@intentius/chant 0.121.1 → 0.123.0

package/src/workspace/records-write-contract.test.ts

@@ -104,14 +104,15 @@ describe("real output validates", () => {
   });
 
   test("records new, as a dry run against the chant repo's own decisions", async () => {
-    const doc = await newRecord({ kind: KIND, fields, dryRun: true, cwd: REPO });
+    // The repo holds ws- and sql- decisions (#3751), so a new one names its prefix.
+    const doc = await newRecord({ kind: KIND, fields, prefix: "ws", dryRun: true, cwd: REPO });
     expectValid(newSchema, doc);
     expect(doc).toMatchObject({ dryRun: true, path: expect.stringMatching(/^docs\/design\/decisions\/ws-\d{3}-a-decision-written-through-chant\.md$/) });
   });
 
   test("each command written, dry-run and refused", async () => {
     const root = copyDecisions();
-    const made = await newRecord({ kind: KIND, fields, cwd: root });
+    const made = await newRecord({ kind: KIND, fields, prefix: "ws", cwd: root });
     expectValid(newSchema, made);
     if ("error" in made) throw new Error(made.error.message);
     expectValid(newSchema, await newRecord({ kind: KIND, fields: "[]", cwd: root }));

package/src/workspace/status-gates.ts

@@ -16,13 +16,14 @@
  * gate in its environment is the anchor, only approvals recorded since it and
  * for its plan count, and a gate with an `approval` block counts them with
  * `tallyGateApprovals`, as `describeApprovalProgress` does after an approve.
+ * Its human quorum reaches back to `humanQuorumSince` (#3206), as a run's does.
  */
 
 import { execFileSync } from "node:child_process";
 import { samePlanDigest } from "../lifecycle/plan-digest";
 import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger";
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, parseGateLedger } from "../lifecycle/gate-ledger";
-import { tallyGateApprovals, type GateApprovalRule } from "../op/gate";
+import { humanQuorumSince, tallyGateApprovals, type GateApprovalRule } from "../op/gate";
 import type { ReasonCode } from "./reason-codes";
 
 /** Why a member's gates can't be listed. Closed: a new code is a contract change. */
@@ -139,7 +140,7 @@ export function approveCommand(component: string, gate: string, env: string | nu
 const approvalOf = (r: GateResolutionRecord): StatusGateApproval => ({ principal: r.resolvedBy, channel: r.origin ?? null, relayedBy: r.relayedBy ?? null, at: r.timestamp });
 
 /** One gate in one environment, decided against its newest pending fact. */
-function decide(component: string, standing: PendingGateRecord, all: GateResolutionRecord[], now: string, rule: GateApprovalRule | null): StatusGate {
+function decide(component: string, standing: PendingGateRecord, facts: PendingGateRecord[], all: GateResolutionRecord[], now: string, rule: GateApprovalRule | null): StatusGate {
   const gate = standing.gate;
   // #3163: under identity.gates, an unsigned approval, or one from outside the class, doesn't count, as a run reads it.
   const resolutions = rule === null ? all : all.filter((r) => r.gate !== gate || rule.refuses(r) === null);
@@ -155,7 +156,8 @@ function decide(component: string, standing: PendingGateRecord, all: GateResolut
   let needed = 1;
   let mismatched: GateResolutionRecord | undefined;
   if (standing.approval) {
-    const tally = tallyGateApprovals(own, gate, since, planDigest, standing.approval);
+    // #3206: a human approval from before a fact re-recorded for a mode or context change still counts.
+    const tally = tallyGateApprovals(own, gate, since, planDigest, standing.approval, humanQuorumSince(facts, standing));
     approved = tally.permit !== undefined || tally.counted.length >= tally.need;
     approvals = tally.permit && !tally.counted.includes(tally.permit) ? [...tally.counted, tally.permit] : tally.counted;
     needed = tally.need;
@@ -207,7 +209,8 @@ export function gatesInLedger(component: string, content: string, envs: readonly
       byEnv.set(env, [...(byEnv.get(env) ?? []), p]);
     }
     for (const env of [...byEnv.keys()].sort((a, b) => envs.indexOf(a ?? "") - envs.indexOf(b ?? ""))) {
-      gates.push(decide(component, latestPendingGate(byEnv.get(env)!, gate)!, resolutions, now, rules(gate)));
+      const envFacts = byEnv.get(env)!;
+      gates.push(decide(component, latestPendingGate(envFacts, gate)!, envFacts, resolutions, now, rules(gate)));
     }
   }
   return { gates, malformed };

package/src/workspace/trust/gate-seal.test.ts

@@ -0,0 +1,156 @@
+/**
+ * #3763, #3785: a gate approval's seal, checked with node:crypto, answers as
+ * ssh-keygen does. Each seal is made by `ssh-keygen -Y sign` and checked three
+ * ways: {@link gateSealRefusal} here, `checkGateSeal` (which now uses the same
+ * verifier), and `ssh-keygen -Y verify` run directly against the same signers
+ * text, so the agreement does not rest on chant's own code alone.
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, describe, expect, test } from "vitest";
+import { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval } from "./gate-seal";
+import { checkGateSeal } from "./seal";
+import { emptyPolicy, parseAllowedSigners, type TrustPolicy } from "./policy";
+import { hasSshKeygen } from "./test-repo";
+
+const dir = mkdtempSync(join(tmpdir(), "chant-3763-seal-"));
+afterAll(() => rmSync(dir, { recursive: true, force: true }));
+
+interface Key {
+  file: string;
+  /** `<type> <base64>`. */
+  pub: string;
+}
+
+function key(name: string, args: string[]): Key {
+  const file = join(dir, `key-${name}`);
+  execFileSync("ssh-keygen", ["-q", ...args, "-N", "", "-C", name, "-f", file]);
+  return { file, pub: readFileSync(`${file}.pub`, "utf-8").trim().split(" ").slice(0, 2).join(" ") };
+}
+
+function sign(k: Key, payload: Buffer, namespace = GATE_SEAL_NAMESPACE): string {
+  const f = join(dir, `payload-${Math.random().toString(36).slice(2)}`);
+  writeFileSync(f, payload);
+  execFileSync("ssh-keygen", ["-q", "-Y", "sign", "-n", namespace, "-f", k.file, f], { stdio: "ignore" });
+  return readFileSync(`${f}.sig`, "utf-8");
+}
+
+const blob = (k: Key): Buffer => Buffer.from(k.pub.split(" ")[1]!, "base64");
+
+function approval(over: Partial<SealedGateApproval> = {}): SealedGateApproval {
+  return { op: "migrations", gate: "migrations-wave-1", planDigest: "jcs1-sha256:abc", resolvedBy: "alice", timestamp: "2026-10-11T00:00:00.000Z", ...over };
+}
+
+const signersText = new WeakMap<TrustPolicy, string>();
+
+function policyOf(text: string): TrustPolicy {
+  const set = parseAllowedSigners(text);
+  const policy: TrustPolicy = { ...emptyPolicy("0".repeat(40)), active: true, signers: set.signers, excluded: set.excluded };
+  signersText.set(policy, text);
+  return policy;
+}
+
+/** Both checks, as `{ ours, keygen }`: null or the refusal, and whether ssh-keygen attested it. */
+function both(policy: TrustPolicy, a: SealedGateApproval): { ours: string | null; keygen: boolean } {
+  const ours = gateSealRefusal(policy as GateSigners, a);
+  // checkGateSeal shares the verifier; it must answer as the rule does.
+  expect(checkGateSeal(policy, a).attested === true).toBe(ours === null);
+  // ssh-keygen -Y verify, run directly, against the same signers text.
+  const seal = a.seal as { signature?: string } | undefined;
+  let keygen = false;
+  if (typeof seal?.signature === "string") {
+    const f = join(dir, `v-${Math.random().toString(36).slice(2)}`);
+    writeFileSync(`${f}.signers`, signersText.get(policy) ?? "");
+    writeFileSync(`${f}.sig`, seal.signature);
+    try {
+      execFileSync("ssh-keygen", ["-Y", "verify", "-f", `${f}.signers`, "-I", a.resolvedBy.normalize("NFKC").trim().toLowerCase(), "-n", GATE_SEAL_NAMESPACE, "-s", `${f}.sig`], { input: gateSealPayload(a), stdio: ["pipe", "ignore", "ignore"] });
+      keygen = true;
+    } catch {
+      keygen = false;
+    }
+  }
+  return { ours, keygen };
+}
+
+describe.skipIf(!hasSshKeygen)("an SSHSIG checked with node:crypto", () => {
+  const keys: Array<[string, string[]]> = [
+    ["ed25519", ["-t", "ed25519"]],
+    ["rsa", ["-t", "rsa", "-b", "2048"]],
+    ["ecdsa-256", ["-t", "ecdsa", "-b", "256"]],
+    ["ecdsa-384", ["-t", "ecdsa", "-b", "384"]],
+    ["ecdsa-521", ["-t", "ecdsa", "-b", "521"]],
+  ];
+
+  test.each(keys)("a %s seal verifies, and an edited approval does not", (name, args) => {
+    const k = key(`alice-${name}`, args);
+    const a = approval();
+    const signature = sign(k, gateSealPayload(a));
+    const r = verifySshSignatureWith(signature, gateSealPayload(a), GATE_SEAL_NAMESPACE, [blob(k)]);
+    expect(r).toEqual({ ok: true, key: sshKeyFingerprint(blob(k)) });
+    // The fingerprint is the one ssh-keygen prints.
+    expect(execFileSync("ssh-keygen", ["-l", "-f", `${k.file}.pub`], { encoding: "utf-8" })).toContain(sshKeyFingerprint(blob(k)));
+
+    const policy = policyOf(`alice ${k.pub}\n`);
+    const seal = { signer: "alice", key: "SHA256:x", signature };
+    expect(both(policy, { ...a, seal })).toEqual({ ours: null, keygen: true });
+    for (const edited of [{ planDigest: "jcs1-sha256:other" }, { timestamp: "2026-10-12T00:00:00.000Z" }, { relayedBy: "bot" }, { environment: "prod" }]) {
+      const res = both(policy, { ...a, ...edited, seal });
+      expect(res.keygen).toBe(false);
+      expect(res.ours).toMatch(/does not verify for alice/);
+    }
+  });
+
+  test("a seal in another namespace, or by a key listed for someone else, does not count either way", () => {
+    const alice = key("alice-ns", ["-t", "ed25519"]);
+    const bob = key("bob-ns", ["-t", "ed25519"]);
+    const a = approval();
+    const policy = policyOf(`alice ${alice.pub}\nbob ${bob.pub}\n`);
+
+    const otherNs = { signer: "alice", key: "k", signature: sign(alice, gateSealPayload(a), "chant-review") };
+    expect(both(policy, { ...a, seal: otherNs }).keygen).toBe(false);
+    expect(both(policy, { ...a, seal: otherNs }).ours).toMatch(/chant-review namespace/);
+
+    const byBob = { signer: "alice", key: "k", signature: sign(bob, gateSealPayload(a)) };
+    expect(both(policy, { ...a, seal: byBob }).keygen).toBe(false);
+    expect(both(policy, { ...a, seal: byBob }).ours).toMatch(/does not list/);
+  });
+
+  test("a signers line's namespaces option is honoured", () => {
+    const k = key("alice-opt", ["-t", "ed25519"]);
+    const a = approval();
+    const seal = { signer: "alice", key: "k", signature: sign(k, gateSealPayload(a)) };
+    expect(both(policyOf(`alice namespaces="chant-gate,git" ${k.pub}\n`), { ...a, seal })).toEqual({ ours: null, keygen: true });
+    expect(both(policyOf(`alice namespaces="chant-*" ${k.pub}\n`), { ...a, seal })).toEqual({ ours: null, keygen: true });
+    const refused = both(policyOf(`alice namespaces="git" ${k.pub}\n`), { ...a, seal });
+    expect(refused.keygen).toBe(false);
+    expect(refused.ours).not.toBeNull();
+  });
+
+  test("principals compare as chant compares them", () => {
+    const k = key("alice-case", ["-t", "ed25519"]);
+    const a = approval({ resolvedBy: "github:Alice" });
+    const seal = { signer: "github:alice", key: "k", signature: sign(k, gateSealPayload(a)) };
+    expect(both(policyOf(`github:alice ${k.pub}\n`), { ...a, seal })).toEqual({ ours: null, keygen: true });
+  });
+});
+
+describe("the refusals that need no signature", () => {
+  const signers = (over: Partial<GateSigners> = {}): GateSigners => ({ base: "a".repeat(40), signersPath: ".chant/allowed_signers", active: true, signers: [], problems: [], ...over });
+
+  test("no signers file at base passes nothing", () => {
+    expect(gateSealRefusal(signers({ active: false }), approval())).toBe(`the gate is sealed, and there is no signers file (.chant/allowed_signers) at base ${"a".repeat(12)}`);
+    expect(gateSealRefusal(signers({ active: false, problems: [".chant/trust.json is invalid"] }), approval())).toMatch(/: \.chant\/trust\.json is invalid$/);
+  });
+
+  test("an unsigned, malformed, or someone else's seal", () => {
+    const listed = signers({ signers: parseAllowedSigners("alice ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOv1\n").signers });
+    expect(gateSealRefusal(listed, approval())).toBe("the approval of gate migrations-wave-1 by alice carries no seal");
+    expect(gateSealRefusal(listed, approval({ seal: { signer: "alice" } }))).toMatch(/malformed/);
+    expect(gateSealRefusal(listed, approval({ seal: { signer: "bob", signature: "x" } }))).toMatch(/is by bob, and its approver is alice/);
+    expect(gateSealRefusal(listed, approval({ resolvedBy: "carol", seal: { signer: "carol", signature: "x" } }))).toBe("carol has no key in .chant/allowed_signers at base, so the seal can't count");
+    expect(gateSealRefusal(listed, approval({ seal: { signer: "alice", signature: "not a signature" } }))).toMatch(/not an armored ssh signature/);
+  });
+});

package/src/workspace/trust/gate-seal.ts

@@ -0,0 +1,254 @@
+/**
+ * A gate approval's seal (#3163, ws-080), checked with node:crypto (#3763).
+ *
+ * `chant approve --sign` seals an approval with `ssh-keygen -Y sign` in the
+ * `chant-gate` namespace, over {@link gateSealPayload}. Signing shells to
+ * ssh-keygen; checking does not. This module checks a seal with node:crypto
+ * and no zod, and `checkGateSeal` (`./seal.ts`) and `sealedApprovalRule` use
+ * it, so an apply job needs no ssh-keygen. A tool that decides a gate from one bundled file
+ * (terragucci's apply job) runs the same rule: `@intentius/chant/gate-decision`
+ * exports it.
+ *
+ * An SSHSIG (OpenSSH's PROTOCOL.sshsig) holds the public key, the namespace,
+ * the hash algorithm and the signature over `"SSHSIG"`, the namespace, the
+ * reserved field, the algorithm and the message's hash. Ed25519, ECDSA (P-256,
+ * P-384, P-521), RSA with SHA-2, and the security-key forms of Ed25519 and
+ * P-256 verify, with the touch flag required, as ssh-keygen requires it for a
+ * signers line with no `no-touch-required` option (which the signers parser
+ * does not accept). An RSA signature over SHA-1 does not verify.
+ */
+
+import { createHash, createPublicKey, verify, type KeyObject } from "node:crypto";
+import type { Signer } from "./trust-files";
+
+/**
+ * The ssh signature namespace of a gate approval's seal (#3163, ws-080), so a
+ * verdict, record or commit signature can't stand in for one.
+ */
+export const GATE_SEAL_NAMESPACE = "chant-gate";
+
+/** The gate approval a seal covers (#3163): the fields of a gate resolution line that say what was approved, by whom and when. */
+export interface SealedGateApproval {
+  op: string;
+  gate: string;
+  environment?: string;
+  planDigest?: string;
+  resolvedBy: string;
+  /** Who relayed the approval for `resolvedBy` (#3402), when someone did. */
+  relayedBy?: string;
+  timestamp: string;
+  seal?: unknown;
+}
+
+/**
+ * The bytes a gate approval's seal signs (#3163): the op (or component), the
+ * gate, the environment, the plan digest, the approver and the time, joined
+ * by LF with no final newline. An approval that binds no environment or plan
+ * signs an empty line for it. A relayed approval (#3402) signs a seventh line,
+ * `relayed-by <principal>`, so the relay can't be added, changed or removed
+ * after sealing; an approval nobody relayed signs the six lines it always did,
+ * so seals made before #3402 still verify.
+ */
+export function gateSealPayload(a: SealedGateApproval): Buffer {
+  const relay = a.relayedBy !== undefined ? `\nrelayed-by ${a.relayedBy}` : "";
+  return Buffer.from(`${a.op}\n${a.gate}\n${a.environment ?? ""}\n${a.planDigest ?? ""}\n${a.resolvedBy}\n${a.timestamp}${relay}`, "utf-8");
+}
+
+// ── SSHSIG ───────────────────────────────────────────────────────────────
+
+/** A reader over ssh wire format: `take(n)` bytes, or `take()` one length-prefixed string. */
+function reader(buf: Buffer): (n?: number) => Buffer {
+  let at = 0;
+  const take = (n?: number): Buffer => {
+    const len = n ?? take(4).readUInt32BE(0);
+    if (at + len > buf.length) throw new Error("the signature is truncated");
+    return buf.subarray(at, (at += len));
+  };
+  return take;
+}
+
+const wire = (b: Buffer | string): Buffer => {
+  const v = Buffer.from(b);
+  const n = Buffer.alloc(4);
+  n.writeUInt32BE(v.length);
+  return Buffer.concat([n, v]);
+};
+const hash = (alg: string, b: Buffer): Buffer => createHash(alg).update(b).digest();
+const b64url = (b: Buffer): string => b.toString("base64url");
+/** An mpint without its sign byte, left-padded to `size` bytes when given. */
+const unsigned = (b: Buffer, size?: number): Buffer => {
+  let v = b;
+  while (v.length > 1 && v[0] === 0) v = v.subarray(1);
+  return size === undefined || v.length >= size ? v : Buffer.concat([Buffer.alloc(size - v.length), v]);
+};
+
+/** `SHA256:<base64>`, the fingerprint ssh-keygen prints for a public key blob. */
+export function sshKeyFingerprint(blob: Buffer): string {
+  return `SHA256:${hash("sha256", blob).toString("base64").replace(/=+$/, "")}`;
+}
+
+const CURVES: Record<string, { crv: string; size: number; hash: string }> = {
+  nistp256: { crv: "P-256", size: 32, hash: "sha256" },
+  nistp384: { crv: "P-384", size: 48, hash: "sha384" },
+  nistp521: { crv: "P-521", size: 66, hash: "sha512" },
+};
+
+/** The key a public key blob holds, what it signs with, and the security key's application when it is one. */
+function publicKey(blob: Buffer): { type: string; key: KeyObject; ecdsa?: { size: number; hash: string }; application?: Buffer } {
+  const take = reader(blob);
+  const type = take().toString();
+  if (type === "ssh-ed25519" || type === "sk-ssh-ed25519@openssh.com") {
+    const key = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: b64url(take()) }, format: "jwk" });
+    return { type, key, ...(type.startsWith("sk-") ? { application: take() } : {}) };
+  }
+  if (type.startsWith("ecdsa-sha2-") || type === "sk-ecdsa-sha2-nistp256@openssh.com") {
+    const curve = CURVES[take().toString()];
+    if (!curve) throw new Error(`unsupported curve in ${type}`);
+    const q = take();
+    if (q[0] !== 4 || q.length !== 1 + 2 * curve.size) throw new Error("the ECDSA key is not an uncompressed point");
+    const key = createPublicKey({
+      key: { kty: "EC", crv: curve.crv, x: b64url(q.subarray(1, 1 + curve.size)), y: b64url(q.subarray(1 + curve.size)) },
+      format: "jwk",
+    });
+    return { type, key, ecdsa: curve, ...(type.startsWith("sk-") ? { application: take() } : {}) };
+  }
+  if (type === "ssh-rsa") {
+    const e = unsigned(take());
+    const n = unsigned(take());
+    return { type, key: createPublicKey({ key: { kty: "RSA", e: b64url(e), n: b64url(n) }, format: "jwk" }) };
+  }
+  throw new Error(`unsupported key type ${type}`);
+}
+
+/** What {@link verifySshSignatureWith} found. */
+export type SshSignatureCheck = { ok: true; key: string } | { ok: false; reason: string };
+
+/**
+ * Whether `armored`, an SSHSIG as `ssh-keygen -Y sign` writes it, signs
+ * `message` in `namespace` with one of `keys` (public key blobs, ssh wire
+ * format). Never throws. On success, `key` is the signing key's fingerprint.
+ */
+export function verifySshSignatureWith(armored: string, message: Buffer, namespace: string, keys: readonly Buffer[]): SshSignatureCheck {
+  try {
+    const body = /-----BEGIN SSH SIGNATURE-----([^-]*)-----END SSH SIGNATURE-----/.exec(armored)?.[1];
+    if (body === undefined) return { ok: false, reason: "it is not an armored ssh signature" };
+    const take = reader(Buffer.from(body.replace(/\s+/g, ""), "base64"));
+    if (take(6).toString() !== "SSHSIG" || take(4).readUInt32BE(0) !== 1) return { ok: false, reason: "it is not an SSHSIG, version 1" };
+    const pk = take();
+    const ns = take();
+    const reserved = take();
+    const alg = take().toString();
+    const sigWire = take();
+    if (ns.toString() !== namespace) return { ok: false, reason: `it is signed in the ${ns.toString()} namespace, not ${namespace}` };
+    if (alg !== "sha256" && alg !== "sha512") return { ok: false, reason: `it hashes with ${alg}, and only sha256 and sha512 are accepted` };
+    if (!keys.some((k) => k.equals(pk))) return { ok: false, reason: "signed by a key the policy at base does not list for the approver" };
+    let data = Buffer.concat([Buffer.from("SSHSIG"), wire(ns), wire(reserved), wire(alg), wire(hash(alg, message))]);
+    const { type, key, ecdsa, application } = publicKey(pk);
+    const sig = reader(sigWire);
+    const sigType = sig().toString();
+    const raw = sig();
+    const fingerprint = sshKeyFingerprint(pk);
+    const answer = (ok: boolean): SshSignatureCheck => (ok ? { ok: true, key: fingerprint } : { ok: false, reason: "the signature does not match the signed fields" });
+    if (type === "ssh-rsa") {
+      if (sigType !== "rsa-sha2-256" && sigType !== "rsa-sha2-512") return { ok: false, reason: `an RSA signature of type ${sigType} is not accepted` };
+      return answer(verify(`sha${sigType.slice(9)}`, data, key, raw));
+    }
+    if (sigType !== type) return { ok: false, reason: `a ${sigType} signature from a ${type} key` };
+    if (application !== undefined) {
+      // A security key signs its application, its flags and counter, then the data's hash; ssh-keygen requires the touch flag.
+      const flags = sig(1);
+      if (!(flags[0]! & 1)) return { ok: false, reason: "the security key was not touched (the user-presence flag is unset)" };
+      data = Buffer.concat([hash("sha256", application), flags, sig(4), hash("sha256", data)]);
+    }
+    if (ecdsa) {
+      const rs = reader(raw);
+      const r = unsigned(rs(), ecdsa.size);
+      const s = unsigned(rs(), ecdsa.size);
+      return answer(verify(application !== undefined ? "sha256" : ecdsa.hash, data, { key, dsaEncoding: "ieee-p1363" }, Buffer.concat([r, s])));
+    }
+    return answer(verify(null, data, key, raw));
+  } catch (err) {
+    return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/**
+ * The key blob an armored SSHSIG carries, or null when it is not one. For
+ * `ssh-keygen -Y check-novalidate`'s question, whether the signature is
+ * intact whoever's key it is: verify against this key.
+ */
+export function sshSignatureKey(armored: string): Buffer | null {
+  try {
+    const body = /-----BEGIN SSH SIGNATURE-----([^-]*)-----END SSH SIGNATURE-----/.exec(armored)?.[1];
+    if (body === undefined) return null;
+    const take = reader(Buffer.from(body.replace(/\s+/g, ""), "base64"));
+    if (take(6).toString() !== "SSHSIG" || take(4).readUInt32BE(0) !== 1) return null;
+    return Buffer.from(take());
+  } catch {
+    return null;
+  }
+}
+
+// ── the rule ─────────────────────────────────────────────────────────────
+
+/**
+ * The signers a sealed gate is judged by, read at base. chant's own
+ * `TrustPolicy` (`./policy.ts`) is one; `gateSignersAt` in
+ * `@intentius/chant/gate-decision` reads one without zod.
+ */
+export interface GateSigners {
+  /** The commit the signers were read at, or null when there is no base. */
+  base: string | null;
+  /** The signers path used. */
+  signersPath: string;
+  /** Whether a signers file exists at base. False: no seal verifies, so a sealed gate passes nothing. */
+  active: boolean;
+  signers: Signer[];
+  /** Why the trust config could not be read, when it could not. `active` is false then. */
+  problems: string[];
+}
+
+const normalise = (name: string): string => name.normalize("NFKC").trim().toLowerCase();
+
+/** Whether ssh-keygen's `namespaces="..."` pattern list admits `namespace`: a `*`/`?` pattern matches, and a `!` pattern that matches refuses. */
+export function namespaceAllowed(list: string | undefined, namespace: string): boolean {
+  if (list === undefined) return true;
+  let allowed = false;
+  for (const raw of list.split(",")) {
+    const negated = raw.startsWith("!");
+    const pattern = negated ? raw.slice(1) : raw;
+    const re = new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
+    if (!re.test(namespace)) continue;
+    if (negated) return false;
+    allowed = true;
+  }
+  return allowed;
+}
+
+/**
+ * Why this approval does not count toward a sealed gate, or null when it
+ * does: its seal verifies, for the approver it names, against a key `signers`
+ * lists for that approver in the `chant-gate` namespace. With no signers file
+ * at base, nothing counts. The same rule as `sealedApprovalRule` in
+ * `../../op/gate-review.ts`, which checks with ssh-keygen.
+ */
+export function gateSealRefusal(signers: GateSigners, a: SealedGateApproval): string | null {
+  const where = `${signers.signersPath} at base`;
+  if (!signers.active) {
+    const why = signers.problems.length > 0 ? `: ${signers.problems.join("; ")}` : "";
+    return `the gate is sealed, and there is no signers file (${signers.signersPath}) at base ${signers.base?.slice(0, 12) ?? ""}`.trim() + why;
+  }
+  const what = `the approval of gate ${a.gate} by ${a.resolvedBy}`;
+  if (a.seal === undefined || a.seal === null) return `${what} carries no seal`;
+  const seal = a.seal as { signer?: unknown; signature?: unknown };
+  if (typeof seal !== "object" || Array.isArray(seal) || typeof seal.signer !== "string" || typeof seal.signature !== "string") {
+    return `the seal on ${what} is malformed: it needs signer and signature`;
+  }
+  if (normalise(seal.signer) !== normalise(a.resolvedBy)) return `the seal on ${what} is by ${seal.signer}, and its approver is ${a.resolvedBy || "empty"}`;
+  const keys = signers.signers
+    .filter((s) => normalise(s.principal) === normalise(a.resolvedBy) && namespaceAllowed(s.namespaces, GATE_SEAL_NAMESPACE))
+    .map((s) => Buffer.from(s.key.split(" ")[1] ?? "", "base64"));
+  if (keys.length === 0) return `${a.resolvedBy} has no key in ${where}, so the seal can't count`;
+  const r = verifySshSignatureWith(seal.signature, gateSealPayload(a), GATE_SEAL_NAMESPACE, keys);
+  return r.ok ? null : `the seal does not verify for ${a.resolvedBy} against ${where}: ${r.reason}`;
+}

package/src/workspace/trust/policy.ts

@@ -24,172 +24,17 @@
 import { posix } from "node:path";
 import { z } from "zod";
 import type { RecordSource } from "../record-source";
+import { DEFAULT_SIGNERS_PATH, TRUST_CONFIG_PATH, parseAllowedSigners, type ExcludedSigner, type Signer } from "./trust-files";
 
-/** The trust config, relative to the repository root. Fixed: it is how the signers path is overridden. */
-export const TRUST_CONFIG_PATH = ".chant/trust.json";
-
-/** Where the signers are when `trust.json` names no other path. */
-export const DEFAULT_SIGNERS_PATH = ".chant/allowed_signers";
-
-// ── allowed_signers ──────────────────────────────────────────────────────────
-
-/** Key types ssh-keygen accepts in an allowed_signers line. */
-const KEY_TYPES = new Set([
-  "ssh-ed25519",
-  "ssh-rsa",
-  "ecdsa-sha2-nistp256",
-  "ecdsa-sha2-nistp384",
-  "ecdsa-sha2-nistp521",
-  "sk-ssh-ed25519@openssh.com",
-  "sk-ecdsa-sha2-nistp256@openssh.com",
-]);
-
-/** One usable signer: a principal and the public key it signs with. */
-export interface Signer {
-  principal: string;
-  /** `<type> <base64>`, with no comment. */
-  key: string;
-  /** The `namespaces="..."` option as written, or undefined when the key may sign any namespace. */
-  namespaces?: string;
-  /** 1-based line in the signers file. */
-  line: number;
-}
-
-/** A line of the signers file that is not used, and why. */
-export interface ExcludedSigner {
-  line: number;
-  reason: string;
-}
-
-export interface SignerSet {
-  signers: Signer[];
-  excluded: ExcludedSigner[];
-}
-
-/**
- * Split one line into fields. Double quotes group, so an option such as
- * `namespaces="git,file"` stays one field.
- */
-function fields(line: string): string[] {
-  const out: string[] = [];
-  let cur = "";
-  let quoted = false;
-  let any = false;
-  for (const ch of line) {
-    if (ch === '"') {
-      quoted = !quoted;
-      cur += ch;
-      any = true;
-    } else if (!quoted && (ch === " " || ch === "\t")) {
-      if (any) out.push(cur);
-      cur = "";
-      any = false;
-    } else {
-      cur += ch;
-      any = true;
-    }
-  }
-  if (any) out.push(cur);
-  return out;
-}
-
-/** `a="x,y",b` as `{ a: "x,y", b: "" }`. */
-function options(field: string): Map<string, string> {
-  const opts = new Map<string, string>();
-  let cur = "";
-  let quoted = false;
-  const flush = () => {
-    if (!cur) return;
-    const eq = cur.indexOf("=");
-    const name = (eq < 0 ? cur : cur.slice(0, eq)).toLowerCase();
-    const value = eq < 0 ? "" : cur.slice(eq + 1).replace(/^"|"$/g, "");
-    opts.set(name, value);
-    cur = "";
-  };
-  for (const ch of field) {
-    if (ch === '"') quoted = !quoted;
-    if (ch === "," && !quoted) flush();
-    else cur += ch;
-  }
-  flush();
-  return opts;
-}
-
-/**
- * Parse an allowed_signers file, keeping only lines whose meaning does not
- * depend on anything the signer controls.
- *
- * Refused, each with a reason, rather than passed to ssh-keygen:
- *
- * - `valid-after` and `valid-before`. git checks them against the commit's own
- *   date, which whoever makes the commit sets. A backdated commit would pass a
- *   window its key has left. Revocation is by position in history (#2553),
- *   never by date.
- * - `cert-authority`. A certificate's validity is also a date, and a CA key
- *   vouches for keys this file never names.
- * - Principal patterns (`*`, `?`, `!`). A signer is named by one exact
- *   principal, so role grants can name it.
- */
-export function parseAllowedSigners(text: string): SignerSet {
-  const signers: Signer[] = [];
-  const excluded: ExcludedSigner[] = [];
-  const lines = text.replace(/\r\n?/g, "\n").split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    const line = i + 1;
-    const raw = lines[i].trim();
-    if (!raw || raw.startsWith("#")) continue;
-    const f = fields(raw);
-    if (f.length < 3) {
-      excluded.push({ line, reason: "expected principals, optional options, a key type and a key" });
-      continue;
-    }
-    const [principals, second] = f;
-    const hasOptions = !KEY_TYPES.has(second);
-    const type = hasOptions ? f[2] : second;
-    const blob = hasOptions ? f[3] : f[2];
-    if (!KEY_TYPES.has(type) || !blob || !/^[A-Za-z0-9+/]+={0,2}$/.test(blob)) {
-      excluded.push({ line, reason: `no supported public key (${type ?? "none"})` });
-      continue;
-    }
-    const opts = hasOptions ? options(second) : new Map<string, string>();
-    const timed = ["valid-after", "valid-before"].filter((o) => opts.has(o));
-    if (timed.length > 0) {
-      excluded.push({
-        line,
-        reason: `${timed.join(" and ")} is checked against the commit's own date, which its author sets; revoke a key by removing it`,
-      });
-      continue;
-    }
-    if (opts.has("cert-authority")) {
-      excluded.push({ line, reason: "cert-authority keys are not supported: a certificate's validity is a date the signer controls" });
-      continue;
-    }
-    const unknown = [...opts.keys()].filter((o) => o !== "namespaces");
-    if (unknown.length > 0) {
-      excluded.push({ line, reason: `unknown option ${unknown.join(", ")}` });
-      continue;
-    }
-    const names = principals.replace(/^"|"$/g, "").split(",").filter(Boolean);
-    const pattern = names.find((p) => /[*?!]/.test(p));
-    if (pattern !== undefined || names.length === 0) {
-      excluded.push({ line, reason: `principal ${JSON.stringify(pattern ?? principals)} is a pattern; name one signer exactly` });
-      continue;
-    }
-    for (const principal of names) {
-      signers.push({ principal, key: `${type} ${blob}`, namespaces: opts.get("namespaces"), line });
-    }
-  }
-  return { signers, excluded };
-}
-
-/** The signers as an allowed_signers file ssh-keygen reads, holding only the usable lines. */
-export function renderAllowedSigners(signers: Signer[]): string {
-  return (
-    signers
-      .map((s) => `${JSON.stringify(s.principal)}${s.namespaces !== undefined ? ` namespaces=${JSON.stringify(s.namespaces)}` : ""} ${s.key}`)
-      .join("\n") + "\n"
-  );
-}
+export {
+  DEFAULT_SIGNERS_PATH,
+  TRUST_CONFIG_PATH,
+  parseAllowedSigners,
+  renderAllowedSigners,
+  type ExcludedSigner,
+  type Signer,
+  type SignerSet,
+} from "./trust-files";
 
 // ── trust.json ───────────────────────────────────────────────────────────────