@intentius/chant 0.124.24 → 0.124.26

package/dist/op/gate-checkpoint.js

@@ -0,0 +1,280 @@
+/**
+ * Resuming a run at an approved gate (#3947, epic #3946).
+ *
+ * Before this, a run that stopped at a gate kept nothing but its record:
+ * after `chant approve`, the next `chant run <op>` began again at the first
+ * phase and recomputed every step before the gate, so a value could not be
+ * carried across a gate with `stepOutput`. A gate with `resume: true` keeps
+ * the outputs the steps after it need, and the next run starts at the gate.
+ *
+ * Stopping. The run works out which outputs cross the gate from the Op's own
+ * references ({@link resumeGatesOf}): an output of a step before the gate
+ * that a step at or after it references, in the main phases, `onFailure` or
+ * the gate's own `approval` context. It writes them to a checkpoint
+ * (`../lifecycle/gate-checkpoint.ts`) and puts the checkpoint's digest on
+ * the pending fact. An output an activity contract marks secret is never
+ * stored, and the gate then doesn't resume ({@link checkpointBlocked}).
+ *
+ * Resuming. {@link decideGateResume} picks the last resume gate whose
+ * standing pending fact carries a checkpoint and has an approval that copied
+ * it. It resumes there only when the fact hasn't expired, the checkpoint file
+ * matches the digest the approver saw and names the fact's run, and this run
+ * is at the same commit and environment. Any failed check starts the run at
+ * the first phase and the reason is reported. The executor then re-runs the
+ * step that produced the gate's `plan`, and starts at the first phase if the
+ * digest moved, so live drift between the approval and the apply is still
+ * caught (`./local-executor.ts`).
+ */
+import { WORK_LEASE_STEP_ID } from "./types.js";
+import { collectStepOutputRefs, isStepOutputRef } from "./step-output-ref.js";
+import { gateName } from "./gate-name.js";
+import { readsSecretOutput } from "./activity-contract.js";
+import { isPendingGateExpired, latestPendingGate } from "../lifecycle/gate-ledger.js";
+import { isApprovalSpent } from "../lifecycle/gate-applied.js";
+import { samePlanDigest } from "../lifecycle/plan-digest.js";
+import { checkpointOutputs, gateCheckpointDigest, gateCheckpointPath, isCheckpointRunId, parseGateCheckpoint, } from "../lifecycle/gate-checkpoint.js";
+/** The step-output references a step reads when it runs: its args, a gate's plan, approval context and point inputs, and an effect's receipt and nested steps. */
+function refsOfStep(step) {
+    if (step.kind === "activity")
+        return collectStepOutputRefs(step.args);
+    if (step.kind === "gate") {
+        const point = typeof step.point === "object" ? step.point.inputs : undefined;
+        return [
+            ...(isStepOutputRef(step.plan) ? [step.plan] : []),
+            ...collectStepOutputRefs(step.approval?.context),
+            ...collectStepOutputRefs(point),
+        ];
+    }
+    return [...collectStepOutputRefs(step.receipt), ...step.steps.flatMap(refsOfStep)];
+}
+/** Every gate step of `config` with `resume: true` that isn't at the top of a main phase. */
+function misplacedResumeGates(config) {
+    const out = [];
+    for (const phase of config.phases) {
+        for (const step of phase.steps) {
+            if (step.kind === "effect")
+                for (const n of step.steps)
+                    if (n.kind === "gate" && n.resume)
+                        out.push({ phase: phase.name, gate: n });
+        }
+    }
+    for (const phase of config.onFailure ?? []) {
+        for (const step of phase.steps) {
+            if (step.kind === "gate" && step.resume)
+                out.push({ phase: phase.name, gate: step });
+            if (step.kind === "effect")
+                for (const n of step.steps)
+                    if (n.kind === "gate" && n.resume)
+                        out.push({ phase: phase.name, gate: n });
+        }
+    }
+    return out;
+}
+/**
+ * The gates of `config` that resume, at the top of a main phase, in authored
+ * order, each with the outputs a checkpoint at it stores. A gate that asks a
+ * decision point, or one in an Op with a `workLease`, is left out: OPS016
+ * refuses both, and a run treats them as gates that don't resume.
+ */
+export function resumeGatesOf(config) {
+    if (config.workLease)
+        return [];
+    const out = [];
+    config.phases.forEach((phase, phaseIndex) => {
+        phase.steps.forEach((step, stepIndex) => {
+            if (step.kind !== "gate" || !step.resume || step.point !== undefined)
+                return;
+            // The steps that have finished when the run reaches the gate. In a
+            // parallel phase the gates are decided before any activity starts.
+            const before = new Map();
+            config.phases.forEach((p, pi) => {
+                if (pi > phaseIndex)
+                    return;
+                p.steps.forEach((s, si) => {
+                    if (s.kind !== "activity" || !s.id)
+                        return;
+                    if (pi === phaseIndex && (p.parallel || si >= stepIndex))
+                        return;
+                    before.set(s.id, { step: s, phaseIndex: pi, stepIndex: si });
+                });
+            });
+            const planStep = isStepOutputRef(step.plan) ? before.get(step.plan.step) : undefined;
+            // What reads them: the gate and every step after it, the compensation
+            // phases, the work lease, and the plan step, which runs again.
+            const after = [
+                ...(phase.parallel ? phase.steps : phase.steps.slice(stepIndex)),
+                ...config.phases.slice(phaseIndex + 1).flatMap((p) => p.steps),
+                ...(config.onFailure ?? []).flatMap((p) => p.steps),
+                ...(planStep ? [planStep.step] : []),
+            ];
+            const crossing = after.flatMap(refsOfStep).filter((ref) => ref.step !== WORK_LEASE_STEP_ID && ref.step !== planStep?.step.id && before.has(ref.step));
+            const ids = new Set(crossing.map((r) => r.step));
+            const stored = [...before.values()]
+                .filter((p) => ids.has(p.step.id))
+                .sort((a, b) => a.phaseIndex - b.phaseIndex || a.stepIndex - b.stepIndex)
+                .map((p) => p.step.id);
+            out.push({ step, name: gateName(step), phaseIndex, stepIndex, ...(planStep ? { planStep } : {}), stored, crossing });
+        });
+    });
+    return out;
+}
+/** The step id that produced `ref`, and its activity, among the steps before `gate`. */
+function producerOf(config, ref) {
+    for (const phase of config.phases) {
+        for (const step of phase.steps)
+            if (step.kind === "activity" && step.id === ref.step)
+                return step;
+    }
+    return undefined;
+}
+/**
+ * Why a checkpoint at `gate` can't hold what the steps after it read, or
+ * undefined when it can (#3947): a reference to an output the producer's
+ * contract marks secret. Secret outputs are never stored.
+ */
+export function checkpointBlocked(config, gate, contracts) {
+    if (!contracts)
+        return undefined;
+    for (const ref of gate.crossing) {
+        const producer = producerOf(config, ref);
+        if (producer && readsSecretOutput(contracts.get(producer.fn), ref.path)) {
+            const what = ref.path ? `output "${ref.path}"` : "output";
+            return `step "${ref.step}"'s ${what} is secret (the ${producer.fn} contract marks it), and a checkpoint never stores a secret`;
+        }
+    }
+    return undefined;
+}
+/**
+ * OPS016's check (#3947): what is wrong with the gates of `config` that set
+ * `resume`. A gate that resumes must sit at the top of a main phase, must not
+ * ask a decision point, must not be in an Op with a `workLease`, must name a
+ * plan step that runs before it when its plan is a reference, and must not
+ * need a secret output after it.
+ */
+export function validateGateResume(config, contracts) {
+    const issues = [];
+    const issue = (phase, gate, message) => issues.push({ opName: config.name, phase, fn: `gate:${gateName(gate)}`, message });
+    for (const { phase, gate } of misplacedResumeGates(config)) {
+        issue(phase, gate, "resume is supported only on a gate at the top of a main phase, not in onFailure or inside an effect");
+    }
+    config.phases.forEach((phase) => {
+        for (const step of phase.steps) {
+            if (step.kind !== "gate" || !step.resume)
+                continue;
+            if (config.workLease)
+                issue(phase.name, step, "a gate can't resume in an Op that runs under a workLease");
+            if (step.point !== undefined)
+                issue(phase.name, step, "a gate that asks a decision point can't resume");
+        }
+    });
+    for (const gate of resumeGatesOf(config)) {
+        const phase = config.phases[gate.phaseIndex].name;
+        if (isStepOutputRef(gate.step.plan) && !gate.planStep) {
+            issue(phase, gate.step, `its plan names step "${gate.step.plan.step}", which must be an activity that runs before the gate at the top of a main phase, so a resumed run can run it again`);
+        }
+        const blocked = checkpointBlocked(config, gate, contracts);
+        if (blocked)
+            issue(phase, gate.step, `can't resume: ${blocked}`);
+    }
+    return issues;
+}
+/**
+ * Build the checkpoint a run stores when it stops at `gate`, or say why it
+ * stores none: a secret output, an unknown commit, a run id that can't name
+ * a file, or an output JSON can't hold.
+ */
+export function buildGateCheckpoint(config, gate, input) {
+    const secret = checkpointBlocked(config, gate, input.contracts);
+    if (secret)
+        return { blocked: secret };
+    if (input.commit === undefined)
+        return { blocked: "the commit this run is at could not be read, and a resumed run must be at the same one" };
+    if (!isCheckpointRunId(input.runId))
+        return { blocked: `the run id "${input.runId}" can't name a checkpoint file` };
+    const stored = checkpointOutputs(input.outputs, gate.stored);
+    if ("unstorable" in stored)
+        return { blocked: `step "${stored.unstorable}"'s output can't be stored as JSON` };
+    return {
+        checkpoint: {
+            version: 1,
+            op: config.name,
+            gate: gate.name,
+            runId: input.runId,
+            commit: input.commit,
+            ...(input.environment !== undefined ? { environment: input.environment } : {}),
+            ...(input.planDigest !== undefined ? { planDigest: input.planDigest } : {}),
+            outputs: stored.outputs,
+        },
+    };
+}
+/**
+ * Decide whether this run resumes, and at which gate. The last resume gate
+ * whose standing pending fact carries a checkpoint, and which an approval
+ * recorded since then copied, is the candidate. Approved gates are tried
+ * from the last one back, so a run that resumed at one gate and stopped at a
+ * later one resumes at the later one next time.
+ *
+ * Reads the gate ledger and the checkpoint file and writes nothing. A gate
+ * with no checkpoint, or none an approval copied, is not a candidate: the run
+ * starts at the first phase as before, and says nothing.
+ */
+export async function decideGateResume(port, config, input) {
+    const gates = resumeGatesOf(config);
+    if (gates.length === 0)
+        return { kind: "none" };
+    const ledger = await port.read(config.name);
+    const spent = port.readApplied ? await port.readApplied(config.name) : [];
+    const at = (iso) => new Date(iso).getTime();
+    for (const gate of [...gates].reverse()) {
+        const standing = latestPendingGate(ledger.pending, gate.name);
+        const digest = standing?.checkpointDigest;
+        if (!standing || digest === undefined)
+            continue;
+        // #3949: an approval carried from an alias never saw this gate's
+        // checkpoint, so it doesn't let the run resume. The run starts at the
+        // first phase and the carried approval passes the gate when it gets there.
+        const approved = ledger.resolutions.some((r) => r.gate === gate.name && r.carriedFrom === undefined && r.checkpointDigest === digest && at(r.timestamp) >= at(standing.timestamp) &&
+            samePlanDigest(r.planDigest, standing.planDigest) && !isApprovalSpent(spent, r));
+        if (!approved)
+            continue;
+        const refuse = (reason) => ({ kind: "refused", gate: gate.name, reason });
+        if (isPendingGateExpired(standing, input.now))
+            return refuse(`its pending fact expired at ${standing.expiresAt}`);
+        if (!standing.runId)
+            return refuse("its pending fact names no run");
+        const { dir, file } = gateCheckpointPath(config.name, standing.runId);
+        const text = port.readCheckpoint ? await port.readCheckpoint(config.name, standing.runId) : null;
+        if (text === null)
+            return refuse(`the checkpoint ${dir}/${file} is not on the ledger`);
+        const checkpoint = parseGateCheckpoint(text);
+        if (checkpoint === null)
+            return refuse(`${dir}/${file} is not a checkpoint`);
+        let actual;
+        try {
+            actual = gateCheckpointDigest(checkpoint);
+        }
+        catch {
+            return refuse(`${dir}/${file} is not a checkpoint`);
+        }
+        if (actual !== digest)
+            return refuse(`${dir}/${file} does not match the digest the approver saw (${digest}, the file is ${actual})`);
+        if (checkpoint.op !== config.name || checkpoint.gate !== gate.name || checkpoint.runId !== standing.runId) {
+            return refuse(`${dir}/${file} is for ${checkpoint.op} / ${checkpoint.gate}, run ${checkpoint.runId}`);
+        }
+        if (!samePlanDigest(checkpoint.planDigest, standing.planDigest))
+            return refuse(`${dir}/${file} names another plan than the pending fact`);
+        if (input.commit === undefined)
+            return refuse("the commit this run is at could not be read");
+        if (input.commit !== checkpoint.commit) {
+            return refuse(`the run that stopped there was at commit ${checkpoint.commit.slice(0, 12)}, and this one is at ${input.commit.slice(0, 12)}`);
+        }
+        if (input.environment !== checkpoint.environment) {
+            return refuse(`the run that stopped there was for environment ${checkpoint.environment ?? "(none)"}, and this one is for ${input.environment ?? "(none)"}`);
+        }
+        const missing = gate.stored.find((id) => !(id in checkpoint.outputs));
+        if (missing !== undefined)
+            return refuse(`${dir}/${file} holds no output for step "${missing}"`);
+        return { kind: "resume", gate, checkpoint, digest, pending: standing };
+    }
+    return { kind: "none" };
+}

package/dist/op/gate.d.ts

@@ -34,6 +34,8 @@
 import { type GateResolutionInput, type GateResolutionRecord, type PendingGateInput, type PendingGateRecord } from "../lifecycle/gate-ledger.js";
 import { type AppliedGateRecord } from "../lifecycle/gate-applied.js";
 import { type GateApprover, type ResolvedGateApproval } from "./gate-approval.js";
+import { type GateCheckpoint } from "../lifecycle/gate-checkpoint.js";
+import type { ResolvedGateAlias } from "./gate-alias.js";
 /**
  * What appending a pending fact learned about reaching the remote.
  *
@@ -89,6 +91,15 @@ export interface GateLedgerPort {
         pushed: boolean;
         pushWarning?: string;
     }>;
+    /**
+     * Store the checkpoint of a run that stops at a gate that resumes (#3947),
+     * at `_gates/<op>/checkpoints/<runId>.json`. Written before the pending
+     * fact that names its digest, and pushed with it. Absent on a port that
+     * keeps none, and the gate then doesn't resume.
+     */
+    writeCheckpoint?(checkpoint: GateCheckpoint): Promise<void>;
+    /** The text of a run's checkpoint, or null when there is none (#3947). */
+    readCheckpoint?(op: string, runId: string): Promise<string | null>;
 }
 /** A workspace's rule for which approvals of a gate count (#3163): a signed approval, from a class when it names one. */
 export interface GateApprovalRule {
@@ -123,6 +134,8 @@ export declare function memoryGateLedgerPort(seed?: {
     appended: PendingGateRecord[];
     resolved: GateResolutionRecord[];
     applied: AppliedGateRecord[];
+    /** Checkpoint texts by `<op>/<runId>` (#3947). */
+    checkpoints: Map<string, string>;
 };
 /** What a caller has to say about the gate it just reached. */
 export interface GateCheckInput {
@@ -178,6 +191,24 @@ export interface GateCheckInput {
     fields?: Record<string, unknown>;
     /** The pending fact it records carries `neverOverMcp` (#3821, chant#3485). */
     neverOverMcp?: boolean;
+    /**
+     * The checkpoint of a run at a gate that resumes (#3947). Given, a pending
+     * fact this records first stores it through the port's `writeCheckpoint`
+     * and carries its digest as `checkpointDigest`. A standing fact with no
+     * checkpoint is recorded again, so the gate gets one.
+     */
+    checkpoint?: GateCheckpoint;
+    /**
+     * The gate's old names (#3949), each with its Op filled in
+     * (`resolveGateAliases` in `./gate-alias.ts`). Read only on a gate bound
+     * to a plan. A person's approval recorded under one counts toward this
+     * gate when it answers that name's standing pending fact, the fact hasn't
+     * expired, it is for `planDigest` and `environment`, neither name has
+     * spent it, and it passes this gate's approval rule. An approval this
+     * counts is written again under this gate (`carriedFrom`), and a line
+     * carried earlier counts only while its alias is still declared.
+     */
+    aliases?: readonly ResolvedGateAlias[];
 }
 /**
  * A standing resolution that answers this gate but not this plan (#2300) —
@@ -221,11 +252,14 @@ export type GateCheck = {
     /**
      * Set on a gate that declares `approval` (#2508). `"quorum"` when enough
      * human approvals were recorded, `"policy"` when an `enforce`-mode permit
-     * passed it on its own.
+     * passed it on its own. `"alias"` (#3949) when an approval recorded
+     * under one of the gate's aliases counted, on any gate.
      */
-    via?: "quorum" | "policy";
+    via?: "quorum" | "policy" | "alias";
     /** Every approval that counted toward the quorum. Set with `via`. */
     approvals?: GateResolutionRecord[];
+    /** The approvals this run carried from an alias and wrote under the gate's name (#3949). Set when `via` is `"alias"`. */
+    carried?: GateResolutionRecord[];
 } | {
     satisfied: false;
     pending: PendingGateRecord;
@@ -306,6 +340,24 @@ export declare function tallyGateApprovals(records: GateResolutionRecord[], gate
  * and environment are read.
  */
 export declare function humanQuorumSince(pending: readonly PendingGateRecord[], standing: PendingGateRecord): string;
+/**
+ * The approvals that answer `standing` (#3949): of its gate, environment and
+ * plan, recorded since it, or on a gate with an `approval` block since the
+ * human quorum's anchor ({@link humanQuorumSince}). The rule
+ * `resolutionAnswering` (`./gate-resume.ts`) decides by, without the tally:
+ * each one counts on its own toward a gate an alias names.
+ */
+export declare function approvalsAnswering(resolutions: readonly GateResolutionRecord[], standing: PendingGateRecord, pending?: readonly PendingGateRecord[]): GateResolutionRecord[];
+/**
+ * The line a run writes for an approval it carries from an alias (#3949):
+ * the approval under `op`/`gate` at `now`, citing the line it came from.
+ * The approver, plan, environment, relay and seal are the original's. A
+ * policy decision is left behind, since it was evaluated against another
+ * gate, and so is a checkpoint digest, which moves onto `carriedFrom`: the
+ * approver saw that checkpoint, not one this gate stores, so a carried
+ * approval never lets a run resume.
+ */
+export declare function carriedApproval(r: GateResolutionRecord, op: string, gate: string, now: string): GateResolutionInput;
 /**
  * Decide a gate against the ledger, recording the pending fact when it isn't
  * answered.

package/dist/op/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/op/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAA2D,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE5H,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAMlG;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IACjG,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChI;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtF,kIAAkI;IAClI,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,uFAAuF;IACvF,aAAa,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAuDzE;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAClC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAO,GAChH,cAAc,GAAG;IAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAAC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;CAAE,CAkCpH;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,UAAQ,GAAG,MAAM,CAgBnH;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GACjB;IACE,SAAS,EAAE,IAAI,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,oBAAoB,CAAC;IACjC;;;;OAIG;IACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,qEAAqE;IACrE,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACpC,GACD;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,kFAAkF;IAClF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAAC;AAEN,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iJAAiJ;AACjJ,wBAAgB,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,YAAY,CAGrE;AAED,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,uHAAuH;IACvH,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,uNAAuN;IACvN,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,GAAE,MAAiB,GAChC,SAAS,CAiDX;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAc3G;AAUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAsHlG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CAK1H;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9F"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/op/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAA2D,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE5H,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAKlG,OAAO,EAAyF,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1J,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IACjG,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChI;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtF,kIAAkI;IAClI,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,uFAAuF;IACvF,aAAa,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F;;;;;OAKG;IACH,eAAe,CAAC,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CA8DzE;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAClC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAO,GAChH,cAAc,GAAG;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kDAAkD;IAClD,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CA0CA;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACxC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,UAAQ,GAAG,MAAM,CAgBnH;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GACjB;IACE,SAAS,EAAE,IAAI,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,oBAAoB,CAAC;IACjC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;IACpC,qEAAqE;IACrE,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,yHAAyH;IACzH,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAClC,GACD;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,kFAAkF;IAClF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAAC;AAEN,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iJAAiJ;AACjJ,wBAAgB,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,YAAY,CAGrE;AAED,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,uHAAuH;IACvH,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,uNAAuN;IACvN,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,GAAE,MAAiB,GAChC,SAAS,CAiDX;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAc3G;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,GACjD,oBAAoB,EAAE,CAOxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAsBnH;AAsDD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAkKlG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CAK1H;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9F"}

package/dist/op/gate.js

@@ -41,6 +41,7 @@ import { pushLifecycleReport, readBlobBySha, readBlobFromPath, readPathSha, requ
 import { parseDuration } from "./duration.js";
 import { resolveGateRunLocator } from "./gate-run-locator.js";
 import { refuseGateWithoutRecording } from "../lifecycle/no-record.js";
+import { gateCheckpointDigest, gateCheckpointText, readGateCheckpointText, writeGateCheckpoint } from "../lifecycle/gate-checkpoint.js";
 /**
  * The real port: the `chant/lifecycle` orphan branch.
  *
@@ -80,6 +81,13 @@ export function gitGateLedgerPort(opts) {
             const { record } = await appendPendingGate(input, opts);
             return { record, ...(await pushLifecycleReport(opts)) };
         },
+        async writeCheckpoint(checkpoint) {
+            await writeGateCheckpoint(checkpoint, opts);
+        },
+        async readCheckpoint(op, runId) {
+            await requireLifecycleLedger(opts);
+            return readGateCheckpointText(op, runId, opts);
+        },
         async readApplied(op) {
             await requireLifecycleLedger(opts);
             const { dir, file } = appliedGatePath(op);
@@ -118,10 +126,18 @@ export function memoryGateLedgerPort(seed = {}) {
     const appended = [];
     const resolved = [];
     const applied = [...(seed.applied ?? [])];
+    const checkpoints = new Map();
     return {
         appended,
         resolved,
         applied,
+        checkpoints,
+        async writeCheckpoint(checkpoint) {
+            checkpoints.set(`${checkpoint.op}/${checkpoint.runId}`, gateCheckpointText(checkpoint));
+        },
+        async readCheckpoint(op, runId) {
+            return checkpoints.get(`${op}/${runId}`) ?? null;
+        },
         async readApplied(op) {
             return applied.filter((a) => a.op === op);
         },
@@ -278,6 +294,88 @@ export function humanQuorumSince(pending, standing) {
     }
     return anchor.timestamp;
 }
+/**
+ * The approvals that answer `standing` (#3949): of its gate, environment and
+ * plan, recorded since it, or on a gate with an `approval` block since the
+ * human quorum's anchor ({@link humanQuorumSince}). The rule
+ * `resolutionAnswering` (`./gate-resume.ts`) decides by, without the tally:
+ * each one counts on its own toward a gate an alias names.
+ */
+export function approvalsAnswering(resolutions, standing, pending = [standing]) {
+    const since = new Date(standing.approval ? humanQuorumSince(pending, standing) : standing.timestamp).getTime();
+    return resolutions.filter((r) => r.gate === standing.gate && r.environment === standing.environment && samePlanDigest(r.planDigest, standing.planDigest) &&
+        new Date(r.timestamp).getTime() >= since);
+}
+/**
+ * The line a run writes for an approval it carries from an alias (#3949):
+ * the approval under `op`/`gate` at `now`, citing the line it came from.
+ * The approver, plan, environment, relay and seal are the original's. A
+ * policy decision is left behind, since it was evaluated against another
+ * gate, and so is a checkpoint digest, which moves onto `carriedFrom`: the
+ * approver saw that checkpoint, not one this gate stores, so a carried
+ * approval never lets a run resume.
+ */
+export function carriedApproval(r, op, gate, now) {
+    return {
+        op,
+        gate,
+        resolvedBy: r.resolvedBy,
+        ...(r.relayedBy !== undefined ? { relayedBy: r.relayedBy } : {}),
+        timestamp: now,
+        ...(r.note ? { note: r.note } : {}),
+        ...(r.url ? { url: r.url } : {}),
+        ...(r.planDigest !== undefined ? { planDigest: r.planDigest } : {}),
+        ...(r.environment !== undefined ? { environment: r.environment } : {}),
+        ...(r.origin ? { origin: r.origin } : {}),
+        ...(r.sameOriginOverride ? { sameOriginOverride: true } : {}),
+        approver: approverOf(r),
+        ...(r.seal ? { seal: r.seal } : {}),
+        carriedFrom: {
+            op: r.op,
+            gate: r.gate,
+            timestamp: r.timestamp,
+            ...(r.checkpointDigest !== undefined ? { checkpointDigest: r.checkpointDigest } : {}),
+        },
+    };
+}
+/**
+ * The approvals recorded under `input.aliases` that may count toward this
+ * gate (#3949), oldest first. Each answers its alias's standing pending
+ * fact, which hasn't expired and was recorded for this plan and
+ * environment. Each is a person's, is spent under neither name, hasn't been
+ * carried already (`ledger` is this gate's own, so a carried line that was
+ * spent keeps its original from being carried again), and passes `rule`,
+ * whose seal check reads the names the approval was signed under. One the
+ * rule refuses is added to `refused`.
+ */
+async function aliasApprovals(port, input, ledger, rule, now, refused) {
+    const at = (iso) => new Date(iso).getTime();
+    const carried = ledger.filter((r) => r.gate === input.gate && r.carriedFrom !== undefined);
+    const wasCarried = (r) => carried.some((c) => c.carriedFrom.op === r.op && c.carriedFrom.gate === r.gate && at(c.carriedFrom.timestamp) === at(r.timestamp) && c.resolvedBy === r.resolvedBy);
+    const ledgers = new Map();
+    const out = [];
+    for (const alias of input.aliases) {
+        let other = ledgers.get(alias.op);
+        if (!other)
+            ledgers.set(alias.op, (other = await port.read(alias.op)));
+        const pending = other.pending.filter((p) => p.environment === input.environment);
+        const standing = latestPendingGate(pending, alias.gate);
+        if (!standing || isPendingGateExpired(standing, now) || !samePlanDigest(standing.planDigest, input.planDigest))
+            continue;
+        const spent = alias.op === input.op && input.spent ? input.spent : ((await port.readApplied?.(alias.op)) ?? []);
+        for (const r of approvalsAnswering(other.resolutions, standing, pending)) {
+            if (r.carriedFrom !== undefined || approverOf(r).kind !== "human" || isApprovalSpent(spent, r) || wasCarried(r))
+                continue;
+            const reason = rule?.refuses(r) ?? null;
+            if (reason !== null) {
+                refused.push({ resolution: r, reason: `carried from ${alias.op}/${alias.gate}: ${reason}` });
+                continue;
+            }
+            out.push(r);
+        }
+    }
+    return out.sort((a, b) => at(a.timestamp) - at(b.timestamp));
+}
 /** Whether two resolved approval blocks are the same, so a standing pending fact still describes this gate. */
 function sameApproval(a, b) {
     return JSON.stringify(a ?? null, sortedJsonReplacer) === JSON.stringify(b ?? null, sortedJsonReplacer);
@@ -322,11 +420,16 @@ export async function evaluateGate(port, input) {
     const rule = (await port.approvalRule?.(input.gate)) ?? null;
     const standing = latestPendingGate(pending, input.gate);
     const since = standing?.timestamp ?? EPOCH;
+    // #3949: aliases admit only approvals of this run's plan, and carrying one writes a line.
+    const aliases = input.planDigest !== undefined && port.appendResolution ? (input.aliases ?? []) : [];
+    const aliased = (from) => aliases.some((a) => a.op === from.op && a.gate === from.gate);
     // #3841: an approval of this plan the rule refuses is named, so a wait says why.
     const refused = [];
     const resolutions = (env === undefined
         ? ledger.resolutions
         : ledger.resolutions.filter((r) => r.environment === undefined || r.environment === env))
+        // #3949: a carried approval counts only while the gate still names its alias.
+        .filter((r) => r.gate !== input.gate || r.carriedFrom === undefined || aliased(r.carriedFrom))
         .filter((r) => input.spent === undefined || r.gate !== input.gate || !isApprovalSpent(input.spent, r))
         .filter((r) => {
         if (rule === null || r.gate !== input.gate)
@@ -338,7 +441,15 @@ export async function evaluateGate(port, input) {
             refused.push({ resolution: r, reason });
         return false;
     });
+    const fromAliases = aliases.length > 0 ? await aliasApprovals(port, { ...input, aliases }, ledger.resolutions, rule, now, refused) : [];
     refused.sort((a, b) => new Date(a.resolution.timestamp).getTime() - new Date(b.resolution.timestamp).getTime());
+    // #3949: write the approvals that counted from an alias under this gate.
+    const carry = async (records) => {
+        const written = [];
+        for (const r of records)
+            written.push((await port.appendResolution(carriedApproval(r, input.op, input.gate, now))).record);
+        return written;
+    };
     let mismatched;
     let quorum;
     if (input.approval) {
@@ -362,11 +473,30 @@ export async function evaluateGate(port, input) {
         }
         mismatched = tally.mismatched;
         quorum = { approvers: tally.counted.map((r) => r.resolvedBy), need: tally.need };
+        // #3949: old and new approvals add up toward one quorum, each approver once.
+        const counted = new Set(tally.counted.map((r) => r.resolvedBy));
+        const extra = fromAliases.filter((r) => !counted.has(r.resolvedBy));
+        if (extra.length > 0) {
+            const asCarried = new Map(extra.map((r) => [{ version: 1, ...carriedApproval(r, input.op, input.gate, now) }, r]));
+            const combined = tallyGateApprovals([...resolutions, ...asCarried.keys()], input.gate, since, input.planDigest, input.approval, humansSince);
+            if (combined.counted.length >= combined.need) {
+                const written = await carry(combined.counted.filter((r) => asCarried.has(r)).map((r) => asCarried.get(r)));
+                const approvals = [...combined.counted.filter((r) => !asCarried.has(r)), ...written];
+                return { satisfied: true, resolution: written[written.length - 1], via: "alias", approvals, carried: written };
+            }
+            quorum = { approvers: combined.counted.map((r) => r.resolvedBy), need: combined.need };
+        }
     }
     else {
         const found = latestResolutionForPlan(resolutions, input.gate, since, input.planDigest);
         if (found.resolution)
             return { satisfied: true, resolution: found.resolution };
+        // #3949: else the newest approval an alias admits passes it, written under this gate.
+        const newest = fromAliases[fromAliases.length - 1];
+        if (newest) {
+            const written = await carry([newest]);
+            return { satisfied: true, resolution: written[0], via: "alias", carried: written };
+        }
         mismatched = found.mismatched;
     }
     // `input.planDigest` is defined whenever `mismatched` is — `latestResolutionForPlan`
@@ -389,10 +519,20 @@ export async function evaluateGate(port, input) {
     // The same holds for the approval block (#2508): a pending fact recorded
     // under another policy version or another context would have `chant
     // approve` evaluate the policy against something this run no longer has.
+    // #3947: and for the checkpoint, so a gate that resumes gets one. A fact
+    // that already carries a checkpoint stands: an approval copies that one.
     if (standing && !isPendingGateExpired(standing, now) && samePlanDigest(standing.planDigest, input.planDigest) &&
-        sameApproval(standing.approval, input.approval)) {
+        sameApproval(standing.approval, input.approval) &&
+        (input.checkpoint === undefined || port.writeCheckpoint === undefined || standing.checkpointDigest !== undefined)) {
         return { satisfied: false, pending: standing, recorded: false, ...asMismatch };
     }
+    // The checkpoint is written before the fact that names it, so a fact never
+    // points at a file that isn't there.
+    let checkpointDigest;
+    if (input.checkpoint !== undefined && port.writeCheckpoint) {
+        checkpointDigest = gateCheckpointDigest(input.checkpoint);
+        await port.writeCheckpoint(input.checkpoint);
+    }
     const url = resolveApprovalUrl();
     // #3683: in CI, where this job runs, so an approval can start it again.
     const resume = resolveGateRunLocator();
@@ -407,6 +547,7 @@ export async function evaluateGate(port, input) {
         ...(url ? { url } : {}),
         ...(resume ? { resume } : {}),
         ...(input.planDigest !== undefined ? { planDigest: input.planDigest } : {}),
+        ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
         ...(env !== undefined ? { environment: env } : {}),
         ...(input.approval ? { approval: input.approval } : {}),
         ...(input.neverOverMcp ? { neverOverMcp: true } : {}),

package/dist/op/index.d.ts

@@ -59,8 +59,11 @@ export type { OpRuntimeProvider, OpRunHandle, OpRunStartOptions, OpGateResolveOp
 export { buildOpIR, serializeOpIR, opConfigFromIR, OP_IR_FORMAT_VERSION } from "./op-ir.js";
 export type { OpIR, OpIRPhase, OpIRStep, OpIRActivityStep, OpIRGateStep, OpIREffectStep, OpIRActivityContract, } from "./op-ir.js";
 export { renderHuman, renderJson } from "./local-output.js";
-export { activityContract, isActivityContract, collectActivityContracts, validateActivitySteps, KNOWN_ACTIVITY_PROFILES, pathExistsInSchema, } from "./activity-contract.js";
+export { activityContract, isActivityContract, collectActivityContracts, validateActivitySteps, KNOWN_ACTIVITY_PROFILES, pathExistsInSchema, readsSecretOutput, } from "./activity-contract.js";
 export type { ActivityContract, ActivityContractIssue } from "./activity-contract.js";
+export { validateGateResume, resumeGatesOf, decideGateResume } from "./gate-checkpoint.js";
+export type { ResumeGate, GateResumeDecision } from "./gate-checkpoint.js";
+export type { GateCheckpoint } from "../lifecycle/gate-checkpoint.js";
 export { stepOutput, isStepOutputRef, collectStepOutputRefs, validateStepOutputRefs, validateStepOutputRefScope, makeOutProxy } from "./step-output-ref.js";
 export type { StepOutputRef, WithStepRefs } from "./step-output-ref.js";
 export type { NamedActivityStep } from "./builders.js";