handoff: fold / TypeScript-as-Data workstream — orchestrator brief

[lex00]

Cold handoff of the fold / TypeScript-as-Data workstream. Read this end to end before doing anything. It encodes decisions already made, traps already hit, and the verification discipline that this work has repeatedly proven necessary.

Your role: orchestrator, not implementer

You dispatch subagents, interrogate them, verify their claims independently, and merge. You do not implement the features yourself. The exceptions are small, surgical fixes (a one-line cast, a doc line) and — always — measurement, which you do yourself and never delegate.

The reason is not efficiency. Every serious defect in this workstream was caught by the orchestrator re-measuring, not by the implementing agent. Two agents shipped confident, well-written reports that were wrong on their central claim. So did the previous orchestrator, three times. Verification is the job.

Model selection

• Sonnet by default. Every feature agent in this workstream ran on Sonnet and the engineering quality was consistently good — including one that correctly defended its result against a wrong orchestrator claim.
• Opus when there is risk. Use it for: anything touching the fold subset or the sandbox boundary, security-relevant work, ambiguous root-cause hunts, and any task where a wrong answer would be expensive to detect. The intermittent-hang investigation is the archetype — it burned three agents and hours of wall clock because the failure was nondeterministic and every plausible theory was wrong.
• Signal to escalate: the task requires falsifying a hypothesis rather than building to a spec.

Interrogate your agents

Do not accept a completion report at face value, and do not wait passively for one.

• Mid-flight, ask: what is your current hypothesis, what have you measured, what have you ruled out and how? Ask for measurements, not reasoning. Explicitly tell them "still characterizing" is an acceptable answer — that permission is what stops an agent inventing a confident theory to fill silence.
• Before dispatch, make them restate the acceptance criterion in their own words if the task is subtle. Two agents optimized a proxy metric because the real goal was one layer removed from what the issue said.
• When a report contains a claim that shifts blame to pre-existing code, treat that as a flag. It happened twice; both times the claim was wrong and one cheap experiment falsified it. Ask for that experiment.
• When an agent pushes back on you, take it seriously. One correctly corrected a stale baseline. Being challenged by a subagent is a signal to re-check your own numbers, not to reassert.

The goal

Fold becomes the default path for real chant applications, so that describing chant as statically folding TypeScript is simply true rather than aspirational.

Coverage percentage on the example corpus is a proxy and a weak one — the corpus is chant's own curated code, is expected to shrink, and can be moved by editing examples. That is metric-gaming; do not do it.

The real metric is loomster (/Users/alex/checkouts/intentius/loomster), a full application built on chant. Currently 13 of 55 files fold. The warden repos are secondary targets. Any decision about making fold default-on should be measured there.

Measurement traps — all five were hit, do not repeat them

1. Never symlink node_modules between checkouts. It resolves lexicon plugins to the wrong tree and produces confidently wrong numbers. This cost a full review cycle and a false accusation against a correct PR.
2. Never capture parallel output to one file. xargs -P 6 … > out.txt interleaves six builds and destroys entry boundaries. Write one file per entry. This produced a fabricated "16 file regressions" that did not exist.
3. Verify a mutation applied before trusting the result. Three separate "the guard did not fire" conclusions came from perl/sed patterns that silently did not match. Always diff and confirm before running.
4. One passing run proves nothing for anything intermittent. The hang reached CI because local runs passed. Require 5+ consecutive clean runs.
5. Never run two full suites concurrently and then interpret a timeout. Contention looks exactly like a hang.

Two message wordings exist for the same fold rejection (function call as a value and call expression as a value), and reasons embed the entire multi-line source node — so line-based grepping of fold output silently miscounts. Parse whole blocks. Tracked as #1054.

Operational safety

This machine hard-crashed early in this work: a runaway test run exhausted 64GB, the kernel jettisoned ~300 daemons, and it cost a reboot. Since then:

• Cap every run. A single test file past ~3 minutes is a bug, not slowness. Full suite baseline is ~45s local, ~7m CI.
• A repeat-until-hang harness with process/CPU/fd diagnostics lives at scratchpad/hang-hunt2.sh in the session scratch dir — reuse the pattern.
• vitest.config.ts now caps per-fork heap derived from host memory and core count, so a runaway fails as a test rather than killing the machine. Do not remove it.

Decisions already made — do not relitigate

• feat(core): fold registered plain-call intrinsics (per-intrinsic opt-in) — DECIDED: yes #1044 — registered plain-call intrinsics may fold, per-intrinsic and opt-in, default off. A closed lexicon-declared allowlist, never arbitrary calls.
• feat(core): fold registered plain-call intrinsics (per-intrinsic opt-in) — DECIDED: yes #1044 / subset.ts — give the shared subset an optional intrinsic registry (exact with one, conservatively rejecting without). Decided on outcomes: subset.ts documents that it may only ever be permissive relative to fold(), never stricter, and keeping the call case out of it would make it systematically stricter. It is also the only choice that keeps the predicate usable by downstream tooling like behold, which needs to ask "will this fold?" without running fold.
• refactor(core): ResourceDeclarable sub-interface for props/attributes — DECIDED: option 2 #1049 — ResourceDeclarable sub-interface plus a type guard, not widening Declarable. Sequence it after the in-flight work; it touches 10 of 11 lexicon serializers and must be mechanical and single-purpose.
• feat(core): build-time parameter injection — DECIDED: option 1 (unblocks loomster, folds 13/55 today) #1064 — build-time parameter injection, option 1. Distinct from the deploy-time Parameter().
• Examples may be rewritten or dropped, but only after capability work lands — most current example blockers are about to become foldable, so rewriting first is wasted effort.

State

Merged this session: #1038, #1039, #1042, #1043, #1045 (all 3 phases), #1047, #1051, #1020, #1062, #1067. Main is green.

In flight: PR #1081 (#1064, build-time parameters). CI pending at handoff. The agent self-caught a performance regression it introduced — reintroducing the cold bare-specifier resolution cost that #1020 had eliminated — and fixed it in c4707dd5. Verify with the repeat-run harness before merging; this exact regression class has bitten twice.

Loomster PR #156 and issue #155 exist for the params migration. Do not merge #156 until a chant release containing #1064 is published — its CI installs chant from npm and will fail otherwise. Releases are cut by pushing a chant-v* tag, which triggers .github/workflows/publish.yml. Current version 0.19.1. Publishing is irreversible and outward-facing: surface that decision to the maintainer rather than tagging unilaterally.

Open, in recommended order

1. feat(core): chant's own authoring helpers (phase, output, Parameter) are unfoldable — caps real-app coverage #1082 — chant's own helpers (phase(), output()) and new Parameter("String", {...}) are unfoldable, capping any real app. This is what actually blocks loomster now, not feat(core): fold registered plain-call intrinsics (per-intrinsic opt-in) — DECIDED: yes #1044 or feat(core): fold cross-file references into lexicon package exports (Azure/GCP pseudo-params, action constants) #1063.
2. feat(core): fold registered plain-call intrinsics (per-intrinsic opt-in) — DECIDED: yes #1044 — registered plain-call intrinsics. ~45 corpus entries, ~1 loomster file.
3. feat(core): fold cross-file references into lexicon package exports (Azure/GCP pseudo-params, action constants) #1063 — cross-file references into lexicon package exports (Azure, GCP namespaces). ~25 corpus entries.
4. bug(core): fold fallback reasons embed the whole source node, truncating the real error #1054 — fold diagnostics; small, and it removes a whole class of misreading.
5. refactor(core): ResourceDeclarable sub-interface for props/attributes — DECIDED: option 2 #1049 — ResourceDeclarable; mechanical, wide.

Also open from the lexicon-contract sweep: #1068, #1070, #1071, #1072 — pre-existing per-lexicon debt, now visible and gated via KNOWN_FAILURES in scripts/check-lexicons.ts.

What "done" looks like

Not a corpus percentage. Loomster folding a large majority of its files, with the remainder being patterns that should never fold — process.env reads, arrow functions, user helper functions. At that point the question of making fold default-on becomes answerable on evidence, and the positioning becomes true.

[lex00]

Session update (2026-07-26 evening)

Merged: #1081 (#1064 build-time params — after root-causing and fixing a PR-introduced sandbox-child hang: module-init fs probe under --permission killed 6 corpus children and drove the vitest worker into a tsx resolver spin; fix 7d63ee5), #1091 (#1082 foldable authoring helpers + positional foldResource), #1092 (#1049 ResourceDeclarable), #1097 (#1044 call-form intrinsics + reverse-taint-edge soundness fix), #1105 (#1063 lexicon-package export resolution), #1095/#1101/#1102 (#1068/#1070/#1071 lexicon debt), #1094/#1096 (lockfile drift + release-recipe fix). Releases: 0.20.0, 0.21.0. Loomster: #156 (params migration) and #158 (#157 sn() migration) merged.

Corpus: 21/98 → 53/98, zero drift at every step, all numbers re-measured by the orchestrator before merge. Azure 13/13, GCP 8/8, AWS 12/18.

Loomster (the real metric): 13 fold / 45 run-fallback / 58 files. Not yet a large majority, but the composition now matches the epic's end-state definition: every chant-side blocker class is gone (helpers, Parameter ctor, Ref call form, sn()); the remainder is 18 taint-held files behind 27 files of genuinely-shouldn't-fold user patterns (exported helper functions ×7, method/fn calls as values ×6, composite arrows ×5, ambient process reads ×4, misc ×5). Moving further is loomster-side refactoring (helpers → composites, the documented intended answer) plus #1108.

Open / filed this session: #1054 (in flight — reason diagnostics), #1093 (resolveCallExpression executes composite factories in-process — punctures the fold-security framing #1045 relies on; needs a decision), #1106 (EVL lint lacks the intrinsic registry — lint flags calls fold accepts), #1108 (component deploy driver never resolves build-time params — params.* = {} under chant run --components; loomster's sn() carries a documented env fallback until fixed), #1072 (needs maintainer decision: build forgejo/temporal to tier-1 vs re-scope tier-1 for non-template lexicons).

Decision candidates for fold-default-on: with azure/gcp corpora at 100% and aws at 12/18, the corpus question has shifted from capability to app-shape. Suggest re-evaluating after #1093 and #1108, since both affect what 'fold by default' would actually promise.

[lex00]

Session update 2 (2026-07-27 early)

Merged since the last update: #1109 (#1054 diagnostics), #1110 (#1106 EVL/fold convergence), #1111 (#1093 — sandbox boundary: with --sandbox, 0 project-source modules execute in the CLI process, measured across 409; per-call factory routing proven impossible with the current codec; cost 3 files / 0 entries), #1115 (#1108 driver build-params), #1123 (#1112 — fold no longer drops Outputs; the differential's blind spot was a HARNESS bug poisoning the run baseline via a stale instanceof after vi.resetModules — fixed with per-call build loading, proven by revert experiment; bedrock's isolated-retry was this bug), #1119 (#1072 full tier-1 for forgejo+temporal), #1125/#1126 (CLI hardening #1116/#1118), #1128 (#1117 root-config discovery — loomster's inert tier tags cured). Releases: 0.22.0, 0.23.0, 0.24.0 (publishing).

Corpus: 55/101, drift 0, isolated-retry 0. Loomster: composites refactor merged (#161 — whole-src 50/17 of 67), on chant 0.23.0 (#163), driver params verified live; remaining chain: bump to 0.24.0 → retire sn() env fallback → verify #162 tier tags.

Filed and open: #1113 (config trust boundary — decision), #1114 (full-fold-inside-child design parked), #1121 (output(string) emits CFN-invalid GetAtt — run path too), #1122 (isLexiconOutput instanceof guard), #1127 (systemic --flag=value drop — decision), loomster#162 (verify after 0.24.0). PR #1124 (#1104) belongs to a parallel session — not touched.

Fold-default-on: the evidence question has genuinely moved — azure/gcp corpora 100%, loomster resource-bearing src folds after composite conversion, Outputs-class drift is now differential-visible, and --sandbox gives the no-in-process-execution property. Remaining gates before proposing default-on: #1121 (correctness of what fold emits), #1113 (config execution), and a loomster re-measure on 0.24.0 with the 3-scope framing.

[lex00]

Capstone measurement — loomster main @ published chant 0.24.0, three-scope framing (commands per the #1064 reconciliation)

scope	0.20.0 baseline	now	command
real infrastructure (src minus examples)	0/40	33 fold / 17 run	chant build src --lexicon aws --fold, examples excluded
ops	1/30	1/29	chant build ops --fold (export default — deliberate subset limit; denominator question still #1107's call)
byo examples	13/17	17/0	src/examples remainder (smoke signal only)

The 17 real-src holdouts are, exhaustively: the six composites/*.ts files (the Composite(props => …) definitions themselves — the arrow IS the composite), three lib/ helper modules, six seam/output-set helper modules (all exported function declarations, zero resources — running them defines functions and nothing else), and two local/ docker files (env(), deliberately inadmissible). Every holdout is a function-definition module, not a resource declaration.

The epic's end-state sentence is now literally true on the honest scope: resource-bearing loomster source folds by a large majority (33/50), and the remainder is exactly the should-never-fold category. Remaining gates before a fold-default-on proposal: #1121 (output(string) emits CFN-invalid GetAtt — a correctness bug in what fold AND run emit), #1113 (chant.config.ts trust boundary), and #1107's ops-denominator call.

[lex00]

Session update 3 (final, 2026-07-27)

All three maintainer decisions from the gate review are implemented and merged: #1132 (#1121 — output() emits literals; undefined refs now fail loudly at build instead of shipping CFN-invalid GetAtt), #1130 (#1113 — --sandbox evaluates chant.config.ts in the child; the boundary statement now covers source AND config, with the bootstrap limit and lint.policies residual documented, the latter filed as #1131), and #1107's ops-exclusion recorded. Also merged: #1135 (#1122 — isLexiconOutput marker guard, the mechanism behind #1112's blind spot; AttrRef's remaining instanceof sites filed as #1137), #1136 (#1133 — two-pass regen; clean clones work again; note CI's workflow hardcodes lexicon order and could adopt just regen someday).

Released: 0.25.0 — the soak release named as precondition 1 of the fold-default-on proposal, filed as #1134 with the full evidence base.

Everything now open is a decision or deliberately parked: #1134 (the flip), #1131 (policies boundary — precondition 2), #1127 (CLI joined-flags), #1137 (AttrRef guard sweep — mechanical, dispatchable anytime), #1114 (full-fold-inside-child design, parked), #1116's real preview mode (future work behind the shipped hard-error), #1069 (github's two tracked entries), plus whatever #1104/#1107's parallel-session threads still hold. Loomster is fully current (0.24.0, fallbacks retired, tier tags proven) and is one dep-bump from soaking 0.25.0.

[lex00]

Session update 4 (final plan execution, 2026-07-27)

Merged: #1141 (#1127 — --flag=value works everywhere, unknown flags hard-error, #1126's special case unified away), #1142 (#1137 — eight AttrRef sites converted to duck-type guards with dual-module tests, entity-wire's deliberate instanceof kept and documented), #1147 (#1131 — lint.policies runs in a post-merge sandboxed child; the boundary statement is now total: under --sandbox, NO project-authored file executes in the CLI process — source, config, or policies; verified post-merge, 0/415 + 0/64 + 0/1 across the corpus), #1145 (#1144 — azure schema fetch pinned to a SHA after unpinned upstream drift broke cold-cache CI repo-wide; root cause was the latest-version picker landing on a disk-only Microsoft.Compute flavor, fixed via the #223 override table), behold#89 (second soak consumer on 0.25.0, zero source changes needed).

Released: 0.26.0 — carries the completed sandbox boundary (#1131), CLI hardening (#1127/#1137), and the azure pin.

#1134 status: precondition 2 (policies boundary) is DONE. Precondition 1 (soak) is running: loomster on 0.24.0→(bump pending)→, behold on 0.25.0; both should bump to 0.26.0 to soak the final boundary. Precondition 3 (migration note) goes in the flip PR itself. The flip awaits maintainer acceptance.

Filed this round: #1143 (k8s skill documents a nonexistent --url flag, now errors loudly), #1146 (docker compose-spec unpinned — azure's twin), #1148 (sandboxed child console output not forwarded + policyGate Op runs policies in-process).

Process note for future orchestrators: state 'do NOT merge your own PR' in every dispatch — #1147's agent merged unverified (it verified clean after the fact); and subagents that 'wait on CI' just idle-stop — CI-watching is the orchestrator's job.

[lex00]

Session update 5 (closing, 2026-07-28)

The epic is shipped end to end. PR #1149 merged (#1134 accepted by the maintainer): fold is the default build path, --no-fold/build.fold: false opt out. Released as 0.27.0; 0.28.0 followed with the backlog wave: #1151 (docker spec pin), #1153 (k8s doc fix), #1155 (k8s/gcp cluster binding — observation refuses the wrong ambient context), #1156 (sandbox child output forwards prefixed), #1160 (unified post-synth suppression, completing #1154). Both soak consumers (loomster #167, behold #91) are on 0.28.0 — and the loomster bump carried the decisive proof: synth output byte-identical between fold-default and --no-fold across all 7 stacks + ops manifest.

Where the epic stands vs the brief's definition of done: 'describing chant as statically folding TypeScript is simply true rather than aspirational' — it is now the default behavior, corpus 55/101 zero-drift with three self-guarding differentials, real-app resource-bearing source folding, and a measured no-project-code-in-process guarantee under --sandbox.

Open, all decision/design-tier: #1157 (policyGate Op boundary), #1089 (observation contract), #1069 (needs its 'unresolvable' note re-read), #1083 (blocker ranking), #1129 (aws spec upgrade), #1114 (parked by trigger), epics #1073/#1085/#1139/#1140/#1065/#1103. Parallel session owns #1124 (draft) and #1159 (failing on its own test).

This closes the workstream this brief was written for. Thanks to the previous orchestrator for the traps — every one of them earned its place.

[lex00]

Session update 6 (2026-07-28, backlog waves)

Waves 6–7 complete. Merged: #1163 (#1069 — github 17/17, its 'unresolvable' KNOWN_FAILURES note was a casing-cascade misdiagnosis), #1164 (#1152 half — Ref(param) stackOutputs no longer vanish silently; property-access half re-scoped on the issue), #1165 (#1129 aws spec — and #991's old failure root-caused as the pre-#1110 EVL registry gap, i.e. our own earlier fix unblocked it), #1167 (#1023 — factory INTERPRETATION: closed subset, project-owned composites fold without invocation, #1023's class now empty on the corpus, real gate filed as #1169: top-level nested-new, 63 files/22 entries), #1168 (#1089 — observation tri-state: unobserved never becomes create/delete, six lexicons on a shared conformance suite), #1170 (#1166 — environments declare endpoints; --live is self-sufficient; zero-resources safety net). Also: #990 closed (already fixed by parallel session's 016f591, verified + swept). behold: #92 (renders unobserved as its own category) + both consumers on 0.29.0.

Releases: 0.29.0 (waves 6–7). Consumers: loomster #168, behold #93.

Open now: #1169 (nested-new — the measured largest fold gate), #1152 (re-scoped property-access half), #1157 (policyGate design), #1114 (parked), epics #1014-remainder (#1015/#1076/#1086/#1087/#1088 now unblocked by the #1089 contract), #1073 k8s runtime, #998 carve, #1057 OKF, #1139/#1140/#1065. Parallel session: #1158/#1159/#1162 (rebase signal posted on #1162), #1104/#1124.

[lex00]

Session update 7 (2026-07-28, k8s runtime epic + deep observation complete)

#1014 deep-observation epic: COMPLETE. Contract #1173 (tri-state-composed, accepted baselines, normalization hooks) + all five rows: aws (reference), temporal #1175, azure #1176, k8s #1181 (managed-fields-derived — the thesis row: chant-owned always diffable, foreign-owned pruned unless declared/contested, structured fieldsV1 walked in lockstep), gcp #1182 (Config Connector reuse via core's managed-fields.ts; finding: kubectl-client-side paths have no chant manager and the contested rule carries the semantics regardless).

#1073 k8s runtime epic: core children DONE. #1177 (#1074 typed client — 184-op generated surface with anti-skew gate, CRDs via cluster discovery, 20-kind map dead, build-path isolation proven by reachability sweep + 32 recorded builds), #1178 (#1075 SSA — chant: field manager, conflict surface naming managers/paths, per-call-only force, full-corpus sha256 byte-identity), #1180 (#1077 — ownerReferences → runtime tier, conservative on unreadable chains, marker-carrying runtime children never delete). Remaining: #1078 (in flight), #1079, behold parity #84-88.

Filed: #1179 (k3d live prune E2E — the destructive path deserves live pinning before owned-only deletes get leaned on).

RELEASE TRAIN HELD: 0.31.0 published core only — @intentius/chant-k8s-client is a NEW package and trusted publishing can't first-publish (ENEEDAUTH). Maintainer action required: one manual npm publish --access public from packages/k8s-client + add the trusted-publisher record on npmjs.com, then re-run publish.yml. Everything merged since 0.30.0 (both epics above) ships the moment that lands; behold's parity wave is blocked behind it (it consumes published chant).