@intentius/chant 0.124.38 → 0.124.40

package/src/components/cli-support.ts

@@ -489,6 +489,8 @@ export interface RunComponentsResult {
   run?: DriverRunResult;
   /** Component names actually dispatched to the driver, in run order. */
   selected: string[];
+  /** The components dispatched, as they ran (#4274): what a component's deploy-input digest is taken over. */
+  components?: DriverComponent[];
   error?: string;
   /** Set when the run stopped at a `gate` nobody has approved (#2119): the component it stopped at and the pending fact recorded for it. */
   gated?: {
@@ -718,6 +720,7 @@ export async function runComponents(
         success: run.status === "ok",
         run,
         selected,
+        components: resolvedTargets,
         buildParams: options.buildParams,
         ...(run.status === "gated" && run.gate
           ? {
@@ -785,6 +788,7 @@ export async function runComponents(
       success: componentResult.ok,
       run,
       selected,
+      components: resolvedTargets,
       buildParams: options.buildParams,
       ...(componentResult.status === "gated" && componentResult.gate
         ? {

package/src/components/deploy-units.ts

@@ -59,6 +59,11 @@ export const DEPLOY_UNIT_RULES: readonly DeployUnitRule[] = [
   // A Terraform-family root (#3049). Its unit is the root's name in
   // `terraform.roots`, which is also the member a gated wave's digest names.
   { kind: "terraform-apply", field: "root", lexicon: "terraform" },
+  // An ARM template applied into one resource group (#4273). Its unit is the group.
+  { kind: "arm-deploy", field: "resourceGroup", lexicon: "azure" },
+  // A Config Connector manifest applied over REST (#4273). Its unit is the
+  // step's `stack`, the member its plan names.
+  { kind: "gcp-apply", field: "stack", lexicon: "gcp" },
 ];
 
 /** One resolved unit a component's deploy composition targets. */

package/src/components/promote.test.ts

@@ -108,6 +108,45 @@ describe("planning", () => {
   });
 });
 
+describe("records of an apply, not an artifact (#4274)", () => {
+  const apply = (component: string, timestamp: string, digestKind: "plan" | "deploy-input" = "plan"): ReleaseRecord => ({
+    ...rec(component, "staging", `jcs1-sha256:${timestamp.slice(0, 10)}`, timestamp),
+    digestKind,
+  });
+  const records = [
+    rec("api", "staging", "sha256:api", "2026-01-02T00:00:00Z"),
+    apply("infra", "2026-01-02T00:00:00Z"),
+    apply("infra", "2026-01-03T00:00:00Z", "deploy-input"),
+  ];
+
+  test("promoting every component leaves an infrastructure component out and says why", () => {
+    const plan = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared: ["api", "infra"] }) as PromotionPlan;
+    expect(plan.items.map((i) => i.component)).toEqual(["api"]);
+    expect(plan.notPromoted).toEqual([{ component: "infra", reason: expect.stringMatching(/only applies are recorded/) }]);
+  });
+
+  test("a newer apply never hides the artifact release before it", () => {
+    const mixed = [rec("api", "staging", "sha256:api", "2026-01-01T00:00:00Z"), apply("api", "2026-01-05T00:00:00Z")];
+    const picked = selectRelease(mixed, "api", "staging");
+    expect("record" in picked && picked.record.digest).toBe("sha256:api");
+  });
+
+  test("promote, rollback and redeploy of a component with only applies are refused by name", () => {
+    const promote = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared: ["api", "infra"], component: "infra" });
+    expect("error" in promote && promote.error).toMatch(/"infra" has only applies recorded in "staging"/);
+    const rollback = planRollback({ env: "staging", records, declared: ["infra"], component: "infra" });
+    expect("error" in rollback && rollback.error).toMatch(/only applies recorded/);
+    const redeploy = planRedeploy({ env: "staging", records, declared: ["infra"], component: "infra" });
+    expect("error" in redeploy && redeploy.error).toMatch(/only applies recorded/);
+  });
+
+  test("a rollback or redeploy carries a templates digest's kind forward", () => {
+    const source: ReleaseRecord = { ...rec("infra", "staging", "sha256:tpl", "2026-01-02T00:00:00Z"), digestKind: "templates" };
+    const run = { runId: "r2", actor: "ci", timestamp: "2026-01-04T00:00:00Z" };
+    expect(rollbackRecord({ component: "infra", digest: "sha256:tpl", source }, "staging", run)).toMatchObject({ digestKind: "templates" });
+  });
+});
+
 describe("pinning each component to a digest (#2602)", () => {
   // api's pinned release is older than its latest one: another pipeline
   // recorded sha256:newer while this one ran.

package/src/components/promote.ts

@@ -39,7 +39,7 @@
  */
 
 import { parseWiringRef, type WiringRef } from "../lint/rules/comp/support";
-import { latestPerComponent, type ReleaseRecord, type ReleaseRecordInput, type ReleaseAdmission, type RunOrigin } from "../lifecycle/release-ledger";
+import { isApplyRecord, latestPerComponent, type ReleaseRecord, type ReleaseRecordInput, type ReleaseAdmission, type RunOrigin } from "../lifecycle/release-ledger";
 import { CapabilityRegistry, type Capability } from "./capability";
 import {
   runInterpretDriver,
@@ -109,19 +109,35 @@ export function selectRelease(
   env: string,
   digest?: string,
 ): { record: ReleaseRecord } | { error: string } {
-  const own = records.filter((r) => r.component === component);
-  if (own.length === 0) return { error: `no release of "${component}" is recorded in "${env}"` };
-  if (digest === undefined) return { record: latestPerComponent(own).get(component)! };
-  const matching = own.filter((r) => r.digest === digest);
+  const own = deployableRecords(records, component, env);
+  if ("error" in own) return own;
+  if (digest === undefined) return { record: latestPerComponent(own.records).get(component)! };
+  const matching = own.records.filter((r) => r.digest === digest);
   if (matching.length === 0) {
     return {
       error: `digest ${digest} is not recorded for "${component}" in "${env}"; ` +
-        `its recorded digests are ${[...new Set(own.map((r) => r.digest))].join(", ")}`,
+        `its recorded digests are ${[...new Set(own.records.map((r) => r.digest))].join(", ")}`,
     };
   }
   return { record: latestPerComponent(matching).get(component)! };
 }
 
+/**
+ * The records of `component` a promote, rollback or redeploy can deploy from
+ * (#4274): every one but those that only say it applied ({@link isApplyRecord}),
+ * whose digest is a plan or deploy-input digest and names no artifact.
+ */
+function deployableRecords(records: ReleaseRecord[], component: string, env: string): { records: ReleaseRecord[] } | { error: string } {
+  const own = records.filter((r) => r.component === component);
+  if (own.length === 0) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = own.filter((r) => !isApplyRecord(r));
+  if (deployable.length === 0) return { error: appliesOnly(component, env) };
+  return { records: deployable };
+}
+
+const appliesOnly = (component: string, env: string): string =>
+  `"${component}" has only applies recorded in "${env}", each by a plan or deploy-input digest, so no artifact of it can be deployed again`;
+
 /**
  * Read `--digest <component>=<digest>` values (#2602) into a component-to-
  * digest map. A value with no `=` is left to the single-component form
@@ -198,13 +214,17 @@ export function planPromotion(input: {
     return { from, to, items: [{ component, digest: picked.record.digest, source: picked.record }], notPromoted: [] };
   }
 
-  const latest = latestPerComponent(sourceRecords);
+  const latest = latestPerComponent(sourceRecords.filter((r) => !isApplyRecord(r)));
   const items: PromotionItem[] = [];
   const notPromoted: PromotionPlan["notPromoted"] = [];
   for (const [name, record] of [...latest].sort(([a], [b]) => a.localeCompare(b))) {
     if (declared.includes(name)) items.push({ component: name, digest: record.digest, source: record });
     else notPromoted.push({ component: name, reason: "recorded but not declared in this checkout" });
   }
+  // #4274: a component that only applied (infrastructure, no artifact) has nothing to promote.
+  for (const name of [...new Set(sourceRecords.filter((r) => isApplyRecord(r) && !latest.has(r.component)).map((r) => r.component))].sort()) {
+    notPromoted.push({ component: name, reason: "only applies are recorded, by a plan or deploy-input digest; there is no artifact to promote" });
+  }
   if (items.length === 0) {
     return { error: `nothing to promote: no component declared here has a release recorded in "${from}"` };
   }
@@ -228,9 +248,10 @@ export function planRollback(input: {
   if (!declared.includes(component)) {
     return { error: `component "${component}" is not declared in this checkout` };
   }
-  const own = records.filter((r) => r.component === component);
-  const current = latestPerComponent(own).get(component);
-  if (!current) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = deployableRecords(records, component, env);
+  if ("error" in deployable) return deployable;
+  const own = deployable.records;
+  const current = latestPerComponent(own).get(component)!;
 
   let target: ReleaseRecord;
   if (digest !== undefined) {
@@ -284,7 +305,7 @@ export function planReleaseRollback(input: {
       notPromoted.push({ component, reason: `in release ${name} but not declared in this checkout` });
       continue;
     }
-    const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest);
+    const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest && !isApplyRecord(r));
     if (ran.length === 0) {
       neverRan.push(component);
       continue;
@@ -299,7 +320,7 @@ export function planReleaseRollback(input: {
     };
   }
   if (items.length === 0) return { error: `release ${name} has no component declared in this checkout` };
-  const current = latestPerComponent(records);
+  const current = latestPerComponent(records.filter((r) => !isApplyRecord(r)));
   const already = items.every((i) => {
     const now = current.get(i.component);
     return now !== undefined && now.releaseDigest === release.releaseDigest && now.digest === i.digest && !input.unsettled?.has(i.component);
@@ -329,8 +350,9 @@ export function planRedeploy(input: {
   if (!declared.includes(component)) {
     return { error: `component "${component}" is not declared in this checkout` };
   }
-  const current = latestPerComponent(records.filter((r) => r.component === component)).get(component);
-  if (!current) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = deployableRecords(records, component, env);
+  if ("error" in deployable) return deployable;
+  const current = latestPerComponent(deployable.records).get(component)!;
   if (digest !== undefined && digest !== current.digest) {
     return {
       error: `${digest} is not the current release of "${component}" in "${env}" (that is ${current.digest}); ` +
@@ -699,6 +721,8 @@ function sharedRecord(item: PromotionItem, env: string, run: DeployRunInfo): Rel
     ...(run.admission ? { admission: run.admission } : {}),
     ...(source.manifestDigest ? { manifestDigest: source.manifestDigest } : {}),
     ...(source.inputDigest ? { inputDigest: source.inputDigest } : {}),
+    // #4274: a release's templates digest stays one when it is deployed again.
+    ...(source.digestKind ? { digestKind: source.digestKind } : {}),
   };
 }
 

package/src/lifecycle/__fixtures__/publish-fakes.ts

@@ -203,7 +203,12 @@ if (args[0] === "publish") {
   const [name, version] = split(args[1]);
   const p = reg.packages[name];
   if (!p) { console.error("npm error 404 Not Found - " + name); process.exit(1); }
-  if (p.lag && p.lag[version] > 0) { p.lag[version] -= 1; save(); }
+  if (process.env.FAKE_NPM_VIEW_ERROR && name.includes(process.env.FAKE_NPM_VIEW_ERROR) && p.versions.includes(version)) { console.error("npm error code E500"); console.error("npm error 500 Internal Server Error - GET https://registry.example/" + name); process.exit(1); }
+  if (p.lag && p.lag[version] > 0) {
+    p.lag[version] -= 1; save();
+    // A new package npm does not serve yet answers 404, as the real registry does.
+    if (process.env.FAKE_NPM_LAG_404) { console.error("npm error code E404"); console.error("npm error 404 No match found for version " + version); process.exit(1); }
+  }
   else if (p.versions.includes(version)) console.log(version);
 } else if (args[0] === "dist-tag" && args[1] === "add") {
   const [name, version] = split(args[2]);

package/src/lifecycle/publish-declaration.ts

@@ -61,9 +61,10 @@ export const NpmPublishSchema = z
      */
     tokenEnv: envName.optional(),
     /**
-     * Seconds the reveal waits for the registry to serve every version it
-     * published before installing them to audit (#4244). A registry accepts a
-     * publish before it serves it. Default 600.
+     * A cap, in seconds, on the reveal's wait for the registry to serve every
+     * version it published before installing them to audit (#4244). A
+     * registry accepts a publish before it serves it. Unset, the wait ends
+     * only when every version is served or the registry fails (#4271).
      */
     registryWait: z.number().int().min(0).optional(),
   })

package/src/lifecycle/publish-npm.ts

@@ -160,10 +160,12 @@ function run(bin: string, args: string[], ctx: PublishContext, cwd: string = ctx
   });
 }
 
-/** Seconds the reveal waits for the registry to serve what it published, by default (#4244). */
-export const NPM_REGISTRY_WAIT_SECONDS = 600;
 /** Between polls of the registry while it waits. */
 export const NPM_REGISTRY_POLL_MS = 10_000;
+/** Between progress lines while the reveal waits for the registry (#4271). */
+export const NPM_REGISTRY_PROGRESS_MS = 60_000;
+/** `npm view`'s answers for a version the registry does not serve yet; any other failure is the registry's error. */
+const NPM_VIEW_NOT_YET = /\bE404\b|\b404 Not Found\b|is not in (this|the npm) registry|No match found for version|\b(ETARGET|notarget)\b/;
 /** npm's errors for a version the registry does not serve yet. */
 const NPM_NOT_SERVED = /\b(ETARGET|ERESOLVE|notarget)\b|No matching version found/;
 
@@ -225,29 +227,52 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
    * `npm audit signatures` there (#4049), which checks each package's
    * registry signature and provenance attestation.
    */
+  /**
+   * Whether the registry serves the version yet, while the reveal waits for
+   * it (#4271). A 404, or an answer without the version, is not yet; any other
+   * failure of `npm view` is the registry's error and ends the wait.
+   */
+  const probe = async (ctx: PublishContext, pkg: NpmPackage): Promise<boolean> => {
+    const r = await npm(ctx, ["view", `${pkg.name}@${pkg.version}`, "version", ...(decl.registry ? ["--registry", decl.registry] : [])]);
+    if (r.code === 0) return r.output.some((l) => l.trim() === pkg.version || l.trim() === JSON.stringify(pkg.version));
+    if (r.output.some((l) => NPM_VIEW_NOT_YET.test(l))) return false;
+    const said = r.output.filter((l) => /^npm (error|ERR!)/.test(l)).at(-1) ?? r.output.at(-1) ?? "npm printed nothing";
+    throw new PublishTargetError(
+      "publish-npm-registry-failed",
+      `npm view ${pkg.name}@${pkg.version} exited ${r.code} while the reveal waited for the registry to serve it, so nothing was audited: ${said}`,
+      "Each package was published. Once the registry answers, run the publish again: it publishes nothing twice and audits again.",
+    );
+  };
   /**
    * Wait until the registry serves every version (#4244): npm accepts a
    * publish minutes before `npm view` and `npm install` find it, so an
-   * install straight after fails with ETARGET or ERESOLVE.
+   * install straight after fails with ETARGET or ERESOLVE. The wait ends when
+   * every version is served or the registry fails (#4271), with a progress
+   * line about once a minute. `registryWait` caps it only when declared.
    */
   const served = async (ctx: PublishContext, pkgs: NpmPackage[]): Promise<void> => {
-    const wait = (decl.registryWait ?? NPM_REGISTRY_WAIT_SECONDS) * 1000;
+    const cap = decl.registryWait === undefined ? undefined : decl.registryWait * 1000;
     const start = now();
+    let logged: number | undefined;
     let missing = pkgs;
     for (;;) {
       const still: NpmPackage[] = [];
-      for (const pkg of missing) if (!(await onRegistry(ctx, pkg))) still.push(pkg);
+      for (const pkg of missing) if (!(await probe(ctx, pkg))) still.push(pkg);
       missing = still;
       if (missing.length === 0) return;
       const names = missing.map((p) => `${p.name}@${p.version}`).join(", ");
-      if (now() - start >= wait) {
+      const waited = now() - start;
+      if (cap !== undefined && waited >= cap) {
         throw new PublishTargetError(
           "publish-npm-not-served",
-          `the registry did not serve ${names} within ${Math.round(wait / 1000)}s of the publish, so nothing was audited`,
+          `the registry did not serve ${names} within ${Math.round(cap / 1000)}s of the publish, so nothing was audited`,
           "Each package was published. Once npm serves them, run the publish again: it publishes nothing twice and audits again. `registryWait` sets the wait.",
         );
       }
-      ctx.log(`waiting for the registry to serve ${names}`);
+      if (logged === undefined || now() - logged >= NPM_REGISTRY_PROGRESS_MS) {
+        ctx.log(`waiting for the registry to serve ${names}${waited > 0 ? ` (${Math.round(waited / 1000)}s so far)` : ""}`);
+        logged = now();
+      }
       await sleep(NPM_REGISTRY_POLL_MS);
     }
   };

package/src/lifecycle/publish-targets.test.ts

@@ -486,7 +486,8 @@ describe("SBOMs and provenance (#4049)", () => {
   });
 
   describe("npm: the reveal waits for the registry to serve what it published (#4244)", () => {
-    function lagged(env: Record<string, string>, registryWait?: number) {
+    // `step` is how far the clock moves per sleep, so a long wait costs few npm runs.
+    function lagged(env: Record<string, string>, registryWait?: number, step?: number) {
       const dir = temp();
       writePackage(join(dir, "core"), "@acme/core", "1.0.0");
       writePackage(join(dir, "cli"), "@acme/cli", "1.0.0");
@@ -494,7 +495,7 @@ describe("SBOMs and provenance (#4049)", () => {
       const npm = writeFakeNpm(join(dir, "bin"), log);
       let clock = 0;
       const sleeps: number[] = [];
-      const deps = { npm, now: () => clock, sleep: async (ms: number) => { sleeps.push(ms); clock += ms; } };
+      const deps = { npm, now: () => clock, sleep: async (ms: number) => { sleeps.push(ms); clock += step ?? ms; } };
       const ctx = context(dir, { env: { PATH: process.env.PATH, ...env }, provenance: OIDC });
       const d = decl({ type: "npm", packages: ["core", "cli"], stage: false, ...(registryWait !== undefined ? { registryWait } : {}) });
       return { log, deps, ctx, d, sleeps };
@@ -518,7 +519,39 @@ describe("SBOMs and provenance (#4049)", () => {
       expect(installs(log)).toBe(1);
     });
 
-    test("a version never served: the wait ends with an error naming it, before any install", async () => {
+    test("with no registryWait it waits past 600 seconds until npm serves, naming what is missing about once a minute (#4271)", async () => {
+      // 21 polls, the clock moving 30s each: served after 630s.
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_LAG: "@acme/core=21,@acme/cli=1" }, undefined, 30_000);
+      const [target] = await createPublishTargets([d], deps);
+      await target!.reveal(ctx, await target!.stage(ctx));
+      expect(sleeps.length).toBe(21);
+      const progress = ctx.lines.filter((l) => l.startsWith("waiting for the registry to serve"));
+      expect(progress[0]).toBe("waiting for the registry to serve @acme/core@1.0.0, @acme/cli@1.0.0");
+      expect(progress[1]).toBe("waiting for the registry to serve @acme/core@1.0.0 (60s so far)");
+      expect(progress.at(-1)).toBe("waiting for the registry to serve @acme/core@1.0.0 (600s so far)");
+      expect(progress.length).toBe(11);
+      expect(installs(log)).toBe(1);
+    });
+
+    test("a 404 for the version is not yet served, and the wait goes on (#4271)", async () => {
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_LAG: "@acme/cli=2", FAKE_NPM_LAG_404: "1" });
+      const [target] = await createPublishTargets([d], deps);
+      await target!.reveal(ctx, await target!.stage(ctx));
+      expect(sleeps).toEqual([10_000, 10_000]);
+      expect(installs(log)).toBe(1);
+    });
+
+    test("a registry error that is not a 404 ends the wait with npm's error, before any install (#4271)", async () => {
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_VIEW_ERROR: "@acme/cli" });
+      const [target] = await createPublishTargets([d], deps);
+      const err = await refused(target!.reveal(ctx, await target!.stage(ctx)));
+      expect(err.code).toBe("publish-npm-registry-failed");
+      expect(err.message).toBe("npm view @acme/cli@1.0.0 exited 1 while the reveal waited for the registry to serve it, so nothing was audited: npm error 500 Internal Server Error - GET https://registry.example/@acme/cli");
+      expect(sleeps).toEqual([]);
+      expect(installs(log)).toBe(0);
+    });
+
+    test("with registryWait declared, a version never served: the wait ends with an error naming it, before any install", async () => {
       const { log, deps, ctx, d } = lagged({ FAKE_NPM_LAG: "@acme/core=1000" }, 30);
       const [target] = await createPublishTargets([d], deps);
       const err = await refused(target!.reveal(ctx, await target!.stage(ctx)));

package/src/lifecycle/release-ledger.ts

@@ -242,6 +242,35 @@ export interface ReleaseRecord {
    * deploy that was not made from a release.
    */
   releaseDigest?: string;
+  /**
+   * Optional: what `digest` names when it is not an artifact digest (#4274).
+   * Absent on a record whose digest is the artifact the deploy promoted, and on
+   * every record written before 0.124.35.
+   *
+   * - `plan`: the component published nothing, and the digest is its plan
+   *   digest, the one its approval bound (`pr-apply`).
+   * - `deploy-input`: the component published nothing and planned nothing, and
+   *   the digest is its deploy-input digest (`componentInputDigests`,
+   *   ../components/fan-out-inputs.ts).
+   * - `templates`: the digest of the templates the release records for the
+   *   component (#4222, `releaseTemplatesDigest`).
+   *
+   * A `plan` or `deploy-input` record says the component applied; it names no
+   * artifact, so promote, rollback and redeploy never deploy it
+   * ({@link isApplyRecord}).
+   */
+  digestKind?: ReleaseDigestKind;
+}
+
+/** What a release record's `digest` names when it is not an artifact digest (#4274). */
+export type ReleaseDigestKind = "plan" | "deploy-input" | "templates";
+
+/**
+ * Whether `record` only says its component applied (#4274): its digest is a
+ * plan or deploy-input digest, not one anything can be deployed from again.
+ */
+export function isApplyRecord(record: Pick<ReleaseRecord, "digestKind">): boolean {
+  return record.digestKind === "plan" || record.digestKind === "deploy-input";
 }
 
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
@@ -319,9 +348,21 @@ export function resolveCiRun(env: NodeJS.ProcessEnv = process.env): { runId: str
       },
     };
   }
+  // #4275: a step of a job the chant runner ran. The forge branches come first, and the runner
+  // strips the forge's run variables from its steps, so neither kind of job is taken for the other.
+  if (env[CHANT_CI_RUN_ID_ENV] && env[CHANT_CI_RUN_FORGE_ENV] === "chant") {
+    return { runId: env[CHANT_CI_RUN_ID_ENV], runOrigin: { forge: "chant" } };
+  }
   return undefined;
 }
 
+/** The run id `chant ci run` hands each step of a job it runs (#4275), the id its run index lists. */
+export const CHANT_CI_RUN_ID_ENV = "CHANT_CI_RUN_ID";
+/** The run's origin `chant ci run` hands each step with {@link CHANT_CI_RUN_ID_ENV}: always `chant`. */
+export const CHANT_CI_RUN_FORGE_ENV = "CHANT_CI_RUN_FORGE";
+/** The forge's run variables, which a step of a job the chant runner ran never gets (#4275). */
+export const FORGE_RUN_ENV = ["GITHUB_RUN_ID", "GITHUB_RUN_ATTEMPT", "GITHUB_JOB", "CI_PIPELINE_ID", "CI_PIPELINE_URL", "CI_JOB_ID"] as const;
+
 /**
  * The CI run the environment names, as {@link resolveCiRun} has it, with the
  * job within the run and the run's attempt when the forge gives them
@@ -332,7 +373,7 @@ export function resolveCiJob(env: NodeJS.ProcessEnv = process.env): { runId: str
   const ci = resolveCiRun(env);
   if (!ci) return undefined;
   const github = ci.runOrigin.forge === "github";
-  const jobId = github ? env.GITHUB_JOB : env.CI_JOB_ID;
+  const jobId = github ? env.GITHUB_JOB : ci.runOrigin.forge === "gitlab" ? env.CI_JOB_ID : undefined;
   const attempt = github ? Number(env.GITHUB_RUN_ATTEMPT) : NaN;
   return {
     runId: ci.runId,

package/src/lifecycle/status.test.ts

@@ -432,6 +432,16 @@ describe("status", () => {
       expect(result.digestB).toBe("sha256:prod-bytes");
     });
 
+    test("apply records compare on the commit, since their digests take in the environment (#4274)", () => {
+      const apply = (env: string, gitSha: string) =>
+        record({ component: "infra", env, gitSha, digest: `jcs1-sha256:${env.padEnd(64, "0").slice(0, 64)}`, digestKind: "deploy-input" });
+      const same = compareAcrossEnvironments("infra", { name: "staging", records: [apply("staging", "a1")] }, { name: "prod", records: [apply("prod", "a1")] });
+      expect(same.same).toBe(true);
+      expect(same.comparedOn).toEqual({ a: "git:a1", b: "git:a1" });
+      const moved = compareAcrossEnvironments("infra", { name: "staging", records: [apply("staging", "b2")] }, { name: "prod", records: [apply("prod", "a1")] });
+      expect(moved.same).toBe(false);
+    });
+
     test("differing inputDigests are a real difference, whatever the bytes say", () => {
       const result = compareAcrossEnvironments(
         "web",
@@ -671,6 +681,15 @@ describe("drifted: live evidence contradicts the recorded release (#2513)", () =
     expect(row.reconciliation).toBe("reconciled");
   });
 
+  test("reconciled: an apply record's plan digest is never held against a live digest (#4274)", () => {
+    const row = reconcile(
+      [entry()],
+      new Map([["svc", { now: live({ attributes: { digest: "sha256:other", gitSha: "1111111" } }) }]]),
+      { ...released, digest: `jcs1-sha256:${"a".repeat(64)}`, digestKind: "plan" },
+    );
+    expect(row.reconciliation).toBe("reconciled");
+  });
+
   test("drifted: a foreign digest", () => {
     const row = reconcile([entry()], new Map([["svc", { now: live({ attributes: { digest: "sha256:other" } }) }]]));
     expect(row.reconciliation).toBe("drifted");

package/src/lifecycle/status.ts

@@ -43,7 +43,7 @@
 
 import type { ChangeSet, ChangeAction } from "./change-set";
 import type { ResourceMetadata } from "../lexicon";
-import { latestPerComponent, type ReleaseRecord } from "./release-ledger";
+import { isApplyRecord, latestPerComponent, type ReleaseRecord } from "./release-ledger";
 import { isLegacyContentDigest } from "./legacy-digest";
 import type { BuildLedgerEntry, ComponentBomSummary } from "./build-ledger";
 import { unobservedReasonText, type UnobservedReason } from "../observation";
@@ -647,7 +647,8 @@ function notBefore(since: string, recordedAt: string): boolean {
  */
 function contradictsRecord(recorded: ReleaseRecord, evidence: LiveComponentEvidence): string | undefined {
   for (const id of evidence.identities ?? []) {
-    if (id.digest !== undefined) {
+    // #4274: an apply's digest is a plan or deploy-input digest, which no live resource reports.
+    if (id.digest !== undefined && !isApplyRecord(recorded)) {
       const matches =
         sameDigest(id.digest, recorded.digest) ||
         (recorded.inputDigest !== undefined && sameDigest(id.digest, recorded.inputDigest));
@@ -697,7 +698,9 @@ export interface CrossEnvComparison {
    * environments legitimately render to different bytes, so cross-environment
    * "is prod running what staging tested" joins on the input side while
    * `digest` proves the exact bytes each cluster got. Records without it
-   * compare on `digest` exactly as before.
+   * compare on `digest` exactly as before. An apply record (#4274) compares
+   * on its `gitSha`, since its plan or deploy-input digest takes in the
+   * environment and so differs between any two.
    */
   same: boolean;
   /** The identities `same` was decided on (`inputDigest ?? digest` per side), when both sides had one and they differ from the digests shown. */
@@ -711,6 +714,11 @@ export interface CrossEnvComparison {
   mixedDigestForms?: true;
 }
 
+/** What two environments' records of a component are compared on: the input side when there is one, the commit for an apply (#4274). */
+export function comparableIdentity(record: ReleaseRecord): string {
+  return isApplyRecord(record) ? `git:${record.gitSha}` : record.inputDigest ?? record.digest;
+}
+
 /** Compare the latest recorded digest for `component` between two environments' release records. */
 export function compareAcrossEnvironments(
   component: string,
@@ -719,9 +727,9 @@ export function compareAcrossEnvironments(
 ): CrossEnvComparison {
   const latestA = latestPerComponent(envA.records).get(component);
   const latestB = latestPerComponent(envB.records).get(component);
-  const idA = latestA ? latestA.inputDigest ?? latestA.digest : undefined;
-  const idB = latestB ? latestB.inputDigest ?? latestB.digest : undefined;
-  const comparedOnInputs = (latestA?.inputDigest ?? latestB?.inputDigest) !== undefined;
+  const idA = latestA ? comparableIdentity(latestA) : undefined;
+  const idB = latestB ? comparableIdentity(latestB) : undefined;
+  const comparedOnInputs = (latestA !== undefined && idA !== latestA.digest) || (latestB !== undefined && idB !== latestB.digest);
   return {
     component,
     envA: envA.name,

package/src/live-endpoint.ts

@@ -145,3 +145,34 @@ export function zeroResourcesWarning(
   if (Object.keys(observed.unobserved).length > 0) return undefined;
   return `${lexicon}: 0 live resources for env "${environment}" (${declaredCount} declared) — check the endpoint/credentials`;
 }
+
+/**
+ * Run `run` with `environment`'s declared endpoint applied, as
+ * {@link applyLiveEndpoint} applies it to a `--live` read, and restored after
+ * (#4281). The component plan and apply paths (`components pr-plan`,
+ * `pr-apply`, `pr-record`, `fan-out`, `promote`, `rollback`, `redeploy` and
+ * `chant run --components`) run capabilities that honor the same ambient vars:
+ * azure's `arm-deploy` reads `AZURE_ENDPOINT_URL`, gcp's `gcp-apply`
+ * `GCP_ENDPOINT_URL`, aws's `cfn-deploy` `AWS_ENDPOINT_URL`. Without this, a
+ * plan for an environment declared against an emulator went to the real cloud
+ * unless the shell exported the var by hand.
+ *
+ * `lexicons` is called only when the environment declares an endpoint, so a
+ * caller that has to load its plugins pays for that only then.
+ */
+export async function withEnvironmentEndpoint<T>(
+  environments: EnvironmentDeclaration[] | undefined,
+  environment: string,
+  lexicons: () => Promise<readonly EndpointLexicon[]> | readonly EndpointLexicon[],
+  run: () => Promise<T>,
+  options: { warn?: (message: string) => void; env?: NodeJS.ProcessEnv } = {},
+): Promise<T> {
+  if (!environmentEndpoint(environments, environment)) return run();
+  const applied = applyLiveEndpoint(environments, environment, await lexicons(), options.env);
+  if (applied.notice) options.warn?.(applied.notice);
+  try {
+    return await run();
+  } finally {
+    applied.restore();
+  }
+}

package/src/workspace/ci-builds.e2e.test.ts

@@ -37,6 +37,8 @@ interface Run {
 }
 
 /** The fake GitHub: runs per commit, and what dispatching the suites at a commit concludes. */
+const RUN_BASE = 100_000;
+
 class FakeGithub {
   runs = new Map<string, Run[]>();
   dispatched: string[] = [];
@@ -74,9 +76,12 @@ class FakeGithub {
       const runs = this.runs.get(m[1]) ?? [];
       return send(200, { total_count: runs.length, check_runs: runs.map((r) => ({ ...r, completed_at: null, html_url: null })) });
     }
-    m = /^\/repos\/acme\/app\/actions\/jobs\/(\d+)\/rerun$/.exec(url.pathname);
+    // Each job is its own workflow run here, numbered RUN_BASE above the job's id.
+    m = /^\/repos\/acme\/app\/actions\/jobs\/(\d+)$/.exec(url.pathname);
+    if (req.method === "GET" && m) return send(200, { id: Number(m[1]), run_id: RUN_BASE + Number(m[1]) });
+    m = /^\/repos\/acme\/app\/actions\/runs\/(\d+)\/rerun-failed-jobs$/.exec(url.pathname);
     if (req.method === "POST" && m) {
-      const id = Number(m[1]);
+      const id = Number(m[1]) - RUN_BASE;
       this.reruns.push(id);
       // The job runs again and fails the same way.
       for (const [sha, runs] of this.runs) {