@intentius/chant 0.101.0 → 0.104.0

package/src/workspace/status.schema.json

@@ -5,6 +5,50 @@
   "description": "What `chant workspace status <env> --json` prints, version 1 of the read contract for releases across members (#2524 D15, D19, #2544). Readers ignore fields they do not know; a field is only ever added within a version. The reason and error codes are closed lists: a new code is a new contract version. Contract version 1 is written by chant 0.81.0 and newer; a reader that needs it refuses output whose `contract` it doesn't know. Every code is in the one closed list of `reason-codes.ts`. Each member's gates, read from its gate ledger on the same branch, are in the JSON only (#2674), and so is each member's box block, from the declaration (#2726), with its isolation resolved (#2727). So are its stewards, their Ops and each Op's last run (#2731), the work lease each Op's turn holds (#2748), and the open decision points a steward waits on (#2749).",
   "oneOf": [{ "$ref": "#/$defs/result" }, { "$ref": "#/$defs/failure" }],
   "$defs": {
+    "boxShip": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["op", "gate", "env", "bookkeeping", "serving", "pending"],
+      "properties": {
+        "op": { "type": "string", "description": "The Op in the box member that commits the staged tree and releases it." },
+        "gate": { "type": "string", "description": "The gate the Op stops at for a person's approval." },
+        "env": { "type": "string", "description": "The environment whose release ledger, under the box member, the Op records each release in." },
+        "bookkeeping": { "type": "array", "items": { "type": "string" }, "description": "Path prefixes from the workspace root whose changes never count as waiting to ship." },
+        "serving": {
+          "description": "The latest release in env's ledger, the commit the box's site serves, or null when nothing has shipped or the ledger can't be read.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["commit", "digest", "component", "at", "actor"],
+              "properties": {
+                "commit": { "type": "string" },
+                "digest": { "type": "string" },
+                "component": { "type": "string" },
+                "at": { "type": "string" },
+                "actor": { "type": ["string", "null"] }
+              }
+            }
+          ]
+        },
+        "pending": {
+          "description": "What is waiting to ship: the files that differ between serving.commit and the working tree, tracked or untracked and not ignored, bookkeeping left out. paths is sorted and lists at most 200. Null when nothing has shipped or the serving commit isn't in this checkout.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["files", "paths"],
+              "properties": {
+                "files": { "type": "integer", "minimum": 0 },
+                "paths": { "type": "array", "items": { "type": "string" }, "maxItems": 200 }
+              }
+            }
+          ]
+        }
+      }
+    },
     "result": {
       "description": "The declaration was read. Exit code 0, even when some ledgers can't be read or members differ.",
       "type": "object",
@@ -31,6 +75,29 @@
             }
           }
         },
+        "checkout": {
+          "description": "Added in contract 1 by #3160. The branch, head and base of the checkout status ran in. records --uncommitted --json lists the records that working tree holds modified or new against head.",
+          "type": "object",
+          "required": ["branch", "head", "base", "baseFrom"],
+          "properties": {
+            "branch": { "type": ["string", "null"], "description": "The checked-out branch's short name, such as chant/work/w-12, or null when HEAD is detached." },
+            "head": { "type": ["string", "null"], "pattern": "^[0-9a-f]{40,64}$", "description": "The full commit id HEAD names, or null before the first commit." },
+            "base": {
+              "type": ["string", "null"],
+              "pattern": "^[0-9a-f]{40,64}$",
+              "description": "The merge base of head and the target branch tip (origin/HEAD, else main, else master), the commit the branch forked from. Null without a head, a target, or common history."
+            },
+            "baseFrom": { "enum": ["origin/HEAD", "main", "master", null], "description": "Where the target branch was found; null when there is none." }
+          }
+        },
+        "replication": {
+          "description": "Added in contract 1 by #3172. When a box block declares replicate (ws-085), where each ref it names (work branches, kept attempts, work-in-progress snapshots, the ledger branch) stands against the remote: replicated, or how many commits ahead. Read from the local refs and what chant recorded at its last push or fetch under refs/chant/replica/<remote>/; the command never fetches. chant workspace wip --json prints the same, with each branch's snapshots. null when no box declares replicate.",
+          "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/replication" }]
+        },
+        "plantable": {
+          "description": "Added in contract 1 by #3146. Whether a host such as a studio's planter can plant the workspace as one box: exactly one member's box block declares services. Not a check: a records-only or infra workspace is valid and simply not plantable.",
+          "$ref": "#/$defs/plantable"
+        },
         "workspace": {
           "type": "object",
           "required": ["name", "root", "file"],
@@ -103,11 +170,24 @@
     },
     "member": {
       "type": "object",
-      "required": ["name", "dir", "kind", "environments", "compare", "readable", "gateLedger", "gates", "box", "stewards", "stewardReasons"],
+      "required": ["name", "dir", "kind", "fields", "environments", "compare", "readable", "gateLedger", "gates", "box", "stewards", "stewardReasons"],
       "properties": {
         "name": { "type": "string" },
         "dir": { "type": "string", "description": "Relative to the workspace root, with / separators; \".\" is the root member." },
         "kind": { "type": "string" },
+        "fields": {
+          "description": "The fields the member's kind declares (#3151), each set from the entry or its default, null when it has neither. Null when the kind declares no fields or no pinned package supplies it. A value of the wrong type reads as the default, and chant workspace check reports it (WSP005). Added in contract 1 by chant 0.103.0.",
+          "type": ["object", "null"],
+          "additionalProperties": {
+            "oneOf": [
+              { "type": "string" },
+              { "type": "integer" },
+              { "type": "boolean" },
+              { "type": "null" },
+              { "type": "object", "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "integer" }, { "type": "boolean" }, { "type": "null" }] } }
+            ]
+          }
+        },
         "environments": {
           "description": "env first, then compareTo when it is given and differs from env.",
           "type": "array",
@@ -466,10 +546,77 @@
         "decided_on": { "type": ["string", "null"], "description": "The day it was decided, or null while it is proposed." }
       }
     },
+    "replication": {
+      "type": "object",
+      "required": ["policy", "remoteConfigured", "replicated", "refs"],
+      "properties": {
+        "policy": {
+          "type": "object",
+          "required": ["box", "remote", "refs", "on", "every"],
+          "properties": {
+            "box": { "type": "string", "description": "The member whose box block declares the policy." },
+            "remote": { "type": "string" },
+            "refs": { "type": "array", "items": { "enum": ["work", "kept", "wip", "ledger"] } },
+            "on": { "type": "array", "items": { "enum": ["save", "release"] } },
+            "every": { "type": ["string", "null"] }
+          }
+        },
+        "remoteConfigured": { "type": "boolean", "description": "Whether the checkout has a git remote of the policy's name." },
+        "replicated": { "type": "boolean", "description": "True when every ref listed is on the remote as it is locally." },
+        "refs": {
+          "type": "array",
+          "description": "Every local ref the policy names, sorted by ref.",
+          "items": {
+            "type": "object",
+            "required": ["ref", "class", "commit", "replica", "replicated", "ahead"],
+            "properties": {
+              "ref": { "type": "string", "description": "Such as refs/heads/chant/work/W-001, refs/chant/kept/W-001/<token>, refs/chant/wip/chant/work/W-001 or refs/heads/chant/lifecycle." },
+              "class": { "enum": ["work", "kept", "wip", "ledger"] },
+              "commit": { "type": "string", "pattern": "^[0-9a-f]{40,64}$" },
+              "replica": { "type": ["string", "null"], "pattern": "^[0-9a-f]{40,64}$", "description": "What the remote held of the ref as chant last saw it (or, for a branch, git's remote-tracking ref), or null when unknown." },
+              "replicated": { "type": "boolean" },
+              "ahead": { "type": "integer", "minimum": 0, "description": "Commits reachable from commit that nothing known to be on the remote reaches; 0 when replicated." }
+            }
+          }
+        }
+      }
+    },
     "box": {
       "type": "object",
       "required": ["capabilities", "isolation", "intent", "services"],
       "properties": {
+        "factory": {
+          "description": "Added in contract 1 by #3146. What the box builds and how (ws-077), with every default filled in, or null when the block declares no factory. At most one member's box has one.",
+          "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/factory" }]
+        },
+        "listing": {
+          "description": "Added in contract 1 by #3146. What the box shows of itself on a home site, or null when the block declares no listing.",
+          "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/listing" }]
+        },
+        "publisher": {
+          "description": "Added in contract 1 by #3165. The command that publishes the box's work, as the box block declares it (ws-088), or null when it names none. A surface offers a publish only when it is set, and asks for one with chant workspace box publish rather than running it.",
+          "type": ["string", "null"]
+        },
+        "ship": {
+          "description": "Added in contract 1 by ws-100. How the box ships its staged work to its own site, with defaults filled in, the release its site serves and what is waiting to ship, or null when the box block declares no ship. A surface offers Ship only when it is set: it runs chant run <op> in the member's directory with the person in CHANT_SHIP_BY and approves <gate> as for any Op.",
+          "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/boxShip" }]
+        },
+        "replicate": {
+          "description": "Added in contract 1 by #3172. Where the box's work in progress is replicated (ws-085), with every default filled in, or null when the block declares no policy. At most one member's box has one; the top-level replication says how far each ref is from the remote.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "required": ["remote", "refs", "on", "every"],
+              "properties": {
+                "remote": { "type": "string", "description": "The git remote, by name; origin when the block names none." },
+                "refs": { "type": "array", "items": { "enum": ["work", "kept", "wip", "ledger"] }, "description": "What is replicated, in this order; all four when the block names none." },
+                "on": { "type": "array", "items": { "enum": ["save", "release"] }, "description": "When chant pushes on its own; both when the block names none." },
+                "every": { "type": ["string", "null"], "description": "The interval at which the host runs chant workspace wip push, or null." }
+              }
+            }
+          ]
+        },
         "services": {
           "description": "The services the box block declares (#2880), in declaration order, or empty when it declares none. A reader has them before any converge tick; a steward's ConvergeOp's lastTick carries each one's verdict. cmd is as declared: its ${VAR} references are left for the process that applies it to expand. Added by chant 0.95.0.",
           "type": "array",
@@ -510,6 +657,93 @@
         }
       }
     },
+    "plantable": {
+      "type": "object",
+      "required": ["plantable", "box", "reason"],
+      "properties": {
+        "plantable": { "type": "boolean" },
+        "box": { "type": ["string", "null"], "description": "The member whose box block declares services, or null when the workspace isn't plantable." },
+        "reason": {
+          "description": "Why the workspace isn't plantable, or null when it is.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "required": ["code", "message"],
+              "properties": {
+                "code": { "enum": ["box-none", "box-several"] },
+                "message": { "type": "string" }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "factory": {
+      "type": "object",
+      "required": ["builds", "check", "checks", "builders", "tiers", "builderFor", "publish"],
+      "properties": {
+        "builds": { "type": "array", "minItems": 1, "items": { "type": "string" }, "description": "The members the factory builds, in declaration order. A work item a person asks for constrains member:<the first>." },
+        "check": {
+          "description": "The verdict command, run from the workspace root, and what it is; null when none is declared.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "required": ["run", "kind"],
+              "properties": {
+                "run": { "type": "string" },
+                "kind": { "enum": ["test", "build", "lint", "plan", "conformance"] }
+              }
+            }
+          ]
+        },
+        "checks": { "type": ["string", "null"], "description": "Where a work item's builder writes its check, from the workspace root, or null for the orchestrator's choice." },
+        "builders": { "type": ["string", "null"], "description": "The member that declares the builder agents, or null." },
+        "tiers": {"type": "array", "items": {"type": "object", "required": ["tier", "agent", "kinds", "session"], "properties": {"tier": {"type": "string"}, "agent": {"type": "string"}, "kinds": {"oneOf": [{"type": "null"}, {"type": "array", "items": {"type": "string"}}]}, "session": {"type": ["string", "null"]}}}, "description": "Which builder agent builds at which tier, as declared (#3152, ws-094), each { tier, agent, kinds, session } with kinds and session null when not declared; empty when none is. Added in contract 1 by chant 0.103.0."},
+        "builderFor": {"type": "object", "additionalProperties": {"type": "object", "additionalProperties": {"type": "object", "required": ["agent", "session"], "properties": {"agent": {"type": "string"}, "session": {"type": ["string", "null"]}}}}, "description": "The builder for each member the factory builds, by tier (#3152): member name, then tier, then { agent, session }. For a member the entry naming its kind is used, else the tier's entry with no kinds; a tier with neither is left out. Added in contract 1 by chant 0.103.0."},
+        "publish": {
+          "description": "Where a finished build is published, or null when the factory doesn't publish past the box.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "required": ["forge", "repo", "base", "branchPrefix", "head"],
+              "properties": {
+                "forge": { "const": "github" },
+                "repo": { "type": "string", "description": "owner/name: where the pull request is opened." },
+                "base": { "type": ["string", "null"], "description": "The branch the pull request targets, or null for the repository's default branch." },
+                "branchPrefix": { "type": "string", "description": "What the published branch's name starts with, before the work item's id. chant/work/ unless declared." },
+                "head": { "type": ["string", "null"], "description": "owner/name of the fork the branch is pushed to, or null to push to repo." }
+              }
+            }
+          ]
+        }
+      }
+    },
+    "listing": {
+      "type": "object",
+      "required": ["published", "title", "line", "cover"],
+      "properties": {
+        "published": { "type": "boolean", "description": "Whether the box is listed; true unless declared otherwise." },
+        "title": { "type": "string", "description": "Empty when not declared: a reader shows a name of its own." },
+        "line": { "type": "string", "description": "Empty when not declared." },
+        "cover": {
+          "description": "The cover image, or null when none is declared.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "required": ["path", "sha256"],
+              "properties": {
+                "path": { "type": "string", "description": "From the workspace root." },
+                "sha256": { "type": ["string", "null"], "pattern": "^[0-9a-f]{64}$", "description": "The sha256 of the file's bytes in the working tree, or null when it can't be read." }
+              }
+            }
+          ]
+        }
+      }
+    },
     "isolation": {
       "type": "object",
       "required": ["host", "slot", "portRange", "ports", "stateDir", "state", "cookies"],
@@ -571,7 +805,7 @@
     },
     "gate": {
       "type": "object",
-      "required": ["component", "name", "env", "planDigest", "state", "recordedAt", "expiresAt", "approvals", "needed", "approve"],
+      "required": ["component", "name", "env", "planDigest", "state", "recordedAt", "expiresAt", "approvals", "needed", "signed", "approve"],
       "properties": {
         "component": { "type": "string", "description": "The ledger file's key: the component, or the op for a gate an Op run reached." },
         "name": { "type": "string", "description": "The gate's name." },
@@ -591,16 +825,30 @@
           "type": "array",
           "items": {
             "type": "object",
-            "required": ["principal", "channel", "at"],
+            "required": ["principal", "channel", "relayedBy", "at"],
             "properties": {
               "principal": { "type": "string", "description": "Who recorded it." },
               "channel": { "type": ["string", "null"], "description": "The channel it was recorded on, such as cli or mcp, or null for a record older than chant#2384." },
+              "relayedBy": { "type": ["string", "null"], "description": "Added in contract 1 by #3402. Who carried the approval to chant for principal (chant approve --relayed-by), such as a follower relaying a person's approval; a seal covers it. Null when nobody relayed it." },
               "at": { "type": "string" }
             }
           }
         },
         "needed": { "type": "integer", "minimum": 1, "description": "The human approvals the gate needs: its quorum's count, 1 without one." },
-        "approve": { "type": "string", "description": "The chant approve line for the gate, run in the member's directory: chant approve <component> <gate>, with --env <env> when env is not null and --plan <planDigest> when planDigest is not null (#2832), so the line approves the plan this read showed." }
+        "signed": {
+          "description": "Added in contract 1 by #3163. The declaration's rule for the gate, read at base (identity.gates, ws-080): only an approval sealed with chant approve --sign by a key the signers file at base lists for its approver counts, and when class is not null, only one whose approver the role grants at base put in that class. Approvals that don't meet it are left out of approvals and state. Null when any approval counts.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "required": ["class"],
+              "properties": {
+                "class": { "type": ["string", "null"], "description": "The principal class the signer must be in, or null for any listed signer." }
+              }
+            }
+          ]
+        },
+        "approve": { "type": "string", "description": "The chant approve line for the gate, run in the member's directory: chant approve <component> <gate>, with --env <env> when env is not null and --plan <planDigest> when planDigest is not null (#2832), so the line approves the plan this read showed, and --sign when signed is not null (#3163). The caller adds --actor <principal>." }
       }
     },
     "environment": {

package/src/workspace/status.ts

@@ -41,11 +41,17 @@ import { readPathSha } from "../lifecycle/git";
 import { latestPerComponent, readReleaseLedger, type ReleaseRecord } from "../lifecycle/release-ledger";
 import { readReleasePlan, type ReleasePlan } from "../lifecycle/plan-ledger";
 import { listWorkLeases, type WorkLeaseState } from "../lifecycle/work-lease";
+import { readCheckoutHead, type CheckoutHead } from "./records-checkout";
+import { policyView, replicationState, type ReplicationState } from "./wip";
 import { findWorkspaceRoot } from "../project-root";
 import { resolveBoxes, type ResolvedIsolation } from "./box-isolation";
 import { resolveBoxIntents, unresolvedIntent, type BoxIntent } from "./box-intent";
+import { loadKindRegistry, resolveMemberFields, type MemberFields } from "./kinds";
+import { factoryView, listingView, plantability, treeBytes, type FactoryView, type ListingView, type Plantable } from "./box-factory";
 import { declaredRecordKinds, readDeclaration, readerVersion, WorkspaceReadError, type Declaration, type ErrorLocation, type Member } from "./declaration";
 import type { ReasonCode } from "./reason-codes";
+import { gateAdmissionFrom } from "./identity";
+import { scopeSource } from "./write-scope";
 import { GATE_REASON_CODES, readMemberGates, type GateLedgerReader, type StatusGate, type StatusGateLedger } from "./status-gates";
 import { STEWARD_REASON_CODES, readMemberStewards, type StatusSteward, type StewardReasonCode } from "./status-stewards";
 import { gitTop, workingTree } from "./tree";
@@ -156,6 +162,13 @@ export interface StatusMember {
   name: string;
   dir: string;
   kind: string;
+  /**
+   * The fields the member's kind declares (#3151), each set from the entry or
+   * its default (null when it has none), or null when the kind declares no
+   * fields or no pinned package supplies it. A value of the wrong type reads
+   * as the default; `chant workspace check` reports it (WSP005).
+   */
+  fields: MemberFields["fields"];
   /** The environment asked for first, then the one compared to, if any. */
   environments: StatusEnvironment[];
   /** Null without `--compare-to`. */
@@ -174,6 +187,31 @@ export interface StatusMember {
   stewardReasons: { code: StewardReasonCode; message: string }[];
 }
 
+/** The most paths `ship.pending.paths` lists; `files` still counts them all. */
+export const SHIP_PENDING_PATHS_MAX = 200;
+
+/**
+ * A box's ship (ws-100): the Op, gate and environment it declares, the
+ * release its site serves (the latest in that environment's release ledger
+ * under the box member), and what is waiting to ship.
+ */
+export interface StatusBoxShip {
+  op: string;
+  gate: string;
+  env: string;
+  bookkeeping: string[];
+  /** The latest release in `env`'s ledger: the commit the box's site serves. Null when nothing has shipped, or the ledger can't be read. */
+  serving: { commit: string; digest: string; component: string; at: string; actor: string | null } | null;
+  /**
+   * The files that differ between `serving.commit` and the working tree
+   * (tracked changes, committed or not, and untracked files git does not
+   * ignore), bookkeeping left out; `paths` sorted, at most
+   * SHIP_PENDING_PATHS_MAX of them. Null when nothing has shipped or the
+   * serving commit isn't in this checkout.
+   */
+  pending: { files: number; paths: string[] } | null;
+}
+
 /** A box's brokered capabilities, from the declaration (#2726). */
 export interface StatusBox {
   capabilities: { name: string; broker: string | null; scope: string[] }[];
@@ -188,6 +226,16 @@ export interface StatusBox {
   intent: BoxIntent | null;
   /** The services the block declares (#2880), in file order, so a reader has them before any converge tick. Empty when it declares none. */
   services: StatusBoxService[];
+  /** What the box builds and how, with defaults filled in (#3146, ws-077), or null when the block declares no factory. */
+  factory: FactoryView | null;
+  /** What the box shows of itself on a home site, with the cover's sha256 (#3146), or null when the block declares no listing. */
+  listing: ListingView | null;
+  /** The command that publishes the box's work, as declared (#3165, ws-088), or null when the block names none. */
+  publisher: string | null;
+  /** How the box ships its staged work, what its site serves and what is waiting (ws-100), or null when the block declares no ship. */
+  ship: StatusBoxShip | null;
+  /** Where the box's work in progress is replicated, with defaults filled in (#3172, ws-085), or null when the block declares no policy. */
+  replicate: { remote: string; refs: string[]; on: string[]; every: string | null } | null;
 }
 
 /** A declared box service as `status --json` prints it (#2880): every field present, null or false when not declared. */
@@ -234,12 +282,18 @@ export type StatusDocument =
       env: string;
       compareTo: string | null;
       lifecycle: { ref: string; commit: string | null };
+      /** The branch, head and base of the checkout read (#3160). `records --uncommitted` lists the records it holds uncommitted. */
+      checkout: CheckoutHead;
       workspace: { name: string; root: string; file: string };
+      /** Whether a host can plant the workspace as one box (#3146): exactly one member's box block declares services. */
+      plantable: Plantable;
       members: StatusMember[];
       /** Every work lease in the workspace's ledgers, active and expired, by member then item (#2732). A released lease has no ref and is not listed. */
       leases: StatusLease[];
       /** Each work item's acceptance criteria, met of total, by declared kind then item (#2772). Empty when no declared work kind has criteria. */
       acceptance: StatusAcceptance[];
+      /** How far each ref the box's replicate policy names is from its remote (#3172), read locally; null when no box declares one. */
+      replication: ReplicationState | null;
       summary: { members: number; released: number; unreadable: number; differing: number | null };
     }
   | {
@@ -309,6 +363,40 @@ async function ledgerFor(member: Member, env: string, cwd: string): Promise<Omit
   return { layout: "flat", path: `${env}/releases.jsonl` };
 }
 
+/** A box's ship as status prints it (ws-100). Never throws: what can't be read is null. */
+async function shipView(member: Member, cwd: string, read: LedgerReader): Promise<StatusBoxShip | null> {
+  const ship = member.box?.ship;
+  if (!ship) return null;
+  const view: StatusBoxShip = { op: ship.op, gate: ship.gate, env: ship.env, bookkeeping: [...ship.bookkeeping], serving: null, pending: null };
+  let records: ReleaseRecord[] = [];
+  try {
+    records = (await read((await ledgerFor(member, ship.env, cwd)).path, cwd)).records;
+  } catch {
+    return view;
+  }
+  const last = records[records.length - 1];
+  if (!last) return view;
+  view.serving = { commit: last.gitSha, digest: last.digest, component: last.component, at: last.timestamp, actor: last.actor ?? null };
+  const top = gitTop(cwd);
+  if (!top) return view;
+  const lines = (args: string[]): string[] | null => {
+    try {
+      return execFileSync("git", args, { cwd: top, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 }).split("\0").filter(Boolean);
+    } catch {
+      return null;
+    }
+  };
+  // The commit must be here: a release from a commit this checkout never had says nothing about it.
+  if (lines(["cat-file", "-e", `${last.gitSha}^{commit}`]) === null) return view;
+  const changed = lines(["diff", "--name-only", "-z", "--no-renames", last.gitSha, "--"]);
+  const untracked = lines(["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (changed === null || untracked === null) return view;
+  const bookkeeping = (path: string) => ship.bookkeeping.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+  const paths = [...new Set([...changed, ...untracked])].filter((path) => !bookkeeping(path)).sort();
+  view.pending = { files: paths.length, paths: paths.slice(0, SHIP_PENDING_PATHS_MAX) };
+  return view;
+}
+
 const defaultReader: LedgerReader = (path, cwd) => readReleaseLedger(path.slice(0, -"/releases.jsonl".length), { cwd });
 
 async function readEnvironment(member: Member, env: string, cwd: string, read: LedgerReader): Promise<StatusEnvironment> {
@@ -399,17 +487,24 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
 
     const isolation = new Map(resolveBoxes(declaration).map((b) => [b.member.name, b.isolation]));
     const intents = new Map((await resolveBoxIntents(declaration, found.dir)).map((i) => [i.member, i.record?.intent ?? unresolvedIntent(i.id)]));
+    const coverBytes = treeBytes(workingTree(found.dir));
+    // The kinds the pins supply (#3151), for each member's fields. A pin that can't be read is check's to report (WSP002).
+    const kinds = loadKindRegistry(declaration.pins, found.dir).registry;
+    // #3163: the declaration's identity.gates at base, read once for every member's gates.
+    const ruleSource = scopeSource(found.dir);
+    const rules = (gate: string) => gateAdmissionFrom(ruleSource, gate);
     const members: StatusMember[] = [];
     for (const m of declaration.members) {
       const environments: StatusEnvironment[] = [];
       for (const env of envs) environments.push(await readEnvironment(m, env, found.dir, read));
       const own = await hasMemberLedger(m, found.dir);
-      const gates = await readMemberGates(own ? `${MEMBERS_DIR}/${m.name}/${GATES_DIR}` : GATES_DIR, own ? "members" : "flat", commit, envs, found.dir, now, query.readGates);
+      const gates = await readMemberGates(own ? `${MEMBERS_DIR}/${m.name}/${GATES_DIR}` : GATES_DIR, own ? "members" : "flat", commit, envs, found.dir, now, query.readGates, rules);
       const stewards = await (query.readStewards ?? readMemberStewards)(resolve(found.dir, m.dir), query.env, now, m.kind, m.box);
       members.push({
         name: m.name,
         dir: m.dir,
         kind: m.kind,
+        fields: resolveMemberFields(kinds.get(m.kind), m.fields).fields,
         environments,
         compare: query.compareTo === undefined ? null : compareEnvironments(environments[0], environments[environments.length - 1]),
         readable: environments.every((e) => e.reason === null),
@@ -431,6 +526,11 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
                   health: s.health,
                   optional: s.optional,
                 })),
+                factory: factoryView(m.box.factory, declaration.members),
+                listing: listingView(m.box.listing, coverBytes),
+                publisher: m.box.publisher,
+                ship: await shipView(m, found.dir, read),
+                replicate: m.box.replicate === null ? null : (({ box: _box, ...rest }) => rest)(policyView(m.name, m.box.replicate)),
               },
         stewards: stewards.stewards,
         stewardReasons: stewards.reasons,
@@ -451,10 +551,13 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
       env: query.env,
       compareTo: query.compareTo ?? null,
       lifecycle: { ref: LIFECYCLE_REF, commit },
+      checkout: readCheckoutHead(top),
       workspace: { name: declaration.name, root: rootDir === "" ? "." : rootDir, file: declaration.file },
+      plantable: plantability(declaration),
       members,
       leases,
       acceptance,
+      replication: replicationOf(declaration, top),
       summary: {
         members: members.length,
         released: members.filter((m) => m.environments[0].releases.length > 0).length,
@@ -611,3 +714,9 @@ export function formatStatus(doc: Extract<StatusDocument, { members: unknown }>)
   );
   return lines.join("\n");
 }
+
+/** Where the box's work in progress stands against its remote (#3172), or null when no box block declares replicate. */
+function replicationOf(declaration: Declaration, top: string): ReplicationState | null {
+  const m = declaration.members.find((x) => x.box?.replicate);
+  return m ? replicationState(top, policyView(m.name, m.box!.replicate!)) : null;
+}