@intentius/chant-lexicon-gitlab 0.56.0 → 0.58.0

package/dist/components/generate-op-pipeline.d.ts

@@ -3,10 +3,12 @@
  *
  * The Op counterpart to `./generate-pipeline.ts` (#563): that module
  * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
- * synthesizes a cron-triggered job per stateless Op — the CI-native
- * alternative to a Temporal `TemporalSchedule` for downstream projects that
- * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
- * accept an optional `schedule` precisely for this).
+ * synthesizes a cron-triggered job per stateless Op. An Op's cadence is an
+ * `OpSchedule` on the Op itself (`packages/core/src/op/types.ts`),
+ * runtime-neutral data each reader interprets; this module is the reader that
+ * turns it into a GitLab pipeline schedule (`WorkflowAuditOp`/
+ * `PipelineAuditOp`/`ReconcileOp` all accept an optional `schedule` precisely
+ * for this).
  *
  * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
  * cron at all — a schedule is a project-level object (Settings → CI/CD →

package/dist/components/generate-op-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CA6CxB"}
+{"version":3,"file":"generate-op-pipeline.d.ts","sourceRoot":"","sources":["../../src/components/generate-op-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EACV,wBAAwB,IAAI,uBAAuB,EAGnD,gBAAgB,IAAI,sBAAsB,EAC1C,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,CAAC;AAmBhE;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EAAE,EACtB,OAAO,GAAE,uBAA4B,GACpC,sBAAsB,CAoDxB"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAQxC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAOxC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAG7D,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAIjC,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACnI,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGtI,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpF,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGzH,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "2d555a71e6c5f87541933dc5961f4d8ee115b98a3113d48c7368362e217c7e44",
+    "manifest.json": "35158c32b55ed8f86ec453b7575d06fd8005641a5edb2ad972f0f4cf06fccd7e",
     "meta.json": "931fc3246a55645b1493080bbeb160e5d205e42349e8bdca96ca243adb5f0da3",
     "types/index.d.ts": "5cd2e99f135a929b72bdd822d00d780d39b1cd407ba0cfb3d511c7ac9d667b58",
     "rules/artifact-no-expiry.ts": "3f3cabf9792cbf8207e53a25f506715466b19ec25e9c3b4d0d77fed6b2eb4542",
@@ -55,5 +55,5 @@
     "skills/chant-gitlab-migrate.md": "4853d04980560b379e5b0f7267dcb0a1e5d5879cb9e9931681ce76b2a5fe69d8",
     "skills/chant-gitlab-patterns.md": "6d9a44e9e8de4c3820be9d65381b0d2ede4cb3626aaaf0011e21838a9fbf556e"
   },
-  "composite": "23a82eb88eb182226439ef2d6a90df9a6e2fa6552f1788eff10ae340482de92f"
+  "composite": "59706e7a6edf95b2ecec5fe2220d0899b0282322ef921583a940a03fb623e7c0"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAEvI,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6CvD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAA0E,KAAK,QAAQ,EAAgB,MAAM,gCAAgC,CAAC;AAGrJ,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA6CvD,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const gitlabAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CA+DxD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "gitlab",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "chantVersion": ">=0.1.0",
   "namespace": "GitLab",
   "intrinsics": [

package/dist/op/activities/gitlab.d.ts

@@ -9,7 +9,7 @@ export interface GitlabPipelineArgs {
 /**
  * Trigger a GitLab CI pipeline and wait for it to complete successfully.
  * Requires `glab` CLI authenticated in the environment.
- * Uses longInfra profile — 20m timeout, heartbeat every poll.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export declare function gitlabPipeline(args: GitlabPipelineArgs, signal?: AbortSignal): Promise<void>;
 //# sourceMappingURL=gitlab.d.ts.map

package/dist/op/activities/gitlab.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gitlab.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAsClG"}
+{"version":3,"file":"gitlab.d.ts","sourceRoot":"","sources":["../../../src/op/activities/gitlab.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAqClG"}

package/dist/op/activities/index.d.ts

@@ -1,10 +1,11 @@
 /**
  * gitlab Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `gitlab` lexicon. `gitlabPipeline` triggers a
- * pipeline over the GitLab CLI with heartbeat/retry semantics; relocated from the
- * temporal lexicon (#809) so gitlab's imperative activity lives with its product.
- * The `gitlabPipeline` step builder stays in core, re-exported from the temporal
- * Op-authoring barrel like the other core builders.
+ * pipeline over the GitLab CLI and polls it to completion under the step's
+ * profile; relocated from the hosting lexicon (#809) so gitlab's imperative
+ * activity lives with its product. The `gitlabPipeline` step builder stays in
+ * core and reaches authors through `@intentius/chant/op` like the other core
+ * builders.
  */
 export { gitlabPipeline } from "./gitlab.js";
 export type { GitlabPipelineArgs } from "./gitlab.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC"}

package/dist/op/builders.d.ts

@@ -7,12 +7,11 @@
  * `./activities/gitlab.ts`. `opts`'s type below IS `GitlabPipelineArgs`
  * itself (via `Omit`/`WithStepRefs`) — never a hand-restated mirror.
  *
- * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`, re-exported from
- * `@intentius/chant-lexicon-temporal`) is UNCHANGED and produces a
- * byte-identical `ActivityStep` for the same inputs — purely additive, and
- * deliberately not swapped into the temporal barrel (see
+ * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`) is UNCHANGED and
+ * produces a byte-identical `ActivityStep` for the same inputs — purely
+ * additive, and deliberately not swapped into core's barrel (see
  * `lexicons/k8s/src/op/builders.ts`'s module doc for why: that would make
- * temporal depend on this package at runtime). An author who wants the typed
+ * core depend on this package at runtime). An author who wants the typed
  * surface imports it from here — `@intentius/chant-lexicon-gitlab`.
  */
 import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";

package/dist/op/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,KACzG,iBAGF,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,KACzG,iBAGF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-gitlab",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "GitLab CI lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -67,8 +67,8 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.56.0",
-    "@intentius/chant-lexicon-github": "^0.56.0",
+    "@intentius/chant": "^0.58.0",
+    "@intentius/chant-lexicon-github": "^0.58.0",
     "typescript": "^5.9.3"
   },
   "peerDependenciesMeta": {

package/src/components/generate-op-pipeline.test.ts

@@ -70,6 +70,18 @@ describe("generateGitlabOpPipeline: one file, one job per scheduled Op", () => {
   });
 });
 
+describe("generateGitlabOpPipeline: no pull_request/push event model (#2084)", () => {
+  test("a pull_request trigger throws a clear error instead of silently ignoring it", () => {
+    const specs: ScheduledOpSpec[] = [{ name: "tf-plan", trigger: { kind: "pull_request" } }];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(/pull_request.*GitLab has no pull_request\/push event model/s);
+  });
+
+  test("a push trigger throws a clear error instead of silently ignoring it", () => {
+    const specs: ScheduledOpSpec[] = [{ name: "tf-apply", trigger: { kind: "push" } }];
+    expect(() => generateGitlabOpPipeline(specs)).toThrow(/push.*GitLab has no pull_request\/push event model/s);
+  });
+});
+
 describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit, not per-job", () => {
   test("runCommand/beforeScript/extraScript apply uniformly across every job", () => {
     const specs: ScheduledOpSpec[] = [
@@ -77,7 +89,7 @@ describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit
       { name: "prod-reconcile", schedule: "0 * * * *" },
     ];
     const result = generateGitlabOpPipeline(specs, {
-      runCommand: ["chant", "run", "{name}", "--temporal"],
+      runCommand: ["chant", "run", "{name}", "--json"],
       beforeScript: ["npm ci"],
       extraScript: ["echo done"],
     });
@@ -87,7 +99,7 @@ describe("generateGitlabOpPipeline: a cross-cutting change is one generator edit
       const job = parsed[spec.name] as Record<string, unknown>;
       const script = job.script as string[];
       expect(script[0]).toBe("npm ci");
-      expect(script[1]).toContain("--temporal");
+      expect(script[1]).toContain("--json");
       expect(script[2]).toBe("echo done");
     }
   });

package/src/components/generate-op-pipeline.ts

@@ -3,10 +3,12 @@
  *
  * The Op counterpart to `./generate-pipeline.ts` (#563): that module
  * synthesizes a deploy-time component graph as one `.gitlab-ci.yml`; this one
- * synthesizes a cron-triggered job per stateless Op — the CI-native
- * alternative to a Temporal `TemporalSchedule` for downstream projects that
- * don't run Temporal (`WorkflowAuditOp`/`PipelineAuditOp`/`ReconcileOp` all
- * accept an optional `schedule` precisely for this).
+ * synthesizes a cron-triggered job per stateless Op. An Op's cadence is an
+ * `OpSchedule` on the Op itself (`packages/core/src/op/types.ts`),
+ * runtime-neutral data each reader interprets; this module is the reader that
+ * turns it into a GitLab pipeline schedule (`WorkflowAuditOp`/
+ * `PipelineAuditOp`/`ReconcileOp` all accept an optional `schedule` precisely
+ * for this).
  *
  * Unlike GitHub Actions' per-workflow `on.schedule`, GitLab has no in-file
  * cron at all — a schedule is a project-level object (Settings → CI/CD →
@@ -27,6 +29,7 @@
  */
 
 import { emitYAML } from "@intentius/chant/yaml";
+import { resolveOpTrigger } from "@intentius/chant/lexicon";
 import type {
   ComponentPipelineOptions as GenerateGitlabOpOptions,
   OpFindingMode,
@@ -49,9 +52,9 @@ const STAGE = "scheduled-ops";
 const SELECTOR_VAR = "CHANT_SCHEDULED_OP";
 
 /** One setup line per Op in the generated file's header comment. */
-function setupLine(spec: ScheduledOpSpec, jobName: string, mode: OpFindingMode): string {
+function setupLine(spec: ScheduledOpSpec, cron: string, jobName: string, mode: OpFindingMode): string {
   const tokenNote = mode === "report" ? "" : " — needs a GITLAB_TOKEN CI/CD variable (masked, scope: api)";
-  return `#   ${jobName}: cron "${spec.schedule}", ${SELECTOR_VAR}="${spec.name}", finding-mode ${mode}${tokenNote}`;
+  return `#   ${jobName}: cron "${cron}", ${SELECTOR_VAR}="${spec.name}", finding-mode ${mode}${tokenNote}`;
 }
 
 /**
@@ -83,9 +86,16 @@ export function generateGitlabOpPipeline(
 
   for (const spec of ops) {
     const findingMode = spec.findingMode ?? "report";
+    const trigger = resolveOpTrigger(spec);
+    if (trigger.kind !== "cron") {
+      throw new Error(
+        `Scheduled Op "${spec.name}" has a "${trigger.kind}" trigger, but GitLab has no pull_request/push event model ` +
+          `(#2084) — only a project-level Pipeline Schedule (cron). Give it a cron trigger, or generate it for github/forgejo instead.`,
+      );
+    }
     const jobName = toJobName(spec.name);
-    jobs.push({ jobName, op: spec.name, schedule: spec.schedule, findingMode });
-    headerLines.push(setupLine(spec, jobName, findingMode));
+    jobs.push({ jobName, op: spec.name, trigger, findingMode });
+    headerLines.push(setupLine(spec, trigger.schedule, jobName, findingMode));
 
     const runParts = runCommand.map((part) => part.replace("{name}", spec.name));
     const script = [...beforeScript, runParts.join(" "), ...extraScript];

package/src/components/generate-pipeline.test.ts

@@ -186,7 +186,7 @@ describe("generateGitlabPipeline: a cross-cutting change is one generator edit,
   test("changing the trigger command (runCommand) updates every job's script uniformly", () => {
     const components = pilotComponents();
     const result = generateGitlabPipeline(components, {
-      runCommand: ["chant", "run", "--components", "{name}", "--env", "staging", "--temporal"],
+      runCommand: ["chant", "run", "--components", "{name}", "--env", "staging", "--verbose"],
     });
     const parsed = parseYAML(result.yaml);
 
@@ -194,7 +194,7 @@ describe("generateGitlabPipeline: a cross-cutting change is one generator edit,
       const script = (parsed[job.jobName] as Record<string, unknown>).script as string[];
       // The runCommand prefix reflects in every job; output-threading flags
       // (--seed-outputs/--dump-outputs) may be appended per the dependency graph.
-      expect(script[0].startsWith(`chant run --components ${job.component} --env staging --temporal`)).toBe(true);
+      expect(script[0].startsWith(`chant run --components ${job.component} --env staging --verbose`)).toBe(true);
     }
   });
 

package/src/index.ts

@@ -7,9 +7,8 @@ export { gitlabPlugin } from "./plugin";
 // Typed Op step-builder wrapper (chant #1288 Stage 2) — gitlabPipeline with
 // authoring-time types derived from this lexicon's own GitlabPipelineArgs
 // (see lexicons/k8s/src/op/builders.ts's module doc for why this lives here
-// rather than in core or the temporal barrel). Opt-in:
-// `@intentius/chant-lexicon-temporal`'s same-named export is core's original
-// untyped builder, unchanged, for cloud-agnostic authoring.
+// rather than in core). Opt-in: `@intentius/chant/op`'s same-named export is
+// core's original untyped builder, unchanged, for cloud-agnostic authoring.
 export { gitlabPipeline } from "./op/builders";
 
 // Intrinsics

package/src/lint/audit-catalog.ts

@@ -2,7 +2,8 @@
  * The gitlab lexicon's chant audit catalog — metadata for its post-synth rules
  * (WGL GitLab CI rules). Contributed via gitlabPlugin.auditCatalog() (#687).
  */
-import { auditRule, GH_INJECTION, GH_OIDC, GH_PWN, GH_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+import { auditRule, GH_INJECTION, GH_OIDC, GH_PWN, GH_SECRETS, SCORECARD_PINNED, type RuleMeta, applyLineage } from "@intentius/chant/audit/catalog";
+import { gitlabAuditLineage } from "./audit-lineage";
 
 export const gitlabAuditCatalog: Record<string, RuleMeta> = {
   WGL010: auditRule("WGL010", "merge-worthy", "guidance", "Job references an undefined stage", "Add the stage to `stages:` or fix the job's `stage:`.", { category: "correctness" }),
@@ -50,3 +51,6 @@ export const gitlabAuditCatalog: Record<string, RuleMeta> = {
   WGL049: auditRule("WGL049", "report-only", "guidance", "Dependency install without a cache", "Add a `cache:` covering the dependency directory.", { category: "efficiency" }),
   WGL050: auditRule("WGL050", "report-only", "guidance", "Merge-request job missing interruptible", "Add `interruptible: true` so a superseded pipeline can be cancelled.", { category: "efficiency" }),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(gitlabAuditCatalog, gitlabAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,73 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const gitlabAuditLineage: Record<string, Lineage[]> = {
+  WGL010: [
+    { tool: "gitlab-docs", rule: "stage: supported values are the default stages or stages listed in `stages`", url: "https://docs.gitlab.com/ci/yaml/#stage", relation: "equivalent" },
+  ],
+  WGL012: [
+    { tool: "gitlab-docs", rule: "Deprecated keywords (only/except, globally-defined image/services/cache/before_script/after_script)", url: "https://docs.gitlab.com/ci/yaml/deprecated_keywords/#only--except", relation: "equivalent" },
+  ],
+  WGL013: [
+    { tool: "gitlab-docs", rule: "Error: 'job' does not exist in the pipeline (needs)", url: "https://docs.gitlab.com/ci/yaml/needs/#error-job-does-not-exist-in-the-pipeline", relation: "equivalent" },
+  ],
+  WGL014: [
+    { tool: "gitlab-docs", rule: "extends: supported values are the name(s) of another job in the pipeline", url: "https://docs.gitlab.com/ci/yaml/#extends", relation: "equivalent" },
+  ],
+  WGL016: [
+    { tool: "gitlab-docs", rule: "CI/CD variable security (secrets belong in masked/protected variables, not in .gitlab-ci.yml)", url: "https://docs.gitlab.com/ci/variables/#cicd-variable-security", relation: "overlaps" },
+  ],
+  WGL023: [
+    { tool: "gitlab-docs", rule: "Pipeline warning: Job may allow multiple pipelines to run for a single action (final `when` rule without conditions)", url: "https://docs.gitlab.com/ci/debugging/#job-may-allow-multiple-pipelines-to-run-for-a-single-action-warning", relation: "overlaps" },
+  ],
+  WGL024: [
+    { tool: "gitlab-docs", rule: "allow_failure default: true for manual jobs, false for rules:when: manual", url: "https://docs.gitlab.com/ci/yaml/#allow_failure", relation: "overlaps" },
+  ],
+  WGL025: [
+    { tool: "gitlab-docs", rule: "cache:key: all jobs with `cache` but no `cache:key` share the `default` cache", url: "https://docs.gitlab.com/ci/yaml/#cachekey", relation: "overlaps" },
+  ],
+  WGL026: [
+    { tool: "gitlab-docs", rule: "Docker-in-Docker with TLS enabled (recommended); DOCKER_TLS_CERTDIR", url: "https://docs.gitlab.com/ci/docker/docker_in_docker/#docker-in-docker-with-tls-enabled-in-the-docker-executor-recommended", relation: "overlaps" },
+  ],
+  WGL029: [
+    { tool: "gitlab-docs", rule: "include:project ref guidance: use a specific SHA hash, protected branch/tag rules", url: "https://docs.gitlab.com/ci/yaml/#includeproject", relation: "overlaps" },
+    { tool: "gitlab-docs", rule: "CI/CD component security best practices: use pinned versions (commit SHA preferred), avoid `latest`", url: "https://docs.gitlab.com/ci/components/#for-component-users", relation: "overlaps" },
+  ],
+  WGL030: [
+    { tool: "gitlab-docs", rule: "include:remote: treat as a third-party dependency; verify integrity with include:integrity", url: "https://docs.gitlab.com/ci/yaml/#includeremote", relation: "overlaps" },
+  ],
+  WGL031: [
+    { tool: "gitlab-docs", rule: "Use checksum to keep your image secure (image@sha256:digest)", url: "https://docs.gitlab.com/ci/docker/using_docker_images/#use-checksum-to-keep-your-image-secure", relation: "overlaps" },
+  ],
+  WGL033: [
+    { tool: "gitlab-docs", rule: "id_tokens: the required `aud` sub-keyword configures the aud claim", url: "https://docs.gitlab.com/ci/yaml/#id_tokens", relation: "overlaps" },
+  ],
+  WGL035: [
+    { tool: "poutine", rule: "injection", url: "https://boostsecurityio.github.io/poutine/rules/injection/", relation: "overlaps" },
+  ],
+  WGL038: [
+    { tool: "gitlab-docs", rule: "Protect a CI/CD variable (available only to protected branches/tags)", url: "https://docs.gitlab.com/ci/variables/#protect-a-cicd-variable", relation: "overlaps" },
+    { tool: "gitlab-docs", rule: "Merge request pipelines from forked projects can steal secrets in the parent project", url: "https://docs.gitlab.com/ci/pipelines/merge_request_pipelines/#use-with-forked-projects", relation: "overlaps" },
+  ],
+  WGL039: [
+    { tool: "gitlab-docs", rule: "CI/CD variable security: accidental-leak-job example (echo of $PASSWORD); mask sensitive variables", url: "https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable", relation: "overlaps" },
+  ],
+  WGL044: [
+    { tool: "gitlab-docs", rule: "artifacts:public (default true: downloadable by anonymous users in public pipelines)", url: "https://docs.gitlab.com/ci/yaml/#artifactspublic", relation: "overlaps" },
+  ],
+  WGL046: [
+    { tool: "gitlab-docs", rule: "Cache key names: protected and non-protected branches do not share the cache by default", url: "https://docs.gitlab.com/ci/caching/#cache-key-names", relation: "overlaps" },
+  ],
+  WGL047: [
+    { tool: "poutine", rule: "unverified_script_exec", url: "https://boostsecurityio.github.io/poutine/rules/unverified_script_exec/", relation: "equivalent" },
+  ],
+  WGL048: [
+    { tool: "gitlab-docs", rule: "Use pipeline names (workflow:name)", url: "https://docs.gitlab.com/ci/debugging/#use-pipeline-names", relation: "overlaps" },
+  ],
+};

package/src/op/activities/gitlab.ts

@@ -1,6 +1,6 @@
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
-import { safeHeartbeat, sleep } from "@intentius/chant/op";
+import { sleep } from "@intentius/chant/op";
 
 const execAsync = promisify(exec);
 
@@ -16,7 +16,7 @@ export interface GitlabPipelineArgs {
 /**
  * Trigger a GitLab CI pipeline and wait for it to complete successfully.
  * Requires `glab` CLI authenticated in the environment.
- * Uses longInfra profile — 20m timeout, heartbeat every poll.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export async function gitlabPipeline(args: GitlabPipelineArgs, signal?: AbortSignal): Promise<void> {
   const ref = args.ref ?? "HEAD";
@@ -34,7 +34,6 @@ export async function gitlabPipeline(args: GitlabPipelineArgs, signal?: AbortSig
   while (true) {
     if (signal?.aborted) throw new Error("gitlabPipeline aborted");
     attempt++;
-    safeHeartbeat({ step: "gitlabPipeline", project: args.name, attempt });
 
     const { stdout } = await execAsync(
       `glab ci status --project ${args.name} --format json`,

package/src/op/activities/index.ts

@@ -1,10 +1,11 @@
 /**
  * gitlab Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `gitlab` lexicon. `gitlabPipeline` triggers a
- * pipeline over the GitLab CLI with heartbeat/retry semantics; relocated from the
- * temporal lexicon (#809) so gitlab's imperative activity lives with its product.
- * The `gitlabPipeline` step builder stays in core, re-exported from the temporal
- * Op-authoring barrel like the other core builders.
+ * pipeline over the GitLab CLI and polls it to completion under the step's
+ * profile; relocated from the hosting lexicon (#809) so gitlab's imperative
+ * activity lives with its product. The `gitlabPipeline` step builder stays in
+ * core and reaches authors through `@intentius/chant/op` like the other core
+ * builders.
  */
 export { gitlabPipeline } from "./gitlab";
 export type { GitlabPipelineArgs } from "./gitlab";

package/src/op/builders.ts

@@ -7,12 +7,11 @@
  * `./activities/gitlab.ts`. `opts`'s type below IS `GitlabPipelineArgs`
  * itself (via `Omit`/`WithStepRefs`) — never a hand-restated mirror.
  *
- * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`, re-exported from
- * `@intentius/chant-lexicon-temporal`) is UNCHANGED and produces a
- * byte-identical `ActivityStep` for the same inputs — purely additive, and
- * deliberately not swapped into the temporal barrel (see
+ * `core`'s own `gitlabPipeline` (in `@intentius/chant/op`) is UNCHANGED and
+ * produces a byte-identical `ActivityStep` for the same inputs — purely
+ * additive, and deliberately not swapped into core's barrel (see
  * `lexicons/k8s/src/op/builders.ts`'s module doc for why: that would make
- * temporal depend on this package at runtime). An author who wants the typed
+ * core depend on this package at runtime). An author who wants the typed
  * surface imports it from here — `@intentius/chant-lexicon-gitlab`.
  */