Configuration tooling keeps getting thrown into one cauldron. Start with eye of newt. Add a splash of versioning and a pinch of transformation and a few sprigs of authoritative state.

Gruel ends up tasting the same no matter how it gets started. Once cooked you have no way to cleanly extract any of the ingredients.

Clean separation of concerns with toolchains like this boils down to the fact that you get to drink yours from one bowl. This sounds pretty convenient at first. If you like your food served this way then everything is fine.

The chant dining experience

chant gives you a menu of choices.

You write TypeScript. It compiles to your platform’s own spec.

When your produced artifacts are your platform’s native format, they continue to be deployable even if you dump the toolchain that produced them.

Serving gruel vs ingredients

Every entry in the left column is a real problem with more than one answer.

The column on the right offers us a path forward that routes around vendor lock-in.

Gruel is not queryable

You cannot pick the versioning back out of a cooked pot. You can only ask it questions in the query language it shipped with.

Plenty of things answer questions without being a database. The live cloud is one. Typed source is another, because chant reads TypeScript as data through the syntax tree, so an agent queries your infra code instead of grepping it.

On aws-bench, asked which security groups were attached to nothing, every toolchain reading a stored copy scored zero out of three.

The half that gets skipped

Handing exact revisions to a reconciler is the easy half. Everyone does that one.

The other half typically gets scoped out.

A gate is a durable wait for a signal. If an apply dies halfway each capability unwinds its own step and the half-applied change comes back.

When live drifts from source ReconcileOp regenerates the TypeScript and opens a pull request. It never merges and it never commits to main. Cloud back into code is the direction most out-of-band changes actually travel, and it tends to lack strong support.

Releases carry an SBOM and a signature and provenance. Publish promotes by digest so the bytes tested in dev are the bytes in prod. behold renders the whole estate live off chant graph and never mutates anything.

A word on OCI bundles

chant publishes images to any OCI registry and promotes them by digest, with SBOMs and signatures attached through the standard referrers API. All of it is optional. There is a registry-free path that loads straight onto the host, and a missing oras binary reports itself instead of failing your publish.

What chant leaves in your hands is the push itself. The bundle exists and is content-addressed, and an Op puts it wherever your reconciler pulls from.

Content-addressing gives identity to output you cannot reproduce. Where synthesis is closed the source is already the identity. A generator like Helm leaves its inputs open so the render needs a digest and chant is building that for charts.

What a toolchain should cost you

Gruel architectures are sold on a fleet story centered around hundreds of clusters and a massive bulk change story to solve.

If your story of scale is a smaller one, the gruel machinery will not shrink for you.

Teams that do have fleet problems are typically the ones least in need of an opinion. What they want is a spec-true artifact and a set of capabilities they can compose on their own terms.

chant’s drift detection ships with a section on determining if it has value for you. The lifecycle is a dial you set per environment. Temporal is opt-in.

chant’s output is CloudFormation, or Kubernetes YAML, or .gitlab-ci.yml, with nothing chant-specific in it. The day you walk, your artifacts keep deploying.

So, gruel or Korean BBQ? I know what I’m having for lunch.

Read more