@intentius/chant 0.44.13 → 0.45.0

package/src/cli/commands/__fixtures__/init-lexicon-output/src/codegen/generate.ts

@@ -62,7 +62,8 @@ export async function generate(options?: { verbose?: boolean; force?: boolean })
  * Write generated files to the package directory.
  */
 export function writeGeneratedFiles(result: GenerateResult, pkgDir?: string): void {
-  const dir = pkgDir ?? dirname(dirname(fileURLToPath(import.meta.url)));
+  // This file lives in src/codegen/, so the package root is three levels up.
+  const dir = pkgDir ?? dirname(dirname(dirname(fileURLToPath(import.meta.url))));
   writeGeneratedArtifacts({
     baseDir: dir,
     files: {

package/src/cli/commands/__snapshots__/init-lexicon.test.ts.snap

@@ -65,7 +65,8 @@ export async function generate(options?: { verbose?: boolean; force?: boolean })
  * Write generated files to the package directory.
  */
 export function writeGeneratedFiles(result: GenerateResult, pkgDir?: string): void {
-  const dir = pkgDir ?? dirname(dirname(fileURLToPath(import.meta.url)));
+  // This file lives in src/codegen/, so the package root is three levels up.
+  const dir = pkgDir ?? dirname(dirname(dirname(fileURLToPath(import.meta.url))));
   writeGeneratedArtifacts({
     baseDir: dir,
     files: {

package/src/cli/commands/audit.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect } from "vitest";
 import { fileURLToPath } from "url";
-import { auditCommand, tokenForHost, coverageNotes } from "./audit";
+import { auditCommand, tokenForHost, coverageNotes, installLine, NO_LEXICONS_EXIT_CODE } from "./audit";
 import { discoverByDetection, loadAuditPlugins } from "../../audit/discover";
 import { MissingLexiconError, type AuditInput, type AuditLexicon } from "../../audit/core";
 
@@ -190,6 +190,88 @@ describe("auditCommand", () => {
     expect(result.error).toMatch(/npm i @intentius\/chant-lexicon-github/);
   });
 
+  describe("lexicon coverage (#1623)", () => {
+    const MIXED = fileURLToPath(new URL("./__fixtures__/audit-coverage", import.meta.url));
+
+    test("zero lexicons: says it had nothing to look with, names each file's lexicon, prints the npx line, exits 2", async () => {
+      const result = await auditCommand({ path: MIXED, plugins: [] });
+      expect(result.success).toBe(true);
+      expect(result.status).toBe("no-lexicons");
+      expect(result.exitCode).toBe(NO_LEXICONS_EXIT_CODE);
+      expect(result.stream).toBe("stderr");
+      expect(result.findings).toEqual([]);
+      expect(result.output).toContain("nothing to look with");
+      expect(result.output).not.toMatch(/Audited \d+ files/);
+      expect(result.output).toContain(".github/workflows/ci.yml  ->  github");
+      expect(result.output).toContain("k8s/deploy.yaml  ->  k8s");
+      expect(result.output).toContain("infra/stack.json  ->  aws");
+      expect(result.output).toContain("Dockerfile  ->  docker");
+      expect(result.output).toContain("infra/main.tf  ->  terraform (not audited; see chant carve)");
+      // The install line names only the lexicons the files wanted, never terraform.
+      expect(result.output).toContain(
+        `npx -p @intentius/chant -p @intentius/chant-lexicon-github -p @intentius/chant-lexicon-docker -p @intentius/chant-lexicon-aws -p @intentius/chant-lexicon-k8s chant audit ${MIXED}`,
+      );
+      expect(result.output).not.toContain("chant-lexicon-terraform");
+    });
+
+    test("zero lexicons with --json: status no-lexicons plus the unclaimed list and install line", async () => {
+      const result = await auditCommand({ path: MIXED, plugins: [], format: "json" });
+      expect(result.exitCode).toBe(NO_LEXICONS_EXIT_CODE);
+      expect(result.stream).toBe("stdout");
+      const json = JSON.parse(result.output);
+      expect(json.status).toBe("no-lexicons");
+      expect(json.findings).toEqual([]);
+      expect(json.missingLexicons).toEqual(["github", "docker", "aws", "k8s"]);
+      expect(json.unclaimed).toContainEqual({ path: "k8s/deploy.yaml", lexicon: "k8s" });
+      expect(json.unclaimed).toContainEqual({ path: "infra/main.tf", lexicon: "terraform" });
+      expect(json.install).toMatch(/^npx -p @intentius\/chant /);
+    });
+
+    test("zero lexicons on an empty dir still refuses to report clean", async () => {
+      const tmp = join(tmpdir(), `chant-audit-nolex-${process.pid}`);
+      const { mkdirSync } = await import("fs");
+      mkdirSync(tmp, { recursive: true });
+      const result = await auditCommand({ path: tmp, plugins: [] });
+      expect(result.status).toBe("no-lexicons");
+      expect(result.exitCode).toBe(NO_LEXICONS_EXIT_CODE);
+      expect(result.output).toContain("nothing to look with");
+      rmSync(tmp, { recursive: true, force: true });
+    });
+
+    test("partial: github loaded, k8s/aws/docker absent -> audit runs and a one-line hint names the gap", async () => {
+      const all = await loadAuditPlugins();
+      const github = all.filter((p) => p.name === "github");
+      expect(github).toHaveLength(1);
+      const result = await auditCommand({ path: MIXED, plugins: github });
+      expect(result.status).toBe("ok");
+      expect(result.exitCode).toBe(0);
+      expect(result.scanned).toEqual([".github/workflows/ci.yml"]);
+      expect(result.output).toMatch(/^Note: 3 files look like docker\/aws\/k8s but those lexicons are not installed, so they were skipped \(npm i @intentius\/chant-lexicon-docker @intentius\/chant-lexicon-aws @intentius\/chant-lexicon-k8s\)\./);
+      expect(result.output).toContain("1 Terraform file skipped; the audit does not read HCL (see chant carve).");
+      expect(result.unclaimed).toContainEqual({ path: "k8s/deploy.yaml", lexicon: "k8s" });
+    });
+
+    test("partial with --json: status ok and the unclaimed files ride along", async () => {
+      const all = await loadAuditPlugins();
+      const result = await auditCommand({ path: MIXED, plugins: all.filter((p) => p.name === "github"), format: "json" });
+      const json = JSON.parse(result.output);
+      expect(json.status).toBe("ok");
+      expect(json.unclaimed.map((u: { lexicon: string }) => u.lexicon).sort()).toEqual(["aws", "docker", "k8s", "terraform"]);
+    });
+
+    test("all lexicons loaded: no coverage note, no unclaimed (terraform aside)", async () => {
+      const result = await auditCommand({ path: MIXED, plugins: await loadAuditPlugins() });
+      expect(result.status).toBe("ok");
+      expect(result.unclaimed).toEqual([{ path: "infra/main.tf", lexicon: "terraform" }]);
+      expect(result.output).not.toContain("not installed");
+      expect(result.scanned.sort()).toEqual([".github/workflows/ci.yml", "Dockerfile", "infra/stack.json", "k8s/deploy.yaml"]);
+    });
+
+    test("installLine puts every lexicon on the same npx -p path", () => {
+      expect(installLine(["github", "gitlab"], ".")).toBe("npx -p @intentius/chant -p @intentius/chant-lexicon-github -p @intentius/chant-lexicon-gitlab chant audit .");
+    });
+  });
+
   test("a path with no CI files succeeds with a clear message", async () => {
     const tmp = join(tmpdir(), `chant-audit-empty-${process.pid}`);
     const { mkdirSync } = await import("fs");

package/src/cli/commands/audit.ts

@@ -7,11 +7,11 @@
 
 import { existsSync, statSync, writeFileSync } from "fs";
 import { auditFiles, type AuditInput, type AuditFinding, type ChecksProvider } from "../../audit/core";
-import { discoverByDetection, classifyFiles, loadAuditPlugins, AUDIT_LEXICONS } from "../../audit/discover";
+import { AUDIT_LEXICONS, classifyFiles, collectCandidates, loadAuditPlugins, unclaimedFiles, type DetectPlugin, type RepoFile, type UnclaimedFile } from "../../audit/discover";
 import { RULE_CATALOG, resolveAuditCatalog, type RuleMeta } from "../../audit/catalog";
 import { renderMarkdown } from "../../audit/report";
 import { renderHtml, type ReportTheme } from "../../audit/report-html";
-import { buildReportJson, type AuditSnapshot } from "../../audit/report-model";
+import { buildReportJson, REPORT_SCHEMA_VERSION, type AuditSnapshot } from "../../audit/report-model";
 import { fetchRepoFiles, resolveActionSha, resolveImageDigest, resolveRepoCommit, parseRepoUrl, FetchError } from "../../audit/fetch";
 import { extractUnpinnedActions, extractUnpinnedImages } from "../../audit/proof";
 import type { ProveOptions } from "../../audit/proof";
@@ -45,6 +45,8 @@ export interface AuditCommandOptions {
   now?: string;
   /** Tool version recorded in the HTML snapshot. */
   toolVersion?: string;
+  /** Injectable detection plugins (testing); defaults to every installed audit lexicon. */
+  plugins?: DetectPlugin[];
 }
 
 export interface AuditCommandResult {
@@ -58,6 +60,94 @@ export interface AuditCommandResult {
   error?: string;
   /** Set when the report was written to a file (via `output`). */
   wroteTo?: string;
+  /**
+   * `"no-lexicons"` when not a single audit lexicon resolved, so nothing was
+   * inspected (#1623). `output` then carries the diagnostic, not a report.
+   */
+  status?: "ok" | "no-lexicons";
+  /** Candidate files that looked like they wanted a lexicon that is not installed. */
+  unclaimed?: UnclaimedFile[];
+  /** Where `output` belongs; diagnostics go to stderr, reports to stdout (default). */
+  stream?: "stdout" | "stderr";
+}
+
+/** Exit code when the audit had no lexicons to look with. Distinct from 1 (findings / failure). */
+export const NO_LEXICONS_EXIT_CODE = 2;
+
+/** The npm package that provides an audit lexicon's detection and checks. */
+function lexiconPackage(name: string): string {
+  return `@intentius/chant-lexicon-${name}`;
+}
+
+/** Missing audit lexicons the unclaimed files pointed at, in first-seen order. `terraform` is not installable. */
+function wantedLexicons(unclaimed: UnclaimedFile[]): string[] {
+  return [...new Set(unclaimed.map((u) => u.lexicon))].filter((l) => l !== "terraform");
+}
+
+/**
+ * The exact one-liner that gives a bare `npx @intentius/chant audit` the
+ * lexicons it needs. Every wanted lexicon is a `-p` package so npx puts all of
+ * them on the same resolution path.
+ */
+export function installLine(lexicons: string[], target: string): string {
+  const pkgs = ["@intentius/chant", ...lexicons.map(lexiconPackage)];
+  return `npx ${pkgs.map((p) => `-p ${p}`).join(" ")} chant audit ${target}`;
+}
+
+/** One-line coverage hint for the partial case: some lexicons loaded, others wanted by files on disk. */
+function missingLexiconHint(unclaimed: UnclaimedFile[]): string | undefined {
+  const wanted = wantedLexicons(unclaimed);
+  const tf = unclaimed.filter((u) => u.lexicon === "terraform").length;
+  const parts: string[] = [];
+  if (wanted.length > 0) {
+    const n = unclaimed.length - tf;
+    parts.push(
+      `${n} file${n === 1 ? " looks" : "s look"} like ${wanted.join("/")} but ${wanted.length === 1 ? "that lexicon is" : "those lexicons are"} not installed, so ${n === 1 ? "it was" : "they were"} skipped` +
+        ` (npm i ${wanted.map(lexiconPackage).join(" ")}).`,
+    );
+  }
+  if (tf > 0) parts.push(`${tf} Terraform file${tf === 1 ? "" : "s"} skipped; the audit does not read HCL (see chant carve).`);
+  return parts.length > 0 ? parts.join(" ") : undefined;
+}
+
+/** Human-readable diagnostic for the zero-lexicon case. */
+function renderNoLexicons(target: string, unclaimed: UnclaimedFile[]): string {
+  const lines: string[] = [];
+  lines.push(`chant audit had nothing to look with: no audit lexicon is installed, so nothing under ${target} was inspected.`);
+  lines.push("This is not a clean result. Detection and checks live in the lexicon packages.");
+  const wanted = wantedLexicons(unclaimed);
+  if (unclaimed.length > 0) {
+    lines.push("", "Files that wanted a lexicon:");
+    for (const u of unclaimed) {
+      const note = u.lexicon === "terraform" ? "terraform (not audited; see chant carve)" : u.lexicon;
+      lines.push(`  ${u.path}  ->  ${note}`);
+    }
+  } else {
+    lines.push("", "No file under the target looked like CI, Kubernetes, Helm, Docker, CloudFormation, ARM, or Config Connector either.");
+  }
+  lines.push("", "Run it with the lexicons those files need:");
+  lines.push(`  ${installLine(wanted.length > 0 ? wanted : [...AUDIT_LEXICONS], target)}`);
+  return lines.join("\n");
+}
+
+/** Machine-readable form of the zero-lexicon diagnostic (`status: "no-lexicons"`). */
+function renderNoLexiconsJson(target: string, unclaimed: UnclaimedFile[]): string {
+  const wanted = wantedLexicons(unclaimed);
+  return JSON.stringify(
+    {
+      schemaVersion: REPORT_SCHEMA_VERSION,
+      tool: { name: "chant-audit" },
+      status: "no-lexicons",
+      target,
+      summary: { total: 0 },
+      findings: [],
+      unclaimed,
+      missingLexicons: wanted,
+      install: installLine(wanted.length > 0 ? wanted : [...AUDIT_LEXICONS], target),
+    },
+    null,
+    2,
+  );
 }
 
 /**
@@ -205,20 +295,21 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
 
   const isUrl = /^https?:\/\//.test(options.path);
 
-  let inputs: AuditInput[];
-  // Content-detected lexicons whose package isn't installed can't be detected
-  // (detection needs the plugin's `detectTemplate`), so a local audit would
-  // silently find nothing. Track the missing packages to turn that into a hint.
-  let missingHint = "";
+  // Detection lives in the lexicon plugins (each one's `detectTemplate`), so a
+  // lexicon that isn't installed can't claim its files. Every branch below
+  // therefore also computes which candidate files looked like they wanted an
+  // absent lexicon, so "nothing found" and "had nothing to look with" never
+  // render the same way (#1623).
+  const plugins = options.plugins ?? (await loadAuditPlugins());
+  let candidates: RepoFile[];
   if (isUrl) {
     try {
       // Fetch the whole repo's candidate files (all lexicons, not just CI) and
       // run them through the same classifier the local path uses (#420).
-      const files = await fetchRepoFiles(options.path, {
+      candidates = await fetchRepoFiles(options.path, {
         token: options.token ?? tokenForHost(options.path),
         fetchImpl: options.fetchImpl,
       });
-      inputs = classifyFiles(files, await loadAuditPlugins());
     } catch (err) {
       const msg = err instanceof FetchError ? err.message : err instanceof Error ? err.message : String(err);
       return { success: false, output: "", findings: [], scanned: [], exitCode: 1, error: msg };
@@ -227,25 +318,25 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     if (!existsSync(options.path)) {
       return { success: false, output: "", findings: [], scanned: [], exitCode: 1, error: `Path not found: ${options.path}` };
     }
-    // One walk, plugin-delegated detection. Each lexicon plugin's own
-    // `detectTemplate` classifies the files it recognizes; CI (path), Dockerfiles
-    // (name), and Helm charts (bundle) are handled by discoverByDetection's
-    // special-cases since content shape alone can't disambiguate them.
-    const plugins = await loadAuditPlugins();
-    const loaded = new Set(plugins.map((p) => p.name));
-    const missing = AUDIT_LEXICONS.filter((n) => !loaded.has(n));
-    if (missing.length > 0) {
-      missingHint =
-        ` Some lexicon packages are not installed, so files of those types were not detected: ${missing.join(", ")}.` +
-        ` Install what you need, e.g. npm i ${missing.map((n) => `@intentius/chant-lexicon-${n}`).join(" ")}`;
-    }
-    inputs = discoverByDetection(options.path, plugins);
+    // One walk, plugin-delegated detection. CI (path), Dockerfiles (name), and
+    // Helm charts (bundle) are special-cased by the classifier since content
+    // shape alone can't disambiguate them.
+    candidates = collectCandidates(options.path);
   }
-
+  const inputs = classifyFiles(candidates, plugins);
+  const unclaimed = unclaimedFiles(candidates, inputs, plugins);
   const scanned = inputs.map((i) => i.path);
 
+  if (plugins.length === 0) {
+    const output = format === "json" ? renderNoLexiconsJson(options.path, unclaimed) : renderNoLexicons(options.path, unclaimed);
+    return { success: true, status: "no-lexicons", output, findings: [], scanned: [], unclaimed, exitCode: NO_LEXICONS_EXIT_CODE, stream: format === "json" ? "stdout" : "stderr" };
+  }
+
+  const missingLexiconNote = missingLexiconHint(unclaimed);
+
   if (inputs.length === 0) {
-    return { success: true, output: `No auditable files found under ${options.path}.${missingHint}`, findings: [], scanned: [], exitCode: 0 };
+    const output = `No auditable files found under ${options.path}.${missingLexiconNote ? ` ${missingLexiconNote}` : ""}`;
+    return { success: true, status: "ok", output, findings: [], scanned: [], unclaimed, exitCode: 0 };
   }
 
   let findings: AuditFinding[];
@@ -262,6 +353,7 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
 
   if (tier === "merge-worthy") findings = findings.filter((f) => isMergeWorthy(f, catalog));
   const notes = coverageNotes(inputs);
+  if (missingLexiconNote) notes.push(missingLexiconNote);
 
   // Diff-bearing renderers (markdown, html) need action SHAs / image digests
   // resolved up front (sync maps so rendering stays synchronous).
@@ -304,7 +396,7 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
   switch (format) {
     case "json": {
       const snapshot = await buildSnapshot(options, scanned, isUrl);
-      output = JSON.stringify(buildReportJson(findings, { snapshot, toolVersion: options.toolVersion, catalog }), null, 2);
+      output = JSON.stringify(buildReportJson(findings, { snapshot, toolVersion: options.toolVersion, catalog, unclaimed }), null, 2);
       break;
     }
     case "sarif":
@@ -329,10 +421,10 @@ export async function auditCommand(options: AuditCommandOptions): Promise<AuditC
     } catch (err) {
       return { success: false, output, findings, scanned, exitCode: 1, error: `Failed to write ${options.output}: ${err instanceof Error ? err.message : String(err)}` };
     }
-    return { success: true, output, findings, scanned, exitCode, wroteTo: options.output };
+    return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode, wroteTo: options.output };
   }
 
-  return { success: true, output, findings, scanned, exitCode };
+  return { success: true, status: "ok", output, findings, scanned, unclaimed, exitCode };
 }
 
 /** Print an audit result to stdout. */
@@ -345,5 +437,6 @@ export function printAuditResult(result: AuditCommandResult): void {
     console.error(`Wrote report to ${result.wroteTo}`);
     return;
   }
-  console.log(result.output);
+  if (result.stream === "stderr") console.error(result.output);
+  else console.log(result.output);
 }

package/src/cli/commands/build.test.ts

@@ -169,6 +169,7 @@ export const testEntity = {
         format: "json",
         serializers: [awsSerializer],
         fold: true,
+        verbose: true,
       });
 
       expect(result.success).toBe(true);
@@ -183,6 +184,131 @@ export const testEntity = {
     }
   });
 
+  describe("#1396 — ownership.env resolves from the env build parameter", () => {
+    const thisDir = dirname(fileURLToPath(import.meta.url));
+    const runtimePath = resolvePath(thisDir, "../../runtime");
+    const paramsPath = resolvePath(thisDir, "../../params");
+
+    // A label-stamping serializer in miniature: the resource's own `env` prop
+    // (from params.env) next to the ownership marker's env (from context).
+    const labelSerializer: Serializer = {
+      name: "aws",
+      rulePrefix: "TEST",
+      serialize: (entities, _outputs, context) =>
+        JSON.stringify(
+          [...entities.values()].map((e) => ({
+            label: (e as unknown as { props: { env: string } }).props.env,
+            marker: context?.ownership,
+          })),
+        ),
+    };
+
+    async function writeProject(ownershipEnv: string) {
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `
+          export default {
+            ownership: { stack: "fountain", env: ${ownershipEnv} },
+            buildParams: {
+              env: { type: "string", default: "dev", env: "CHANT_TEST_1396_ENV" },
+            },
+          };
+        `,
+      );
+      await writeFile(
+        join(testDir, "resources.ts"),
+        `
+          import { createResource } from ${JSON.stringify(runtimePath)};
+          export const Bucket = createResource("Test::Bucket", "aws", { arn: "Arn" });
+        `,
+      );
+      await writeFile(
+        join(testDir, "main.ts"),
+        `
+          import { Bucket } from "./resources";
+          import { params } from ${JSON.stringify(paramsPath)};
+          export const bucket = new Bucket({ env: params.env });
+        `,
+      );
+    }
+
+    function built(): Array<{ label: string; marker?: { stack: string; env?: string } }> {
+      return JSON.parse(readFileSync(outputFile, "utf-8"));
+    }
+
+    test("--param env=prod drives both the label and the ownership marker", async () => {
+      await writeProject(`{ param: "env" }`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildCommand({
+          path: testDir,
+          output: outputFile,
+          format: "json",
+          serializers: [labelSerializer],
+          params: { env: "prod" },
+        });
+        expect(result.errors).toEqual([]);
+        expect(result.success).toBe(true);
+        expect(built()).toEqual([{ label: "prod", marker: { stack: "fountain", env: "prod" } }]);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    test("with no parameter supplied, both follow the declared default", async () => {
+      await writeProject(`{ param: "env" }`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildCommand({
+          path: testDir,
+          output: outputFile,
+          format: "json",
+          serializers: [labelSerializer],
+        });
+        expect(result.success).toBe(true);
+        expect(built()).toEqual([{ label: "dev", marker: { stack: "fountain", env: "dev" } }]);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    test("a literal ownership.env that disagrees with --param env is warned about", async () => {
+      await writeProject(`"dev"`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildCommand({
+          path: testDir,
+          output: outputFile,
+          format: "json",
+          serializers: [labelSerializer],
+          params: { env: "prod" },
+        });
+        expect(result.success).toBe(true);
+        expect(built()).toEqual([{ label: "prod", marker: { stack: "fountain", env: "dev" } }]);
+        expect(result.warnings.some((w) => w.includes('ownership.env is "dev"') && w.includes('"prod"'))).toBe(true);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+
+    test("a reference to an undeclared parameter fails the build", async () => {
+      await writeProject(`{ param: "environment" }`);
+      const errorSpy = vi.spyOn(console, "error").mockImplementation(() => {});
+      try {
+        const result = await buildCommand({
+          path: testDir,
+          output: outputFile,
+          format: "json",
+          serializers: [labelSerializer],
+        });
+        expect(result.success).toBe(false);
+        expect(result.errors.some((e) => e.includes('build parameter "environment"'))).toBe(true);
+      } finally {
+        errorSpy.mockRestore();
+      }
+    });
+  });
+
   test("#1064 — a declared build-time parameter binds to params.<name> and folds to a literal", async () => {
     const thisDir = dirname(fileURLToPath(import.meta.url));
     const runtimePath = resolvePath(thisDir, "../../runtime");
@@ -235,10 +361,10 @@ export const testEntity = {
       expect(result.resourceCount).toBe(1);
       expect(result.buildParams).toEqual([{ name: "tier", value: "production", source: "cli" }]);
 
-      const loggedParamLine = errorSpy.mock.calls
-        .map((call) => String(call[0]))
-        .some((line) => line.includes("[param] tier") && line.includes("production") && line.includes("cli"));
-      expect(loggedParamLine).toBe(true);
+      // #1424 — without --verbose the echo is a one-line count by source.
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => line.includes("1 build parameter resolved (1 from cli)"))).toBe(true);
+      expect(logged.some((line) => line.includes("[param] tier"))).toBe(false);
     } finally {
       errorSpy.mockRestore();
     }
@@ -346,6 +472,19 @@ export const testEntity = {
 
       expect(result.success).toBe(true);
       expect(result.resourceCount).toBe(1);
+      // #1424 — the default report is one summary line, not one line per file.
+      const logged = errorSpy.mock.calls.map((call) => String(call[0]));
+      expect(logged.some((line) => /^.*fold: \d+ files? folded, \d+ ran/.test(line))).toBe(true);
+      expect(logged.some((line) => line.includes("[fold:"))).toBe(false);
+
+      errorSpy.mockClear();
+      const verboseResult = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        verbose: true,
+      });
+      expect(verboseResult.success).toBe(true);
       const anyFoldLine = errorSpy.mock.calls.map((call) => String(call[0])).some((line) => line.includes("[fold:"));
       expect(anyFoldLine).toBe(true);
 
@@ -360,7 +499,7 @@ export const testEntity = {
       expect(runResult.resourceCount).toBe(1);
       const anyFoldLineOff = errorSpy.mock.calls
         .map((call) => String(call[0]))
-        .some((line) => line.includes("[fold:"));
+        .some((line) => line.includes("[fold:") || line.includes("fold: "));
       expect(anyFoldLineOff).toBe(false);
     } finally {
       errorSpy.mockRestore();

package/src/cli/commands/build.ts

@@ -1,5 +1,13 @@
 import { build } from "../../build";
-import { loadChantConfigUpward, resolveOwnershipMarker, resolveFoldEnabled, resolveSandboxEnabled } from "../../config";
+import {
+  loadChantConfigUpward,
+  resolveOwnershipMarker,
+  resolveOwnershipEnv,
+  ownershipEnvDisagreement,
+  resolveFoldEnabled,
+  resolveSandboxEnabled,
+} from "../../config";
+import type { OwnershipMarker } from "../../ownership";
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
@@ -141,10 +149,9 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // its default.
   const loaded = await loadChantConfigUpward(infraPath);
   const config = loaded.config;
-  const ownership = resolveOwnershipMarker(config);
+  // The ownership marker is resolved further down, after build parameters —
+  // `ownership.env` may reference one (#1396).
 
-  // Environment for policy evaluation: explicit --env wins, else ownership.env.
-  const env = options.env ?? config.ownership?.env;
   // Project-authored organizational policy checks (lint.policies), run over the
   // resolved resources during build. Resolve paths relative to the config dir.
   const configDir = loaded.configPath ? dirname(loaded.configPath) : infraPath;
@@ -197,11 +204,13 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // missing required value, a type/enum mismatch) is reported as a chant
   // build error naming the parameter, never a thrown error from inside user
   // source (which is what loomster's hand-rolled `tierFromEnv()`-style
-  // validators did before migrating to this mechanism). Also logs every
-  // resolved value (`[param] name = value (source)`) on success.
+  // validators did before migrating to this mechanism). Also logs a one-line
+  // count on success, or every resolved value (`[param] name = value
+  // (source)`) under --verbose (#1424).
   const paramsResolution = resolveCliBuildParams(config.buildParams, {
     cli: options.params,
     paramsFile: options.paramsFile,
+    verbose: options.verbose,
   });
   if (!paramsResolution.success) {
     errors.push(...paramsResolution.errors);
@@ -228,6 +237,27 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
     );
   }
 
+  // #1396 — opt-in ownership marking, resolved AFTER build parameters so
+  // `ownership.env: { param: "env" }` takes the value `--param env=prod` (or
+  // the declared env mapping, or the default) bound to params.env — one
+  // source for the label and the marker. A reference that cannot be
+  // satisfied is a build error, not a marker silently stamped without an env.
+  let ownership: OwnershipMarker | undefined;
+  // Environment for policy evaluation: explicit --env wins, else ownership.env
+  // (read even when marking itself is off, so policy can still branch on it).
+  let env: string | undefined;
+  try {
+    ownership = resolveOwnershipMarker(config, paramsResolution.provenance);
+    env = options.env ?? resolveOwnershipEnv(config, paramsResolution.provenance);
+  } catch (err) {
+    errors.push(formatError({ message: err instanceof Error ? err.message : String(err) }));
+    return { success: false, resourceCount: 0, fileCount: 0, errors, warnings };
+  }
+  // A literal `ownership.env` next to an `env` build parameter that resolved
+  // to something else is the silent divergence #1396 reports — say so.
+  const disagreement = ownershipEnvDisagreement(config, paramsResolution.provenance);
+  if (disagreement) warnings.push(formatWarning({ message: disagreement }));
+
   // #1039 — thread each loaded plugin's registered intrinsics (e.g. AWS's
   // `Sub`) through to the fold path, so a file using a registered intrinsic
   // tagged template folds instead of unconditionally falling back to run.
@@ -272,14 +302,22 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   });
 
   // #1022 — report per-file fold vs run so it's visible what still runs.
-  if (fold) {
-    for (const decision of result.foldDecisions) {
-      const rel = relative(infraPath, decision.file) || decision.file;
-      const detail =
-        decision.mode === "fold"
-          ? `${decision.resourceCount ?? 0} resource(s), no module execution`
-          : (decision.reason ?? "fell back to run");
-      console.error(formatInfo(`[fold:${decision.mode}] ${rel} — ${detail}`));
+  // #1424 — one line by default; the per-file lines and their reasons are
+  // --verbose. A file that ran is the expected outcome for source that
+  // computes values in functions, and a dozen "is not foldable" notes read
+  // like errors to someone meeting the project for the first time.
+  if (fold && result.foldDecisions.length > 0) {
+    if (options.verbose) {
+      for (const decision of result.foldDecisions) {
+        const rel = relative(infraPath, decision.file) || decision.file;
+        const detail =
+          decision.mode === "fold"
+            ? `${decision.resourceCount ?? 0} resource(s), no module execution`
+            : (decision.reason ?? "fell back to run");
+        console.error(formatInfo(`[fold:${decision.mode}] ${rel} — ${detail}`));
+      }
+    } else {
+      console.error(formatInfo(summarizeFoldDecisions(result.foldDecisions)));
     }
   }
 
@@ -587,6 +625,20 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   };
 }
 
+/**
+ * `fold: 8 files folded, 13 ran (--verbose for reasons)` — the non-verbose
+ * report of a fold build's per-file decisions (#1424). The "(--verbose for
+ * reasons)" hint appears only when something ran, since that is the only case
+ * with a reason to read.
+ */
+export function summarizeFoldDecisions(decisions: readonly { mode: string }[]): string {
+  const folded = decisions.filter((d) => d.mode === "fold").length;
+  const ran = decisions.length - folded;
+  const files = (n: number) => `${n} file${n === 1 ? "" : "s"}`;
+  const hint = ran > 0 ? " (--verbose for reasons)" : "";
+  return `fold: ${files(folded)} folded, ${ran} ran${hint}`;
+}
+
 /**
  * Simple JSON to YAML converter
  */