docs(lexicons): the fountain, k8s, cedar, github, gitlab, terraform, helm, k3d, k3s and aws docs and skills describe the current run mechanism (#2194)

[lex00]

Closes #2194.

Sub-issue 3 of #2191: the lexicon docs pages, skills and user-facing strings that still teach the deleted hosting-runtime model. Skills are loaded by agents on demand, so a stale skill is an instruction rather than a comment. Nothing here changes behaviour; the diff is prose, docstrings, one LSP completion table, two skills, one test assertion and the regenerated doc twins.

fountain

The second-apply claim is now scoped to the three kinds it is true of. src/op/activities/fountain-apply.ts:120-131 says bulk apply reports created or updated and nothing else, so an Environment that changed in no way still comes back updated; the per-route reconcilers below it (:302-310, Teammate, Schedule and Webhook) read live state and compare before they write. docs/pages/steward.mdx:103, docs/pages/composites.mdx:71 and src/skills/chant-fountain-ops.md:78 all say that now instead of "makes no writes".

docs/pages/steward.mdx:13 said "chant needs six things" over a seven-row table; it says seven. docs/pages/composites.mdx:71 said chant build "emits all four" over a list of six kinds, and src/composites/steward.ts:44 constructs Environment, Vault, Agent, Teammate, Schedule and Webhook; it says six.

src/deep-observe.ts:29 justified passing the payload through as "the AWS situation, not temporal's". The comparison had nothing left on the other side, so the sentence states the fact on its own.

docs/pages/profiles.mdx and runtime.mdx:40 and line 89 of the ops skill are untouched: they belong to #2192.

k8s

src/skills/chant-k8s-argo.md told the reader to "orchestrate it in Temporal" and to reach for waitForArgoSync "(temporal lexicon, argoSync profile)". Both attributions were wrong: waitForArgoSync is exported from this lexicon at src/op/activities/index.ts:30, and argoSync is core's, at packages/core/src/op/activity-profiles.ts:92. The section is rewritten as "Splitting a deploy between Argo and an Op" and teaches the current split: Argo owns the sync, the Op owns the ordering and the gates (packages/core/src/op/local-executor.ts:7-16: a run that reaches an unapproved gate records the pending fact, ends gated and exits 3, and chant approve <op> <gate> lets the next run through), and CI runs the Op on the cadence its schedule names. The example is an activity("waitForArgoSync", …, "argoSync") step, since activity() takes the profile as its third argument (packages/core/src/op/builders.ts:76-82). The three-layer table at the top of the skill and the skill description in src/plugin.ts:635 follow.

docs/pages/argo-composites.mdx:15 is now "The three-layer model: Argo, an Op and CI", and its middle row names a chant Op rather than a deleted runtime. Both inbound anchors move with it in this commit: docs/pages/crd-classes.mdx:424 now links #the-three-layer-model-argo-an-op-and-ci, and docs/pages/flux-composites.mdx:94 names the split the new way. The new slug follows the same github-slugger rule the existing cross-page anchor #the-accepted-baseline---update-baseline demonstrates (lowercase, punctuation dropped, spaces to hyphens) against #### The accepted baseline — --update-baseline`` in docs/src/content/docs/concepts/drift-detection.mdx:88.

docs/pages/api-client.mdx:21 said "workers register activities by name". The registry keys the activity map by export name (packages/core/src/op/activity-registry.ts:26-32, 47-64) and an Op step resolves its fn string against that map, which is the real reason the export cannot be renamed. :82 put nativeApply "in the Temporal lexicon"; it is packages/core/src/op/activities/apply.ts:480.

src/op/activities/wait-for-ready.ts:338 and kubectl.ts:6,380 promised heartbeat timeouts. ActivityProfile (packages/core/src/op/activity-profiles.ts:18-37) has only timeout and retry, and its header (lines 10-15) says heartbeatTimeout deliberately did not come along. Each now states what its profile actually gives it: k8sWait marking ReadinessFailedError non-retryable, longInfra's 20m timeout and three attempts backing off from 30s.

src/deep-observe-hooks.ts:73 cited TEMPORAL_SCHEDULE_DEFAULTS, which exists nowhere; the reason for listing spec.strategy whole is stated directly. :64 and src/deep-observe.ts:12,124 cited "AWS, Azure and Temporal's rows"; they name AWS_SERVICE_DEFAULTS and AZURE_SERVICE_DEFAULTS, which exist. src/config.ts:6 offered temporal.profiles.<env> as a live peer example; AWS and Azure are peers enough.

src/op/activities/argo.test.ts:8 said profiles "live centrally in the temporal lexicon" above an import from @intentius/chant/op/activity-profiles; :69 named a test "60s heartbeat" while asserting only the timeout. Both corrected.

The worker-loads-it-cheaply justifications in this lexicon's activity files (src/op/activities/index.ts:16-18, argo.ts:19, wait-for-ready.ts:9, kubectl.test.ts:4, plus src/export-resources.ts:31 and src/api/sweep-types.ts:13, which make the same argument) now name loadActivities, which imports the module by subpath at run time.

src/composites/operator-stack.ts:214 and its TMP014 citations are left alone: they belong to #2192 and #2195.

cedar

src/skills/chant-cedar-dogwood.md:285 and docs/pages/dogwood-replay.mdx:70-73 said scheduling was "a project-side TemporalSchedule pairing". #2131's fix landed in src/dogwood/replay-op.ts:17-31: the cadence is schedule on the Op, OpSchedule in packages/core/src/op/types.ts:49-59, which lands as { cron, overlap: "skip" } (replay-op.ts:238). Both places now teach that, with the worked declaration on the docs page.

src/op/activities/index.ts:13-14, src/dogwood/replay-activity.ts:8-10 and src/index.ts:118 claimed independence from a package that no longer exists; they now say what is true, that the activity imports no runtime of its own and the local executor calls it directly.

github and gitlab

lexicons/github/docs/pages/lint-rules.mdx:191 and lexicons/gitlab/docs/pages/lint-rules.mdx:169 sent readers to "the temporal lexicon" for WorkflowAuditOp and PipelineAuditOp. Both are packages/core/src/op/composites/workflow-audit-op.ts and pipeline-audit-op.ts, exported through packages/core/src/op/index.ts:23.

lexicons/github/src/components/generate-op-pipeline.ts:7-10 and lexicons/gitlab/src/components/generate-op-pipeline.ts:7-9 described themselves as the alternative to a TemporalSchedule. What they read is OpSchedule (packages/core/src/op/types.ts:49), so each names the field and says it is the reader that turns it into a cron.

lexicons/gitlab/src/op/activities/index.ts:4 and gitlab.ts:19 promised heartbeat semantics; corrected against ActivityProfile the same way as k8s.

terraform

src/lsp/option-keys.ts:43 offered a taskQueue completion for a field that does not exist: TerraformApplyOpConfig and TerraformAdoptOpConfig have no such key, and terraform-apply-op.test.ts:206 and terraform-adopt-op.test.ts:168 assert not.toHaveProperty("taskQueue"). The completion is gone, as are both taskQueue rows in docs/pages/ops.mdx. src/lsp/completions.test.ts:94 asserted the completion existed; it now asserts gateTimeout is offered and taskQueue is not.

The name row said the name was "the default task queue and gate signal suffix". There is no task queue, and what the name actually feeds is signalName, whose default is approve-<name>. Both docs tables, the LSP detail string and the two composites' own docstrings (terraform-apply-op.ts:99, terraform-adopt-op.ts:92, the source of the other three) say that instead.

helm, k3d, k3s, aws

The heartbeat promises in lexicons/helm/src/op/activities/index.ts:3-4, helm.ts:397, lexicons/k3d/src/op/activities/k3d.ts:141 and lexicons/k3s/src/op/activities/k3s.ts:114-115 are replaced by what longInfra really is. safeHeartbeat calls and the setInterval loops are untouched; their removal is #2195's.

The "a Temporal worker loads them cheaply" and "re-exported from the temporal Op-authoring barrel" justifications in lexicons/aws/src/agentcore/trace-fetch.ts:9-10, lexicons/k3d/src/op/activities/index.ts:11-13, lexicons/k3s/src/op/activities/index.ts:15-18 and lexicons/helm/src/op/activities/index.ts:6-7 name @intentius/chant/op for the builders and loadActivities (packages/core/src/op/activity-registry.ts) for the run-time import.

lexicons/aws/src/op/activities/floci.ts:104-105 explained its env injection by contrast with "a distributed Temporal worker"; it now says the local executor runs every step of a run in this process, which is what makes the injection work. lexicons/aws/docs/pages/policy-validation.mdx:56 said a violation "fails the workflow" nine lines above a mention of the local executor; it fails the run.

Doc twins

Only docs/pages/ sources were edited; each edited page's twin was regenerated with its lexicon's npm run docs (fountain, k8s, cedar, github, gitlab, terraform, aws). Eleven pages were edited and eleven twins changed, one for one: no twin here without a source change of the same basename, and no edited source without its twin regenerated. Per page, the twin's added and removed lines are identical to its source's, verified mechanically.

One twin carries more than its source's diff. lexicons/k8s/docs/src/content/docs/crd-classes.mdx gains the "A kind with no generated class: k8sManifest" section, which docs/pages/crd-classes.mdx:473 already carried and the twin was missing. That is source-derived, so it comes along with the anchor fix.

Regenerating also rewrote six twins whose sources this PR does not touch: lexicons/aws/docs/src/content/docs/index.mdx and intrinsics.mdx, and index.mdx under cedar, github, gitlab and k8s. Those are not in this PR; they were restored to main in the second commit. The regeneration was not faithful, because the generator reads each lexicon's local dist/manifest.json and those manifests are stale relative to src/ in a working checkout: lexicons/aws/src/intrinsics.ts defines Fn::Equals, Fn::And, Fn::Or and Fn::Not (#2068), thirteen intrinsics, while lexicons/aws/dist/manifest.json is version 0.56.0 and lists nine; lexicons/github/dist/manifest.json is dated Aug 25 at version 0.46.0 and lists one where the committed twin says nineteen. CI runs prepack fresh, so what those pages should say is not knowable from here, and writing a locally regenerated number would swap one wrong value for another. They need a fresh prepack and their own PR, the way ffb1bd6 handled #1980. Filed as #2199.

Acceptance

• Every page, skill and string listed describes the current mechanism, with the core file that proves it named above per item.
• The second-apply claim is scoped to the three per-route kinds in all three fountain places: docs/pages/steward.mdx:103, docs/pages/composites.mdx:71, src/skills/chant-fountain-ops.md:78.
• The k8s argo skill section and the argo-composites heading are rewritten and both inbound anchors resolve. crd-classes.mdx:424 and flux-composites.mdx:94 are in this commit; the new slug follows the same slugifier rule the existing #the-accepted-baseline---update-baseline link demonstrates.
• The cedar skill and replay page teach schedule on the Op, quoting the shape replay-op.ts:238 builds.
• Terraform's taskQueue rows and completion are gone and the name row no longer mentions a task queue or signal suffix. rg -n "taskQueue|task queue" lexicons/terraform now returns only the two tests that assert the field's absence.
• No activity file promises a heartbeat. Alongside the four the issue named, src/op/activities/wait-for-ready.ts:274, argo.ts:39,116 and kubectl.ts:61 described the same non-existent protocol in passing and were corrected too. What rg -in "heartbeat" lexicons --glob '!**/dist/**' --glob '!**/generated/**' still finds is code rather than a promise: the safeHeartbeat call sites and their setInterval loops, including terraform's withHeartbeat wrapper, all of which sweep: search-attribute and workflow vocabulary, safeHeartbeat and its forty callers, and the other dead code #2116 left #2195 deletes; fountain's SSE keep-alive comments, which are a real fountain protocol; and the cedar read_heartbeat_since_login_30s example policy name.
• Every doc twin of an edited page matches its source, regenerated with each lexicon's npm run docs, and each twin's diff mirrors its source's. Six further twins are stale on main; regenerating them here would have written numbers from a stale local dist/manifest.json, so they are left alone and filed as docs: six lexicon doc twins are stale on main; regenerate them from a fresh prepack #2199.

Remaining temporal hits

rg -in "temporal" lexicons --glob '!**/generated/**' --glob '!**/dist/**' --glob '!**/node_modules/**' --glob '!lexicons/cedar/**', with why each stays:

• lexicons/fountain/docs/pages/profiles.mdx:7,43,76 and its twin at :11,47,80. Owned by core+fountain: chant approve drops --approver, approve --on fountain never re-applies, --profile does not exist, and four more behaviour leftovers from #2116 #2192 with the --profile flag itself.
• lexicons/fountain/src/lint/post-synth/ftn020-schedule-cron-syntax.ts:19, TMP010 provenance for the inlined cron check. Not on this issue's list; the rule-id sweep is sweep: search-attribute and workflow vocabulary, safeHeartbeat and its forty callers, and the other dead code #2116 left #2195's.
• lexicons/{aws,azure,gcp,k3d,k3s}/src/op/builders.ts:4 (and aws:6), the barrel justification. Explicitly sweep: search-attribute and workflow vocabulary, safeHeartbeat and its forty callers, and the other dead code #2116 left #2195's.
• lexicons/azure/src/deep-observe.ts:342, "AWS's or temporal's readers". azure is outside this issue's lexicon list; same class as the k8s ones, for sweep: search-attribute and workflow vocabulary, safeHeartbeat and its forty callers, and the other dead code #2116 left #2195's sweep.
• lexicons/{github,gitlab}/src/components/generate-pipeline.test.ts and generate-op-pipeline.test.ts, --temporal as the sample run command. Named in the epic as its own item; the bridge flag stays until 0.58.0.
• lexicons/aws/src/codegen/docs.ts:117 and lexicons/aws/src/op/activities/aws-apply.ts:262, provenance notes about where something used to live. Not on this issue's list.
• lexicons/aws/src/agentcore/trace-fetch.ts:46,196,208,418, trace-fetch.test.ts:70, trace-render.test.ts:235. "Temporal window" and "temporal predicate" in the Cedar sense: domain vocabulary, not the runtime.
• lexicons/k8s/src/composites/operator-stack.ts:10,33. Line 10 quotes issue chant operator: native durable ticks without Temporal #1485's title verbatim; the file is core+fountain: chant approve drops --approver, approve --on fountain never re-applies, --profile does not exist, and four more behaviour leftovers from #2116 #2192's and sweep: search-attribute and workflow vocabulary, safeHeartbeat and its forty callers, and the other dead code #2116 left #2195's.
• lexicons/k8s/src/lint/post-synth/wk8301.ts:8 and post-synth.test.ts:942, "a queue/Temporal worker" as an example of a container with no port. A workload example, deliberately kept.

Gates

All run from the worktree root.

• npx vitest run lexicons/fountain lexicons/k8s lexicons/cedar lexicons/github lexicons/gitlab lexicons/terraform lexicons/helm lexicons/k3d lexicons/k3s lexicons/aws: 572 files passed, 2 skipped; 7447 tests passed, 29 skipped.
• npx vitest run packages lexicons: 1174 files passed, 3 skipped; 15674 tests passed, 30 skipped. An earlier run of this suite concurrently with the targeted one reported 9 failures, all of them 20s timeouts or SIGTERM in packages/core/src/cli/{component-,}security-boundary.test.ts, op/discover.test.ts, cli/mcp/server.test.ts and cli/commands/audit.test.ts; every one passes in isolation and in the uncontended full run, so they are load flakes rather than regressions.
• npx tsc --noEmit: clean.
• npx tsx scripts/typecheck.ts: 37 known failures, no regressions (37 baselined).
• npx tsx scripts/check-lexicons.ts: every lexicon 23/23 tier-1 checks passing, no untracked tier-1 failures.
• node scripts/lint-docs-sentences.mjs: 4111 gated findings, no regressions.
• node scripts/check-docs-diataxis.mjs: no failures (21 tutorial, 52 how-to, 58 reference, 34 explanation).

🤖 Generated with Claude Code

https://claude.ai/code/session_0148a4dPTErCBpmNy7J7933f