@intentius/chant 0.91.0 → 0.94.0

package/src/cli/mcp/workspace-tools.ts

@@ -6,7 +6,8 @@
  * is a thin call into the code the CLI runs:
  *
  * - The reads (`workspace-ls`, `workspace-status`, `workspace-graph`,
- *   `workspace-records`, `workspace-points`) run `chant workspace <command>
+ *   `workspace-changes`, `workspace-records`, `workspace-points`,
+ *   `workspace-work-history`) run `chant workspace <command>
  *   ... --json` with the chant this server runs as, in the server's
  *   directory, and return the
  *   document it printed, unchanged, with its reason codes (#2536). Running the
@@ -52,7 +53,7 @@ export interface WorkspaceToolsOptions {
 
 const PROTOCOL =
   "Records are proposals until they are reviewed: a new record opens proposed, and people decide it through reviews and amendments. " +
-  "by must name the person or agent that actually decided, as it is recorded as given.";
+  "by must name the person or agent that actually proposed or decided it, as it is recorded as given.";
 
 const kindProp = {
   type: "string",
@@ -105,10 +106,29 @@ export const workspaceReadTools: ToolDefinition[] = [
       },
     },
   },
+  {
+    name: "workspace-changes",
+    description:
+      "The forward coverage check over a diff: chant workspace check --changes <range> --json (changes.schema.json, #2773). Each changed path with the current records whose constrains cover it, and a change-uncovered or change-out-of-scope finding for each gap, at the severity the declaration's changes block sets. Returns the document unchanged.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        range: { type: "string", description: "The diff: <base>..<head>, <base>...<head> (from their merge base), or <base> alone, to HEAD (--changes)." },
+        work: { type: "string", description: "The id of the work item in hand, whose out_of_scope and whose decisions' out_of_scope apply (--work)." },
+        severity: { type: "string", enum: ["off", "warn", "fail"], description: "In place of the declaration's changes.severity (--severity)." },
+        kind: {
+          type: "array",
+          items: { type: "string" },
+          description: "Record kind files to read in place of the declared ones (--kind).",
+        },
+      },
+      required: ["range"],
+    },
+  },
   {
     name: "workspace-records",
     description:
-      "The records of a kind, validated, with supersession, provenance, quorum and warnings: chant workspace records --json (records.schema.json). With since, what changed since a revision or a review session (records-since.schema.json). Returns the document unchanged; with id, only that record is kept in records. " +
+      "The records of a kind, validated, with supersession, remediation, provenance, quorum and warnings: chant workspace records --json (records.schema.json). With since, what changed since a revision or a review session (records-since.schema.json). Returns the document unchanged; with id, only that record is kept in records. " +
       PROTOCOL,
     inputSchema: {
       type: "object",
@@ -134,6 +154,19 @@ export const workspaceReadTools: ToolDefinition[] = [
       },
     },
   },
+  {
+    name: "workspace-work-history",
+    description:
+      "One work item's lease history, from the lifecycle ledger of the member that owns its work kind: chant workspace work history <item> --json (work-history.schema.json, #2785). Each claim has its fencing token and holder and how it ended: released with an outcome, still held, or never released (expired, or lost to a later claim). Returns the document unchanged.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        item: { type: "string", description: "The work item's id." },
+        kind: { type: "string", description: "The work kind file, when more than one declared work kind has the id (--kind)." },
+      },
+      required: ["item"],
+    },
+  },
 ];
 
 export const workspaceWriteTools: ToolDefinition[] = [
@@ -148,7 +181,11 @@ export const workspaceWriteTools: ToolDefinition[] = [
         kind: kindProp,
         record: { type: "object", description: "The record's fields, as the kind's schema describes them. The id is allocated when left out." },
         prefix: { type: "string", description: "The id prefix to allocate under, when the records use several (--prefix)." },
-        by: { type: "string", description: "Who decided: written to the kind's decider field, such as decided_by. Required to sign." },
+        by: {
+          type: "string",
+          description:
+            "Who proposed it: written to the kind's proposedBy field, such as proposed_by, since a record opens proposed. Written to its decider field, such as decided_by, only when the record's fields open it straight into a later state. Required to sign.",
+        },
         sign: signProp,
         dryRun: dryRunProp,
       },
@@ -281,6 +318,27 @@ export function readArgv(tool: string, params: Record<string, unknown>): string[
       if (intent !== undefined) return ["workspace", "graph", "--intent", intent, ...kindArgs, ...atArgs, "--json"];
       return ["workspace", "graph", ...kindArgs, ...atArgs, "--json"];
     }
+    case "workspace-changes": {
+      const range = str(params, "range", true)!;
+      const work = str(params, "work");
+      const severity = str(params, "severity");
+      if (severity !== undefined && !["off", "warn", "fail"].includes(severity)) throw new ToolInputError("severity must be off, warn or fail");
+      return [
+        "workspace",
+        "check",
+        "--changes",
+        range,
+        ...(work !== undefined ? ["--work", work] : []),
+        ...(severity !== undefined ? ["--severity", severity] : []),
+        ...kinds(params).flatMap((k) => ["--kind", k]),
+        "--json",
+      ];
+    }
+    case "workspace-work-history": {
+      const item = str(params, "item", true)!;
+      const kind = str(params, "kind");
+      return ["workspace", "work", "history", item, ...(kind !== undefined ? ["--kind", kind] : []), "--json"];
+    }
     case "workspace-points": {
       const kind = str(params, "kind");
       return ["workspace", "points", ...(bool(params, "open") ? ["--open"] : []), ...(kind !== undefined ? ["--kind", kind] : []), ...atArgs, "--json"];

package/src/cli/plugins.ts

@@ -1,4 +1,4 @@
-import { importLexiconModule, lexiconModulePath, lexiconNames, registerLexiconDeclarations } from "../lexicon-module";
+import { importLexiconModule, importLexiconPackage, lexiconModulePath, lexiconNames, registerLexiconDeclarations, resolveFromProject } from "../lexicon-module";
 import { readLexiconDeclarationsStatically, type StaticLexiconRead } from "../config-static";
 export { unknownPathLexiconsNotice } from "../config-static";
 import { createRequire } from "node:module";
@@ -51,7 +51,7 @@ export async function loadPlugin(lexiconName: string): Promise<LexiconPlugin> {
   }
 
   const packageName = `@intentius/chant-lexicon-${lexiconName}`;
-  const mod = await import(packageName);
+  const mod = (await importLexiconPackage(packageName)) as Record<string, any>;
 
   // Look for an explicit LexiconPlugin export
   for (const value of Object.values(mod)) {
@@ -109,7 +109,15 @@ export function resolveLexiconVersions(lexiconNames: readonly string[]): Record<
     if (lexiconModulePath(name) !== undefined) continue;
     const packageName = `@intentius/chant-lexicon-${name}`;
     try {
-      let dir = dirname(require_.resolve(packageName));
+      // chant#2845 — a lexicon chant's own install can't reach is resolved from the project.
+      let entry: string | undefined;
+      try {
+        entry = require_.resolve(packageName);
+      } catch (err) {
+        entry = resolveFromProject(packageName);
+        if (entry === undefined) throw err;
+      }
+      let dir = dirname(entry);
       // Bounded walk — a resolved entry point is never deeply nested inside
       // its own package, and an unbounded loop here would climb to `/`.
       for (let depth = 0; depth < 10; depth++) {

package/src/cli/registry.ts

@@ -303,13 +303,23 @@ export interface ParsedArgs {
   composites?: boolean;
   /** `chant workspace graph --intent <path[:start-end]>` (#2651): the region the intent graph is over. */
   intent?: string;
+  /** `chant workspace check --changes <base>..<head>` (#2773): the diff the forward coverage check maps to records. */
+  changes?: string;
+  /** `chant workspace check --changes ... --severity off|warn|fail` (#2773): in place of the declaration's `changes.severity`. */
+  severity?: string;
   /** `chant workspace records --current` (#2546): leave out records a closed record supersedes. */
   current?: boolean;
   /** `chant workspace records amend <id> --set <file|->` (#2670): the JSON fields to set. */
   set?: string;
   /** `chant workspace records review <id> --verdict <v>` (#2670): agree, dissent or abstain. */
   verdict?: string;
-  /** `chant workspace records review <id> --by <principal>` (#2670): the reviewer, as the caller names them. */
+  /**
+   * `chant workspace records review <id> --by <principal>` (#2670): the
+   * reviewer, as the caller names them. Also `chant workspace records new
+   * --by <name>` (#2756): the record's proposer, or its decider when it
+   * opens straight into a later state; see {@link ChannelOptions.by} in
+   * `records-write.ts`.
+   */
   by?: string;
   /**
    * `chant workspace records review <id> --sign [<key file>]` (#2687): the key that seals the verdict, or true for git's user.signingkey.
@@ -436,7 +446,7 @@ export interface ParsedArgs {
   steward?: string;
   /** `chant workspace work claim|renew|release <id> --holder <name>` (#2732): who holds, or releases, the work lease. */
   holder?: string;
-  /** `chant run <op> --work <id>` (#2748): the work item an Op with a work lease runs under. */
+  /** `chant run <op> --work <id>` (#2748): the work item an Op with a work lease runs under. `chant workspace check --changes --work <id>` (#2773): the work item in hand. */
   work?: string;
   /** `chant workspace work claim|renew <id> --ttl <seconds|duration>` (#2732): how long the lease lasts unless renewed. */
   ttl?: string;

package/src/cli/serve-mcp-workspace.test.ts

@@ -73,8 +73,8 @@ describe("chant serve mcp at a workspace root with no lexicon of its own (#2700)
     expect(init.instructions).toContain("Member delivery (delivery/) declares docker.");
   }, TIMEOUT);
 
-  test("a chud-shaped root, lexicons only in a member, serves core and the lexicons that load", () => {
-    const root = join(scratch, "chud-shaped");
+  test("a lexiconless root, lexicons only in a member, serves core and the lexicons that load", () => {
+    const root = join(scratch, "lexiconless-shaped");
     mkdirSync(join(root, ".git"), { recursive: true });
     mkdirSync(join(root, "delivery"), { recursive: true });
     mkdirSync(join(root, "app"), { recursive: true });
@@ -87,9 +87,9 @@ describe("chant serve mcp at a workspace root with no lexicon of its own (#2700)
       ],
       pins: [],
     }));
-    // `chud` is not installed here, as it would not be for a chant without
-    // @intentius/chud: it is named as not loaded and the rest is served.
-    writeFileSync(join(root, "delivery", "chant.config.ts"), 'export default { lexicons: ["docker", "chud"] };\n');
+    // `acme` names a lexicon package that isn't installed here: it is named
+    // as not loaded and the rest is served.
+    writeFileSync(join(root, "delivery", "chant.config.ts"), 'export default { lexicons: ["docker", "acme"] };\n');
     writeFileSync(join(root, "app", "server.js"), "// not chant\n");
 
     const { status, stderr, init, tools } = initializeAndList(root);
@@ -97,7 +97,7 @@ describe("chant serve mcp at a workspace root with no lexicon of its own (#2700)
     for (const name of CORE_TOOLS) expect(tools).toContain(name);
     expect(tools).toContain("docker:diff");
     expect(init.instructions).toContain('workspace "t"');
-    expect(init.instructions).toContain("Lexicon chud did not load");
+    expect(init.instructions).toContain("Lexicon acme did not load");
     expect(init.instructions).toContain("Lexicon tools and resources served: docker.");
   }, TIMEOUT);
 

package/src/codegen/pinned-upgrade.ts

@@ -26,6 +26,7 @@ import { join } from "path";
 import { regenLexicon, type RegenResult } from "./lexicon-regen";
 import { fetchWithRetry } from "./fetch";
 import { isLexiconPlugin, type UpstreamPin } from "../lexicon";
+import { importLexiconPackage } from "../lexicon-module";
 
 // ── Public types ──────────────────────────────────────────────────────
 
@@ -200,7 +201,7 @@ export function revertVersionBump(filePath: string, original: string): void {
 export async function loadUpstreamPin(lexicon: LexiconId): Promise<UpstreamPin | null> {
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(`@intentius/chant-lexicon-${lexicon}`)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(`@intentius/chant-lexicon-${lexicon}`)) as Record<string, unknown>;
   } catch {
     return null;
   }

package/src/codegen/release-wiring.test.ts

@@ -171,7 +171,54 @@ describe("release wiring: preflight gates both recipes (#1255)", () => {
     }
   });
 
-  it("the whole-repo release requires main, since it pushes main", () => {
-    expect(recipeBody("release")).toMatch(/release-preflight\.sh main/);
+});
+
+/**
+ * #2816 — main's HEAD is rarely green, so a release tags the newest green
+ * commit on main (or the one named) and merges the bump back into main.
+ * scripts/release-preflight.test.ts runs the mechanics; this pins the wiring.
+ */
+describe("release wiring: release the newest green commit (#2816)", () => {
+  it("both recipes tag the commit the preflight chose, not HEAD", () => {
+    for (const recipe of ["release", "release-lexicon"]) {
+      const body = recipeBody(recipe);
+      expect(body).toMatch(/sha=\$\(bash scripts\/release-preflight\.sh/);
+      expect(body).toMatch(/release_open "\$sha"/);
+    }
+  });
+
+  it("both recipes merge the tag back into main instead of pushing HEAD", () => {
+    for (const recipe of ["release", "release-lexicon"]) {
+      const body = recipeBody(recipe);
+      expect(body).toMatch(/release_ship "\$tag"/);
+      expect(body).not.toMatch(/git push/);
+      expect(body.indexOf("git tag")).toBeLessThan(body.indexOf("release_ship"));
+    }
+    const lib = readFileSync(join(repoRoot, "scripts", "release-lib.sh"), "utf-8");
+    // main and the tag land together or not at all, and nothing is forced.
+    expect(lib).toMatch(/git push --quiet --atomic origin "HEAD:refs\/heads\/main" "refs\/tags\/\$tag"/);
+    expect(lib).not.toMatch(/git push[^\n]*(--force|\s-f\b)/);
+  });
+
+  it("both recipes offer a dry run that stops before committing", () => {
+    for (const recipe of ["release", "release-lexicon"]) {
+      const body = recipeBody(recipe);
+      expect(body.indexOf("RELEASE_DRY_RUN")).toBeGreaterThan(-1);
+      expect(body.indexOf("RELEASE_DRY_RUN")).toBeLessThan(body.indexOf("git commit"));
+    }
+  });
+
+  it("the whole-repo floor reads main as well as the green commit", () => {
+    expect(recipeBody("release")).toMatch(/release_version_at "\$RELEASE_MAIN"/);
+    expect(recipeBody("release-lexicon")).toMatch(/release_version_at "\$RELEASE_MAIN"/);
+  });
+
+  it("a push to main does not cancel main's chant run; PR runs still cancel", () => {
+    const workflow = readFileSync(join(repoRoot, ".github", "workflows", "chant.yml"), "utf-8");
+    const block = workflow.match(/^concurrency:\n((?:[ ]+.*\n)+)/m)?.[1] ?? "";
+    // One group per commit on main, so a later push neither cancels a running
+    // run nor replaces a queued one.
+    expect(block).toMatch(/group:.*github\.ref == 'refs\/heads\/main' && github\.sha \|\| github\.ref/);
+    expect(block).toMatch(/cancel-in-progress: \$\{\{ github\.ref != 'refs\/heads\/main' \}\}/);
   });
 });

package/src/components/capability-plugin-loader.ts

@@ -22,7 +22,7 @@
  */
 
 import { CapabilityRegistry } from "./capability";
-import { lexiconModulePath } from "../lexicon-module";
+import { lexiconModulePath, importLexiconPackage } from "../lexicon-module";
 import type { CapabilityPlugin } from "./capability-plugin";
 import { isCapabilityPlugin } from "./capability-plugin";
 import { starterCapabilityPlugin } from "./starter-plugin";
@@ -62,7 +62,7 @@ export async function loadCapabilityPlugin(name: string): Promise<CapabilityPlug
   const packageName = `@intentius/chant-capability-${name}`;
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(packageName)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(packageName)) as Record<string, unknown>;
   } catch (err) {
     throw new Error(
       `capability plugin package "${packageName}" could not be loaded: ${err instanceof Error ? err.message : String(err)}`,
@@ -118,7 +118,7 @@ export async function loadCapabilityPluginFromLexicon(name: string): Promise<Cap
   const packageName = lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`;
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(packageName)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(packageName)) as Record<string, unknown>;
   } catch {
     return null; // lexicon not installed / not resolvable here — nothing to contribute.
   }

package/src/components/cli-support.ts

@@ -22,7 +22,7 @@
  *    executor, the CLI entrypoint the driver (#556) never had.
  */
 
-import { lexiconModulePath, lexiconNames } from "../lexicon-module";
+import { lexiconModulePath, lexiconNames, importLexiconPackage } from "../lexicon-module";
 import { discoverComponents } from "./discover";
 import type { BuildParamProvenance } from "../provenance";
 import { inferArchetype, projectToJson, type Archetype } from "./component";
@@ -244,7 +244,7 @@ export interface GenerateComponentsResult {
 async function loadLexiconPlugin(name: string): Promise<LexiconPlugin | null> {
   let mod: Record<string, unknown>;
   try {
-    mod = (await import(lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`)) as Record<string, unknown>;
+    mod = (await importLexiconPackage(lexiconModulePath(name) ?? `@intentius/chant-lexicon-${name}`)) as Record<string, unknown>;
   } catch {
     return null;
   }

package/src/config.ts

@@ -11,6 +11,7 @@ import type { BuildParamProvenance } from "./provenance";
 import { findProjectConfig } from "./project-root";
 import { evaluateProjectConfig } from "./config-sandbox";
 import { lexiconNames, pathLexiconRoot, registerLexiconDeclarations, type LexiconDeclaration } from "./lexicon-module";
+import { decideConfigSchema, type DecideConfig } from "./op/decide-config";
 
 /**
  * One project-declared environment (chant #1166). Historically always a bare
@@ -194,6 +195,7 @@ export const ChantConfigSchema = z.object({
   knowledge: z.object({
     dir: z.string().min(1).optional(),
   }).optional(),
+  decide: decideConfigSchema.optional(),
   exclude: z.array(z.string().min(1)).optional(),
   include: z.array(z.string().min(1)).optional(),
   rootOnly: z.boolean().optional(),
@@ -449,6 +451,15 @@ export interface ChantConfig {
     dir?: string;
   };
 
+  /**
+   * The backends the `decide` Op activity calls (#2828): backend name, as a
+   * decision point's model decider names it, to `{ url, key?, timeoutMs? }`.
+   * A key is `{ env }` or a brokered capability, never a literal (SYS001). A
+   * `decide` step's own `backends` take the place of these. See
+   * `./op/decide-config.ts`.
+   */
+  decide?: DecideConfig;
+
   /**
    * Globs, relative to the directory holding this config, naming files that
    * source discovery must skip (#2519): `build`, `lint`, `list`, `explain`

package/src/lexicon-module.ts

@@ -24,7 +24,9 @@
  * a project that names lexicons by package takes exactly the path it always did.
  */
 
-import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { createRequire } from "node:module";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
 
 /**
  * One `lexicons` entry: a package-backed name, or a name plus the module that
@@ -213,3 +215,56 @@ export function lexiconPackagesToInstall(
 ): string[] {
   return names.filter((name) => !paths.has(name)).map((name) => `@intentius/chant-lexicon-${name}`);
 }
+
+/**
+ * chant#2845 — the npm package a bare specifier names: `@scope/name` for a
+ * scoped one, else its first segment. `undefined` for a relative or absolute
+ * path, which is not a package.
+ */
+export function packageNameOf(spec: string): string | undefined {
+  if (spec.startsWith(".") || isAbsolute(spec) || spec.startsWith("file:")) return undefined;
+  const parts = spec.split("/");
+  return spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
+
+/** True when `err` says the package `pkg` itself could not be found, not something it imports. */
+function isPackageNotFound(err: unknown, pkg: string): boolean {
+  const code = (err as { code?: unknown } | null)?.code;
+  if (code !== "ERR_MODULE_NOT_FOUND" && code !== "MODULE_NOT_FOUND") return false;
+  const message = err instanceof Error ? err.message : String(err);
+  return message.includes(`'${pkg}'`) || message.includes(`"${pkg}"`) || message.includes(`${pkg}/`);
+}
+
+/**
+ * chant#2845 — resolve `spec` (a lexicon package or one of its subpaths) from
+ * `fromDir` instead of from chant's own install, or `undefined` when the
+ * project doesn't have it either.
+ */
+export function resolveFromProject(spec: string, fromDir: string = process.cwd()): string | undefined {
+  try {
+    return createRequire(join(fromDir, "package.json")).resolve(spec);
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * chant#2845 — import a lexicon package, or one of its subpaths, by its bare
+ * specifier. chant's own install is tried first, as a bare `import()` always
+ * did, so a lexicon chant can reach loads exactly as before. When the package
+ * isn't there, which is the case for a chant installed globally and a project
+ * that installs its lexicons in its own node_modules, it is resolved from
+ * `fromDir` (the project) and imported from there. Any other failure, and a
+ * package the project doesn't have either, rethrows the first error.
+ */
+export async function importLexiconPackage(spec: string, fromDir: string = process.cwd()): Promise<Record<string, unknown>> {
+  try {
+    return (await import(spec)) as Record<string, unknown>;
+  } catch (err) {
+    const pkg = packageNameOf(spec);
+    if (pkg === undefined || !isPackageNotFound(err, pkg)) throw err;
+    const resolved = resolveFromProject(spec, fromDir);
+    if (resolved === undefined) throw err;
+    return (await import(pathToFileURL(resolved).href)) as Record<string, unknown>;
+  }
+}

package/src/lexicon-package.test.ts

@@ -0,0 +1,96 @@
+/**
+ * chant#2845 — a lexicon the project installs in its own node_modules loads
+ * when chant's own install can't reach it (a global chant): the plugin, its
+ * op activities and its activity contracts, resolved from the working
+ * directory after the bare import from chant's location fails.
+ */
+import { describe, test, expect, beforeAll, afterAll } from "vitest";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { importLexiconPackage, packageNameOf, resolveFromProject } from "./lexicon-module";
+import { loadActivities } from "./op/activity-registry";
+import { loadActivityContracts } from "./op/activity-contract-registry";
+import { resolveLexiconVersions } from "./cli/plugins";
+
+const NAME = "zz2845";
+const PKG = `@intentius/chant-lexicon-${NAME}`;
+let project: string;
+
+beforeAll(async () => {
+  project = await mkdtemp(join(tmpdir(), "chant-2845-"));
+  const dir = join(project, "node_modules", "@intentius", `chant-lexicon-${NAME}`);
+  await mkdir(join(dir, "op"), { recursive: true });
+  await writeFile(
+    join(dir, "package.json"),
+    JSON.stringify({
+      name: PKG,
+      version: "9.9.9",
+      type: "module",
+      exports: { ".": { default: "./index.js" }, "./op/activities": { default: "./op/activities.js" }, "./op/activity-contracts": { default: "./op/contracts.js" } },
+    }),
+  );
+  await writeFile(join(dir, "index.js"), "export const marker = 'plugin';\n");
+  await writeFile(join(dir, "op", "activities.js"), "export async function zz2845Probe() { return { ok: true }; }\n");
+  // A contract is branded with a global symbol, so a plain object built here is one.
+  await writeFile(
+    join(dir, "op", "contracts.js"),
+    "export const zz2845ProbeContract = { [Symbol.for('chant.op.activityContract')]: true, name: 'zz2845Probe', args: {}, returns: {} };\n",
+  );
+});
+
+afterAll(async () => {
+  await rm(project, { recursive: true, force: true });
+});
+
+describe("importLexiconPackage (#2845)", () => {
+  test("a package chant can't reach is imported from the project", async () => {
+    await expect(import(PKG)).rejects.toThrow();
+    const mod = await importLexiconPackage(PKG, project);
+    expect(mod.marker).toBe("plugin");
+    const op = await importLexiconPackage(`${PKG}/op/activities`, project);
+    expect(typeof op.zz2845Probe).toBe("function");
+  });
+
+  test("a package chant reaches loads from chant's install, whatever the directory", async () => {
+    const mod = await importLexiconPackage("zod", project);
+    expect(typeof mod.z).toBe("object");
+  });
+
+  test("a package neither has fails with the bare import's own error", async () => {
+    await expect(importLexiconPackage("@intentius/chant-lexicon-nope-2845", project)).rejects.toThrow(/chant-lexicon-nope-2845/);
+  });
+
+  test("a path is not looked up in the project", () => {
+    expect(packageNameOf("/abs/lexicon.ts")).toBeUndefined();
+    expect(packageNameOf("./lexicon.ts")).toBeUndefined();
+    expect(packageNameOf(`${PKG}/op/activities`)).toBe(PKG);
+    expect(resolveFromProject(PKG, project)).toMatch(/index\.js$/);
+  });
+});
+
+describe("the loaders take the project's lexicon (#2845)", () => {
+  const inProject = async <T>(fn: () => Promise<T> | T): Promise<T> => {
+    const cwd = process.cwd();
+    process.chdir(project);
+    try {
+      return await fn();
+    } finally {
+      process.chdir(cwd);
+    }
+  };
+
+  test("loadActivities finds its op activities", async () => {
+    const activities = await inProject(() => loadActivities([NAME]));
+    expect(activities.has("zz2845Probe")).toBe(true);
+  });
+
+  test("loadActivityContracts finds its contracts", async () => {
+    const contracts = await inProject(() => loadActivityContracts([NAME]));
+    expect(contracts.has("zz2845Probe")).toBe(true);
+  });
+
+  test("resolveLexiconVersions reads its version", async () => {
+    expect(await inProject(() => resolveLexiconVersions([NAME]))).toEqual({ [NAME]: "9.9.9" });
+  });
+});

package/src/lifecycle/converge-ledger.ts

@@ -66,6 +66,12 @@ export interface ConvergeRuleOutcome {
   action: "ran" | "reported" | "skipped-budget" | "skipped-flap" | "gated";
   /** The dispatched Op name, for `action: "ran"` or `"gated"`. */
   op?: string;
+  /**
+   * The resource the rule fired for, on a tick of a ConvergeOp with an
+   * observer step (#2778), which evaluates its rules once per resource. The
+   * dispatched Op reads it from `CHANT_CONVERGE_RESOURCE`.
+   */
+  resource?: string;
   /** The gate's signal name, for `action: "gated"`. */
   gateName?: string;
   /**
@@ -131,6 +137,14 @@ export function componentVerdicts(rows: readonly ComponentStatusRow[]): Converge
   }));
 }
 
+/** One resource an observer step reported on a tick (#2778). */
+export interface ConvergeResourceVerdict {
+  name: string;
+  status: "in-sync" | "drifted" | "unknown";
+  /** The observer's reason, capped to one line. */
+  detail?: string;
+}
+
 /** One immutable converge-tick record. */
 export interface ConvergeTickRecord {
   /** Schema version, so an incompatible future shape is detected before being misread. */
@@ -168,6 +182,12 @@ export interface ConvergeTickRecord {
    * records written before #2027 have none; absent is not "no components".
    */
   components?: ConvergeComponentVerdict[];
+  /**
+   * What a ConvergeOp's observer step reported this tick (#2778), one entry
+   * per resource: in its place of `components` for resources no lexicon
+   * observes. Absent on a tick observed through a lexicon environment.
+   */
+  resources?: ConvergeResourceVerdict[];
   /** Aggregate counts backing the tick's one log line. */
   summary: {
     drifted: number;

package/src/lifecycle/run-ledger.ts

@@ -85,6 +85,8 @@ export function buildRunRecord(
     status: OpRunRecord["status"];
     id?: string;
     gate?: OpRunRecord["gate"];
+    point?: OpRunRecord["point"];
+    steward?: string;
   },
 ): OpRunRecordInput {
   const phases: OpRunPhaseRecord[] = [];
@@ -106,6 +108,8 @@ export function buildRunRecord(
       ...(record.approval ? { approval: record.approval } : {}),
       ...(record.error !== undefined ? { error: record.error } : {}),
       ...(record.refusal !== undefined ? { refusal: record.refusal } : {}),
+      ...(record.point ? { point: record.point } : {}),
+      ...(record.gate ? { gate: record.gate } : {}),
     });
     if (record.outcome) outcomes[record.outcome.name] = record.outcome.value;
   }
@@ -122,6 +126,8 @@ export function buildRunRecord(
     outcomes,
     phases,
     ...(times.gate ? { gate: times.gate } : {}),
+    ...(times.point ? { point: times.point } : {}),
+    ...(times.steward ? { steward: times.steward } : {}),
   };
 }