@intentius/chant-lexicon-k8s 0.57.0 → 0.58.0

package/dist/api/sweep-types.d.ts

@@ -10,8 +10,7 @@
  *
  * It lives in its own module, with no imports of its own, because both
  * consumers reach it from different directions — `../export-resources.ts`
- * pulls in the whole import parser, and a Temporal worker loading the apply
- * activity should not.
+ * pulls in the whole import parser, and the apply activity should not.
  */
 export declare const DEFAULT_IMPORT_TYPES: readonly string[];
 //# sourceMappingURL=sweep-types.d.ts.map

package/dist/api/sweep-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sweep-types.d.ts","sourceRoot":"","sources":["../../src/api/sweep-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC"}
+{"version":3,"file":"sweep-types.d.ts","sourceRoot":"","sources":["../../src/api/sweep-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAoBjD,CAAC"}

package/dist/composites/operator-stack.d.ts

@@ -16,39 +16,40 @@
  * (lease fencing, `chant operator status`, durable gate-as-fact semantics).
  * `OperatorStack`'s container command is deliberately `chant run <name>`,
  * the one-shot local tick `ConvergeOp` (#1484) already ships and tests
- * against (`lexicons/temporal/src/composites/converge-op.ts`'s own doc:
+ * against (`packages/core/src/op/composites/converge-op.ts`'s own doc:
  * "one-shot runnable locally for a single tick"). When #1485 lands, a
  * caller can override `command` to shell out to `chant operator tick`
  * instead — this composite doesn't need to change for that; only the
  * command a caller passes does.
  *
  * `concurrencyPolicy: "Forbid"` is the k8s-native analogue of
- * `ConvergeOp`'s own Temporal schedule `overlap: "Skip"` policy — never
- * queue a second tick behind one still running.
+ * `ConvergeOp`'s own `schedule.overlap: "skip"` policy — never queue a
+ * second tick behind one still running.
  *
  * ## RBAC derivation
  *
  * `ConvergeOp` adds no authority an environment did not already grant
  * (#1484's Autonomy table). `OperatorStack` re-derives the same bound at the
- * k8s RBAC layer, independently of the temporal lexicon (this module has no
- * dependency on it — see the layering note below): for each hosted
+ * k8s RBAC layer, from the Op configs alone (see the Layering note below for
+ * what this module imports and what it restates): for each hosted
  * ConvergeOp, walk its `dispatchTargets` (the OpConfigs its rule table's
  * `run()` actions may name) through `classifyOpVerbClass`
  * (`packages/core/src/op/op-verb-class.ts`, #1954), then keep only the
  * highest verb class this host's `dial` could ever actually free-run —
  * exactly `convergeTick`'s own `verbClassAllowedToDispatch` gate and
- * `TMP014`'s build-time refusal, restated as an RBAC ceiling:
+ * `OPS014`'s build-time refusal, restated as an RBAC ceiling:
  *
  * - `dial: "observe"` never dispatches (report-only) → read-only RBAC,
  *   regardless of what the rule table's targets could otherwise do.
- * - `dial: "reconcile"` only free-runs a read-only target (TMP014 refuses a
+ * - `dial: "reconcile"` only free-runs a read-only target (OPS014 refuses a
  *   mutating dispatch under reconcile in v1) → read-only RBAC.
  * - `dial: "apply"` free-runs read-only and mutating targets → RBAC gains
  *   create/update/patch, never delete.
  * - A `dispatchTargets` entry that itself classifies `destructive` is
- *   refused outright, at construction — TMP014 already refuses a
- *   destructive `run()` target under any dial in v1 (the local dispatch
- *   executor can't honor its required gate), so a `destructive` target
+ *   refused outright, at construction — OPS014 already refuses a
+ *   destructive `run()` target under any dial in v1 (a converge tick runs
+ *   unattended, and a destructive dispatch needs a person's approval before
+ *   it is attempted, not a gate read after the fact), so a `destructive` target
  *   reaching this composite is either a config bypassing that build check
  *   or a target `OperatorStack` should never grant permission toward.
  *   `never delete`, unconditionally, in v1 — no verb class here ever grants
@@ -61,11 +62,11 @@
  *
  * ## Layering
  *
- * `lexicons/k8s` has no workspace dependency on `lexicons/temporal` (nor
- * the reverse — see both packages' `package.json`), so this module doesn't
- * import `ConvergeOpConfig`/`ConvergeRule` types. `OperatorStackConvergeHost`
- * restates the handful of `ConvergeOp` fields this composite actually needs
- * (`name`, `schedule`, `env`, `dial`) structurally; `dispatchTargets` takes
+ * `OperatorStackConvergeHost` restates the handful of `ConvergeOp` fields
+ * this composite actually needs (`name`, `schedule`, `env`, `dial`)
+ * structurally rather than importing `ConvergeOpConfig`: the CronJob is
+ * built from a host description, not from an Op config, and a caller that
+ * has neither should still be able to describe one. `dispatchTargets` takes
  * plain `OpConfig`-shaped values from `@intentius/chant/op` (a dependency
  * this lexicon already has via the `@intentius/chant` peer dependency),
  * the same type `classifyOpVerbClass` itself takes.
@@ -74,7 +75,7 @@ import type { OpConfig, OpVerbClass } from "@intentius/chant/op";
 import { Namespace, CronJob, ServiceAccount, Role, RoleBinding } from "../generated/index.js";
 /**
  * Mirrors `ConvergeOp`'s own `ConvergeDial`
- * (`lexicons/temporal/src/composites/converge-op.ts`) structurally — see
+ * (`packages/core/src/op/composites/converge-op.ts`) structurally — see
  * this module's Layering doc for why it's restated rather than imported.
  */
 export type OperatorDial = "observe" | "reconcile" | "apply";
@@ -96,7 +97,7 @@ export interface OperatorStackConvergeHost {
     /**
      * OpConfigs for every op this ConvergeOp's rule table may `run()` — the
      * sibling `*.op.ts` declarations its `run()` actions name. Used to derive
-     * least-privilege RBAC the same way `TMP014` derives its build-time
+     * least-privilege RBAC the same way `OPS014` derives its build-time
      * refusals. Omit or leave empty when every rule only `report()`s; the
      * host still gets read-only RBAC for its own observation.
      */
@@ -153,7 +154,7 @@ export declare const DEFAULT_RESOURCE_RULES: OperatorRbacResourceRule[];
  * Derive the highest verb class a host's ServiceAccount actually needs:
  * the max, across `dispatchTargets`, of each target's own class — but only
  * counting a target `dial` could ever actually dispatch (one it can't just
- * gets reported, per `TMP014`/`convergeTick`, and needs no elevated grant).
+ * gets reported, per `OPS014`/`convergeTick`, and needs no elevated grant).
  * A `dispatchTargets` entry that classifies `destructive` is refused
  * outright rather than silently ignored — see this module's RBAC
  * derivation doc on why a destructive target reaching this composite is

package/dist/composites/operator-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator-stack.d.ts","sourceRoot":"","sources":["../../src/composites/operator-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIrF;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,uOAAuO;AACvO,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oIAAoI;IACpI,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,oOAAoO;IACpO,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC;IAC3D,2LAA2L;IAC3L,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACvC,2JAA2J;IAC3J,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,iIAAiI;IACjI,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,2HAA2H;IAC3H,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C,iBAAiB;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,iBAAiB;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC5C,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,CAAC,MAAM,EAAE,MAAM,GACX,YAAY,CAAC,OAAO,SAAS,CAAC,GAC9B,YAAY,CAAC,OAAO,cAAc,CAAC,GACnC,YAAY,CAAC,OAAO,IAAI,CAAC,GACzB,YAAY,CAAC,OAAO,WAAW,CAAC,GAChC,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CAClC;AAID,+MAA+M;AAC/M,eAAO,MAAM,sBAAsB,EAAE,wBAAwB,EAI5D,CAAC;AAwBF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,GAAG,WAAW,CAchJ;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,0FA6IP,CAAC"}
+{"version":3,"file":"operator-stack.d.ts","sourceRoot":"","sources":["../../src/composites/operator-stack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAIrF;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE7D,uOAAuO;AACvO,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,oIAAoI;IACpI,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,QAAQ,EAAE,MAAM,CAAC;IACjB,oOAAoO;IACpO,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC;IAC3D,2LAA2L;IAC3L,SAAS,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACvC,2JAA2J;IAC3J,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,iIAAiI;IACjI,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACtC,2HAA2H;IAC3H,gBAAgB,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC9C,iBAAiB;IACjB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,iBAAiB;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC5C,CAAC;CACH;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,YAAY,CAAC,OAAO,SAAS,CAAC,CAAC;IAC1C,CAAC,MAAM,EAAE,MAAM,GACX,YAAY,CAAC,OAAO,SAAS,CAAC,GAC9B,YAAY,CAAC,OAAO,cAAc,CAAC,GACnC,YAAY,CAAC,OAAO,IAAI,CAAC,GACzB,YAAY,CAAC,OAAO,WAAW,CAAC,GAChC,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CAClC;AAID,+MAA+M;AAC/M,eAAO,MAAM,sBAAsB,EAAE,wBAAwB,EAI5D,CAAC;AAwBF;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC,EAAE,GAAG,WAAW,CAehJ;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,aAAa,0FA6IP,CAAC"}

package/dist/config.d.ts

@@ -2,8 +2,8 @@
  * K8s environment → cluster binding — chant #1100.
  *
  * Every cloud lexicon binds an environment to a scope: AWS resolves `<env>`
- * to a CloudFormation stack, Azure treats `<env>` as the resource group,
- * Temporal looks up `temporal.profiles.<env>`. Before this, k8s bound
+ * to a CloudFormation stack, Azure treats `<env>` as the resource group.
+ * Before this, k8s bound
  * nothing — `describeResources` shelled out to `kubectl get` with no
  * `--context`, so `chant lifecycle diff prod --live` read whichever cluster
  * `kubectl config current-context` happened to point at.
@@ -40,8 +40,8 @@
  *   and the missing binding.
  *
  * `ChantConfig` uses `.passthrough()` in its Zod schema so the `k8s` key is
- * accepted at runtime without core changes, exactly like `temporal.profiles`
- * (see `lexicons/temporal/src/config.ts`). The type side is the declaration
+ * accepted at runtime without core changes, exactly like the `terraform` key
+ * (see `lexicons/terraform/src/config.ts`). The type side is the declaration
  * merge at the bottom of this file — without it the snippet above compiles
  * only until someone adds `satisfies ChantConfig`, which every example
  * project does and which is the only thing type-checking the rest of the

package/dist/deep-observe-hooks.d.ts

@@ -49,7 +49,8 @@ import type { DeepArrayElement, DeepNormalizationHooks } from "@intentius/chant/
  * Kubernetes-defaulted fields, per entity type, as index-erased property
  * paths. Subtracted only where source never declared the property
  * (`side === "live" && counterpart === "absent"`) — cdk-real-drift's default
- * subtraction, same convention as AWS/Azure/Temporal's tables.
+ * subtraction, same convention as the AWS and Azure tables
+ * (`AWS_SERVICE_DEFAULTS`, `AZURE_SERVICE_DEFAULTS`).
  *
  * Sparse and evidence-based rather than derived from the generated schema:
  * the k8s OpenAPI spec this lexicon's codegen consumes
@@ -58,9 +59,8 @@ import type { DeepArrayElement, DeepNormalizationHooks } from "@intentius/chant/
  * actually expressible today. Widening this table is additive and needs no
  * contract change.
  *
- * `spec.strategy` is listed whole, not as `spec.strategy.type`, for the same
- * reason Temporal's `TEMPORAL_SCHEDULE_DEFAULTS` lists `state` whole: pruning
- * only the leaf would still recurse into the object, and a nested default the
+ * `spec.strategy` is listed whole rather than as `spec.strategy.type`, because
+ * pruning only the leaf would still recurse into the object, and a nested default the
  * table does not separately name (`rollingUpdate.maxSurge`/`maxUnavailable`,
  * both `"25%"` when `spec.strategy` is omitted entirely) would leave behind an
  * empty `strategy: {}` — a value distinct from no `strategy` key at all, and

package/dist/deep-observe.d.ts

@@ -9,10 +9,10 @@
  *
  * ## What managedFields decides, and what it does not
  *
- * AWS, Azure and Temporal's rows all prune by a **static, entityType-keyed**
- * table: an ARN always looks like an ARN, `provisioningState` is always
- * server-populated, a namespace's retention default is always the same
- * value. None of that needs the specific live object in hand — it is exactly
+ * The AWS and Azure rows both prune by a **static, entityType-keyed** table
+ * (`AWS_SERVICE_DEFAULTS`, `AZURE_SERVICE_DEFAULTS`): an ARN always looks like
+ * an ARN, `provisioningState` is always server-populated. Neither needs the
+ * specific live object in hand — it is exactly
  * what `./deep-observe-hooks.ts`'s `k8sDeepNormalizationHooks` is, and it
  * covers Kubernetes' *equivalent* static noise (`status`,
  * `metadata.{uid,resourceVersion,generation,creationTimestamp}`, a handful of
@@ -31,7 +31,7 @@
  * was controller noise. It silenced exactly the case the deep read exists
  * for — `kubectl label deploy web team=platform` is foreign-owned
  * (`kubectl-edit`) and undeclared, and never appeared in fieldDrift. The
- * policy now (recorded on #1202) is:
+ * policy now (recorded on #1202, refined by #2160) is:
  *
  * 1. **Chant-owned** (`chant`, `chant:<stack>` — chant #1075, matched on the
  *    family so a stack rename does not stop recognizing its own history) is
@@ -41,18 +41,25 @@
  *    write currently holds the field, and a foreign write that overrides a
  *    value chant's manifest asks for is the thing `lifecycle diff --live`
  *    exists to surface. It reports as `changed`.
- * 3. **Foreign-owned and undeclared** is reported as `undeclared` drift,
- *    unless the accepted baseline already carries it at that value. The
- *    baseline (`--update-baseline`) is the noise valve: an HPA that owns
- *    `spec.replicas` on a Deployment whose source is silent about replicas
- *    reports once, gets accepted, and stays quiet until the value moves.
+ * 3. **Undeclared** — a path outside the declaration's claimed-field set
+ *    (`@intentius/chant/claimed-fields`) — is reported as unclaimed and
+ *    is not drift at all. Before #2160 it was `undeclared` drift that the
+ *    accepted baseline had to absorb one path at a time; the declaration
+ *    answers on the first read instead, so an HPA that owns `spec.replicas`
+ *    on a Deployment whose source is silent about replicas is quiet with
+ *    nothing recorded anywhere.
  *
- * So ownership decides nothing about *whether* a path is compared. What it
- * contributes is `fieldOwners` (#1189): every reported drift names the
- * manager that holds the field live, which is how an operator tells
- * `hpa-controller` doing its job from somebody running `kubectl edit`. The
- * only fields subtracted because a foreign manager wrote them are the
- * well-known system ones on the static allowlist.
+ * So ownership decides nothing about *whether* a path is compared, and since
+ * #2160 it no longer decides the verdict either — the declaration does. What
+ * it contributes is `fieldOwners` (#1189), and that is worth more here than
+ * anywhere else: on every other substrate a held field can only be reported
+ * as "not chant's", while here it is reported as `hpa-controller`'s or
+ * `kubectl-edit`'s by name, which is the difference between a controller
+ * doing its job and somebody bypassing the pipeline. Core takes the manager
+ * where this reader supplies one and falls back to the claim where it does
+ * not (a path inside a key-addressed list, which no `fieldsV1` entry names in
+ * that form). The only fields subtracted because a foreign manager wrote them
+ * are the well-known system ones on the static allowlist.
  *
  * ## Resolving a managedFields entry against a live array
  *

package/dist/deep-observe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAgHhC"}
+{"version":3,"file":"deep-observe.d.ts","sourceRoot":"","sources":["../src/deep-observe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmGG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACzF,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,eAAe,CAAC;AAQvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AASjE,OAAO,EAAE,yBAAyB,EAAE,kBAAkB,EAAE,KAAK,aAAa,EAAE,CAAC;AAE7E,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAQD;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAgHhC"}

package/dist/export-resources.d.ts

@@ -25,7 +25,7 @@ import { DEFAULT_IMPORT_TYPES } from "./api/sweep-types.js";
  * reachable by naming it with `--selector type=...`. Defined in
  * `./api/sweep-types.ts` and re-exported here, its original home — chant
  * #1075's ownership-scoped prune needs the same list without pulling the
- * import parser into a Temporal worker.
+ * import parser in behind the apply activity.
  */
 export { DEFAULT_IMPORT_TYPES };
 export declare function exportResources(options: {

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "59d95435bd997afca33caae5656b741b07bd149fff54c0e5526f50658fa89533",
+    "manifest.json": "5c4819e96d62042f7bd66f276c2d447f93dcb92105f1fce9a0b820249803c09d",
     "meta.json": "8b999bc142f448b0b627ecdc9e2388bbe672c8a1f7aae5303135624cf2fe65e3",
     "types/index.d.ts": "5f67de738adb455805e72600948940af9c664283785fb68c9fd8f5ea90d42cc3",
     "rules/argo-appset-single-project.ts": "afa9f310753aa2d475f35012b13135b2dfaebed2a35d44edbe185ebc07673674",
@@ -62,8 +62,8 @@
     "skills/chant-k8s-eks.md": "9e953d6a2c39518c4b797a2bf54ff5b4a33530503e5b6d66e35921e8f952432f",
     "skills/chant-k8s-gke.md": "8938840bf9ef5ed58d6333fdd773b3dd54ecaf25a9df35e58f7f5c3355d4928f",
     "skills/chant-k8s-aks.md": "e18f0e2b055f72cd7a37deaf258d7027c2d4d3e286e8fd4975b27a1f981a3ad9",
-    "skills/chant-k8s-argo.md": "b1a0b826559d8c5033a479c5781efaf650320f0aee4419d8841170bd3393cea5",
+    "skills/chant-k8s-argo.md": "24c9a85b78a2fc5c6657424baac9cc6d6caff6f47605b8146b2c0082133181cf",
     "skills/chant-k8s-flux.md": "9670efc2e9854bd14686b5adeb707396b9030a4dcaee6529b30abf56efe2c50c"
   },
-  "composite": "dd244a5bfdea037184159b9ec82b11c6047c37905a28f50ad9f88205e548338b"
+  "composite": "293e1809032d42cf01169debcfa6fd95d04dd9e66b2c08779b9463fdec798f9f"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAElH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAyCpD,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAqD,KAAK,QAAQ,EAAgB,MAAM,gCAAgC,CAAC;AAGhI,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAyCpD,CAAC"}

package/dist/lint/audit-lineage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+export declare const k8sAuditLineage: Record<string, Lineage[]>;
+//# sourceMappingURL=audit-lineage.d.ts.map

package/dist/lint/audit-lineage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAqHrD,CAAC"}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "k8s",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "chantVersion": ">=0.1.0",
   "namespace": "K8s",
   "intrinsics": [],

package/dist/op/activities/argo.d.ts

@@ -10,8 +10,8 @@
  * `ResourceFetcher` for `waitForReady`.
  *
  * It stays **dependency-light** — primitives-only signature (app name /
- * namespace / server), no generated Argo CRD types — so a Temporal worker loads
- * it cheaply.
+ * namespace / server), no generated Argo CRD types — so importing the lexicon's
+ * activity module at run time stays cheap.
  */
 export interface WaitForArgoSyncArgs {
     /** Argo Application name. */
@@ -29,7 +29,7 @@ export interface WaitForArgoSyncArgs {
     insecure?: boolean;
     /** kubectl context (used when `server` is not set). */
     context?: string;
-    /** Poll interval in ms (default 15000). Heartbeats every poll. */
+    /** Poll interval in ms (default 15000). */
     intervalMs?: number;
 }
 /** The two status fields the activity gates on. */
@@ -52,7 +52,7 @@ export declare const defaultArgoStatusFetcher: ArgoStatusFetcher;
  * `ArgoSyncFailedError` if it reaches a terminal unhealthy state (Degraded /
  * Missing).
  *
- * Delegates the poll loop, heartbeat, and ready/terminal evaluation to the
+ * Delegates the poll loop and the ready/terminal evaluation to the
  * generic `waitForReady` using the shared `argoproj.io/Application` readiness
  * spec. The Argo `ArgoStatusFetcher` is adapted into a `ResourceFetcher` that
  * shapes `{health, sync}` into the `status.health.status` / `status.sync.status`

package/dist/op/activities/argo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"argo.d.ts","sourceRoot":"","sources":["../../../src/op/activities/argo.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,4EAA4E;AAC5E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4CD,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAE,iBACkC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,iBAA4C,GACpD,OAAO,CAAC,aAAa,CAAC,CAkCxB"}
+{"version":3,"file":"argo.d.ts","sourceRoot":"","sources":["../../../src/op/activities/argo.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAC9B,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,4EAA4E;AAC5E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AA4CD,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAE,iBACkC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,iBAA4C,GACpD,OAAO,CAAC,aAAa,CAAC,CAkCxB"}

package/dist/op/activities/index.d.ts

@@ -1,21 +1,23 @@
 /**
  * k8s Op activities — resolved by the core activity registry when a project's
- * `chant.config.ts` lists the `k8s` lexicon. Relocated from the temporal lexicon
+ * `chant.config.ts` lists the `k8s` lexicon. Relocated from the hosting lexicon
  * (#809) so Kubernetes-facing imperative activities live with their product:
  *   - kubectlApply — server-side apply a rendered manifest (and, since chant
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
- *     is the same work with a report of what it did, which is what the
- *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
+ *     is the same work with a report of what it did, which is what core's
+ *     `nativeApply` dispatcher calls for a kubectl target)
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
  * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
  * owns its own product's activities, and k3d is its own product now. Projects
  * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
  *
- * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
- * the temporal Op-authoring barrel like the other core builders. Each activity is
- * dependency-light — it shells out to a CLI and does not import the k8s declarable
- * surface — so a Temporal worker loads it cheaply.
+ * The step builders (kubectlApply, k3dUp, k3dDown) stay in core and reach
+ * authors through `@intentius/chant/op` like the other core builders. Each
+ * activity is dependency-light — it shells out to a CLI and does not import the
+ * k8s declarable surface — so `loadActivities`
+ * (`packages/core/src/op/activity-registry.ts`), which imports this module at
+ * run time, pulls in nothing expensive.
  */
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl.js";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAC/E,YAAY,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMpG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,YAAY,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAC;AACxF,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAEpF,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,kBAAkB,CAAC;AAW1B,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AACrG,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/op/activities/kubectl.d.ts

@@ -3,9 +3,9 @@
  *
  * chant #1074 moved this off `kubectl apply -f`. The activity contract is
  * unchanged (a manifest path, an optional context, `Promise<void>`, the
- * `longInfra` profile's 15s heartbeat) because Temporal workers register it by
- * that signature; what changed is underneath. The name is kept for the same
- * reason.
+ * `longInfra` profile) because an Op step names the activity by its export
+ * name and core's registry resolves it there; what changed is underneath. The
+ * name is kept for the same reason.
  *
  * chant #1075 finished the job on two axes:
  *
@@ -35,14 +35,14 @@ import { type K8sConnector } from "../../api/connect.js";
 /**
  * How the apply treats chant-owned objects that are no longer declared. The
  * same three values `nativeApply` has always taken; `gated` differs from
- * `owned-only` only in that the workflow pauses for approval first, which is
- * the composite's business, not this activity's.
+ * `owned-only` only in that an approval gate runs before this activity does,
+ * which is the composite's business, not this activity's.
  */
 export type ApplyDeleteMode = "never" | "owned-only" | "gated";
 export interface KubectlApplyArgs {
     /**
      * Path to a manifest file, or a directory of them. With `documents` given,
-     * this becomes only the human-facing label the heartbeats and logs carry
+     * this becomes only the human-facing label the step's log lines carry
      * (e.g. `kustomize:<dir>`), and nothing is read from disk.
      */
     manifest: string;
@@ -151,7 +151,7 @@ export declare function resolveFieldManager(args: KubectlApplyArgs): Promise<str
 export declare function applyManifest(args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector): Promise<ApplyManifestResult>;
 /**
  * Apply every document in `args.manifest`.
- * Uses longInfra profile — 20m timeout, heartbeat every 15s.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export declare function kubectlApply(args: KubectlApplyArgs, signal?: AbortSignal, connect?: K8sConnector): Promise<void>;
 //# sourceMappingURL=kubectl.d.ts.map

package/dist/op/activities/kubectl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAYH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAK3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAkE9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"kubectl.d.ts","sourceRoot":"","sources":["../../../src/op/activities/kubectl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAWH,OAAO,KAAK,EAAa,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAK3E;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,sCAAsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sFAAsF;IACtF,MAAM,EAAE,UAAU,EAAE,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;CACzB;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAiB7E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjF;AAqHD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,mBAAmB,CAAC,CAqD9B;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAkC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/op/activities/wait-for-ready.d.ts

@@ -4,8 +4,8 @@ import { type K8sConnector } from "../../api/connect.js";
  * ready, driven by a data-only **readiness spec** rather than per-CRD code.
  *
  * Like `waitForArgoSync`, this activity is intentionally **dependency-light**:
- * its signature is primitives + a plain readiness spec, so a Temporal worker
- * loads it without importing the generated CRD declarable surface. It reads the
+ * its signature is primitives + a plain readiness spec, so the activity module
+ * loads without pulling in the generated CRD declarable surface. It reads the
  * resource and evaluates the spec's predicates. It generalizes the bespoke
  * `waitForArgoSync` / `waitForStack` waits — see #365.
  *
@@ -99,7 +99,7 @@ export interface WaitForReadyArgs {
     group?: string;
     /** Explicit readiness spec — wins over the registry/default. */
     spec?: ReadinessSpec;
-    /** Poll interval in ms (default 15000). Heartbeats every poll. */
+    /** Poll interval in ms (default 15000). */
     intervalMs?: number;
 }
 /** Pluggable resource reader — overridden in tests with a fake. */
@@ -121,8 +121,9 @@ export declare function apiResourceFetcher(connect?: K8sConnector): ResourceFetc
 export declare const defaultResourceFetcher: ResourceFetcher;
 /**
  * Poll until the resource satisfies its readiness spec. Throws
- * `ReadinessFailedError` on a terminal state. Heartbeats every poll so the
- * `k8sWait` profile's 60s heartbeat timeout never trips.
+ * `ReadinessFailedError` on a terminal state, which the `k8sWait` profile lists
+ * as non-retryable, so a resource that will never become ready fails on the
+ * first attempt instead of burning the profile's 15m timeout three times.
  *
  * @param fetcher injectable reader (defaults to kubectl). Tests pass a fake to
  *   drive not-ready → ready / terminal transitions.

package/dist/op/activities/wait-for-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AA4CF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2C7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAyDD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuBlC"}
+{"version":3,"file":"wait-for-ready.d.ts","sourceRoot":"","sources":["../../../src/op/activities/wait-for-ready.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;;;;;;;;;;;GAiBG;AAIH,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACnC,4CAA4C;IAC5C,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;CAEhC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAE/E,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAG/B,CAAC;AA4CF,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA2C7D,CAAC;AAEF,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CAEnF;AAyDD,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAGlE;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,cAAc,GAAG,SAAS,CAE3F;AAID,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,gGAAgG;IAChG,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,YAAkC,GAAG,eAAe,CAmC/F;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAAsE,CAAC;AAE5G;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,gBAAgB,EACtB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,eAAsC,GAC9C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsBlC"}

package/dist/op/builders.d.ts

@@ -18,20 +18,20 @@
  * earlier step's declared output.
  *
  * `core`'s own `kubectlApply`/`waitForReady`/`ensureSecret` (in
- * `@intentius/chant/op`, re-exported from `@intentius/chant-lexicon-temporal`
- * for lexicon-agnostic single-import convenience) are UNCHANGED and produce
- * byte-identical `ActivityStep` output for the same inputs — these are purely
- * additive. Deliberately not swapped into the temporal barrel: that would
- * make `@intentius/chant-lexicon-temporal` depend on this package (and on
- * helm, for `helmInstall`) at runtime, which is exactly the "a worker image
- * needs no kubectl binary" / "temporal stays product-agnostic" property the
+ * `@intentius/chant/op`, the lexicon-agnostic single-import barrel) are
+ * UNCHANGED and produce byte-identical `ActivityStep` output for the same
+ * inputs — these are purely additive. Deliberately not swapped into core's
+ * barrel: that would make `@intentius/chant` depend on this package (and on
+ * helm, for `helmInstall`) at runtime, so a project that never touches
+ * Kubernetes would install both just to import anything from `op`. That is
+ * exactly the "core stays product-agnostic" property the
  * `op/activities/index.ts` module docs across this repo call out on purpose
- * (activities were moved OUT of temporal into per-product lexicons for this
- * reason; the step-builder layer shouldn't reintroduce the coupling from the
- * other direction). An author who wants the typed surface imports it from
- * here — `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
- * already depends on; existing `@intentius/chant-lexicon-temporal` imports
- * keep working exactly as before, opting in only if the import is changed.
+ * (activities live in per-product lexicons for this reason; the step-builder
+ * layer shouldn't reintroduce the coupling from the other direction). An
+ * author who wants the typed surface imports it from here —
+ * `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
+ * already depends on; existing `@intentius/chant/op` imports keep working
+ * exactly as before, opting in only if the import is changed.
  */
 import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
 import type { KubectlApplyArgs } from "./activities/kubectl.js";

package/dist/skills/chant-k8s-argo.md

@@ -1,6 +1,6 @@
 ---
 skill: chant-k8s-argo
-description: Argo CD composites for GitOps reconciliation — ArgoAppFor, ArgoAppSetForRegions, AppProject scoping, cluster registration, and the Argo-vs-Temporal split
+description: Argo CD composites for GitOps reconciliation — ArgoAppFor, ArgoAppSetForRegions, AppProject scoping, cluster registration, and how a deploy splits between Argo and a chant Op
 user-invocable: true
 ---
 
@@ -14,9 +14,9 @@ Chant authors typed infrastructure into manifests. Argo CD continuously reconcil
 |---|---|---|
 | **Chant** | Authoring typed infra → manifests | the lexicons |
 | **Argo CD** | Continuously reconciling declarative manifests (the apply layer) | `ArgoAppFor` / `ArgoAppSetForRegions` |
-| **Temporal** | Procedural steps Argo can't express — ordering, signals, human gates, one-shot RPCs | the temporal lexicon + `waitForArgoSync` |
+| **A chant Op** | Procedural steps Argo can't express: ordering, human gates, one-shot RPCs | an `Op` in the project, plus this lexicon's `waitForArgoSync` |
 
-Rule of thumb: **if it's declarative and converges, let Argo reconcile it. If it's a procedure with ordering, gates, or out-of-band steps, orchestrate it in Temporal.** Prefer Argo CD over Argo Workflows — the procedural layer stays Temporal.
+Rule of thumb: **if it's declarative and converges, let Argo reconcile it. If it's a procedure with ordering, gates, or out-of-band steps, write it as a chant Op and run it from CI or a steward.** Prefer Argo CD over Argo Workflows; the procedural layer stays an Op.
 
 ## Prerequisites
 
@@ -138,9 +138,9 @@ Produces a `Secret` labelled `argocd.argoproj.io/secret-type: cluster`. After th
 
 ---
 
-## The Argo-vs-Temporal split
+## Splitting a deploy between Argo and an Op
 
-When a deploy has both declarative and procedural parts, let each layer own what it's good at. Example — the multi-region CockroachDB deploy:
+When a deploy has both declarative and procedural parts, let each layer own what it's good at. Example, the multi-region CockroachDB deploy:
 
 | Step | Owner | Why |
 |---|---|---|
@@ -148,16 +148,30 @@ When a deploy has both declarative and procedural parts, let each layer own what
 | Install ESO / operators (Helm) | **Argo** | Declarative Helm source |
 | Apply per-cluster K8s manifests | **Argo** (`ApplicationSet`) | One App per workload cluster |
 | Wait for workloads Healthy | **Argo** (`Health=Healthy`) | Subsumed by Application health |
-| Wait for DNS delegation | **Temporal** | Signal/update/auto-poll race — out of band |
-| Generate + push TLS certs | **Temporal** | One-shot procedure, secrets not in git |
-| `cockroach init`, configure regions | **Temporal** | Ordered one-shot RPCs |
-
-From a Temporal workflow, gate procedural steps on Argo finishing a declarative apply with the `waitForArgoSync` activity (temporal lexicon, `argoSync` profile):
+| Wait for DNS delegation | **an Op** | Out of band, and a human confirms it |
+| Generate + push TLS certs | **an Op** | One-shot procedure, secrets not in git |
+| `cockroach init`, configure regions | **an Op** | Ordered one-shot RPCs |
+
+Argo owns the sync. The Op owns the ordering and the gates: its phases run in
+sequence in one process (`packages/core/src/op/local-executor.ts`), and a `gate`
+step reads the gate ledger, so a run that reaches a gate nobody has approved
+records the pending fact, ends with status `gated` and exits 3. Someone runs
+`chant approve <op> <gate>`, the next run reads the resolution and walks
+through. CI is what runs the Op, on whatever cadence the Op's `schedule`
+names.
+
+To make a step wait on Argo, use this lexicon's `waitForArgoSync` activity. It is
+exported from `lexicons/k8s/src/op/activities/index.ts`, and the core activity
+registry resolves it by export name once `k8s` is in the project's `lexicons`.
+Give the step core's `argoSync` profile
+(`packages/core/src/op/activity-profiles.ts`): a 30m timeout, five attempts
+backing off from 10s, and `ArgoSyncFailedError` marked non-retryable so a
+terminally unhealthy Application fails fast instead of polling to the cap.
 
 ```typescript
-// In a Temporal Op workflow:
-await waitForArgoSync({ appName: "east-crdb", namespace: "argocd" });
-// ...now run the procedural steps that depend on the workloads being Healthy.
+// In an Op phase:
+activity("waitForArgoSync", { appName: "east-crdb", namespace: "argocd" }, "argoSync"),
+// Later steps in the phase run once the workloads are Healthy.
 ```
 
 `waitForArgoSync` is dependency-free — it polls the Application's status (`health=Healthy && sync=Synced`) and never imports the Argo CRD types.