feat: adopt chant 0.55.0's live-denominator removalDeltaCap

Bump @intentius/chant and @intentius/chant-lexicon-github to ^0.55.0 and
delete the warden-local removalLiveCap guardrail: chant's removalDeltaCap
now takes a managedTotal live denominator (chant#2067), so runGuardrails
passes the countLiveManaged value straight through as
{ maxFraction, managedTotal }. The runner's diff→guardrails sequencing
capture and its lock test are unchanged, as are adminFloor /
requiredAdmins / requireSelf and their member-visibility gating. Tests
now assert the same behavioral cases through the upstream function, and
the docs no longer describe the cap as warden-local. Action bundle
rebuilt for the dependency bump.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RErsihpfppjyZ37vQuRwKb

Author: lex00

CYCLES.md

@@ -20,11 +20,11 @@ Shared behavior, so it isn't repeated thirteen times:
   resource types; see [POLICY.md](POLICY.md)) marks resources owned; a
   programmatic `diffOptions.isOwned` predicate overrides the declaration when
   supplied.
-- **Guardrails before apply.** `removalLiveCap` refuses an apply whose
+- **Guardrails before apply.** `removalDeltaCap` refuses an apply whose
   deletes exceed 25% of the live managed entries in the collections the
   policy declares; with nothing live to measure against it falls back to
-  chant's plan-relative `removalDeltaCap` (deletes over the plan's updates
-  plus deletes). `adminFloor` (at least 2 org admins must remain) always
+  its plan-relative denominator (deletes over the plan's updates plus
+  deletes). `adminFloor` (at least 2 org admins must remain) always
   runs too; `requiredAdmins` and `requireSelf` run when configured
   programmatically. `resolveRenames` collapses a `previously`-marked
   delete+create pair into an update first, so a rename is not counted as a
@@ -114,7 +114,7 @@ who is an admin.
 - Member entries are keyed by `login`. Removal of an undeclared live member
   requires marking `member` owned (`owned: true` or `owned: [member, ...]`
   on the org). Removals, once enabled, run the member-aware guardrails in
-  full (`adminFloor`, `requiredAdmins`, `requireSelf`, `removalLiveCap`);
+  full (`adminFloor`, `requiredAdmins`, `requireSelf`, `removalDeltaCap`);
   `requireSelf` means the managing identity must remain an org admin rather
   than a plain member.
 - The schema does not model outside collaborators (a per-repo concept), so
@@ -140,7 +140,7 @@ Reconciles the team tree, team membership/roles, and team-to-repo permissions
   disturbed. Deleting a team, team member, or team repo requires ownership.
 - Rename: a `previously` slug makes the guardrail layer collapse
   `delete(old)` + `create(new)` into one update, so a rename doesn't count
-  toward `removalLiveCap`. When teams are not owned the delete half is
+  toward `removalDeltaCap`. When teams are not owned the delete half is
   never emitted anyway, so a rename appears purely as a create and the old
   team is left in place. The runner does not yet perform an atomic
   GitHub-side rename.
@@ -256,7 +256,7 @@ expired, over-max-lifetime, or idle grants lose their org access.
   `POST /orgs/{org}/personal-access-tokens/{pat_id}`, which revokes the
   grant's org access. Violations are emitted as updates ("revoke org
   access") on one `token-grant` entry per grant, rather than deletes, so a
-  routine sweep does not trip `removalLiveCap`.
+  routine sweep does not trip `removalDeltaCap`.
 - Callable only by a GitHub App; a PAT cannot drive this cycle. The API
   cannot create or rotate a user's PAT, so revoking org access is the
   enforcement lever. The expiry check uses GitHub's own `expired` flag;

POLICY.md

@@ -20,7 +20,7 @@ It is the one file you must author.
   resource collection it reconciles there; `owned: [team, repo, ...]` limits
   ownership to the listed change-set resource types. A programmatic
   `diffOptions.isOwned` predicate, when supplied, overrides the declaration.
-  Owned deletes still run the guardrails (`removalLiveCap` etc.) before any
+  Owned deletes still run the guardrails (`removalDeltaCap` etc.) before any
   apply.
 
 One authoring note: the CLI ships a small built-in YAML reader that handles
@@ -418,7 +418,7 @@ only approve or deny; the requested repo scope cannot be changed.
 
 ## What the policy does not declare
 
-- **Guardrail thresholds.** `removalLiveCap` (default: deletes capped at 25%
+- **Guardrail thresholds.** `removalDeltaCap` (default: deletes capped at 25%
   of the live managed entries in the collections the policy declares),
   `adminFloor` (default: at least 2 org
   admins must remain), `requiredAdmins`, and `requireSelf` are configured

README.md

@@ -241,7 +241,7 @@ Before any apply, warden runs safety checks and refuses dangerous changes
 
 | Guardrail | What it refuses or protects |
 |---|---|
-| `removalLiveCap` | Refuses an apply whose deletes exceed 25% of the live managed entries in the collections the policy declares (typo protection). With nothing live to measure against it falls back to chant's plan-relative `removalDeltaCap`. |
+| `removalDeltaCap` | Refuses an apply whose deletes exceed 25% of the live managed entries in the collections the policy declares (typo protection). With nothing live to measure against it falls back to the plan-relative denominator. |
 | `adminFloor` | Refuses if fewer than 2 org admins would remain. |
 | `requiredAdmins` / `requireSelf` | Keep named admins (and the managing identity) from being removed. |
 | rename-without-loss | A `previously` alias collapses a delete+create into an update, so a rename doesn't count as a deletion. |
@@ -337,7 +337,7 @@ The hermetic compose smoke drives every cycle's full loop against a stateful
 mock GitHub (dependency-free node, run via docker compose or directly). Each
 cycle applies its policy slice and then re-plans to convergence, with
 out-of-band drift corrected and deletes exercised under `owned`. The suite
-also trips the `removalLiveCap` block and walks the permission-gated 403 NOTE
+also trips the `removalDeltaCap` block and walks the permission-gated 403 NOTE
 path, and auth runs the real App JWT and installation-token flow against the
 mock.
 

action/index.mjs

@@ -349,6 +349,7 @@ function diffCollection(params2) {
       out.push({ kind: "delete", resourceType, key: entryKey, before: l });
     }
   }
+  return live.size;
 }
 function summarizeChangeSet(cs) {
   const counts = { create: 0, update: 0, delete: 0 };
@@ -419,13 +420,24 @@ function resolveRenames(changeSet) {
   const filteredEntries = changeSet.entries.filter(
     (e) => !(e.kind === "delete" && resolvedDeletes.has(e.key)) && !(e.kind === "create" && resolvedCreates.has(e.key))
   );
-  return { org: changeSet.org, entries: [...filteredEntries, ...syntheticUpdates] };
+  return { ...changeSet, entries: [...filteredEntries, ...syntheticUpdates] };
 }
 function removalDeltaCap(changeSet, opts = {}) {
   const maxFraction = opts.maxFraction ?? 0.25;
+  const deletes = changeSet.entries.filter((e) => e.kind === "delete").length;
+  const managedTotal = opts.managedTotal ?? changeSet.managedCount;
+  if (managedTotal !== void 0 && managedTotal > 0) {
+    const fraction2 = deletes / managedTotal;
+    if (fraction2 > maxFraction) {
+      return {
+        guardrail: "removalDeltaCap",
+        message: `${deletes} of ${managedTotal} live managed entries (${Math.round(fraction2 * 100)}%) would be deleted, exceeding the ${Math.round(maxFraction * 100)}% threshold. Check for typos in config or raise maxFraction to proceed.`
+      };
+    }
+    return null;
+  }
   const total = changeSet.entries.filter((e) => e.kind !== "create").length;
   if (total === 0) return null;
-  const deletes = changeSet.entries.filter((e) => e.kind === "delete").length;
   const fraction = deletes / total;
   if (fraction > maxFraction) {
     return {
@@ -1054,19 +1066,6 @@ var init_diff = __esm({
 });
 
 // src/reconcile/guardrails.ts
-function removalLiveCap(changeSet, liveManagedTotal, opts = {}) {
-  if (liveManagedTotal === 0) return removalDeltaCap(changeSet, opts);
-  const maxFraction = opts.maxFraction ?? 0.25;
-  const deletes = changeSet.entries.filter((e) => e.kind === "delete").length;
-  const fraction = deletes / liveManagedTotal;
-  if (liveManagedTotal > 0 && fraction > maxFraction) {
-    return {
-      guardrail: "removalLiveCap",
-      message: `${deletes} of ${liveManagedTotal} live managed entries (${Math.round(fraction * 100)}%) would be deleted, exceeding the ${Math.round(maxFraction * 100)}% threshold. Check for typos in config or raise maxFraction to proceed.`
-    };
-  }
-  return null;
-}
 function adminFloor(changeSet, live, opts = {}) {
   const min = opts.min ?? 2;
   const liveMembers = live.members ?? [];
@@ -1124,11 +1123,10 @@ function requireSelf(changeSet, live, opts) {
 function runGuardrails(changeSet, live, config2 = {}, liveManagedTotal = 0) {
   const resolved = resolveRenames(changeSet);
   const diagnostics = [];
-  const cap = removalLiveCap(
-    resolved,
-    liveManagedTotal,
-    config2.removalLiveCap ?? config2.removalDeltaCap
-  );
+  const cap = removalDeltaCap(resolved, {
+    maxFraction: config2.removalDeltaCap?.maxFraction,
+    managedTotal: liveManagedTotal > 0 ? liveManagedTotal : config2.removalDeltaCap?.managedTotal
+  });
   if (cap) diagnostics.push(cap);
   const memberAware = live.members !== void 0 || resolved.entries.some((e) => e.resourceType === "member");
   if (memberAware) {
@@ -238803,8 +238801,8 @@ var package_default = {
     prepublishOnly: "npm run build"
   },
   dependencies: {
-    "@intentius/chant": "^0.54.3",
-    "@intentius/chant-lexicon-github": "^0.54.3"
+    "@intentius/chant": "^0.55.0",
+    "@intentius/chant-lexicon-github": "^0.55.0"
   },
   devDependencies: {
     "@types/libsodium-wrappers": "^0.7.14",

e2e/README.md

@@ -52,7 +52,7 @@ auth.
 
 "yes" means exercised and asserted by the smoke; "n/a" means the behavior
 does not exist for that cycle (the reason is noted). Deletes run under
-`owned`, with the `removalLiveCap` arithmetic spelled out in each test.
+`owned`, with the `removalDeltaCap` arithmetic spelled out in each test.
 
 | Cycle | Read | Apply | Converge | Drift | Delete via `owned` | Gated-read NOTE |
 |---|---|---|---|---|---|---|
@@ -74,7 +74,7 @@ Cross-cutting behaviors, also in the smoke:
 
 - Read-only fetchLive is asserted for all 13 cycles before any apply.
 - The guardrail block path: shrinking the member policy to drop 1 of 3 live
-  members trips `removalLiveCap` (33% over the 25% cap), blocks the apply,
+  members trips `removalDeltaCap` (33% over the 25% cap), blocks the apply,
   and leaves the member in place.
 - The permission-gated 403 NOTE path: the mock 403s the org-variables read;
   the cycle plans optimistically and the plan carries the

e2e/smoke.e2e.test.ts

@@ -15,7 +15,7 @@
  * See e2e/README.md for the cycle-by-cycle table. Per cycle: apply from a
  * policy, re-run to a converged (empty) plan, mutate out-of-band and re-run to
  * correct the drift, and (where a delete is plannable) a real delete under
- * `owned`. Plus the guardrail-block path (removalLiveCap trip on a
+ * `owned`. Plus the guardrail-block path (removalDeltaCap trip on a
  * mass-removal policy edit) and the permission-gated 403 NOTE path (the mock
  * 403s one slice). Auth goes through the real App flow: a generated RSA key
  * signs the App JWT, the mock's /app/installations/{id}/access_tokens mints
@@ -353,7 +353,7 @@ suite("github-warden smoke (mock GitHub)", () => {
       expect(members.body.map((m) => m.login)).not.toContain("stray");
     });
 
-    it("removalLiveCap blocks dropping 1 of 3 members from the policy (33% > 25%)", async () => {
+    it("removalDeltaCap blocks dropping 1 of 3 members from the policy (33% > 25%)", async () => {
       const shrunk: OrgConfig = {
         owned: ["member"],
         members: POLICY.members!.filter((m) => m.login !== "bob"),
@@ -363,7 +363,7 @@ suite("github-warden smoke (mock GitHub)", () => {
       expect(cr.guardrailBlocked).toBe(true);
       expect(cr.guardrails.ok).toBe(false);
       if (!cr.guardrails.ok) {
-        expect(cr.guardrails.diagnostics[0]!.guardrail).toBe("removalLiveCap");
+        expect(cr.guardrails.diagnostics[0]!.guardrail).toBe("removalDeltaCap");
         expect(cr.guardrails.diagnostics[0]!.message).toContain("1 of 3 live managed entries");
       }
       // Nothing was removed.
@@ -567,7 +567,7 @@ suite("github-warden smoke (mock GitHub)", () => {
       // = 33% — over the default 25% cap, so raise it for the deliberate cleanup.
       const cr = only(
         await reconcile(["environments"], cfg, {
-          guardrails: { removalLiveCap: { maxFraction: 0.5 } },
+          guardrails: { removalDeltaCap: { maxFraction: 0.5 } },
         }),
       );
       expect(cr.counts.delete).toBe(1);

package-lock.json

@@ -35,8 +35,8 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@intentius/chant": "^0.54.3",
-    "@intentius/chant-lexicon-github": "^0.54.3"
+    "@intentius/chant": "^0.55.0",
+    "@intentius/chant-lexicon-github": "^0.55.0"
   },
   "devDependencies": {
     "@types/libsodium-wrappers": "^0.7.14",

package.json

@@ -26,7 +26,7 @@
  * default runner wiring (no predicate) this cycle only ADDS or re-roles
  * declared members and never removes anyone — the safe default. When removals
  * ARE enabled, the `adminFloor`, `requiredAdmins`, `requireSelf`, and
- * `removalLiveCap` guardrails (all member-aware) gate the apply.
+ * `removalDeltaCap` guardrails gate the apply.
  */
 
 import type { AppClient } from "../auth/app-client.js";

src/cycles/membership.ts

@@ -35,7 +35,7 @@
  * A `TeamConfig.previously` slug marks a rename. Its effect is at the GUARDRAIL
  * layer: `resolveRenames` collapses a `delete(previously)` + `create(slug)`
  * pair into a single update so the rename does not count against
- * `removalLiveCap` (a rename is not a mass-deletion). The delete half only
+ * `removalDeltaCap` (a rename is not a mass-deletion). The delete half only
  * exists when the old slug is owned (`DiffOptions.isOwned`); with the safe
  * default (no ownership predicate) a renamed team is emitted purely as a
  * create, leaving the old team in place — nothing is deleted, so nothing is