@intentius/chant-lexicon-fountain 0.76.0 → 0.78.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fountain",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "type": "module",
   "description": "Fountain lexicon for chant — sandboxed agent environments, vaults, and agents as typed estate",
   "license": "Apache-2.0",
@@ -50,7 +50,7 @@
     "bundle": "tsx src/package-cli.ts"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.76.0",
+    "@intentius/chant": "^0.78.0",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   },

package/src/codegen/docs.ts

@@ -13,7 +13,7 @@ import { docsPipeline, writeDocsSite, type DocsConfig } from "@intentius/chant/c
 
 const pkgDir = dirname(dirname(dirname(fileURLToPath(import.meta.url))));
 
-const overview = `The **fountain** lexicon declares [fountain](https://github.com/BinaryBourbon/fountain)'s workload layer as typed chant resources. fountain runs coding agents in sandboxed VMs. Six kinds are declarable: \`Environment\` (sandbox baseline), \`Vault\` (env-var overrides) and \`Agent\` (a runnable agent config) are what \`fountain apply\` reconciles; \`Teammate\` (an agent seated on the team, with a thread of its own), \`Schedule\` (a cron prompt into that thread) and \`Webhook\` (where the estate's events leave it) belong to the team, schedule and webhook routes.
+const overview = `The **fountain** lexicon declares [fountain](https://github.com/managoat/fountain)'s workload layer as typed chant resources. fountain runs coding agents in sandboxed VMs. Six kinds are declarable: \`Environment\` (sandbox baseline), \`Vault\` (env-var overrides) and \`Agent\` (a runnable agent config) are what \`fountain apply\` reconciles; \`Teammate\` (an agent seated on the team, with a thread of its own), \`Schedule\` (a cron prompt into that thread) and \`Webhook\` (where the estate's events leave it) belong to the team, schedule and webhook routes.
 
 Types are generated from a pinned fountain release's OpenAPI spec, so they track the real API.
 
@@ -91,7 +91,7 @@ The output is ejectable — \`fountain apply -f\` accepts it verbatim, so adopti
 
 \`fountainApply\` parses this same YAML and sends it to fountain's bulk \`POST /api/apply\` endpoint in one request — the server reconciles by name, Environment then Vault then Agent, and resolves an agent's \`environment\` reference itself, against the manifest or the tenant's existing environments. See the Ops page for the activity's own behavior (prune, secrets, failure reporting).
 
-Bulk apply accepts those three kinds only. A \`Teammate\`, \`Schedule\` or \`Webhook\` document is emitted and is valid, and \`fountainApply\` does not send it yet: applying the three through their own routes waits on chant #2127, and on BinaryBourbon/fountain#1636 for a bulk call that covers them.
+\`fountainApply\` sends those three kinds in the bulk call. A \`Teammate\`, \`Schedule\` or \`Webhook\` document goes through its own route afterwards, matched by name (a webhook by url). fountain v0.21.0's bulk apply accepts all six kinds (fountain#1636), and \`fountainApply\` has not moved the team-side three onto it yet.
 
 ## Ownership
 

package/src/composites/composites.test.ts

@@ -5,6 +5,9 @@ import { Steward, stewardForOp, __resetStewardsForTests } from "./steward";
 import { Environment, Vault } from "../generated/index";
 import { fountainSerializer } from "../serializer";
 import type { Declarable } from "@intentius/chant";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { runtimeModelValidCheck } from "../lint/post-synth/ftn016-runtime-model-valid";
+import { acpRuntimeCommandCheck } from "../lint/post-synth/ftn023-acp-runtime-command";
 
 describe("ConciergeStack", () => {
   it("defaults to deny-all egress, no vaults, and the ownership marker", () => {
@@ -61,6 +64,22 @@ describe("Steward", () => {
   const toolchain = () => new Environment({ name: "toolchain" });
   const creds = () => new Vault({ name: "prod-creds" });
 
+  it("passes FTN016 and FTN023 now that acp is upstream's runtime, not chant's extension", () => {
+    const { agent, teammate } = Steward({
+      name: "prod-steward",
+      environment: toolchain(),
+      ops: [op("prod-watch", { cron: "*/10 * * * *" })],
+    });
+    const entities = new Map<string, Declarable>([
+      ["agent", agent as unknown as Declarable],
+      ["teammate", teammate as unknown as Declarable],
+    ]);
+    const ctx = { outputs: new Map(), entities, buildResult: { warnings: [], errors: [] } } as unknown as PostSynthContext;
+
+    expect(runtimeModelValidCheck.check(ctx)).toEqual([]);
+    expect(acpRuntimeCommandCheck.check(ctx)).toEqual([]);
+  });
+
   it("returns an acp agent, a teammate, a schedule per scheduled op, and the webhook", () => {
     const environment = toolchain();
     const vault = creds();

package/src/coverage.test.ts

@@ -44,6 +44,14 @@ describe("fountain coverage", () => {
     expect(report.unaccountedKinds).toEqual([]);
   });
 
+  it("excludes only schemas the pinned spec still has", () => {
+    // An exclusion for a schema upstream removed matches nothing and proves
+    // nothing. v0.21.0 dropped three that v0.16.0 had (#2505).
+    const schemas = (JSON.parse(spec) as { components: { schemas: Record<string, unknown> } }).components.schemas;
+    const stale = Object.keys(EXCLUDED_KINDS).filter((name) => !(name in schemas));
+    expect(stale).toEqual([]);
+  });
+
   it("flags a property upstream added that the surface lacks", () => {
     const stripped = structuredClone(surface);
     stripped.entries.Agent.props = stripped.entries.Agent.props!.filter(

package/src/coverage.ts

@@ -25,11 +25,12 @@ import { parseFountainOpenAPI, fountainShortName, MODELED_REQUEST_SCHEMAS } from
 /**
  * Request schemas with no typed resource, and why.
  *
- * Every `*Request` schema in the pinned spec is either modeled or listed here.
- * v0.16.0 describes the whole product, not just the workload layer, so most of
- * this list is one restatement of the same three reasons: it is a session and
- * not a thing, it is an account operation and not estate, or it is write-only
- * and so could never be diffed.
+ * Every `*Request` schema in the pinned spec is either modeled or listed here,
+ * and every name listed here is a schema the pinned spec has (the coverage test
+ * holds both). The spec describes the whole product, not just the workload
+ * layer, so most of this list restates three reasons: it is a session and not a
+ * thing, it is an account operation and not estate, or it is write-only and so
+ * could never be diffed.
  */
 export const EXCLUDED_KINDS: Record<string, string> = {
   // Runs, turns, and the envelope around them.
@@ -37,7 +38,15 @@ export const EXCLUDED_KINDS: Record<string, string> = {
   PromptRequest: "turn-level input inside a conversation run",
   PermissionAnswerRequest: "a human's answer to one tool card mid-run — an event on a conversation, not estate",
   TeamMessageRequest: "one turn addressed to a teammate — the run, not the seat",
-  ChatCompletionRequest: "the OpenAI-compatible inference shim; a request to a model, unrelated to estate",
+  ConversationLabelsRequest:
+    "merges labels into one conversation; a runtime action on a run, not estate",
+  ConversationReapplyRequest:
+    "swaps the Agent, Environment or Vault under a running conversation; a runtime action on a run, not estate",
+  SandboxRequest:
+    "a queued start or schedule run waiting for sandbox capacity; runtime state, and a response record despite the name",
+  PendingPermissionRequest:
+    "a permission request still open after its turn ended; runtime state on a conversation, and a response record " +
+    "despite the name. Answering it is PermissionAnswerRequest",
   ApplyRequest:
     "the envelope fountainApply builds around a manifest, not a thing anyone declares — " +
     "its contents are the Environment/Vault/Agent resources, which are modeled",
@@ -50,14 +59,19 @@ export const EXCLUDED_KINDS: Record<string, string> = {
     "every apply, or reporting it permanently unobservable. Same reason as SecretRequest",
   InferenceCredentialRequest: "a provider key, write-only for the same reason as ApiKeyRequest",
   SecretBindingRequest: "binds a stored secret to a host for the egress broker; the value behind it is write-only",
+  VaultSecretMetadataRequest:
+    "edits a stored secret's advisory expiry. The secret stays write-only; its expiry is metadata chant#2391 " +
+    "proposes surfacing as drift rather than declaring",
+  InferenceCredentialSetCreateRequest:
+    "an account-level store of provider API keys, write-only. A kind of its own if it is ever modeled; until then " +
+    "an Agent names one by uuid in inference_credential_id",
+  InferenceCredentialSetUpdateRequest: "renames an inference credential set or makes it the default; same reason as the create",
 
   // Partial updates of a modeled kind — chant declares the whole thing.
   TeamRenameRequest: "a partial update of a modeled Teammate — chant declares the full shape and applies it",
   TeamScheduleUpdateRequest: "a partial update of a modeled Schedule",
   WebhookEndpointUpdateRequest: "a partial update of a modeled Webhook",
-  TeamContactRequest: "sets a teammate's email and phone (flag team_comms) — a per-seat contact detail, not estate",
   AvatarRequest: "sets an agent's avatar image; presentation, not configuration",
-  AvatarGenerateRequest: "asks fountain to draw an avatar — a one-shot action with no resource behind it",
 
   // The account, its people, and its money.
   RegisterRequest: "account signup",
@@ -73,6 +87,8 @@ export const EXCLUDED_KINDS: Record<string, string> = {
   CreditsCheckoutRequest: "starts a Stripe checkout for credits",
   SupportReportCreateRequest: "files a support report",
   ConnectionProviderRequest: "registers an OAuth app for third-party connections; the connections themselves are per-user grants",
+  OAuthClientRequest: "registers an OAuth client app against fountain; app registration, not estate",
+  OAuthClientUpdateRequest: "renames an OAuth client or changes its redirect URIs; app registration, not estate",
   BuzzProvisionRequest: "provisions a Buzz identity for an agent — a separate product surface",
   BuzzAccessUpdateRequest: "changes who may use a Buzz identity",
 

package/src/generated/index.d.ts

@@ -4,20 +4,24 @@
 
 export declare class Agent {
   constructor(props: {
-    model: string;
     name: string;
     runtime: "acp" | "claude" | "codex" | "gemini" | "opencode";
-    /** Environments a conversation may launch this agent under instead of its own. Same shape as allowed_vault_ids: null (default) allows any environment the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own environment always passes. */
+    /** Environments a conversation may launch this agent under instead of its own (environment_id on create). Same shape as allowed_vault_ids: null (default) allows any environment the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own environment always passes. */
     allowed_environment_ids?: string[];
+    /** Credential sets a conversation may launch this agent on instead of the agent's (inference_credential_id on create). Same shape as allowed_vault_ids: null (default) allows any set the tenant owns; an empty list forbids overriding; a non-empty list is an allowlist. The agent's own set always passes. */
+    allowed_inference_credential_ids?: string[];
     /** Vaults a conversation may attach to this agent. null (default) allows any vault the tenant owns; an empty list forbids attaching any vault; a non-empty list is an allowlist. */
     allowed_vault_ids?: string[];
     description?: string;
     environment_id?: string;
+    /** The credential set this agent's conversations run on. null (default) is the account's default set, which is what every agent had before an account could hold more than one. */
+    inference_credential_id?: string;
     mcp_servers?: Record<string, unknown>;
     metadata?: Record<string, unknown>;
+    model?: string;
     /** Per-tool permission policy: a map of key to verdict, plus an optional "default" key. A key is matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); prefer a kind, because claude titles a tool call with the command it is about to run. Unset keys fall back to the default, and an unset default is auto_allow. "ask" holds the tool until a human answers it on the conversation stream, and denies if nobody does before the timeout. A conversation may narrow this at launch, never widen it. A runtime that never asks (opencode) refuses anything stricter than auto_allow with 422 permission_policy_unenforceable. */
-    permission_policy?: Record<string, "ask" | "auto_allow" | "auto_deny">;
-    /** The command line an "acp" agent speaks the Agent Client Protocol over, e.g. "chant acp". chant extension, pending BinaryBourbon/fountain#1634 — an instance without that PR rejects it at apply. */
+    permission_policy?: Record<string, "ask" | "auto_allow" | "auto_deny" | number>;
+    /** The command the acp runtime launches inside the sandbox, as a shell line resolved there (for example `chant acp`). Required when runtime is acp, and rejected on every other runtime, which resolves its own executable. A free string by design: it runs under the same isolation as an environment's setup script. */
     runtime_command?: string;
     /** Where a conversation of this agent runs by default (ADR 0023). ephemeral: a sandbox per conversation, reclaimed with it. persistent: one sandbox per agent identity (agent, environment, vault) — the agent's computer — that every conversation of that identity lands on and shares; it survives a conversation ending and is parked, not destroyed, at the ceiling. A launch may name the other with sandbox_mode on POST /api/conversations. */
     sandbox_mode?: "ephemeral" | "persistent";
@@ -45,10 +49,13 @@ export declare class Environment {
     networking_type?: "limited" | "unrestricted";
     packages?: Record<string, unknown>;
     repositories?: Repository[];
+    /** Secrets upserted with the resource at apply, as key/value pairs; fountainApply sends them as the manifest's inline `secrets` map. Values are write-only upstream and can never be read back or diffed. Write a reference that resolves at build (an env var, a secret-manager lookup), never a literal: FTN001 flags a literal here as it does anywhere else in a declaration. */
+    secrets?: { key: string; value: string }[];
     setup_script?: string;
+    /** Setup exec timeout in seconds; defaults to 120. The overall provisioning deadline still applies. */
+    setup_timeout_seconds?: number;
   });
   readonly agent_count: number;
-  readonly allowed_environment_ids: string[];
   readonly id: string;
   readonly inserted_at: string;
   readonly secret_count: number;
@@ -87,7 +94,6 @@ export declare class Teammate {
     /** Layer this vault's secrets on top. Must satisfy allowed_vault_ids. */
     vault?: Vault | string;
   });
-  readonly contact: Record<string, unknown>;
   readonly conversation: Record<string, unknown>;
   readonly last_turn: Record<string, unknown>;
   readonly presence: Record<string, unknown>;
@@ -101,6 +107,8 @@ export declare class Vault {
     name: string;
     description?: string;
     metadata?: Record<string, unknown>;
+    /** Secrets upserted with the resource at apply, as key/value pairs; fountainApply sends them as the manifest's inline `secrets` map. Values are write-only upstream and can never be read back or diffed. Write a reference that resolves at build (an env var, a secret-manager lookup), never a literal: FTN001 flags a literal here as it does anywhere else in a declaration. */
+    secrets?: { key: string; value: string }[];
   });
   readonly id: string;
   readonly inserted_at: string;

package/src/generated/index.ts

@@ -2,9 +2,9 @@
 import { createResource, createProperty } from "./runtime";
 
 export const Agent = createResource("Fountain::V1::Agent", "fountain", {"acp":"acp","avatar_media_type":"avatar_media_type","conversation_count":"conversation_count","id":"id","inserted_at":"inserted_at","updated_at":"updated_at"});
-export const Environment = createResource("Fountain::V1::Environment", "fountain", {"agent_count":"agent_count","allowed_environment_ids":"allowed_environment_ids","id":"id","inserted_at":"inserted_at","secret_count":"secret_count","updated_at":"updated_at"});
+export const Environment = createResource("Fountain::V1::Environment", "fountain", {"agent_count":"agent_count","id":"id","inserted_at":"inserted_at","secret_count":"secret_count","updated_at":"updated_at"});
 export const Schedule = createResource("Fountain::V1::Schedule", "fountain", {"agent_id":"agent_id","id":"id","inserted_at":"inserted_at","last_conversation_id":"last_conversation_id","last_error":"last_error","last_run_at":"last_run_at","next_run_at":"next_run_at","updated_at":"updated_at"});
-export const Teammate = createResource("Fountain::V1::Teammate", "fountain", {"contact":"contact","conversation":"conversation","last_turn":"last_turn","presence":"presence","preview":"preview","unread":"unread","usage_total":"usage_total"});
+export const Teammate = createResource("Fountain::V1::Teammate", "fountain", {"conversation":"conversation","last_turn":"last_turn","presence":"presence","preview":"preview","unread":"unread","usage_total":"usage_total"});
 export const Vault = createResource("Fountain::V1::Vault", "fountain", {"id":"id","inserted_at":"inserted_at","secret_count":"secret_count","updated_at":"updated_at"});
 export const Webhook = createResource("Fountain::V1::Webhook", "fountain", {"consecutive_failures":"consecutive_failures","disabled_at":"disabled_at","disabled_reason":"disabled_reason","id":"id","inserted_at":"inserted_at","status":"status","updated_at":"updated_at"});
 

package/src/generated/lexicon-fountain.json

@@ -5,9 +5,11 @@
     "lexicon": "fountain",
     "props": [
       "allowed_environment_ids",
+      "allowed_inference_credential_ids",
       "allowed_vault_ids",
       "description",
       "environment_id",
+      "inference_credential_id",
       "mcp_servers",
       "metadata",
       "model",
@@ -24,6 +26,9 @@
       "environment_id": {
         "format": "uuid"
       },
+      "inference_credential_id": {
+        "format": "uuid"
+      },
       "model": {
         "pattern": "^[a-z0-9_-]+/[a-z0-9._-]+$"
       },
@@ -68,7 +73,9 @@
       "networking_type",
       "packages",
       "repositories",
-      "setup_script"
+      "secrets",
+      "setup_script",
+      "setup_timeout_seconds"
     ],
     "propertyConstraints": {
       "name": {
@@ -80,6 +87,10 @@
           "unrestricted",
           "limited"
         ]
+      },
+      "setup_timeout_seconds": {
+        "minimum": 1,
+        "maximum": 900
       }
     }
   },
@@ -154,7 +165,8 @@
     "props": [
       "description",
       "metadata",
-      "name"
+      "name",
+      "secrets"
     ],
     "propertyConstraints": {
       "name": {

package/src/lint/audit-catalog.ts

@@ -20,8 +20,8 @@ import { fountainAuditLineage } from "./audit-lineage";
 import { applyLineage } from "@intentius/chant/audit/catalog";
 
 const FOUNTAIN_PRIMITIVES: Authority = {
-  name: "fountain — Environment, Vault, Agent, Teammate, Schedule and Webhook primitives",
-  url: "https://github.com/BinaryBourbon/fountain/blob/main/docs/primitives.md",
+  name: "fountain: Environment, Vault, Agent, Teammate, Schedule and Webhook primitives",
+  url: "https://github.com/managoat/fountain/blob/main/docs/primitives.md",
 };
 
 const OWASP_LLM_INJECTION: Authority = {
@@ -114,7 +114,7 @@ export const fountainAuditCatalog: Record<string, RuleMeta> = {
     "merge-worthy",
     "correctness",
     "Two declarations of one kind resolve to the same fountain name",
-    "fountain reconciles by name — rename one, or the second silently overwrites the first.",
+    "fountain reconciles by name, so rename one. Otherwise the second silently overwrites the first.",
   ),
   FTN020: rule(
     "FTN020",
@@ -148,6 +148,14 @@ export const fountainAuditCatalog: Record<string, RuleMeta> = {
     'Agent runtime "acp" is missing runtime_command, or another runtime carries one',
     "Pair the acp runtime with the command it speaks the protocol over, and drop the field elsewhere.",
   ),
+  FTN024: rule(
+    "FTN024",
+    "merge-worthy",
+    "correctness",
+    "Environment setup_timeout_seconds is outside 1 to 900, or not a whole number",
+    "Use an integer from 1 to 900, or omit the field for fountain's default of 120. Changing the value " +
+      "invalidates the environment's checkpoints.",
+  ),
 };
 
 // Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).

package/src/lint/post-synth/ftn016-runtime-model-valid.ts

@@ -8,11 +8,11 @@ import { propsOf } from "../../entity-props";
  * this backstops untyped construction (imported templates, hand-built
  * plans) so a typo fails the build instead of a 422 at apply.
  *
- * `acp` is the exception on both counts. It is a chant extension pending
- * BinaryBourbon/fountain#1634, and it names a process rather than a hosted
- * model: the model is whatever the command on the other end of the protocol
- * decides to use, so a `model` on an acp agent is a value nothing reads. The
- * command itself is FTN023's business.
+ * `acp` is the exception on the model. The runtime is in the spec since
+ * fountain v0.21.0, which also stopped requiring `model`, and it names a
+ * process rather than a hosted model: the model is whatever the command on the
+ * other end of the protocol decides to use, so a `model` on an acp agent is a
+ * value nothing reads. The command itself is FTN023's business.
  */
 
 const RUNTIMES = new Set(["claude", "codex", "gemini", "opencode", "acp"]);

package/src/lint/post-synth/ftn023-acp-runtime-command.ts

@@ -11,12 +11,13 @@ import { propsOf } from "../../entity-props";
  * expects to run that nothing will ever execute, which is worse than an error
  * because it looks configured.
  *
- * Both fields are chant extensions pending BinaryBourbon/fountain#1634; the
- * rule holds the shape steady until upstream enforces it.
+ * Both fields are in the spec since fountain v0.21.0, and the server refuses
+ * either half without the other at apply. The rule moves that refusal to
+ * build, where it is a diagnostic in review instead of a 422 in a run.
  */
 export const acpRuntimeCommandCheck: PostSynthCheck = {
   id: "FTN023",
-  description: 'Agent runtime "acp" requires runtime_command, and no other runtime accepts one',
+  description: "Agent runtime \"acp\" requires runtime_command, and no other runtime accepts one",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];

package/src/lint/post-synth/ftn024-setup-timeout-range.ts

@@ -0,0 +1,48 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { propsOf } from "../../entity-props";
+
+/**
+ * FTN024: an Environment's `setup_timeout_seconds` is a whole number from 1 to 900.
+ *
+ * fountain v0.21.0 declares the field as an integer with `minimum: 1` and
+ * `maximum: 900`, and defaults it to 120 when it is absent. Codegen types it as
+ * `number` and carries neither bound into validation, so without this rule a
+ * 901 or a 12.5 builds cleanly and the first anyone hears of it is a 422 at
+ * apply.
+ *
+ * A value in range is still worth a second look in review. Changing it
+ * invalidates the environment's checkpoints (recorded on chant#2391), so an
+ * edit to this field costs what an edit to `setup_script` costs.
+ */
+
+const MIN = 1;
+const MAX = 900;
+
+export const setupTimeoutRangeCheck: PostSynthCheck = {
+  id: "FTN024",
+  description: "Environment setup_timeout_seconds must be an integer from 1 to 900",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== "Fountain::V1::Environment") continue;
+      const timeout = propsOf(entity).setup_timeout_seconds;
+      if (timeout === undefined || timeout === null) continue;
+
+      if (typeof timeout !== "number" || !Number.isInteger(timeout) || timeout < MIN || timeout > MAX) {
+        diagnostics.push({
+          checkId: "FTN024",
+          severity: "error",
+          message:
+            `Environment "${name}" setup_timeout_seconds ${JSON.stringify(timeout)} is not an integer ` +
+            `from ${MIN} to ${MAX}; fountain refuses it at apply`,
+          entity: name,
+          lexicon: "fountain",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/index.ts

@@ -12,6 +12,7 @@ import { scheduleCronSyntaxCheck } from "./ftn020-schedule-cron-syntax";
 import { typedReferencesResolveCheck } from "./ftn021-typed-references-resolve";
 import { webhookUrlPublicHttpsCheck } from "./ftn022-webhook-url-public-https";
 import { acpRuntimeCommandCheck } from "./ftn023-acp-runtime-command";
+import { setupTimeoutRangeCheck } from "./ftn024-setup-timeout-range";
 
 export const postSynthChecks: PostSynthCheck[] = [
   networkingExplicitCheck,
@@ -26,4 +27,5 @@ export const postSynthChecks: PostSynthCheck[] = [
   typedReferencesResolveCheck,
   webhookUrlPublicHttpsCheck,
   acpRuntimeCommandCheck,
+  setupTimeoutRangeCheck,
 ];

package/src/lint/post-synth/post-synth.test.ts

@@ -13,6 +13,7 @@ import { scheduleCronSyntaxCheck } from "./ftn020-schedule-cron-syntax";
 import { typedReferencesResolveCheck } from "./ftn021-typed-references-resolve";
 import { webhookUrlPublicHttpsCheck } from "./ftn022-webhook-url-public-https";
 import { acpRuntimeCommandCheck } from "./ftn023-acp-runtime-command";
+import { setupTimeoutRangeCheck } from "./ftn024-setup-timeout-range";
 
 function ctx(entities: Record<string, Record<string, unknown>>): PostSynthContext {
   const map = new Map<string, Declarable>();
@@ -280,3 +281,26 @@ describe("FTN023 acp-runtime-command", () => {
     ).toHaveLength(0);
   });
 });
+
+describe("FTN024 setup-timeout-range", () => {
+  const env = (setup_timeout_seconds: unknown) =>
+    ctx({ e: { entityType: ENV, name: "e", networking_type: "limited", setup_timeout_seconds } });
+
+  it.each([0, 901, 12.5, -1, "120"])("errors on %j", (value) => {
+    const diags = setupTimeoutRangeCheck.check(env(value));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("FTN024");
+    expect(diags[0].message).toContain("1 to 900");
+  });
+
+  it.each([1, 120, 900])("is silent on %j", (value) => {
+    expect(setupTimeoutRangeCheck.check(env(value))).toHaveLength(0);
+  });
+
+  it("is silent when the field is absent, and on other kinds", () => {
+    expect(setupTimeoutRangeCheck.check(ctx({ e: { entityType: ENV, name: "e" } }))).toHaveLength(0);
+    expect(
+      setupTimeoutRangeCheck.check(ctx({ v: { entityType: VAULT, name: "v", setup_timeout_seconds: 901 } })),
+    ).toHaveLength(0);
+  });
+});

package/src/lsp/hover.test.ts

@@ -46,8 +46,15 @@ describe("LSP hover", () => {
     expect(hover(ctx("Webhook"))?.contents).toContain("RFC1918");
   });
 
-  it("says the acp runtime is a chant extension pending upstream", () => {
-    expect(hover(ctx("Agent"))?.contents).toContain("BinaryBourbon/fountain#1634");
+  it("describes the acp runtime without calling it an extension", () => {
+    const agent = hover(ctx("Agent"))?.contents;
+    expect(agent).toContain("runtime_command");
+    expect(agent).toContain("FTN023");
+    expect(agent).not.toContain("#1634");
+  });
+
+  it("points an Environment's setup timeout at FTN024", () => {
+    expect(hover(ctx("Environment"))?.contents).toContain("FTN024");
   });
 
   it("marks property types as non-declarable", () => {

package/src/lsp/hover.ts

@@ -12,7 +12,9 @@ const KIND_NOTES: Record<string, string> = {
   Environment:
     "Sandbox baseline — packages, repositories, env_vars, secrets, networking.\n\n" +
     "`networking_type: limited` restricts egress to `networking_config.allowed_hosts`; " +
-    "an empty list denies all egress. `unrestricted` is open — FTN010/FTN011 flag both silence and openness.",
+    "an empty list denies all egress. `unrestricted` is open — FTN010/FTN011 flag both silence and openness.\n\n" +
+    "`setup_timeout_seconds` is an integer from 1 to 900 (default 120); FTN024 checks the range, " +
+    "and changing it invalidates the environment's checkpoints.",
   Vault:
     "Env-var overrides attached at conversation create. Vault values win on key " +
     "collision with the environment, silently — FTN014 surfaces the shadowing in review.",
@@ -20,9 +22,9 @@ const KIND_NOTES: Record<string, string> = {
     "A runnable agent config bound to one Environment. `allowed_vault_ids`: " +
     "`null` allows any tenant vault, `[]` forbids all, a list is an allowlist — " +
     "set `[]` when the reviewed environment must not be overridable at spawn.\n\n" +
-    "`runtime: \"acp\"` with `runtime_command` is a chant extension pending " +
-    "BinaryBourbon/fountain#1634; FTN023 keeps the pair together and FTN016 " +
-    "rejects a model on it.",
+    "`runtime: \"acp\"` launches `runtime_command` inside the sandbox and speaks " +
+    "the Agent Client Protocol to it. FTN023 keeps the pair together and FTN016 " +
+    "rejects a model on it, since the command picks its own.",
   Teammate:
     "An Agent seated on the team, with a thread of its own. `agent` is a typed " +
     "reference; `environment` and `vault` override the agent's own for this " +

package/src/plugin.test.ts

@@ -41,7 +41,7 @@ describe("fountain plugin", () => {
 
   it("exposes every post-synth check and lint rule", () => {
     expect(fountainPlugin.lintRules?.()).toHaveLength(1);
-    expect(fountainPlugin.postSynthChecks?.()).toHaveLength(12);
+    expect(fountainPlugin.postSynthChecks?.()).toHaveLength(13);
   });
 
   it("carries audit metadata for every rule it ships", () => {

package/src/serializer.test.ts

@@ -253,8 +253,8 @@ describe("fountain serializer", () => {
     const [runnable, seat, cadence] = documents(out);
     expect(seat.spec.agent).toBe("steward");
     expect(cadence.spec.teammate).toBe("steward-seat");
-    // The ACP extension survives the round trip — an instance with
-    // BinaryBourbon/fountain#1634 gets both halves or neither.
+    // The acp pair survives the round trip, so the instance gets both
+    // halves or neither.
     expect(runnable.spec.runtime_command).toBe("chant acp");
   });
 

package/src/skills/chant-fountain-ops.md

@@ -125,7 +125,8 @@ The second posts `chant run <op>` back onto the steward's thread, with
 now-resolved fact.
 
 `--durable-requests` (answering fountain's own permission card instead) is
-refused by name: it needs BinaryBourbon/fountain#1635, which has not shipped.
+refused by name: it needs fountain#1635's request-answer path, which fountain
+v0.21.0 carries and chant does not use yet (chant#2391).
 
 ## When the steward is busy
 
@@ -158,7 +159,7 @@ success nobody saw.
 
 ## Two upstream caveats
 
-- `runtime: "acp"` with `runtime_command` is BinaryBourbon/fountain#1634 and is
-  not in v0.16.0. An instance without it rejects the pair at apply.
-- Bulk apply covering the team-side kinds is BinaryBourbon/fountain#1636. Until
-  then they go through their own routes, which is what `fountainApply` does.
+- `runtime: "acp"` with `runtime_command` needs fountain v0.21.0 or later. An
+  older instance rejects the pair at apply.
+- Bulk apply covering the team-side kinds is fountain#1636. Until chant uses it,
+  they go through their own routes, which is what `fountainApply` does.

package/src/skills/chant-fountain-secrets.md

@@ -11,7 +11,7 @@ user-invocable: true
 Everything materialized into a fountain sandbox must be presumed exfiltrated once untrusted agent code runs. Order of preference:
 
 1. **`${VAR}` substitution references** in agent config (MCP server env, system prompts). Resolved at spawn from the merged environment + vault sets. Never a value in source.
-2. **Environment secrets** (`spec.secrets`) — encrypted at rest, write-only over the API (values are never returned once stored). `fountainApply` sends them inline with the rest of the resource in the bulk apply request, and the server upserts them through the encrypted envelope path; a changed value cannot be detected, only overwritten.
+2. **Environment and Vault secrets** (`spec.secrets`), typed on both kinds as `secrets: { key: string; value: string }[]`. Encrypted at rest, write-only over the API (values are never returned once stored). Write the value as a reference your build resolves, not the secret itself. `fountainApply` sends them inline with the rest of the resource in the bulk apply request, and the server upserts them through the encrypted envelope path; a changed value cannot be detected, only overwritten.
 3. **`env_vars`** — plaintext config only. FTN012 errors on credential-shaped keys or values here.
 
 Never put a literal credential anywhere in a declaration: FTN001 catches known shapes (AWS keys, GitHub/Slack tokens, `sk-`/`ftn_` keys, private key material) at the AST; FTN015 errors on secret-shaped MCP env keys that are not `${VAR}` references.
@@ -26,4 +26,4 @@ FTN013 warns when an agent references `${VAR}` and its declared environment has
 
 ## Round-trips and their limits
 
-`chant import --from` exports live resources but never secrets: values are write-only upstream, and secret keys are not on the typed request surface. Re-declare imported environments' secrets through your secret provider. Upstream discussion of a reference-based model that would fix this: BinaryBourbon/fountain#148.
+`chant import --from` exports live resources but never secrets: values are write-only upstream, so there is nothing to read back into `secrets`. Re-declare imported environments' secrets through your secret provider. Upstream discussion of a reference-based model that would fix this: BinaryBourbon/fountain#148.

package/src/skills/chant-fountain.md

@@ -8,7 +8,7 @@ user-invocable: true
 
 ## What this lexicon covers
 
-[fountain](https://github.com/BinaryBourbon/fountain) runs coding agents in sandboxed VMs. Six kinds are declarable, and this lexicon types all of them. `Environment` (sandbox baseline), `Vault` (env-var overrides) and `Agent` (a runnable agent config) are the workload layer; `Teammate` (an agent seated on the team, with a thread of its own), `Schedule` (a cron prompt into that thread) and `Webhook` (where the estate's events leave it) are the team, schedule and webhook routes. Conversations are runs, not resources: start them with the `fountainRun` op, never declare them.
+[fountain](https://github.com/managoat/fountain) runs coding agents in sandboxed VMs. Six kinds are declarable, and this lexicon types all of them. `Environment` (sandbox baseline), `Vault` (env-var overrides) and `Agent` (a runnable agent config) are the workload layer; `Teammate` (an agent seated on the team, with a thread of its own), `Schedule` (a cron prompt into that thread) and `Webhook` (where the estate's events leave it) are the team, schedule and webhook routes. Conversations are runs, not resources: start them with the `fountainRun` op, never declare them.
 
 The source of truth is the TypeScript in `src/`. `chant build` serializes it to fountain's own manifest YAML (ejectable — `fountain apply -f` accepts it verbatim). `fountainApply` sends that same YAML to fountain's bulk `POST /api/apply` endpoint in one request: create-if-new, update-by-name, opt-in owned-only prune keyed on the `managed-by: chant` metadata marker. Bulk apply covers Environment, Vault and Agent only — a Teammate, Schedule or Webhook document is emitted and valid, and applying it through its own route waits on chant #2127.
 
@@ -64,6 +64,6 @@ What a client sees:
 - A run that stops at an unapproved gate replies with the pending fact and the `chant approve <op> <gate>` line, and the turn ends. The gate is a fact on chant's ledger, not a wait — the next run re-evaluates it.
 - `session/cancel` aborts the in-flight step, runs the op's `onFailure` phases, and ends the turn `cancelled`.
 
-`--durable-requests` turns the gated reply into a `session/request_permission` with `allow_once`/`reject_once` and ends the turn `waiting`; the client answers on a later prompt carrying `_meta.chant.permission`, which records the resolution and re-runs. It is off by default because a request that outlives a turn needs BinaryBourbon/fountain#1635.
+`--durable-requests` turns the gated reply into a `session/request_permission` with `allow_once`/`reject_once` and ends the turn `waiting`; the client answers on a later prompt carrying `_meta.chant.permission`, which records the resolution and re-runs. It is off by default because a request that outlives a turn needs fountain#1635, which v0.21.0 carries and chant does not answer through yet (chant#2391).
 
 The server does not redact. A step's output reaches the thread verbatim and fountain redacts secrets on the way in; chant never reads or prints the environment it was spawned with.