@intentius/chant 0.57.0 → 0.59.0

package/src/cli/commands/build.test.ts

@@ -950,19 +950,21 @@ export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexi
     });
   });
 
-  test("op worker files go to <project>/dist/ops even with no --output (#878)", async () => {
-    // The generated Op worker must land where `chant run <op> --temporal` reads it
-    // (`<project>/dist/ops/<name>/worker.ts`) even when the build has no --output
-    // (a Temporal Op project often has no primary resource manifest to route).
+  test("serializer files under ops/ go to <project>/dist/ops even with no --output (#878)", async () => {
+    // Whatever a serializer emits under `ops/` must land in
+    // `<project>/dist/ops/<name>/`, beside the `op.json` core writes there,
+    // even when the build has no --output (an Op-only project often has no
+    // primary resource manifest to route). The routing is on the `ops/`
+    // prefix alone — it does not know or care what the files are.
     const opSerializer: Serializer = {
       name: "multi",
       rulePrefix: "MULTI",
       serialize: () => ({
         primary: "{}",
         files: {
-          "ops/durable-hello/workflow.ts": "// workflow\n",
-          "ops/durable-hello/worker.ts": "// worker\n",
-          "ops/durable-hello/activities.ts": "// activities\n",
+          "ops/nightly-report/steps.json": "{}\n",
+          "ops/nightly-report/notes.md": "# notes\n",
+          "ops/nightly-report/nested/extra.txt": "extra\n",
         },
       }),
     };
@@ -979,8 +981,31 @@ export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexi
     } as BuildOptions);
 
     expect(result.errors).toEqual([]);
-    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "worker.ts"))).toBe(true);
-    expect(existsSync(join(testDir, "dist", "ops", "durable-hello", "workflow.ts"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "nightly-report", "steps.json"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "nightly-report", "notes.md"))).toBe(true);
+    expect(existsSync(join(testDir, "dist", "ops", "nightly-report", "nested", "extra.txt"))).toBe(true);
+  });
+
+  test("an Op entity emits dist/ops/<name>/op.json from core, with no serializer involved (#2118)", async () => {
+    await writeFile(
+      join(testDir, "deploy.op.ts"),
+      `export default { [Symbol.for("chant.declarable")]: true, entityType: "Chant::Op", lexicon: "chant", kind: "resource", attributes: {},` +
+        ` props: { name: "deploy", overview: "Deploy the thing", labels: { Env: "staging" },` +
+        ` phases: [{ name: "Apply", steps: [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }] }] } };`,
+    );
+
+    const result = await buildCommand({ path: testDir, format: "json", serializers: [] } as BuildOptions);
+
+    expect(result.errors).toEqual([]);
+    const ir = JSON.parse(readFileSync(join(testDir, "dist", "ops", "deploy", "op.json"), "utf-8"));
+    expect(ir.formatVersion).toBe("2.0");
+    expect(ir.name).toBe("deploy");
+    expect(ir.labels).toEqual({ Env: "staging" });
+    expect(ir).not.toHaveProperty("taskQueue");
+    expect(ir.phases[0].steps[0]).toMatchObject({ kind: "activity", fn: "shellCmd", profile: "fastIdempotent" });
+    // Ops are held out of `partitionByLexicon` (they have no serializer and
+    // need none), so core's own `chant` lexicon never trips the warning.
+    expect(result.warnings.filter((w) => w.includes("No serializer"))).toEqual([]);
   });
 
   // ── #284 bug 2: array-of-objects must serialize to valid YAML ──────────
@@ -1219,6 +1244,302 @@ export const x = { [Symbol.for("chant.declarable")]: true, entityType: "X", lexi
       30_000,
     );
   });
+
+  describe("post-synth findings honor inline chant-ignore comments (chant #2111)", () => {
+    /**
+     * A discovered entity carrying a `suppressions` directive by hand, the
+     * generic, duck-typed field `applyInlineSuppressions` reads (see
+     * `../../lint/suppressions.ts`'s module doc). The terraform lexicon
+     * populates this from real `# chant-ignore*` HCL comments
+     * (`lexicons/terraform/src/hcl/suppressions.ts`); this test proves the
+     * core wiring, that `chant build` applies it to ANY lexicon's entities,
+     * without needing a real HCL parse.
+     */
+    async function writeSuppressibleEntity(ids: string): Promise<void> {
+      await writeFile(
+        join(testDir, "main.ts"),
+        `export const e = {\n` +
+          `  lexicon: "test",\n` +
+          `  entityType: "TestEntity",\n` +
+          `  [Symbol.for("chant.declarable")]: true,\n` +
+          `  suppressions: [{ form: "chant-ignore", ids: new Set(${JSON.stringify(ids.split(","))}), file: "main.ts", line: 1, key: "main.ts:1:chant-ignore" }],\n` +
+          `};\n`,
+      );
+    }
+
+    /** Same shape as `fakePostSynthPlugin` above, except its check attaches `entity` to whatever entity the build discovered, so a suppression directive on that entity has something to match against. */
+    function fakeEntitySuppressionPlugin(checkId: string, severity: "error" | "warning" | "info"): LexiconPlugin {
+      return {
+        name: "fake",
+        serializer: { name: "fake", rulePrefix: "FAKE", serialize: () => "{}" },
+        generate: async () => {},
+        validate: async () => {},
+        coverage: async () => {},
+        package: async () => {},
+        postSynthChecks: () => [
+          {
+            id: checkId,
+            description: "test check",
+            check: (ctx) => {
+              const [key] = [...ctx.entities.keys()];
+              return key ? [{ checkId, severity, message: `${checkId} triggered`, entity: key }] : [];
+            },
+          },
+        ],
+      };
+    }
+
+    test("an inline chant-ignore naming the finding's checkId suppresses it and reports a suppressed count", async () => {
+      await writeSuppressibleEntity("FAKE005");
+      await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakeEntitySuppressionPlugin("FAKE005", "error")],
+      });
+
+      expect(result.success).toBe(true);
+      expect(result.errors).toEqual([]);
+      expect(result.warnings.some((w) => w.includes("1 post-synth finding(s) suppressed via inline chant-ignore comments"))).toBe(true);
+    });
+
+    test("an inline chant-ignore naming a different id has no effect", async () => {
+      await writeSuppressibleEntity("FAKE006");
+      await writeFile(join(testDir, "chant.config.ts"), `export default {};\n`);
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakeEntitySuppressionPlugin("FAKE007", "error")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE007 triggered"))).toBe(true);
+      expect(result.warnings.some((w) => w.includes("suppressed"))).toBe(false);
+    });
+
+    test("ignorable: false in lint.rules denies the ignore and reports the attempt, keeping the finding active", async () => {
+      await writeSuppressibleEntity("FAKE008");
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FAKE008": ["error", { ignorable: false }] } } };\n`,
+      );
+
+      const result = await buildCommand({
+        path: testDir,
+        format: "json",
+        serializers: [mockSerializer],
+        plugins: [fakeEntitySuppressionPlugin("FAKE008", "error")],
+      });
+
+      expect(result.success).toBe(false);
+      expect(result.errors.some((e) => e.includes("FAKE008 triggered"))).toBe(true);
+      expect(result.warnings.some((w) => w.includes("SUPP003") && w.includes("ignorable: false"))).toBe(true);
+    });
+  });
+
+  /**
+   * chant #2113: `lint.presets` filters WHICH post-synth check ids are
+   * reported at all, ahead of `lint.rules`' severity overrides (proven
+   * above). A plugin with no `lintPresets()` is unaffected (the common case
+   * today); one that ships presets defaults to `recommended` and is
+   * overridden per-lexicon via `lint.presets: { <name>: "<preset>" }`.
+   */
+  describe("post-synth findings honor lint.presets (chant #2113)", () => {
+    async function writeTrivialEntity(): Promise<void> {
+      await writeFile(
+        join(testDir, "main.ts"),
+        `export const e = { lexicon: "test", entityType: "TestEntity", [Symbol.for("chant.declarable")]: true };\n`,
+      );
+    }
+
+    /** A `LexiconPlugin` whose one post-synth check always fires, with `recommended`/`all` presets. `recommended` excludes the check's own id, `all` includes it. */
+    function fakePresetPlugin(): LexiconPlugin {
+      return {
+        name: "fakepreset",
+        serializer: { name: "fakepreset", rulePrefix: "FP", serialize: () => "{}" },
+        generate: async () => {},
+        validate: async () => {},
+        coverage: async () => {},
+        package: async () => {},
+        postSynthChecks: () => [
+          {
+            id: "FP001",
+            description: "a report-only check, always fires",
+            check: () => [{ checkId: "FP001", severity: "warning" as const, message: "FP001 triggered" }],
+          },
+        ],
+        lintPresets: () => ({ recommended: [], all: ["FP001"] }),
+      };
+    }
+
+    test("with no lint.presets config, the default preset (recommended) excludes the finding", async () => {
+      await writeTrivialEntity();
+      const result = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [fakePresetPlugin()] });
+      expect(result.warnings.join("\n")).not.toContain("FP001 triggered");
+      expect(result.warnings.some((w) => w.includes("not reported: excluded by the active lint.presets preset"))).toBe(true);
+    });
+
+    test('lint.presets: { fakepreset: "all" } includes the finding', async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { presets: { fakepreset: "all" } } };\n`,
+      );
+      const result = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [fakePresetPlugin()] });
+      expect(result.warnings.join("\n")).toContain("FP001 triggered");
+    });
+
+    test("an explicit lint.rules entry re-enables the rule even under the excluding (recommended) preset", async () => {
+      await writeTrivialEntity();
+      await writeFile(
+        join(testDir, "chant.config.ts"),
+        `export default { lint: { rules: { "FP001": "warning" } } };\n`,
+      );
+      const result = await buildCommand({ path: testDir, format: "json", serializers: [mockSerializer], plugins: [fakePresetPlugin()] });
+      expect(result.warnings.join("\n")).toContain("FP001 triggered");
+    });
+  });
+});
+
+// #2122 (epic #2114 sub-issue 6) — OPS012/OPS013/OPS014 are core-owned
+// post-synth checks over the Op model, run unscoped by `coreOpChecks()`
+// regardless of which plugins/lexicons are configured. This is the
+// end-to-end path acceptance criterion 3 needs: `chant build` over a real
+// ConvergeOp-shaped fixture with a destructive gated dispatch rule fails
+// with the OPS014 refusal, with zero plugins/lexicons loaded.
+describe("buildCommand — OPS014 (op-model post-synth checks, #2122)", () => {
+  let testDir: string;
+
+  const mockSerializer: Serializer = {
+    name: "test",
+    rulePrefix: "TEST",
+    serialize: (entities) => JSON.stringify({ resources: [...entities.keys()] }, null, 2),
+  };
+
+  beforeEach(async () => {
+    testDir = join(tmpdir(), `chant-ops014-test-${Date.now()}-${Math.random()}`);
+    await mkdir(testDir, { recursive: true });
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  test("fails build with the OPS014 refusal on a ConvergeOp dispatching a destructive, gated op", async () => {
+    // The destructive dispatch target: a gated `nativeApply` with
+    // `deleteMode: "gated"` — classified destructive by
+    // `../../op/op-verb-class.ts`, gate or not.
+    await writeFile(
+      join(testDir, "prune-staging.op.ts"),
+      `
+export const pruneStaging = {
+  [Symbol.for("chant.declarable")]: true,
+  entityType: "Chant::Op",
+  lexicon: "chant",
+  kind: "resource",
+  props: {
+    name: "prune-staging",
+    overview: "test",
+    phases: [
+      { name: "Approve", steps: [{ kind: "gate", gate: "approve-x" }] },
+      { name: "Apply", steps: [
+        { kind: "activity", fn: "nativeApply", args: { target: "kubectl", env: "staging", output: "dist", deleteMode: "gated" } },
+      ] },
+    ],
+  },
+};
+      `,
+    );
+
+    // The ConvergeOp-shaped Op: dial "apply", one rule dispatching the
+    // destructive target above.
+    await writeFile(
+      join(testDir, "converge.op.ts"),
+      `
+export const converge = {
+  [Symbol.for("chant.declarable")]: true,
+  entityType: "Chant::Op",
+  lexicon: "chant",
+  kind: "resource",
+  props: {
+    name: "converge",
+    overview: "test",
+    labels: { Converge: "true", Env: "staging", Dial: "apply" },
+    phases: [
+      { name: "Observe", steps: [{ kind: "activity", fn: "lifecycleDiff", args: { env: "staging" }, id: "diff" }] },
+      { name: "Converge", steps: [{ kind: "activity", fn: "convergeTick", args: { rules: [
+        {
+          id: "drift-prune",
+          when: { kind: "field-comparison", field: "status", op: "eq", value: "drifted" },
+          then: { kind: "run", op: "prune-staging" },
+          why: "Prune drifted resources.",
+        },
+      ] } }] },
+    ],
+  },
+};
+      `,
+    );
+
+    const result = await buildCommand({
+      path: testDir,
+      format: "json",
+      serializers: [mockSerializer],
+      plugins: [],
+    });
+
+    expect(result.success).toBe(false);
+    // build.ts's plain error strings carry the diagnostic's message text, not
+    // its checkId — OPS014's own message names what it refused and why (see
+    // ../../lint/rules/op/ops014-converge-rule-refusals.ts).
+    expect(
+      result.errors.some(
+        (e) => e.includes("destructive") && e.includes("prune-staging") && e.includes("refused in v1"),
+      ),
+    ).toBe(true);
+  });
+
+  // #2202: a gate step spelling its name `signalName` still builds, and the
+  // build says so once, naming the Ops involved rather than each gate step.
+  test("warns once, naming the Ops, when a gate step still uses the deprecated `signalName` key", async () => {
+    const opFile = (name: string): string => `
+export const ${name.replace(/-/g, "")} = {
+  [Symbol.for("chant.declarable")]: true,
+  entityType: "Chant::Op",
+  lexicon: "chant",
+  kind: "resource",
+  props: {
+    name: "${name}",
+    overview: "test",
+    phases: [{ name: "Approve", steps: [{ kind: "gate", signalName: "approve-x" }] }],
+  },
+};
+      `;
+    await writeFile(join(testDir, "old-a.op.ts"), opFile("old-a"));
+    await writeFile(join(testDir, "old-b.op.ts"), opFile("old-b"));
+    await writeFile(
+      join(testDir, "new-c.op.ts"),
+      opFile("new-c").replace("signalName", "gate"),
+    );
+
+    const result = await buildCommand({
+      path: testDir,
+      format: "json",
+      serializers: [mockSerializer],
+      plugins: [],
+    });
+
+    const deprecation = result.warnings.filter((w) => w.includes("signalName"));
+    expect(deprecation).toHaveLength(1);
+    expect(deprecation[0]).toContain("old-a");
+    expect(deprecation[0]).toContain("old-b");
+    expect(deprecation[0]).not.toContain("new-c");
+    expect(deprecation[0]).toContain("0.60.0");
+  });
 });
 
 // ── #284 bug 1: -o extension drives format when --format is absent ────────

package/src/cli/commands/build.ts

@@ -14,11 +14,19 @@ import type { OwnershipMarker } from "../../ownership";
 import { resolveCliBuildParams } from "../build-params-cli";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
-import { runPostSynthChecks } from "../../lint/post-synth";
+import { runPostSynthChecks, type PostSynthDiagnostic } from "../../lint/post-synth";
+import { loadActivityContracts } from "../../op/activity-contract-registry";
+import { isOpEntity } from "../../op/resource";
+import { serializeOpIR } from "../../op/op-ir";
+import { opUsesDeprecatedGateKey, DEPRECATED_GATE_KEY_WARNING } from "../../op/gate-name";
+import type { OpConfig } from "../../op/types";
 import { coreReceiptChecks } from "../../lint/receipt-checks";
 import { coreOutputChecks } from "../../lint/output-checks";
 import { coreKnowledgeChecks } from "../../lint/knowledge-checks";
-import { applyConfiguredSeverity } from "../../lint/config";
+import { applyConfiguredSeverity, applyConfiguredPreset, resolvePresetIds } from "../../lint/config";
+import { applyInlineSuppressions, type SuppressionMetaFinding } from "../../lint/suppressions";
+import type { Declarable } from "../../declarable";
+import { coreOpChecks } from "../../lint/rules/op";
 import { loadPolicyChecks } from "../../lint/policy";
 import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { sortedJsonReplacer } from "../../utils";
@@ -392,7 +400,46 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // rule id — so `lint.rules: { WAW019: "off" }` suppresses a post-synth
   // finding just as it suppresses a pre-synth one. A finding it suppresses is
   // counted, not dropped silently — see `suppressedPostSynthCount` below.
+  //
+  // chant #2111: every batch also goes through `applyInlineSuppressions`
+  // right after, so a `# chant-ignore` comment on an entity (terraform's HCL
+  // blocks today; any lexicon that attaches `suppressions` to its own
+  // entities tomorrow) suppresses identically regardless of which phase
+  // produced the diagnostic. Same counted-not-dropped contract, in its own
+  // `inlineSuppressedCount`, plus `suppressionMeta` for directives that are
+  // themselves worth a finding (expired, misplaced, denied by `ignorable: false`).
   let suppressedPostSynthCount = 0;
+  let inlineSuppressedCount = 0;
+  const suppressionMeta: SuppressionMetaFinding[] = [];
+  // A rule a `lint.presets` preset excludes (chant #2113) is a distinct
+  // reason a finding doesn't reach the errors/warnings lists. The preset
+  // decided the rule shouldn't run at all under this project's configured
+  // tier, not that `lint.rules` downgraded it to "off", so it gets its own
+  // counter and its own summary line rather than folding into the one above.
+  let suppressedPresetCount = 0;
+
+  /**
+   * Apply every suppression/filtering surface to one batch, in order:
+   * `lint.presets` (chant #2113, which check ids are enabled at all; a
+   * no-op when `presetIds` is undefined, the case for every call site below
+   * except the per-plugin loop, which is the only one with a lexicon a
+   * preset could apply to), then `lint.rules` severity overrides (chant
+   * #1138), then inline `# chant-ignore` comments (chant #2111).
+   */
+  const resolvePostSynth = (
+    diags: PostSynthDiagnostic[],
+    entities: Map<string, Declarable>,
+    presetIds?: Set<string>,
+  ): PostSynthDiagnostic[] => {
+    const { diagnostics: afterPreset, suppressed: presetSuppressed } = applyConfiguredPreset(diags, presetIds, config.lint?.rules);
+    suppressedPresetCount += presetSuppressed.length;
+    const { diagnostics: afterConfig, suppressed: configSuppressed } = applyConfiguredSeverity(afterPreset, config.lint?.rules);
+    suppressedPostSynthCount += configSuppressed.length;
+    const { diagnostics: active, suppressed: inlineSuppressed, meta } = applyInlineSuppressions(afterConfig, entities, config.lint?.rules);
+    inlineSuppressedCount += inlineSuppressed.length;
+    suppressionMeta.push(...meta);
+    return active;
+  };
 
   // Core-owned post-synth checks over effect receipts (#1833). Receipts are
   // recognized by marker, lexicon-independently, so this set runs over the
@@ -400,9 +447,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // Same severity-resolution funnel as every other post-synth finding.
   if (result.errors.length === 0) {
     const receiptDiags = runPostSynthChecks(coreReceiptChecks(), result, env);
-    const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(receiptDiags, config.lint?.rules);
-    suppressedPostSynthCount += suppressed.length;
-    for (const diag of activeDiags) {
+    for (const diag of resolvePostSynth(receiptDiags, result.entities)) {
       const prefix = diag.entity ? `[${diag.entity}] ` : "";
       const lexiconSuffix = diag.lexicon ? ` (${diag.lexicon})` : "";
       if (diag.severity === "error") {
@@ -419,9 +464,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // the FULL build result the same way the receipt checks above do.
   if (result.errors.length === 0) {
     const outputDiags = runPostSynthChecks(coreOutputChecks(), result, env);
-    const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(outputDiags, config.lint?.rules);
-    suppressedPostSynthCount += suppressed.length;
-    for (const diag of activeDiags) {
+    for (const diag of resolvePostSynth(outputDiags, result.entities)) {
       const prefix = diag.entity ? `[${diag.entity}] ` : "";
       const lexiconSuffix = diag.lexicon ? ` (${diag.lexicon})` : "";
       if (diag.severity === "error") {
@@ -440,7 +483,36 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   if (result.errors.length === 0) {
     const bundle = await loadOkfBundle(resolveKnowledgeDir(config, configDir));
     const knowledgeDiags = runPostSynthChecks(coreKnowledgeChecks(bundle), result, env);
-    const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(knowledgeDiags, config.lint?.rules);
+    for (const diag of resolvePostSynth(knowledgeDiags, result.entities)) {
+      const prefix = diag.entity ? `[${diag.entity}] ` : "";
+      const lexiconSuffix = diag.lexicon ? ` (${diag.lexicon})` : "";
+      if (diag.severity === "error") {
+        errors.push(formatError({ message: `${prefix}${diag.message}${lexiconSuffix}` }));
+      } else {
+        warnings.push(formatWarning({ message: `${prefix}${diag.message}${lexiconSuffix}` }));
+      }
+    }
+  }
+
+  // Activity contracts across every loaded lexicon (chant #2101): core's own
+  // plus each lexicon's, by the same `@intentius/chant-lexicon-<name>/op/...`
+  // convention `loadActivities` resolves implementations with. OPS012/OPS013
+  // and a plugin's own checks merge this over their own tables, so a step
+  // calling a lexicon's activity is validated against that lexicon's contract
+  // instead of failing for the absence of one. Resolved once, for both check
+  // passes below.
+  const activityContracts =
+    result.errors.length === 0 ? await loadActivityContracts(options.plugins ?? []) : undefined;
+
+  // Core-owned post-synth checks over the Op model (#2122, epic #2114
+  // sub-issue 6) — OPS012/OPS013/OPS014, ported from a hosting lexicon's
+  // own TMP012/TMP013/TMP014. An Op is recognized by entity type
+  // (`OpResource`), not by which lexicon declared it, so this runs over the
+  // FULL build result regardless of which plugins loaded — same as the
+  // receipt/output/knowledge checks above.
+  if (result.errors.length === 0) {
+    const opDiags = runPostSynthChecks(coreOpChecks(), result, env, { activityContracts });
+    const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(opDiags, config.lint?.rules);
     suppressedPostSynthCount += suppressed.length;
     for (const diag of activeDiags) {
       const prefix = diag.entity ? `[${diag.entity}] ` : "";
@@ -471,10 +543,16 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
       }
 
       const scopedResult = { ...result, outputs: scopedOutputs };
-      const postDiags = runPostSynthChecks(checks, scopedResult, env);
-      const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(postDiags, config.lint?.rules);
-      suppressedPostSynthCount += suppressed.length;
-      for (const diag of activeDiags) {
+      const postDiags = runPostSynthChecks(checks, scopedResult, env, { activityContracts });
+      // `lint.presets` (chant #2113) filters WHICH check ids are reported at
+      // all, before `lint.rules`/inline suppression act on the reported
+      // ones. It's a no-op for a lexicon that ships no `lintPresets()` (the
+      // common case today), since `resolvePresetIds` returns `undefined`
+      // for one. This is the only `resolvePostSynth` call site with a
+      // lexicon a preset could apply to; every other call below passes no
+      // `presetIds` at all.
+      const presetIds = resolvePresetIds(plugin.lintPresets?.(), config.lint?.presets?.[plugin.name] ?? "recommended");
+      for (const diag of resolvePostSynth(postDiags, result.entities, presetIds)) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const lexiconSuffix = diag.lexicon ? ` (${diag.lexicon})` : "";
         if (diag.severity === "error") {
@@ -511,9 +589,7 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
         env,
         preloaded: preloadedPolicyChecks,
       });
-      const { diagnostics: activePolicyDiags, suppressed } = applyConfiguredSeverity(policyDiags, config.lint?.rules);
-      suppressedPostSynthCount += suppressed.length;
-      for (const diag of activePolicyDiags) {
+      for (const diag of resolvePostSynth(policyDiags, result.entities)) {
         const prefix = diag.entity ? `[${diag.entity}] ` : "";
         const where = diag.lexicon ? ` (${diag.lexicon})` : "";
         const msg = `[policy:${diag.checkId}] ${prefix}${diag.message}${where}`;
@@ -529,15 +605,58 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
         }),
       );
     }
+
+    if (suppressedPresetCount > 0) {
+      warnings.push(
+        formatWarning({
+          message: `${suppressedPresetCount} post-synth finding(s) not reported: excluded by the active lint.presets preset`,
+        }),
+      );
+    }
+
+    if (inlineSuppressedCount > 0) {
+      warnings.push(
+        formatWarning({
+          message: `${inlineSuppressedCount} post-synth finding(s) suppressed via inline chant-ignore comments`,
+        }),
+      );
+    }
+
+    // Directives that are themselves worth a finding (expired, misplaced, or
+    // naming a rule id configured `ignorable: false`) are reported once
+    // each, never silently (chant #2111).
+    for (const m of suppressionMeta) {
+      warnings.push(formatWarning({ message: `[${m.checkId}] ${m.file}:${m.line} ${m.message}` }));
+    }
   }
 
   // Empty-output guard: source files were discovered but no lexicon produced
   // any output. Almost always indicates broken imports resolving to undefined
   // (e.g. missing root re-exports from a lexicon) or modules that exported no
   // Declarables. Without this guard, chant writes "{}" and exits 0.
+  //
+  // An Op declaration is the honest exception (#2118): it belongs to no
+  // lexicon partition and its build output is the `op.json` written below,
+  // not a resource manifest, so an Ops-only project legitimately produces no
+  // serializer output and must not be reported as a broken import.
+  const declaredOps = [...result.entities.values()].filter(isOpEntity);
+
+  // The gate step's name key was renamed from `signalName` to `gate` in #2202.
+  // The old key is still read; a build that finds an Op still using it says so
+  // once, naming every Op involved, rather than once per gate step.
+  const opsOnOldGateKey = declaredOps
+    .map((entity) => (entity as unknown as { props?: OpConfig }).props)
+    .filter((config): config is OpConfig => Boolean(config?.name) && opUsesDeprecatedGateKey(config as OpConfig))
+    .map((config) => config.name);
+  if (opsOnOldGateKey.length > 0) {
+    warnings.push(
+      formatWarning({ message: `${DEPRECATED_GATE_KEY_WARNING} Ops: ${opsOnOldGateKey.join(", ")}.` }),
+    );
+  }
   if (
     result.sourceFileCount > 0 &&
     result.outputs.size === 0 &&
+    declaredOps.length === 0 &&
     result.errors.length === 0 &&
     errors.length === 0
   ) {
@@ -658,12 +777,12 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
       }
     }
 
-    // Op worker artifacts (`ops/<name>/{workflow,worker,activities}.ts`) always
-    // go to `<project>/dist/ops/` — the fixed location `chant run <op> --temporal`
-    // reads (`join(projectPath, "dist", "ops", ...)`) — independent of `--output`,
-    // which routes the primary resource manifest. Without this, a bare `chant build`
-    // only printed them to stderr and `--output foo.yaml` scattered them next to
-    // `foo.yaml`, so the durable-run worker was never where `run --temporal` looks.
+    // Anything a serializer emits under `ops/` always goes to
+    // `<project>/dist/ops/` — the fixed place an Op's build output is read
+    // from, alongside the `op.json` core writes below — independent of
+    // `--output`, which routes the primary resource manifest. Without this, a
+    // bare `chant build` only printed them to stderr and `--output foo.yaml`
+    // scattered them next to `foo.yaml`.
     const projectDist = resolve(options.path ?? ".", "dist");
     let opsWritten = 0;
     for (const [filename, entry] of [...additionalFiles]) {
@@ -677,13 +796,40 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
       } catch (err) {
         errors.push(
           formatError({
-            message: `Failed to write Op worker file ${filename}: ${err instanceof Error ? err.message : String(err)}`,
+            message: `Failed to write Op output file ${filename}: ${err instanceof Error ? err.message : String(err)}`,
           }),
         );
       }
     }
     if (opsWritten > 0) {
-      console.error(formatInfo(`Wrote ${opsWritten} Op worker file(s) under ${join(options.path ?? ".", "dist", "ops")}/`));
+      console.error(formatInfo(`Wrote ${opsWritten} Op output file(s) under ${join(options.path ?? ".", "dist", "ops")}/`));
+    }
+
+    // `dist/ops/<name>/op.json` — the Op IR (#1289), written here by core
+    // rather than emitted by a lexicon serializer (#2118). An Op declaration
+    // is core's own entity now (`Chant::Op`, lexicon `chant`) and is held out
+    // of `partitionByLexicon` entirely, so this is the one place its build
+    // output is produced: a deterministic, engine-neutral restatement of the
+    // step graph that anything can read without importing chant.
+    let irWritten = 0;
+    for (const entity of declaredOps) {
+      const config = (entity as unknown as { props?: OpConfig }).props;
+      if (!config?.name) continue;
+      try {
+        const targetPath = join(projectDist, "ops", config.name, "op.json");
+        mkdirSync(dirname(targetPath), { recursive: true });
+        writeFileSync(targetPath, serializeOpIR(config));
+        irWritten += 1;
+      } catch (err) {
+        errors.push(
+          formatError({
+            message: `Failed to write op.json for Op "${config.name}": ${err instanceof Error ? err.message : String(err)}`,
+          }),
+        );
+      }
+    }
+    if (irWritten > 0) {
+      console.error(formatInfo(`Wrote ${irWritten} op.json file(s) under ${join(options.path ?? ".", "dist", "ops")}/`));
     }
 
     if (options.output) {