@intentius/chant-lexicon-k8s 0.57.0 → 0.59.0

package/src/lint/audit-lineage.ts

@@ -0,0 +1,127 @@
+/**
+ * Prior art for these audit rules: the open-source tools whose checks cover the
+ * same condition, credited per rule. See packages/core/src/audit/prior-art.ts for
+ * the registry, the relation vocabulary, and why this is credit rather than
+ * authority. Kept by hand; the prior-art sweep (scripts/prior-art-sweep.ts) reports
+ * when a credited tool's index no longer lists a rule cited here.
+ */
+import type { Lineage } from "@intentius/chant/audit/catalog";
+
+export const k8sAuditLineage: Record<string, Lineage[]> = {
+  FLUX002: [
+    { tool: "flux-docs", rule: ".spec.sourceRef", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#source-reference", relation: "overlaps" },
+  ],
+  FLUX003: [
+    { tool: "flux-docs", rule: ".spec.dependsOn", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#dependencies", relation: "overlaps" },
+  ],
+  WK8005: [
+    { tool: "polaris", rule: "sensitiveContainerEnvVar", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+    { tool: "kube-linter", rule: "env-var-secret", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-var-secret", relation: "overlaps" },
+  ],
+  WK8006: [
+    { tool: "kube-linter", rule: "latest-tag", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#latest-tag", relation: "equivalent" },
+    { tool: "polaris", rule: "tagNotSpecified", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_14", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8041: [
+    { tool: "polaris", rule: "sensitiveContainerEnvVar", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+    { tool: "kube-linter", rule: "env-var-secret", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-var-secret", relation: "overlaps" },
+    { tool: "datree", rule: "prevent-exposed-secrets-aws", url: "https://hub.datree.io/built-in-rules/prevent-exposed-secrets-aws", relation: "overlaps" },
+  ],
+  WK8042: [
+    { tool: "polaris", rule: "sensitiveConfigmapContent", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+    { tool: "datree", rule: "prevent-exposed-secrets-privatekey", url: "https://hub.datree.io/built-in-rules/prevent-exposed-secrets-privatekey", relation: "overlaps" },
+  ],
+  WK8101: [
+    { tool: "kube-linter", rule: "mismatching-selector", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#mismatching-selector", relation: "equivalent" },
+    { tool: "kube-score", rule: "deployment-pod-selector-labels-match-template-metadata-labels", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+  ],
+  WK8105: [
+    { tool: "polaris", rule: "pullPolicyNotAlways", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+    { tool: "kube-score", rule: "container-image-pull-policy", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_K8S_15", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+  ],
+  WK8201: [
+    { tool: "polaris", rule: "cpuLimitsMissing", url: "https://polaris.docs.fairwinds.com/checks/efficiency/", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_K8S_13", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    { tool: "kube-score", rule: "container-resources", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+  ],
+  WK8202: [
+    { tool: "kube-linter", rule: "privileged-container", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#privileged-container", relation: "equivalent" },
+    { tool: "polaris", rule: "runAsPrivileged", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_16", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8203: [
+    { tool: "kube-linter", rule: "no-read-only-root-fs", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#no-read-only-root-fs", relation: "equivalent" },
+    { tool: "polaris", rule: "notReadOnlyRootFilesystem", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_22", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8204: [
+    { tool: "polaris", rule: "runAsRootAllowed", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_23", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+    { tool: "kube-linter", rule: "run-as-non-root", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#run-as-non-root", relation: "overlaps" },
+  ],
+  WK8205: [
+    { tool: "kubesec", rule: "containers[] .securityContext .capabilities .drop | index(\"ALL\")", url: "https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/", relation: "equivalent" },
+    { tool: "kics", rule: "No Drop Capabilities for Containers", url: "https://docs.kics.io/latest/queries/kubernetes-queries/268ca686-7fb7-4ae9-b129-955a2a89064e/", relation: "overlaps" },
+    { tool: "kube-linter", rule: "drop-net-raw-capability", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#drop-net-raw-capability", relation: "overlaps" },
+  ],
+  WK8207: [
+    { tool: "kube-linter", rule: "host-network", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-network", relation: "equivalent" },
+    { tool: "polaris", rule: "hostNetworkSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_19", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8208: [
+    { tool: "kube-linter", rule: "host-pid", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-pid", relation: "equivalent" },
+    { tool: "polaris", rule: "hostPIDSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_17", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8209: [
+    { tool: "kube-linter", rule: "host-ipc", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#host-ipc", relation: "equivalent" },
+    { tool: "polaris", rule: "hostIPCSet", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "equivalent" },
+    { tool: "checkov", rule: "CKV_K8S_18", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "equivalent" },
+  ],
+  WK8301: [
+    { tool: "kube-score", rule: "pod-probes", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "polaris", rule: "readinessProbeMissing", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+    { tool: "checkov", rule: "CKV_K8S_8", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+  ],
+  WK8302: [
+    { tool: "polaris", rule: "deploymentMissingReplicas", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "equivalent" },
+    { tool: "kube-score", rule: "deployment-replicas", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "equivalent" },
+    { tool: "datree", rule: "ensure-minimum-two-replicas", url: "https://hub.datree.io/built-in-rules/ensure-minimum-two-replicas", relation: "equivalent" },
+  ],
+  WK8303: [
+    { tool: "kube-score", rule: "deployment-has-poddisruptionbudget", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "polaris", rule: "missingPodDisruptionBudget", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+    { tool: "kics", rule: "Deployment Without PodDisruptionBudget", url: "https://docs.kics.io/latest/queries/kubernetes-queries/b23e9b98-0cb6-4fc9-b257-1f3270442678/", relation: "overlaps" },
+  ],
+  WK8304: [
+    { tool: "polaris", rule: "tlsSettingsMissing", url: "https://polaris.docs.fairwinds.com/checks/security/", relation: "overlaps" },
+  ],
+  WK8305: [
+    { tool: "kube-linter", rule: "dangling-ingress", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#dangling-ingress", relation: "overlaps" },
+    { tool: "kube-score", rule: "ingress-targets-service", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+  ],
+  WK8405: [
+    { tool: "kube-score", rule: "deployment-has-poddisruptionbudget", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "polaris", rule: "missingPodDisruptionBudget", url: "https://polaris.docs.fairwinds.com/checks/reliability/", relation: "overlaps" },
+  ],
+  WK8406: [
+    { tool: "checkov", rule: "CKV_K8S_13", url: "https://www.checkov.io/5.Policy%20Index/kubernetes.html", relation: "overlaps" },
+    { tool: "kube-score", rule: "container-resources", url: "https://github.com/zegl/kube-score/blob/master/README_CHECKS.md", relation: "overlaps" },
+    { tool: "kube-linter", rule: "unset-memory-requirements", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#unset-memory-requirements", relation: "overlaps" },
+  ],
+  WK8501: [
+    { tool: "kube-linter", rule: "schema-validation", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#schema-validation", relation: "overlaps" },
+  ],
+  WK8502: [
+    { tool: "kube-linter", rule: "schema-validation", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#schema-validation", relation: "overlaps" },
+  ],
+  WK8503: [
+    { tool: "kube-linter", rule: "env-value-from", url: "https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md#env-value-from", relation: "overlaps" },
+  ],
+  WK8505: [
+    { tool: "flux-docs", rule: ".spec.decryption", url: "https://fluxcd.io/flux/components/kustomize/kustomizations/#decryption", relation: "overlaps" },
+  ],
+};

package/src/lint/post-synth/wk8505.ts

@@ -15,7 +15,9 @@
  * invocations, so "no Kustomization in THIS build sets spec.decryption" can
  * mean "wired up in the other build" as easily as "forgotten" — the design
  * doc's §4 explains why no path-to-build-target join exists to tell those
- * apart. Promote to error if that join ever becomes available.
+ * apart. Single-build-root scoped, tracked by chant #1939 as a candidate for
+ * an opt-in project-level mode; promote to error if that join ever becomes
+ * available.
  *
  * Fires only on claims that actually resolved (`problems.length === 0`, via
  * `resolveEncryptedSecretClaims`), not on every raw declaration. An
@@ -39,7 +41,7 @@ function fluxKustomizations(manifests: K8sManifest[]): K8sManifest[] {
 export const wk8505: PostSynthCheck = {
   id: "WK8505",
   description:
-    "committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it",
+    "committed-encrypted secret with no Flux decryption wiring — add decryption: 'sops' to the FluxAppFor reconciling the path that carries it. Sees one build root at a time, so it goes silent when that Kustomization lives in a different build root (chant #1939).",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const kustomizations = fluxKustomizations(allManifests(ctx));

package/src/op/activities/argo.test.ts

@@ -5,9 +5,9 @@ import {
   type ArgoAppStatus,
   type ArgoStatusFetcher,
 } from "./argo";
-// Activity profiles live centrally in the temporal lexicon (loadProfiles reads
-// them there); argoSync marks ArgoSyncFailedError non-retryable for this activity.
-import { TEMPORAL_ACTIVITY_PROFILES } from "@intentius/chant-lexicon-temporal/config";
+// Activity profiles live centrally in core (loadProfiles serves this table);
+// argoSync marks ArgoSyncFailedError non-retryable for this activity.
+import { ACTIVITY_PROFILES } from "@intentius/chant/op/activity-profiles";
 
 /** A fetcher that returns a scripted sequence of statuses, repeating the last. */
 function scriptedFetcher(sequence: ArgoAppStatus[]): ArgoStatusFetcher {
@@ -66,14 +66,13 @@ describe("waitForArgoSync", () => {
 });
 
 describe("argoSync profile", () => {
-  test("is exported with a long timeout and 60s heartbeat", () => {
-    const p = TEMPORAL_ACTIVITY_PROFILES.argoSync;
-    expect(p.startToCloseTimeout).toBe("30m");
-    expect(p.heartbeatTimeout).toBe("60s");
+  test("is exported with a long timeout", () => {
+    const p = ACTIVITY_PROFILES.argoSync;
+    expect(p.timeout).toBe("30m");
   });
 
   test("treats ArgoSyncFailedError as non-retryable", () => {
-    expect(TEMPORAL_ACTIVITY_PROFILES.argoSync.retry?.nonRetryableErrorTypes).toContain(
+    expect(ACTIVITY_PROFILES.argoSync.retry?.nonRetryableErrorTypes).toContain(
       "ArgoSyncFailedError",
     );
   });

package/src/op/activities/argo.ts

@@ -16,8 +16,8 @@ const execAsync = promisify(exec);
  * `ResourceFetcher` for `waitForReady`.
  *
  * It stays **dependency-light** — primitives-only signature (app name /
- * namespace / server), no generated Argo CRD types — so a Temporal worker loads
- * it cheaply.
+ * namespace / server), no generated Argo CRD types — so importing the lexicon's
+ * activity module at run time stays cheap.
  */
 
 export interface WaitForArgoSyncArgs {
@@ -36,7 +36,7 @@ export interface WaitForArgoSyncArgs {
   insecure?: boolean;
   /** kubectl context (used when `server` is not set). */
   context?: string;
-  /** Poll interval in ms (default 15000). Heartbeats every poll. */
+  /** Poll interval in ms (default 15000). */
   intervalMs?: number;
 }
 
@@ -113,7 +113,7 @@ export const defaultArgoStatusFetcher: ArgoStatusFetcher = (args, signal) =>
  * `ArgoSyncFailedError` if it reaches a terminal unhealthy state (Degraded /
  * Missing).
  *
- * Delegates the poll loop, heartbeat, and ready/terminal evaluation to the
+ * Delegates the poll loop and the ready/terminal evaluation to the
  * generic `waitForReady` using the shared `argoproj.io/Application` readiness
  * spec. The Argo `ArgoStatusFetcher` is adapted into a `ResourceFetcher` that
  * shapes `{health, sync}` into the `status.health.status` / `status.sync.status`

package/src/op/activities/index.ts

@@ -1,21 +1,23 @@
 /**
  * k8s Op activities — resolved by the core activity registry when a project's
- * `chant.config.ts` lists the `k8s` lexicon. Relocated from the temporal lexicon
+ * `chant.config.ts` lists the `k8s` lexicon. Relocated from the hosting lexicon
  * (#809) so Kubernetes-facing imperative activities live with their product:
  *   - kubectlApply — server-side apply a rendered manifest (and, since chant
  *     #1075, prune chant-owned objects it no longer declares; `applyManifest`
- *     is the same work with a report of what it did, which is what the
- *     Temporal lexicon's `nativeApply` dispatcher calls for a kubectl target)
+ *     is the same work with a report of what it did, which is what core's
+ *     `nativeApply` dispatcher calls for a kubectl target)
  *   - waitForArgoSync — block until an Argo CD Application is Healthy && Synced
  *
  * k3dUp / k3dDown moved again, to the k3d lexicon (chant #1410) — a lexicon
  * owns its own product's activities, and k3d is its own product now. Projects
  * using them list `k3d` in `lexicons`; loadActivities(["k3d"]) provides them.
  *
- * The step builders (kubectlApply, k3dUp, k3dDown) stay in core, re-exported from
- * the temporal Op-authoring barrel like the other core builders. Each activity is
- * dependency-light — it shells out to a CLI and does not import the k8s declarable
- * surface — so a Temporal worker loads it cheaply.
+ * The step builders (kubectlApply, k3dUp, k3dDown) stay in core and reach
+ * authors through `@intentius/chant/op` like the other core builders. Each
+ * activity is dependency-light — it shells out to a CLI and does not import the
+ * k8s declarable surface — so `loadActivities`
+ * (`packages/core/src/op/activity-registry.ts`), which imports this module at
+ * run time, pulls in nothing expensive.
  */
 export { kubectlApply, applyManifest, readManifestDocuments } from "./kubectl";
 export type { KubectlApplyArgs, ApplyManifestResult, AppliedRef, ApplyDeleteMode } from "./kubectl";
@@ -61,3 +63,17 @@ export type {
 // truth — see `lexicons/k8s/src/config.ts` for the config shape.
 export { resolveClusterTarget, ClusterBindingMismatchError } from "@intentius/chant/kubectl-context";
 export type { ResolvedClusterTarget, K8sClusterProfile, K8sConfigShape } from "@intentius/chant/kubectl-context";
+
+// Effect-receipt activities (#2074): core's receipt seam (#1834) bound to
+// this lexicon's ConfigMap-backed store (../../receipt-store.ts), the same
+// way the aws lexicon binds its SSM store (#1835). Re-exported individually:
+// `receiptRead`/`receiptWrite` serve the `effect()` step's
+// read-compare-run-write, `receiptStaleness` serves WatchOp's read-only
+// staleness reporting.
+import { receiptActivities } from "@intentius/chant/op/receipt-store";
+import { k8sReceiptStore } from "../../receipt-store";
+
+const boundReceiptActivities = receiptActivities(k8sReceiptStore());
+export const receiptRead = boundReceiptActivities.receiptRead;
+export const receiptWrite = boundReceiptActivities.receiptWrite;
+export const receiptStaleness = boundReceiptActivities.receiptStaleness;

package/src/op/activities/kubectl.test.ts

@@ -1,10 +1,11 @@
 /**
  * `kubectlApply` over the typed API client (chant #1074, #1075).
  *
- * The activity contract is what Temporal workers register, so the shape of the
- * arguments and the `Promise<void>` return are asserted alongside the new
- * behavior. Nothing here spawns a process or reads an ambient kubeconfig,
- * which is the acceptance criterion: a worker image needs no `kubectl` binary.
+ * The activity contract is what an Op step names and core's registry resolves,
+ * so the shape of the arguments and the `Promise<void>` return are asserted
+ * alongside the new behavior. Nothing here spawns a process or reads an ambient
+ * kubeconfig, which is the acceptance criterion: the image a run happens in
+ * needs no `kubectl` binary.
  *
  * chant #1075 adds two things to assert: that the field manager is derived
  * from the project's `ownership.stack` rather than hardcoded, and that the
@@ -493,6 +494,44 @@ describe("the ownership-scoped prune (chant #1075)", () => {
     expect(deletes).toEqual(["/api/v1/namespaces/prod/secrets/stale-config"]);
   });
 
+  test("an effect receipt ConfigMap is excluded from the prunable set and reported retained (#2074)", async () => {
+    const cluster = fakeCluster({
+      respond: echoApplies,
+      objects: {
+        [objectKey("apps/v1", "Deployment", "web", "prod")]: ownedObject("apps/v1", "Deployment", "web", "prod"),
+        [objectKey("v1", "ConfigMap", "chant-receipt.demo.prod.db-seed", "prod")]: ownedObject(
+          "v1",
+          "ConfigMap",
+          "chant-receipt.demo.prod.db-seed",
+          "prod",
+          {
+            metadata: {
+              labels: {
+                "app.kubernetes.io/managed-by": "chant",
+                "chant.intentius.io/effect-receipt": "db-seed",
+              },
+            },
+          },
+        ),
+        [objectKey("v1", "ConfigMap", "stale-config", "prod")]: ownedObject("v1", "ConfigMap", "stale-config", "prod"),
+      },
+    });
+    const result = await applyManifest(
+      { manifest: manifest(), deleteMode: "owned-only" },
+      undefined,
+      cluster.connector,
+    );
+
+    expect(result.retained).toEqual([
+      { apiVersion: "v1", kind: "ConfigMap", name: "chant-receipt.demo.prod.db-seed", namespace: "prod" },
+    ]);
+    expect(result.pruned).toEqual([
+      { apiVersion: "v1", kind: "ConfigMap", name: "stale-config", namespace: "prod" },
+    ]);
+    const deletes = cluster.layer.requests.filter((r) => r.method === "DELETE").map((r) => r.path);
+    expect(deletes).toEqual(["/api/v1/namespaces/prod/configmaps/stale-config"]);
+  });
+
   test("an object without chant's marker is never a candidate", async () => {
     const cluster = clusterWithOrphans();
     await applyManifest({ manifest: manifest(), deleteMode: "owned-only" }, undefined, cluster.connector);

package/src/op/activities/kubectl.ts

@@ -3,9 +3,9 @@
  *
  * chant #1074 moved this off `kubectl apply -f`. The activity contract is
  * unchanged (a manifest path, an optional context, `Promise<void>`, the
- * `longInfra` profile's 15s heartbeat) because Temporal workers register it by
- * that signature; what changed is underneath. The name is kept for the same
- * reason.
+ * `longInfra` profile) because an Op step names the activity by its export
+ * name and core's registry resolves it there; what changed is underneath. The
+ * name is kept for the same reason.
  *
  * chant #1075 finished the job on two axes:
  *
@@ -34,7 +34,6 @@
 import { readFileSync, readdirSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { loadAll } from "js-yaml";
-import { safeHeartbeat } from "@intentius/chant/op";
 import { loadChantConfig, resolveOwnershipStack } from "@intentius/chant/config";
 import {
   hasOwnershipMarker,
@@ -46,19 +45,20 @@ import { defaultK8sConnector, type K8sConnector } from "../../api/connect";
 import { operationFor } from "../../api/operation-surface";
 import { DEFAULT_IMPORT_TYPES } from "../../api/sweep-types";
 import { isGeneratedOnce } from "../../secret-labels";
+import { isEffectReceiptObject } from "../../effect-receipt-row";
 
 /**
  * How the apply treats chant-owned objects that are no longer declared. The
  * same three values `nativeApply` has always taken; `gated` differs from
- * `owned-only` only in that the workflow pauses for approval first, which is
- * the composite's business, not this activity's.
+ * `owned-only` only in that an approval gate runs before this activity does,
+ * which is the composite's business, not this activity's.
  */
 export type ApplyDeleteMode = "never" | "owned-only" | "gated";
 
 export interface KubectlApplyArgs {
   /**
    * Path to a manifest file, or a directory of them. With `documents` given,
-   * this becomes only the human-facing label the heartbeats and logs carry
+   * this becomes only the human-facing label the step's log lines carry
    * (e.g. `kustomize:<dir>`), and nothing is read from disk.
    */
   manifest: string;
@@ -310,74 +310,61 @@ export async function applyManifest(
 ): Promise<ApplyManifestResult> {
   const documents = args.documents ?? readManifestDocuments(args.manifest);
   const { fieldManager, stack } = await resolveApplyIdentity(args);
-  const heartbeatInterval = setInterval(() => {
-    safeHeartbeat({ step: "kubectl apply", manifest: args.manifest });
-  }, 15_000);
-
-  try {
-    const { client } = await connect({
-      ...(args.environment !== undefined ? { environment: args.environment } : {}),
-      ...(args.context !== undefined ? { context: args.context } : {}),
-      ...(args.cwd !== undefined ? { cwd: args.cwd } : {}),
-    });
+  const { client } = await connect({
+    ...(args.environment !== undefined ? { environment: args.environment } : {}),
+    ...(args.context !== undefined ? { context: args.context } : {}),
+    ...(args.cwd !== undefined ? { cwd: args.cwd } : {}),
+  });
 
-    const applied: AppliedRef[] = [];
-    for (const document of documents) {
-      const stamped = stampOwnership(document as K8sObject, stack);
-      let result: K8sObject;
-      try {
-        result = await client.apply(stamped, {
-          fieldManager,
-          force: args.force ?? false,
-          dryRun: args.dryRun,
-          signal,
-        });
-      } catch (err) {
-        // "chant never forces a conflict on its own" is about taking fields
-        // from ANOTHER tool. A conflict where every contested field is owned
-        // by another `chant:*` manager is chant contesting itself — the
-        // ownership-stack → unit-stack label migration, or a renamed deploy
-        // unit — and refusing that forever would strand every estate applied
-        // before the rename with no non-force path back. Retake those fields
-        // deliberately, once, and only when no foreign manager is involved.
-        if (!isChantSelfConflict(err)) throw err;
-        result = await client.apply(stamped, { fieldManager, force: true, dryRun: args.dryRun, signal });
-      }
-      const ref: AppliedRef = {
-        apiVersion: String(result.apiVersion ?? document.apiVersion ?? ""),
-        kind: String(result.kind ?? document.kind ?? ""),
-        name: String(result.metadata?.name ?? ""),
-        ...(result.metadata?.namespace !== undefined
-          ? { namespace: String(result.metadata.namespace) }
-          : {}),
-      };
-      applied.push(ref);
-      safeHeartbeat({
-        step: "kubectl apply",
-        manifest: args.manifest,
-        applied: `${ref.kind}/${ref.name}`,
+  const applied: AppliedRef[] = [];
+  for (const document of documents) {
+    const stamped = stampOwnership(document as K8sObject, stack);
+    let result: K8sObject;
+    try {
+      result = await client.apply(stamped, {
+        fieldManager,
+        force: args.force ?? false,
+        dryRun: args.dryRun,
+        signal,
       });
-      console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} applied${args.dryRun ? " (dry run — nothing persisted)" : ""}`);
+    } catch (err) {
+      // "chant never forces a conflict on its own" is about taking fields
+      // from ANOTHER tool. A conflict where every contested field is owned
+      // by another `chant:*` manager is chant contesting itself — the
+      // ownership-stack → unit-stack label migration, or a renamed deploy
+      // unit — and refusing that forever would strand every estate applied
+      // before the rename with no non-force path back. Retake those fields
+      // deliberately, once, and only when no foreign manager is involved.
+      if (!isChantSelfConflict(err)) throw err;
+      result = await client.apply(stamped, { fieldManager, force: true, dryRun: args.dryRun, signal });
     }
+    const ref: AppliedRef = {
+      apiVersion: String(result.apiVersion ?? document.apiVersion ?? ""),
+      kind: String(result.kind ?? document.kind ?? ""),
+      name: String(result.metadata?.name ?? ""),
+      ...(result.metadata?.namespace !== undefined
+        ? { namespace: String(result.metadata.namespace) }
+        : {}),
+    };
+    applied.push(ref);
+    console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} applied${args.dryRun ? " (dry run — nothing persisted)" : ""}`);
+  }
 
-    const deleteMode = args.deleteMode ?? "never";
-    const { pruned, retained } =
-      deleteMode === "never" || args.dryRun
-        ? { pruned: [], retained: [] }
-        : await pruneOrphans(client, applied, {
-            ...(stack !== undefined ? { stack } : {}),
-            signal,
-          });
+  const deleteMode = args.deleteMode ?? "never";
+  const { pruned, retained } =
+    deleteMode === "never" || args.dryRun
+      ? { pruned: [], retained: [] }
+      : await pruneOrphans(client, applied, {
+          ...(stack !== undefined ? { stack } : {}),
+          signal,
+        });
 
-    return { fieldManager, applied, pruned, retained };
-  } finally {
-    clearInterval(heartbeatInterval);
-  }
+  return { fieldManager, applied, pruned, retained };
 }
 
 /**
  * Apply every document in `args.manifest`.
- * Uses longInfra profile — 20m timeout, heartbeat every 15s.
+ * Uses the longInfra profile: 20m timeout, three attempts backing off from 30s.
  */
 export async function kubectlApply(
   args: KubectlApplyArgs,
@@ -517,6 +504,20 @@ async function pruneOrphans(
       );
       continue;
     }
+    // An effect receipt never enters the prunable set either (#2074, epic
+    // #1703 decision 3). It is chant-owned and is never in ANY apply set,
+    // the `effect()` step being its sole writer, which is exactly the shape
+    // this sweep deletes. Pruning one would tell the next plan that an effect
+    // never ran and re-fire it, or worse, be re-stamped by nothing and leave
+    // the estate re-running a migration on every apply.
+    if (target.kind === "ConfigMap" && isEffectReceiptObject(item.metadata?.labels)) {
+      retained.push(ref);
+      console.log(
+        `${ref.apiVersion} ${ref.kind}/${ref.name} retained (effect receipt: owned and never declared ` +
+          `in an apply set, but never pruned; the effect() step is its sole writer)`,
+      );
+      continue;
+    }
     candidates.push(ref);
   }
 
@@ -524,7 +525,6 @@ async function pruneOrphans(
   for (const ref of candidates) {
     await client.delete(ref, { ...(options.signal ? { signal: options.signal } : {}) });
     pruned.push(ref);
-    safeHeartbeat({ step: "prune", pruned: `${ref.kind}/${ref.name}` });
     console.log(`${ref.apiVersion} ${ref.kind}/${ref.name} pruned (chant-owned, no longer declared)`);
   }
   return { pruned, retained };

package/src/op/activities/wait-for-ready.test.ts

@@ -11,7 +11,7 @@ import {
   type ReadinessSpec,
 } from "./wait-for-ready";
 // The k8sWait profile marks ReadinessFailedError non-retryable for this activity.
-import { TEMPORAL_ACTIVITY_PROFILES } from "@intentius/chant-lexicon-temporal/config";
+import { ACTIVITY_PROFILES } from "@intentius/chant/op/activity-profiles";
 import { fakeCluster, objectKey } from "../../api/fake-cluster";
 
 /** A fetcher returning a scripted sequence of objects, repeating the last. */
@@ -156,7 +156,7 @@ describe("waitForReady", () => {
   });
 
   test("k8sWait marks ReadinessFailedError non-retryable", () => {
-    expect(TEMPORAL_ACTIVITY_PROFILES.k8sWait.retry?.nonRetryableErrorTypes).toContain("ReadinessFailedError");
+    expect(ACTIVITY_PROFILES.k8sWait.retry?.nonRetryableErrorTypes).toContain("ReadinessFailedError");
   });
 
   test("explicit spec wins over the registry", async () => {

package/src/op/activities/wait-for-ready.ts

@@ -1,4 +1,4 @@
-import { safeHeartbeat, sleep } from "@intentius/chant/op";
+import { sleep } from "@intentius/chant/op";
 import { defaultK8sConnector, type K8sConnector } from "../../api/connect";
 
 /**
@@ -6,8 +6,8 @@ import { defaultK8sConnector, type K8sConnector } from "../../api/connect";
  * ready, driven by a data-only **readiness spec** rather than per-CRD code.
  *
  * Like `waitForArgoSync`, this activity is intentionally **dependency-light**:
- * its signature is primitives + a plain readiness spec, so a Temporal worker
- * loads it without importing the generated CRD declarable surface. It reads the
+ * its signature is primitives + a plain readiness spec, so the activity module
+ * loads without pulling in the generated CRD declarable surface. It reads the
  * resource and evaluates the spec's predicates. It generalizes the bespoke
  * `waitForArgoSync` / `waitForStack` waits — see #365.
  *
@@ -271,7 +271,7 @@ export interface WaitForReadyArgs {
   group?: string;
   /** Explicit readiness spec — wins over the registry/default. */
   spec?: ReadinessSpec;
-  /** Poll interval in ms (default 15000). Heartbeats every poll. */
+  /** Poll interval in ms (default 15000). */
   intervalMs?: number;
 }
 
@@ -335,8 +335,9 @@ export const defaultResourceFetcher: ResourceFetcher = (args, signal) => apiReso
 
 /**
  * Poll until the resource satisfies its readiness spec. Throws
- * `ReadinessFailedError` on a terminal state. Heartbeats every poll so the
- * `k8sWait` profile's 60s heartbeat timeout never trips.
+ * `ReadinessFailedError` on a terminal state, which the `k8sWait` profile lists
+ * as non-retryable, so a resource that will never become ready fails on the
+ * first attempt instead of burning the profile's 15m timeout three times.
  *
  * @param fetcher injectable reader (defaults to kubectl). Tests pass a fake to
  *   drive not-ready → ready / terminal transitions.
@@ -355,7 +356,6 @@ export async function waitForReady(
     attempt++;
 
     const obj = await fetcher(args, signal);
-    safeHeartbeat({ step: "waitForReady", kind: args.kind, name: args.name, attempt });
 
     const term = firstTerminal(obj, spec);
     if (term) {

package/src/op/builders.ts

@@ -18,20 +18,20 @@
  * earlier step's declared output.
  *
  * `core`'s own `kubectlApply`/`waitForReady`/`ensureSecret` (in
- * `@intentius/chant/op`, re-exported from `@intentius/chant-lexicon-temporal`
- * for lexicon-agnostic single-import convenience) are UNCHANGED and produce
- * byte-identical `ActivityStep` output for the same inputs — these are purely
- * additive. Deliberately not swapped into the temporal barrel: that would
- * make `@intentius/chant-lexicon-temporal` depend on this package (and on
- * helm, for `helmInstall`) at runtime, which is exactly the "a worker image
- * needs no kubectl binary" / "temporal stays product-agnostic" property the
+ * `@intentius/chant/op`, the lexicon-agnostic single-import barrel) are
+ * UNCHANGED and produce byte-identical `ActivityStep` output for the same
+ * inputs — these are purely additive. Deliberately not swapped into core's
+ * barrel: that would make `@intentius/chant` depend on this package (and on
+ * helm, for `helmInstall`) at runtime, so a project that never touches
+ * Kubernetes would install both just to import anything from `op`. That is
+ * exactly the "core stays product-agnostic" property the
  * `op/activities/index.ts` module docs across this repo call out on purpose
- * (activities were moved OUT of temporal into per-product lexicons for this
- * reason; the step-builder layer shouldn't reintroduce the coupling from the
- * other direction). An author who wants the typed surface imports it from
- * here — `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
- * already depends on; existing `@intentius/chant-lexicon-temporal` imports
- * keep working exactly as before, opting in only if the import is changed.
+ * (activities live in per-product lexicons for this reason; the step-builder
+ * layer shouldn't reintroduce the coupling from the other direction). An
+ * author who wants the typed surface imports it from here —
+ * `@intentius/chant-lexicon-k8s` — which a project using `kubectlApply`
+ * already depends on; existing `@intentius/chant/op` imports keep working
+ * exactly as before, opting in only if the import is changed.
  */
 
 import {