@intentius/chant 0.57.0 → 0.58.0

package/src/cli/mcp/server.ts

@@ -9,7 +9,7 @@ import { searchTool, createSearchHandler } from "./tools/search";
 import type { LexiconPlugin } from "../../lexicon";
 import type { McpRequest, McpResponse, McpRequestMeta, ToolDefinition, ToolHandler, ResourceDefinition } from "./types";
 import { createSnapshotTool, createDiffTool } from "./lifecycle-tools";
-import { createOpListTool, createOpRunTool, createOpStatusTool, createOpSignalTool, createOpReportTool } from "./op-tools";
+import { createOpListTool, createOpRunTool, createOpStatusTool, createOpApproveTool, createOpReportTool } from "./op-tools";
 import { buildResourcesList, handleResourcesRead } from "./resource-handlers";
 
 /**
@@ -103,7 +103,7 @@ export class McpServer {
     this.registerTool(diff.definition, diff.handler);
 
     // Register Op tools
-    for (const factory of [createOpListTool, createOpRunTool, createOpStatusTool, createOpSignalTool, createOpReportTool]) {
+    for (const factory of [createOpListTool, createOpRunTool, createOpStatusTool, createOpApproveTool, createOpReportTool]) {
       const t = factory();
       this.registerTool(t.definition, t.handler);
     }

package/src/cli/registry.ts

@@ -18,12 +18,26 @@ export interface ParsedArgs {
   watch: boolean;
   verbose: boolean;
   help: boolean;
-  profile?: string;
   report?: boolean;
   /** `chant run` — force the local in-process executor (the default). */
   local?: boolean;
-  /** `chant run` — run via a Temporal cluster instead of the local executor. */
-  temporal?: boolean;
+  /**
+   * `chant run <op> --on <lexicon>` (#2121) — which runtime hosts the run.
+   * The named lexicon's `opRuntime` (`../lexicon.ts`) takes it; omitted, core's
+   * built-in `local` provider does. Applies to every `run` subcommand, so
+   * `run status`/`log`/`list`/`cancel`/`approve` all address the same runtime
+   * the run started on.
+   */
+  on?: string;
+  /**
+   * `-p, --profile <name>` (#2124, restored in #2192) — which named connection
+   * profile the hosting runtime targets, handed to it as
+   * {@link OpRunStartOptions.profile}. Only a runtime that declares profiles
+   * reads it: fountain resolves it through `fountain.profiles` in
+   * `chant.config.ts` and refuses a name it does not find. Omitted, each
+   * runtime keeps its own default (fountain's `defaultProfile`).
+   */
+  profile?: string;
   /** `chant run` — emit the structured OpRunResult as JSON on stdout. */
   json?: boolean;
   /**
@@ -32,10 +46,9 @@ export interface ParsedArgs {
    * per line to stdout while the run executes, so a consumer can render live
    * wave/component/phase/step progress instead of tailing raw logs.
    *
-   * `chant run <name> --temporal --progress-json` (chant #1676) — the same
-   * flag on an Op's durable path streams one NDJSON `StepRecord`
-   * (../../op/local-executor.ts, reconstructed from workflow history by
-   * ../handlers/op-progress.ts) per settled step instead.
+   * `chant run <name> --progress-json` streams one NDJSON `StepRecord`
+   * (../../op/local-executor.ts) per settled step instead, fed by whatever
+   * the resolved runtime reports through its `progress` hook (#2121).
    *
    * Both are purely additive: run semantics, ordering, and exit code are
    * unchanged; omitted (undefined, not false) when the flag isn't passed.
@@ -173,7 +186,7 @@ export interface ParsedArgs {
    * registered in `~/.claude.json`, not just the path argument.
    */
   allProjects?: boolean;
-  /** `chant audit --fail-on merge-worthy|warning|none` */
+  /** `chant audit --fail-on merge-worthy|warning|error|none` */
   failOn?: string;
   /** `chant audit --theme <file>` — JSON theme knobs for the HTML report */
   theme?: string;
@@ -251,8 +264,10 @@ export interface ParsedArgs {
   runId?: string;
   /** `chant components release record --actor <name>` (#568) — who/what triggered the deploy. */
   actor?: string;
-  /** `--approver <name>` (#1035) — who approved a gated change. Supplied to `chant run signal` (rides the gate signal payload into workflow history) and to `chant components release` (recorded on the release ledger). Optional; absent for ungated changes. */
+  /** `--approver <name>` (#1035) — who approved a gated change. Read by `chant approve` and `chant run approve` (recorded as `resolvedBy` on the gate-resolution fact, taking precedence over `--actor`) and by `chant components release` (recorded on the release ledger). Optional; absent for ungated changes. */
   approver?: string;
+  /** `chant run approve <op> <gate> --on <lexicon> --durable-requests` (#2126) — reserved. It would resolve the gate by answering the hosting runtime's own pending request instead of posting a follow-up prompt. No runtime implements it: fountain's needs the request-answer path from BinaryBourbon/fountain#1635, which has not shipped, and refuses by name rather than reporting a resolution it did not make. */
+  durableRequests?: boolean;
   /** `chant components status <env> --compare-to <env>` (#568) — a second environment to cross-check the same component's recorded digest against. */
   compareTo?: string;
   /** `chant run --components <name> --env <env> --no-release-record` (#597) — opt out of auto-emitting a release-ledger record after a successful component deploy. Default (flag omitted): recording is ON. Also settable project-wide via `chant.config.ts`'s `release.autoRecord: false`. */
@@ -287,6 +302,8 @@ export interface ParsedArgs {
   once?: boolean;
   /** `chant approve <op> <gate> --note <text>` (#1485) — optional free-text prose recorded on the gate-resolution fact. The PR link belongs in `--url` since #2028; this is for everything that isn't the link. */
   note?: string;
+  /** `chant approve <op> <gate> --expire` (#2119) — clear the gate's standing pending fact instead of approving it, so the next run decides the gate from scratch and records a fresh one. Writes no resolution: nothing is approved, the wait is only restarted. */
+  expire?: boolean;
   /** `chant operator log --op <name>` (#2029) — restrict the tick history to one ConvergeOp by name. Omitted, every discovered ConvergeOp's ticks are merged into one timeline. */
   op?: string;
   /** `chant operator log --since <iso>` (#2029) — only entries at or after this ISO-8601 instant. */

package/src/codegen/docs.ts

@@ -325,7 +325,7 @@ export function writeDocsSite(config: DocsConfig, result: DocsResult): void {
   // Starlight does not auto-discover pages, so a page absent from the sidebar
   // is reachable only by typing its URL. The pipeline deliberately preserves
   // hand-written pages it did not emit (above), which makes it easy to add one
-  // and never wire it up — azure, temporal, helm and github each accumulated
+  // and never wire it up — azure, helm and github each accumulated
   // several that way (#1312). Report them; `chant dev check-lexicon` gates on
   // the same condition.
   const unreachable = unreachablePages(contentDir, sidebar);

package/src/codegen/generate-post-synth-barrel.test.ts

@@ -12,7 +12,7 @@ describe("generatePostSynthBarrel", () => {
 
     expect(out).toContain("// Code generated by chant generate. DO NOT EDIT.");
     expect(out).toContain('import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";');
-    // Export name may differ from the module name (docker/helm/temporal).
+    // Export name may differ from the module name (docker/helm).
     expect(out).toContain('import { dkrd010 } from "./apt-no-recommends";');
     // Array is ordered by id, not insertion order.
     const arrayBody = out.slice(out.indexOf("postSynthChecks: PostSynthCheck[] = ["));

package/src/codegen/generate-post-synth-barrel.ts

@@ -9,7 +9,7 @@
  *
  * Detection reuses the runtime's own `isPostSynthCheck`, so the barrel contains
  * exactly the checks discovery would — including files whose export name differs
- * from the filename (docker/helm/temporal) and excluding helper modules
+ * from the filename (docker/helm) and excluding helper modules
  * (cf-refs, arm-refs, …) that export no check.
  */
 

package/src/components/README.md

@@ -50,8 +50,9 @@ adopting chant.
   be a nested `Phase`, which is how fan-out (e.g. a Neo4j cluster seeding one
   node then rolling through the rest) is expressed as composition rather than
   orchestrator knowledge.
-- **Gates** — a distinct step shape (`kind: "gate"`, `signalName`) for a
-  durable, human-approval wait.
+- **Gates** — a distinct step shape (`kind: "gate"`, `signalName`) for a human
+  approval, decided against the gate ledger: a run that reaches one with no
+  resolution stops there with status `gated` and the pending fact recorded.
 - **Wiring reference forms**, all resolved by the graph, never by orchestrator
   code:
   - `$env.<path>` — environment config (e.g. `$env.registry`).

package/src/components/auto-release.test.ts

@@ -22,7 +22,6 @@ vi.mock("../lifecycle/release-ledger", async () => {
 const {
   maybeRecordAutoRelease,
   extractRunDigest,
-  extractRunDigestFromPhaseOutputs,
 } = await import("./auto-release");
 
 function publishRecord(digest: string): DriverStepRecord {
@@ -64,21 +63,6 @@ describe("extractRunDigest", () => {
   });
 });
 
-describe("extractRunDigestFromPhaseOutputs", () => {
-  test("finds the digest across phase outputs (Temporal workflow result shape)", () => {
-    expect(extractRunDigestFromPhaseOutputs({ Publish: { digest: "sha256:abc", uri: "repo@sha256:abc" }, Apply: { ok: true } })).toBe("sha256:abc");
-  });
-
-  test("returns undefined for undefined/empty phaseOutputs", () => {
-    expect(extractRunDigestFromPhaseOutputs(undefined)).toBeUndefined();
-    expect(extractRunDigestFromPhaseOutputs({})).toBeUndefined();
-  });
-
-  test("ignores a phase output carrying only a content digest (SBOM, #665)", () => {
-    expect(extractRunDigestFromPhaseOutputs({ Sbom: { digest: "sha256:sbombytes" } })).toBeUndefined();
-  });
-});
-
 describe("maybeRecordAutoRelease", () => {
   beforeEach(() => {
     getHeadCommitMock.mockReset().mockResolvedValue("abc123headsha");
@@ -111,19 +95,19 @@ describe("maybeRecordAutoRelease", () => {
     expect(pushLifecycleMock).toHaveBeenCalledTimes(1);
   });
 
-  test("a pre-resolved digest (Temporal path) takes precedence and is used directly", async () => {
+  test("a pre-resolved digest takes precedence and is used directly", async () => {
     appendReleaseRecordMock.mockResolvedValue({
       commit: "b".repeat(40),
-      record: { version: 1, component: "svc", env: "prod", digest: "sha256:temporal", gitSha: "x", runId: "r", timestamp: "t", actor: "a" },
+      record: { version: 1, component: "svc", env: "prod", digest: "sha256:preresolved", gitSha: "x", runId: "r", timestamp: "t", actor: "a" },
     });
 
     await maybeRecordAutoRelease(
-      { component: "svc", env: "prod", success: true, digest: "sha256:temporal", records: [publishRecord("sha256:ignored")], runId: "run-1" },
+      { component: "svc", env: "prod", success: true, digest: "sha256:preresolved", records: [publishRecord("sha256:ignored")], runId: "run-1" },
       { actor: "alice" },
     );
 
     const [input] = appendReleaseRecordMock.mock.calls[0];
-    expect(input.digest).toBe("sha256:temporal");
+    expect(input.digest).toBe("sha256:preresolved");
   });
 
   test("failure (run.success = false) -> writes nothing", async () => {

package/src/components/auto-release.ts

@@ -4,23 +4,19 @@
  * release ledger (../lifecycle/release-ledger.ts) was only populated by the
  * standalone `chant components release <env>` command — a deploy that never
  * called it left the ledger silently empty. This module makes recording
- * happen *by construction*: the CLI post-run step for both the local
- * executor (`runOpComponents`) and the durable Temporal path
- * (`runComponentTemporal`) calls `maybeRecordAutoRelease` after the run
- * reports success.
+ * happen *by construction*: the CLI's post-run step (`runOpComponents`)
+ * calls `maybeRecordAutoRelease` after the run reports success.
  *
  * Deliberately CLI-side, not driver-side or workflow-side:
  *  - `../components/driver.ts` stays capability-agnostic — it already
  *    resists per-component/per-capability branching, and "write to git"
  *    is exactly the kind of side effect that doesn't belong in a step
  *    dispatcher tests exercise against a bare `CapabilityRegistry`.
- *  - The Temporal workflow (lexicons/temporal/src/component-op/) must stay
- *    deterministic and replay-safe. A ledger write is a non-idempotent git
- *    push with real-world side effects (network, `Date.now()`, file writes
- *    outside workflow state) — precisely what Temporal workflow code must
- *    never do directly. It happens in the CLI, after `handle.describe()`
- *    reports a terminal COMPLETED status, the same place `runOpTemporal`
- *    already writes its deployment report post-run.
+ *  - A ledger write is a non-idempotent git push with real-world side
+ *    effects (network, `Date.now()`, file writes) — the kind of thing that
+ *    belongs at the edge of a run rather than inside a step a retry may run
+ *    a second time. It happens in the CLI, once the run has reported a
+ *    terminal outcome.
  *
  * Reuses ../lifecycle/release-ledger.ts's `appendReleaseRecord` verbatim —
  * this module only decides *whether* to call it and *what digest* to record,
@@ -72,27 +68,6 @@ export function extractRunDigest(records: DriverStepRecord[]): string | undefine
   return found;
 }
 
-/**
- * Same digest extraction as `extractRunDigest`, but over a component
- * Temporal workflow's returned `phaseOutputs` (`{ [phase]: output }`) instead
- * of a `DriverStepRecord[]` — the shape `handle.result()` resolves to for a
- * COMPLETED component workflow (see lexicons/temporal/src/component-op/
- * serializer.ts's generated `return { phaseOutputs, componentOutputs }`).
- * Used by the `--temporal` CLI path, which never sees individual step
- * records (those exist only inside the workflow/activities).
- */
-export function extractRunDigestFromPhaseOutputs(
-  phaseOutputs: Record<string, Record<string, unknown>> | undefined,
-): string | undefined {
-  let found: string | undefined;
-  for (const output of Object.values(phaseOutputs ?? {})) {
-    if (isPromotedArtifact(output) && typeof output.digest === "string") {
-      found = output.digest;
-    }
-  }
-  return found;
-}
-
 /** Explicit reasons `maybeRecordAutoRelease` declined to write a record — never a thrown error, since "nothing to record" (or "opted out") is an expected, common outcome. */
 export type AutoReleaseSkipReason =
   | "opted-out"
@@ -105,19 +80,19 @@ export type AutoReleaseResult =
   | { recorded: false; reason: AutoReleaseSkipReason; detail?: string }
   | { recorded: false; reason: "error"; error: string };
 
-/** Input describing one component's completed run, common to both the local-executor and Temporal-durable CLI paths. */
+/** Input describing one component's completed run. */
 export interface AutoReleaseRunInfo {
   component: string;
   env: string;
-  /** Whether the run reported overall success — `DriverRunResult.ok` (local) or a terminal `COMPLETED` Temporal status. A caller must not call this for a non-terminal/in-progress run. */
+  /** Whether the run reported overall success (`DriverRunResult.ok`). A caller must not call this for a non-terminal/in-progress run. */
   success: boolean;
   /** The component's step records (local executor), used to locate the published digest via `extractRunDigest`. Mutually exclusive with `digest` — pass whichever the caller already has. */
   records?: DriverStepRecord[];
-  /** A digest already resolved by the caller (e.g. the `--temporal` path, via `extractRunDigestFromPhaseOutputs` over the workflow's `handle.result()`). Takes precedence over `records` when both are given. */
+  /** A digest the caller already resolved by its own means. Takes precedence over `records` when both are given. */
   digest?: string;
-  /** Orchestrator run identifier — a Temporal `runId`, or a locally generated id for the local executor (mirrors `runComponentsReleaseRecord`'s `--run-id` default). */
+  /** Orchestrator run identifier — a hosting runtime's own run id, or a locally generated one (mirrors `runComponentsReleaseRecord`'s `--run-id` default). */
   runId: string;
-  /** The id space `runId` lives in (#2045) — `{ forge: "op" }` for a Temporal run, `{ forge: "local" }` for a local-executor mint. Recorded verbatim as the release record's `runOrigin`. */
+  /** The id space `runId` lives in (#2045) — `{ forge: "op" }` for a hosted run, `{ forge: "local" }` for a local-executor mint. Recorded verbatim as the release record's `runOrigin`. */
   runOrigin?: RunOrigin;
   /** The bypassed capability-profile divergences, when the caller deliberately overrode a deploy-time profile assertion (chant #1244) — recorded verbatim as the release record's `profileOverride`. */
   profileOverride?: string;
@@ -142,11 +117,11 @@ function resolveActor(override?: string): string | undefined {
 }
 
 /**
- * After a successful `chant run --components <name> --env <env>` (local or
- * `--temporal`), append exactly one immutable release record to the ledger
- * and push it — or explain, without throwing, why it didn't. Never called
- * for a failed run (`run.success` must be true before the caller invokes
- * this at all; see `runOpComponents`/`runComponentTemporal`) — a failed
+ * After a successful `chant run --components <name> --env <env>`, append
+ * exactly one immutable release record to the ledger and push it — or
+ * explain, without throwing, why it didn't. Never called for a failed run
+ * (`run.success` must be true before the caller invokes this at all; see
+ * `runOpComponents`) — a failed
  * deploy writes nothing, by construction, since this function is simply
  * never reached on that path.
  *

package/src/components/capability.ts

@@ -50,10 +50,10 @@ export interface Capability<In = unknown, Out = unknown> {
    * returned (#1944, epic #1564 phase 4) — a serializable identity channel a
    * capability can use to recover state `rollback` needs when it cannot rely
    * on in-process object identity between its `run`/`rollback` calls. The
-   * local interpret driver (../driver.ts) always threads it through; the
-   * durable Temporal path (lexicons/temporal/src/component-op/*.ts) threads
-   * it across the Activity boundary as plain JSON, which is exactly the case
-   * this exists for — see ./verbs/run-agent.ts's "Rollback identity" doc
+   * local interpret driver (../driver.ts) always threads it through; a
+   * hosting runtime that splits a run across process boundaries threads it
+   * across as plain JSON, which is exactly the case this exists for — see
+   * ./verbs/run-agent.ts's "Rollback identity" doc
    * comment for the motivating gap (a fresh sprite's checkpoint id, recorded
    * only in an in-process `WeakMap` keyed by `run()`'s `input` object, never
    * survives to a `rollback()` call that runs as a separate Activity with its

package/src/components/cli-support.test.ts

@@ -25,6 +25,7 @@ import {
   generateComponentsPipeline,
 } from "./cli-support";
 import { CapabilityRegistry, type DeployContext } from "./capability";
+import { memoryGateLedgerPort } from "../op/gate";
 import type { DriverComponent, RunProgressEvent } from "./driver";
 
 // A minimal stand-in for the real gitlab lexicon plugin, satisfying
@@ -587,7 +588,7 @@ describe("runComponents", () => {
     expect(result.error).toContain("svc");
   });
 
-  test("a gate in the selected component is rejected before any step runs", async () => {
+  test("a gate in the selected component ends the run pending approval (#2119)", async () => {
     await writeFile(
       join(testDir, "svc.component.ts"),
       `export const svc = { name: "svc", dependsOn: [], deploy: [
@@ -600,11 +601,15 @@ describe("runComponents", () => {
     const registry = new CapabilityRegistry();
     registry.register(capability);
 
-    const result = await runComponents(testDir, "svc", { registry });
+    const gates = memoryGateLedgerPort();
+    const result = await runComponents(testDir, "svc", { registry, gates });
 
     expect(result.success).toBe(false);
-    expect(result.gateUnsupported).toEqual({ component: "svc", signalName: "release-approval" });
-    // Pre-flighted: the deploy-thing step after the gate never ran.
+    expect(result.gated?.component).toBe("svc");
+    expect(result.gated?.gate.gate).toBe("release-approval");
+    expect(result.run?.status).toBe("gated");
+    expect(gates.appended).toHaveLength(1);
+    // Nothing after the gate ran.
     expect(capability.calls).toHaveLength(0);
   });
 
@@ -844,7 +849,7 @@ describe("resolveComponentTargets — buildParams (chant #1108)", () => {
     await rm(testDir, { recursive: true, force: true });
   });
 
-  test("forwards buildParams into discovery — the durable (--temporal) path's entrypoint", async () => {
+  test("forwards buildParams into discovery — the selector-resolution entrypoint", async () => {
     await writeFile(
       join(testDir, "svc.component.ts"),
       `

package/src/components/cli-support.ts

@@ -31,12 +31,13 @@ import {
   runComponentDeploy,
   UnknownDependencyError,
   DependencyCycleError,
-  DriverGateUnsupportedError,
   DriverRunFailure,
   type DriverComponent,
   type DriverPhase,
   type DriverRunResult,
 } from "./driver";
+import type { PendingGateRecord } from "../lifecycle/gate-ledger";
+import type { GateLedgerPort } from "../op/gate";
 import { isLexiconPlugin, type LexiconPlugin, type ComponentPipelineOptions } from "../lexicon";
 import type { RunProgressEvent } from "./run-progress";
 import { relative } from "node:path";
@@ -313,11 +314,11 @@ function toDriverComponent(component: { name: string; dependsOn: string[]; deplo
 
 /**
  * Find the first `gate` step anywhere in a component's `deploy`/`rollback`
- * composition (including nested fan-out phases), mirroring
- * `../op/local-executor.ts`'s `findGate`. Used as a pre-flight check so
- * `chant run --components` fails before any step runs — matching
- * `runOpLocal`'s behavior for Ops — rather than only failing mid-run when the
- * driver itself reaches the gated phase (`DriverGateUnsupportedError`).
+ * composition (including nested fan-out phases).
+ *
+ * A declaration-time question, not a pre-flight refusal: since #2119 the
+ * driver decides a gate against the ledger when it reaches one, so nothing
+ * needs to know up front that a component has one.
  */
 export function findComponentGate(component: DriverComponent): { signalName: string } | undefined {
   const search = (phases: DriverPhase[] | undefined): { signalName: string } | undefined => {
@@ -406,6 +407,8 @@ export interface RunComponentsOptions {
    * every test in `cli-support.test.ts`) that doesn't supply this.
    */
   buildParams?: BuildParamProvenance[];
+  /** Where a `gate` step's facts are read and written (#2119). Defaults to the `chant/lifecycle` orphan branch; a test passes `memoryGateLedgerPort()` from `../op/gate.ts`. */
+  gates?: GateLedgerPort;
 }
 
 /** Result of `chant run --components <name|all>`. */
@@ -416,8 +419,8 @@ export interface RunComponentsResult {
   /** Component names actually dispatched to the driver, in run order. */
   selected: string[];
   error?: string;
-  /** Set when a selected component (or one of its `deploy`/`rollback` phases) contains a `gate` the local executor cannot run. */
-  gateUnsupported?: { component: string; signalName: string };
+  /** Set when the run stopped at a `gate` nobody has approved (#2119): the component it stopped at and the pending fact recorded for it. */
+  gated?: { component: string; gate: PendingGateRecord };
   /** This run's resolved build-time parameters (chant #1108) — the component-driver counterpart of `../cli/commands/build.ts`'s `BuildResult.buildParams`. Present only once the run actually reached dispatch (mirrors `BuildResult.buildParams`, which is likewise absent on an early-error return). */
   buildParams?: BuildParamProvenance[];
 }
@@ -428,8 +431,7 @@ export interface RunComponentsResult {
  * local in-process executor — the CLI entrypoint the driver never had (#585,
  * follow-up to #556). Discovers the full component set first, then either:
  *  - `selector === "all"`: resolves the whole set's dependency order/waves
- *    and dispatches every component through `runInterpretDriver`, matching
- *    what the generated orchestrator Op will eventually do — the same
+ *    and dispatches every component through `runInterpretDriver`, in the same
  *    order `chant graph --components` reports.
  *  - a single name: dispatches just that component via `runComponentDeploy`,
  *    without requiring the rest of its `dependsOn` graph to be present in
@@ -441,14 +443,12 @@ export interface RunComponentsResult {
  *    infra outside the discovered set (e.g. a shared stack, per the
  *    `search-service` pilot), which is exactly the common case.
  *
- * Pre-flights every selected component for a `gate` step and fails before any
- * step runs (`gateUnsupported`), matching `runOpLocal`'s pre-flight
- * `findGate` check for Ops — gated components need a durable (Temporal)
- * backend, which is out of scope here (issue #585 scopes Temporal-backed
- * component execution to what already exists for Ops; the epic tracks
- * graduating a gated component to `--temporal` separately).
+ * A `gate` no longer refuses the run up front (#2119). The driver decides each
+ * one against the gate ledger as it reaches it; a gate nobody has approved
+ * stops the run there with `gated` set, which the CLI turns into exit code 3
+ * and the `chant approve` line.
  */
-/** Result of resolving a `<name|all>` selector against discovered components — shared by the local (`runComponents`) and durable (Temporal codegen, #589) entrypoints. */
+/** Result of resolving a `<name|all>` selector against discovered components. */
 export interface ResolvedComponentTargets {
   success: boolean;
   targets: DriverComponent[];
@@ -459,10 +459,8 @@ export interface ResolvedComponentTargets {
  * Discover every component under `path` and resolve `selector` (`"all"` or a
  * single component name) to the `DriverComponent`(s) to run, with no gate
  * check and no dispatch — just discovery + selection, factored out of
- * `runComponents` so the durable Temporal entrypoint (`chant run --components
- * <name> --temporal`, #589) can reuse the exact same selection semantics
- * without also inheriting the local executor's pre-flight gate rejection
- * (gates are exactly what the durable path exists to support).
+ * `runComponents` so another entrypoint can reuse the exact same selection
+ * semantics without inheriting the run itself.
  */
 export async function resolveComponentTargets(
   path: string,
@@ -526,17 +524,6 @@ export async function runComponents(
   }
   const targets = resolved.targets;
 
-  for (const component of targets) {
-    const gate = findComponentGate(component);
-    if (gate) {
-      return {
-        success: false,
-        selected: targets.map((c) => c.name),
-        gateUnsupported: { component: component.name, signalName: gate.signalName },
-      };
-    }
-  }
-
   // (#629) Resolve `chant.config.ts`'s `sbom`/`signing`/`vulnPolicy` sections
   // and fill their defaults into every recognized step (`generate-sbom`,
   // `sign`/`attest-provenance`, `verify`, `vuln-gate`) that didn't already
@@ -563,10 +550,25 @@ export async function runComponents(
   const seedOutputs = options.componentOutputs ?? {};
   const { onProgress } = options;
 
+  const gates = options.gates;
+
   try {
     if (selector === "all") {
-      const run = await runInterpretDriver(resolvedTargets, registry, { env, componentOutputs: seedOutputs, onProgress });
-      return { success: true, run, selected, buildParams: options.buildParams };
+      const run = await runInterpretDriver(resolvedTargets, registry, {
+        env,
+        componentOutputs: seedOutputs,
+        onProgress,
+        ...(gates ? { gates } : {}),
+      });
+      return {
+        success: run.status === "ok",
+        run,
+        selected,
+        buildParams: options.buildParams,
+        ...(run.status === "gated" && run.gate
+          ? { gated: { component: run.gatedComponent ?? selected[0], gate: run.gate } }
+          : {}),
+      };
     }
 
     // Single-component invocation: run just this component, bypassing
@@ -592,8 +594,9 @@ export async function runComponents(
       registry,
       componentOutputs,
       onProgress,
+      gates ? { port: gates } : undefined,
     );
-    const status: "ok" | "failed" = componentResult.ok ? "ok" : "failed";
+    const status = componentResult.status === "fail" ? "failed" : componentResult.status;
     onProgress?.({ type: "component-done", wave: 1, component: componentName, status });
     onProgress?.({ type: "wave-done", wave: 1, status });
     onProgress?.({ type: "run-done", status });
@@ -602,21 +605,26 @@ export async function runComponents(
       waves: [selected],
       results: [componentResult],
       ok: componentResult.ok,
-      failedComponent: componentResult.ok ? undefined : componentResult.component,
+      status: componentResult.status,
+      failedComponent: componentResult.status === "fail" ? componentResult.component : undefined,
+      ...(componentResult.status === "gated"
+        ? { gatedComponent: componentResult.component, gate: componentResult.gate }
+        : {}),
       componentOutputs,
     };
-    return { success: componentResult.ok, run, selected, buildParams: options.buildParams };
+    return {
+      success: componentResult.ok,
+      run,
+      selected,
+      buildParams: options.buildParams,
+      ...(componentResult.status === "gated" && componentResult.gate
+        ? { gated: { component: componentResult.component, gate: componentResult.gate } }
+        : {}),
+    };
   } catch (err) {
     if (err instanceof DriverRunFailure) {
       return { success: false, run: err.result, selected, error: err.message };
     }
-    if (err instanceof DriverGateUnsupportedError) {
-      return {
-        success: false,
-        selected,
-        gateUnsupported: { component: err.component, signalName: err.signalName },
-      };
-    }
     if (err instanceof UnknownDependencyError || err instanceof DependencyCycleError) {
       return { success: false, selected, error: err.message };
     }

package/src/components/component.schema.json

@@ -162,7 +162,7 @@
 
     "Gate": {
       "type": "object",
-      "description": "Pauses the composition for an external signal (typically human approval) before continuing. A gate in a component's composition requires the durable (Temporal) execution backend; it cannot run on the local in-process executor.",
+      "description": "Ends the run pending human approval. The driver decides a gate against the gate ledger when it reaches one; a gate nobody has approved stops the run there, and `chant approve <component> <gate>` records the resolution the next run reads.",
       "required": ["kind", "signalName"],
       "additionalProperties": false,
       "properties": {
@@ -170,7 +170,7 @@
         "signalName": {
           "type": "string",
           "minLength": 1,
-          "description": "Signal name the generated workflow waits for before continuing."
+          "description": "The gate's name — what `chant approve <component> <gate>` resolves."
         },
         "timeout": {
           "type": "string",

package/src/components/component.ts

@@ -77,11 +77,11 @@ export interface Step {
   [param: string]: unknown;
 }
 
-/** Mirrors `$defs.Gate` — pauses the composition for an external signal (typically human approval). */
+/** Mirrors `$defs.Gate` — a human approval decided against the gate ledger; the run stops here with status `gated` until `chant approve` has answered it. */
 export interface Gate {
   kind: "gate";
   signalName: string;
-  /** Duration string bounding the wait, e.g. "48h". Default: "48h". */
+  /** How long a recorded pending gate stays valid, as a duration string. Default: "48h". */
   timeout?: string;
   /** Human-readable description of the action required to unblock this gate. */
   description?: string;
@@ -170,7 +170,7 @@ export function phase(name: string, steps: Array<Step | Gate | Phase>, opts?: {
   return { phase: name, steps, ...(opts?.parallel ? { parallel: true } : {}) };
 }
 
-/** Author a gate step — pauses the composition for an external signal (typically human approval). */
+/** Author a gate step — a human approval the driver decides against the gate ledger, stopping the run `gated` when nothing has answered it. */
 export function gate(signalName: string, opts?: { timeout?: string; description?: string }): Gate {
   return { kind: "gate", signalName, ...opts };
 }

package/src/components/driver-output.ts

@@ -51,15 +51,27 @@ export function renderDriverHuman(result: DriverRunResult, write: Writer = stder
       } else {
         write(`    ${mark} ${record.kind}   ${formatDuration(record.durationMs)}`);
       }
+      if (record.approval) {
+        write(`      [approved] ${record.approval.resolvedBy} at ${record.approval.timestamp}` +
+          (record.approval.url ? ` (${record.approval.url})` : ""));
+      }
       if (record.error) {
         write(`      ${record.error}`);
       }
     }
-    write(componentResult.ok ? `  component "${componentResult.component}" completed` : `  component "${componentResult.component}" failed`);
+    write(
+      componentResult.status === "ok"
+        ? `  component "${componentResult.component}" completed`
+        : componentResult.status === "gated"
+          ? `  component "${componentResult.component}" gated on "${componentResult.gate?.gate ?? "?"}"`
+          : `  component "${componentResult.component}" failed`,
+    );
   }
 
-  if (result.ok) {
+  if (result.status === "ok") {
     write(`interpret run completed (${result.order.length} component(s))`);
+  } else if (result.status === "gated") {
+    write(`interpret run is gated at component "${result.gatedComponent}"`);
   } else {
     write(`interpret run failed at component "${result.failedComponent}"`);
   }