@intentius/chant 0.124.39 → 0.124.40

package/src/lifecycle/publish-npm.ts

@@ -160,10 +160,12 @@ function run(bin: string, args: string[], ctx: PublishContext, cwd: string = ctx
   });
 }
 
-/** Seconds the reveal waits for the registry to serve what it published, by default (#4244). */
-export const NPM_REGISTRY_WAIT_SECONDS = 600;
 /** Between polls of the registry while it waits. */
 export const NPM_REGISTRY_POLL_MS = 10_000;
+/** Between progress lines while the reveal waits for the registry (#4271). */
+export const NPM_REGISTRY_PROGRESS_MS = 60_000;
+/** `npm view`'s answers for a version the registry does not serve yet; any other failure is the registry's error. */
+const NPM_VIEW_NOT_YET = /\bE404\b|\b404 Not Found\b|is not in (this|the npm) registry|No match found for version|\b(ETARGET|notarget)\b/;
 /** npm's errors for a version the registry does not serve yet. */
 const NPM_NOT_SERVED = /\b(ETARGET|ERESOLVE|notarget)\b|No matching version found/;
 
@@ -225,29 +227,52 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
    * `npm audit signatures` there (#4049), which checks each package's
    * registry signature and provenance attestation.
    */
+  /**
+   * Whether the registry serves the version yet, while the reveal waits for
+   * it (#4271). A 404, or an answer without the version, is not yet; any other
+   * failure of `npm view` is the registry's error and ends the wait.
+   */
+  const probe = async (ctx: PublishContext, pkg: NpmPackage): Promise<boolean> => {
+    const r = await npm(ctx, ["view", `${pkg.name}@${pkg.version}`, "version", ...(decl.registry ? ["--registry", decl.registry] : [])]);
+    if (r.code === 0) return r.output.some((l) => l.trim() === pkg.version || l.trim() === JSON.stringify(pkg.version));
+    if (r.output.some((l) => NPM_VIEW_NOT_YET.test(l))) return false;
+    const said = r.output.filter((l) => /^npm (error|ERR!)/.test(l)).at(-1) ?? r.output.at(-1) ?? "npm printed nothing";
+    throw new PublishTargetError(
+      "publish-npm-registry-failed",
+      `npm view ${pkg.name}@${pkg.version} exited ${r.code} while the reveal waited for the registry to serve it, so nothing was audited: ${said}`,
+      "Each package was published. Once the registry answers, run the publish again: it publishes nothing twice and audits again.",
+    );
+  };
   /**
    * Wait until the registry serves every version (#4244): npm accepts a
    * publish minutes before `npm view` and `npm install` find it, so an
-   * install straight after fails with ETARGET or ERESOLVE.
+   * install straight after fails with ETARGET or ERESOLVE. The wait ends when
+   * every version is served or the registry fails (#4271), with a progress
+   * line about once a minute. `registryWait` caps it only when declared.
    */
   const served = async (ctx: PublishContext, pkgs: NpmPackage[]): Promise<void> => {
-    const wait = (decl.registryWait ?? NPM_REGISTRY_WAIT_SECONDS) * 1000;
+    const cap = decl.registryWait === undefined ? undefined : decl.registryWait * 1000;
     const start = now();
+    let logged: number | undefined;
     let missing = pkgs;
     for (;;) {
       const still: NpmPackage[] = [];
-      for (const pkg of missing) if (!(await onRegistry(ctx, pkg))) still.push(pkg);
+      for (const pkg of missing) if (!(await probe(ctx, pkg))) still.push(pkg);
       missing = still;
       if (missing.length === 0) return;
       const names = missing.map((p) => `${p.name}@${p.version}`).join(", ");
-      if (now() - start >= wait) {
+      const waited = now() - start;
+      if (cap !== undefined && waited >= cap) {
         throw new PublishTargetError(
           "publish-npm-not-served",
-          `the registry did not serve ${names} within ${Math.round(wait / 1000)}s of the publish, so nothing was audited`,
+          `the registry did not serve ${names} within ${Math.round(cap / 1000)}s of the publish, so nothing was audited`,
           "Each package was published. Once npm serves them, run the publish again: it publishes nothing twice and audits again. `registryWait` sets the wait.",
         );
       }
-      ctx.log(`waiting for the registry to serve ${names}`);
+      if (logged === undefined || now() - logged >= NPM_REGISTRY_PROGRESS_MS) {
+        ctx.log(`waiting for the registry to serve ${names}${waited > 0 ? ` (${Math.round(waited / 1000)}s so far)` : ""}`);
+        logged = now();
+      }
       await sleep(NPM_REGISTRY_POLL_MS);
     }
   };

package/src/lifecycle/publish-targets.test.ts

@@ -486,7 +486,8 @@ describe("SBOMs and provenance (#4049)", () => {
   });
 
   describe("npm: the reveal waits for the registry to serve what it published (#4244)", () => {
-    function lagged(env: Record<string, string>, registryWait?: number) {
+    // `step` is how far the clock moves per sleep, so a long wait costs few npm runs.
+    function lagged(env: Record<string, string>, registryWait?: number, step?: number) {
       const dir = temp();
       writePackage(join(dir, "core"), "@acme/core", "1.0.0");
       writePackage(join(dir, "cli"), "@acme/cli", "1.0.0");
@@ -494,7 +495,7 @@ describe("SBOMs and provenance (#4049)", () => {
       const npm = writeFakeNpm(join(dir, "bin"), log);
       let clock = 0;
       const sleeps: number[] = [];
-      const deps = { npm, now: () => clock, sleep: async (ms: number) => { sleeps.push(ms); clock += ms; } };
+      const deps = { npm, now: () => clock, sleep: async (ms: number) => { sleeps.push(ms); clock += step ?? ms; } };
       const ctx = context(dir, { env: { PATH: process.env.PATH, ...env }, provenance: OIDC });
       const d = decl({ type: "npm", packages: ["core", "cli"], stage: false, ...(registryWait !== undefined ? { registryWait } : {}) });
       return { log, deps, ctx, d, sleeps };
@@ -518,7 +519,39 @@ describe("SBOMs and provenance (#4049)", () => {
       expect(installs(log)).toBe(1);
     });
 
-    test("a version never served: the wait ends with an error naming it, before any install", async () => {
+    test("with no registryWait it waits past 600 seconds until npm serves, naming what is missing about once a minute (#4271)", async () => {
+      // 21 polls, the clock moving 30s each: served after 630s.
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_LAG: "@acme/core=21,@acme/cli=1" }, undefined, 30_000);
+      const [target] = await createPublishTargets([d], deps);
+      await target!.reveal(ctx, await target!.stage(ctx));
+      expect(sleeps.length).toBe(21);
+      const progress = ctx.lines.filter((l) => l.startsWith("waiting for the registry to serve"));
+      expect(progress[0]).toBe("waiting for the registry to serve @acme/core@1.0.0, @acme/cli@1.0.0");
+      expect(progress[1]).toBe("waiting for the registry to serve @acme/core@1.0.0 (60s so far)");
+      expect(progress.at(-1)).toBe("waiting for the registry to serve @acme/core@1.0.0 (600s so far)");
+      expect(progress.length).toBe(11);
+      expect(installs(log)).toBe(1);
+    });
+
+    test("a 404 for the version is not yet served, and the wait goes on (#4271)", async () => {
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_LAG: "@acme/cli=2", FAKE_NPM_LAG_404: "1" });
+      const [target] = await createPublishTargets([d], deps);
+      await target!.reveal(ctx, await target!.stage(ctx));
+      expect(sleeps).toEqual([10_000, 10_000]);
+      expect(installs(log)).toBe(1);
+    });
+
+    test("a registry error that is not a 404 ends the wait with npm's error, before any install (#4271)", async () => {
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_VIEW_ERROR: "@acme/cli" });
+      const [target] = await createPublishTargets([d], deps);
+      const err = await refused(target!.reveal(ctx, await target!.stage(ctx)));
+      expect(err.code).toBe("publish-npm-registry-failed");
+      expect(err.message).toBe("npm view @acme/cli@1.0.0 exited 1 while the reveal waited for the registry to serve it, so nothing was audited: npm error 500 Internal Server Error - GET https://registry.example/@acme/cli");
+      expect(sleeps).toEqual([]);
+      expect(installs(log)).toBe(0);
+    });
+
+    test("with registryWait declared, a version never served: the wait ends with an error naming it, before any install", async () => {
       const { log, deps, ctx, d } = lagged({ FAKE_NPM_LAG: "@acme/core=1000" }, 30);
       const [target] = await createPublishTargets([d], deps);
       const err = await refused(target!.reveal(ctx, await target!.stage(ctx)));

package/src/lifecycle/release-ledger.ts

@@ -242,6 +242,35 @@ export interface ReleaseRecord {
    * deploy that was not made from a release.
    */
   releaseDigest?: string;
+  /**
+   * Optional: what `digest` names when it is not an artifact digest (#4274).
+   * Absent on a record whose digest is the artifact the deploy promoted, and on
+   * every record written before 0.124.35.
+   *
+   * - `plan`: the component published nothing, and the digest is its plan
+   *   digest, the one its approval bound (`pr-apply`).
+   * - `deploy-input`: the component published nothing and planned nothing, and
+   *   the digest is its deploy-input digest (`componentInputDigests`,
+   *   ../components/fan-out-inputs.ts).
+   * - `templates`: the digest of the templates the release records for the
+   *   component (#4222, `releaseTemplatesDigest`).
+   *
+   * A `plan` or `deploy-input` record says the component applied; it names no
+   * artifact, so promote, rollback and redeploy never deploy it
+   * ({@link isApplyRecord}).
+   */
+  digestKind?: ReleaseDigestKind;
+}
+
+/** What a release record's `digest` names when it is not an artifact digest (#4274). */
+export type ReleaseDigestKind = "plan" | "deploy-input" | "templates";
+
+/**
+ * Whether `record` only says its component applied (#4274): its digest is a
+ * plan or deploy-input digest, not one anything can be deployed from again.
+ */
+export function isApplyRecord(record: Pick<ReleaseRecord, "digestKind">): boolean {
+  return record.digestKind === "plan" || record.digestKind === "deploy-input";
 }
 
 /** Thrown by `appendReleaseRecord` when the record is missing a required field — a release record can never be recorded partially, since it is never editable afterward. */
@@ -319,9 +348,21 @@ export function resolveCiRun(env: NodeJS.ProcessEnv = process.env): { runId: str
       },
     };
   }
+  // #4275: a step of a job the chant runner ran. The forge branches come first, and the runner
+  // strips the forge's run variables from its steps, so neither kind of job is taken for the other.
+  if (env[CHANT_CI_RUN_ID_ENV] && env[CHANT_CI_RUN_FORGE_ENV] === "chant") {
+    return { runId: env[CHANT_CI_RUN_ID_ENV], runOrigin: { forge: "chant" } };
+  }
   return undefined;
 }
 
+/** The run id `chant ci run` hands each step of a job it runs (#4275), the id its run index lists. */
+export const CHANT_CI_RUN_ID_ENV = "CHANT_CI_RUN_ID";
+/** The run's origin `chant ci run` hands each step with {@link CHANT_CI_RUN_ID_ENV}: always `chant`. */
+export const CHANT_CI_RUN_FORGE_ENV = "CHANT_CI_RUN_FORGE";
+/** The forge's run variables, which a step of a job the chant runner ran never gets (#4275). */
+export const FORGE_RUN_ENV = ["GITHUB_RUN_ID", "GITHUB_RUN_ATTEMPT", "GITHUB_JOB", "CI_PIPELINE_ID", "CI_PIPELINE_URL", "CI_JOB_ID"] as const;
+
 /**
  * The CI run the environment names, as {@link resolveCiRun} has it, with the
  * job within the run and the run's attempt when the forge gives them
@@ -332,7 +373,7 @@ export function resolveCiJob(env: NodeJS.ProcessEnv = process.env): { runId: str
   const ci = resolveCiRun(env);
   if (!ci) return undefined;
   const github = ci.runOrigin.forge === "github";
-  const jobId = github ? env.GITHUB_JOB : env.CI_JOB_ID;
+  const jobId = github ? env.GITHUB_JOB : ci.runOrigin.forge === "gitlab" ? env.CI_JOB_ID : undefined;
   const attempt = github ? Number(env.GITHUB_RUN_ATTEMPT) : NaN;
   return {
     runId: ci.runId,

package/src/lifecycle/status.test.ts

@@ -432,6 +432,16 @@ describe("status", () => {
       expect(result.digestB).toBe("sha256:prod-bytes");
     });
 
+    test("apply records compare on the commit, since their digests take in the environment (#4274)", () => {
+      const apply = (env: string, gitSha: string) =>
+        record({ component: "infra", env, gitSha, digest: `jcs1-sha256:${env.padEnd(64, "0").slice(0, 64)}`, digestKind: "deploy-input" });
+      const same = compareAcrossEnvironments("infra", { name: "staging", records: [apply("staging", "a1")] }, { name: "prod", records: [apply("prod", "a1")] });
+      expect(same.same).toBe(true);
+      expect(same.comparedOn).toEqual({ a: "git:a1", b: "git:a1" });
+      const moved = compareAcrossEnvironments("infra", { name: "staging", records: [apply("staging", "b2")] }, { name: "prod", records: [apply("prod", "a1")] });
+      expect(moved.same).toBe(false);
+    });
+
     test("differing inputDigests are a real difference, whatever the bytes say", () => {
       const result = compareAcrossEnvironments(
         "web",
@@ -671,6 +681,15 @@ describe("drifted: live evidence contradicts the recorded release (#2513)", () =
     expect(row.reconciliation).toBe("reconciled");
   });
 
+  test("reconciled: an apply record's plan digest is never held against a live digest (#4274)", () => {
+    const row = reconcile(
+      [entry()],
+      new Map([["svc", { now: live({ attributes: { digest: "sha256:other", gitSha: "1111111" } }) }]]),
+      { ...released, digest: `jcs1-sha256:${"a".repeat(64)}`, digestKind: "plan" },
+    );
+    expect(row.reconciliation).toBe("reconciled");
+  });
+
   test("drifted: a foreign digest", () => {
     const row = reconcile([entry()], new Map([["svc", { now: live({ attributes: { digest: "sha256:other" } }) }]]));
     expect(row.reconciliation).toBe("drifted");

package/src/lifecycle/status.ts

@@ -43,7 +43,7 @@
 
 import type { ChangeSet, ChangeAction } from "./change-set";
 import type { ResourceMetadata } from "../lexicon";
-import { latestPerComponent, type ReleaseRecord } from "./release-ledger";
+import { isApplyRecord, latestPerComponent, type ReleaseRecord } from "./release-ledger";
 import { isLegacyContentDigest } from "./legacy-digest";
 import type { BuildLedgerEntry, ComponentBomSummary } from "./build-ledger";
 import { unobservedReasonText, type UnobservedReason } from "../observation";
@@ -647,7 +647,8 @@ function notBefore(since: string, recordedAt: string): boolean {
  */
 function contradictsRecord(recorded: ReleaseRecord, evidence: LiveComponentEvidence): string | undefined {
   for (const id of evidence.identities ?? []) {
-    if (id.digest !== undefined) {
+    // #4274: an apply's digest is a plan or deploy-input digest, which no live resource reports.
+    if (id.digest !== undefined && !isApplyRecord(recorded)) {
       const matches =
         sameDigest(id.digest, recorded.digest) ||
         (recorded.inputDigest !== undefined && sameDigest(id.digest, recorded.inputDigest));
@@ -697,7 +698,9 @@ export interface CrossEnvComparison {
    * environments legitimately render to different bytes, so cross-environment
    * "is prod running what staging tested" joins on the input side while
    * `digest` proves the exact bytes each cluster got. Records without it
-   * compare on `digest` exactly as before.
+   * compare on `digest` exactly as before. An apply record (#4274) compares
+   * on its `gitSha`, since its plan or deploy-input digest takes in the
+   * environment and so differs between any two.
    */
   same: boolean;
   /** The identities `same` was decided on (`inputDigest ?? digest` per side), when both sides had one and they differ from the digests shown. */
@@ -711,6 +714,11 @@ export interface CrossEnvComparison {
   mixedDigestForms?: true;
 }
 
+/** What two environments' records of a component are compared on: the input side when there is one, the commit for an apply (#4274). */
+export function comparableIdentity(record: ReleaseRecord): string {
+  return isApplyRecord(record) ? `git:${record.gitSha}` : record.inputDigest ?? record.digest;
+}
+
 /** Compare the latest recorded digest for `component` between two environments' release records. */
 export function compareAcrossEnvironments(
   component: string,
@@ -719,9 +727,9 @@ export function compareAcrossEnvironments(
 ): CrossEnvComparison {
   const latestA = latestPerComponent(envA.records).get(component);
   const latestB = latestPerComponent(envB.records).get(component);
-  const idA = latestA ? latestA.inputDigest ?? latestA.digest : undefined;
-  const idB = latestB ? latestB.inputDigest ?? latestB.digest : undefined;
-  const comparedOnInputs = (latestA?.inputDigest ?? latestB?.inputDigest) !== undefined;
+  const idA = latestA ? comparableIdentity(latestA) : undefined;
+  const idB = latestB ? comparableIdentity(latestB) : undefined;
+  const comparedOnInputs = (latestA !== undefined && idA !== latestA.digest) || (latestB !== undefined && idB !== latestB.digest);
   return {
     component,
     envA: envA.name,

package/src/live-endpoint.ts

@@ -145,3 +145,34 @@ export function zeroResourcesWarning(
   if (Object.keys(observed.unobserved).length > 0) return undefined;
   return `${lexicon}: 0 live resources for env "${environment}" (${declaredCount} declared) — check the endpoint/credentials`;
 }
+
+/**
+ * Run `run` with `environment`'s declared endpoint applied, as
+ * {@link applyLiveEndpoint} applies it to a `--live` read, and restored after
+ * (#4281). The component plan and apply paths (`components pr-plan`,
+ * `pr-apply`, `pr-record`, `fan-out`, `promote`, `rollback`, `redeploy` and
+ * `chant run --components`) run capabilities that honor the same ambient vars:
+ * azure's `arm-deploy` reads `AZURE_ENDPOINT_URL`, gcp's `gcp-apply`
+ * `GCP_ENDPOINT_URL`, aws's `cfn-deploy` `AWS_ENDPOINT_URL`. Without this, a
+ * plan for an environment declared against an emulator went to the real cloud
+ * unless the shell exported the var by hand.
+ *
+ * `lexicons` is called only when the environment declares an endpoint, so a
+ * caller that has to load its plugins pays for that only then.
+ */
+export async function withEnvironmentEndpoint<T>(
+  environments: EnvironmentDeclaration[] | undefined,
+  environment: string,
+  lexicons: () => Promise<readonly EndpointLexicon[]> | readonly EndpointLexicon[],
+  run: () => Promise<T>,
+  options: { warn?: (message: string) => void; env?: NodeJS.ProcessEnv } = {},
+): Promise<T> {
+  if (!environmentEndpoint(environments, environment)) return run();
+  const applied = applyLiveEndpoint(environments, environment, await lexicons(), options.env);
+  if (applied.notice) options.warn?.(applied.notice);
+  try {
+    return await run();
+  } finally {
+    applied.restore();
+  }
+}

package/src/workspace/ci-run.test.ts

@@ -24,6 +24,7 @@ import type { StepRecord } from "../op/local-executor";
 import { sshFromEd25519 } from "./trust/dsse";
 import { verifyOpRunStatement } from "./trust/op-run-statement";
 import { readRunLedger } from "../lifecycle/run-ledger";
+import { resolveRunId } from "../lifecycle/release-ledger";
 import { prLoopJobs, PR_LOOP_SETUP } from "../components/pr-pipeline";
 import { parseArgs } from "../cli/parse-args";
 import { ciSecretsFor, readCiSecrets } from "./ci-secrets";
@@ -837,6 +838,31 @@ describe("a generated forge job runs ci run --in-place (#4156)", () => {
     expect(index.runs[0]).toMatchObject({ job: "plan", runId: "forge-plan-1", signer: null, runOrigin: { forge: "github", jobId: "plan", attempt: 2 } });
   });
 
+  test("a release record written in a runner job names the run the run index lists, and a forge job's never does (#4275)", async () => {
+    const { app, base } = workspace();
+    const reports = scratchDir("chant-ci-run-index-");
+    const output = join(scratchDir("chant-ci-run-out-"), "pr");
+    // The host's forge run id, even passed on by name, does not reach a runner job's steps.
+    const r = await ciRun({ image: JOB_IMAGE, cwd: app, job: "plan", env: "prod", forge: "forgejo", base, pr: 7, chant: fakeChant(), hostEnv: { ...HOST, ...FORGE }, passEnv: ["GITHUB_RUN_ID", "GITHUB_JOB"], push: false, output, loop: { reportUrl: `file://${reports}` } });
+    expect(r.status).toBe("ok");
+    const step = envFile(output, "pr-plan");
+    expect(step).not.toHaveProperty("GITHUB_RUN_ID");
+    const index = JSON.parse(readFileSync(join(reports, "runs", "index.json"), "utf-8")) as { runs: { runId: string; runOrigin: unknown }[] };
+    expect(index.runs[0]!.runId).toMatch(/^chant-\d+$/);
+    expect(resolveRunId(undefined, step)).toEqual({ runId: index.runs[0]!.runId, runOrigin: index.runs[0]!.runOrigin });
+    expect(index.runs[0]!.runOrigin).toEqual({ forge: "chant" });
+
+    // In place in a forge job, the runner's variables from the host are dropped, and the record names the forge's run.
+    const forge = await ciRun({ cwd: app, job: "plan", env: "prod", forge: "forgejo", base, pr: 7, chant: fakeChant(), hostEnv: { ...HOST, ...FORGE, CHANT_CI_RUN_ID: "chant-1", CHANT_CI_RUN_FORGE: "chant" }, inPlace: true, push: false, runId: "forge-plan-2" });
+    expect(forge.status).toBe("ok");
+    const inPlace = envFile(join(app, ".chant/pr"), "pr-plan");
+    expect(inPlace).not.toHaveProperty("CHANT_CI_RUN_ID");
+    expect(resolveRunId(undefined, inPlace).runOrigin).toMatchObject({ forge: "github", repo: "acme/estate" });
+    // And a forge's run id wins over the runner's variables wherever both appear.
+    expect(resolveRunId(undefined, { GITHUB_RUN_ID: "4242", CHANT_CI_RUN_ID: "chant-1", CHANT_CI_RUN_FORGE: "chant" }).runId).toBe("4242");
+    expect(resolveRunId(undefined, { CHANT_CI_RUN_ID: "chant-1" }).runOrigin).toEqual({ forge: "local" });
+  });
+
   test("a failed command's exit code is the job's, and --wave reaches pr-apply", async () => {
     const { app, base } = workspace();
     const r = await ciRun({ cwd: app, job: "apply", env: "prod", forge: "github", base, chant: fakeChant(), hostEnv: { ...HOST, ...FORGE, FAKE_EXIT: "3" }, inPlace: true, push: false, loop: { waveGate: "release" }, wave: 2 });

package/src/workspace/ci-run.ts

@@ -79,7 +79,7 @@ import { detectForge, ForgeEnvironmentError, forgeFromEnv, FORGE_KINDS, type Com
 import { PR_APPLY_GATE } from "../pr-loop";
 import type { CommandContext } from "../cli/registry";
 import { formatError, formatWarning } from "../cli/format";
-import { resolveCiJob, type RunOrigin } from "../lifecycle/release-ledger";
+import { CHANT_CI_RUN_FORGE_ENV, CHANT_CI_RUN_ID_ENV, FORGE_RUN_ENV, resolveCiJob, type RunOrigin } from "../lifecycle/release-ledger";
 import { fetchLifecycleStatus, pushLifecycleReport } from "../lifecycle/git";
 import { ACTIVITY_PROFILES } from "../op/activity-profiles";
 import type { ActivityFn, ActivityProfile } from "../op/activity-registry";
@@ -761,6 +761,23 @@ function ciRunSigner(req: CiRunRequest, at: { cwd: string; top: string; commit:
   }
 }
 
+/**
+ * The steps' environment (#4275). A job the chant runner ran gets its run's id
+ * and origin, so a release record written inside it names the run the run
+ * index lists, and none of the forge's run variables. Any other job, in place
+ * in a forge job or on this machine, never carries the runner's.
+ */
+export function ciRunStepEnv(jobEnv: Record<string, string>, origin: RunOrigin, runId: string): Record<string, string> {
+  const out = { ...jobEnv };
+  delete out[CHANT_CI_RUN_ID_ENV];
+  delete out[CHANT_CI_RUN_FORGE_ENV];
+  if (origin.forge !== "chant") return out;
+  for (const name of FORGE_RUN_ENV) delete out[name];
+  out[CHANT_CI_RUN_ID_ENV] = runId;
+  out[CHANT_CI_RUN_FORGE_ENV] = "chant";
+  return out;
+}
+
 /** Where the job runs: a fresh worktree of the commit, or with `inPlace` the checkout itself, which is left as it is. */
 function jobCheckout(top: string, commit: string, inPlace?: boolean): { dir: string; remove(): void } {
   return inPlace ? { dir: top, remove() {} } : freshCheckout(top, commit);
@@ -788,16 +805,16 @@ async function runCiJob(
   const checkout = jobCheckout(top, commit, req.inPlace);
   try {
     const jobDir = place.dir === "." ? checkout.dir : join(checkout.dir, place.dir);
+    const runId = req.runId ?? `chant-${Date.now()}`;
     const op = ciJobOp({
       job,
       env: req.env,
       cwd: jobDir,
-      jobEnv,
+      jobEnv: ciRunStepEnv(jobEnv, origin, runId),
       setup: req.inPlace ? [] : prLoopSetup(req.image ?? PR_LOOP_IMAGE),
       build: [...(req.beforeScript ?? []), ...(job.build ?? [])],
       ...(req.chant ? { chant: req.chant } : {}),
     });
-    const runId = req.runId ?? `chant-${Date.now()}`;
     const warnings: string[] = [...early];
     const resume = req.job === "apply" && req.resumeRecord ? { host: resolve(req.resumeRecord), job: join(jobDir, PR_APPLY_RECORD) } : undefined;
     if (resume && existsSync(resume.host)) {

package/src/workspace/status.schema.json

@@ -1149,6 +1149,7 @@
         "releaseDigest": { "type": ["string", "null"], "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The release this deploy was made from: the releaseDigest of _releases/<releaseDigest>.json. A promote with --release writes it, a run --components with --release writes it, and a rollback or redeploy copies it from the record it restores. Null for a deploy that named no release. With the item's environment it names the release target." },
         "releaseLabel": { "type": ["string", "null"], "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The label that release was cut with, from _releases/cuts.jsonl. Null when releaseDigest is null, when the release has no label, and when the cuts can't be read." },
         "flags": { "type": "array", "items": { "enum": ["legacy-digest"] } },
+        "digestKind": { "enum": ["plan", "deploy-input", "templates"], "description": "Added in contract 1 by #4274, written by chant 0.124.35 and newer. What digest names when it is not an artifact digest: plan, the plan digest a pr-apply of a component that published nothing applied under its approval; deploy-input, that component's deploy-input digest when nothing planned; templates, the digest of the templates a release records for the component (#4222). Absent for an artifact digest. Compare joins a plan or deploy-input record on gitSha." },
         "plan": {
           "type": ["object", "null"],
           "description": "The release plan digest names, read from _plans/<digest>.json on chant/lifecycle (ws-055, #2733): the work items and evidence this release shipped. Null when this checkout has no plan stored under that digest — most releases carry no plan, and a plan not yet fetched also reads null."

package/src/workspace/status.ts

@@ -38,7 +38,7 @@ import { formatError } from "../cli/format";
 import type { CommandContext } from "../cli/registry";
 import { GATES_DIR } from "../lifecycle/gate-ledger";
 import { readPathSha } from "../lifecycle/git";
-import { latestPerComponent, readReleaseLedger, type ReleaseRecord } from "../lifecycle/release-ledger";
+import { latestPerComponent, readReleaseLedger, type ReleaseDigestKind, type ReleaseRecord } from "../lifecycle/release-ledger";
 import { describeRevocation, revokedCommitsAt, revokedReleaseLookup, type ReleaseRevocation, type RevokedRelease } from "../lifecycle/release-revocation";
 import { readReleasePlan, type ReleasePlan } from "../lifecycle/plan-ledger";
 import { readDeployOutcomes, type DeployOutcome } from "../lifecycle/deploy-outcome";
@@ -138,6 +138,8 @@ export interface StatusRelease {
   releaseLabel: string | null;
   /** Read flags, such as `legacy-digest` (#2514). */
   flags: string[];
+  /** What `digest` names when it is not an artifact digest (#4274): `plan`, `deploy-input` or `templates`. Absent for an artifact digest. */
+  digestKind?: ReleaseDigestKind;
   /**
    * The release plan `digest` names, read from `_plans/<digest>.json` on
    * chant/lifecycle (ws-055, #2733) — the work items and evidence this
@@ -611,6 +613,7 @@ async function readEnvironment(
       releaseDigest: r.releaseDigest ?? null,
       releaseLabel: (r.releaseDigest !== undefined ? labels.get(r.releaseDigest) : undefined) ?? null,
       flags: [...(r.flags ?? [])],
+      ...(r.digestKind ? { digestKind: r.digestKind } : {}),
       plan: await readReleasePlan(r.digest, { cwd, prefix: planPrefix }),
       ...(await revokedItem(r, env, revokedOf, back)),
     })),
@@ -665,8 +668,9 @@ async function supersedeRevokedGates(gates: StatusGate[], revokedOf: RevokedOf):
   );
 }
 
-/** The digest two environments are compared on: the input side when there is one. */
-const compareKey = (r: StatusRelease): string => r.inputDigest ?? r.digest;
+/** The digest two environments are compared on: the input side when there is one, the commit for an apply (#4274). */
+const compareKey = (r: StatusRelease): string =>
+  r.digestKind === "plan" || r.digestKind === "deploy-input" ? `git:${r.gitSha}` : r.inputDigest ?? r.digest;
 
 export function compareEnvironments(a: StatusEnvironment, b: StatusEnvironment): StatusCompare {
   const left = new Map(a.releases.map((r) => [r.component, r]));