@intentius/chant 0.100.0 → 0.101.0

package/src/cli/handlers/fan-out.test.ts

@@ -204,8 +204,8 @@ describe("proof: a plan-only invocation prints the derivation and dispatches not
     expect(out).toContain("wave 1: cluster-a");
     expect(out).toContain("seeded from an earlier run: net");
     expect(out).toMatch(/billing +unaffected/);
-    expect(out).toMatch(/plan: sha256:[0-9a-f]{64}/);
-    expect(out).toMatch(/approve: chant approve fan-out release --plan sha256:[0-9a-f]{64}/);
+    expect(out).toMatch(/plan: jcs1-sha256:[0-9a-f]{64}/);
+    expect(out).toMatch(/approve: chant approve fan-out release --plan jcs1-sha256:[0-9a-f]{64}/);
   });
 
   test("--dry-run with --resume shows what is left, at the digest that approves it", async () => {
@@ -214,7 +214,7 @@ describe("proof: a plan-only invocation prints the derivation and dispatches not
       const resume = join(dir, "attempt.json");
       failing = ["cluster-a"];
       await runComponentsFanOut(ctx({ base: "main", env: "test", resume }));
-      const digest = /plan: (sha256:[0-9a-f]{64})/.exec(stderr())?.[1];
+      const digest = /plan: (jcs1-sha256:[0-9a-f]{64})/.exec(stderr())?.[1];
 
       ran = [];
       stderrLines = [];
@@ -236,7 +236,7 @@ describe("proof: a plan-only invocation prints the derivation and dispatches not
     expect(exit).toBe(0);
     const parsed = JSON.parse(stdout());
     expect(parsed.order).toEqual(["net", "cluster-a", "cluster-b", "app-one", "app-three", "app-two"]);
-    expect(parsed.digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(parsed.digest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
   });
 });
 
@@ -334,10 +334,10 @@ describe("proof: one approval covers the set, and the printed digest is what app
     expect(ran).toEqual([]);
     const out = stderr();
     expect(out).toContain("gated: nothing ran.");
-    expect(out).toMatch(/approve : chant approve fan-out release --plan sha256:[0-9a-f]{64}/);
+    expect(out).toMatch(/approve : chant approve fan-out release --plan jcs1-sha256:[0-9a-f]{64}/);
     // One pending fact for the whole set, not one per component.
     expect(gateLedger.appended).toHaveLength(1);
-    expect(gateLedger.appended[0].planDigest).toBe(/plan: (sha256:[0-9a-f]{64})/.exec(out)?.[1]);
+    expect(gateLedger.appended[0].planDigest).toBe(/plan: (jcs1-sha256:[0-9a-f]{64})/.exec(out)?.[1]);
   });
 
   test("the resolution for that digest lets the whole set through", async () => {

package/src/cli/handlers/fan-out.ts

@@ -38,6 +38,7 @@
 import { resolve, dirname } from "node:path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { loadChantConfig, resolveAutoReleaseDisabled, type ChantConfig } from "../../config";
+import { samePlanDigest } from "../../lifecycle/plan-digest";
 import { affectedStacks } from "../../lifecycle/affected";
 import { deriveFanOut, fanOutRegistry } from "../../components/fan-out-support";
 import { runFanOut } from "../../components/fan-out-run";
@@ -242,7 +243,7 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
       console.error(formatError({ message: `--resume: could not read "${args.resume}": ${err instanceof Error ? err.message : String(err)}` }));
       return 1;
     }
-    if (attempt && attempt.digest !== derived.plan.digest) {
+    if (attempt && !samePlanDigest(attempt.digest, derived.plan.digest)) {
       console.error(formatWarning({
         message: `--resume: "${args.resume}" records a different fan-out (${attempt.digest || "no digest"}), so its progress does not apply here`,
         hint: "The derivation changed, which makes this a different change. Everything selected will run.",

package/src/cli/handlers/graph.test.ts

@@ -161,6 +161,7 @@ describe("runGraph", () => {
     observeMock.mockReset();
     buildMock.mockReset();
     loadPluginsMock.mockReset();
+    loadPluginsMock.mockResolvedValue([]);
     resolveLexMock.mockReset();
     loadChantConfigMock.mockReset();
     loadChantConfigMock.mockResolvedValue({ config: {} });
@@ -228,6 +229,47 @@ describe("runGraph", () => {
       expect(ir.edges).toContainEqual({ from: "subnet", to: "vpc", kind: "ref", viaAttr: "network" });
     });
 
+    // #2559 — a lexicon's graphMeta answer lands in the IR meta, so the
+    // workspace graph can list collector pipelines without core importing otel.
+    test("--format ir carries what a lexicon's graphMeta reports under meta", async () => {
+      lintClean(); discovered();
+      const seen: string[][] = [];
+      loadPluginsMock.mockResolvedValue([{
+        name: "gcp",
+        serializer: {},
+        graphMeta: (entities: Map<string, unknown>) => {
+          seen.push([...entities.keys()].sort());
+          return { collector: { pipelines: [] } };
+        },
+      }]);
+      resolveLexMock.mockResolvedValue(["gcp"]);
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      expect(seen).toEqual([["pod", "subnet", "vpc"]]);
+      expect(JSON.parse(stdoutBuf.join("\n")).meta).toEqual({ collector: { pipelines: [] } });
+    });
+
+    test("--format ir has no meta when no lexicon reports anything", async () => {
+      lintClean(); discovered();
+      loadPluginsMock.mockResolvedValue([{ name: "gcp", serializer: {}, graphMeta: () => undefined }, { name: "k8s", serializer: {} }]);
+      resolveLexMock.mockResolvedValue(["gcp", "k8s"]);
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      expect("meta" in JSON.parse(stdoutBuf.join("\n"))).toBe(false);
+    });
+
+    test("--format ir keeps the first answer when two lexicons report one key", async () => {
+      lintClean(); discovered();
+      loadPluginsMock.mockResolvedValue([
+        { name: "a", serializer: {}, graphMeta: () => ({ collector: 1 }) },
+        { name: "b", serializer: {}, graphMeta: () => ({ collector: 2 }) },
+      ]);
+      resolveLexMock.mockResolvedValue(["a", "b"]);
+      const exit = await runGraph({ args: makeArgs({ format: "ir" }), plugins: [], serializers: [] });
+      expect(exit).toBe(0);
+      expect(JSON.parse(stdoutBuf.join("\n")).meta).toEqual({ collector: 1 });
+    });
+
     // #2529 — the IR carries its version, as the first key, so a reader can
     // decide how to read the rest before it reads anything else.
     test("--format ir leads with the IR version", async () => {

package/src/cli/handlers/graph.ts

@@ -702,6 +702,27 @@ async function buildPipelineProjection(
  * Lint-gated: the IR represents valid infra, so we refuse to emit for source that
  * does not pass lint. Non-zero on discovery errors or a layout-engine failure.
  */
+/**
+ * Add what the lexicons' `graphMeta` hooks report to `ir.meta` (#2559). A
+ * lexicon with nothing to report leaves the IR as it was, so a project that
+ * declares none of their entities prints what it did before. Two lexicons
+ * that answer the same key keep the first and say so on stderr.
+ */
+function withGraphMeta(ir: GraphIR, plugins: LexiconPlugin[], entities: Map<string, import("../../declarable").Declarable>): GraphIR {
+  const added: Record<string, unknown> = {};
+  for (const p of plugins) {
+    if (!p.graphMeta) continue;
+    for (const [key, value] of Object.entries(p.graphMeta(entities) ?? {})) {
+      if (key in added || (ir.meta && key in ir.meta)) {
+        console.error(formatWarning({ message: `the ${p.name} lexicon reports graph meta "${key}", which another source already set; its value is dropped` }));
+        continue;
+      }
+      added[key] = value;
+    }
+  }
+  return Object.keys(added).length === 0 ? ir : { ...ir, meta: { ...(ir.meta ?? {}), ...added } };
+}
+
 /** Returned instead of a graph when the prediction cannot be attempted honestly. */
 const REFUSED = Symbol("behaviour-refused");
 
@@ -855,6 +876,7 @@ async function runGraphView(
     });
     if (predicted === REFUSED) return 1;
     ir = predicted;
+    ir = withGraphMeta(ir, plugins as LexiconPlugin[], result.entities);
   }
 
   if (ctx.args.lens) {

package/src/cli/handlers/operator.ts

@@ -1047,7 +1047,7 @@ export async function recordGateApproval(
   if (opts.plan !== undefined) {
     if (!isPlanDigest(opts.plan)) {
       console.error(formatError({
-        message: `--plan must be a plan digest ("sha256:" and 64 hex characters), got "${opts.plan}"`,
+        message: `--plan must be a plan digest ("jcs1-sha256:" or "sha256:", then 64 hex characters), got "${opts.plan}"`,
         hint: "Copy it from the gated run's `plan :` line, or from the pending-gate summary. It is not a plan file path.",
       }));
       return { ok: false };

package/src/cli/main.test.ts

@@ -747,25 +747,57 @@ describe("workspace init and ls (#2534)", () => {
     expect(resolveCommand(init, commandRegistry)?.def.name).toBe("workspace init");
     expect(commandRegistry.filter((c) => c.name === "workspace" || c.name.startsWith("workspace ")).map((c) => c.name).sort()).toEqual([
       "workspace",
+      "workspace admit",
+      "workspace adopt-lineage",
+      "workspace agent",
       "workspace audit",
       "workspace build",
       "workspace check",
+      "workspace evidence",
+      "workspace export",
       "workspace graph",
+      "workspace hash-index",
+      "workspace import",
       "workspace init",
       "workspace lineage",
       "workspace lint",
       "workspace ls",
       "workspace member-run",
       "workspace patch",
+      "workspace pin",
       "workspace points",
       "workspace records",
+      "workspace signers",
       "workspace status",
       "workspace upgrade",
       "workspace verify",
+      "workspace versions",
       "workspace work",
     ]);
   });
 
+  test("adopt-lineage, hash-index, versions and upgrade --source take their flags (#2551)", () => {
+    const adopt = parseArgs(["workspace", "adopt-lineage", "app", "--from", "acme/starter#svc", "--tags", "v*", "--index", "i.json", "--param", "name=x", "--dry-run"]);
+    expect(adopt).toMatchObject({ command: "workspace", path: "adopt-lineage", extraPositional: "app", migrateFrom: "acme/starter#svc", tags: "v*", index: "i.json", param: ["name=x"], dryRun: true });
+    expect(resolveCommand(adopt, commandRegistry)?.def.name).toBe("workspace adopt-lineage");
+    expect(parseArgs(["workspace", "versions", "--available", "--template", "x"])).toMatchObject({ path: "versions", available: true, template: "x" });
+    expect(parseArgs(["workspace", "upgrade", "--source", "acme/upstream", "--to", "v2.0.0"])).toMatchObject({ source: "acme/upstream", migrateTo: "v2.0.0" });
+    expect(() => parseArgs(["workspace", "adopt-lineage", "--tags"])).toThrow(/--tags needs a tag glob/);
+    expect(() => parseArgs(["workspace", "upgrade", "--source", "--to"])).toThrow(/--source needs a template/);
+  });
+
+  test("export, import and admit take their arguments (#2552)", () => {
+    const exp = parseArgs(["workspace", "export", "app,design", "--to", "out", "--param", "domain=example.com", "--dry-run", "--json"]);
+    expect(exp).toMatchObject({ command: "workspace", path: "export", extraPositional: "app,design", migrateTo: "out", param: ["domain=example.com"], dryRun: true, json: true });
+    expect(resolveCommand(exp, commandRegistry)?.def.name).toBe("workspace export");
+    const imp = parseArgs(["workspace", "import", "../copy", "--remove"]);
+    expect(imp).toMatchObject({ path: "import", extraPositional: "../copy", remove: true });
+    expect(resolveCommand(imp, commandRegistry)?.def.name).toBe("workspace import");
+    const admit = parseArgs(["workspace", "admit", "ret-0123456789ab", "--note", "returned from the studio"]);
+    expect(admit).toMatchObject({ path: "admit", extraPositional: "ret-0123456789ab", note: "returned from the studio" });
+    expect(resolveCommand(admit, commandRegistry)?.def.name).toBe("workspace admit");
+  });
+
   test("workspace work takes its verb, id and lease flags (#2732)", () => {
     const claim = parseArgs(["workspace", "work", "claim", "W-001", "--holder", "a", "--ttl", "60", "--json"]);
     expect(claim).toMatchObject({ command: "workspace", path: "work", extraPositional: "claim", extraPositional2: "W-001", holder: "a", ttl: "60", json: true });

package/src/cli/main.ts

@@ -456,6 +456,12 @@ export function parseArgs(args: string[]): ParsedArgs {
       // `chant workspace records new <kind> --prefix <prefix>` (#2670): the id prefix to allocate under.
       result.prefix = args[++i];
       if (!result.prefix || result.prefix.startsWith("-")) throw new Error("--prefix needs an id prefix: --prefix <prefix>");
+    } else if (arg === "--key" || arg === "--check-id" || arg === "--claim" || arg === "--environment" || arg === "--envelope" || arg === "--threshold") {
+      // `chant workspace evidence sign|verify` and `chant workspace signers` (#2553)
+      const value = args[++i];
+      if (value === undefined || value.startsWith("-")) throw new Error(`${arg} needs a value`);
+      const field = ({ "--key": "key", "--check-id": "checkId", "--claim": "claim", "--environment": "environment", "--envelope": "envelope", "--threshold": "threshold" } as const)[arg];
+      result[field] = value;
     } else if (arg === "--require") {
       // `chant workspace records|verify --require attested` (#2547)
       result.require = args[++i];
@@ -576,6 +582,24 @@ export function parseArgs(args: string[]): ParsedArgs {
       // #2550 — `chant workspace upgrade` runs a template's code migrations
       // only when asked to.
       result.allowCode = true;
+    } else if (arg === "--source") {
+      // #2551 — `chant workspace upgrade --source <repo>[#<member>]`.
+      result.source = args[++i];
+      if (!result.source || result.source.startsWith("-")) throw new Error("--source needs a template: --source <repo>[#<member>]");
+    } else if (arg === "--tags") {
+      // #2551 — `chant workspace adopt-lineage --tags <glob>`, also hash-index and versions.
+      result.tags = args[++i];
+      if (!result.tags || result.tags.startsWith("-")) throw new Error("--tags needs a tag glob: --tags 'v*'");
+    } else if (arg === "--index") {
+      // #2551 — `chant workspace adopt-lineage --index <file>`.
+      result.index = args[++i];
+      if (!result.index || result.index.startsWith("-")) throw new Error("--index needs a hash index file: --index <file>");
+    } else if (arg === "--remove") {
+      // #2552 — `chant workspace import --remove` removes the export member instead of writing it again.
+      result.remove = true;
+    } else if (arg === "--available") {
+      // #2551 — `chant workspace versions --available` lists the template's version tags.
+      result.available = true;
     } else if (arg === "--root-only") {
       // #2537 — `chant build` and `chant lint` at a declared workspace root
       // run on the root project alone instead of refusing with WSP000.
@@ -909,24 +933,77 @@ Workspace (level 1, #2524):
   workspace points answer <id> --answer <value> --by <name>... [--kind <kind file>] [--dry-run]
                         Record people's answer to an open question, or confirm
                         a model's proposal, once the point's quorum is met
+  workspace pin <path> [--json]
+                        Print the integrity value that pins the plugin at
+                        <path>, to put in a path pin of chant.workspace.json.
+                        chant checks it before it reads the plugin
+  workspace agent [<name>] [--json]
+                        Print an agent session from the declaration: the one
+                        member it is bound to, the record kinds and verbs its
+                        write scope allows, and the spec records --current
+                        prints. Without a name, the session CHANT_AGENT names
   workspace verify [--base <rev>] [--head <rev>] [--require attested]
                         Check the commits in base..head against the signers
                         and roles read from base. A change to the signers file
                         or .chant/trust.json needs a signature by a signer
-                        trusted at base. Does nothing without a signers file
+                        trusted at base, and a new signer set needs a
+                        threshold of the old one. Does nothing without a
+                        signers file
+  workspace signers [--json] [rotate [--threshold <n>] | sign --key <file>]
+                        Show the signer history at base, or propose the next
+                        signer set and sign it with a current signer's key
+  workspace evidence sign --kind <kind file> --key <runner.pem> --check-id <id>
+                        Sign runner evidence over the records' hashes in a
+                        DSSE envelope, with a runner key .chant/trust.json
+                        lists. For CI and services, never a person's key
+  workspace evidence verify --envelope <file> [--at <rev>] [--json]
+                        Verify runner evidence offline, and whether the
+                        records it covers are unchanged
   workspace lineage [--json]
                         Show each scope in .chant/workspace.lock.json: its
                         template and pin, locally edited files and open
                         manual steps. Needs no workspace file
   workspace lineage resolve <path>
                         Close a manual step once the file is merged by hand
-  workspace upgrade [<scope>] [--to <ref|dir>] [--allow-code] [--dry-run] [--output <file>]
+  workspace upgrade [<scope>] [--to <ref|dir>] [--source <repo>[#<member>]] [--allow-code] [--dry-run] [--output <file>]
                         Bring a lineage scope to a newer template version: fetch
                         it, migrate and merge per file in a worktree, run build,
                         lint and workspace check there, then gate on the digest
                         of the patch (chant approve workspace-upgrade <scope>).
-                        A second run with the approval applies the patch
-  workspace check [--at <rev>] [--json] [--format stylish|json|sarif] [--generated] [--kind <kind file>]
+                        A second run with the approval applies the patch.
+                        --source <repo>[#<member>] moves the scope to another
+                        template through that template's bridge migration
+  workspace adopt-lineage [<scope>] --from <repo>[@<ref>][#<member>] [--tags <glob>]
+                        [--index <file>] [--param name=value] [--dry-run] [--json]
+                        Give a scope a git lineage: match a scope with none
+                        against the template's versions and record the best
+                        one, with the adopted commit range in .chant/trust.json,
+                        or move a directory lineage onto the version that
+                        reproduces its recorded files
+  workspace hash-index --from <repo>[#<member>] [--tags <glob>] [--output <file>]
+                        Compute the per-version file hashes adopt-lineage
+                        matches against, for a template's CI to publish
+  workspace versions [<dir>] [--template <id>] [--available [--tags <glob>]] [--json]
+                        Report the template, chant and lexicon versions of
+                        every lineage lock under <dir>, grouped into families
+                        by template; --available also lists each git
+                        template's version tags and where each lock sits
+  workspace export [<member>[,<member>...]] [--to <member>] [--param name=value] [--dry-run] [--json]
+                        Write members that set travel, with their lineage and
+                        records, into the export member (role export) as a
+                        workspace of their own; with no member named, every
+                        member that travels and the workspace's own records.
+                        --param gives a host-bound parameter its value there
+  workspace import [<dir>] [--remove] [--dry-run] [--json]
+                        Bring an export back: merge per file against the
+                        export's hashes, switch host values back, record the
+                        return in .chant/returns/<id>.json with the commits the
+                        files were made in, then write the export member again
+                        or, with --remove, remove it
+  workspace admit <return id> [--note <text>] [--dry-run] [--json]
+                        Admit the signers of a return in .chant/trust.json, so
+                        its signed work reads as attested once merged
+  workspace check [--at <rev>] [--json] [--format stylish|json|sarif] [--generated] [--kind <kind file>] [--live --env <env>]
                         Fail on an unreadable lineage lock or an open manual
                         step, and, in a declared workspace, on a WSP check of
                         the declaration, member ledgers, pipelines or
@@ -934,14 +1011,21 @@ Workspace (level 1, #2524):
                         and compares their output. --kind warns on records
                         whose pinned files changed. Needs no workspace file.
                         --at reads a commit's git objects; --format json
-                        prints the read-contract document
+                        prints the read-contract document. --live --env
+                        resolves each declared member link against the live
+                        graph of <env> (each chant member runs chant graph
+                        --live, which reaches the account) and reports
+                        WSP141 and WSP142
   workspace check --changes <base>..<head> [--work <id>] [--severity off|warn|fail] [--kind <kind file>...] [--json]
                         Map each path the diff changes to the current records
                         whose constrains cover it: change-uncovered when none
                         does, change-out-of-scope when a record in hand (the
                         --work item and its decisions) lists it in
                         out_of_scope. The declaration's changes block sets
-                        the severity (warn by default) and ignore globs
+                        the severity (warn by default) and ignore globs. When
+                        the declaration at base has writeScope or agents, each
+                        commit that writes outside its writer's scope fails
+                        the check (write-scope-member, write-scope-kind)
   workspace patch <base>..<head>|<base>...<head>|<commit> [--path <p>...] [--max-bytes <n>] [--json]
   workspace patch [<commit>] --worktree [--path <p>...] [--max-bytes <n>] [--json]
                         The hunks of a diff, file by file: a range, a work
@@ -1471,6 +1555,14 @@ export const commandRegistry: CommandDef[] = [
   { name: "workspace status", handler: async (ctx) => (await import("../workspace/status")).runWorkspaceStatus(ctx) },
   { name: "workspace lineage", handler: async (ctx) => (await import("../workspace/lineage-cli")).runWorkspaceLineage(ctx) },
   { name: "workspace upgrade", handler: async (ctx) => (await import("../workspace/lineage-upgrade-cli")).runWorkspaceUpgrade(ctx) },
+  // #2551 — adopt a lineage, the hash index it matches against, and the versions of a family of workspaces.
+  { name: "workspace adopt-lineage", handler: async (ctx) => (await import("../workspace/lineage-adopt-cli")).runWorkspaceAdoptLineage(ctx) },
+  { name: "workspace hash-index", handler: async (ctx) => (await import("../workspace/lineage-adopt-cli")).runWorkspaceHashIndex(ctx) },
+  // #2552 — export a workspace or members, bring an export back, and admit a return's signers.
+  { name: "workspace export", handler: async (ctx) => (await import("../workspace/export-cli")).runWorkspaceExport(ctx) },
+  { name: "workspace import", handler: async (ctx) => (await import("../workspace/export-cli")).runWorkspaceImport(ctx) },
+  { name: "workspace admit", handler: async (ctx) => (await import("../workspace/export-cli")).runWorkspaceAdmit(ctx) },
+  { name: "workspace versions", handler: async (ctx) => (await import("../workspace/lineage-versions")).runWorkspaceVersions(ctx) },
   // #2641 — workspace check reads member configs statically and never runs one.
   { name: "workspace check", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/lineage-check")).runWorkspaceCheck(ctx) },
   // The hunks of a diff, for a reader that runs no git of its own.
@@ -1484,7 +1576,12 @@ export const commandRegistry: CommandDef[] = [
   { name: "workspace graph", handler: async (ctx) => (await import("../workspace/member-commands")).runWorkspaceMembers(ctx, "graph") },
   // Each unit decides for itself whether its config is loaded (runCommandInProcess).
   { name: "workspace member-run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/member-run")).runWorkspaceMemberRun(ctx, runCommandInProcess) },
+  { name: "workspace pin", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/pin-cli")).runWorkspacePin(ctx) },
+  // #2548 — an agent session's member, write scope and spec, for a session that resumes.
+  { name: "workspace agent", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/agent-cli")).runWorkspaceAgent(ctx) },
   { name: "workspace verify", handler: async (ctx) => (await import("../workspace/trust/verify-cli")).runWorkspaceVerify(ctx) },
+  { name: "workspace signers", handler: async (ctx) => (await import("../workspace/trust/signers-cli")).runWorkspaceSigners(ctx) },
+  { name: "workspace evidence", handler: async (ctx) => (await import("../workspace/trust/evidence-cli")).runWorkspaceEvidence(ctx) },
 
   // State subcommands
   { name: "lifecycle snapshot", requiresPlugins: true, handler: runLifecycleSnapshot },

package/src/cli/mcp/workspace-tools.test.ts

@@ -85,7 +85,7 @@ describe("which servers have the workspace tools", () => {
       const { tools } = (await rpc(server(cwd), "tools/list")) as { tools: { name: string }[] };
       expect(tools.map((t) => t.name)).toEqual(expect.arrayContaining(names));
     }
-    expect(names).toEqual(["workspace-ls", "workspace-status", "workspace-graph", "workspace-changes", "workspace-records", "workspace-points", "workspace-work-history", "records-new", "records-amend", "records-review", "records-close", "points-answer"]);
+    expect(names).toEqual(["workspace-ls", "workspace-status", "workspace-graph", "workspace-changes", "workspace-records", "workspace-points", "workspace-agent", "workspace-work-history", "records-new", "records-amend", "records-review", "records-close", "points-answer"]);
   });
 
   test("a server outside any workspace, or given none, does not", async () => {

package/src/cli/mcp/workspace-tools.ts

@@ -28,11 +28,20 @@
  *
  * Nothing here listens on a port or authenticates anyone (ws-052): the server
  * speaks over stdio, and `by` is recorded as given, as `--by` is.
+ *
+ * An agent session (#2548): a server started with `CHANT_AGENT` set writes in
+ * that session, bound to its one member, and its writes are refused outside
+ * the session's write scope with the CLI's codes (`write-scope-member`,
+ * `write-scope-kind`, `agent-unknown`). `workspace-agent` returns what the
+ * session reloads from.
  */
 
 import { spawn } from "node:child_process";
 import type { ToolContext, ToolDefinition, ToolHandler } from "./types";
 
+/** `AGENT_ENV` of `workspace/write-scope.ts`, kept here so the server loads nothing under workspace/ until a tool is called. */
+const AGENT_ENV = "CHANT_AGENT";
+
 /** How the reads run chant: a command and its leading arguments. */
 export type ChantCommand = string[];
 
@@ -49,6 +58,8 @@ export interface WorkspaceToolsOptions {
   cwd: string;
   /** The chant the reads run. Defaults to {@link ownChantCommand}. */
   chantCommand?: ChantCommand;
+  /** The agent session the writes are made in (#2548). Defaults to `CHANT_AGENT`. */
+  agent?: string;
 }
 
 const PROTOCOL =
@@ -154,6 +165,17 @@ export const workspaceReadTools: ToolDefinition[] = [
       },
     },
   },
+  {
+    name: "workspace-agent",
+    description:
+      "An agent session and what it reloads from (#2548): chant workspace agent <name> --json (agent.schema.json). The one member it is bound to, the record kinds and verbs its write scope allows, and the spec records --current prints, read from the repository alone. Without name, this server's session (CHANT_AGENT). Returns the document unchanged.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        name: { type: "string", description: "The session's name, as the declaration's agents list gives it." },
+      },
+    },
+  },
   {
     name: "workspace-work-history",
     description:
@@ -334,6 +356,10 @@ export function readArgv(tool: string, params: Record<string, unknown>): string[
         "--json",
       ];
     }
+    case "workspace-agent": {
+      const name = str(params, "name", true)!;
+      return ["workspace", "agent", name, "--json"];
+    }
     case "workspace-work-history": {
       const item = str(params, "item", true)!;
       const kind = str(params, "kind");
@@ -413,10 +439,12 @@ export interface WorkspaceTool {
 export function createWorkspaceTools(options: WorkspaceToolsOptions): WorkspaceTool[] {
   const { cwd } = options;
   const chant = options.chantCommand ?? ownChantCommand();
+  const agent = options.agent ?? (process.env[AGENT_ENV] || undefined);
   const reads: WorkspaceTool[] = workspaceReadTools.map((definition) => ({
     definition,
     handler: async (params) => {
-      const argv = readArgv(definition.name, params);
+      const given = definition.name === "workspace-agent" && params.name === undefined && agent !== undefined ? { ...params, name: agent } : params;
+      const argv = readArgv(definition.name, given);
       const id = definition.name === "workspace-records" ? str(params, "id") : undefined;
       const doc = await runRead(chant, argv, cwd);
       return id !== undefined ? onlyRecord(doc, id) : doc;
@@ -446,6 +474,7 @@ export function createWorkspaceTools(options: WorkspaceToolsOptions): WorkspaceT
         sign: sign(params),
         dryRun: bool(params, "dryRun"),
         cwd,
+        agent,
         through: { source: mcpSource(context), opensInitial: true },
       });
     },
@@ -463,6 +492,7 @@ export function createWorkspaceTools(options: WorkspaceToolsOptions): WorkspaceT
         sign: sign(params),
         dryRun: bool(params, "dryRun"),
         cwd,
+        agent,
         through: { source: mcpSource(context) },
       });
     },
@@ -481,6 +511,7 @@ export function createWorkspaceTools(options: WorkspaceToolsOptions): WorkspaceT
         sign: sign(params),
         dryRun: bool(params, "dryRun"),
         cwd,
+        agent,
       });
     },
     "points-answer": async (params) => {
@@ -498,7 +529,7 @@ export function createWorkspaceTools(options: WorkspaceToolsOptions): WorkspaceT
       const named = str(params, "kind");
       const kind = named !== undefined ? w.resolveWriteKind(named, cwd) : await w.declaredSessionKind(RECORDS_CLOSE_SCHEMA_ID, cwd);
       if (typeof kind !== "string") return kind;
-      return closeRecord({ kind, id, dryRun: bool(params, "dryRun"), cwd });
+      return closeRecord({ kind, id, dryRun: bool(params, "dryRun"), cwd, agent });
     },
   };
 

package/src/cli/registry.ts

@@ -133,6 +133,16 @@ export interface ParsedArgs {
   namespace?: string;
   /** `chant workspace upgrade --allow-code` (#2550) — run migrations whose body is the template's own code. */
   allowCode?: boolean;
+  /** `chant workspace upgrade --source <repo>[#<member>]` (#2551): move the scope to another template. */
+  source?: string;
+  /** `chant workspace adopt-lineage --tags <glob>` and `hash-index --tags` (#2551): the tags to compare. */
+  tags?: string;
+  /** `chant workspace adopt-lineage --index <file>` (#2551): a cached hash index. */
+  index?: string;
+  /** `chant workspace versions --available` (#2551): list each git template's version tags. */
+  available?: boolean;
+  /** `chant workspace import --remove` (#2552): remove the export member instead of writing it again. */
+  remove?: boolean;
   /** `chant lifecycle rollback --dry-run` — compute the rollback delta and print it; open no PR, push nothing, leave no branch. */
   dryRun?: boolean;
   /** `chant lifecycle teardown <env> --yes` — execute the planned deletion
@@ -342,6 +352,18 @@ export interface ParsedArgs {
   prefix?: string;
   /** `chant workspace records|verify --require attested` (#2547): the provenance level a gate requires. */
   require?: string;
+  /** `chant workspace evidence sign --key` (a runner's Ed25519 PEM) and `signers sign --key` (an ssh private key) (#2553). */
+  key?: string;
+  /** `chant workspace evidence sign --check-id <id>` (#2553): the check the evidence is for. */
+  checkId?: string;
+  /** `chant workspace evidence sign --claim <file>` (#2553): hashed into the evidence. */
+  claim?: string;
+  /** `chant workspace evidence sign --environment <file>` (#2553): the runner environment, hashed into the evidence. */
+  environment?: string;
+  /** `chant workspace evidence verify --envelope <file>` (#2553). */
+  envelope?: string;
+  /** `chant workspace signers rotate --threshold <n>` (#2553). */
+  threshold?: string;
   /**
    * `chant build --root-only` and `chant lint --root-only` (#2537): run on the
    * root project of a declared workspace, members left out, instead of

package/src/cli/serve-mcp-workspace.test.ts

@@ -70,7 +70,7 @@ describe("chant serve mcp at a workspace root with no lexicon of its own (#2700)
     expect(init.serverInfo.name).toBe("chant");
     for (const name of CORE_TOOLS) expect(tools).toContain(name);
     expect(tools).toContain("docker:diff");
-    expect(init.instructions).toContain("Member delivery (delivery/) declares docker.");
+    expect(init.instructions).toContain("Member delivery (delivery/) declares docker, otel.");
   }, TIMEOUT);
 
   test("a lexiconless root, lexicons only in a member, serves core and the lexicons that load", () => {

package/src/codegen/release-wiring.test.ts

@@ -36,6 +36,9 @@ function releaseTagShapes(): Array<{ recipe: string; example: string }> {
   // `git tag "chant-v$next"` / `git tag "lexicon-{{name}}-v$next"`
   for (const m of justfile.matchAll(/git tag "([^"]+)"/g)) {
     const raw = m[1];
+    // The reference workspace's tag (`release_reference_tag`, #2543) rides
+    // along with a chant release and publishes nothing by design.
+    if (raw === "$rtag") continue;
     const example = raw
       .replace(/\{\{name\}\}/g, "docker")
       .replace(/\$\{?next\}?/g, "9.9.9");
@@ -196,7 +199,8 @@ describe("release wiring: release the newest green commit (#2816)", () => {
     }
     const lib = readFileSync(join(repoRoot, "scripts", "release-lib.sh"), "utf-8");
     // main and the tag land together or not at all, and nothing is forced.
-    expect(lib).toMatch(/git push --quiet --atomic origin "HEAD:refs\/heads\/main" "refs\/tags\/\$tag"/);
+    expect(lib).toMatch(/push_refs=\("refs\/tags\/\$tag"\)/);
+    expect(lib).toMatch(/git push --quiet --atomic origin "HEAD:refs\/heads\/main" "\$\{push_refs\[@\]\}"/);
     expect(lib).not.toMatch(/git push[^\n]*(--force|\s-f\b)/);
   });
 

package/src/components/fan-out-output.test.ts

@@ -93,7 +93,7 @@ describe("the derivation", () => {
     expect(out).toContain(`plan: ${plan.digest}`);
     expect(out).toContain(`chant approve fan-out release --plan ${plan.digest}`);
     // Nothing abbreviates it: the whole 64-hex string is on the line.
-    expect(plan.digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(plan.digest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
   });
 
   test("says so plainly when a change propagates to nothing", () => {

package/src/components/fan-out.test.ts

@@ -157,7 +157,7 @@ describe("the binding digest", () => {
   });
 
   test("it looks like every other plan digest, so `chant approve --plan` accepts it", () => {
-    expect(planFanOut({ components: ESTATE, changed: ["net"] }).digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(planFanOut({ components: ESTATE, changed: ["net"] }).digest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
   });
 });
 

package/src/components/promote.test.ts

@@ -492,7 +492,7 @@ describe("a redeploy's gate approval is bound like a rollback's (#2574, #2604)",
     const first = await runPromotion({ ...opts, now: "2026-01-05T00:00:00Z" });
     expect(first.status).toBe("gated");
     expect(first.gate?.environment).toBe("prod");
-    expect(first.gate?.planDigest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(first.gate?.planDigest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
     expect(ran).toEqual([]);
 
     resolutions.push(approval({ planDigest: first.gate!.planDigest!, environment: "prod" }, "2026-01-05T00:01:00Z"));

package/src/config.ts

@@ -283,6 +283,18 @@ export interface ChantConfig {
   /** Lint configuration (rules, extends, overrides, plugins) */
   lint?: LintConfig;
 
+  /**
+   * Telemetry attribution (#2558, D22): lexicons that declare workloads stamp
+   * resource attributes (`chant.workspace`, `chant.member`, `chant.decl`,
+   * `service.name`, `deployment.environment.name`) as `OTEL_*` environment
+   * variables. Inside a workspace this is on; `attribution: false` turns it
+   * off. Outside a workspace it is off, and `attribution: true` turns it on
+   * with the attributes that need no workspace. See `./telemetry-attribution.ts`.
+   */
+  telemetry?: {
+    attribution?: boolean;
+  };
+
   /**
    * Opt-in cloud-side ownership marking. When `stack` is set (and `enabled`
    * is not false), the serializer stamps a chant ownership marker carrying