@intentius/chant 0.124.11 → 0.124.13

package/dist/workspace/identity-gate-rule.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The `identity.gates` rule as data and one pure function (#3862).
+ *
+ * A gate the declaration names under `identity.gates` passes only on an
+ * approval sealed by a signer at base, from the class the gate names when it
+ * names one (#3163, ws-080). chant's `gateAdmissionFrom` (`./identity.ts`)
+ * builds a {@link GateAdmissionRule} from what `scopeSource` reads and judges
+ * every approval with {@link admitApprover}. `@intentius/chant/gate-decision`
+ * builds the same rule from a bare clone at a base commit
+ * (`identityGateAdmissionAt`) and judges with the same function, so a tool
+ * counts approvals as chant's wave gate does.
+ *
+ * The module imports node:crypto through `./trust/gate-seal.ts` and nothing
+ * else: no zod, no ajv, no package loading, so it bundles small.
+ */
+import { type SealedGateApproval } from "./trust/gate-seal.js";
+import type { Signer } from "./trust/trust-files.js";
+/** The core classes, in the order a principal's roles are tried; `human` holds no role and is the rest. */
+export declare const CORE_PRINCIPAL_CLASSES: readonly ["human", "agent", "runner", "service"];
+export type CorePrincipalClass = (typeof CORE_PRINCIPAL_CLASSES)[number];
+export interface PrincipalClass {
+    name: string;
+    /** One line saying who is in the class. */
+    description: string;
+    /** The role whose grant at base puts a principal in the class, or null for `human`, the rest. */
+    role: string | null;
+    /** `core`, or the pin (package name or path) that supplies the class. */
+    source: string;
+}
+export declare const CORE_CLASSES: readonly PrincipalClass[];
+/** A class as the rule reads it: its name, and the role whose grant puts a principal in it (null for `human`). */
+export type ClassGrant = Pick<PrincipalClass, "name" | "role">;
+/** What an `identity.gates` gate is judged by, all read at base. */
+export interface GateAdmissionRule {
+    gate: string;
+    /** The class the approver must be in, or null for any signer. */
+    class: string | null;
+    /** The signers file at base: its path, whether it exists, and its signers. */
+    signers: {
+        signersPath: string;
+        active: boolean;
+        signers: readonly Signer[];
+    };
+    /** The role grants at base (`.chant/trust.json` `roles`). */
+    roles: Readonly<Record<string, readonly string[]>>;
+    /** Every class the rule knows, core first, then domain classes in pin order. */
+    classes: readonly ClassGrant[];
+    /**
+     * Why a class the rule does not know is unknown, for the refusal. Default
+     * "no pinned package supplies", which is what chant says once it has read
+     * every pin.
+     */
+    unknownClass?: string;
+}
+/** Every class `principal`'s role grants put it in, in `classes` order: what `classesOf` in `./principal-classes.ts` answers. */
+export declare function grantedClasses(classes: readonly ClassGrant[], roles: Readonly<Record<string, readonly string[]>>, principal: string | null): string[];
+/**
+ * Why `a` does not count toward the gate, or null when it does. An approval
+ * counts only when its seal verifies for its approver against the signers at
+ * base and, when the rule names a class, the role grants at base put the
+ * approver in it (`human`: in no other class). A class the rule does not
+ * know lets nothing through.
+ */
+export declare function admitApprover(rule: GateAdmissionRule, a: SealedGateApproval): string | null;
+//# sourceMappingURL=identity-gate-rule.d.ts.map

package/dist/workspace/identity-gate-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-gate-rule.d.ts","sourceRoot":"","sources":["../../src/workspace/identity-gate-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAkF,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5I,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,2GAA2G;AAC3G,eAAO,MAAM,sBAAsB,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAKjD,CAAC;AAEF,kHAAkH;AAClH,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;AAE/D,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,8EAA8E;IAC9E,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IAC9E,6DAA6D;IAC7D,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,gFAAgF;IAChF,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAC/B;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,iIAAiI;AACjI,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAIrJ;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAa3F"}

package/dist/workspace/identity.d.ts

@@ -27,7 +27,7 @@
 import type { Declaration, SignedGate } from "./declaration.js";
 import { type ClassRegistry } from "./principal-classes.js";
 import type { TrustPolicy } from "./trust/policy.js";
-import { type SealedGateApproval } from "./trust/seal.js";
+import type { SealedGateApproval } from "./trust/gate-seal.js";
 /** The forges a forge identity can name. */
 export declare const FORGES: readonly ["github", "gitlab", "forgejo", "gitea"];
 export type Forge = (typeof FORGES)[number];
@@ -98,7 +98,9 @@ export interface GateRuleSource extends IdentitySource {
  * approval counts only when its seal verifies for its approver against the
  * signers at base and, when the rule names a class, the approver's role
  * grants at base put it in that class. A class no pinned package supplies
- * lets nothing through.
+ * lets nothing through. The judge is {@link admitApprover}, which
+ * `@intentius/chant/gate-decision` also judges with (#3862). The policy is
+ * the one at base, never a returned work's copy.
  */
 export declare function gateAdmissionFrom(source: GateRuleSource, gate: string): GateAdmission | null;
 /**

package/dist/workspace/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/workspace/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAgD,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGvG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGtE,4CAA4C;AAC5C,eAAO,MAAM,MAAM,YAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AACxE,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAK5C,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAO1E;AAED,8HAA8H;AAC9H,wBAAgB,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,CAExD;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;CAC7B;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAE,WAAW,GAAG,IAAW,GAAG,UAAU,CAQnH;AAED,uDAAuD;AACvD,eAAO,MAAM,cAAc,qCAAsE,CAAC;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAA4B;IACvD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,8GAA8G;AAC9G,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,IAAI,CAS7I;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAElD,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,sHAAsH;AACtH,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAmB5F;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAE5F"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/workspace/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,EAA4C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGnG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,4CAA4C;AAC5C,eAAO,MAAM,MAAM,YAAI,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAU,CAAC;AACxE,MAAM,MAAM,KAAK,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAK5C,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,CAAC;IACb,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAO1E;AAED,8HAA8H;AAC9H,wBAAgB,cAAc,CAAC,EAAE,EAAE,aAAa,GAAG,MAAM,CAExD;AAED,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAEhE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,YAAY,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;CAC7B;AAID;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAE,WAAW,GAAG,IAAW,GAAG,UAAU,CAQnH;AAED,uDAAuD;AACvD,eAAO,MAAM,cAAc,qCAAsE,CAAC;AAClG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAA4B;IACvD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,8GAA8G;AAC9G,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAAG,IAAI,CAS7I;AAED,+EAA+E;AAC/E,MAAM,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAElD,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,UAAU,CAAC;IACxB,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,sHAAsH;AACtH,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAM5F;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAE5F"}

package/dist/workspace/principal-classes.d.ts

@@ -24,26 +24,15 @@
 import { type KindLoadProblem, type PinLike } from "./kinds.js";
 import type { TrustPolicy } from "./trust/policy.js";
 import { type WorkspaceTree } from "./tree.js";
+import { type PrincipalClass } from "./identity-gate-rule.js";
 export declare const PRINCIPALS_SCHEMA_ID: string;
 /** The subpath a package publishes its principal classes at. */
 export declare const PRINCIPALS_SUBPATH = "./workspace-principals";
-/** The core classes, in the order a principal's roles are tried; `human` holds no role and is the rest. */
-export declare const CORE_PRINCIPAL_CLASSES: readonly ["human", "agent", "runner", "service"];
-export type CorePrincipalClass = (typeof CORE_PRINCIPAL_CLASSES)[number];
+export { CORE_CLASSES, CORE_PRINCIPAL_CLASSES, type CorePrincipalClass, type PrincipalClass } from "./identity-gate-rule.js";
 /** A class name: a core class, or a domain class a pinned package supplies. */
 export type PrincipalClassName = string;
 /** The grammar of a class name, as `workspace-principals.schema.json` and the declaration's writeScope keys say it. */
 export declare const CLASS_NAME: RegExp;
-export interface PrincipalClass {
-    name: string;
-    /** One line saying who is in the class. */
-    description: string;
-    /** The role whose grant at base puts a principal in the class, or null for `human`, the rest. */
-    role: string | null;
-    /** `core`, or the pin (package name or path) that supplies the class. */
-    source: string;
-}
-export declare const CORE_CLASSES: readonly PrincipalClass[];
 export interface ClassRegistry {
     get(name: string): PrincipalClass | undefined;
     /** Every class name, core first, for "unknown class" messages. */
@@ -63,7 +52,7 @@ export declare function roleGrants(policy: TrustPolicy): Record<string, string[]
 /**
  * Every class `principal`'s role grants at base put it in, in registry order
  * (core first). Empty for a principal in no class but `human`, and for null.
- * Names compare as {@link normalisePrincipal} folds them.
+ * Names compare as `normalisePrincipal` (`./records.ts`) folds them.
  */
 export declare function classesOf(classes: ClassRegistry, policy: TrustPolicy, principal: string | null): string[];
 /** The class write scope judges `principal` as: the first class its grants put it in, or `human`. */

package/dist/workspace/principal-classes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"principal-classes.d.ts","sourceRoot":"","sources":["../../src/workspace/principal-classes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAuC,KAAK,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEtD,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAE3D,2GAA2G;AAC3G,eAAO,MAAM,sBAAsB,YAAI,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,+EAA+E;AAC/E,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAExC,uHAAuH;AACvH,eAAO,MAAM,UAAU,QAAiC,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,iGAAiG;IACjG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,EAKjD,CAAC;AAIF,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,KAAK,IAAI,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,GAAG,IAAI,SAAS,cAAc,EAAE,CAAC;CAClC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,SAAS,cAAc,EAAO,GAAG,aAAa,CAQxF;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,IAAI,aAAa,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAExE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAQzG;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,aAAmC,GAAG,MAAM,CAElI;AAqBD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAsCtE;AAED,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEhE,mCAAmC;AACnC,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAQnD;AAED,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAUxE;AAED,wJAAwJ;AACxJ,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAiBjF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,aAAa,CAAA;CAAO,GAAG,aAAa,CA6CrI;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,EAAE,CAEhH"}
+{"version":3,"file":"principal-classes.d.ts","sourceRoot":"","sources":["../../src/workspace/principal-classes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAuC,KAAK,eAAe,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAElG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AACtD,OAAO,EAAwD,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEjH,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,KAAK,kBAAkB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE1H,+EAA+E;AAC/E,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAExC,uHAAuH;AACvH,eAAO,MAAM,UAAU,QAAiC,CAAC;AAIzD,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC9C,kEAAkE;IAClE,KAAK,IAAI,MAAM,EAAE,CAAC;IAClB,oFAAoF;IACpF,GAAG,IAAI,SAAS,cAAc,EAAE,CAAC;CAClC;AAED,wBAAgB,mBAAmB,CAAC,KAAK,GAAE,SAAS,cAAc,EAAO,GAAG,aAAa,CAQxF;AAED,+FAA+F;AAC/F,wBAAgB,iBAAiB,IAAI,aAAa,CAEjD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAExE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAEzG;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,GAAE,aAAmC,GAAG,MAAM,CAElI;AAqBD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAsCtE;AAED,gGAAgG;AAChG,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEhE,mCAAmC;AACnC,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAQnD;AAED,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CAUxE;AAED,wJAAwJ;AACxJ,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAiBjF;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,CAAC;IACxB,QAAQ,EAAE,eAAe,EAAE,CAAC;CAC7B;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,aAAa,CAAA;CAAO,GAAG,aAAa,CA6CrI;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,EAAE,CAEhH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.124.11",
+  "version": "0.124.13",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/lint.ts

@@ -32,6 +32,7 @@ import { applyConfiguredPreset, applyConfiguredSeverity, resolvePresetIds } from
 import { applyInlineSuppressions } from "../../lint/suppressions";
 import { getProvenance } from "../../provenance";
 import { runLexiconPostSynthChecks } from "./build";
+import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 
 // Import config loader
 import { loadConfig, resolveRulesForFile, resolveConfiguredSeverity, findProjectRoot } from "../../lint/config";
@@ -665,9 +666,15 @@ async function runOpCheckDiagnostics(
  * builds `infraPath`, the target the caller asked to lint, never the project
  * root above it, so `chant lint <dir>` costs a build of `<dir>` and nothing
  * more (the same scoping {@link runOpCheckDiagnostics} documents). It is
- * skipped outright when no loaded lexicon ships post-synth checks, which keeps
- * a project with no lexicon, and every core-only fixture, from building at
- * all.
+ * skipped outright when no loaded lexicon ships post-synth checks and the
+ * project declares no `lint.policies`, which keeps a project with no lexicon,
+ * and every core-only fixture, from building at all.
+ *
+ * The project's `lint.policies` run over the same build after the lexicons'
+ * checks (#3870), with every lexicon's output and the env, as `chant build`
+ * runs them, and sandboxed when the build is. `lint.rules` applies to their
+ * ids; a policy that does not load is reported under
+ * {@link BUILD_FAILURE_RULE_ID}.
  *
  * A target that does not build reports each build error under
  * {@link BUILD_FAILURE_RULE_ID} and skips the checks. Findings go through
@@ -686,10 +693,10 @@ async function runLexiconPostSynthDiagnostics(
   const diagnostics: LintDiagnostic[] = [];
   const suppressed: Array<LintDiagnostic & { reason?: string }> = [];
   const withChecks = plugins.filter((plugin) => (plugin.postSynthChecks?.() ?? []).length > 0);
-  if (withChecks.length === 0) return { diagnostics, suppressed };
-
   const projectRoot = findProjectRoot(infraPath);
   const lintConfig = loadConfig(projectRoot);
+  if (withChecks.length === 0 && (lintConfig.policies ?? []).length === 0) return { diagnostics, suppressed };
+
   // Where a finding that names no declared entity is reported: the config the
   // build loads once it is known (past a lint-only fragment), else the nearest.
   let fallbackFile = findProjectConfig(projectRoot).configPath ?? projectRoot;
@@ -707,6 +714,7 @@ async function runLexiconPostSynthDiagnostics(
   let telemetry: Awaited<ReturnType<typeof resolveTelemetryAttribution>>;
   let configDir = infraPath;
   let loadedConfig: Record<string, unknown> | undefined;
+  let policies: readonly string[] = [];
   try {
     const loaded = await loadChantConfigUpward(infraPath);
     const config = loaded.config;
@@ -720,6 +728,10 @@ async function runLexiconPostSynthDiagnostics(
     // fragment with no `buildParams` (a `src/chant.config.json`).
     const params = buildParams ?? resolveBuildParams(config.buildParams, { env: process.env }).provenance;
     env = resolveOwnershipEnv(config, params);
+    policies = config.lint?.policies ?? [];
+    // #3870: a sandboxed build sandboxes the policies too, as `chant build` arms it.
+    const modes = resolveBuildModes(config, { sandbox });
+    if (modes.sandbox && policies.length > 0) armSandboxPolicyExecution();
     telemetry = await resolveTelemetryAttribution(configDir, config as unknown as Record<string, unknown>, env);
     // Every lexicon the lint loaded, as `chant build` serializes with every
     // lexicon it loaded: a check may read another lexicon's entities, and the
@@ -732,7 +744,7 @@ async function runLexiconPostSynthDiagnostics(
         config,
         configDir,
         plugins,
-        modes: resolveBuildModes(config, { sandbox }),
+        modes,
         ownership: resolveOwnershipMarker(config, params),
         buildParams: params,
         telemetry,
@@ -781,6 +793,21 @@ async function runLexiconPostSynthDiagnostics(
     }
   }
 
+  // #3870: the project's `lint.policies`, over the same build, as `chant
+  // build` runs them: every lexicon's output at once, with the env, and
+  // `lint.rules` applied to their ids.
+  if (policies.length > 0) {
+    let raw: Awaited<ReturnType<typeof runProjectPolicies>>;
+    try {
+      raw = await runProjectPolicies({ policies, configDir, buildResult: result, env });
+    } catch (err) {
+      diagnostics.push(buildFailure(err instanceof Error ? err.message : String(err)));
+      return { diagnostics, suppressed };
+    }
+    const configured = applyConfiguredSeverity(raw, lintConfig.rules);
+    for (const d of configured.diagnostics) diagnostics.push(toLint(d));
+  }
+
   return { diagnostics, suppressed };
 }
 

package/src/gate-decision-bundle.test.ts

@@ -5,8 +5,8 @@
  * toolchain, and checked sealed approvals with its own copy of chant's seal
  * rule because `@intentius/chant/op/gate` pulls in zod and the git ledger
  * code. `@intentius/chant/gate-decision` holds the decision for a plan digest
- * under `ledger`, `pr-review` and `sealed`, and the seal check over
- * node:crypto. This bundles it the way terragucci would and reads esbuild's
+ * under `ledger`, `pr-review` and `sealed`, the seal check over
+ * node:crypto, and the `identity.gates` rule with its class check (#3862). This bundles it the way terragucci would and reads esbuild's
  * own list of what went in.
  */
 
@@ -46,6 +46,7 @@ describe("the gate-decision bundle", () => {
       "packages/core/src/notify.ts",
       "packages/core/src/op/gate-point.ts",
       "packages/core/src/op/op-waves.ts",
+      "packages/core/src/workspace/identity-gate-rule.ts",
       "packages/core/src/workspace/jsonc.ts",
       "packages/core/src/workspace/trust/gate-seal.ts",
       "packages/core/src/workspace/trust/trust-files.ts",

package/src/gate-decision-identity.test.ts

@@ -0,0 +1,176 @@
+/**
+ * #3862: `identityGateAdmissionAt` judges an `identity.gates` approval from a
+ * bare clone at a base commit as chant's `gateAdmission(cwd, gate, base)`
+ * does: the seal against the signers at base, and the class against the role
+ * grants at base. Each fixture is judged both ways and the answers compared,
+ * reasons included.
+ */
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "vitest";
+import {
+  admitApprover,
+  CORE_CLASSES,
+  decideGateApproval,
+  GATE_SEAL_NAMESPACE,
+  gateSealPayload,
+  identityGateAdmissionAt,
+  type GateResolutionRecord,
+} from "./gate-decision";
+import { gateAdmission } from "./workspace/identity";
+import { hasSshKeygen, TestRepo, type Key } from "./workspace/trust/test-repo";
+import { evaluateGate, memoryGateLedgerPort } from "./op/gate";
+
+const D1 = "sha256:" + "a".repeat(64);
+const GATES = { ship: {}, deploy: { class: "human" }, release: { class: "runner" }, ops: { class: "operator" } };
+const NAMES = [...Object.keys(GATES), "undeclared"];
+
+describe.skipIf(!hasSshKeygen)("identity.gates read at base, as chant reads it", () => {
+  const repos: TestRepo[] = [];
+  afterEach(() => {
+    while (repos.length) repos.pop()!.cleanup();
+  });
+  // Keys and seals are made once, by ssh-keygen, and shared by every fixture.
+  let signer: TestRepo;
+  let k: Record<"alice" | "bob" | "carol" | "mallory", Key>;
+  const sigs = new Map<string, string>();
+  beforeAll(() => {
+    signer = new TestRepo("3862-keys");
+    k = { alice: signer.key("alice"), bob: signer.key("bob"), carol: signer.key("carol"), mallory: signer.key("mallory") };
+  });
+  afterAll(() => signer.cleanup());
+  const sign = (key: Key, payload: Buffer): string => {
+    const id = `${key.name}\n${payload.toString("utf-8")}`;
+    if (!sigs.has(id)) sigs.set(id, signer.sshSign(key, payload, GATE_SEAL_NAMESPACE));
+    return sigs.get(id)!;
+  };
+
+  function setup(files: (k: Record<string, Key>) => Record<string, string>, declaration: Record<string, unknown> = {}) {
+    const r = new TestRepo("3862-identity");
+    repos.push(r);
+    r.write("chant.workspace.json", JSON.stringify({ name: "acme", schema: 1, members: [], identity: { gates: GATES }, ...declaration }));
+    for (const [path, text] of Object.entries(files(k))) r.write(path, text);
+    const base = r.commit("base");
+    // The change being applied lists mallory and makes alice a runner; neither counts at base.
+    r.write(".chant/allowed_signers", `alice ${k.alice.pub}\nbob ${k.bob.pub}\nmallory ${k.mallory.pub}\n`);
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1, roles: { runner: ["alice", "bob"] } }));
+    r.commit("widens the policy");
+    const approval = (gate: string, resolvedBy: string, extra: Partial<GateResolutionRecord> = {}): GateResolutionRecord => ({
+      version: 1, op: "web", gate, resolvedBy, timestamp: "2026-10-11T11:00:00.000Z", planDigest: D1, ...extra,
+    });
+    const seal = (a: GateResolutionRecord, key: Key, signer = a.resolvedBy): GateResolutionRecord => ({
+      ...a,
+      seal: { signer, key: "k", signature: sign(key, gateSealPayload(a)) },
+    });
+    const made = new Map<string, GateResolutionRecord[]>();
+    const approvals = (gate: string): GateResolutionRecord[] => made.get(gate) ?? (made.set(gate, approvalsOf(gate)), made.get(gate)!);
+    const approvalsOf = (gate: string): GateResolutionRecord[] => [
+      approval(gate, "alice"),
+      seal(approval(gate, "alice"), k.alice),
+      seal(approval(gate, "BOB "), k.bob, "bob"),
+      seal(approval(gate, "mallory"), k.mallory),
+      seal(approval(gate, "carol"), k.carol),
+      seal(approval(gate, "alice"), k.bob),
+      seal(approval(gate, "alice"), k.alice, "bob"),
+      { ...approval(gate, "alice"), seal: { signer: "alice" } as unknown as GateResolutionRecord["seal"] },
+      { ...seal(approval(gate, "alice"), k.alice), planDigest: "sha256:" + "b".repeat(64) },
+    ];
+    return { r, base, approvals };
+  }
+
+  /** Every approval of every gate, judged by both readers: the pairs, and the reasons gate-decision gave. */
+  function judgeBoth(r: TestRepo, base: string, approvals: (gate: string) => GateResolutionRecord[]) {
+    const ours: Record<string, (string | null)[] | null> = {};
+    for (const gate of NAMES) {
+      const here = identityGateAdmissionAt(r.dir, base, gate);
+      const chant = gateAdmission(r.dir, gate, base);
+      expect(here === null, gate).toBe(chant === null);
+      if (here === null || chant === null) {
+        ours[gate] = null;
+        continue;
+      }
+      expect(here.requirement).toEqual({ gate, class: chant.requirement.class });
+      const reasons = approvals(gate).map((a) => here.refuses(a));
+      expect(reasons, gate).toEqual(approvals(gate).map((a) => chant.refuses(a)));
+      ours[gate] = reasons;
+    }
+    return ours;
+  }
+
+  test("signers, role grants and classes at base, approval by approval", () => {
+    const { r, base, approvals } = setup((k) => ({
+      ".chant/allowed_signers": `alice ${k.alice.pub}\nbob ${k.bob.pub}\ncarol namespaces="git" ${k.carol.pub}\n`,
+      ".chant/trust.json": JSON.stringify({ schema: 1, roles: { runner: ["Bob"] } }),
+    }));
+    const ours = judgeBoth(r, base, approvals);
+    expect(ours.undeclared).toBeNull();
+    const passed = (gate: string) => ours[gate]!.flatMap((reason, i) => (reason === null ? [i] : []));
+    // Any signer: alice and bob, each with their own key. Not mallory (listed after base), not carol (no chant-gate namespace).
+    expect(passed("ship")).toEqual([1, 2]);
+    // human: alice; bob holds the runner role at base.
+    expect(passed("deploy")).toEqual([1]);
+    expect(ours.deploy![2]).toMatch(/^BOB  is not in the class human that gate deploy needs/);
+    // runner: bob, by the grant at base; alice's grant comes after base.
+    expect(passed("release")).toEqual([2]);
+    expect(ours.release![1]).toBe("alice is not in the class runner that gate release needs: no role grant at base puts them there");
+    // operator: no pinned package supplies it.
+    expect(passed("ops")).toEqual([]);
+    expect(ours.ops![1]).toMatch(/names the class operator, which no pinned package supplies, .*known classes: human, agent, runner, service/);
+    expect(ours.ship![0]).toBe("the approval by alice is not signed; gate ship needs chant approve --sign");
+    expect(ours.ship![3]).toBe("mallory has no key in .chant/allowed_signers at base, so the seal can't count");
+    expect(ours.ship![4]).toMatch(/^the seal does not verify for carol against \.chant\/allowed_signers at base/);
+  });
+
+  test("a signers path trust.json names", () => {
+    const named = setup((k) => ({
+      ".chant/trust.json": JSON.stringify({ schema: 1, signers: "ops/signers", roles: { runner: ["alice"] } }),
+      "ops/signers": `alice ${k.alice.pub}\n`,
+    }));
+    expect(judgeBoth(named.r, named.base, named.approvals).release![1]).toBeNull();
+  });
+
+  test("no signers file at base, and a trust.json chant refuses", () => {
+    const none = setup(() => ({ "README.md": "x\n" }));
+    expect(judgeBoth(none.r, none.base, none.approvals).ship![1]).toBe("gate ship needs a signed approval, and there is no signers file (.chant/allowed_signers) at base to check one against");
+
+    const invalid = setup((k) => ({
+      ".chant/trust.json": JSON.stringify({ schema: 1, roles: { Admin: ["alice"] } }),
+      ".chant/allowed_signers": `alice ${k.alice.pub}\n`,
+    }));
+    expect(judgeBoth(invalid.r, invalid.base, invalid.approvals).ship![1]).toMatch(/no signers file/);
+  });
+
+  test("a domain class the caller read from a pin, and a pin this reader does not load", () => {
+    const { r, base, approvals } = setup(
+      (k) => ({ ".chant/allowed_signers": `alice ${k.alice.pub}\n`, ".chant/trust.json": JSON.stringify({ schema: 1, roles: { operator: ["alice"] } }) }),
+      { pins: [{ package: "@acme/ops-classes", version: "1.0.0" }] },
+    );
+    const unread = identityGateAdmissionAt(r.dir, base, "ops")!;
+    expect(unread.refuses(approvals("ops")[1])).toMatch(/is not a core class, and this reader does not load the classes the pinned packages in chant\.workspace\.json at base supply/);
+    const read = identityGateAdmissionAt(r.dir, base, "ops", { classes: [{ name: "operator", role: "operator" }] })!;
+    expect(read.refuses(approvals("ops")[1])).toBeNull();
+    expect(read.refuses(approvals("ops")[0])).toMatch(/not signed/);
+  });
+
+  test("passed to decideGateApproval as refuses, it counts what chant's wave gate counts", async () => {
+    const { r, base, approvals } = setup((k) => ({
+      ".chant/allowed_signers": `alice ${k.alice.pub}\nbob ${k.bob.pub}\n`,
+      ".chant/trust.json": JSON.stringify({ schema: 1, roles: { runner: ["bob"] } }),
+    }));
+    const here = identityGateAdmissionAt(r.dir, base, "release")!;
+    const chant = gateAdmission(r.dir, "release", base)!;
+    for (const resolutions of [approvals("release").slice(0, 2), approvals("release")]) {
+      const decided = decideGateApproval({ ledger: { pending: [], resolutions }, gate: "release", planDigest: D1, refuses: here.refuses, now: "2026-10-11T12:00:00.000Z" });
+      const port = { ...memoryGateLedgerPort({ pending: [], resolutions }), approvalRule: async () => chant };
+      const check = await evaluateGate(port, { op: "web", gate: "release", planDigest: D1, now: "2026-10-11T12:00:00.000Z" });
+      expect(decided.status === "approved" && decided.via === "ledger" ? decided.resolution : null).toEqual(check.satisfied ? check.resolution : null);
+    }
+  });
+});
+
+describe("admitApprover", () => {
+  test("is the rule gateAdmission judges by: a class it does not know refuses before the seal is read", () => {
+    const rule = { gate: "ship", class: "operator", signers: { signersPath: ".chant/allowed_signers", active: false, signers: [] }, roles: {}, classes: CORE_CLASSES };
+    expect(admitApprover(rule, { op: "web", gate: "ship", resolvedBy: "alice", timestamp: "t" })).toMatch(/no pinned package supplies/);
+    expect(admitApprover({ ...rule, class: null }, { op: "web", gate: "ship", resolvedBy: "alice", timestamp: "t" })).toMatch(/no signers file/);
+  });
+});

package/src/gate-decision.ts

@@ -16,6 +16,12 @@
  *   approving review, when its head planned this digest
  *   ({@link reviewApproval}).
  *
+ * A gate the declaration at base names under `identity.gates` counts only a
+ * sealed approval from its class: {@link identityGateAdmissionAt} reads that
+ * rule from a bare clone at base and judges by `admitApprover`, the function
+ * chant's `gateAdmission` judges by (#3862); pass its `refuses` to
+ * {@link decideGateApproval}.
+ *
  * With `spend` (#3784), an approval a wave already applied under is spent and
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
@@ -36,7 +42,7 @@ import {
 } from "./lifecycle/gate-ledger-select";
 import { samePlanDigest } from "./lifecycle/plan-digest";
 import { isApprovalSpent, type AppliedGateRecord } from "./lifecycle/gate-applied";
-import { gateSealRefusal, type GateSigners } from "./workspace/trust/gate-seal";
+import { gateSealRefusal, type GateSigners, type SealedGateApproval } from "./workspace/trust/gate-seal";
 import {
   DEFAULT_SIGNERS_PATH,
   TRUST_CONFIG_PATH,
@@ -44,6 +50,7 @@ import {
   trustConfigProblems,
 } from "./workspace/trust/trust-files";
 import { parseJsonText } from "./workspace/jsonc";
+import { CORE_CLASSES, admitApprover, type ClassGrant, type GateAdmissionRule } from "./workspace/identity-gate-rule";
 import type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger";
 import type { MergedReview } from "./op/gate-review";
 import type { GateApprovalSource } from "./op/op-waves";
@@ -75,6 +82,14 @@ export {
   type SignerSet,
 } from "./workspace/trust/trust-files";
 export type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger";
+export {
+  CORE_CLASSES,
+  admitApprover,
+  grantedClasses,
+  type ClassGrant,
+  type GateAdmissionRule,
+  type PrincipalClass,
+} from "./workspace/identity-gate-rule";
 export {
   appliedGateApplies,
   appliedGatePath,
@@ -117,17 +132,12 @@ export function baseCommit(repo: string): string {
   return parent;
 }
 
-/**
- * The signers at `base`: the file `.chant/trust.json` names there, else
- * `.chant/allowed_signers`, read as chant's trust policy reads it. A
- * trust.json that is not valid (`trustConfigProblems`) turns attestation
- * off, as it does in chant, so a sealed gate passes nothing. `base` is a
- * commit the repository holds, such as {@link baseCommit}'s answer.
- */
-export function gateSignersAt(repo: string, base: string): GateSigners {
-  const off = (problems: string[]): GateSigners => ({ base, signersPath: DEFAULT_SIGNERS_PATH, active: false, signers: [], problems });
+/** The signers and role grants at `base`, as chant's trust policy reads them. */
+function trustAt(repo: string, base: string): { signers: GateSigners; roles: Record<string, string[]> } {
+  const off = (problems: string[]) => ({ signers: { base, signersPath: DEFAULT_SIGNERS_PATH, active: false, signers: [], problems }, roles: {} });
   const configText = showAt(repo, base, TRUST_CONFIG_PATH);
   let signersPath = DEFAULT_SIGNERS_PATH;
+  let roles: Record<string, string[]> = {};
   if (configText !== undefined) {
     let raw: unknown;
     try {
@@ -138,9 +148,21 @@ export function gateSignersAt(repo: string, base: string): GateSigners {
     const problems = trustConfigProblems(raw);
     if (problems.length > 0) return off([`${TRUST_CONFIG_PATH} is invalid: ${problems.join("; ")}`]);
     signersPath = (raw as { signers?: string }).signers ?? DEFAULT_SIGNERS_PATH;
+    roles = (raw as { roles?: Record<string, string[]> }).roles ?? {};
   }
   const text = showAt(repo, base, signersPath);
-  return { base, signersPath, active: text !== undefined, signers: text === undefined ? [] : parseAllowedSigners(text).signers, problems: [] };
+  return { signers: { base, signersPath, active: text !== undefined, signers: text === undefined ? [] : parseAllowedSigners(text).signers, problems: [] }, roles };
+}
+
+/**
+ * The signers at `base`: the file `.chant/trust.json` names there, else
+ * `.chant/allowed_signers`, read as chant's trust policy reads it. A
+ * trust.json that is not valid (`trustConfigProblems`) turns attestation
+ * off, as it does in chant, so a sealed gate passes nothing. `base` is a
+ * commit the repository holds, such as {@link baseCommit}'s answer.
+ */
+export function gateSignersAt(repo: string, base: string): GateSigners {
+  return trustAt(repo, base).signers;
 }
 
 /** A gate the declaration at base names under `identity.gates`, and the principal class its signer must be in, if any. */
@@ -149,23 +171,79 @@ export interface IdentityGate {
   class: string | null;
 }
 
-/**
- * The gates `chant.workspace.json` (or `.jsonc`) at `base` names under
- * `identity.gates`: each counts only a sealed approval, from its class when
- * it names one. chant checks the class against the role grants at base; this
- * reads the names. Empty when there is no declaration at base. Throws when
- * the declaration there cannot be parsed, since the gate cannot be decided.
- */
-export function identityGatesAt(repo: string, base: string): IdentityGate[] {
+/** The declaration at `base`, parsed, or null when there is none. Throws when it cannot be parsed. */
+function declarationAt(repo: string, base: string): { file: string; value: unknown } | null {
   for (const file of ["chant.workspace.json", "chant.workspace.jsonc"]) {
     const text = showAt(repo, base, file);
     if (text === undefined) continue;
     const parsed = parseJsonText(text, { jsonc: file.endsWith(".jsonc") });
     if (!parsed.ok) throw new Error(`${file} at base is not valid JSON (${parsed.message}), so the gate cannot be decided`);
-    const gates = (parsed.value as { identity?: { gates?: Record<string, { class?: unknown } | null> } } | null)?.identity?.gates ?? {};
-    return Object.entries(gates).map(([gate, entry]) => ({ gate, class: typeof entry?.class === "string" ? entry.class : null }));
+    return { file, value: parsed.value };
   }
-  return [];
+  return null;
+}
+
+function identityGatesOf(declaration: unknown): IdentityGate[] {
+  const gates = (declaration as { identity?: { gates?: Record<string, { class?: unknown } | null> } } | null)?.identity?.gates ?? {};
+  return Object.entries(gates).map(([gate, entry]) => ({ gate, class: typeof entry?.class === "string" ? entry.class : null }));
+}
+
+/**
+ * The gates `chant.workspace.json` (or `.jsonc`) at `base` names under
+ * `identity.gates`: each counts only a sealed approval, from its class when
+ * it names one. {@link identityGateAdmissionAt} judges an approval by one.
+ * Empty when there is no declaration at base. Throws when the declaration
+ * there cannot be parsed, since the gate cannot be decided.
+ */
+export function identityGatesAt(repo: string, base: string): IdentityGate[] {
+  const declaration = declarationAt(repo, base);
+  return declaration === null ? [] : identityGatesOf(declaration.value);
+}
+
+/** An `identity.gates` gate at base, and the judge for its approvals. */
+export interface IdentityGateAdmission {
+  requirement: IdentityGate;
+  /** Why `approval` does not count toward the gate, or null when it does. Pass it to {@link decideGateApproval} as `refuses`. */
+  refuses(approval: SealedGateApproval): string | null;
+}
+
+/**
+ * The `identity.gates` rule for `gate` at `base`, or null when the
+ * declaration there names none: what chant's `gateAdmission(cwd, gate, base)`
+ * answers, read from a bare clone. An approval counts when its seal verifies
+ * for its approver against the signers at base and, when the gate names a
+ * class, the role grants in `.chant/trust.json` at base put the approver in
+ * it. Both judge with the same function ({@link admitApprover}).
+ *
+ * The classes are the four core ones, then `classes`, the domain classes the
+ * caller read from the pinned packages (`./workspace-principals`), in pin
+ * order. This reader loads no package. A gate whose class is in neither
+ * refuses every approval, and when the declaration at base pins anything the
+ * reason says the pins were not read, since one of them may supply it.
+ * Throws when the declaration at base cannot be parsed.
+ */
+export function identityGateAdmissionAt(
+  repo: string,
+  base: string,
+  gate: string,
+  opts: { classes?: readonly ClassGrant[] } = {},
+): IdentityGateAdmission | null {
+  const declaration = declarationAt(repo, base);
+  const requirement = declaration === null ? undefined : identityGatesOf(declaration.value).find((g) => g.gate === gate);
+  if (!requirement) return null;
+  const { signers, roles } = trustAt(repo, base);
+  const pins = (declaration!.value as { pins?: unknown }).pins;
+  const rule: GateAdmissionRule = {
+    gate,
+    class: requirement.class,
+    signers,
+    roles,
+    classes: [...CORE_CLASSES, ...(opts.classes ?? [])],
+    ...(Array.isArray(pins) && pins.length > 0
+      ? { unknownClass: `is not a core class, and this reader does not load the classes the pinned packages in ${declaration!.file} at base supply` }
+      : {}),
+  };
+  return { requirement, refuses: (a) => admitApprover(rule, a) };
 }
 
 // ── pr-review ────────────────────────────────────────────────────────────