@intentius/chant-lexicon-fountain 0.72.2 → 0.72.4

package/dist/acp/host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/acp/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,oDAAoD;IACpD,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,6FAA6F;IAC7F,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChG,uFAAuF;IACvF,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,0EAA0E;AAC1E,eAAO,MAAM,YAAY,cAAc,CAAC;AAExC;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAuCtD"}
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../src/acp/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,uDAAuD;IACvD,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACxC,oDAAoD;IACpD,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACrE,6FAA6F;IAC7F,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChG,uFAAuF;IACvF,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,0EAA0E;AAC1E,eAAO,MAAM,YAAY,cAAc,CAAC;AAExC;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAwDtD"}

package/dist/acp/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/acp/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/acp/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,wFAAwF;AACxF,wBAAsB,iBAAiB,CAAC,IAAI,GAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB/F"}

package/dist/composites/steward.d.ts

@@ -22,7 +22,13 @@
  * `sandbox_mode: "persistent"` because the environment's checkout and tool
  * cache have to survive a turn ending, `permission_policy: { default:
  * "auto_allow" }` because there is nobody at the keyboard to answer a
- * permission card and chant's own gates are where a human belongs, no `model`
+ * permission card. Chant's own gates are still where a human belongs, and
+ * that is enforced rather than assumed: a gate resolved from this session
+ * would be answering a gate this session produced, which `recordGateApproval`
+ * refuses (chant#2384's origin rule, reached through chant#2400). So
+ * `auto_allow` decides ordinary tool calls and cannot clear a gate — the
+ * resolution has to arrive on a channel this agent is not on, normally
+ * `chant approve` at a shell, no `model`
  * because an `acp` agent's model is whatever the command it launches decides
  * to use, and no skills because a steward's competence is chant's op
  * definitions rather than prose.

package/dist/composites/steward.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"steward.d.ts","sourceRoot":"","sources":["../../src/composites/steward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK5F;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;AAQnE,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,8EAA8E;IAC9E,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IACnC;;;;OAIG;IACH,GAAG,EAAE,SAAS,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IAClC,QAAQ,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;IACxC,4DAA4D;IAC5D,SAAS,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,EAAE,CAAC;IAC3C,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CACxC;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAiBnD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3D;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AA8BD,wBAAgB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,gBAAgB,CAsF3D"}
+{"version":3,"file":"steward.d.ts","sourceRoot":"","sources":["../../src/composites/steward.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAK5F;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;AAQnE,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,WAAW,EAAE,YAAY,CAAC,OAAO,WAAW,CAAC,CAAC;IAC9C,8EAA8E;IAC9E,KAAK,CAAC,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IACnC;;;;OAIG;IACH,GAAG,EAAE,SAAS,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,CAAC,OAAO,KAAK,CAAC,CAAC;IAClC,QAAQ,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,CAAC;IACxC,4DAA4D;IAC5D,SAAS,EAAE,YAAY,CAAC,OAAO,QAAQ,CAAC,EAAE,CAAC;IAC3C,OAAO,CAAC,EAAE,YAAY,CAAC,OAAO,OAAO,CAAC,CAAC;CACxC;AAED,mEAAmE;AACnE,eAAO,MAAM,uBAAuB,cAAc,CAAC;AAiBnD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3D;AAED,iFAAiF;AACjF,wBAAgB,uBAAuB,IAAI,IAAI,CAG9C;AA8BD,wBAAgB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,gBAAgB,CAsF3D"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "600e74f7ef572c9b8baf266c4584eafc4b7d96b9834a9d166a8d419a1a9e3a0b",
+    "manifest.json": "22fc085ff69da74c44cb495ae9fdc594f95ec183191e8bef2b9884cfaf7d75da",
     "meta.json": "ed2c507b18806e3eac6641d9b8fc85cd59401a86ab39ba39405869fab91ba729",
     "types/index.d.ts": "242196b012731a2fb7b586159ab234bf33f63b1653e49fc625b1cff0b3f7f1f3",
     "rules/ftn001-no-secret-literals.ts": "a417b194cd7039911cca9a0f14c49b042dfa6b1ee48517f7c2e22b16590a8599",
@@ -22,5 +22,5 @@
     "skills/chant-fountain-ops.md": "206b9088be0c43807df32de39949888bd28eefd870a191743e051814c94b2d0c",
     "skills/chant-fountain-locked-sandboxes.md": "de82f06cb3a08ba6bf3ae45fb9869e21d6da18b9ebe0fc769da8aebaceea7dd1"
   },
-  "composite": "66890c794d939ed2f94154068924345c167a15a259773d22e71786a7150053e3"
+  "composite": "47bc6b0b254f3c5aa1b838d07c086731e1de903f915528ce0090ab9cb6c031fe"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "fountain",
-  "version": "0.72.2",
+  "version": "0.72.4",
   "chantVersion": ">=0.1.0",
   "namespace": "Fountain",
   "specVersion": "v0.16.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fountain",
-  "version": "0.72.2",
+  "version": "0.72.4",
   "type": "module",
   "description": "Fountain lexicon for chant — sandboxed agent environments, vaults, and agents as typed estate",
   "license": "Apache-2.0",
@@ -50,7 +50,7 @@
     "bundle": "tsx src/package-cli.ts"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.72.2",
+    "@intentius/chant": "^0.72.4",
     "typescript": "^5.9.3",
     "zod": "^4.3.6"
   },

package/src/acp/gate-resolution.test.ts

@@ -0,0 +1,81 @@
+import { describe, test, expect } from "vitest";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+/**
+ * chant#2400 — an ACP session cannot clear a gate it produced.
+ *
+ * The `Steward` composite ships `permission_policy: { default: "auto_allow" }`,
+ * with a comment explaining that chant's own gates are where a human belongs.
+ * On the `--durable-requests` path that was not true. A gate became a
+ * `session/request_permission` (`./turn.ts`'s `gatedReply`), `auto_allow`
+ * answered it without anyone, and `AcpServer.resume` then wrote a real gate
+ * resolution and re-ran the command, which walked through the gate. The
+ * composite's doc described a separation its configuration removed, which is
+ * how it survived review: a reader finds an argument rather than a smell.
+ *
+ * chant#2384 did not close it, and the reason is the interesting part.
+ * `createChantHost`'s `resolveGate` called `appendGateResolution` DIRECTLY,
+ * writing a line that looked like an approval while skipping every check one
+ * carries: #2300's plan binding, so the resolution named no plan and
+ * authorised whatever the next run produced rather than what anyone read; the
+ * standing-pending-fact requirement, so it could answer a gate nothing had
+ * reached; and #2384's origin rule, which is the one that bites here.
+ *
+ * Routed through `recordGateApproval`, the same function `chant approve`
+ * calls, the rule applies: the pending fact and the resolution are both
+ * authored by the same ACP session, so it refuses. The property is now a
+ * consequence of the mechanism rather than of how a composite is configured.
+ */
+const HOST = fileURLToPath(new URL("./host.ts", import.meta.url));
+const STEWARD = fileURLToPath(new URL("../composites/steward.ts", import.meta.url));
+
+describe("an ACP gate resolution goes through the same door as chant approve (chant#2400)", () => {
+  const host = readFileSync(HOST, "utf8");
+
+  test("resolveGate calls recordGateApproval, not appendGateResolution", () => {
+    expect(host).toContain("recordGateApproval");
+
+    // The direct call is the defect. Writing the ledger line without the
+    // checks around it produces a record indistinguishable from an approval,
+    // which is worse than failing to write one.
+    //
+    // Matched on the import rather than the bare name, so the comment above
+    // `resolveGate` can go on explaining what it no longer does. A test that
+    // fails on its own subject being mentioned teaches people to stop
+    // mentioning it.
+    const importsLedgerWriter = /import\("@intentius\/chant\/lifecycle\/gate-ledger"\)/.test(host)
+      && /\bappendGateResolution\s*[,}]/.test(host);
+    expect(
+      importsLedgerWriter,
+      "resolveGate must not append a resolution directly — that skips the plan binding, the " +
+        "standing-pending-fact requirement and the origin rule",
+    ).toBe(false);
+  });
+
+  test("it names the ACP channel, so the origin rule has something to compare", () => {
+    // Without an origin the rule cannot fire: `sameOriginRefusal` matches
+    // positively, so an unlabelled resolution is never refused.
+    expect(host).toMatch(/origin:\s*"acp"/);
+  });
+
+  test("a refusal is surfaced rather than swallowed", () => {
+    // `recordGateApproval` reports failure by returning `{ ok: false }` and
+    // printing. A caller that ignored that would carry on and re-run the
+    // command, which is exactly the bypass this closes.
+    expect(host).toMatch(/outcome\.ok/);
+    expect(host).toContain("chant approve");
+  });
+
+  test("the Steward's doc no longer claims a separation its configuration removes", () => {
+    const steward = readFileSync(STEWARD, "utf8");
+
+    // The configuration is unchanged and deliberately so: `auto_allow` is right
+    // for ordinary tool calls on a machine with nobody at the keyboard. What
+    // changed is that it can no longer clear a gate, and the doc has to say
+    // which of those it means.
+    expect(steward).toContain('permission_policy: { default: "auto_allow" }');
+    expect(steward).toMatch(/cannot clear a gate/);
+    expect(steward).toMatch(/chant#2384|origin rule/);
+  });
+});

package/src/acp/host.ts

@@ -94,11 +94,28 @@ export function createChantHost(cwd: string): ChantHost {
     },
 
     async resolveGate(op, gate, resolvedBy) {
-      const { appendGateResolution } = await import("@intentius/chant/lifecycle/gate-ledger");
-      await appendGateResolution(
-        { op, gate, resolvedBy, timestamp: new Date().toISOString() },
-        { cwd },
-      );
+      // chant#2400 — through `recordGateApproval`, the same function `chant
+      // approve` calls, rather than straight to `appendGateResolution`.
+      //
+      // Going direct wrote a line that looked like an approval and was missing
+      // every check one carries. It skipped #2300's plan binding, so the
+      // resolution named no plan and authorised whatever the next run produced
+      // rather than what anyone had read. It skipped the standing-pending-fact
+      // requirement, so it could answer a gate nothing had reached. And it
+      // skipped chant#2384's origin rule, which is the one that matters here:
+      // the pending fact and this resolution are both authored by the same ACP
+      // session, so the model that produced the gate was resolving it.
+      //
+      // With the rule applied, that case now refuses, which is the point. A
+      // Steward's gate reaches a person or it does not clear.
+      const { recordGateApproval } = await import("@intentius/chant/cli/handlers/operator");
+      const outcome = await recordGateApproval(op, gate, { actor: resolvedBy, origin: "acp" });
+      if (!outcome.ok) {
+        throw new Error(
+          `the resolution for gate "${gate}" on "${op}" was refused. A gate reached over ACP cannot ` +
+            `also be resolved over ACP — approve it with \`chant approve ${op} ${gate}\` at a shell.`,
+        );
+      }
     },
   };
 }

package/src/acp/serve.ts

@@ -10,6 +10,7 @@
  */
 
 import { readFileSync } from "node:fs";
+import { setGateOrigin } from "@intentius/chant/lifecycle/gate-origin";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { AcpServer } from "./server";
@@ -17,6 +18,14 @@ import { streamTransport } from "./jsonrpc";
 
 /** Serve until the client closes stdin, which is how it says the connection is over. */
 export async function serveAcpOverStdio(opts: { durableRequests?: boolean } = {}): Promise<void> {
+  // chant#2384 — every prompt this session carries is authored by the model,
+  // and `approve` is a verb in chant's registry like any other, so nothing in
+  // the transport stops `chant run <op>` being followed by
+  // `chant approve <op> <gate>` as the next prompt. Declaring the channel is
+  // what makes the gate ledger able to tell that apart from a person at a
+  // shell; the same-origin rule then refuses it.
+  setGateOrigin("acp");
+
   const server = new AcpServer({
     durableRequests: opts.durableRequests ?? false,
     version: lexiconVersion(),

package/src/composites/steward.ts

@@ -22,7 +22,13 @@
  * `sandbox_mode: "persistent"` because the environment's checkout and tool
  * cache have to survive a turn ending, `permission_policy: { default:
  * "auto_allow" }` because there is nobody at the keyboard to answer a
- * permission card and chant's own gates are where a human belongs, no `model`
+ * permission card. Chant's own gates are still where a human belongs, and
+ * that is enforced rather than assumed: a gate resolved from this session
+ * would be answering a gate this session produced, which `recordGateApproval`
+ * refuses (chant#2384's origin rule, reached through chant#2400). So
+ * `auto_allow` decides ordinary tool calls and cannot clear a gate — the
+ * resolution has to arrive on a channel this agent is not on, normally
+ * `chant approve` at a shell, no `model`
  * because an `acp` agent's model is whatever the command it launches decides
  * to use, and no skills because a steward's competence is chant's op
  * definitions rather than prose.

package/src/op/runtime.test.ts

@@ -585,11 +585,23 @@ describe("tailConversation", () => {
         json: { data: { id: "conv-1", status: "running", turn_count: 1 } },
       },
     });
-    // The turn thinks for a while, then finishes: several polls, then the event
-    // the polls were waiting through.
+    // The turn thinks until the poller has had more than one look at it, then
+    // finishes: several polls, then the event the polls were waiting through.
+    //
+    // The wait is on the poll count rather than on a fixed sleep. This used to
+    // sleep 25ms and assert that more than one 1ms poll had fit inside it,
+    // which is a wall-clock race the full suite loses every so often: a worker
+    // stalled past the sleep leaves the first event already due, exactly one
+    // poll lands, and `calls.length` is 1. Waiting on the number the assertion
+    // is about makes the same claim without timing it. The deadline keeps a
+    // genuine regression — a tail that stops polling — a loud failure here
+    // instead of a hang.
+    const deadline = Date.now() + 5_000;
     const sse: FountainSse = () => ({
       async *[Symbol.asyncIterator]() {
-        await new Promise((resolve) => setTimeout(resolve, 25));
+        while (calls.length < 2 && Date.now() < deadline) {
+          await new Promise((resolve) => setTimeout(resolve, 1));
+        }
         yield sseEvent("1", { stream: "stdout", blocks: [{ kind: "text", body: JSON.stringify(RECORD) }] });
         yield sseEvent("2", { stream: "stage", stage: "turn", state: "done" });
       },