@intentius/chant 0.93.0 → 0.94.0

package/src/cli/main.ts

@@ -1284,9 +1284,10 @@ async function loadPluginsOrExit(path: string): Promise<import("../lexicon").Lex
  * #2700 — whether `path` is the root of a declared workspace and holds no
  * lexicon of its own: no `lexicons` in a root config, and no lexicon import in
  * the root's source, which leaves the members' directories out (#2527). A
- * generated chud repo is this shape: its lexicons are all in `delivery/`.
- * `chant serve mcp` starts there instead of refusing with "No lexicon
- * detected", and serves core with the chant members' lexicons.
+ * generated app repo can be this shape: its lexicons are all under a
+ * delivery directory, not the root. `chant serve mcp` starts there instead of
+ * refusing with "No lexicon detected", and serves core with the chant
+ * members' lexicons.
  *
  * A directory with no workspace declaration costs only `findWorkspaceRoot`'s
  * existence checks, so a level-0 project reaches `loadPluginsOrExit` as before.

package/src/cli/mcp/workspace-plugins.ts

@@ -2,12 +2,12 @@
  * #2700 — the lexicons `chant serve mcp` loads at the root of a declared
  * workspace that has no lexicon of its own.
  *
- * Such a root (a generated chud repo, say, whose lexicons are all in
- * `delivery/`) used to refuse with "No lexicon detected", so an agent started
- * there got none of chant's tools. The server now starts with core's tools and
- * resources, and with the lexicons of the workspace's members of kind chant,
- * each read from that member's own config the way `chant build` in the
- * member's directory reads it.
+ * Such a root (a generated app repo, say, whose lexicons are all under a
+ * delivery directory) used to refuse with "No lexicon detected", so an agent
+ * started there got none of chant's tools. The server now starts with core's
+ * tools and resources, and with the lexicons of the workspace's members of
+ * kind chant, each read from that member's own config the way `chant build`
+ * in the member's directory reads it.
  *
  * Loading is best effort, one member and one lexicon at a time: a member whose
  * config does not load, or a lexicon this chant cannot import, is left out and

package/src/cli/serve-mcp-workspace.test.ts

@@ -73,8 +73,8 @@ describe("chant serve mcp at a workspace root with no lexicon of its own (#2700)
     expect(init.instructions).toContain("Member delivery (delivery/) declares docker.");
   }, TIMEOUT);
 
-  test("a chud-shaped root, lexicons only in a member, serves core and the lexicons that load", () => {
-    const root = join(scratch, "chud-shaped");
+  test("a lexiconless root, lexicons only in a member, serves core and the lexicons that load", () => {
+    const root = join(scratch, "lexiconless-shaped");
     mkdirSync(join(root, ".git"), { recursive: true });
     mkdirSync(join(root, "delivery"), { recursive: true });
     mkdirSync(join(root, "app"), { recursive: true });
@@ -87,9 +87,9 @@ describe("chant serve mcp at a workspace root with no lexicon of its own (#2700)
       ],
       pins: [],
     }));
-    // `chud` is not installed here, as it would not be for a chant without
-    // @intentius/chud: it is named as not loaded and the rest is served.
-    writeFileSync(join(root, "delivery", "chant.config.ts"), 'export default { lexicons: ["docker", "chud"] };\n');
+    // `acme` names a lexicon package that isn't installed here: it is named
+    // as not loaded and the rest is served.
+    writeFileSync(join(root, "delivery", "chant.config.ts"), 'export default { lexicons: ["docker", "acme"] };\n');
     writeFileSync(join(root, "app", "server.js"), "// not chant\n");
 
     const { status, stderr, init, tools } = initializeAndList(root);
@@ -97,7 +97,7 @@ describe("chant serve mcp at a workspace root with no lexicon of its own (#2700)
     for (const name of CORE_TOOLS) expect(tools).toContain(name);
     expect(tools).toContain("docker:diff");
     expect(init.instructions).toContain('workspace "t"');
-    expect(init.instructions).toContain("Lexicon chud did not load");
+    expect(init.instructions).toContain("Lexicon acme did not load");
     expect(init.instructions).toContain("Lexicon tools and resources served: docker.");
   }, TIMEOUT);
 

package/src/op/activities/decide.test.ts

@@ -65,6 +65,14 @@ afterAll(async () => {
 });
 
 describe("decide against the stub (#2740)", () => {
+  test("points --json carries each point's criteria, as the points file declares it (#2853)", async () => {
+    const doc = await workspacePoints({ cwd: root });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.points.find((p) => p.name === "triage")?.criteria).toEqual({ true: "A person looks at it today.", false: "It can wait." });
+    expect(doc.points.find((p) => p.name === "route")?.criteria).toEqual({ platform: "The platform team.", app: "The app team.", docs: "The docs team." });
+    expect(doc.points.find((p) => p.name === "effort")?.criteria).toEqual(["low", "medium", "high"]);
+  });
+
   test("a noul: the model's answer at the threshold is recorded as proposed, and the run waits on it", async () => {
     script = { triage: { type: "noul", noul: 0.91 } };
     const w = await waitsOn(ask({ point: "triage", inputs: { "record.size": 5, "record.risky": true }, subject: "T-1" }));

package/src/op/steward-points.test.ts

@@ -311,3 +311,54 @@ describe("an Op waiting on a decision point (#2749)", () => {
     expect((await readMemberStewards(root, "local", "2027-01-01T00:11:00Z")).stewards[0].waiting).toEqual([]);
   });
 });
+
+describe("a waiting run of an Op the steward does not list (studio#137)", () => {
+  test("status lists it under the steward its record names, and leaves out a run no steward of the member started", async () => {
+    // The steward lists one Op; its process starts `dispatch` itself, with CHANT_STEWARD set.
+    const tick = shipOp("factory-tick", "r-20", "0 0 1 1 *");
+    const steward = declareSteward({ name: "factory-steward", ops: [tick], capabilities: ["inference"] });
+    const dispatch = shipOp("factory-dispatch", "r-21");
+    const lonely = shipOp("factory-lonely", "r-22");
+    const stranger = shipOp("factory-stranger", "r-23");
+    mkdirSync(join(root, "ops"), { recursive: true });
+    writeFileSync(join(root, "chant.config.json"), "{}\n");
+    writeFileSync(join(root, "ops", "factory-steward.op.ts"), `export const steward = ${JSON.stringify(steward)};\n`);
+    writeFileSync(
+      join(root, "ops", "factory.op.ts"),
+      [dispatch, lonely, stranger].map((op, i) => `export const op${i} = { props: ${JSON.stringify(op)} };\n`).join(""),
+    );
+
+    // Each release its own subject, so no earlier answer to ship-now stands for it.
+    const log: string[] = [];
+    const acts = new Map<string, ActivityFn>([
+      ...shipActivities(log),
+      ["askShip", async (args) => (await askPointInRun({ cwd: root, point: "ship-now", inputs: { release: args.release }, subject: String(args.release), on })).answer],
+    ]);
+    process.env[STEWARD_ENV] = "factory-steward";
+    const run = await runOpLocally(dispatch, acts, PROFILES, undefined, { ledger: { cwd: root } });
+    process.env[STEWARD_ENV] = "not-a-steward-here";
+    await runOpLocally(stranger, acts, PROFILES, undefined, { ledger: { cwd: root } });
+    resetStewardTurn();
+    await runOpLocally(lonely, acts, PROFILES, undefined, { ledger: { cwd: root } });
+    expect(run.status).toBe("waiting");
+    const newest = (await readRunLedger("local", "factory-dispatch", { cwd: root })).records.at(-1)!;
+    expect(newest).toMatchObject({ status: "waiting", steward: "factory-steward", point: { id: run.point!.id } });
+    expect((await readRunLedger("local", "factory-lonely", { cwd: root })).records.at(-1)).toMatchObject({ status: "waiting" });
+    expect((await readRunLedger("local", "factory-stranger", { cwd: root })).records.at(-1)).toMatchObject({ status: "waiting", steward: "not-a-steward-here" });
+
+    const status = await readMemberStewards(root, "local", "2027-01-01T00:01:00Z");
+    expect(status.reasons).toEqual([]);
+    const entry = status.stewards.find((s) => s.name === "factory-steward")!;
+    const stewardShape = contract({ $schema: statusSchema.$schema, $id: "urn:test:status-steward-undeclared", $defs: statusSchema.$defs, $ref: "#/$defs/steward" });
+    stewardShape.expectValid(entry);
+    // `ops` stays the declared Ops; `waiting` also names the run of the Op the steward's process started.
+    expect(entry.ops.map((o) => o.name)).toEqual(["factory-tick"]);
+    expect(entry.waiting).toEqual([
+      { op: "factory-dispatch", run: newest.id, id: run.point!.id, point: "ship-now", state: "escalated", path: newest.point!.path, subject: "r-21", since: newest.point!.since },
+    ]);
+    // A run nobody's turn started, or another steward's, is no steward's wait here.
+    const listed = status.stewards.flatMap((s) => s.waiting.map((w) => w.op));
+    expect(listed).not.toContain("factory-lonely");
+    expect(listed).not.toContain("factory-stranger");
+  });
+});

package/src/workspace/box-intent.test.ts

@@ -0,0 +1,205 @@
+/**
+ * A box's intent (#2850): the decision record the box block names, as
+ * `status --json` reports it, as `check` finds it (WSP126, WSP127) and as
+ * `graph --intent` shows it for the box's files.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterAll, describe, expect, test } from "vitest";
+import { cleanScratch, commitAll, contract, REPO, repo } from "./__fixtures__/contract-repo";
+import { constrainsBox, constrainsWorkspace } from "./box-intent";
+import { runDeclarationChecks } from "./checks";
+import { parseDeclaration } from "./declaration";
+import { intentGraph } from "./intent";
+import { parseFrontMatter } from "./records";
+import { workspaceStatus, type StatusDocument } from "./status";
+import statusSchema from "./status.schema.json";
+
+afterAll(cleanScratch);
+
+const REF = join(REPO, "reference-workspace", "decisions");
+const BASE = (() => {
+  const fm = parseFrontMatter(readFileSync(join(REF, "ref-001-how-the-app-is-deployed.md"), "utf-8"));
+  if (!fm.ok) throw new Error(fm.message);
+  return fm.value as Record<string, unknown>;
+})();
+
+const QUESTION = "What is this box for?";
+const CHOICE = { option: "a", reason: "The person who planted the box answered it." };
+const ANSWER = "a chant project with the docker lexicon";
+
+/** A decision record from ref-001: proposed with no choice, or decided by alex. JSON is YAML, so the front matter is JSON. */
+function decision(id: string, state: "proposed" | "decided", constrains: string[]): string {
+  const data = {
+    ...BASE,
+    id,
+    title: `Intent ${id}`,
+    state,
+    question: QUESTION,
+    choice: state === "decided" ? CHOICE : null,
+    rejected: [],
+    evidence: [],
+    decided_by: state === "decided" ? "alex" : null,
+    decided_on: state === "decided" ? "2026-09-26" : null,
+    constrains,
+  };
+  return `---\n${JSON.stringify(data, null, 2)}\n---\n\n# ${id}\n`;
+}
+
+function workspace(box: Record<string, unknown>, records: Record<string, string>, declareKind = true): string {
+  return repo({
+    "chant.workspace.json": JSON.stringify(
+      {
+        name: "acme",
+        schema: 1,
+        members: [{ name: "app", dir: "app", kind: "other", because: "the box", box }],
+        ...(declareKind ? { records: [{ kind: "decisions/decision.kind.mjs" }] } : {}),
+      },
+      null,
+      2,
+    ),
+    "app/server.mjs": "export const port = 8080;\n",
+    "decisions/decision.kind.mjs": readFileSync(join(REF, "decision.kind.mjs"), "utf-8"),
+    "decisions/decision.schema.json": readFileSync(join(REF, "decision.schema.json"), "utf-8"),
+    ...records,
+  });
+}
+
+/**
+ * A workspace shaped like the studio template (studio#112, #2857): the box
+ * block sits on member `box`, the steward and its Ops, and a separate
+ * member `app` is the app the box runs. `records` overlays the decision
+ * files, keyed the same way `repo()` takes every other file.
+ */
+function studioShapedWorkspace(records: Record<string, string>): string {
+  return repo({
+    "chant.workspace.json": JSON.stringify(
+      {
+        name: "acme",
+        schema: 1,
+        members: [
+          { name: "box", dir: "box", kind: "other", because: "the box's steward and its Ops", box: { intent: "box-001" } },
+          { name: "app", dir: "app", kind: "other", because: "the app the box runs" },
+        ],
+        records: [{ kind: "decisions/decision.kind.mjs" }],
+      },
+      null,
+      2,
+    ),
+    "box/ops.mjs": "export const ops = true;\n",
+    "app/server.mjs": "export const port = 8080;\n",
+    "decisions/decision.kind.mjs": readFileSync(join(REF, "decision.kind.mjs"), "utf-8"),
+    "decisions/decision.schema.json": readFileSync(join(REF, "decision.schema.json"), "utf-8"),
+    ...records,
+  });
+}
+
+const intentFindings = async (root: string) =>
+  (await runDeclarationChecks(root)).diagnostics.filter((d) => d.ruleId === "WSP126" || d.ruleId === "WSP127").map((d) => [d.ruleId, d.severity, d.code, d.entity]);
+
+const status = contract(statusSchema);
+async function boxOf(root: string) {
+  const doc: StatusDocument = await workspaceStatus({ cwd: root, env: "prod" });
+  if ("error" in doc) throw new Error(doc.error.message);
+  status.expectValid(doc);
+  return doc.members[0].box;
+}
+
+describe("the box block's intent", () => {
+  test("is parsed into the box declaration, and is null when the block names none", () => {
+    const parse = (box: unknown) =>
+      parseDeclaration(JSON.stringify({ name: "acme", schema: 1, members: [{ name: "app", dir: "app", kind: "other", because: "x", box }] }), "chant.workspace.json").members[0].box;
+    expect(parse({ intent: "box-001" })?.intent).toBe("box-001");
+    expect(parse({})?.intent).toBeNull();
+  });
+
+  test("covers the box through member:, or a path: at, above or inside its directory", () => {
+    const m = { name: "app", dir: "apps/app" };
+    expect(["member:app", "path:apps/app", "path:apps", "path:apps/app/server.mjs"].map((c) => constrainsBox(c, m))).toEqual([true, true, true, true]);
+    expect(["member:web", "path:apps/application", "path:web", "issue:1"].map((c) => constrainsBox(c, m))).toEqual([false, false, false, false]);
+  });
+
+  test("constrainsWorkspace: an entry names a member or path of the workspace whether or not it's the box's own (#2857)", () => {
+    const members = [
+      { name: "box", dir: "box" },
+      { name: "app", dir: "app" },
+    ];
+    expect(["member:box", "member:app", "path:app", "path:box/ops.mjs"].map((c) => constrainsWorkspace(c, members))).toEqual([true, true, true, true]);
+    expect(["member:web", "path:docs", "issue:1"].map((c) => constrainsWorkspace(c, members))).toEqual([false, false, false]);
+    expect(constrainsWorkspace("member:app", [])).toBe(false);
+  });
+});
+
+describe("a box planted as a question", () => {
+  test("a proposed intent reports its question and no answer, and passes the checks", async () => {
+    const root = workspace({ intent: "box-001" }, { "decisions/box-001-what-app-is-for.md": decision("box-001", "proposed", ["member:app"]) });
+    expect((await boxOf(root))?.intent).toEqual({ id: "box-001", state: "proposed", question: QUESTION, choice: null, answer: null, decided_by: null, decided_on: null });
+    expect(await intentFindings(root)).toEqual([]);
+  });
+
+  test("a decided intent reports the answer and who gave it, and graph --intent shows it for the box's files", async () => {
+    const root = workspace({ intent: "box-001" }, { "decisions/box-001-what-app-is-for.md": decision("box-001", "decided", ["member:app"]) });
+    expect((await boxOf(root))?.intent).toEqual({ id: "box-001", state: "decided", question: QUESTION, choice: CHOICE, answer: ANSWER, decided_by: "alex", decided_on: "2026-09-26" });
+    expect(await intentFindings(root)).toEqual([]);
+    commitAll(root, "plant the box");
+    const { doc } = await intentGraph({ cwd: root, region: "app" });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.nodes.filter((n) => n.kind === "decision").map((n) => (n.kind === "decision" ? [n.record, n.state, n.decided_by] : []))).toEqual([["box-001", "decided", "alex"]]);
+  });
+
+  test("a decided intent whose choice names an option not in options[] reports a null answer", async () => {
+    const data = { ...BASE, id: "box-001", title: "Intent box-001", state: "decided", question: QUESTION, choice: { option: "z", reason: "no such option" }, rejected: [], evidence: [], decided_by: "alex", decided_on: "2026-09-26", constrains: ["member:app"] };
+    const record = `---\n${JSON.stringify(data, null, 2)}\n---\n\n# box-001\n`;
+    const root = workspace({ intent: "box-001" }, { "decisions/box-001-what-app-is-for.md": record });
+    expect((await boxOf(root))?.intent?.answer).toBeNull();
+  });
+
+  test("an intent no decision record has fails WSP126, and status reports only its id", async () => {
+    const root = workspace({ intent: "box-009" }, { "decisions/box-001-what-app-is-for.md": decision("box-001", "proposed", ["member:app"]) });
+    expect((await boxOf(root))?.intent).toEqual({ id: "box-009", state: null, question: null, choice: null, answer: null, decided_by: null, decided_on: null });
+    expect(await intentFindings(root)).toEqual([["WSP126", "error", "box-intent-unknown", "app"]]);
+    const [d] = (await runDeclarationChecks(root)).diagnostics.filter((x) => x.ruleId === "WSP126");
+    expect(d.message).toContain("no record of decisions/decision.kind.mjs has that id");
+  });
+
+  test("an intent in a workspace that declares no decision kind fails WSP126", async () => {
+    const root = workspace({ intent: "box-001" }, {}, false);
+    const [d] = (await runDeclarationChecks(root)).diagnostics.filter((x) => x.ruleId === "WSP126");
+    expect(d.message).toContain("the declaration names no record kind called decision");
+  });
+
+  test("an intent whose constrains names no member or path of the workspace warns WSP127", async () => {
+    const root = workspace({ intent: "box-001" }, { "decisions/box-001-what-app-is-for.md": decision("box-001", "proposed", ["path:docs"]) });
+    expect(await intentFindings(root)).toEqual([["WSP127", "warning", "box-intent-unconstrained", "app"]]);
+  });
+
+  test("an intent with empty constrains warns WSP127", async () => {
+    const root = studioShapedWorkspace({ "decisions/box-001-what-app-is-for.md": decision("box-001", "proposed", []) });
+    expect(await intentFindings(root)).toEqual([["WSP127", "warning", "box-intent-unconstrained", "box"]]);
+    const d = (await runDeclarationChecks(root)).diagnostics.find((x) => x.ruleId === "WSP127")!;
+    expect(d.message).toContain("whose constrains is empty");
+    expect(d.message).toContain("add member:<name> for the member the intent is about");
+  });
+
+  test("an intent naming an unknown member warns WSP127", async () => {
+    const root = studioShapedWorkspace({ "decisions/box-001-what-app-is-for.md": decision("box-001", "proposed", ["member:web"]) });
+    expect(await intentFindings(root)).toEqual([["WSP127", "warning", "box-intent-unconstrained", "box"]]);
+  });
+
+  test("an intent that constrains the app a box runs passes WSP127, on a workspace shaped like the studio template (#2857)", async () => {
+    const root = studioShapedWorkspace({ "decisions/box-001-what-app-is-for.md": decision("box-001", "proposed", ["member:app"]) });
+    expect(await intentFindings(root)).toEqual([]);
+  });
+
+  test("an intent with a path: entry inside another member's directory passes WSP127 (#2857)", async () => {
+    const root = studioShapedWorkspace({ "decisions/box-001-what-app-is-for.md": decision("box-001", "proposed", ["path:app/server.mjs"]) });
+    expect(await intentFindings(root)).toEqual([]);
+  });
+
+  test("a box with no intent reports null", async () => {
+    const root = workspace({ capabilities: [] }, {});
+    expect((await boxOf(root))?.intent).toBeNull();
+    expect(await intentFindings(root)).toEqual([]);
+  });
+});

package/src/workspace/box-intent.ts

@@ -0,0 +1,159 @@
+/**
+ * A box's intent (#2850): the decision record its box block names.
+ *
+ * A new box starts as a question, and the first answer to it is what the box
+ * is for. That answer is a decision record, so the intent graph, hud and a
+ * box's runtime all read the same thing. The box block names the record's
+ * id in `intent`; the record is looked for among the records of every
+ * declared kind named `decision` (the entry's `name`, or the kind file's
+ * `recordKind.name`), read from the working tree through the same reader as
+ * `chant workspace records`.
+ *
+ * `chant workspace status --json` reports the record's state and answer
+ * under the member's `box.intent`, and `chant workspace check` fails when no
+ * decision record has the id (WSP126) and warns when the record constrains
+ * no member or path of this workspace at all (WSP127, #2857): the member it
+ * names need not be the box's own, since a decision naming another member
+ * can be what the box is for, such as the app it runs.
+ */
+
+import { loadDeclaredKinds, type DeclaredKind } from "./declared-kinds";
+import type { Declaration, Member } from "./declaration";
+import { constraintCovers, isWorkspacePath } from "./record-assets";
+import { workingTree } from "./tree";
+
+/** The declared kind name a box's intent is looked for in. */
+export const INTENT_KIND_NAME = "decision";
+
+/** A box's intent as `status --json` reports it: the record's id, state and answer. */
+export interface BoxIntent {
+  id: string;
+  /** The record's state, such as proposed or decided, or null when no decision record has the id. */
+  state: string | null;
+  question: string | null;
+  /** The record's choice as written, such as `{ option, reason }`, or null while it is proposed. */
+  choice: unknown;
+  /** The chosen option's label, from `options[]`, or null while no option is chosen. */
+  answer: string | null;
+  decided_by: string | null;
+  decided_on: string | null;
+}
+
+/** The decision record a box's intent names, as the checks read it. */
+export interface ResolvedBoxIntent {
+  member: string;
+  id: string;
+  /** The `intent` field's JSON Pointer in the declaration. */
+  pointer: string;
+  /** The record, or null when no decision record has the id. */
+  record: {
+    /** The kind file that holds it, from the workspace root. */
+    kind: string;
+    /** The record file, from the repository root. */
+    path: string;
+    /** The record's constrains entries, as written. */
+    constrains: string[];
+    intent: BoxIntent;
+  } | null;
+  /** Why no record was found when none was, such as no declared decision kind. Empty when one was found. */
+  why: string;
+}
+
+const str = (v: unknown): string | null => (typeof v === "string" ? v : null);
+
+/** The label of `options[]`'s entry whose id is `choice.option`, or null when no option is chosen. */
+function answerOf(choice: unknown, options: unknown): string | null {
+  const chosen = choice && typeof choice === "object" ? (choice as { option?: unknown }).option : null;
+  if (typeof chosen !== "string" || !Array.isArray(options)) return null;
+  const found = options.find((o): o is { id: unknown; label: unknown } => !!o && typeof o === "object" && (o as { id?: unknown }).id === chosen);
+  return found && typeof found.label === "string" ? found.label : null;
+}
+
+/** The intent of `id` with no record: every field but the id null. */
+export function unresolvedIntent(id: string): BoxIntent {
+  return { id, state: null, question: null, choice: null, answer: null, decided_by: null, decided_on: null };
+}
+
+/**
+ * Resolve the intent of every box that names one, reading the records of each
+ * declared decision kind once. `kinds` are the declared kinds already loaded,
+ * when the caller has them. Only the working tree is read.
+ */
+export async function resolveBoxIntents(declaration: Declaration, root: string, kinds?: readonly DeclaredKind[]): Promise<ResolvedBoxIntent[]> {
+  const boxes = declaration.members.filter((m): m is Member & { box: NonNullable<Member["box"]> & { intent: string } } => m.box?.intent != null);
+  if (boxes.length === 0) return [];
+  const loaded = kinds ?? (await loadDeclaredKinds(declaration, workingTree(root), root));
+  const decisionKinds = loaded.filter((k) => (k.declared.name ?? k.kind) === INTENT_KIND_NAME);
+  const found = new Map<string, NonNullable<ResolvedBoxIntent["record"]>>();
+  const problems: string[] = [];
+  const { readRecordsFor } = await import("./records-cli");
+  const { RecordReadError } = await import("./records");
+  for (const k of decisionKinds) {
+    if (k.reason) {
+      problems.push(`${k.declared.path} can't be loaded: ${k.reason.message}`);
+      continue;
+    }
+    try {
+      const read = await readRecordsFor({ kind: k.file, cwd: root, workGaps: false });
+      const field = read.loaded.kind.constrains?.field ?? "constrains";
+      for (const r of read.result.records) {
+        if (r.id === null || found.has(r.id)) continue;
+        const data = r.data ?? {};
+        const constrains = Array.isArray(data[field]) ? (data[field] as unknown[]).filter((c): c is string => typeof c === "string") : [];
+        found.set(r.id, {
+          kind: k.declared.path,
+          path: r.path,
+          constrains,
+          intent: {
+            id: r.id,
+            state: r.state,
+            question: str(data.question),
+            choice: data.choice ?? null,
+            answer: answerOf(data.choice, data.options),
+            decided_by: str(data.decided_by),
+            decided_on: str(data.decided_on),
+          },
+        });
+      }
+    } catch (err) {
+      if (!(err instanceof RecordReadError)) throw err;
+      problems.push(`${k.declared.path} can't be read: ${err.message}`);
+    }
+  }
+  const why =
+    decisionKinds.length === 0
+      ? `the declaration names no record kind called ${INTENT_KIND_NAME}`
+      : `no record of ${decisionKinds.map((k) => k.declared.path).join(" or ")} has that id` + (problems.length > 0 ? ` (${problems.join("; ")})` : "");
+  return boxes.map((m) => {
+    const record = found.get(m.box.intent) ?? null;
+    return { member: m.name, id: m.box.intent, pointer: `${m.box.pointer}/intent`, record, why: record ? "" : why };
+  });
+}
+
+/**
+ * Whether a constrains entry covers something of the box: `member:<name>`, or
+ * a `path:` entry that is the member's directory, a directory above it or a
+ * path inside it.
+ */
+export function constrainsBox(entry: string, member: { name: string; dir: string }): boolean {
+  if (entry === `member:${member.name}`) return true;
+  if (!entry.startsWith("path:")) return false;
+  const path = entry.slice("path:".length);
+  if (!isWorkspacePath(path)) return false;
+  // The root member holds every path.
+  if (member.dir === ".") return true;
+  return constraintCovers(path, member.dir) || constraintCovers(member.dir, path);
+}
+
+/**
+ * Whether a constrains entry names a member or path of this workspace at
+ * all: `member:<name>` for any declared member, or a `path:` entry that is
+ * some member's directory, a directory above it or a path inside it. An
+ * intent's constrains can govern a member other than the one whose box
+ * names it (a box run by one member can be what a decision about another
+ * member's app is for), so this asks only whether the entry is real, not
+ * whether it reaches a particular member.
+ */
+export function constrainsWorkspace(entry: string, members: readonly { name: string; dir: string }[]): boolean {
+  return members.some((m) => constrainsBox(entry, m));
+}

package/src/workspace/chant-migrations.ts

@@ -26,6 +26,11 @@
  * still the template's, so to a later upgrade they are the project's own
  * edits, merged per file like any other (ws-005). A deleted file keeps its
  * entry too, so a template version that still has it leaves it deleted.
+ *
+ * chant itself carries no chud lexicon or chud-shaped code (#2830, once
+ * #2715's proof passed): `chud-lexicon-exit` and its follow-ons are the
+ * retirement tool, not a remaining dependency. They stay until no known repo
+ * still depends on chud, and are removed only in a major version.
  */
 
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";

package/src/workspace/check.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://intentius.io/chant/schemas/workspace/check/v1/check.schema.json",
   "title": "chant workspace check output",
-  "description": "What `chant workspace check --format json` prints, version 1 of the read contract for checking a workspace (#2524 D9, D15, D16, #2535, #2536). The lineage lock findings carry reason codes; the declaration findings carry WSP ids from the check catalog, WSP001, a declaration that can't be read, also carries the declaration's reason code, and the box checks WSP121 to WSP125 carry theirs. Readers ignore fields they do not know; a field is only ever added within a version. The reason and error codes are closed lists: a new code is a new contract version. Contract version 1 is written by chant 0.81.0 and newer; a reader that needs it refuses output whose `contract` it doesn't know. Every code is in the one closed list of `reason-codes.ts`.",
+  "description": "What `chant workspace check --format json` prints, version 1 of the read contract for checking a workspace (#2524 D9, D15, D16, #2535, #2536). The lineage lock findings carry reason codes; the declaration findings carry WSP ids from the check catalog, WSP001, a declaration that can't be read, also carries the declaration's reason code, and the box checks WSP121 to WSP127 carry theirs. Readers ignore fields they do not know; a field is only ever added within a version. The reason and error codes are closed lists: a new code is a new contract version. Contract version 1 is written by chant 0.81.0 and newer; a reader that needs it refuses output whose `contract` it doesn't know. Every code is in the one closed list of `reason-codes.ts`.",
   "oneOf": [
     {
       "$ref": "#/$defs/result"
@@ -228,12 +228,14 @@
             "box-isolation-collision",
             "box-isolation-literal",
             "box-fountain-callback-undeclared",
+            "box-intent-unknown",
+            "box-intent-unconstrained",
             "work-acceptance-unmet",
             "diagram-source-missing",
             "diagram-render-missing",
             "diagram-render-drift"
           ],
-          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP125, the box finding (#2726, #2727, #2780). For WSP117, work-acceptance-unmet (#2772). For WSP131 to WSP133, the diagram finding (#2764)."
+          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP131 to WSP133, the diagram finding (#2764)."
         }
       }
     },
@@ -304,12 +306,14 @@
             "box-isolation-collision",
             "box-isolation-literal",
             "box-fountain-callback-undeclared",
+            "box-intent-unknown",
+            "box-intent-unconstrained",
             "work-acceptance-unmet",
             "diagram-source-missing",
             "diagram-render-missing",
             "diagram-render-drift"
           ],
-          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP125, the box finding (#2726, #2727, #2780). For WSP117, work-acceptance-unmet (#2772). For WSP131 to WSP133, the diagram finding (#2764)."
+          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP131 to WSP133, the diagram finding (#2764)."
         },
         "reason": {
           "type": "string"

package/src/workspace/checks/boxes.test.ts

@@ -89,7 +89,7 @@ describe("box-credential-declared (WSP121)", () => {
   test("an env file and a shell script in the box's directory are read too; prose only for credential shapes", async () => {
     const root = repo({
       "chant.workspace.json": declaration(BROKERED),
-      "spec/.env": `FOUNTAIN_API_KEY=abc123def456\nPORT=8080\nGIT_TOKEN=\${CHUD_GIT_TOKEN}\n`,
+      "spec/.env": `FOUNTAIN_API_KEY=abc123def456\nPORT=8080\nGIT_TOKEN=\${ACME_GIT_TOKEN}\n`,
       "spec/run.sh": `#!/bin/sh\nexport GITHUB_TOKEN=${GITHUB_TOKEN}\necho "password=$GIT_TOKEN"\nTOKEN=$1\ntoken=~/box/llm-token\nSECRET=/run/secrets/x\n`,
       "spec/README.md": `Token: rotate it monthly.\n`,
       "spec/node_modules/pkg/index.js": `export const k = ${JSON.stringify(ANTHROPIC_KEY)};\n`,
@@ -156,6 +156,7 @@ describe("the box block in the declaration", () => {
     expect(d.members[0].box).toEqual({
       pointer: "/members/0/box",
       isolation: null,
+      intent: null,
       capabilities: [
         { name: "fountain", broker: "lobby", scope: ["agent", "vault"], pointer: "/members/0/box/capabilities/0" },
         { name: "inference", broker: null, scope: [], pointer: "/members/0/box/capabilities/1" },