@intentius/chant 0.124.13 → 0.124.15

package/dist/workspace/checks/links.js

@@ -0,0 +1,191 @@
+/**
+ * The member-link checks, WSP091 to WSP097 (#2539; #2524 D6, ws-008).
+ *
+ * `chant workspace check` resolves every declared link in source: the
+ * producer's outputs come from its kind, and a `chant` producer's are read
+ * from its TypeScript without running it (`../member-handles.ts`). Nothing
+ * here reaches the network or starts a process. The rows themselves come
+ * from `../links.ts`, which `chant workspace graph` shares.
+ *
+ * | Id | Fails when |
+ * |---|---|
+ * | WSP091 | a link names no member, an example group, or its own member (fixed) |
+ * | WSP092 | a link's kind is not a link kind chant knows (fixed) |
+ * | WSP093 | the producer exposes no output of that name, as when it was renamed |
+ * | WSP094 | the producer's outputs can't be read in source, so the link is kept unresolved |
+ * | WSP095 | an inferred join is ambiguous: a parameter matches two or more outputs |
+ * | WSP096 | a consumer states the same link twice |
+ * | WSP097 | an entry lists `outputs` for a kind that doesn't take them from the entry |
+ * | WSP098 | a link states a `protocol` and its kind is not `telemetry` (#2558) |
+ */
+import { sourceMemberHandles } from "../member-handles.js";
+import { DEFAULT_LINK_KIND, LINK_KINDS, TELEMETRY_LINK_KIND, linkTargetProblem, resolveLinks } from "../links.js";
+const tables = new WeakMap();
+/** The link rows for a check run, resolved once and shared by every link check. */
+export function linkTable(ctx) {
+    let rows = tables.get(ctx);
+    if (!rows) {
+        rows = resolveLinks(ctx.declaration, sourceMemberHandles(ctx.declaration, ctx.tree, ctx.groups, ctx.kinds));
+        tables.set(ctx, rows);
+    }
+    return rows;
+}
+const declaredRows = (ctx) => linkTable(ctx).filter((r) => r.status !== "ambiguous" && r.origin === "declared");
+function linkFinding(check, row, field, message) {
+    return { checkId: check.id, severity: check.severity, message, entity: row.consumer, pointer: `${row.pointer}/${field}` };
+}
+const describeLink = (row) => `${row.consumer}'s link to ${row.producer} output ${row.output}`;
+export const LINK_CHECKS = [
+    {
+        id: "WSP091",
+        name: "link-target-unknown",
+        description: "Every member link names another member of the workspace. A link to an unknown name, an example group or the consumer itself fails closed.",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            return ctx.declaration.members.flatMap((m) => m.links.flatMap((l) => {
+                const problem = linkTargetProblem(ctx.declaration, m, l);
+                return problem ? [{ checkId: this.id, severity: this.severity, message: problem, entity: m.name, pointer: `${l.pointer}/member` }] : [];
+            }));
+        },
+    },
+    {
+        id: "WSP092",
+        name: "link-kind-unknown",
+        description: `Every member link's kind is one chant knows. Unknown link kinds fail closed; ${DEFAULT_LINK_KIND} is the default, and ${LINK_KINDS.filter((k) => k !== DEFAULT_LINK_KIND).join(", ")} is the other.`,
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            return ctx.declaration.members.flatMap((m) => m.links
+                .filter((l) => l.kind !== null && !LINK_KINDS.includes(l.kind))
+                .map((l) => ({
+                checkId: this.id,
+                severity: this.severity,
+                message: `member ${m.name}'s link to ${l.member} has kind ${l.kind}, which is not a link kind chant knows; known link kinds: ${LINK_KINDS.join(", ")}`,
+                entity: m.name,
+                pointer: `${l.pointer}/kind`,
+            })));
+        },
+    },
+    {
+        id: "WSP093",
+        name: "link-output-missing",
+        description: "Every member link names an output its producer exposes, matched exactly. A producer that renames an output fails this for every consumer that links to the old name.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            return declaredRows(ctx)
+                .filter((r) => r.status === "missing")
+                .map((r) => linkFinding(this, r, "output", `${describeLink(r)} does not resolve: ${r.reason}`));
+        },
+    },
+    {
+        id: "WSP094",
+        name: "link-unresolved",
+        description: "A member link whose producer's outputs can't be read in source is kept, unresolved, and reported.",
+        severity: "info",
+        configurable: true,
+        check(ctx) {
+            return declaredRows(ctx)
+                .filter((r) => r.status === "unresolved")
+                .map((r) => linkFinding(this, r, "output", `${describeLink(r)} is kept unresolved: ${r.reason}`));
+        },
+    },
+    {
+        id: "WSP095",
+        name: "join-ambiguous",
+        description: "No inferred join is ambiguous: a parameter that matches outputs of two producers (or two outputs of one) needs a declared link saying which.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const byName = new Map(ctx.declaration.members.map((m) => [m.name, m]));
+            return linkTable(ctx)
+                .filter((r) => r.status === "ambiguous")
+                .map((r) => {
+                const choices = r.candidates.map((c) => `${c.producer} output ${c.output} (${c.label})`).join(", ");
+                const first = r.candidates[0];
+                return {
+                    checkId: this.id,
+                    severity: this.severity,
+                    message: `${r.reason}: ${choices}. Declare the one it reads, such as { "member": "${first.producer}", "output": "${first.output}" } in ${r.consumer}'s links`,
+                    entity: r.consumer,
+                    pointer: byName.get(r.consumer).pointer,
+                };
+            });
+        },
+    },
+    {
+        id: "WSP096",
+        name: "link-duplicate",
+        description: "A link is stated once: no consumer lists the same member and output twice.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const out = [];
+            for (const m of ctx.declaration.members) {
+                const seen = new Map();
+                for (const l of m.links) {
+                    const key = `${l.member}\0${l.output}\0${l.kind ?? DEFAULT_LINK_KIND}`;
+                    const first = seen.get(key);
+                    if (first) {
+                        out.push({
+                            checkId: this.id,
+                            severity: this.severity,
+                            message: `member ${m.name} links to ${l.member} output ${l.output} twice; the first is at ${first}`,
+                            entity: m.name,
+                            pointer: l.pointer,
+                        });
+                    }
+                    else {
+                        seen.set(key, l.pointer);
+                    }
+                }
+            }
+            return out;
+        },
+    },
+    {
+        id: "WSP097",
+        name: "outputs-not-listable",
+        description: "An entry lists outputs only when its kind takes them from the entry: other, or a kind from a package. A chant member's outputs are read from its source, and a nested workspace exposes none.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            return ctx.declaration.members
+                .filter((m) => m.outputs !== null)
+                .flatMap((m) => {
+                const kind = ctx.kinds.get(m.kind);
+                if (!kind || kind.outputs.from === "declared")
+                    return [];
+                const why = kind.outputs.from === "chant-source" ? "reads a member's outputs from its source" : "exposes no outputs";
+                return [
+                    {
+                        checkId: this.id,
+                        severity: this.severity,
+                        message: `member ${m.name} lists outputs, and kind ${m.kind} ${why}; remove the list`,
+                        entity: m.name,
+                        pointer: `${m.pointer}/outputs`,
+                    },
+                ];
+            });
+        },
+    },
+    {
+        id: "WSP098",
+        name: "link-protocol-misplaced",
+        description: "A link states a protocol only when it is a telemetry link: protocol is the OTLP protocol the consumer sends to the producer's collector, and no other link kind has one.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            return ctx.declaration.members.flatMap((m) => m.links
+                .filter((l) => l.protocol !== null && (l.kind ?? DEFAULT_LINK_KIND) !== TELEMETRY_LINK_KIND)
+                .map((l) => ({
+                checkId: this.id,
+                severity: this.severity,
+                message: `member ${m.name}'s link to ${l.member} output ${l.output} states protocol ${l.protocol}, and its kind is ${l.kind ?? DEFAULT_LINK_KIND}; protocol belongs to a ${TELEMETRY_LINK_KIND} link`,
+                entity: m.name,
+                pointer: `${l.pointer}/protocol`,
+            })));
+        },
+    },
+];

package/dist/workspace/checks/live.js

@@ -0,0 +1,100 @@
+/**
+ * The live link checks, WSP141 and WSP142 (#2549; #2524 D6, ws-062).
+ *
+ * `chant workspace check --live --env <env>` resolves each declared member
+ * link against what its producer's estate publishes now. It reads the live
+ * graph the way `chant workspace graph --live --env <env>` does: each `chant`
+ * member runs `chant graph --live` under its own toolchain, and the outputs of
+ * the live graph (the stack outputs a lexicon's live read reports) are the
+ * names a link may match, exactly. That is the one place this command reaches
+ * a network, through the member's own chant, with the member's own
+ * credentials. Without `--live` none of this runs, and the source checks
+ * (`./links.ts`) stay offline.
+ *
+ * | Id | Fails when |
+ * |---|---|
+ * | WSP141 | the producer was read live and publishes no output of that name |
+ * | WSP142 | the link could not be resolved live: the producer's kind is not read live, its read failed, or the read returned no outputs at all |
+ *
+ * Only declared links of kind `output` are resolved live. A `telemetry` link
+ * names a collector's pipeline or exporter, which the graph reports from the
+ * member's source, so it is not part of this check.
+ */
+import { DEFAULT_LINK_KIND, irMemberHandles, resolveLinks } from "../links.js";
+const describeLink = (row) => `${row.consumer}'s link to ${row.producer} output ${row.output}`;
+/**
+ * Read the live graph of the workspace at `cwd` for `env` and resolve the
+ * declared links against it. `onStderr` gets each member's stderr, which is
+ * where a lexicon's live read reports an account it could not reach.
+ */
+export async function gatherLiveLinkFacts(cwd, declaration, kinds, env, onStderr) {
+    const { workspaceGraph } = await import("../graph-cli.js");
+    const { doc } = await workspaceGraph({ cwd, args: { live: true, env }, noCache: true, ...(onStderr ? { onStderr } : {}) });
+    if ("error" in doc) {
+        return { env, rows: unreadRows(declaration, `the live graph could not be read: ${doc.error.code}: ${doc.error.message}`) };
+    }
+    const read = new Map(doc.members.map((m) => [m.name, m]));
+    const composed = doc.members.filter((m) => m.status === "composed").map((m) => m.name);
+    const handles = irMemberHandles({ composed, exports: doc.exports, imports: doc.imports });
+    const table = resolveLinks(declaration, handles);
+    const rows = [];
+    for (const r of table) {
+        if (r.status === "ambiguous" || r.origin !== "declared" || r.kind !== DEFAULT_LINK_KIND)
+            continue;
+        const row = { ...r, resolves: "live" };
+        if (row.status !== "invalid") {
+            const producer = read.get(row.producer);
+            const kind = kinds.get(declaration.members.find((m) => m.name === row.producer)?.kind ?? "");
+            if (!producer || producer.status !== "composed") {
+                row.status = "unresolved";
+                row.reason =
+                    producer?.reason?.message ??
+                        (kind ? `${row.producer} is kind ${kind.name}, which chant does not read live` : `${row.producer} was not read live`);
+            }
+            else if (row.status === "missing" && !doc.exports.some((e) => e.member === row.producer)) {
+                row.status = "unresolved";
+                row.reason = `the live read of ${row.producer} returned no outputs: the account may be unreachable, or its lexicon reports none`;
+            }
+            else if (row.status === "missing") {
+                row.reason = row.reason?.replace(/^(\S+) has no output/, "$1 publishes no output") ?? row.reason;
+            }
+        }
+        rows.push(row);
+    }
+    return { env, rows };
+}
+/** Every declared output link as unresolved, when the live graph could not be read at all. */
+function unreadRows(declaration, reason) {
+    return resolveLinks(declaration, new Map())
+        .filter((r) => r.status !== "ambiguous" && r.origin === "declared" && r.kind === DEFAULT_LINK_KIND)
+        .map((r) => ({ ...r, resolves: "live", ...(r.status === "invalid" ? {} : { status: "unresolved", reason }) }));
+}
+function liveFinding(check, row, message) {
+    return { checkId: check.id, severity: check.severity, message, entity: row.consumer, pointer: `${row.pointer}/output` };
+}
+export const LIVE_CHECKS = [
+    {
+        id: "WSP141",
+        name: "link-live-missing",
+        description: "With --live, a member link names an output its producer's estate publishes now, matched exactly. A producer whose declared output isn't deployed yet, or was renamed in the estate, fails this for every consumer.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            return (ctx.facts?.live?.rows ?? [])
+                .filter((r) => r.status === "missing")
+                .map((r) => liveFinding(this, r, `${describeLink(r)} does not resolve live in ${ctx.facts.live.env}: ${r.reason}`));
+        },
+    },
+    {
+        id: "WSP142",
+        name: "link-live-unresolved",
+        description: "With --live, a member link that could not be resolved against a live read is kept, unresolved, and reported: the producer's kind is not read live, its read failed, or the read returned no outputs.",
+        severity: "info",
+        configurable: true,
+        check(ctx) {
+            return (ctx.facts?.live?.rows ?? [])
+                .filter((r) => r.status === "unresolved")
+                .map((r) => liveFinding(this, r, `${describeLink(r)} is kept unresolved in ${ctx.facts.live.env}: ${r.reason}`));
+        },
+    },
+];

package/dist/workspace/checks/pipelines.js

@@ -0,0 +1,188 @@
+/**
+ * The workspace checks behind per-member pipelines (#2542; #2524 D19,
+ * ws-040, ws-041 and ws-042).
+ *
+ * - `WSP081`: each generated file has exactly one declarer. Two members that
+ *   both list `.github/workflows/deploy.yml` would each overwrite the other's
+ *   pipeline on every regeneration.
+ * - `WSP082`: a member declares generated files only inside its own
+ *   directory, with one exception: forge CI files, which forges read from
+ *   fixed paths at the repository root ({@link isForgePath}).
+ * - `WSP083`: linked members share at least one environment name. Names are
+ *   matched exactly, with no mapping (ws-040), so this is a warning: a
+ *   member with its own names still builds.
+ *
+ * The checks are pure functions over {@link MemberPipelineFacts}.
+ * {@link gatherPipelineFacts} collects those facts from a checkout, reading
+ * each member's generated-file record (../member-pipeline.ts), and
+ * `chant workspace check` gathers them before it runs {@link PIPELINE_CHECKS}
+ * (#2641).
+ */
+import { join } from "node:path";
+import { declaredMemberLinks } from "../links.js";
+import { readGeneratedRecord } from "../member-pipeline.js";
+export const WSP_ONE_DECLARER = "WSP081";
+export const WSP_GENERATED_PLACEMENT = "WSP082";
+export const WSP_LINKED_ENVIRONMENTS = "WSP083";
+/**
+ * Whether `path` (repository-relative) is a forge CI file: a file directly in
+ * `.github/workflows/`, `.forgejo/workflows/` or `.gitea/workflows/`, the
+ * root `.gitlab-ci.yml`, or a file directly in `.gitlab/ci/`, which the root
+ * `.gitlab-ci.yml` includes. The exemption is this narrow on purpose (ws-042).
+ */
+export function isForgePath(path) {
+    if (path === ".gitlab-ci.yml")
+        return true;
+    return /^(\.github\/workflows|\.forgejo\/workflows|\.gitea\/workflows|\.gitlab\/ci)\/[^/]+$/.test(path);
+}
+function inside(path, dir) {
+    return dir === "." || path === dir || path.startsWith(`${dir}/`);
+}
+/** `WSP081`: no two members declare the same generated file. */
+export function checkOneDeclarer(facts) {
+    const byPath = new Map();
+    for (const f of facts) {
+        for (const path of new Set(f.generated))
+            byPath.set(path, [...(byPath.get(path) ?? []), f.name]);
+    }
+    const findings = [];
+    for (const [path, members] of [...byPath].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+        if (members.length < 2)
+            continue;
+        findings.push({
+            id: WSP_ONE_DECLARER,
+            severity: "error",
+            members,
+            path,
+            message: `members ${members.join(", ")} all declare ${path} as a generated file; each would overwrite ` +
+                `the others' output. Keep it in one member, and give the others their own file ` +
+                `(a member's pipeline is named after it by default).`,
+        });
+    }
+    return findings;
+}
+/** `WSP082`: a member's generated files sit in its own directory, or are forge CI files. */
+export function checkGeneratedPlacement(facts) {
+    const findings = [];
+    for (const f of facts) {
+        for (const path of f.generated) {
+            if (inside(path, f.dir) || isForgePath(path))
+                continue;
+            findings.push({
+                id: WSP_GENERATED_PLACEMENT,
+                severity: "error",
+                members: [f.name],
+                path,
+                message: `member ${f.name} declares ${path}, which is outside its directory (${f.dir}) and is not a forge ` +
+                    `CI file. Only files in .github/workflows/, .forgejo/workflows/, .gitea/workflows/ or .gitlab/ci/, ` +
+                    `and .gitlab-ci.yml, may sit outside the member that generates them.`,
+            });
+        }
+    }
+    return findings;
+}
+/** `WSP083`: every link joins members that share an environment name, when both name any. */
+export function checkLinkedEnvironments(facts, links) {
+    const byName = new Map(facts.map((f) => [f.name, f]));
+    const order = new Map(facts.map((f, i) => [f.name, i]));
+    const seen = new Set();
+    const findings = [];
+    for (const link of links) {
+        const a = byName.get(link.consumer);
+        const b = byName.get(link.producer);
+        if (!a || !b || a === b)
+            continue;
+        const [first, second] = order.get(a.name) <= order.get(b.name) ? [a, b] : [b, a];
+        const key = `${first.name}\0${second.name}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        // A member that names no environment has nothing to line up yet.
+        if (first.environments.length === 0 || second.environments.length === 0)
+            continue;
+        const shared = first.environments.filter((e) => second.environments.includes(e));
+        if (shared.length > 0)
+            continue;
+        const list = (f) => [...new Set(f.environments)].sort().join(", ");
+        findings.push({
+            id: WSP_LINKED_ENVIRONMENTS,
+            severity: "warning",
+            members: [first.name, second.name],
+            message: `linked members ${first.name} (${list(first)}) and ${second.name} (${list(second)}) share no ` +
+                `environment name. Names are matched exactly, so a view across members, such as ` +
+                `chant workspace status <env>, can't line their releases up. Rename one side to match.`,
+        });
+    }
+    return findings;
+}
+/**
+ * Collect the facts from a checkout. `prefix` is the workspace root relative
+ * to the repository root (`"."` when they are the same). Each member's
+ * generated files and environments come from its generated-file record.
+ */
+export function gatherPipelineFacts(workspaceRoot, declaration, prefix = ".") {
+    return declaration.members.map((m) => {
+        const record = readGeneratedRecord(m.dir === "." ? workspaceRoot : join(workspaceRoot, m.dir));
+        const dir = prefix === "." ? m.dir : m.dir === "." ? prefix : `${prefix}/${m.dir}`;
+        return {
+            name: m.name,
+            dir,
+            generated: record.files.map((f) => f.path),
+            environments: [...new Set(record.files.flatMap((f) => (f.env ? [f.env] : [])))],
+        };
+    });
+}
+/**
+ * Run the three checks. `links` defaults to none; `chant workspace check`
+ * passes the declared member links (#2539).
+ */
+export function checkPipelines(facts, links = []) {
+    return [...checkOneDeclarer(facts), ...checkGeneratedPlacement(facts), ...checkLinkedEnvironments(facts, links)];
+}
+// ── As workspace checks ──────────────────────────────────────────────────────
+/**
+ * A finding as a workspace diagnostic. It sits at the first member it names,
+ * in declaration order, and that member's entry is the one that can carry a
+ * `suppress`.
+ */
+function toDiagnostic(check, ctx, f) {
+    const member = ctx.declaration.members.find((m) => m.name === f.members[0]);
+    return { checkId: check.id, severity: check.severity, message: f.message, entity: f.members[0], pointer: member?.pointer ?? "" };
+}
+/** The member links `WSP083` compares: the pairs the declaration links (#2539). */
+function declaredLinks(ctx) {
+    return declaredMemberLinks(ctx.declaration);
+}
+/** The pipeline checks, which read `ctx.facts.pipelines`. They find nothing when the facts were not gathered. */
+export const PIPELINE_CHECKS = [
+    {
+        id: WSP_ONE_DECLARER,
+        name: "generated-declared-twice",
+        description: "No two members record the same generated file, so no member's regeneration overwrites another's pipeline.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            return checkOneDeclarer(ctx.facts?.pipelines ?? []).map((f) => toDiagnostic(this, ctx, f));
+        },
+    },
+    {
+        id: WSP_GENERATED_PLACEMENT,
+        name: "generated-outside-member",
+        description: "A member's recorded generated files sit in its own directory, or are forge CI files at the fixed paths forges read.",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            return checkGeneratedPlacement(ctx.facts?.pipelines ?? []).map((f) => toDiagnostic(this, ctx, f));
+        },
+    },
+    {
+        id: WSP_LINKED_ENVIRONMENTS,
+        name: "linked-environments-disjoint",
+        description: "Linked members share at least one environment name, matched exactly, when both name any.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            return checkLinkedEnvironments(ctx.facts?.pipelines ?? [], declaredLinks(ctx)).map((f) => toDiagnostic(this, ctx, f));
+        },
+    },
+];

package/dist/workspace/checks/records.js

@@ -0,0 +1,169 @@
+/**
+ * The record checks, WSP111 to WSP114 (#2549; #2524 D4, D18).
+ *
+ * With `--kind <kind file>`, `chant workspace check` reads the records the
+ * kind locates, in the tree it checks, and reports the files they pin by hash
+ * that have changed or gone since. A decision stays valid when its evidence
+ * drifts, so drift is a warning: it asks for the decision to be looked at
+ * again, and the declaration's `checks` can raise it to an error.
+ *
+ * | Id | Finds |
+ * |---|---|
+ * | WSP111 | a pinned file whose bytes no longer hash to the pinned sha256 |
+ * | WSP112 | a pinned file that does not exist |
+ * | WSP113 | a pinned file that a superseding record pins at the old hash: the artifact did not follow the decision |
+ * | WSP114 | the records of `--kind` can't be read (fixed) |
+ * | WSP115 | a record kind the declaration names is missing or does not load as one (fixed, #2680) |
+ * | WSP116 | an answer kind's decision points file is missing or not valid (fixed, ws-058, #2738) |
+ * | WSP117 | a done work item has an acceptance criterion no passing evidence meets (#2772) |
+ *
+ * WSP117 reads the records of every declared work kind with acceptance
+ * criteria, in the working tree, and the records of `--kind`. It carries the
+ * reason code `work-acceptance-unmet`.
+ */
+/** The read contract's codes the record checks carry as `code`: WSP117's (#2772). */
+export const RECORD_FINDING_CODES = ["work-acceptance-unmet"];
+function warningFindings(check, facts, code) {
+    if (!facts || "error" in facts)
+        return [];
+    const out = [];
+    for (const r of facts.records) {
+        // A superseded record's evidence no longer backs anything current.
+        if (r.supersededBy !== null)
+            continue;
+        for (const w of r.warnings) {
+            if (w.code !== code)
+                continue;
+            out.push({ checkId: check.id, severity: check.severity, message: `${r.id ?? r.path}: ${w.message}`, pointer: "", file: r.file });
+        }
+    }
+    return out;
+}
+export const RECORD_CHECKS = [
+    {
+        id: "WSP111",
+        name: "record-asset-drift",
+        description: "Every file a current record pins by hash still hashes to the pinned sha256. A changed file asks for the record to be revisited.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            return warningFindings(this, ctx.facts?.records, "asset-drift");
+        },
+    },
+    {
+        id: "WSP112",
+        name: "record-asset-missing",
+        description: "Every file a current record pins by hash exists.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            return warningFindings(this, ctx.facts?.records, "asset-missing");
+        },
+    },
+    {
+        id: "WSP113",
+        name: "record-asset-stale",
+        description: "No current record pins a file at the same hash as a record it supersedes while the file is unchanged since: when a decision changes, the artifacts it rests on follow.",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            return warningFindings(this, ctx.facts?.records, "asset-stale");
+        },
+    },
+    {
+        id: "WSP114",
+        name: "records-unreadable",
+        description: "The records of the kind named with --kind can be read.",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            const facts = ctx.facts?.records;
+            if (!facts || !("error" in facts))
+                return [];
+            return [{ checkId: this.id, severity: this.severity, message: `--kind ${facts.kind}: ${facts.error.code}: ${facts.error.message}`, pointer: "" }];
+        },
+    },
+    {
+        id: "WSP115",
+        name: "record-kind-unloadable",
+        description: "Every record kind the declaration names is a file that exports a valid recordKind, with the schema it names.",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            return (ctx.facts?.declaredKinds ?? [])
+                .filter((k) => k.reason !== null)
+                .map((k) => ({
+                checkId: this.id,
+                severity: this.severity,
+                message: `${k.declared.member === null ? "the workspace" : `member ${k.declared.member}`} declares the record kind ${k.declared.kind}, which can't be loaded: ${k.reason.code}: ${k.reason.message}`,
+                ...(k.declared.member !== null ? { entity: k.declared.member } : {}),
+                pointer: `${k.declared.pointer}/kind`,
+            }));
+        },
+    },
+    {
+        id: "WSP116",
+        name: "decision-points-invalid",
+        description: "Every answer kind the declaration names has a decision points file that matches decision-points.schema.json: each input names a read-contract output, each table row tests declared inputs and answers a candidate, each model id is pinned, and the chain ends in its one quorum (ws-058).",
+        severity: "error",
+        configurable: false,
+        check(ctx) {
+            const out = [];
+            for (const k of ctx.facts?.declaredKinds ?? []) {
+                if (!k.points)
+                    continue;
+                const where = k.declared.member === null ? "the workspace" : `member ${k.declared.member}`;
+                const finding = (message) => ({
+                    checkId: this.id,
+                    severity: this.severity,
+                    message,
+                    ...(k.declared.member !== null ? { entity: k.declared.member } : {}),
+                    pointer: `${k.declared.pointer}/kind`,
+                });
+                for (const p of k.points.problems)
+                    out.push(finding(`${where} declares the answer kind ${k.declared.kind}, whose points file ${k.points.file} ${p.field ? `has ${p.field}, which ${p.message}` : p.message}`));
+            }
+            return out;
+        },
+    },
+    {
+        id: "WSP117",
+        name: "work-acceptance-unmet",
+        description: "Every done work item meets its acceptance criteria: each has evidence that names it, passed, and has the verification the criterion expects, and a manual verdict is from someone other than the implementer (#2772).",
+        severity: "error",
+        configurable: true,
+        check(ctx) {
+            const out = [];
+            const seen = new Set();
+            const facts = ctx.facts?.records;
+            if (facts && !("error" in facts)) {
+                for (const r of facts.records) {
+                    if (r.supersededBy !== null)
+                        continue;
+                    const w = r.warnings.find((x) => x.code === "work-acceptance-unmet");
+                    if (!w || seen.has(r.file))
+                        continue;
+                    seen.add(r.file);
+                    out.push({ checkId: this.id, severity: this.severity, message: w.message, pointer: "", file: r.file, code: "work-acceptance-unmet" });
+                }
+            }
+            for (const k of ctx.facts?.declaredKinds ?? []) {
+                for (const a of k.acceptance ?? []) {
+                    if (a.unmet === null || seen.has(a.file))
+                        continue;
+                    seen.add(a.file);
+                    out.push({
+                        checkId: this.id,
+                        severity: this.severity,
+                        message: a.unmet,
+                        ...(k.declared.member !== null ? { entity: k.declared.member } : {}),
+                        pointer: "",
+                        file: a.file,
+                        code: "work-acceptance-unmet",
+                    });
+                }
+            }
+            return out;
+        },
+    },
+];