@intentius/chant 0.124.25 → 0.124.27

package/src/op/local-output.ts

@@ -28,6 +28,10 @@ function formatDuration(ms: number): string {
  * stays clean for piping (the `--json` renderer owns stdout).
  */
 export function renderHuman(result: OpRunResult, write: Writer = stderr, sealed = false): void {
+  // #3947: a run that resumed at a gate says where it picked up.
+  if (result.resumed) {
+    write(`[resume] at gate "${result.resumed.gate}", from run ${result.resumed.run}'s checkpoint ${result.resumed.checkpoint}`);
+  }
   let currentPhase: string | undefined;
   for (const record of result.records) {
     if (record.phase !== currentPhase) {
@@ -36,7 +40,9 @@ export function renderHuman(result: OpRunResult, write: Writer = stderr, sealed
     }
     const mark = record.status === "ok" ? "✓" : record.status === "fail" ? "✗" : "•";
     const call = `${record.fn}(${formatArgs(record.args ?? {})})`;
-    if (record.status === "skipped") {
+    if (record.status === "skipped" && record.resumed) {
+      write(`  ${mark} ${call}   from run ${record.resumed.run}`);
+    } else if (record.status === "skipped") {
       write(`  ${mark} ${call}   skipped`);
     } else {
       write(`  ${mark} ${call}   ${formatDuration(record.durationMs)}`);
@@ -47,6 +53,10 @@ export function renderHuman(result: OpRunResult, write: Writer = stderr, sealed
     if (record.approval) {
       write(`    [approved] ${record.approval.resolvedBy} at ${record.approval.timestamp}` +
         (record.approval.url ? ` (${record.approval.url})` : ""));
+      // #3949: an approval carried from one of the gate's aliases names where it came from.
+      for (const c of record.approval.carriedFrom ?? []) {
+        write(`    [carried] ${c.resolvedBy}'s approval of ${c.op}/${c.gate} at ${c.timestamp}`);
+      }
     }
     if (record.refusal) {
       write(`    [refused] ${record.refusal}`);
@@ -72,6 +82,8 @@ export function renderHuman(result: OpRunResult, write: Writer = stderr, sealed
     write(`[work] nothing claimed: ${work.refusal}`);
   }
 
+  for (const note of result.resumeNotes ?? []) write(`[resume] ${note}`);
+
   const total = `${(result.totalMs / 1000).toFixed(1)}s`;
   if (result.status === "ok") {
     write(`Op "${result.op}" completed in ${total}`);
@@ -104,6 +116,8 @@ export function renderHuman(result: OpRunResult, write: Writer = stderr, sealed
   write(`  approve : ${approveCommand(gate.op, gate.gate, undefined, gate.planDigest, sealed)}`);
   if (gate.url) write(`  approve at: ${gate.url}`);
   write(`  expires : ${gate.expiresAt}`);
+  // #3947: the approval also lets the next run start here.
+  if (gate.checkpointDigest) write(`  resume  : once approved, the next run starts at this gate (checkpoint ${gate.checkpointDigest})`);
   // #2310: this run's own append reached only the local chant/lifecycle
   // branch, not the remote. The pending fact is still correct — the gate is
   // still right to stand — but an operator working from a clone of the
@@ -139,7 +153,9 @@ export function renderJson(result: OpRunResult, write: Writer = stdout, sealed =
   const push = result.gatePushed === false
     ? { pushed: false, pushWarning: result.gatePushWarning ?? "the pending fact was recorded locally only" }
     : {};
-  write(JSON.stringify({ ...result.record, ...approve, ...push }));
+  // #3947: why a gate that resumes did not, beside the record like `push`.
+  const notes = result.resumeNotes ? { resumeNotes: result.resumeNotes } : {};
+  write(JSON.stringify({ ...result.record, ...approve, ...push, ...notes }));
 }
 
 export type { OpRunResult, StepRecord };

package/src/op/op-ir.test.ts

@@ -257,6 +257,31 @@ describe("op.json IR", () => {
     expect(serializeOpIR(reconstructed)).toBe(text);
   });
 
+  // #3947: a gate that resumes says so in op.json, for a runtime that reads it.
+  it("carries a gate's resume through op.json and back", () => {
+    const config: OpConfig = {
+      name: "live-apply",
+      overview: "o",
+      phases: [phase("Gate", [{ kind: "gate", gate: "approve-live-apply", resume: true }])],
+    };
+    const text = serializeOpIR(config);
+    expect((JSON.parse(text) as OpIR).phases[0].steps[0]).toMatchObject({ kind: "gate", resume: true });
+    expect(opConfigFromIR(JSON.parse(text) as OpIR).phases[0]!.steps[0]).toMatchObject({ kind: "gate", resume: true });
+  });
+
+  // #3949: a gate's aliases travel in op.json, so a runtime that reads it counts the same approvals.
+  it("carries a gate's aliases through op.json and back", () => {
+    const aliases = [{ op: "upgrade-tier-1", gate: "approve" }, { gate: "approve-old" }];
+    const config: OpConfig = {
+      name: "upgrade",
+      overview: "o",
+      phases: [phase("Gate", [{ kind: "gate", gate: "approve-tier-1", plan: "jcs1-sha256:" + "a".repeat(64), aliases }])],
+    };
+    const text = serializeOpIR(config);
+    expect((JSON.parse(text) as OpIR).phases[0].steps[0]).toMatchObject({ kind: "gate", aliases });
+    expect(opConfigFromIR(JSON.parse(text) as OpIR).phases[0]!.steps[0]).toMatchObject({ kind: "gate", aliases });
+  });
+
   it("round-trips a minimal Op (no gate, effect, onFailure or labels) too", () => {
     const original: OpConfig = { name: "minimal", overview: "o", phases: [phase("Only", [shell("echo hi")])] };
     const text = serializeOpIR(original);

package/src/op/op-ir.ts

@@ -151,6 +151,10 @@ export interface OpIRGateStep {
   approval?: GateStep["approval"];
   /** The decision point the gate asks (#3170), carried as authored. Absent on a gate that `chant approve` passes. */
   point?: GateStep["point"];
+  /** The gate resumes once approved (#3947). Absent on a gate that starts its run again at the first phase. */
+  resume?: true;
+  /** The gate's old names (#3949), carried as authored. Absent on a gate that has none. */
+  aliases?: GateStep["aliases"];
 }
 
 export interface OpIREffectStep {
@@ -263,6 +267,8 @@ function irGateStep(step: GateStep): OpIRGateStep {
     ...(step.plan !== undefined ? { plan: step.plan } : {}),
     ...(step.approval !== undefined ? { approval: step.approval } : {}),
     ...(step.point !== undefined ? { point: step.point } : {}),
+    ...(step.resume ? { resume: true as const } : {}),
+    ...(step.aliases !== undefined && step.aliases.length > 0 ? { aliases: step.aliases } : {}),
   };
 }
 
@@ -419,6 +425,8 @@ function opStepFromIR(step: OpIRStep): StepDefinition {
       ...(step.plan !== undefined ? { plan: step.plan } : {}),
       ...(step.approval !== undefined ? { approval: step.approval } : {}),
       ...(step.point !== undefined ? { point: step.point } : {}),
+      ...(step.resume ? { resume: true } : {}),
+      ...(step.aliases !== undefined && step.aliases.length > 0 ? { aliases: step.aliases } : {}),
     };
   }
   return {

package/src/op/runtime.ts

@@ -59,6 +59,8 @@ export interface OpRunStepRecord {
   point?: WaitingPoint;
   /** The gate this step's command stopped at (#2779), for a step skipped because of it. */
   gate?: { op: string; gate: string };
+  /** The run whose checkpoint supplied this step's output, for a step a resumed run skipped (#3947). */
+  resumed?: { run: string; gate: string };
 }
 
 /** One phase's steps and the verdict they add up to. */
@@ -151,6 +153,12 @@ export interface OpRunRecord {
   point?: WaitingPoint & { since: string };
   /** The steward whose turn the run was, when a steward ran it (#2749). */
   steward?: string;
+  /**
+   * The gate this run resumed at (#3947), the run whose checkpoint it carried
+   * on from, and the checkpoint's digest. Absent on a run that started at the
+   * first phase.
+   */
+  resumed?: { gate: string; run: string; checkpoint: string };
 }
 
 /** An {@link OpRunRecord} before the ledger stamps its version and mints an id. */

package/src/op/runtimes/local.ts

@@ -22,8 +22,9 @@ import { lexiconNames } from "../../lexicon-module";
 import { loadChantConfig } from "../../config";
 import { loadActivities, loadProfiles } from "../activity-registry";
 import { runOpLocally, OpRunFailure, type OpRunResult } from "../local-executor";
+import { loadActivityContracts } from "../activity-contract-registry";
+import { resumeGatesOf } from "../gate-checkpoint";
 import { stepHeartbeatMs } from "../step-console";
-import { runComponents } from "../../components/cli-support";
 import { discoverOps } from "../discover";
 import { readRunLedger, runEnvOf, DEFAULT_RUN_ENV } from "../../lifecycle/run-ledger";
 import type { OpConfig } from "../types";
@@ -139,6 +140,8 @@ export function createLocalOpRuntime(opts: { projectPath?: string } = {}): OpRun
       }
 
       const [activities, profiles] = await Promise.all([loadActivities(lexicons), loadProfiles()]);
+      // #3947: a gate that resumes stores no output a contract marks secret.
+      const contracts = resumeGatesOf(op).length > 0 ? await loadActivityContracts(lexicons) : undefined;
 
       // A caller that names the run (#3539: `chant acp` on fountain passes the
       // conversation id) gets its id on the record; otherwise one is minted.
@@ -179,6 +182,7 @@ export function createLocalOpRuntime(opts: { projectPath?: string } = {}): OpRun
               stepOutput: (line) => process.stderr.write(`${line}\n`),
               stepHeartbeatMs: stepHeartbeatMs(process.env, (message) => process.stderr.write(`warning: ${message}\n`)),
               ...(startOpts.work ? { work: startOpts.work } : {}),
+              ...(contracts ? { contracts } : {}),
               onWorkLeaseWarning: (message) =>
                 process.stderr.write(`warning: "${op.name}" could not renew its work lease, retrying at the next beat: ${message}\n`),
             },
@@ -232,7 +236,10 @@ export function createLocalOpRuntime(opts: { projectPath?: string } = {}): OpRun
       );
     },
 
-    runComponents(path, selector, options) {
+    async runComponents(path, selector, options) {
+      // Imported here, not at the top: the components driver is most of core's components tree, and this module is
+      // re-exported by `@intentius/chant/op`, which every `*.op.ts` imports (#3982).
+      const { runComponents } = await import("../../components/cli-support");
       return runComponents(path, selector, options);
     },
   };

package/src/op/types.ts

@@ -298,6 +298,38 @@ export interface GateStepBase {
    * `./gate-point.ts`.
    */
   point?: string | GatePoint;
+  /**
+   * A run that stops at this gate can be resumed here once it is approved
+   * (#3947), rather than starting again at the first phase. The run stores
+   * the step outputs a later step references in a checkpoint on
+   * `chant/lifecycle`, and the next run after `chant approve` re-runs the
+   * step that produced the gate's `plan`, checks the checkpoint, and carries
+   * on from the gate. Any check that fails starts the run at the first phase,
+   * and the run says why. See `./gate-checkpoint.ts`.
+   *
+   * Only a gate at the top of a main phase resumes, and not one that asks a
+   * decision point or sits in an Op with a `workLease`. OPS016 refuses the
+   * rest at build.
+   */
+  resume?: boolean;
+  /**
+   * The names this gate had before an Op was restructured (#3949), so the
+   * approvals already recorded under them still count. `op` defaults to this
+   * Op. An approval recorded under an alias counts toward this gate when it
+   * answers that name's standing pending fact, the fact hasn't expired, it
+   * is for the plan this run planned and the same environment, it hasn't
+   * been spent, it passes this gate's `identity.gates` rule, and a person
+   * made it. The run then writes it again under this gate's name, citing
+   * the line it came from (`carriedFrom`). Only a gate bound to a `plan`
+   * takes aliases, and OPS017 refuses an alias that is still a gate.
+   */
+  aliases?: GateAlias[];
+}
+
+/** A name a gate had before (#3949): a gate of `op`, or of the gate's own Op when `op` is absent. */
+export interface GateAlias {
+  op?: string;
+  gate: string;
 }
 
 /**

package/src/workspace/trust/gate-seal.test.ts

@@ -11,7 +11,7 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterAll, describe, expect, test } from "vitest";
-import { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval } from "./gate-seal";
+import { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealRefusal, gateSealVersion, sshKeyFingerprint, verifySshSignatureWith, type GateSigners, type SealedGateApproval } from "./gate-seal";
 import { checkGateSeal } from "./seal";
 import { emptyPolicy, parseAllowedSigners, type TrustPolicy } from "./policy";
 import { hasSshKeygen } from "./test-repo";
@@ -96,7 +96,7 @@ describe.skipIf(!hasSshKeygen)("an SSHSIG checked with node:crypto", () => {
     const policy = policyOf(`alice ${k.pub}\n`);
     const seal = { signer: "alice", key: "SHA256:x", signature };
     expect(both(policy, { ...a, seal })).toEqual({ ours: null, keygen: true });
-    for (const edited of [{ planDigest: "jcs1-sha256:other" }, { timestamp: "2026-10-12T00:00:00.000Z" }, { relayedBy: "bot" }, { environment: "prod" }]) {
+    for (const edited of [{ planDigest: "jcs1-sha256:other" }, { timestamp: "2026-10-12T00:00:00.000Z" }, { relayedBy: "bot" }, { environment: "prod" }, { checkpointDigest: "jcs1-sha256:added" }]) {
       const res = both(policy, { ...a, ...edited, seal });
       expect(res.keygen).toBe(false);
       expect(res.ours).toMatch(/does not verify for alice/);
@@ -137,6 +137,33 @@ describe.skipIf(!hasSshKeygen)("an SSHSIG checked with node:crypto", () => {
   });
 });
 
+// #3947: seal version 2 signs the checkpoint digest as one more line, so the
+// outputs a resumed run carries on with are covered, and a version 1 payload
+// is unchanged.
+describe("seal version 2 covers the checkpoint", () => {
+  test("the payload adds a checkpoint line only when the approval carries one", () => {
+    const a = approval({ relayedBy: "bot" });
+    expect(gateSealVersion(a)).toBe(1);
+    expect(gateSealPayload(a).toString()).toBe("migrations\nmigrations-wave-1\n\njcs1-sha256:abc\nalice\n2026-10-11T00:00:00.000Z\nrelayed-by bot");
+    const b = approval({ relayedBy: "bot", checkpointDigest: "jcs1-sha256:cp" });
+    expect(gateSealVersion(b)).toBe(2);
+    expect(gateSealPayload(b).toString()).toBe(`${gateSealPayload(a).toString()}\ncheckpoint jcs1-sha256:cp`);
+  });
+
+  test.skipIf(!hasSshKeygen)("a version 2 seal verifies, and swapping or removing the checkpoint stops it", () => {
+    const k = key("alice-cp", ["-t", "ed25519"]);
+    const a = approval({ checkpointDigest: "jcs1-sha256:cp" });
+    const seal = { signer: "alice", key: "SHA256:x", signature: sign(k, gateSealPayload(a)), version: 2 };
+    const policy = policyOf(`alice ${k.pub}\n`);
+    expect(both(policy, { ...a, seal })).toEqual({ ours: null, keygen: true });
+    for (const edited of [{ checkpointDigest: "jcs1-sha256:other" }, { checkpointDigest: undefined }]) {
+      const res = both(policy, { ...a, ...edited, seal });
+      expect(res.keygen).toBe(false);
+      expect(res.ours).toMatch(/does not verify for alice/);
+    }
+  });
+});
+
 describe("the refusals that need no signature", () => {
   const signers = (over: Partial<GateSigners> = {}): GateSigners => ({ base: "a".repeat(40), signersPath: ".chant/allowed_signers", active: true, signers: [], problems: [], ...over });
 

package/src/workspace/trust/gate-seal.ts

@@ -37,9 +37,42 @@ export interface SealedGateApproval {
   /** Who relayed the approval for `resolvedBy` (#3402), when someone did. */
   relayedBy?: string;
   timestamp: string;
+  /** The checkpoint the approval lets a run resume from (#3947), when it carries one. */
+  checkpointDigest?: string;
+  /** The line a carried approval came from (#3949): the names and time its seal was made under. */
+  carriedFrom?: { op: string; gate: string; timestamp: string; checkpointDigest?: string };
   seal?: unknown;
 }
 
+/**
+ * The approval as it was sealed (#3949). A carried approval is recorded
+ * under a gate's new name and the time it was carried, and its seal was
+ * made over the line it came from, so its op, gate, time and checkpoint
+ * digest are read off `carriedFrom`. Any other approval is returned as it is.
+ */
+export function sealedFieldsOf(a: SealedGateApproval): SealedGateApproval {
+  const from = a.carriedFrom;
+  if (from === undefined) return a;
+  const { carriedFrom: _from, checkpointDigest: _checkpoint, ...rest } = a;
+  return {
+    ...rest,
+    op: from.op,
+    gate: from.gate,
+    timestamp: from.timestamp,
+    ...(from.checkpointDigest !== undefined ? { checkpointDigest: from.checkpointDigest } : {}),
+  };
+}
+
+/**
+ * The version of a seal over `a` (#3947): 2 when the approval carries a
+ * checkpoint digest, which the payload signs, and 1 otherwise. `chant approve
+ * --sign` records 2 on the seal; a seal records no version for 1.
+ */
+export function gateSealVersion(a: Pick<SealedGateApproval, "checkpointDigest" | "carriedFrom">): 1 | 2 {
+  const checkpoint = a.carriedFrom !== undefined ? a.carriedFrom.checkpointDigest : a.checkpointDigest;
+  return checkpoint !== undefined ? 2 : 1;
+}
+
 /**
  * The bytes a gate approval's seal signs (#3163): the op (or component), the
  * gate, the environment, the plan digest, the approver and the time, joined
@@ -48,10 +81,21 @@ export interface SealedGateApproval {
  * `relayed-by <principal>`, so the relay can't be added, changed or removed
  * after sealing; an approval nobody relayed signs the six lines it always did,
  * so seals made before #3402 still verify.
+ *
+ * Seal version 2 (#3947) adds the checkpoint a resumed run carries its step
+ * outputs from: an approval with a `checkpointDigest` signs one more line,
+ * `checkpoint <digest>`, last. The values the steps after the gate read are
+ * then covered by the seal too, and removing or swapping the digest stops it
+ * verifying. An approval with none signs what a version 1 seal signed.
+ *
+ * A carried approval (#3949) signs what the line it came from signed: see
+ * {@link sealedFieldsOf}.
  */
-export function gateSealPayload(a: SealedGateApproval): Buffer {
+export function gateSealPayload(approval: SealedGateApproval): Buffer {
+  const a = sealedFieldsOf(approval);
   const relay = a.relayedBy !== undefined ? `\nrelayed-by ${a.relayedBy}` : "";
-  return Buffer.from(`${a.op}\n${a.gate}\n${a.environment ?? ""}\n${a.planDigest ?? ""}\n${a.resolvedBy}\n${a.timestamp}${relay}`, "utf-8");
+  const checkpoint = gateSealVersion(a) === 2 ? `\ncheckpoint ${a.checkpointDigest}` : "";
+  return Buffer.from(`${a.op}\n${a.gate}\n${a.environment ?? ""}\n${a.planDigest ?? ""}\n${a.resolvedBy}\n${a.timestamp}${relay}${checkpoint}`, "utf-8");
 }
 
 // ── SSHSIG ───────────────────────────────────────────────────────────────

package/src/workspace/trust/seal.ts

@@ -32,7 +32,7 @@ import type { Signer } from "./trust-files";
 import { sshKeygen, verifySshSignature } from "./ssh-commit";
 import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshSignatureKey, verifySshSignatureWith, type SealedGateApproval } from "./gate-seal";
 
-export { GATE_SEAL_NAMESPACE, gateSealPayload, type SealedGateApproval } from "./gate-seal";
+export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf, type SealedGateApproval } from "./gate-seal";
 
 /** The ssh signature namespace of a verdict seal. */
 export const REVIEW_SEAL_NAMESPACE = "chant-review";