@intentius/chant 0.105.1 → 0.106.3

package/src/lexicon.ts

@@ -41,6 +41,7 @@ export type {
   OpRunHandle,
   OpRunRecord,
   OpRunStartOptions,
+  OpGateResolveOptions,
   OpRunState,
   OpRunStatus,
 } from "./op/runtime";
@@ -562,6 +563,12 @@ export interface ComponentPipelineOptions {
    * GitLab's job rules) are limited to the member's files and the pipeline
    * file. Its jobs run in the member's directory, and its names carry the
    * member's name so two members' pipelines never collide.
+   *
+   * A pull-request pipeline (`prLoop`, #3465) takes no path filter: a change
+   * outside the member can reach it (a module it calls in another member),
+   * so its plan runs on every pull request and selects from the whole
+   * change. Its commands pass `--member`, which gives the member its own
+   * gate op, note and statuses on the pull request.
    */
   member?: PipelineMember;
 }
@@ -913,7 +920,12 @@ export interface ChangedUnitsContext {
   projectRoot: string;
   /** The resolved project configuration, for the lexicon's own namespace. */
   config: Record<string, unknown>;
-  /** Files the change added, modified or deleted, relative to `projectRoot`, with `/` separators. */
+  /**
+   * Files the change added, modified or deleted, relative to `projectRoot`,
+   * with `/` separators. Files outside `projectRoot` are listed too, as
+   * `../...`, so a unit that calls code outside the project (another
+   * workspace member's module, #3465) can claim them.
+   */
   changedFiles: string[];
 }
 

package/src/lifecycle/gate-ledger.ts

@@ -41,7 +41,7 @@
  * (absent on the resolution lines written before #2119, which is why
  * `"resolution"` is the default reading).
  */
-import { FAN_OUT_GATE_OP } from "../op/gate-name";
+import { isNeverOverMcpGateOp } from "../op/gate-name";
 import { samePlanDigest } from "./plan-digest";
 import { sortedJsonReplacer } from "../utils";
 import { currentGateOrigin, type GateOrigin } from "./gate-origin";
@@ -342,8 +342,9 @@ export async function appendPendingGate(
     kind: "pending",
     origin: currentGateOrigin(),
     // chant#3485: an Op MCP cannot discover declares nothing, so the gate
-    // records the rule for it. Every fan-out gate is one.
-    ...(input.op === FAN_OUT_GATE_OP ? { neverOverMcp: true as const } : {}),
+    // records the rule for it: fan-out, workspace-upgrade (chant#3513) and
+    // the pull-request gate's `pr-<number>` op.
+    ...(isNeverOverMcpGateOp(input.op) ? { neverOverMcp: true as const } : {}),
     ...input,
   };
   const commit = await appendGateLine(record, "Pending gate record", opts);

package/src/op/gate-name.ts

@@ -37,6 +37,23 @@ export const FAN_OUT_GATE_OP = "fan-out";
  */
 export const WORKSPACE_UPGRADE_GATE_OP = "workspace-upgrade";
 
+/**
+ * The pull-request loop records its gate under `pr-<number>`, or
+ * `pr-<number>-<member>` in a workspace member (`prOp` in `pr-loop.ts`), and
+ * no `*.op.ts` stands behind that name either.
+ */
+const PR_GATE_OP = /^pr-\d+(?:-[a-z0-9][a-z0-9-]*)?$/;
+
+/**
+ * Whether gates recorded under this op name are never resolved over MCP or ACP
+ * (chant#3485, chant#3513). These are the gate-only names MCP cannot discover:
+ * `fan-out`, `workspace-upgrade` and the pull-request gate `pr-<number>`. With
+ * no Op config to read `neverOverMcp` from, the pending record carries it.
+ */
+export function isNeverOverMcpGateOp(op: string): boolean {
+  return op === FAN_OUT_GATE_OP || op === WORKSPACE_UPGRADE_GATE_OP || PR_GATE_OP.test(op);
+}
+
 /** Either spelling of a gate step's name. `gate` since #2202; `signalName` through 0.59.0. */
 export interface GateNamed {
   gate?: string;

package/src/op/gate-summary.test.ts

@@ -107,3 +107,15 @@ describe("writeGatedRunSummary surfaces (#2243, #2256)", () => {
     expect(writeGatedRunSummary(summary, { CHANT_GATE_SUMMARY: "/no/such/dir/gate.md" })).toBeUndefined();
   });
 });
+
+describe("gatedRunSummaryMarkdown on a sealed gate (#3521)", () => {
+  test("the approve line carries --sign when sealed", () => {
+    const md = gatedRunSummaryMarkdown({ ...summary, sealed: true });
+    expect(md).toContain("chant approve app-apply approve-app-apply --sign --approver <you>");
+  });
+
+  test("the approve line has no --sign when unsealed", () => {
+    expect(gatedRunSummaryMarkdown({ ...summary, sealed: false })).not.toContain("--sign");
+    expect(gatedRunSummaryMarkdown(summary)).not.toContain("--sign");
+  });
+});

package/src/op/gate-summary.ts

@@ -57,6 +57,8 @@ export interface GatedRunSummary {
    * Absent at level 0 and for the root member.
    */
   ledgerPrefix?: string;
+  /** Whether the workspace seals this gate, so the `chant approve` line carries `--sign`. */
+  sealed?: boolean;
   /** The environment a component gate's pending fact was recorded in (#2574). The `chant approve` line names it. */
   environment?: string;
 }
@@ -101,7 +103,7 @@ export function gatedRunSummaryMarkdown(summary: GatedRunSummary): string {
     "Approve it, then re-run this workflow:",
     "",
     "```",
-    `${approveCommand(summary.op, summary.gate, summary.environment)} --approver <you>`,
+    `${approveCommand(summary.op, summary.gate, summary.environment, undefined, summary.sealed === true)} --approver <you>`,
     "```",
     "",
     `Ledger: \`${gateLedgerPath(summary.op, summary.ledgerPrefix)}\` on the \`chant/lifecycle\` branch.`,

package/src/op/gate.test.ts

@@ -16,7 +16,7 @@ import { writeFileSync } from "node:fs";
 import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { evaluateGate, gitGateLedgerPort, type GateLedgerPort } from "./gate";
+import { approveCommand, describeGateMismatch, evaluateGate, gitGateLedgerPort, type GateDigestMismatch, type GateLedgerPort } from "./gate";
 import { appendGateResolution, readGateLedger } from "../lifecycle/gate-ledger";
 import {
   requireLifecycleLedger,
@@ -612,3 +612,17 @@ describe("op/gate — a rejected ledger push is reported, not swallowed (#2310)"
     expect(check.pending.gate).toBe("approve-live-apply");
   });
 });
+
+describe("op/gate — the approve hint on a sealed gate (#3521)", () => {
+  test("approveCommand adds --sign last, only when sealed", () => {
+    expect(approveCommand("app", "ship")).toBe("chant approve app ship");
+    expect(approveCommand("app", "ship", "prod", "sha256:abc", true)).toBe("chant approve app ship --env prod --plan sha256:abc --sign");
+    expect(approveCommand("app", "ship", undefined, undefined, false)).toBe("chant approve app ship");
+  });
+
+  test("describeGateMismatch names --sign when sealed, and not when unsealed", () => {
+    const mismatch = { approved: "sha256:old", planned: "sha256:new", resolvedBy: "alex", timestamp: "2026-09-08T00:00:00Z" } as GateDigestMismatch;
+    expect(describeGateMismatch("app", "ship", mismatch, true)).toMatch(/chant approve app ship --sign$/);
+    expect(describeGateMismatch("app", "ship", mismatch)).not.toContain("--sign");
+  });
+});

package/src/op/gate.ts

@@ -235,7 +235,7 @@ export interface GateDigestMismatch {
  * have changed — the record simply never said what it approved, which is
  * every record written before #2300.
  */
-export function describeGateMismatch(op: string, gate: string, mismatch: GateDigestMismatch): string {
+export function describeGateMismatch(op: string, gate: string, mismatch: GateDigestMismatch, sealed = false): string {
   const why =
     mismatch.approved === undefined
       ? mismatch.environment !== undefined
@@ -249,7 +249,7 @@ export function describeGateMismatch(op: string, gate: string, mismatch: GateDig
     `Gate "${gate}" is approved, but not for this plan. ` +
     `approved: ${describePlanDigest(mismatch.approved)} (by ${mismatch.resolvedBy} at ${mismatch.timestamp}); ` +
     `planned: ${mismatch.planned}. ` +
-    `${why} ${approveCommand(op, gate, mismatch.environment)}`
+    `${why} ${approveCommand(op, gate, mismatch.environment, undefined, sealed)}`
   );
 }
 
@@ -512,8 +512,25 @@ export async function evaluateGate(port: GateLedgerPort, input: GateCheckInput):
  * plan the reader was shown and not whatever is pending by the time they run
  * it.
  */
-export function approveCommand(op: string, gate: string, environment?: string, planDigest?: string): string {
+export function approveCommand(op: string, gate: string, environment?: string, planDigest?: string, sealed = false): string {
   return `chant approve ${op} ${gate}` +
     (environment === undefined ? "" : ` --env ${environment}`) +
-    (planDigest === undefined ? "" : ` --plan ${planDigest}`);
+    (planDigest === undefined ? "" : ` --plan ${planDigest}`) +
+    (sealed ? " --sign" : "");
+}
+
+/**
+ * Whether the workspace seals `gate` (`identity.gates`), so an approval
+ * without `--sign` doesn't count. Callers pass the answer to
+ * {@link approveCommand} so the hint names the flag. Loaded on demand, as the
+ * git ledger port does: the workspace modules import the Op modules. A read
+ * that throws counts as unsealed, since the hint is advice and not the check.
+ */
+export async function gateIsSealed(gate: string, cwd: string = process.cwd()): Promise<boolean> {
+  try {
+    const { gateAdmission } = await import("../workspace/identity");
+    return gateAdmission(cwd, gate) !== null;
+  } catch {
+    return false;
+  }
 }

package/src/op/index.ts

@@ -62,7 +62,7 @@ export { runOpLocally, parseDuration, OpRunFailure } from "./local-executor";
 export type { StepRecord, OpRunResult, RunOpOptions } from "./local-executor";
 export { currentOpRun, withOpRunContext } from "./run-context";
 export type { OpRunContext, PassedGate } from "./run-context";
-export { evaluateGate, gitGateLedgerPort, memoryGateLedgerPort, approveCommand, describeGateMismatch } from "./gate";
+export { evaluateGate, gitGateLedgerPort, memoryGateLedgerPort, approveCommand, describeGateMismatch, gateIsSealed } from "./gate";
 export type { GateLedgerPort, GateCheck, GateCheckInput, PendingGatePush, GateDigestMismatch, GateQuorumProgress, GateTally } from "./gate";
 export { tallyGateApprovals, approverOf } from "./gate";
 export {
@@ -80,7 +80,7 @@ export type { GateNamed } from "./gate-name";
 export { createLocalOpRuntime } from "./runtimes/local";
 export { runStateOf } from "./runtime";
 export type {
-  OpRuntimeProvider, OpRunHandle, OpRunStartOptions, OpRunState, OpRunStatus,
+  OpRuntimeProvider, OpRunHandle, OpRunStartOptions, OpGateResolveOptions, OpRunState, OpRunStatus,
   OpRunRecord, OpRunRecordInput, OpRunPhaseRecord, OpRunStepRecord,
 } from "./runtime";
 export { buildOpIR, serializeOpIR, opConfigFromIR, OP_IR_FORMAT_VERSION } from "./op-ir";

package/src/op/local-executor.test.ts

@@ -9,6 +9,14 @@ import {
 import { memoryGateLedgerPort, type GateLedgerPort } from "./gate";
 import { computePlanDigest } from "../lifecycle/plan-digest";
 import { renderHuman } from "./local-output";
+
+// #3521: whether the workspace seals a gate is read from identity.gates in the
+// working directory; a test says which gates are sealed instead.
+const sealedGates = new Set<string>();
+vi.mock("./gate", async () => {
+  const actual = await vi.importActual<typeof import("./gate")>("./gate");
+  return { ...actual, gateIsSealed: async (gate: string) => sealedGates.has(gate) };
+});
 import type { GateResolutionRecord, PendingGateRecord, PendingGateInput } from "../lifecycle/gate-ledger";
 import { stepOutput } from "./step-output-ref";
 
@@ -778,6 +786,33 @@ describe("runOpLocally — a gate approves a plan, not the next run (#2300)", ()
     expect(lines.some((l) => l.includes("[refused]") && l.includes("not for this plan"))).toBe(true);
   });
 
+  describe("the refusal's approve command (#3521)", () => {
+    async function refusalOnRename(): Promise<string | undefined> {
+      const { root, activities, config, digestOf } = harness();
+      const gates = approvableLedger();
+      await runOpLocally(config, activities, PROFILES, undefined, { gates, now: NOW });
+      gates.approve("approve-live-apply", digestOf("aws_s3_bucket.original"), "2026-09-09T12:05:00.000Z");
+      root.address = "aws_s3_bucket.renamed";
+      const second = await runOpLocally(config, activities, PROFILES, undefined, { gates, now: "2026-09-09T12:10:00.000Z" });
+      return second.records.find((r) => r.fn === "gate:approve-live-apply")?.refusal;
+    }
+
+    test("unsealed gate: the refusal's approve command has no --sign", async () => {
+      const refusal = await refusalOnRename();
+      expect(refusal).toContain("chant approve live-apply approve-live-apply");
+      expect(refusal).not.toContain("--sign");
+    });
+
+    test("sealed gate: the refusal's approve command ends in --sign", async () => {
+      sealedGates.add("approve-live-apply");
+      try {
+        expect(await refusalOnRename()).toContain("chant approve live-apply approve-live-apply --sign");
+      } finally {
+        sealedGates.clear();
+      }
+    });
+  });
+
   test("approve, re-run with the root unchanged — it applies", async () => {
     const { applied, activities, config, digestOf } = harness();
     const gates = approvableLedger();

package/src/op/local-executor.ts

@@ -26,7 +26,7 @@ import type { ReceiptReadResult } from "./receipt-store";
 import { isStepOutputRef } from "./step-output-ref";
 import { parseDuration } from "./duration";
 import { stepTimeoutProblem } from "./activity-profiles";
-import { describeGateMismatch, evaluateGate, gitGateLedgerPort, type GateCheck, type GateLedgerPort } from "./gate";
+import { describeGateMismatch, evaluateGate, gateIsSealed, gitGateLedgerPort, type GateCheck, type GateLedgerPort } from "./gate";
 import { gateName } from "./gate-name";
 import type { ResolvedGateApproval } from "./gate-approval";
 import { withOpRunContext, type OpRunContext, type PassedGate } from "./run-context";
@@ -672,7 +672,7 @@ async function runGateStep(
   }
 
   const refusal = check.mismatch
-    ? { refusal: describeGateMismatch(gates.op, gateName(step), check.mismatch) }
+    ? { refusal: describeGateMismatch(gates.op, gateName(step), check.mismatch, await gateIsSealed(gateName(step))) }
     : {};
   return {
     record: {

package/src/op/local-output.test.ts

@@ -207,3 +207,23 @@ describe("renderJson", () => {
     expect(parsed.pushed).toBeUndefined();
   });
 });
+
+describe("a sealed gate's approve line carries --sign (#3521)", () => {
+  test("renderHuman prints --sign when sealed, and not when unsealed", () => {
+    const sealed: string[] = [];
+    renderHuman(GATED_WITH_PLAN, (l) => sealed.push(l), true);
+    expect(sealed.join("\n")).toContain(`approve : chant approve prod-apply rollout-gate --plan ${GATED_WITH_PLAN.gate!.planDigest} --sign`);
+    const unsealed: string[] = [];
+    renderHuman(GATED_WITH_PLAN, (l) => unsealed.push(l), false);
+    expect(unsealed.join("\n")).not.toContain("--sign");
+  });
+
+  test("renderJson's approve field carries --sign when sealed, and not when unsealed", () => {
+    const sealed: string[] = [];
+    renderJson(GATED, (l) => sealed.push(l), true);
+    expect(JSON.parse(sealed[0]).approve).toBe("chant approve prod-apply rollout-gate --sign");
+    const unsealed: string[] = [];
+    renderJson(GATED, (l) => unsealed.push(l), false);
+    expect(JSON.parse(unsealed[0]).approve).toBe("chant approve prod-apply rollout-gate");
+  });
+});

package/src/op/local-output.ts

@@ -26,7 +26,7 @@ function formatDuration(ms: number): string {
  * Render a run result as human-readable progress. Defaults to stderr so stdout
  * stays clean for piping (the `--json` renderer owns stdout).
  */
-export function renderHuman(result: OpRunResult, write: Writer = stderr): void {
+export function renderHuman(result: OpRunResult, write: Writer = stderr, sealed = false): void {
   let currentPhase: string | undefined;
   for (const record of result.records) {
     if (record.phase !== currentPhase) {
@@ -100,7 +100,7 @@ export function renderHuman(result: OpRunResult, write: Writer = stderr): void {
   // #2300: the plan the approval will be bound to. Printed before the
   // command, because it is what the command approves.
   if (gate.planDigest) write(`  plan    : ${gate.planDigest}`);
-  write(`  approve : ${approveCommand(gate.op, gate.gate, undefined, gate.planDigest)}`);
+  write(`  approve : ${approveCommand(gate.op, gate.gate, undefined, gate.planDigest, sealed)}`);
   if (gate.url) write(`  approve at: ${gate.url}`);
   write(`  expires : ${gate.expiresAt}`);
   // #2310: this run's own append reached only the local chant/lifecycle
@@ -127,8 +127,8 @@ export function renderHuman(result: OpRunResult, write: Writer = stderr): void {
  * stopped on; the `approve` command line rides alongside so a CI job reporting
  * the gate doesn't have to reassemble it from the op and gate names.
  */
-export function renderJson(result: OpRunResult, write: Writer = stdout): void {
-  const approve = result.gate ? { approve: approveCommand(result.gate.op, result.gate.gate, undefined, result.gate.planDigest) } : {};
+export function renderJson(result: OpRunResult, write: Writer = stdout, sealed = false): void {
+  const approve = result.gate ? { approve: approveCommand(result.gate.op, result.gate.gate, undefined, result.gate.planDigest, sealed) } : {};
   // #2310: whether this run's own append reached the remote — not part of
   // the persisted ledger record (a replay has nothing new to report), but a
   // live run's JSON consumer needs it exactly where the human render shows it.

package/src/op/runtime.ts

@@ -183,10 +183,29 @@ export interface OpRunStartOptions {
   signal?: AbortSignal;
   /**
    * For an Op that declares `workLease` (#2748): the work item this run is
-   * for (`--work <id>`) and who holds its lease (`--holder`). Only the local
-   * runtime takes it; a hosted run's lease is taken where the run executes.
+   * for (`--work <id>`) and who holds its lease (`--holder`). The local
+   * runtime takes the lease itself; a runtime that declares
+   * {@link OpRuntimeProvider.carriesWork} hands both to where the run
+   * executes, which takes it there.
    */
   work?: { item?: string; holder?: string };
+  /**
+   * The id to name this run by, in place of one the runtime mints (#3539).
+   * The local runtime uses it as the run record's id, the gate ledger's
+   * `runId` and `currentOpRun().runId`. `chant acp` passes fountain's
+   * conversation id here, so the record a hosted run writes in the sandbox
+   * and the run `chant run status --on fountain` reports carry the same id.
+   */
+  runId?: string;
+}
+
+/** What a caller hands {@link OpRuntimeProvider.resolveGate} besides the resolution. */
+export interface OpGateResolveOptions {
+  /**
+   * `--env` on `chant run approve` (#3539): the environment the woken run
+   * runs in. Omitted, a runtime keeps the environment the gated run had.
+   */
+  env?: string;
 }
 
 /**
@@ -202,6 +221,13 @@ export interface OpRuntimeProvider {
   /** How the CLI names this runtime in messages, and what `--on` matches. */
   readonly name: string;
 
+  /**
+   * Whether `start` carries `opts.work` to where the run executes (#3555),
+   * so `chant run <op> --work <id> --on <name>` is allowed. Omitted, a
+   * non-local runtime is refused `--work` and `--holder` by name.
+   */
+  readonly carriesWork?: boolean;
+
   /** Start a run. Rejects with an actionable Error when it cannot. */
   start(op: OpConfig, opts: OpRunStartOptions): Promise<OpRunHandle>;
 
@@ -220,9 +246,10 @@ export interface OpRuntimeProvider {
   /**
    * Wake a run whose gate has just been resolved. The ledger write is the
    * fact and `chant approve` owns it; this is the runtime's chance to act on
-   * it. Omit when a run re-reads the ledger on its own.
+   * it. Omit when a run re-reads the ledger on its own. `opts.env` is the
+   * `--env` the approver named, when they named one.
    */
-  resolveGate?(op: string, gate: string, resolution: GateResolutionRecord): Promise<void>;
+  resolveGate?(op: string, gate: string, resolution: GateResolutionRecord, opts?: OpGateResolveOptions): Promise<void>;
 
   /**
    * Host `chant run --components`. Optional: a runtime without it refuses the

package/src/op/runtimes/local.test.ts

@@ -95,6 +95,21 @@ describe("the local op runtime", () => {
     expect(status.result?.record?.id).toBe(handle.runId);
   });
 
+  test("a run named by its caller carries that id on the handle, the run context and the record (#3539)", async () => {
+    const { currentOpRun } = await import("../run-context");
+    let seen: ReturnType<typeof currentOpRun>;
+    loadActivitiesMock.mockResolvedValue(new Map([["ok", vi.fn(async () => { seen = currentOpRun(); })]]));
+    const runtime = createLocalOpRuntime();
+
+    const handle = await runtime.start(op("hello", [{ kind: "activity", fn: "ok", args: {} }]), { runId: "conv-42" });
+    const status = await handle.result();
+
+    expect(handle.runId).toBe("conv-42");
+    expect(status.runId).toBe("conv-42");
+    expect(seen?.runId).toBe("conv-42");
+    expect(status.result?.record?.id).toBe("conv-42");
+  });
+
   test("the project's configured lexicons decide which appliers load", async () => {
     loadActivitiesMock.mockResolvedValue(new Map([["ok", vi.fn(async () => ({}))]]));
     const runtime = createLocalOpRuntime();

package/src/op/runtimes/local.ts

@@ -139,7 +139,9 @@ export function createLocalOpRuntime(opts: { projectPath?: string } = {}): OpRun
 
       const [activities, profiles] = await Promise.all([loadActivities(lexicons), loadProfiles()]);
 
-      const runId = `local-${Date.now()}`;
+      // A caller that names the run (#3539: `chant acp` on fountain passes the
+      // conversation id) gets its id on the record; otherwise one is minted.
+      const runId = startOpts.runId ?? `local-${Date.now()}`;
       const startedAt = new Date().toISOString();
       noteEnv(op);
 

package/src/pr-loop.test.ts

@@ -16,7 +16,9 @@ import {
   PR_REPORT_SCHEMA_ID,
   prApproveCommand,
   prNoteMarker,
+  PR_GATE_OP,
   prOp,
+  prStatusContext,
   prStatusDescription,
   prStatusState,
   renderPrNote,
@@ -101,6 +103,12 @@ const appliedReport: PrReport = {
   ],
 };
 
+const resumedReport: PrReport = {
+  ...appliedReport,
+  members: [{ ...planReport.members[0], status: "applied" }, { ...planReport.members[1], status: "applied" }],
+  resumed: { applied: ["a"] },
+};
+
 describe("the pr-report schema", () => {
   test("is a valid schema and names this module's id", () => {
     expect(validSchema(schema)).toBe(true);
@@ -108,7 +116,7 @@ describe("the pr-report schema", () => {
   });
 
   test("every stage's report validates, and its change set validates against the change-set schema", () => {
-    for (const report of [planReport, refusedReport, appliedReport]) {
+    for (const report of [planReport, refusedReport, appliedReport, resumedReport]) {
       expectValid(report);
       expectValidChangeSet(report.changeSet);
       expect(report.changeSet.digest).toBe(report.digest);
@@ -144,6 +152,12 @@ describe("the note", () => {
     golden("pr-apply-applied.note.golden.md", note);
   });
 
+  test("a resumed apply names what the earlier attempt applied (#3464)", () => {
+    const note = renderPrNote(resumedReport);
+    expect(note).toContain("Resumed under the same approval: `a` applied in an earlier attempt and did not run again.");
+    expect(renderPrNote(appliedReport)).not.toContain("Resumed");
+  });
+
   test("a small limit leaves the summary out rather than cutting the table", () => {
     const note = renderPrNote(planReport, { limit: 800 });
     expect(note).toContain("| `app` |");
@@ -169,3 +183,29 @@ describe("the status", () => {
     expect(prApproveCommand(planReport, "gitlab:ana")).toBe(`chant approve pr-12 pr-apply --plan ${doc.digest} --approver gitlab:ana --sign`);
   });
 });
+
+describe("a workspace member's loop (#3465)", () => {
+  const memberReport: PrReport = { ...planReport, member: "network", op: prOp(12, "network") };
+
+  test("the op, the note marker and the status contexts carry the member's name", () => {
+    expect(prOp(12)).toBe("pr-12");
+    expect(prOp(12, "network")).toBe("pr-12-network");
+    expect(prNoteMarker("prod", "network")).toBe("<!-- chant-pr:prod:network -->");
+    expect(prNoteMarker("prod", "network")).not.toBe(prNoteMarker("prod"));
+    expect(prStatusContext("plan")).toBe("chant/plan");
+    expect(prStatusContext("apply", "network")).toBe("chant/apply/network");
+  });
+
+  test("the gate op pattern takes both forms and nothing else", () => {
+    for (const op of ["pr-12", "pr-12-network", "pr-3-a1-b2"]) expect(PR_GATE_OP.test(op)).toBe(true);
+    for (const op of ["pr-", "pr-x", "pr-12-", "pr-12-Net", "fan-out"]) expect(PR_GATE_OP.test(op)).toBe(false);
+  });
+
+  test("the report with a member validates, and its note names the member and approves its own op", () => {
+    expectValid(memberReport);
+    const note = renderPrNote(memberReport);
+    expect(note.startsWith("<!-- chant-pr:" + memberReport.env + ":network -->")).toBe(true);
+    expect(note).toContain("in member `network`");
+    expect(note).toContain("chant approve pr-12-network pr-apply");
+  });
+});

package/src/pr-loop.ts

@@ -16,8 +16,9 @@
  *
  * One gate per pull request: op `pr-<number>`, gate `pr-apply` unless the
  * pipeline names another. It binds the digest of the change-set document over
- * every planned member (`changeSetDigest`, #3181), the same digest a gated
- * wave binds over its members (#3049). A reviewer approves it with `chant
+ * every planned member (`changeSetDocumentDigest`, #3181): the set digest a
+ * gated wave binds over its members (#3049), and the document's entries, holes
+ * and side effects with it (#3555). A reviewer approves it with `chant
  * approve pr-<number> pr-apply --plan <digest>`. The op carries the number so
  * that one pull request's approval never answers another's, and the gate name
  * stays fixed so a workspace can require signed approvals for it under
@@ -26,6 +27,14 @@
  * On merge the apply plans the same members again, before anything applies,
  * and decides the gate against the new digest. The same plan applies; a moved
  * plan stops with both digests named and nothing applied.
+ *
+ * ## Inside a workspace member
+ *
+ * Each workspace member that generates the pipeline (#3465) runs its own
+ * plan and apply on the same pull request, so each keeps its own gate, note
+ * and statuses: op `pr-<number>-<member>`, the note marker and the status
+ * contexts carry the member's name. The gate name stays the same, so one
+ * `identity.gates` entry covers every member.
  */
 
 import type { ChangeSetAction, ChangeSetDocument } from "./change-set";
@@ -40,19 +49,30 @@ export const PR_REPORT_CONTRACT = 1;
 /** The gate a pull request's apply waits on, unless the pipeline names another. */
 export const PR_APPLY_GATE = "pr-apply";
 
-/** The op a pull request's gate is recorded under: `pr-<number>`. */
-export function prOp(pr: number): string {
-  return `pr-${pr}`;
+/**
+ * The op a pull request's gate is recorded under: `pr-<number>`, or
+ * `pr-<number>-<member>` for a workspace member's pipeline (#3465).
+ */
+export function prOp(pr: number, member?: string): string {
+  return member ? `pr-${pr}-${member}` : `pr-${pr}`;
 }
 
-/** The hidden line that marks the pull request's note, one per environment. */
-export function prNoteMarker(env: string): string {
-  return `<!-- chant-pr:${env} -->`;
+/** Whether `op` is a pull request's gate op, with or without a member. Member names follow the declaration's name pattern. */
+export const PR_GATE_OP = /^pr-\d+(?:-[a-z0-9][a-z0-9-]*)?$/;
+
+/** The hidden line that marks the pull request's note, one per environment and, in a workspace, per member. */
+export function prNoteMarker(env: string, member?: string): string {
+  return member ? `<!-- chant-pr:${env}:${member} -->` : `<!-- chant-pr:${env} -->`;
 }
 
 /** The status contexts the two stages set on the commit. */
 export const PR_STATUS_CONTEXTS = { plan: "chant/plan", apply: "chant/apply" } as const;
 
+/** A stage's status context: `chant/plan`, or `chant/plan/<member>` for a workspace member's pipeline. */
+export function prStatusContext(stage: "plan" | "apply", member?: string): string {
+  return member ? `${PR_STATUS_CONTEXTS[stage]}/${member}` : PR_STATUS_CONTEXTS[stage];
+}
+
 /** Changes a member's plan proposes, by the actions a reviewer reads. */
 export interface PrMemberCounts {
   create: number;
@@ -143,6 +163,8 @@ export interface PrReport {
   /** The pull or merge request number, when known. */
   pr: number | null;
   env: string;
+  /** The workspace member whose pipeline ran the stage (#3465). Absent outside a workspace member. */
+  member?: string;
   /** The commit the change is measured from: the merge base of the given base and `head`. */
   base: string;
   head: string;
@@ -155,6 +177,12 @@ export interface PrReport {
   refusal?: PrRefusal;
   /** The refusal or failure, as printed. */
   message?: string;
+  /**
+   * Apply stage, `--resume` (#3464): an earlier attempt at the approved set
+   * failed partway, and these components applied in it. This run applied
+   * the rest under the same approval and did not run them again.
+   */
+  resumed?: { applied: string[] };
   approval: PrApproval;
   /** Component names: which changed, which run because they depend on one, and what the change touched that no component deploys. */
   selection: {
@@ -255,12 +283,15 @@ function approvalLines(report: PrReport, approver: string): string[] {
 export function renderPrNote(report: PrReport, options: { limit?: number; approver?: string } = {}): string {
   const limit = options.limit ?? GITHUB_COMMENT_LIMIT;
   const out: string[] = [
-    prNoteMarker(report.env),
-    `### chant ${report.stage === "plan" ? "plan" : "apply"} for ${code(report.env)}`,
+    prNoteMarker(report.env, report.member),
+    `### chant ${report.stage === "plan" ? "plan" : "apply"} for ${code(report.env)}${report.member ? ` in member ${code(report.member)}` : ""}`,
     "",
     `${headline(report)} Head ${code(short(report.head))}, measured from ${code(short(report.base))}.`,
   ];
   if (report.message) out.push("", `> ${report.message.split("\n").join("\n> ")}`);
+  if (report.resumed && report.resumed.applied.length > 0) {
+    out.push("", `Resumed under the same approval: ${report.resumed.applied.map(code).join(", ")} applied in an earlier attempt and did not run again.`);
+  }
   if (report.members.length > 0) {
     out.push("", "| Member | Component | Status | Create | Update | Replace | Delete |", "|---|---|---|---:|---:|---:|---:|");
     for (const m of report.members) {

package/src/workspace/change-set.schema.json

@@ -26,7 +26,7 @@
     "digest": {
       "type": "string",
       "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$",
-      "description": "computePlanDigest(\"change-set\", \u2026) over the members' { member, planDigest } pairs sorted by member, provisional members left out. What a gate over the whole run binds."
+      "description": "computePlanDigest(\"change-set-document\", \u2026) over the set digest (computePlanDigest(\"change-set\", \u2026) over the members' { member, planDigest } pairs sorted by member), each member's member, status and holes, the entries and the side effects, provisional members and their entries left out. What a gate over the whole run binds."
     },
     "members": {
       "type": "array",

package/src/workspace/lineage-upgrade-cli.ts

@@ -15,7 +15,7 @@ import { writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { formatError, formatInfo, formatSuccess, formatWarning } from "../cli/format";
 import type { CommandContext } from "../cli/registry";
-import { approveCommand, describeGateMismatch, evaluateGate, gitGateLedgerPort, type GateLedgerPort } from "../op/gate";
+import { approveCommand, describeGateMismatch, evaluateGate, gateIsSealed, gitGateLedgerPort, type GateLedgerPort } from "../op/gate";
 import { WORKSPACE_UPGRADE_GATE_OP } from "../op/gate-name";
 import { LockError } from "./lineage-lock";
 import { applyStagedUpgrade, describeStaged, stageUpgrade, type ChantRunner, type StagedUpgrade } from "./lineage-upgrade";
@@ -104,12 +104,13 @@ export async function upgradeCommand(opts: UpgradeCommandOptions): Promise<Upgra
     });
     if (!check.satisfied) {
       if (!opts.json) {
-        if (check.mismatch) console.error(formatWarning({ message: describeGateMismatch(WORKSPACE_UPGRADE_GATE_OP, gate, check.mismatch) }));
+        const sealed = await gateIsSealed(gate);
+        if (check.mismatch) console.error(formatWarning({ message: describeGateMismatch(WORKSPACE_UPGRADE_GATE_OP, gate, check.mismatch, sealed) }));
         if (check.pushWarning) console.error(formatWarning({ message: check.pushWarning }));
         if (check.quorum) console.error(formatInfo(`approvals so far: ${check.quorum.approvers.length} of ${check.quorum.need}`));
         console.error(
           formatInfo(
-            `Gated: the patch ${staged.digest} waits for approval. Review it (--output <file> writes it), then run \`${approveCommand(WORKSPACE_UPGRADE_GATE_OP, gate)}\` and repeat this command to apply it.`,
+            `Gated: the patch ${staged.digest} waits for approval. Review it (--output <file> writes it), then run \`${approveCommand(WORKSPACE_UPGRADE_GATE_OP, gate, undefined, undefined, sealed)}\` and repeat this command to apply it.`,
           ),
         );
       }