@intentius/chant 0.100.0 → 0.102.0

package/src/op/composites/apply-op.ts

@@ -10,8 +10,11 @@
  * the ownership tag on `arm` (chant #1448 — previously `--mode Complete`, which
  * removed resources chant never applied), the ownership label on `gcp`
  * (chant #1449), the metadata marker (machines) and managed app
- * (volumes/ips/certs/secrets) on `fly` (chant #1449), and the stack itself on
- * `cloudformation`, which a resource CFN did not create is not in. All of
+ * (volumes/ips/certs/secrets) on `fly` (chant #1449), the ownership labels on
+ * `grafana` (chant #3011), the comment marker on `clickhouse` (chant #3208)
+ * and `postgres` (chant #3280),
+ * and the stack itself on `cloudformation`, which a
+ * resource CFN did not create is not in. All of
  * them are owned-only. See {@link DeleteMode}.
  *
  * A gate is a fact, not a wait (#2119): the local executor reads the gate
@@ -52,14 +55,18 @@ import { defaultOutput, hasNativeRollback, type ApplyTarget, type DeleteMode } f
 export interface ApplyOpConfig {
   /** Op name (kebab-case). */
   name: string;
-  /** Environment — CFN stack name / ARM resource group / kube context env;
-   * a log label on `gcp` and `fly`. */
+  /** Environment — CFN stack name / ARM resource group / kube context env /
+   * the `grafana.profiles.<env>` entry on `grafana` / the `sql.profiles.<env>`
+   * entry on `clickhouse` and `postgres`; a log label on `gcp` and
+   * `fly`. */
   env: string;
   /** Native apply mechanism. Default: "kubectl". */
   target?: ApplyTarget;
   /** Built manifest/template path. Default per target: `dist` (dir) for kubectl,
    * `template.json` (file) for CloudFormation/ARM, `dist/gcp.yaml` for gcp,
-   * `dist/fly.json` for fly. Must match your build output. */
+   * `dist/fly.json` for fly, `dist/grafana.json` (the build index) for
+   * grafana, `dist/schema.json` for clickhouse and postgres. Must match your
+   * build output. */
   output?: string;
   /** Project directory to build. Default: ".". */
   path?: string;

package/src/op/composites/composites.test.ts

@@ -157,6 +157,33 @@ describe("ApplyOp: shape", () => {
     expect(applyStep.fn).toBe("nativeApply");
     expect(applyStep.args).toEqual({ target: "kubectl", env: "prod", output: "dist", deleteMode: "never" });
   });
+
+  test("target clickhouse applies the sql build output, dist/schema.json by default (#3208)", () => {
+    const { op } = ApplyOp({ name: "p", env: "prod", target: "clickhouse", delete: "owned-only" });
+    const phases = getProps(op).phases as Array<Record<string, unknown>>;
+    const applyStep = (phases[2].steps as Array<Record<string, unknown>>)[0];
+    expect(applyStep.fn).toBe("nativeApply");
+    expect(applyStep.args).toEqual({ target: "clickhouse", env: "prod", output: "dist/schema.json", deleteMode: "owned-only" });
+    expect(getProps(op).onFailure).toBeUndefined();
+  });
+
+  test("target postgres applies the sql build output, dist/schema.json by default (#3280)", () => {
+    const { op } = ApplyOp({ name: "p", env: "prod", target: "postgres", delete: "owned-only" });
+    const phases = getProps(op).phases as Array<Record<string, unknown>>;
+    const applyStep = (phases[2].steps as Array<Record<string, unknown>>)[0];
+    expect(applyStep.fn).toBe("nativeApply");
+    expect(applyStep.args).toEqual({ target: "postgres", env: "prod", output: "dist/schema.json", deleteMode: "owned-only" });
+    expect(getProps(op).onFailure).toBeUndefined();
+  });
+
+  test("target grafana applies the build index, dist/grafana.json by default (#3011)", () => {
+    const { op } = ApplyOp({ name: "p", env: "prod", target: "grafana", delete: "owned-only" });
+    const phases = getProps(op).phases as Array<Record<string, unknown>>;
+    const applyStep = (phases[2].steps as Array<Record<string, unknown>>)[0];
+    expect(applyStep.fn).toBe("nativeApply");
+    expect(applyStep.args).toEqual({ target: "grafana", env: "prod", output: "dist/grafana.json", deleteMode: "owned-only" });
+    expect(getProps(op).onFailure).toBeUndefined();
+  });
 });
 
 describe("ApplyOp: gating + deletes", () => {
@@ -274,7 +301,7 @@ describe("ApplyOp: compensation (#125, total-or-refused in #1449)", () => {
   });
 
   test("compensate: true is refused at build time for every rollback-less target (#1449)", () => {
-    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly"] as const) {
+    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "grafana", "clickhouse", "postgres"] as const) {
       expect(() => ApplyOp({ name: "p", env: "prod", target, compensate: true })).toThrow(
         new RegExp(`ApplyOp "p": compensate is enabled, but target "${target}" has no automatic rollback`),
       );
@@ -296,7 +323,7 @@ describe("ApplyOp: compensation (#125, total-or-refused in #1449)", () => {
   });
 
   test("an object without a command is refused the same way as true", () => {
-    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly"] as const) {
+    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "grafana", "clickhouse", "postgres"] as const) {
       expect(() => ApplyOp({ name: "p", env: "prod", target, compensate: {} })).toThrow(
         /has no automatic rollback/,
       );
@@ -304,7 +331,7 @@ describe("ApplyOp: compensation (#125, total-or-refused in #1449)", () => {
   });
 
   test("a command lifts the refusal on every target", () => {
-    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "cloudformation"] as const) {
+    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "grafana", "clickhouse", "postgres", "cloudformation"] as const) {
       const { op } = ApplyOp({
         name: "p",
         env: "prod",

package/src/op/composites/lexicon-upgrade-op.test.ts

@@ -49,17 +49,22 @@ describe("LexiconUpgradeOp composite (#527)", () => {
     expect(phases[0].steps[0].outcomeAttribute).toEqual({ name: "HasUpgrade", from: "hasUpgrade" });
   });
 
-  test("in-scope set is exactly the 9 lexicons (helm/forgejo excluded)", () => {
+  test("known set is exactly the 11 lexicons (helm/forgejo excluded)", () => {
     // cedar joined with #1650: it pins `CEDAR_WASM_VERSION`, a dependency
     // rather than a downloaded spec, but the pinned-constant machinery the Op
     // drives is identical. helm/forgejo still have no upstream at all.
     expect([...IN_SCOPE_LEXICONS].sort()).toEqual(
-      ["aws", "azure", "cedar", "docker", "fly", "gcp", "github", "gitlab", "k8s"].sort(),
+      ["aws", "azure", "cedar", "docker", "fly", "gcp", "github", "gitlab", "k3s", "k8s", "sql"].sort(),
     );
     expect(IN_SCOPE_LEXICONS).not.toContain("helm");
     expect(IN_SCOPE_LEXICONS).not.toContain("forgejo");
   });
 
+  test("accepts a pinned lexicon by name, discovered at run time", () => {
+    expect(() => LexiconUpgradeOp({ lexicon: "sql" })).not.toThrow();
+    expect(() => LexiconUpgradeOp({ lexicon: "k3s" })).not.toThrow();
+  });
+
   test("rejects out-of-scope lexicons at construction", () => {
     for (const l of ["helm", "forgejo"]) {
       expect(() => LexiconUpgradeOp({ lexicon: l as never })).toThrow(/not in scope/);

package/src/op/composites/lexicon-upgrade-op.ts

@@ -13,9 +13,13 @@
  * lands on the Op itself (#2120).
  *
  * Lexicon classification (which check the activity dispatches to):
- *   PINNED  {k8s, gcp, docker, gitlab} → checkPinnedUpgrade
- *   ROLLING {aws, azure, github}       → checkRollingUpgrade
- * helm / forgejo are excluded — no upstream spec.
+ *   ROLLING {aws, azure, github, fly}  → checkRollingUpgrade
+ *   PINNED  any other lexicon whose plugin declares `upstreamPin`
+ *           (k8s, k3s, gcp, docker, gitlab, cedar, sql, ...) → checkPinnedUpgrade
+ * The pinned set is discovered from the plugin at run time, the way `chant dev
+ * pinned-upgrade` does. A pin that moves with other constants (`alsoMoves`, as
+ * sql's version plus digest) is report-only. helm / forgejo are excluded: no
+ * upstream spec.
  *
  * Finding-modes mirror ReconcileOp: `report` (default, no external services)
  * | `issue` | `pull-request`. For the epic goal, `pull-request` opens/updates a
@@ -43,9 +47,15 @@ import { Op, phase } from "../builders";
 import type { OpResource } from "../resource";
 import type { LexiconUpgradeMode, SupportedLexicon } from "../activities/lexicon-upgrade";
 
-/** The in-scope lexicons. helm / forgejo are excluded (no upstream spec). */
+/**
+ * The lexicons known to be in scope. This is not a gate: a lexicon that declares
+ * `upstreamPin` is dispatched without being listed. helm / forgejo are excluded
+ * (no upstream spec).
+ */
 export const IN_SCOPE_LEXICONS: readonly SupportedLexicon[] = [
   "k8s",
+  "k3s",
+  "sql",
   "gcp",
   "docker",
   "gitlab",
@@ -74,6 +84,12 @@ export interface LexiconUpgradeOpConfig {
    * `<cwd>/lexicons/<lexicon>` at run time.
    */
   lexiconDir?: string;
+  /**
+   * Label of one pin to check, for a lexicon whose plugin declares several
+   * (`upstreamPins`; sql has `clickhouse` and `postgres-14` to `postgres-18`).
+   * Omit to check every pin.
+   */
+  pin?: string;
   /**
    * What to produce on findings. Default: "report".
    * @default "report"
@@ -86,15 +102,19 @@ export interface LexiconUpgradeOpResources {
   op: InstanceType<typeof OpResource>;
 }
 
+const EXCLUDED_LEXICONS: ReadonlySet<string> = new Set(["helm", "forgejo"]);
+
 /**
- * Build a LexiconUpgradeOp for one lexicon. Rejects out-of-scope lexicons at
- * construction time so a typo never silently produces a no-op Op.
+ * Build a LexiconUpgradeOp for one lexicon. Rejects the lexicons with no
+ * upstream spec at construction time. Whether any other name declares a pin is
+ * only known by loading its plugin, so the activity checks that at run time and
+ * fails with a clear message for a name that has none.
  */
 export function LexiconUpgradeOp(config: LexiconUpgradeOpConfig): LexiconUpgradeOpResources {
-  if (!IN_SCOPE_LEXICONS.includes(config.lexicon)) {
+  if (EXCLUDED_LEXICONS.has(config.lexicon)) {
     throw new Error(
       `LexiconUpgradeOp: "${config.lexicon}" is not in scope. ` +
-        `In-scope lexicons: ${IN_SCOPE_LEXICONS.join(", ")} ` +
+        `Known lexicons: ${IN_SCOPE_LEXICONS.join(", ")}, and any lexicon declaring upstreamPin ` +
         `(helm, forgejo have no upstream spec).`,
     );
   }
@@ -119,6 +139,7 @@ export function LexiconUpgradeOp(config: LexiconUpgradeOpConfig): LexiconUpgrade
           args: {
             lexicon: config.lexicon,
             ...(config.lexiconDir ? { lexiconDir: config.lexiconDir } : {}),
+            ...(config.pin ? { pin: config.pin } : {}),
             mode: onFinding,
           },
           // Surface whether a PR-worthy upgrade was found as the run's

package/src/op/emulator-lifecycle.test.ts

@@ -39,3 +39,26 @@ describe("emulatorLifecycle command builders", () => {
     expect(emu.endpoint(4599)).toBe("http://localhost:4599");
   });
 });
+
+describe("an emulator reached by its own client, not over HTTP", () => {
+  const pg = emulatorLifecycle({
+    name: "chant-postgres",
+    image: "postgres:18",
+    containerPort: 5432,
+    readyCommand: ["pg_isready", "-h", "127.0.0.1"],
+    endpoint: (port) => `postgres://postgres@localhost:${port}/postgres`,
+  });
+
+  test("readiness is a command run in the container", () => {
+    expect(pg.readyExecCommand("chant-postgres")).toBe("docker exec chant-postgres pg_isready -h 127.0.0.1");
+    expect(emulatorLifecycle({ name: "x", image: "x:1", containerPort: 1, healthPath: "/h" }).readyExecCommand("x")).toBeUndefined();
+  });
+
+  test("the endpoint is the declared one, not an http URL", () => {
+    expect(pg.endpoint(55432)).toBe("postgres://postgres@localhost:55432/postgres");
+  });
+
+  test("a spec with neither a health path nor a ready command is refused", () => {
+    expect(() => emulatorLifecycle({ name: "x", image: "x:1", containerPort: 1 })).toThrow(/neither a healthPath nor a readyCommand/);
+  });
+});

package/src/op/emulator-lifecycle.ts

@@ -16,8 +16,25 @@ export interface EmulatorSpec {
   image: string;
   /** Port the emulator listens on inside the container (e.g. 4566, 4280). */
   containerPort: number;
-  /** Health path on the host port (e.g. `/_localstack/health`, `/_mudflaps/health`). */
-  healthPath: string;
+  /**
+   * Health path on the host port (e.g. `/_localstack/health`, `/_mudflaps/health`).
+   * Required unless {@link readyCommand} is set: an emulator is reached over
+   * HTTP or checks itself inside its container, one or the other.
+   */
+  healthPath?: string;
+  /**
+   * A command run inside the container (`docker exec <name> ...`) whose exit
+   * status 0 means ready, for an emulator with no HTTP health endpoint: a
+   * database server answers its own client (`pg_isready`), not a URL. When
+   * set, it replaces the HTTP poll of {@link healthPath}.
+   */
+  readyCommand?: readonly string[];
+  /**
+   * The endpoint a tool connects to, for an emulator that is not reached over
+   * HTTP, e.g. a `postgres://` URL for a database server.
+   * Default: `http://localhost:<port>`.
+   */
+  endpoint?: (port: number) => string;
   /** Readiness predicate over the health body. Default: any 200 response is ready. */
   ready?: (healthBody: string) => boolean;
   /** Extra `docker run` args inserted before the image (e.g. a socket mount). */
@@ -102,6 +119,8 @@ export interface EmulatorLifecycle {
   existsCommand(name: string): string;
   rmCommand(name: string): string;
   healthUrl(port: number): string;
+  /** `docker exec <name> <readyCommand...>`, or undefined for an emulator polled over HTTP. */
+  readyExecCommand(name: string): string | undefined;
   endpoint(port: number): string;
   up(args?: EmulatorUpArgs, signal?: AbortSignal): Promise<{ endpoint: string }>;
   down(args?: { name?: string }, signal?: AbortSignal): Promise<void>;
@@ -116,6 +135,9 @@ export interface EmulatorLifecycle {
  */
 export function emulatorLifecycle(spec: EmulatorSpec): EmulatorLifecycle {
   const ready = spec.ready ?? (() => true);
+  if (spec.healthPath === undefined && !spec.readyCommand?.length) {
+    throw new Error(`emulator "${spec.name}" declares neither a healthPath nor a readyCommand, so nothing can tell when it is ready`);
+  }
 
   const runCommand = (args: EmulatorUpArgs = {}): string => {
     const name = args.name ?? spec.name;
@@ -128,8 +150,30 @@ export function emulatorLifecycle(spec: EmulatorSpec): EmulatorLifecycle {
   };
   const existsCommand = (name: string): string => `docker ps -q -f name=${name}`;
   const rmCommand = (name: string): string => `docker rm -f ${name}`;
-  const healthUrl = (port: number): string => `http://localhost:${port}${spec.healthPath}`;
-  const endpoint = (port: number): string => `http://localhost:${port}`;
+  const healthUrl = (port: number): string => `http://localhost:${port}${spec.healthPath ?? ""}`;
+  const endpoint = (port: number): string => (spec.endpoint ? spec.endpoint(port) : `http://localhost:${port}`);
+  const readyExecCommand = (name: string): string | undefined =>
+    spec.readyCommand?.length ? ["docker", "exec", name, ...spec.readyCommand].join(" ") : undefined;
+
+  /** One readiness probe: the in-container command when declared, else the HTTP health path. */
+  async function probe(name: string, port: number, signal?: AbortSignal): Promise<boolean> {
+    const command = readyExecCommand(name);
+    if (command) {
+      try {
+        await execAsync(command, { signal });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    try {
+      const res = await fetch(healthUrl(port), { signal });
+      return res.ok && ready(await res.text());
+    } catch {
+      // Not up yet (connection refused / non-2xx) — retry.
+      return false;
+    }
+  }
 
   async function up(args: EmulatorUpArgs = {}, signal?: AbortSignal): Promise<{ endpoint: string }> {
     const name = args.name ?? spec.name;
@@ -153,19 +197,13 @@ export function emulatorLifecycle(spec: EmulatorSpec): EmulatorLifecycle {
       await execAsync(runCommand({ ...args, name, port }), { signal });
     }
 
-    const url = healthUrl(port);
     const deadline = Date.now() + timeoutMs;
     let ok = false;
     while (Date.now() < deadline) {
       if (signal?.aborted) throw new Error(`emulator "${name}" wait aborted`);
-      try {
-        const res = await fetch(url, { signal });
-        if (res.ok && ready(await res.text())) {
-          ok = true;
-          break;
-        }
-      } catch {
-        // Not up yet (connection refused / non-2xx) — retry.
+      if (await probe(name, port, signal)) {
+        ok = true;
+        break;
       }
       await sleep(intervalMs, signal);
     }
@@ -187,5 +225,5 @@ export function emulatorLifecycle(spec: EmulatorSpec): EmulatorLifecycle {
     }
   }
 
-  return { runCommand, existsCommand, rmCommand, healthUrl, endpoint, up, down };
+  return { runCommand, existsCommand, rmCommand, healthUrl, readyExecCommand, endpoint, up, down };
 }

package/src/op/gate-approval.test.ts

@@ -107,6 +107,23 @@ describe("gate approval — quorum (#2508)", () => {
     expect(port.appended).toHaveLength(0);
   });
 
+  // #2547: a gate still pending, and an approval given, under the bare sha256: prefix
+  // keep working once the run computes the same plan's digest as jcs1-sha256:.
+  test("a pending gate and an approval recorded under the bare prefix match the jcs1 digest of the same plan", async () => {
+    const jcs = `jcs1-${PLAN_A}`;
+    const block: ResolvedGateApproval = { quorum: { count: 1 }, mode: "log-only" };
+    const run = async (resolutions: GateResolutionRecord[]) => {
+      const port = memoryGateLedgerPort({ resolutions, pending: [{ ...PENDING, approval: block }] });
+      return { port, check: await evaluateGate(port, { op: "release", gate: "ship", planDigest: jcs, approval: block, now: NOW }) };
+    };
+    const approved = await run([approval({ resolvedBy: "alex", timestamp: "2026-09-01T01:00:00.000Z" })]);
+    expect(approved.check.satisfied).toBe(true);
+    // A standing fact is not rewritten just because the prefix moved.
+    const waiting = await run([]);
+    expect(waiting.check.satisfied).toBe(false);
+    expect(waiting.port.appended).toHaveLength(0);
+  });
+
   test("an approval older than the standing pending fact does not count", async () => {
     const { check } = await decide(
       [approval({ resolvedBy: "alex", timestamp: "2026-08-31T00:00:00.000Z" })],
@@ -174,6 +191,80 @@ describe("gate approval — policy decisions (#2508)", () => {
     expect(check.satisfied).toBe(false);
   });
 
+  test("log-only then enforce: a permit recorded under log-only does not pass the enforced gate (#2512)", async () => {
+    const logOnly: ResolvedGateApproval = { policy: POLICY, mode: "log-only", context: { risk: "low" } };
+    const enforce: ResolvedGateApproval = { ...logOnly, mode: "enforce" };
+    // The pending fact was recorded while the gate was log-only, and the agent's allow was recorded against it.
+    const port = memoryGateLedgerPort({
+      resolutions: [approval({ resolvedBy: "release-bot", timestamp: "2026-09-01T01:00:00.000Z", approver: { kind: "agent" }, policyDecision: allow("log-only") })],
+      pending: [{ ...PENDING, approval: logOnly }],
+    });
+    const check = await evaluateGate(port, { op: "release", gate: "ship", planDigest: PLAN_A, approval: enforce, now: NOW });
+    expect(check.satisfied).toBe(false);
+
+    const tally = tallyGateApprovals(
+      [approval({ resolvedBy: "release-bot", timestamp: "2026-09-01T01:00:00.000Z", approver: { kind: "agent" }, policyDecision: allow("log-only") })],
+      "ship", PENDING.timestamp, PLAN_A, enforce,
+    );
+    expect(tally.permit).toBeUndefined();
+  });
+
+  test("log-only then enforce: a human's approval recorded under log-only still counts toward the quorum (#2512)", async () => {
+    const logOnly: ResolvedGateApproval = { quorum: { count: 1 }, policy: POLICY, mode: "log-only" };
+    const enforce: ResolvedGateApproval = { ...logOnly, mode: "enforce" };
+    const port = memoryGateLedgerPort({
+      resolutions: [approval({ resolvedBy: "alex", timestamp: "2026-09-01T01:00:00.000Z", policyDecision: allow("log-only") })],
+      pending: [{ ...PENDING, approval: logOnly }],
+    });
+    const check = await evaluateGate(port, { op: "release", gate: "ship", planDigest: PLAN_A, approval: enforce, now: NOW });
+    expect(check.satisfied).toBe(true);
+    if (!check.satisfied) return;
+    expect(check.via).toBe("quorum");
+    expect(check.resolution.resolvedBy).toBe("alex");
+  });
+
+  test("log-only then enforce: the gated run re-records the pending fact under enforce, and only a fresh permit passes (#2512)", async () => {
+    const logOnly: ResolvedGateApproval = { policy: POLICY, mode: "log-only", context: { risk: "low" } };
+    const enforce: ResolvedGateApproval = { ...logOnly, mode: "enforce" };
+    const stale = approval({ resolvedBy: "release-bot", timestamp: "2026-09-01T01:00:00.000Z", approver: { kind: "agent" }, policyDecision: allow("log-only") });
+    const port = memoryGateLedgerPort({ resolutions: [stale], pending: [{ ...PENDING, approval: logOnly }] });
+
+    const first = await evaluateGate(port, { op: "release", gate: "ship", planDigest: PLAN_A, approval: enforce, now: NOW });
+    expect(first.satisfied).toBe(false);
+    if (first.satisfied) return;
+    // The standing fact described the log-only gate, so a fresh one carries
+    // enforce, and `chant approve` evaluates the next agent approval under it.
+    expect(first.recorded).toBe(true);
+    expect(first.pending.approval?.mode).toBe("enforce");
+
+    // Re-running without a new approval still waits: the stale permit predates the new pending fact as well.
+    const again = await evaluateGate(port, { op: "release", gate: "ship", planDigest: PLAN_A, approval: enforce, now: "2026-09-01T12:30:00.000Z" });
+    expect(again.satisfied).toBe(false);
+
+    const fresh = approval({ resolvedBy: "release-bot", timestamp: "2026-09-01T13:00:00.000Z", approver: { kind: "agent" }, policyDecision: allow("enforce") });
+    const after = await evaluateGate(
+      memoryGateLedgerPort({ resolutions: [stale, fresh], pending: [first.pending] }),
+      { op: "release", gate: "ship", planDigest: PLAN_A, approval: enforce, now: "2026-09-01T14:00:00.000Z" },
+    );
+    expect(after.satisfied).toBe(true);
+    if (!after.satisfied) return;
+    expect(after.via).toBe("policy");
+    expect(after.resolution.timestamp).toBe(fresh.timestamp);
+  });
+
+  test("enforce: a recorded decision with no mode does not pass the gate (#2512)", async () => {
+    const block: ResolvedGateApproval = { policy: POLICY, mode: "enforce" };
+    const { mode: _mode, ...noMode } = allow()!;
+    const { check } = await decide(
+      [approval({
+        resolvedBy: "release-bot", timestamp: "2026-09-01T01:00:00.000Z", approver: { kind: "agent" },
+        policyDecision: noMode as GateResolutionRecord["policyDecision"],
+      })],
+      block,
+    );
+    expect(check.satisfied).toBe(false);
+  });
+
   test("enforce: a deny-by-default policy keeps the old behaviour, where only a human's approval counts", async () => {
     const block: ResolvedGateApproval = { policy: POLICY, mode: "enforce" };
     const deny = { ...allow()!, decision: "deny" as const, determining: ["floor"] };

package/src/op/gate-approval.ts

@@ -119,7 +119,11 @@ export interface GatePolicyAnswer {
 export interface GatePolicyDecision extends GatePolicyAnswer {
   policy: string;
   version: string;
-  /** The gate's mode when the decision was recorded. A run reads the gate's current mode, not this. */
+  /**
+   * The gate's mode when the decision was recorded. A permit passes a gate
+   * only when both this and the gate's current mode are `enforce` (#2512), so
+   * an allow recorded under `log-only` never binds after a switch.
+   */
   mode: GateApprovalMode;
 }
 

package/src/op/gate.ts

@@ -44,7 +44,7 @@ import {
   type PendingGateInput,
   type PendingGateRecord,
 } from "../lifecycle/gate-ledger";
-import { describePlanDigest } from "../lifecycle/plan-digest";
+import { describePlanDigest, samePlanDigest } from "../lifecycle/plan-digest";
 import { isModelAuthored } from "../lifecycle/gate-origin";
 import { sortedJsonReplacer } from "../utils";
 import type { GateApprover, ResolvedGateApproval } from "./gate-approval";
@@ -74,6 +74,19 @@ export interface PendingGatePush {
 export interface GateLedgerPort {
   read(op: string): Promise<{ resolutions: GateResolutionRecord[]; pending: PendingGateRecord[] }>;
   appendPending(input: PendingGateInput): Promise<PendingGatePush>;
+  /**
+   * The rule a workspace sets for approvals of `gate` (#3163, ws-080), or
+   * null when none applies: the declaration's `identity.gates`, read at base.
+   * Absent, every approval is judged as before.
+   */
+  approvalRule?(gate: string): Promise<GateApprovalRule | null>;
+}
+
+/** A workspace's rule for which approvals of a gate count (#3163): a signed approval, from a class when it names one. */
+export interface GateApprovalRule {
+  requirement: { gate: string; class: string | null };
+  /** Why `approval` doesn't count, or null when it does. */
+  refuses(approval: GateResolutionRecord): string | null;
 }
 
 /**
@@ -102,6 +115,11 @@ export function gitGateLedgerPort(opts?: { cwd?: string }): GateLedgerPort {
       const { resolutions, pending } = await readGateLedger(op, opts);
       return { resolutions, pending };
     },
+    async approvalRule(gate) {
+      // Loaded on demand: the rule lives in the workspace modules, which import the Op modules.
+      const { gateAdmission } = await import("../workspace/identity");
+      return gateAdmission(opts?.cwd ?? process.cwd(), gate);
+    },
     async appendPending(input) {
       const { record } = await appendPendingGate(input, opts);
       try {
@@ -288,7 +306,7 @@ export interface GateTally {
   counted: GateResolutionRecord[];
   /** The quorum's count, 1 when the gate declares none. */
   need: number;
-  /** The newest approval whose recorded permit passes the gate on its own. Only in `enforce` mode, and only under the gate's current policy version. */
+  /** The newest approval whose recorded permit passes the gate on its own. Only in `enforce` mode, only for a permit recorded under `enforce`, and only under the gate's current policy version. */
   permit?: GateResolutionRecord;
   /** The newest approval of this gate for a different plan, when the gate binds one. */
   mismatched?: GateResolutionRecord;
@@ -305,8 +323,9 @@ export interface GateTally {
  * Of those, only a human's counts toward the quorum, once per `resolvedBy`,
  * and only with one of the quorum's roles when it names any. An agent counts
  * only through a recorded `allow` in `enforce` mode, evaluated under the
- * policy version the gate declares now. A `log-only` decision never changes
- * the outcome, and a `deny` never removes a human's approval: a policy can add
+ * policy version the gate declares now and recorded while the gate was in
+ * `enforce` (#2512). A `log-only` decision never changes the outcome, even
+ * after the gate switches to `enforce`, and a `deny` never removes a human's approval: a policy can add
  * a way through the gate but cannot take one away.
  */
 export function tallyGateApprovals(
@@ -325,14 +344,18 @@ export function tallyGateApprovals(
   let mismatched: GateResolutionRecord | undefined;
   for (const r of records) {
     if (r.gate !== gate || at(r) < since) continue;
-    if (planDigest !== undefined && r.planDigest !== planDigest) {
+    if (planDigest !== undefined && !samePlanDigest(r.planDigest, planDigest)) {
       if (!mismatched || at(r) >= at(mismatched)) mismatched = r;
       continue;
     }
 
     const decision = r.policyDecision;
+    // #2512: the decision must also have been recorded under `enforce`. An
+    // allow recorded while the gate was log-only was never binding, and a
+    // later switch to enforce does not make it binding.
     if (
       approval.mode === "enforce" && approval.policy && decision?.decision === "allow" &&
+      decision.mode === "enforce" &&
       decision.version === approval.policy.version && (!permit || at(r) >= at(permit))
     ) {
       permit = r;
@@ -394,10 +417,13 @@ export async function evaluateGate(port: GateLedgerPort, input: GateCheckInput):
   // a mismatch with a message instead of silently not counting.
   const env = input.environment;
   const pending = env === undefined ? ledger.pending : ledger.pending.filter((p) => p.environment === env);
-  const resolutions =
+  // #3163: a gate the workspace's identity.gates names counts only signed approvals from its class.
+  const rule = (await port.approvalRule?.(input.gate)) ?? null;
+  const resolutions = (
     env === undefined
       ? ledger.resolutions
-      : ledger.resolutions.filter((r) => r.environment === undefined || r.environment === env);
+      : ledger.resolutions.filter((r) => r.environment === undefined || r.environment === env)
+  ).filter((r) => rule === null || r.gate !== input.gate || rule.refuses(r) === null);
 
   const standing = latestPendingGate(pending, input.gate);
   const since = standing?.timestamp ?? EPOCH;
@@ -447,7 +473,7 @@ export async function evaluateGate(port: GateLedgerPort, input: GateCheckInput):
   // under another policy version or another context would have `chant
   // approve` evaluate the policy against something this run no longer has.
   if (
-    standing && !isPendingGateExpired(standing, now) && standing.planDigest === input.planDigest &&
+    standing && !isPendingGateExpired(standing, now) && samePlanDigest(standing.planDigest, input.planDigest) &&
     sameApproval(standing.approval, input.approval)
   ) {
     return { satisfied: false, pending: standing, recorded: false, ...asMismatch };

package/src/op/index.ts

@@ -60,6 +60,8 @@ export type { ActivityProfile, ActivityProfileName } from "./activity-profiles";
 export { NonRetryableActivityError, nonRetryableFailure } from "./activity-failure";
 export { runOpLocally, parseDuration, OpRunFailure } from "./local-executor";
 export type { StepRecord, OpRunResult, RunOpOptions } from "./local-executor";
+export { currentOpRun, withOpRunContext } from "./run-context";
+export type { OpRunContext, PassedGate } from "./run-context";
 export { evaluateGate, gitGateLedgerPort, memoryGateLedgerPort, approveCommand, describeGateMismatch } from "./gate";
 export type { GateLedgerPort, GateCheck, GateCheckInput, PendingGatePush, GateDigestMismatch, GateQuorumProgress, GateTally } from "./gate";
 export { tallyGateApprovals, approverOf } from "./gate";
@@ -71,7 +73,7 @@ export type {
   GatePolicyEvaluator, GatePolicyRef, GatePolicyRequest, GateQuorum, ResolvedGateApproval,
 } from "./gate-approval";
 export {
-  computePlanDigest, isPlanDigest, describePlanDigest, PLAN_DIGEST_ALGORITHM,
+  computePlanDigest, isPlanDigest, describePlanDigest, samePlanDigest, PLAN_DIGEST_ALGORITHM, PLAN_DIGEST_PREFIX,
 } from "../lifecycle/plan-digest";
 export { gateName, usesDeprecatedGateKey, DEPRECATED_GATE_KEY_WARNING } from "./gate-name";
 export type { GateNamed } from "./gate-name";

package/src/op/local-executor.test.ts

@@ -232,6 +232,21 @@ describe("runOpLocally — outcomeAttribute", () => {
     expect(result.records[0].outcome).toEqual({ name: "Drift", value: true });
   });
 
+  test("an attribute whose path the result does not hold is left off, not recorded as undefined", async () => {
+    const done: ActivityFn = async () => ({ state: "done", switched: false });
+    const config = op({
+      phases: [{ name: "Switch", steps: [
+        { kind: "activity", fn: "migrationSwitch", outcomeAttribute: [{ name: "OldColumn", from: "oldColumn" }, { name: "State", from: "state" }] },
+        { kind: "activity", fn: "migrationRetain", outcomeAttribute: { name: "RetainUntil", from: "retainUntil" } },
+      ] }],
+    });
+    const result = await runOpLocally(config, new Map([["migrationSwitch", done], ["migrationRetain", done]]), PROFILES);
+    expect(result.records[0].outcomes).toEqual([{ name: "State", value: "done" }]);
+    expect(result.records[0].outcome).toEqual({ name: "State", value: "done" });
+    expect(result.records[1].outcomes).toBeUndefined();
+    expect(result.records[1].outcome).toBeUndefined();
+  });
+
   test("a step with no attribute leaves both fields absent", async () => {
     const noop: ActivityFn = async () => ({ ok: true });
     const config = op({ phases: [{ name: "Plan", steps: [{ kind: "activity", fn: "noop" }] }] });