirs --env live with the spawnEnv. This is the bundled choudoufu-estate demo read from the checkout instead of a copy that drifts; reuse example-choudoufu-estate/scripts/*.sh's shape.

Generated, choudoufu. No path; setup renders into the target.

• choudoufu-cohort-s3, choudoufu-cohort-iam-ecr, choudoufu-cohort-ec2-networking — env -u PWD go -C "$BEHOLD_WORKBENCH_DIR/../choudoufu" run ./tools/estate-gen -cohort <name> -out "$PWD" (estate-gen runs terraform init for schemas: requires terraform or tofu on PATH — check tools/estate-gen/schemas.go for which, and put it in requires), then scratch floci, choudoufu init, choudoufu apply, serve --env live. The cohort already carries estate.chdf.hcl.

• terralith-1, terralith-4 — go run ./tools/terralith-gen -scale <n> -out "$PWD", write estate.chdf.hcl (estate = "behold-terralith-<n>", record_store "local" { path = ".tofu-records" }), scratch floci, choudoufu init, choudoufu apply -auto-approve, serve --env live. The greenfield stage is gauntlet-proven on the pinned image (../choudoufu/live/floci-image); at scale 1 that is 79 resources, at scale 4 about 205. Under the built-in table live-check refuses aws_route53_record (10 sites); after init it must not — assert that in the up script.

• terralith-4-adopt — the same render, then STOCK terraform init && terraform apply -auto-approve (requires terraform or tofu; the generator's versions.tf has no live block, that is the point), keep terraform.tfstate, THEN write the sidecar and choudoufu init. Serve --env live: every card unowned. The description tells the person the one command to run by hand, in the target, with the printed endpoint:

  choudoufu live-import -state=terraform.tfstate -approve
  

  and to reload. No -estate (the sidecar names it). The by-hand pattern is the bundled choudoufu demo's own (choudoufu member M4: a demo entry on the live-mv workbench, blocked on its pin (#366, choudoufu#970) #372); behold never runs the write.

Scratch discipline

Each entry's floci is behold-wb-<entry> on its own host port (4651 upward, one per entry, in the entry's spawnEnv.AWS_ENDPOINT_URL), image from ../choudoufu/live/floci-image, refused if the name exists, removed only by scripts/down.sh that the up script writes into the target. src/scratch.test.ts gets a row per boot site if it enumerates scripts; otherwise the scripts assert the name prefix themselves. Never 4566.

Scripts use ${CHOUDOUFU_BIN:-choudoufu} and the same readiness loop as example-choudoufu-estate/scripts/choudoufu-up.sh. Requirements per entry: docker, choudoufu, go, plus terraform where stock applies or estate-gen renders.

Definition of done

• behold demo --list shows every entry, ready or naming what is missing.
• just example terralith-4 serves 205 resources green; just example choudoufu-cohort-s3 serves a sidecar estate as a choudoufu member; just example terralith-4-adopt serves unowned cards, and after the by-hand import and a reload they are green. Report the actual node counts and the timings in the PR.
• Each up script is idempotent on a reused target (a second behold demo <name> restarts the serve, does not re-render over live state).
• README "Demos" gains three lines: the workbench exists, it is this checkout's, just example.

[lex00]

Merged in #392 (072480e), released in @intentius/behold@0.18.0.