@intentius/chant 0.124.23 → 0.124.25

package/src/cli/mcp/workspace-tools.ts

@@ -15,9 +15,9 @@
  *   read to the workspace root's pinned chant included (ws-021), and keeps
  *   anything a command prints away from the protocol on stdout.
  * - The writes (`records-new`, `records-amend`, `records-review`,
- *   `records-close`, `points-answer`, `points-retract`) call the functions
- *   `chant workspace records new|amend|review|close` and `points
- *   answer|retract` call, and return the
+ *   `records-close`, `points-answer`, `points-retract`, `points-withdraw`)
+ *   call the functions `chant workspace records new|amend|review|close` and
+ *   `points answer|retract|withdraw` call, and return the
  *   same JSON result. They keep every rule
  *   the CLI keeps: the kind's schema, a closed record never changing, an
  *   approved one changing only as its approval rule allows, a dissent needing
@@ -165,7 +165,7 @@ export const workspaceReadTools: ToolDefinition[] = [
   {
     name: "workspace-points",
     description:
-      "The workspace's decision points and the questions asked of them: chant workspace points --json (points.schema.json, ws-058). A question is open while it is escalated to people, or proposed by a model and not yet confirmed; each lists any model's answer with its confidence and threshold. Returns the document unchanged. chant calls no model to answer this.",
+      "The workspace's decision points and the questions asked of them: chant workspace points --json (points.schema.json, ws-058). A question is open while it is escalated to people, or proposed by a model and not yet confirmed, and not withdrawn; each lists any model's answer with its confidence and threshold. Returns the document unchanged. chant calls no model to answer this.",
     inputSchema: {
       type: "object",
       properties: {
@@ -326,6 +326,23 @@ export const workspaceWriteTools: ToolDefinition[] = [
       required: ["id", "by"],
     },
   },
+  {
+    name: "points-withdraw",
+    description:
+      "Close an open decision point question that no longer applies, such as one about a work item its author changed, which a run asks about anew: chant workspace points withdraw (#2888). The question keeps its state, with who withdrew it, when and why; workspace-points open leaves it out, and points-answer refuses it. Asking it again opens it again. Withdrawing answers nothing, so it needs no quorum. An answered question is not withdrawn: points-retract takes the answer back. " +
+      PROTOCOL,
+    inputSchema: {
+      type: "object",
+      properties: {
+        id: { type: "string", description: "The question's id, as workspace-points lists it." },
+        by: { type: "array", items: { type: "string" }, description: "Who withdraws the question (--by)." },
+        note: { type: "string", description: "Why, such as the question that asks about the subject now (--note)." },
+        kind: { type: "string", description: "The answer kind file. Without it, the declared answer kinds." },
+        dryRun: dryRunProp,
+      },
+      required: ["id", "by"],
+    },
+  },
 ];
 
 /** A tool call that can't be made as given: the client gets it as an error result, and nothing runs. */
@@ -581,6 +598,12 @@ export function createWorkspaceTools(options: WorkspaceToolsOptions): WorkspaceT
       if (!Array.isArray(by) || by.length === 0 || !by.every((b) => typeof b === "string" && b.trim() !== "")) throw new ToolInputError("by must list each person who takes the answer back");
       return retractAnswer({ cwd, id: str(params, "id", true)!, by: by as string[], note: str(params, "note"), kind: str(params, "kind"), dryRun: bool(params, "dryRun") });
     },
+    "points-withdraw": async (params) => {
+      const { withdrawQuestion } = await import("../../workspace/decide");
+      const by = params.by;
+      if (!Array.isArray(by) || by.length === 0 || !by.every((b) => typeof b === "string" && b.trim() !== "")) throw new ToolInputError("by must name who withdraws the question");
+      return withdrawQuestion({ cwd, id: str(params, "id", true)!, by: by as string[], note: str(params, "note"), kind: str(params, "kind"), dryRun: bool(params, "dryRun") });
+    },
     "records-close": async (params) => {
       const w = await write();
       const { closeRecord, RECORDS_CLOSE_SCHEMA_ID } = await import("../../workspace/records-close");

package/src/cli/parse-args.ts

@@ -54,6 +54,7 @@ const BOOLEAN_FLAGS = new Set([
   "--check",
   "--bump",
   "--no-release-record",
+  "--no-record",
   "--fold",
   "--no-fold",
   "--no-cache",
@@ -74,6 +75,7 @@ const BOOLEAN_FLAGS = new Set([
   "--generated",
   "--decide",
   "--record-plans",
+  "--loopback",
 ]);
 
 /**
@@ -261,6 +263,18 @@ export function parseArgs(args: string[]): ParsedArgs {
       const value = args[++i];
       if (!value || value.startsWith("-")) throw new Error("--port needs a port: --port <container-port>=<host-port>");
       (result.port ??= []).push(value);
+    } else if (arg === "--image") {
+      result.image = args[++i];
+      if (!result.image || result.image.startsWith("-")) throw new Error("--image needs an image reference: --image <name>:<tag>");
+    } else if (arg === "--network") {
+      result.network = args[++i];
+      if (!result.network || result.network.startsWith("-")) throw new Error("--network needs a Docker network name: --network <name>");
+    } else if (arg === "--setting") {
+      const value = args[++i];
+      if (!value || value.startsWith("-")) throw new Error("--setting needs a value: --setting <KEY>=<VALUE>");
+      (result.setting ??= []).push(value);
+    } else if (arg === "--loopback") {
+      result.loopback = true;
     } else if (arg === "--promote-to") {
       result.promoteTo = args[++i];
       if (!result.promoteTo || result.promoteTo.startsWith("-")) throw new Error("--promote-to needs an environment: --promote-to <env>");
@@ -333,6 +347,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.decide = true;
     } else if (arg === "--record-plans") {
       result.recordPlans = true;
+    } else if (arg === "--group") {
+      const raw = args[++i];
+      if (!raw || raw.startsWith("-")) throw new Error("--group needs a job group's name: --group <name>");
+      result.group = raw;
     } else if (arg === "--share") {
       const raw = args[++i];
       const share = Number(raw);
@@ -591,6 +609,9 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.compareTo = args[++i];
     } else if (arg === "--no-release-record") {
       result.noReleaseRecord = true;
+    } else if (arg === "--no-record") {
+      // `chant run <op|--components> --no-record` (#3955): write nothing to chant/lifecycle and push nothing.
+      result.noRecord = true;
     } else if (arg === "--fold") {
       result.fold = true;
     } else if (arg === "--no-cache") {

package/src/cli/registry.ts

@@ -167,6 +167,14 @@ export interface ParsedArgs {
   env?: string;
   /** `chant emulator up --port <container-port>=<host-port>`, repeatable (#3673); a bare `<host-port>` when one emulator is selected. */
   port?: string[];
+  /** `chant emulator up --image <ref>` (#3952): the image to start, when one emulator is selected. */
+  image?: string;
+  /** `chant emulator up --network <name>` (#3952): the Docker network each started container joins. */
+  network?: string;
+  /** `chant emulator up --setting <KEY>=<VALUE>`, repeatable (#3952): an emulator setting such as `FLOCI_<NAME>`, passed as `-e`. */
+  setting?: string[];
+  /** `chant emulator up --loopback` (#3952): publish ports on 127.0.0.1 only. */
+  loopback?: boolean;
   /** `chant build --components --generate <lexicon> --promote-to <env>` (#2575) — add a promote job to the generated pipeline. */
   promoteTo?: string;
   /** `chant graph --stacks` — render the cross-stack apply-ordering graph */
@@ -260,6 +268,8 @@ export interface ParsedArgs {
   recordPlans?: boolean;
   /** `chant run wave --share <i>` (#3679) — apply share `i` of a decided wide wave. */
   share?: number;
+  /** `chant run wave --group <name>` (#3914) — apply one job group's runs of a decided wave. */
+  group?: string;
   /** `chant components fan-out --canary <component>` (#3049), repeatable — components that form wave 1. */
   canary?: string[];
   /**
@@ -547,6 +557,8 @@ export interface ParsedArgs {
   compareTo?: string;
   /** `chant run --components <name> --env <env> --no-release-record` (#597) — opt out of auto-emitting a release-ledger record after a successful component deploy. Default (flag omitted): recording is ON. Also settable project-wide via `chant.config.ts`'s `release.autoRecord: false`. */
   noReleaseRecord?: boolean;
+  /** `chant run <op>` / `chant run --components <name>` `--no-record` (#3955) — run every step but record nothing on `chant/lifecycle` and push nothing; a gate step fails. `CHANT_NO_RECORD=1` does the same for every chant process that inherits it (../../lifecycle/no-record.ts). */
+  noRecord?: boolean;
   /** `chant run --components <name> --dump-outputs <file>` — after the run, write the accumulated cross-component/cross-stack outputs (JSON, keyed by component name) to `<file>`, for a downstream job to `--seed-outputs`. */
   dumpOutputs?: string;
   /** `chant run --components <name> --digest-file <file>` (#2602) — after a successful run, write one `<component>=<digest>` line per release the run recorded to `<file>`, the form `chant components promote --digest` takes, so a generated promote job promotes exactly the release its pipeline run built. Written empty when nothing was recorded. */

package/src/components/cli-support.test.ts

@@ -601,6 +601,81 @@ describe("runComponents", () => {
     expect(result.error).toMatch(/cycle/i);
   });
 
+  describe("a comma list (#3950)", () => {
+    const comp = (name: string, dependsOn: string[], extra = "") =>
+      `export const c = { name: "${name}", ${extra}dependsOn: ${JSON.stringify(dependsOn)}, deploy: [{ phase: "Apply", steps: [{ kind: "deploy-thing" }] }] };`;
+
+    beforeEach(async () => {
+      await writeFile(join(testDir, "db.component.ts"), comp("db", []));
+      await writeFile(join(testDir, "cache.component.ts"), comp("cache", []));
+      await writeFile(join(testDir, "api.component.ts"), comp("api", ["db"]));
+      await writeFile(join(testDir, "web.component.ts"), comp("web", ["api", "cache"]));
+      await writeFile(join(testDir, "worker.component.ts"), comp("worker", ["db"]));
+    });
+
+    test("runs the named components and their transitive dependencies in one dependency-ordered run", async () => {
+      const plans: unknown[] = [];
+      const result = await runComponents(testDir, "web", { registry: fakeRegistry() });
+      expect(result.selected).toEqual(["web"]);
+
+      const listed = await runComponents(testDir, "web,worker", { registry: fakeRegistry(), onPlan: (p) => plans.push(p) });
+      expect(listed.success).toBe(true);
+      expect([...listed.selected].sort()).toEqual(["api", "cache", "db", "web", "worker"]);
+      expect(listed.run?.waves).toEqual([["cache", "db"], ["api", "worker"], ["web"]].map((w) => expect.arrayContaining(w)));
+      const order = listed.run?.order ?? [];
+      expect(order.indexOf("db")).toBeLessThan(order.indexOf("api"));
+      expect(order.indexOf("api")).toBeLessThan(order.indexOf("web"));
+      expect(plans).toHaveLength(1);
+      expect(plans[0]).toMatchObject({ order: listed.run?.order, waves: listed.run?.waves });
+      expect([...(plans[0] as { added: string[] }).added].sort()).toEqual(["api", "cache", "db"]);
+    });
+
+    test("leaves out components the list does not reach", async () => {
+      const result = await runComponents(testDir, "api, api ,", { registry: fakeRegistry() });
+      expect(result.success).toBe(true);
+      expect(result.run?.order).toEqual(["db", "api"]);
+    });
+
+    test("refuses unknown names, naming every one, before anything runs", async () => {
+      const onPlan = vi.fn();
+      const result = await runComponents(testDir, "api,nope,also-nope", { registry: fakeRegistry(), onPlan });
+      expect(result.success).toBe(false);
+      expect(result.run).toBeUndefined();
+      expect(result.error).toContain('Components "nope", "also-nope" not found');
+      expect(result.error).toContain("Known components: api, cache, db, web, worker");
+      expect(onPlan).not.toHaveBeenCalled();
+    });
+
+    test("refuses a disabled name; a disabled dependency is dropped as \"all\" drops it", async () => {
+      await writeFile(join(testDir, "cache.component.ts"), comp("cache", [], "enabled: false, "));
+      const refused = await runComponents(testDir, "api,cache", { registry: fakeRegistry() });
+      expect(refused.success).toBe(false);
+      expect(refused.run).toBeUndefined();
+      expect(refused.error).toContain('Component "cache" is disabled');
+
+      const result = await runComponents(testDir, "web", { registry: fakeRegistry() });
+      expect(result.success).toBe(true);
+      const listed = await runComponents(testDir, "web,", { registry: fakeRegistry() });
+      expect(listed.success).toBe(true);
+      expect(listed.run?.order).toEqual(["db", "api", "web"]);
+    });
+
+    test("refuses \"all\" inside a list", async () => {
+      const result = await runComponents(testDir, "all,api", { registry: fakeRegistry() });
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('"all" cannot be part of a component list');
+    });
+
+    test("a dependency outside the discovered set fails as it does under \"all\"", async () => {
+      await writeFile(join(testDir, "api.component.ts"), comp("api", ["shared-alb"]));
+      const onPlan = vi.fn();
+      const result = await runComponents(testDir, "api,web", { registry: fakeRegistry(), onPlan });
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("shared-alb");
+      expect(onPlan).not.toHaveBeenCalled();
+    });
+  });
+
   test("unknown component name → clear error listing known components", async () => {
     await writeFile(
       join(testDir, "svc.component.ts"),

package/src/components/cli-support.ts

@@ -228,6 +228,28 @@ export async function computeComponentGraph(
 /** A generate-mode target lexicon name — any lexicon whose plugin implements `generateComponentPipeline` (gitlab, github, and forgejo today). */
 export type GenerateLexicon = string;
 
+/**
+ * The components an "all" run takes, in `discovered` order (chant #1522). A
+ * seam-gated component (`enabled: false`, computed from this run's own
+ * params) sits out: the run deploys the estate the parameters describe, not
+ * the units the seams turned off. A disabled dependency is satisfied
+ * vacuously, since ordering is dependsOn's only meaning, so it is also
+ * stripped from the survivors' dependsOn rather than failing wave resolution
+ * as an unknown name. `chant run --components all`, a component list's
+ * dependency closure (#3950) and the generated pipelines (#3951) all select
+ * through this.
+ */
+export function withoutDisabled<T extends { name: string; dependsOn?: string[] }>(
+  discovered: ReadonlyArray<{ name: string; enabled?: boolean }>,
+  components: T[],
+): T[] {
+  const disabled = new Set(discovered.filter((c) => c.enabled === false).map((c) => c.name));
+  if (disabled.size === 0) return components;
+  return components
+    .filter((c) => !disabled.has(c.name))
+    .map((c) => (c.dependsOn?.some((d) => disabled.has(d)) ? { ...c, dependsOn: c.dependsOn.filter((d) => !disabled.has(d)) } : c));
+}
+
 /** Result of `chant build --components --generate <lexicon>`. */
 export interface GenerateComponentsResult {
   success: boolean;
@@ -301,11 +323,13 @@ export async function generateComponentsPipeline(
     return { success: false, error: result.errors.map((e) => e.message).join("\n") };
   }
 
-  const driverComponents: DriverComponent[] = [...result.components.values()].map(({ component }) => ({
-    name: component.name,
-    dependsOn: component.dependsOn,
-    deploy: component.deploy,
-  }));
+  // #3951: the pipeline holds the jobs `chant run --components all` would
+  // run, so a disabled component has no job and no other job needs it.
+  const discovered = [...result.components.values()].map(({ component }) => component);
+  const driverComponents = withoutDisabled(
+    discovered,
+    discovered.map((component) => ({ name: component.name, dependsOn: component.dependsOn, deploy: component.deploy })),
+  );
 
   try {
     const { yaml, stages, jobs, env } = plugin.generateComponentPipeline(driverComponents, options);
@@ -404,7 +428,7 @@ export interface RunComponentsOptions {
   /**
    * Opt-in structured progress observer (`chant run --components <name|all>
    * --progress-json`, see ./run-progress.ts). Threaded straight through to
-   * `runInterpretDriver` for `selector === "all"`; for a single-component
+   * `runInterpretDriver` for `"all"` and a list; for a single-component
    * selector (which bypasses `runInterpretDriver` — see the docstring above),
    * this function emits the same `run-start`/`wave-start`/`component-start`/
    * …/`run-done` envelope itself, treating the one component as a run with a
@@ -430,6 +454,12 @@ export interface RunComponentsOptions {
   buildParams?: BuildParamProvenance[];
   /** Where a `gate` step's facts are read and written (#2119). Defaults to the `chant/lifecycle` orphan branch; a test passes `memoryGateLedgerPort()` from `../op/gate.ts`. */
   gates?: GateLedgerPort;
+  /**
+   * Called once for a list selector (`a,b,c`, #3950) with the resolved run
+   * order, waves and the dependencies the list pulled in, after selection and
+   * before the first component runs. The CLI prints it.
+   */
+  onPlan?: (plan: ComponentRunPlan) => void;
   /**
    * The commit the run deploys, for the workloads' `vcs.ref.head.revision`
    * (#3061). Default: `git rev-parse HEAD` in the project, or nothing outside
@@ -438,7 +468,15 @@ export interface RunComponentsOptions {
   revision?: string | null;
 }
 
-/** Result of `chant run --components <name|all>`. */
+/** The resolved order of a list run (#3950), reported through `RunComponentsOptions.onPlan`. */
+export interface ComponentRunPlan {
+  order: string[];
+  waves: string[][];
+  /** Dependencies the list did not name but the run includes. */
+  added: string[];
+}
+
+/** Result of `chant run --components <name|all|a,b,c>`. */
 export interface RunComponentsResult {
   success: boolean;
   /** The driver's run result, when the run reached the driver (even on a failed component). */
@@ -468,6 +506,10 @@ export interface RunComponentsResult {
  *  - `selector === "all"`: resolves the whole set's dependency order/waves
  *    and dispatches every component through `runInterpretDriver`, in the same
  *    order `chant graph --components` reports.
+ *  - a list (`a,b,c`, #3950): the named components plus everything they
+ *    depend on, through the same `runInterpretDriver` path as `"all"`, so the
+ *    subset runs in the order `"all"` would give it, in one process. The
+ *    resolved order goes to `onPlan` before the first component starts.
  *  - a single name: dispatches just that component via `runComponentDeploy`,
  *    without requiring the rest of its `dependsOn` graph to be present in
  *    this invocation. This mirrors generate mode's per-job invocation model
@@ -483,17 +525,24 @@ export interface RunComponentsResult {
  * stops the run there with `gated` set, which the CLI turns into exit code 3
  * and the `chant approve` line.
  */
-/** Result of resolving a `<name|all>` selector against discovered components. */
+/** Result of resolving a `<name|all|a,b,c>` selector against discovered components. */
 export interface ResolvedComponentTargets {
   success: boolean;
   targets: DriverComponent[];
+  /** For a list selector (#3950): the dependencies the closure added that the list did not name, in discovery order. */
+  added?: string[];
   error?: string;
 }
 
+/** Whether `selector` is a comma-separated component list (#3950), as opposed to `all` or one name. */
+export function isComponentList(selector: string): boolean {
+  return selector.includes(",");
+}
+
 /**
- * Discover every component under `path` and resolve `selector` (`"all"` or a
- * single component name) to the `DriverComponent`(s) to run, with no gate
- * check and no dispatch — just discovery + selection, factored out of
+ * Discover every component under `path` and resolve `selector` (`"all"`, a
+ * single component name, or a comma-separated list, #3950) to the
+ * `DriverComponent`(s) to run, with no gate check and no dispatch — just discovery + selection, factored out of
  * `runComponents` so another entrypoint can reuse the exact same selection
  * semantics without inheriting the run itself.
  */
@@ -512,19 +561,9 @@ export async function resolveComponentTargets(
   const discovered = [...result.components.values()].map(({ component }) => component);
   const all = discovered.map((component) => toDriverComponent(component));
 
-  if (selector === "all") {
-    // chant #1522 — a seam-gated component (`enabled: false`, computed from
-    // this run's own params) sits out of "all": the run deploys the estate
-    // the parameters describe, not the units the seams turned off. A disabled
-    // dependency is satisfied vacuously — ordering is dependsOn's only
-    // semantics — so it is also stripped from the survivors' dependsOn,
-    // rather than failing wave resolution as an unknown name.
-    const disabled = new Set(discovered.filter((c) => c.enabled === false).map((c) => c.name));
-    const targets = all
-      .filter((c) => !disabled.has(c.name))
-      .map((c) => (c.dependsOn?.some((d) => disabled.has(d)) ? { ...c, dependsOn: c.dependsOn.filter((d) => !disabled.has(d)) } : c));
-    return { success: true, targets };
-  }
+  if (isComponentList(selector)) return resolveComponentList(selector, discovered, all);
+
+  if (selector === "all") return { success: true, targets: withoutDisabled(discovered, all) };
 
   const found = all.find((c) => c.name === selector);
   const disabledByName = discovered.find((c) => c.name === selector && c.enabled === false);
@@ -548,6 +587,65 @@ export async function resolveComponentTargets(
   return { success: true, targets: [found] };
 }
 
+/**
+ * A list selector (`a,b,c`, #3950): the named components plus every component
+ * they depend on, transitively, so the list runs as one dependency-ordered
+ * set. Refused before anything runs when a name is unknown, disabled, or `all`
+ * (which already means every component). Dependencies are followed through
+ * `withoutDisabled`, the selection `"all"` uses, so a disabled *dependency*
+ * is dropped and stripped from dependsOn exactly as `"all"` drops it. A
+ * dependsOn name that matches no discovered component is left in place, so
+ * wave resolution reports it as `"all"` would.
+ */
+function resolveComponentList(
+  selector: string,
+  discovered: ReadonlyArray<{ name: string; enabled?: boolean }>,
+  all: DriverComponent[],
+): ResolvedComponentTargets {
+  const names = [...new Set(selector.split(",").map((n) => n.trim()).filter((n) => n.length > 0))];
+  if (names.length === 0) {
+    return { success: false, targets: [], error: `Component list "${selector}" names no components.` };
+  }
+  if (names.includes("all")) {
+    return { success: false, targets: [], error: `"all" cannot be part of a component list; pass --components all on its own, or name the components.` };
+  }
+  // An explicit ask for a unit the parameters excluded is a mistake to
+  // surface, not to skip silently, as it is for a single name.
+  const off = names.filter((n) => discovered.some((c) => c.name === n && c.enabled === false));
+  if (off.length > 0) {
+    const one = off.length === 1;
+    return {
+      success: false,
+      targets: [],
+      error: `${one ? "Component" : "Components"} ${off.map((n) => `"${n}"`).join(", ")} ${one ? "is" : "are"} disabled under this run's parameters (enabled: false). Enable the seam ${one ? "it is" : "they are"} gated on, or leave ${one ? "it" : "them"} out of the list.`,
+    };
+  }
+  const unknown = names.filter((n) => !all.some((c) => c.name === n));
+  if (unknown.length > 0) {
+    const known = all.map((c) => c.name).sort().join(", ");
+    return {
+      success: false,
+      targets: [],
+      error: `${unknown.length === 1 ? "Component" : "Components"} ${unknown.map((n) => `"${n}"`).join(", ")} not found.${known ? ` Known components: ${known}` : " No components discovered."}`,
+    };
+  }
+
+  const enabled = withoutDisabled(discovered, all);
+  const byName = new Map(enabled.map((c) => [c.name, c]));
+  const included = new Set<string>();
+  const visit = (name: string): void => {
+    const component = byName.get(name);
+    if (!component || included.has(name)) return;
+    included.add(name);
+    for (const dep of component.dependsOn ?? []) visit(dep);
+  };
+  for (const name of names) visit(name);
+
+  const targets = enabled.filter((c) => included.has(c.name));
+  const named = new Set(names);
+  return { success: true, targets, added: targets.map((c) => c.name).filter((n) => !named.has(n)) };
+}
+
 export async function runComponents(
   path: string,
   selector: string,
@@ -595,7 +693,14 @@ export async function runComponents(
   const releaseIdentity = () => (revision ? { revision } : {});
 
   try {
-    if (selector === "all") {
+    if (selector === "all" || isComponentList(selector)) {
+      if (isComponentList(selector) && options.onPlan) {
+        // Resolved here, before dispatch, so the order is printed before any
+        // component runs. A cycle or unknown dependency throws the same error
+        // `runInterpretDriver` would, caught below.
+        const graph = resolveComponentGraph(resolvedTargets);
+        options.onPlan({ order: graph.order, waves: graph.waves, added: resolved.added ?? [] });
+      }
       const run = await runInterpretDriver(resolvedTargets, registry, {
         env,
         releaseIdentity,

package/src/components/driver.test.ts

@@ -239,6 +239,34 @@ describe("runComponentDeploy — gate as fact (#2119)", () => {
     return { registry, calls, rolledBack };
   }
 
+  // #3955: a run that records nothing cannot spend an approval or leave a
+  // pending fact, so the gate fails even with an approval standing for it.
+  it("fails at the gate under CHANT_NO_RECORD, writing nothing and running nothing after it", async () => {
+    const { registry, calls } = registryWithCalls();
+    const port = memoryGateLedgerPort({
+      resolutions: [{ op: "neo4j-cluster", gate: "approve-node-1", resolvedBy: "alice", timestamp: NOW, environment: "dev" } as never],
+    });
+    process.env.CHANT_NO_RECORD = "1";
+    let result;
+    try {
+      result = await runComponentDeploy(
+        gatedComponent(), { env: "dev", component: "neo4j-cluster" }, registry, {}, undefined,
+        { port, now: NOW },
+      );
+    } finally {
+      delete process.env.CHANT_NO_RECORD;
+    }
+
+    expect(result.status).toBe("fail");
+    expect(port.appended).toHaveLength(0);
+    // A failure, so the component unwinds as any failed step would; nothing after the gate ran.
+    expect(calls).not.toContain("code-deploy");
+    const gate = result.records.find((r) => r.kind === "gate:approve-node-1");
+    expect(gate).toMatchObject({ status: "fail" });
+    expect(gate!.error).toContain("cannot be passed under --no-record");
+    expect(result.records.find((r) => r.kind === "code-deploy")).toMatchObject({ status: "skipped" });
+  });
+
   it("ends gated, records the pending fact, and runs nothing after the gate", async () => {
     const { registry, calls, rolledBack } = registryWithCalls();
     const port = memoryGateLedgerPort();

package/src/components/driver.ts

@@ -50,6 +50,7 @@ import { topoSort } from "../codegen/topo-sort";
 import { kahnLayers } from "./layers";
 import { evaluateGate, gitGateLedgerPort, type GateDigestMismatch, type GateLedgerPort } from "../op/gate";
 import { gateName } from "../op/gate-name";
+import { GateNotRecordableError } from "../lifecycle/no-record";
 import { componentPlanDigest } from "./gate-plan";
 import type { PendingGateRecord } from "../lifecycle/gate-ledger";
 import type { CapabilityRegistry, DeployContext } from "./capability";
@@ -473,17 +474,29 @@ async function runPhase(
     const gateRecords: DriverStepRecord[] = [];
     for (const gate of phaseDef.steps.filter(isGateStep)) {
       const start = Date.now();
-      const check = await evaluateGate(gates.port, {
-        op: ctx.component,
-        gate: gateName(gate),
-        // #2574: an approval counts only for this environment and this plan.
-        environment: ctx.env,
-        ...(gates.planDigest !== undefined ? { planDigest: gates.planDigest } : {}),
-        ...(gate.description ? { description: gate.description } : {}),
-        ...(gate.timeout ? { timeout: gate.timeout } : {}),
-        ...(gates.now ? { now: gates.now } : {}),
-      });
       const base = { component: ctx.component, phase: phaseDef.phase, kind: `gate:${gateName(gate)}` };
+      let check: Awaited<ReturnType<typeof evaluateGate>>;
+      try {
+        check = await evaluateGate(gates.port, {
+          op: ctx.component,
+          gate: gateName(gate),
+          // #2574: an approval counts only for this environment and this plan.
+          environment: ctx.env,
+          ...(gates.planDigest !== undefined ? { planDigest: gates.planDigest } : {}),
+          ...(gate.description ? { description: gate.description } : {}),
+          ...(gate.timeout ? { timeout: gate.timeout } : {}),
+          ...(gates.now ? { now: gates.now } : {}),
+        });
+      } catch (err) {
+        // #3955: a run that records nothing fails at the gate, as the Op
+        // executor's gate step does, and the component unwinds like any failure.
+        if (!(err instanceof GateNotRecordableError)) throw err;
+        gateRecords.push({ ...base, status: "fail" as const, durationMs: Date.now() - start, error: err.message });
+        for (const skipped of phaseDef.steps.filter((s): s is DriverStep | DriverPhase => !isGateStep(s))) {
+          gateRecords.push(skippedRecord(skipped));
+        }
+        throw new StepFailure(gateRecords, []);
+      }
       if (!check.satisfied) {
         gateRecords.push({ ...base, status: "skipped" as const, durationMs: Date.now() - start });
         for (const skipped of phaseDef.steps.filter((s): s is DriverStep | DriverPhase => !isGateStep(s))) {

package/src/components/generate-disabled.test.ts

@@ -0,0 +1,56 @@
+/**
+ * `chant build --components --generate <forge>` leaves out a component with
+ * `enabled: false` (#3951), the same way `chant run --components all` skips it
+ * (#1522): no job for it, and no other job needs it. Runs against the real
+ * GitHub, GitLab and Forgejo plugins, not a stand-in, so each forge's own
+ * `needs` rendering is what the assertions read.
+ */
+
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdir, writeFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { generateComponentsPipeline, resolveComponentTargets } from "./cli-support";
+
+describe.each(["github", "gitlab", "forgejo"])("generateComponentsPipeline %s: enabled: false (#3951)", (forge) => {
+  let testDir: string;
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-generate-disabled-${forge}-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+    await writeFile(
+      join(testDir, "tunnel.component.ts"),
+      `export const tunnel = { name: "tunnel", enabled: false, dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell", reason: "t" }] }] };`,
+    );
+    await writeFile(
+      join(testDir, "db.component.ts"),
+      `export const db = { name: "db", dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "shell", reason: "t" }] }] };`,
+    );
+    await writeFile(
+      join(testDir, "api.component.ts"),
+      `export const api = { name: "api", dependsOn: ["db", "tunnel"], deploy: [{ phase: "Apply", steps: [{ kind: "shell", reason: "t" }] }] };`,
+    );
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  test("the disabled component has no job, and its dependent no longer needs it", async () => {
+    const result = await generateComponentsPipeline(testDir, forge, { env: "prod" });
+
+    expect(result.success).toBe(true);
+    expect(result.jobs?.map((j) => j.component).sort()).toEqual(["api", "db"]);
+    const api = result.jobs?.find((j) => j.component === "api");
+    const db = result.jobs?.find((j) => j.component === "db");
+    expect(api?.needs).toEqual([db?.jobName]);
+    expect(result.yaml).not.toMatch(/tunnel/);
+  });
+
+  test("the pipeline holds the components an \"all\" run takes", async () => {
+    const result = await generateComponentsPipeline(testDir, forge, { env: "prod" });
+    const run = await resolveComponentTargets(testDir, "all");
+
+    expect(result.jobs?.map((j) => j.component).sort()).toEqual(run.targets.map((t) => t.name).sort());
+  });
+});

package/src/effect-receipt.ts

@@ -66,6 +66,28 @@ export const EFFECT_RECEIPT_ENTITY_TYPE = "Chant::EffectReceipt";
  */
 export const EXISTENCE_EXPECTATION = "chant.effect-receipt:exists";
 
+const OUTPUTS_SEPARATOR = "+outputs=";
+
+/**
+ * A receipt expectation with the digest of the step outputs its effect read
+ * appended (#3948). The effect step writes this value, so the next run fires
+ * again when one of those outputs changed, though the declared inputs did not.
+ */
+export function withStepOutputs(expectation: string, outputs: string): string {
+  return `${expectation}${OUTPUTS_SEPARATOR}${outputs}`;
+}
+
+/**
+ * The part of a stored receipt value that the declared inputs determine: the
+ * value without any step-output digest {@link withStepOutputs} appended. The
+ * plan and `receiptStaleness` compare this part, since step outputs exist only
+ * while the Op runs.
+ */
+export function declaredExpectation(value: string): string {
+  const at = value.indexOf(OUTPUTS_SEPARATOR);
+  return at < 0 ? value : value.slice(0, at);
+}
+
 /**
  * An effect receipt declaration — a Declarable, so discovery collects it,
  * `chant list` shows it, and (unlike a secret declaration) serialization