@intentius/chant 0.72.1 → 0.72.3

package/src/cli/mcp/op-approve-origin.test.ts

@@ -0,0 +1,70 @@
+import { describe, test, expect, afterEach } from "vitest";
+import { createOpApproveTool } from "./op-tools";
+import { McpServer } from "./server";
+import { readFileSync } from "node:fs";
+import { resetGateOrigin, currentGateOrigin } from "../../lifecycle/gate-origin";
+
+/**
+ * chant#2384 — the MCP surface cannot both produce a gate and resolve it.
+ *
+ * `op-run` executes the Op in-process and returns the gate it stopped on;
+ * `op-approve` then wrote the resolution with the approver taken from the
+ * request. So the agent that produced a pending gate resolved it under any
+ * name it liked, and #2300's plan binding did not close it: the digest comes
+ * off the standing pending fact, which is the plan the same caller produced one
+ * tool call earlier. The approval was for the right plan and meant nothing.
+ *
+ * These assert the two halves of the fix that are visible without a ledger: the
+ * tool no longer offers a name it cannot verify, and constructing the server
+ * declares the channel. The rule itself is exercised in
+ * `../../lifecycle/gate-origin.test.ts`.
+ */
+describe("op-approve on the MCP channel (chant#2384)", () => {
+  afterEach(() => resetGateOrigin());
+
+  test("the tool no longer accepts a free-text approver", () => {
+    const schema = createOpApproveTool().definition.inputSchema as {
+      properties: Record<string, unknown>;
+      required: string[];
+    };
+
+    // The hole, stated as a test: `approver` was free text on a channel that
+    // cannot verify one, and the ledger recorded it indistinguishably from a
+    // name a person gave. Recording "unattested" is more honest than recording
+    // a name the model chose.
+    expect(Object.keys(schema.properties)).not.toContain("approver");
+
+    // The rest of the tool is unchanged — this narrows one field, it does not
+    // remove the tool. The narrower alternative in the issue was to drop
+    // op-approve entirely; this keeps it useful for the cross-channel case.
+    expect(Object.keys(schema.properties).sort()).toEqual(["gate", "name", "note", "runtime", "url"]);
+    expect(schema.required.sort()).toEqual(["gate", "name"]);
+  });
+
+  test("the description tells the caller where an approval has to come from", () => {
+    // A model reads this string and nothing else. If it does not say that the
+    // gate must be approved elsewhere, the model's only signal is a refusal it
+    // cannot act on.
+    const description = createOpApproveTool().definition.description;
+    expect(description).toMatch(/refuses a gate this same channel reached/i);
+    expect(description).toContain("chant approve");
+    expect(description).toMatch(/unattested/i);
+  });
+
+  test("merely constructing a server does not change what the process is", () => {
+    // Deliberate: the channel is declared in `start()`, not the constructor.
+    // Building a server object in a test must not make every later gate fact in
+    // that worker read as model-authored — which is exactly the contamination
+    // the first version of this caused.
+    new McpServer();
+    expect(currentGateOrigin()).toBe("cli");
+  });
+
+  test("op-approve names its own channel, so it holds even on a server that never started", () => {
+    // The ambient value covers the pending fact written during `op-run`. The
+    // resolution does not rely on it: the tool passes `origin: "mcp"` outright,
+    // so the rule holds regardless of what the process thinks it is.
+    const source = readFileSync(new URL("./op-tools.ts", import.meta.url), "utf8");
+    expect(source).toContain('origin: "mcp"');
+  });
+});

package/src/cli/mcp/op-tools.ts

@@ -181,13 +181,18 @@ export function createOpApproveTool(): ToolRegistration {
     definition: {
       name: "op-approve",
       description:
-        "Record a gate's resolution on the gate ledger and wake the runtime hosting the gated run. The rename of op-signal: a gate is resolved by recording the fact, not by sending a message.",
+        "Record a gate's resolution on the gate ledger and wake the runtime hosting the gated run. " +
+        "Refuses a gate this same channel reached: a run started with op-run must be approved from " +
+        "somewhere else, normally `chant approve <op> <gate>` at a shell. The approver is recorded as " +
+        "unattested, because this channel cannot verify a name.",
       inputSchema: {
         type: "object",
         properties: {
           name: { type: "string", description: "Op name (e.g. alb-deploy)" },
           gate: { type: "string", description: "Gate name (e.g. gate-dns-delegation)" },
-          approver: { type: "string", description: "Who approved; defaults to the CI or shell identity" },
+          // chant#2384 — no `approver`. It was free text on a channel that
+          // cannot verify one, so the model named itself whatever it liked and
+          // the ledger recorded it indistinguishably from a name a person gave.
           note: { type: "string", description: "Free-text context recorded on the resolution" },
           url: { type: "string", description: "Absolute http/https URL this resolution happened at" },
           runtime: RUNTIME_PARAM,
@@ -202,11 +207,19 @@ export function createOpApproveTool(): ToolRegistration {
 
       const runtime = await runtimeFor(params.runtime);
       const outcome = await recordGateApproval(name, gate, {
-        actor: params.approver as string | undefined,
         note: params.note as string | undefined,
         url: params.url as string | undefined,
+        // Named rather than left to the ambient value, so this tool states its
+        // own channel even if it is ever registered on a server that did not.
+        origin: "mcp",
       });
-      if (!outcome.ok) throw new Error(`Gate "${gate}" on "${name}" was not recorded`);
+      if (!outcome.ok) {
+        throw new Error(
+          `Gate "${gate}" on "${name}" was not recorded. If the gate was reached over MCP, it cannot ` +
+            `also be resolved over MCP — approve it from another channel, normally ` +
+            `\`chant approve ${name} ${gate}\` at a shell.`,
+        );
+      }
 
       if (runtime.resolveGate) await runtime.resolveGate(name, gate, outcome.record);
 
@@ -214,6 +227,7 @@ export function createOpApproveTool(): ToolRegistration {
         op: name,
         gate,
         resolvedBy: outcome.record.resolvedBy,
+        origin: outcome.record.origin,
         timestamp: outcome.record.timestamp,
         runtimeNotified: Boolean(runtime.resolveGate),
       };

package/src/cli/mcp/server.ts

@@ -9,6 +9,7 @@ import { searchTool, createSearchHandler } from "./tools/search";
 import type { LexiconPlugin } from "../../lexicon";
 import type { McpRequest, McpResponse, McpRequestMeta, ToolDefinition, ToolHandler, ResourceDefinition } from "./types";
 import { createSnapshotTool, createDiffTool } from "./lifecycle-tools";
+import { setGateOrigin } from "../../lifecycle/gate-origin";
 import { createOpListTool, createOpRunTool, createOpStatusTool, createOpApproveTool, createOpReportTool } from "./op-tools";
 import { buildResourcesList, handleResourcesRead } from "./resource-handlers";
 
@@ -302,6 +303,16 @@ export class McpServer {
    * Start the MCP server on stdio
    */
   async start(): Promise<void> {
+    // chant#2384 — declared here rather than in the constructor, because this
+    // is where the PROCESS becomes an MCP server. Constructing the object does
+    // not change what the process is, and a test that builds one should not
+    // silently make every later gate fact in that worker read as model-authored.
+    //
+    // From here on a person's only act was launching this; every call is the
+    // model's. So every gate fact written records the channel it came through,
+    // and a gate reached here cannot also be resolved here.
+    setGateOrigin("mcp");
+
     const rl = createInterface({
       input: process.stdin,
       output: process.stdout,

package/src/cli/registry.ts

@@ -341,6 +341,12 @@ export interface ParsedArgs {
   note?: string;
   /** `chant approve <op> <gate> --expire` (#2119) — clear the gate's standing pending fact instead of approving it, so the next run decides the gate from scratch and records a fresh one. Writes no resolution: nothing is approved, the wait is only restarted. */
   expire?: boolean;
+  /**
+   * `chant approve --allow-same-origin` (chant#2384) — record a resolution
+   * from the same channel that reached the gate, which is refused by default
+   * on a model-authored channel.
+   */
+  allowSameOrigin?: boolean;
   /** `chant approve <op> <gate> --plan <digest>` (#2300) — the plan this approval is for, as `sha256:<64 hex>`. Omitted, the digest is taken from the gate's standing pending fact, which is the plan the run that stopped at the gate actually produced; pass it to approve a plan explicitly, or to approve one before any run has recorded a pending fact. */
   plan?: string;
   /** `chant operator log --op <name>` (#2029) — restrict the tick history to one ConvergeOp by name. Omitted, every discovered ConvergeOp's ticks are merged into one timeline. */

package/src/discovery/fold-counters-public.test.ts

@@ -0,0 +1,67 @@
+import { describe, test, expect, beforeEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  foldProject,
+  foldExecutionCounts,
+  resetFoldExecutionCounts,
+  type FoldExecutionCounts,
+} from "../index";
+
+/**
+ * chant#2446 — F-Obs-Counters, reachable from the public entry.
+ *
+ * Both functions were already exported from `discovery/fold-import`, but the
+ * public entry re-exports that module by name rather than wholesale, so a
+ * consumer importing `@intentius/chant` could not reach them. The
+ * specification's harness reports the three integers per build
+ * (INTENTIUS/typescript-as-data#121) and had to hold the fixture out for that
+ * reason alone.
+ *
+ * This is a gate against the export being dropped, not a test of the counting
+ * itself, which `fold-import.test.ts` already covers. It imports from `../index`
+ * on purpose: importing from the module would still pass with the entry broken,
+ * which is exactly the failure it exists to catch.
+ */
+describe("the fold execution counters are on the public entry (chant#2446)", () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "chant-counters-"));
+    resetFoldExecutionCounts();
+  });
+
+  test("both functions are exported and the snapshot has F-Obs-Counters' three integers", () => {
+    const counts = foldExecutionCounts();
+    expect(Object.keys(counts).sort()).toEqual([
+      "factoryInterpretations",
+      "factoryInvocations",
+      "projectFactoryInvocations",
+    ]);
+    for (const v of Object.values(counts)) expect(typeof v).toBe("number");
+  });
+
+  test("reset zeroes them, which is what makes a per-build figure possible", async () => {
+    const file = join(root, "app.ts");
+    writeFileSync(file, 'export const n = 1 + 1;\n');
+    await foldProject([file], []);
+
+    resetFoldExecutionCounts();
+
+    // The counters are process-wide and monotonic, so "per build" means
+    // zeroing first. A caller that could not reset would read this process's
+    // whole history and call it one build.
+    expect(foldExecutionCounts()).toEqual<FoldExecutionCounts>({
+      factoryInvocations: 0,
+      projectFactoryInvocations: 0,
+      factoryInterpretations: 0,
+    });
+  });
+
+  test("a snapshot is a copy, so a caller cannot move the counters by holding one", () => {
+    const snapshot = foldExecutionCounts() as FoldExecutionCounts;
+    snapshot.factoryInvocations = 9999;
+    expect(foldExecutionCounts().factoryInvocations).not.toBe(9999);
+  });
+});

package/src/discovery/fold-div-depth.test.ts

@@ -0,0 +1,104 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { foldProject } from "../index";
+import type { IntrinsicDef } from "../lexicon";
+
+/**
+ * chant#2441 — `F-Div-Depth` is a refusal, and a refusal must not be
+ * papered over by invoking instead.
+ *
+ * `divergence.md`'s L3.16 says a `new`, tagged template, helper call,
+ * intrinsic call or `.step` is not foldable inside a folded function body.
+ * `fold()` has always guarded this, and the guard fires: `callFoldableFunction`
+ * raises `functionBodyDepth` and `insideFunctionBody` throws.
+ *
+ * What went wrong was downstream. `resolveCallExpression` catches a fold
+ * failure on an imported callee and falls back to importing and invoking it —
+ * right when the body merely did not fold, wrong here, because the folder has
+ * DECLINED and invoking produces the envelope the fixture's own note warns
+ * about: a value the file's own declarators never produced.
+ *
+ * That direction is the whole point. Every other `F-Div` row is a fallback and
+ * `divergence.md` says so outright, which is what makes the direction safe.
+ * This one was not: chant produced a value where the specification says it must
+ * decline, the one outcome the fold path exists never to have.
+ */
+describe("a refusal at depth is not rescued by invoking (chant#2441)", () => {
+  let root: string;
+  const ref: IntrinsicDef = { name: "ref", lexicon: "shapes", foldsAsCall: true } as unknown as IntrinsicDef;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "chant-div-depth-"));
+    const pkg = join(root, "node_modules", "@tsad", "shapes");
+    mkdirSync(pkg, { recursive: true });
+    writeFileSync(
+      join(pkg, "package.json"),
+      JSON.stringify({ name: "@tsad/shapes", version: "0.0.0", type: "module", main: "index.js" }),
+    );
+    writeFileSync(join(pkg, "index.js"), 'export function ref(x) { return { Ref: x }; }\n');
+  });
+
+  afterEach(() => rmSync(root, { recursive: true, force: true }));
+
+  const write = (name: string, source: string): string => {
+    const p = join(root, name);
+    writeFileSync(p, source);
+    return p;
+  };
+
+  test("an intrinsic call inside a project-local function refuses, rather than folding to a revived envelope", async () => {
+    const fn = write("fn.ts", 'import { ref } from "@tsad/shapes";\nexport function r() { return ref("x"); }\n');
+    const app = write("app.ts", 'import { r } from "./fn";\nexport const v = r();\n');
+
+    const verdicts = await foldProject([app, fn], [ref], { lexiconPackages: ["@tsad/shapes"] });
+
+    // Before the fix this was `fold` with v = {"Ref":"x"} — the host's `ref`
+    // actually invoked, its result revived, and the envelope surfacing in a
+    // file whose own declarators never produced one.
+    expect(verdicts.get(app)!.verdict).toBe("run");
+    expect(verdicts.get(app)!.reason).toMatch(/inside a folded function body is not foldable/);
+  });
+
+  test("the reason names the callee and the position inside it, not just the call site", async () => {
+    const fn = write("fn.ts", 'import { ref } from "@tsad/shapes";\nexport function r() { return ref("x"); }\n');
+    const app = write("app.ts", 'import { r } from "./fn";\nexport const v = r();\n');
+
+    const reason = (await foldProject([app, fn], [ref], { lexiconPackages: ["@tsad/shapes"] })).get(app)!.reason!;
+
+    // The point of the re-anchoring in `callFoldableFunction`: the `[fold:run]`
+    // line says which function to fix and where, not merely that this call
+    // failed.
+    expect(reason).toContain('call to "r"');
+    expect(reason).toContain("fn.ts");
+    expect(reason).toContain("intrinsic call `ref(...)`");
+  });
+
+  test("the same intrinsic call at the top level still folds, so the guard is about depth and nothing else", async () => {
+    // The refusal must not spread to the direct case, which is the ordinary way
+    // an intrinsic reaches a declarator and is exactly what should keep working.
+    const app = write("app.ts", 'import { ref } from "@tsad/shapes";\nexport const v = ref("x");\n');
+
+    const verdict = (await foldProject([app], [ref], { lexiconPackages: ["@tsad/shapes"] })).get(app)!;
+
+    expect(verdict.verdict).toBe("fold");
+    expect(JSON.parse(JSON.stringify(Object.fromEntries(verdict.exports!)))).toEqual({ v: { Ref: "x" } });
+  });
+
+  test("an ordinary fold failure in an imported callee still falls back to invoking it", async () => {
+    // The fallback that #2441 narrowed is otherwise load-bearing: a helper whose
+    // body simply does not fold keeps folding by invocation, as it did before.
+    // Narrowing it to depth refusals only is the whole of the change.
+    const fn = write(
+      "fn.ts",
+      'export function r() {\n  const parts = ["a", "b"];\n  return { joined: parts.join("-") };\n}\n',
+    );
+    const app = write("app.ts", 'import { r } from "./fn";\nexport const v = r();\n');
+
+    const verdict = (await foldProject([app, fn], [], {})).get(app)!;
+
+    expect(verdict.verdict).toBe("fold");
+    expect(JSON.parse(JSON.stringify(Object.fromEntries(verdict.exports!)))).toEqual({ v: { joined: "a-b" } });
+  });
+});

package/src/discovery/fold-executing-mode.test.ts

@@ -0,0 +1,115 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { foldProject, foldExecutionCounts, resetFoldExecutionCounts } from "../index";
+
+/**
+ * chant#2455 — `ι = executing`, the third isolation mode (spec `1.8`).
+ *
+ * chant#2453 made the default strict: a declarator call to a declared project
+ * function whose body cannot fold refuses the file rather than importing and
+ * invoking it. That closed a real leak — the fold of a file reading
+ * `process.env` carried the folding shell's environment, under a `fold`
+ * verdict that read as "determined statically".
+ *
+ * The old behaviour is worth having when the caller means it, so it comes back
+ * as a mode. What it cannot be is implicit. `open` is the default and is
+ * strict; a build that wants what a run would compute has to ask, and the
+ * asking is what makes the environment dependence visible.
+ */
+describe("the executing isolation mode (chant#2455)", () => {
+  let root: string;
+  let app: string;
+  let params: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "chant-executing-"));
+    params = join(root, "params.ts");
+    app = join(root, "app.ts");
+    writeFileSync(
+      params,
+      'export function fromEnv() {\n  return { prefix: process.env.CHANT_TEST_MODE ?? "fallback" };\n}\n',
+    );
+    writeFileSync(app, 'import { fromEnv } from "./params";\nexport const v = fromEnv();\n');
+    resetFoldExecutionCounts();
+    process.env.CHANT_TEST_MODE = "from-the-environment";
+  });
+
+  afterEach(() => {
+    delete process.env.CHANT_TEST_MODE;
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  test("the default refuses, and nothing of the project runs", async () => {
+    const verdict = (await foldProject([app, params], [], {})).get(app)!;
+
+    expect(verdict.verdict).toBe("run");
+    expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+  });
+
+  test("executing invokes it, and the fold carries what a run would compute", async () => {
+    const verdict = (await foldProject([app, params], [], { executing: true })).get(app)!;
+
+    expect(verdict.verdict).toBe("fold");
+    expect(JSON.parse(JSON.stringify(Object.fromEntries(verdict.exports!)))).toEqual({
+      v: { prefix: "from-the-environment" },
+    });
+    // The counter is how the mode is observable from outside: this is a
+    // project-owned invocation, which is what F-Call step 6 counts.
+    expect(foldExecutionCounts().projectFactoryInvocations).toBe(1);
+  });
+
+  test("the environment dependence is real, which is why the mode has to be asked for", async () => {
+    process.env.CHANT_TEST_MODE = "one";
+    const first = (await foldProject([app, params], [], { executing: true })).get(app)!;
+    process.env.CHANT_TEST_MODE = "two";
+    const second = (await foldProject([app, params], [], { executing: true })).get(app)!;
+
+    // Under `executing` the same source folds to different values in different
+    // environments. That is the mode behaving as specified, not a defect — and
+    // it is exactly what must not happen by default.
+    expect(JSON.stringify([...first.exports!])).not.toBe(JSON.stringify([...second.exports!]));
+  });
+
+  test("sandbox still refuses, and is unchanged by the new mode", async () => {
+    const verdict = (await foldProject([app, params], [], { sandbox: true })).get(app)!;
+
+    expect(verdict.verdict).toBe("run");
+    expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+  });
+
+  test("asking for both sandbox and executing is refused rather than resolved", async () => {
+    // Not a preference between two readings — a contradiction. One refuses to
+    // import project code, the other exists to invoke it, and silently picking
+    // either would make the fold's meaning depend on which.
+    await expect(foldProject([app, params], [], { sandbox: true, executing: true })).rejects.toThrow(
+      /mutually exclusive/,
+    );
+  });
+
+  test("the default's reason names the mode that would have folded it", async () => {
+    const reason = (await foldProject([app, params], [], {})).get(app)!.reason!;
+
+    // The body's own diagnostic is kept — it is the actionable half, and here
+    // it says to use a build parameter rather than reach for the new mode.
+    expect(reason).toContain('ambient "process" read is not foldable');
+    expect(reason).toContain("executing");
+  });
+
+  test("a function whose body folds is untouched by the mode", async () => {
+    const helper = join(root, "helper.ts");
+    writeFileSync(helper, 'export function j() {\n  return { j: ["a", "b"].join("-") };\n}\n');
+    const caller = join(root, "caller.ts");
+    writeFileSync(caller, 'import { j } from "./helper";\nexport const v = j();\n');
+
+    for (const options of [{}, { executing: true }]) {
+      resetFoldExecutionCounts();
+      const verdict = (await foldProject([caller, helper], [], options)).get(caller)!;
+      expect(verdict.verdict).toBe("fold");
+      // Interpreted in both modes: `executing` is a fallback for a body that
+      // did NOT fold, not a shortcut past interpretation.
+      expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+    }
+  });
+});

package/src/discovery/fold-import.ts

@@ -261,6 +261,8 @@ export interface FoldSession {
    * only the fold half would buy nothing there.
    */
   readonly sandbox: boolean;
+  /** chant#2455 — `ι = executing`: invoke a declared project function whose body did not fold. */
+  readonly executing: boolean;
   /**
    * chant #1023 — per-build memo for {@link readFactoryModule}, keyed by the
    * resolved absolute path of a module that DEFINES a composite. A composite
@@ -322,6 +324,8 @@ export function createFoldSession(
    * named as a specifier rather than only as a lexicon.
    */
   lexiconPackages: readonly string[] = [],
+  /** chant#2455 — `ι = executing`. Mutually exclusive with `sandbox`. */
+  executing = false,
 ): FoldSession {
   return {
     intrinsics,
@@ -332,6 +336,7 @@ export function createFoldSession(
     buildParams,
     lexiconPackages: new Set([...lexicons.map(lexiconPackageName), ...lexiconPackages]),
     sandbox,
+    executing,
     factoryModules: new Map(),
   };
 }
@@ -1275,6 +1280,8 @@ interface ResolveCtx {
   lexiconPackages: ReadonlySet<string>;
   /** chant #1093 — see {@link FoldSession.sandbox}. */
   sandbox: boolean;
+  /** chant#2455 — see {@link FoldSession.executing}. */
+  executing: boolean;
   /**
    * chant #1023 — the whole build session, for the two things composite-factory
    * interpretation needs that a per-file context cannot carry: the
@@ -1458,14 +1465,57 @@ async function resolveCallExpression(node: ts.CallExpression, ctx: ResolveCtx):
       if (!(err instanceof Error)) throw err;
       foldFailure = err;
     }
-    if (!binding) throw foldFailure;
-    try {
-      return await resolveImportedCall(node, calleeName, binding, ctx);
-    } catch (err) {
+    // chant#2453 — a DECLARED function is judged by its body, and that is the
+    // whole answer. There is no invocation arm here any more.
+    //
+    // There used to be: when the body did not fold, an imported callee was
+    // imported and invoked instead. chant#2441 narrowed that to stop it
+    // rescuing a depth refusal. The external corpus then showed what the rest
+    // of it does, in a project nobody here maintains
+    // (jhgaylor/infisical-chant, INTENTIUS/typescript-as-data#129):
+    //
+    //     export const namingParams = namingParamsFromEnv();
+    //
+    // whose body reads `process.env`. `F-Eval-Ident` step 4 rejects `process`,
+    // so the body does not fold — and chant imported the module and ran it,
+    // folding the file to whatever the FOLDING PROCESS's environment held. The
+    // file reported `fold`, which reads as "determined statically". Two people
+    // folding the same source got different output and nothing said so.
+    //
+    // That is wrong in chant's own terms before it is wrong in J1's: `--fold`
+    // is the value you would get by running, WITHOUT running, and this ran. So
+    // the rejection propagates and the file runs, carrying the reason
+    // `F-Eval-CallLocal` gives.
+    //
+    // `F-Call` step 6's invocation is for a binding that is neither a declared
+    // function nor an interpretable composite, and it still happens — below,
+    // in the arm this one is not. A composite factory is not a
+    // `FoldableFunction`, so `resolveImportedCall` still interprets it and
+    // still invokes it when interpretation declines.
+    //
+    // chant#2455 — unless the caller asked for `ι = executing` (spec 1.8),
+    // which is this behaviour as a MODE rather than as a silent default. The
+    // value is then what a run would compute in this process, environment and
+    // all, which is exactly why it cannot be implicit.
+    if (ctx.executing && binding) {
+      try {
+        return await resolveImportedCall(node, calleeName, binding, ctx);
+      } catch (err) {
+        throw cheapError(
+          `${foldFailure.message}; invoking it instead failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+    }
+    // Name the mode that would have folded it, so the reason is actionable
+    // rather than only correct. Not under `sandbox`, where `executing` is not
+    // an option the caller could take.
+    if (binding && !ctx.sandbox) {
       throw cheapError(
-        `${foldFailure.message}; invoking it instead failed: ${err instanceof Error ? err.message : String(err)}`,
+        `${foldFailure.message} (the default mode does not invoke a declared project function; ` +
+          "`executing` would run it and fold what it returns)",
       );
     }
+    throw foldFailure;
   }
 
   if (!binding) {
@@ -2346,6 +2396,7 @@ async function interpretCompositeFactory(
     resolvePathCache: ctx.resolvePathCache,
     lexiconPackages: ctx.lexiconPackages,
     sandbox: ctx.sandbox,
+    executing: ctx.executing,
     session: ctx.session,
     interpretDepth: ctx.interpretDepth + 1,
     // chant #2161 — set unconditionally, and NOT inherited from `ctx`: a nested
@@ -3658,6 +3709,7 @@ async function tryFoldFileCore(file: string, session: FoldSession): Promise<Fold
       resolvePathCache: session.resolvePathCache,
       lexiconPackages: session.lexiconPackages,
       sandbox: session.sandbox,
+      executing: session.executing,
       session,
       interpretDepth: 0,
       // chant#2423 — filled by the pre-build below, read by
@@ -4092,6 +4144,25 @@ export interface FoldProjectOptions {
   readonly buildParams?: Readonly<Record<string, BuildParamValue>>;
   /** chant #1093: this build asked for the sandbox, so fold may not reach outside the trusted allowlist. */
   readonly sandbox?: boolean;
+  /**
+   * chant#2455 — opt in to `ι = executing`, the third isolation mode
+   * (typescript-as-data spec `1.8`).
+   *
+   * Under it, a declarator call to a declared project function whose body
+   * cannot fold continues at `F-Call` step 6 and is invoked, so the fold's
+   * value is what a run would compute **in the folding process's
+   * environment**. That is the behaviour chant had before #2453, where it was
+   * the silent default and leaked the folding shell's `process.env` into the
+   * output of a file reported as `fold`.
+   *
+   * It is here as a mode rather than gone, because the value is real when the
+   * caller means it. What it cannot be is implicit: `open` is the default and
+   * is strict, so a build that wants a run's answer has to say so.
+   *
+   * Mutually exclusive with {@link sandbox}, which refuses to import project
+   * code at all. Asking for both is a contradiction and refuses.
+   */
+  readonly executing?: boolean;
   /**
    * chant#2438 — package specifiers to follow a bare import into, verbatim,
    * alongside whatever `lexicons` names.
@@ -4148,12 +4219,24 @@ export async function foldProject(
   intrinsics: readonly IntrinsicDef[] = [],
   options: FoldProjectOptions = {},
 ): Promise<Map<string, FoldProjectVerdict>> {
+  // chant#2455 — `sandbox` refuses to import project code at all and
+  // `executing` exists to invoke it. Asking for both is not a preference
+  // between two readings, it is a contradiction, and silently picking one would
+  // make the fold's meaning depend on which.
+  if (options.sandbox === true && options.executing === true) {
+    throw new Error(
+      "foldProject: `sandbox` and `executing` are mutually exclusive — the first refuses to import " +
+        "project code and the second exists to invoke it. Pass one.",
+    );
+  }
+
   const session = createFoldSession(
     intrinsics,
     options.buildParams,
     options.lexicons ?? [],
     options.sandbox ?? false,
     options.lexiconPackages ?? [],
+    options.executing ?? false,
   );
   const attempts = new Map<string, FoldFileResult>();
   for (const file of files) attempts.set(file, await tryFoldFile(file, intrinsics, session));