@intentius/chant 0.102.0 → 0.104.0

package/src/cli/handlers/fan-out.ts

@@ -33,19 +33,28 @@
  * `--resume` carries the earlier attempt's progress, `remainingFanOut` narrows
  * the plan before the gate is decided, and the digest is carried rather than
  * recomputed, so the approval still stands.
+ *
+ * `--wave-gate <name>` (#3049) swaps the one gate for one per wave: the same
+ * repeated command stops at each wave's gate in turn, each planned after the
+ * wave before it applied, and `chant approve fan-out <name>-wave-<n>` answers
+ * it. `--wave <n>` runs one wave, for a CI job per wave.
  */
 
 import { resolve, dirname } from "node:path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { loadChantConfig, resolveAutoReleaseDisabled, type ChantConfig } from "../../config";
 import { samePlanDigest } from "../../lifecycle/plan-digest";
 import { affectedStacks } from "../../lifecycle/affected";
+import { changedFilesBetween, lexiconChangedUnits } from "../../components/changed-files";
 import { deriveFanOut, fanOutRegistry } from "../../components/fan-out-support";
-import { runFanOut } from "../../components/fan-out-run";
+import { EarlierWaveNotAppliedError, runFanOut } from "../../components/fan-out-run";
+import { readFanOutAttempt, writeFanOutAttempt, type FanOutAttempt } from "../../components/fan-out-record";
+import { describeChangedWave, withWaveRecord, type WaveRecord } from "../../gated-waves";
 import { renderFanOutHuman, renderFanOutJson, renderFanOutPlan } from "../../components/fan-out-output";
 import { ndjsonProgressSink } from "../../components/run-progress";
 import { summaryLedgerPrefix, writeGatedRunSummary } from "../../op/gate-summary";
 import { approveCommand } from "../../op/gate";
+import { getHeadCommit } from "../../lifecycle/git";
 import { remainingFanOut, type ChangedUnits, type FanOutProgress } from "../../components/fan-out";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 import { formatError, formatInfo, formatWarning } from "../format";
@@ -54,37 +63,6 @@ import { resolveBuildRoot } from "./lifecycle";
 import { GATED_EXIT_CODE, recordAutoReleasesForRun } from "./run";
 import type { CommandContext } from "../registry";
 
-
-
-/**
- * What an attempt left behind, and what the next one reads (`--resume`).
- *
- * The digest is stored alongside the progress because progress is only
- * meaningful for the plan it was made against. A fan-out derived from different
- * source is a different fan-out, and carrying "cluster-a already applied" into
- * it would be a claim about work nobody did.
- */
-interface FanOutAttempt {
-  digest: string;
-  completed: string[];
-  failed: string[];
-}
-
-function readAttempt(path: string): FanOutAttempt | undefined {
-  if (!existsSync(path)) return undefined;
-  const parsed = JSON.parse(readFileSync(path, "utf8")) as Partial<FanOutAttempt>;
-  return {
-    digest: typeof parsed.digest === "string" ? parsed.digest : "",
-    completed: Array.isArray(parsed.completed) ? parsed.completed.filter((n): n is string => typeof n === "string") : [],
-    failed: Array.isArray(parsed.failed) ? parsed.failed.filter((n): n is string => typeof n === "string") : [],
-  };
-}
-
-function writeAttempt(path: string, attempt: FanOutAttempt): void {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, JSON.stringify(attempt, null, 2) + "\n");
-}
-
 /**
  * The stack-level change signal, from whichever end the invocation supplied.
  *
@@ -100,13 +78,20 @@ function writeAttempt(path: string, attempt: FanOutAttempt): void {
  * consumes a changed export is affected at stack granularity in the same way a
  * changed component is at component granularity.
  */
-async function resolveChangedUnits(
+export async function resolveChangedUnits(
   ctx: CommandContext,
   config: ChantConfig,
+  opts: {
+    /** Measure from this commit instead of `--base` (a pull request's merge base, #3183). */
+    base?: string;
+    /** Build both refs for `lifecycle affected` only when the project declares `stacks`. */
+    stacksOnly?: boolean;
+  } = {},
 ): Promise<{ units: ChangedUnits } | { error: string; hint?: string }> {
   const { args } = ctx;
+  const base = opts.base ?? args.base;
   const fromFile = args.fromAffected;
-  if (args.base && fromFile) {
+  if (base && fromFile) {
     return {
       error: "--base and --from-affected both name a change signal",
       hint: "Pass --base <ref> to derive it here, or --from-affected <file> to read one `chant lifecycle affected --json` already wrote.",
@@ -136,7 +121,7 @@ async function resolveChangedUnits(
     };
   }
 
-  if (!args.base) {
+  if (!base) {
     return {
       error: "A change signal is required: chant components fan-out --base <ref> [--head <ref>]",
       hint: "Or pass --from-affected <file> with the JSON `chant lifecycle affected --base <ref> --json` wrote.",
@@ -144,23 +129,37 @@ async function resolveChangedUnits(
   }
 
   try {
-    const result = await affectedStacks({
-      // Components are discovered from the current directory, the convention
-      // every component command follows. In a multi-stack project the diff
-      // reads the same root, because `stacks[].src` is written relative to it.
-      projectPath: config.stacks?.length ? resolve(".") : resolveBuildRoot(args, config),
-      serializers: ctx.plugins.map((p) => p.serializer),
-      baseRef: args.base,
-      headRef: args.head,
-      includeDependents: args.includeDependents,
-      // A project that declares its stacks gets an answer keyed by stack name,
-      // which is the name a component's deploy step uses. Without this the diff
-      // answers by lexicon partition and the join below claims none of it.
-      ...(config.stacks ? { stacks: config.stacks } : {}),
-    });
+    // A unit that is not chant source, such as a Terraform root, never shows
+    // in the artifact diff below; the lexicon that owns it answers from the
+    // changed paths (#3183).
+    const projectRoot = resolve(".");
+    const lexiconUnits = ctx.plugins.some((p) => p.changedUnits)
+      ? await lexiconChangedUnits(ctx.plugins, {
+          projectRoot,
+          config: config as Record<string, unknown>,
+          changedFiles: await changedFilesBetween(projectRoot, base, args.head ?? "HEAD"),
+        })
+      : [];
+    const result =
+      opts.stacksOnly && !config.stacks?.length
+        ? { changed: [], dependents: [], indeterminate: [] }
+        : await affectedStacks({
+            // Components are discovered from the current directory, the convention
+            // every component command follows. In a multi-stack project the diff
+            // reads the same root, because `stacks[].src` is written relative to it.
+            projectPath: config.stacks?.length ? resolve(".") : resolveBuildRoot(args, config),
+            serializers: ctx.plugins.map((p) => p.serializer),
+            baseRef: base,
+            headRef: args.head,
+            includeDependents: args.includeDependents,
+            // A project that declares its stacks gets an answer keyed by stack name,
+            // which is the name a component's deploy step uses. Without this the diff
+            // answers by lexicon partition and the join below claims none of it.
+            ...(config.stacks ? { stacks: config.stacks } : {}),
+          });
     return {
       units: {
-        changed: [...new Set([...result.changed, ...result.dependents])].sort(),
+        changed: [...new Set([...result.changed, ...result.dependents, ...lexiconUnits])].sort(),
         indeterminate: result.indeterminate,
       },
     };
@@ -190,6 +189,21 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
     return 1;
   }
 
+  // The two gate modes (#3049). `--gate` approves the whole set once, as
+  // #2417 decided; `--wave-gate` approves each wave once the waves before it
+  // applied. They answer different questions, so one run takes one of them.
+  if (args.gate && args.waveGate) {
+    console.error(formatError({
+      message: "--gate and --wave-gate both name a gate",
+      hint: "Pass --gate <name> for one approval over the whole set, or --wave-gate <name> for one per wave.",
+    }));
+    return 1;
+  }
+  if (args.wave !== undefined && !args.waveGate) {
+    console.error(formatError({ message: "--wave runs one wave of a gated-wave fan-out, so it needs --wave-gate <name>" }));
+    return 1;
+  }
+
   const signal = await resolveChangedUnits(ctx, config);
   if ("error" in signal) {
     console.error(formatError({ message: signal.error, ...(signal.hint ? { hint: signal.hint } : {}) }));
@@ -204,6 +218,7 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
       sandbox: args.sandbox,
       buildParams: paramsResolution.provenance,
       config,
+      ...(args.canary?.length ? { canary: args.canary } : {}),
     });
   } catch (err) {
     // A cycle or an unknown `dependsOn` refuses here, over the whole graph and
@@ -226,6 +241,9 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   }
 
   const gate = args.gate ? { op: FAN_OUT_GATE_OP, gate: args.gate } : undefined;
+  const waveGate = args.waveGate
+    ? { op: FAN_OUT_GATE_OP, gate: args.waveGate, ...(args.wave !== undefined ? { only: args.wave } : {}) }
+    : undefined;
 
   // `--resume`: what an earlier attempt at this same plan finished. Read before
   // the dry-run branch so a plan-only invocation shows what is actually left
@@ -234,11 +252,13 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   // approval survives the resume rather than being re-asked for.
   const resumePath = args.resume ? resolve(args.resume) : undefined;
   let priorCompleted: string[] = [];
+  let priorOutputs: Record<string, Record<string, unknown>> = {};
+  let priorWaves: WaveRecord[] = [];
   let progress: FanOutProgress | undefined;
   if (resumePath) {
     let attempt: FanOutAttempt | undefined;
     try {
-      attempt = readAttempt(resumePath);
+      attempt = readFanOutAttempt(resumePath);
     } catch (err) {
       console.error(formatError({ message: `--resume: could not read "${args.resume}": ${err instanceof Error ? err.message : String(err)}` }));
       return 1;
@@ -255,16 +275,22 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
       // exists to retry them — the operator repeated the command precisely
       // because the thing that failed is now expected to work.
       priorCompleted = attempt.completed;
+      priorOutputs = Object.fromEntries(
+        Object.entries(attempt.outputs).filter(([name]) => attempt.completed.includes(name)),
+      );
       progress = { completed: attempt.completed };
+      priorWaves = attempt.waves ?? [];
     }
   }
 
   if (args.dryRun) {
     // `remainingFanOut` carries the digest rather than minting a new one, so
     // the digest printed here is the same string that approves the real run.
-    const plan = progress ? remainingFanOut(derived.plan, derived.components, progress) : derived.plan;
+    // A gated-wave fan-out keeps the derivation's wave numbers, since they
+    // name the gates, so its plan is printed whole.
+    const plan = progress && !waveGate ? remainingFanOut(derived.plan, derived.components, progress) : derived.plan;
     if (args.json) renderFanOutJson(plan);
-    else renderFanOutPlan(plan, { ...(gate ? { gate } : {}) });
+    else renderFanOutPlan(plan, { ...(gate ? { gate } : {}), ...(waveGate ? { waveGate } : {}) });
     return 0;
   }
 
@@ -279,13 +305,72 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   }
 
   const registry = await fanOutRegistry(projectPath, config);
-  const result = await runFanOut(derived.plan, derived.components, registry, {
-    env: args.env ?? "local",
-    componentOutputs: seededOutputs,
-    ...(gate ? { gate } : {}),
-    ...(progress ? { progress } : {}),
-    ...(args.progressJson ? { onProgress: ndjsonProgressSink() } : {}),
-  });
+  // #3061: the commit this run deploys, for the workloads' vcs.ref.head.revision.
+  const revision = await getHeadCommit().catch(() => undefined);
+
+  // The record is rewritten as each component settles, not only once the run
+  // returns. A fan-out killed in its third wave (a cancelled CI job, a lost
+  // runner, ctrl-c) then still knows that the first two applied, and the
+  // repeated command picks up from there instead of redoing them.
+  const completedSoFar = new Set(priorCompleted);
+  const failedSoFar: string[] = [];
+  const outputsSoFar = { ...priorOutputs };
+  let wavesSoFar = priorWaves;
+  const recordAttempt = (): void => {
+    if (!resumePath) return;
+    const attempt: FanOutAttempt = {
+      digest: derived.plan.digest,
+      completed: [...completedSoFar].sort(),
+      failed: [...failedSoFar].sort(),
+      outputs: outputsSoFar,
+      ...(wavesSoFar.length > 0 ? { waves: wavesSoFar } : {}),
+    };
+    writeFanOutAttempt(resumePath, attempt);
+  };
+
+  let result;
+  try {
+    result = await runFanOut(derived.plan, derived.components, registry, {
+      env: args.env ?? "local",
+      releaseIdentity: () => (revision ? { revision } : {}),
+      // A completed component's recorded outputs win over a `--seed-outputs`
+      // entry for the same name, as a fresh apply's outputs merge over a seed in
+      // the driver: the record holds what this fan-out itself applied.
+      componentOutputs: { ...seededOutputs, ...priorOutputs },
+      ...(gate ? { gate } : {}),
+      ...(waveGate ? { waveGate } : {}),
+      ...(waveGate
+        ? {
+            onWaveSettled: (record: WaveRecord) => {
+              wavesSoFar = withWaveRecord(wavesSoFar, record);
+              recordAttempt();
+            },
+          }
+        : {}),
+      ...(progress ? { progress } : {}),
+      ...(args.progressJson ? { onProgress: ndjsonProgressSink() } : {}),
+      ...(resumePath
+        ? {
+            onComponentSettled: (settled, outputs) => {
+              if (settled.status === "ok") {
+                completedSoFar.add(settled.component);
+                if (outputs) outputsSoFar[settled.component] = outputs;
+              } else if (settled.status === "fail") {
+                failedSoFar.push(settled.component);
+              }
+              recordAttempt();
+            },
+          }
+        : {}),
+    });
+  } catch (err) {
+    // `--wave <n>` reached before an earlier wave applied: nothing ran.
+    if (err instanceof EarlierWaveNotAppliedError) {
+      console.error(formatError({ message: err.message }));
+      return 1;
+    }
+    throw err;
+  }
 
   if (args.dumpOutputs) {
     const dumpPath = resolve(args.dumpOutputs);
@@ -293,25 +378,28 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
     writeFileSync(dumpPath, JSON.stringify(result.componentOutputs, null, 2));
   }
 
-  // Written even on a failure and even on a gate: the next attempt needs to
-  // know what this one got through, and a gated attempt got through nothing,
-  // which is itself worth recording against this plan's digest.
-  if (resumePath) {
-    writeAttempt(resumePath, {
-      digest: result.plan.digest,
-      completed: [...new Set([...priorCompleted, ...result.completed])].sort(),
-      failed: result.failed,
-    });
-  }
+  // Written again at the end, even on a failure and even on a gate: a gated
+  // attempt got through nothing, which is itself worth recording against this
+  // plan's digest.
+  recordAttempt();
 
   if (args.json) renderFanOutJson(result);
-  else renderFanOutHuman(result, { ...(gate ? { gate } : {}) });
+  else renderFanOutHuman(result, { ...(gate ? { gate } : {}), ...(waveGate ? { waveGate } : {}) });
+
+  // A wave whose set moved after its approval stops with both digests named
+  // (#3049), the #2300 refusal on a set. Printed on stderr even under --json,
+  // since it is the line a CI log reader is looking for.
+  for (const wave of result.waves ?? []) {
+    if (wave.status === "gated" && wave.approved) console.error(formatWarning({ message: describeChangedWave(wave) }));
+  }
 
   // The same durable trace `chant run --components` leaves (#597), for the
   // components this fan-out actually applied. A partial fan-out records the
   // branches that finished and nothing else, which is the whole reason the
   // runner reports `completed` separately from `failed`.
-  if (result.status !== "gated") {
+  // A gated-wave run can stop at a later wave's gate after earlier waves
+  // applied, and those applies are recorded like any other.
+  if (result.status !== "gated" || result.completed.length > 0) {
     await recordAutoReleasesForRun(
       result.results,
       args.env ?? "local",
@@ -320,7 +408,9 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
     );
   }
 
-  if (result.status === "gated" && result.gate) {
+  // A failed root outranks a gate in the status, but a gated-wave run that
+  // stopped at a wave's gate still prints how to approve it.
+  if (result.gate && (result.status === "gated" || waveGate)) {
     const pending = result.gate;
     // The pending fact's own plan: the fan-out's digest for the gate over the
     // set, or a component's plan and environment for a gate inside one (#2574).
@@ -337,7 +427,7 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
       ...(await summaryLedgerPrefix()),
       ...(pending.environment ? { environment: pending.environment } : {}),
     });
-    return GATED_EXIT_CODE;
+    return result.status === "gated" ? GATED_EXIT_CODE : 1;
   }
 
   return result.status === "ok" ? 0 : 1;

package/src/cli/handlers/graph.ts

@@ -637,6 +637,9 @@ async function runComponentGraphView(
         // `chant workspace graph --composites` labels a component without
         // importing its source.
         ...(graph.archetypes?.[name] ? { archetype: graph.archetypes[name] } : {}),
+        // The environments the component declares (#3153), where each release goes, so
+        // `chant workspace graph --composites` lists them without importing its source.
+        ...(graph.environments?.[name] ? { environments: graph.environments[name] } : {}),
       },
       // Deep-link the node to its `*.component.ts` (behold's inspect panel).
       ...(graph.files?.[name] ? { sourceLoc: { file: graph.files[name] } } : {}),

package/src/cli/handlers/operator.test.ts

@@ -455,6 +455,27 @@ describe("runApprove", () => {
     vi.unstubAllEnvs();
   });
 
+  // #3402 — a relayed approval names who relayed it, typed, not in --note.
+  test("--relayed-by is recorded on the resolution line, and a blank one is refused", async () => {
+    seedPending("fountain-apply", "rollout-gate", PLAN_A);
+    appendGateResolutionMock.mockResolvedValue({
+      commit: "sha",
+      record: { version: 1, op: "fountain-apply", gate: "rollout-gate", resolvedBy: "github:alice", relayedBy: "github:hud-follower", timestamp: "2026-01-01T00:00:00.000Z" },
+    });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "fountain-apply", extraPositional: "rollout-gate", actor: "github:alice", relayedBy: "github:hud-follower" }))).toBe(0);
+    expect(appendGateResolutionMock).toHaveBeenCalledWith(
+      expect.objectContaining({ resolvedBy: "github:alice", relayedBy: "github:hud-follower" }),
+    );
+    expect(errSpy.mock.calls.flat().join("\n")).toMatch(/resolved by github:alice, relayed by github:hud-follower,/);
+
+    appendGateResolutionMock.mockClear();
+    expect(await runApprove(ctx({ path: "fountain-apply", extraPositional: "rollout-gate", actor: "github:alice", relayedBy: "a\nb" }))).toBe(1);
+    expect(appendGateResolutionMock).not.toHaveBeenCalled();
+    errSpy.mockRestore();
+  });
+
   test("without --url, the surrounding PR/MR job is itself the address", async () => {
     vi.stubEnv("GITHUB_SERVER_URL", "https://github.com");
     vi.stubEnv("GITHUB_REPOSITORY", "INTENTIUS/chant");

package/src/cli/handlers/operator.ts

@@ -134,6 +134,9 @@ async function collectOperatorSubscribers(
   }
 }
 
+/** A pull request's gate op, `pr-<number>` (#3183, `prOp` in ../../pr-loop.ts). */
+const PR_GATE_OP = /^pr-\d+$/;
+
 // ── chant operator ──────────────────────────────────────────────────────────
 
 /**
@@ -882,7 +885,9 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
     console.error(formatInfo(
       opName === FAN_OUT_GATE_OP
         ? `The next \`chant components fan-out\` decides this gate from scratch and records a fresh pending fact.`
-        : opName === WORKSPACE_UPGRADE_GATE_OP
+        : PR_GATE_OP.test(opName)
+          ? `The next \`chant components pr-apply\` decides this gate from scratch and records a fresh pending fact.`
+          : opName === WORKSPACE_UPGRADE_GATE_OP
           ? `The next \`chant workspace upgrade ${gate}\` decides this gate from scratch and records a fresh pending fact.`
           : `The next \`chant run ${opName}\` decides this gate from scratch and records a fresh pending fact.`,
     ));
@@ -903,6 +908,7 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
     ...(ctx.args.roles ? { roles: ctx.args.roles } : {}),
     ...(ctx.args.agent ? { agent: true } : {}),
     ...(ctx.args.sign !== undefined ? { sign: ctx.args.sign } : {}),
+    ...(ctx.args.relayedBy !== undefined ? { relayedBy: ctx.args.relayedBy } : {}),
   });
   if (!outcome.ok) return 1;
 
@@ -910,7 +916,9 @@ export async function runApprove(ctx: CommandContext): Promise<number> {
     `This records the resolution as a fact; it does not itself re-run anything. ` +
       (opName === FAN_OUT_GATE_OP
         ? `Repeat the \`chant components fan-out\` command and it walks through gate "${gate}".`
-        : opName === WORKSPACE_UPGRADE_GATE_OP
+        : PR_GATE_OP.test(opName)
+          ? `The pull request's apply (\`chant components pr-apply\`) walks through gate "${gate}" when it plans this same digest.`
+          : opName === WORKSPACE_UPGRADE_GATE_OP
           ? `Repeat \`chant workspace upgrade ${gate}\` with the same target, and it applies the patch this approval names.`
           : `Run \`chant run ${opName}\` and it walks through gate "${gate}".`),
   ));
@@ -938,6 +946,13 @@ export interface GateApprovalOptions {
   actor?: string;
   /** `--note` — free-text prose. */
   note?: string;
+  /**
+   * `--relayed-by <principal>` (#3402): who carried this approval to chant for
+   * the approver, such as a follower program relaying a person's approval.
+   * Recorded as `relayedBy` on the resolution line and covered by `--sign`.
+   * The approver is still `--actor`; the relay is not an approver.
+   */
+  relayedBy?: string;
   /** `--url` — the approval surface, validated as absolute http/https. */
   url?: string;
   /**
@@ -1101,6 +1116,16 @@ export async function recordGateApproval(
     return { ok: false };
   }
 
+  // #3402: the relay is a principal, on one line (the seal's payload is LF-joined).
+  const relayedBy = opts.relayedBy?.trim();
+  if (opts.relayedBy !== undefined && (!relayedBy || /[\r\n]/.test(relayedBy))) {
+    console.error(formatError({
+      message: `--relayed-by needs one principal on one line (got ${JSON.stringify(opts.relayedBy)})`,
+      hint: "Name who relayed the approval, such as --relayed-by github:<login> or a principal the signers file lists.",
+    }));
+    return { ok: false };
+  }
+
   const resolvedBy = opts.actor
     ?? (isModelAuthored(origin)
       // A channel that cannot attest to a name does not get to write one down.
@@ -1126,6 +1151,7 @@ export async function recordGateApproval(
   const scope = scopeSource(cwd);
   try {
     identity.refuseUnidentified(scope, [resolvedBy], opts.actor !== undefined ? "--actor" : "the approver");
+    if (relayedBy) identity.refuseUnidentified(scope, [relayedBy], "--relayed-by");
   } catch (err) {
     if (!(err instanceof identity.IdentityError)) throw err;
     console.error(formatError({
@@ -1158,6 +1184,7 @@ export async function recordGateApproval(
           ...(environment !== undefined ? { environment } : {}),
           ...(planDigest !== undefined ? { planDigest } : {}),
           resolvedBy,
+          ...(relayedBy ? { relayedBy } : {}),
           timestamp,
         });
       } finally {
@@ -1176,6 +1203,7 @@ export async function recordGateApproval(
       ...(environment !== undefined ? { environment } : {}),
       ...(planDigest !== undefined ? { planDigest } : {}),
       resolvedBy,
+      ...(relayedBy ? { relayedBy } : {}),
       timestamp,
       seal,
     });
@@ -1230,6 +1258,7 @@ export async function recordGateApproval(
     op: opName,
     gate,
     resolvedBy,
+    ...(relayedBy ? { relayedBy } : {}),
     timestamp,
     ...(seal ? { seal } : {}),
     approver,
@@ -1247,7 +1276,9 @@ export async function recordGateApproval(
   );
 
   console.error(formatSuccess(
-    `Gate "${gate}" on "${opName}" resolved by ${record.resolvedBy} at ${record.timestamp}` +
+    `Gate "${gate}" on "${opName}" resolved by ${record.resolvedBy}` +
+      (record.relayedBy ? `, relayed by ${record.relayedBy},` : "") +
+      ` at ${record.timestamp}` +
       (record.url ? ` (${record.url})` : "") +
       (record.seal ? `, signed with ${record.seal.key}` : "") +
       (pushed ? "" : " (local only — the push did not land)"),