@intentius/chant 0.57.0 → 0.58.0

package/dist/lifecycle/gate-ledger.d.ts

@@ -33,11 +33,13 @@ export declare function isApprovalUrl(raw: string): boolean;
 export interface GateResolutionRecord {
     /** Schema version, so an incompatible future shape is detected before being misread. */
     version: 1;
+    /** Discriminator against {@link PendingGateRecord}, which shares this file. Absent on every line written before #2119, so a reader must treat "no kind" as `"resolution"`. */
+    kind?: "resolution";
     /** The dispatched op the gate belongs to. */
     op: string;
     /** The gate's signal name (matches `ConvergeRuleOutcome.gateName`). */
     gate: string;
-    /** Who resolved it — an actor name, the same convention `components release --actor` and `run signal --approver` use. */
+    /** Who resolved it — an actor name, the same convention `components release --actor` and `run approve --approver` use. */
     resolvedBy: string;
     /** ISO-8601 timestamp, caller-supplied (library code never calls `Date.now()` internally). */
     timestamp: string;
@@ -55,7 +57,46 @@ export interface GateResolutionRecord {
      */
     url?: string;
 }
-export type GateResolutionInput = Omit<GateResolutionRecord, "version">;
+export type GateResolutionInput = Omit<GateResolutionRecord, "version" | "kind">;
+/**
+ * One immutable pending-gate record (#2119) — what an executor writes when a
+ * run reaches a `gate` step with no resolution standing against it. The run
+ * ends here with status `gated`; this line is the durable trace of that, and
+ * the anchor a later {@link GateResolutionRecord} has to be newer than to
+ * count as its answer.
+ *
+ * Idempotent by design: a run that finds a live (unexpired) pending fact for
+ * the same gate reuses it rather than appending a second one, so a converge
+ * loop ticking every minute against an unapproved gate does not grow the
+ * ledger by a line a minute. Once `expiresAt` passes, the fact is stale and
+ * the next run records a fresh one.
+ */
+export interface PendingGateRecord {
+    /** Schema version, so an incompatible future shape is detected before being misread. */
+    version: 1;
+    kind: "pending";
+    /** The op (or, on the component driver, the component) the gate belongs to. */
+    op: string;
+    /** The gate's signal name (matches `GateStep.signalName`). */
+    gate: string;
+    /** The gate's human-readable description, when it declared one — what `chant operator status` shows a reader who wasn't there for the run. */
+    description?: string;
+    /** The run that reached the gate, when the caller identifies its runs. */
+    runId?: string;
+    /** ISO-8601 timestamp, caller-supplied (library code never calls `Date.now()` internally). */
+    timestamp: string;
+    /** ISO-8601 expiry, from the gate's `timeout` (default {@link DEFAULT_GATE_EXPIRY}). Past it, the fact is stale and a run re-records it. */
+    expiresAt: string;
+    /** The address approval happens at, when the run knew one — see {@link resolveApprovalUrl}. */
+    url?: string;
+}
+export type PendingGateInput = Omit<PendingGateRecord, "version" | "kind">;
+/** Either kind of line in `_gates/<op>.jsonl`. */
+export type GateLedgerRecord = GateResolutionRecord | PendingGateRecord;
+/** The default a gate's pending fact expires after when its `GateStep` declares no `timeout` — the same 48h `GateStep.timeout` documents as its own default. */
+export declare const DEFAULT_GATE_EXPIRY = "48h";
+/** Whether a pending fact has aged out of relevance at `nowIso`. */
+export declare function isPendingGateExpired(record: PendingGateRecord, nowIso: string): boolean;
 /** Append one immutable gate-resolution record. Does not push to the remote — call `pushLifecycle` (./git.ts) afterward, same two-step shape every other ledger write here uses. Retries on `RefCASConflictError` the same way `appendConvergeRecord` does (./converge-ledger.ts) — a concurrent writer to a different op's/env's file on the same orphan branch is the ordinary case, not an edge case. The baseline read must be `readPathSha` + `readBlobBySha` rather than `readBlobFromPath`, so the exact sha `existing` came from can be passed as `expectPriorPathSha` — see `writeBlobToPath` (./git.ts) for the race that closes. */
 export declare function appendGateResolution(input: GateResolutionInput, opts?: {
     cwd?: string;
@@ -63,13 +104,40 @@ export declare function appendGateResolution(input: GateResolutionInput, opts?:
     commit: string;
     record: GateResolutionRecord;
 }>;
-/** Read every gate-resolution record for `op`, oldest first. Malformed lines are skipped, not thrown on, the same graceful-degradation stance `readConvergeLedger` takes. Returns `[]` (never throws) when `op` has no resolutions recorded yet. */
+/**
+ * Append one immutable pending-gate record (#2119) — the fact a run leaves
+ * behind when it reaches a gate nobody has approved. Same file, same
+ * append-and-retry discipline, same "does not push" contract as
+ * {@link appendGateResolution}.
+ */
+export declare function appendPendingGate(input: PendingGateInput, opts?: {
+    cwd?: string;
+}): Promise<{
+    commit: string;
+    record: PendingGateRecord;
+}>;
+/**
+ * Read every line of `op`'s gate file, oldest first, split into the two kinds
+ * (#2119). Malformed lines are skipped and counted, not thrown on — the same
+ * graceful-degradation stance `readConvergeLedger` takes. Returns empty arrays
+ * (never throws) when `op` has nothing recorded yet.
+ */
+export declare function readGateLedger(op: string, opts?: {
+    cwd?: string;
+}): Promise<{
+    resolutions: GateResolutionRecord[];
+    pending: PendingGateRecord[];
+    malformed: number;
+}>;
+/** Read every gate-*resolution* record for `op`, oldest first — {@link readGateLedger} narrowed to the half every caller before #2119 wanted. Pending facts are not malformed lines and are not counted as such. */
 export declare function readGateResolutions(op: string, opts?: {
     cwd?: string;
 }): Promise<{
     records: GateResolutionRecord[];
     malformed: number;
 }>;
+/** The most recent pending fact for `gate`, expired or not — the anchor {@link latestResolutionSince} measures a resolution against. `undefined` when the gate has never been recorded pending. */
+export declare function latestPendingGate(records: PendingGateRecord[], gate: string): PendingGateRecord | undefined;
 /** The most recent resolution for `gate` recorded after `sinceIso` (a gated tick's own timestamp) — what `chant operator status` uses to tell a resolved gate from a still-pending one. `undefined` when no such resolution exists. */
 export declare function latestResolutionSince(records: GateResolutionRecord[], gate: string, sinceIso: string): GateResolutionRecord | undefined;
 //# sourceMappingURL=gate-ledger.d.ts.map

package/dist/lifecycle/gate-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA4CA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAY3F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,yHAAyH;IACzH,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAMxE,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAqB3D;AAED,oPAAoP;AACpP,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BjE;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}
+{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA0CA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAY3F;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOlD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,8KAA8K;IAC9K,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,0HAA0H;IAC1H,UAAU,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,8IAA8I;IAC9I,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,4IAA4I;IAC5I,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAE3E,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAExE,gKAAgK;AAChK,eAAO,MAAM,mBAAmB,QAAQ,CAAC;AAEzC,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEvF;AAMD,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAI3D;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAIxD;AA2BD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAqCnG;AAED,oNAAoN;AACpN,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAGjE;AAED,mMAAmM;AACnM,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,iBAAiB,EAAE,EAC5B,IAAI,EAAE,MAAM,GACX,iBAAiB,GAAG,SAAS,CAO/B;AAED,uOAAuO;AACvO,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,oBAAoB,GAAG,SAAS,CASlC"}

package/dist/lifecycle/index.d.ts

@@ -20,6 +20,7 @@ export * from "./teardown.js";
 export * from "./assert-live.js";
 export * from "./symptoms.js";
 export * from "./converge-ledger.js";
+export * from "./run-ledger.js";
 export * from "./scenario.js";
 export * from "./scenario-eval.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lifecycle/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lifecycle/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lifecycle/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,OAAO,CAAC;AACtB,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,wBAAwB,CAAC;AACvC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/lifecycle/release-ledger.d.ts

@@ -93,8 +93,8 @@ export interface ReleaseRecord {
     /**
      * Who approved the change at its durable approval gate (#1035). Populated for
      * a gated change — the same identity the approver supplied when they cleared
-     * the Temporal gate (`chant run signal ... --approver`, carried in the gate
-     * signal payload and thus the workflow history). Optional and omitted for an
+     * the gate (`chant approve <op> <gate> --approver`, recorded on the gate
+     * resolution fact). Optional and omitted for an
      * ungated change (nothing to approve), so `actor` alone answers "who made
      * it" while `approver` answers "who approved it" only where a gate exists.
      * Distinct from `actor`: the approver is deliberately a different person than

package/dist/lifecycle/run-ledger.d.ts

@@ -0,0 +1,53 @@
+import type { OpConfig } from "../op/types.js";
+import type { StepRecord } from "../op/local-executor.js";
+import type { OpRunRecord, OpRunRecordInput } from "../op/runtime.js";
+/** The env a run records against when its Op declares no `labels.Env`. */
+export declare const DEFAULT_RUN_ENV = "local";
+/** The env a run records against: the Op's own `labels.Env`, else {@link DEFAULT_RUN_ENV}. */
+export declare function runEnvOf(config: Pick<OpConfig, "labels">): string;
+/**
+ * Fold a run's step records into the ledger shape, pure — no clock, no git.
+ * `started`/`ended` are supplied by the caller for the same reason
+ * `ConvergeTickRecord.timestamp` is: library code here never calls
+ * `Date.now()` itself.
+ *
+ * Phases are grouped by `StepRecord.phase` in first-seen order, which is
+ * execution order for the sequential path and the authored order for a
+ * parallel one. A compensation (`onFailure`) phase appears after the phase
+ * that failed, exactly where the executor emitted its records.
+ */
+export declare function buildRunRecord(config: Pick<OpConfig, "name" | "labels">, records: readonly StepRecord[], times: {
+    started: string;
+    ended: string;
+    status: OpRunRecord["status"];
+    id?: string;
+    gate?: OpRunRecord["gate"];
+}): OpRunRecordInput;
+/**
+ * Append one immutable run record. Does not push to the remote — call
+ * `pushLifecycle` (./git.ts) afterward, the two-step shape every ledger here
+ * uses.
+ *
+ * Mints `record.id` when the input carries none, and retries the whole
+ * read-modify-write on `RefCASConflictError` re-reading fresh each attempt —
+ * see `appendConvergeRecord`'s doc for why both of those live in the append
+ * function rather than in its callers.
+ */
+export declare function appendRunRecord(input: OpRunRecordInput, opts?: {
+    cwd?: string;
+}): Promise<{
+    commit: string;
+    record: OpRunRecord;
+}>;
+/**
+ * Read every run record for `op` in `environment`, oldest first. Malformed
+ * lines are skipped and counted, never thrown on — a hand-edited or truncated
+ * ledger degrades to a shorter history, the stance every ledger here takes.
+ */
+export declare function readRunLedger(environment: string, op: string, opts?: {
+    cwd?: string;
+}): Promise<{
+    records: OpRunRecord[];
+    malformed: number;
+}>;
+//# sourceMappingURL=run-ledger.d.ts.map

package/dist/lifecycle/run-ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAqC,MAAM,eAAe,CAAC;AAStG,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5B,GACA,gBAAgB,CAoClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BxD"}

package/dist/lifecycle/symptoms.d.ts

@@ -8,8 +8,8 @@
  * `LexiconPlugin.symptoms?()` interface in v1 — everything here is a pure
  * projection of structures chant already computes (`ChangeSet`,
  * `ComponentStatusRow[]`). No I/O in this module; a caller (the `convergeTick`
- * activity, lexicons/temporal/src/op/activities/converge.ts) gathers those
- * inputs and hands them here.
+ * activity, ../op/activities/converge.ts) gathers those inputs and hands them
+ * here.
  *
  * One record per tick, not per component: the issue's own rule sketch reads
  * `s.status`/`s.backupVerifiedAge` as a single symptom `s` a rule closes
@@ -58,6 +58,6 @@ export interface ConvergeSymptom {
  * `ConvergeSymptom`. Pure — no I/O.
  */
 export declare function deriveSymptoms(env: string, cs: ChangeSet, statusRows: ComponentStatusRow[]): ConvergeSymptom;
-/** Every field name a `ConvergeSymptom` produces — the runtime whitelist `TMP014` (lexicons/temporal) re-validates a serialized rule table's predicates against. Kept in sync with {@link ConvergeSymptom} by hand (deliberately small, changes rarely). */
+/** Every field name a `ConvergeSymptom` produces — the runtime whitelist `OPS014` (packages/core/src/lint/rules/op/ops014-converge-rule-refusals.ts) re-validates a serialized rule table's predicates against. Kept in sync with {@link ConvergeSymptom} by hand (deliberately small, changes rarely). */
 export declare const CONVERGE_SYMPTOM_FIELDS: ReadonlySet<string>;
 //# sourceMappingURL=symptoms.d.ts.map

package/dist/lifecycle/symptoms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symptoms.d.ts","sourceRoot":"","sources":["../../src/lifecycle/symptoms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAkB7E,qKAAqK;AACrK,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAM5F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,gHAAgH;IAChH,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,wIAAwI;IACxI,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,wLAAwL;IACxL,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAwB5G;AAED,4PAA4P;AAC5P,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAatD,CAAC"}
+{"version":3,"file":"symptoms.d.ts","sourceRoot":"","sources":["../../src/lifecycle/symptoms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAgB,SAAS,EAAE,MAAM,cAAc,CAAC;AAE5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAkB7E,qKAAqK;AACrK,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAM5F;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,gHAAgH;IAChH,MAAM,EAAE,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC7C,wIAAwI;IACxI,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,wLAAwL;IACxL,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,eAAe,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACtC,kGAAkG;IAClG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,eAAe,CAwB5G;AAED,2SAA2S;AAC3S,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAatD,CAAC"}

package/dist/lint/config.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import type { Severity, RuleConfig } from "./rule.js";
 import type { PostSynthDiagnostic } from "./post-synth.js";
+import { type RuleMeta } from "../audit/catalog.js";
 export { findProjectRoot } from "../project-root.js";
 export declare const LintConfigSchema: z.ZodObject<{
     rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodEnum<{
@@ -31,6 +32,7 @@ export declare const LintConfigSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     plugins: z.ZodOptional<z.ZodArray<z.ZodString>>;
     policies: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    presets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 /**
  * Per-file rule override
@@ -61,6 +63,23 @@ export interface LintConfig {
      * phase; same engine.
      */
     policies?: string[];
+    /**
+     * Lexicon name mapped to a preset name (chant #2113), e.g.
+     * `{ terraform: "recommended" }`. A preset is a lexicon's own bundle of
+     * post-synth check ids. tflint ships `recommended` (a subset) and `all`
+     * for its Terraform-language rules the same way, and a lexicon that ships
+     * one exposes it through its plugin's `lintPresets()` (`../lexicon.ts`).
+     * Naming a preset here changes which of that lexicon's post-synth findings
+     * are reported at all, distinct from `rules`, which changes an
+     * already-reported finding's severity. A rule a preset excludes is not
+     * suppressed (it never runs the severity-override gauntlet in the first
+     * place), but an explicit `rules` entry for it always wins and re-enables
+     * it regardless of the active preset, see `resolvePresetIds`/
+     * `applyConfiguredPreset` below. Unset, or naming a preset the lexicon
+     * does not export, falls back to `"recommended"`. A lexicon that ships no
+     * presets at all is unaffected by this field, same as today.
+     */
+    presets?: Record<string, string>;
 }
 /**
  * Parsed rule configuration with severity and optional options
@@ -96,8 +115,17 @@ export declare function parseRuleConfig(value: RuleConfig): ParsedRuleConfig;
  * checks have no per-file scope to begin with (see {@link
  * ./post-synth.ts!PostSynthDiagnostic}'s doc for why), so they always pass
  * `config.rules` directly.
+ *
+ * `catalog` (chant #2113) is optional and off by default: pass a resolved
+ * audit catalog to also honor a `rules` key that names one of `id`'s
+ * `RuleMeta.aliases` rather than `id` itself. A project's
+ * `lint.rules: { OLD_ID: "off" }` then keeps suppressing the rule after it
+ * is renamed/renumbered, instead of silently starting to match nothing. Every
+ * existing call site omits `catalog` and is unaffected; a caller that has one
+ * handy (an audit-shaped consumer, not `chant build`'s post-synth loop, which
+ * has no catalog readily resolved at that point) opts in by passing it.
  */
-export declare function resolveConfiguredSeverity(rules: Record<string, RuleConfig> | undefined, id: string, defaultSeverity: Severity): ParsedRuleConfig;
+export declare function resolveConfiguredSeverity(rules: Record<string, RuleConfig> | undefined, id: string, defaultSeverity: Severity, catalog?: Record<string, RuleMeta>): ParsedRuleConfig;
 /**
  * Default configuration with all rules enabled at strict preset severities
  */
@@ -182,6 +210,57 @@ export interface PostSynthSeverityResult {
  * remove. Config severity (`"off"`) is the one suppression surface this can
  * offer uniformly; a check that wants a per-instance escape hatch can read
  * `ctx.env`/its own options to decide not to emit a diagnostic at all.
+ *
+ * chant #2111 adds a second, narrower surface next to this one:
+ * `./suppressions.ts`'s `applyInlineSuppressions` matches `diag.entity`
+ * against `ctx.entities` (a source-level map key every `PostSynthContext`
+ * carries) instead of a name in the synthesized output, so it sidesteps the
+ * exact mismatch this comment describes. It is opt-in per lexicon (an entity
+ * has to carry a `suppressions` field) and runs as its own pass, right after
+ * this one, in both `chant build` and `chant audit`. See that module's doc
+ * for the full reasoning.
+ *
+ * `catalog` (chant #2113, optional) passes straight through to
+ * `resolveConfiguredSeverity` above for alias resolution; see its doc for
+ * what that buys and why it's opt-in.
+ */
+export declare function applyConfiguredSeverity(diagnostics: readonly PostSynthDiagnostic[], rules: Record<string, RuleConfig> | undefined, catalog?: Record<string, RuleMeta>): PostSynthSeverityResult;
+/**
+ * Result of applying a lexicon preset to a set of post-synth diagnostics.
+ * Shaped like {@link PostSynthSeverityResult} so a caller threading both
+ * through (a preset filter, then a severity override) handles them the same
+ * way. See `applyConfiguredPreset` below.
+ */
+export interface PostSynthPresetResult {
+    /** Diagnostics whose check id the active preset enables (or that `rules` explicitly configures, see below). */
+    diagnostics: PostSynthDiagnostic[];
+    /** Diagnostics the active preset excluded, unaltered. Countable rather than silently dropped, mirroring `PostSynthSeverityResult.suppressed`. */
+    suppressed: PostSynthDiagnostic[];
+}
+/**
+ * Resolve `lint.presets`' name for one lexicon into the set of check ids that
+ * preset enables (chant #2113). `presets` is what a lexicon plugin's
+ * `lintPresets()` returns (`../lexicon.ts`). A lexicon that ships none
+ * passes `undefined` here, in which case this returns `undefined` and
+ * `applyConfiguredPreset` below becomes a no-op (every rule reports, exactly
+ * today's behavior for a lexicon this feature doesn't touch).
+ *
+ * An unrecognized preset name (a typo, or a name the lexicon doesn't define)
+ * also returns `undefined` rather than an empty set. Falling back to
+ * unfiltered is the safe failure direction; silently reporting nothing would
+ * not be.
+ */
+export declare function resolvePresetIds(presets: Record<string, string[]> | undefined, presetName: string): Set<string> | undefined;
+/**
+ * Filter post-synth diagnostics down to an active preset's ids (chant
+ * #2113). `presetIds` is `resolvePresetIds`'s output. `undefined` disables
+ * filtering entirely (a lexicon with no presets, or an unresolved preset
+ * name), matching tflint's own precedence chain (`--only` / rule config,
+ * then preset, then `disabled_by_default`, `tflint-ruleset-terraform`'s
+ * config docs): an explicit `lint.rules` entry for a check id always keeps
+ * that id's findings, whether or not the active preset includes it, so a
+ * project can opt a single report-only rule back in under `recommended`
+ * without switching its whole lexicon to `all`.
  */
-export declare function applyConfiguredSeverity(diagnostics: readonly PostSynthDiagnostic[], rules: Record<string, RuleConfig> | undefined): PostSynthSeverityResult;
+export declare function applyConfiguredPreset(diagnostics: readonly PostSynthDiagnostic[], presetIds: Set<string> | undefined, rules: Record<string, RuleConfig> | undefined): PostSynthPresetResult;
 //# sourceMappingURL=config.d.ts.map

package/dist/lint/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AASxD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,EAC7C,EAAE,EAAE,MAAM,EACV,eAAe,EAAE,QAAQ,GACxB,gBAAgB,CAIlB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,uHAAuH;IACvH,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,GAC5C,uBAAuB,CAczB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lint/config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAQlE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAiBlD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAU3B,CAAC;AAkGH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnC,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,gDAAgD;IAChD,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAsBnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,EAC7C,EAAE,EAAE,MAAM,EACV,eAAe,EAAE,QAAQ,EACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GACjC,gBAAgB,CASlB;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAG5B,CAAC;AA0HF;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAkClD;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAkBpG;AAED,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,uHAAuH;IACvH,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC;;;;;OAKG;IACH,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,EAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GACjC,uBAAuB,CAczB;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,+GAA+G;IAC/G,WAAW,EAAE,mBAAmB,EAAE,CAAC;IACnC,iJAAiJ;IACjJ,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,EAC7C,UAAU,EAAE,MAAM,GACjB,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAGzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,SAAS,mBAAmB,EAAE,EAC3C,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,EAClC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,SAAS,GAC5C,qBAAqB,CAUvB"}

package/dist/lint/post-synth.d.ts

@@ -1,4 +1,5 @@
 import type { Declarable } from "../declarable.js";
+import type { ActivityContract } from "../op/activity-contract.js";
 import type { SerializerResult } from "../serializer.js";
 import type { Severity } from "./rule.js";
 import { type OutputDoc } from "./output-docs.js";
@@ -36,6 +37,22 @@ export interface PostSynthContext {
      * with `ctx.docs ?? []` only when a context's provenance is unknown.
      */
     readonly docs?: OutputDoc[];
+    /**
+     * Activity contracts resolved across every lexicon this build configured
+     * (chant #2101), keyed by activity name — core's own plus whatever each
+     * lexicon contributes at `@intentius/chant-lexicon-<name>/op/activity-contracts`
+     * or through its plugin. Filled in by `chant build`, `chant lint` and
+     * `check-lexicon`'s example harness via `loadActivityContracts`.
+     *
+     * The checks that validate Op steps against contracts (OPS012 and OPS013,
+     * `./rules/op/`) merge this over their own statically imported table with
+     * `mergeActivityContracts`, so an Op calling `terraformPlan` or
+     * `k3sInstall` validates against the contract the owning lexicon declared
+     * instead of failing for the absence of one. Optional, and absent from a
+     * hand-built context: a check must behave as it did before this existed
+     * when it is `undefined`.
+     */
+    readonly activityContracts?: ReadonlyMap<string, ActivityContract>;
     /** Raw build result object */
     buildResult: {
         outputs: Map<string, string | SerializerResult>;
@@ -87,6 +104,14 @@ export declare function getAdditionalFiles(output: string | SerializerResult): R
  * comment (`chant-disable`) suppression is out of scope for post-synth
  * findings — see `./config.ts`'s `applyConfiguredSeverity` doc for the full
  * reasoning and what suppression surface post-synth findings get instead.
+ *
+ * chant #2111 finds a narrower anchor that does generalize: `./suppressions.ts`'s
+ * `applyInlineSuppressions` matches `entity` against `ctx.entities` (a map key
+ * every context already carries, source-level, before serialization), not
+ * against a name in the synthesized OUTPUT. A lexicon whose entities carry a
+ * `suppressions` field (see that file's module doc) gets inline `# chant-
+ * ignore`-style comments this way; one that doesn't is unaffected, and this
+ * interface's own contract (no `file`/`line`) is unchanged either way.
  */
 export interface PostSynthDiagnostic {
     /** ID of the check that produced this diagnostic */
@@ -103,6 +128,30 @@ export interface PostSynthDiagnostic {
     entity?: string;
     /** Optional lexicon related to this diagnostic */
     lexicon?: string;
+    /**
+     * Set when the finding is that something does not exist, rather than that
+     * something present is wrong (chant #2113). TF001 (no remote backend) is
+     * the motivating case: there is no resource to set `entity` to, only the
+     * scope that is missing one. Snyk's policy-engine spec names this the
+     * "missing-resource" archetype (a `deny` whose `info` carries a
+     * `resource_type` instead of a `resource`, because there is nothing to
+     * attach to) and is the only tool in chant's TF-family survey with a
+     * first-class shape for it; trivy's own inline-ignore comments admit they
+     * cannot suppress an absence finding for exactly this reason. `kind` names
+     * what is missing (a `backend`/`cloud` block, a required resource type);
+     * `scope` names where it is missing (a root module name, a file). Renders
+     * distinctly in all three reporters (stylish/JSON/SARIF, `../cli/commands/
+     * audit.ts` and `../audit/report-model.ts`) instead of falling back to
+     * `entity`, and gives #2111's HCL suppression a block-anchored key to
+     * suppress an absence finding by (the block that *should* declare `kind`
+     * inside `scope`), independent of whatever `entity` this diagnostic sets.
+     */
+    missing?: {
+        /** What kind of thing is absent (e.g. `"backend"`, `"cloud"`). */
+        kind: string;
+        /** Where it is missing from (e.g. a root module name). */
+        scope: string;
+    };
 }
 /**
  * A post-synthesis check that validates build output. Lexicons ship these as
@@ -121,7 +170,11 @@ export interface PostSynthCheck {
 export declare function isPostSynthCheck(value: unknown): value is PostSynthCheck;
 /**
  * Run a set of post-synthesis checks against a build result. `env` is threaded
- * into the context so a check can branch on the current environment/stack.
+ * into the context so a check can branch on the current environment/stack, and
+ * `opts.activityContracts` (chant #2101) carries the build's cross-lexicon
+ * activity-contract map to the checks that validate Op steps against it.
  */
-export declare function runPostSynthChecks(checks: PostSynthCheck[], buildResult: PostSynthContext["buildResult"], env?: string): PostSynthDiagnostic[];
+export declare function runPostSynthChecks(checks: PostSynthCheck[], buildResult: PostSynthContext["buildResult"], env?: string, opts?: {
+    activityContracts?: ReadonlyMap<string, ActivityContract>;
+}): PostSynthDiagnostic[];
 //# sourceMappingURL=post-synth.d.ts.map

package/dist/lint/post-synth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5B,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,GAC9C,MAAM,SAAS,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5F;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,GACX,mBAAmB,EAAE,CAiBvB"}
+{"version":3,"file":"post-synth.d.ts","sourceRoot":"","sources":["../../src/lint/post-synth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;IAChD,8CAA8C;IAC9C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACnE,8BAA8B;IAC9B,WAAW,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,CAAC;QAChD,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjD,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAAC,GAC9C,MAAM,SAAS,EAAE,CAQnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAE1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE5F;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,6BAA6B;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,EAAE;QACR,kEAAkE;QAClE,IAAI,EAAE,MAAM,CAAC;QACb,0DAA0D;QAC1D,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,mBAAmB,EAAE,CAAC;CACrD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAQxE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,cAAc,EAAE,EACxB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,GAAG,CAAC,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;CAAE,GACnE,mBAAmB,EAAE,CAkBvB"}

package/dist/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.d.ts

@@ -1,4 +1,4 @@
 import type { Component } from "../../../../../../components/component.js";
-/** COMP004 pass case: a genuine gate, opted out via a file-level disable directive with a documented reason — the intended path for a component that graduates to the Temporal backend. */
+/** COMP004 pass case: a genuine gate, opted out via a file-level disable directive with a documented reason — the intended path for a component whose rollout genuinely waits on a person. */
 export declare const neo4jCluster: Component;
 //# sourceMappingURL=neo4j-cluster.component.d.ts.map

package/dist/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"neo4j-cluster.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,2LAA2L;AAC3L,eAAO,MAAM,YAAY,EAAE,SAiB1B,CAAC"}
+{"version":3,"file":"neo4j-cluster.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/neo4j-cluster.component.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,8LAA8L;AAC9L,eAAO,MAAM,YAAY,EAAE,SAiB1B,CAAC"}

package/dist/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.d.ts

@@ -1,4 +1,4 @@
 import type { Component } from "../../../../../../components/component.js";
-/** COMP004 pass case: no gate step anywhere — nothing requires the durable backend. */
+/** COMP004 pass case: no gate step anywhere — nothing here stops the run for a person. */
 export declare const ordersTable: Component;
 //# sourceMappingURL=orders-table.component.d.ts.map

package/dist/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orders-table.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,uFAAuF;AACvF,eAAO,MAAM,WAAW,EAAE,SAKzB,CAAC"}
+{"version":3,"file":"orders-table.component.d.ts","sourceRoot":"","sources":["../../../../../../../src/lint/rules/__fixtures__/comp/comp004/pass/orders-table.component.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGxE,0FAA0F;AAC1F,eAAO,MAAM,WAAW,EAAE,SAKzB,CAAC"}

package/dist/lint/rules/comp/comp004-gate-needs-durable-runtime.d.ts

@@ -0,0 +1,44 @@
+/**
+ * COMP004: gate-needs-durable-runtime (the file is renamed in #2116; the
+ * behaviour changed in #2119)
+ *
+ * The file name and the exported symbol keep the old wording on purpose
+ * (#2195): the id is what an author writes in a `chant-disable` comment and
+ * what every import names, and churning both buys nothing. `description`
+ * below is the accurate sentence, and it is what the docs page uses as its
+ * heading — since #2119 the rule has nothing to do with which runtime hosts
+ * the run.
+ *
+ * Flags a `gate` step anywhere in a component's composition — the point where
+ * a run stops and waits for a person. Since #2119 that is not a refusal: the
+ * driver decides the gate against the gate ledger (`../../../op/gate.ts`), and
+ * one nobody has approved ends the run pending `chant approve <component>
+ * <gate>`, to be re-decided next run.
+ *
+ * The rule survives the change because what it flags survives it. The
+ * component contract has no per-component runtime field (the runtime is chosen
+ * per *run*, via `chant run --on`, intentionally not part of the declaration),
+ * so lint cannot tell from the declaration alone that a `gate` is deliberate;
+ * every one is a standing "this component stops for a human" fact worth
+ * surfacing, not a mistake to silently allow. Acknowledge it explicitly with a
+ * **file-level**
+ * disable directive once the human wait is genuinely intended (see
+ * lint-rules/disable-directives.mdx) — a COMP* diagnostic carries no real
+ * line/column (it is reported for the whole component; see
+ * ../../component-checks.ts), so only the file-level `chant-disable` form is
+ * honored for these rules — `-line`/`-next-line` do not suppress a COMP*
+ * diagnostic (see ../../../cli/commands/lint.ts's
+ * `runComponentCheckDiagnostics`):
+ *
+ * ```ts
+ * // chant-disable COMP004 -- the rollout waits on a release manager's approval
+ * ```
+ *
+ * Triggers on: any `gate` step in `deploy`/`rollback` with no matching
+ * file-level disable directive.
+ * OK: a component with no `gate` steps at all, or a `gate` whose file-level
+ * disable directive says who is expected to approve it and why.
+ */
+import type { ComponentCheck } from "../../component-checks.js";
+export declare const comp004GateNeedsDurableRuntimeRule: ComponentCheck;
+//# sourceMappingURL=comp004-gate-needs-durable-runtime.d.ts.map

package/dist/lint/rules/comp/comp004-gate-needs-durable-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comp004-gate-needs-durable-runtime.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/comp004-gate-needs-durable-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmD,MAAM,wBAAwB,CAAC;AAG9G,eAAO,MAAM,kCAAkC,EAAE,cA4BhD,CAAC"}

package/dist/lint/rules/comp/index.d.ts

@@ -9,7 +9,7 @@ import type { ComponentCheck } from "../../component-checks.js";
 export { comp001PublishesNeverAppliesRule } from "./comp001-publishes-never-applies.js";
 export { comp002DanglingWiringRefRule } from "./comp002-dangling-wiring-ref.js";
 export { comp003MutatingNoRollbackRule } from "./comp003-mutating-no-rollback.js";
-export { comp004GateNeedsTemporalRule } from "./comp004-gate-needs-temporal.js";
+export { comp004GateNeedsDurableRuntimeRule } from "./comp004-gate-needs-durable-runtime.js";
 export { comp005CapabilityKindIsNounRule } from "./comp005-capability-kind-is-noun.js";
 export { comp006ShellNeedsReasonRule } from "./comp006-shell-needs-reason.js";
 export { comp007CompositionSprawlRule } from "./comp007-composition-sprawl.js";

package/dist/lint/rules/comp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAS7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE5E,4CAA4C;AAC5C,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAUtD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/comp/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAS7D,OAAO,EAAE,gCAAgC,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAE5E,4CAA4C;AAC5C,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAUtD"}

package/dist/lint/rules/op/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * OPS* Op-model post-synth checks (#2122, epic #2114 sub-issue 6) — ported
+ * from a hosting lexicon's own TMP012/TMP013/TMP014. Registered as core-owned
+ * post-synth checks (`coreOpChecks`, mirroring `../../receipt-checks.ts`'s
+ * `coreReceiptChecks`) so they run over the FULL build result regardless of
+ * which lexicons are configured — an Op is recognized by entity type
+ * (`../../../op/resource.ts`'s `OpResource`), not by which lexicon declared
+ * it.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export { ops012 } from "./ops012-activity-contract.js";
+export { ops013 } from "./ops013-step-output-ref.js";
+export { ops014 } from "./ops014-converge-rule-refusals.js";
+/** Core's own post-synth checks over the Op model — OPS012, OPS013, OPS014. */
+export declare function coreOpChecks(): PostSynthCheck[];
+//# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/op/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKvD,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAEzD,+EAA+E;AAC/E,wBAAgB,YAAY,IAAI,cAAc,EAAE,CAE/C"}

package/dist/lint/rules/op/ops012-activity-contract.d.ts

@@ -0,0 +1,27 @@
+/**
+ * OPS012: activity step args/outcomeAttribute must match the activity's
+ * declared contract (chant #1288 Stage 1; moved from a hosting lexicon's own
+ * TMP012 to core in #2122, epic #2114 sub-issue 6, so it fires on every
+ * project that declares an Op, not only one with that lexicon configured).
+ *
+ * Validates every Op entity's steps against core's own base-activity
+ * contracts (`../../../op/activities/activity-contracts.ts`, #2117), using
+ * the generic walk in `@intentius/chant/op`'s `validateActivitySteps`. A step
+ * whose `fn` has no registered contract here is skipped — most activities
+ * don't have one yet; see that module's doc for why that's the intended,
+ * non-breaking default.
+ *
+ * Cross-lexicon (chant #2101): an Op step may call an activity any
+ * configured lexicon contributes (`terraformPlan`, `k3sInstall`,
+ * `flyApply`), and since this check became core-owned it fires on every
+ * project that declares an Op. `ctx.activityContracts` carries the contracts
+ * every configured lexicon declared, resolved by `loadActivityContracts`
+ * (`../../../op/activity-contract-registry.ts`) the same way
+ * `loadActivities` resolves the implementations, and is merged over the
+ * static table below. A context that carries none — a hand-built one in a
+ * test, a caller that has not loaded any — falls back to that table alone,
+ * exactly as before.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops012: PostSynthCheck;
+//# sourceMappingURL=ops012-activity-contract.d.ts.map

package/dist/lint/rules/op/ops012-activity-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops012-activity-contract.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops012-activity-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAU9F,eAAO,MAAM,MAAM,EAAE,cA4BpB,CAAC"}