feat(terraform): render an estate chant read — types as kinds, roots as boxes, and a decision about what is a card (#379, #380, #382)

[lex00]

Closes #379, #380, #382. Child work of #378; #381 was answered and closed first, and its finding shaped this.

The starting point

behold serve already rendered a Terraform estate, because chant's terraform lexicon reads the estate's own HCL and a project using it is a chant project. It was just unreadable: 247 nodes, every card titled Terraform::Resource with a generic glyph, one box, and 108 variables plus 53 outputs plus 14 terraform blocks competing with 43 resources for the canvas.

Three passes

pass	issue	what it does
normalizeTerraformNodes	#379	resource type out of attrs.address into kind, block class into attrs.block; a data source gains reads
groupTerraformByRoot	#380	roots become the boxes; detects upstream grouping and retires itself when chant#2266 lands
filterTerraformCards	#382	what is a card, with a note saying what was left out

All guarded on hasTerraformEntities, so a chant, k8s or choudoufu estate gets the identical object back — asserted.

#382's decision, written into AGENTS.md so the next lens can find it:

tier	blocks	why
default	resource, data, module	the estate
detail 3	+ output, variable	its interface
never	terraform, provider, locals	settings

One pack, two producers. render.ts registered the terraform lexicon for carveCardFields, and a read block has no score. It now dispatches: carve node by score, read block by block. Neither producer had to change lexicon, which matters — a carve node and a read block are both Terraform and should not disagree about what they are.

No invented edges. A stock estate has none until chant#2265. #381 measured the one relationship that looked derivable and refused it; a data source states what it reads as a row (reads name ${var.boundary_name}), interpolation unresolved.

Verified against real output

Two recorded chant graph --format ir documents from the published lexicon 0.59.0, provenance in the test files: behold's own example-carve/legacy-tf as one root (29 nodes, all seven entity kinds), and water park's baseline plus waterpark-runner as two roots at detail 3 (30 nodes, the cross-root read). Served for real:

detail=2   4 cards   boxes {baseline: 1, runner: 3}   kinds aws_iam_policy ×2, aws_ecr_repository, module
           note: showing the estate — 11 variables, 9 outputs, 3 terraform blocks,
                 2 locals blocks, 1 provider not drawn (outputs and variables appear at detail 3 …)
detail=3  24 cards   note drops the interface line; the data card reads "name ${var.boundary_name}"
logical=1  4 cards   byContainer {root baseline: 1, root runner: 3}

Tests

just check green: 88 files, 1718 tests. terraform-lens.test.ts (18) covers each pass, idempotence, an unknown future entity kind left untouched, a non-Terraform estate byte-identical, the elision arithmetic and its wording, the pack's dispatch, and the lens. terraform-route.test.ts (4) drives /api/graph at both details and through the logical lens with the chant shell-out mocked, and asserts a k8s estate is unaffected.

🤖 Generated with Claude Code

https://claude.ai/code/session_0124XP1LJTZxgJRy7Dh1UfXt