Serialization

The fountain lexicon serializes to fountain’s own manifest YAML — nothing else. fountainApply reads that same YAML, so there is no sidecar to keep in sync with it.

Manifests

Each declared resource becomes a manifest document with apiVersion: fountain.dev/v1:

apiVersion: fountain.dev/v1
kind: Environment
metadata:
  name: team-env
spec:
  networking_type: limited
  networking_config:
    allowed_hosts:
      - github.com

Documents come out in dependency order — Environment, Vault, Agent — whatever order the file declared them in, so the manifest reads the way it applies. Within one kind, declaration order is kept.

metadata.name is the resource’s declared name, not the name of the variable you exported it as. fountain reconciles by that name, so renaming the variable does not orphan the resource. An entity declared without a name falls back to the export name. The name appears only in metadata; it is not repeated under spec, so the apply request carries one name per resource.

The output is ejectable — fountain apply -f accepts it verbatim, so adopting chant here does not trap the manifests behind chant.

Applying the manifest

fountainApply parses this same YAML and sends it to fountain’s bulk POST /api/apply endpoint in one request — the server reconciles by name, Environment then Vault then Agent, and resolves an agent’s environment reference itself, against the manifest or the tenant’s existing environments. See the Ops page for the activity’s own behavior (prune, secrets, failure reporting).

A Teammate, Schedule or Webhook is never written to the manifest: Managoat removed them, and FTN025 fails the build that declares one.

Ownership

Resources carrying metadata."managed-by": chant are chant-owned. That marker gates the opt-in prune (fountainApply deletes only owned resources absent from the manifest) and the --owned filter on drift and live export. Set it on every declaration you want reconciled.

Secrets

spec.secrets is authored as an ordered {key, value}[], same as any other typed prop. fountainApply converts it to the {KEY: value} map fountain’s bulk apply expects on the wire; the server upserts it through the encrypted envelope path. Values are write-only upstream, so this is upsert-always — a changed value cannot be detected, only overwritten.