@intentius/chant 0.124.25 → 0.124.26

package/dist/workspace/trust/gate-seal.d.ts

@@ -33,8 +33,30 @@ export interface SealedGateApproval {
     /** Who relayed the approval for `resolvedBy` (#3402), when someone did. */
     relayedBy?: string;
     timestamp: string;
+    /** The checkpoint the approval lets a run resume from (#3947), when it carries one. */
+    checkpointDigest?: string;
+    /** The line a carried approval came from (#3949): the names and time its seal was made under. */
+    carriedFrom?: {
+        op: string;
+        gate: string;
+        timestamp: string;
+        checkpointDigest?: string;
+    };
     seal?: unknown;
 }
+/**
+ * The approval as it was sealed (#3949). A carried approval is recorded
+ * under a gate's new name and the time it was carried, and its seal was
+ * made over the line it came from, so its op, gate, time and checkpoint
+ * digest are read off `carriedFrom`. Any other approval is returned as it is.
+ */
+export declare function sealedFieldsOf(a: SealedGateApproval): SealedGateApproval;
+/**
+ * The version of a seal over `a` (#3947): 2 when the approval carries a
+ * checkpoint digest, which the payload signs, and 1 otherwise. `chant approve
+ * --sign` records 2 on the seal; a seal records no version for 1.
+ */
+export declare function gateSealVersion(a: Pick<SealedGateApproval, "checkpointDigest" | "carriedFrom">): 1 | 2;
 /**
  * The bytes a gate approval's seal signs (#3163): the op (or component), the
  * gate, the environment, the plan digest, the approver and the time, joined
@@ -43,8 +65,17 @@ export interface SealedGateApproval {
  * `relayed-by <principal>`, so the relay can't be added, changed or removed
  * after sealing; an approval nobody relayed signs the six lines it always did,
  * so seals made before #3402 still verify.
+ *
+ * Seal version 2 (#3947) adds the checkpoint a resumed run carries its step
+ * outputs from: an approval with a `checkpointDigest` signs one more line,
+ * `checkpoint <digest>`, last. The values the steps after the gate read are
+ * then covered by the seal too, and removing or swapping the digest stops it
+ * verifying. An approval with none signs what a version 1 seal signed.
+ *
+ * A carried approval (#3949) signs what the line it came from signed: see
+ * {@link sealedFieldsOf}.
  */
-export declare function gateSealPayload(a: SealedGateApproval): Buffer;
+export declare function gateSealPayload(approval: SealedGateApproval): Buffer;
 /** `SHA256:<base64>`, the fingerprint ssh-keygen prints for a public key blob. */
 export declare function sshKeyFingerprint(blob: Buffer): string;
 /** What {@link verifySshSignatureWith} found. */

package/dist/workspace/trust/gate-seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/gate-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,kIAAkI;AAClI,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAG7D;AA8BD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAmCD,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CA0CtI;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU9D;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID,kJAAkJ;AAClJ,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAmB1F"}
+{"version":3,"file":"gate-seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/gate-seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,eAAe,CAAC;AAEhD,kIAAkI;AAClI,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,WAAW,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAWxE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAGtG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAKpE;AA8BD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAmCD,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CA0CtI;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU9D;AAID;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yFAAyF;IACzF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID,kJAAkJ;AAClJ,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAYrF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,GAAG,IAAI,CAmB1F"}

package/dist/workspace/trust/gate-seal.js

@@ -23,6 +23,34 @@ import { createHash, createPublicKey, verify } from "node:crypto";
  * verdict, record or commit signature can't stand in for one.
  */
 export const GATE_SEAL_NAMESPACE = "chant-gate";
+/**
+ * The approval as it was sealed (#3949). A carried approval is recorded
+ * under a gate's new name and the time it was carried, and its seal was
+ * made over the line it came from, so its op, gate, time and checkpoint
+ * digest are read off `carriedFrom`. Any other approval is returned as it is.
+ */
+export function sealedFieldsOf(a) {
+    const from = a.carriedFrom;
+    if (from === undefined)
+        return a;
+    const { carriedFrom: _from, checkpointDigest: _checkpoint, ...rest } = a;
+    return {
+        ...rest,
+        op: from.op,
+        gate: from.gate,
+        timestamp: from.timestamp,
+        ...(from.checkpointDigest !== undefined ? { checkpointDigest: from.checkpointDigest } : {}),
+    };
+}
+/**
+ * The version of a seal over `a` (#3947): 2 when the approval carries a
+ * checkpoint digest, which the payload signs, and 1 otherwise. `chant approve
+ * --sign` records 2 on the seal; a seal records no version for 1.
+ */
+export function gateSealVersion(a) {
+    const checkpoint = a.carriedFrom !== undefined ? a.carriedFrom.checkpointDigest : a.checkpointDigest;
+    return checkpoint !== undefined ? 2 : 1;
+}
 /**
  * The bytes a gate approval's seal signs (#3163): the op (or component), the
  * gate, the environment, the plan digest, the approver and the time, joined
@@ -31,10 +59,21 @@ export const GATE_SEAL_NAMESPACE = "chant-gate";
  * `relayed-by <principal>`, so the relay can't be added, changed or removed
  * after sealing; an approval nobody relayed signs the six lines it always did,
  * so seals made before #3402 still verify.
+ *
+ * Seal version 2 (#3947) adds the checkpoint a resumed run carries its step
+ * outputs from: an approval with a `checkpointDigest` signs one more line,
+ * `checkpoint <digest>`, last. The values the steps after the gate read are
+ * then covered by the seal too, and removing or swapping the digest stops it
+ * verifying. An approval with none signs what a version 1 seal signed.
+ *
+ * A carried approval (#3949) signs what the line it came from signed: see
+ * {@link sealedFieldsOf}.
  */
-export function gateSealPayload(a) {
+export function gateSealPayload(approval) {
+    const a = sealedFieldsOf(approval);
     const relay = a.relayedBy !== undefined ? `\nrelayed-by ${a.relayedBy}` : "";
-    return Buffer.from(`${a.op}\n${a.gate}\n${a.environment ?? ""}\n${a.planDigest ?? ""}\n${a.resolvedBy}\n${a.timestamp}${relay}`, "utf-8");
+    const checkpoint = gateSealVersion(a) === 2 ? `\ncheckpoint ${a.checkpointDigest}` : "";
+    return Buffer.from(`${a.op}\n${a.gate}\n${a.environment ?? ""}\n${a.planDigest ?? ""}\n${a.resolvedBy}\n${a.timestamp}${relay}${checkpoint}`, "utf-8");
 }
 // ── SSHSIG ───────────────────────────────────────────────────────────────
 /** A reader over ssh wire format: `take(n)` bytes, or `take()` one length-prefixed string. */

package/dist/workspace/trust/seal.d.ts

@@ -24,7 +24,7 @@
 import type { SealCode } from "../records.js";
 import { type TrustPolicy } from "./policy.js";
 import { type SealedGateApproval } from "./gate-seal.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload, type SealedGateApproval } from "./gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf, type SealedGateApproval } from "./gate-seal.js";
 /** The ssh signature namespace of a verdict seal. */
 export declare const REVIEW_SEAL_NAMESPACE = "chant-review";
 /** The ssh signature namespace of a record's author seal (#2688). */

package/dist/workspace/trust/seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAmG,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvJ,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE5F,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAgFD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF"}
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,OAAO,EAAmG,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvJ,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE7H,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,kBAAkB,GAAG,SAAS,CASnF;AAgFD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,kBAAkB,GAAG,WAAW,CAEpF"}

package/dist/workspace/trust/seal.js

@@ -27,7 +27,7 @@ import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { sshKeygen, verifySshSignature } from "./ssh-commit.js";
 import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshSignatureKey, verifySshSignatureWith } from "./gate-seal.js";
-export { GATE_SEAL_NAMESPACE, gateSealPayload } from "./gate-seal.js";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf } from "./gate-seal.js";
 /** The ssh signature namespace of a verdict seal. */
 export const REVIEW_SEAL_NAMESPACE = "chant-review";
 /** The ssh signature namespace of a record's author seal (#2688). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.124.25",
+  "version": "0.124.26",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/build.ts

@@ -27,7 +27,7 @@ import { coreKnowledgeChecks } from "../../lint/knowledge-checks";
 import { applyConfiguredSeverity, applyConfiguredPreset, resolvePresetIds } from "../../lint/config";
 import { applyInlineSuppressions, type SuppressionMetaFinding } from "../../lint/suppressions";
 import type { Declarable } from "../../declarable";
-import { coreOpChecks } from "../../lint/rules/op";
+import { coreOpChecks, workspaceIdentityGates } from "../../lint/rules/op";
 import { loadPolicyChecks } from "../../lint/policy";
 import { armSandboxPolicyExecution, runProjectPolicies } from "../../lint/policy-sandbox";
 import { sortedJsonReplacer } from "../../utils";
@@ -588,7 +588,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // FULL build result regardless of which plugins loaded — same as the
   // receipt/output/knowledge checks above.
   if (result.errors.length === 0) {
-    const opDiags = runPostSynthChecks(coreOpChecks({ decideBackends: config.decide?.backends }), result, env, { activityContracts });
+    // OPS017 (#3949) reads the workspace's identity.gates, when an Op has gate aliases.
+    const identityGates = await workspaceIdentityGates(configDir, result.entities);
+    const opDiags = runPostSynthChecks(
+      coreOpChecks({ decideBackends: config.decide?.backends, ...(identityGates ? { identityGates } : {}) }),
+      result,
+      env,
+      { activityContracts },
+    );
     const { diagnostics: activeDiags, suppressed } = applyConfiguredSeverity(opDiags, config.lint?.rules);
     suppressedPostSynthCount += suppressed.length;
     for (const diag of activeDiags) {

package/src/cli/commands/lint.ts

@@ -13,7 +13,7 @@ import { loadComponentChecks } from "../../lint/rules/comp/index";
 import { runComponentChecks, type ComponentCheckDiagnostic } from "../../lint/component-checks";
 import { buildCapabilityRegistry } from "../../components/capability-plugin-loader";
 import type { RollbackPolicy } from "../../components/capability";
-import { coreOpChecks } from "../../lint/rules/op";
+import { coreOpChecks, workspaceIdentityGates } from "../../lint/rules/op";
 import { loadActivityContracts } from "../../op/activity-contract-registry";
 import { runPostSynthChecks } from "../../lint/post-synth";
 import { rule } from "../../lint/declarative";
@@ -627,8 +627,10 @@ async function runOpCheckDiagnostics(
     .then((loaded) => loaded.config.decide?.backends)
     .catch(() => undefined);
 
+  // OPS017 (#3949) reads the workspace's identity.gates, when an Op has gate aliases.
+  const identityGates = await workspaceIdentityGates(findProjectRoot(infraPath), entities);
   const raw = runPostSynthChecks(
-    coreOpChecks({ decideBackends }),
+    coreOpChecks({ decideBackends, ...(identityGates ? { identityGates } : {}) }),
     {
       outputs: new Map(),
       entities: entities as Map<string, never>,

package/src/cli/handlers/approve.ts

@@ -5,6 +5,7 @@
  * re-exports everything here.
  */
 import { discoverOps } from "../../op/discover";
+import { aliasingGate } from "../../op/gate-alias";
 import type { GateResolutionRecord, PendingGateRecord } from "../../lifecycle/gate-ledger";
 import {
   currentGateOrigin, isModelAuthored, sameOriginRefusal, UNATTESTED_APPROVER, type GateOrigin,
@@ -280,7 +281,9 @@ export async function recordGateApproval(
   // `fan-out` is the op name every `chant components fan-out` gate is recorded
   // under (../handlers/fan-out.ts). It is a command rather than a declaration,
   // so there is no `*.op.ts` to find and nothing is wrong when none is there.
-  if (!ops.has(opName) && opName !== FAN_OUT_GATE_OP && opName !== WORKSPACE_UPGRADE_GATE_OP && opName !== OVERRIDE_GATE_OP) {
+  // #3949: a gate that lists this one as an alias, after an Op was restructured.
+  const successor = aliasingGate([...ops.values()].map((o) => o.config), opName, gate);
+  if (!successor && !ops.has(opName) && opName !== FAN_OUT_GATE_OP && opName !== WORKSPACE_UPGRADE_GATE_OP && opName !== OVERRIDE_GATE_OP) {
     console.error(formatWarning({
       message: `Op "${opName}" was not found among discovered *.op.ts declarations — recording the resolution anyway`,
     }));
@@ -301,6 +304,26 @@ export async function recordGateApproval(
     return { ok: false };
   }
 
+  // #3949: an approval under an alias counts toward the new gate only while
+  // the new gate has no standing fact of its own. Once it has one, approve
+  // the gate the runs now stop at.
+  if (successor) {
+    const theirs = latestPendingGate((await readGateLedger(successor.op)).pending, successor.gate);
+    if (theirs && !isPendingGateExpired(theirs, new Date().toISOString())) {
+      console.error(formatError({
+        message:
+          `Gate "${gate}" on "${opName}" is now gate "${successor.gate}" on "${successor.op}", which lists it as an alias, ` +
+          `and "${successor.gate}" has a standing pending fact`,
+        hint: `Approve that gate instead: chant approve ${successor.op} ${successor.gate}`,
+      }));
+      return { ok: false };
+    }
+    console.error(formatInfo(
+      `Gate "${gate}" on "${opName}" is an alias of gate "${successor.gate}" on "${successor.op}": ` +
+        `the next run of ${successor.op} counts this approval there while the pending fact it answers stands and the plan is the same.`,
+    ));
+  }
+
   // #2028: the resolution's link is typed. `--url` wins; otherwise, running
   // inside the PR/MR job that carries the change is itself the address, the
   // same env fallback `--actor` uses. `--note` stays free-text prose.
@@ -358,6 +381,14 @@ export async function recordGateApproval(
     }
     planDigest = standing.planDigest;
   }
+  // #3947: a gate that resumes recorded a checkpoint with its pending fact.
+  // An approval of that fact's plan copies the checkpoint's digest, the way it
+  // copies the plan's, so the run that resumes checks the file against what
+  // was approved here. An approval of another plan copies none.
+  const checkpointDigest =
+    standing?.checkpointDigest !== undefined && samePlanDigest(planDigest, standing.planDigest)
+      ? standing.checkpointDigest
+      : undefined;
 
   // chant#2384 — the gate's whole value is that its two halves have different
   // authors. At a shell they do: a person runs, reads the plan, and approves.
@@ -457,11 +488,11 @@ export async function recordGateApproval(
   const timestamp = new Date().toISOString();
   let seal: GateResolutionRecord["seal"];
   if (opts.sign !== undefined) {
-    const { resolveSigningKey, sealGateApproval, SealError } = await import("../../workspace/trust/seal");
+    const { resolveSigningKey, sealGateApproval, gateSealVersion, SealError } = await import("../../workspace/trust/seal");
     try {
       const key = resolveSigningKey(opts.sign, cwd);
       try {
-        seal = sealGateApproval(key.file, {
+        const sealed = {
           op: opName,
           gate,
           ...(environment !== undefined ? { environment } : {}),
@@ -469,7 +500,10 @@ export async function recordGateApproval(
           resolvedBy,
           ...(relayedBy ? { relayedBy } : {}),
           timestamp,
-        });
+          ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
+        };
+        // #3947: a seal over a checkpoint digest is seal version 2.
+        seal = { ...sealGateApproval(key.file, sealed), ...(gateSealVersion(sealed) === 2 ? { version: 2 as const } : {}) };
       } finally {
         key.cleanup();
       }
@@ -488,6 +522,7 @@ export async function recordGateApproval(
       resolvedBy,
       ...(relayedBy ? { relayedBy } : {}),
       timestamp,
+      ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
       seal,
     });
     if (why !== null) {
@@ -550,6 +585,7 @@ export async function recordGateApproval(
     ...(opts.note ? { note: opts.note } : {}),
     ...(url ? { url } : {}),
     ...(planDigest !== undefined ? { planDigest } : {}),
+    ...(checkpointDigest !== undefined ? { checkpointDigest } : {}),
     ...(environment !== undefined ? { environment } : {}),
     origin,
     ...(refusal && opts.allowSameOrigin ? { sameOriginOverride: true } : {}),
@@ -574,6 +610,12 @@ export async function recordGateApproval(
         ", and only that plan. A run whose fresh plan differs refuses rather than applying it.",
     ));
   }
+  if (record.checkpointDigest) {
+    console.error(formatInfo(
+      `The next run resumes at this gate from run ${standing?.runId ?? "(unknown)"}'s checkpoint ${record.checkpointDigest}, ` +
+        "after it plans again. A moved plan or another commit starts it at the first phase.",
+    ));
+  }
   if (approval) {
     for (const line of describeApprovalProgress(approval, record, ledger.resolutions, standingForOrigin, ledger.pending)) {
       console.error(formatInfo(line));

package/src/cli/handlers/operator.test.ts

@@ -929,6 +929,97 @@ describe("runApprove — the resolution names the plan it approves (#2300)", ()
   });
 });
 
+/** #3947 — a gate that resumes recorded a checkpoint, and its approval copies the digest. */
+describe("runApprove — the approval copies the checkpoint a resumed run carries on from (#3947)", () => {
+  const CHECKPOINT = `jcs1-sha256:${"c".repeat(64)}`;
+  const seedCheckpoint = () =>
+    readGateLedgerMock.mockResolvedValue({
+      resolutions: [],
+      pending: [{
+        version: 1, kind: "pending", op: "fountain-apply", gate: "rollout-gate", runId: "local-1",
+        timestamp: "2026-01-01T00:00:00.000Z", expiresAt: "2099-01-01T00:00:00.000Z",
+        planDigest: PLAN_A, checkpointDigest: CHECKPOINT,
+      }],
+      malformed: 0,
+    });
+
+  test("approving the standing fact copies its checkpoint digest and says the next run resumes", async () => {
+    seedCheckpoint();
+    appendGateResolutionMock.mockResolvedValue({
+      commit: "sha",
+      record: {
+        version: 1, op: "fountain-apply", gate: "rollout-gate", resolvedBy: "alex",
+        timestamp: "2026-01-01T00:00:00.000Z", planDigest: PLAN_A, checkpointDigest: CHECKPOINT,
+      },
+    });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "fountain-apply", extraPositional: "rollout-gate", actor: "alex" }))).toBe(0);
+    expect(appendGateResolutionMock).toHaveBeenCalledWith(expect.objectContaining({ planDigest: PLAN_A, checkpointDigest: CHECKPOINT }));
+    expect(errSpy.mock.calls.map((c) => String(c[0])).join("\n")).toContain(`resumes at this gate from run local-1's checkpoint ${CHECKPOINT}`);
+    errSpy.mockRestore();
+  });
+
+  test("an approval of another plan copies no checkpoint", async () => {
+    seedCheckpoint();
+    const other = `sha256:${"b".repeat(64)}`;
+    appendGateResolutionMock.mockResolvedValue({
+      commit: "sha",
+      record: { version: 1, op: "fountain-apply", gate: "rollout-gate", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z", planDigest: other },
+    });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "fountain-apply", extraPositional: "rollout-gate", actor: "alex", plan: other }))).toBe(0);
+    expect(appendGateResolutionMock.mock.calls[0][0]).not.toHaveProperty("checkpointDigest");
+    errSpy.mockRestore();
+  });
+});
+
+/** #3949 — once a gate that aliases this one has a standing fact, approve that gate. */
+describe("runApprove — an approval under a gate's alias (#3949)", () => {
+  const merged = {
+    config: {
+      name: "upgrade",
+      overview: "upgrade every tier",
+      phases: [{ name: "Wave 1", steps: [{ kind: "gate", gate: "approve-tier-1", plan: PLAN_A, aliases: [{ op: "upgrade-tier-1", gate: "approve" }] }] }],
+    },
+  };
+  const fact = (op: string, gate: string) => ({
+    version: 1, kind: "pending", op, gate, timestamp: "2026-01-01T00:00:00.000Z", expiresAt: "2099-01-01T00:00:00.000Z", planDigest: PLAN_A,
+  });
+  const ledgers = (byOp: Record<string, unknown[]>) =>
+    readGateLedgerMock.mockImplementation(async (op: string) => ({ resolutions: [], pending: byOp[op] ?? [], malformed: 0 }));
+
+  test("refuses and names the new gate once it has a standing pending fact", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([["upgrade", merged]]), errors: [] });
+    ledgers({ "upgrade-tier-1": [fact("upgrade-tier-1", "approve")], upgrade: [fact("upgrade", "approve-tier-1")] });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "upgrade-tier-1", extraPositional: "approve", actor: "alex" }))).toBe(1);
+    const out = errSpy.mock.calls.map((c) => String(c[0])).join("\n");
+    expect(out).toContain('is now gate "approve-tier-1" on "upgrade"');
+    expect(out).toContain("chant approve upgrade approve-tier-1");
+    expect(out).not.toContain("was not found among discovered");
+    expect(appendGateResolutionMock).not.toHaveBeenCalled();
+    errSpy.mockRestore();
+  });
+
+  test("records the approval while the new gate has none, and says where it counts", async () => {
+    discoverOpsMock.mockResolvedValue({ ops: new Map([["upgrade", merged]]), errors: [] });
+    ledgers({ "upgrade-tier-1": [fact("upgrade-tier-1", "approve")] });
+    appendGateResolutionMock.mockResolvedValue({
+      commit: "sha",
+      record: { version: 1, op: "upgrade-tier-1", gate: "approve", resolvedBy: "alex", timestamp: "2026-01-01T00:00:00.000Z", planDigest: PLAN_A },
+    });
+    const errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
+
+    expect(await runApprove(ctx({ path: "upgrade-tier-1", extraPositional: "approve", actor: "alex" }))).toBe(0);
+    expect(appendGateResolutionMock).toHaveBeenCalledWith(expect.objectContaining({ op: "upgrade-tier-1", gate: "approve", planDigest: PLAN_A }));
+    expect(errSpy.mock.calls.map((c) => String(c[0])).join("\n")).toContain('is an alias of gate "approve-tier-1" on "upgrade"');
+    errSpy.mockRestore();
+  });
+});
+
 /**
  * #2574 — a component's gate ledger holds every environment's pending facts.
  * The approval records the environment it answers, and `--env` picks it.

package/src/gate-decision.ts

@@ -72,6 +72,8 @@ export {
   GATE_SEAL_NAMESPACE,
   gateSealPayload,
   gateSealRefusal,
+  gateSealVersion,
+  sealedFieldsOf,
   sshKeyFingerprint,
   verifySshSignatureWith,
   type GateSigners,

package/src/lifecycle/gate-audit.ts

@@ -48,6 +48,13 @@
  * - `override`: an apply cites an override that no line holds.
  * - `malformed-line`: a line that is not a gate record. Its content is lost
  *   to the trail, so it is said.
+ * - `carried-without-source`: an approval carried from a gate's alias
+ *   (#3949, `carriedFrom`) whose cited line is not in the cited op's
+ *   ledger. Checked only when that ledger is passed in.
+ *
+ * A carried approval's request is the pending fact of the name it was
+ * carried from, in that op's ledger. When that ledger is not passed in,
+ * neither gap is looked for, and the entry's `carriedFrom` says where to look.
  *
  * ## Sources and ids
  *
@@ -211,13 +218,15 @@ export interface GateAuditEntry {
   subject?: "approval" | "override";
   /** An applied entry: the approval entry it ran under, if one is held. An override-spent entry: the override entry. */
   under?: string;
+  /** An approval a run carried from one of the gate's aliases (#3949): the op, gate and time of the line it came from. */
+  carriedFrom?: { op: string; gate: string; at: string };
   /** Everything else the line carries, such as `members`, `via` or a product's own fields. */
   detail: Record<string, unknown>;
   source: GateAuditSource;
 }
 
 export interface GateAuditGap {
-  kind: "approval-without-request" | "unsealed" | "approval" | "override" | "malformed-line";
+  kind: "approval-without-request" | "unsealed" | "approval" | "override" | "malformed-line" | "carried-without-source";
   op?: string;
   gate?: string;
   digest?: string;
@@ -284,7 +293,7 @@ type Row = Record<string, unknown>;
 
 const KNOWN = new Set([
   "version", "kind", "op", "gate", "resolvedBy", "relayedBy", "timestamp", "note", "url", "planDigest", "environment",
-  "approver", "seal", "review", "runId", "expiresAt", "description", "wave", "heldBy", "approvalMode", "rules", "pr", "head", "reviewers",
+  "approver", "seal", "review", "runId", "expiresAt", "description", "wave", "heldBy", "approvalMode", "rules", "pr", "head", "reviewers", "carriedFrom",
 ]);
 
 const waveOf = (v: unknown): { number: number; name: string; op?: string } | undefined => {
@@ -335,6 +344,11 @@ function approverOf(r: Row): GateAuditEntry["approver"] {
   return { kind: a.kind, ...(roles ? { roles } : {}) };
 }
 
+const carriedOf = (v: unknown): GateAuditEntry["carriedFrom"] => {
+  const c = v as { op?: unknown; gate?: unknown; timestamp?: unknown } | null;
+  return c && typeof c === "object" && typeof c.op === "string" && typeof c.gate === "string" && typeof c.timestamp === "string" ? { op: c.op, gate: c.gate, at: c.timestamp } : undefined;
+};
+
 const drop = <T extends object>(o: T): T => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined)) as T;
 
 const idOf = (...parts: unknown[]): string => contentDigest(canonicalJson(parts));
@@ -375,6 +389,19 @@ export function deriveGateAudit(input: GateAuditInput): { entries: GateAuditEntr
   const entries: GateAuditEntry[] = [];
   const gaps: GateAuditGap[] = [];
 
+  // #3949: every ledger's requests and approvals by op, for an approval carried from another op's gate.
+  const byOp = new Map<string, { requests: Seen[]; approvals: Row[] }>();
+  for (const ledger of input.ledgers) {
+    const held = byOp.get(ledger.op) ?? { requests: [], approvals: [] };
+    byOp.set(ledger.op, held);
+    for (const line of ledger.lines) {
+      const r = rowOf(line);
+      if (!r || line.removed || typeof r.gate !== "string" || typeof r.timestamp !== "string") continue;
+      if (r.kind === "pending") held.requests.push({ op: ledger.op, gate: r.gate, at: time(r.timestamp), ...(str(r.planDigest) ? { digest: str(r.planDigest) } : {}) });
+      else held.approvals.push(r);
+    }
+  }
+
   for (const ledger of input.ledgers) {
     const path = ledger.path ?? `_gates/${ledger.op}.jsonl`;
     const parsed: { line: GateLedgerLine; n: number; r: Row; pending: boolean }[] = [];
@@ -453,12 +480,22 @@ export function deriveGateAudit(input: GateAuditInput): { entries: GateAuditEntr
         at: String(r.timestamp),
         by: String(r.resolvedBy),
         seal,
-        ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str(r.relayedBy), approver: approverOf(r), note: str(r.note), url: str(r.url), review: reviewOf(r), rules }),
+        ...drop({ sealed, signer, committedBy: line.added?.by, relayedBy: str(r.relayedBy), approver: approverOf(r), note: str(r.note), url: str(r.url), review: reviewOf(r), rules, carriedFrom: carriedOf(r.carriedFrom) }),
         detail: extra,
       });
       entries.push(entry);
 
-      if (!override) {
+      const carried = entry.carriedFrom;
+      if (!override && carried) {
+        const cited = byOp.get(carried.op);
+        const from = `${carried.op}/${carried.gate}`;
+        if (cited && !cited.approvals.some((a) => a.gate === carried.gate && time(String(a.timestamp)) === time(carried.at) && a.resolvedBy === r.resolvedBy)) {
+          gaps.push({ kind: "carried-without-source", op: ledger.op, gate, ...(digest ? { digest } : {}), detail: `${path} holds an approval of ${gate} by ${entry.by} carried from ${from} at ${carried.at}, and _gates/${carried.op}.jsonl holds no such approval` });
+        }
+        if (cited && !cited.requests.some((q) => q.gate === carried.gate && q.at <= time(carried.at) && compatible(q.digest, digest))) {
+          gaps.push({ kind: "approval-without-request", op: ledger.op, gate, ...(digest ? { digest } : {}), detail: `${path} holds an approval of ${gate} by ${entry.by} carried from ${from} at ${carried.at} with no pending fact of ${from}${digest ? " and digest" : ""} before it` });
+        }
+      } else if (!override) {
         const at = time(entry.at);
         const env = str(r.environment);
         const asked = requests.some((q) => q.gate === gate && q.at <= at && compatible(q.digest, digest) && (q.environment === undefined || env === undefined || q.environment === env));