@intentius/chant 0.124.27 → 0.124.29

package/src/workspace/status.ts

@@ -39,7 +39,10 @@ import type { CommandContext } from "../cli/registry";
 import { GATES_DIR } from "../lifecycle/gate-ledger";
 import { readPathSha } from "../lifecycle/git";
 import { latestPerComponent, readReleaseLedger, type ReleaseRecord } from "../lifecycle/release-ledger";
+import { describeRevocation, revokedCommitsAt, revokedReleaseLookup, type ReleaseRevocation, type RevokedRelease } from "../lifecycle/release-revocation";
 import { readReleasePlan, type ReleasePlan } from "../lifecycle/plan-ledger";
+import { readDeployOutcomes, type DeployOutcome } from "../lifecycle/deploy-outcome";
+import { mixedEnvironment, releaseRollbackLine, rollbackTarget, type MixedEnvironment, type ReleaseCheck } from "../lifecycle/mixed-environment";
 import { listWorkLeases, type WorkLeaseState } from "../lifecycle/work-lease";
 import { readCheckoutHead, worktreeChanges, type CheckoutHead } from "./records-checkout";
 import { policyView, replicationState, type ReplicationState } from "./wip";
@@ -50,7 +53,12 @@ import { loadKindRegistry, resolveMemberFields, type MemberFields } from "./kind
 import { factoryView, listingView, plantability, treeBytes, type FactoryView, type ListingView, type Plantable } from "./box-factory";
 import { declaredRecordKinds, extensionsAt, readDeclaration, readerVersion, WorkspaceReadError, type Declaration, type ErrorLocation, type Member } from "./declaration";
 import type { ReasonCode } from "./reason-codes";
-import { gateAdmissionFrom } from "./identity";
+import type { FlagDecision, FlagValue } from "./flags";
+import type { OverlapChangeSetRef, OverlapReport } from "./overlap";
+import type { WorkLink } from "./work";
+import { readMemberPromotionOrder, type PromotionStep } from "./promotion-order";
+import { gateAdmissionFrom, releaseRuleFrom } from "./identity";
+import { checkReleaseSignature, type GateAdmissionRule, type ReleaseSignatureCheck } from "./identity-gate-rule";
 import { scopeSource } from "./write-scope";
 import { GATE_REASON_CODES, readMemberGates, type GateLedgerReader, type StatusGate, type StatusGateLedger } from "./status-gates";
 import { STEWARD_REASON_CODES, readMemberStewards, type StatusSteward, type StewardReasonCode } from "./status-stewards";
@@ -120,6 +128,14 @@ export interface StatusRelease {
   runId: string;
   timestamp: string;
   actor: string;
+  /** Who approved the change at its gate (#1035), when it had one. Null for an ungated release. */
+  approver: string | null;
+  /** The gate resolution that admitted the release (#4020): the gate and when it was resolved. Null for an ungated release and for one recorded before chant 0.124.28. */
+  admission: { op: string; gate: string; resolvedAt: string } | null;
+  /** The release this deploy was made from (#4043): the `releaseDigest` of `_releases/<releaseDigest>.json`. Null for a deploy that named no release and for one recorded before chant 0.124.29. */
+  releaseDigest: string | null;
+  /** The label that release was cut with (#4043), or null when it has none, when no release is named, or when the cut can't be read. Chant 0.124.29 and newer write it. */
+  releaseLabel: string | null;
   /** Read flags, such as `legacy-digest` (#2514). */
   flags: string[];
   /**
@@ -131,6 +147,25 @@ export interface StatusRelease {
    * hasn't fetched yet.
    */
   plan: ReleasePlan | null;
+  /**
+   * Set when the deploy names a release (`releaseDigest` on its record) that
+   * was cut from a revoked commit (#4033, ws-105): the revoked tag on that
+   * commit, the release and its label, and the line that rolls the component
+   * back. Absent otherwise, and from chant older than 0.124.29.
+   */
+  revoked?: StatusRevokedRelease;
+}
+
+/** A release an environment runs that was cut from a revoked commit (#4033). */
+export interface StatusRevokedRelease extends RevokedRelease {
+  /**
+   * The command that rolls the environment back, run in the member's
+   * directory: `chant components rollback <env> --release <label|digest>`
+   * naming the newest release the environment ran before this one that is
+   * still kept and not revoked (#4035), or `chant components rollback <env>
+   * --component <component>` when there is none.
+   */
+  rollback: string;
 }
 
 export interface StatusLedger {
@@ -148,6 +183,14 @@ export interface StatusEnvironment {
   /** The latest release of each component in the ledger, sorted by component. */
   releases: StatusRelease[];
   reason: { code: StatusReasonCode; message: string } | null;
+  /**
+   * Set when the environment runs a mix (#4035): a promote, rollback or
+   * redeploy left a component failed or gated and nothing has been recorded
+   * for it since, or its components' latest records name more than one
+   * release. Each component with what it runs, and the lines that settle it.
+   * Absent otherwise, and from chant older than 0.124.29.
+   */
+  mixed?: MixedEnvironment;
 }
 
 export type CompareState = "same" | "differs" | "only-env" | "only-compare";
@@ -185,6 +228,63 @@ export interface StatusMember {
   stewards: StatusSteward[];
   /** Why a steward or a last run may be missing from `stewards`. */
   stewardReasons: { code: StewardReasonCode; message: string }[];
+  /**
+   * The member's promotion order (#4030): the literal entries of the
+   * `environments` array in its chant.config.ts, in order, each with whether
+   * it is marked canary. A release moves from each step to the next. `[]`
+   * when the config declares no environments, null when it could not be read.
+   * Added in contract 1 by chant 0.124.28.
+   */
+  promotionOrder: PromotionStep[] | null;
+  /**
+   * The member's release cuts (#4026, ws-104), oldest first, each with
+   * whether its signature verifies for its actor against the signers at
+   * base and, when the declaration names a `release` gate with a class,
+   * whether the actor is in it (#4031). `[]` when none is cut, null when the
+   * cuts could not be read. Added in contract 1 by chant 0.124.28.
+   */
+  releaseCuts: StatusReleaseCut[] | null;
+  /**
+   * The member's feature flags (#4024): each record of a declared flag kind
+   * that names this member, with its value per environment and the work item
+   * it hides. Sorted by id. `[]` when none names it, null when the flag
+   * records could not be read. Called `featureFlags` because a release
+   * record's `flags` already means something else. Added in contract 1 by
+   * chant 0.124.29.
+   */
+  featureFlags: StatusFeatureFlag[] | null;
+}
+
+/** One feature flag of a member (#4024), as `status --json` lists it. */
+export interface StatusFeatureFlag {
+  /** The flag's name, its record's id. */
+  id: string;
+  /** The build parameter of the member the flag sets. */
+  param: string;
+  owner: string;
+  /** The value per environment, as the record writes it. An environment it leaves out builds with the parameter's default. */
+  values: Record<string, FlagValue>;
+  /** The work item the flag hides, with its state (null when no record has it), or null when the record names none. */
+  work: WorkLink | null;
+  /** Each decision the work item implements, with its state and whether it is confirmed. */
+  implements: FlagDecision[];
+  /** True when every decision the work item implements is confirmed: the flag is due for removal (check WSP118). */
+  stale: boolean;
+  /** The kind file and the record file, from the workspace root. */
+  kind: string;
+  path: string;
+}
+
+/** One cut of a member's release (#4031), as `status --json` lists it. */
+export interface StatusReleaseCut {
+  releaseDigest: string;
+  label: string | null;
+  /** The release's commit, or null when its release file can't be read. */
+  commit: string | null;
+  actor: string;
+  timestamp: string;
+  signature: string | null;
+  signatureCheck: ReleaseSignatureCheck;
 }
 
 /** The most paths `ship.pending.paths` lists; `files` still counts them all. */
@@ -294,6 +394,14 @@ export type StatusDocument =
       acceptance: StatusAcceptance[];
       /** How far each ref the box's replicate policy names is from its remote (#3172), read locally; null when no box declares one. */
       replication: ReplicationState | null;
+      /**
+       * Overlap between in-flight work items (#4025): pairs of items whose
+       * linked commits touch the same files, or that both reach one entry of
+       * a change set a pending or approved gate binds. A report, never a
+       * lock. Null when no work kind is declared or the work records or
+       * history can't be read. Added in contract 1 by chant 0.124.29.
+       */
+      overlap: OverlapReport | null;
       summary: { members: number; released: number; unreadable: number; differing: number | null };
     }
   | {
@@ -312,12 +420,16 @@ export interface StatusQuery {
   compareTo?: string;
   /** Reads one ledger; the lifecycle reader unless a test swaps it. */
   readLedger?: LedgerReader;
+  /** Reads the deploy outcomes beside one ledger (#4035), given the ledger's path; the lifecycle reader unless a test swaps it. */
+  readOutcomes?: OutcomeReader;
   /** Reads one member's gate ledger directory; git unless a test swaps it. */
   readGates?: GateLedgerReader;
   /** The instant a gate's expiry is measured against; now by default. */
   now?: string;
   /** Reads one member's stewards; the declaration and ledger reader unless a test swaps it. */
   readStewards?: typeof readMemberStewards;
+  /** Reads one member's promotion order from its directory; its chant.config.ts unless a test swaps it. */
+  readPromotionOrder?: (dir: string) => Promise<PromotionStep[] | null>;
 }
 
 /** A factory view with the declaration's x- keys on it and on its check, publish and tiers (#3595). */
@@ -412,7 +524,27 @@ async function shipView(member: Member, cwd: string, read: LedgerReader): Promis
 
 const defaultReader: LedgerReader = (path, cwd) => readReleaseLedger(path.slice(0, -"/releases.jsonl".length), { cwd });
 
-async function readEnvironment(member: Member, env: string, cwd: string, read: LedgerReader): Promise<StatusEnvironment> {
+/** Reads the deploy outcomes (#4035) in the directory of the ledger at `path`. */
+type OutcomeReader = (path: string, cwd: string) => Promise<DeployOutcome[]>;
+
+const defaultOutcomeReader: OutcomeReader = (path, cwd) => readDeployOutcomes(path.slice(0, -"/releases.jsonl".length), { cwd }).catch(() => []);
+
+/** A release digest's revocation, for one member, or null (#4033). */
+type RevokedOf = (releaseDigest: string) => Promise<RevokedRelease | null>;
+
+/** The per-component rollback line, for a component an environment runs from a revoked release when no earlier release can be named (#4033). */
+export function rollbackLine(env: string, component: string): string {
+  return `chant components rollback ${env} --component ${component}`;
+}
+
+async function readEnvironment(
+  member: Member,
+  env: string,
+  cwd: string,
+  read: LedgerReader,
+  revokedOf: RevokedOf = async () => null,
+  readOutcomes: OutcomeReader = defaultOutcomeReader,
+): Promise<StatusEnvironment> {
   const ledger = await ledgerFor(member, env, cwd);
   let records: ReleaseRecord[];
   let malformed: number;
@@ -434,6 +566,37 @@ async function readEnvironment(member: Member, env: string, cwd: string, read: L
   // member (see plan-ledger.ts's readReleasePlan doc).
   const planPrefix = ledger.layout === "members" ? `${MEMBERS_DIR}/${member.name}/` : "";
   const latest = [...latestPerComponent(records).values()].sort((a, b) => (a.component < b.component ? -1 : a.component > b.component ? 1 : 0));
+  // #4043: a release item names the label of the release it was deployed from.
+  const memberDir = resolve(cwd, member.dir);
+  let labels = new Map<string, string>();
+  let labelsRead = false;
+  const readLabels = async (): Promise<Map<string, string>> => {
+    if (labelsRead) return labels;
+    labelsRead = true;
+    try {
+      const { readCuts, labelsByDigest } = await import("../lifecycle/release-store");
+      labels = labelsByDigest((await readCuts({ cwd: memberDir })).cuts);
+    } catch {
+      // The label is a convenience; the digest is the join key.
+    }
+    return labels;
+  };
+  if (latest.some((r) => r.releaseDigest !== undefined)) await readLabels();
+  // #4035: whether a release a rollback could go back to is kept and not revoked.
+  const checks = new Map<string, Promise<ReleaseCheck>>();
+  const check = (digest: string): Promise<ReleaseCheck> => {
+    let found = checks.get(digest);
+    if (!found) {
+      found = (async () => {
+        const { readRelease } = await import("../lifecycle/release-store");
+        const kept = (await readRelease(digest, { cwd: memberDir }).catch(() => null)) !== null;
+        return { kept, revoked: kept && (await revokedOf(digest)) !== null };
+      })();
+      checks.set(digest, found);
+    }
+    return found;
+  };
+  const back = { records, check, label: async (digest: string) => (await readLabels()).get(digest) };
   const releases: StatusRelease[] = await Promise.all(
     latest.map(async (r) => ({
       component: r.component,
@@ -443,10 +606,16 @@ async function readEnvironment(member: Member, env: string, cwd: string, read: L
       runId: r.runId,
       timestamp: r.timestamp,
       actor: r.actor,
+      approver: r.approver ?? null,
+      admission: r.admission ? { op: r.admission.op, gate: r.admission.gate, resolvedAt: r.admission.resolvedAt } : null,
+      releaseDigest: r.releaseDigest ?? null,
+      releaseLabel: (r.releaseDigest !== undefined ? labels.get(r.releaseDigest) : undefined) ?? null,
       flags: [...(r.flags ?? [])],
       plan: await readReleasePlan(r.digest, { cwd, prefix: planPrefix }),
+      ...(await revokedItem(r, env, revokedOf, back)),
     })),
   );
+  const mixed = await mixedEnvironment({ env, records, outcomes: await readOutcomes(ledger.path, cwd), label: back.label, check });
   return {
     env,
     ledger: { ...ledger, shared: false },
@@ -455,9 +624,47 @@ async function readEnvironment(member: Member, env: string, cwd: string, read: L
       malformed > 0
         ? { code: "ledger-malformed", message: `${ledger.path}: ${malformed} line${malformed === 1 ? " is" : "s are"} not a release record and ${malformed === 1 ? "was" : "were"} skipped` }
         : null,
+    ...(mixed ? { mixed } : {}),
   };
 }
 
+/**
+ * `{ revoked }` when the record names a release cut from a revoked commit
+ * (#4033), else nothing. Its rollback line names the newest release the
+ * environment ran before this one that is kept and not revoked (#4035).
+ */
+async function revokedItem(
+  r: ReleaseRecord,
+  env: string,
+  revokedOf: RevokedOf,
+  back: { records: readonly ReleaseRecord[]; check: (digest: string) => Promise<ReleaseCheck>; label: (digest: string) => Promise<string | undefined> },
+): Promise<{ revoked?: StatusRevokedRelease }> {
+  if (r.releaseDigest === undefined) return {};
+  const revoked = await revokedOf(r.releaseDigest);
+  if (!revoked) return {};
+  const target = await rollbackTarget({ records: back.records, exclude: new Set([r.releaseDigest]), before: r.timestamp, check: back.check });
+  const rollback = target ? releaseRollbackLine(env, target, await back.label(target)) : rollbackLine(env, r.component);
+  return { revoked: { ...revoked, rollback } };
+}
+
+/**
+ * A release gate whose release was cut from a revoked commit is superseded
+ * (#4033): `chant approve` refuses it and the promote refuses the release, so
+ * neither an approval nor a pending fact will pass it. An expired gate stays
+ * expired. The gate carries the revocation.
+ */
+async function supersedeRevokedGates(gates: StatusGate[], revokedOf: RevokedOf): Promise<StatusGate[]> {
+  return Promise.all(
+    gates.map(async (g) => {
+      if (g.releaseDigest === undefined) return g;
+      const revoked = await revokedOf(g.releaseDigest);
+      if (!revoked) return g;
+      const { releaseDigest: _d, label: _l, ...revocation } = revoked;
+      return { ...g, state: g.state === "expired" ? g.state : "superseded", revoked: revocation };
+    }),
+  );
+}
+
 /** The digest two environments are compared on: the input side when there is one. */
 const compareKey = (r: StatusRelease): string => r.inputDigest ?? r.digest;
 
@@ -506,10 +713,18 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
     // #3163: the declaration's identity.gates at base, read once for every member's gates.
     const ruleSource = scopeSource(found.dir);
     const rules = (gate: string) => gateAdmissionFrom(ruleSource, gate);
+    const releaseRule = releaseRuleFrom(ruleSource).rule;
+    // #4033 (ws-105): revoked commits, read from local tags once and only when a release is met.
+    // Tags that can't be judged read as none revoked; workspace check reports the declaration.
+    let revokedCommits: Promise<ReadonlyMap<string, ReleaseRevocation>> | undefined;
+    const revoked = () => (revokedCommits ??= revokedCommitsAt(top, ruleSource.declaration?.ci?.green ?? null).catch(() => new Map()));
+    // #4024: the flag records, read once for every member. Unreadable records list as null.
+    const flags = await readStatusFlags(declaration, found.dir);
     const members: StatusMember[] = [];
     for (const m of declaration.members) {
+      const revokedOf = revokedReleaseLookup(resolve(found.dir, m.dir), revoked);
       const environments: StatusEnvironment[] = [];
-      for (const env of envs) environments.push(await readEnvironment(m, env, found.dir, read));
+      for (const env of envs) environments.push(await readEnvironment(m, env, found.dir, read, revokedOf, query.readOutcomes));
       const own = await hasMemberLedger(m, found.dir);
       const gates = await readMemberGates(own ? `${MEMBERS_DIR}/${m.name}/${GATES_DIR}` : GATES_DIR, own ? "members" : "flat", commit, envs, found.dir, now, query.readGates, rules);
       const stewards = await (query.readStewards ?? readMemberStewards)(resolve(found.dir, m.dir), query.env, now, m.kind, m.box);
@@ -526,7 +741,7 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
         compare: query.compareTo === undefined ? null : compareEnvironments(environments[0], environments[environments.length - 1]),
         readable: environments.every((e) => e.reason === null),
         gateLedger: gates.ledger,
-        gates: gates.gates,
+        gates: await supersedeRevokedGates(gates.gates, revokedOf),
         box:
           m.box === null
             ? null
@@ -553,6 +768,9 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
               },
         stewards: stewards.stewards,
         stewardReasons: stewards.reasons,
+        promotionOrder: await (query.readPromotionOrder ?? readMemberPromotionOrder)(resolve(found.dir, m.dir)),
+        releaseCuts: await readReleaseCuts(resolve(found.dir, m.dir), releaseRule),
+        featureFlags: flags === null ? null : flags.filter((f) => f.member === m.name).map(({ member: _member, ...f }) => f),
         ...x(m.pointer),
       });
     }
@@ -565,6 +783,16 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
 
     const leases = await readWorkspaceLeases(declaration.members, found.dir, new Date(now));
     const acceptance = await readWorkspaceAcceptance(declaration, found.dir);
+    // #4025: the change sets still waiting to apply, the ones a pending or approved gate binds.
+    const pendingChangeSets: OverlapChangeSetRef[] = [];
+    for (const m of members) {
+      const own = m.gateLedger.layout === "members";
+      for (const g of m.gates) {
+        if (g.changeSet === undefined || (g.state !== "pending" && g.state !== "approved")) continue;
+        pendingChangeSets.push({ digest: g.changeSet, cwd: resolve(found.dir, m.dir), ledgerMember: own ? m.name : null, gitSha: g.gitSha ?? null });
+      }
+    }
+    const overlap = await readStatusOverlap(declaration, found.dir, top, pendingChangeSets);
 
     return {
       ...head,
@@ -578,6 +806,7 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
       leases,
       acceptance,
       replication: replicationOf(declaration, top),
+      overlap,
       summary: {
         members: members.length,
         released: members.filter((m) => m.environments[0].releases.length > 0).length,
@@ -595,6 +824,35 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
   }
 }
 
+/**
+ * A member's release cuts with their signatures judged (#4031), read from
+ * its ledger on the local `chant/lifecycle`. Null when they can't be read.
+ */
+async function readReleaseCuts(memberDir: string, rule: GateAdmissionRule): Promise<StatusReleaseCut[] | null> {
+  try {
+    const { readCuts, readRelease } = await import("../lifecycle/release-store");
+    const loc = { cwd: memberDir };
+    const { cuts } = await readCuts(loc);
+    const commits = new Map<string, string | null>();
+    const out: StatusReleaseCut[] = [];
+    for (const c of cuts) {
+      if (!commits.has(c.releaseDigest)) commits.set(c.releaseDigest, (await readRelease(c.releaseDigest, loc))?.commit ?? null);
+      out.push({
+        releaseDigest: c.releaseDigest,
+        label: c.label,
+        commit: commits.get(c.releaseDigest) ?? null,
+        actor: c.actor,
+        timestamp: c.timestamp,
+        signature: c.signature,
+        signatureCheck: checkReleaseSignature(rule, c),
+      });
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The work leases of the flat ledger and of each member's (#2732). Leases are
  * env-independent, so the environment asked for doesn't narrow them. Never
@@ -610,6 +868,31 @@ async function readWorkspaceLeases(members: Member[], cwd: string, now: Date): P
   return out;
 }
 
+/** Every flag of the declared flag kinds (#4024), read in the working tree, sorted by id; null when they can't be read. */
+async function readStatusFlags(declaration: Declaration, root: string): Promise<Array<StatusFeatureFlag & { member: string }> | null> {
+  if (declaredRecordKinds(declaration).length === 0) return [];
+  try {
+    const { readWorkspaceFlags } = await import("./flags-read");
+    const { flags } = await readWorkspaceFlags(root);
+    return flags
+      .map((f) => ({ id: f.id, member: f.member, param: f.param, owner: f.owner, values: f.values, work: f.work, implements: f.implements, stale: f.stale, kind: f.kind, path: f.path }))
+      .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+  } catch {
+    return null;
+  }
+}
+
+/** The overlap report (#4025); null when no work kind is declared or it can't be read. */
+async function readStatusOverlap(declaration: Declaration, root: string, top: string, changeSets: OverlapChangeSetRef[]): Promise<OverlapReport | null> {
+  if (declaredRecordKinds(declaration).length === 0) return null;
+  try {
+    const { readOverlap } = await import("./overlap");
+    return await readOverlap({ declaration, root, top, changeSets });
+  } catch {
+    return null;
+  }
+}
+
 /** The acceptance counts of every declared work kind with criteria (#2772), read in the working tree. */
 async function readWorkspaceAcceptance(declaration: Declaration, root: string): Promise<StatusAcceptance[]> {
   if (declaredRecordKinds(declaration).length === 0) return [];
@@ -695,6 +978,22 @@ export function formatStatus(doc: Extract<StatusDocument, { members: unknown }>)
       for (const e of m.environments) {
         if (e.reason) memberNotes.push(`  ${e.reason.code}: ${e.reason.message}`);
         else if (e.ledger.shared && e.releases.length > 0) memberNotes.push(`  ${e.env} is read from the shared flat ledger ${e.ledger.path}`);
+        // #4033: a component running a release cut from a revoked commit, and the way back.
+        for (const r of e.releases) {
+          if (!r.revoked) continue;
+          const name = r.revoked.label ?? r.revoked.releaseDigest;
+          memberNotes.push(`  ${e.env}: ${r.component} runs release ${name}, revoked by ${r.revoked.tag} (${describeRevocation(r.revoked)}); roll back: ${r.revoked.rollback}`);
+        }
+        // #4035: an environment running a mix, what each component runs, and the lines that settle it.
+        if (e.mixed) {
+          const what = e.mixed.components.map((c) => {
+            const runs = c.releaseDigest ? `release ${c.releaseLabel ?? c.releaseDigest.slice(0, 24)}` : c.digest ? "no release" : "nothing recorded";
+            return c.state === "settled" ? `${c.component} runs ${runs}` : `${c.component} ${c.state} (${c.attempt!.verb} ${c.attempt!.runId}), recorded ${runs}`;
+          });
+          memberNotes.push(`  ${e.env} is mixed: ${what.join("; ")}`);
+          for (const line of e.mixed.redeploy) memberNotes.push(`    redeploy: ${line}`);
+          if (e.mixed.rollback) memberNotes.push(`    roll back: ${e.mixed.rollback}`);
+        }
       }
       if (memberNotes.length > 0) notes.set(rows.length - 1, memberNotes);
     }
@@ -715,6 +1014,37 @@ export function formatStatus(doc: Extract<StatusDocument, { members: unknown }>)
     for (const a of doc.acceptance) rows.push([a.member ? `${a.member}/${a.item}` : a.item, a.state ?? "-", `${a.met}/${a.total}`]);
     lines.push(...table(rows));
   }
+  const cut = doc.members.filter((m) => (m.releaseCuts ?? []).length > 0);
+  if (cut.length > 0) {
+    lines.push("");
+    const rows: string[][] = [["MEMBER", "RELEASE", "COMMIT", "CUT BY", "SIGNATURE"]];
+    for (const m of cut) {
+      for (const c of m.releaseCuts!) rows.push([m.name, c.label ?? c.releaseDigest.slice(0, 24), c.commit?.slice(0, 12) ?? "-", c.actor, c.signatureCheck.status]);
+    }
+    lines.push(...table(rows));
+  }
+  const flagged = doc.members.filter((m) => (m.featureFlags ?? []).length > 0);
+  if (flagged.length > 0) {
+    lines.push("");
+    const rows: string[][] = [["FLAG", "PARAM", doc.env.toUpperCase(), "WORK ITEM", ""]];
+    for (const m of flagged) {
+      for (const f of m.featureFlags!) {
+        const value = f.values[doc.env];
+        rows.push([`${m.name}/${f.id}`, f.param, value === undefined ? "default" : JSON.stringify(value), f.work ? `${f.work.id} (${f.work.state ?? "unknown"})` : "-", f.stale ? "due for removal" : ""]);
+      }
+    }
+    lines.push(...table(rows));
+  }
+  // #4025: in-flight work items that changed the same thing.
+  if (doc.overlap && doc.overlap.pairs.length > 0) {
+    lines.push("");
+    const rows: string[][] = [["OVERLAP", "FILES", "ADDRESSES"]];
+    for (const p of doc.overlap.pairs) {
+      const list = (xs: string[]) => (xs.length === 0 ? "-" : xs.length <= 2 ? xs.join(", ") : `${xs.slice(0, 2).join(", ")} and ${xs.length - 2} more`);
+      rows.push([`${p.items[0]} and ${p.items[1]}`, list(p.files), list([...new Set(p.addresses.map((x) => x.node ?? x.address))])]);
+    }
+    lines.push(...table(rows));
+  }
   const boxes = doc.members.filter((m) => m.box?.isolation);
   if (boxes.length > 0) {
     lines.push("");

package/src/workspace/trust/ci-tag-statement.ts

@@ -0,0 +1,151 @@
+/**
+ * The statement a ci tag carries (#4031): a runner's signed word that a
+ * commit went green, or went red after it was green.
+ *
+ * `ci/green/<sha>` and `ci/revoked/<sha>` are plain git tags (ws-103), so
+ * anyone who may push a tag could make one by hand and go around CI. When the
+ * declaration sets `ci.green.signedSince` to a commit, a tag on any commit
+ * that is not a strict first-parent ancestor of it counts only when its
+ * annotation holds a statement signed by a runner key, and readers ignore
+ * and report a tag without a valid one.
+ *
+ * The statement reuses what runner evidence (#2553, ws-069) and the agent-run
+ * statement (#3192, ws-090) already use: an in-toto Statement v1 in a DSSE
+ * envelope (./dsse.ts), signed with an Ed25519 key that `.chant/trust.json`
+ * at base lists under `runners`. The key's principal must also hold the
+ * `runner` role there, since a tag says CI ran. A key the signers file lists
+ * is never a runner key (./policy.ts).
+ *
+ * - `subject`: the tagged commit, by `digest.gitCommit`.
+ * - `predicate`: the signer's principal and the tag's JSON record as the
+ *   annotation holds it (`tag`, `commit`, `branch`, `at`, and the phases'
+ *   runs for a green tag or the failed phase and run for a revoked one).
+ *
+ * The envelope sits in the annotation's JSON record as `statement`, beside
+ * the fields it signs, so a reader that does not know it reads the record as
+ * before. Verifying needs the tag, the envelope and the runner keys at base,
+ * so it works offline, and every read verifies again.
+ */
+
+import { z } from "zod";
+import { canonicalJson } from "../../effect-receipt";
+import { IN_TOTO_PAYLOAD_TYPE, signEnvelope, verifyEnvelope, type DsseEnvelope } from "./dsse";
+import { STATEMENT_TYPE } from "./evidence";
+import type { KeyObject } from "node:crypto";
+import type { RunnerKey } from "./policy";
+
+export const CI_TAG_PREDICATE = "https://intentius.io/chant/ci-tag/v1";
+
+/** The role a tag's signer must hold in `.chant/trust.json` (#4031): the core class `runner`. */
+export const CI_TAG_SIGNER_ROLE = "runner";
+
+const fullCommit = z.string().regex(/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/);
+const text = z.string().min(1);
+
+/** The statement a ci tag carries. Strict at the top, so a verifier never acts on a field it does not know. */
+export const ciTagStatementSchema = z
+  .object({
+    _type: z.literal(STATEMENT_TYPE),
+    subject: z
+      .array(
+        z
+          .object({ name: fullCommit, digest: z.object({ gitCommit: fullCommit }).strict() })
+          .strict()
+          .refine((s) => s.name === s.digest.gitCommit, "a commit subject is named by its own id"),
+      )
+      .length(1),
+    predicateType: z.literal(CI_TAG_PREDICATE),
+    predicate: z
+      .object({
+        signer: text,
+        record: z
+          .object({ schema: z.literal(1), tag: z.enum(["green", "revoked"]), commit: fullCommit, branch: text, at: text })
+          .passthrough(),
+      })
+      .strict(),
+  })
+  .strict();
+export type CiTagStatement = z.infer<typeof ciTagStatementSchema>;
+
+/** A tag's JSON record, without the statement. */
+export type CiTagRecord = Record<string, unknown> & { tag: "green" | "revoked"; commit: string; branch: string };
+
+/** Whoever signs the tags a tick makes: a runner key and the principal `.chant/trust.json` lists it for. */
+export interface CiTagSigner {
+  principal: string;
+  key: KeyObject;
+  publicKey: string;
+}
+
+export function buildCiTagStatement(record: CiTagRecord, signer: string): CiTagStatement {
+  return {
+    _type: STATEMENT_TYPE,
+    subject: [{ name: record.commit, digest: { gitCommit: record.commit } }],
+    predicateType: CI_TAG_PREDICATE,
+    predicate: { signer, record: record as CiTagStatement["predicate"]["record"] },
+  };
+}
+
+/** The envelope a tag's record carries as `statement`, signed by `signer`. */
+export function signCiTagRecord(record: CiTagRecord, signer: CiTagSigner): DsseEnvelope {
+  const statement = buildCiTagStatement(record, signer.principal);
+  return signEnvelope(IN_TOTO_PAYLOAD_TYPE, Buffer.from(canonicalJson(statement), "utf8"), signer.key, signer.publicKey);
+}
+
+/**
+ * Why a tag is ignored: it has no statement, the statement is not one, no
+ * runner key at base signed it, or it signs another tag's facts. The same
+ * words a run's attestation uses (`./run-statement.ts`).
+ */
+export type CiTagFailure = "unsigned" | "invalid" | "untrusted" | "mismatch";
+
+export type CiTagVerdict =
+  | { status: "signed"; signer: string; keyid: string; reason: string }
+  | { status: CiTagFailure; reason: string };
+
+const normalise = (name: string): string => name.normalize("NFKC").trim().toLowerCase();
+
+/**
+ * Verify the statement in a tag's record. `expect` is what the tag itself
+ * says: the commit its name gives, its kind and the declared branch. The
+ * signer's key must be a runner key at base and its principal must hold the
+ * `runner` role in `roles`. Never throws.
+ */
+export function verifyCiTagStatement(
+  record: Record<string, unknown> | null,
+  expect: { sha: string; kind: "green" | "revoked"; branch: string },
+  runners: readonly RunnerKey[],
+  roles: Readonly<Record<string, readonly string[]>>,
+): CiTagVerdict {
+  const tag = `ci/${expect.kind}/${expect.sha}`;
+  if (record === null) return { status: "unsigned", reason: `${tag} has no JSON record in its annotation, so it carries no statement (a lightweight tag, or one made by hand)` };
+  const { statement: envelope, ...fields } = record;
+  if (envelope === undefined) return { status: "unsigned", reason: `${tag} carries no statement signed by a runner key` };
+  const v = verifyEnvelope(envelope, runners);
+  if (!v.ok) return { status: v.code === "envelope-untrusted" ? "untrusted" : "invalid", reason: `${tag}: ${v.reason}` };
+  if (!(roles[CI_TAG_SIGNER_ROLE] ?? []).some((p) => normalise(p) === normalise(v.principal))) {
+    return { status: "untrusted", reason: `${tag} is signed by ${v.principal}'s runner key, and ${v.principal} holds no ${CI_TAG_SIGNER_ROLE} role in .chant/trust.json at base` };
+  }
+  if (v.payloadType !== IN_TOTO_PAYLOAD_TYPE) return { status: "invalid", reason: `${tag}: payload type ${v.payloadType} is not ${IN_TOTO_PAYLOAD_TYPE}` };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(v.payload.toString("utf8"));
+  } catch {
+    return { status: "invalid", reason: `${tag}: the statement's payload is not JSON` };
+  }
+  const parsed = ciTagStatementSchema.safeParse(raw);
+  if (!parsed.success) {
+    const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "/"}: ${i.message}`).join("; ");
+    return { status: "invalid", reason: `${tag}: the payload is not a ${CI_TAG_PREDICATE} statement: ${detail}` };
+  }
+  const p = parsed.data.predicate;
+  if (p.signer !== v.principal) return { status: "invalid", reason: `${tag}: the statement names signer ${JSON.stringify(p.signer)}, but ${v.principal}'s key signed it` };
+  const differs: string[] = [];
+  if (parsed.data.subject[0]!.name !== expect.sha) differs.push(`it is for commit ${parsed.data.subject[0]!.name.slice(0, 12)}`);
+  if (p.record.commit !== expect.sha) differs.push(`its record names commit ${p.record.commit.slice(0, 12)}`);
+  if (p.record.tag !== expect.kind) differs.push(`it signs a ${p.record.tag} tag`);
+  if (p.record.branch !== expect.branch) differs.push(`it is for branch ${p.record.branch}, and ci.green names ${expect.branch}`);
+  if (canonicalJson(p.record) !== canonicalJson(fields)) differs.push("the annotation's record is not the one signed");
+  if (differs.length > 0) return { status: "mismatch", reason: `${tag} is signed by ${v.principal}, but the statement does not match the tag: ${differs.join("; ")}` };
+  return { status: "signed", signer: v.principal, keyid: v.keyid, reason: `signed by ${v.principal} (${CI_TAG_SIGNER_ROLE})` };
+}