@intentius/chant-lexicon-k8s 0.57.0 → 0.58.0

package/src/deep-observe.ts

@@ -9,10 +9,10 @@
  *
  * ## What managedFields decides, and what it does not
  *
- * AWS, Azure and Temporal's rows all prune by a **static, entityType-keyed**
- * table: an ARN always looks like an ARN, `provisioningState` is always
- * server-populated, a namespace's retention default is always the same
- * value. None of that needs the specific live object in hand — it is exactly
+ * The AWS and Azure rows both prune by a **static, entityType-keyed** table
+ * (`AWS_SERVICE_DEFAULTS`, `AZURE_SERVICE_DEFAULTS`): an ARN always looks like
+ * an ARN, `provisioningState` is always server-populated. Neither needs the
+ * specific live object in hand — it is exactly
  * what `./deep-observe-hooks.ts`'s `k8sDeepNormalizationHooks` is, and it
  * covers Kubernetes' *equivalent* static noise (`status`,
  * `metadata.{uid,resourceVersion,generation,creationTimestamp}`, a handful of
@@ -31,7 +31,7 @@
  * was controller noise. It silenced exactly the case the deep read exists
  * for — `kubectl label deploy web team=platform` is foreign-owned
  * (`kubectl-edit`) and undeclared, and never appeared in fieldDrift. The
- * policy now (recorded on #1202) is:
+ * policy now (recorded on #1202, refined by #2160) is:
  *
  * 1. **Chant-owned** (`chant`, `chant:<stack>` — chant #1075, matched on the
  *    family so a stack rename does not stop recognizing its own history) is
@@ -41,18 +41,25 @@
  *    write currently holds the field, and a foreign write that overrides a
  *    value chant's manifest asks for is the thing `lifecycle diff --live`
  *    exists to surface. It reports as `changed`.
- * 3. **Foreign-owned and undeclared** is reported as `undeclared` drift,
- *    unless the accepted baseline already carries it at that value. The
- *    baseline (`--update-baseline`) is the noise valve: an HPA that owns
- *    `spec.replicas` on a Deployment whose source is silent about replicas
- *    reports once, gets accepted, and stays quiet until the value moves.
+ * 3. **Undeclared** — a path outside the declaration's claimed-field set
+ *    (`@intentius/chant/claimed-fields`) — is reported as unclaimed and
+ *    is not drift at all. Before #2160 it was `undeclared` drift that the
+ *    accepted baseline had to absorb one path at a time; the declaration
+ *    answers on the first read instead, so an HPA that owns `spec.replicas`
+ *    on a Deployment whose source is silent about replicas is quiet with
+ *    nothing recorded anywhere.
  *
- * So ownership decides nothing about *whether* a path is compared. What it
- * contributes is `fieldOwners` (#1189): every reported drift names the
- * manager that holds the field live, which is how an operator tells
- * `hpa-controller` doing its job from somebody running `kubectl edit`. The
- * only fields subtracted because a foreign manager wrote them are the
- * well-known system ones on the static allowlist.
+ * So ownership decides nothing about *whether* a path is compared, and since
+ * #2160 it no longer decides the verdict either — the declaration does. What
+ * it contributes is `fieldOwners` (#1189), and that is worth more here than
+ * anywhere else: on every other substrate a held field can only be reported
+ * as "not chant's", while here it is reported as `hpa-controller`'s or
+ * `kubectl-edit`'s by name, which is the difference between a controller
+ * doing its job and somebody bypassing the pipeline. Core takes the manager
+ * where this reader supplies one and falls back to the claim where it does
+ * not (a path inside a key-addressed list, which no `fieldsV1` entry names in
+ * that form). The only fields subtracted because a foreign manager wrote them
+ * are the well-known system ones on the static allowlist.
  *
  * ## Resolving a managedFields entry against a live array
  *
@@ -114,7 +121,7 @@ import { k8sDeepNormalizationHooks } from "./deep-observe-hooks";
 
 // Re-exported so a dynamic importer of this module (plugin.ts's
 // `observeResourcesDeep`, a test) can get the reader and its hooks from one
-// place, the same shape AWS/Azure/Temporal's single deep-observe.ts offers.
+// place, the same shape the AWS and Azure deep-observe.ts modules offer.
 // `plugin.ts`'s own `deepNormalizationHooks` field imports the hooks
 // separately, directly from `./deep-observe-hooks` — that file has no
 // dependency on `@intentius/chant-k8s-client`, so it is safe to import
@@ -244,10 +251,10 @@ export async function observeResourcesDeepK8s(
           hooks: k8sDeepNormalizationHooks,
         }),
         // Who owns each path (#1189). Nothing is pruned by ownership any more
-        // (#1191), so a foreign-owned undeclared field reaches the diff as
-        // `undeclared` — and naming the manager is the whole question there:
-        // an operator needs to tell `hpa-controller` doing its job from
-        // somebody running `kubectl edit`.
+        // (#1191), so a foreign-owned undeclared field still reaches the diff
+        // — as a held field since #2160 — and naming the manager is the whole
+        // question there: an operator needs to tell `hpa-controller` doing its
+        // job from somebody running `kubectl edit`.
         ...(sets.owners.size > 0 ? { fieldOwners: Object.fromEntries(sets.owners) } : {}),
       };
     } catch (err) {

package/src/export-resources.ts

@@ -28,7 +28,7 @@ import { DEFAULT_IMPORT_TYPES } from "./api/sweep-types";
  * reachable by naming it with `--selector type=...`. Defined in
  * `./api/sweep-types.ts` and re-exported here, its original home — chant
  * #1075's ownership-scoped prune needs the same list without pulling the
- * import parser into a Temporal worker.
+ * import parser in behind the apply activity.
  */
 export { DEFAULT_IMPORT_TYPES };
 

package/src/lint/audit-catalog.ts

@@ -2,7 +2,8 @@
  * The k8s lexicon's chant audit catalog — metadata for its post-synth rules
  * (WK8 and ARGO Kubernetes-manifest rules). Contributed via k8sPlugin.auditCatalog() (#687).
  */
-import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, type RuleMeta } from "@intentius/chant/audit/catalog";
+import { auditRule, K8S_PSS, K8S_SECRETS, SCORECARD_PINNED, type RuleMeta, applyLineage } from "@intentius/chant/audit/catalog";
+import { k8sAuditLineage } from "./audit-lineage";
 
 export const k8sAuditCatalog: Record<string, RuleMeta> = {
   ARGO002: auditRule("ARGO002", "merge-worthy", "guidance", "Argo Application references an undeclared AppProject", "Declare the named AppProject or reference an existing project.", { category: "correctness" }),
@@ -46,3 +47,6 @@ export const k8sAuditCatalog: Record<string, RuleMeta> = {
   WK8504: auditRule("WK8504", "merge-worthy", "guidance", "committed-encrypted secret declaration does not resolve", "Point `file` at the committed ciphertext, make its metadata.name match the declaration, and re-run `sops -e -i` so every data/stringData value is ENC[...].", { authority: [K8S_SECRETS] }),
   WK8505: auditRule("WK8505", "report-only", "guidance", "committed-encrypted secret with no Flux decryption wiring", "Add decryption: \"sops\" to the FluxAppFor reconciling the path that carries the ciphertext sidecar, or ignore if that Kustomization is declared in a different build.", { category: "correctness" }),
 };
+
+// Prior art credits live beside the rules in ./audit-lineage.ts (see core audit/prior-art.ts).
+applyLineage(k8sAuditCatalog, k8sAuditLineage);

package/src/lint/audit-lineage.ts

@@ -0,0 +1,127 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const k8sAuditLineage: Record<string, Lineage[]> = {
+  FLUX002: [
+    { tool: "flux-docs", rule: ".spec.sourceRef", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#source-reference", relation: "overlaps" },
+  ],
+  FLUX003: [
+    { tool: "flux-docs", rule: ".spec.dependsOn", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#dependencies", relation: "overlaps" },
+  ],
+  WK8005: [
+    { tool: "polaris", rule: "sensitiveContainerEnvVar", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+    { tool: "kube-linter", rule: "env-var-secret", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-var-secret", relation: "overlaps" },
+  ],
+  WK8006: [
+    { tool: "kube-linter", rule: "latest-tag", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#latest-tag", relation: "equivalent" },
+    { tool: "polaris", rule: "tagNotSpecified", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_14", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8041: [
+    { tool: "polaris", rule: "sensitiveContainerEnvVar", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+    { tool: "kube-linter", rule: "env-var-secret", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-var-secret", relation: "overlaps" },
+    { tool: "datree", rule: "prevent-exposed-secrets-aws", url: "https://hub.datree.io/built-in-rules/prevent-exposed-secrets-aws", relation: "overlaps" },
+  ],
+  WK8042: [
+    { tool: "polaris", rule: "sensitiveConfigmapContent", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+    { tool: "datree", rule: "prevent-exposed-secrets-privatekey", url: "https://hub.datree.io/built-in-rules/prevent-exposed-secrets-privatekey", relation: "overlaps" },
+  ],
+  WK8101: [
+    { tool: "kube-linter", rule: "mismatching-selector", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#mismatching-selector", relation: "equivalent" },
+    { tool: "kube-score", rule: "deployment-pod-selector-labels-match-template-metadata-labels", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+  ],
+  WK8105: [
+    { tool: "polaris", rule: "pullPolicyNotAlways", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+    { tool: "kube-score", rule: "container-image-pull-policy", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_K8S_15", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+  ],
+  WK8201: [
+    { tool: "polaris", rule: "cpuLimitsMissing", url: "https://polaris.docs.fairwinds.com/checks/efficiency/", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_K8S_13", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    { tool: "kube-score", rule: "container-resources", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+  ],
+  WK8202: [
+    { tool: "kube-linter", rule: "privileged-container", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#privileged-container", relation: "equivalent" },
+    { tool: "polaris", rule: "runAsPrivileged", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_16", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8203: [
+    { tool: "kube-linter", rule: "no-read-only-root-fs", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#no-read-only-root-fs", relation: "equivalent" },
+    { tool: "polaris", rule: "notReadOnlyRootFilesystem", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_22", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8204: [
+    { tool: "polaris", rule: "runAsRootAllowed", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_23", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    { tool: "kube-linter", rule: "run-as-non-root", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#run-as-non-root", relation: "overlaps" },
+  ],
+  WK8205: [
+    { tool: "kubesec", rule: "containers[] .securityContext .capabilities .drop | index(\"ALL\")", url: "https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/", relation: "equivalent" },
+    { tool: "kics", rule: "No Drop Capabilities for Containers", url: "https://docs.kics.io/latest/queries/kubernetes-queries/268ca686-7fb7-4ae9-b129-955a2a89064e/", relation: "overlaps" },
+    { tool: "kube-linter", rule: "drop-net-raw-capability", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#drop-net-raw-capability", relation: "overlaps" },
+  ],
+  WK8207: [
+    { tool: "kube-linter", rule: "host-network", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-network", relation: "equivalent" },
+    { tool: "polaris", rule: "hostNetworkSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_19", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8208: [
+    { tool: "kube-linter", rule: "host-pid", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-pid", relation: "equivalent" },
+    { tool: "polaris", rule: "hostPIDSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_17", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8209: [
+    { tool: "kube-linter", rule: "host-ipc", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-ipc", relation: "equivalent" },
+    { tool: "polaris", rule: "hostIPCSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_18", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8301: [
+    { tool: "kube-score", rule: "pod-probes", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "polaris", rule: "readinessProbeMissing", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_K8S_8", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+  ],
+  WK8302: [
+    { tool: "polaris", rule: "deploymentMissingReplicas", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "equivalent" },
+    { tool: "kube-score", rule: "deployment-replicas", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+    { tool: "datree", rule: "ensure-minimum-two-replicas", url: "https://hub.datree.io/built-in-rules/ensure-minimum-two-replicas", relation: "equivalent" },
+  ],
+  WK8303: [
+    { tool: "kube-score", rule: "deployment-has-poddisruptionbudget", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "polaris", rule: "missingPodDisruptionBudget", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+    { tool: "kics", rule: "Deployment Without PodDisruptionBudget", url: "https://docs.kics.io/latest/queries/kubernetes-queries/b23e9b98-0cb6-4fc9-b257-1f3270442678/", relation: "overlaps" },
+  ],
+  WK8304: [
+    { tool: "polaris", rule: "tlsSettingsMissing", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+  ],
+  WK8305: [
+    { tool: "kube-linter", rule: "dangling-ingress", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#dangling-ingress", relation: "overlaps" },
+    { tool: "kube-score", rule: "ingress-targets-service", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+  ],
+  WK8405: [
+    { tool: "kube-score", rule: "deployment-has-poddisruptionbudget", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "polaris", rule: "missingPodDisruptionBudget", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+  ],
+  WK8406: [
+    { tool: "checkov", rule: "CKV_K8S_13", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    { tool: "kube-score", rule: "container-resources", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "kube-linter", rule: "unset-memory-requirements", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#unset-memory-requirements", relation: "overlaps" },
+  ],
+  WK8501: [
+    { tool: "kube-linter", rule: "schema-validation", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#schema-validation", relation: "overlaps" },
+  ],
+  WK8502: [
+    { tool: "kube-linter", rule: "schema-validation", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#schema-validation", relation: "overlaps" },
+  ],
+  WK8503: [
+    { tool: "kube-linter", rule: "env-value-from", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-value-from", relation: "overlaps" },
+  ],
+  WK8505: [
+    { tool: "flux-docs", rule: ".spec.decryption", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#decryption", relation: "overlaps" },
+  ],
+};

package/src/op/activities/argo.test.ts

@@ -5,9 +5,9 @@ import {
   type ArgoAppStatus,
   type ArgoStatusFetcher,
 } from "./argo";
-// Activity profiles live centrally in the temporal lexicon (loadProfiles reads
-// them there); argoSync marks ArgoSyncFailedError non-retryable for this activity.
-import { TEMPORAL_ACTIVITY_PROFILES } from "@intentius/chant-lexicon-temporal/config";
+// Activity profiles live centrally in core (loadProfiles serves this table);
+// argoSync marks ArgoSyncFailedError non-retryable for this activity.
+import { ACTIVITY_PROFILES } from "@intentius/chant/op/activity-profiles";
 
 /** A fetcher that returns a scripted sequence of statuses, repeating the last. */
 function scriptedFetcher(sequence: ArgoAppStatus[]): ArgoStatusFetcher {
@@ -66,14 +66,13 @@ describe("waitForArgoSync", () => {
 });
 
 describe("argoSync profile", () => {
-  test("is exported with a long timeout and 60s heartbeat", () => {
-    const p = TEMPORAL_ACTIVITY_PROFILES.argoSync;
-    expect(p.startToCloseTimeout).toBe("30m");
-    expect(p.heartbeatTimeout).toBe("60s");
+  test("is exported with a long timeout", () => {
+    const p = ACTIVITY_PROFILES.argoSync;
+    expect(p.timeout).toBe("30m");
   });
 
   test("treats ArgoSyncFailedError as non-retryable", () => {
-    expect(TEMPORAL_ACTIVITY_PROFILES.argoSync.retry?.nonRetryableErrorTypes).toContain(
+    expect(ACTIVITY_PROFILES.argoSync.retry?.nonRetryableErrorTypes).toContain(
       "ArgoSyncFailedError",
     );
   });

package/src/op/activities/argo.ts

@@ -16,8 +16,8 @@ const execAsync = promisify(exec);
  * `ResourceFetcher` for `waitForReady`.
  *
  * It stays **dependency-light** — primitives-only signature (app name /
- * namespace / server), no generated Argo CRD types — so a Temporal worker loads
- * it cheaply.
+ * namespace / server), no generated Argo CRD types — so importing the lexicon's
+ * activity module at run time stays cheap.
  */
 
 export interface WaitForArgoSyncArgs {
@@ -36,7 +36,7 @@ export interface WaitForArgoSyncArgs {
   insecure?: boolean;
   /** kubectl context (used when `server` is not set). */
   context?: string;
-  /** Poll interval in ms (default 15000). Heartbeats every poll. */
+  /** Poll interval in ms (default 15000). */
   intervalMs?: number;
 }
 
@@ -113,7 +113,7 @@ export const defaultArgoStatusFetcher: ArgoStatusFetcher = (args, signal) =>
  * `ArgoSyncFailedError` if it reaches a terminal unhealthy state (Degraded /
  * Missing).
  *
- * Delegates the poll loop, heartbeat, and ready/terminal evaluation to the
+ * Delegates the poll loop and the ready/terminal evaluation to the
  * generic `waitForReady` using the shared `argoproj.io/Application` readiness
  * spec. The Argo `ArgoStatusFetcher` is adapted into a `ResourceFetcher` that
  * shapes `{health, sync}` into the `status.health.status` / `status.sync.status`

package/src/op/activities/index.ts

@@ -1,21 +1,23 @@
 /**
  * k8s Op activities — resolved by the core activity registry when a project's
- * `chant.config.ts` lists the `k8s` lexicon. Relocated from the temporal lexicon
+ * `chant.config.ts` lists the `k8s` lexicon. Relocated from the hosting lexicon
  * (#809) so Kubernetes-facing imperative activities live with their product:
  *   - kubectlApply — server-side apply a rendered manifest (and, since chant
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
- *     is the same work with a report of what it did, which is what the
- *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
+ *     is the same work with a report of what it did, which is what core's
+ *     `nativeApply` dispatcher calls for a kubectl target)
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
  * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
  * owns its own product's activities, and k3d is its own product now. Projects
  * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
  *
- * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
- * the temporal Op-authoring barrel like the other core builders. Each activity is
- * dependency-light — it shells out to a CLI and does not import the k8s declarable
- * surface — so a Temporal worker loads it cheaply.
+ * The step builders (kubectlApply, k3dUp, k3dDown) stay in core and reach
+ * authors through `@intentius/chant/op` like the other core builders. Each
+ * activity is dependency-light — it shells out to a CLI and does not import the
+ * k8s declarable surface — so `loadActivities`
+ * (`packages/core/src/op/activity-registry.ts`), which imports this module at
+ * run time, pulls in nothing expensive.
  */
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl";

package/src/op/activities/kubectl.test.ts

@@ -1,10 +1,11 @@
 /**
  * `kubectlApply` over the typed API client (chant #1074, #1075).
  *
- * The activity contract is what Temporal workers register, so the shape of the
- * arguments and the `Promise<void>` return are asserted alongside the new
- * behavior. Nothing here spawns a process or reads an ambient kubeconfig,
- * which is the acceptance criterion: a worker image needs no `kubectl` binary.
+ * The activity contract is what an Op step names and core's registry resolves,
+ * so the shape of the arguments and the `Promise<void>` return are asserted
+ * alongside the new behavior. Nothing here spawns a process or reads an ambient
+ * kubeconfig, which is the acceptance criterion: the image a run happens in
+ * needs no `kubectl` binary.
  *
  * chant #1075 adds two things to assert: that the field manager is derived
  * from the project's `ownership.stack` rather than hardcoded, and that the

package/src/op/activities/kubectl.ts

@@ -3,9 +3,9 @@
  *
  * chant #1074 moved this off `kubectl apply -f`. The activity contract is
  * unchanged (a manifest path, an optional context, `Promise<void>`, the
- * `longInfra` profile's 15s heartbeat) because Temporal workers register it by
- * that signature; what changed is underneath. The name is kept for the same
- * reason.
+ * `longInfra` profile) because an Op step names the activity by its export
+ * name and core's registry resolves it there; what changed is underneath. The
+ * name is kept for the same reason.
  *
  * chant #1075 finished the job on two axes:
  *
@@ -34,7 +34,6 @@
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { loadAll } from "js-yaml";
-import { safeHeartbeat } from "@intentius/chant/op";
 import { loadChantConfig, resolveOwnershipStack } from "@intentius/chant/config";
 import {
   hasOwnershipMarker,
@@ -50,15 +49,15 @@ import { isGeneratedOnce } from "../../secret-labels";
 /**
  * How the apply treats chant-owned objects that are no longer declared. The
  * same three values `nativeApply` has always taken; `gated` differs from
- * `owned-only` only in that the workflow pauses for approval first, which is
- * the composite's business, not this activity's.
+ * `owned-only` only in that an approval gate runs before this activity does,
+ * which is the composite's business, not this activity's.
  */
 export type ApplyDeleteMode = "never" | "owned-only" | "gated";
 
 export interface KubectlApplyArgs {
   /**
    * Path to a manifest file, or a directory of them. With `documents` given,
-   * this becomes only the human-facing label the heartbeats and logs carry
+   * this becomes only the human-facing label the step's log lines carry
    * (e.g. `kustomize:<dir>`), and nothing is read from disk.
    */
   manifest: string;
@@ -310,74 +309,61 @@ export async function applyManifest(
 ): Promise<ApplyManifestResult> {
   const documents = args.documents ?? readManifestDocuments(args.manifest);
   const { fieldManager, stack } = await resolveApplyIdentity(args);
-  const heartbeatInterval = setInterval(() => {
-    safeHeartbeat({ step: "kubectl apply", manifest: args.manifest });
-  }, 15_000);
-
-  try {
-    const { client } = await connect({
-      ...(args.environment !== undefined ? { environment: args.environment } : {}),
-      ...(args.context !== undefined ? { context: args.context } : {}),
-      ...(args.cwd !== undefined ? { cwd: args.cwd } : {}),
-    });
+  const { client } = await connect({
+    ...(args.environment !== undefined ? { environment: args.environment } : {}),
+    ...(args.context !== undefined ? { context: args.context } : {}),
+    ...(args.cwd !== undefined ? { cwd: args.cwd } : {}),
+  });
 
-    const applied: AppliedRef[] = [];
-    for (const document of documents) {
-      const stamped = stampOwnership(document as K8sObject, stack);
-      let result: K8sObject;
-      try {
-        result = await client.apply(stamped, {
-          fieldManager,
-          force: args.force ?? false,
-          dryRun: args.dryRun,
-          signal,
-        });
-      } catch (err) {
-        // "chant never forces a conflict on its own" is about taking fields
-        // from ANOTHER tool. A conflict where every contested field is owned
-        // by another `chant:*` manager is chant contesting itself — the
-        // ownership-stack → unit-stack label migration, or a renamed deploy
-        // unit — and refusing that forever would strand every estate applied
-        // before the rename with no non-force path back. Retake those fields
-        // deliberately, once, and only when no foreign manager is involved.
-        if (!isChantSelfConflict(err)) throw err;
-        result = await client.apply(stamped, { fieldManager, force: true, dryRun: args.dryRun, signal });
-      }
-      const ref: AppliedRef = {
-        apiVersion: String(result.apiVersion ?? document.apiVersion ?? ""),
-        kind: String(result.kind ?? document.kind ?? ""),
-        name: String(result.metadata?.name ?? ""),
-        ...(result.metadata?.namespace !== undefined
-          ? { namespace: String(result.metadata.namespace) }
-          : {}),
-      };
-      applied.push(ref);
-      safeHeartbeat({
-        step: "kubectl apply",
-        manifest: args.manifest,
-        applied: `${ref.kind}/${ref.name}`,
+  const applied: AppliedRef[] = [];
+  for (const document of documents) {
+    const stamped = stampOwnership(document as K8sObject, stack);
+    let result: K8sObject;
+    try {
+      result = await client.apply(stamped, {
+        fieldManager,
+        force: args.force ?? false,
+        dryRun: args.dryRun,
+        signal,
       });
-      console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} applied${args.dryRun ? " (dry run — nothing persisted)" : ""}`);
+    } catch (err) {
+      // "chant never forces a conflict on its own" is about taking fields
+      // from ANOTHER tool. A conflict where every contested field is owned
+      // by another `chant:*` manager is chant contesting itself — the
+      // ownership-stack → unit-stack label migration, or a renamed deploy
+      // unit — and refusing that forever would strand every estate applied
+      // before the rename with no non-force path back. Retake those fields
+      // deliberately, once, and only when no foreign manager is involved.
+      if (!isChantSelfConflict(err)) throw err;
+      result = await client.apply(stamped, { fieldManager, force: true, dryRun: args.dryRun, signal });
     }
+    const ref: AppliedRef = {
+      apiVersion: String(result.apiVersion ?? document.apiVersion ?? ""),
+      kind: String(result.kind ?? document.kind ?? ""),
+      name: String(result.metadata?.name ?? ""),
+      ...(result.metadata?.namespace !== undefined
+        ? { namespace: String(result.metadata.namespace) }
+        : {}),
+    };
+    applied.push(ref);
+    console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} applied${args.dryRun ? " (dry run — nothing persisted)" : ""}`);
+  }
 
-    const deleteMode = args.deleteMode ?? "never";
-    const { pruned, retained } =
-      deleteMode === "never" || args.dryRun
-        ? { pruned: [], retained: [] }
-        : await pruneOrphans(client, applied, {
-            ...(stack !== undefined ? { stack } : {}),
-            signal,
-          });
+  const deleteMode = args.deleteMode ?? "never";
+  const { pruned, retained } =
+    deleteMode === "never" || args.dryRun
+      ? { pruned: [], retained: [] }
+      : await pruneOrphans(client, applied, {
+          ...(stack !== undefined ? { stack } : {}),
+          signal,
+        });
 
-    return { fieldManager, applied, pruned, retained };
-  } finally {
-    clearInterval(heartbeatInterval);
-  }
+  return { fieldManager, applied, pruned, retained };
 }
 
 /**
  * Apply every document in `args.manifest`.
- * Uses longInfra profile — 20m timeout, heartbeat every 15s.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export async function kubectlApply(
   args: KubectlApplyArgs,
@@ -524,7 +510,6 @@ async function pruneOrphans(
   for (const ref of candidates) {
     await client.delete(ref, { ...(options.signal ? { signal: options.signal } : {}) });
     pruned.push(ref);
-    safeHeartbeat({ step: "prune", pruned: `${ref.kind}/${ref.name}` });
     console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} pruned (chant-owned, no longer declared)`);
   }
   return { pruned, retained };

package/src/op/activities/wait-for-ready.test.ts

@@ -11,7 +11,7 @@ import {
   type ReadinessSpec,
 } from "./wait-for-ready";
 // The k8sWait profile marks ReadinessFailedError non-retryable for this activity.
-import { TEMPORAL_ACTIVITY_PROFILES } from "@intentius/chant-lexicon-temporal/config";
+import { ACTIVITY_PROFILES } from "@intentius/chant/op/activity-profiles";
 import { fakeCluster, objectKey } from "../../api/fake-cluster";
 
 /** A fetcher returning a scripted sequence of objects, repeating the last. */
@@ -156,7 +156,7 @@ describe("waitForReady", () => {
   });
 
   test("k8sWait marks ReadinessFailedError non-retryable", () => {
-    expect(TEMPORAL_ACTIVITY_PROFILES.k8sWait.retry?.nonRetryableErrorTypes).toContain("ReadinessFailedError");
+    expect(ACTIVITY_PROFILES.k8sWait.retry?.nonRetryableErrorTypes).toContain("ReadinessFailedError");
   });
 
   test("explicit spec wins over the registry", async () => {

package/src/op/activities/wait-for-ready.ts

@@ -1,4 +1,4 @@
-import { safeHeartbeat, sleep } from "@intentius/chant/op";
+import { sleep } from "@intentius/chant/op";
 import { defaultK8sConnector, type K8sConnector } from "../../api/connect";
 
 /**
@@ -6,8 +6,8 @@ import { defaultK8sConnector, type K8sConnector } from "../../api/connect";
  * ready, driven by a data-only **readiness spec** rather than per-CRD code.
  *
  * Like `waitForArgoSync`, this activity is intentionally **dependency-light**:
- * its signature is primitives + a plain readiness spec, so a Temporal worker
- * loads it without importing the generated CRD declarable surface. It reads the
+ * its signature is primitives + a plain readiness spec, so the activity module
+ * loads without pulling in the generated CRD declarable surface. It reads the
  * resource and evaluates the spec's predicates. It generalizes the bespoke
  * `waitForArgoSync` / `waitForStack` waits — see #365.
  *
@@ -271,7 +271,7 @@ export interface WaitForReadyArgs {
   group?: string;
   /** Explicit readiness spec — wins over the registry/default. */
   spec?: ReadinessSpec;
-  /** Poll interval in ms (default 15000). Heartbeats every poll. */
+  /** Poll interval in ms (default 15000). */
   intervalMs?: number;
 }
 
@@ -335,8 +335,9 @@ export const defaultResourceFetcher: ResourceFetcher = (args, signal) => apiReso
 
 /**
  * Poll until the resource satisfies its readiness spec. Throws
- * `ReadinessFailedError` on a terminal state. Heartbeats every poll so the
- * `k8sWait` profile's 60s heartbeat timeout never trips.
+ * `ReadinessFailedError` on a terminal state, which the `k8sWait` profile lists
+ * as non-retryable, so a resource that will never become ready fails on the
+ * first attempt instead of burning the profile's 15m timeout three times.
  *
  * @param fetcher injectable reader (defaults to kubectl). Tests pass a fake to
  *   drive not-ready → ready / terminal transitions.
@@ -355,7 +356,6 @@ export async function waitForReady(
     attempt++;
 
     const obj = await fetcher(args, signal);
-    safeHeartbeat({ step: "waitForReady", kind: args.kind, name: args.name, attempt });
 
     const term = firstTerminal(obj, spec);
     if (term) {