@intentius/chant 0.124.13 → 0.124.15

package/src/discovery/fold-import.ts

@@ -60,6 +60,7 @@ import {
 import { getInterpolationFields, getProvenance, setPathProvenance, setProvenance } from "../provenance";
 import { foldProvenanceOfEntities, type FoldProvenance } from "../fold-provenance";
 import { collectEntities } from "./collect";
+import { hostCompositeName, markHostCompositeInstance } from "./host-composite";
 import { intrinsicCallFoldsEagerly, intrinsicTagFolds, type IntrinsicDef } from "../lexicon";
 import type { BuildParamValue } from "../build-params";
 
@@ -3056,53 +3057,6 @@ async function interpretCompositeFactory(
   }
 }
 
-/**
- * chant#3598 — a host composite instance's own marker. Non-enumerable and
- * symbol-keyed, like provenance, so nothing that serializes or compares the
- * exports sees it. It carries the composite's name, which the members object
- * otherwise has no record of once it is returned.
- */
-const HOST_COMPOSITE_INSTANCE = Symbol.for("chant.fold.hostCompositeInstance");
-
-/**
- * Mark `members` as the instance a host's composite produced, and return it
- * unchanged.
- *
- * chant#3608 — every declarable member, and every member of a nested host
- * instance, is also stamped with the composite, the way `expandComposite`
- * stamps a chant instance's members. A destructured member is never expanded,
- * so this is the only record it has that a composite wrote it, and without
- * it a path the fold did not attribute reads as authored and so `direct`.
- * `setProvenance` keeps the first writer, and a nested instance was marked
- * when its own call returned, so a member keeps its innermost composite.
- */
-function markHostCompositeInstance(members: Record<string, unknown>, compositeName: string): Record<string, unknown> {
-  if (Object.isExtensible(members) && !Object.prototype.hasOwnProperty.call(members, HOST_COMPOSITE_INSTANCE)) {
-    Object.defineProperty(members, HOST_COMPOSITE_INSTANCE, {
-      value: compositeName,
-      enumerable: false,
-      configurable: true,
-    });
-  }
-  stampHostCompositeMembers(members, compositeName);
-  return members;
-}
-
-/** Stamp `composite` on each declarable member of a host instance, descending into nested host instances. */
-function stampHostCompositeMembers(members: Record<string, unknown>, compositeName: string): void {
-  for (const member of Object.values(members)) {
-    if (isDeclarable(member)) setProvenance(member, { composite: compositeName });
-    else if (hostCompositeName(member) !== undefined) stampHostCompositeMembers(member as Record<string, unknown>, compositeName);
-  }
-}
-
-/** The composite name a host composite instance was marked with, or `undefined` for any other value. */
-function hostCompositeName(value: unknown): string | undefined {
-  if (!isIndexableObject(value)) return undefined;
-  const name = (value as Record<symbol, unknown>)[HOST_COMPOSITE_INSTANCE];
-  return typeof name === "string" ? name : undefined;
-}
-
 /** Evaluate an admissible factory body's statements in order, binding each `const`, and return the `return` expression's value. */
 async function interpretFactoryBody(
   fn: ts.ArrowFunction | ts.FunctionExpression,
@@ -3620,8 +3574,7 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
   } catch {
     return false;
   }
-  const root = chantCoreRoot();
-  return targetPath === root || targetPath.startsWith(root + sep);
+  return isChantCorePath(targetPath);
 }
 
 /**
@@ -3643,7 +3596,7 @@ function isChantOwnedHelperBinding(binding: ImportBinding, ctx: ResolveCtx): boo
  *     modules by subpath instead of through the barrel names code the process
  *     already trusts, not code the project controls.
  *  2. **chant-core's own executing tree** — the specifier is RESOLVED and the
- *     resulting path checked against {@link chantCoreRoot}. A text match is
+ *     resulting path checked against {@link chantCoreRoots}. A text match is
  *     not enough here: `@intentius/chant` and `@intentius/chant-lexicon-evil`
  *     are both strings an untrusted repo can write into its own source and
  *     back with its own `node_modules` directory, and
@@ -3700,8 +3653,7 @@ function isTrustedExecutableBinding(binding: ImportBinding, ctx: ResolveCtx): bo
   // chant#2590 — the subpath case of the same arm: another file of a
   // multi-file path lexicon, under its trusted directory.
   if (inPathLexiconRoot(targetPath, ctx.lexiconRoots)) return true;
-  const root = chantCoreRoot();
-  return targetPath === root || targetPath.startsWith(root + sep);
+  return isChantCorePath(targetPath);
 }
 
 /**
@@ -3737,17 +3689,29 @@ function sandboxedExecutionRefusal(
 }
 
 /**
- * chant-core's own module root — `packages/core/src` in this repo,
- * `<pkg>/dist` in a published install — derived from THIS module's location.
+ * chant-core's own module roots, derived from THIS module's location:
+ * `packages/core/src` in this repo, and in a published install both
+ * `<pkg>/src` (where `@intentius/chant/*` specifiers resolve, through the
+ * package exports) and `<pkg>/dist` (where the compiled CLI runs from, #3878).
  * Pure string arithmetic on `import.meta.url`, no filesystem access at all, so
  * it is safe in the #1045 sandbox child (which locks reads to an allowlist);
  * lazy and memoized purely to avoid doing it per call.
  */
-let chantCoreRootMemo: string | undefined;
-function chantCoreRoot(): string {
-  // .../<root>/discovery/fold-import.ts -> .../<root>
-  chantCoreRootMemo ??= dirname(dirname(fileURLToPath(import.meta.url)));
-  return chantCoreRootMemo;
+let chantCoreRootsMemo: readonly string[] | undefined;
+function chantCoreRoots(): readonly string[] {
+  if (!chantCoreRootsMemo) {
+    // .../<root>/discovery/fold-import.{ts,js} -> .../<root>
+    const root = dirname(dirname(fileURLToPath(import.meta.url)));
+    const name = basename(root);
+    const sibling = name === "dist" ? join(dirname(root), "src") : name === "src" ? join(dirname(root), "dist") : undefined;
+    chantCoreRootsMemo = sibling ? [root, sibling] : [root];
+  }
+  return chantCoreRootsMemo;
+}
+
+/** Whether `path` is one of chant-core's own modules (see {@link chantCoreRoots}). */
+function isChantCorePath(path: string): boolean {
+  return chantCoreRoots().some((root) => path === root || path.startsWith(root + sep));
 }
 
 /** Revive every value in a folded props/attributes object (see {@link reviveFoldedValue}). */
@@ -4467,8 +4431,7 @@ async function tryFoldFileCore(file: string, session: FoldSession): Promise<Fold
   // exclusion has to be explicit, or a fixture/in-repo import by path would
   // walk fold into chant's own tree and fold `params` to an empty object.
   {
-    const root = chantCoreRoot();
-    if (file === root || file.startsWith(root + sep)) {
+    if (isChantCorePath(file)) {
       return { ok: false, reason: "chant's own module is not project source" };
     }
   }
@@ -5072,7 +5035,7 @@ export async function foldProject(
       const attempt = attempts.get(file);
       return {
         file,
-        exports: attempt?.ok === true ? expandHostCompositeExports(Object.fromEntries(attempt.exportedValues)) : {},
+        exports: attempt?.ok === true ? Object.fromEntries(attempt.exportedValues) : {},
       };
     }),
   );
@@ -5144,71 +5107,6 @@ function foldProvenanceByFile(
   return out;
 }
 
-/**
- * chant#3598 — a file's exports with every host composite instance replaced by
- * its members, for {@link foldProvenanceByFile} only.
- *
- * A host's registration form (chant#2442) returns the members object the
- * factory built, not a chant `CompositeInstance`, because wrapping it would run
- * chant's member validation against the host's own entities. `collectEntities`
- * expands only chant's instances, so an instance exported whole
- * (`export const store = Store({...})`) contributed no entity and therefore no
- * record, while a destructured member, a plain declarable export, did.
- *
- * The members are named and stamped the way `expandComposite` names and stamps
- * a chant instance: `${exportName}${Member}`, with a whole-entity `composite`
- * origin under the paths the fold already attributed. That origin is written
- * before `collectEntities` adds its `authored` one, and the first writer wins,
- * so a path the fold did not attribute is `unknown` rather than `direct`.
- *
- * Only a top-level export is expanded. A host instance nested in another
- * composite's body or placed in an array does not fold today, so its file is
- * `run` and has no record to give.
- *
- * The exports a caller receives in the verdict are the originals.
- */
-function expandHostCompositeExports(exports: Record<string, unknown>): Record<string, unknown> {
-  const out: Record<string, unknown> = {};
-  for (const [name, value] of Object.entries(exports)) {
-    if (hostCompositeName(value) === undefined) {
-      out[name] = value;
-      continue;
-    }
-    expandHostCompositeInstance(name, value as Record<string, unknown>, name, out);
-  }
-  return out;
-}
-
-/**
- * chant#3608 — one host instance's members into `out`, a nested host instance
- * expanded in place under its member's name (`siteMainBucket`), as
- * `expandComposite` expands a nested chant instance. Every member belongs to
- * the top-level `instance`; its composite is the innermost one, which
- * {@link markHostCompositeInstance} already stamped, so the whole-entity
- * origin names that composite too.
- */
-function expandHostCompositeInstance(
-  prefix: string,
-  members: Record<string, unknown>,
-  instance: string,
-  out: Record<string, unknown>,
-): void {
-  const compositeName = hostCompositeName(members) as string;
-  for (const [memberName, member] of Object.entries(members)) {
-    if (memberName.length === 0) continue;
-    const fullName = `${prefix}${memberName[0].toUpperCase()}${memberName.slice(1)}`;
-    if (hostCompositeName(member) !== undefined) {
-      expandHostCompositeInstance(fullName, member as Record<string, unknown>, instance, out);
-      continue;
-    }
-    if (!isDeclarable(member)) continue;
-    setProvenance(member, { composite: compositeName, compositeInstance: instance });
-    const composite = getProvenance(member)?.composite ?? compositeName;
-    setPathProvenance(member, "", { kind: "composite", composite, instance });
-    out[fullName] = member;
-  }
-}
-
 /** The deepest directory every one of `files` sits under. */
 function commonDirectory(files: readonly string[]): string {
   const split = files.map((file) => dirname(resolvePath(file)).split(sep));

package/src/discovery/fold-project-provenance.test.ts

@@ -394,11 +394,15 @@ describe("foldProject provenance for host composites (chant#3608)", () => {
     expect(provenance.bucket.composite).toBe("Archive");
     expect(provenance.bucket.fields).toEqual({ name: unknown, versioned: unknown });
 
-    // build() does not expand a host instance exported whole, so the
-    // destructured member is the one it can be held to.
-    const built = await build(join(root, "archive"), [namesSerializer], undefined, { fold: true });
+    // chant#3612 — build() expands the whole instance too, and agrees on every record.
+    const built = await build(join(root, "archive"), [namesSerializer], undefined, {
+      fold: true,
+      lexiconPackages: ["@tsad/shapes-3608"],
+      sandbox: true,
+    });
     expect(built.errors).toEqual([]);
-    expect(built.foldProvenance.bucket).toEqual(provenance.bucket);
+    expect([...built.entities.keys()].sort()).toEqual(["archiveBucket", "bucket"]);
+    expect(built.foldProvenance).toEqual(provenance);
   });
 
   test("a whole instance's nested composite members have records, and the innermost composite wins", async () => {
@@ -458,6 +462,19 @@ describe("foldProject provenance for host composites (chant#3608)", () => {
     expect(provenance.mainBucket.fields).toMatchObject({ name: innerName("main"), tier: innerTier("main") });
     expect(provenance.fixedBucket.fields).toMatchObject({ name: innerName("fixed"), tier: innerTier("fixed") });
     expect(provenance.side.fields.name).toMatchObject({ kind: "composite-parameter", composite: "Outer", parameters: ["name"] });
+
+    // chant#3612 — build() given the same host package reports the same
+    // entities and the same records. Before, it emitted nothing for `site`
+    // and, with the host off the allowlist, ran the file and read `side` as direct.
+    const built = await build(join(root, "site"), [namesSerializer], undefined, {
+      fold: true,
+      lexiconPackages: ["@tsad/shapes-3608"],
+      sandbox: true,
+    });
+    expect(built.errors).toEqual([]);
+    expect(built.foldDecisions.map((d) => d.mode)).toEqual(["fold"]);
+    expect([...built.entities.keys()].sort()).toEqual(Object.keys(provenance).sort());
+    expect(built.foldProvenance).toEqual(provenance);
   });
 });
 

package/src/discovery/host-composite.ts

@@ -0,0 +1,101 @@
+import { isDeclarable, type Declarable } from "../declarable";
+import { getProvenance, setPathProvenance, setProvenance } from "../provenance";
+
+/**
+ * chant#3598 — a host composite instance's own marker. Non-enumerable and
+ * symbol-keyed, like provenance, so nothing that serializes or compares the
+ * exports sees it. It carries the composite's name, which the members object
+ * otherwise has no record of once it is returned.
+ *
+ * Only the fold path sets it: a host's registration form (chant#2442) returns
+ * the members object the factory built, not a chant `CompositeInstance`, and
+ * chant knows the object came from a composite only because the fold resolved
+ * the call. A file that runs instead has no such knowledge.
+ */
+const HOST_COMPOSITE_INSTANCE = Symbol.for("chant.fold.hostCompositeInstance");
+
+function isPlainIndexable(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Mark `members` as the instance a host's composite produced, and return it
+ * unchanged.
+ *
+ * chant#3608 — every declarable member, and every member of a nested host
+ * instance, is also stamped with the composite, the way `expandComposite`
+ * stamps a chant instance's members. A destructured member is never expanded,
+ * so this is the only record it has that a composite wrote it, and without
+ * it a path the fold did not attribute reads as authored and so `direct`.
+ * `setProvenance` keeps the first writer, and a nested instance was marked
+ * when its own call returned, so a member keeps its innermost composite.
+ */
+export function markHostCompositeInstance(
+  members: Record<string, unknown>,
+  compositeName: string,
+): Record<string, unknown> {
+  if (Object.isExtensible(members) && !Object.prototype.hasOwnProperty.call(members, HOST_COMPOSITE_INSTANCE)) {
+    Object.defineProperty(members, HOST_COMPOSITE_INSTANCE, {
+      value: compositeName,
+      enumerable: false,
+      configurable: true,
+    });
+  }
+  stampHostCompositeMembers(members, compositeName);
+  return members;
+}
+
+/** Stamp `composite` on each declarable member of a host instance, descending into nested host instances. */
+function stampHostCompositeMembers(members: Record<string, unknown>, compositeName: string): void {
+  for (const member of Object.values(members)) {
+    if (isDeclarable(member)) setProvenance(member, { composite: compositeName });
+    else if (hostCompositeName(member) !== undefined) stampHostCompositeMembers(member as Record<string, unknown>, compositeName);
+  }
+}
+
+/** The composite name a host composite instance was marked with, or `undefined` for any other value. */
+export function hostCompositeName(value: unknown): string | undefined {
+  if (!isPlainIndexable(value)) return undefined;
+  const name = (value as Record<symbol, unknown>)[HOST_COMPOSITE_INSTANCE];
+  return typeof name === "string" ? name : undefined;
+}
+
+/**
+ * chant#3598, chant#3612 — a host composite instance's members as entities,
+ * for `collectEntities`.
+ *
+ * `collectEntities` is the one place `build()` and `foldProject` turn exports
+ * into entities, so expanding here is what makes the two report the same set:
+ * `export const archive = Archive({...})` gives `archiveBucket` to both.
+ *
+ * The members are named and stamped the way `expandComposite` names and stamps
+ * a chant instance: `${exportName}${Member}`, a nested host instance expanded
+ * in place under its member's name (`siteMainBucket`), with a whole-entity
+ * `composite` origin under the paths the fold already attributed. That origin
+ * is written before `collectEntities` adds its own record, and the first
+ * writer wins, so a path the fold did not attribute is `unknown` rather than
+ * `direct`. Every member belongs to the top-level `instance`; its composite is
+ * the innermost one, which {@link markHostCompositeInstance} already stamped.
+ */
+export function expandHostComposite(
+  prefix: string,
+  members: Record<string, unknown>,
+  instance: string = prefix,
+): Array<[string, Declarable]> {
+  const out: Array<[string, Declarable]> = [];
+  const compositeName = hostCompositeName(members) as string;
+  for (const [memberName, member] of Object.entries(members)) {
+    if (memberName.length === 0) continue;
+    const fullName = `${prefix}${memberName[0].toUpperCase()}${memberName.slice(1)}`;
+    if (hostCompositeName(member) !== undefined) {
+      out.push(...expandHostComposite(fullName, member as Record<string, unknown>, instance));
+      continue;
+    }
+    if (!isDeclarable(member)) continue;
+    setProvenance(member, { composite: compositeName, compositeInstance: instance });
+    const composite = getProvenance(member)?.composite ?? compositeName;
+    setPathProvenance(member, "", { kind: "composite", composite, instance });
+    out.push([fullName, member]);
+  }
+  return out;
+}

package/src/discovery/import.ts

@@ -1,4 +1,5 @@
 import { DiscoveryError } from "../errors";
+import { ensureTypeScriptLoader } from "../ts-loader";
 
 /**
  * Modules whose evaluation threw, and the error each threw with (#2368).
@@ -57,6 +58,7 @@ export async function importModule(
   if (failed) throw failed;
 
   try {
+    ensureTypeScriptLoader();
     return await import(path);
   } catch (error) {
     const message =

package/src/discovery/index.ts

@@ -143,6 +143,16 @@ export interface DiscoveryOptions {
    */
   lexicons?: readonly string[];
 
+  /**
+   * chant#3612 — package specifiers to follow a bare import into, verbatim,
+   * alongside whatever {@link lexicons} names. The same allowlist
+   * `FoldProjectOptions.lexiconPackages` gives `foldProject` (chant#2438), so
+   * a build over a host of its own folds the files `foldProject` folds. A
+   * chant project never needs it: its packages are `lexicons`. Only
+   * meaningful when {@link fold} is set. Default: none.
+   */
+  lexiconPackages?: readonly string[];
+
   /**
    * chant #1045 Phase 2 — opt-in: whatever would otherwise reach the
    * in-process `importModule` step (every file, when {@link fold} isn't set;
@@ -289,7 +299,7 @@ export async function discover(path: string, options?: DiscoveryOptions): Promis
         buildParamValuesMap,
         options.lexicons,
         options.sandbox === true,
-        [],
+        options.lexiconPackages ?? [],
         options.executing === true,
         files,
       )

package/src/discovery/sandbox/driver.ts

@@ -1,5 +1,6 @@
 import { dirname, join } from "node:path";
 import { params as currentBuildParams } from "../../params";
+import { chantSourceDir } from "../../ts-loader";
 
 /**
  * chant #1045 Phase 2 — generates the source of the "driver" module that runs
@@ -30,7 +31,8 @@ import { params as currentBuildParams } from "../../params";
  * boundary at all.
  */
 
-const HERE = import.meta.dirname;
+// #3878: the TypeScript source, also when this module runs compiled from dist/.
+const HERE = chantSourceDir(import.meta.url);
 const DISCOVERY_DIR = join(HERE, "..");
 
 /** Absolute paths to chant's OWN trusted modules the generated driver imports — always resolved relative to THIS file's own location on disk, so this works whether chant is running from the monorepo or from a consumer's `node_modules` (both route runtime resolution at `src/*.ts` — see `packages/core/package.json`'s `development`/`default` export conditions). */

package/src/gate-decision-bundle.test.ts

@@ -6,7 +6,7 @@
  * rule because `@intentius/chant/op/gate` pulls in zod and the git ledger
  * code. `@intentius/chant/gate-decision` holds the decision for a plan digest
  * under `ledger`, `pr-review` and `sealed`, the seal check over
- * node:crypto, and the `identity.gates` rule with its class check (#3862). This bundles it the way terragucci would and reads esbuild's
+ * node:crypto, and the `identity.gates` rule with its class check (#3862), reading the classes pinned packages supply as data, without ajv (#3888). This bundles it the way terragucci would and reads esbuild's
  * own list of what went in.
  */
 
@@ -15,7 +15,7 @@ import { build } from "esbuild";
 import { describe, expect, test } from "vitest";
 import { REPO } from "./workspace/__fixtures__/contract-repo";
 
-const FORBIDDEN = [/node_modules\//, /\/src\/fold\//, /\/src\/lint\//, /\/src\/codegen\//, /\/src\/lifecycle\/git\.ts$/, /\/src\/lifecycle\/gate-ledger\.ts$/];
+const FORBIDDEN = [/node_modules\//, /\/src\/workspace\/(kinds|principal-classes|pin-integrity)\.ts$/, /\/src\/fold\//, /\/src\/lint\//, /\/src\/codegen\//, /\/src\/lifecycle\/git\.ts$/, /\/src\/lifecycle\/gate-ledger\.ts$/];
 
 describe("the gate-decision bundle", () => {
   test("holds the decision, the seal check and the plan digest, and no package or git code", async () => {
@@ -46,13 +46,14 @@ describe("the gate-decision bundle", () => {
       "packages/core/src/notify.ts",
       "packages/core/src/op/gate-point.ts",
       "packages/core/src/op/op-waves.ts",
+      "packages/core/src/workspace/class-data.ts",
       "packages/core/src/workspace/identity-gate-rule.ts",
       "packages/core/src/workspace/jsonc.ts",
       "packages/core/src/workspace/trust/gate-seal.ts",
       "packages/core/src/workspace/trust/trust-files.ts",
     ]);
-    // About 27 KB today.
+    // About 43 KB unminified today, 7 KB of it the pinned classes read as data (#3888).
     const bytes = result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0);
-    expect(bytes).toBeLessThan(40 * 1024);
+    expect(bytes).toBeLessThan(48 * 1024);
   });
 });

package/src/gate-decision-identity.test.ts

@@ -139,18 +139,71 @@ describe.skipIf(!hasSshKeygen)("identity.gates read at base, as chant reads it",
     expect(judgeBoth(invalid.r, invalid.base, invalid.approvals).ship![1]).toMatch(/no signers file/);
   });
 
-  test("a domain class the caller read from a pin, and a pin this reader does not load", () => {
-    const { r, base, approvals } = setup(
-      (k) => ({ ".chant/allowed_signers": `alice ${k.alice.pub}\n`, ".chant/trust.json": JSON.stringify({ schema: 1, roles: { operator: ["alice"] } }) }),
-      { pins: [{ package: "@acme/ops-classes", version: "1.0.0" }] },
+  /** A plugin publishing `classes` at ./workspace-principals, as files under `dir`. */
+  const plugin = (dir: string, classes: unknown[], version = "1.0.0"): Record<string, string> => ({
+    [`${dir}/package.json`]: JSON.stringify({ name: "@acme/ops-classes", version, exports: { "./workspace-principals": "./principals.json" } }),
+    [`${dir}/principals.json`]: JSON.stringify({ schema: 1, classes }),
+  });
+  const OPERATOR = { name: "operator", description: "people who apply infrastructure", role: "operator" };
+  const operatorPolicy = (k: Record<string, Key>) => ({
+    ".chant/allowed_signers": `alice ${k.alice.pub}\nbob ${k.bob.pub}\n`,
+    ".chant/trust.json": JSON.stringify({ schema: 1, roles: { operator: ["alice"], runner: ["bob"] } }),
+  });
+  const install = (r: TestRepo, files: Record<string, string>) => {
+    for (const [path, text] of Object.entries(files)) r.write(path, text);
+  };
+
+  test("a class only a pinned package supplies, read from the installed package as chant reads it (#3888)", () => {
+    const { r, base, approvals } = setup(operatorPolicy, { pins: [{ package: "@acme/ops-classes", version: "1.0.0" }] });
+    install(r, plugin("node_modules/@acme/ops-classes", [OPERATOR]));
+    const ours = judgeBoth(r, base, approvals);
+    // alice holds the operator role at base, so she is an operator and no longer human.
+    expect(ours.ops![1]).toBeNull();
+    expect(ours.ops![2]).toBe("BOB  is not in the class operator that gate ops needs: no role grant at base puts them there");
+    expect(ours.deploy![1]).toMatch(/^alice is not in the class human that gate deploy needs/);
+
+    // A bare clone holds no node_modules; the caller names where the packages are installed.
+    const bare = `${r.dir}.git`;
+    r.git(["clone", "-q", "--bare", r.dir, bare]);
+    const fromBare = identityGateAdmissionAt(bare, base, "ops", { packages: r.dir })!;
+    expect(approvals("ops").map((a) => fromBare.refuses(a))).toEqual(ours.ops);
+  });
+
+  test("a path pin's class is read at base, so the change being applied can't remap it", () => {
+    const { r, base, approvals } = setup((k) => ({ ...operatorPolicy(k), ...plugin("plugins/ops", [OPERATOR]) }), { pins: [{ path: "plugins/ops" }] });
+    // After base the plugin moves the operator class to bob's role; base still says operator.
+    install(r, plugin("plugins/ops", [{ ...OPERATOR, role: "runner-ops" }]));
+    r.commit("remaps operator");
+    const ours = judgeBoth(r, base, approvals);
+    expect(ours.ops![1]).toBeNull();
+  });
+
+  test("a pin it cannot read refuses a gate whose class the pin could change, and says why", () => {
+    const { r, base, approvals } = setup(operatorPolicy, { pins: [{ package: "@acme/ops-classes", version: "1.0.0" }] });
+    const missing = identityGateAdmissionAt(r.dir, base, "ops")!;
+    expect(missing.refuses(approvals("ops")[1])).toBe(
+      `identity.gates.ops names the class operator, and the pins in chant.workspace.json at base could not all be read, so no approval can show it is in that class: @acme/ops-classes is not installed under ${r.dir}`,
     );
-    const unread = identityGateAdmissionAt(r.dir, base, "ops")!;
-    expect(unread.refuses(approvals("ops")[1])).toMatch(/is not a core class, and this reader does not load the classes the pinned packages in chant\.workspace\.json at base supply/);
+    // human is everyone in no other class, so an unread pin leaves it unknown too; runner and no class are not affected.
+    expect(identityGateAdmissionAt(r.dir, base, "deploy")!.refuses(approvals("deploy")[1])).toMatch(/names the class human, and the pins .* could not all be read/);
+    expect(identityGateAdmissionAt(r.dir, base, "release")!.refuses(approvals("release")[2])).toBeNull();
+    expect(identityGateAdmissionAt(r.dir, base, "ship")!.refuses(approvals("ship")[1])).toBeNull();
+
+    install(r, plugin("node_modules/@acme/ops-classes", [OPERATOR], "2.0.0"));
+    expect(identityGateAdmissionAt(r.dir, base, "ops")!.refuses(approvals("ops")[1])).toMatch(/: @acme\/ops-classes is pinned at 1\.0\.0, and 2\.0\.0 is installed under /);
+
+    // A class the caller read stands for the pins, as before.
     const read = identityGateAdmissionAt(r.dir, base, "ops", { classes: [{ name: "operator", role: "operator" }] })!;
     expect(read.refuses(approvals("ops")[1])).toBeNull();
     expect(read.refuses(approvals("ops")[0])).toMatch(/not signed/);
   });
 
+  test("an installed package that supplies no such class refuses as chant does", () => {
+    const { r, base, approvals } = setup(operatorPolicy, { pins: [{ package: "@acme/ops-classes", version: "1.0.0" }] });
+    install(r, plugin("node_modules/@acme/ops-classes", [{ ...OPERATOR, name: "deployer" }]));
+    expect(judgeBoth(r, base, approvals).ops![1]).toMatch(/names the class operator, which no pinned package supplies, .*known classes: human, agent, runner, service, deployer/);
+  });
+
   test("passed to decideGateApproval as refuses, it counts what chant's wave gate counts", async () => {
     const { r, base, approvals } = setup((k) => ({
       ".chant/allowed_signers": `alice ${k.alice.pub}\nbob ${k.bob.pub}\n`,