@intentius/chant 0.124.1 → 0.124.3

package/src/workspace/decide.ts

@@ -93,6 +93,7 @@ import { IdentityError, refuseUnidentified } from "./identity";
 import { scopeSource } from "./write-scope";
 import { RefCASConflictError } from "../lifecycle/git";
 import { readLedgerAnswers, refreshLedger, withLedgerAnswers, writeLedgerAnswer, type LedgerAnswers } from "./answers-ledger";
+import { currentGateOrigin, isModelAuthored, type GateOrigin } from "../lifecycle/gate-origin";
 
 /** The version of the write documents `points ask`, `points answer` and `points retract` print. */
 export const POINTS_WRITE_CONTRACT_VERSION = 1;
@@ -122,6 +123,8 @@ export const POINTS_WRITE_ERROR_CODES = [
   "record-id-taken",
   /** The answer was given during a steward's turn (#2749): a steward never answers a question, its own or another's. */
   "answer-in-steward-turn",
+  /** The answer or retraction came over MCP or ACP, and the question constrains a gate that is never resolved there (#3817). */
+  "answer-never-over-mcp",
   /** An answerer is named by a bare name, and identity.attribution at base is identified (#3163). */
   "principal-unidentified",
   /** `points retract` names a question that has no answer: escalated or proposed (#3351). */
@@ -442,7 +445,9 @@ export interface AskPointOptions {
    * or the lifecycle ledger (#2786). Defaults to the ledger in a steward's
    * turn (`steward` given, or this process a steward's turn), since a steward
    * never writes the checkout, and to the tree otherwise. A question already
-   * held on the ledger is rewritten there whatever this says.
+   * held on the ledger is rewritten there whatever this says. Outside a
+   * steward's turn, `points ask --store ledger` and a gate's `point.store`
+   * reach it (#3815), for a checkout that does not outlive the run.
    */
   store?: "tree" | "ledger";
   /** The date written as asked_on, and answered_on for a table's answer, YYYY-MM-DD. Defaults to today, in UTC. */
@@ -715,6 +720,13 @@ export interface AnswerPointOptions {
   kind?: string;
   on?: string;
   dryRun?: boolean;
+  /**
+   * The channel the answer came through (#3817). Defaults to this process's
+   * (`currentGateOrigin`). Over MCP or ACP nobody `by` names counts toward
+   * the quorum, and a question that constrains a `neverOverMcp` gate is
+   * refused outright.
+   */
+  origin?: GateOrigin;
 }
 
 /**
@@ -813,7 +825,10 @@ async function findQuestion(cwd: string, kind: string | undefined, id: string):
   if (kinds.length === 0) throw new PointsWriteError("points-undeclared", "no record kind with an answers block is declared: name one with --kind, or declare one in chant.workspace.json");
   for (const k of kinds) {
     const opened = await openAnswers(k, cwd);
-    // A question a steward asked is on the ledger (#2786), and people's answer goes back there.
+    // A question a steward asked is on the ledger (#2786), and people's answer goes back there. So is
+    // one a CI job asked with --store ledger (#3815), from a checkout that is gone: fetch the
+    // branch first, so a clone that never ran the job finds the question.
+    await refreshLedger(opened.o.loaded.file);
     const read = await readWithLedger(opened.o);
     const target = read.before.find((e) => e.id === id);
     if (target && target.data !== null) return { opened, before: read.before, read, target: target as FoundQuestion["target"] };
@@ -821,20 +836,83 @@ async function findQuestion(cwd: string, kind: string | undefined, id: string):
   throw new PointsWriteError("record-not-found", `no answer record has id ${id}`);
 }
 
-/** Count `by` toward the point's quorum, or refuse with `quorum-not-met`. */
-function meetQuorum(name: string, by: string[], quorum: { count: number; roles?: string[] }, root: string, steward: string | undefined, verb: "answer" | "retract"): { counted: string[] } {
-  const tally = tallyQuorum(by, quorum, policyFor(root), steward);
+/** A model-authored channel's name, as a person reads it. */
+const channelName = (origin: GateOrigin): string => (origin === "acp" ? "ACP" : "MCP");
+
+/**
+ * Count `by` toward the point's quorum, or refuse with `quorum-not-met`.
+ *
+ * Over MCP or ACP (#3817) the names are the model's to choose, as a gate's
+ * approver is (`lifecycle/gate-origin.ts`), so the answer is an agent's and
+ * nobody it names counts: a person answers at a shell or through hud.
+ */
+function meetQuorum(name: string, by: string[], quorum: { count: number; roles?: string[] }, root: string, steward: string | undefined, verb: "answer" | "retract", origin: GateOrigin): { counted: string[] } {
+  const overModel = isModelAuthored(origin);
+  const tally = overModel
+    ? { counted: [] as string[], left: by.map((n) => ({ name: n, why: `was named over ${channelName(origin)}, where an answer is an agent's` })), met: false }
+    : tallyQuorum(by, quorum, policyFor(root), steward);
   if (!tally.met) {
     const got = tally.counted.length;
     const left = tally.left.length ? `; not counted: ${tally.left.map((l) => `${l.name}, who ${l.why}`).join("; ")}` : "";
+    const remedy = overModel ? `: a person ${verb === "answer" ? "answers" : "retracts it"} at a shell with \`chant workspace points ${verb}\`, or through hud` : "";
     throw new PointsWriteError(
       "quorum-not-met",
-      `${name} needs ${quorum.count} ${quorum.count === 1 ? "person" : "people"}${quorum.roles ? ` holding ${quorum.roles.join(" or ")}` : ""} to ${verb === "answer" ? "answer" : "retract an answer"}, and ${got} ${got === 1 ? "counts" : "count"}${got ? ` (${tally.counted.join(", ")})` : ""}${left}`,
+      `${name} needs ${quorum.count} ${quorum.count === 1 ? "person" : "people"}${quorum.roles ? ` holding ${quorum.roles.join(" or ")}` : ""} to ${verb === "answer" ? "answer" : "retract an answer"}, and ${got} ${got === 1 ? "counts" : "count"}${got ? ` (${tally.counted.join(", ")})` : ""}${left}${remedy}`,
     );
   }
   return tally;
 }
 
+/** The gates a question's `constrains` names, as `gate:<op>/<gate>` with an optional `@<env>` (`op/gate-point.ts`'s `gateSubject`). */
+function constrainedGates(d: Record<string, unknown>): { op: string; gate: string }[] {
+  const out: { op: string; gate: string }[] = [];
+  for (const c of Array.isArray(d.constrains) ? d.constrains : []) {
+    if (typeof c !== "string" || !c.startsWith("gate:")) continue;
+    const rest = c.slice("gate:".length);
+    const at = rest.lastIndexOf("@");
+    const named = at > 0 ? rest.slice(0, at) : rest;
+    const slash = named.indexOf("/");
+    if (slash > 0 && slash < named.length - 1) out.push({ op: named.slice(0, slash), gate: named.slice(slash + 1) });
+  }
+  return out;
+}
+
+/**
+ * Refuse an answer or retraction over MCP or ACP to a question that
+ * constrains a gate never resolved there (#3817, #3485): the gate-only op
+ * names chant knows, a pending fact on the gate ledger that says so (as
+ * terragucci's records do), or the Op's own `neverOverMcp`. `op-approve`
+ * refuses the same gates.
+ */
+async function refuseNeverOverMcp(id: string, d: Record<string, unknown>, root: string, origin: GateOrigin, does: "answers" | "retracts"): Promise<void> {
+  if (!isModelAuthored(origin)) return;
+  const gates = constrainedGates(d);
+  if (gates.length === 0) return;
+  const { isNeverOverMcpGateOp } = await import("../op/gate-name");
+  const { readGateLedger } = await import("../lifecycle/gate-ledger");
+  let configs: Map<string, { config: { neverOverMcp?: boolean } }> | undefined;
+  for (const { op, gate } of gates) {
+    let never = isNeverOverMcpGateOp(op);
+    if (!never) {
+      const { pending } = await readGateLedger(op, { cwd: root }).catch(() => ({ pending: [] as { gate: string; neverOverMcp?: true }[] }));
+      never = pending.some((p) => p.gate === gate && p.neverOverMcp === true);
+    }
+    if (!never) {
+      if (configs === undefined) {
+        const { discoverOps } = await import("../op/discover");
+        configs = await discoverOps({ cwd: root }).then((r) => r.ops as Map<string, { config: { neverOverMcp?: boolean } }>).catch(() => new Map());
+      }
+      never = Boolean(configs.get(op)?.config.neverOverMcp);
+    }
+    if (never) {
+      throw new PointsWriteError(
+        "answer-never-over-mcp",
+        `${id} constrains gate "${gate}" on "${op}", which is never resolved over ${channelName(origin)}, so its question is not ${does === "answers" ? "answered" : "retracted"} there either: a person ${does === "answers" ? "answers" : "retracts the answer to"} it at a shell with \`chant workspace points ${does === "answers" ? "answer" : "retract"} ${id}\`, or through hud`,
+      );
+    }
+  }
+}
+
 /**
  * People answer an open question: `points answer`. A proposed question the
  * people answer as the model did is confirmed, and keeps the model as its
@@ -884,8 +962,10 @@ async function answerPointLocked(opts: AnswerPointOptions): Promise<PointsWriteD
     if (value === undefined || !allowed.includes(value)) {
       throw new PointsWriteError("answer-not-candidate", `${opts.id} takes one of ${allowed.map((c) => JSON.stringify(c)).join(", ")}, not ${JSON.stringify(opts.answer)}`);
     }
+    const origin = opts.origin ?? currentGateOrigin();
+    await refuseNeverOverMcp(opts.id, d, o.root, origin, "answers");
     const quorum = quorumOf(point);
-    const tally = meetQuorum(name, opts.by, quorum, o.root, askedByOf(d)?.steward, "answer");
+    const tally = meetQuorum(name, opts.by, quorum, o.root, askedByOf(d)?.steward, "answer", origin);
     const on = opts.on ?? today();
     const decider = d.decider as Record<string, unknown>;
     const confirmed = target.state === "proposed" && decider.kind === "model" && d.answer === value;
@@ -960,6 +1040,8 @@ export interface RetractAnswerOptions {
   kind?: string;
   on?: string;
   dryRun?: boolean;
+  /** The channel the retraction came through, counted as for an answer (#3817). */
+  origin?: GateOrigin;
 }
 
 /**
@@ -998,8 +1080,10 @@ async function retractAnswerLocked(opts: RetractAnswerOptions): Promise<PointsWr
     const name = String(d.point);
     const point = pointOf(opened.points, name);
     if (!point) throw new PointsWriteError("point-unknown", `${opts.id} answers ${name}, which ${opened.pointsFile} no longer declares, so no quorum can take the answer back: ask the point as it is declared now`);
+    const origin = opts.origin ?? currentGateOrigin();
+    await refuseNeverOverMcp(opts.id, d, o.root, origin, "retracts");
     const quorum = quorumOf(point);
-    const tally = meetQuorum(name, opts.by, quorum, o.root, askedByOf(d)?.steward, "retract");
+    const tally = meetQuorum(name, opts.by, quorum, o.root, askedByOf(d)?.steward, "retract", origin);
     const on = opts.on ?? today();
     const type = String(d.question_type);
     const decider = d.decider !== null && typeof d.decider === "object" && !Array.isArray(d.decider) ? (d.decider as Record<string, unknown>) : { kind: "quorum" };

package/src/workspace/points-cli.ts

@@ -304,7 +304,7 @@ export async function runWorkspacePoints(ctx: CommandContext): Promise<number> {
       if (!("value" in response)) return print(response);
       ask = responseAsk(response.value);
     }
-    return print(await askPoint({ cwd, point, inputs: inputs.value, candidates: given, subject: args.subject, kind: args.kind, ask, dryRun: args.dryRun }));
+    return print(await askPoint({ cwd, point, inputs: inputs.value, candidates: given, subject: args.subject, kind: args.kind, ask, ...(args.store ? { store: args.store } : {}), dryRun: args.dryRun }));
   }
   if (verb === "answer") {
     const id = args.extraPositional2;

package/src/workspace/points-write.schema.json

@@ -626,6 +626,7 @@
                 "answer-not-candidate",
                 "quorum-not-met",
                 "answer-in-steward-turn",
+                "answer-never-over-mcp",
                 "principal-unidentified",
                 "answer-not-answered",
                 "answer-field-unsupported",

package/src/workspace/reason-codes.ts

@@ -157,8 +157,9 @@ export const REASONS = {
   "point-inputs-invalid": "The inputs given to an ask are not a JSON object of the point's declared inputs.",
   "point-decider-failed": "A model decider that fails closed (unreachable: fail) could not answer, so the ask wrote nothing.",
   "answer-not-candidate": "The people's answer is not one of the question's candidates.",
-  "quorum-not-met": "Too few of the people who answered count toward the point's quorum: distinct, not holding the agent role, not the steward that asked, and holding one of its roles when it names any.",
+  "quorum-not-met": "Too few of the people who answered count toward the point's quorum: distinct, not holding the agent role, not the steward that asked, and holding one of its roles when it names any. Nobody named over MCP or ACP counts (#3817).",
   "answer-in-steward-turn": "The answer was given during a steward's turn, or by a process it started: a steward never answers a decision point, and a person answers it through hud or at a shell.",
+  "answer-never-over-mcp": "The answer or retraction came over MCP or ACP, or from a process a session on one started, and the question constrains a gate that is never resolved there: a person answers it at a shell or through hud (#3817).",
   "answer-not-answered": "points retract names a question that has no answer to retract: it is escalated or proposed, and people answer it instead (#3351).",
   "answer-field-unsupported": "The answer kind's copy of point-answer.schema.json predates a field the write needs, a note, a relay, a retraction or an ad-hoc question's asked: copy the schema anew to turn it on (#3351, #3402, #3403).",
   "point-candidates-invalid": "points ask names an ad-hoc point without --candidates, a declared point with them, or candidates that are not a question and criteria of the point's question type (#3403).",