@intentius/chant 0.45.0 → 0.49.0

package/src/fold/subset.ts

@@ -231,18 +231,19 @@ export function unsupportedExpressionMessage(node: ts.Node): string {
 export function checkObjectMember(
   prop: ts.ObjectLiteralElementLike,
   intrinsics?: readonly IntrinsicDef[],
+  allowCompositeStepAccess?: boolean,
 ): SubsetViolation | undefined {
   if (ts.isPropertyAssignment(prop)) {
     if (!isLiteralPropertyName(prop.name)) {
       return violation(prop.name, computedPropertyNameMessage(prop.name));
     }
-    return findSubsetViolation(prop.initializer, intrinsics);
+    return findSubsetViolation(prop.initializer, intrinsics, allowCompositeStepAccess);
   }
   if (ts.isShorthandPropertyAssignment(prop)) {
     return undefined;
   }
   if (ts.isSpreadAssignment(prop)) {
-    return findSubsetViolation(prop.expression, intrinsics);
+    return findSubsetViolation(prop.expression, intrinsics, allowCompositeStepAccess);
   }
   return violation(prop, UNSUPPORTED_OBJECT_MEMBER_MESSAGE);
 }
@@ -251,9 +252,10 @@ export function checkObjectMember(
 function checkArrayElement(
   el: ts.Expression,
   intrinsics?: readonly IntrinsicDef[],
+  allowCompositeStepAccess?: boolean,
 ): SubsetViolation | undefined {
-  if (ts.isSpreadElement(el)) return findSubsetViolation(el.expression, intrinsics);
-  return findSubsetViolation(el, intrinsics);
+  if (ts.isSpreadElement(el)) return findSubsetViolation(el.expression, intrinsics, allowCompositeStepAccess);
+  return findSubsetViolation(el, intrinsics, allowCompositeStepAccess);
 }
 
 /**
@@ -265,10 +267,24 @@ function checkArrayElement(
  * environment-dependent exceptions). Returns the first (deepest,
  * `fold()`-evaluation-order) unsupported node, or `undefined` when `node`'s
  * whole shape is foldable.
+ *
+ * `allowCompositeStepAccess` (chant #1544) is an EVL-only, MORE-permissive
+ * divergence in the same direction as points 1/2/2b/2c in the module doc
+ * above: a call immediately narrowed to a single member access — the
+ * `Checkout({...}).step` shape every lexicon's single-action `Composite()`
+ * wrappers document as their embedded-inline idiom (see composites.mdx —
+ * "normally embedded inline as `checkout.step` inside a `Job`'s `steps`
+ * array") — is treated as shape-valid. `fold()` itself never passes this
+ * (it has no such parameter to pass; only EVL001 opts in), so `fold()`'s own
+ * behavior is unchanged: it still falls the file back to the run path for
+ * this shape, exactly as composites.mdx describes as the expected, correct
+ * outcome — not an error. What changes is that EVL001 stops treating that
+ * ordinary, documented fallback as a lint error.
  */
 export function findSubsetViolation(
   node: ts.Node,
   intrinsics?: readonly IntrinsicDef[],
+  allowCompositeStepAccess?: boolean,
 ): SubsetViolation | undefined {
   if (
     ts.isParenthesizedExpression(node) ||
@@ -276,7 +292,7 @@ export function findSubsetViolation(
     ts.isSatisfiesExpression(node) ||
     ts.isNonNullExpression(node)
   ) {
-    return findSubsetViolation(node.expression, intrinsics);
+    return findSubsetViolation(node.expression, intrinsics, allowCompositeStepAccess);
   }
 
   if (
@@ -311,7 +327,7 @@ export function findSubsetViolation(
 
   if (ts.isTemplateExpression(node)) {
     for (const span of node.templateSpans) {
-      const v = findSubsetViolation(span.expression, intrinsics);
+      const v = findSubsetViolation(span.expression, intrinsics, allowCompositeStepAccess);
       if (v) return v;
     }
     return undefined;
@@ -319,7 +335,7 @@ export function findSubsetViolation(
 
   if (ts.isObjectLiteralExpression(node)) {
     for (const prop of node.properties) {
-      const v = checkObjectMember(prop, intrinsics);
+      const v = checkObjectMember(prop, intrinsics, allowCompositeStepAccess);
       if (v) return v;
     }
     return undefined;
@@ -327,28 +343,35 @@ export function findSubsetViolation(
 
   if (ts.isArrayLiteralExpression(node)) {
     for (const el of node.elements) {
-      const v = checkArrayElement(el, intrinsics);
+      const v = checkArrayElement(el, intrinsics, allowCompositeStepAccess);
       if (v) return v;
     }
     return undefined;
   }
 
   if (ts.isPropertyAccessExpression(node)) {
-    return findSubsetViolation(node.expression, intrinsics);
+    // chant #1544 — see this function's doc comment. `<call>(...).step`
+    // (any callee, any argument shape) is the composite-consumer idiom, EVL
+    // opt-in only: `fold()` never sets `allowCompositeStepAccess`, so it is
+    // unaffected and still falls back to the run path for this shape.
+    if (allowCompositeStepAccess && node.name.text === "step" && ts.isCallExpression(node.expression)) {
+      return undefined;
+    }
+    return findSubsetViolation(node.expression, intrinsics, allowCompositeStepAccess);
   }
 
   if (ts.isElementAccessExpression(node)) {
     if (!isLiteralElementKey(node.argumentExpression)) {
       return violation(node.argumentExpression, dynamicElementAccessMessage(node.argumentExpression), "EVL003");
     }
-    return findSubsetViolation(node.expression, intrinsics);
+    return findSubsetViolation(node.expression, intrinsics, allowCompositeStepAccess);
   }
 
   if (ts.isPrefixUnaryExpression(node)) {
     if (!SUPPORTED_UNARY_OPERATORS.has(node.operator)) {
       return violation(node, UNSUPPORTED_UNARY_MESSAGE);
     }
-    return findSubsetViolation(node.operand, intrinsics);
+    return findSubsetViolation(node.operand, intrinsics, allowCompositeStepAccess);
   }
 
   if (ts.isBinaryExpression(node)) {
@@ -358,15 +381,18 @@ export function findSubsetViolation(
     }
     // Flow-insensitive — see module doc: fold() short-circuits &&/||/?? and
     // only evaluates the taken side; EVL requires both sides shape-valid.
-    return findSubsetViolation(node.left, intrinsics) ?? findSubsetViolation(node.right, intrinsics);
+    return (
+      findSubsetViolation(node.left, intrinsics, allowCompositeStepAccess) ??
+      findSubsetViolation(node.right, intrinsics, allowCompositeStepAccess)
+    );
   }
 
   if (ts.isConditionalExpression(node)) {
     // Flow-insensitive — see module doc: fold() only folds the taken branch.
     return (
-      findSubsetViolation(node.condition, intrinsics) ??
-      findSubsetViolation(node.whenTrue, intrinsics) ??
-      findSubsetViolation(node.whenFalse, intrinsics)
+      findSubsetViolation(node.condition, intrinsics, allowCompositeStepAccess) ??
+      findSubsetViolation(node.whenTrue, intrinsics, allowCompositeStepAccess) ??
+      findSubsetViolation(node.whenFalse, intrinsics, allowCompositeStepAccess)
     );
   }
 
@@ -377,14 +403,14 @@ export function findSubsetViolation(
     // argument is classified on its own terms and nothing is rejected merely
     // for being in the "wrong" position.
     for (const arg of node.arguments ?? []) {
-      const v = findSubsetViolation(arg, intrinsics);
+      const v = findSubsetViolation(arg, intrinsics, allowCompositeStepAccess);
       if (v) return v;
     }
     return undefined;
   }
 
   if (ts.isSpreadElement(node)) {
-    return findSubsetViolation(node.expression, intrinsics);
+    return findSubsetViolation(node.expression, intrinsics, allowCompositeStepAccess);
   }
 
   if (ts.isCallExpression(node)) {
@@ -400,7 +426,7 @@ export function findSubsetViolation(
     // ever be MORE permissive than `fold()`, never stricter.
     if (ts.isIdentifier(node.expression) && isFoldableHelperName(node.expression.text)) {
       for (const arg of node.arguments) {
-        const v = findSubsetViolation(arg, intrinsics);
+        const v = findSubsetViolation(arg, intrinsics, allowCompositeStepAccess);
         if (v) return v;
       }
       return undefined;
@@ -420,7 +446,7 @@ export function findSubsetViolation(
       intrinsics.some((i) => i.name === (node.expression as ts.Identifier).text && intrinsicCallFolds(i))
     ) {
       for (const arg of node.arguments) {
-        const v = findSubsetViolation(arg, intrinsics);
+        const v = findSubsetViolation(arg, intrinsics, allowCompositeStepAccess);
         if (v) return v;
       }
       return undefined;

package/src/index.ts

@@ -7,6 +7,9 @@
 export * from "./declarable";
 export * from "./composite";
 export * from "./provenance";
+export * from "./secret-provenance";
+export * from "./secret-materialization";
+export * from "./effect-receipt";
 export * from "./build-params";
 export * from "./intrinsic";
 export * from "./types";
@@ -43,6 +46,7 @@ export * from "./lint/selectors";
 export * from "./lint/named-checks";
 export * from "./lint/post-synth";
 export * from "./lint/policy";
+export * from "./lint/pipeline-change-gate";
 export * from "./lint/rule-loader";
 export * from "./lint/discover";
 export * from "./import/parser";

package/src/lexicon.ts

@@ -11,12 +11,12 @@ import type { CompletionContext, CompletionItem, HoverContext, HoverInfo, CodeAc
 import type { McpToolContribution, McpResourceContribution } from "./mcp/types";
 import type { DriverComponent } from "./components/driver";
 import type { EmulatorDeclaration } from "./op/emulator-lifecycle";
-import type { OwnershipChannel } from "./ownership";
+import type { OwnershipChannel, OwnershipMarker } from "./ownership";
 import type { LexiconConfigSchema } from "./lexicon-config";
 import type { RuleMeta } from "./audit/catalog";
 import type { ReferenceCatalog } from "./graph-refs";
 import type { IREdge } from "./graph-ir";
-import type { DescribeResourcesResult } from "./observation";
+import type { DescribeResourcesResult, UnobservedReason } from "./observation";
 import type { DeepNormalizationHooks, DeepObservationResult } from "./deep-observation";
 import type { OwnerChainVerdict } from "./owner-chain";
 import type { CommandGroup } from "./cli/command-group";
@@ -439,6 +439,24 @@ export interface BuildRootContext {
   projectRoot: string;
   /** The resolved project configuration, for the lexicon's own namespace. */
   config: Record<string, unknown>;
+  /**
+   * The discovered entities, read-only (#1828 / SOPS provenance). A
+   * contributor that reacts to what the project DECLARED — rather than to
+   * what its config listed — reads them here: the committed-encrypted
+   * `declareSecret()` hook resolves each declaration's `file` into a sidecar
+   * entity, and any future declaration-driven contributor needs the same.
+   *
+   * Read-only on purpose. The merge that follows is the only thing that adds
+   * to the entity set, and it refuses a name collision rather than
+   * overwriting; a contributor mutating the map directly would slip past
+   * that. Contributors run in order, so a contributor also sees entities
+   * earlier contributors added.
+   *
+   * Optional: a caller that has no entity set (a plugin hook invoked
+   * directly, a graph mode that never discovered) omits it, and a hook must
+   * treat an absent map as an empty one.
+   */
+  entities?: ReadonlyMap<string, Declarable>;
 }
 
 /**
@@ -450,6 +468,17 @@ export interface BuildRootContribution {
   warnings?: string[];
 }
 
+/**
+ * A plugin's `buildRoots` hook, already bound to this invocation's project
+ * root and config (`collectBuildRootContributors`, ./cli/plugins.ts). What is
+ * NOT bindable that early is the entity set — discovery has not run yet — so
+ * the merge supplies it when it calls the closure. A contributor that ignores
+ * the argument is still assignable, which is what every pre-#1828 hook does.
+ */
+export type BuildRootContributor = (
+  ctx: Pick<BuildRootContext, "entities">,
+) => Promise<BuildRootContribution>;
+
 export interface LexiconPlugin {
   // ── Required ──────────────────────────────────────────────
   /** Human-readable name (e.g. "aws", "gcp") */
@@ -540,6 +569,34 @@ export interface LexiconPlugin {
    */
   auditCatalog?(): Record<string, RuleMeta>;
 
+  /**
+   * Parse standalone template content (a file audit discovery classified for
+   * this lexicon) into the lexicon's entity graph, keyed the way `ctx.entities`
+   * is during a build. Lets entity-reading post-synth checks fire on
+   * `chant audit` of hand-written manifests — parse-to-graph rather than
+   * output-reading rule variants (#1567). Implementations must tolerate
+   * arbitrary external content: a malformed document yields no entities, never
+   * a throw. Omit for lexicons whose audit checks read `ctx.outputs`.
+   */
+  auditEntities?(content: string): Map<string, Declarable>;
+
+  /**
+   * Machine-readable spec-coverage accounting for `check-lexicon` (#1330).
+   *
+   * `coverage()` prints a report for humans; this returns the one fact the
+   * completeness gate cares about: which upstream spec kinds are neither
+   * modeled as declarables nor on the lexicon's exclusion list. fountain held
+   * this line in a lexicon-local vitest assertion (`coverage.test.ts`), which
+   * is a convention rather than a contract — the same class of gap #1342
+   * closed for LSP providers.
+   *
+   * Implementations must work offline from committed snapshots (fountain
+   * reads `spec/fountain-openapi.snapshot.json` plus its surface baseline):
+   * `check-lexicon` runs on every PR, so no network I/O. Omit when the
+   * lexicon has no kind-level spec accounting; the check passes vacuously.
+   */
+  coverageReport?(): Promise<{ unaccountedKinds?: string[] }>;
+
   /** Return intrinsic function definitions */
   intrinsics?(): IntrinsicDef[];
 
@@ -862,6 +919,86 @@ export interface LexiconPlugin {
    */
   describeStackStatus?(options: { environment: string; stack: string }): Promise<StackStatusObservation | null>;
 
+  /**
+   * Enumerate the resources this lexicon would delete for one marker identity
+   * (#1222). Opt-in, and read-only here: this method names the would-delete
+   * set, it never deletes. `chant lifecycle teardown <env>` calls it to plan;
+   * the execution half ({@link executeTeardown}) deletes from the same
+   * enumeration.
+   *
+   * Selection is marker-scoped by construction. `marker` carries this
+   * project's ownership stack plus the requested environment, and every
+   * returned candidate must have been read carrying exactly that identity on
+   * this lexicon's marker channel — managed-by present, stack equal, env
+   * equal. A resource whose marker is absent, foreign-stack, or foreign-env is
+   * not a candidate, ever. Core re-checks each candidate's `marker` and drops
+   * mismatches, so a buggy implementation cannot widen the set.
+   *
+   * The #1089 discipline applies: a kind this lexicon stamps but cannot read
+   * back (no reader for the kind, the read errored, no credentials) is a
+   * `hole`, named with a total {@link UnobservedReason} — never silently
+   * absent, because "absent from the plan" reads as "safe", and an unreadable
+   * kind is unknown, not safe.
+   *
+   * A lexicon without this capability still takes part in teardown planning:
+   * core falls back to {@link describeResources} and filters on
+   * {@link ResourceMetadata.marker}. Implement this when that read is the
+   * wrong shape for deletion — aws, whose thin read carries no tags and whose
+   * teardown is stack-level, is the motivating case.
+   */
+  teardownOwned?(options: {
+    environment: string;
+    /** The identity to select on: this project's ownership stack + the env being torn down. */
+    marker: OwnershipMarker;
+    /** Deployed stack name, for a multi-stack project (see `stacks` in {@link ChantConfig}). */
+    stack?: string;
+    /** Region that stack is deployed in (#1261's contract). */
+    region?: string;
+    /**
+     * Every deployed stack a multi-stack project declares (see `stacks` in
+     * {@link ChantConfig}), for a lexicon whose enumeration is stack-shaped
+     * (aws). When absent or empty, the single-stack convention applies:
+     * `stack`, else the stack named after the environment.
+     */
+    stacks?: Array<{ name: string; region?: string }>;
+  }): Promise<TeardownEnumeration>;
+
+  /**
+   * Delete the teardown candidates core hands over — the execution half of
+   * `chant lifecycle teardown <env> --yes` (#1222). Opt-in, and the sibling of
+   * {@link teardownOwned}: that method names the would-delete set, this one
+   * deletes it. A lexicon that enumerates but does not implement this reports
+   * its candidates as skipped rather than pretending.
+   *
+   * `candidates` is the marker-verified set core computed from the plan — an
+   * implementation deletes those and only those, in whatever order its target
+   * requires (k8s deletes namespaces last; fly deletes apps last). It never
+   * re-widens the set: a live resource not in `candidates` is not this call's
+   * business, whatever its labels say.
+   *
+   * Every candidate gets exactly one outcome per call, keyed by `name`:
+   * `deleted` (including already-gone — deletion is idempotent), `failed`
+   * (the delete errored; core runs one bounded retry pass over these), or
+   * `not-prunable` with a reason (the live object no longer carries the
+   * requested identity, the kind cannot be addressed, the target refuses).
+   * A candidate the implementation says nothing about is reported as failed
+   * by core — silence is never success.
+   */
+  executeTeardown?(options: {
+    environment: string;
+    /** The identity everything was selected on: ownership stack + env. */
+    marker: OwnershipMarker;
+    /** The marker-verified candidates to delete — from {@link teardownOwned} / the plan. */
+    candidates: TeardownCandidate[];
+    /** Deployed stack name, for a multi-stack project (see `stacks` in {@link ChantConfig}). */
+    stack?: string;
+    /** Region that stack is deployed in (#1261's contract). */
+    region?: string;
+    /** Every declared deployed stack, mirroring {@link teardownOwned} — how a
+     * stack-shaped execution (aws) finds each candidate's region. */
+    stacks?: Array<{ name: string; region?: string }>;
+  }): Promise<TeardownExecution>;
+
   /**
    * Where this lexicon can stamp and read chant's ownership marker (#1348).
    * Data, not a method.
@@ -962,6 +1099,79 @@ export interface LexiconPlugin {
   }): Promise<ExportedTemplate>;
 }
 
+/**
+ * One resource {@link LexiconPlugin.teardownOwned} would delete (#1222).
+ * Identity only — no delete happens on this path.
+ */
+export interface TeardownCandidate {
+  /** chant entity name where a declared mapping exists, else the provider-side name. */
+  name: string;
+  /** Resource type (e.g. "AWS::S3::Bucket", "K8s::Apps::Deployment"). */
+  type: string;
+  /** Provider-side identifier, when the read surfaces one. */
+  physicalId?: string;
+  /**
+   * The stack/env identity read off the resource's own marker — read back,
+   * never inferred. Core verifies it equals the requested identity and drops
+   * the candidate otherwise.
+   */
+  marker: OwnershipMarker;
+}
+
+/**
+ * One kind or entity a teardown enumeration could not read (#1089). A hole is
+ * a claim of ignorance, not of absence: the plan must print it loudly, and the
+ * execution half must refuse to call the env clean while holes exist.
+ */
+export interface TeardownHole {
+  /** The unreadable kind or entity name. */
+  name: string;
+  /** Resource type, when known. */
+  type?: string;
+  /** Total verdict — the same vocabulary the observation envelope uses. */
+  reason: UnobservedReason;
+  /** Human-readable detail: the failing command, the unsupported kind. */
+  detail?: string;
+}
+
+/** What {@link LexiconPlugin.teardownOwned} returns: the would-delete set plus its holes. */
+export interface TeardownEnumeration {
+  candidates: TeardownCandidate[];
+  /** Omit or leave empty when every stamped kind was readable. */
+  holes?: TeardownHole[];
+}
+
+/**
+ * One candidate's fate after {@link LexiconPlugin.executeTeardown} (#1222).
+ * `name` keys it back to the candidate it answers for.
+ */
+export interface TeardownOutcome {
+  /** The candidate's `name`, verbatim. */
+  name: string;
+  /** Resource type, when the implementation carries it through. */
+  type?: string;
+  /** Provider-side identifier, when known. */
+  physicalId?: string;
+  /**
+   * - `deleted` — gone, including already-gone (deletion is idempotent);
+   * - `failed` — the delete errored (core retries these once);
+   * - `not-prunable` — deliberately not deleted; `detail` says why;
+   * - `retained` — owned and no longer declared, but deliberately kept
+   *   (#1365 decision 5): a `generated-once` secret never enters the prunable
+   *   set, because deleting it would destroy the only copy of material chant
+   *   never held. Reported loudly, never deleted; deletion is an explicit act
+   *   (`kubectl delete`, or a future gated op), never a sweep's.
+   */
+  outcome: "deleted" | "failed" | "not-prunable" | "retained";
+  /** The error for `failed`, the reason for `not-prunable`/`retained`. */
+  detail?: string;
+}
+
+/** What {@link LexiconPlugin.executeTeardown} returns: one outcome per candidate. */
+export interface TeardownExecution {
+  outcomes: TeardownOutcome[];
+}
+
 /**
  * The observation view of a lexicon — every capability except live export.
  *
@@ -1047,6 +1257,21 @@ export interface ResourceMetadata {
    * a delete, and never escalates `unknown` to one.
    */
   ownership?: "owned" | "foreign" | "unknown";
+  /**
+   * The stack/env identity read off the resource's own ownership marker
+   * (#1222) — the tags/labels/metadata chant stamped at synthesis, read back
+   * verbatim on the same channel. This is what marker-scoped selection keys
+   * on: {@link ownership} says "chant's", `marker` says *which* stack and env.
+   *
+   * Set only when the live model actually carries the channel and the
+   * managed-by marker is present — an absent channel means an absent field,
+   * never a guess. In particular aws's thin read is sourced from
+   * `describe-stack-resources`, which returns no tags at all, so aws never
+   * populates this here; aws teardown is stack-level and reads the stack's own
+   * tags instead (later PR). A populated `marker` does not by itself imply an
+   * {@link ownership} verdict on paths that do not declare a marker channel.
+   */
+  marker?: OwnershipMarker;
   /**
    * Where this resource's owner-reference chain leads, for a live resource
    * that is not itself declared (#1077). A lexicon that maintains an

package/src/lifecycle/change-set.ts

@@ -31,11 +31,30 @@ import { unobservedReasonText, type UnobservedReason } from "../observation";
  *   not drift, just the runtime doing its job. `runtimeOwner` names the
  *   declared entity it belongs to.
  * - `noop` — declared and live with no drift, or already reconciled.
+ * - `effect` — a declared effect receipt (#1832) whose live value is absent or
+ *   differs from the resolved expectation: the effect step will fire. Never a
+ *   `create` or `update` — the generic apply path is observe-only to receipts,
+ *   and the `effect()` step is the sole writer (epic #1703, decision 3). Read
+ *   `effect` for the effect's identity and `effectReason` for why it fires.
  * - `unobserved` — declared, and the lexicon could not look (#1089). Not a
  *   proposal at all: it is the plan admitting a hole. Never a create, never a
  *   delete. Read `unobservedReason` for which hole.
  */
-export type ChangeAction = "create" | "update" | "delete" | "adopt" | "runtime" | "noop" | "unobserved";
+export type ChangeAction = "create" | "update" | "delete" | "adopt" | "runtime" | "noop" | "effect" | "unobserved";
+
+/**
+ * Why an `effect` entry proposes a fire (#1832).
+ *
+ * - `receipt-absent` — the provider confirmed the receipt absent: the effect
+ *   has never recorded a run (or the run crashed before the write — the
+ *   at-least-once case this classification exists to preserve).
+ * - `receipt-stale` — the receipt is live but its value differs from the
+ *   resolved expectation: the effect's inputs changed since the last run.
+ * - `unresolved-input` — a reference input could not resolve at plan time, so
+ *   the expectation cannot be computed. The fire is proposed rather than
+ *   guessed away; the effect step resolves again at run.
+ */
+export type EffectFireReason = "receipt-absent" | "receipt-stale" | "unresolved-input";
 
 /**
  * Who answers "is this resource chant's?". `unknown` until a live ownership
@@ -100,6 +119,16 @@ export interface ChangeSetEntry {
   queried?: string;
   /** The declared entity this resource's owner chain resolves to, for `action: "runtime"` (#1077). */
   runtimeOwner?: string;
+  /**
+   * The effect a receipt witnesses (#1832), for entries derived from an effect
+   * receipt. On `action: "effect"` it names what will fire; on a receipt's
+   * `noop`/`unobserved` rows it keeps the attribution.
+   */
+  effect?: string;
+  /** Why the effect fires, for `action: "effect"` (#1832). */
+  effectReason?: EffectFireReason;
+  /** Human-readable backing for `effectReason` (the digests that differ, the unresolved path). */
+  effectDetail?: string;
 }
 
 export interface ChangeSet {
@@ -234,13 +263,14 @@ export function buildChangeSet(env: string, input: DiffLiveInput, options?: Chan
   return { env, entries };
 }
 
-const ACTION_ORDER: ChangeAction[] = ["create", "update", "delete", "adopt", "runtime", "noop", "unobserved"];
+const ACTION_ORDER: ChangeAction[] = ["create", "update", "effect", "delete", "adopt", "runtime", "noop", "unobserved"];
 
 /** Count entries per action. */
 export function summarize(cs: ChangeSet): Record<ChangeAction, number> {
   const counts: Record<ChangeAction, number> = {
     create: 0,
     update: 0,
+    effect: 0,
     delete: 0,
     adopt: 0,
     runtime: 0,
@@ -257,10 +287,10 @@ export function summarize(cs: ChangeSet): Record<ChangeAction, number> {
  * GitLab renders an `artifacts:reports:terraform` artifact in the merge-request
  * UI as "N to add, M to change, K to delete". The format is generic — any tool
  * that emits this JSON gets the widget — and the chant plan maps onto it
- * directly. Only the mutating actions count: `adopt`, `runtime`, `noop` and
- * `unobserved` are excluded, since the widget has no column for "live but
- * undeclared", "expected runtime child" (#1077), "no change", or "could not
- * look" (#1089). The widget is therefore a floor, not a complete plan: read
+ * directly. Only the mutating actions count: `adopt`, `runtime`, `noop`,
+ * `effect` and `unobserved` are excluded, since the widget has no column for
+ * "live but undeclared", "expected runtime child" (#1077), "no change", "an
+ * effect will fire" (#1832), or "could not look" (#1089). The widget is therefore a floor, not a complete plan: read
  * the full change set when entities are unobserved or classified runtime.
  *
  * The widget label reads "Terraform" regardless of producer; that is GitLab's
@@ -292,9 +322,18 @@ export function renderChangeSet(cs: ChangeSet): string {
         ? "\nUNOBSERVED (declared; chant could not read live state — no action proposed):"
         : action === "runtime"
           ? "\nRUNTIME (owned by a declared resource; not drift, never a delete/adopt candidate):"
-          : `\n${action.toUpperCase()}:`,
+          : action === "effect"
+            ? "\nEFFECT (receipt absent or stale; the effect step fires — the generic apply never writes a receipt):"
+            : `\n${action.toUpperCase()}:`,
     );
     for (const e of group) {
+      if (e.action === "effect") {
+        lines.push(
+          `  effect will fire: ${e.effect ?? e.name} — receipt ${e.name}${e.type ? ` (${e.type})` : ""}` +
+            `${e.effectDetail ? ` — ${e.effectDetail}` : ""}`,
+        );
+        continue;
+      }
       const own = e.ownership === "unknown" ? "" : ` [${e.ownership}]`;
       const why = e.unobservedReason
         ? ` — ${unobservedReasonText(e.unobservedReason)}${e.unobservedDetail ? `: ${e.unobservedDetail}` : ""}`

package/src/lifecycle/index.ts

@@ -7,9 +7,12 @@ export * from "./deep-diff";
 export * from "./deep-observe";
 export * from "./observation-baseline";
 export * from "./change-set";
+export * from "./unobserved-gate";
+export * from "./receipt-plan";
 export * from "./affected";
 export * from "./release-ledger";
 export * from "./build-ledger";
 export * from "./build-ledger-store";
 export * from "./oras-referrer-lookup";
 export * from "./status";
+export * from "./teardown";

package/src/lifecycle/observation-baseline.test.ts

@@ -97,3 +97,49 @@ describe("acceptDeviations", () => {
     expect(countAccepted(null)).toBe(0);
   });
 });
+
+describe("acceptDeviations refuses effect receipts (#1833)", () => {
+  const now = "2026-08-24T00:00:00.000Z";
+
+  test("refuses a deviation whose type is the core receipt entityType", () => {
+    expect(() =>
+      acceptDeviations(emptyBaseline("prod"), "chant", [
+        { entity: "seededReceipt", type: "Chant::EffectReceipt", path: "value", value: "gone" },
+      ], { now }),
+    ).toThrow(/effect receipt "seededReceipt"/);
+  });
+
+  test("refuses a deviation on an entity the caller recognized as a receipt (materialized row)", () => {
+    expect(() =>
+      acceptDeviations(emptyBaseline("prod"), "aws", [
+        { entity: "migratedReceipt", type: "AWS::SSM::Parameter", path: "Value", value: "stale" },
+      ], { now, receipts: new Set(["migratedReceipt"]) }),
+    ).toThrow(/effect receipt "migratedReceipt"/);
+  });
+
+  test("the refusal names the receipt and the effect step as sole writer, and records nothing", () => {
+    const before = emptyBaseline("prod");
+    let error: Error | undefined;
+    try {
+      acceptDeviations(before, "aws", [
+        { entity: "Role", type: "AWS::IAM::Role", path: "MaxSessionDuration", value: 7200 },
+        { entity: "migratedReceipt", type: "AWS::SSM::Parameter", path: "Value", value: "stale" },
+      ], { now, receipts: new Set(["migratedReceipt"]) });
+    } catch (e) {
+      error = e as Error;
+    }
+    expect(error).toBeDefined();
+    expect(error!.message).toContain('effect receipt "migratedReceipt"');
+    expect(error!.message).toContain("only writer");
+    expect(error!.message).toContain("defuse the effect");
+    // The whole acceptance aborts — the non-receipt row was not recorded either.
+    expect(before.lexicons).toEqual({});
+  });
+
+  test("passes: non-receipt deviations accept as before, receipts set present", () => {
+    const b = acceptDeviations(emptyBaseline("prod"), "aws", [
+      { entity: "Role", type: "AWS::IAM::Role", path: "MaxSessionDuration", value: 7200 },
+    ], { now, receipts: new Set(["migratedReceipt"]) });
+    expect(baselineForLexicon(b, "aws").Role.accepted).toHaveLength(1);
+  });
+});