@intentius/chant 0.57.0 → 0.59.0

package/src/cli/handlers/run.test.ts

@@ -1,26 +1,22 @@
-import { describe, test, expect, vi, beforeEach } from "vitest";
-import { createMockTemporalClient } from "@intentius/chant-test-utils";
+import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
+import { existsSync, mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import type { ParsedArgs } from "../registry";
-import { EventEmitter } from "node:events";
 
 const discoverOpsMock = vi.fn();
 const loadChantConfigMock = vi.fn();
-const loadTemporalClientMock = vi.fn();
-const resolveProfileMock = vi.fn();
-const existsSyncMock = vi.fn();
 const writeFileSyncMock = vi.fn();
 const mkdirSyncMock = vi.fn();
-const spawnChildMock = vi.fn();
-const generateReportMock = vi.fn();
-const writeReportMock = vi.fn();
-const waitForTemporalSpy = vi.fn();
 const runComponentsMock = vi.fn();
-const resolveComponentTargetsMock = vi.fn();
-const findComponentGateMock = vi.fn();
-const loadComponentTemporalCodegenMock = vi.fn();
+const listComponentsMock = vi.fn();
 const maybeRecordAutoReleaseMock = vi.fn();
 const maybePersistBuildManifestMock = vi.fn();
-const listComponentsMock = vi.fn();
+const loadPluginsMock = vi.fn();
+const recordGateApprovalMock = vi.fn();
+
+const { memoryGateLedgerPort } = await vi.importActual<typeof import("../../op/gate")>("../../op/gate");
+let gateLedger = memoryGateLedgerPort();
 
 vi.mock("../../op/discover", () => ({ discoverOps: () => discoverOpsMock() }));
 vi.mock("../../config", async () => {
@@ -29,87 +25,67 @@ vi.mock("../../config", async () => {
 });
 vi.mock("../../components/auto-release", () => ({
   maybeRecordAutoRelease: (...args: unknown[]) => maybeRecordAutoReleaseMock(...args),
-  extractRunDigestFromPhaseOutputs: (phaseOutputs: Record<string, Record<string, unknown>> | undefined) => {
-    for (const output of Object.values(phaseOutputs ?? {})) {
-      if (output && typeof output === "object" && "digest" in output) return (output as { digest: string }).digest;
-    }
-    return undefined;
-  },
 }));
 vi.mock("../../components/manifest-persistence", () => ({
   maybePersistBuildManifest: (...args: unknown[]) => maybePersistBuildManifestMock(...args),
-  extractRunManifestFromPhaseOutputs: (phaseOutputs: Record<string, Record<string, unknown>> | undefined) => {
-    for (const output of Object.values(phaseOutputs ?? {})) {
-      if (output && typeof output === "object" && "manifest" in output) return (output as { manifest: unknown }).manifest;
-    }
-    return undefined;
-  },
-}));
-vi.mock("./run-client", () => ({
-  loadTemporalClient: () => loadTemporalClientMock(),
-  connectionOptions: (profile: { address: string }) => ({ address: profile.address }),
-  resolveProfile: (...args: unknown[]) => resolveProfileMock(...args),
-  resolveWorkflowId: (name: string) => `chant-op-${name}`,
-  // Test fixtures already use the short event-type form fetchNormalizedHistory
-  // produces (see mock-temporal-client.ts) — a passthrough keeps them valid.
-  fetchNormalizedHistory: (handle: { fetchHistory(): Promise<unknown> }) => handle.fetchHistory(),
 }));
 vi.mock("node:fs", async () => {
   const actual = await vi.importActual<typeof import("node:fs")>("node:fs");
   return {
     ...actual,
-    existsSync: (p: string) => existsSyncMock(p),
     writeFileSync: (...args: unknown[]) => writeFileSyncMock(...args),
     mkdirSync: (...args: unknown[]) => mkdirSyncMock(...args),
   };
 });
-vi.mock("node:child_process", async () => {
-  const actual = await vi.importActual<typeof import("node:child_process")>("node:child_process");
-  return { ...actual, spawn: (...args: unknown[]) => spawnChildMock(...args) };
-});
-vi.mock("./run-report", () => ({
-  generateReport: (...args: unknown[]) => generateReportMock(...args),
-  writeReport: (...args: unknown[]) => writeReportMock(...args),
-}));
 vi.mock("../../components/cli-support", () => ({
   runComponents: (...args: unknown[]) => runComponentsMock(...args),
-  resolveComponentTargets: (...args: unknown[]) => resolveComponentTargetsMock(...args),
-  findComponentGate: (...args: unknown[]) => findComponentGateMock(...args),
   listComponents: (...args: unknown[]) => listComponentsMock(...args),
 }));
-vi.mock("../../components/temporal-codegen-loader", () => ({
-  loadComponentTemporalCodegen: () => loadComponentTemporalCodegenMock(),
+vi.mock("../plugins", () => ({
+  loadPlugins: (...args: unknown[]) => loadPluginsMock(...args),
 }));
+vi.mock("./operator", () => ({
+  recordGateApproval: (...args: unknown[]) => recordGateApprovalMock(...args),
+}));
+// The gate ledger a local run consults (#2119) is the `chant/lifecycle` orphan
+// branch by default. Point it at memory here: these tests exercise the CLI's
+// gate handling, and a unit test must never write a fact to the real repo.
+vi.mock("../../op/gate", async () => {
+  const actual = await vi.importActual<typeof import("../../op/gate")>("../../op/gate");
+  return { ...actual, gitGateLedgerPort: () => gateLedger };
+});
+// The local runtime appends each run's record to that same branch (#2118).
+// Real behavior in a project, and exactly what this suite must not do in
+// chant's own checkout, since the append is against `process.cwd()`. Only the
+// write and the read-back are stubbed — `buildRunRecord` stays real, so
+// `--json` is still asserted against the record the executor actually built.
+vi.mock("../../lifecycle/run-ledger", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../lifecycle/run-ledger")>();
+  return {
+    ...actual,
+    appendRunRecord: async (input: Parameters<typeof actual.appendRunRecord>[0]) => ({
+      commit: "0".repeat(40),
+      record: { version: 1 as const, ...input, id: input.id ?? "test-run-id" },
+    }),
+    readRunLedger: async () => ({ records: [], malformed: 0 }),
+  };
+});
 
-// Speed up runOp polling — POLL_INTERVAL_MS is 3000 in production. We use
-// fake timers in the runOp suite below; vi.advanceTimersByTime drives the loop.
-
-const { runOpList, runOpStatus, runOpLog, runOpSignal, runOpCancel, runOp, runOpComponents } = await import("./run");
+const { runOpList, runOpStatus, runOpLog, runOpSignalRenamed, runOpApprove, runOpCancel, runOp, runOpComponents } =
+  await import("./run");
 
 function makeArgs(overrides: Partial<ParsedArgs> = {}): ParsedArgs {
   return {
     command: "run", path: ".",
     format: "", fix: false, watch: false, verbose: false, help: false, live: false,
-    // These suites exercise the Temporal path; local mode is the CLI default,
-    // so opt in explicitly here. Local-mode behavior is covered separately below.
-    temporal: true,
     ...overrides,
   };
 }
 
-function makeOp(name: string, depends: string[] = []): [string, { config: { name: string; phases: unknown[]; taskQueue?: string; depends?: string[]; overview: string } }] {
+function makeOp(name: string, depends: string[] = []): [string, { config: { name: string; phases: unknown[]; depends?: string[]; overview: string } }] {
   return [name, { config: { name, phases: [], depends, overview: `${name} overview` } }];
 }
 
-function setupTemporalClient(mock: ReturnType<typeof createMockTemporalClient>) {
-  loadTemporalClientMock.mockResolvedValue({
-    Connection: { connect: vi.fn(async () => ({})) },
-    Client: vi.fn(function () { return mock.client; }) as unknown as new () => unknown,
-  });
-  loadChantConfigMock.mockResolvedValue({ config: {} });
-  resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-}
-
 function makeStdoutSpy() {
   const buf: string[] = [];
   vi.spyOn(console, "log").mockImplementation((s: string) => { buf.push(s); });
@@ -122,495 +98,35 @@ function makeStderrSpy() {
   return buf;
 }
 
-describe("runOpList", () => {
-  beforeEach(() => {
-    discoverOpsMock.mockReset();
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-  });
-
-  test("warns when no Ops discovered, returns 0", async () => {
-    discoverOpsMock.mockResolvedValue({ ops: new Map(), errors: [] });
-    const stderr = makeStderrSpy();
-    const exit = await runOpList({ args: makeArgs(), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    expect(stderr.join("\n")).toContain("No Op definitions found");
-  });
-
-  test("prints table with one row per Op when Temporal connection fails", async () => {
-    discoverOpsMock.mockResolvedValue({
-      ops: new Map([makeOp("alb-deploy"), makeOp("infra")]),
-      errors: [],
-    });
-    // No Temporal — make loadTemporalClient throw so degraded path is exercised
-    loadTemporalClientMock.mockRejectedValue(new Error("not installed"));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpList({ args: makeArgs(), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    const out = stdout.join("\n");
-    expect(out).toContain("NAME");
-    expect(out).toContain("alb-deploy");
-    expect(out).toContain("infra");
-  });
-
-  test("annotates Ops with Temporal status when client is available", async () => {
-    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("alb-deploy")]), errors: [] });
-    setupTemporalClient(createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-op-alb-deploy": {
-          workflowId: "chant-op-alb-deploy", runId: "r1",
-          status: { name: "RUNNING" }, startTime: new Date(),
-          taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-        },
-      },
-    }));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpList({ args: makeArgs(), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    expect(stdout.join("\n")).toContain("RUNNING");
-  });
-});
-
-// ── chant run list --components (#599) ──────────────────────────────────────
-
-describe("runOpList --components", () => {
-  beforeEach(() => {
-    listComponentsMock.mockReset();
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-  });
-
-  test("without --temporal → exit 1, actionable message, no discovery", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpList({ args: makeArgs({ components: true, temporal: false }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("not available in local mode");
-    expect(listComponentsMock).not.toHaveBeenCalled();
-  });
-
-  test("warns when no components discovered, returns 0", async () => {
-    listComponentsMock.mockResolvedValue({ success: true, components: [], errors: [] });
-    const stderr = makeStderrSpy();
-    const exit = await runOpList({ args: makeArgs({ components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    expect(stderr.join("\n")).toContain("No component definitions found");
-  });
-
-  test("discovery error → exit 1 with the error message", async () => {
-    listComponentsMock.mockResolvedValue({ success: false, components: [], errors: ["bad component file"] });
-    const stderr = makeStderrSpy();
-    const exit = await runOpList({ args: makeArgs({ components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("bad component file");
-  });
-
-  test("prints table with one row per component when Temporal connection fails", async () => {
-    listComponentsMock.mockResolvedValue({
-      success: true,
-      components: [
-        { name: "search-service", archetype: "service", dependsOn: ["shared-alb"], hasBuild: true, phases: ["Build", "Apply"], filePath: "src/search.component.ts" },
-      ],
-      errors: [],
-    });
-    loadTemporalClientMock.mockRejectedValue(new Error("not installed"));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpList({ args: makeArgs({ components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    const out = stdout.join("\n");
-    expect(out).toContain("NAME");
-    expect(out).toContain("search-service");
-    expect(out).toContain("shared-alb");
-  });
-
-  test("annotates components with Temporal status when client is available", async () => {
-    listComponentsMock.mockResolvedValue({
-      success: true,
-      components: [
-        { name: "gated-svc", archetype: "service", dependsOn: [], hasBuild: true, phases: ["Apply"], filePath: "src/gated.component.ts" },
-      ],
-      errors: [],
-    });
-    setupTemporalClient(createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-component-gated-svc": {
-          workflowId: "chant-component-gated-svc", runId: "r1",
-          status: { name: "RUNNING" }, startTime: new Date(),
-          taskQueue: "gated-svc", type: { name: "gatedSvcComponentWorkflow" },
-        },
-      },
-    }));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpList({ args: makeArgs({ components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    expect(stdout.join("\n")).toContain("RUNNING");
-  });
-});
-
-describe("runOpStatus", () => {
-  beforeEach(() => {
-    discoverOpsMock.mockReset();
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-  });
-
-  test("missing op name → exit 1", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: undefined }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("Op name is required");
-  });
-
-  test("connection error → exit 1 with message", async () => {
-    loadTemporalClientMock.mockRejectedValue(new Error("UNAVAILABLE"));
-    loadChantConfigMock.mockResolvedValue({ config: {} });
-    resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-    const stderr = makeStderrSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: "alb-deploy" }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("UNAVAILABLE");
-  });
-
-  test("happy path: prints workflow id, run id, status, activity counts", async () => {
-    setupTemporalClient(createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-op-alb-deploy": {
-          workflowId: "chant-op-alb-deploy", runId: "r1",
-          status: { name: "COMPLETED" },
-          startTime: new Date("2026-05-01T00:00:00Z"),
-          closeTime: new Date("2026-05-01T01:00:00Z"),
-          taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-        },
-      },
-      historyByWorkflowId: {
-        "chant-op-alb-deploy": [
-          { eventType: "ActivityTaskScheduled" },
-          { eventType: "ActivityTaskScheduled" },
-          { eventType: "ActivityTaskCompleted" },
-        ],
-      },
-    }));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: "alb-deploy" }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    const out = stdout.join("\n");
-    expect(out).toContain("chant-op-alb-deploy");
-    expect(out).toContain("COMPLETED");
-    expect(out).toContain("1/2 completed");
-  });
-
-  test("a pending gate prints a Gate line via the gateState query (#1676)", async () => {
-    setupTemporalClient(createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-op-alb-deploy": {
-          workflowId: "chant-op-alb-deploy", runId: "r1",
-          status: { name: "RUNNING" },
-          startTime: new Date("2026-05-01T00:00:00Z"),
-          taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-        },
-      },
-      historyByWorkflowId: { "chant-op-alb-deploy": [] },
-      queryResultByWorkflowId: {
-        "chant-op-alb-deploy:gateState": {
-          signalName: "gate-dns-delegation",
-          description: "Approve DNS delegation",
-          since: "2026-05-01T00:05:00.000Z",
-        },
-      },
-    }));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: "alb-deploy" }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    const out = stdout.join("\n");
-    expect(out).toContain("Gate");
-    expect(out).toContain("gate-dns-delegation");
-    expect(out).toContain("Approve DNS delegation");
-    expect(out).toContain("2026-05-01T00:05:00.000Z");
-  });
-
-  test("an Op with no pending gate (query unregistered or answers null) prints no Gate line", async () => {
-    setupTemporalClient(createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-op-alb-deploy": {
-          workflowId: "chant-op-alb-deploy", runId: "r1",
-          status: { name: "COMPLETED" },
-          startTime: new Date("2026-05-01T00:00:00Z"),
-          closeTime: new Date("2026-05-01T01:00:00Z"),
-          taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-        },
-      },
-      historyByWorkflowId: { "chant-op-alb-deploy": [] },
-    }));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: "alb-deploy" }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    expect(stdout.join("\n")).not.toContain("Gate");
-  });
-});
-
-// ── chant run status <name> --components (#599) ─────────────────────────────
-
-describe("runOpStatus --components", () => {
-  beforeEach(() => {
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-  });
-
-  test("missing component name → exit 1 with component-flavored message", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: undefined, components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("Component name is required");
-  });
-
-  test("without --temporal → exit 1, actionable message", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: "gated-svc", components: true, temporal: false }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("not available in local mode");
-  });
-
-  test("connection error → exit 1 with message", async () => {
-    loadTemporalClientMock.mockRejectedValue(new Error("UNAVAILABLE"));
-    loadChantConfigMock.mockResolvedValue({ config: {} });
-    resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-    const stderr = makeStderrSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: "gated-svc", components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("UNAVAILABLE");
-  });
-
-  test("happy path: queries the component workflow id, prints status + activity counts", async () => {
-    setupTemporalClient(createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-component-gated-svc": {
-          workflowId: "chant-component-gated-svc", runId: "r1",
-          status: { name: "RUNNING" },
-          startTime: new Date("2026-05-01T00:00:00Z"),
-          taskQueue: "gated-svc", type: { name: "gatedSvcComponentWorkflow" },
-        },
-      },
-      historyByWorkflowId: {
-        "chant-component-gated-svc": [
-          { eventType: "ActivityTaskScheduled" },
-          { eventType: "ActivityTaskScheduled" },
-          { eventType: "ActivityTaskCompleted" },
-        ],
-      },
-    }));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpStatus({ args: makeArgs({ extraPositional: "gated-svc", components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    const out = stdout.join("\n");
-    expect(out).toContain("Component: gated-svc");
-    expect(out).toContain("chant-component-gated-svc");
-    expect(out).toContain("RUNNING");
-    expect(out).toContain("1/2 completed");
-  });
-});
-
-describe("runOpLog", () => {
-  beforeEach(() => {
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-  });
-
-  test("missing op name → exit 1", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpLog({ args: makeArgs({ extraPositional: undefined }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("Op name is required");
-  });
-
-  test("prints one row per matching workflow execution", async () => {
-    setupTemporalClient(createMockTemporalClient({
-      list: [
-        { workflowId: "chant-op-alb-deploy", runId: "r1", type: { name: "albDeployWorkflow" }, status: { name: "COMPLETED" }, startTime: new Date("2026-05-01T00:00:00Z"), closeTime: new Date("2026-05-01T01:00:00Z") },
-        { workflowId: "chant-op-alb-deploy", runId: "r2", type: { name: "albDeployWorkflow" }, status: { name: "RUNNING" }, startTime: new Date("2026-05-02T00:00:00Z") },
-      ],
-    }));
-    const stdout = makeStdoutSpy();
-    const exit = await runOpLog({ args: makeArgs({ extraPositional: "alb-deploy" }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    const out = stdout.join("\n");
-    expect(out).toContain("RUN-ID");
-    expect(out).toContain("r1");
-    expect(out).toContain("r2");
-    expect(out).toContain("COMPLETED");
-    expect(out).toContain("RUNNING");
-  });
-});
-
-// ── chant run log <name> --components (#599) ────────────────────────────────
-
-describe("runOpLog --components", () => {
-  beforeEach(() => {
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-    loadComponentTemporalCodegenMock.mockReset();
-  });
-
-  test("missing component name → exit 1 with component-flavored message", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpLog({ args: makeArgs({ extraPositional: undefined, components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("Component name is required");
-  });
-
-  test("without --temporal → exit 1, actionable message", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpLog({ args: makeArgs({ extraPositional: "gated-svc", components: true, temporal: false }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("not available in local mode");
-  });
-
-  test("codegen unavailable → exit 1 with the loader's error message", async () => {
-    setupTemporalClient(createMockTemporalClient());
-    loadComponentTemporalCodegenMock.mockRejectedValue(new Error("no durable component codegen available"));
-    const stderr = makeStderrSpy();
-    const exit = await runOpLog({ args: makeArgs({ extraPositional: "gated-svc", components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("no durable component codegen available");
-  });
-
-  test("prints one row per matching component workflow execution, keyed by the component's workflow type", async () => {
-    setupTemporalClient(createMockTemporalClient({
-      list: [
-        { workflowId: "chant-component-gated-svc", runId: "r1", type: { name: "gatedSvcComponentWorkflow" }, status: { name: "COMPLETED" }, startTime: new Date("2026-05-01T00:00:00Z"), closeTime: new Date("2026-05-01T01:00:00Z") },
-        { workflowId: "chant-component-gated-svc", runId: "r2", type: { name: "gatedSvcComponentWorkflow" }, status: { name: "RUNNING" }, startTime: new Date("2026-05-02T00:00:00Z") },
-      ],
-    }));
-    loadComponentTemporalCodegenMock.mockResolvedValue({
-      serializeComponent: vi.fn(),
-      componentWorkflowFnName: (name: string) => `${name}ComponentWorkflow`,
-    });
-    const stdout = makeStdoutSpy();
-    const exit = await runOpLog({ args: makeArgs({ extraPositional: "gated-svc", components: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(0);
-    const out = stdout.join("\n");
-    expect(out).toContain("RUN-ID");
-    expect(out).toContain("r1");
-    expect(out).toContain("r2");
-    expect(out).toContain("COMPLETED");
-    expect(out).toContain("RUNNING");
-  });
-});
-
-// ── chant run <name> --components --temporal: config defaults reach codegen ──
-// The interpret/local path fills chant.config's sbom/signing/vulnPolicy
-// defaults via runComponents; the durable path inlines the composition into
-// generated workflow code, so it must apply the same pass before serializing
-// — otherwise the Temporal path silently drops project defaults the local
-// path honors.
-describe("runComponentTemporal — applies chant.config defaults before codegen", () => {
-  beforeEach(() => {
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-    resolveComponentTargetsMock.mockReset();
-    loadComponentTemporalCodegenMock.mockReset();
-    writeFileSyncMock.mockReset();
-    mkdirSyncMock.mockReset();
-  });
-
-  test("serializeComponent receives a component with config's sbom.format filled in", async () => {
-    resolveComponentTargetsMock.mockResolvedValue({
-      success: true,
-      targets: [{
-        name: "search-svc",
-        dependsOn: [],
-        deploy: [{ phase: "Build", steps: [{ kind: "generate-sbom", artifactType: "image", path: "img" }] }],
-      }],
-    });
-    // config sets a project-wide SBOM format the step itself omits.
-    loadChantConfigMock.mockResolvedValue({ config: { sbom: { format: "cyclonedx" } } });
-    resolveProfileMock.mockReturnValue({ autoStart: false, address: "localhost:7233", namespace: "default", taskQueue: "q" });
-
-    const serializeSpy = vi.fn().mockReturnValue({});
-    loadComponentTemporalCodegenMock.mockResolvedValue({
-      serializeComponent: serializeSpy,
-      componentWorkflowFnName: (n: string) => `${n}ComponentWorkflow`,
-    });
-    // Fail the client connect right after codegen so the handler returns
-    // without driving the whole workflow-start machinery — the spy has already
-    // captured the (resolved) component by then.
-    loadTemporalClientMock.mockRejectedValue(new Error("client-unavailable"));
-    makeStderrSpy();
-
-    await runOpComponents({ args: makeArgs({ path: "search-svc", components: true, temporal: true }), plugins: [], serializers: [] });
-
-    expect(serializeSpy).toHaveBeenCalledTimes(1);
-    const passedComponent = serializeSpy.mock.calls[0]![0] as { deploy: Array<{ steps: Array<{ format?: string }> }> };
-    expect(passedComponent.deploy[0]!.steps[0]!.format).toBe("cyclonedx");
-  });
-});
-
-describe("runOpSignal", () => {
-  beforeEach(() => {
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-  });
-
-  test("missing op or signal name → exit 1", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpSignal({ args: makeArgs({ extraPositional: "op-only" }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("Usage:");
-  });
-
-  test("happy path: signal is sent and success message logged", async () => {
-    const mockClient = createMockTemporalClient();
-    setupTemporalClient(mockClient);
+describe("runOpSignalRenamed", () => {
+  test("`run signal` points at `run approve` and never sends anything", async () => {
     const stderr = makeStderrSpy();
-    const exit = await runOpSignal({
+    const exit = await runOpSignalRenamed({
       args: makeArgs({ extraPositional: "alb-deploy", extraPositional2: "gate-dns" }),
       plugins: [], serializers: [],
     });
-    expect(exit).toBe(0);
-    expect(mockClient.calls.signalCalls).toEqual([
-      { workflowId: "chant-op-alb-deploy", signalName: "gate-dns" },
-    ]);
-    expect(stderr.join("\n")).toContain("Signal");
-    expect(stderr.join("\n")).toContain("gate-dns");
-  });
-
-  test("--components: signals the component workflow id, not the Op one (#589)", async () => {
-    const mockClient = createMockTemporalClient();
-    setupTemporalClient(mockClient);
-    const stderr = makeStderrSpy();
-    const exit = await runOpSignal({
-      args: makeArgs({ extraPositional: "gated-svc", extraPositional2: "release-approval", components: true }),
-      plugins: [], serializers: [],
-    });
-    expect(exit).toBe(0);
-    expect(mockClient.calls.signalCalls).toEqual([
-      { workflowId: "chant-component-gated-svc", signalName: "release-approval" },
-    ]);
-    expect(stderr.join("\n")).toContain("component");
+    expect(exit).toBe(1);
+    const out = stderr.join("\n");
+    expect(out).toContain("`chant run signal` is now `chant run approve`");
+    expect(out).toContain("chant run approve alb-deploy gate-dns");
   });
 });
 
 describe("runOpCancel", () => {
   beforeEach(() => {
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
+    discoverOpsMock.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: {} });
+    loadPluginsMock.mockReset().mockResolvedValue([]);
   });
 
-  test("missing op name → exit 1", async () => {
+  test("missing op name -> exit 1", async () => {
     const stderr = makeStderrSpy();
     const exit = await runOpCancel({ args: makeArgs({ extraPositional: undefined }), plugins: [], serializers: [] });
     expect(exit).toBe(1);
     expect(stderr.join("\n")).toContain("Op name is required");
   });
 
-  test("requires --force → exit 1 without it", async () => {
+  test("requires --force -> exit 1 without it", async () => {
     const stderr = makeStderrSpy();
     const exit = await runOpCancel({
       args: makeArgs({ extraPositional: "alb-deploy", force: false }),
@@ -619,52 +135,15 @@ describe("runOpCancel", () => {
     expect(exit).toBe(1);
     expect(stderr.join("\n")).toContain("--force");
   });
-
-  test("with --force: cancel is sent and success logged", async () => {
-    const mockClient = createMockTemporalClient();
-    setupTemporalClient(mockClient);
-    const stderr = makeStderrSpy();
-    const exit = await runOpCancel({
-      args: makeArgs({ extraPositional: "alb-deploy", force: true }),
-      plugins: [], serializers: [],
-    });
-    expect(exit).toBe(0);
-    expect(mockClient.calls.cancelCalls).toEqual([{ workflowId: "chant-op-alb-deploy" }]);
-    expect(stderr.join("\n")).toContain("Cancellation requested");
-  });
-
-  test("--components: cancels the component workflow id, not the Op one (#589)", async () => {
-    const mockClient = createMockTemporalClient();
-    setupTemporalClient(mockClient);
-    const stderr = makeStderrSpy();
-    const exit = await runOpCancel({
-      args: makeArgs({ extraPositional: "gated-svc", force: true, components: true }),
-      plugins: [], serializers: [],
-    });
-    expect(exit).toBe(0);
-    expect(mockClient.calls.cancelCalls).toEqual([{ workflowId: "chant-component-gated-svc" }]);
-    expect(stderr.join("\n")).toContain("component");
-  });
 });
 
-// ── runOp (the main `chant run <name>` command) ─────────────────────────────
-
-function makeFakeChildProcess(): { proc: EventEmitter & { kill: () => void } } {
-  const proc = Object.assign(new EventEmitter(), { kill: vi.fn() });
-  return { proc };
-}
+// ── runOp (the main `chant run <name>` command) ───────────────────────
 
 describe("runOp", () => {
   beforeEach(() => {
     discoverOpsMock.mockReset();
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-    existsSyncMock.mockReset();
-    spawnChildMock.mockReset();
-    generateReportMock.mockReset();
-    writeReportMock.mockReset();
-    waitForTemporalSpy.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: {} });
+    loadPluginsMock.mockReset().mockResolvedValue([]);
   });
 
   test("path defaults to '.' → exit 1 with hint", async () => {
@@ -693,297 +172,226 @@ describe("runOp", () => {
     expect(stderr.join("\n")).toContain("No *.op.ts files found");
   });
 
-  test("profile resolution failure → exit 1", async () => {
-    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("alb-deploy")]), errors: [] });
-    loadChantConfigMock.mockResolvedValue({ config: {} });
-    resolveProfileMock.mockImplementation(() => { throw new Error("Profile not found: prod"); });
-    const stderr = makeStderrSpy();
-    const exit = await runOp({ args: makeArgs({ path: "alb-deploy" }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("Profile not found: prod");
-  });
+});
 
-  test("missing dist/ops/<name>/worker.ts → exit 1 with build hint", async () => {
-    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("alb-deploy")]), errors: [] });
-    loadChantConfigMock.mockResolvedValue({ config: {} });
-    resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-    existsSyncMock.mockReturnValue(false);
-    const stderr = makeStderrSpy();
-    const exit = await runOp({ args: makeArgs({ path: "alb-deploy" }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("worker.ts not found");
-    expect(stderr.join("\n")).toContain("`chant build` first");
-  });
+// ── local mode dispatcher + guards ──────────────────────────────────────────
 
-  test("--report path: prints generated report from describe + history", async () => {
-    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("alb-deploy")]), errors: [] });
-    setupTemporalClient(createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-op-alb-deploy": {
-          workflowId: "chant-op-alb-deploy", runId: "r1",
-          status: { name: "COMPLETED" }, startTime: new Date(),
-          taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-        },
-      },
-      historyByWorkflowId: { "chant-op-alb-deploy": [] },
-    }));
-    generateReportMock.mockReturnValue("# Report\nDeploy completed.");
-    const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+function localOp(name: string, steps: unknown[]) {
+  return [name, { config: { name, overview: `${name} overview`, phases: [{ name: "Phase", steps }] } }] as const;
+}
 
-    const exit = await runOp({ args: makeArgs({ path: "alb-deploy", report: true }), plugins: [], serializers: [] });
+describe("runOp dispatcher", () => {
+  beforeEach(() => {
+    discoverOpsMock.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: {} });
+    loadPluginsMock.mockReset().mockResolvedValue([]);
+  });
 
+  test("no --on → the built-in local runtime runs the Op in this process", async () => {
+    discoverOpsMock.mockResolvedValue({
+      ops: new Map([localOp("hello", [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }])]),
+      errors: [],
+    });
+    const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const exit = await runOp({ args: makeArgs({ path: "hello" }), plugins: [], serializers: [] });
     expect(exit).toBe(0);
-    expect(generateReportMock).toHaveBeenCalledTimes(1);
-    expect(stdoutSpy).toHaveBeenCalledWith("# Report\nDeploy completed.");
-    stdoutSpy.mockRestore();
+    expect(loadPluginsMock).not.toHaveBeenCalled();
+    stderrWrite.mockRestore();
   });
 
-  test("happy path: spawns worker, starts workflow, polls until COMPLETED, writes report, exits 0", async () => {
-    vi.useFakeTimers();
-    try {
-      discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("alb-deploy")]), errors: [] });
-      const mockClient = createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-op-alb-deploy": {
-            workflowId: "chant-op-alb-deploy", runId: "r1",
-            status: { name: "COMPLETED" }, startTime: new Date(),
-            taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-          },
-        },
-        historyByWorkflowId: {
-          "chant-op-alb-deploy": [{ eventType: "ActivityTaskScheduled" }, { eventType: "ActivityTaskCompleted" }],
-        },
-      });
-      setupTemporalClient(mockClient);
-      existsSyncMock.mockReturnValue(true);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      generateReportMock.mockReturnValue("# Report");
-      writeReportMock.mockReturnValue("/tmp/report.md");
-      const stderrWriteSpy = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-
-      const promise = runOp({ args: makeArgs({ path: "alb-deploy" }), plugins: [], serializers: [] });
-      // Drive the polling loop forward.
-      await vi.advanceTimersByTimeAsync(5000);
-
-      const exit = await promise;
-      expect(exit).toBe(0);
-      expect(spawnChildMock).toHaveBeenCalledTimes(1);
-      expect(spawnChildMock.mock.calls[0][0]).toBe("npx");
-      expect(mockClient.calls.startCalls).toHaveLength(1);
-      expect(mockClient.calls.startCalls[0].opts.workflowId).toBe("chant-op-alb-deploy");
-      expect(generateReportMock).toHaveBeenCalledTimes(1);
-      expect(writeReportMock).toHaveBeenCalledTimes(1);
-      expect(proc.kill).toHaveBeenCalled();
-
-      stderrWriteSpy.mockRestore();
-    } finally {
-      vi.useRealTimers();
-    }
+  test("--report → exit 1 naming the removal, nothing run (#2116)", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    const stderr = makeStderrSpy();
+    const exit = await runOp({ args: makeArgs({ path: "hello", report: true }), plugins: [], serializers: [] });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain("#2116 removed");
+    expect(discoverOpsMock).not.toHaveBeenCalled();
   });
 
-  // ── --progress-json (#1676) ──────────────────────────────────────────────
-
-  test("--progress-json streams one NDJSON StepRecord per settled step, plus a final skipped record", async () => {
-    vi.useFakeTimers();
-    try {
-      discoverOpsMock.mockResolvedValue({
-        ops: new Map([[
-          "alb-deploy",
-          {
-            config: {
-              name: "alb-deploy", overview: "o",
-              phases: [
-                { name: "Build", steps: [{ kind: "activity", fn: "build" }] },
-                { name: "Deploy", steps: [{ kind: "activity", fn: "deploy" }] },
-              ],
-            },
-          },
-        ]]),
-        errors: [],
-      });
-      setupTemporalClient(createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-op-alb-deploy": {
-            workflowId: "chant-op-alb-deploy", runId: "r1",
-            status: { name: "COMPLETED" }, startTime: new Date(),
-            taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-          },
-        },
-        historyByWorkflowId: {
-          "chant-op-alb-deploy": [
-            { eventId: "1", eventType: "ActivityTaskScheduled", activityTaskScheduledEventAttributes: { activityId: "1", activityType: { name: "build" } } },
-            { eventType: "ActivityTaskCompleted", activityTaskCompletedEventAttributes: { scheduledEventId: "1" } },
-          ],
-        },
-      }));
-      existsSyncMock.mockReturnValue(true);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      generateReportMock.mockReturnValue("# Report");
-      writeReportMock.mockReturnValue("/tmp/report.md");
-      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-      const stdoutLines: string[] = [];
-      const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation((chunk) => { stdoutLines.push(String(chunk)); return true; });
-
-      const promise = runOp({ args: makeArgs({ path: "alb-deploy", progressJson: true }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
-      const exit = await promise;
-
-      expect(exit).toBe(0);
-      const records = stdoutLines.filter((l) => l.trim()).map((l) => JSON.parse(l));
-      expect(records).toEqual([
-        { phase: "Build", fn: "build", status: "ok", durationMs: 0 },
-        { phase: "Deploy", fn: "deploy", status: "skipped", durationMs: 0 },
-      ]);
-      stdoutSpy.mockRestore();
-    } finally {
-      vi.useRealTimers();
-    }
-  }, 10_000);
-
-  test("without --progress-json, nothing is written to stdout during the poll loop", async () => {
-    vi.useFakeTimers();
-    try {
-      discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("alb-deploy")]), errors: [] });
-      setupTemporalClient(createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-op-alb-deploy": {
-            workflowId: "chant-op-alb-deploy", runId: "r1",
-            status: { name: "COMPLETED" }, startTime: new Date(),
-            taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-          },
-        },
-        historyByWorkflowId: { "chant-op-alb-deploy": [] },
-      }));
-      existsSyncMock.mockReturnValue(true);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      generateReportMock.mockReturnValue("# Report");
-      writeReportMock.mockReturnValue("/tmp/report.md");
-      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-      const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
-
-      const promise = runOp({ args: makeArgs({ path: "alb-deploy" }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
-      await promise;
-
-      expect(stdoutSpy).not.toHaveBeenCalled();
-      stdoutSpy.mockRestore();
-    } finally {
-      vi.useRealTimers();
-    }
+  test("gate in local mode → exit 3 and the approve line (#2119)", async () => {
+    gateLedger = memoryGateLedgerPort();
+    discoverOpsMock.mockResolvedValue({
+      ops: new Map([localOp("gated", [{ kind: "gate", gate: "approve-prod" }])]),
+      errors: [],
+    });
+    // `renderHuman` writes straight to process.stderr, not through console.error.
+    const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const exit = await runOp({ args: makeArgs({ path: "gated" }), plugins: [], serializers: [] });
+    expect(exit).toBe(3);
+    const out = stderrWrite.mock.calls.map((c) => String(c[0])).join("");
+    stderrWrite.mockRestore();
+    expect(out).toContain('is gated on "approve-prod"');
+    expect(out).toContain("chant approve gated approve-prod");
+    expect(gateLedger.appended).toHaveLength(1);
   });
 
-  test("workflow ends in FAILED → exit 1, worker still killed", async () => {
-    vi.useFakeTimers();
-    try {
-      discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("alb-deploy")]), errors: [] });
-      const mockClient = createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-op-alb-deploy": {
-            workflowId: "chant-op-alb-deploy", runId: "r1",
-            status: { name: "FAILED" }, startTime: new Date(),
-            taskQueue: "alb-deploy", type: { name: "albDeployWorkflow" },
-          },
-        },
-        historyByWorkflowId: { "chant-op-alb-deploy": [] },
-      });
-      setupTemporalClient(mockClient);
-      existsSyncMock.mockReturnValue(true);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      generateReportMock.mockReturnValue("# Report");
-      writeReportMock.mockReturnValue("/tmp/report.md");
-      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-
-      const promise = runOp({ args: makeArgs({ path: "alb-deploy" }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
+  test("an approved gate lets the run through and exits 0", async () => {
+    gateLedger = memoryGateLedgerPort({
+      pending: [{
+        version: 1, kind: "pending", op: "gated", gate: "approve-prod",
+        timestamp: "2026-09-05T10:00:00.000Z", expiresAt: "2099-01-01T00:00:00.000Z",
+      }],
+      resolutions: [{
+        version: 1, op: "gated", gate: "approve-prod",
+        resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z",
+      }],
+    });
+    discoverOpsMock.mockResolvedValue({
+      ops: new Map([localOp("gated", [
+        { kind: "gate", gate: "approve-prod" },
+        { kind: "activity", fn: "shellCmd", args: { cmd: "true" } },
+      ])]),
+      errors: [],
+    });
+    const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const exit = await runOp({ args: makeArgs({ path: "gated" }), plugins: [], serializers: [] });
+    expect(exit).toBe(0);
+    expect(stderrWrite.mock.calls.map((c) => String(c[0])).join("")).toContain("[approved] alex");
+    stderrWrite.mockRestore();
+  });
 
-      const exit = await promise;
-      expect(exit).toBe(1);
-      expect(proc.kill).toHaveBeenCalled();
-    } finally {
-      vi.useRealTimers();
-    }
+  test("--json → the run's ledger record on stdout (#2118)", async () => {
+    discoverOpsMock.mockResolvedValue({
+      ops: new Map([localOp("hello", [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }])]),
+      errors: [],
+    });
+    const stdoutWrite = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const exit = await runOp({ args: makeArgs({ path: "hello", json: true }), plugins: [], serializers: [] });
+    expect(exit).toBe(0);
+    const printed = stdoutWrite.mock.calls.map((c) => String(c[0])).join("");
+    const parsed = JSON.parse(printed.trim());
+    expect(parsed.op).toBe("hello");
+    expect(parsed.version).toBe(1);
+    expect(parsed.status).toBe("ok");
+    expect(parsed.phases[0].steps[0]).toMatchObject({ fn: "shellCmd", status: "ok" });
+    vi.restoreAllMocks();
   });
 });
 
-// ── local mode dispatcher + guards ──────────────────────────────────────────
+/**
+ * chant #2243 — a gated run's exit code is the one thing `--gated-exit`
+ * remaps, and the gate is reported where CI can see it without opening a log.
+ *
+ * The motivating shape is a push-to-main terraform apply: GitHub Actions has
+ * no neutral conclusion for a `run:` step, so exit 3 paints the branch red on
+ * every merge until someone approves. `--gated-exit 0` says a pending
+ * approval is not a broken build; nothing else about the run changes, and a
+ * failure is still a failure.
+ */
+describe("runOp: --gated-exit (#2243)", () => {
+  const gateStep = { kind: "gate", gate: "approve-prod" };
 
-function localOp(name: string, steps: unknown[]) {
-  return [name, { config: { name, overview: `${name} overview`, phases: [{ name: "Phase", steps }] } }] as const;
-}
+  function summaryFile(): string {
+    return join(mkdtempSync(join(tmpdir(), "chant-gated-exit-")), "summary.md");
+  }
 
-describe("runOp dispatcher", () => {
   beforeEach(() => {
     discoverOpsMock.mockReset();
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-    existsSyncMock.mockReset();
-    spawnChildMock.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: {} });
+    loadPluginsMock.mockReset().mockResolvedValue([]);
+    gateLedger = memoryGateLedgerPort();
+    delete process.env.GITHUB_STEP_SUMMARY;
+  });
+
+  afterEach(() => {
+    delete process.env.GITHUB_STEP_SUMMARY;
+    vi.restoreAllMocks();
+  });
+
+  test("unmapped: without the flag a gated run still exits 3", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([localOp("gated", [gateStep])]), errors: [] });
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const exit = await runOp({ args: makeArgs({ path: "gated" }), plugins: [], serializers: [] });
+    expect(exit).toBe(3);
   });
 
-  test("no flag → local executor (no Temporal client or worker spawned)", async () => {
-    discoverOpsMock.mockResolvedValue({
-      ops: new Map([localOp("hello", [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }])]),
-      errors: [],
+  test("mapped: --gated-exit 0 exits 0 and writes the gate to GITHUB_STEP_SUMMARY", async () => {
+    const file = summaryFile();
+    process.env.GITHUB_STEP_SUMMARY = file;
+    discoverOpsMock.mockResolvedValue({ ops: new Map([localOp("gated", [gateStep])]), errors: [] });
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    const stderr = makeStderrSpy();
+
+    const exit = await runOp({
+      args: makeArgs({ path: "gated", gatedExit: 0 }),
+      plugins: [], serializers: [],
     });
-    const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-    const exit = await runOp({ args: makeArgs({ path: "hello", temporal: false }), plugins: [], serializers: [] });
+
     expect(exit).toBe(0);
-    expect(loadTemporalClientMock).not.toHaveBeenCalled();
-    expect(spawnChildMock).not.toHaveBeenCalled();
-    stderrWrite.mockRestore();
-  });
+    // The run genuinely stopped: the pending fact is on the ledger, and
+    // nothing after the gate ran.
+    expect(gateLedger.appended).toHaveLength(1);
+    const summary = readFileSync(file, "utf8");
+    expect(summary).toContain("approve-prod");
+    expect(summary).toContain("chant approve gated approve-prod");
+    expect(summary).toContain("_gates/gated.jsonl");
+    // A green run that applied nothing says so on stderr too.
+    expect(stderr.join("\n")).toContain("exiting 0");
+  });
+
+  test("mapped: the --json payload still reports the gate, not a success", async () => {
+    const file = summaryFile();
+    process.env.GITHUB_STEP_SUMMARY = file;
+    discoverOpsMock.mockResolvedValue({ ops: new Map([localOp("gated", [gateStep])]), errors: [] });
+    const stdoutWrite = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    makeStderrSpy();
 
-  test("--temporal → Temporal path (missing worker.ts → exit 1)", async () => {
-    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
-    loadChantConfigMock.mockResolvedValue({ config: {} });
-    resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-    existsSyncMock.mockReturnValue(false);
-    const stderr = makeStderrSpy();
-    const exit = await runOp({ args: makeArgs({ path: "hello", temporal: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("worker.ts not found");
+    const exit = await runOp({
+      args: makeArgs({ path: "gated", gatedExit: 0, json: true }),
+      plugins: [], serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    const parsed = JSON.parse(stdoutWrite.mock.calls.map((c) => String(c[0])).join("").trim());
+    expect(parsed.status).toBe("gated");
+    expect(parsed.gate).toMatchObject({ name: "approve-prod" });
+    expect(parsed.approve).toBe("chant approve gated approve-prod");
+    // The summary is written whether or not stdout is machine-readable.
+    expect(readFileSync(file, "utf8")).toContain("chant approve gated approve-prod");
   });
 
-  test("gate in local mode → fast-fail before execution, suggests --temporal", async () => {
+  test("a run that fails for any other reason is still red under the flag", async () => {
     discoverOpsMock.mockResolvedValue({
-      ops: new Map([localOp("gated", [{ kind: "gate", signalName: "approve-prod" }])]),
+      ops: new Map([localOp("broken", [{ kind: "activity", fn: "shellCmd", args: { cmd: "exit 7" } }])]),
       errors: [],
     });
-    const stderr = makeStderrSpy();
-    const exit = await runOp({ args: makeArgs({ path: "gated", temporal: false }), plugins: [], serializers: [] });
+    const file = summaryFile();
+    process.env.GITHUB_STEP_SUMMARY = file;
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+
+    const exit = await runOp({
+      args: makeArgs({ path: "broken", gatedExit: 0 }),
+      plugins: [], serializers: [],
+    });
+
     expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("--temporal");
-    expect(loadTemporalClientMock).not.toHaveBeenCalled();
+    // Nothing is pending, so nothing is reported as pending.
+    expect(existsSync(file)).toBe(false);
   });
 
-  test("--local and --temporal together → exit 1 before any work", async () => {
+  test("a value that is not an exit status is refused before the Op runs", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([localOp("gated", [gateStep])]), errors: [] });
     const stderr = makeStderrSpy();
-    const exit = await runOp({ args: makeArgs({ path: "hello", local: true, temporal: true }), plugins: [], serializers: [] });
+    const exit = await runOp({
+      args: makeArgs({ path: "gated", gatedExit: 300 }),
+      plugins: [], serializers: [],
+    });
     expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("mutually exclusive");
+    expect(stderr.join("\n")).toContain("--gated-exit expects a whole number from 0 to 255");
     expect(discoverOpsMock).not.toHaveBeenCalled();
-    expect(loadTemporalClientMock).not.toHaveBeenCalled();
   });
 
-  test("--json → structured result on stdout", async () => {
-    discoverOpsMock.mockResolvedValue({
-      ops: new Map([localOp("hello", [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }])]),
-      errors: [],
-    });
-    const stdoutWrite = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+  test("no GITHUB_STEP_SUMMARY, no file: the variable is the whole forge coupling", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([localOp("gated", [gateStep])]), errors: [] });
     vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-    const exit = await runOp({ args: makeArgs({ path: "hello", temporal: false, json: true }), plugins: [], serializers: [] });
+    const exit = await runOp({
+      args: makeArgs({ path: "gated", gatedExit: 0 }),
+      plugins: [], serializers: [],
+    });
     expect(exit).toBe(0);
-    const printed = stdoutWrite.mock.calls.map((c) => String(c[0])).join("");
-    const parsed = JSON.parse(printed.trim());
-    expect(parsed.op).toBe("hello");
-    expect(parsed.ok).toBe(true);
-    vi.restoreAllMocks();
+    expect(process.env.GITHUB_STEP_SUMMARY).toBeUndefined();
   });
 });
 
@@ -1001,18 +409,15 @@ describe("runOp: --sandbox with a policyGate step (chant #2003)", () => {
 
   beforeEach(() => {
     discoverOpsMock.mockReset();
-    loadTemporalClientMock.mockReset();
-    loadChantConfigMock.mockReset();
-    resolveProfileMock.mockReset();
-    existsSyncMock.mockReset();
-    spawnChildMock.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: { lexicons: ["stub"] } });
+    loadPluginsMock.mockReset().mockResolvedValue([]);
   });
 
-  test("local mode → refuses before any phase runs, naming the combination", async () => {
+  test("refuses before any phase runs, naming the combination", async () => {
     discoverOpsMock.mockResolvedValue({ ops: new Map([policyGateOp("gate")]), errors: [] });
     const stderr = makeStderrSpy();
 
-    const exit = await runOp({ args: makeArgs({ path: "gate", temporal: false, sandbox: true }), plugins: [], serializers: [] });
+    const exit = await runOp({ args: makeArgs({ path: "gate", sandbox: true }), plugins: [], serializers: [] });
 
     expect(exit).toBe(1);
     const out = stderr.join("\n");
@@ -1022,19 +427,6 @@ describe("runOp: --sandbox with a policyGate step (chant #2003)", () => {
     expect(out).not.toContain("This is a chant bug");
   });
 
-  test("--temporal → the same refusal, as a CLI error rather than an activity failure", async () => {
-    discoverOpsMock.mockResolvedValue({ ops: new Map([policyGateOp("gate")]), errors: [] });
-    const stderr = makeStderrSpy();
-
-    const exit = await runOp({ args: makeArgs({ path: "gate", temporal: true, sandbox: true }), plugins: [], serializers: [] });
-
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("policyGate");
-    // Refused before the project config is even loaded — nothing is scheduled.
-    expect(loadChantConfigMock).not.toHaveBeenCalled();
-    expect(loadTemporalClientMock).not.toHaveBeenCalled();
-  });
-
   test("a policyGate nested in an effect step is found too", async () => {
     discoverOpsMock.mockResolvedValue({
       ops: new Map([
@@ -1046,7 +438,7 @@ describe("runOp: --sandbox with a policyGate step (chant #2003)", () => {
     });
     const stderr = makeStderrSpy();
 
-    const exit = await runOp({ args: makeArgs({ path: "gate", temporal: false, sandbox: true }), plugins: [], serializers: [] });
+    const exit = await runOp({ args: makeArgs({ path: "gate", sandbox: true }), plugins: [], serializers: [] });
 
     expect(exit).toBe(1);
     expect(stderr.join("\n")).toContain("policyGate");
@@ -1054,19 +446,68 @@ describe("runOp: --sandbox with a policyGate step (chant #2003)", () => {
 
   test("without --sandbox the same Op is not refused", async () => {
     discoverOpsMock.mockResolvedValue({ ops: new Map([policyGateOp("gate")]), errors: [] });
-    loadChantConfigMock.mockResolvedValue({ config: {} });
-    resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-    existsSyncMock.mockReturnValue(false);
+    const start = vi.fn(async () => ({
+      op: "gate",
+      runId: "stub-1",
+      result: async () => ({ op: "gate", runId: "stub-1", state: "completed", startedAt: "2026-01-01T00:00:00.000Z" }),
+    }));
+    makeStdoutSpy();
     const stderr = makeStderrSpy();
 
-    // The Temporal path, so the run stops at the missing worker.ts rather than
-    // actually building a project: reaching that point proves the pre-flight
-    // let it through.
-    const exit = await runOp({ args: makeArgs({ path: "gate", temporal: true }), plugins: [], serializers: [] });
+    // On a stub runtime, so reaching `start` proves the pre-flight let it
+    // through without the policyGate itself having to run here.
+    const exit = await runOp({
+      args: makeArgs({ path: "gate", on: "stub" }),
+      plugins: [{ name: "stub", opRuntime: { name: "stub", start } } as never], serializers: [],
+    });
 
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("worker.ts not found");
-    expect(loadChantConfigMock).toHaveBeenCalled();
+    expect(exit).toBe(0);
+    expect(start).toHaveBeenCalledTimes(1);
+    expect(stderr.join("\n")).not.toContain("policyGate");
+  });
+
+  // #2192 — `--profile` is core's flag and the runtime's meaning. The handler
+  // only has to hand it over; fountain's own tests cover what it does with it.
+  test("--profile reaches the hosting runtime's start options", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("prod-apply")]), errors: [] });
+    const start = vi.fn(async () => ({
+      op: "prod-apply",
+      runId: "stub-1",
+      result: async () => ({ op: "prod-apply", runId: "stub-1", state: "completed", startedAt: "2026-01-01T00:00:00.000Z" }),
+    }));
+    makeStdoutSpy();
+    makeStderrSpy();
+
+    const exit = await runOp({
+      args: makeArgs({ path: "prod-apply", on: "stub", profile: "staging" }),
+      plugins: [{ name: "stub", opRuntime: { name: "stub", start } } as never], serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(start).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ profile: "staging" }));
+  });
+
+  test("without --profile the runtime is left to its own default", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("prod-apply")]), errors: [] });
+    let seen: Record<string, unknown> | undefined;
+    const start = vi.fn(async (_op: unknown, opts: Record<string, unknown>) => {
+      seen = opts;
+      return {
+        op: "prod-apply",
+        runId: "stub-1",
+        result: async () => ({ op: "prod-apply", runId: "stub-1", state: "completed", startedAt: "2026-01-01T00:00:00.000Z" }),
+      };
+    });
+    makeStdoutSpy();
+    makeStderrSpy();
+
+    await runOp({
+      args: makeArgs({ path: "prod-apply", on: "stub" }),
+      plugins: [{ name: "stub", opRuntime: { name: "stub", start } } as never], serializers: [],
+    });
+
+    expect(seen).toBeDefined();
+    expect(seen).not.toHaveProperty("profile");
   });
 
   test("--sandbox on an Op with no policyGate step is untouched", async () => {
@@ -1076,27 +517,220 @@ describe("runOp: --sandbox with a policyGate step (chant #2003)", () => {
     });
     const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    const exit = await runOp({ args: makeArgs({ path: "hello", temporal: false, sandbox: true }), plugins: [], serializers: [] });
+    const exit = await runOp({ args: makeArgs({ path: "hello", sandbox: true }), plugins: [], serializers: [] });
 
     expect(exit).toBe(0);
     stderrWrite.mockRestore();
   });
 });
 
-describe("Temporal-only subcommand guards", () => {
+/**
+ * #2116 — `run list/status/log/cancel --components` reported a component's
+ * durable run state. Nothing keeps one any more, so each refuses with a line
+ * that says so and points at the command that still answers. The Op-path
+ * counterparts run on the resolved runtime, covered below.
+ */
+describe("run <sub> --components refuses (#2116)", () => {
   const cases: Array<[string, (ctx: { args: ParsedArgs; plugins: never[]; serializers: never[] }) => Promise<number>]> = [
     ["list", runOpList],
     ["status", runOpStatus],
     ["log", runOpLog],
-    ["signal", runOpSignal],
     ["cancel", runOpCancel],
   ];
 
-  test.each(cases)("run %s without --temporal → exit 1 + actionable message", async (_name, handler) => {
+  test.each(cases)("run %s --components -> exit 1 naming the removal", async (_name, handler) => {
+    const stderr = makeStderrSpy();
+    const exit = await handler({
+      args: makeArgs({ components: true, force: true, extraPositional: "x", extraPositional2: "y" }),
+      plugins: [], serializers: [],
+    });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain("durable run state, which #2116 removed");
+  });
+
+  test("run list --components points at `chant list --components`", async () => {
+    const stderr = makeStderrSpy();
+    const exit = await runOpList({ args: makeArgs({ components: true }), plugins: [], serializers: [] });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain("chant list --components");
+    expect(listComponentsMock).not.toHaveBeenCalled();
+  });
+});
+
+// ── the runtime seam (#2121) ────────────────────────────────────────────────
+
+describe("run subcommands on the resolved runtime", () => {
+  function makeStubRuntime(overrides: Record<string, unknown> = {}) {
+    return {
+      name: "stub",
+      start: vi.fn(async (op: { name: string }) => ({
+        op: op.name,
+        runId: "stub-1",
+        result: async () => ({
+          op: op.name, runId: "stub-1", state: "completed", startedAt: "2026-01-01T00:00:00.000Z",
+          endedAt: "2026-01-01T00:00:05.000Z",
+        }),
+      })),
+      status: vi.fn(async (op: string) => ({
+        op, runId: "stub-1", state: "running", startedAt: "2026-01-01T00:00:00.000Z",
+      })),
+      // A provider's `log` returns run-ledger records (#2118), newest first.
+      log: vi.fn(async (op: string) => [
+        {
+          version: 1, id: "stub-1", op, env: "staging", status: "ok",
+          started: "2026-01-01T00:00:00.000Z", ended: "2026-01-01T00:00:05.000Z",
+          labels: {}, outcomes: {}, phases: [],
+        },
+      ]),
+      list: vi.fn(async (ops: Array<{ name: string }>) =>
+        new Map(ops.map((o) => [o.name, { op: o.name, runId: "stub-1", state: "completed", startedAt: "2026-01-01T00:00:00.000Z" }]))),
+      cancel: vi.fn(async () => undefined),
+      ...overrides,
+    };
+  }
+
+  function stubPlugin(runtime: unknown) {
+    return { name: "stub", opRuntime: runtime } as never;
+  }
+
+  beforeEach(() => {
+    discoverOpsMock.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: { lexicons: ["stub"] } });
+    loadPluginsMock.mockReset().mockResolvedValue([]);
+  });
+
+  test("--on stub reaches the stub lexicon's start", async () => {
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    makeStdoutSpy();
+    const exit = await runOp({
+      args: makeArgs({ path: "hello", on: "stub" }),
+      plugins: [stubPlugin(runtime)], serializers: [],
+    });
+    expect(exit).toBe(0);
+    expect(runtime.start).toHaveBeenCalledTimes(1);
+    expect((runtime.start.mock.calls[0][0] as { name: string }).name).toBe("hello");
+  });
+
+  test("run status/log/list/cancel --on stub reach their methods", async () => {
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    makeStdoutSpy();
+    makeStderrSpy();
+    const ctx = (over: Partial<ParsedArgs>) => ({
+      args: makeArgs({ on: "stub", ...over }),
+      plugins: [stubPlugin(runtime)], serializers: [],
+    });
+
+    expect(await runOpStatus(ctx({ extraPositional: "hello" }))).toBe(0);
+    expect(await runOpLog(ctx({ extraPositional: "hello" }))).toBe(0);
+    expect(await runOpList(ctx({}))).toBe(0);
+    expect(await runOpCancel(ctx({ extraPositional: "hello", force: true }))).toBe(0);
+
+    expect(runtime.status).toHaveBeenCalledWith("hello");
+    expect(runtime.log).toHaveBeenCalledWith("hello", undefined);
+    expect(runtime.list).toHaveBeenCalledTimes(1);
+    expect(runtime.cancel).toHaveBeenCalledWith("hello", { force: true });
+  });
+
+  test("--on nope → exit 1 naming the configured lexicons", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    loadChantConfigMock.mockResolvedValue({ config: { lexicons: ["aws", "k8s"] } });
+    const stderr = makeStderrSpy();
+    const exit = await runOp({
+      args: makeArgs({ path: "hello", on: "nope" }),
+      plugins: [], serializers: [],
+    });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain("is not a configured lexicon");
+    expect(stderr.join("\n")).toContain("aws, k8s");
+  });
+
+  test("--on a lexicon with no opRuntime → exit 1 naming the lexicon", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    const stderr = makeStderrSpy();
+    const exit = await runOp({
+      args: makeArgs({ path: "hello", on: "plain" }),
+      plugins: [{ name: "plain" } as never], serializers: [],
+    });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain('lexicon "plain" does not host Op runs');
+  });
+
+  test("--components on a runtime that cannot host them → one line, exit 1", async () => {
+    const runtime = makeStubRuntime();
+    const stderr = makeStderrSpy();
+    const exit = await runOpComponents({
+      args: makeArgs({ path: "search-service", components: true, on: "stub" }),
+      plugins: [stubPlugin(runtime)], serializers: [],
+    });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain('--components is not supported on the "stub" runtime');
+    expect(runComponentsMock).not.toHaveBeenCalled();
+  });
+});
+
+describe("runOpApprove", () => {
+  beforeEach(() => {
+    recordGateApprovalMock.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: { lexicons: ["stub"] } });
+    loadPluginsMock.mockReset().mockResolvedValue([]);
+  });
+
+  test("missing op or gate name → exit 1, nothing recorded", async () => {
+    const stderr = makeStderrSpy();
+    const exit = await runOpApprove({
+      args: makeArgs({ extraPositional: "alb-deploy" }),
+      plugins: [], serializers: [],
+    });
+    expect(exit).toBe(1);
+    expect(stderr.join("\n")).toContain("chant run approve <op> <gate>");
+    expect(recordGateApprovalMock).not.toHaveBeenCalled();
+  });
+
+  test("writes the resolution, then calls the provider's resolveGate", async () => {
+    const record = { version: 1, op: "alb-deploy", gate: "release", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z" };
+    recordGateApprovalMock.mockResolvedValue({ ok: true, record });
+    const resolveGate = vi.fn(async () => undefined);
+    const stderr = makeStderrSpy();
+
+    const exit = await runOpApprove({
+      args: makeArgs({ on: "stub", extraPositional: "alb-deploy", extraPositional2: "release", approver: "alex" }),
+      plugins: [{ name: "stub", opRuntime: { name: "stub", resolveGate } } as never], serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(recordGateApprovalMock).toHaveBeenCalledWith("alb-deploy", "release", {
+      actor: "alex", note: undefined, url: undefined,
+    });
+    expect(resolveGate).toHaveBeenCalledWith("alb-deploy", "release", record);
+    expect(stderr.join("\n")).toContain('Runtime "stub" was notified');
+  });
+
+  test("a provider with no resolveGate still records the fact and exits 0", async () => {
+    const record = { version: 1, op: "alb-deploy", gate: "release", resolvedBy: "ci", timestamp: "2026-01-01T00:00:00.000Z" };
+    recordGateApprovalMock.mockResolvedValue({ ok: true, record });
     const stderr = makeStderrSpy();
-    const exit = await handler({ args: makeArgs({ temporal: false, extraPositional: "x", extraPositional2: "y" }), plugins: [], serializers: [] });
+
+    const exit = await runOpApprove({
+      args: makeArgs({ extraPositional: "alb-deploy", extraPositional2: "release" }),
+      plugins: [], serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(recordGateApprovalMock).toHaveBeenCalledTimes(1);
+    expect(stderr.join("\n")).toContain("when the op next runs");
+  });
+
+  test("a refused ledger write → exit 1 without waking the runtime", async () => {
+    recordGateApprovalMock.mockResolvedValue({ ok: false });
+    const resolveGate = vi.fn(async () => undefined);
+    const exit = await runOpApprove({
+      args: makeArgs({ on: "stub", extraPositional: "alb-deploy", extraPositional2: "release" }),
+      plugins: [{ name: "stub", opRuntime: { name: "stub", resolveGate } } as never], serializers: [],
+    });
     expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("not available in local mode");
+    expect(resolveGate).not.toHaveBeenCalled();
   });
 });
 
@@ -1112,10 +746,10 @@ describe("runOp dispatcher: --components routes to runOpComponents", () => {
 
   test("runOp with --components dispatches to runComponents, not Op discovery", async () => {
     discoverOpsMock.mockReset();
-    runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true } });
+    runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" } });
     vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    const exit = await runOp({ args: makeArgs({ path: "svc", components: true, temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOp({ args: makeArgs({ path: "svc", components: true }), plugins: [], serializers: [] });
 
     expect(exit).toBe(0);
     expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", { env: undefined, componentOutputs: {}, buildParams: [] });
@@ -1123,15 +757,14 @@ describe("runOp dispatcher: --components routes to runOpComponents", () => {
     vi.restoreAllMocks();
   });
 
-  // chant #1116 — --report is Op/Temporal-only (reads a past workflow run);
-  // the component driver never checked it, so it was silently ignored and the
-  // command fell through to a real dispatch. Hard-error instead, before
-  // runComponents is ever reached.
+  // chant #1116 — the component driver never checked --report, so it was
+  // silently ignored and the command fell through to a real dispatch.
+  // Hard-error instead, before runComponents is ever reached.
   test("--report combined with --components → exit 1 before any dispatch, no fall-through (#1116)", async () => {
     discoverOpsMock.mockReset();
     const stderr = makeStderrSpy();
 
-    const exit = await runOp({ args: makeArgs({ path: "svc", components: true, report: true, temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOp({ args: makeArgs({ path: "svc", components: true, report: true }), plugins: [], serializers: [] });
 
     expect(exit).toBe(1);
     expect(stderr.join("\n")).toContain("not supported with --components");
@@ -1144,10 +777,10 @@ describe("runOp dispatcher: --components routes to runOpComponents", () => {
   // real dispatch through runComponents — mocked here, never a real cloud call.
   test("plain --components (no --report) still dispatches to runComponents (#1116 regression guard)", async () => {
     discoverOpsMock.mockReset();
-    runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true } });
+    runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" } });
     vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    const exit = await runOp({ args: makeArgs({ path: "svc", components: true, report: false, temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOp({ args: makeArgs({ path: "svc", components: true, report: false }), plugins: [], serializers: [] });
 
     expect(exit).toBe(0);
     expect(runComponentsMock).toHaveBeenCalled();
@@ -1165,7 +798,7 @@ describe("runOpComponents", () => {
 
   test("no component name → exit 1 with hint", async () => {
     const stderr = makeStderrSpy();
-    const exit = await runOpComponents({ args: makeArgs({ path: ".", temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOpComponents({ args: makeArgs({ path: "." }), plugins: [], serializers: [] });
     expect(exit).toBe(1);
     expect(stderr.join("\n")).toContain("Component name is required");
     expect(runComponentsMock).not.toHaveBeenCalled();
@@ -1181,11 +814,11 @@ describe("runOpComponents", () => {
       runComponentsMock.mockResolvedValue({
         success: true,
         selected: ["svc"],
-        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
       });
       const stderr = makeStderrSpy();
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(0);
       expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", expect.objectContaining({
@@ -1203,13 +836,13 @@ describe("runOpComponents", () => {
       runComponentsMock.mockResolvedValue({
         success: true,
         selected: ["svc"],
-        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
       });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
       const stderr = makeStderrSpy();
 
       const exit = await runOpComponents({
-        args: makeArgs({ path: "svc", temporal: false, param: ["tier=production"] }),
+        args: makeArgs({ path: "svc", param: ["tier=production"] }),
         plugins: [],
         serializers: [],
       });
@@ -1228,7 +861,7 @@ describe("runOpComponents", () => {
       });
       const stderr = makeStderrSpy();
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(1);
       expect(stderr.join("\n")).toMatch(/"tier"/);
@@ -1242,7 +875,7 @@ describe("runOpComponents", () => {
       const stderr = makeStderrSpy();
 
       const exit = await runOpComponents({
-        args: makeArgs({ path: "svc", temporal: false, param: ["tier=bogus"] }),
+        args: makeArgs({ path: "svc", param: ["tier=bogus"] }),
         plugins: [],
         serializers: [],
       });
@@ -1261,13 +894,14 @@ describe("runOpComponents", () => {
       run: {
         order: ["svc"],
         waves: [["svc"]],
-        results: [{ component: "svc", ok: true, records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "ok", durationMs: 5 }] }],
+        results: [{ component: "svc", ok: true, status: "ok", records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "ok", durationMs: 5 }] }],
         ok: true,
+        status: "ok",
       },
     });
     const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
     expect(exit).toBe(0);
     expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", { env: undefined, componentOutputs: {}, buildParams: [] });
@@ -1277,21 +911,21 @@ describe("runOpComponents", () => {
   });
 
   test("threads --env through to runComponents", async () => {
-    runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true } });
+    runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" } });
     vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    await runOpComponents({ args: makeArgs({ path: "svc", env: "staging", temporal: false }), plugins: [], serializers: [] });
+    await runOpComponents({ args: makeArgs({ path: "svc", env: "staging" }), plugins: [], serializers: [] });
 
     expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", { env: "staging", componentOutputs: {}, buildParams: [] });
     vi.restoreAllMocks();
   });
 
   test("--json emits the DriverRunResult as JSON on stdout", async () => {
-    const run = { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true };
+    const run = { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" };
     runComponentsMock.mockResolvedValue({ success: true, selected: ["svc"], run });
     const stdoutWrite = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
 
-    const exit = await runOpComponents({ args: makeArgs({ path: "svc", json: true, temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOpComponents({ args: makeArgs({ path: "svc", json: true }), plugins: [], serializers: [] });
 
     expect(exit).toBe(0);
     const printed = stdoutWrite.mock.calls.map((c) => String(c[0])).join("");
@@ -1309,7 +943,7 @@ describe("runOpComponents", () => {
         return {
           success: true,
           selected: ["svc"],
-          run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+          run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
         };
       },
     );
@@ -1317,7 +951,7 @@ describe("runOpComponents", () => {
     vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
     const exit = await runOpComponents({
-      args: makeArgs({ path: "svc", progressJson: true, temporal: false }),
+      args: makeArgs({ path: "svc", progressJson: true }),
       plugins: [],
       serializers: [],
     });
@@ -1337,12 +971,12 @@ describe("runOpComponents", () => {
     runComponentsMock.mockResolvedValue({
       success: true,
       selected: ["svc"],
-      run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+      run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
     });
     const stdoutWrite = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
     vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+    await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
     expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "svc", {
       env: undefined,
@@ -1362,15 +996,16 @@ describe("runOpComponents", () => {
         order: ["shared-alb", "search-service"],
         waves: [["shared-alb"], ["search-service"]],
         results: [
-          { component: "shared-alb", ok: true, records: [] },
-          { component: "search-service", ok: true, records: [] },
+          { component: "shared-alb", ok: true, status: "ok", records: [] },
+          { component: "search-service", ok: true, status: "ok", records: [] },
         ],
         ok: true,
+        status: "ok",
       },
     });
     const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    const exit = await runOpComponents({ args: makeArgs({ path: "all", temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOpComponents({ args: makeArgs({ path: "all" }), plugins: [], serializers: [] });
 
     expect(exit).toBe(0);
     expect(runComponentsMock).toHaveBeenCalledWith(expect.any(String), "all", { env: undefined, componentOutputs: {}, buildParams: [] });
@@ -1387,14 +1022,15 @@ describe("runOpComponents", () => {
       run: {
         order: ["svc"],
         waves: [["svc"]],
-        results: [{ component: "svc", ok: false, records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "fail", durationMs: 5, error: "boom" }] }],
+        results: [{ component: "svc", ok: false, status: "fail", records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "fail", durationMs: 5, error: "boom" }] }],
         ok: false,
+        status: "fail",
         failedComponent: "svc",
       },
     });
     const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-    const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
     expect(exit).toBe(1);
     const printed = stderrWrite.mock.calls.map((c) => String(c[0])).join("");
@@ -1406,26 +1042,33 @@ describe("runOpComponents", () => {
     runComponentsMock.mockResolvedValue({ success: false, selected: [], error: 'Component "missing" not found. Known components: svc' });
     const stderr = makeStderrSpy();
 
-    const exit = await runOpComponents({ args: makeArgs({ path: "missing", temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOpComponents({ args: makeArgs({ path: "missing" }), plugins: [], serializers: [] });
 
     expect(exit).toBe(1);
     expect(stderr.join("\n")).toContain('Component "missing" not found');
   });
 
-  test("a gate in the component (local mode) → exit 1 with an actionable, Temporal-pointing message", async () => {
+  test("a gate in the component → exit 3 and the approve line (#2119)", async () => {
     runComponentsMock.mockResolvedValue({
       success: false,
       selected: ["svc"],
-      gateUnsupported: { component: "svc", signalName: "release-approval" },
+      gated: {
+        component: "svc",
+        gate: {
+          version: 1, kind: "pending", op: "svc", gate: "release-approval",
+          timestamp: "2026-09-05T12:00:00.000Z", expiresAt: "2026-09-07T12:00:00.000Z",
+        },
+      },
     });
     const stderr = makeStderrSpy();
 
-    const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+    const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
-    expect(exit).toBe(1);
+    expect(exit).toBe(3);
     const out = stderr.join("\n");
-    expect(out).toContain('gate "release-approval"');
-    expect(out).toContain("--temporal");
+    expect(out).toContain('gated on "release-approval"');
+    expect(out).toContain("chant approve svc release-approval");
+    expect(out).toContain("expires : 2026-09-07T12:00:00.000Z");
   });
 
   // ── auto-release recording post-run (#597) ────────────────────────────────
@@ -1438,14 +1081,15 @@ describe("runOpComponents", () => {
         run: {
           order: ["svc"],
           waves: [["svc"]],
-          results: [{ component: "svc", ok: true, records: [{ component: "svc", phase: "Publish", kind: "publish-image", status: "ok", durationMs: 5, output: { digest: "sha256:abc" } }] }],
+          results: [{ component: "svc", ok: true, status: "ok", records: [{ component: "svc", phase: "Publish", kind: "publish-image", status: "ok", durationMs: 5, output: { digest: "sha256:abc" } }] }],
           ok: true,
+          status: "ok",
         },
       });
       maybeRecordAutoReleaseMock.mockResolvedValue({ recorded: true, commit: "a".repeat(40), record: { version: 1, component: "svc", env: "staging", digest: "sha256:abc", gitSha: "x", runId: "local-1", timestamp: "t", actor: "a" } });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", env: "staging", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc", env: "staging" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(0);
       expect(maybeRecordAutoReleaseMock).toHaveBeenCalledTimes(1);
@@ -1463,14 +1107,15 @@ describe("runOpComponents", () => {
         run: {
           order: ["svc"],
           waves: [["svc"]],
-          results: [{ component: "svc", ok: false, records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "fail", durationMs: 5, error: "boom" }] }],
+          results: [{ component: "svc", ok: false, status: "fail", records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "fail", durationMs: 5, error: "boom" }] }],
           ok: false,
+          status: "fail",
           failedComponent: "svc",
         },
       });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(1);
       expect(maybeRecordAutoReleaseMock).not.toHaveBeenCalled();
@@ -1481,12 +1126,12 @@ describe("runOpComponents", () => {
       runComponentsMock.mockResolvedValue({
         success: true,
         selected: ["svc"],
-        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
       });
       maybeRecordAutoReleaseMock.mockResolvedValue({ recorded: false, reason: "opted-out" });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false, noReleaseRecord: true }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc", noReleaseRecord: true }), plugins: [], serializers: [] });
 
       expect(exit).toBe(0);
       expect(maybeRecordAutoReleaseMock).toHaveBeenCalledTimes(1);
@@ -1499,13 +1144,13 @@ describe("runOpComponents", () => {
       runComponentsMock.mockResolvedValue({
         success: true,
         selected: ["svc"],
-        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
       });
       loadChantConfigMock.mockResolvedValue({ config: { release: { autoRecord: false } } });
       maybeRecordAutoReleaseMock.mockResolvedValue({ recorded: false, reason: "opted-out" });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+      await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
       const [, options] = maybeRecordAutoReleaseMock.mock.calls[0];
       expect(options).toMatchObject({ disabled: true });
@@ -1516,13 +1161,13 @@ describe("runOpComponents", () => {
       runComponentsMock.mockResolvedValue({
         success: true,
         selected: ["svc"],
-        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
       });
       maybeRecordAutoReleaseMock.mockResolvedValue({ recorded: false, reason: "error", error: "ledger push failed" });
       const stderr = makeStderrSpy();
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(0);
       expect(stderr.join("\n")).toContain("ledger push failed");
@@ -1543,12 +1188,13 @@ describe("runOpComponents", () => {
           waves: [["svc"]],
           results: [{ component: "svc", ok: true, records: [{ component: "svc", phase: "Build", kind: "docker-build", status: "ok", durationMs: 5, output: buildOutput }] }],
           ok: true,
+          status: "ok",
         },
       });
       maybePersistBuildManifestMock.mockResolvedValue({ persisted: true, commit: "a".repeat(40), manifestDigest: "sha256:manifestabc" });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", env: "staging", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc", env: "staging" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(0);
       expect(maybePersistBuildManifestMock).toHaveBeenCalledTimes(1);
@@ -1566,14 +1212,15 @@ describe("runOpComponents", () => {
         run: {
           order: ["svc"],
           waves: [["svc"]],
-          results: [{ component: "svc", ok: false, records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "fail", durationMs: 5, error: "boom" }] }],
+          results: [{ component: "svc", ok: false, status: "fail", records: [{ component: "svc", phase: "Apply", kind: "cfn-deploy", status: "fail", durationMs: 5, error: "boom" }] }],
           ok: false,
+          status: "fail",
           failedComponent: "svc",
         },
       });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(1);
       expect(maybePersistBuildManifestMock).not.toHaveBeenCalled();
@@ -1584,12 +1231,12 @@ describe("runOpComponents", () => {
       runComponentsMock.mockResolvedValue({
         success: true,
         selected: ["svc"],
-        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
       });
       maybePersistBuildManifestMock.mockResolvedValue({ persisted: false, reason: "opted-out" });
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false, noReleaseRecord: true }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc", noReleaseRecord: true }), plugins: [], serializers: [] });
 
       expect(exit).toBe(0);
       expect(maybePersistBuildManifestMock).toHaveBeenCalledTimes(1);
@@ -1602,13 +1249,13 @@ describe("runOpComponents", () => {
       runComponentsMock.mockResolvedValue({
         success: true,
         selected: ["svc"],
-        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, records: [] }], ok: true },
+        run: { order: ["svc"], waves: [["svc"]], results: [{ component: "svc", ok: true, status: "ok", records: [] }], ok: true, status: "ok" },
       });
       maybePersistBuildManifestMock.mockResolvedValue({ persisted: false, reason: "error", error: "manifest push failed" });
       const stderr = makeStderrSpy();
       vi.spyOn(process.stderr, "write").mockImplementation(() => true);
 
-      const exit = await runOpComponents({ args: makeArgs({ path: "svc", temporal: false }), plugins: [], serializers: [] });
+      const exit = await runOpComponents({ args: makeArgs({ path: "svc" }), plugins: [], serializers: [] });
 
       expect(exit).toBe(0);
       expect(stderr.join("\n")).toContain("manifest push failed");
@@ -1616,377 +1263,3 @@ describe("runOpComponents", () => {
     });
   });
 });
-
-// ── chant run --components <name> --temporal (#589) ─────────────────────────
-
-describe("runOpComponents: --temporal routes to the durable path", () => {
-  beforeEach(() => {
-    resolveComponentTargetsMock.mockReset();
-    findComponentGateMock.mockReset();
-    loadComponentTemporalCodegenMock.mockReset();
-    // chant #1108 — runOpComponents now resolves build-time parameters (which
-    // needs chant.config.ts's declared `buildParams`) BEFORE dispatching to
-    // either the local or --temporal path, so every test in this block hits
-    // loadChantConfig at least once now, even ones that never reach the rest
-    // of the durable path (e.g. "unknown component"). Individual tests below
-    // still override this where they care about a specific config shape.
-    loadChantConfigMock.mockReset().mockResolvedValue({ config: {} });
-    resolveProfileMock.mockReset();
-    loadTemporalClientMock.mockReset();
-    spawnChildMock.mockReset();
-    existsSyncMock.mockReset();
-    findComponentGateMock.mockReturnValue(undefined);
-    maybeRecordAutoReleaseMock.mockReset().mockResolvedValue({ recorded: false, reason: "no-digest" });
-    maybePersistBuildManifestMock.mockReset().mockResolvedValue({ persisted: false, reason: "no-manifest" });
-  });
-
-  test("all --temporal → exit 1, not supported", async () => {
-    const stderr = makeStderrSpy();
-    const exit = await runOpComponents({ args: makeArgs({ path: "all", temporal: true }), plugins: [], serializers: [] });
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain("not supported");
-    expect(resolveComponentTargetsMock).not.toHaveBeenCalled();
-  });
-
-  test("unknown component → exit 1 with the resolver's error message", async () => {
-    resolveComponentTargetsMock.mockResolvedValue({ success: false, targets: [], error: 'Component "missing" not found.' });
-    const stderr = makeStderrSpy();
-
-    const exit = await runOpComponents({ args: makeArgs({ path: "missing", temporal: true }), plugins: [], serializers: [] });
-
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toContain('Component "missing" not found');
-  });
-
-  // ── build-time parameters (chant #1108) — resolved before discovery here too ─
-
-  test("resolved build-time parameters are forwarded into resolveComponentTargets on the --temporal path", async () => {
-    process.env.LOOM_ENV = "staging";
-    resolveComponentTargetsMock.mockResolvedValue({
-      success: true,
-      targets: [{ name: "gated-svc", dependsOn: [], deploy: [] }],
-    });
-    resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-    loadComponentTemporalCodegenMock.mockResolvedValue({
-      serializeComponent: () => ({ "components/gated-svc/worker.ts": "// worker" }),
-      componentWorkflowFnName: (name: string) => `${name}ComponentWorkflow`,
-    });
-    const mockClient = createMockTemporalClient({
-      describeByWorkflowId: {
-        "chant-component-gated-svc": {
-          workflowId: "chant-component-gated-svc", runId: "r1",
-          status: { name: "COMPLETED" }, startTime: new Date(),
-          taskQueue: "gated-svc", type: { name: "gatedSvcComponentWorkflow" },
-        },
-      },
-      historyByWorkflowId: { "chant-component-gated-svc": [] },
-    });
-    // setupTemporalClient sets its own default loadChantConfigMock resolved
-    // value, so the test's own (buildParams-declaring) config must be set
-    // AFTER calling it, not before.
-    setupTemporalClient(mockClient);
-    loadChantConfigMock.mockResolvedValue({
-      config: { buildParams: { env: { type: "string", env: "LOOM_ENV", default: "dev" } } },
-    });
-    const { proc } = makeFakeChildProcess();
-    spawnChildMock.mockReturnValue(proc);
-    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-
-    try {
-      vi.useFakeTimers();
-      const promise = runOpComponents({ args: makeArgs({ path: "gated-svc", temporal: true }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
-      const exit = await promise;
-
-      expect(exit).toBe(0);
-      expect(resolveComponentTargetsMock).toHaveBeenCalledWith(
-        expect.any(String),
-        "gated-svc",
-        undefined,
-        [{ name: "env", value: "staging", source: "env" }],
-      );
-    } finally {
-      vi.useRealTimers();
-      vi.restoreAllMocks();
-      delete process.env.LOOM_ENV;
-    }
-  });
-
-  test("an unresolved required build-time parameter → exit 1, never reaches resolveComponentTargets", async () => {
-    loadChantConfigMock.mockResolvedValue({
-      config: { buildParams: { tier: { type: "string" } } },
-    });
-    const stderr = makeStderrSpy();
-
-    const exit = await runOpComponents({ args: makeArgs({ path: "gated-svc", temporal: true }), plugins: [], serializers: [] });
-
-    expect(exit).toBe(1);
-    expect(stderr.join("\n")).toMatch(/"tier"/);
-    expect(resolveComponentTargetsMock).not.toHaveBeenCalled();
-  });
-
-  test("compiles the component, spawns the worker, submits the workflow, polls to COMPLETED", async () => {
-    vi.useFakeTimers();
-    try {
-      resolveComponentTargetsMock.mockResolvedValue({
-        success: true,
-        targets: [{ name: "gated-svc", dependsOn: [], deploy: [] }],
-      });
-      loadChantConfigMock.mockResolvedValue({ config: {} });
-      resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-      const serializeComponentMock = vi.fn().mockReturnValue({
-        "components/gated-svc/workflow.ts": "// wf",
-        "components/gated-svc/activities.ts": "// act",
-        "components/gated-svc/worker.ts": "// worker",
-      });
-      loadComponentTemporalCodegenMock.mockResolvedValue({
-        serializeComponent: serializeComponentMock,
-        componentWorkflowFnName: (name: string) => `${name}ComponentWorkflow`,
-      });
-      const mockClient = createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-component-gated-svc": {
-            workflowId: "chant-component-gated-svc", runId: "r1",
-            status: { name: "COMPLETED" }, startTime: new Date(),
-            taskQueue: "gated-svc", type: { name: "gatedSvcComponentWorkflow" },
-          },
-        },
-        historyByWorkflowId: { "chant-component-gated-svc": [] },
-      });
-      setupTemporalClient(mockClient);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-
-      const promise = runOpComponents({ args: makeArgs({ path: "gated-svc", temporal: true, env: "staging" }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
-      const exit = await promise;
-
-      expect(exit).toBe(0);
-      expect(spawnChildMock).toHaveBeenCalledTimes(1);
-      expect(spawnChildMock.mock.calls[0][0]).toBe("npx");
-      expect(mockClient.calls.startCalls).toHaveLength(1);
-      expect(mockClient.calls.startCalls[0].opts.workflowId).toBe("chant-component-gated-svc");
-      expect(proc.kill).toHaveBeenCalled();
-      // --env must reach the codegen call, not just the local-mode path (the bug this locks in: #589 review).
-      expect(serializeComponentMock).toHaveBeenCalledWith(
-        expect.objectContaining({ name: "gated-svc" }),
-        expect.objectContaining({ env: "staging" }),
-      );
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  test("a failed (non-COMPLETED) workflow → exit 1", async () => {
-    vi.useFakeTimers();
-    try {
-      resolveComponentTargetsMock.mockResolvedValue({
-        success: true,
-        targets: [{ name: "gated-svc", dependsOn: [], deploy: [] }],
-      });
-      loadChantConfigMock.mockResolvedValue({ config: {} });
-      resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-      loadComponentTemporalCodegenMock.mockResolvedValue({
-        serializeComponent: () => ({ "components/gated-svc/worker.ts": "// worker" }),
-        componentWorkflowFnName: (name: string) => `${name}ComponentWorkflow`,
-      });
-      const mockClient = createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-component-gated-svc": {
-            workflowId: "chant-component-gated-svc", runId: "r1",
-            status: { name: "FAILED" }, startTime: new Date(),
-            taskQueue: "gated-svc", type: { name: "gatedSvcComponentWorkflow" },
-          },
-        },
-        historyByWorkflowId: { "chant-component-gated-svc": [] },
-      });
-      setupTemporalClient(mockClient);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-
-      const promise = runOpComponents({ args: makeArgs({ path: "gated-svc", temporal: true }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
-      const exit = await promise;
-
-      expect(exit).toBe(1);
-      expect(proc.kill).toHaveBeenCalled();
-      // (#597) a failed workflow never reaches auto-release recording.
-      expect(maybeRecordAutoReleaseMock).not.toHaveBeenCalled();
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  // ── auto-release recording post-run (#597) ────────────────────────────────
-
-  describe("auto-release recording", () => {
-    async function runCompletedWorkflow(overrides: Partial<ParsedArgs> = {}, resultByWorkflowId?: unknown) {
-      resolveComponentTargetsMock.mockResolvedValue({
-        success: true,
-        targets: [{ name: "gated-svc", dependsOn: [], deploy: [] }],
-      });
-      loadChantConfigMock.mockResolvedValue({ config: {} });
-      resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-      loadComponentTemporalCodegenMock.mockResolvedValue({
-        serializeComponent: () => ({ "components/gated-svc/worker.ts": "// worker" }),
-        componentWorkflowFnName: (name: string) => `${name}ComponentWorkflow`,
-      });
-      const mockClient = createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-component-gated-svc": {
-            workflowId: "chant-component-gated-svc", runId: "r1",
-            status: { name: "COMPLETED" }, startTime: new Date(),
-            taskQueue: "gated-svc", type: { name: "gatedSvcComponentWorkflow" },
-          },
-        },
-        historyByWorkflowId: { "chant-component-gated-svc": [] },
-        resultByWorkflowId: resultByWorkflowId ? { "chant-component-gated-svc": resultByWorkflowId } : undefined,
-      });
-      setupTemporalClient(mockClient);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-
-      const promise = runOpComponents({ args: makeArgs({ path: "gated-svc", temporal: true, ...overrides }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
-      const exit = await promise;
-      return { exit };
-    }
-
-    test("a COMPLETED workflow → reads the digest via handle.result() and calls maybeRecordAutoRelease once", async () => {
-      vi.useFakeTimers();
-      try {
-        maybeRecordAutoReleaseMock.mockResolvedValue({
-          recorded: true, commit: "a".repeat(40),
-          record: { version: 1, component: "gated-svc", env: "staging", digest: "sha256:temporal-digest", gitSha: "x", runId: "r1", timestamp: "t", actor: "a" },
-        });
-
-        const { exit } = await runCompletedWorkflow({ env: "staging" }, { phaseOutputs: { Publish: { digest: "sha256:temporal-digest" } }, componentOutputs: {} });
-
-        expect(exit).toBe(0);
-        expect(maybeRecordAutoReleaseMock).toHaveBeenCalledTimes(1);
-        const [runInfo, options] = maybeRecordAutoReleaseMock.mock.calls[0];
-        expect(runInfo).toMatchObject({ component: "gated-svc", env: "staging", success: true, digest: "sha256:temporal-digest", runId: "r1" });
-        expect(options).toMatchObject({ disabled: false });
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-
-    test("--no-release-record → disabled: true is threaded through on the Temporal path too", async () => {
-      vi.useFakeTimers();
-      try {
-        maybeRecordAutoReleaseMock.mockResolvedValue({ recorded: false, reason: "opted-out" });
-
-        await runCompletedWorkflow({ noReleaseRecord: true });
-
-        const [, options] = maybeRecordAutoReleaseMock.mock.calls[0];
-        expect(options).toMatchObject({ disabled: true });
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-
-    test("no digest in the workflow result → maybeRecordAutoRelease still called, with digest: undefined", async () => {
-      vi.useFakeTimers();
-      try {
-        maybeRecordAutoReleaseMock.mockResolvedValue({ recorded: false, reason: "no-digest" });
-
-        const { exit } = await runCompletedWorkflow({}, { phaseOutputs: {}, componentOutputs: {} });
-
-        expect(exit).toBe(0);
-        const [runInfo] = maybeRecordAutoReleaseMock.mock.calls[0];
-        expect(runInfo.digest).toBeUndefined();
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-  });
-
-  // ── build-manifest persistence post-run (#609) ──────────────────────────────
-
-  describe("build-manifest persistence", () => {
-    async function runCompletedWorkflow(overrides: Partial<ParsedArgs> = {}, resultByWorkflowId?: unknown) {
-      resolveComponentTargetsMock.mockResolvedValue({
-        success: true,
-        targets: [{ name: "gated-svc", dependsOn: [], deploy: [] }],
-      });
-      loadChantConfigMock.mockResolvedValue({ config: {} });
-      resolveProfileMock.mockReturnValue({ address: "localhost:7233", namespace: "default", taskQueue: "q" });
-      loadComponentTemporalCodegenMock.mockResolvedValue({
-        serializeComponent: () => ({ "components/gated-svc/worker.ts": "// worker" }),
-        componentWorkflowFnName: (name: string) => `${name}ComponentWorkflow`,
-      });
-      const mockClient = createMockTemporalClient({
-        describeByWorkflowId: {
-          "chant-component-gated-svc": {
-            workflowId: "chant-component-gated-svc", runId: "r1",
-            status: { name: "COMPLETED" }, startTime: new Date(),
-            taskQueue: "gated-svc", type: { name: "gatedSvcComponentWorkflow" },
-          },
-        },
-        historyByWorkflowId: { "chant-component-gated-svc": [] },
-        resultByWorkflowId: resultByWorkflowId ? { "chant-component-gated-svc": resultByWorkflowId } : undefined,
-      });
-      setupTemporalClient(mockClient);
-      const { proc } = makeFakeChildProcess();
-      spawnChildMock.mockReturnValue(proc);
-      vi.spyOn(process.stderr, "write").mockImplementation(() => true);
-
-      const promise = runOpComponents({ args: makeArgs({ path: "gated-svc", temporal: true, ...overrides }), plugins: [], serializers: [] });
-      await vi.advanceTimersByTimeAsync(5000);
-      const exit = await promise;
-      return { exit };
-    }
-
-    const sampleManifest = { version: 1, component: "gated-svc", createdAt: "t", contents: [], manifestDigest: "sha256:manifest-temporal" };
-
-    test("a COMPLETED workflow → reads the manifest via handle.result() and calls maybePersistBuildManifest once", async () => {
-      vi.useFakeTimers();
-      try {
-        maybePersistBuildManifestMock.mockResolvedValue({ persisted: true, commit: "a".repeat(40), manifestDigest: "sha256:manifest-temporal" });
-
-        const { exit } = await runCompletedWorkflow({ env: "staging" }, { phaseOutputs: { Build: { manifest: sampleManifest } }, componentOutputs: {} });
-
-        expect(exit).toBe(0);
-        expect(maybePersistBuildManifestMock).toHaveBeenCalledTimes(1);
-        const [runInfo, options] = maybePersistBuildManifestMock.mock.calls[0];
-        expect(runInfo).toMatchObject({ success: true, manifest: sampleManifest });
-        expect(options).toMatchObject({ disabled: false });
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-
-    test("--no-release-record also disables manifest persistence on the Temporal path", async () => {
-      vi.useFakeTimers();
-      try {
-        maybePersistBuildManifestMock.mockResolvedValue({ persisted: false, reason: "opted-out" });
-
-        await runCompletedWorkflow({ noReleaseRecord: true });
-
-        const [, options] = maybePersistBuildManifestMock.mock.calls[0];
-        expect(options).toMatchObject({ disabled: true });
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-
-    test("no manifest in the workflow result → maybePersistBuildManifest still called, with manifest: undefined", async () => {
-      vi.useFakeTimers();
-      try {
-        maybePersistBuildManifestMock.mockResolvedValue({ persisted: false, reason: "no-manifest" });
-
-        const { exit } = await runCompletedWorkflow({}, { phaseOutputs: {}, componentOutputs: {} });
-
-        expect(exit).toBe(0);
-        const [runInfo] = maybePersistBuildManifestMock.mock.calls[0];
-        expect(runInfo.manifest).toBeUndefined();
-      } finally {
-        vi.useRealTimers();
-      }
-    });
-  });
-});