@intentius/chant 0.100.0 → 0.102.0

package/src/cli/handlers/lifecycle.test.ts

@@ -97,6 +97,19 @@ function makeBuildResult(entitiesByLexicon: Record<string, string[]>): BuildResu
   } as unknown as BuildResult;
 }
 
+/**
+ * #3001 — a build holding one resource and one property-kind declarable that
+ * the resource inlines, the shape every grafana dashboard with exported panels
+ * has. Only the resource has a live counterpart of its own.
+ */
+function buildWithPropertyKind(lexicon: string): BuildResult {
+  const build = makeBuildResult({ [lexicon]: ["board"] });
+  const panel = { lexicon, entityType: `${lexicon}::Panel`, kind: "property", props: { title: "CPU" } };
+  build.entities.set("board", { lexicon, entityType: `${lexicon}::Board`, kind: "resource", props: { panels: [panel] } } as never);
+  build.entities.set("cpuPanel", panel as never);
+  return build;
+}
+
 const meta = (overrides: Partial<ResourceMetadata> = {}): ResourceMetadata => ({
   type: "AWS::S3::Bucket",
   status: "CREATE_COMPLETE",
@@ -537,6 +550,37 @@ describe("runLifecycleDiff --live", () => {
   });
 
   // #1014 — property-level drift, gated purely on the deep capability.
+  test("hands only resource-kind entities to describeResources and observeResourcesDeep (#3001)", async () => {
+    buildMock.mockResolvedValue(buildWithPropertyKind("graf"));
+    fetchLifecycleMock.mockResolvedValue(undefined);
+    readSnapshotMock.mockResolvedValue(null);
+    const seen: { thin?: string[]; deep?: string[] } = {};
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({
+        name: "graf",
+        describeResources: async (opts) => {
+          seen.thin = [...opts.entities.keys()];
+          return { board: meta({ type: "graf::Board", physicalId: "uid-1" }) };
+        },
+        observeResourcesDeep: async (opts) => {
+          seen.deep = [...opts.entities.keys()];
+          return deepObservation({ board: { type: "graf::Board", properties: { panels: [{ title: "CPU" }] } } });
+        },
+      }),
+    ];
+    const exit = await runLifecycleDiff({
+      args: makeArgs({ path: "diff", extraPositional: "prod", live: true }),
+      plugins,
+      serializers: plugins.map((p) => p.serializer),
+    });
+    expect(exit).toBe(0);
+    expect(seen.thin).toEqual(["board"]);
+    expect(seen.deep).toEqual(["board"]);
+    const stdout = stdoutBuf.join("\n");
+    expect(stdout).not.toContain("cpuPanel");
+    expect(stdout).toContain("0 missing");
+  });
+
   describe("deep observation (#1014)", () => {
     const withDeep = (over: Parameters<typeof createMockPlugin>[0] = {}) =>
       createMockPlugin({
@@ -872,6 +916,29 @@ describe("runLifecyclePlan", () => {
     expect(stdoutBuf.join("\n")).toContain("bucket");
   });
 
+  test("proposes no create for a property-kind declarable its parent inlines (#3001)", async () => {
+    buildMock.mockResolvedValue(buildWithPropertyKind("graf"));
+    let names: string[] = [];
+    const plugins: LexiconPlugin[] = [
+      createMockPlugin({
+        name: "graf",
+        describeResources: async (opts) => {
+          names = opts.entityNames;
+          return { board: meta({ type: "graf::Board", physicalId: "uid-1" }) };
+        },
+      }),
+    ];
+    const exit = await runLifecyclePlan({
+      args: makeArgs({ path: "plan", extraPositional: "prod", json: true }),
+      plugins,
+      serializers: plugins.map((p) => p.serializer),
+    });
+    expect(exit).toBe(0);
+    expect(names).toEqual(["board"]);
+    const plan = JSON.parse(stdoutBuf.join("\n"));
+    expect(plan.entries.map((e: { name: string }) => e.name)).not.toContain("cpuPanel");
+  });
+
   // #1983 — `--report markdown` emits the reviewer-facing projection instead
   // of the human render, same as `--report gitlab-mr` swaps in the widget JSON.
   test("--report markdown emits the markdown projection instead of the human render", async () => {

package/src/cli/handlers/lifecycle.ts

@@ -42,7 +42,7 @@ import { unknownEnvError, isProdLikeEnvironment } from "../../env";
 import { planTeardown, executeTeardown, type TeardownPlan, type TeardownReport } from "../../lifecycle/teardown";
 import { collectBuildRootContributors } from "../plugins";
 import { applyLiveEndpoint } from "../../live-endpoint";
-import { isResourceDeclarable } from "../../declarable";
+import { isObservableDeclarable } from "../../declarable";
 import { formatError, formatWarning, formatSuccess, formatBold } from "../format";
 import type { CommandContext } from "../registry";
 import type { LifecycleSnapshot } from "../../lifecycle/types";
@@ -812,13 +812,14 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<LiveDiffOutcome
     }
 
     // Build per-lexicon entity index. Resource declarables only — outputs,
-    // parameters and serializer directives have no live counterpart, and a
+    // parameters, serializer directives and property-kind declarables (read
+    // inside their parent, #3001) have no live counterpart of their own, and a
     // declared name the reader can never resolve reads as missing (see
     // lifecycle/observe.ts).
     const declared = new Set<string>();
     const entities: DeclaredEntities = new Map();
     for (const [name, entity] of args.buildResult.entities) {
-      if (entity.lexicon === lexiconName && isResourceDeclarable(entity)) {
+      if (entity.lexicon === lexiconName && isObservableDeclarable(entity)) {
         declared.add(name);
         // Path origins are carried across explicitly (#1443): this map is plain
         // objects, and the symbol-keyed provenance channel does not survive it.
@@ -1289,11 +1290,11 @@ export async function runLifecyclePlan(ctx: CommandContext): Promise<number> {
         // A receipt has no `props` payload of its own but is declared, diffed,
         // and observed like any resource (#1832) — it joins the declared axis
         // so its lexicon's observation can confirm presence or absence.
-        if (entity.lexicon === lexiconName && (isResourceDeclarable(entity) || isEffectReceipt(entity))) {
+        if (entity.lexicon === lexiconName && (isObservableDeclarable(entity) || isEffectReceipt(entity))) {
           declared.add(name);
           entities.set(name, {
             entityType: entity.entityType,
-            props: (isResourceDeclarable(entity) && entity.props != null ? entity.props : {}) as Record<string, unknown>,
+            props: (isObservableDeclarable(entity) && entity.props != null ? entity.props : {}) as Record<string, unknown>,
           });
         }
       }

package/src/cli/handlers/misc.ts

@@ -324,6 +324,7 @@ export async function runImport(ctx: CommandContext): Promise<number> {
       lexicon: "k8s",
       output: args.output,
       force: args.force,
+      parserOptions: args.parserOption,
     });
     printImportResult(result);
     return result.success ? 0 : 1;
@@ -381,6 +382,7 @@ export async function runImport(ctx: CommandContext): Promise<number> {
     output: ctx.args.output,
     force: ctx.args.force,
     lexicon: ctx.args.lexicon,
+    parserOptions: ctx.args.parserOption,
   });
 
   printImportResult(result);

package/src/cli/handlers/operator.ts

@@ -9,7 +9,7 @@
 import { lexiconNames } from "../../lexicon-module";
 import { loadChantConfig } from "../../config";
 import { build } from "../../build";
-import { isResourceDeclarable } from "../../declarable";
+import { isObservableDeclarable } from "../../declarable";
 import { collectBuildRootContributors, collectChangeSubscribers } from "../plugins";
 import { discoverOps, discoverStewards } from "../../op/discover";
 import { pickSteward, stewardBesideOf, stewardFormFor, stewardLeaseName, stewardTurnOps, DEFAULT_STEWARD_ENV } from "../../op/steward";
@@ -116,7 +116,7 @@ async function collectOperatorSubscribers(
     // subscription may watch.
     const entities = new Map<string, Map<string, { entityType: string; props: Record<string, unknown> }>>();
     for (const [name, entity] of buildResult.entities) {
-      if (!isResourceDeclarable(entity)) continue;
+      if (!isObservableDeclarable(entity)) continue;
       let perLexicon = entities.get(entity.lexicon);
       if (!perLexicon) entities.set(entity.lexicon, (perLexicon = new Map()));
       perLexicon.set(name, {
@@ -902,6 +902,7 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
     allowSameOrigin: ctx.args.allowSameOrigin,
     ...(ctx.args.roles ? { roles: ctx.args.roles } : {}),
     ...(ctx.args.agent ? { agent: true } : {}),
+    ...(ctx.args.sign !== undefined ? { sign: ctx.args.sign } : {}),
   });
   if (!outcome.ok) return 1;
 
@@ -959,6 +960,15 @@ export interface GateApprovalOptions {
    * model-authored channel it is one whether or not this is set.
    */
   agent?: boolean;
+  /**
+   * `--sign [<key file>]` (#3163, ws-080): seal the approval with an ssh key,
+   * a key file or true for git's `user.signingkey`. The seal attests the
+   * approver when the signers file at base lists the key for them, and a gate
+   * the declaration's `identity.gates` names counts only sealed approvals.
+   */
+  sign?: string | true;
+  /** Where the workspace and the key file are looked up from. Defaults to the process's directory. */
+  cwd?: string;
   /** Replaces the lexicon evaluator a gate policy is loaded from. For tests. */
   evaluator?: GatePolicyEvaluator;
 }
@@ -1047,7 +1057,7 @@ export async function recordGateApproval(
   if (opts.plan !== undefined) {
     if (!isPlanDigest(opts.plan)) {
       console.error(formatError({
-        message: `--plan must be a plan digest ("sha256:" and 64 hex characters), got "${opts.plan}"`,
+        message: `--plan must be a plan digest ("jcs1-sha256:" or "sha256:", then 64 hex characters), got "${opts.plan}"`,
         hint: "Copy it from the gated run's `plan :` line, or from the pending-gate summary. It is not a plan file path.",
       }));
       return { ok: false };
@@ -1107,6 +1117,78 @@ export async function recordGateApproval(
     ...(opts.roles && opts.roles.length > 0 ? { roles: [...new Set(opts.roles)] } : {}),
   };
 
+  // #3163, ws-080: the declaration at base may require a checkable approver
+  // (identity.attribution "identified") and a signed approval for this gate
+  // (identity.gates). Both are judged before anything is written.
+  const cwd = opts.cwd ?? process.cwd();
+  const identity = await import("../../workspace/identity");
+  const { scopeSource } = await import("../../workspace/write-scope");
+  const scope = scopeSource(cwd);
+  try {
+    identity.refuseUnidentified(scope, [resolvedBy], opts.actor !== undefined ? "--actor" : "the approver");
+  } catch (err) {
+    if (!(err instanceof identity.IdentityError)) throw err;
+    console.error(formatError({
+      message: `Gate "${gate}" on "${opName}" was not approved: ${err.message}`,
+      hint: "Pass --actor <forge identity or signer>, as the surface that signed the person in maps them, for example --actor github:<login>.",
+    }));
+    return { ok: false };
+  }
+  const rule = identity.gateAdmissionFrom(scope, gate);
+  if (rule && opts.sign === undefined) {
+    console.error(formatError({
+      message:
+        `Gate "${gate}" needs a signed approval: chant.workspace.json at base names it in identity.gates` +
+        (rule.requirement.class !== null ? `, from the class ${rule.requirement.class}` : "") +
+        `, and this approval is not signed`,
+      hint: `chant approve ${opName} ${gate} --actor <principal> --sign [<key file>], with a key ${scope.policy.signersPath} at base lists for that principal.`,
+    }));
+    return { ok: false };
+  }
+  const timestamp = new Date().toISOString();
+  let seal: GateResolutionRecord["seal"];
+  if (opts.sign !== undefined) {
+    const { resolveSigningKey, sealGateApproval, SealError } = await import("../../workspace/trust/seal");
+    try {
+      const key = resolveSigningKey(opts.sign, cwd);
+      try {
+        seal = sealGateApproval(key.file, {
+          op: opName,
+          gate,
+          ...(environment !== undefined ? { environment } : {}),
+          ...(planDigest !== undefined ? { planDigest } : {}),
+          resolvedBy,
+          timestamp,
+        });
+      } finally {
+        key.cleanup();
+      }
+    } catch (err) {
+      if (!(err instanceof SealError)) throw err;
+      console.error(formatError({ message: `Gate "${gate}" on "${opName}" was not approved: ${err.message}` }));
+      return { ok: false };
+    }
+  }
+  if (rule) {
+    const why = rule.refuses({
+      op: opName,
+      gate,
+      ...(environment !== undefined ? { environment } : {}),
+      ...(planDigest !== undefined ? { planDigest } : {}),
+      resolvedBy,
+      timestamp,
+      seal,
+    });
+    if (why !== null) {
+      console.error(formatError({
+        message: `Gate "${gate}" on "${opName}" was not approved: ${why}`,
+        hint: `identity.gates.${gate} in chant.workspace.json at base counts only an approval signed by a key ${scope.policy.signersPath} lists for the approver` +
+          (rule.requirement.class !== null ? `, who holds the role of the class ${rule.requirement.class}` : "") + ".",
+      }));
+      return { ok: false };
+    }
+  }
+
   // #2508: a gate with a policy has it evaluated for this approval now, while
   // the approver is known, against the context the gated run recorded. The
   // decision is written next to the approval, so a pass can be traced to the
@@ -1148,7 +1230,8 @@ export async function recordGateApproval(
     op: opName,
     gate,
     resolvedBy,
-    timestamp: new Date().toISOString(),
+    timestamp,
+    ...(seal ? { seal } : {}),
     approver,
     ...(policyDecision ? { policyDecision } : {}),
     ...(opts.note ? { note: opts.note } : {}),
@@ -1166,6 +1249,7 @@ export async function recordGateApproval(
   console.error(formatSuccess(
     `Gate "${gate}" on "${opName}" resolved by ${record.resolvedBy} at ${record.timestamp}` +
       (record.url ? ` (${record.url})` : "") +
+      (record.seal ? `, signed with ${record.seal.key}` : "") +
       (pushed ? "" : " (local only — the push did not land)"),
   ));
   if (record.planDigest) {

package/src/cli/handlers/run.test.ts

@@ -424,6 +424,30 @@ describe("runOp: a steward's turn (#2750)", () => {
     expect(acquireStewardTurnMock).not.toHaveBeenCalled();
   });
 
+  test("fountain form with run.on: fountain and no flag: runs on fountain like --on fountain (#2523)", async () => {
+    const runtime = {
+      name: "fountain",
+      start: vi.fn(async (op: { name: string }) => ({
+        op: op.name,
+        runId: "f-1",
+        result: async () => ({ op: op.name, runId: "f-1", state: "completed" as const, startedAt: "t", endedAt: "t" }),
+      })),
+      status: vi.fn(), log: vi.fn(), list: vi.fn(), cancel: vi.fn(),
+    };
+    discoverOpsMock.mockResolvedValue({ ops: new Map([localOp("release", [])]), errors: [] });
+    discoverStewardsMock.mockResolvedValueOnce(stewardOwning("release", "box-steward", "fountain"));
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["fountain"], run: { on: "fountain" } } });
+    makeStdoutSpy();
+    const exit = await runOp({
+      args: makeArgs({ path: "release" }),
+      plugins: [{ name: "fountain", opRuntime: runtime } as never], serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(runtime.start).toHaveBeenCalledTimes(1);
+    expect(acquireStewardTurnMock).not.toHaveBeenCalled();
+  });
+
   test("local form, the turn lease's own acquire throws (a stale .lock): refused as a lease error, not an uncaught exception, and nothing runs", async () => {
     discoverOpsMock.mockResolvedValue({
       ops: new Map([localOp("release", [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }])]),
@@ -899,6 +923,93 @@ describe("run subcommands on the resolved runtime", () => {
     expect(stderr.join("\n")).toContain('lexicon "plain" does not host Op runs');
   });
 
+  test("run.on in chant.config.ts is the default runtime when --on is not given (#2523)", async () => {
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["stub"], run: { on: "stub" } } });
+    makeStdoutSpy();
+    makeStderrSpy();
+    const ctx = (over: Partial<ParsedArgs>) => ({ args: makeArgs(over), plugins: [stubPlugin(runtime)], serializers: [] });
+
+    expect(await runOp(ctx({ path: "hello" }))).toBe(0);
+    expect(await runOpStatus(ctx({ extraPositional: "hello" }))).toBe(0);
+    expect(await runOpLog(ctx({ extraPositional: "hello" }))).toBe(0);
+    expect(await runOpList(ctx({}))).toBe(0);
+    expect(runtime.start).toHaveBeenCalledTimes(1);
+    expect(runtime.status).toHaveBeenCalledWith("hello");
+    expect(runtime.log).toHaveBeenCalledTimes(1);
+    expect(runtime.list).toHaveBeenCalledTimes(1);
+  });
+
+  test("--on local overrides run.on and runs on the built-in runtime (#2523)", async () => {
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["stub"], run: { on: "stub" } } });
+    makeStdoutSpy();
+    makeStderrSpy();
+    await runOpList({ args: makeArgs({ on: "local" }), plugins: [stubPlugin(runtime)], serializers: [] });
+    expect(runtime.list).not.toHaveBeenCalled();
+  });
+
+  test("run.on naming an unconfigured lexicon gets --on's refusal, naming run.on (#2523)", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["aws"], run: { on: "nope" } } });
+    const stderr = makeStderrSpy();
+    const exit = await runOp({ args: makeArgs({ path: "hello" }), plugins: [], serializers: [] });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain('run.on "nope" in chant.config.ts: "nope" is not a configured lexicon');
+    expect(stderr.join("\n")).toContain("Configured lexicons: aws");
+    expect(stderr.join("\n")).toContain("--on local");
+  });
+
+  test("an explicit --on wins over run.on (#2523)", async () => {
+    const chosen = makeStubRuntime();
+    const other = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["stub", "other"], run: { on: "other" } } });
+    makeStdoutSpy();
+    makeStderrSpy();
+    const plugins = [stubPlugin(chosen), { name: "other", opRuntime: other } as never];
+    expect(await runOpList({ args: makeArgs({ on: "stub" }), plugins, serializers: [] })).toBe(0);
+    expect(chosen.list).toHaveBeenCalledTimes(1);
+    expect(other.list).not.toHaveBeenCalled();
+  });
+
+  test("run.on: local selects the built-in runtime (#2523)", async () => {
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["stub"], run: { on: "local" } } });
+    makeStdoutSpy();
+    makeStderrSpy();
+    await runOpList({ args: makeArgs({}), plugins: [stubPlugin(runtime)], serializers: [] });
+    expect(runtime.list).not.toHaveBeenCalled();
+  });
+
+  test("an invalid run block is refused, not run locally (#2523)", async () => {
+    const { InvalidChantConfigError } = await vi.importActual<typeof import("../../config")>("../../config");
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockRejectedValue(
+      new InvalidChantConfigError("Invalid chant config in /p/chant.config.ts: run.on: Expected string, received number", "run"),
+    );
+    const stderr = makeStderrSpy();
+    makeStdoutSpy();
+    expect(await runOpList({ args: makeArgs({}), plugins: [stubPlugin(runtime)], serializers: [] })).toBe(1);
+    expect(stderr.join("\n")).toContain("Invalid chant config in /p/chant.config.ts: run.on");
+    expect(runtime.list).not.toHaveBeenCalled();
+    // --on local still runs: the flag needs nothing from the config.
+    expect(await runOpList({ args: makeArgs({ on: "local" }), plugins: [stubPlugin(runtime)], serializers: [] })).toBe(0);
+  });
+
+  test("run.on naming a lexicon with no opRuntime gets --on's refusal, naming run.on (#2523)", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["plain"], run: { on: "plain" } } });
+    const stderr = makeStderrSpy();
+    const exit = await runOp({ args: makeArgs({ path: "hello" }), plugins: [{ name: "plain" } as never], serializers: [] });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain('run.on "plain" in chant.config.ts: lexicon "plain" does not host Op runs');
+  });
+
   test("--components on a runtime that cannot host them → one line, exit 1", async () => {
     const runtime = makeStubRuntime();
     const stderr = makeStderrSpy();

package/src/cli/handlers/run.ts

@@ -1,7 +1,7 @@
 import { lexiconNames } from "../../lexicon-module";
-import { resolve, dirname } from "node:path";
+import { resolve, dirname, basename } from "node:path";
 import { writeFileSync, mkdirSync, readFileSync } from "node:fs";
-import { loadChantConfig, resolveAutoReleaseDisabled, type ChantConfig } from "../../config";
+import { loadChantConfig, resolveAutoReleaseDisabled, InvalidChantConfigError, type ChantConfig } from "../../config";
 import { discoverOps, discoverStewards } from "../../op/discover";
 import { stewardWorkHolder } from "../../op/work-lease-run";
 import type { OpConfig } from "../../op/types";
@@ -108,10 +108,12 @@ function refuseDurableComponentSubcommand(what: string, hint: string): number {
 /**
  * Resolve the one runtime this invocation talks to.
  *
- * `--on <name>` picks the named lexicon's `opRuntime` (`../../lexicon.ts`);
- * without it, core's built-in `local` provider runs the Op in this process.
- * Every `chant run` subcommand goes through whichever comes back, so there is
- * one dispatch path rather than a branch per runtime.
+ * `--on <name>` picks the named lexicon's `opRuntime` (`../../lexicon.ts`).
+ * Without it, `run.on` in `chant.config.ts` does (#2523), and without either,
+ * core's built-in `local` provider runs the Op in this process. `local`, from
+ * either place, names the built-in provider. Every `chant run` subcommand goes
+ * through whichever comes back, so there is one dispatch path rather than a
+ * branch per runtime.
  *
  * A lexicon already loaded into the command context wins the lookup — that is
  * how a test hands in a stub, and how a command that loaded plugins for its
@@ -121,22 +123,20 @@ function refuseDurableComponentSubcommand(what: string, hint: string): number {
  *
  * Returns `undefined` after printing an actionable error — an unconfigured
  * name is answered with the configured list, a configured lexicon that hosts
- * nothing is named outright.
+ * nothing is named outright. A `run.on` default gets the same messages as
+ * `--on`, labelled `run.on` and the config file instead of `--on`.
  */
 async function resolveOpRuntime(ctx: CommandContext): Promise<OpRuntimeProvider | undefined> {
-  const on = ctx.args.on;
+  const choice = await chooseOpRuntime(ctx);
+  if (!choice) return undefined;
+  const { on, source, configured } = choice;
   if (!on || on === "local") return createLocalOpRuntime({ projectPath: resolve(".") });
 
-  // Read the configured list straight from `chant.config.ts` rather than
-  // through `resolveProjectLexicons`: `--on` names a *configured* lexicon, and
-  // that helper's fallback is a source scan of the whole project, which is a
-  // long wait to be told a name is wrong.
-  let configured: string[] = [];
-  try {
-    configured = lexiconNames((await loadChantConfig(resolve("."))).config.lexicons ?? []);
-  } catch {
-    // No/unreadable chant.config.ts — the error below says so by listing nothing.
-  }
+  // How the error names the choice, and how to get the built-in runtime back.
+  const label = source === "flag" ? `--on ${on}` : `run.on "${on}" in ${choice.configFile}`;
+  const fallback = source === "flag"
+    ? "Omit --on to run on the built-in local runtime."
+    : `Fix \`run.on\` in ${choice.configFile}, or pass --on local to run on the built-in local runtime.`;
 
   let plugin = ctx.plugins.find((p) => p.name === on);
   if (!plugin && configured.includes(on)) {
@@ -146,18 +146,18 @@ async function resolveOpRuntime(ctx: CommandContext): Promise<OpRuntimeProvider
   if (!plugin) {
     const known = [...new Set([...ctx.plugins.map((p) => p.name), ...configured])];
     console.error(formatError({
-      message: `--on ${on}: "${on}" is not a configured lexicon`,
+      message: `${label}: "${on}" is not a configured lexicon`,
       hint: known.length > 0
-        ? `Configured lexicons: ${known.join(", ")}. Omit --on to run on the built-in local runtime.`
-        : "chant.config.ts configures no lexicons. Omit --on to run on the built-in local runtime.",
+        ? `Configured lexicons: ${known.join(", ")}. ${fallback}`
+        : `chant.config.ts configures no lexicons. ${fallback}`,
     }));
     return undefined;
   }
 
   if (!plugin.opRuntime) {
     console.error(formatError({
-      message: `--on ${on}: lexicon "${on}" does not host Op runs`,
-      hint: "It declares no opRuntime. Omit --on to run on the built-in local runtime.",
+      message: `${label}: lexicon "${on}" does not host Op runs`,
+      hint: `It declares no opRuntime. ${fallback}`,
     }));
     return undefined;
   }
@@ -165,6 +165,64 @@ async function resolveOpRuntime(ctx: CommandContext): Promise<OpRuntimeProvider
   return plugin.opRuntime;
 }
 
+/** Which runtime name an invocation asked for, and where the name came from. */
+interface OpRuntimeChoice {
+  /** The runtime name; `undefined` or `"local"` is the built-in runtime. */
+  on: string | undefined;
+  /** `flag` for `--on`, `config` for `run.on`, `default` when neither named one. */
+  source: "flag" | "config" | "default";
+  /** The lexicons `chant.config.ts` configures. */
+  configured: string[];
+  /** The config file's name, for messages about `run.on`. */
+  configFile: string;
+}
+
+/**
+ * The runtime name `--on`, then `run.on` in `chant.config.ts` (#2523), then
+ * the built-in default pick, without loading any lexicon.
+ *
+ * Reads the configured list straight from `chant.config.ts` rather than
+ * through `resolveProjectLexicons`: `--on` names a *configured* lexicon, and
+ * that helper's fallback is a source scan of the whole project, which is a
+ * long wait to be told a name is wrong.
+ *
+ * A config that fails to load leaves the flag's choice alone, as before. With
+ * no flag, a config whose `run` block is invalid is refused (printed, then
+ * `undefined`): running the Op locally would hide that the project asked for
+ * another runtime. Any other load failure falls back to the built-in runtime,
+ * which is what a project with no `run.on` got before. `quiet` skips printing
+ * that refusal, for a caller that only peeks at the choice and leaves the
+ * reporting to {@link resolveOpRuntime}.
+ */
+async function chooseOpRuntime(ctx: CommandContext, quiet = false): Promise<OpRuntimeChoice | undefined> {
+  const flag = ctx.args.on;
+  if (flag === "local") return { on: "local", source: "flag", configured: [], configFile: "chant.config.ts" };
+
+  let configured: string[] = [];
+  let configuredOn: string | undefined;
+  let configFile = "chant.config.ts";
+  try {
+    const { config, configPath } = await loadChantConfig(resolve("."));
+    configured = lexiconNames(config.lexicons ?? []);
+    configuredOn = config.run?.on;
+    if (configPath) configFile = basename(configPath);
+  } catch (err) {
+    if (!flag && err instanceof InvalidChantConfigError && err.key === "run") {
+      if (quiet) return undefined;
+      console.error(formatError({
+        message: err.message,
+        hint: "`run.on` names the runtime that hosts this project's Op runs: a configured lexicon with an opRuntime, or \"local\". Fix it, or pass --on to pick the runtime for this run.",
+      }));
+      return undefined;
+    }
+    // No/unreadable chant.config.ts: an `--on` error says so by listing nothing.
+  }
+
+  if (flag) return { on: flag, source: "flag", configured, configFile };
+  if (configuredOn) return { on: configuredOn, source: "config", configured, configFile };
+  return { on: undefined, source: "default", configured, configFile };
+}
+
 /** An ISO-8601 instant trimmed to what a table cell has room for. */
 function shortInstant(iso: string | undefined): string {
   return iso ? iso.slice(0, 19).replace("T", " ") : "—";
@@ -395,6 +453,7 @@ export async function runOpApprove(ctx: CommandContext): Promise<number> {
     note: ctx.args.note,
     url: ctx.args.url,
     plan: ctx.args.plan,
+    ...(ctx.args.sign !== undefined ? { sign: ctx.args.sign } : {}),
   });
   if (!outcome.ok) return 1;
 
@@ -582,7 +641,9 @@ async function stewardTurnGate(opName: string, ctx: CommandContext): Promise<Ste
   const form = stewardFormFor(owner, env);
 
   if (form === "fountain") {
-    if (ctx.args.on === "fountain") return { ok: true };
+    // `run.on: "fountain"` asks for the steward's thread as much as the flag
+    // does (#2523).
+    if ((await chooseOpRuntime(ctx, true))?.on === "fountain") return { ok: true };
     return {
       ok: false,
       message: `Op "${opName}" is one of steward "${owner.name}"'s Ops, which runs on fountain in environment "${env}"`,

package/src/cli/handlers/scenario.ts

@@ -15,7 +15,7 @@ import { collectEffectReceipts, isEffectReceipt, type EffectReceiptDeclaration }
 import { evaluateScenario, type ScenarioBehaviourFixture, type ScenarioVerdict } from "../../lifecycle/scenario-eval";
 import { validateBehaviourResult } from "../../behaviour-delta";
 import { collectScenarios, type ScenarioDeclaration, type ScenarioGiven } from "../../lifecycle/scenario";
-import { isResourceDeclarable } from "../../declarable";
+import { isObservableDeclarable } from "../../declarable";
 import { loadChantConfig } from "../../config";
 import { unknownEnvError } from "../../env";
 import { collectBuildRootContributors } from "../plugins";
@@ -281,7 +281,7 @@ async function evaluateOneScenario(
     // and observed like any resource (#1832) — it joins the declared axis so
     // its lexicon's fixture data can confirm presence, absence, or a hole,
     // the same as `runLifecyclePlan` (lifecycle.ts:1184).
-    if (!isResourceDeclarable(entity) && !isEffectReceipt(entity)) continue;
+    if (!isObservableDeclarable(entity) && !isEffectReceipt(entity)) continue;
     if (!declaredByLexicon.has(entity.lexicon)) declaredByLexicon.set(entity.lexicon, new Set());
     declaredByLexicon.get(entity.lexicon)!.add(name);
   }