@intentius/chant 0.124.26 → 0.124.28

package/src/workspace/status.ts

@@ -50,7 +50,9 @@ import { loadKindRegistry, resolveMemberFields, type MemberFields } from "./kind
 import { factoryView, listingView, plantability, treeBytes, type FactoryView, type ListingView, type Plantable } from "./box-factory";
 import { declaredRecordKinds, extensionsAt, readDeclaration, readerVersion, WorkspaceReadError, type Declaration, type ErrorLocation, type Member } from "./declaration";
 import type { ReasonCode } from "./reason-codes";
-import { gateAdmissionFrom } from "./identity";
+import { readMemberPromotionOrder, type PromotionStep } from "./promotion-order";
+import { gateAdmissionFrom, releaseRuleFrom } from "./identity";
+import { checkReleaseSignature, type GateAdmissionRule, type ReleaseSignatureCheck } from "./identity-gate-rule";
 import { scopeSource } from "./write-scope";
 import { GATE_REASON_CODES, readMemberGates, type GateLedgerReader, type StatusGate, type StatusGateLedger } from "./status-gates";
 import { STEWARD_REASON_CODES, readMemberStewards, type StatusSteward, type StewardReasonCode } from "./status-stewards";
@@ -120,6 +122,10 @@ export interface StatusRelease {
   runId: string;
   timestamp: string;
   actor: string;
+  /** Who approved the change at its gate (#1035), when it had one. Null for an ungated release. */
+  approver: string | null;
+  /** The gate resolution that admitted the release (#4020): the gate and when it was resolved. Null for an ungated release and for one recorded before chant 0.124.28. */
+  admission: { op: string; gate: string; resolvedAt: string } | null;
   /** Read flags, such as `legacy-digest` (#2514). */
   flags: string[];
   /**
@@ -185,6 +191,34 @@ export interface StatusMember {
   stewards: StatusSteward[];
   /** Why a steward or a last run may be missing from `stewards`. */
   stewardReasons: { code: StewardReasonCode; message: string }[];
+  /**
+   * The member's promotion order (#4030): the literal entries of the
+   * `environments` array in its chant.config.ts, in order, each with whether
+   * it is marked canary. A release moves from each step to the next. `[]`
+   * when the config declares no environments, null when it could not be read.
+   * Added in contract 1 by chant 0.124.28.
+   */
+  promotionOrder: PromotionStep[] | null;
+  /**
+   * The member's release cuts (#4026, ws-104), oldest first, each with
+   * whether its signature verifies for its actor against the signers at
+   * base and, when the declaration names a `release` gate with a class,
+   * whether the actor is in it (#4031). `[]` when none is cut, null when the
+   * cuts could not be read. Added in contract 1 by chant 0.124.28.
+   */
+  releaseCuts: StatusReleaseCut[] | null;
+}
+
+/** One cut of a member's release (#4031), as `status --json` lists it. */
+export interface StatusReleaseCut {
+  releaseDigest: string;
+  label: string | null;
+  /** The release's commit, or null when its release file can't be read. */
+  commit: string | null;
+  actor: string;
+  timestamp: string;
+  signature: string | null;
+  signatureCheck: ReleaseSignatureCheck;
 }
 
 /** The most paths `ship.pending.paths` lists; `files` still counts them all. */
@@ -318,6 +352,8 @@ export interface StatusQuery {
   now?: string;
   /** Reads one member's stewards; the declaration and ledger reader unless a test swaps it. */
   readStewards?: typeof readMemberStewards;
+  /** Reads one member's promotion order from its directory; its chant.config.ts unless a test swaps it. */
+  readPromotionOrder?: (dir: string) => Promise<PromotionStep[] | null>;
 }
 
 /** A factory view with the declaration's x- keys on it and on its check, publish and tiers (#3595). */
@@ -443,6 +479,8 @@ async function readEnvironment(member: Member, env: string, cwd: string, read: L
       runId: r.runId,
       timestamp: r.timestamp,
       actor: r.actor,
+      approver: r.approver ?? null,
+      admission: r.admission ? { op: r.admission.op, gate: r.admission.gate, resolvedAt: r.admission.resolvedAt } : null,
       flags: [...(r.flags ?? [])],
       plan: await readReleasePlan(r.digest, { cwd, prefix: planPrefix }),
     })),
@@ -506,6 +544,7 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
     // #3163: the declaration's identity.gates at base, read once for every member's gates.
     const ruleSource = scopeSource(found.dir);
     const rules = (gate: string) => gateAdmissionFrom(ruleSource, gate);
+    const releaseRule = releaseRuleFrom(ruleSource).rule;
     const members: StatusMember[] = [];
     for (const m of declaration.members) {
       const environments: StatusEnvironment[] = [];
@@ -553,6 +592,8 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
               },
         stewards: stewards.stewards,
         stewardReasons: stewards.reasons,
+        promotionOrder: await (query.readPromotionOrder ?? readMemberPromotionOrder)(resolve(found.dir, m.dir)),
+        releaseCuts: await readReleaseCuts(resolve(found.dir, m.dir), releaseRule),
         ...x(m.pointer),
       });
     }
@@ -595,6 +636,35 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
   }
 }
 
+/**
+ * A member's release cuts with their signatures judged (#4031), read from
+ * its ledger on the local `chant/lifecycle`. Null when they can't be read.
+ */
+async function readReleaseCuts(memberDir: string, rule: GateAdmissionRule): Promise<StatusReleaseCut[] | null> {
+  try {
+    const { readCuts, readRelease } = await import("../lifecycle/release-store");
+    const loc = { cwd: memberDir };
+    const { cuts } = await readCuts(loc);
+    const commits = new Map<string, string | null>();
+    const out: StatusReleaseCut[] = [];
+    for (const c of cuts) {
+      if (!commits.has(c.releaseDigest)) commits.set(c.releaseDigest, (await readRelease(c.releaseDigest, loc))?.commit ?? null);
+      out.push({
+        releaseDigest: c.releaseDigest,
+        label: c.label,
+        commit: commits.get(c.releaseDigest) ?? null,
+        actor: c.actor,
+        timestamp: c.timestamp,
+        signature: c.signature,
+        signatureCheck: checkReleaseSignature(rule, c),
+      });
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The work leases of the flat ledger and of each member's (#2732). Leases are
  * env-independent, so the environment asked for doesn't narrow them. Never
@@ -715,6 +785,15 @@ export function formatStatus(doc: Extract<StatusDocument, { members: unknown }>)
     for (const a of doc.acceptance) rows.push([a.member ? `${a.member}/${a.item}` : a.item, a.state ?? "-", `${a.met}/${a.total}`]);
     lines.push(...table(rows));
   }
+  const cut = doc.members.filter((m) => (m.releaseCuts ?? []).length > 0);
+  if (cut.length > 0) {
+    lines.push("");
+    const rows: string[][] = [["MEMBER", "RELEASE", "COMMIT", "CUT BY", "SIGNATURE"]];
+    for (const m of cut) {
+      for (const c of m.releaseCuts!) rows.push([m.name, c.label ?? c.releaseDigest.slice(0, 24), c.commit?.slice(0, 12) ?? "-", c.actor, c.signatureCheck.status]);
+    }
+    lines.push(...table(rows));
+  }
   const boxes = doc.members.filter((m) => m.box?.isolation);
   if (boxes.length > 0) {
     lines.push("");

package/src/workspace/trust/ci-tag-statement.ts

@@ -0,0 +1,151 @@
+/**
+ * The statement a ci tag carries (#4031): a runner's signed word that a
+ * commit went green, or went red after it was green.
+ *
+ * `ci/green/<sha>` and `ci/revoked/<sha>` are plain git tags (ws-103), so
+ * anyone who may push a tag could make one by hand and go around CI. When the
+ * declaration sets `ci.green.signedSince` to a commit, a tag on any commit
+ * that is not a strict first-parent ancestor of it counts only when its
+ * annotation holds a statement signed by a runner key, and readers ignore
+ * and report a tag without a valid one.
+ *
+ * The statement reuses what runner evidence (#2553, ws-069) and the agent-run
+ * statement (#3192, ws-090) already use: an in-toto Statement v1 in a DSSE
+ * envelope (./dsse.ts), signed with an Ed25519 key that `.chant/trust.json`
+ * at base lists under `runners`. The key's principal must also hold the
+ * `runner` role there, since a tag says CI ran. A key the signers file lists
+ * is never a runner key (./policy.ts).
+ *
+ * - `subject`: the tagged commit, by `digest.gitCommit`.
+ * - `predicate`: the signer's principal and the tag's JSON record as the
+ *   annotation holds it (`tag`, `commit`, `branch`, `at`, and the phases'
+ *   runs for a green tag or the failed phase and run for a revoked one).
+ *
+ * The envelope sits in the annotation's JSON record as `statement`, beside
+ * the fields it signs, so a reader that does not know it reads the record as
+ * before. Verifying needs the tag, the envelope and the runner keys at base,
+ * so it works offline, and every read verifies again.
+ */
+
+import { z } from "zod";
+import { canonicalJson } from "../../effect-receipt";
+import { IN_TOTO_PAYLOAD_TYPE, signEnvelope, verifyEnvelope, type DsseEnvelope } from "./dsse";
+import { STATEMENT_TYPE } from "./evidence";
+import type { KeyObject } from "node:crypto";
+import type { RunnerKey } from "./policy";
+
+export const CI_TAG_PREDICATE = "https://intentius.io/chant/ci-tag/v1";
+
+/** The role a tag's signer must hold in `.chant/trust.json` (#4031): the core class `runner`. */
+export const CI_TAG_SIGNER_ROLE = "runner";
+
+const fullCommit = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
+const text = z.string().min(1);
+
+/** The statement a ci tag carries. Strict at the top, so a verifier never acts on a field it does not know. */
+export const ciTagStatementSchema = z
+  .object({
+    _type: z.literal(STATEMENT_TYPE),
+    subject: z
+      .array(
+        z
+          .object({ name: fullCommit, digest: z.object({ gitCommit: fullCommit }).strict() })
+          .strict()
+          .refine((s) => s.name === s.digest.gitCommit, "a commit subject is named by its own id"),
+      )
+      .length(1),
+    predicateType: z.literal(CI_TAG_PREDICATE),
+    predicate: z
+      .object({
+        signer: text,
+        record: z
+          .object({ schema: z.literal(1), tag: z.enum(["green", "revoked"]), commit: fullCommit, branch: text, at: text })
+          .passthrough(),
+      })
+      .strict(),
+  })
+  .strict();
+export type CiTagStatement = z.infer<typeof ciTagStatementSchema>;
+
+/** A tag's JSON record, without the statement. */
+export type CiTagRecord = Record<string, unknown> & { tag: "green" | "revoked"; commit: string; branch: string };
+
+/** Whoever signs the tags a tick makes: a runner key and the principal `.chant/trust.json` lists it for. */
+export interface CiTagSigner {
+  principal: string;
+  key: KeyObject;
+  publicKey: string;
+}
+
+export function buildCiTagStatement(record: CiTagRecord, signer: string): CiTagStatement {
+  return {
+    _type: STATEMENT_TYPE,
+    subject: [{ name: record.commit, digest: { gitCommit: record.commit } }],
+    predicateType: CI_TAG_PREDICATE,
+    predicate: { signer, record: record as CiTagStatement["predicate"]["record"] },
+  };
+}
+
+/** The envelope a tag's record carries as `statement`, signed by `signer`. */
+export function signCiTagRecord(record: CiTagRecord, signer: CiTagSigner): DsseEnvelope {
+  const statement = buildCiTagStatement(record, signer.principal);
+  return signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from(canonicalJson(statement), "utf8"), signer.key, signer.publicKey);
+}
+
+/**
+ * Why a tag is ignored: it has no statement, the statement is not one, no
+ * runner key at base signed it, or it signs another tag's facts. The same
+ * words a run's attestation uses (`./run-statement.ts`).
+ */
+export type CiTagFailure = "unsigned" | "invalid" | "untrusted" | "mismatch";
+
+export type CiTagVerdict =
+  | { status: "signed"; signer: string; keyid: string; reason: string }
+  | { status: CiTagFailure; reason: string };
+
+const normalise = (name: string): string => name.normalize("NFKC").trim().toLowerCase();
+
+/**
+ * Verify the statement in a tag's record. `expect` is what the tag itself
+ * says: the commit its name gives, its kind and the declared branch. The
+ * signer's key must be a runner key at base and its principal must hold the
+ * `runner` role in `roles`. Never throws.
+ */
+export function verifyCiTagStatement(
+  record: Record<string, unknown> | null,
+  expect: { sha: string; kind: "green" | "revoked"; branch: string },
+  runners: readonly RunnerKey[],
+  roles: Readonly<Record<string, readonly string[]>>,
+): CiTagVerdict {
+  const tag = `ci/${expect.kind}/${expect.sha}`;
+  if (record === null) return { status: "unsigned", reason: `${tag} has no JSON record in its annotation, so it carries no statement (a lightweight tag, or one made by hand)` };
+  const { statement: envelope, ...fields } = record;
+  if (envelope === undefined) return { status: "unsigned", reason: `${tag} carries no statement signed by a runner key` };
+  const v = verifyEnvelope(envelope, runners);
+  if (!v.ok) return { status: v.code === "envelope-untrusted" ? "untrusted" : "invalid", reason: `${tag}: ${v.reason}` };
+  if (!(roles[CI_TAG_SIGNER_ROLE] ?? []).some((p) => normalise(p) === normalise(v.principal))) {
+    return { status: "untrusted", reason: `${tag} is signed by ${v.principal}'s runner key, and ${v.principal} holds no ${CI_TAG_SIGNER_ROLE} role in .chant/trust.json at base` };
+  }
+  if (v.payloadType !== IN_TOTO_PAYLOAD_TYPE) return { status: "invalid", reason: `${tag}: payload type ${v.payloadType} is not ${IN_TOTO_PAYLOAD_TYPE}` };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(v.payload.toString("utf8"));
+  } catch {
+    return { status: "invalid", reason: `${tag}: the statement's payload is not JSON` };
+  }
+  const parsed = ciTagStatementSchema.safeParse(raw);
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "/"}: ${i.message}`).join("; ");
+    return { status: "invalid", reason: `${tag}: the payload is not a ${CI_TAG_PREDICATE} statement: ${detail}` };
+  }
+  const p = parsed.data.predicate;
+  if (p.signer !== v.principal) return { status: "invalid", reason: `${tag}: the statement names signer ${JSON.stringify(p.signer)}, but ${v.principal}'s key signed it` };
+  const differs: string[] = [];
+  if (parsed.data.subject[0]!.name !== expect.sha) differs.push(`it is for commit ${parsed.data.subject[0]!.name.slice(0, 12)}`);
+  if (p.record.commit !== expect.sha) differs.push(`its record names commit ${p.record.commit.slice(0, 12)}`);
+  if (p.record.tag !== expect.kind) differs.push(`it signs a ${p.record.tag} tag`);
+  if (p.record.branch !== expect.branch) differs.push(`it is for branch ${p.record.branch}, and ci.green names ${expect.branch}`);
+  if (canonicalJson(p.record) !== canonicalJson(fields)) differs.push("the annotation's record is not the one signed");
+  if (differs.length > 0) return { status: "mismatch", reason: `${tag} is signed by ${v.principal}, but the statement does not match the tag: ${differs.join("; ")}` };
+  return { status: "signed", signer: v.principal, keyid: v.keyid, reason: `signed by ${v.principal} (${CI_TAG_SIGNER_ROLE})` };
+}

package/src/workspace/trust/op-run-statement.ts

@@ -0,0 +1,148 @@
+/**
+ * The Op-run statement (#4044): a runner's signed word that an Op ran on a
+ * commit and settled as its run record says.
+ *
+ * `chant ci tick` can take chant's own Op runs as its status source in place
+ * of a forge's check runs (`ci.green.source: "runs"`), so a project whose
+ * pipelines run as chant Ops gets green and revoked tags with no forge check
+ * runs. The run ledger on `chant/lifecycle` is written by whatever ran the
+ * Op, so the tick counts a run only when its record carries a statement
+ * signed by a runner key, the same keys and role a ci tag needs (#4031):
+ * `.chant/trust.json` at base lists the key under `runners`, and its
+ * principal holds the `runner` role there. A key the signers file lists is
+ * never a runner key (./policy.ts).
+ *
+ * The statement is an in-toto Statement v1 in a DSSE envelope (./dsse.ts),
+ * as runner evidence (#2553), the agent-run statement (#3192) and the ci tag
+ * statement (#4031) are:
+ *
+ * - `subject`: the commit the run built from (`gitSha`), by `digest.gitCommit`.
+ * - `predicate`: the signer's principal, and the run's id, Op, env, status
+ *   and the SHA-256 of its record without the statement.
+ *
+ * The runner signs at the end of the run when it is given a key
+ * (`chant run <op> --key <file>` or `CHANT_RUNNER_KEY`), and the envelope is
+ * stored on the record itself as `statement`, so the record and its
+ * signature are one ledger line. Verifying needs the record and the runner
+ * keys at base, so it works offline, and every read verifies again.
+ */
+
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { canonicalJson } from "../../effect-receipt";
+import type { OpRunRecord } from "../../op/runtime";
+import { IN_TOTO_PAYLOAD_TYPE, signEnvelope, verifyEnvelope, type DsseEnvelope } from "./dsse";
+import { STATEMENT_TYPE } from "./evidence";
+import { CI_TAG_SIGNER_ROLE, type CiTagFailure, type CiTagSigner } from "./ci-tag-statement";
+import type { RunnerKey } from "./policy";
+
+export const OP_RUN_PREDICATE = "https://intentius.io/chant/op-run/v1";
+
+const fullCommit = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
+const text = z.string().min(1);
+
+/** The statement a runner signs for an Op run. Strict, so a verifier never acts on a field it does not know. */
+export const opRunStatementSchema = z
+  .object({
+    _type: z.literal(STATEMENT_TYPE),
+    subject: z
+      .array(
+        z
+          .object({ name: fullCommit, digest: z.object({ gitCommit: fullCommit }).strict() })
+          .strict()
+          .refine((s) => s.name === s.digest.gitCommit, "a commit subject is named by its own id"),
+      )
+      .length(1),
+    predicateType: z.literal(OP_RUN_PREDICATE),
+    predicate: z
+      .object({
+        signer: text,
+        run: z
+          .object({
+            id: text,
+            op: text,
+            env: text,
+            status: z.enum(["ok", "fail", "gated", "waiting"]),
+            record: z.object({ sha256: z.string().regex(/^[0-9a-f]{64}$/) }).strict(),
+          })
+          .strict(),
+      })
+      .strict(),
+  })
+  .strict();
+export type OpRunStatement = z.infer<typeof opRunStatementSchema>;
+
+/**
+ * The SHA-256 of a run record: the canonical JSON (keys sorted, no
+ * whitespace) of the record without its `statement`, so storing the
+ * statement never changes the hash it signs.
+ */
+export function opRunRecordDigest(record: OpRunRecord): string {
+  const { statement: _statement, ...rest } = record;
+  return createHash("sha256").update(canonicalJson(rest), "utf8").digest("hex");
+}
+
+/** The statement for a settled run, as `signer` would sign it. Throws for a run that knew no commit. */
+export function buildOpRunStatement(record: OpRunRecord, signer: string): OpRunStatement {
+  const sha = record.gitSha;
+  if (!sha || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(sha)) {
+    throw new Error(`run ${record.id} of ${record.op} names no full commit sha, so there is no commit for its statement to sign`);
+  }
+  return {
+    _type: STATEMENT_TYPE,
+    subject: [{ name: sha, digest: { gitCommit: sha } }],
+    predicateType: OP_RUN_PREDICATE,
+    predicate: { signer, run: { id: record.id, op: record.op, env: record.env, status: record.status, record: { sha256: opRunRecordDigest(record) } } },
+  };
+}
+
+/** The envelope a run record carries as `statement`, signed by `signer`. */
+export function signOpRunRecord(record: OpRunRecord, signer: CiTagSigner): DsseEnvelope {
+  const statement = buildOpRunStatement(record, signer.principal);
+  return signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from(canonicalJson(statement), "utf8"), signer.key, signer.publicKey);
+}
+
+/** One run record judged: signed by a runner holding the `runner` role, or why not, in the words a ci tag uses. */
+export type OpRunVerdict = { status: "signed"; signer: string; keyid: string; reason: string } | { status: CiTagFailure; reason: string };
+
+const normalise = (name: string): string => name.normalize("NFKC").trim().toLowerCase();
+
+/**
+ * Verify the statement a run record carries against the runner keys and
+ * roles at base: a signature by a runner key whose principal holds the
+ * `runner` role, over a statement for this run, its commit and its record as
+ * the ledger holds it. Never throws.
+ */
+export function verifyOpRunStatement(record: OpRunRecord, runners: readonly RunnerKey[], roles: Readonly<Record<string, readonly string[]>>): OpRunVerdict {
+  const run = `run ${record.id} of ${record.op}`;
+  if (record.statement === undefined) return { status: "unsigned", reason: `${run} carries no statement signed by a runner key` };
+  const v = verifyEnvelope(record.statement, runners);
+  if (!v.ok) return { status: v.code === "envelope-untrusted" ? "untrusted" : "invalid", reason: `${run}: ${v.reason}` };
+  if (!(roles[CI_TAG_SIGNER_ROLE] ?? []).some((p) => normalise(p) === normalise(v.principal))) {
+    return { status: "untrusted", reason: `${run} is signed by ${v.principal}'s runner key, and ${v.principal} holds no ${CI_TAG_SIGNER_ROLE} role in .chant/trust.json at base` };
+  }
+  if (v.payloadType !== IN_TOTO_PAYLOAD_TYPE) return { status: "invalid", reason: `${run}: payload type ${v.payloadType} is not ${IN_TOTO_PAYLOAD_TYPE}` };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(v.payload.toString("utf8"));
+  } catch {
+    return { status: "invalid", reason: `${run}: the statement's payload is not JSON` };
+  }
+  const parsed = opRunStatementSchema.safeParse(raw);
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "/"}: ${i.message}`).join("; ");
+    return { status: "invalid", reason: `${run}: the payload is not a ${OP_RUN_PREDICATE} statement: ${detail}` };
+  }
+  const p = parsed.data.predicate;
+  if (p.signer !== v.principal) return { status: "invalid", reason: `${run}: the statement names signer ${JSON.stringify(p.signer)}, but ${v.principal}'s key signed it` };
+  const differs: string[] = [];
+  if (parsed.data.subject[0]!.name !== record.gitSha) differs.push(`it is for commit ${parsed.data.subject[0]!.name.slice(0, 12)}, and the record names ${record.gitSha ? record.gitSha.slice(0, 12) : "none"}`);
+  if (p.run.id !== record.id) differs.push(`it is for run ${p.run.id}`);
+  if (p.run.op !== record.op) differs.push(`it is for Op ${p.run.op}`);
+  if (p.run.env !== record.env) differs.push(`it is for env ${p.run.env}`);
+  if (p.run.status !== record.status) differs.push(`it says ${p.run.status}, and the record says ${record.status}`);
+  const digest = opRunRecordDigest(record);
+  if (p.run.record.sha256 !== digest) differs.push(`the record hashed ${p.run.record.sha256.slice(0, 12)} when signed and ${digest.slice(0, 12)} now`);
+  if (differs.length > 0) return { status: "mismatch", reason: `${run} is signed by ${v.principal}, but the statement does not match its record: ${differs.join("; ")}` };
+  return { status: "signed", signer: v.principal, keyid: v.keyid, reason: `signed by ${v.principal} (${CI_TAG_SIGNER_ROLE})` };
+}

package/src/workspace/trust/rotation.ts

@@ -256,15 +256,24 @@ export function signerHistory(repo: string, base: string, signersPath: string):
   return { versions };
 }
 
+/** A full commit id, as git prints it: lowercase hex, sha1 or sha256. */
+const FULL_ID = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+
 /**
  * Finds the signer set in effect for a commit, by its position in the base's
- * history. Built once per base; the first-parent line is read once and
- * each lookup is a binary search.
+ * history. Built once per base. The first-parent line and the parents of
+ * every commit the base reaches are read once, in two `git rev-list` walks,
+ * and each lookup of a full commit id is then a map read (#4032). Before,
+ * each lookup ran `git merge-base --is-ancestor` about log2(n) times, and a
+ * trace over a busy file spent most of its time starting those processes. A
+ * commit named any other way (a ref, an abbreviated id) is still looked up
+ * with `git merge-base`, as before.
  */
 export class SignerPositions {
   private line: string[] | undefined;
   private index = new Map<string, number>();
   private memo = new Map<string, SignerVersion | null>();
+  private entries: Map<string, number> | undefined;
 
   constructor(
     private readonly repo: string,
@@ -291,21 +300,39 @@ export class SignerPositions {
   }
 
   /**
-   * The version that judges `commit`, or null when no signer set was in
-   * effect there (before the first one, or the chain is broken).
+   * For every commit the base reaches, the index on the first-parent line
+   * (newest first) of the oldest first-parent commit that contains it: where
+   * it came in. The line is walked oldest first, and each first-parent commit
+   * marks what it reaches that nothing older reached. A marked commit's
+   * ancestors are all marked, so the walk stops at one.
    */
-  versionFor(commit: string): SignerVersion | null {
-    const hit = this.memo.get(commit);
-    if (hit !== undefined) return hit;
-    const answer = this.lookup(commit);
-    this.memo.set(commit, answer);
-    return answer;
+  private entryIndex(): Map<string, number> {
+    if (!this.entries) {
+      const line = this.firstParents();
+      const parents = new Map<string, string[]>();
+      for (const row of git(this.repo, ["rev-list", "--parents", this.base]).split("\n")) {
+        const [commit, ...ps] = row.trim().split(" ");
+        if (commit) parents.set(commit, ps);
+      }
+      const entries = new Map<string, number>();
+      for (let i = line.length - 1; i >= 0; i--) {
+        const stack = [line[i]];
+        while (stack.length > 0) {
+          const c = stack.pop()!;
+          if (entries.has(c)) continue;
+          entries.set(c, i);
+          for (const p of parents.get(c) ?? []) if (!entries.has(p)) stack.push(p);
+        }
+      }
+      this.entries = entries;
+    }
+    return this.entries;
   }
 
-  private lookup(commit: string): SignerVersion | null {
-    if (this.history.broken) return null;
-    const latest = this.history.versions.at(-1) ?? null;
-    if (!this.isAncestor(commit, this.base)) return latest;
+  /** Where `commit` came in on the first-parent line, or null when the base doesn't reach it. */
+  private entryOf(commit: string): number | null {
+    if (FULL_ID.test(commit)) return this.entryIndex().get(commit) ?? null;
+    if (!this.isAncestor(commit, this.base)) return null;
     const line = this.firstParents();
     // The oldest first-parent commit that contains `commit` is where it came in.
     let lo = 0;
@@ -320,6 +347,26 @@ export class SignerPositions {
         hi = mid - 1;
       }
     }
+    return at;
+  }
+
+  /**
+   * The version that judges `commit`, or null when no signer set was in
+   * effect there (before the first one, or the chain is broken).
+   */
+  versionFor(commit: string): SignerVersion | null {
+    const hit = this.memo.get(commit);
+    if (hit !== undefined) return hit;
+    const answer = this.lookup(commit);
+    this.memo.set(commit, answer);
+    return answer;
+  }
+
+  private lookup(commit: string): SignerVersion | null {
+    if (this.history.broken) return null;
+    const latest = this.history.versions.at(-1) ?? null;
+    const at = this.entryOf(commit);
+    if (at === null) return latest;
     // The newest version made strictly before that commit.
     let best: SignerVersion | null = null;
     let bestIndex = Infinity;

package/src/workspace/trust/seal.ts

@@ -31,6 +31,7 @@ import { type TrustPolicy } from "./policy";
 import type { Signer } from "./trust-files";
 import { sshKeygen, verifySshSignature } from "./ssh-commit";
 import { GATE_SEAL_NAMESPACE, gateSealPayload, namespaceAllowed, sshSignatureKey, verifySshSignatureWith, type SealedGateApproval } from "./gate-seal";
+import { RELEASE_SEAL_NAMESPACE, releaseSealPayload } from "../identity-gate-rule";
 
 export { GATE_SEAL_NAMESPACE, gateSealPayload, gateSealVersion, sealedFieldsOf, type SealedGateApproval } from "./gate-seal";
 
@@ -321,6 +322,15 @@ export function sealGateApproval(keyFile: string, a: SealedGateApproval): Verdic
   return sign(keyFile, gateSealPayload(a), GATE_SEAL_NAMESPACE, a.resolvedBy);
 }
 
+/**
+ * Sign a release cut (#4031) with the key in `keyFile`, over
+ * `releaseSealPayload` in the `chant-release` namespace. The cut line keeps
+ * the armored signature; its actor is the signer. Throws a {@link SealError}.
+ */
+export function sealReleaseCut(keyFile: string, cut: { releaseDigest: string; label: string | null; actor: string; timestamp: string }): VerdictSeal {
+  return sign(keyFile, releaseSealPayload(cut), RELEASE_SEAL_NAMESPACE, cut.actor);
+}
+
 function sign(keyFile: string, payload: Buffer, namespace: string, signer: string): VerdictSeal {
   const signed = sshKeygen(["-q", "-Y", "sign", "-n", namespace, "-f", keyFile], payload);
   if (signed.missing) throw new SealError("--sign needs ssh-keygen, and it is not installed here");

package/src/workspace/trust/ssh-commit.ts

@@ -57,12 +57,14 @@ export function splitSignedCommit(raw: Buffer, header = "gpgsig"): SignedCommit
   return { payload, signature: sig.length > 0 ? sig.join("\n") + "\n" : undefined };
 }
 
-function objectFormat(repo: string): string {
-  try {
-    return execFileSync("git", ["rev-parse", "--show-object-format"], { cwd: repo, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-  } catch {
-    return "sha1";
-  }
+/**
+ * The signature header of a raw commit object, by its object format, which
+ * shows in the length of its tree id. Read from the object itself, so judging
+ * a commit starts no `git rev-parse` (#4032).
+ */
+function signatureHeader(raw: Buffer): "gpgsig" | "gpgsig-sha256" {
+  const tree = /^tree ([0-9a-f]+)$/m.exec(raw.subarray(0, 200).toString("latin1"))?.[1];
+  return tree?.length === 64 ? "gpgsig-sha256" : "gpgsig";
 }
 
 /** Run ssh-keygen; `missing` is true when it is not installed. Shared with the verdict seals (./seal.ts). */
@@ -117,14 +119,13 @@ export const sshCommitAttestor: CommitAttestor = {
     const hit = cache.get(memo);
     if (hit) return hit;
     const raw = execFileSync("git", ["cat-file", "commit", commit], { cwd: ctx.repo, maxBuffer: 64 * 1024 * 1024 });
-    const answer = judgeRaw(raw, objectFormat(ctx.repo) === "sha256" ? "gpgsig-sha256" : "gpgsig", signers);
+    const answer = judgeRaw(raw, signatureHeader(raw), signers);
     cache.set(memo, answer);
     return answer;
   },
   attestRaw(ctx: AttestorContext, raw: Buffer): CommitAttestation {
     // A commit from another repository: its object format shows in its tree line.
-    const tree = /^tree ([0-9a-f]+)$/m.exec(raw.subarray(0, 200).toString("latin1"))?.[1];
-    return judgeRaw(raw, tree?.length === 64 ? "gpgsig-sha256" : "gpgsig", ctx.policy.signers);
+    return judgeRaw(raw, signatureHeader(raw), ctx.policy.signers);
   },
 };
 

package/src/cli/commands/__fixtures__/init-lexicon-output/docs/astro.config.mjs

@@ -1,14 +0,0 @@
-// @ts-check
-import { defineConfig } from 'astro/config';
-import starlight from '@astrojs/starlight';
-
-export default defineConfig({
-  integrations: [
-    starlight({
-      title: 'Fixture',
-      sidebar: [
-        { label: 'Overview', slug: '' },
-      ],
-    }),
-  ],
-});

package/src/cli/commands/__fixtures__/init-lexicon-output/docs/package.json

@@ -1,16 +0,0 @@
-{
-  "name": "@intentius/chant-lexicon-fixture-docs",
-  "type": "module",
-  "version": "0.0.1",
-  "private": true,
-  "scripts": {
-    "dev": "astro dev",
-    "build": "astro build",
-    "preview": "astro preview"
-  },
-  "dependencies": {
-    "@astrojs/starlight": "^0.37.6",
-    "astro": "^5.6.1",
-    "sharp": "^0.34.2"
-  }
-}

package/src/cli/commands/__fixtures__/init-lexicon-output/docs/src/content/docs/index.mdx

@@ -1,8 +0,0 @@
----
-title: Overview
-description: Fixture lexicon for chant
----
-
-Welcome to the Fixture lexicon documentation.
-
-Run `just generate` to populate this site with generated reference pages.