Drift and Adoption

The lexicon reads live Managoat state on three paths, across its three kinds: environments, vaults and agents, each from its own collection. Teams, schedules and webhooks were removed upstream (managoat/managoat#2793), so nothing reads them; a declared Teammate, Schedule or Webhook fails the build with FTN025 before any read.

Drift

chant lifecycle diff --live reports each declared entity as observed present, observed absent, or not observed with a reason. A read failure is never reported as an absence, which would propose a spurious create.

This catches an out-of-band change to a locked environment, such as a UI edit that adds a secret, opens networking, or drops the marker. It also catches an agent’s model or vault allowlist edited in the console. Wire it into a scheduled watch and treat a hit as an incident.

What identifies a resource

The read looks a resource up by the same key the serializer writes it under, so a clean apply reads back as unchanged.

Kind	Key
Environment, Vault, Agent	the declared name, or the export name when there is none

Who owns what

Ownership comes from the managed-by: chant marker in a resource’s metadata. --owned claims only what carries it.

What a change costs

chant lifecycle plan annotates each pending update with its blast radius where a lexicon publishes one. This lexicon publishes none. Its verdicts were for the team-side kinds, and an Agent edit reaches only conversations created after it, so a pending update says unknown rather than guess.

Import

chant import --from adopts UI-built resources into typed files. Server-written fields are stripped to the authored shape, and every server-resolved id is put back into the vocabulary an author writes: an agent’s environment_id becomes the environment’s name. Importing a manifest file written before the team kinds were removed skips its Teammate, Schedule and Webhook documents, since there is nothing on the instance for them to declare.

Secrets do not round-trip: values are write-only upstream and secret keys are not on the typed request surface, so environments export without them and the caller is warned per environment that carried any. Re-declare them through your secret provider.

Graph

chant graph --live reconstructs the topology from one edge: an Agent runs in an Environment. Vaults get no edge, since a conversation picks its vault at start, within the agent’s allowed_vault_ids.

===