@intentius/chant 0.57.0 → 0.59.0

package/src/cli/main.test.ts

@@ -10,6 +10,17 @@ describe("parseArgs", () => {
     expect(parseArgs(["build", "src", "--no-fold"]).fold).toBe(false);
   });
 
+  // #2192 — #2130 deleted `-p/--profile` with the Temporal runtime, on the
+  // belief nothing outside it read the flag. #2124 had already documented it
+  // for fountain, so the flag is back and reaches the runtime seam.
+  test("-p/--profile carries the runtime's connection profile (#2124)", () => {
+    expect(parseArgs(["run", "prod-apply", "--on", "fountain"]).profile).toBeUndefined();
+    expect(parseArgs(["run", "prod-apply", "--on", "fountain", "--profile", "staging"]).profile).toBe("staging");
+    expect(parseArgs(["run", "prod-apply", "--on", "fountain", "-p", "staging"]).profile).toBe("staging");
+    // The joined form `splitJoinedFlags` rewrites into two tokens.
+    expect(parseArgs(["run", "prod-apply", "--profile=staging"]).profile).toBe("staging");
+  });
+
   test("--namespace carries the live read's namespace default (#1629)", () => {
     expect(parseArgs(["graph", "--live", "--env", "prod"]).namespace).toBeUndefined();
     expect(parseArgs(["graph", "--live", "--env", "prod", "--namespace", "app-b"]).namespace).toBe("app-b");
@@ -578,19 +589,19 @@ describe("resolveCommand", () => {
   });
 });
 
-describe("parseArgs — run flags", () => {
-  test("parses --profile flag", () => {
-    const result = parseArgs(["run", "alb-deploy", "--profile", "local"]);
-    expect(result.command).toBe("run");
-    expect(result.path).toBe("alb-deploy");
-    expect(result.profile).toBe("local");
-  });
-
-  test("parses -p shorthand for --profile", () => {
-    const result = parseArgs(["run", "alb-deploy", "-p", "cloud"]);
-    expect(result.profile).toBe("cloud");
+describe("--temporal, removed in #2116", () => {
+  // #2204 removed the bridge that caught the flag ahead of the parser and
+  // exited 2. Both spellings now take the same route any other unrecognised
+  // flag takes, and nothing in the CLI knows the word.
+  test("both spellings fail as an unknown flag, like any other unrecognised flag", () => {
+    expect(() => parseArgs(["run", "alb-deploy", "--temporal"])).toThrow(/Unknown flag: --temporal/);
+    expect(() => parseArgs(["run", "alb-deploy", "--temporal=true"])).toThrow(/Unknown flag: --temporal/);
+    // The message and the throw match what an invented flag gets.
+    expect(() => parseArgs(["run", "alb-deploy", "--nonesuch"])).toThrow(/Unknown flag: --nonesuch/);
   });
+});
 
+describe("parseArgs — run flags", () => {
   test("parses --report flag", () => {
     const result = parseArgs(["run", "alb-deploy", "--report"]);
     expect(result.command).toBe("run");
@@ -603,11 +614,6 @@ describe("parseArgs — run flags", () => {
     expect(result.report).toBe(undefined);
   });
 
-  test("profile is undefined when not provided", () => {
-    const result = parseArgs(["run", "alb-deploy"]);
-    expect(result.profile).toBe(undefined);
-  });
-
   test("run signal parses op name and signal into positionals", () => {
     const result = parseArgs(["run", "signal", "alb-deploy", "gate-dns"]);
     expect(result.command).toBe("run");

package/src/cli/main.ts

@@ -30,7 +30,7 @@ import { runScenarioCheck, runScenarioUnknown } from "./handlers/scenario";
 import { runGraph } from "./handlers/graph";
 import { runExplain } from "./handlers/explain";
 import { runSearch } from "./handlers/search";
-import { runOp, runOpList, runOpStatus, runOpSignal, runOpCancel, runOpLog } from "./handlers/run";
+import { runOp, runOpList, runOpStatus, runOpApprove, runOpSignalRenamed, runOpCancel, runOpLog } from "./handlers/run";
 import { runOperator, runOperatorStatus, runOperatorLog, runApprove } from "./handlers/operator";
 import { runEmulator } from "./handlers/emulator";
 import { splitJoinedFlags, dispatchCommandGroup, collectCommandGroups, formatCommandGroupsHelp, type CommandGroup } from "./command-group";
@@ -71,7 +71,6 @@ const BOOLEAN_FLAGS = new Set([
   "--down",
   "--include-dependents",
   "--local",
-  "--temporal",
   "--json",
   "--progress-json",
   "--update-snapshot",
@@ -86,9 +85,11 @@ const BOOLEAN_FLAGS = new Set([
   "--yes",
   "--confirm-prod",
   "--once",
+  "--expire",
   "--check-live",
   "--check-snapshot",
   "--fail-on-drift",
+  "--durable-requests",
 ]);
 
 /**
@@ -115,12 +116,11 @@ export function parseArgs(args: string[]): ParsedArgs {
     watch: false,
     verbose: false,
     help: false,
-    profile: undefined,
     param: undefined,
     paramsFile: undefined,
     report: undefined,
     local: undefined,
-    temporal: undefined,
+    profile: undefined,
     json: undefined,
     live: false,
     migrateFrom: undefined,
@@ -303,12 +303,21 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.includeDependents = true;
     } else if (arg === "--local") {
       result.local = true;
-    } else if (arg === "--temporal") {
-      result.temporal = true;
     } else if (arg === "--json") {
       result.json = true;
     } else if (arg === "--progress-json") {
       result.progressJson = true;
+    } else if (arg === "--gated-exit") {
+      // `chant run <op> --gated-exit <code>` (#2243) — remap only the gated
+      // outcome's exit code. Parsed as a number here and range-checked in the
+      // handler, where the refusal can name the flag alongside the run.
+      result.gatedExit = Number(args[++i]);
+    } else if (arg === "--durable-requests") {
+      // `chant run approve ... --on <lexicon> --durable-requests` (#2126) —
+      // resolve the gate on the hosting runtime's own request path rather
+      // than by posting a follow-up prompt. Core only carries the flag; the
+      // runtime decides whether it has such a path.
+      result.durableRequests = true;
     } else if (arg === "--update-snapshot") {
       result.updateSnapshot = true;
     } else if (arg === "--update-baseline") {
@@ -345,6 +354,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.actor = args[++i];
     } else if (arg === "--approver") {
       result.approver = args[++i];
+    } else if (arg === "--on") {
+      // `chant run ... --on <lexicon>` (#2121) — which runtime hosts the run.
+      result.on = args[++i];
+      if (!result.on || result.on.startsWith("-")) throw new Error("--on needs a runtime name: --on <lexicon>");
     } else if (arg === "--compare-to") {
       result.compareTo = args[++i];
     } else if (arg === "--no-release-record") {
@@ -389,6 +402,8 @@ export function parseArgs(args: string[]): ParsedArgs {
       result.once = true;
     } else if (arg === "--note") {
       result.note = args[++i];
+    } else if (arg === "--expire") {
+      result.expire = true;
     } else if (arg === "--url") {
       result.url = args[++i];
     } else if (arg === "--op") {
@@ -463,7 +478,7 @@ Commands:
                          chant code instead of reading a template file)
   audit [path|url]      Audit a repo's CI YAML for security issues
                         (--format stylish|json|sarif|markdown|html, -o <file>,
-                         --tier merge-worthy|all, --fail-on merge-worthy|warning|none,
+                         --tier merge-worthy|all, --fail-on merge-worthy|warning|error|none,
                          --template <file> / --theme <file> for the html report)
                         --agents audits this machine's agent configuration —
                         instruction files, MCP servers, skills, plugins,
@@ -505,18 +520,12 @@ Commands:
                                           applied) and path. Read-only.
 
 Ops:
-  run <name>            Start an Op workflow (spawns worker + submits to Temporal)
-  run list              List all Ops with current run status
-                        --components: list discovered Components instead (--temporal
-                        also annotates each with its latest run status; #599)
-  run status <name>     Show current workflow run state
-                        --components: show a Component's durable run state instead (#599)
-  run signal <name> <signal>  Send a named signal to unblock a gate
-                        --components: signal a Component's workflow instead (#589)
-  run cancel <name>     Cancel the active workflow run (requires --force)
-                        --components: cancel a Component's workflow instead (#589)
+  run <name>            Run an Op on the resolved runtime (--on; local by default)
+  run list              List all Ops with the runtime's state for each
+  run status <name>     Show the runtime's state for one Op's latest run
+  run approve <op> <gate>  Record a gate's resolution and wake the runtime
+  run cancel <name>     Cancel the active run (requires --force)
   run log <name>        Show run history for an Op
-                        --components: show a Component's run history instead (#599)
   run --components <name|all>  Run discovered Component(s) through the interpret
                         driver on the local executor (--env <env>; #585).
                         On success, auto-emits a release-ledger record per
@@ -528,7 +537,7 @@ Ops:
                         progress instead of tailing raw logs (additive; run
                         semantics/exit code unchanged)
   operator               Run scheduled ticks for discovered ConvergeOps
-                        locally, no Temporal (#1485): acquire/renew a per-op
+                        locally (#1485): acquire/renew a per-op
                         lease (git ref CAS), tick on --interval, record every
                         result as a ledger fact. --env <env> scopes to one
                         environment; --interval <dur> (default 60s) and
@@ -548,13 +557,14 @@ Ops:
                         silently short
   approve <op> <gate>    Record a gate's out-of-band resolution fact
                         (--actor <name>, --note <text>, --url <url>) — the
-                        durable counterpart to a converge tick's
-                        gate-as-fact outcome; see the pending-gates list in
-                        operator status. --url is the PR/MR the resolution
+                        durable counterpart to the pending fact a run records
+                        when it reaches the gate; see the pending-gates list
+                        in operator status. --url is the PR/MR the resolution
                         happened at, recorded typed rather than as free text,
                         and defaults to the PR/MR of the surrounding CI job.
-                        Does not itself unblock the gated op's local
-                        dispatch (re-run --temporal, or merge its PR)
+                        The next "chant run <op>" walks through the gate.
+                        --expire clears a pending fact without approving it,
+                        so the gate is re-decided from scratch next run
 
   graph                 Show Op dependency graph (--stacks for cross-stack order,
                         --format ir|mermaid|dot|layout for the lint-gated graph IR,
@@ -663,12 +673,15 @@ Options:
                         resolved build parameter and per-file fold decision
                         instead of the one-line summaries
   -h, --help            Show this help message
-  -p, --profile <name>  Temporal worker profile to use (run command)
+  --on <lexicon>        Which runtime hosts the run: a configured lexicon with
+                        an opRuntime, or the built-in local runtime when
+                        omitted (every run subcommand; #2121)
   --local               Run an Op with the local in-process executor (default)
-  --temporal            Run an Op via a Temporal cluster (gates, schedules, durable resume)
+  -p, --profile <name>  Named connection profile the hosting runtime targets
+                        (fountain.profiles in chant.config.ts); each runtime's
+                        own default when omitted (#2124)
   --json                Emit the structured run result as JSON (run command)
-  --report              Print deployment report instead of running (run command)
-                        OR with a path arg: SARIF report destination (migrate)
+  --report              With a path arg: SARIF report destination (migrate)
                         OR '--report gitlab-mr': emit the GitLab MR plan-widget
                         JSON (lifecycle plan)
                         OR '--report markdown': emit a reviewer-facing markdown
@@ -794,8 +807,17 @@ async function tryPluginCommand(rawArgv: string[]): Promise<number | undefined>
   if (!groupName || groupName.startsWith("-")) return undefined;
 
   const plugins = await loadPluginsBestEffort();
-  const rawArgs = rawArgv.slice(2);
-  const result = await dispatchCommandGroup(plugins, groupName, verbName, rawArgs);
+
+  // A group declaring a `defaultVerb` (#2125) answers its bare name, so
+  // `chant acp` and `chant acp --durable-requests` both reach that verb. The
+  // slicing follows: with no verb token consumed, everything after the group
+  // name is the default verb's own argument list.
+  const group = collectCommandGroups(plugins).find((g) => g.name === groupName);
+  const useDefault =
+    group?.defaultVerb !== undefined && (verbName === undefined || verbName.startsWith("-"));
+  const verb = useDefault ? group?.defaultVerb : verbName;
+  const rawArgs = rawArgv.slice(useDefault ? 1 : 2);
+  const result = await dispatchCommandGroup(plugins, groupName, verb, rawArgs);
 
   if (result.kind === "no-group") return undefined;
   if (result.kind === "usage-error") {
@@ -852,7 +874,17 @@ async function loadPluginsOrExit(path: string): Promise<import("../lexicon").Lex
 
 // ── Command registry ──────────────────────────────────────────────
 
-const registry: CommandDef[] = [
+/**
+ * Every command word `chant` answers to, and the handler behind it.
+ *
+ * Exported because a caller other than `main()` now needs to ask "is this a
+ * chant verb, and what runs it?" — the fountain lexicon's ACP server (#2125)
+ * treats a prompt as a chant command line, and the only honest answer to
+ * whether `chant lifecycle diff` is a verb is this list. A hand-kept copy
+ * would be wrong the first time a command is added, and the ACP server would
+ * refuse a verb that works at the terminal.
+ */
+export const commandRegistry: CommandDef[] = [
   // Primary commands
   { name: "build", requiresPlugins: true, handler: runBuild },
   { name: "lint", handler: runLint },
@@ -897,7 +929,8 @@ const registry: CommandDef[] = [
   // Op / run subcommands
   { name: "run list", handler: runOpList },
   { name: "run status", handler: runOpStatus },
-  { name: "run signal", handler: runOpSignal },
+  { name: "run approve", handler: runOpApprove },
+  { name: "run signal", handler: runOpSignalRenamed },
   { name: "run cancel", handler: runOpCancel },
   { name: "run log", handler: runOpLog },
   { name: "run", handler: runOp },
@@ -1026,7 +1059,7 @@ async function main(): Promise<void> {
     process.exit(1);
   }
 
-  const match = resolveCommand(args, registry);
+  const match = resolveCommand(args, commandRegistry);
   if (!match) {
     // chant #1078 — not one of core's own commands; check whether a lexicon
     // mounted a command group under this name before giving up. This is the

package/src/cli/mcp/op-tools.ts

@@ -1,56 +1,94 @@
+/**
+ * MCP tools over Ops — on the runtime seam (#2121), not on any one runtime's
+ * own client.
+ *
+ * Every tool here goes through an {@link OpRuntimeProvider} — the built-in
+ * `local` one by default, or the `runtime` argument's lexicon `opRuntime` when
+ * an agent names one. One provider is built per call, so a long-lived server
+ * picks up a project's config as it is now rather than as it was at boot; the
+ * local provider's in-process run history is the exception and is held for the
+ * life of the module, so `op-status` can answer for a run `op-run` started.
+ *
+ * #2118 owns the ledger-backed record shape; when it lands, `status`/`log`
+ * read the ledger and this file stops depending on the process outliving the
+ * run.
+ */
+
 import { resolve } from "node:path";
 import { discoverOps } from "../../op/discover";
-import { makeTemporalClient } from "../handlers/run";
-import { resolveWorkflowId, fetchNormalizedHistory } from "../handlers/run-client";
-import { generateReport } from "../handlers/run-report";
-import { extractStepRecords, countActivities, queryGateState } from "../handlers/op-progress";
+import { createLocalOpRuntime } from "../../op/runtimes/local";
+import type { OpRuntimeProvider } from "../../op/runtime";
+import { loadChantConfig } from "../../config";
+import { loadPlugins } from "../plugins";
+import { recordGateApproval } from "../handlers/operator";
 import type { ToolRegistration } from "./lifecycle-tools";
 
-function workflowFnName(opName: string): string {
-  return opName.replace(/-([a-z])/g, (_, c: string) => c.toUpperCase()) + "Workflow";
+/** The `local` provider, shared so an `op-run` is visible to a later `op-status`. */
+let localRuntime: OpRuntimeProvider | undefined;
+
+/**
+ * Resolve the runtime a tool call addresses. `runtime` names a configured
+ * lexicon's `opRuntime`; omitted (or `local`) it is core's built-in provider.
+ * Throws with an actionable message — the MCP layer turns that into `isError`.
+ */
+async function runtimeFor(name: unknown): Promise<OpRuntimeProvider> {
+  const wanted = typeof name === "string" && name.length > 0 ? name : "local";
+  if (wanted === "local") {
+    localRuntime ??= createLocalOpRuntime({ projectPath: resolve(".") });
+    return localRuntime;
+  }
+
+  const configured = await loadChantConfig(resolve("."))
+    .then(({ config }) => config.lexicons ?? [])
+    .catch(() => [] as string[]);
+  if (!configured.includes(wanted)) {
+    throw new Error(
+      `runtime "${wanted}" is not a configured lexicon` +
+        (configured.length > 0 ? ` (configured: ${configured.join(", ")})` : ""),
+    );
+  }
+  const plugin = (await loadPlugins([wanted]))[0];
+  if (!plugin?.opRuntime) throw new Error(`lexicon "${wanted}" does not host Op runs`);
+  return plugin.opRuntime;
 }
 
+const RUNTIME_PARAM = {
+  type: "string",
+  description: 'Runtime to address: a lexicon name with an opRuntime, or "local" (the default)',
+} as const;
+
 export function createOpListTool(): ToolRegistration {
   return {
     definition: {
       name: "op-list",
-      description: "List all Op definitions discovered from *.op.ts files with their current run status",
+      description: "List all Op definitions discovered from *.op.ts files with their current run state",
       inputSchema: {
         type: "object",
         properties: {
-          profile: { type: "string", description: "Temporal profile name from chant.config.ts (optional)" },
+          runtime: RUNTIME_PARAM,
         },
       },
     },
     handler: async (params) => {
       const { ops, errors } = await discoverOps();
-      const profile = params.profile as string | undefined;
 
-      let client: Awaited<ReturnType<typeof makeTemporalClient>>["client"] | undefined;
+      let states: Map<string, { state: string } | undefined> = new Map();
       try {
-        ({ client } = await makeTemporalClient(profile, resolve(".")));
+        const runtime = await runtimeFor(params.runtime);
+        states = await runtime.list([...ops.values()].map((d) => d.config));
       } catch {
-        // Temporal not available — degrade gracefully
+        // Runtime unavailable — the definitions are still worth listing.
       }
 
       const result = [];
       for (const [name, { config }] of ops) {
-        let runStatus = "—";
-        if (client) {
-          try {
-            const desc = await client.workflow.getHandle(resolveWorkflowId(name)).describe();
-            runStatus = desc.status.name;
-          } catch {
-            // workflow not found or Temporal error
-          }
-        }
         result.push({
           name,
           overview: config.overview,
           phases: config.phases.length,
-          taskQueue: config.taskQueue ?? config.name,
+          labels: config.labels ?? {},
           depends: config.depends ?? [],
-          runStatus,
+          runState: states.get(name)?.state ?? "—",
         });
       }
 
@@ -64,19 +102,18 @@ export function createOpRunTool(): ToolRegistration {
     definition: {
       name: "op-run",
       description:
-        "Submit an Op workflow to Temporal (Temporal mode). A Temporal worker must already be running — start it with `chant run <name> --temporal`.",
+        "Run an Op on a runtime and return its result. Defaults to the built-in local runtime, which executes the Op in this process.",
       inputSchema: {
         type: "object",
         properties: {
           name: { type: "string", description: "Op name (e.g. alb-deploy)" },
-          profile: { type: "string", description: "Temporal profile name from chant.config.ts (optional)" },
+          runtime: RUNTIME_PARAM,
         },
         required: ["name"],
       },
     },
     handler: async (params) => {
       const name = params.name as string;
-      const profile = params.profile as string | undefined;
 
       const { ops } = await discoverOps();
       if (!ops.has(name)) {
@@ -84,18 +121,19 @@ export function createOpRunTool(): ToolRegistration {
         return `Op "${name}" not found. Available: ${available.join(", ") || "none"}`;
       }
 
-      const { config } = ops.get(name)!;
-      const { client, profile: resolvedProfile } = await makeTemporalClient(profile, resolve("."));
-      const workflowId = resolveWorkflowId(name);
-      const taskQueue = resolvedProfile.taskQueue ?? config.taskQueue ?? name;
-
-      await client.workflow.start(workflowFnName(name), {
-        taskQueue,
-        workflowId,
-        workflowIdConflictPolicy: "FAIL",
-      });
+      const runtime = await runtimeFor(params.runtime);
+      const handle = await runtime.start(ops.get(name)!.config, {});
+      const status = await handle.result();
 
-      return { workflowId, message: `Workflow "${workflowId}" submitted to task queue "${taskQueue}"` };
+      return {
+        op: status.op,
+        runId: status.runId,
+        state: status.state,
+        startedAt: status.startedAt,
+        endedAt: status.endedAt ?? null,
+        ...(status.records ? { records: status.records } : {}),
+        ...(status.gate ? { gate: status.gate } : {}),
+      };
     },
   };
 }
@@ -104,78 +142,81 @@ export function createOpStatusTool(): ToolRegistration {
   return {
     definition: {
       name: "op-status",
-      description: "Return the current run state of an Op workflow",
+      description: "Return the current run state of an Op on a runtime",
       inputSchema: {
         type: "object",
         properties: {
           name: { type: "string", description: "Op name (e.g. alb-deploy)" },
-          profile: { type: "string", description: "Temporal profile name from chant.config.ts (optional)" },
+          runtime: RUNTIME_PARAM,
         },
         required: ["name"],
       },
     },
     handler: async (params) => {
       const name = params.name as string;
-      const profile = params.profile as string | undefined;
 
       const { ops } = await discoverOps();
-      const config = ops.get(name)?.config;
-
-      const { client } = await makeTemporalClient(profile, resolve("."));
-      const handle = client.workflow.getHandle(resolveWorkflowId(name));
-      const desc = await handle.describe();
-      const history = await fetchNormalizedHistory(handle);
-
-      const { completed: activitiesCompleted, scheduled: activitiesScheduled } = countActivities(history);
-      // Per-phase progress (#1676) — the same StepRecord shape `chant run
-      // <name> --json` uses locally, so a consumer renders one way
-      // regardless of executor. Only buildable when the Op's config was
-      // discoverable (a *.op.ts file on disk); absent otherwise rather than
-      // guessed at.
-      const progress = config ? extractStepRecords(config, history, { final: Boolean(desc.closeTime) }) : undefined;
-      const gate = await queryGateState(handle);
+      if (!ops.has(name)) throw new Error(`Op "${name}" not found`);
+
+      const runtime = await runtimeFor(params.runtime);
+      const status = await runtime.status(name);
+      if (!status) return { op: name, runtime: runtime.name, state: null, message: "no run recorded" };
 
       return {
-        workflowId: desc.workflowId,
-        runId: desc.runId,
-        status: desc.status.name,
-        startTime: desc.startTime,
-        closeTime: desc.closeTime ?? null,
-        taskQueue: desc.taskQueue,
-        activitiesCompleted,
-        activitiesScheduled,
-        ...(progress ? { progress } : {}),
-        gate: gate ?? null,
+        op: status.op,
+        runtime: runtime.name,
+        runId: status.runId,
+        state: status.state,
+        startedAt: status.startedAt,
+        endedAt: status.endedAt ?? null,
+        ...(status.records ? { records: status.records } : {}),
+        gate: status.gate ?? null,
       };
     },
   };
 }
 
-export function createOpSignalTool(): ToolRegistration {
+export function createOpApproveTool(): ToolRegistration {
   return {
     definition: {
-      name: "op-signal",
-      description: "Send a named signal to an Op workflow (e.g. to unblock a gate step)",
+      name: "op-approve",
+      description:
+        "Record a gate's resolution on the gate ledger and wake the runtime hosting the gated run. The rename of op-signal: a gate is resolved by recording the fact, not by sending a message.",
       inputSchema: {
         type: "object",
         properties: {
           name: { type: "string", description: "Op name (e.g. alb-deploy)" },
-          signal: { type: "string", description: "Signal name (e.g. gate-dns-delegation)" },
-          profile: { type: "string", description: "Temporal profile name from chant.config.ts (optional)" },
+          gate: { type: "string", description: "Gate name (e.g. gate-dns-delegation)" },
+          approver: { type: "string", description: "Who approved; defaults to the CI or shell identity" },
+          note: { type: "string", description: "Free-text context recorded on the resolution" },
+          url: { type: "string", description: "Absolute http/https URL this resolution happened at" },
+          runtime: RUNTIME_PARAM,
         },
-        required: ["name", "signal"],
+        required: ["name", "gate"],
       },
     },
     handler: async (params) => {
       const name = params.name as string;
-      const signal = params.signal as string;
-      const profile = params.profile as string | undefined;
+      const gate = params.gate as string;
+      if (!name || !gate) throw new Error("op-approve needs both an Op name and a gate name");
 
-      const { client } = await makeTemporalClient(profile, resolve("."));
-      const handle = client.workflow.getHandle(resolveWorkflowId(name));
-      await handle.signal(signal);
+      const runtime = await runtimeFor(params.runtime);
+      const outcome = await recordGateApproval(name, gate, {
+        actor: params.approver as string | undefined,
+        note: params.note as string | undefined,
+        url: params.url as string | undefined,
+      });
+      if (!outcome.ok) throw new Error(`Gate "${gate}" on "${name}" was not recorded`);
+
+      if (runtime.resolveGate) await runtime.resolveGate(name, gate, outcome.record);
 
-      return `Signal "${signal}" sent to Op "${name}"`;
+      return {
+        op: name,
+        gate,
+        resolvedBy: outcome.record.resolvedBy,
+        timestamp: outcome.record.timestamp,
+        runtimeNotified: Boolean(runtime.resolveGate),
+      };
     },
   };
 }
@@ -184,32 +225,50 @@ export function createOpReportTool(): ToolRegistration {
   return {
     definition: {
       name: "op-report",
-      description: "Return a markdown deployment report for the latest run of an Op",
+      description: "Return a markdown report for the latest run of an Op on a runtime",
       inputSchema: {
         type: "object",
         properties: {
           name: { type: "string", description: "Op name (e.g. alb-deploy)" },
-          profile: { type: "string", description: "Temporal profile name from chant.config.ts (optional)" },
+          runtime: RUNTIME_PARAM,
         },
         required: ["name"],
       },
     },
     handler: async (params) => {
       const name = params.name as string;
-      const profile = params.profile as string | undefined;
 
       const { ops } = await discoverOps();
-      if (!ops.has(name)) {
-        return `Op "${name}" not found`;
-      }
+      if (!ops.has(name)) return `Op "${name}" not found`;
       const { config } = ops.get(name)!;
 
-      const { client } = await makeTemporalClient(profile, resolve("."));
-      const handle = client.workflow.getHandle(resolveWorkflowId(name));
-      const desc = await handle.describe();
-      const history = await fetchNormalizedHistory(handle);
+      const runtime = await runtimeFor(params.runtime);
+      const status = await runtime.status(name);
+      if (!status) return `# ${name}\n\n${config.overview}\n\nNo run is recorded on the "${runtime.name}" runtime.\n`;
+
+      const lines = [
+        `# ${name}`,
+        "",
+        config.overview,
+        "",
+        `- Runtime: ${runtime.name}`,
+        `- Run: ${status.runId}`,
+        `- State: ${status.state}`,
+        `- Started: ${status.startedAt}`,
+        ...(status.endedAt ? [`- Ended: ${status.endedAt}`] : []),
+        ...(status.gate ? [`- Gate: ${status.gate.name} (pending since ${status.gate.since})`] : []),
+        "",
+      ];
+
+      if (status.records?.length) {
+        lines.push("| Phase | Step | Status | Duration |", "|---|---|---|---|");
+        for (const record of status.records) {
+          lines.push(`| ${record.phase} | ${record.fn} | ${record.status} | ${record.durationMs}ms |`);
+        }
+        lines.push("");
+      }
 
-      return generateReport(name, config, desc, history);
+      return lines.join("\n");
     },
   };
 }