@intentius/chant 0.124.24 → 0.124.26

package/dist/lifecycle/gate-audit.js

@@ -48,6 +48,13 @@
  * - `override`: an apply cites an override that no line holds.
  * - `malformed-line`: a line that is not a gate record. Its content is lost
  *   to the trail, so it is said.
+ * - `carried-without-source`: an approval carried from a gate's alias
+ *   (#3949, `carriedFrom`) whose cited line is not in the cited op's
+ *   ledger. Checked only when that ledger is passed in.
+ *
+ * A carried approval's request is the pending fact of the name it was
+ * carried from, in that op's ledger. When that ledger is not passed in,
+ * neither gap is looked for, and the entry's `carriedFrom` says where to look.
  *
  * ## Sources and ids
  *
@@ -96,7 +103,7 @@ export function isOverrideGate(op, gate) {
 }
 const KNOWN = new Set([
     "version", "kind", "op", "gate", "resolvedBy", "relayedBy", "timestamp", "note", "url", "planDigest", "environment",
-    "approver", "seal", "review", "runId", "expiresAt", "description", "wave", "heldBy", "approvalMode", "rules", "pr", "head", "reviewers",
+    "approver", "seal", "review", "runId", "expiresAt", "description", "wave", "heldBy", "approvalMode", "rules", "pr", "head", "reviewers", "carriedFrom",
 ]);
 const waveOf = (v) => {
     const w = v;
@@ -145,6 +152,10 @@ function approverOf(r) {
     const roles = strings(a.roles);
     return { kind: a.kind, ...(roles ? { roles } : {}) };
 }
+const carriedOf = (v) => {
+    const c = v;
+    return c && typeof c === "object" && typeof c.op === "string" && typeof c.gate === "string" && typeof c.timestamp === "string" ? { op: c.op, gate: c.gate, at: c.timestamp } : undefined;
+};
 const drop = (o) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined));
 const idOf = (...parts) => contentDigest(canonicalJson(parts));
 /** Whether two digests, either absent, can be the same plan: absent matches anything, as an old line records none. */
@@ -174,6 +185,21 @@ export function deriveGateAudit(input) {
     const keyed = (e) => (rekey ? { ...e, id: rekey(e) } : e);
     const entries = [];
     const gaps = [];
+    // #3949: every ledger's requests and approvals by op, for an approval carried from another op's gate.
+    const byOp = new Map();
+    for (const ledger of input.ledgers) {
+        const held = byOp.get(ledger.op) ?? { requests: [], approvals: [] };
+        byOp.set(ledger.op, held);
+        for (const line of ledger.lines) {
+            const r = rowOf(line);
+            if (!r || line.removed || typeof r.gate !== "string" || typeof r.timestamp !== "string")
+                continue;
+            if (r.kind === "pending")
+                held.requests.push({ op: ledger.op, gate: r.gate, at: time(r.timestamp), ...(str(r.planDigest) ? { digest: str(r.planDigest) } : {}) });
+            else
+                held.approvals.push(r);
+        }
+    }
     for (const ledger of input.ledgers) {
         const path = ledger.path ?? `_gates/${ledger.op}.jsonl`;
         const parsed = [];
@@ -249,11 +275,22 @@ export function deriveGateAudit(input) {
                 at: String(r.timestamp),
                 by: String(r.resolvedBy),
                 seal,
-                ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str(r.relayedBy), approver: approverOf(r), note: str(r.note), url: str(r.url), review: reviewOf(r), rules }),
+                ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str(r.relayedBy), approver: approverOf(r), note: str(r.note), url: str(r.url), review: reviewOf(r), rules, carriedFrom: carriedOf(r.carriedFrom) }),
                 detail: extra,
             });
             entries.push(entry);
-            if (!override) {
+            const carried = entry.carriedFrom;
+            if (!override && carried) {
+                const cited = byOp.get(carried.op);
+                const from = `${carried.op}/${carried.gate}`;
+                if (cited && !cited.approvals.some((a) => a.gate === carried.gate && time(String(a.timestamp)) === time(carried.at) && a.resolvedBy === r.resolvedBy)) {
+                    gaps.push({ kind: "carried-without-source", op: ledger.op, gate, ...(digest ? { digest } : {}), detail: `${path} holds an approval of ${gate} by ${entry.by} carried from ${from} at ${carried.at}, and _gates/${carried.op}.jsonl holds no such approval` });
+                }
+                if (cited && !cited.requests.some((q) => q.gate === carried.gate && q.at <= time(carried.at) && compatible(q.digest, digest))) {
+                    gaps.push({ kind: "approval-without-request", op: ledger.op, gate, ...(digest ? { digest } : {}), detail: `${path} holds an approval of ${gate} by ${entry.by} carried from ${from} at ${carried.at} with no pending fact of ${from}${digest ? " and digest" : ""} before it` });
+                }
+            }
+            else if (!override) {
                 const at = time(entry.at);
                 const env = str(r.environment);
                 const asked = requests.some((q) => q.gate === gate && q.at <= at && compatible(q.digest, digest) && (q.environment === undefined || env === undefined || q.environment === env));

package/dist/lifecycle/gate-checkpoint.d.ts

@@ -0,0 +1,78 @@
+/**
+ * A gate's checkpoint (#3947): the step outputs a run held when it stopped at
+ * a gate that resumes, kept on `chant/lifecycle` at
+ * `_gates/<op>/checkpoints/<runId>.json`.
+ *
+ * The run writes the file just before it appends the pending fact, and puts
+ * the file's digest on that fact as `checkpointDigest`. `chant approve`
+ * copies the digest onto the approval, the way it copies the plan digest, and
+ * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * resumes at the gate reads the file back and checks it against the digest
+ * the approver saw, so a value pushed onto the branch after the approval is
+ * refused rather than carried into the steps after the gate.
+ *
+ * Only the outputs some step after the gate references are stored, worked
+ * out from the Op's references (`../op/gate-checkpoint.ts`). An output that
+ * an activity contract marks secret is never stored: the gate doesn't
+ * resume, and the next run starts at the first phase.
+ *
+ * Pure apart from the two git helpers at the bottom.
+ */
+/** One gate checkpoint file. */
+export interface GateCheckpoint {
+    version: 1;
+    /** The op the gate belongs to. */
+    op: string;
+    /** The gate's name. */
+    gate: string;
+    /** The run that stopped at the gate, and the file's name. The pending fact names the same run. */
+    runId: string;
+    /** The commit the run ran at. A resumed run must be at the same one. */
+    commit: string;
+    /** The environment the run was started for (`--env`), when it named one. */
+    environment?: string;
+    /** The plan the run reached the gate with, when the gate binds one. */
+    planDigest?: string;
+    /** Step id to the output that step returned, for each step a later step references. */
+    outputs: Record<string, unknown>;
+}
+/** The prefix a checkpoint digest is written with: the JCS form of the file, hashed with SHA-256. */
+export declare const CHECKPOINT_DIGEST_PREFIX = "jcs1-sha256:";
+/** Whether `raw` is a checkpoint digest this code wrote. */
+export declare function isCheckpointDigest(raw: unknown): raw is string;
+/** The digest of a checkpoint: SHA-256 over its RFC 8785 (JCS) form. Throws when an output can't be put in JSON. */
+export declare function gateCheckpointDigest(checkpoint: GateCheckpoint): string;
+/**
+ * A run id is the checkpoint's file name, so it may hold only letters,
+ * digits, `.`, `_` and `-`, and may not start with a dot. A run named
+ * otherwise (a caller-chosen id with a slash in it) gets no checkpoint.
+ */
+export declare function isCheckpointRunId(runId: string): boolean;
+/** Where the checkpoint of `runId` lives on `chant/lifecycle`: the directory and the file, as `writeBlobToPath` takes them. */
+export declare function gateCheckpointPath(op: string, runId: string): {
+    dir: string;
+    file: string;
+};
+/** The file's text: the checkpoint as JSON, keys sorted, one value per line. */
+export declare function gateCheckpointText(checkpoint: GateCheckpoint): string;
+/**
+ * Put `outputs` in the form a checkpoint stores: each value as JSON would
+ * carry it. Returns the step whose output JSON can't hold (a cycle, a bigint)
+ * instead, so the caller can say which one blocks the gate's resume.
+ */
+export declare function checkpointOutputs(outputs: ReadonlyMap<string, unknown>, ids: readonly string[]): {
+    outputs: Record<string, unknown>;
+} | {
+    unstorable: string;
+};
+/** A checkpoint file's text read back, or null when it isn't one. */
+export declare function parseGateCheckpoint(text: string): GateCheckpoint | null;
+/** Write a checkpoint to the local `chant/lifecycle` branch. Does not push: the pending fact appended after it does. */
+export declare function writeGateCheckpoint(checkpoint: GateCheckpoint, opts?: {
+    cwd?: string;
+}): Promise<void>;
+/** The text of `runId`'s checkpoint for `op`, or null when there is none. */
+export declare function readGateCheckpointText(op: string, runId: string, opts?: {
+    cwd?: string;
+}): Promise<string | null>;
+//# sourceMappingURL=gate-checkpoint.d.ts.map

package/dist/lifecycle/gate-checkpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-checkpoint.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,qGAAqG;AACrG,eAAO,MAAM,wBAAwB,iBAAiB,CAAC;AAIvD,4DAA4D;AAC5D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,MAAM,CAE9D;AAED,oHAAoH;AACpH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,+HAA+H;AAC/H,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAE3F;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CAErE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAe9J;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAkBvE;AAED,wHAAwH;AACxH,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5G;AAED,6EAA6E;AAC7E,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvH"}

package/dist/lifecycle/gate-checkpoint.js

@@ -0,0 +1,103 @@
+/**
+ * A gate's checkpoint (#3947): the step outputs a run held when it stopped at
+ * a gate that resumes, kept on `chant/lifecycle` at
+ * `_gates/<op>/checkpoints/<runId>.json`.
+ *
+ * The run writes the file just before it appends the pending fact, and puts
+ * the file's digest on that fact as `checkpointDigest`. `chant approve`
+ * copies the digest onto the approval, the way it copies the plan digest, and
+ * a seal covers it (`../workspace/trust/gate-seal.ts`). A later run that
+ * resumes at the gate reads the file back and checks it against the digest
+ * the approver saw, so a value pushed onto the branch after the approval is
+ * refused rather than carried into the steps after the gate.
+ *
+ * Only the outputs some step after the gate references are stored, worked
+ * out from the Op's references (`../op/gate-checkpoint.ts`). An output that
+ * an activity contract marks secret is never stored: the gate doesn't
+ * resume, and the next run starts at the first phase.
+ *
+ * Pure apart from the two git helpers at the bottom.
+ */
+import { canonicalJson } from "../effect-receipt.js";
+import { contentDigest } from "../content-digest.js";
+import { sortedJsonReplacer } from "../utils.js";
+import { readBlobFromPath, writeBlobToPath } from "./git.js";
+/** The prefix a checkpoint digest is written with: the JCS form of the file, hashed with SHA-256. */
+export const CHECKPOINT_DIGEST_PREFIX = "jcs1-sha256:";
+const CHECKPOINT_DIGEST_PATTERN = /^jcs1-sha256:[0-9a-f]{64}$/;
+/** Whether `raw` is a checkpoint digest this code wrote. */
+export function isCheckpointDigest(raw) {
+    return typeof raw === "string" && CHECKPOINT_DIGEST_PATTERN.test(raw);
+}
+/** The digest of a checkpoint: SHA-256 over its RFC 8785 (JCS) form. Throws when an output can't be put in JSON. */
+export function gateCheckpointDigest(checkpoint) {
+    return CHECKPOINT_DIGEST_PREFIX + contentDigest(canonicalJson(checkpoint)).slice("sha256:".length);
+}
+/**
+ * A run id is the checkpoint's file name, so it may hold only letters,
+ * digits, `.`, `_` and `-`, and may not start with a dot. A run named
+ * otherwise (a caller-chosen id with a slash in it) gets no checkpoint.
+ */
+export function isCheckpointRunId(runId) {
+    return /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/.test(runId) && runId.length <= 200;
+}
+/** Where the checkpoint of `runId` lives on `chant/lifecycle`: the directory and the file, as `writeBlobToPath` takes them. */
+export function gateCheckpointPath(op, runId) {
+    return { dir: `_gates/${op}/checkpoints`, file: `${runId}.json` };
+}
+/** The file's text: the checkpoint as JSON, keys sorted, one value per line. */
+export function gateCheckpointText(checkpoint) {
+    return `${JSON.stringify(checkpoint, sortedJsonReplacer, 2)}\n`;
+}
+/**
+ * Put `outputs` in the form a checkpoint stores: each value as JSON would
+ * carry it. Returns the step whose output JSON can't hold (a cycle, a bigint)
+ * instead, so the caller can say which one blocks the gate's resume.
+ */
+export function checkpointOutputs(outputs, ids) {
+    const out = {};
+    for (const id of ids) {
+        if (!outputs.has(id))
+            continue;
+        const value = outputs.get(id);
+        try {
+            const text = JSON.stringify(value === undefined ? null : value);
+            const parsed = JSON.parse(text);
+            canonicalJson(parsed);
+            out[id] = parsed;
+        }
+        catch {
+            return { unstorable: id };
+        }
+    }
+    return { outputs: out };
+}
+/** A checkpoint file's text read back, or null when it isn't one. */
+export function parseGateCheckpoint(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const r = raw;
+    if (r === null || typeof r !== "object" || r.version !== 1 || typeof r.op !== "string" || typeof r.gate !== "string" ||
+        typeof r.runId !== "string" || typeof r.commit !== "string" ||
+        r.outputs === null || typeof r.outputs !== "object" || Array.isArray(r.outputs) ||
+        (r.environment !== undefined && typeof r.environment !== "string") ||
+        (r.planDigest !== undefined && typeof r.planDigest !== "string")) {
+        return null;
+    }
+    return r;
+}
+/** Write a checkpoint to the local `chant/lifecycle` branch. Does not push: the pending fact appended after it does. */
+export async function writeGateCheckpoint(checkpoint, opts) {
+    const { dir, file } = gateCheckpointPath(checkpoint.op, checkpoint.runId);
+    await writeBlobToPath(dir, file, gateCheckpointText(checkpoint), `Gate checkpoint for ${checkpoint.gate}`, opts);
+}
+/** The text of `runId`'s checkpoint for `op`, or null when there is none. */
+export async function readGateCheckpointText(op, runId, opts) {
+    const { dir, file } = gateCheckpointPath(op, runId);
+    return readBlobFromPath(dir, file, opts);
+}

package/dist/lifecycle/gate-ledger.d.ts

@@ -75,6 +75,12 @@ export interface GateResolutionRecord {
      * such a record proves is that somebody approved *something*.
      */
     planDigest?: string;
+    /**
+     * The checkpoint this approval lets a run resume from (#3947), copied off
+     * the pending fact it answers. Set only on an approval of a gate that
+     * resumes (`resume: true`) whose run stored a checkpoint. A seal covers it.
+     */
+    checkpointDigest?: string;
     /**
      * The environment this approval is for (#2574), copied off the pending fact
      * it answers. Set for a component gate, whose ledger is keyed by component
@@ -145,12 +151,37 @@ export interface GateResolutionRecord {
      * `constrains` names the gate back (`gate:<op>/<gate>`).
      */
     answer?: GateAnswerRef;
+    /**
+     * The line this approval was carried from (#3949): an approval recorded
+     * under one of the gate's aliases, which a run counted toward the gate and
+     * wrote again under its new name. `op`, `gate` and `timestamp` name that
+     * line; `checkpointDigest` is the one it carried, if any, since a seal
+     * signs it. `resolvedBy`, the plan, the environment and the seal are the
+     * original's, and the seal verifies against the names in here. This
+     * record's own `timestamp` is when it was carried.
+     */
+    carriedFrom?: GateCarriedFrom;
+}
+/** Where a carried approval came from (#3949): the original line's op, gate and time, and its checkpoint digest when it had one. */
+export interface GateCarriedFrom {
+    op: string;
+    gate: string;
+    timestamp: string;
+    checkpointDigest?: string;
 }
+/** Whether `raw` is a {@link GateCarriedFrom}. */
+export declare function isGateCarriedFrom(raw: unknown): raw is GateCarriedFrom;
 /** A gate approval's seal (#3163): who signed, the key's fingerprint (reported, never trusted), and the armored signature. */
 export interface GateApprovalSeal {
     signer: string;
     key: string;
     signature: string;
+    /**
+     * The seal's version (#3947). `2` on a seal over an approval that carries a
+     * `checkpointDigest`, whose payload signs the digest as one more line.
+     * Absent on every other seal, which is version 1.
+     */
+    version?: 2;
 }
 export type GateResolutionInput = Omit<GateResolutionRecord, "version" | "kind">;
 /**
@@ -214,6 +245,16 @@ export interface PendingGateRecord {
      * binds one since #2574.
      */
     planDigest?: string;
+    /**
+     * The digest of the checkpoint the run stored when it stopped here (#3947),
+     * on a gate that resumes (`resume: true`). The file is at
+     * `_gates/<op>/checkpoints/<runId>.json` (`./gate-checkpoint.ts`). `chant
+     * approve` copies it onto the approval, and a run resumes at this gate only
+     * from a checkpoint that matches it. Absent when the gate doesn't resume,
+     * or when its run could not store one, such as when an output it needs is
+     * secret.
+     */
+    checkpointDigest?: string;
     /**
      * The environment the run reached this gate in (#2574). Set by the
      * component driver, whose gate ledger is keyed by component, so pending

package/dist/lifecycle/gate-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI7D,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGxF,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAI9B,sHAAsH;AACtH,eAAO,MAAM,SAAS,WAAM,CAAC;AAI7B;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;CAChC;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,8KAA8K;IAC9K,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,0HAA0H;IAC1H,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,8HAA8H;AAC9H,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,0GAA0G;AAC1G,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,8IAA8I;IAC9I,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,4IAA4I;IAC5I,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAE3E,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAOxE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,SAAK,GAAG,MAAM,CAEpE;AAED,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAI3D;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAiBxD;AA2BD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAInG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,GACd;IAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAyD1F;AAED,oNAAoN;AACpN,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAGjE"}
+{"version":3,"file":"gate-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/gate-ledger.ts"],"names":[],"mappings":"AA6CA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAI7D,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGxF,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,mBAAmB,GACzB,MAAM,sBAAsB,CAAC;AAI9B,sHAAsH;AACtH,eAAO,MAAM,SAAS,WAAM,CAAC;AAI7B;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;CAChC;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,8KAA8K;IAC9K,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,0HAA0H;IAC1H,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,oLAAoL;IACpL,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAC3D;;;;;OAKG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,oIAAoI;AACpI,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,kDAAkD;AAClD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,eAAe,CAMtE;AAED,8HAA8H;AAC9H,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,CAAC;CACb;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,0GAA0G;AAC1G,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,OAAO,EAAE,CAAC,CAAC;IACX,IAAI,EAAE,SAAS,CAAC;IAChB,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,8IAA8I;IAC9I,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,SAAS,EAAE,MAAM,CAAC;IAClB,4IAA4I;IAC5I,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;OAIG;IACH,YAAY,CAAC,EAAE,IAAI,CAAC;IACpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;OAGG;IACH,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;OAIG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,iBAAiB,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAE3E,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAOxE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,SAAK,GAAG,MAAM,CAEpE;AAED,+mBAA+mB;AAC/mB,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC,CAI3D;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAiBxD;AA2BD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAInG;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,GACd;IAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAqE1F;AAED,oNAAoN;AACpN,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAGjE"}

package/dist/lifecycle/gate-ledger.js

@@ -53,6 +53,12 @@ const DIR = "_gates";
 /** The directory on the `chant/lifecycle` branch that holds gate ledgers, under a member's prefix when it has one. */
 export const GATES_DIR = DIR;
 const APPEND_RETRY_ATTEMPTS = 5;
+/** Whether `raw` is a {@link GateCarriedFrom}. */
+export function isGateCarriedFrom(raw) {
+    const c = raw;
+    return (!!c && typeof c === "object" && !Array.isArray(c) && typeof c.op === "string" && typeof c.gate === "string" &&
+        typeof c.timestamp === "string" && (c.checkpointDigest === undefined || typeof c.checkpointDigest === "string"));
+}
 function filename(op) {
     return `${op}.jsonl`;
 }
@@ -166,6 +172,12 @@ export function parseGateLedger(content) {
                 malformed++;
                 continue;
             }
+            // #3947: and for the checkpoint an approval lets a run resume from.
+            const rawCheckpoint = parsed.checkpointDigest;
+            if (rawCheckpoint !== undefined && typeof rawCheckpoint !== "string") {
+                malformed++;
+                continue;
+            }
             if (parsed.kind === "pending") {
                 if (typeof parsed.expiresAt !== "string") {
                     malformed++;
@@ -186,6 +198,12 @@ export function parseGateLedger(content) {
                 malformed++;
                 continue;
             }
+            // #3949: a carried approval's seal is checked against the line it cites, so the citation must be whole.
+            const rawCarried = parsed.carriedFrom;
+            if (rawCarried !== undefined && !isGateCarriedFrom(rawCarried)) {
+                malformed++;
+                continue;
+            }
             resolutions.push(parsed);
         }
         catch {

package/dist/lifecycle/receipt-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receipt-plan.d.ts","sourceRoot":"","sources":["../../src/lifecycle/receipt-plan.ts"],"names":[],"mappings":"AAkCA,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CAIzF;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACpD,oBAAoB,CAiBtB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,EAC7C,QAAQ,EAAE,oBAAoB,GAC7B,cAAc,EAAE,CAoGlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,cAAc,EAAE,cAAc,EAAE,GAC/B,SAAS,CAMX"}
+{"version":3,"file":"receipt-plan.d.ts","sourceRoot":"","sources":["../../src/lifecycle/receipt-plan.ts"],"names":[],"mappings":"AAkCA,OAAO,EAIL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,OAAO,CAIzF;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,4EAA4E;IAC5E,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,GACpD,oBAAoB,CAiBtB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,EAC7C,QAAQ,EAAE,oBAAoB,GAC7B,cAAc,EAAE,CAsGlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvD,cAAc,EAAE,cAAc,EAAE,GAC/B,SAAS,CAMX"}

package/dist/lifecycle/receipt-plan.js

@@ -32,7 +32,7 @@
  * plan's merged observed values).
  */
 import { AttrRef } from "../attrref.js";
-import { EXISTENCE_EXPECTATION, resolveReceiptExpectation, } from "../effect-receipt.js";
+import { EXISTENCE_EXPECTATION, declaredExpectation, resolveReceiptExpectation, } from "../effect-receipt.js";
 /**
  * The attribute a materialized receipt's live value is read from. A lexicon
  * receipt row's observation (#1835) maps the stored value onto
@@ -148,7 +148,9 @@ export function planReceipts(receipts, readings, resolver) {
             });
             continue;
         }
-        if (reading.value === expectation) {
+        // A value an effect step wrote with the digest of the step outputs it read
+        // (#3948) is compared on its declared part: outputs exist only at run.
+        if (typeof reading.value === "string" && declaredExpectation(reading.value) === expectation) {
             entries.push({ ...base, action: "noop", evidence });
             continue;
         }

package/dist/lifecycle/run-ledger.d.ts

@@ -24,6 +24,8 @@ export declare function buildRunRecord(config: Pick<OpConfig, "name" | "labels">
     gate?: OpRunRecord["gate"];
     point?: OpRunRecord["point"];
     steward?: string;
+    /** The gate the run resumed at, for a run that resumed (#3947). */
+    resumed?: OpRunRecord["resumed"];
     /** Each phase's wall-clock time, by name, as the executor measured it. */
     phaseDurations?: Record<string, number>;
 }): OpRunRecordInput;

package/dist/lifecycle/run-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAqC,MAAM,eAAe,CAAC;AAStG,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CA6ClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BxD"}
+{"version":3,"file":"run-ledger.d.ts","sourceRoot":"","sources":["../../src/lifecycle/run-ledger.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAqC,MAAM,eAAe,CAAC;AAStG,0EAA0E;AAC1E,eAAO,MAAM,eAAe,UAAU,CAAC;AAMvC,8FAA8F;AAC9F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,CAEjE;AAQD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC,EACzC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,KAAK,EAAE;IACL,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;IACjC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,gBAAgB,CA+ClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,gBAAgB,EACvB,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAsBlD;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA4BxD"}

package/dist/lifecycle/run-ledger.js

@@ -89,6 +89,7 @@ export function buildRunRecord(config, records, times) {
             ...(record.refusal !== undefined ? { refusal: record.refusal } : {}),
             ...(record.point ? { point: record.point } : {}),
             ...(record.gate ? { gate: record.gate } : {}),
+            ...(record.resumed ? { resumed: record.resumed } : {}),
         });
         if (record.outcome)
             outcomes[record.outcome.name] = record.outcome.value;
@@ -112,6 +113,7 @@ export function buildRunRecord(config, records, times) {
         ...(times.gate ? { gate: times.gate } : {}),
         ...(times.point ? { point: times.point } : {}),
         ...(times.steward ? { steward: times.steward } : {}),
+        ...(times.resumed ? { resumed: times.resumed } : {}),
     };
 }
 /**

package/dist/lint/rules/op/index.d.ts

@@ -14,15 +14,19 @@ export { ops012 } from "./ops012-activity-contract.js";
 export { ops013 } from "./ops013-step-output-ref.js";
 export { ops014 } from "./ops014-converge-rule-refusals.js";
 export { ops015 } from "./ops015-gate-approval.js";
+export { ops016 } from "./ops016-gate-resume.js";
+export { ops017, ops017Check, workspaceIdentityGates } from "./ops017-gate-alias.js";
 export { sys010, sys010Check } from "./sys010-key-over-plain-http.js";
 export interface CoreOpCheckOptions {
     /** `decide.backends` from the project's chant.config, for SYS010 (#2828). */
     decideBackends?: Record<string, Pick<DecideBackend, "url" | "key">>;
+    /** The workspace's `identity.gates`, gate to class, for OPS017 (#3949): `workspaceIdentityGates`' answer. */
+    identityGates?: ReadonlyMap<string, string | null>;
 }
 /**
  * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
- * OPS015, and SYS010 over the `decide` steps and the configured decide
- * backends.
+ * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, and SYS010
+ * over the `decide` steps and the configured decide backends.
  */
 export declare function coreOpChecks(opts?: CoreOpCheckOptions): PostSynthCheck[];
 //# sourceMappingURL=index.d.ts.map

package/dist/lint/rules/op/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAMvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;CACrE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,EAAE,CAE5E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAQvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,iCAAiC,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC;IACpE,6GAA6G;IAC7G,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;CACpD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,kBAAuB,GAAG,cAAc,EAAE,CAE5E"}

package/dist/lint/rules/op/index.js

@@ -12,17 +12,21 @@ import { ops012 } from "./ops012-activity-contract.js";
 import { ops013 } from "./ops013-step-output-ref.js";
 import { ops014 } from "./ops014-converge-rule-refusals.js";
 import { ops015 } from "./ops015-gate-approval.js";
+import { ops016 } from "./ops016-gate-resume.js";
+import { ops017Check } from "./ops017-gate-alias.js";
 import { sys010Check } from "./sys010-key-over-plain-http.js";
 export { ops012 } from "./ops012-activity-contract.js";
 export { ops013 } from "./ops013-step-output-ref.js";
 export { ops014 } from "./ops014-converge-rule-refusals.js";
 export { ops015 } from "./ops015-gate-approval.js";
+export { ops016 } from "./ops016-gate-resume.js";
+export { ops017, ops017Check, workspaceIdentityGates } from "./ops017-gate-alias.js";
 export { sys010, sys010Check } from "./sys010-key-over-plain-http.js";
 /**
  * Core's own post-synth checks over the Op model: OPS012, OPS013, OPS014,
- * OPS015, and SYS010 over the `decide` steps and the configured decide
- * backends.
+ * OPS015, OPS016, OPS017 over the workspace's `identity.gates`, and SYS010
+ * over the `decide` steps and the configured decide backends.
  */
 export function coreOpChecks(opts = {}) {
-    return [ops012, ops013, ops014, ops015, sys010Check(opts.decideBackends)];
+    return [ops012, ops013, ops014, ops015, ops016, ops017Check(opts.identityGates), sys010Check(opts.decideBackends)];
 }

package/dist/lint/rules/op/ops016-gate-resume.d.ts

@@ -0,0 +1,14 @@
+/**
+ * OPS016: a gate that resumes (`resume: true`, #3947) can. It sits at the top
+ * of a main phase, asks no decision point, is not in an Op with a
+ * `workLease`, names a plan step that runs before it when its plan is a
+ * reference, and no step after it reads an output an activity contract marks
+ * secret, since a checkpoint never stores one.
+ *
+ * The run itself treats a gate that fails one of these as one that doesn't
+ * resume. This check makes that a build error instead of a quiet re-run from
+ * the first phase. Contracts come from the same merged map OPS013 uses.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+export declare const ops016: PostSynthCheck;
+//# sourceMappingURL=ops016-gate-resume.d.ts.map

package/dist/lint/rules/op/ops016-gate-resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops016-gate-resume.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops016-gate-resume.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAW9F,eAAO,MAAM,MAAM,EAAE,cAyBpB,CAAC"}

package/dist/lint/rules/op/ops016-gate-resume.js

@@ -0,0 +1,31 @@
+import { mergeActivityContracts } from "../../../op/index.js";
+import { validateGateResume } from "../../../op/gate-checkpoint.js";
+import * as contracts from "../../../op/activities/activity-contracts.js";
+import { isOpEntity } from "./support.js";
+const CONTRACTS = new Map(Object.values(contracts).map((c) => [c.name, c]));
+export const ops016 = {
+    id: "OPS016",
+    description: "A gate with resume: true can resume: at the top of a main phase, no decision point or workLease, a plan step before it, and no secret output read after it",
+    check(ctx) {
+        const diagnostics = [];
+        const activeContracts = mergeActivityContracts(CONTRACTS, ctx.activityContracts);
+        for (const [entityKey, entity] of ctx.entities) {
+            if (!isOpEntity(entity))
+                continue;
+            const rec = entity;
+            const props = (entity.props ?? {});
+            if (typeof props.name !== "string" || !Array.isArray(props.phases))
+                continue;
+            for (const issue of validateGateResume(props, activeContracts)) {
+                diagnostics.push({
+                    checkId: "OPS016",
+                    severity: "error",
+                    message: `Op "${issue.opName}", phase "${issue.phase}", ${issue.fn}: ${issue.message}`,
+                    entity: entityKey,
+                    lexicon: typeof rec.lexicon === "string" ? rec.lexicon : undefined,
+                });
+            }
+        }
+        return diagnostics;
+    },
+};

package/dist/lint/rules/op/ops017-gate-alias.d.ts

@@ -0,0 +1,30 @@
+/**
+ * OPS017: a gate's aliases (#3949) can stand. An alias admits approvals of
+ * the plan a run planned, so the gate must bind a `plan`, and a gate that
+ * asks a decision point takes none. An alias must not name a gate that still
+ * exists in the build, or one approval would answer two gates, and two gates
+ * must not claim one alias. When the workspace's `identity.gates` names an
+ * alias, the new gate must be named too, with the alias's class, or
+ * approvals that needed a seal would count without one.
+ *
+ * The identity rules come from the caller, as SYS010's decide backends do:
+ * `chant build` and `chant lint` read them with
+ * {@link workspaceIdentityGates}, which loads workspace code only when an Op
+ * has aliases and the project sits in a workspace. Without them that part
+ * is skipped.
+ */
+import type { PostSynthCheck } from "../../post-synth.js";
+/**
+ * The gates the workspace around `projectDir` names under `identity.gates`,
+ * each with its class (null for any signer), for OPS017. Undefined when no
+ * Op among `entities` has aliases, outside a workspace, or when the
+ * declaration can't be read, which `chant workspace check` reports. The
+ * workspace modules load only past the first two checks, so a level-0
+ * build loads none.
+ */
+export declare function workspaceIdentityGates(projectDir: string, entities: Iterable<[string, unknown]>): Promise<Map<string, string | null> | undefined>;
+/** OPS017, judging `identity.gates` by `identityGates` when given. */
+export declare function ops017Check(identityGates?: ReadonlyMap<string, string | null>): PostSynthCheck;
+/** OPS017 without the workspace's identity rules. */
+export declare const ops017: PostSynthCheck;
+//# sourceMappingURL=ops017-gate-alias.d.ts.map

package/dist/lint/rules/op/ops017-gate-alias.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops017-gate-alias.d.ts","sourceRoot":"","sources":["../../../../src/lint/rules/op/ops017-gate-alias.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AAsB9F;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC,CAYjD;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,GAAG,cAAc,CAsB9F;AAED,qDAAqD;AACrD,eAAO,MAAM,MAAM,EAAE,cAA8B,CAAC"}