@intentius/chant-lexicon-helm 0.57.0 → 0.58.0

package/dist/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,oCAAoC,CAAC;AAG5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAwEtD,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CA8BzE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAqBxE;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,SAAS,EAAE,qBAAqB,GAC/B,MAAM,CAqBR;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA6B/D;AAwGD,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,CA6B7G;AAoDD,2CAA2C;AAC3C,wBAAgB,gBAAgB,IAAI,YAAY,CA4B/C"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,oCAAoC,CAAC;AAG5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAwEtD,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CA8BzE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,kBAAkB,GAAG,MAAM,CAqBxE;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,SAAS,gBAAgB,EAAE,EACpC,SAAS,EAAE,qBAAqB,GAC/B,MAAM,CAqBR;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA6B/D;AAwGD,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,MAAM,CA2C7G;AAoDD,2CAA2C;AAC3C,wBAAgB,gBAAgB,IAAI,YAAY,CA4B/C"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "e4b0ada186355d9a00da15d5996c384b24090dea9231ca816e5ce1d610cca916",
+    "manifest.json": "526933c04346b013042d73549162c3ac08c28d69b0a8d46f9a1bc1f30f6a9a1d",
     "meta.json": "14243c5730a07c6a6edc35ddd351438547d58df5cf345f2233a355b0c7611ccc",
     "types/index.d.ts": "5377696ca8698cd2999e4680feb8e8e4b54a7b49fb603a87b2f27356114d1794",
     "rules/chart-metadata.ts": "8f3377e893d5e2828460b7fe5924fca098334245a9a2fdb90f6b67e490eaf091",
@@ -36,5 +36,5 @@
     "skills/chant-helm-patterns.md": "9e79e6a46391da46709d8aa57e2825a7cd9eb981cd923f02ad60836c49b2561e",
     "skills/chant-helm-security.md": "bfc367eabceed2e84f1cf94501b407df78aeed963cec104f24a321d0962063c9"
   },
-  "composite": "20e043bed8bda67f5bf7c7569731819e9ddab79e8d64ac19eb237285f12ac631"
+  "composite": "2e8feeb1af653ef40ce335a8c96adc0a116f529fb04a18e17c93f9584537b947"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwBrD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAgB,MAAM,gCAAgC,CAAC;AAGhI,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAwBrD,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const helmAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAoDtD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "helm",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Helm",
   "intrinsics": [

package/dist/op/activities/helm.d.ts

@@ -186,7 +186,7 @@ export declare function helmInstallInputDigest(args: HelmInstallArgs): string;
  * finished deploy into a failed activity — the record is observability, not
  * part of the deploy itself.
  *
- * Uses longInfra profile — 20m timeout, heartbeat every 15s.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export declare function helmInstall(args: HelmInstallArgs, signal?: AbortSignal): Promise<HelmInstallResult>;
 //# sourceMappingURL=helm.d.ts.map

package/dist/op/activities/helm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../../src/op/activities/helm.ts"],"names":[],"mappings":"AAiBA,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0CAA0C,CAAC;AAIlD;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,yJAAyJ;IACzJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kJAAkJ;IAClJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wLAAwL;IACxL,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oHAAoH;IACpH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oHAAoH;IACpH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4KAA4K;IAC5K,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iHAAiH;AACjH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wHAAwH;IACxH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mHAAmH;IACnH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yHAAyH;IACzH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sJAAsJ;IACtJ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sGAAsG;AACtG,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAQhD;AAED,6IAA6I;AAC7I,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAQlD;AAED,mJAAmJ;AACnJ,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAU1E;AAED,4FAA4F;AAC5F,MAAM,MAAM,2BAA2B,GACnC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEhE;;;;GAIG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;aAIrC,WAAW,EAAE,MAAM,EAAE;gBAFrC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,EACf,WAAW,EAAE,MAAM,EAAE;CAaxC;AA0CD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAapE;AAwFD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAiE5B"}
+{"version":3,"file":"helm.d.ts","sourceRoot":"","sources":["../../../src/op/activities/helm.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0CAA0C,CAAC;AAIlD;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,yJAAyJ;IACzJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kJAAkJ;IAClJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,wLAAwL;IACxL,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C;;;;;;;;OAQG;IACH,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,oHAAoH;IACpH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oHAAoH;IACpH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4KAA4K;IAC5K,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,iHAAiH;AACjH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,OAAO,EAAE,iBAAiB,CAAC;IAC3B;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;OAIG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wHAAwH;IACxH,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mHAAmH;IACnH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yHAAyH;IACzH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sJAAsJ;IACtJ,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sGAAsG;AACtG,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAQhD;AAED,6IAA6I;AAC7I,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAQlD;AAED,mJAAmJ;AACnJ,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE;CAU1E;AAED,4FAA4F;AAC5F,MAAM,MAAM,2BAA2B,GACnC;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,MAAM,EAAE,CAAC;IAAC,UAAU,EAAE,IAAI,CAAA;CAAE,CAAC;AAEhE;;;;GAIG;AACH,qBAAa,8BAA+B,SAAQ,KAAK;aAIrC,WAAW,EAAE,MAAM,EAAE;gBAFrC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,EACf,WAAW,EAAE,MAAM,EAAE;CAaxC;AA0CD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAapE;AAwFD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAyD5B"}

package/dist/op/activities/index.d.ts

@@ -1,10 +1,10 @@
 /**
  * helm Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `helm` lexicon. `helmInstall` shells out to the
- * helm CLI with heartbeat/retry semantics; relocated from the temporal lexicon
- * (#809) so helm's imperative activity lives with its product, not in temporal.
- * The `helmInstall` step builder stays in core (@intentius/chant/op), re-exported
- * from the temporal Op-authoring barrel like the other core builders.
+ * helm CLI, retried under the step's profile; relocated from the hosting
+ * lexicon (#809) so helm's imperative activity lives with its product. The
+ * `helmInstall` step builder stays in core and reaches authors through
+ * `@intentius/chant/op` like the other core builders.
  */
 export { helmInstall, helmInstallInputDigest, CapabilityProfileMismatchError, PinnedRenderNotFoundError, PinnedRenderIntegrityError, PinnedInstallInputError, PinnedProfileMismatchError, } from "./helm.js";
 export type { HelmInstallArgs, HelmInstallResult, HelmCapabilityProfile, HelmProfileAssertionOutcome, } from "./helm.js";

package/dist/op/builders.d.ts

@@ -13,13 +13,13 @@
  * Every field also accepts a {@link StepOutputRef} in its place
  * ({@link WithStepRefs}, chant #1950).
  *
- * `core`'s own `helmInstall`/`helmInstallPinned` (in `@intentius/chant/op`,
- * re-exported from `@intentius/chant-lexicon-temporal`) are UNCHANGED and
- * produce byte-identical `ActivityStep` output for the same inputs — these
- * are purely additive. Deliberately not swapped into the temporal barrel
- * (see `lexicons/k8s/src/op/builders.ts`'s module doc for why: it would make
- * temporal depend on this package at runtime, undoing the product-agnostic
- * split #809 did). An author who wants the typed surface imports it from
+ * `core`'s own `helmInstall`/`helmInstallPinned` (in `@intentius/chant/op`)
+ * are UNCHANGED and produce byte-identical `ActivityStep` output for the same
+ * inputs — these are purely additive. Deliberately not swapped into core's
+ * barrel (see `lexicons/k8s/src/op/builders.ts`'s module doc for why: it
+ * would make core depend on this package at runtime, undoing the
+ * product-agnostic split #809 did). An author who wants the typed surface
+ * imports it from
  * here — `@intentius/chant-lexicon-helm` — which a project using
  * `helmInstall` already depends on.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-helm",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "Helm chart lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -86,7 +86,7 @@
     "@types/js-yaml": "^4.0.9"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.57.0",
+    "@intentius/chant": "^0.58.0",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   }

package/src/commands.test.ts

@@ -19,7 +19,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { RESERVED_COMMAND_NAMES } from "@intentius/chant/cli/command-group";
-import { formatRenderDiff, formatRenderRecords, helmCommandGroup } from "./commands";
+import { formatRenderDiff, formatRenderLiveDiff, formatRenderRecords, helmCommandGroup } from "./commands";
 import { helmPlugin } from "./plugin";
 import { renderStability } from "./render-digest";
 import { persistHelmRender } from "./render-store";
@@ -417,6 +417,31 @@ describe("formatRenderDiff", () => {
   });
 });
 
+describe("formatRenderLiveDiff", () => {
+  // #2181 - the bucket for a live value this render never set is `unclaimed`,
+  // which is a different fact from a property declared `heldElsewhere()`.
+  it("prints the unclaimed section for a live value the render never set", () => {
+    const out = formatRenderLiveDiff(`sha256:${"a".repeat(64)}`, "prod", {
+      drifted: [],
+      accepted: [],
+      unclaimed: [
+        {
+          name: "Deployment web/app",
+          type: "apps/v1 Deployment",
+          fields: [{ path: "spec.replicas", live: 7, heldBy: "hpa-controller", source: "field-manager" }],
+        },
+      ],
+      held: [],
+      unchanged: [],
+      unobserved: [],
+      undeclaredEntities: [],
+    });
+    expect(out).toContain("1 unclaimed");
+    expect(out).toContain("UNCLAIMED (live values this render never sets; not drift):");
+    expect(out).toContain("spec.replicas: 7 [held by hpa-controller]");
+  });
+});
+
 describe("chant helm diff --live (#1250)", () => {
   it("requires a content digest and an environment", async () => {
     await expect(verb("diff").handler({ verb: "diff", rawArgs: ["--live"] })).rejects.toThrow(

package/src/commands.ts

@@ -334,10 +334,14 @@ function formatDeepValue(v: unknown): string {
 /** The printed render-to-live diff report: property drift per document, then holes. */
 export function formatRenderLiveDiff(contentDigest: string, environment: string, diff: DeepDiffResult): string {
   const driftCount = diff.drifted.reduce((n, e) => n + e.changes.length, 0);
+  // Fields the render never sets (#2160). Live has them and this chart did not
+  // ask for them, so they are somebody else's, not a difference to reconcile.
+  const unclaimedCount = diff.unclaimed.reduce((n, e) => n + e.fields.length, 0);
   const lines: string[] = [
     `render ${contentDigest} vs live (${environment})`,
     `${driftCount} property drift across ${diff.drifted.length} document(s), ` +
       `${diff.accepted.length} accepted, ${diff.unchanged.length} unchanged` +
+      (unclaimedCount > 0 ? `, ${unclaimedCount} unclaimed` : "") +
       (diff.unobserved.length > 0 ? `, ${diff.unobserved.length} unobserved` : "") +
       (diff.undeclaredEntities.length > 0 ? `, ${diff.undeclaredEntities.length} undeclared` : ""),
   ];
@@ -356,6 +360,16 @@ export function formatRenderLiveDiff(contentDigest: string, environment: string,
       }
     }
   }
+  if (diff.unclaimed.length > 0) {
+    lines.push("", "UNCLAIMED (live values this render never sets; not drift):");
+    for (const entity of diff.unclaimed) {
+      lines.push(`  - ${entity.name} (${entity.type})`);
+      for (const field of entity.fields) {
+        const holder = field.heldBy ? ` [held by ${field.heldBy}]` : "";
+        lines.push(`      ${field.path}: ${formatDeepValue(field.live)}${holder}`);
+      }
+    }
+  }
   if (diff.undeclaredEntities.length > 0) {
     lines.push("", "UNDECLARED (live, not in this render):");
     for (const name of diff.undeclaredEntities) lines.push(`  - ${name}`);

package/src/index.ts

@@ -13,9 +13,9 @@ export { helmUpgradeCapability, createHelmUpgradeCapability, type HelmUpgradeInp
 // Typed Op step-builder wrappers (chant #1288 Stage 2) — helmInstall/
 // helmInstallPinned with authoring-time types derived from this lexicon's
 // own HelmInstallArgs (see ./op/builders.ts's module doc for why these live
-// here rather than in core or the temporal barrel). Opt-in:
-// `@intentius/chant-lexicon-temporal`'s same-named exports are core's
-// original untyped builders, unchanged, for cloud-agnostic authoring.
+// here rather than in core). Opt-in: `@intentius/chant/op`'s same-named
+// exports are core's original untyped builders, unchanged, for
+// cloud-agnostic authoring.
 export { helmInstall, helmInstallPinned } from "./op/builders";
 
 // Resources

package/src/lint/audit-catalog.ts

@@ -2,7 +2,8 @@
  * The helm lexicon's chant audit catalog — metadata for its post-synth rules
  * (WHM Helm-chart rules). Contributed via helmPlugin.auditCatalog() (#687).
  */
-import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, type RuleMeta, applyLineage } from "@intentius/chant/audit/catalog";
+import { helmAuditLineage } from "./audit-lineage";
 
 export const helmAuditCatalog: Record<string, RuleMeta> = {
   WHM005: auditRule("WHM005", "report-only", "guidance", "Sub-chart wrapper with no templates", "Deploy the upstream chart directly instead of an empty wrapper.", { category: "best-practice" }),
@@ -29,3 +30,6 @@ export const helmAuditCatalog: Record<string, RuleMeta> = {
   WHM503: auditRule("WHM503", "merge-worthy", "guidance", "Pinned render carries Secret data", "Declare the value with runtimeSlot() or replace the Secret with HelmExternalSecret.", { authority: [K8S_SECRETS] }),
   WHM504: auditRule("WHM504", "merge-worthy", "guidance", "Dead value assignment", "Remove supplied values that never survive coalescing (shadowed, disabled subchart, or unknown subchart).", { category: "correctness" }),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(helmAuditCatalog, helmAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,62 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const helmAuditLineage: Record<string, Lineage[]> = {
+  WHM005: [
+    { tool: "helm-lint", rule: "templatesDirExists", url: "https://github.com/helm/helm/blob/main/pkg/chart/v2/lint/rules/template.go", relation: "overlaps" },
+  ],
+  WHM101: [
+    { tool: "helm-lint", rule: "Chartfile (validateChartName, validateChartAPIVersion, validateChartVersion)", url: "https://github.com/helm/helm/blob/main/pkg/chart/v2/lint/rules/chartfile.go", relation: "equivalent" },
+    { tool: "chart-testing", rule: "ct lint --chart-yaml-schema", url: "https://github.com/helm/chart-testing/blob/main/doc/ct_lint.md", relation: "overlaps" },
+  ],
+  WHM103: [
+    { tool: "helm-lint", rule: "Templates (render error)", url: "https://github.com/helm/helm/blob/main/pkg/chart/v2/lint/rules/template.go", relation: "equivalent" },
+  ],
+  WHM302: [
+    { tool: "kube-score", rule: "container-resources", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "kube-linter", rule: "unset-cpu-requirements", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#unset-cpu-requirements", relation: "overlaps" },
+    { tool: "polaris", rule: "cpuRequestsMissing", url: "https://polaris.docs.fairwinds.com/checks/efficiency/", relation: "overlaps" },
+  ],
+  WHM401: [
+    { tool: "kube-score", rule: "container-image-tag", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+    { tool: "kics", rule: "Invalid Image Tag", url: "https://docs.kics.io/latest/queries/kubernetes-queries/583053b7-e632-46f0-b989-f81ff8045385/", relation: "equivalent" },
+    { tool: "datree", rule: "ensure-image-pinned-version", url: "https://hub.datree.io/built-in-rules/ensure-image-pinned-version", relation: "equivalent" },
+  ],
+  WHM402: [
+    { tool: "kubesec", rule: "containers[] .securityContext .runAsNonRoot == true", url: "https://kubesec.io/basics/containers-securitycontext-runasnonroot-true/", relation: "equivalent" },
+    { tool: "kics", rule: "Container Running As Root", url: "https://docs.kics.io/latest/queries/kubernetes-queries/cf34805e-3872-4c08-bf92-6ff7bb0cfadb/", relation: "equivalent" },
+    { tool: "kube-score", rule: "container-security-context-user-group-id", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+  ],
+  WHM403: [
+    { tool: "kubesec", rule: "containers[] .securityContext .readOnlyRootFilesystem == true", url: "https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/", relation: "equivalent" },
+    { tool: "kics", rule: "Root Container Not Mounted Read-only", url: "https://docs.kics.io/latest/queries/kubernetes-queries/a9c2f49d-0671-4fc9-9ece-f4e261e128d0/", relation: "equivalent" },
+    { tool: "kube-score", rule: "container-security-context-readonlyrootfilesystem", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+  ],
+  WHM404: [
+    { tool: "kubesec", rule: "containers[] .securityContext .privileged == true", url: "https://kubesec.io/basics/containers-securitycontext-privileged-true/", relation: "equivalent" },
+    { tool: "kics", rule: "Container Is Privileged", url: "https://docs.kics.io/latest/queries/kubernetes-queries/dd29336b-fe57-445b-a26e-e6aa867ae609/", relation: "equivalent" },
+    { tool: "kube-score", rule: "container-security-context-privileged", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+  ],
+  WHM405: [
+    { tool: "checkov", rule: "CKV_K8S_10", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_K8S_12", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    { tool: "kubesec", rule: "containers[] .resources .limits .memory", url: "https://kubesec.io/basics/containers-resources-limits-memory/", relation: "overlaps" },
+  ],
+  WHM407: [
+    { tool: "kics", rule: "Using Kubernetes Native Secret Management", url: "https://docs.kics.io/latest/queries/kubernetes-queries/b9c83569-459b-4110-8f79-6305aa33cb37/", relation: "overlaps" },
+  ],
+  WHM502: [
+    { tool: "pluto", rule: "detect-files", url: "https://github.com/FairwindsOps/pluto", relation: "equivalent" },
+    { tool: "helm-lint", rule: "validateNoDeprecations", url: "https://github.com/helm/helm/blob/main/pkg/chart/v2/lint/rules/deprecations.go", relation: "equivalent" },
+    { tool: "kube-score", rule: "stable-version", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+  ],
+  WHM503: [
+    { tool: "kics", rule: "Using Kubernetes Native Secret Management", url: "https://docs.kics.io/latest/queries/kubernetes-queries/b9c83569-459b-4110-8f79-6305aa33cb37/", relation: "overlaps" },
+  ],
+};

package/src/op/activities/helm.test.ts

@@ -46,7 +46,11 @@ const ledger = vi.hoisted(() => ({
   outcome: undefined as unknown,
 }));
 
-vi.mock("node:child_process", async () => {
+// Partial, via `importOriginal`: `@intentius/chant/op` reaches the base
+// activities now (chant #2114), and modules on that path promisify
+// `execFile` at load. A wholesale replacement of node:child_process would
+// make them fail to import rather than fail an assertion.
+vi.mock("node:child_process", async (importOriginal) => {
   const { readFileSync, readdirSync, statSync } = await import("node:fs");
   const { join } = await import("node:path");
   const snapshotDir = (dir: string, rel = ""): Record<string, string> => {
@@ -99,7 +103,7 @@ vi.mock("node:child_process", async () => {
     if (helm.fail) throw new Error("Error: UPGRADE FAILED: context deadline exceeded");
     return { stdout: "Release deployed\n", stderr: "" };
   };
-  return { exec };
+  return { ...(await importOriginal<typeof import("node:child_process")>()), exec };
 });
 
 vi.mock("@intentius/chant/components/auto-release", () => ({

package/src/op/activities/helm.ts

@@ -14,7 +14,6 @@ import {
   compareCapabilityProfile,
   probeClusterCapabilities,
 } from "./cluster-probe";
-import { safeHeartbeat } from "@intentius/chant/op";
 import {
   maybeRecordAutoRelease,
   type AutoReleaseResult,
@@ -394,7 +393,7 @@ async function recordHelmRelease(
  * finished deploy into a failed activity — the record is observability, not
  * part of the deploy itself.
  *
- * Uses longInfra profile — 20m timeout, heartbeat every 15s.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export async function helmInstall(
   args: HelmInstallArgs,
@@ -431,17 +430,9 @@ export async function helmInstall(
   if (args.values) parts.push("-f", args.values);
   for (const [k, v] of Object.entries(args.set ?? {})) parts.push("--set", `${k}=${v}`);
 
-  const heartbeatInterval = setInterval(() => {
-    safeHeartbeat({ step: "helm install", release: args.name });
-  }, 15_000);
-
-  try {
-    const { stdout, stderr } = await execAsync(parts.join(" "), { signal });
-    if (stdout) console.log(stdout);
-    if (stderr) console.error(stderr);
-  } finally {
-    clearInterval(heartbeatInterval);
-  }
+  const { stdout, stderr } = await execAsync(parts.join(" "), { signal });
+  if (stdout) console.log(stdout);
+  if (stderr) console.error(stderr);
 
   const profileOverride =
     profileAssertion && !profileAssertion.matched ? profileAssertion.divergences.join("; ") : undefined;
@@ -562,9 +553,6 @@ async function pinnedHelmInstall(
   }
 
   const wrapperDir = mkdtempSync(join(tmpdir(), "chant-helm-pinned-"));
-  const heartbeatInterval = setInterval(() => {
-    safeHeartbeat({ step: "helm install (pinned)", release: args.name });
-  }, 15_000);
   try {
     materializeWrapperChart(routed, wrapperDir);
     const parts = ["helm", "upgrade", "--install", "--wait", args.name, wrapperDir];
@@ -573,7 +561,6 @@ async function pinnedHelmInstall(
     if (stdout) console.log(stdout);
     if (stderr) console.error(stderr);
   } finally {
-    clearInterval(heartbeatInterval);
     rmSync(wrapperDir, { recursive: true, force: true });
   }
 

package/src/op/activities/index.ts

@@ -1,10 +1,10 @@
 /**
  * helm Op activities — resolved by the core activity registry when a project's
  * `chant.config.ts` lists the `helm` lexicon. `helmInstall` shells out to the
- * helm CLI with heartbeat/retry semantics; relocated from the temporal lexicon
- * (#809) so helm's imperative activity lives with its product, not in temporal.
- * The `helmInstall` step builder stays in core (@intentius/chant/op), re-exported
- * from the temporal Op-authoring barrel like the other core builders.
+ * helm CLI, retried under the step's profile; relocated from the hosting
+ * lexicon (#809) so helm's imperative activity lives with its product. The
+ * `helmInstall` step builder stays in core and reaches authors through
+ * `@intentius/chant/op` like the other core builders.
  */
 export {
   helmInstall,

package/src/op/builders.ts

@@ -13,13 +13,13 @@
  * Every field also accepts a {@link StepOutputRef} in its place
  * ({@link WithStepRefs}, chant #1950).
  *
- * `core`'s own `helmInstall`/`helmInstallPinned` (in `@intentius/chant/op`,
- * re-exported from `@intentius/chant-lexicon-temporal`) are UNCHANGED and
- * produce byte-identical `ActivityStep` output for the same inputs — these
- * are purely additive. Deliberately not swapped into the temporal barrel
- * (see `lexicons/k8s/src/op/builders.ts`'s module doc for why: it would make
- * temporal depend on this package at runtime, undoing the product-agnostic
- * split #809 did). An author who wants the typed surface imports it from
+ * `core`'s own `helmInstall`/`helmInstallPinned` (in `@intentius/chant/op`)
+ * are UNCHANGED and produce byte-identical `ActivityStep` output for the same
+ * inputs — these are purely additive. Deliberately not swapped into core's
+ * barrel (see `lexicons/k8s/src/op/builders.ts`'s module doc for why: it
+ * would make core depend on this package at runtime, undoing the
+ * product-agnostic split #809 did). An author who wants the typed surface
+ * imports it from
  * here — `@intentius/chant-lexicon-helm` — which a project using
  * `helmInstall` already depends on.
  */