@intentius/chant 0.124.45 → 0.124.48

package/src/workspace/composites.test.ts

@@ -17,6 +17,7 @@ import { MEMBER_RUN_REASON_CODES } from "./compose-graph";
 import {
   COMPOSITES_CONTRACT_VERSION,
   COMPOSITES_ENVIRONMENT_REASON_CODES,
+  COMPOSITES_EXECUTOR_REASON_CODES,
   COMPOSITES_ERROR_CODES,
   COMPOSITES_OUTPUT_SCHEMA_ID,
   COMPOSITES_REASON_CODES,
@@ -30,6 +31,8 @@ import {
 import { GRAPH_ERROR_CODES } from "./graph-cli";
 import schema from "./composites.schema.json";
 
+const NO_EXECUTOR = { forge: null, workflow: null, reason: { code: "executor-none-declared", message: expect.any(String) } };
+
 afterAll(cleanScratch);
 
 const { expectValid } = contract(schema);
@@ -61,7 +64,7 @@ const componentIr = (components: { name: string; composites?: string[]; archetyp
 const local = (name: string) => ({ name: "local", lexicon: null, default: true, command: `chant run --components ${name}` });
 
 /** The default environment, named by nothing but chant itself. */
-const localEnv = (name: string) => ({ name: "local", default: true, source: "builtin", site: null, command: `chant run --components ${name}` });
+const localEnv = (name: string) => ({ name: "local", default: true, source: "builtin", site: null, executor: NO_EXECUTOR, command: `chant run --components ${name}` });
 
 /**
  * app declares three instances and exports ImageUri; delivery links to it and
@@ -117,6 +120,7 @@ describe("composites output schema", () => {
     expect(schema.$defs.member.properties.reason.oneOf[1].properties!.code.enum).toEqual([...MEMBER_RUN_REASON_CODES]);
     expect(schema.$defs.member.properties.runtimeReasons.items.properties.code.enum).toEqual([...COMPOSITES_RUNTIME_REASON_CODES]);
     expect(schema.$defs.member.properties.environmentReasons.items.properties.code.enum).toEqual([...COMPOSITES_ENVIRONMENT_REASON_CODES]);
+    expect(schema.$defs.environment.properties.executor.properties.reason.oneOf[1].properties!.code.enum).toEqual([...COMPOSITES_EXECUTOR_REASON_CODES]);
   });
 });
 
@@ -381,11 +385,11 @@ describe("the environments each component may deploy to (#2695)", () => {
     const g = result((await workspaceComposites({ cwd: declared() })).doc);
     expectValid(g);
     expect(g.components.find((c) => c.id === "jobs/queue-runner")!.environments).toEqual([
-      { name: "local", default: true, source: "builtin", site: null, command: "chant run --components queue-runner" },
-      { name: "staging", default: false, source: "config", site: null, command: "chant run --components queue-runner --env staging" },
-      { name: "prod", default: false, source: "config", site: null, command: "chant run --components queue-runner --env prod" },
+      { name: "local", default: true, source: "builtin", site: null, executor: NO_EXECUTOR, command: "chant run --components queue-runner" },
+      { name: "staging", default: false, source: "config", site: null, executor: NO_EXECUTOR, command: "chant run --components queue-runner --env staging" },
+      { name: "prod", default: false, source: "config", site: null, executor: NO_EXECUTOR, command: "chant run --components queue-runner --env prod" },
       // The pattern pr-* is no environment by itself, and it covers the ledger's pr-42.
-      { name: "pr-42", default: false, source: "ledger", site: null, command: "chant run --components queue-runner --env pr-42" },
+      { name: "pr-42", default: false, source: "ledger", site: null, executor: NO_EXECUTOR, command: "chant run --components queue-runner --env pr-42" },
     ]);
     const jobs = g.members.find((m) => m.name === "jobs")!;
     expect(jobs.environmentReasons).toEqual([{ code: "environments-ledger-undeclared", message: expect.stringContaining("retired") }]);
@@ -397,7 +401,7 @@ describe("the environments each component may deploy to (#2695)", () => {
     // delivery has no _members/delivery, so the flat staging ledger is its; its config declares nothing, so anything goes.
     expect(g.components.find((c) => c.id === "delivery/edge")!.environments).toEqual([
       localEnv("edge"),
-      { name: "staging", default: false, source: "ledger", site: null, command: "chant run --components edge --env staging" },
+      { name: "staging", default: false, source: "ledger", site: null, executor: NO_EXECUTOR, command: "chant run --components edge --env staging" },
     ]);
     expect(g.members.find((m) => m.name === "delivery")!.environmentReasons.map((r) => r.code)).toEqual(["environments-none-declared"]);
     expect(g.members.find((m) => m.name === "docs")!.environmentReasons).toEqual([]);
@@ -409,8 +413,8 @@ describe("the environments each component may deploy to (#2695)", () => {
     const g = result((await workspaceComposites({ cwd: root })).doc);
     expectValid(g);
     expect(g.components.find((c) => c.id === "jobs/queue-runner")!.environments).toEqual([
-      { name: "local", default: true, source: "config", site: null, command: "chant run --components queue-runner" },
-      { name: "prod", default: false, source: "config", site: null, command: "chant run --components queue-runner --env prod" },
+      { name: "local", default: true, source: "config", site: null, executor: NO_EXECUTOR, command: "chant run --components queue-runner" },
+      { name: "prod", default: false, source: "config", site: null, executor: NO_EXECUTOR, command: "chant run --components queue-runner --env prod" },
     ]);
     expect(g.members.find((m) => m.name === "jobs")!.environmentReasons).toEqual([]);
   });
@@ -445,4 +449,31 @@ describe("the environments each component may deploy to (#2695)", () => {
     expect(g.members.find((m) => m.name === "jobs")!.environmentReasons).toEqual([{ code: "environments-ledger-unreadable", message: "boom" }]);
     expect(g.components.find((c) => c.id === "jobs/queue-runner")!.environments.map((e) => e.name)).toEqual(["local", "prod"]);
   });
+
+  test("each environment names the forge workflow the config declares for it, a literal before a pattern (#4402)", async () => {
+    const root = declared();
+    writeFileSync(
+      join(root, "jobs", "chant.config.ts"),
+      'export default { environments: ["staging", { name: "prod", executor: { forge: "github", workflow: "deploy-prod.yml" } }, { name: "pr-*", executor: { forge: "forgejo", workflow: "preview.yml" } }] };\n',
+    );
+    const g = result((await workspaceComposites({ cwd: root })).doc);
+    expectValid(g);
+    const executors = Object.fromEntries(g.components.find((c) => c.id === "jobs/queue-runner")!.environments.map((e) => [e.name, e.executor]));
+    expect(executors).toEqual({
+      local: NO_EXECUTOR,
+      staging: NO_EXECUTOR,
+      prod: { forge: "github", workflow: "deploy-prod.yml", reason: null },
+      "pr-42": { forge: "forgejo", workflow: "preview.yml", reason: null },
+    });
+  });
+
+  test("a config that can't be read says no executor is known (#4402)", async () => {
+    const root = declared();
+    writeFileSync(join(root, "jobs", "chant.config.ts"), 'throw new Error("no config here");\nexport default {};\n');
+    const g = result((await workspaceComposites({ cwd: root })).doc);
+    expectValid(g);
+    for (const e of g.components.find((c) => c.id === "jobs/queue-runner")!.environments) {
+      expect(e.executor).toEqual({ forge: null, workflow: null, reason: { code: "executor-config-unreadable", message: expect.stringContaining(e.name) } });
+    }
+  });
 });

package/src/workspace/composites.ts

@@ -36,7 +36,8 @@
  * And each component lists the environments it may deploy to (#2695,
  * `environments.ts`): `local`, the environments its member's config declares,
  * and those with a release in the member's ledger on `chant/lifecycle`, with
- * the command line for each.
+ * the command line for each, and the forge workflow that deploys each one
+ * when the member's config names it (#4402).
  */
 
 import { formatError } from "../cli/format";
@@ -50,7 +51,7 @@ import { emitDocument, type UnitResult } from "./member-commands";
 import { readerVersion, WORKSPACE_ERROR_CODES, type ErrorLocation, type WorkspaceErrorCode } from "./declaration";
 import type { ReasonCode } from "./reason-codes";
 import type { ComponentEnvironmentDeclaration } from "../components/component";
-import { componentEnvironments, ENVIRONMENT_REASON_CODES, memberEnvironments, readLedgerEnvironments, type ComponentEnvironment, type EnvironmentReason, type LedgerEnvironmentReader, type MemberEnvironments } from "./environments";
+import { componentEnvironments, ENVIRONMENT_REASON_CODES, EXECUTOR_REASON_CODES, memberEnvironments, readLedgerEnvironments, type ComponentEnvironment, type EnvironmentReason, type LedgerEnvironmentReader, type MemberEnvironments } from "./environments";
 import { componentRuntimes, readRuntimesIn, RUNTIME_REASON_CODES, type ComponentRuntime, type MemberRuntimes, type PluginLoader, type RuntimeReason } from "./runtimes";
 
 /** `$id` of the JSON Schema for the document, shipped beside this file. */
@@ -83,6 +84,9 @@ export const COMPOSITES_RUNTIME_REASON_CODES = RUNTIME_REASON_CODES;
 /** Why a member's environments are only `local`, or leave out one its ledger has (#2695). Closed. */
 export const COMPOSITES_ENVIRONMENT_REASON_CODES = ENVIRONMENT_REASON_CODES;
 
+/** Why an environment row's executor names no forge workflow (#4402). Closed. */
+export const COMPOSITES_EXECUTOR_REASON_CODES = EXECUTOR_REASON_CODES;
+
 export interface CompositesMember {
   name: string;
   dir: string;

package/src/workspace/conformance/__writer_fixture__/work/work.schema.json

@@ -79,7 +79,7 @@
       "uniqueItems": true
     },
     "evidence": {
-      "description": "The proof of done: public links, or workspace files pinned by the hash of their bytes (chant workspace records pin <path>). May be empty while the work is open; a done item with none gets the warning work-done-unpinned. An entry that names a criterion from acceptance carries the verification it is and its result, and a manual verdict names who gave it in by (#2772).",
+      "description": "The proof of done: public links, workspace files pinned by the hash of their bytes (chant workspace records pin <path>), or ops results on the chant/lifecycle branch (#3171). May be empty while the work is open; a done item with none gets the warning work-done-unpinned. An entry that names a criterion from acceptance carries the verification it is and its result, and a manual verdict names who gave it in by (#2772).",
       "type": "array",
       "items": {
         "oneOf": [
@@ -88,6 +88,9 @@
           },
           {
             "$ref": "#/definitions/evidencePin"
+          },
+          {
+            "$ref": "#/definitions/evidenceOps"
           }
         ]
       }
@@ -305,6 +308,107 @@
         ]
       }
     },
+    "evidenceOps": {
+      "description": "An ops result on the chant/lifecycle branch (#3171): a run, a deploy, a gate answer or a release plan, named the way graph --intent's trace names a link. chant workspace work evidence and the workEvidence activity check it against the ledger before writing it, and a cited run's outcome agrees with result.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "title",
+        "ops"
+      ],
+      "properties": {
+        "title": {
+          "type": "string",
+          "minLength": 1
+        },
+        "ops": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "ledger",
+            "ref",
+            "field",
+            "value",
+            "sha256"
+          ],
+          "properties": {
+            "ledger": {
+              "description": "Which ledger: an Op run, a deploy record, a gate answer or a release plan.",
+              "enum": [
+                "run",
+                "deploy",
+                "gate",
+                "plan"
+              ]
+            },
+            "ref": {
+              "description": "The ledger file, as chant/lifecycle:<path>.",
+              "type": "string",
+              "pattern": "^chant/lifecycle:"
+            },
+            "field": {
+              "description": "The field of the record that picks it out of the file, such as id, runId, timestamp or digest.",
+              "type": "string",
+              "minLength": 1
+            },
+            "value": {
+              "description": "That field's value.",
+              "type": "string",
+              "minLength": 1
+            },
+            "sha256": {
+              "description": "Hex SHA-256 of the record as the ledger stores it: the line, or the plan file.",
+              "type": "string",
+              "pattern": "^[0-9a-f]{64}$"
+            },
+            "env": {
+              "description": "The environment, for a run or a deploy.",
+              "type": "string"
+            },
+            "outcome": {
+              "description": "The run's status, for a run.",
+              "enum": [
+                "ok",
+                "fail"
+              ]
+            }
+          }
+        },
+        "as_of": {
+          "description": "When the result was cited, as an ISO 8601 timestamp.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "criterion": {
+          "description": "The acceptance criterion this evidence is for, by id (#2772).",
+          "type": "string",
+          "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"
+        },
+        "verification": {
+          "$ref": "#/definitions/verification"
+        },
+        "result": {
+          "description": "Whether the evidence shows the criterion met.",
+          "enum": [
+            "pass",
+            "fail"
+          ]
+        },
+        "by": {
+          "description": "Who produced the evidence: the lease holder for a steward's, the person for a manual verdict.",
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "dependencies": {
+        "criterion": [
+          "verification",
+          "result"
+        ]
+      }
+    },
     "evidencePin": {
       "description": "A file in the workspace, pinned by the hash of its bytes. chant workspace records reports a file that changed or went missing since.",
       "type": "object",

package/src/workspace/conformance/conformance.e2e.test.ts

@@ -39,6 +39,8 @@ const JSON_FLAG: Record<ReadContractCommand, string[]> = {
   "graph --composites": ["--json"],
   runs: ["--json"],
   wip: ["--json"],
+  search: ["--json"],
+  "search --capabilities": ["--json"],
 };
 
 /** The smallest reader that conforms, with a hook to misbehave. */
@@ -65,6 +67,17 @@ describe("the generated conformance workspace (#2679)", () => {
     expect(report.skipped).toEqual([]);
   }, 300_000);
 
+  test("search answers over the chant member with workspace graph's ids, and lists the others (#4374)", async () => {
+    const docs: Record<string, unknown>[] = [];
+    const report = await runWorkspaceReaderConformance(reader((doc) => (docs.push(doc), doc)), { workspaceDir: ws.dir, commands: ["search"] });
+    expect(report.problems).toEqual([]);
+    const doc = docs[0] as { at: null; matches: { id: string; member: string }[]; members: { name: string; status: string; alone?: boolean }[] };
+    expect(doc.at).toBeNull();
+    expect(doc.matches.length).toBeGreaterThan(0);
+    for (const m of doc.matches) expect(m.id.startsWith(`${m.member}/`), m.id).toBe(true);
+    expect(doc.members.find((m) => m.name === "delivery")).toMatchObject({ status: "searched", alone: true });
+  }, 300_000);
+
   test("graph --composites joins the fixture's composite to its component", async () => {
     const docs: Record<string, unknown>[] = [];
     await runWorkspaceReaderConformance(reader((doc) => (docs.push(doc), doc)), { workspaceDir: ws.dir, commands: ["graph --composites"] });
@@ -120,7 +133,7 @@ describe("commands (#2679)", () => {
     expect(report.problems).toEqual([]);
     expect(read).toEqual(["ls", "status", "graph --composites"]);
     expect(report.checked).toEqual(["ls", "status", "graph --composites"]);
-    expect(report.skipped).toEqual(["graph", "check", "records", "records --uncommitted", "graph --intent", "runs", "wip"]);
+    expect(report.skipped).toEqual(["graph", "check", "records", "records --uncommitted", "graph --intent", "runs", "wip", "search", "search --capabilities"]);
   }, 300_000);
 
   test("a name that is not a contract command, or an empty list, is refused", () => {

package/src/workspace/conformance/index.ts

@@ -56,7 +56,7 @@ import { isDeepStrictEqual } from "node:util";
 import { READ_CONTRACT_VERSION } from "../reason-codes";
 
 /** The read-contract commands, as a reader names them. */
-export const READ_CONTRACT_COMMANDS = ["ls", "graph", "check", "status", "records", "records --uncommitted", "graph --intent", "graph --composites", "runs", "wip"] as const;
+export const READ_CONTRACT_COMMANDS = ["ls", "graph", "check", "status", "records", "records --uncommitted", "graph --intent", "graph --composites", "runs", "wip", "search", "search --capabilities"] as const;
 export type ReadContractCommand = (typeof READ_CONTRACT_COMMANDS)[number];
 
 /**
@@ -75,6 +75,10 @@ export const READ_CONTRACT_SCHEMAS: Record<ReadContractCommand, string> = {
   "graph --composites": "composites.schema.json",
   runs: "runs.schema.json",
   wip: "wip.schema.json",
+  // `workspace search` (#4374). Plain `chant search --json` prints the same document for one project.
+  search: "search.schema.json",
+  // The capability catalog (#4375), from the workspace's chant.
+  "search --capabilities": "capabilities.schema.json",
 };
 
 /** The flags that ask each command for its JSON document. A reader adds one of these and nothing else. */
@@ -89,6 +93,8 @@ export const READ_CONTRACT_JSON_FLAGS: Record<ReadContractCommand, readonly (rea
   "graph --composites": [[], ["--json"]],
   runs: [["--json"]],
   wip: [["--json"]],
+  search: [["--json"]],
+  "search --capabilities": [["--json"]],
 };
 
 /** The arguments the suite passes each read, on the reference workspace or the generated one. */
@@ -103,6 +109,9 @@ export const REFERENCE_READS: Record<ReadContractCommand, string[]> = {
   "graph --composites": [],
   runs: [],
   wip: [],
+  // A bare word: on either workspace it searches the chant member, delivery, and lists the others.
+  search: ["app"],
+  "search --capabilities": [],
 };
 
 /** One chant run: the arguments after `chant`, what it was given on stdin, and what it printed. */
@@ -344,6 +353,8 @@ export const MCP_READ_TOOLS: Partial<Record<ReadContractCommand, string>> = {
   "graph --intent": "workspace-graph",
   "graph --composites": "workspace-graph",
   runs: "workspace-runs",
+  search: "workspace-search",
+  "search --capabilities": "capabilities",
 };
 
 /**
@@ -359,9 +370,14 @@ export function mcpToolCall(argv: readonly string[]): { name: string; arguments:
   const args: Record<string, unknown> = {};
   const positional: string[] = [];
   const kinds: string[] = [];
+  const members: string[] = [];
   for (let i = 0; i < rest.length; i++) {
     const a = rest[i];
     const value = (): string | undefined => rest[++i];
+    if (a === "--") {
+      positional.push(...rest.slice(i + 1));
+      break;
+    }
     if (a === "--json") continue;
     if (a === "--format" && rest[i + 1] === "json") {
       i++;
@@ -381,7 +397,14 @@ export function mcpToolCall(argv: readonly string[]): { name: string; arguments:
     else if (a === "--by") args.by = value();
     else if (a === "--uncommitted") args.uncommitted = true;
     else if (a === "--composites") args.composites = true;
-    else if (a.startsWith("-")) return undefined;
+    else if (verb === "search" && a === "--member") members.push(value() ?? "");
+    else if (verb === "search" && a === "--env") args.env = value();
+    else if (verb === "search" && a === "--snapshot") args.snapshot = value();
+    else if (verb === "search" && a === "--count-by") args.countBy = value();
+    else if (verb === "search" && a === "--show") args.show = value();
+    else if (verb === "search" && a === "--explain") args.explain = true;
+    else if (verb === "search" && a === "--capabilities") args.capabilities = true;
+    else if (/^-[A-Za-z-]/.test(a)) return undefined;
     else positional.push(a);
   }
   switch (verb) {
@@ -397,6 +420,12 @@ export function mcpToolCall(argv: readonly string[]): { name: string; arguments:
       return positional.length === 0 ? { name: "workspace-graph", arguments: { ...args, ...(kinds.length ? { kind: kinds } : {}) } } : undefined;
     case "runs":
       return positional.length === 0 && kinds.length === 0 ? { name: "workspace-runs", arguments: args } : undefined;
+    case "search":
+      // The catalog (#4375) is its own tool, and takes nothing.
+      if (args.capabilities) return positional.length === 0 && Object.keys(args).length === 1 && kinds.length === 0 && members.length === 0 ? { name: "capabilities", arguments: {} } : undefined;
+      return positional.length <= 1 && kinds.length === 0
+        ? { name: "workspace-search", arguments: { ...args, query: positional[0] ?? "", ...(members.length ? { member: members } : {}) } }
+        : undefined;
     default:
       return undefined;
   }

package/src/workspace/cross-root-lint.test.ts

@@ -0,0 +1,90 @@
+/**
+ * The disagreement lint (#2549, #2524 D6) in #1939's cross-build-root mode:
+ * LNK001 over the composed graph's links, and the cross-root checks the
+ * members' lexicons ship.
+ */
+import { describe, test, expect } from "vitest";
+import { createCrossRootContext, type CrossRootCheck } from "../lint/post-synth";
+import type { WorkspaceGraph } from "./compose-graph";
+import { crossRootLinks, crossRootLint, lnk001 } from "./cross-root-lint";
+import { crossRootInputs } from "./workspace-run";
+
+function member(name: string, status: "composed" | "skipped" = "composed") {
+  return { name, dir: name, kind: "chant", status, reason: null, chant: null, irVersion: 1, live: false };
+}
+
+const declared = (consumer: string, producer: string, output: string) => ({ consumer, producer, output, kind: "output", origin: "declared", resolves: "source", status: "resolved", label: "exact", input: null, reason: null });
+const inferred = (consumer: string, producer: string, output: string, input: string) => ({ consumer, producer, output, kind: "output", origin: "inferred:joinKey", resolves: "source", status: "resolved", label: "exact", input, reason: null });
+
+function graph(links: unknown[]): WorkspaceGraph {
+  return {
+    version: 1,
+    workspace: { name: "acme", root: "." },
+    members: [member("network"), member("legacy-net"), member("api")],
+    nodes: [
+      { id: "network/vpc", kind: "AWS::EC2::VPC", lexicon: "aws", member: "network", attrs: {} },
+      { id: "api/fn", kind: "AWS::Lambda::Function", lexicon: "aws", member: "api", attrs: {} },
+      { id: "api/svc", kind: "Deployment", lexicon: "k8s", member: "api", attrs: {} },
+    ],
+    edges: [],
+    groups: { byMember: {} },
+    exports: [],
+    imports: [],
+    links,
+    collectors: [],
+    records: [],
+  } as unknown as WorkspaceGraph;
+}
+
+describe("LNK001: a declared link and the graph's join disagree", () => {
+  test("flags a declaration that names another producer than the one the consumer's graph joins", () => {
+    const g = graph([declared("api", "legacy-net", "vpcId"), inferred("api", "network", "VpcId", "vpcId")]);
+    const ctx = createCrossRootContext(crossRootInputs(g), { links: crossRootLinks(g.links) });
+    const found = lnk001.check(ctx);
+    expect(found).toHaveLength(1);
+    expect(found[0]).toMatchObject({ checkId: "LNK001", severity: "warning", root: "api", entity: "vpcId" });
+    expect(found[0]!.message).toContain("declares a link to legacy-net's output vpcId");
+    expect(found[0]!.message).toContain("network's output VpcId");
+  });
+
+  test("agrees when the declaration names the producer the graph joins, or a handle the join doesn't touch", () => {
+    for (const links of [
+      [declared("api", "network", "subnetIds"), inferred("api", "network", "VpcId", "vpcId")],
+      [declared("api", "legacy-net", "dnsZone"), inferred("api", "network", "VpcId", "vpcId")],
+    ]) {
+      const g = graph(links);
+      expect(lnk001.check(createCrossRootContext(crossRootInputs(g), { links: crossRootLinks(g.links) }))).toEqual([]);
+    }
+  });
+
+  test("says nothing about a consumer whose graph was not read, or with no links passed", () => {
+    const g = graph([declared("api", "legacy-net", "vpcId"), inferred("api", "network", "VpcId", "vpcId")]);
+    g.members = g.members.map((m) => (m.name === "api" ? { ...m, status: "skipped" as const } : m));
+    expect(lnk001.check(createCrossRootContext(crossRootInputs(g), { links: crossRootLinks(g.links) }))).toEqual([]);
+    expect(lnk001.check(createCrossRootContext(crossRootInputs(graph([]))))).toEqual([]);
+  });
+});
+
+describe("crossRootLint", () => {
+  test("runs LNK001 and the cross-root checks of each lexicon the members' graphs name, and reports a lexicon it can't load", async () => {
+    const asked: string[] = [];
+    const awsCheck: CrossRootCheck = {
+      id: "AWSX01",
+      description: "sees every root",
+      scope: "cross-root",
+      check: (ctx) => [{ checkId: "AWSX01", severity: "info", message: `${ctx.roots.length} roots, ${ctx.links?.length ?? 0} links` }],
+    };
+    const result = await crossRootLint(graph([declared("api", "legacy-net", "vpcId"), inferred("api", "network", "VpcId", "vpcId")]), {
+      load: async (lexicon) => {
+        asked.push(lexicon);
+        if (lexicon === "k8s") throw new Error("Cannot find package '@intentius/chant-lexicon-k8s'");
+        return [awsCheck, { id: "PLAIN", description: "per-build, never run here", check: () => [] }];
+      },
+    });
+    expect(asked).toEqual(["aws", "k8s"]);
+    expect(result.checks).toEqual(["LNK001", "AWSX01"]);
+    expect(result.findings.map((f) => f.checkId)).toEqual(["LNK001", "AWSX01"]);
+    expect(result.findings[1]!.message).toBe("3 roots, 2 links");
+    expect(result.unloaded).toEqual([{ lexicon: "k8s", reason: "Cannot find package '@intentius/chant-lexicon-k8s'" }]);
+  });
+});

package/src/workspace/cross-root-lint.ts

@@ -0,0 +1,126 @@
+/**
+ * The disagreement lint (#2549, #2524 D6): `chant workspace lint --cross-root`.
+ *
+ * A member link is written down once, on the consumer. The members' graphs
+ * can surface the same relation on their own: a consumer's parameter that
+ * joins another member's output by name, or any relation a lexicon puts in
+ * its IR. The lint reports where the two disagree.
+ *
+ * It uses #1939's cross-build-root mode. Each composed member is one build
+ * root, read under the member's own toolchain as `chant workspace graph`
+ * reads it (`crossRootInputs` in `./workspace-run.ts`), and the composed
+ * graph's link table goes to every check as `ctx.links`. The checks are:
+ *
+ * - LNK001, core's own: the consumer declares a link to one member's output
+ *   while its graph joins a parameter of the same name to another member's.
+ * - every cross-root check a lexicon ships through `crossRootChecks()`, for
+ *   the lexicons the members' graphs name. A lexicon applies its own rule
+ *   once it surfaces the relation in its IR. One that can't be loaded here
+ *   is reported and skipped.
+ *
+ * Nothing runs unless `--cross-root` asks, so a plain `workspace lint`, and
+ * level 0, pay nothing for it.
+ */
+
+import { joinKey } from "../join-key";
+import type { CrossRootCheck, CrossRootLink, PostSynthCheck, PostSynthDiagnostic } from "../lint/post-synth";
+import { runCrossRootChecks } from "../lint/post-synth";
+import type { WorkspaceGraph } from "./compose-graph";
+import { crossRootInputs } from "./workspace-run";
+
+export const LNK001_ID = "LNK001";
+
+/** The links of the composed graph, as a cross-root check reads them. Ambiguous rows and record links are left out. */
+export function crossRootLinks(links: WorkspaceGraph["links"]): CrossRootLink[] {
+  const out: CrossRootLink[] = [];
+  for (const row of links) {
+    const r = row as { consumer?: unknown; producer?: unknown; output?: unknown; origin?: unknown; input?: unknown; status?: unknown; kind?: unknown };
+    if (typeof r.consumer !== "string" || typeof r.producer !== "string" || typeof r.output !== "string" || typeof r.origin !== "string") continue;
+    out.push({
+      consumer: r.consumer,
+      producer: r.producer,
+      output: r.output,
+      origin: r.origin,
+      ...(typeof r.input === "string" || r.input === null ? { input: r.input as string | null } : {}),
+      ...(typeof r.status === "string" ? { status: r.status } : {}),
+    });
+  }
+  return out;
+}
+
+/**
+ * LNK001: a declared link and a join the graph surfaces name different
+ * producers for the same handle. The consumer must be one of the run's roots,
+ * so its graph was read.
+ */
+export const lnk001: CrossRootCheck = {
+  id: LNK001_ID,
+  description: "A declared member link and the join the members' graphs surface name different producers for the same output",
+  scope: "cross-root",
+  check(ctx) {
+    const links = ctx.links ?? [];
+    const findings: PostSynthDiagnostic[] = [];
+    const declared = links.filter((l) => l.origin === "declared" && l.status !== "invalid");
+    for (const inferred of links) {
+      if (!inferred.origin.startsWith("inferred:") || inferred.status !== "resolved") continue;
+      if (!ctx.root(inferred.consumer)) continue;
+      const keys = new Set([joinKey(inferred.output), ...(inferred.input ? [joinKey(inferred.input)] : [])]);
+      for (const d of declared) {
+        if (d.consumer !== inferred.consumer || d.producer === inferred.producer) continue;
+        if (!keys.has(joinKey(d.output))) continue;
+        findings.push({
+          checkId: LNK001_ID,
+          severity: "warning",
+          message:
+            `${d.consumer} declares a link to ${d.producer}'s output ${d.output}, but its graph joins ` +
+            `${inferred.input ? `parameter ${inferred.input}` : "a parameter"} to ${inferred.producer}'s output ${inferred.output}. ` +
+            `Point the link at the member the graph reads from, or rename the parameter so it joins the declared output.`,
+          root: d.consumer,
+          entity: inferred.input ?? undefined,
+        });
+      }
+    }
+    return findings;
+  },
+};
+
+/** What a cross-root lint run found. */
+export interface CrossRootLintResult {
+  findings: PostSynthDiagnostic[];
+  /** The checks that ran, by id. */
+  checks: string[];
+  /** Lexicons whose cross-root checks could not be loaded here, and why. */
+  unloaded: { lexicon: string; reason: string }[];
+}
+
+/** Loads a lexicon's cross-root checks; the plugin loader by default. */
+export type CrossRootCheckLoader = (lexicon: string) => Promise<ReadonlyArray<CrossRootCheck | PostSynthCheck>>;
+
+async function pluginChecks(lexicon: string): Promise<ReadonlyArray<CrossRootCheck | PostSynthCheck>> {
+  const { loadPlugin } = await import("../cli/plugins");
+  const plugin = await loadPlugin(lexicon);
+  return plugin.crossRootChecks?.() ?? [];
+}
+
+/**
+ * Run the disagreement lint over a composed graph: one root per composed
+ * member, LNK001, and the cross-root checks of every lexicon the roots name.
+ */
+export async function crossRootLint(graph: WorkspaceGraph, opts: { env?: string; load?: CrossRootCheckLoader } = {}): Promise<CrossRootLintResult> {
+  const roots = crossRootInputs(graph, opts.env);
+  const lexicons = [...new Set(roots.flatMap((r) => [...r.buildResult.entities.values()].map((e) => e.lexicon)))]
+    .filter((l) => typeof l === "string" && l !== "chant")
+    .sort();
+  const checks: Array<CrossRootCheck | PostSynthCheck> = [lnk001];
+  const unloaded: CrossRootLintResult["unloaded"] = [];
+  for (const lexicon of lexicons) {
+    try {
+      checks.push(...(await (opts.load ?? pluginChecks)(lexicon)));
+    } catch (err) {
+      unloaded.push({ lexicon, reason: err instanceof Error ? err.message.split("\n")[0]! : String(err) });
+    }
+  }
+  const findings = runCrossRootChecks(checks, roots, { ...(opts.env ? { env: opts.env } : {}), links: crossRootLinks(graph.links) });
+  const ran = checks.filter((c) => (c as CrossRootCheck).scope === "cross-root").map((c) => c.id);
+  return { findings, checks: ran, unloaded };
+}

package/src/workspace/dbt-kind.test.ts

@@ -75,8 +75,9 @@ describe("the dbt kind in the sql lexicon's kinds file (#3932)", () => {
   test("validates, probes dbt_project.yml and names the dbt-project reader", () => {
     const { kinds, problems } = parseKindData(SQL_KINDS, "@intentius/chant-lexicon-sql");
     expect(problems).toEqual([]);
-    expect(kinds.map((k) => [k.name, k.reader, k.probe])).toEqual([["dbt", "dbt-project", { anyFile: ["dbt_project.yml"] }]]);
-    expect(Object.keys(kinds[0].fields ?? {})).toEqual(["sqlMember", "dialect"]);
+    expect(kinds.filter((k) => k.name === "dbt").map((k) => [k.name, k.reader, k.probe])).toEqual([["dbt", "dbt-project", { anyFile: ["dbt_project.yml"] }]]);
+    expect(kinds.map((k) => [k.name, k.reader])).toEqual([["dbt", "dbt-project"], ["goose", "goose-dir"], ["golang-migrate", "golang-migrate-dir"], ["clickhouse-migrations", "clickhouse-migrations-dir"], ["flyway", "flyway-dir"]]);
+    expect(Object.keys(kinds[0].fields ?? {})).toEqual(["sqlMember", "dialect", "modelSchema"]);
   });
 
   test("a reader this chant doesn't have keeps the kind without one, and says so", () => {