@intentius/chant 0.62.0 → 0.63.0

package/src/fold/subset-doc-parity.test.ts

@@ -3,7 +3,7 @@ import * as ts from "typescript";
 import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
 import { join } from "path";
-import { collectConsts } from "./fold";
+import { collectConsts, fold, FoldError } from "./fold";
 import { findSubsetViolation } from "./subset";
 
 /**
@@ -50,6 +50,20 @@ import { findSubsetViolation } from "./subset";
  *     module boundary, or not at all (subset.ts's module doc, point 1) — a
  *     documented, intentional asymmetry, not something this guard can
  *     usefully narrow further without a binding resolver of its own.
+ *
+ * One doc claim below is checked against `fold()` instead of
+ * `findSubsetViolation` — chant #2306. "Unregistered tagged template
+ * intrinsics" is a claim `findSubsetViolation` structurally cannot decide:
+ * subset.ts treats every tagged template's interior as shape-valid
+ * regardless of tag registration (its own module doc explains why — EVL has
+ * no intrinsic registry at lint time), so registered vs. unregistered is
+ * indistinguishable at that layer no matter which heading the claim sits
+ * under. The registry check lives in `fold()` (`foldTaggedTemplate`), so
+ * that is what this one test calls instead. This is also why the doc bullet
+ * survived as long as it did in unfenced prose (chant #2306's own issue
+ * comment): moving it under a `###` heading with a fenced block, the shape
+ * every other case here uses, was necessary but not sufficient — the
+ * fixture still has to be run through the right function.
  */
 
 const repoRoot = fileURLToPath(new URL("../../../../", import.meta.url));
@@ -208,3 +222,23 @@ describe("subset-doc-parity — unsupported patterns in typescript-as-data.mdx c
     expect(findSubsetViolation(resourceArg(consts, "store"))).toBeDefined();
   });
 });
+
+describe("subset-doc-parity — fold()-decided claim in typescript-as-data.mdx (#2306)", () => {
+  test("Unregistered tagged template intrinsics", () => {
+    // findSubsetViolation cannot decide this one — see this file's module
+    // doc. Fold the doc's own example with an empty intrinsics list (no tag
+    // registered at all, the same as no lexicon opting `unknownTag` in) and
+    // check the real rejection, `foldTaggedTemplate` in ./fold.ts, fires.
+    const consts = parseConsts(extractFencedBlock("Unregistered tagged template intrinsics"));
+    const arg = resourceArg(consts, "store");
+    let error: unknown;
+    try {
+      fold(arg, consts, []);
+    } catch (e) {
+      error = e;
+    }
+    expect(error).toBeInstanceOf(FoldError);
+    expect((error as FoldError).message).toContain("unregistered tagged template intrinsic");
+    expect((error as FoldError).message).toContain("unknownTag");
+  });
+});

package/src/fold/subset.ts

@@ -44,6 +44,16 @@ import { intrinsicCallFolds, intrinsicCallFoldsEagerly, type IntrinsicDef } from
  *      re-folding the initializer would construct a duplicate of a resource
  *      discovery has already registered. Shape cannot see the difference, and
  *      the rejection is a fall-back-to-run, never a wrong value.
+ *
+ *      chant #2328 adds another, in the same direction and for the same
+ *      reason: a property or element read whose OBJECT resolves to `null` or
+ *      `undefined` (`cfg.nett.vpcId`, a typo in a nested path). Running it
+ *      throws a `TypeError`, so `fold()` refuses rather than answering
+ *      `undefined` and letting the build carry on with the property dropped.
+ *      What the object resolves to is exactly the resolution this module
+ *      does not do, so `cfg.nett.vpcId` stays shape-valid here — and a
+ *      genuinely optional `cfg.net?.vpcId`, which folds to `undefined`
+ *      because JavaScript defines it that way, is shape-valid in both.
  *   2. Tagged-template *tag registration* — needs a lexicon's intrinsics
  *      manifest, which isn't available to a syntax-only lint rule. `fold()`
  *      alone checks it; this module treats any tag name as shape-valid and

package/src/lifecycle/gate-ledger.test.ts

@@ -6,7 +6,8 @@ import { join } from "node:path";
 import {
   appendGateResolution, appendPendingGate, readGateResolutions, readGateLedger,
   latestResolutionSince, latestPendingGate, isPendingGateExpired,
-  resolveApprovalUrl, isApprovalUrl, type PendingGateRecord,
+  resolveApprovalUrl, isApprovalUrl, latestResolutionForPlan,
+  type PendingGateRecord, type GateResolutionRecord,
 } from "./gate-ledger";
 import { readBlobFromPath, writeBlobToPath } from "./git";
 
@@ -253,3 +254,134 @@ describe("lifecycle/gate-ledger — pending facts (#2119)", () => {
     });
   });
 });
+
+/**
+ * #2300. `latestResolutionSince` asks "is there a newer approval", which a run
+ * answers yes to however much has changed since it was written. That is the
+ * rule INTENTIUS/choudoufu#1026 measured applying a renamed resource without
+ * complaint. `latestResolutionForPlan` asks "is there an approval of *this*",
+ * with recency demoted from the criterion to the tiebreak.
+ */
+describe("latestResolutionForPlan (#2300)", () => {
+  const EPOCH = new Date(0).toISOString();
+  const PLAN_A = `sha256:${"a".repeat(64)}`;
+  const PLAN_B = `sha256:${"b".repeat(64)}`;
+
+  const resolution = (over: Partial<GateResolutionRecord>): GateResolutionRecord => ({
+    version: 1, op: "live-apply", gate: "approve-live-apply", resolvedBy: "alex",
+    timestamp: "2026-01-02T00:00:00.000Z", ...over,
+  });
+
+  test("a resolution for this plan answers the gate", () => {
+    const found = latestResolutionForPlan([resolution({ planDigest: PLAN_A })], "approve-live-apply", EPOCH, PLAN_A);
+    expect(found.resolution?.resolvedBy).toBe("alex");
+    expect(found.mismatched).toBeUndefined();
+  });
+
+  test("a resolution for another plan does not, and comes back named", () => {
+    const found = latestResolutionForPlan([resolution({ planDigest: PLAN_B })], "approve-live-apply", EPOCH, PLAN_A);
+    expect(found.resolution).toBeUndefined();
+    expect(found.mismatched?.planDigest).toBe(PLAN_B);
+  });
+
+  // The migration, and the safe reading of it: a record with no digest proves
+  // someone approved something, and nothing about what.
+  test("a resolution written before #2300 never matches a plan-bound gate", () => {
+    const found = latestResolutionForPlan([resolution({})], "approve-live-apply", EPOCH, PLAN_A);
+    expect(found.resolution).toBeUndefined();
+    expect(found.mismatched).toBeDefined();
+    expect(found.mismatched?.planDigest).toBeUndefined();
+  });
+
+  // Recency is the tiebreak, not the criterion: a newer approval of the wrong
+  // plan does not shadow an older approval of the right one.
+  test("an older resolution for this plan beats a newer one for another", () => {
+    const found = latestResolutionForPlan(
+      [
+        resolution({ planDigest: PLAN_A, resolvedBy: "right", timestamp: "2026-01-02T00:00:00.000Z" }),
+        resolution({ planDigest: PLAN_B, resolvedBy: "wrong", timestamp: "2026-01-09T00:00:00.000Z" }),
+      ],
+      "approve-live-apply", EPOCH, PLAN_A,
+    );
+    expect(found.resolution?.resolvedBy).toBe("right");
+  });
+
+  test("among several for this plan, the newest wins", () => {
+    const found = latestResolutionForPlan(
+      [
+        resolution({ planDigest: PLAN_A, resolvedBy: "first", timestamp: "2026-01-02T00:00:00.000Z" }),
+        resolution({ planDigest: PLAN_A, resolvedBy: "second", timestamp: "2026-01-03T00:00:00.000Z" }),
+      ],
+      "approve-live-apply", EPOCH, PLAN_A,
+    );
+    expect(found.resolution?.resolvedBy).toBe("second");
+  });
+
+  test("the staleness rule still applies — a resolution older than the pending fact is no answer to it", () => {
+    const found = latestResolutionForPlan(
+      [resolution({ planDigest: PLAN_A, timestamp: "2026-01-01T00:00:00.000Z" })],
+      "approve-live-apply", "2026-01-05T00:00:00.000Z", PLAN_A,
+    );
+    expect(found.resolution).toBeUndefined();
+    expect(found.mismatched).toBeUndefined();
+  });
+
+  test("a gate that binds no plan decides exactly as latestResolutionSince does", () => {
+    const records = [resolution({}), resolution({ resolvedBy: "newer", timestamp: "2026-01-04T00:00:00.000Z" })];
+    expect(latestResolutionForPlan(records, "approve-live-apply", EPOCH, undefined).resolution?.resolvedBy)
+      .toBe(latestResolutionSince(records, "approve-live-apply", EPOCH)?.resolvedBy);
+  });
+
+  test("another gate's resolutions are not read as this one's", () => {
+    const found = latestResolutionForPlan(
+      [resolution({ gate: "approve-live-adopt", planDigest: PLAN_A })],
+      "approve-live-apply", EPOCH, PLAN_A,
+    );
+    expect(found.resolution).toBeUndefined();
+    expect(found.mismatched).toBeUndefined();
+  });
+});
+
+/**
+ * A `planDigest` that is present but not a string is a malformed line, not a
+ * line with a field to ignore (#2300) — ignoring it would demote a plan-bound
+ * record to a digest-less one, which is the shape a plan-bound gate refuses.
+ */
+describe("readGateLedger — a corrupted planDigest is malformed (#2300)", () => {
+  test("a non-string planDigest is counted, not read as an approval of nothing", async () => {
+    await withTestDir(async (dir) => {
+      await initRepo(dir);
+      await writeBlobToPath(
+        "_gates", "live-apply.jsonl",
+        JSON.stringify({
+          version: 1, op: "live-apply", gate: "g", resolvedBy: "alex",
+          timestamp: "2026-01-01T00:00:00.000Z", planDigest: { sha: "…" },
+        }),
+        "hand-written",
+        { cwd: dir },
+      );
+      const { resolutions, malformed } = await readGateLedger("live-apply", { cwd: dir });
+      expect(malformed).toBe(1);
+      expect(resolutions).toEqual([]);
+    });
+  });
+
+  test("a string planDigest round-trips onto both kinds of record", async () => {
+    await withTestDir(async (dir) => {
+      await initRepo(dir);
+      const digest = `sha256:${"a".repeat(64)}`;
+      await appendPendingGate(
+        { op: "live-apply", gate: "g", timestamp: "2026-01-01T00:00:00.000Z", expiresAt: "2026-01-03T00:00:00.000Z", planDigest: digest },
+        { cwd: dir },
+      );
+      await appendGateResolution(
+        { op: "live-apply", gate: "g", resolvedBy: "alex", timestamp: "2026-01-02T00:00:00.000Z", planDigest: digest },
+        { cwd: dir },
+      );
+      const { resolutions, pending, malformed } = await readGateLedger("live-apply", { cwd: dir });
+      expect(malformed).toBe(0);
+      expect(pending[0].planDigest).toBe(digest);
+      expect(resolutions[0].planDigest).toBe(digest);
+    });
+  });
+});

package/src/lifecycle/gate-ledger.ts

@@ -22,6 +22,13 @@
  * `chant approve` locally can write one, the same trust boundary a local
  * commit already has.
  *
+ * Since #2300 both halves also carry a plan identity (`./plan-digest.ts`): a
+ * run records the plan it reached the gate with, `chant approve` records the
+ * plan it approves, and {@link latestResolutionForPlan} matches on that
+ * rather than on recency alone. Before it, an approval authorised the next
+ * run of an op rather than the plan its approver had read
+ * (INTENTIUS/choudoufu#1026).
+ *
  * Since #2119 the file carries both halves of the loop. A `gate` step the
  * local executor reaches (`../op/local-executor.ts`) appends a
  * {@link PendingGateRecord} and ends that run with status `gated`; `chant
@@ -119,6 +126,18 @@ export interface GateResolutionRecord {
    * URL — see {@link isApprovalUrl}.
    */
   url?: string;
+  /**
+   * The plan this approval is for (#2300) — `computePlanDigest`'s output
+   * (`./plan-digest.ts`), normally copied off the {@link PendingGateRecord}
+   * this resolution answers.
+   *
+   * Absent on every resolution written before #2300, and on one written for a
+   * gate that binds no plan. Absent is not a wildcard: {@link
+   * latestResolutionForPlan} refuses a digest-less resolution against a
+   * plan-bound gate rather than letting it through, because the only thing
+   * such a record proves is that somebody approved *something*.
+   */
+  planDigest?: string;
 }
 
 export type GateResolutionInput = Omit<GateResolutionRecord, "version" | "kind">;
@@ -154,6 +173,16 @@ export interface PendingGateRecord {
   expiresAt: string;
   /** The address approval happens at, when the run knew one — see {@link resolveApprovalUrl}. */
   url?: string;
+  /**
+   * The plan the run reached this gate with (#2300) — `computePlanDigest`'s
+   * output (`./plan-digest.ts`). This is what `chant approve` copies onto the
+   * resolution by default, so approving the standing fact approves the plan
+   * the approver was shown rather than the next run's.
+   *
+   * Absent when the gate binds no plan (a component gate, an authored `gate`
+   * step with no `plan`), which is the shape every gate had before #2300.
+   */
+  planDigest?: string;
 }
 
 export type PendingGateInput = Omit<PendingGateRecord, "version" | "kind">;
@@ -262,6 +291,16 @@ export async function readGateLedger(
         malformed++;
         continue;
       }
+      // #2300: a `planDigest` that is present but not a string is a
+      // malformed line, not a line with a field to ignore. Ignoring it would
+      // silently demote a plan-bound record to a digest-less one, which is
+      // the shape `latestResolutionForPlan` refuses — a corrupted approval
+      // must not read as an approval of anything at all.
+      const rawDigest: unknown = (parsed as { planDigest?: unknown }).planDigest;
+      if (rawDigest !== undefined && typeof rawDigest !== "string") {
+        malformed++;
+        continue;
+      }
       if (parsed.kind === "pending") {
         if (typeof parsed.expiresAt !== "string") {
           malformed++;
@@ -319,3 +358,72 @@ export function latestResolutionSince(
   }
   return latest;
 }
+
+/** What {@link latestResolutionForPlan} found for the plan a run is holding. */
+export interface PlanBoundResolution {
+  /** The resolution that answers this gate for this plan. Absent when nothing does. */
+  resolution?: GateResolutionRecord;
+  /**
+   * Present instead of {@link PlanBoundResolution.resolution} when a
+   * resolution stands for this gate but for a different plan — the newest
+   * such record, so a refusal can name who approved what and when. Its
+   * `planDigest` is `undefined` for a record written before #2300.
+   */
+  mismatched?: GateResolutionRecord;
+}
+
+/**
+ * The resolution that answers `gate` for the plan `planDigest` identifies
+ * (#2300).
+ *
+ * The criterion is the digest; recency is only the tiebreak between several
+ * resolutions that all match it. That inversion is the whole point of the
+ * issue: {@link latestResolutionSince} asks "is there a newer approval",
+ * which a run answers yes to no matter what has changed since, and this asks
+ * "is there an approval of *this*".
+ *
+ * - `planDigest` `undefined` — the gate binds no plan (a component gate, a
+ *   `gate` step authored with no `plan`). Falls straight through to
+ *   {@link latestResolutionSince}: gates that never claimed to bind a plan
+ *   behave exactly as they did before #2300.
+ * - A resolution whose `planDigest` equals `planDigest` answers the gate.
+ * - A resolution for a different plan does not, and comes back as
+ *   `mismatched` so the caller can name both digests.
+ * - A resolution with no `planDigest` at all — every record written before
+ *   #2300 — does not either, and comes back as `mismatched` with an absent
+ *   `planDigest`. This is the safe reading of the migration: such a record
+ *   proves someone approved something, and nothing about what. Accepting it
+ *   once would silently apply the very change this check exists to catch, on
+ *   exactly the estates that have been running longest. The cost is one
+ *   further `chant approve` per gate after the upgrade, which the refusal
+ *   says out loud.
+ */
+export function latestResolutionForPlan(
+  records: GateResolutionRecord[],
+  gate: string,
+  sinceIso: string,
+  planDigest: string | undefined,
+): PlanBoundResolution {
+  if (planDigest === undefined) {
+    const resolution = latestResolutionSince(records, gate, sinceIso);
+    return resolution ? { resolution } : {};
+  }
+
+  const since = new Date(sinceIso).getTime();
+  let matched: GateResolutionRecord | undefined;
+  let mismatched: GateResolutionRecord | undefined;
+  for (const r of records) {
+    if (r.gate !== gate) continue;
+    if (new Date(r.timestamp).getTime() < since) continue;
+    const newest = (best: GateResolutionRecord | undefined) =>
+      !best || new Date(r.timestamp).getTime() >= new Date(best.timestamp).getTime();
+    if (r.planDigest === planDigest) {
+      if (newest(matched)) matched = r;
+    } else if (newest(mismatched)) {
+      mismatched = r;
+    }
+  }
+
+  if (matched) return { resolution: matched };
+  return mismatched ? { mismatched } : {};
+}

package/src/lifecycle/index.ts

@@ -23,3 +23,4 @@ export * from "./converge-ledger";
 export * from "./run-ledger";
 export * from "./scenario";
 export * from "./scenario-eval";
+export * from "./plan-digest";

package/src/lifecycle/plan-digest.test.ts

@@ -0,0 +1,49 @@
+import { describe, test, expect } from "vitest";
+import { computePlanDigest, isPlanDigest, describePlanDigest } from "./plan-digest";
+
+describe("computePlanDigest", () => {
+  test("the same change set digests the same, whatever order its keys arrived in", () => {
+    const a = computePlanDigest("terraform-plan", { address: "aws_s3_bucket.a", actions: ["create"] });
+    const b = computePlanDigest("terraform-plan", { actions: ["create"], address: "aws_s3_bucket.a" });
+    expect(a).toBe(b);
+  });
+
+  test("a changed address changes it", () => {
+    expect(computePlanDigest("terraform-plan", { address: "aws_s3_bucket.a" })).not.toBe(
+      computePlanDigest("terraform-plan", { address: "aws_s3_bucket.b" }),
+    );
+  });
+
+  // The kind is hashed alongside the subject so a gate bound to a terraform
+  // plan cannot be satisfied by another kind of plan that happened to
+  // serialize identically.
+  test("two kinds of plan over identical data do not collide", () => {
+    expect(computePlanDigest("terraform-plan", { x: 1 })).not.toBe(
+      computePlanDigest("lifecycle-diff", { x: 1 }),
+    );
+  });
+
+  test("it is a sha256 digest, in the shape isPlanDigest accepts", () => {
+    const digest = computePlanDigest("terraform-plan", {});
+    expect(digest).toMatch(/^sha256:[0-9a-f]{64}$/);
+    expect(isPlanDigest(digest)).toBe(true);
+  });
+});
+
+describe("isPlanDigest", () => {
+  test("refuses everything a copy-paste or a path could be", () => {
+    expect(isPlanDigest("chant.tfplan")).toBe(false);
+    expect(isPlanDigest(`sha256:${"a".repeat(63)}`)).toBe(false);
+    expect(isPlanDigest("a".repeat(64))).toBe(false);
+    expect(isPlanDigest(`sha256:${"A".repeat(64)}`)).toBe(false);
+    expect(isPlanDigest(undefined)).toBe(false);
+    expect(isPlanDigest(12)).toBe(false);
+  });
+});
+
+describe("describePlanDigest", () => {
+  test("an absent digest reads as the pre-#2300 record it is, never as undefined", () => {
+    expect(describePlanDigest(undefined)).toBe("(none — recorded before plan-bound gates)");
+    expect(describePlanDigest("sha256:abc")).toBe("sha256:abc");
+  });
+});

package/src/lifecycle/plan-digest.ts

@@ -0,0 +1,86 @@
+/**
+ * Plan identity for a gate (#2300, measured on INTENTIUS/choudoufu#1026).
+ *
+ * A gate resolution used to carry the op, the gate, the approver and a
+ * timestamp, and nothing about what was approved. Approve, edit the root,
+ * re-run, and the second run re-planned and applied: the resolution had
+ * authorised the *next run* of that op rather than the plan the approver
+ * read. This module is the missing half — one string that identifies a plan,
+ * written onto the pending fact the run records, onto the resolution `chant
+ * approve` appends, and compared by {@link latestResolutionForPlan} when a
+ * later run decides the gate.
+ *
+ * ## What a digest covers
+ *
+ * The change set, and only the change set: what a run proposes to create,
+ * update, replace or destroy, at which addresses, with which values. Two
+ * plans share a digest exactly when applying either one would do the same
+ * thing to the estate.
+ *
+ * ## What it deliberately does not cover
+ *
+ * - **When the plan was taken.** A plan file's own `timestamp`, and the
+ *   resolution's. Re-planning an unchanged root a minute later must produce
+ *   the same digest, or every approval would expire on the clock rather than
+ *   on the content.
+ * - **Which run took it.** `runId`, the CI job number, the workflow attempt.
+ *   Approving a plan and re-running the workflow is the whole loop; binding
+ *   the run id would make the approval unusable by the run that consumes it.
+ * - **The tool that produced it.** The terraform/choudoufu version, the plan
+ *   file's binary bytes and its path on disk. The digest is taken over the
+ *   `show -json` rendering rather than the file, so a plan-format bump does
+ *   not read as a changed plan.
+ * - **Who approved it, or where.** `resolvedBy`, `note`, `url` — those
+ *   describe the approval, not the plan.
+ *
+ * The identity is therefore a claim about consequence, not about provenance.
+ * That is the claim an approver is actually making.
+ */
+import { sortedJsonReplacer } from "../utils";
+import { getRuntime } from "../runtime-adapter";
+
+/** The hash a plan digest is taken with, and the prefix every digest carries. */
+export const PLAN_DIGEST_ALGORITHM = "sha256";
+
+/** Shape of a well-formed digest: `sha256:` and 64 lowercase hex characters. */
+const PLAN_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+
+/**
+ * Hash a plan's change set into a stable identity.
+ *
+ * `kind` names the shape `subject` is in (`"terraform-plan"`,
+ * `"lifecycle-diff"`), and is hashed alongside it so two different kinds of
+ * plan can never collide into the same digest by coincidence — a gate bound
+ * to a terraform plan must not be satisfiable by a lifecycle diff that
+ * happened to serialize identically.
+ *
+ * `subject` is canonicalised by {@link sortedJsonReplacer}, so object key
+ * order — which neither terraform's JSON writer nor `JSON.parse` guarantees
+ * across versions — does not change the answer. It is the caller's job to
+ * hand in a projection that already excludes the volatile fields this
+ * module's doc comment lists.
+ */
+export function computePlanDigest(kind: string, subject: unknown): string {
+  const canonical = JSON.stringify({ kind, subject }, sortedJsonReplacer);
+  return `${PLAN_DIGEST_ALGORITHM}:${getRuntime().hash(canonical)}`;
+}
+
+/**
+ * Whether `raw` is a digest this code produced. Used at the `chant approve
+ * --plan` boundary, so a typo, a truncated copy-paste or a plan *file* path
+ * is refused before it is written into an immutable resolution that would
+ * then never match anything.
+ */
+export function isPlanDigest(raw: unknown): raw is string {
+  return typeof raw === "string" && PLAN_DIGEST_PATTERN.test(raw);
+}
+
+/**
+ * A digest as it reads in a message, and the one place that decides how an
+ * absent one reads. Records written before #2300 carry no digest at all, and
+ * "(none — recorded before plan-bound gates)" is what a refusal has to say
+ * about them instead of printing `undefined`.
+ */
+export function describePlanDigest(digest: string | undefined): string {
+  return digest ?? "(none — recorded before plan-bound gates)";
+}

package/src/lifecycle/run-ledger.ts

@@ -105,6 +105,7 @@ export function buildRunRecord(
       ...(record.outcome ? { outcome: record.outcome } : {}),
       ...(record.approval ? { approval: record.approval } : {}),
       ...(record.error !== undefined ? { error: record.error } : {}),
+      ...(record.refusal !== undefined ? { refusal: record.refusal } : {}),
     });
     if (record.outcome) outcomes[record.outcome.name] = record.outcome.value;
   }

package/src/op/activities/lexicon-upgrade.test.ts

@@ -257,9 +257,9 @@ describe("lexiconUpgrade issue mode", () => {
 
   test("on a GitHub Actions job (GITHUB_REPOSITORY set), opens the sticky issue via gh api (#2297)", async () => {
     const checkPinned: CheckPinnedFn = vi.fn(async () => pinnedResult());
-    const calls: string[] = [];
-    const gh = vi.fn(async (cmd: string) => {
-      calls.push(cmd);
+    const calls: Array<{ cmd: string; env?: NodeJS.ProcessEnv }> = [];
+    const gh = vi.fn(async (cmd: string, opts?: { env?: NodeJS.ProcessEnv }) => {
+      calls.push({ cmd, env: opts?.env });
       if (cmd.includes("--paginate")) return { stdout: "", stderr: "" }; // no owned issue yet
       if (cmd.includes("--method POST")) return { stdout: "https://github.com/acme/infra/issues/11\n", stderr: "" };
       return { stdout: "", stderr: "" };
@@ -267,6 +267,8 @@ describe("lexiconUpgrade issue mode", () => {
 
     vi.stubEnv("GITHUB_REPOSITORY", "acme/infra");
     vi.stubEnv("GITHUB_API_URL", "");
+    vi.stubEnv("CHANT_FORGEJO_TOKEN", "");
+    vi.stubEnv("GH_TOKEN", "ghs-workflow");
     try {
       const r = await lexiconUpgrade({
         lexicon: "gcp",
@@ -276,10 +278,14 @@ describe("lexiconUpgrade issue mode", () => {
       });
 
       expect(r.issueUrl).toBe("https://github.com/acme/infra/issues/11");
-      expect(calls.some((c) => c.includes("gh issue create"))).toBe(false);
-      const post = calls.find((c) => c.includes("--method POST"));
-      expect(post).toContain("https://api.github.com/repos/acme/infra/issues");
-      expect(post).toContain("<!-- chant-lexicon-upgrade:gcp -->");
+      expect(calls.some((c) => c.cmd.includes("gh issue create"))).toBe(false);
+      const post = calls.find((c) => c.cmd.includes("--method POST"));
+      expect(post?.cmd).toContain("https://api.github.com/repos/acme/infra/issues");
+      expect(post?.cmd).toContain("<!-- chant-lexicon-upgrade:gcp -->");
+      // #2320: the shared `postOrUpdateGithubIssue` resolves the credential
+      // and hands it to the runner, so this caller gets the same forwarding
+      // reconcilePr's issue mode does rather than leaving `gh` to guess.
+      for (const call of calls) expect(call.env?.GH_TOKEN).toBe("ghs-workflow");
     } finally {
       vi.unstubAllEnvs();
     }
@@ -287,9 +293,9 @@ describe("lexiconUpgrade issue mode", () => {
 
   test("a re-run on a GitHub Actions job PATCHes the issue it already owns (#2297)", async () => {
     const checkPinned: CheckPinnedFn = vi.fn(async () => pinnedResult());
-    const calls: string[] = [];
-    const gh = vi.fn(async (cmd: string) => {
-      calls.push(cmd);
+    const calls: Array<{ cmd: string; env?: NodeJS.ProcessEnv }> = [];
+    const gh = vi.fn(async (cmd: string, opts?: { env?: NodeJS.ProcessEnv }) => {
+      calls.push({ cmd, env: opts?.env });
       if (cmd.includes("--paginate")) return { stdout: "11\n", stderr: "" }; // marker search found issue 11
       if (cmd.includes("--method PATCH")) return { stdout: "https://github.com/acme/infra/issues/11\n", stderr: "" };
       return { stdout: "", stderr: "" };
@@ -297,6 +303,10 @@ describe("lexiconUpgrade issue mode", () => {
 
     vi.stubEnv("GITHUB_REPOSITORY", "acme/infra");
     vi.stubEnv("GITHUB_API_URL", "");
+    // The cross-instance case (#2320): a Forgejo token that must outrank the
+    // job's own `github.token`, on the path that used to forward neither.
+    vi.stubEnv("CHANT_FORGEJO_TOKEN", "forgejo-cross-instance");
+    vi.stubEnv("GH_TOKEN", "ghs-this-instance-only");
     try {
       const r = await lexiconUpgrade({
         lexicon: "gcp",
@@ -306,8 +316,10 @@ describe("lexiconUpgrade issue mode", () => {
       });
 
       expect(r.issueUrl).toBe("https://github.com/acme/infra/issues/11");
-      expect(calls.some((c) => c.includes("--method POST"))).toBe(false);
-      expect(calls.some((c) => c.includes("gh issue create"))).toBe(false);
+      expect(calls.some((c) => c.cmd.includes("--method POST"))).toBe(false);
+      expect(calls.some((c) => c.cmd.includes("gh issue create"))).toBe(false);
+      const patch = calls.find((c) => c.cmd.includes("--method PATCH"));
+      expect(patch?.env?.GH_TOKEN).toBe("forgejo-cross-instance");
     } finally {
       vi.unstubAllEnvs();
     }

package/src/op/activities/lexicon-upgrade.ts

@@ -120,8 +120,21 @@ export type CheckRollingFn = (opts: {
   verbose?: boolean;
 }) => Promise<RollingUpgradeResult>;
 
-/** Minimal shell-exec interface for gh/git invocations. */
-export type GhRunner = (cmd: string) => Promise<{ stdout: string; stderr: string }>;
+/**
+ * Minimal shell-exec interface for gh/git invocations.
+ *
+ * `opts` carries the environment `postOrUpdateGithubIssue` resolves the issue
+ * credential into (chant #2320) — the same `GhExec` shape reconcile.ts
+ * declares, so the two stay one signature and this can keep being passed
+ * straight through. Every other call site here forwards nothing and passes
+ * nothing. A mock runner is free to ignore the argument; the default one
+ * hands it to `execAsync`, which is what makes CHANT_FORGEJO_TOKEN actually
+ * reach `gh` on a cross-instance Forgejo run.
+ */
+export type GhRunner = (
+  cmd: string,
+  opts?: { env?: NodeJS.ProcessEnv },
+) => Promise<{ stdout: string; stderr: string }>;
 
 /** Applies a pinned version bump permanently (no revert). Async (core loads the lexicon's pin descriptor); a sync mock is also accepted. */
 export type ApplyBumpFn = (
@@ -283,7 +296,7 @@ function shellQuote(s: string): string {
   return `'${s.replace(/'/g, "'\\''")}'`;
 }
 
-const defaultGh: GhRunner = async (cmd) => execAsync(cmd);
+const defaultGh: GhRunner = async (cmd, opts) => execAsync(cmd, { ...opts });
 
 /**
  * The hidden marker that makes this lexicon's upgrade-status issue findable
@@ -320,6 +333,9 @@ async function postLexiconIssue(
   const marker = lexiconUpgradeIssueMarker(lexicon);
   const repo = process.env.GITHUB_REPOSITORY;
   if (repo) {
+    // `postOrUpdateGithubIssue` resolves the token itself and hands it back
+    // through `gh`'s second argument (#2320), so this runner has to forward
+    // what it is given rather than dropping it — see `GhRunner`.
     return postOrUpdateGithubIssue(repo, marker, title, body, gh);
   }
   const { stdout } = await gh(