@intentius/chant 0.124.27 → 0.124.29

package/src/workspace/ci-green-cli.ts

@@ -1,32 +1,61 @@
 /**
  * `chant ci` (#3573, ws-103): which commits passed CI.
  *
- *   ci last-green [--json]               the newest commit on the branch with a green tag and no revoked tag
- *   ci tick [--dry-run] [--forge github] tag the commits that turned green, revoke the ones that turned red
+ *   ci last-green [--json] [--from <rev>] the newest commit on the branch with a green tag and no revoked tag
+ *   ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs]
+ *                                        the branch's commits within the window, each with its state and phase results
+ *   ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>]
+ *                                        tag the commits that turned green, revoke the ones that turned red
  *   ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>]
- *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
+ *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]
  *                                        write the root CI file that runs the tick
  *
- * `last-green --json` prints `ci-last-green.schema.json`. The tick and the
+ * The tick signs its tags with a runner key (#4031) from `--key <file>` or
+ * the PEM in `CHANT_RUNNER_KEY`, which the generated workflow sets from the
+ * secret `--runner-key-secret` names.
+ *
+ * `--source runs` (or `ci.green.source: "runs"`) reads phase results from
+ * chant's own signed Op runs on `chant/lifecycle` in place of the forge's
+ * check runs (#4044); a tick from runs needs no forge token.
+ *
+ * `last-green --json` prints `ci-last-green.schema.json` and `list --json` prints
+ * `ci-list.schema.json`. The tick and the
  * workflow print text.
  */
 
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { formatError } from "../cli/format";
 import type { CommandContext } from "../cli/registry";
 import { findWorkspaceRoot } from "../project-root";
-import { ciTick, CiGreenError, formatTick, lastGreen } from "./ci-green";
+import { ciList, ciTick, CiGreenError, formatList, formatTick, lastGreen, RUNNER_KEY_ENV } from "./ci-green";
 import { ciForgeFromEnv } from "./ci-green-forge";
 import { ACTIONS_NAME, CI_GREEN_WORKFLOW_FILE, ciGreenHeader, type PushToken, readWorkflowSources, renderCiGreenWorkflow, workflowsHolding, writeWorkflowFile } from "./ci-green-workflow";
-import { readDeclaration, readerVersion, WorkspaceReadError } from "./declaration";
+import { readDeclaration, readerVersion, WorkspaceReadError, type CiSource } from "./declaration";
 import { recordGeneratedFiles, resolveMemberContext, shellArg } from "./member-pipeline";
 import { gitTop, workingTree } from "./tree";
 
-const USAGE = "chant ci last-green [--json] | ci tick [--dry-run] [--forge github] | ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>] [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]";
+const USAGE =
+  "chant ci last-green [--json] [--from <rev>] | ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs] | ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>] | " +
+  "ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>] [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]";
+
+export { RUNNER_KEY_ENV };
+
+/** `--source`, checked (#4044): `checks` or `runs`, or undefined to follow `ci.green.source`. */
+function sourceOf(args: CommandContext["args"]): CiSource | undefined {
+  const v = args.source;
+  if (v === undefined) return undefined;
+  if (v !== "checks" && v !== "runs") throw new Error(`--source takes checks (the forge's check runs) or runs (chant's own Op runs), not ${JSON.stringify(v)}`);
+  return v;
+}
+
+/** Each ignored tag as a warning line for stderr (#4031). */
+function warnIgnored(ignored: readonly { tag: string; status: string; reason: string }[]): void {
+  for (const t of ignored) console.error(`warning: ignored ${t.tag} (${t.status}): ${t.reason}`);
+}
 
 export async function runCiLastGreen(ctx: CommandContext): Promise<number> {
-  const doc = lastGreen({ cwd: process.cwd() });
+  const doc = lastGreen({ cwd: process.cwd(), ...(ctx.args.migrateFrom !== undefined ? { from: ctx.args.migrateFrom } : {}) });
   if (ctx.args.json) {
     console.log(JSON.stringify(doc, null, 2));
     return "error" in doc ? 1 : 0;
@@ -35,6 +64,7 @@ export async function runCiLastGreen(ctx: CommandContext): Promise<number> {
     console.error(formatError({ message: doc.error.message, hint: USAGE }));
     return 1;
   }
+  warnIgnored(doc.ignored);
   if (!doc.commit) {
     console.error(`No first-parent commit of ${doc.ref} has a ci/green tag without a ci/revoked one. Fetch the tags first: git fetch origin --tags`);
     return 1;
@@ -43,12 +73,39 @@ export async function runCiLastGreen(ctx: CommandContext): Promise<number> {
   return 0;
 }
 
+export async function runCiList(ctx: CommandContext): Promise<number> {
+  try {
+    const limit = ctx.args.limit;
+    if (limit !== undefined && (!Number.isInteger(limit) || limit < 1)) throw new Error("--limit takes a whole number of commits, 1 or more");
+    // Only an explicit --forge reaches the network; without it the list reads local refs and tags.
+    const forge = ctx.args.forge !== undefined ? ciForgeFromEnv(ctx.args.forge) : undefined;
+    const source = sourceOf(ctx.args);
+    const doc = await ciList({ cwd: process.cwd(), limit, since: ctx.args.since, forge, ...(source ? { source } : {}) });
+    if (ctx.args.json) {
+      console.log(JSON.stringify(doc, null, 2));
+      return "error" in doc ? 1 : 0;
+    }
+    if ("error" in doc) {
+      console.error(formatError({ message: doc.error.message, hint: USAGE }));
+      return 1;
+    }
+    console.log(formatList(doc));
+    return 0;
+  } catch (err) {
+    console.error(formatError({ message: `chant ci list: ${describe(err)}`, hint: USAGE }));
+    return 1;
+  }
+}
+
 const describe = (err: unknown) => (err instanceof WorkspaceReadError ? err.describe() : err instanceof Error ? err.message : String(err));
 
 export async function runCiTick(ctx: CommandContext): Promise<number> {
   try {
-    const forge = ciForgeFromEnv(ctx.args.forge ?? "github");
-    const result = await ciTick({ cwd: process.cwd(), forge, dryRun: ctx.args.dryRun === true });
+    const source = sourceOf(ctx.args);
+    // The forge is made only when the source is check runs, so a tick from chant runs needs no forge token.
+    const forge = () => ciForgeFromEnv(ctx.args.forge ?? "github");
+    const runnerKey = ctx.args.key !== undefined ? readFileSync(resolve(ctx.args.key), "utf-8") : process.env[RUNNER_KEY_ENV] || undefined;
+    const result = await ciTick({ cwd: process.cwd(), forge, dryRun: ctx.args.dryRun === true, ...(source ? { source } : {}), ...(runnerKey !== undefined ? { runnerKey } : {}) });
     console.log(formatTick(result, ctx.args.dryRun === true));
     return 0;
   } catch (err) {
@@ -60,7 +117,7 @@ export async function runCiTick(ctx: CommandContext): Promise<number> {
 /** The push token the flags ask for, or none for the Actions token. Throws on a half-given or clashing pair. */
 function pushToken(args: CommandContext["args"]): PushToken | undefined {
   const { ciTokenSecret: secret, ciAppIdVar: appIdVar, ciAppKeySecret: appKeySecret } = args;
-  for (const [flag, name] of [["--token-secret", secret], ["--app-id-var", appIdVar], ["--app-key-secret", appKeySecret]] as const) {
+  for (const [flag, name] of [["--token-secret", secret], ["--app-id-var", appIdVar], ["--app-key-secret", appKeySecret], ["--runner-key-secret", args.ciRunnerKeySecret]] as const) {
     if (name !== undefined && !ACTIONS_NAME.test(name)) throw new Error(`${flag} takes a secret or variable name, letters, digits and underscores, not ${JSON.stringify(name)}`);
   }
   if (secret !== undefined && (appIdVar !== undefined || appKeySecret !== undefined)) throw new Error("--token-secret and --app-id-var/--app-key-secret each name the push token; pass one or the other");
@@ -102,11 +159,16 @@ export async function runCiWorkflow(ctx: CommandContext): Promise<number> {
     if (ctx.args.ciInstall) parts.push("--install", ctx.args.ciInstall);
     if (push && "secret" in push) parts.push("--token-secret", push.secret);
     if (push && "appIdVar" in push) parts.push("--app-id-var", push.appIdVar, "--app-key-secret", push.appKeySecret);
+    const runnerKeySecret = ctx.args.ciRunnerKeySecret;
+    if (runnerKeySecret) parts.push("--runner-key-secret", runnerKeySecret);
+    if (green.signedSince && !runnerKeySecret) {
+      console.error(`warning: ci.green.signedSince is set, so the tick needs a runner key; pass --runner-key-secret <NAME> naming the repository secret that holds it, or every tick will fail`);
+    }
     const command = parts.map(shellArg).join(" ");
     const workspaceRoot = relative(repoRoot, root).split(sep).join("/") || ".";
     // The install runs in the workspace root, so its lockfile there keys setup-node's npm cache.
     const npmLock = ctx.args.ciInstall && existsSync(join(root, "package-lock.json")) ? (workspaceRoot === "." ? "package-lock.json" : `${workspaceRoot}/package-lock.json`) : undefined;
-    const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push });
+    const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push, ...(runnerKeySecret ? { runnerKeySecret } : {}) });
     const written = writeWorkflowFile(target, ciGreenHeader(command, member ? "member" : "root") + yaml);
     if (member) recordGeneratedFiles(member.memberRoot, [{ path: fromRepo, command }]);
     console.log(`Wrote ${written}: ticks when ${workflows.join(", ")} complete${workflows.length === 1 ? "s" : ""} on ${green.branch}, and every 15 minutes.`);

package/src/workspace/ci-green-forge.ts

@@ -6,15 +6,18 @@
  * The tags themselves are git's, pushed to the remote like any other ref, so
  * the forge is asked for check runs and nothing else. GitHub is the one
  * forge implemented. Forgejo reports commit statuses rather than check runs,
- * and GitLab reports pipeline jobs; each can implement {@link CiForge} by
- * mapping those to {@link CheckRun}s, and until one does `--forge` refuses
- * them by name.
+ * and GitLab reports pipeline jobs, and neither gets a reader here (#4021): a
+ * project on either runs its pipelines as chant Ops and sets
+ * `ci.green.source` to `runs`, so the tick reads signed Op runs from the run
+ * ledger instead (#4044, `./ci-green.ts`). `--forge` refuses them by name and
+ * says so.
  *
  * The client takes a `fetch` like the pull-request loop's (`../pr-forge.ts`),
  * so the tests drive it with a recording fake and no network.
  */
 
 import { ForgeApiError, ForgeEnvironmentError, type ForgeFetch, type ForgeKind } from "../pr-forge";
+import type { OpRunRecord } from "../op/runtime";
 
 /** One attempt of one check run on a commit. */
 export interface CheckRun {
@@ -27,6 +30,21 @@ export interface CheckRun {
   conclusion: string | null;
   completedAt: string | null;
   url: string | null;
+  /**
+   * Set when the "check run" is a chant Op run (#4044, `ci.green.source:
+   * "runs"`): the run's id and env, the runner whose statement it carries,
+   * and that statement. `name` is then the Op's name and `id` the run's end
+   * time in milliseconds, which orders a re-run after the run it replaced.
+   */
+  opRun?: OpRunRef;
+}
+
+/** The Op run a {@link CheckRun} stands for (#4044). */
+export interface OpRunRef {
+  id: string;
+  env: string;
+  signer: string;
+  statement: NonNullable<OpRunRecord["statement"]>;
 }
 
 export interface CiForge {
@@ -87,7 +105,9 @@ export function githubCiForge(opts: GithubCiForgeOptions): CiForge {
 /** Thrown for a forge `chant ci tick` has no check-run client for yet. */
 export class CiForgeUnsupportedError extends Error {
   constructor(kind: string) {
-    super(`check runs are read from GitHub only so far, and --forge asked for ${kind}; see #3573`);
+    super(
+      `check runs are read from GitHub only, and --forge asked for ${kind}. A ${kind} project runs its pipelines as chant Ops and sets ci.green.source to "runs" (or passes --source runs), so the tick reads signed Op runs from chant/lifecycle instead`,
+    );
     this.name = "CiForgeUnsupportedError";
   }
 }

package/src/workspace/ci-green-runs.test.ts

@@ -0,0 +1,242 @@
+/**
+ * #4044: chant run results as a status source for `ci tick`. With
+ * `ci.green.source: "runs"` (or `--source runs`) the tick reads Op runs from
+ * the run ledger on `chant/lifecycle` instead of a forge's check runs. A run
+ * counts only when its record carries a statement signed by a runner key
+ * `.chant/trust.json` lists for a principal holding the `runner` role; the
+ * tick ignores and reports any other. Every tag it makes is signed, and names
+ * the runs behind it.
+ *
+ * Each test works in its own temp repository with a bare origin, and every
+ * key is a throwaway one. Nothing is written in process.cwd().
+ */
+
+import { execFileSync } from "node:child_process";
+import { createPublicKey, generateKeyPairSync } from "node:crypto";
+import { afterAll, describe, expect, test } from "vitest";
+import { cleanScratch, contract, declaration, git, scratchDir, writeFiles } from "./__fixtures__/contract-repo";
+import { ciList, ciTick, formatList, formatTick, opRunSigner, readOpRunSource } from "./ci-green";
+import { ciForgeFromEnv } from "./ci-green-forge";
+import { sshFromEd25519 } from "./trust/dsse";
+import { verifyCiTagStatement } from "./trust/ci-tag-statement";
+import { verifyOpRunStatement } from "./trust/op-run-statement";
+import { appendRunRecord, readRunLedger } from "../lifecycle/run-ledger";
+import { runOpLocally, OpRunFailure } from "../op/local-executor";
+import type { ActivityFn } from "../op/activity-registry";
+import type { OpConfig } from "../op/types";
+import type { OpRunRecord } from "../op/runtime";
+import listSchema from "./ci-list.schema.json";
+
+afterAll(cleanScratch);
+
+const NOW = new Date("2026-10-06T12:00:00Z");
+const hoursAgo = (h: number) => new Date(NOW.getTime() - h * 3_600_000).toISOString();
+const GREEN = { branch: "main", phases: { lint: ["lint"], test: ["test"] }, require: ["lint", "test"], source: "runs" };
+
+/** A throwaway runner key: its PEM and its ssh public key line. */
+function runnerKey(): { pem: string; ssh: string } {
+  const { privateKey } = generateKeyPairSync("ed25519");
+  const jwk = createPublicKey(privateKey).export({ format: "jwk" }) as { x: string };
+  return { pem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(), ssh: sshFromEd25519(Buffer.from(jwk.x, "base64url")) };
+}
+
+const BOT = runnerKey();
+const RUNNERS = [{ principal: "ci-bot", class: "runner" as const, key: BOT.ssh }];
+
+function commitAt(root: string, hours: number, file: string): string {
+  writeFiles(root, { [file]: `${file} ${hours}\n` });
+  const date = hoursAgo(hours);
+  const env = { ...process.env, GIT_AUTHOR_DATE: date, GIT_COMMITTER_DATE: date };
+  for (const args of [["add", "-A"], ["commit", "-q", "-m", file]]) {
+    execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", ...args], { cwd: root, env, stdio: "ignore" });
+  }
+  return git(root, "rev-parse", "HEAD");
+}
+
+/** A checkout on main with a bare origin, declaring `ci.green` from runs and listing BOT as the runner `ci-bot`. */
+function workspace(green: Record<string, unknown> = GREEN): { root: string; origin: string } {
+  const origin = scratchDir("chant-ci-runs-origin-");
+  git(origin, "init", "-q", "--bare");
+  const root = scratchDir("chant-ci-runs-");
+  git(root, "init", "-q");
+  git(root, "symbolic-ref", "HEAD", "refs/heads/main");
+  git(root, "config", "user.name", "t");
+  git(root, "config", "user.email", "t@example.com");
+  writeFiles(root, {
+    "chant.workspace.json": declaration([{ name: "app", dir: "app", kind: "other", because: "the app" }], { ci: { green } }),
+    ".chant/trust.json": JSON.stringify({ schema: 1, runners: [{ principal: "ci-bot", class: "runner", key: BOT.ssh }], roles: { runner: ["ci-bot"] } }),
+    "app/a.txt": "a\n",
+  });
+  git(root, "remote", "add", "origin", origin);
+  commitAt(root, 23, "app/init.txt");
+  return { root, origin };
+}
+
+const op = (name: string): OpConfig => ({ name, overview: `run ${name}`, labels: { Env: "ci" }, phases: [{ name: "Run", steps: [{ kind: "activity", fn: "step", args: {} }] }] });
+const PASS = new Map<string, ActivityFn>([["step", async () => ({})]]);
+const FAIL = new Map<string, ActivityFn>([
+  [
+    "step",
+    async () => {
+      throw new Error("red");
+    },
+  ],
+]);
+
+/** Run Op `name` at the checkout's HEAD, recording on its ledger, signed with `pem` when given. */
+async function runOp(root: string, name: string, opts: { pem?: string; fail?: boolean } = {}): Promise<OpRunRecord> {
+  const options = { cwd: root, ledger: { cwd: root }, ...(opts.pem ? { signRecord: opRunSigner(root, opts.pem) } : {}) };
+  try {
+    return (await runOpLocally(op(name), opts.fail ? FAIL : PASS, {}, undefined, options)).record;
+  } catch (err) {
+    if (err instanceof OpRunFailure) return err.result.record;
+    throw err;
+  }
+}
+
+/** Push main and the run ledger, as a CI job does after its runs. */
+function push(root: string): void {
+  git(root, "push", "-q", "origin", "main");
+  git(root, "push", "-q", "origin", "chant/lifecycle");
+}
+
+const recordOf = (root: string, tag: string) => {
+  const note = git(root, "tag", "-l", "--format=%(contents)", tag);
+  return JSON.parse(note.slice(note.indexOf("{"))) as Record<string, unknown>;
+};
+
+describe("chant runs as the ci tick's status source (#4044)", () => {
+  const readList = contract(listSchema);
+
+  test("a commit is tagged green from signed local Op runs, and the tag names and carries them", async () => {
+    const { root } = workspace();
+    const a = commitAt(root, 3, "app/a.txt");
+    const lint = await runOp(root, "lint", { pem: BOT.pem });
+    const test1 = await runOp(root, "test", { pem: BOT.pem });
+    expect(lint.gitSha).toBe(a);
+    expect(lint.statement).toBeDefined();
+    // The ledger holds the signed record, and it verifies there.
+    const stored = (await readRunLedger("ci", "test", { cwd: root })).records[0]!;
+    expect(stored.statement).toEqual(test1.statement);
+    expect(verifyOpRunStatement(stored, RUNNERS, { runner: ["ci-bot"] })).toMatchObject({ status: "signed", signer: "ci-bot" });
+    push(root);
+
+    // No forge is given: a tick from runs needs none.
+    const tick = await ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem });
+    expect(tick.source).toBe("runs");
+    expect(tick.made).toEqual([`ci/green/${a}`]);
+    expect(tick.signer).toBe("ci-bot");
+    expect(formatTick(tick)).toContain("judged from chant runs");
+
+    const record = recordOf(root, `ci/green/${a}`);
+    expect(record.source).toBe("runs");
+    const phases = record.phases as Record<string, { name: string; id: null; opRun: { id: string; env: string; signer: string; statement: unknown } }[]>;
+    expect(phases.lint![0]).toMatchObject({ name: "lint", id: null, conclusion: "success", opRun: { id: lint.id, env: "ci", signer: "ci-bot" } });
+    expect(phases.test![0]!.opRun.id).toBe(test1.id);
+    expect(phases.test![0]!.opRun.statement).toEqual(test1.statement);
+    expect(verifyCiTagStatement(record, { sha: a, kind: "green", branch: "main" }, RUNNERS, { runner: ["ci-bot"] })).toMatchObject({ status: "signed" });
+
+    // The tag is pushed, and ci list reads it.
+    expect(git(scratchDir("chant-ci-runs-peek-"), "ls-remote", "--tags", git(root, "remote", "get-url", "origin"))).toContain(`refs/tags/ci/green/${a}`);
+    const list = await ciList({ cwd: root, now: NOW });
+    readList.expectValid(list);
+    const at = (list as Extract<typeof list, { commits: unknown }>).commits.find((c) => c.sha === a)!;
+    expect(at.state).toBe("green");
+    expect(at.phases[0]).toMatchObject({ phase: "lint", result: "pass", runs: [{ name: "lint", id: null, opRun: { id: lint.id, env: "ci", signer: "ci-bot" } }] });
+    expect(at.ignoredRuns).toEqual([]);
+
+    // A second tick over the same runs changes nothing.
+    expect((await ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem })).made).toEqual([]);
+  });
+
+  test("an unsigned run is refused: it neither greens nor revokes a commit, and is reported", async () => {
+    const { root } = workspace();
+    const a = commitAt(root, 3, "app/a.txt");
+    await runOp(root, "lint", { pem: BOT.pem });
+    const unsigned = await runOp(root, "test");
+    expect(unsigned.statement).toBeUndefined();
+    push(root);
+
+    const tick = await ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem });
+    expect(tick.made).toEqual([]);
+    const at = tick.commits.find((c) => c.sha === a)!;
+    expect(at.verdict?.verdict).toBe("pending");
+    expect(at.ignoredRuns).toEqual([{ run: unsigned.id, op: "test", env: "ci", status: "unsigned", reason: expect.stringContaining("carries no statement signed by a runner key") }]);
+    expect(formatTick(tick)).toContain(`ignored run ${unsigned.id} of test in ci (unsigned)`);
+    expect(git(root, "tag", "-l")).toBe("");
+
+    const list = (await ciList({ cwd: root, now: NOW })) as Extract<Awaited<ReturnType<typeof ciList>>, { commits: unknown }>;
+    readList.expectValid(list);
+    const listed = list.commits.find((c) => c.sha === a)!;
+    expect(listed.phases.map((p) => [p.phase, p.result])).toEqual([
+      ["lint", "pass"],
+      ["test", "pending"],
+    ]);
+    expect(listed.ignoredRuns?.map((r) => r.status)).toEqual(["unsigned"]);
+    expect(formatList(list)).toContain(`ignored run ${unsigned.id} of test in ci (unsigned)`);
+
+    // Signed now, the commit goes green; a later unsigned failure does not revoke it.
+    await runOp(root, "test", { pem: BOT.pem });
+    push(root);
+    expect((await ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem })).made).toEqual([`ci/green/${a}`]);
+    await runOp(root, "test", { fail: true });
+    push(root);
+    const after = await ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem });
+    expect(after.made).toEqual([]);
+    expect(after.commits.find((c) => c.sha === a)!.ignoredRuns?.map((r) => r.status)).toEqual(["unsigned", "unsigned"]);
+  });
+
+  test("a run signed by an unlisted key, or whose record changed after signing, does not count", async () => {
+    const { root } = workspace();
+    const a = commitAt(root, 3, "app/a.txt");
+    // A key trust.json does not list can't sign a run here at all.
+    const mallory = runnerKey();
+    expect(() => opRunSigner(root, mallory.pem)).toThrow(/lists no runner with this key/);
+    // A signed record whose outcome is edited before it reaches the ledger.
+    const signed = await runOp(root, "lint", { pem: BOT.pem });
+    const { version: _v, ...input } = { ...signed, status: "ok" as const, outcomes: { edited: true } };
+    await appendRunRecord({ ...input, id: "tampered" }, { cwd: root });
+    const source = await readOpRunSource(root, root, git(root, "rev-parse", "HEAD"));
+    expect(source.checkRuns(a).map((r) => r.opRun!.id)).toEqual([signed.id]);
+    expect(source.ignored.get(a)).toEqual([{ run: "tampered", op: "lint", env: "ci", status: "mismatch", reason: expect.stringContaining("does not match its record") }]);
+  });
+
+  test("a signed failing run revokes a green commit, and the revoked tag names the run", async () => {
+    const { root } = workspace();
+    const a = commitAt(root, 3, "app/a.txt");
+    await runOp(root, "lint", { pem: BOT.pem });
+    await runOp(root, "test", { pem: BOT.pem });
+    push(root);
+    expect((await ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem })).made).toEqual([`ci/green/${a}`]);
+
+    const red = await runOp(root, "test", { pem: BOT.pem, fail: true });
+    expect(red.status).toBe("fail");
+    push(root);
+    const tick = await ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem });
+    expect(tick.made).toEqual([`ci/revoked/${a}`]);
+    expect(formatTick(tick)).toContain("phase test, test failure");
+    const record = recordOf(root, `ci/revoked/${a}`);
+    expect(record).toMatchObject({ source: "runs", phase: "test", run: { name: "test", id: null, conclusion: "failure", opRun: { id: red.id, signer: "ci-bot" } } });
+  });
+
+  test("a tick from runs needs a runner key unless it is a dry run, --source overrides the declaration, and ci list refuses --forge", async () => {
+    const { root } = workspace({ ...GREEN, source: "checks" });
+    const a = commitAt(root, 3, "app/a.txt");
+    await runOp(root, "lint", { pem: BOT.pem });
+    await runOp(root, "test", { pem: BOT.pem });
+    push(root);
+    await expect(ciTick({ cwd: root, now: NOW, source: "runs" })).rejects.toThrow(/every tag it makes from them is signed by a runner key, and none was given/);
+    expect((await ciTick({ cwd: root, now: NOW, source: "runs", dryRun: true })).made).toEqual([`ci/green/${a}`]);
+    expect(git(root, "tag", "-l")).toBe("");
+    // The declaration says checks, so without --source the tick wants a forge.
+    await expect(ciTick({ cwd: root, now: NOW, runnerKey: BOT.pem })).rejects.toThrow(/needs a forge/);
+    await expect(ciList({ cwd: root, now: NOW, source: "runs", forge: { kind: "github", checkRuns: async () => [] } })).rejects.toThrow(/--forge reads check runs, and the source is chant runs/);
+    const list = (await ciList({ cwd: root, now: NOW, source: "runs" })) as Extract<Awaited<ReturnType<typeof ciList>>, { commits: unknown }>;
+    expect(list.commits.find((c) => c.sha === a)!.phases.map((p) => p.result)).toEqual(["pass", "pass"]);
+  });
+
+  test("GitLab and Forgejo get no check-run reader, and the refusal points at chant runs", () => {
+    expect(() => ciForgeFromEnv("gitlab", {})).toThrow(/sets ci.green.source to "runs"/);
+    expect(() => ciForgeFromEnv("forgejo", {})).toThrow(/--source runs/);
+  });
+});