@intentius/chant 0.105.0 → 0.106.1

package/src/cli/handlers/run.test.ts

@@ -75,8 +75,9 @@ vi.mock("./operator", () => ({
 // gate handling, and a unit test must never write a fact to the real repo.
 vi.mock("../../op/gate", async () => {
   const actual = await vi.importActual<typeof import("../../op/gate")>("../../op/gate");
-  return { ...actual, gitGateLedgerPort: () => gateLedger };
+  return { ...actual, gitGateLedgerPort: () => gateLedger, gateIsSealed: async (gate: string) => sealedGates.has(gate) };
 });
+const sealedGates = new Set<string>();
 // The local runtime appends each run's record to that same branch (#2118).
 // Real behavior in a project, and exactly what this suite must not do in
 // chant's own checkout, since the append is against `process.cwd()`. Only the
@@ -264,9 +265,28 @@ describe("runOp dispatcher", () => {
     stderrWrite.mockRestore();
     expect(out).toContain('is gated on "approve-prod"');
     expect(out).toContain("chant approve gated approve-prod");
+    expect(out).not.toContain("--sign");
     expect(gateLedger.appended).toHaveLength(1);
   });
 
+  test("gate in local mode on a sealed gate: the approve line carries --sign (#3521)", async () => {
+    gateLedger = memoryGateLedgerPort();
+    sealedGates.add("approve-prod");
+    discoverOpsMock.mockResolvedValue({
+      ops: new Map([localOp("gated", [{ kind: "gate", gate: "approve-prod" }])]),
+      errors: [],
+    });
+    const stderrWrite = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    try {
+      expect(await runOp({ args: makeArgs({ path: "gated" }), plugins: [], serializers: [] })).toBe(3);
+      const out = stderrWrite.mock.calls.map((c) => String(c[0])).join("");
+      expect(out).toContain("approve : chant approve gated approve-prod --sign");
+    } finally {
+      stderrWrite.mockRestore();
+      sealedGates.clear();
+    }
+  });
+
   test("an approved gate lets the run through and exits 0", async () => {
     gateLedger = memoryGateLedgerPort({
       pending: [{
@@ -616,6 +636,25 @@ describe("runOp: --gated-exit (#2243)", () => {
     expect(readFileSync(file, "utf8")).toContain("chant approve gated approve-prod");
   });
 
+  test("a sealed gate: the --json approve field and the summary carry --sign (#3521)", async () => {
+    const file = summaryFile();
+    process.env.GITHUB_STEP_SUMMARY = file;
+    sealedGates.add("approve-prod");
+    discoverOpsMock.mockResolvedValue({ ops: new Map([localOp("gated", [gateStep])]), errors: [] });
+    const stdoutWrite = vi.spyOn(process.stdout, "write").mockImplementation(() => true);
+    vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    makeStderrSpy();
+
+    try {
+      await runOp({ args: makeArgs({ path: "gated", gatedExit: 0, json: true }), plugins: [], serializers: [] });
+      const parsed = JSON.parse(stdoutWrite.mock.calls.map((c) => String(c[0])).join("").trim());
+      expect(parsed.approve).toBe("chant approve gated approve-prod --sign");
+      expect(readFileSync(file, "utf8")).toContain("chant approve gated approve-prod --sign --approver <you>");
+    } finally {
+      sealedGates.clear();
+    }
+  });
+
   test("a run that fails for any other reason is still red under the flag", async () => {
     discoverOpsMock.mockResolvedValue({
       // atMostOnce: one attempt. The default profile retries twice with 5s and
@@ -776,6 +815,45 @@ describe("runOp: --sandbox with a policyGate step (chant #2003)", () => {
     expect(seen).not.toHaveProperty("profile");
   });
 
+  // #3521: a hosted runtime that reports only a gate name gets a hint whose
+  // approve command names `--sign` when the workspace seals that gate.
+  describe("a runtime that reports a gated state with only the gate name (#3521)", () => {
+    async function runGatedOnStub(): Promise<string> {
+      discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("prod-apply")]), errors: [] });
+      const start = vi.fn(async () => ({
+        op: "prod-apply",
+        runId: "stub-1",
+        result: async () => ({
+          op: "prod-apply", runId: "stub-1", state: "gated", startedAt: "2026-01-01T00:00:00.000Z",
+          gate: { name: "approve-prod", since: "2026-01-01T00:00:00.000Z" },
+        }),
+      }));
+      makeStdoutSpy();
+      const stderr = makeStderrSpy();
+      const exit = await runOp({
+        args: makeArgs({ path: "prod-apply", on: "stub" }),
+        plugins: [{ name: "stub", opRuntime: { name: "stub", start } } as never], serializers: [],
+      });
+      expect(exit).toBe(3);
+      return stderr.join("\n");
+    }
+
+    test("unsealed gate: the hint's approve command has no --sign", async () => {
+      const out = await runGatedOnStub();
+      expect(out).toContain("Record the resolution with: chant approve prod-apply approve-prod");
+      expect(out).not.toContain("--sign");
+    });
+
+    test("sealed gate: the hint's approve command ends in --sign", async () => {
+      sealedGates.add("approve-prod");
+      try {
+        expect(await runGatedOnStub()).toContain("Record the resolution with: chant approve prod-apply approve-prod --sign");
+      } finally {
+        sealedGates.clear();
+      }
+    });
+  });
+
   test("--sandbox on an Op with no policyGate step is untouched", async () => {
     discoverOpsMock.mockResolvedValue({
       ops: new Map([localOp("hello", [{ kind: "activity", fn: "shellCmd", args: { cmd: "true" } }])]),
@@ -878,6 +956,29 @@ describe("run subcommands on the resolved runtime", () => {
     expect((runtime.start.mock.calls[0][0] as { name: string }).name).toBe("hello");
   });
 
+  test("--param reaches the runtime's start as params (#3539)", async () => {
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    makeStdoutSpy();
+    const exit = await runOp({
+      args: makeArgs({ path: "hello", on: "stub", env: "staging", param: ["agent=ops-bot", "tier=gold plus"] }),
+      plugins: [stubPlugin(runtime)], serializers: [],
+    });
+    expect(exit).toBe(0);
+    expect((runtime.start.mock.calls[0] as unknown[])[1]).toMatchObject({
+      env: "staging",
+      params: { agent: "ops-bot", tier: "gold plus" },
+    });
+  });
+
+  test("no --param hands start no params", async () => {
+    const runtime = makeStubRuntime();
+    discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
+    makeStdoutSpy();
+    await runOp({ args: makeArgs({ path: "hello", on: "stub" }), plugins: [stubPlugin(runtime)], serializers: [] });
+    expect((runtime.start.mock.calls[0] as unknown[])[1]).not.toHaveProperty("params");
+  });
+
   test("run status/log/list/cancel --on stub reach their methods", async () => {
     const runtime = makeStubRuntime();
     discoverOpsMock.mockResolvedValue({ ops: new Map([makeOp("hello")]), errors: [] });
@@ -1060,6 +1161,21 @@ describe("runOpApprove", () => {
     expect(stderr.join("\n")).toContain('Runtime "stub" was notified');
   });
 
+  test("--env on the approve line reaches resolveGate (#3539)", async () => {
+    const record = { version: 1, op: "alb-deploy", gate: "release", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z" };
+    recordGateApprovalMock.mockResolvedValue({ ok: true, record });
+    const resolveGate = vi.fn(async () => undefined);
+    makeStderrSpy();
+
+    const exit = await runOpApprove({
+      args: makeArgs({ on: "stub", extraPositional: "alb-deploy", extraPositional2: "release", approver: "alex", env: "prod" }),
+      plugins: [{ name: "stub", opRuntime: { name: "stub", resolveGate } } as never], serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(resolveGate).toHaveBeenCalledWith("alb-deploy", "release", record, { env: "prod" });
+  });
+
   test("a provider with no resolveGate still records the fact and exits 0", async () => {
     const record = { version: 1, op: "alb-deploy", gate: "release", resolvedBy: "ci", timestamp: "2026-01-01T00:00:00.000Z" };
     recordGateApprovalMock.mockResolvedValue({ ok: true, record });
@@ -1141,6 +1257,53 @@ describe("runOp dispatcher: --components routes to runOpComponents", () => {
   });
 });
 
+// #3521: a gated component's approve line and mismatch line name `--sign` on
+// a sealed gate and leave it off otherwise.
+describe("runOp --components gate hints (#3521)", () => {
+  beforeEach(() => {
+    runComponentsMock.mockReset();
+    loadChantConfigMock.mockReset().mockResolvedValue({ config: {} });
+    maybeRecordAutoReleaseMock.mockReset().mockResolvedValue({ recorded: false, reason: "no-digest" });
+    maybePersistBuildManifestMock.mockReset().mockResolvedValue({ persisted: false, reason: "no-manifest" });
+  });
+
+  async function runGatedComponent(): Promise<string> {
+    runComponentsMock.mockResolvedValue({
+      success: false,
+      selected: ["svc"],
+      gated: {
+        component: "svc",
+        gate: {
+          version: 1, kind: "pending", op: "svc", gate: "approve-prod", environment: "prod",
+          timestamp: "2026-09-05T10:00:00.000Z", expiresAt: "2099-01-01T00:00:00.000Z",
+        },
+        mismatch: { approved: "sha256:aaa", planned: "sha256:bbb", resolvedBy: "alex", timestamp: "2026-09-05T11:00:00.000Z", environment: "prod" },
+      },
+    });
+    const stderr = makeStderrSpy();
+    expect(await runOp({ args: makeArgs({ path: "svc", components: true }), plugins: [], serializers: [] })).toBe(3);
+    return stderr.join("\n");
+  }
+
+  test("unsealed gate: the approve line and the mismatch line carry no --sign", async () => {
+    const out = await runGatedComponent();
+    expect(out).toContain("approve : chant approve svc approve-prod --env prod");
+    expect(out).toContain("needs a fresh one: chant approve svc approve-prod --env prod");
+    expect(out).not.toContain("--sign");
+  });
+
+  test("sealed gate: the approve line and the mismatch line end in --sign", async () => {
+    sealedGates.add("approve-prod");
+    try {
+      const out = await runGatedComponent();
+      expect(out).toContain("approve : chant approve svc approve-prod --env prod --sign");
+      expect(out).toContain("needs a fresh one: chant approve svc approve-prod --env prod --sign");
+    } finally {
+      sealedGates.clear();
+    }
+  });
+});
+
 describe("runOpComponents", () => {
   beforeEach(() => {
     runComponentsMock.mockReset();

package/src/cli/handlers/run.ts

@@ -7,7 +7,7 @@ import { stewardWorkHolder } from "../../op/work-lease-run";
 import type { OpConfig } from "../../op/types";
 import { loadActivities, loadProfiles } from "../../op/activity-registry";
 import { runOpLocally, findPolicyGateStep, OpRunFailure, type StepRecord } from "../../op/local-executor";
-import { approveCommand, describeGateMismatch } from "../../op/gate";
+import { approveCommand, describeGateMismatch, gateIsSealed } from "../../op/gate";
 import { summaryLedgerPrefix, writeGatedRunSummary, type GatedRunSummary } from "../../op/gate-summary";
 import { createLocalOpRuntime } from "../../op/runtimes/local";
 import type { OpRuntimeProvider, OpRunStatus } from "../../op/runtime";
@@ -77,8 +77,8 @@ function resolveGatedExitCode(ctx: CommandContext): number | undefined {
  * passes `--gated-exit 0` reports success, and the one line that explains why
  * a zero-exit run applied nothing belongs next to the gate itself.
  */
-function reportGatedRun(summary: GatedRunSummary, exitCode: number): void {
-  writeGatedRunSummary(summary);
+async function reportGatedRun(summary: GatedRunSummary, exitCode: number): Promise<void> {
+  writeGatedRunSummary({ ...summary, sealed: await gateIsSealed(summary.gate) });
   if (exitCode !== GATED_EXIT_CODE) {
     console.error(formatInfo(
       `gated: exiting ${exitCode} because --gated-exit asked for it. Nothing after the gate ran.`,
@@ -466,7 +466,10 @@ export async function runOpApprove(ctx: CommandContext): Promise<number> {
   }
 
   try {
-    await runtime.resolveGate(opName, gate, outcome.record);
+    // `--env` on the approve line names the environment the woken run runs
+    // in (#3539); without it the runtime keeps the gated run's.
+    if (ctx.args.env !== undefined) await runtime.resolveGate(opName, gate, outcome.record, { env: ctx.args.env });
+    else await runtime.resolveGate(opName, gate, outcome.record);
   } catch (err) {
     console.error(formatWarning({
       message:
@@ -962,10 +965,11 @@ export async function runOpComponents(ctx: CommandContext): Promise<number> {
     }));
     // #2574: an approval stands, but for another plan or for none. Say so,
     // with the command that replaces it.
+    const sealed = await gateIsSealed(gate.gate);
     if (result.gated.mismatch) {
-      console.error(formatWarning({ message: describeGateMismatch(gate.op, gate.gate, result.gated.mismatch) }));
+      console.error(formatWarning({ message: describeGateMismatch(gate.op, gate.gate, result.gated.mismatch, sealed) }));
     }
-    console.error(formatInfo(`approve : ${approveCommand(gate.op, gate.gate, gate.environment)}`));
+    console.error(formatInfo(`approve : ${approveCommand(gate.op, gate.gate, gate.environment, undefined, sealed)}`));
     if (gate.url) console.error(formatInfo(`approve at: ${gate.url}`));
     console.error(formatInfo(`expires : ${gate.expiresAt}`));
     // #2310: this run's own append reached only the local chant/lifecycle
@@ -978,7 +982,7 @@ export async function runOpComponents(ctx: CommandContext): Promise<number> {
         hint: "an operator working from a clone of the remote cannot approve it until it does",
       }));
     }
-    reportGatedRun(
+    await reportGatedRun(
       {
         op: gate.op,
         gate: gate.gate,
@@ -1107,8 +1111,13 @@ export async function runOpOnRuntime(ctx: CommandContext): Promise<number> {
   process.on("SIGTERM", onSigint);
 
   try {
+    // `--param name=value` reaches the runtime (#3539). The local runtime
+    // has no use for it; fountain reads `agent` to pick the steward and posts
+    // the rest on the command line it hands the sandbox.
+    const params = parseParamFlags(ctx.args.param);
     const handle = await runtime.start(config, {
       env: ctx.args.env,
+      ...(params ? { params } : {}),
       ...(ctx.args.profile !== undefined ? { profile: ctx.args.profile } : {}),
       progress,
       signal: controller.signal,
@@ -1119,13 +1128,14 @@ export async function runOpOnRuntime(ctx: CommandContext): Promise<number> {
     if (status.result) {
       // The executor's own render already prints a gate, its approve line
       // and its expiry (#2119).
-      if (ctx.args.json) renderJson(status.result); else renderHuman(status.result);
+      const sealed = status.result.gate ? await gateIsSealed(status.result.gate.gate) : false;
+      if (ctx.args.json) renderJson(status.result, undefined, sealed); else renderHuman(status.result, undefined, sealed);
     } else {
       renderRuntimeStatus("Op", opName, runtime.name, status);
       if (status.state === "gated" && status.gate) {
         console.error(formatWarning({
           message: `Op "${opName}" is waiting on gate "${status.gate.name}"`,
-          hint: `Record the resolution with: ${approveCommand(opName, status.gate.name)}`,
+          hint: `Record the resolution with: ${approveCommand(opName, status.gate.name, undefined, undefined, await gateIsSealed(status.gate.name))}`,
         }));
       }
     }
@@ -1140,7 +1150,7 @@ export async function runOpOnRuntime(ctx: CommandContext): Promise<number> {
       const pending = status.result?.gate;
       const gate = pending?.gate ?? status.gate?.name;
       if (gate) {
-        reportGatedRun(
+        await reportGatedRun(
           {
             op: opName,
             gate,
@@ -1175,7 +1185,8 @@ export async function runOpOnRuntime(ctx: CommandContext): Promise<number> {
     return status.state === "completed" ? 0 : 1;
   } catch (err) {
     if (err instanceof OpRunFailure) {
-      if (ctx.args.json) renderJson(err.result); else renderHuman(err.result);
+      const sealed = err.result.gate ? await gateIsSealed(err.result.gate.gate) : false;
+      if (ctx.args.json) renderJson(err.result, undefined, sealed); else renderHuman(err.result, undefined, sealed);
       return 1;
     }
     console.error(formatError({ message: err instanceof Error ? err.message : String(err) }));

package/src/cli/main.ts

@@ -606,6 +606,10 @@ export function parseArgs(args: string[]): ParsedArgs {
       // didn't support joined forms at all — now that it does, the joined
       // form is just as valid as the space-separated one).
       (result.param ??= []).push(args[++i]);
+    } else if (arg === "--lexicon-output") {
+      // `--lexicon-output <lexicon>=<path>` (repeatable); the joined form
+      // `--lexicon-output=otel=a.yml` arrives here already split at the first `=`.
+      (result.lexiconOutput ??= []).push(args[++i]);
     } else if (arg === "--params-file") {
       result.paramsFile = args[++i];
     } else if (arg === "--projection") {
@@ -1308,7 +1312,11 @@ Component release ledger + status:
                             (chant approve pr-<n> pr-apply --plan <digest>);
                             a moved plan refuses with exit 3
                             (--require-review: the approver must have
-                            approved the pull request on the forge)
+                            approved the pull request on the forge;
+                            --member <name>, both commands: a workspace
+                            member's loop, gate op pr-<n>-<member>;
+                            --resume <file> finishes an apply that failed
+                            partway under the same approval)
   components release <env> Append one immutable release record
                             (--component <name> --digest <sha256:...>
                              [--git-sha <sha>] [--run-id <id>] [--actor <name>]);
@@ -1376,6 +1384,10 @@ Options:
                         - build: json (default) or yaml
                         - list: text (default) or json
                         - lint: stylish (default), json, or sarif
+      --lexicon-output <lexicon>=<path>
+                        build: write that lexicon's output to its own file
+                        (repeatable). Lexicons not named go to --output when
+                        given, and are skipped otherwise
   -d, --lexicon <name>  Build only the specified lexicon (e.g. aws, gitlab);
                         import: use this lexicon instead of detecting one
       --env <name>      Active environment: sets CHANT_ENV so env-aware source

package/src/cli/mcp/never-over-mcp.test.ts

@@ -166,4 +166,78 @@ describe("neverOverMcp (chant#3447)", () => {
       expect(outcome.ok).toBe(true);
     });
   });
+
+  // chant#3513: workspace-upgrade and the pull-request gate are undiscovered too.
+  const gateOnlyOps: Array<{ op: string; gate: string }> = [
+    { op: "workspace-upgrade", gate: "." },
+    { op: "pr-12", gate: "pr-apply" },
+  ];
+
+  for (const { op, gate } of gateOnlyOps) {
+    async function repoWithGate(dir: string): Promise<void> {
+      git(["init", "-q", "-b", "main"], dir);
+      git(["config", "user.email", "t@chant.dev"], dir);
+      git(["config", "user.name", "T"], dir);
+      writeFileSync(join(dir, "README.md"), "x\n");
+      git(["add", "."], dir);
+      git(["commit", "-q", "-m", "init"], dir);
+      await appendPendingGate(
+        {
+          op,
+          gate,
+          timestamp: "2026-01-01T00:00:00.000Z",
+          origin: "cli",
+          expiresAt: "2999-01-01T00:00:00.000Z",
+          planDigest: `sha256:${"c".repeat(64)}`,
+        },
+        { cwd: dir },
+      );
+    }
+
+    test(`${op}: the gate record carries neverOverMcp (chant#3513)`, async () => {
+      await withTestDir(async (dir) => {
+        await repoWithGate(dir);
+        const { pending } = await readGateLedger(op, { cwd: dir });
+        expect(pending[0].neverOverMcp).toBe(true);
+      });
+    });
+
+    test(`${op}: op-approve over MCP is refused and the ledger is unchanged (chant#3513)`, async () => {
+      await withTestDir(async (dir) => {
+        await repoWithGate(dir);
+        const before = await readGateLedger(op, { cwd: dir });
+        process.chdir(dir);
+        await expect(createOpApproveTool().handler({ name: op, gate })).rejects.toThrow(
+          /neverOverMcp.*whichever channel/s,
+        );
+        expect(await readGateLedger(op, { cwd: dir })).toEqual(before);
+        expect(resolveGate).not.toHaveBeenCalled();
+      });
+    });
+
+    test(`${op}: ACP is refused even with the same-origin override (chant#3513)`, async () => {
+      await withTestDir(async (dir) => {
+        await repoWithGate(dir);
+        const before = await readGateLedger(op, { cwd: dir });
+        process.chdir(dir);
+        const outcome = await recordGateApproval(op, gate, {
+          origin: "acp",
+          actor: "agent",
+          allowSameOrigin: true,
+          cwd: dir,
+        });
+        expect(outcome.ok).toBe(false);
+        expect(await readGateLedger(op, { cwd: dir })).toEqual(before);
+      });
+    });
+
+    test(`${op}: a person at a shell can still approve (chant#3513)`, async () => {
+      await withTestDir(async (dir) => {
+        await repoWithGate(dir);
+        process.chdir(dir);
+        const outcome = await recordGateApproval(op, gate, { origin: "cli", actor: "alex", cwd: dir });
+        expect(outcome.ok).toBe(true);
+      });
+    });
+  }
 });

package/src/cli/registry.ts

@@ -282,6 +282,9 @@ export interface ParsedArgs {
    * the identical command finishes what an interrupted attempt left, because
    * the plan is narrowed by this file before the gate is decided and the
    * digest is carried rather than recomputed, so the approval still stands.
+   * `chant components pr-apply --resume <file>` (#3464) keeps the same record
+   * with the approved change set in it, and finishes an apply that failed
+   * partway under that approval.
    */
   resume?: string;
   /** `chant audit --tier merge-worthy|all` */
@@ -446,6 +449,8 @@ export interface ParsedArgs {
   /**
    * `chant workspace build|lint|audit|graph --member <name>` (#2537): run only
    * the named members or example groups. Repeatable, and a comma list works too.
+   * `chant components pr-plan|pr-apply --member <name>` (#3465) takes exactly
+   * one: the workspace member whose pull-request loop runs.
    */
   members?: string[];
   /**
@@ -524,6 +529,8 @@ export interface ParsedArgs {
   foldRankCollapsedFile?: string;
   /** `chant build --param name=value` (#1064) — repeatable. Bound to `params.<name>` (`@intentius/chant/params`) for source to reference, after validation against `chant.config.ts`'s declared `buildParams`. Highest precedence over `--params-file`/a declared `env` mapping/the declared `default`. */
   param?: string[];
+  /** `chant build --lexicon-output <lexicon>=<path>` — repeatable. Writes that lexicon's output to its own file, so one project can declare several lexicons (otel and prometheus) without their outputs sharing a file. Lexicons not named are built into `--output` when given, and skipped otherwise. */
+  lexiconOutput?: string[];
   /** `chant build --params-file <path>` (#1064) — a JSON file of `{ "name": value }` build-time parameter values. Second precedence, after `--param`. */
   paramsFile?: string;
   /** `chant graph --components --format ir --projection <lexicon>` (#989) — add

package/src/components/changed-files.test.ts

@@ -0,0 +1,58 @@
+/**
+ * The files a change touched (#3183), as a project in a workspace member
+ * sees them (#3465): every changed file in the repository, relative to the
+ * member's directory, so one outside it reads `../...`.
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterAll, describe, expect, test } from "vitest";
+import { changedFilesBetween } from "./changed-files";
+
+const repo = mkdtempSync(join(tmpdir(), "chant-changed-files-"));
+afterAll(() => rmSync(repo, { recursive: true, force: true }));
+
+const git = (...args: string[]): string =>
+  execFileSync("git", args, {
+    cwd: repo,
+    encoding: "utf8",
+    env: { ...process.env, GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@example.com", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@example.com" },
+  }).trim();
+
+function put(path: string, text: string): void {
+  mkdirSync(dirname(join(repo, path)), { recursive: true });
+  writeFileSync(join(repo, path), text);
+}
+
+git("init", "-q", "-b", "main");
+put("infra/network/roots/vpc/main.tf", "");
+put("shared/modules/base/main.tf", "");
+put("apps/web/main.tf", "");
+git("add", "-A");
+git("commit", "-q", "-m", "base");
+const base = git("rev-parse", "HEAD");
+put("infra/network/roots/vpc/main.tf", "# changed\n");
+put("shared/modules/base/main.tf", "# changed\n");
+put("apps/web/main.tf", "# changed\n");
+git("add", "-A");
+git("commit", "-q", "-m", "change");
+
+describe("changedFilesBetween", () => {
+  test("at the repository root, every file by its repository path", async () => {
+    expect(await changedFilesBetween(repo, base)).toEqual([
+      "apps/web/main.tf",
+      "infra/network/roots/vpc/main.tf",
+      "shared/modules/base/main.tf",
+    ]);
+  });
+
+  test("in a member's directory, every file relative to the member, outside ones included", async () => {
+    expect(await changedFilesBetween(join(repo, "infra/network"), base)).toEqual([
+      "../../apps/web/main.tf",
+      "../../shared/modules/base/main.tf",
+      "roots/vpc/main.tf",
+    ]);
+  });
+});

package/src/components/changed-files.ts

@@ -9,6 +9,7 @@
  */
 
 import { execFile } from "node:child_process";
+import { posix } from "node:path";
 import { promisify } from "node:util";
 import type { LexiconPlugin } from "../lexicon";
 
@@ -43,12 +44,26 @@ export async function resolveCommit(cwd: string, ref: string): Promise<string> {
 }
 
 /**
- * Files changed between `base` and `head`, relative to `cwd` and limited to
- * it, with `/` separators. A rename counts as its old and its new path.
+ * Files changed between `base` and `head`, relative to `cwd`, with `/`
+ * separators. A rename counts as its old and its new path.
+ *
+ * Every changed file in the repository is listed, not only those under
+ * `cwd`: one outside it reads `../...`. A project in a workspace member
+ * (#3465) can call a module that lives in another member or beside the
+ * members, and a change there reaches it; `changedUnits` decides which of
+ * these paths matter.
  */
 export async function changedFilesBetween(cwd: string, base: string, head = "HEAD"): Promise<string[]> {
-  const out = await git(cwd, ["diff", "--name-only", "-z", "--no-renames", "--relative", base, head]);
-  return out.split("\0").filter(Boolean).sort();
+  const prefix = (await git(cwd, ["rev-parse", "--show-prefix"])).trim().replace(/\/+$/, "");
+  const out = await git(cwd, ["diff", "--name-only", "-z", "--no-renames", "--no-relative", base, head]);
+  return out
+    .split("\0")
+    .filter(Boolean)
+    .map((file) => {
+      const rel = posix.relative(prefix, file);
+      return rel === "" ? "." : rel;
+    })
+    .sort();
 }
 
 /** The union of every plugin's `changedUnits` answer, sorted. */

package/src/components/fan-out-record.test.ts

@@ -1,13 +1,16 @@
 /**
  * The attempt record keeps what steps carried per member (#3459), so the
- * next attempt, in this process or in the next CI job, hands it back.
+ * next attempt, in this process or in the next CI job, hands it back. It
+ * also keeps the change set a pull request's apply approved (#3464), so a
+ * re-run finishes it under that approval.
  */
 
 import { describe, expect, test } from "vitest";
 import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { readFanOutAttempt, writeFanOutAttempt } from "./fan-out-record";
+import { readFanOutAttempt, writeFanOutAttempt, type PrApplyRecord } from "./fan-out-record";
+import { composeChangeSet } from "../change-set";
 
 describe("carried", () => {
   test("round-trips through the record", () => {
@@ -25,3 +28,45 @@ describe("carried", () => {
     expect(readFanOutAttempt(join(dir, "b.json"))?.carried).toBeUndefined();
   });
 });
+
+describe("prApply (#3464)", () => {
+  const changeSet = composeChangeSet([
+    {
+      member: { member: "net", lexicon: "terraform", planner: "tofu", status: "planned", planDigest: `jcs1-sha256:${"1".repeat(64)}`, holes: [] },
+      entries: [],
+    },
+  ]);
+  const prApply: PrApplyRecord = {
+    op: "pr-12",
+    gate: "pr-apply",
+    head: "2".repeat(40),
+    digest: changeSet.digest,
+    approvedBy: ["github:alice"],
+    members: [
+      {
+        member: "net",
+        component: "net",
+        planDigest: `jcs1-sha256:${"1".repeat(64)}`,
+        status: "planned",
+        counts: { create: 0, update: 0, replace: 0, delete: 0 },
+      },
+    ],
+    changeSet,
+    planOutputs: { net: { cidr: "10.0.0.0/16" } },
+  };
+
+  test("round-trips through the record", () => {
+    const path = join(mkdtempSync(join(tmpdir(), "fan-out-record-")), "pr-apply.json");
+    writeFanOutAttempt(path, { digest: "d", completed: ["net"], failed: [], outputs: { net: { cidr: "10.0.0.0/16" } }, prApply });
+    expect(readFanOutAttempt(path)?.prApply).toEqual(prApply);
+  });
+
+  test("an entry whose change set does not carry its digest, or that misses a field, reads as none", () => {
+    const dir = mkdtempSync(join(tmpdir(), "fan-out-record-"));
+    const base = { digest: "d", completed: [], failed: [], outputs: {} };
+    writeFileSync(join(dir, "a.json"), JSON.stringify({ ...base, prApply: { ...prApply, digest: `jcs1-sha256:${"9".repeat(64)}` } }));
+    writeFileSync(join(dir, "b.json"), JSON.stringify({ ...base, prApply: { ...prApply, head: undefined } }));
+    writeFileSync(join(dir, "c.json"), JSON.stringify({ ...base, prApply: "pr-12" }));
+    for (const name of ["a.json", "b.json", "c.json"]) expect(readFanOutAttempt(join(dir, name))?.prApply).toBeUndefined();
+  });
+});