Site: releases as compile targets, and chant audit

The pipeline card and the CI service are reframed around the release as
a compile target, linking the post. The tools page gains an Audit
section under chant, and the writing page leads with the post.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EFsqVDRNABeAMP8zhQawtz

Author: lex00

content/_index.md

@@ -11,10 +11,10 @@ problems:
     body: "The program makes the call and never holds the credential."
     link: "Agents against real infrastructure"
     href: "/work/#agents-against-real-infrastructure"
-  - title: "A pipeline per platform, by hand"
-    body: "One typed project generates the pipeline for GitHub, GitLab or Forgejo, with the approval gate as a commit."
-    link: "Generated CI"
-    href: "/work/#generated-ci-with-gates"
+  - title: "A pipeline per component, drifting"
+    body: "Describe each component as data and the release compiles from it. Adding one is a declaration, and the CI is generated from the same declarations."
+    link: "Releases as compile targets"
+    href: "/work/#releases-as-compile-targets"
 ---
 
 <div class="tool">

content/tools.md

@@ -11,10 +11,14 @@ OpenTofu plus identity hooks. Each AWS resource carries its identity as two tags
 
 ## chant
 
-A type system for operations. Infrastructure in a statically evaluable subset of TypeScript, folded to the platform's own spec with no execution. It deploys to the three big clouds and Kubernetes from one project. Seventeen lexicons in all, generated pipelines, and gates that are commits, under Apache 2.0.
+A type system for operations. Infrastructure in a statically evaluable subset of TypeScript, folded to the platform's own spec with no execution. It deploys to the three big clouds and Kubernetes from one project. A release is a compile target: components described as data, the deploy order from the dependency graph, and the CI generated from the same declarations. Seventeen lexicons in all, under Apache 2.0.
 
 [Docs](https://intentius.io/chant/) · [Source](https://github.com/INTENTIUS/chant) · [The subset as a spec](https://github.com/INTENTIUS/typescript-as-data) · [Compare](/compare/chant-cdk-and-pulumi/)
 
+### Audit
+
+`chant audit` reads an existing repository, with no chant project required, and runs a few hundred security and correctness checks over its pipelines and infrastructure config. It reads the CI workflows for all three platforms and the Kubernetes and Helm config beside them. It reads Dockerfiles and Terraform roots. It reads the cloud templates for AWS, Azure and GCP, and it scans every file for secrets. Findings that are safe to fix mechanically come back as ready-to-apply diffs. Point it at a local path or a public URL, or use [blacklight](https://blacklight.intentius.io), which is the same audit hosted.
+
 ### Agents
 
 `chant init` writes the MCP server into your editor's config and installs a skill per platform. Over MCP an agent can build and lint the project or search it. It can take a lifecycle snapshot and diff it against live. It can run an Op and approve or report on one. The GitHub, GitLab and Forgejo lexicons add read-only tools that answer questions about a pipeline before it runs: what it does, what it pulls in and whether that is pinned, what re-runs if a job changes. An agent meets a gate the same way a person does.

content/work/_index.md

@@ -23,9 +23,11 @@ We take one operation you run by hand and write it as a chant Op. It runs in a [
 
 You keep the Ops, the lint rules and the audit trail. We will not promise the agent never surprises you. The gates are there because it will.
 
-## Generated CI with gates
+## Releases as compile targets
 
-Five Ops over one root, with the pipeline YAML generated from them for whichever of the three platforms you run. Two read on a pull request, two write on a push behind an approval, one sweeps the account on a cron. The gate is a commit, so an outage cannot lose it.
+Off Kubernetes there is no shared apply verb, so every component grows its own pipeline and they drift apart. We describe each component as data instead, and the release compiles from it: typed and linted before anything runs, with cross-stack references resolved by name rather than scraped out with `jq`. One generic runner deploys every component in dependency order, and adding the hundredth costs one declaration and no new pipeline. [The argument in full.](https://lex00.github.io/posts/a-release-is-a-compile-target/)
+
+The CI is generated from the same declarations, one thin job per component, for whichever of the three platforms you run. A write stops at an approval, and the approval is a commit, so an outage cannot lose it.
 
 You keep one `chant.config.ts` and the workflows. A warden declares the org and its repositories too, if you want that. {{< wardens >}}
 

content/writing.md

@@ -3,6 +3,7 @@ title: "Writing"
 summary: "The arguments behind the tools, on our blog. Start with these."
 ---
 
+- [A release is a compile target](https://lex00.github.io/posts/a-release-is-a-compile-target/)
 - [Terraform state has three pieces](https://lex00.github.io/posts/terraform-state-has-three-pieces/)
 - [Invisible ownership is ridiculous](https://lex00.github.io/posts/invisible-ownership-is-ridiculous/)
 - [Infra tooling expectations in 2026](https://lex00.github.io/posts/infra-tooling-expectations-in-2026/)