@intentius/chant 0.91.0 → 0.93.0

package/src/cli/registry.ts

@@ -303,13 +303,23 @@ export interface ParsedArgs {
   composites?: boolean;
   /** `chant workspace graph --intent <path[:start-end]>` (#2651): the region the intent graph is over. */
   intent?: string;
+  /** `chant workspace check --changes <base>..<head>` (#2773): the diff the forward coverage check maps to records. */
+  changes?: string;
+  /** `chant workspace check --changes ... --severity off|warn|fail` (#2773): in place of the declaration's `changes.severity`. */
+  severity?: string;
   /** `chant workspace records --current` (#2546): leave out records a closed record supersedes. */
   current?: boolean;
   /** `chant workspace records amend <id> --set <file|->` (#2670): the JSON fields to set. */
   set?: string;
   /** `chant workspace records review <id> --verdict <v>` (#2670): agree, dissent or abstain. */
   verdict?: string;
-  /** `chant workspace records review <id> --by <principal>` (#2670): the reviewer, as the caller names them. */
+  /**
+   * `chant workspace records review <id> --by <principal>` (#2670): the
+   * reviewer, as the caller names them. Also `chant workspace records new
+   * --by <name>` (#2756): the record's proposer, or its decider when it
+   * opens straight into a later state; see {@link ChannelOptions.by} in
+   * `records-write.ts`.
+   */
   by?: string;
   /**
    * `chant workspace records review <id> --sign [<key file>]` (#2687): the key that seals the verdict, or true for git's user.signingkey.
@@ -436,7 +446,7 @@ export interface ParsedArgs {
   steward?: string;
   /** `chant workspace work claim|renew|release <id> --holder <name>` (#2732): who holds, or releases, the work lease. */
   holder?: string;
-  /** `chant run <op> --work <id>` (#2748): the work item an Op with a work lease runs under. */
+  /** `chant run <op> --work <id>` (#2748): the work item an Op with a work lease runs under. `chant workspace check --changes --work <id>` (#2773): the work item in hand. */
   work?: string;
   /** `chant workspace work claim|renew <id> --ttl <seconds|duration>` (#2732): how long the lease lasts unless renewed. */
   ttl?: string;

package/src/codegen/pinned-upgrade.ts

@@ -26,6 +26,7 @@ import { join } from "path";
 import { regenLexicon, type RegenResult } from "./lexicon-regen";
 import { fetchWithRetry } from "./fetch";
 import { isLexiconPlugin, type UpstreamPin } from "../lexicon";
+import { importLexiconPackage } from "../lexicon-module";
 
 // ── Public types ──────────────────────────────────────────────────────
 
@@ -200,7 +201,7 @@ export function revertVersionBump(filePath: string, original: string): void {
 export async function loadUpstreamPin(lexicon: LexiconId): Promise<UpstreamPin | null> {
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(`@intentius/chant-lexicon-${lexicon}`)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(`@intentius/chant-lexicon-${lexicon}`)) as Record<string, unknown>;
   } catch {
     return null;
   }

package/src/codegen/release-wiring.test.ts

@@ -171,7 +171,54 @@ describe("release wiring: preflight gates both recipes (#1255)", () => {
     }
   });
 
-  it("the whole-repo release requires main, since it pushes main", () => {
-    expect(recipeBody("release")).toMatch(/release-preflight\.sh main/);
+});
+
+/**
+ * #2816 — main's HEAD is rarely green, so a release tags the newest green
+ * commit on main (or the one named) and merges the bump back into main.
+ * scripts/release-preflight.test.ts runs the mechanics; this pins the wiring.
+ */
+describe("release wiring: release the newest green commit (#2816)", () => {
+  it("both recipes tag the commit the preflight chose, not HEAD", () => {
+    for (const recipe of ["release", "release-lexicon"]) {
+      const body = recipeBody(recipe);
+      expect(body).toMatch(/sha=\$\(bash scripts\/release-preflight\.sh/);
+      expect(body).toMatch(/release_open "\$sha"/);
+    }
+  });
+
+  it("both recipes merge the tag back into main instead of pushing HEAD", () => {
+    for (const recipe of ["release", "release-lexicon"]) {
+      const body = recipeBody(recipe);
+      expect(body).toMatch(/release_ship "\$tag"/);
+      expect(body).not.toMatch(/git push/);
+      expect(body.indexOf("git tag")).toBeLessThan(body.indexOf("release_ship"));
+    }
+    const lib = readFileSync(join(repoRoot, "scripts", "release-lib.sh"), "utf-8");
+    // main and the tag land together or not at all, and nothing is forced.
+    expect(lib).toMatch(/git push --quiet --atomic origin "HEAD:refs\/heads\/main" "refs\/tags\/\$tag"/);
+    expect(lib).not.toMatch(/git push[^\n]*(--force|\s-f\b)/);
+  });
+
+  it("both recipes offer a dry run that stops before committing", () => {
+    for (const recipe of ["release", "release-lexicon"]) {
+      const body = recipeBody(recipe);
+      expect(body.indexOf("RELEASE_DRY_RUN")).toBeGreaterThan(-1);
+      expect(body.indexOf("RELEASE_DRY_RUN")).toBeLessThan(body.indexOf("git commit"));
+    }
+  });
+
+  it("the whole-repo floor reads main as well as the green commit", () => {
+    expect(recipeBody("release")).toMatch(/release_version_at "\$RELEASE_MAIN"/);
+    expect(recipeBody("release-lexicon")).toMatch(/release_version_at "\$RELEASE_MAIN"/);
+  });
+
+  it("a push to main does not cancel main's chant run; PR runs still cancel", () => {
+    const workflow = readFileSync(join(repoRoot, ".github", "workflows", "chant.yml"), "utf-8");
+    const block = workflow.match(/^concurrency:\n((?:[ ]+.*\n)+)/m)?.[1] ?? "";
+    // One group per commit on main, so a later push neither cancels a running
+    // run nor replaces a queued one.
+    expect(block).toMatch(/group:.*github\.ref == 'refs\/heads\/main' && github\.sha \|\| github\.ref/);
+    expect(block).toMatch(/cancel-in-progress: \$\{\{ github\.ref != 'refs\/heads\/main' \}\}/);
   });
 });

package/src/components/capability-plugin-loader.ts

@@ -22,7 +22,7 @@
  */
 
 import { CapabilityRegistry } from "./capability";
-import { lexiconModulePath } from "../lexicon-module";
+import { lexiconModulePath, importLexiconPackage } from "../lexicon-module";
 import type { CapabilityPlugin } from "./capability-plugin";
 import { isCapabilityPlugin } from "./capability-plugin";
 import { starterCapabilityPlugin } from "./starter-plugin";
@@ -62,7 +62,7 @@ export async function loadCapabilityPlugin(name: string): Promise<CapabilityPlug
   const packageName = `@intentius/chant-capability-${name}`;
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(packageName)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(packageName)) as Record<string, unknown>;
   } catch (err) {
     throw new Error(
       `capability plugin package "${packageName}" could not be loaded: ${err instanceof Error ? err.message : String(err)}`,
@@ -118,7 +118,7 @@ export async function loadCapabilityPluginFromLexicon(name: string): Promise<Cap
   const packageName = lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`;
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(packageName)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(packageName)) as Record<string, unknown>;
   } catch {
     return null; // lexicon not installed / not resolvable here — nothing to contribute.
   }

package/src/components/cli-support.ts

@@ -22,7 +22,7 @@
  *    executor, the CLI entrypoint the driver (#556) never had.
  */
 
-import { lexiconModulePath, lexiconNames } from "../lexicon-module";
+import { lexiconModulePath, lexiconNames, importLexiconPackage } from "../lexicon-module";
 import { discoverComponents } from "./discover";
 import type { BuildParamProvenance } from "../provenance";
 import { inferArchetype, projectToJson, type Archetype } from "./component";
@@ -244,7 +244,7 @@ export interface GenerateComponentsResult {
 async function loadLexiconPlugin(name: string): Promise<LexiconPlugin | null> {
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`)) as Record<string, unknown>;
   } catch {
     return null;
   }

package/src/config.ts

@@ -11,6 +11,7 @@ import type { BuildParamProvenance } from "./provenance";
 import { findProjectConfig } from "./project-root";
 import { evaluateProjectConfig } from "./config-sandbox";
 import { lexiconNames, pathLexiconRoot, registerLexiconDeclarations, type LexiconDeclaration } from "./lexicon-module";
+import { decideConfigSchema, type DecideConfig } from "./op/decide-config";
 
 /**
  * One project-declared environment (chant #1166). Historically always a bare
@@ -194,6 +195,7 @@ export const ChantConfigSchema = z.object({
   knowledge: z.object({
     dir: z.string().min(1).optional(),
   }).optional(),
+  decide: decideConfigSchema.optional(),
   exclude: z.array(z.string().min(1)).optional(),
   include: z.array(z.string().min(1)).optional(),
   rootOnly: z.boolean().optional(),
@@ -449,6 +451,15 @@ export interface ChantConfig {
     dir?: string;
   };
 
+  /**
+   * The backends the `decide` Op activity calls (#2828): backend name, as a
+   * decision point's model decider names it, to `{ url, key?, timeoutMs? }`.
+   * A key is `{ env }` or a brokered capability, never a literal (SYS001). A
+   * `decide` step's own `backends` take the place of these. See
+   * `./op/decide-config.ts`.
+   */
+  decide?: DecideConfig;
+
   /**
    * Globs, relative to the directory holding this config, naming files that
    * source discovery must skip (#2519): `build`, `lint`, `list`, `explain`

package/src/lexicon-module.ts

@@ -24,7 +24,9 @@
  * a project that names lexicons by package takes exactly the path it always did.
  */
 
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
 
 /**
  * One `lexicons` entry: a package-backed name, or a name plus the module that
@@ -213,3 +215,56 @@ export function lexiconPackagesToInstall(
 ): string[] {
   return names.filter((name) => !paths.has(name)).map((name) => `@intentius/chant-lexicon-${name}`);
 }
+
+/**
+ * chant#2845 — the npm package a bare specifier names: `@scope/name` for a
+ * scoped one, else its first segment. `undefined` for a relative or absolute
+ * path, which is not a package.
+ */
+export function packageNameOf(spec: string): string | undefined {
+  if (spec.startsWith(".") || isAbsolute(spec) || spec.startsWith("file:")) return undefined;
+  const parts = spec.split("/");
+  return spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
+
+/** True when `err` says the package `pkg` itself could not be found, not something it imports. */
+function isPackageNotFound(err: unknown, pkg: string): boolean {
+  const code = (err as { code?: unknown } | null)?.code;
+  if (code !== "ERR_MODULE_NOT_FOUND" && code !== "MODULE_NOT_FOUND") return false;
+  const message = err instanceof Error ? err.message : String(err);
+  return message.includes(`'${pkg}'`) || message.includes(`"${pkg}"`) || message.includes(`${pkg}/`);
+}
+
+/**
+ * chant#2845 — resolve `spec` (a lexicon package or one of its subpaths) from
+ * `fromDir` instead of from chant's own install, or `undefined` when the
+ * project doesn't have it either.
+ */
+export function resolveFromProject(spec: string, fromDir: string = process.cwd()): string | undefined {
+  try {
+    return createRequire(join(fromDir, "package.json")).resolve(spec);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * chant#2845 — import a lexicon package, or one of its subpaths, by its bare
+ * specifier. chant's own install is tried first, as a bare `import()` always
+ * did, so a lexicon chant can reach loads exactly as before. When the package
+ * isn't there, which is the case for a chant installed globally and a project
+ * that installs its lexicons in its own node_modules, it is resolved from
+ * `fromDir` (the project) and imported from there. Any other failure, and a
+ * package the project doesn't have either, rethrows the first error.
+ */
+export async function importLexiconPackage(spec: string, fromDir: string = process.cwd()): Promise<Record<string, unknown>> {
+  try {
+    return (await import(spec)) as Record<string, unknown>;
+  } catch (err) {
+    const pkg = packageNameOf(spec);
+    if (pkg === undefined || !isPackageNotFound(err, pkg)) throw err;
+    const resolved = resolveFromProject(spec, fromDir);
+    if (resolved === undefined) throw err;
+    return (await import(pathToFileURL(resolved).href)) as Record<string, unknown>;
+  }
+}

package/src/lexicon-package.test.ts

@@ -0,0 +1,96 @@
+/**
+ * chant#2845 — a lexicon the project installs in its own node_modules loads
+ * when chant's own install can't reach it (a global chant): the plugin, its
+ * op activities and its activity contracts, resolved from the working
+ * directory after the bare import from chant's location fails.
+ */
+import { describe, test, expect, beforeAll, afterAll } from "vitest";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { importLexiconPackage, packageNameOf, resolveFromProject } from "./lexicon-module";
+import { loadActivities } from "./op/activity-registry";
+import { loadActivityContracts } from "./op/activity-contract-registry";
+import { resolveLexiconVersions } from "./cli/plugins";
+
+const NAME = "zz2845";
+const PKG = `@intentius/chant-lexicon-${NAME}`;
+let project: string;
+
+beforeAll(async () => {
+  project = await mkdtemp(join(tmpdir(), "chant-2845-"));
+  const dir = join(project, "node_modules", "@intentius", `chant-lexicon-${NAME}`);
+  await mkdir(join(dir, "op"), { recursive: true });
+  await writeFile(
+    join(dir, "package.json"),
+    JSON.stringify({
+      name: PKG,
+      version: "9.9.9",
+      type: "module",
+      exports: { ".": { default: "./index.js" }, "./op/activities": { default: "./op/activities.js" }, "./op/activity-contracts": { default: "./op/contracts.js" } },
+    }),
+  );
+  await writeFile(join(dir, "index.js"), "export const marker = 'plugin';\n");
+  await writeFile(join(dir, "op", "activities.js"), "export async function zz2845Probe() { return { ok: true }; }\n");
+  // A contract is branded with a global symbol, so a plain object built here is one.
+  await writeFile(
+    join(dir, "op", "contracts.js"),
+    "export const zz2845ProbeContract = { [Symbol.for('chant.op.activityContract')]: true, name: 'zz2845Probe', args: {}, returns: {} };\n",
+  );
+});
+
+afterAll(async () => {
+  await rm(project, { recursive: true, force: true });
+});
+
+describe("importLexiconPackage (#2845)", () => {
+  test("a package chant can't reach is imported from the project", async () => {
+    await expect(import(PKG)).rejects.toThrow();
+    const mod = await importLexiconPackage(PKG, project);
+    expect(mod.marker).toBe("plugin");
+    const op = await importLexiconPackage(`${PKG}/op/activities`, project);
+    expect(typeof op.zz2845Probe).toBe("function");
+  });
+
+  test("a package chant reaches loads from chant's install, whatever the directory", async () => {
+    const mod = await importLexiconPackage("zod", project);
+    expect(typeof mod.z).toBe("object");
+  });
+
+  test("a package neither has fails with the bare import's own error", async () => {
+    await expect(importLexiconPackage("@intentius/chant-lexicon-nope-2845", project)).rejects.toThrow(/chant-lexicon-nope-2845/);
+  });
+
+  test("a path is not looked up in the project", () => {
+    expect(packageNameOf("/abs/lexicon.ts")).toBeUndefined();
+    expect(packageNameOf("./lexicon.ts")).toBeUndefined();
+    expect(packageNameOf(`${PKG}/op/activities`)).toBe(PKG);
+    expect(resolveFromProject(PKG, project)).toMatch(/index\.js$/);
+  });
+});
+
+describe("the loaders take the project's lexicon (#2845)", () => {
+  const inProject = async <T>(fn: () => Promise<T> | T): Promise<T> => {
+    const cwd = process.cwd();
+    process.chdir(project);
+    try {
+      return await fn();
+    } finally {
+      process.chdir(cwd);
+    }
+  };
+
+  test("loadActivities finds its op activities", async () => {
+    const activities = await inProject(() => loadActivities([NAME]));
+    expect(activities.has("zz2845Probe")).toBe(true);
+  });
+
+  test("loadActivityContracts finds its contracts", async () => {
+    const contracts = await inProject(() => loadActivityContracts([NAME]));
+    expect(contracts.has("zz2845Probe")).toBe(true);
+  });
+
+  test("resolveLexiconVersions reads its version", async () => {
+    expect(await inProject(() => resolveLexiconVersions([NAME]))).toEqual({ [NAME]: "9.9.9" });
+  });
+});

package/src/lifecycle/converge-ledger.ts

@@ -66,6 +66,12 @@ export interface ConvergeRuleOutcome {
   action: "ran" | "reported" | "skipped-budget" | "skipped-flap" | "gated";
   /** The dispatched Op name, for `action: "ran"` or `"gated"`. */
   op?: string;
+  /**
+   * The resource the rule fired for, on a tick of a ConvergeOp with an
+   * observer step (#2778), which evaluates its rules once per resource. The
+   * dispatched Op reads it from `CHANT_CONVERGE_RESOURCE`.
+   */
+  resource?: string;
   /** The gate's signal name, for `action: "gated"`. */
   gateName?: string;
   /**
@@ -131,6 +137,14 @@ export function componentVerdicts(rows: readonly ComponentStatusRow[]): Converge
   }));
 }
 
+/** One resource an observer step reported on a tick (#2778). */
+export interface ConvergeResourceVerdict {
+  name: string;
+  status: "in-sync" | "drifted" | "unknown";
+  /** The observer's reason, capped to one line. */
+  detail?: string;
+}
+
 /** One immutable converge-tick record. */
 export interface ConvergeTickRecord {
   /** Schema version, so an incompatible future shape is detected before being misread. */
@@ -168,6 +182,12 @@ export interface ConvergeTickRecord {
    * records written before #2027 have none; absent is not "no components".
    */
   components?: ConvergeComponentVerdict[];
+  /**
+   * What a ConvergeOp's observer step reported this tick (#2778), one entry
+   * per resource: in its place of `components` for resources no lexicon
+   * observes. Absent on a tick observed through a lexicon environment.
+   */
+  resources?: ConvergeResourceVerdict[];
   /** Aggregate counts backing the tick's one log line. */
   summary: {
     drifted: number;

package/src/lifecycle/run-ledger.ts

@@ -85,6 +85,8 @@ export function buildRunRecord(
     status: OpRunRecord["status"];
     id?: string;
     gate?: OpRunRecord["gate"];
+    point?: OpRunRecord["point"];
+    steward?: string;
   },
 ): OpRunRecordInput {
   const phases: OpRunPhaseRecord[] = [];
@@ -106,6 +108,8 @@ export function buildRunRecord(
       ...(record.approval ? { approval: record.approval } : {}),
       ...(record.error !== undefined ? { error: record.error } : {}),
       ...(record.refusal !== undefined ? { refusal: record.refusal } : {}),
+      ...(record.point ? { point: record.point } : {}),
+      ...(record.gate ? { gate: record.gate } : {}),
     });
     if (record.outcome) outcomes[record.outcome.name] = record.outcome.value;
   }
@@ -122,6 +126,8 @@ export function buildRunRecord(
     outcomes,
     phases,
     ...(times.gate ? { gate: times.gate } : {}),
+    ...(times.point ? { point: times.point } : {}),
+    ...(times.steward ? { steward: times.steward } : {}),
   };
 }
 

package/src/lifecycle/symptoms.ts

@@ -124,3 +124,98 @@ export const CONVERGE_SYMPTOM_FIELDS: ReadonlySet<string> = new Set([
   "unobservedReasons",
   "totalCount",
 ]);
+
+// ── Resources an observer step reports (#2778) ──────────────────────────────
+
+/**
+ * One resource's verdict, as an observer step reports it: `in-sync` when it
+ * is what its declaration says, `drifted` when it isn't, and `unknown` when
+ * the observer could not tell.
+ */
+export type ResourceStatus = "in-sync" | "drifted" | "unknown";
+
+/** One resource an observer step looked at. */
+export interface ObservedResource {
+  name: string;
+  status: ResourceStatus;
+  /** Why the observer gave that verdict, in one line. */
+  detail?: string;
+}
+
+/**
+ * What a `ConvergeOp`'s observer step returns (#2778), for resources no
+ * lexicon declares or observes: the processes a supervisor runs in a box,
+ * for example. `ConvergeOp({ observe })` evaluates its rules once per
+ * resource, against a {@link ResourceSymptom}.
+ */
+export interface ResourceObservation {
+  resources: ObservedResource[];
+}
+
+/**
+ * The record a `ConvergeOp` with an observer step evaluates each rule
+ * against, once per observed resource (#2778). A rule reads `status` (and
+ * may read `resource` to single one out); a `run()` it fires is dispatched
+ * for that resource, which the dispatched Op reads from
+ * `CHANT_CONVERGE_RESOURCE`.
+ */
+export interface ResourceSymptom {
+  env: string;
+  /** The resource's name, as the observer reported it. */
+  resource: string;
+  status: ResourceStatus;
+  /** The observer's one-line reason, or "". */
+  detail: string;
+}
+
+/**
+ * The environment variable a dispatched Op reads the resource from, when a
+ * ConvergeOp with an observer step fired its rule for one resource (#2778).
+ */
+export const CONVERGE_RESOURCE_ENV = "CHANT_CONVERGE_RESOURCE";
+
+/** Every field a {@link ResourceSymptom} produces: OPS014's whitelist for a ConvergeOp with an observer step. */
+export const RESOURCE_SYMPTOM_FIELDS: ReadonlySet<string> = new Set(["env", "resource", "status", "detail"]);
+
+const RESOURCE_STATUSES: ReadonlySet<string> = new Set(["in-sync", "drifted", "unknown"]);
+
+/**
+ * Read an observer step's result as a {@link ResourceObservation}. The
+ * result is the observation itself, or a `shell()` step's result whose
+ * stdout is the observation as JSON. Throws, naming what is wrong, on
+ * anything else: a tick must not converge from a reading it can't parse.
+ */
+export function parseResourceObservation(value: unknown): ResourceObservation {
+  let candidate: unknown = value;
+  if (candidate && typeof candidate === "object" && !("resources" in candidate) && typeof (candidate as { stdout?: unknown }).stdout === "string") {
+    const stdout = (candidate as { stdout: string }).stdout;
+    try {
+      candidate = JSON.parse(stdout);
+    } catch {
+      throw new Error(`the observer step's stdout is not JSON: ${stdout.slice(0, 120)}`);
+    }
+  }
+  const resources = (candidate as { resources?: unknown } | null)?.resources;
+  if (!Array.isArray(resources)) {
+    throw new Error("the observer step returned no `resources` array: it must return { resources: [{ name, status }] }, or print it as JSON");
+  }
+  const seen = new Set<string>();
+  const out: ObservedResource[] = [];
+  for (const [i, r] of resources.entries()) {
+    const entry = r as { name?: unknown; status?: unknown; detail?: unknown } | null;
+    if (!entry || typeof entry.name !== "string" || entry.name === "") {
+      throw new Error(`the observer step's resources[${i}] has no name`);
+    }
+    if (typeof entry.status !== "string" || !RESOURCE_STATUSES.has(entry.status)) {
+      throw new Error(`the observer step's resource "${entry.name}" has status ${JSON.stringify(entry.status)}: it must be in-sync, drifted or unknown`);
+    }
+    if (seen.has(entry.name)) throw new Error(`the observer step reported resource "${entry.name}" twice`);
+    seen.add(entry.name);
+    out.push({
+      name: entry.name,
+      status: entry.status as ResourceStatus,
+      ...(typeof entry.detail === "string" && entry.detail !== "" ? { detail: entry.detail } : {}),
+    });
+  }
+  return { resources: out };
+}

package/src/lint/rules/index.ts

@@ -1,5 +1,6 @@
 /**
- * Core lint rules for chant projects (COR + EVL).
+ * Core lint rules for chant projects (COR + EVL, and SYS001 for the `decide`
+ * activity's backends, #2828).
  */
 
 import type { LintRule } from "../rule";
@@ -29,6 +30,7 @@ export { cor018CompositePreferLexiconTypeRule } from "./cor018-composite-prefer-
 export { cor021EnvLiteralNameRule } from "./cor021-env-literal-name";
 export { cor022ReceiptLeafRule, collectReceiptVariables, receiptFactoryCall } from "./cor022-receipt-leaf";
 export { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer";
+export { noLiteralKeyRule } from "./sys001-no-literal-key";
 export { isInsideCompositeFactory } from "./composite-scope";
 
 import { flatDeclarationsRule } from "./flat-declarations";
@@ -56,9 +58,10 @@ import { cor018CompositePreferLexiconTypeRule } from "./cor018-composite-prefer-
 import { cor021EnvLiteralNameRule } from "./cor021-env-literal-name";
 import { cor022ReceiptLeafRule } from "./cor022-receipt-leaf";
 import { cor024ReceiptSecretPointerRule } from "./cor024-receipt-secret-pointer";
+import { noLiteralKeyRule } from "./sys001-no-literal-key";
 
 /**
- * Load all 24 core lint rules (COR + EVL).
+ * Load all core lint rules (COR + EVL + SYS001).
  */
 export function loadCoreRules(): LintRule[] {
   return [
@@ -87,5 +90,6 @@ export function loadCoreRules(): LintRule[] {
     cor021EnvLiteralNameRule,
     cor022ReceiptLeafRule,
     cor024ReceiptSecretPointerRule,
+    noLiteralKeyRule,
   ];
 }

package/src/lint/rules/op/index.ts

@@ -5,7 +5,8 @@
  * `coreReceiptChecks`) so they run over the FULL build result regardless of
  * which lexicons are configured — an Op is recognized by entity type
  * (`../../../op/resource.ts`'s `OpResource`), not by which lexicon declared
- * it.
+ * it. SYS010 (#2828) joined them when the `decide` activity moved into core:
+ * it reads the decide steps, and the `decide.backends` the caller passes.
  */
 
 import type { PostSynthCheck } from "../../post-synth";
@@ -13,13 +14,25 @@ import { ops012 } from "./ops012-activity-contract";
 import { ops013 } from "./ops013-step-output-ref";
 import { ops014 } from "./ops014-converge-rule-refusals";
 import { ops015 } from "./ops015-gate-approval";
+import { sys010Check } from "./sys010-key-over-plain-http";
+import type { DecideBackend } from "../../../op/decide-config";
 
 export { ops012 } from "./ops012-activity-contract";
 export { ops013 } from "./ops013-step-output-ref";
 export { ops014 } from "./ops014-converge-rule-refusals";
 export { ops015 } from "./ops015-gate-approval";
+export { sys010, sys010Check } from "./sys010-key-over-plain-http";
 
-/** Core's own post-synth checks over the Op model — OPS012, OPS013, OPS014, OPS015. */
-export function coreOpChecks(): PostSynthCheck[] {
-  return [ops012, ops013, ops014, ops015];
+export interface CoreOpCheckOptions {
+  /** `decide.backends` from the project's chant.config, for SYS010 (#2828). */
+  decideBackends?: Record<string, Pick<DecideBackend, "url" | "key">>;
+}
+
+/**
+ * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
+ * OPS015, and SYS010 over the `decide` steps and the configured decide
+ * backends.
+ */
+export function coreOpChecks(opts: CoreOpCheckOptions = {}): PostSynthCheck[] {
+  return [ops012, ops013, ops014, ops015, sys010Check(opts.decideBackends)];
 }

package/src/lint/rules/op/ops014-converge-rule-refusals.test.ts

@@ -8,7 +8,7 @@ import type { PostSynthContext } from "../../post-synth";
 import { DECLARABLE_MARKER } from "../../../declarable";
 import { when, eq, gt, allOf, run, report } from "../../../op";
 import type { ConvergeRule } from "../../../op";
-import type { ConvergeSymptom } from "../../../lifecycle/symptoms";
+import type { ConvergeSymptom, ResourceSymptom } from "../../../lifecycle/symptoms";
 import { ops014 } from "./ops014-converge-rule-refusals";
 
 function makeEntity(entityType: string, props: Record<string, unknown>) {
@@ -261,3 +261,25 @@ describe("OPS014: converge-rule-refusals", () => {
     expect(ops014.check(ctx)).toHaveLength(0);
   });
 });
+
+describe("OPS014 over a ConvergeOp with an observer step (#2778)", () => {
+  test("its rules are checked against ResourceSymptom's fields", () => {
+    const observed = (rules: unknown[]) =>
+      makeEntity("Chant::Op", {
+        name: "box-converge",
+        overview: "test",
+        labels: { Converge: "true", Env: "box", Dial: "apply", Observe: "step" },
+        phases: [
+          { name: "Observe", steps: [{ kind: "activity", fn: "spriteServicesObserve", args: {}, id: "observe" }] },
+          { name: "Converge", steps: [{ kind: "activity", fn: "convergeTick", args: { rules, observed: { kind: "step-output-ref", step: "observe" } } }] },
+        ],
+      });
+    const restartOp = opEntity("restart-service", [{ kind: "activity", fn: "spriteServiceRestart", args: {} }]);
+    const good = when<ResourceSymptom>(eq("status", "drifted"), run("restart-service"), { id: "restart", why: "x" });
+    const wrongField = { ...good, id: "adopt", when: { kind: "field-comparison", field: "adoptCount", op: "gt", value: 0 } };
+    const ok = ops014.check(makeCtxFromEntities(new Map<string, unknown>([["c", observed([good])], ["r", restartOp]])));
+    expect(ok).toEqual([]);
+    const bad = ops014.check(makeCtxFromEntities(new Map<string, unknown>([["c", observed([wrongField])], ["r", restartOp]])));
+    expect(bad.map((d) => d.message)).toEqual([expect.stringMatching(/rule "adopt": predicate is outside the evaluable subset/)]);
+  });
+});