@intentius/chant 0.124.27 → 0.124.29

package/dist/workspace/changes.js

@@ -41,8 +41,9 @@ import { relative, resolve, sep } from "node:path";
 import picomatch from "picomatch";
 import { declaredRecordKinds, readDeclaration, readerVersion, WORKSPACE_ERROR_CODES, WorkspaceReadError } from "./declaration.js";
 import { declaredKindFile } from "./declared-kinds.js";
+import { COMMIT_UNLINKED_FIX, hasLeaseLedger, judgeCommits, mergeCommits } from "./commit-links.js";
 import { isGeneratedPath } from "./generated-files.js";
-import { parseRegion } from "./intent.js";
+import { commitDetails, parseRegion } from "./intent.js";
 import { loadClassRegistry } from "./principal-classes.js";
 import { constraintCovers, isWorkspacePath, memberHolding } from "./record-assets.js";
 import { loadRecordKind, RecordReadError } from "./records.js";
@@ -62,6 +63,13 @@ export const CHANGES_FINDING_CODES = [
     /** A record in hand for the change lists a changed path in its out_of_scope. */
     "change-out-of-scope",
 ];
+/** The codes of a finding on a commit rather than a path (#4029). Closed. */
+export const COMMIT_LINK_FINDING_CODES = [
+    /** A trunk commit in the range names no work item: no Chant-Record of a work kind and no Chant-Lease. */
+    "commit-unlinked",
+    /** A trunk commit in the range names a work item that is not there: a record id no work kind has, a record of another kind, or a lease that resolves to nothing. */
+    "commit-wrongly-linked",
+];
 /** Why the check failed as a whole: the declaration's codes, the record kind's, or a `--work` item no record has. */
 export const CHANGES_ERROR_CODES = [
     ...WORKSPACE_ERROR_CODES,
@@ -345,6 +353,7 @@ async function run(query, head) {
     }
     const count = (s) => paths.filter((p) => p.status === s).length;
     const scope = await writeScopeAtBase(query, top, range, workspacePrefix);
+    const links = commitLinks(top, range, kinds, severity);
     return {
         ...head,
         workspace: { name: declaration.name, root: located.root },
@@ -357,9 +366,47 @@ async function run(query, head) {
         findings,
         summary: { paths: paths.length, covered: count("covered"), uncovered: count("uncovered"), outOfScope: count("out-of-scope"), ignored: count("ignored"), records: count("record") },
         scope,
-        ok: !(severity === "fail" && findings.length > 0) && (scope === null || scope.findings.length === 0),
+        links,
+        ok: !(severity === "fail" && (findings.length > 0 || (links?.findings.length ?? 0) > 0)) && (scope === null || scope.findings.length === 0),
     };
 }
+/**
+ * Whether each trunk commit of the range, first-parent and merges left out,
+ * names a work item (#4029). Records are read at the head, as the paths are.
+ * Null when no work kind was read.
+ */
+function commitLinks(top, range, kinds, severity) {
+    const work = kinds.filter((k) => k.role === "work");
+    if (work.length === 0)
+        return null;
+    const index = {
+        kinds: new Map(work.map((k) => [k.loaded.kind.name, new Set(k.records.flatMap((r) => (r.id === null ? [] : [r.id])))])),
+        ledger: hasLeaseLedger(top),
+    };
+    const shas = git(top, ["rev-list", "--first-parent", "--reverse", `${range.base}..${range.head}`]).split("\n").filter(Boolean);
+    const judged = judgeCommits(top, shas, index, mergeCommits(top, shas));
+    const details = commitDetails(top, shas);
+    const commits = [];
+    const findings = [];
+    for (const sha of shas) {
+        const link = judged.get(sha);
+        if (link.state === "merge")
+            continue;
+        const subject = details.get(sha)?.subject ?? "";
+        commits.push({ commit: sha, subject, state: link.state, ids: link.ids, problems: link.problems });
+        if (link.state === "linked" || severity === "off")
+            continue;
+        const short = sha.slice(0, 8);
+        if (link.state === "unlinked") {
+            findings.push({ id: `finding:commit-unlinked:${sha}`, code: "commit-unlinked", commit: sha, severity, message: `${short} "${subject}" carries no Chant-Record trailer of a work kind and no Chant-Lease trailer, so it names no work item`, fix: COMMIT_UNLINKED_FIX });
+        }
+        else {
+            const named = link.problems.map((p) => `${p.trailer} (${p.message})`).join("; ");
+            findings.push({ id: `finding:commit-wrongly-linked:${sha}`, code: "commit-wrongly-linked", commit: sha, severity, message: `${short} "${subject}" names no work item that exists: ${named}`, fix: `correct the trailer to name an existing work record, \`Chant-Record: ${[...index.kinds.keys()][0]}:<id>\`, or a lease taken on one` });
+        }
+    }
+    return { kinds: [...index.kinds.keys()], commits, findings };
+}
 /**
  * The write scope check over the range (#2548), with the declaration, its
  * record kinds and the trust policy read at the range's base, so a change

package/dist/workspace/changes.schema.json

@@ -210,6 +210,17 @@
             }
           ]
         },
+        "links": {
+          "description": "Whether each trunk commit of the range names the work item it belongs to (#4029): the first-parent commits of base..head, merges left out. A commit names one with a `Chant-Record: <kind>:<id>` trailer of a work kind the declaration names, or a `Chant-Lease` trailer a lease history on chant/lifecycle resolves to a work item. A window match does not count. Null when no work kind was read. The field is added within contract version 1, and is written by chant 0.124.28 and newer; a reader that finds none is reading an older chant. Its findings follow `severity`, like `findings`.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/links"
+            }
+          ]
+        },
         "ok": {
           "type": "boolean",
           "description": "False when severity is fail and there is a finding, or when scope has a finding."
@@ -637,6 +648,130 @@
           "type": "string"
         }
       }
+    },
+    "links": {
+      "type": "object",
+      "required": [
+        "kinds",
+        "commits",
+        "findings"
+      ],
+      "properties": {
+        "kinds": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The work kinds read, by name. A Chant-Record links a commit only when its kind is one of these."
+        },
+        "commits": {
+          "type": "array",
+          "description": "Oldest first.",
+          "items": {
+            "$ref": "#/$defs/linkCommit"
+          }
+        },
+        "findings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/linkFinding"
+          }
+        }
+      }
+    },
+    "linkCommit": {
+      "type": "object",
+      "required": [
+        "commit",
+        "subject",
+        "state",
+        "ids",
+        "problems"
+      ],
+      "properties": {
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40,64}$"
+        },
+        "subject": {
+          "type": "string"
+        },
+        "state": {
+          "enum": [
+            "linked",
+            "unlinked",
+            "wrong"
+          ],
+          "description": "linked: a trailer names a work record that exists, or a lease that resolves to one (a lease is taken as linked when this checkout has no chant/lifecycle branch to read). unlinked: no Chant-Record or Chant-Lease trailer names anything. wrong: trailers name a work item but none of them is one that exists."
+        },
+        "ids": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The work records the trailers name, as <kind>:<id>. Empty unless state is linked."
+        },
+        "problems": {
+          "type": "array",
+          "description": "The trailers that do not link the commit. Empty unless state is wrong.",
+          "items": {
+            "type": "object",
+            "required": [
+              "trailer",
+              "message"
+            ],
+            "properties": {
+              "trailer": {
+                "type": "string",
+                "description": "The trailer as written, such as Chant-Record: decision:ws-075."
+              },
+              "message": {
+                "type": "string"
+              }
+            }
+          }
+        }
+      }
+    },
+    "linkFinding": {
+      "type": "object",
+      "required": [
+        "id",
+        "code",
+        "commit",
+        "message",
+        "fix",
+        "severity"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "finding:<code>:<commit>."
+        },
+        "code": {
+          "enum": [
+            "commit-unlinked",
+            "commit-wrongly-linked"
+          ]
+        },
+        "commit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40,64}$"
+        },
+        "message": {
+          "type": "string"
+        },
+        "fix": {
+          "type": "string",
+          "description": "What to change so the commit names its work item."
+        },
+        "severity": {
+          "enum": [
+            "warn",
+            "fail"
+          ]
+        }
+      }
     }
   }
 }

package/dist/workspace/check.schema.json

@@ -295,11 +295,12 @@
             "box-intent-unknown",
             "box-intent-unconstrained",
             "work-acceptance-unmet",
+            "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
             "diagram-render-drift"
           ],
-          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP131 to WSP133, the diagram finding (#2764)."
+          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         }
       }
     },
@@ -373,11 +374,12 @@
             "box-intent-unknown",
             "box-intent-unconstrained",
             "work-acceptance-unmet",
+            "flag-stale",
             "diagram-source-missing",
             "diagram-render-missing",
             "diagram-render-drift"
           ],
-          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP131 to WSP133, the diagram finding (#2764)."
+          "description": "For WSP001: why the declaration can't be read. For WSP121 to WSP127, the box finding (#2726, #2727, #2780, #2850). For WSP117, work-acceptance-unmet (#2772). For WSP118, flag-stale (#4024). For WSP131 to WSP133, the diagram finding (#2764)."
         },
         "reason": {
           "type": "string"

package/dist/workspace/checks/records.d.ts

@@ -16,15 +16,23 @@
  * | WSP115 | a record kind the declaration names is missing or does not load as one (fixed, #2680) |
  * | WSP116 | an answer kind's decision points file is missing or not valid (fixed, ws-058, #2738) |
  * | WSP117 | a done work item has an acceptance criterion no passing evidence meets (#2772) |
+ * | WSP118 | a feature flag whose work item's decisions are all confirmed, so it is due for removal (#4024) |
  *
  * WSP117 reads the records of every declared work kind with acceptance
  * criteria, in the working tree, and the records of `--kind`. It carries the
  * reason code `work-acceptance-unmet`.
+ *
+ * WSP118 reads the records of every declared flag kind (#4024), in the
+ * working tree. A flag is due for removal when the work item it hides
+ * implements at least one decision and every one is confirmed: closed in its
+ * kind and superseded by nothing. It is a warning by default, since a flag
+ * left on trunk breaks nothing; the declaration's `checks` can raise it. It
+ * carries the reason code `flag-stale`.
  */
 import type { WorkspaceCheck } from "../checks.js";
 import type { ReadErrorCode, RecordEntry } from "../records.js";
 /** The read contract's codes the record checks carry as `code`: WSP117's (#2772). */
-export declare const RECORD_FINDING_CODES: readonly ["work-acceptance-unmet"];
+export declare const RECORD_FINDING_CODES: readonly ["work-acceptance-unmet", "flag-stale"];
 /** The records `check --kind` read, or why they could not be read. */
 export type RecordFacts = {
     kind: string;

package/dist/workspace/checks/records.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE7D,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,oCAAqE,CAAC;AAEvG,sEAAsE;AACtE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAC,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAgBtE,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EA2HlD,CAAC"}
+{"version":3,"file":"records.d.ts","sourceRoot":"","sources":["../../../src/workspace/checks/records.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE7D,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,kDAAmF,CAAC;AAErH,sEAAsE;AACtE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAC,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAgBtE,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,EAqJlD,CAAC"}

package/dist/workspace/checks/records.js

@@ -16,13 +16,21 @@
  * | WSP115 | a record kind the declaration names is missing or does not load as one (fixed, #2680) |
  * | WSP116 | an answer kind's decision points file is missing or not valid (fixed, ws-058, #2738) |
  * | WSP117 | a done work item has an acceptance criterion no passing evidence meets (#2772) |
+ * | WSP118 | a feature flag whose work item's decisions are all confirmed, so it is due for removal (#4024) |
  *
  * WSP117 reads the records of every declared work kind with acceptance
  * criteria, in the working tree, and the records of `--kind`. It carries the
  * reason code `work-acceptance-unmet`.
+ *
+ * WSP118 reads the records of every declared flag kind (#4024), in the
+ * working tree. A flag is due for removal when the work item it hides
+ * implements at least one decision and every one is confirmed: closed in its
+ * kind and superseded by nothing. It is a warning by default, since a flag
+ * left on trunk breaks nothing; the declaration's `checks` can raise it. It
+ * carries the reason code `flag-stale`.
  */
 /** The read contract's codes the record checks carry as `code`: WSP117's (#2772). */
-export const RECORD_FINDING_CODES = ["work-acceptance-unmet"];
+export const RECORD_FINDING_CODES = ["work-acceptance-unmet", "flag-stale"];
 function warningFindings(check, facts, code) {
     if (!facts || "error" in facts)
         return [];
@@ -166,4 +174,30 @@ export const RECORD_CHECKS = [
             return out;
         },
     },
+    {
+        id: "WSP118",
+        name: "flag-stale",
+        description: "No feature flag outlives its work: a flag whose work item implements decisions that are all confirmed (closed in their kind and superseded by nothing) is due for removal, with the parameter it backs (#4024).",
+        severity: "warning",
+        configurable: true,
+        check(ctx) {
+            const out = [];
+            for (const k of ctx.facts?.declaredKinds ?? []) {
+                for (const f of k.flags ?? []) {
+                    if (f.stale === null)
+                        continue;
+                    out.push({
+                        checkId: this.id,
+                        severity: this.severity,
+                        message: `flag ${f.flag} ${f.stale}; remove the flag record and the parameter it backs`,
+                        ...(k.declared.member !== null ? { entity: k.declared.member } : {}),
+                        pointer: "",
+                        file: f.file,
+                        code: "flag-stale",
+                    });
+                }
+            }
+            return out;
+        },
+    },
 ];

package/dist/workspace/checks.d.ts

@@ -30,6 +30,7 @@
  * | WSP115 | the record kinds the declaration names (#2680) |
  * | WSP116 | the decision points file of each declared answer kind (ws-058) |
  * | WSP117 | a done work item's acceptance criteria all met (#2772) |
+ * | WSP118 | no feature flag outlives its work: a flag whose work item's decisions are all confirmed is due for removal (#4024) |
  * | WSP121, WSP122 | boxes: no literal credential, every capability brokered (#2726) |
  * | WSP123, WSP124 | box isolation: no shared port, state path or cookie, no literal machine path (#2727) |
  * | WSP125 | boxes: a fountain Box declares the callback token fountain gives its sandbox (#2780) |

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAiMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAiMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}

package/dist/workspace/checks.js

@@ -30,6 +30,7 @@
  * | WSP115 | the record kinds the declaration names (#2680) |
  * | WSP116 | the decision points file of each declared answer kind (ws-058) |
  * | WSP117 | a done work item's acceptance criteria all met (#2772) |
+ * | WSP118 | no feature flag outlives its work: a flag whose work item's decisions are all confirmed is due for removal (#4024) |
  * | WSP121, WSP122 | boxes: no literal credential, every capability brokered (#2726) |
  * | WSP123, WSP124 | box isolation: no shared port, state path or cookie, no literal machine path (#2727) |
  * | WSP125 | boxes: a fountain Box declares the callback token fountain gives its sandbox (#2780) |
@@ -386,7 +387,7 @@ export async function runDeclarationChecks(root, display = (f) => f, options = {
     const gathered = options.gather === false || options.tree ? {} : await gatherWorkspaceFacts(root, declaration, options);
     // The declared record kinds load from the working tree; under --at only whether each exists at the revision is checked (#2680).
     // A declared work kind's acceptance criteria are counted in the working tree too (#2772).
-    const declaredKinds = options.gather === false ? undefined : await loadDeclaredKinds(declaration, tree, root, { load: !options.tree, acceptance: !options.tree });
+    const declaredKinds = options.gather === false ? undefined : await loadDeclaredKinds(declaration, tree, root, { load: !options.tree, acceptance: !options.tree, flags: !options.tree });
     // A box's intent is read from the working tree's records, so not under --at (#2850).
     const boxIntents = declaredKinds && !options.tree ? await resolveBoxIntents(declaration, root, declaredKinds) : undefined;
     // A linked member's lexicons name its tables and columns as outputs (#3931); reading them folds its source, never runs it.

package/dist/workspace/ci-green-cli.d.ts

@@ -1,17 +1,32 @@
 /**
  * `chant ci` (#3573, ws-103): which commits passed CI.
  *
- *   ci last-green [--json]               the newest commit on the branch with a green tag and no revoked tag
- *   ci tick [--dry-run] [--forge github] tag the commits that turned green, revoke the ones that turned red
+ *   ci last-green [--json] [--from <rev>] the newest commit on the branch with a green tag and no revoked tag
+ *   ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs]
+ *                                        the branch's commits within the window, each with its state and phase results
+ *   ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>]
+ *                                        tag the commits that turned green, revoke the ones that turned red
  *   ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>]
- *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
+ *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]
  *                                        write the root CI file that runs the tick
  *
- * `last-green --json` prints `ci-last-green.schema.json`. The tick and the
+ * The tick signs its tags with a runner key (#4031) from `--key <file>` or
+ * the PEM in `CHANT_RUNNER_KEY`, which the generated workflow sets from the
+ * secret `--runner-key-secret` names.
+ *
+ * `--source runs` (or `ci.green.source: "runs"`) reads phase results from
+ * chant's own signed Op runs on `chant/lifecycle` in place of the forge's
+ * check runs (#4044); a tick from runs needs no forge token.
+ *
+ * `last-green --json` prints `ci-last-green.schema.json` and `list --json` prints
+ * `ci-list.schema.json`. The tick and the
  * workflow print text.
  */
 import type { CommandContext } from "../cli/registry.js";
+import { RUNNER_KEY_ENV } from "./ci-green.js";
+export { RUNNER_KEY_ENV };
 export declare function runCiLastGreen(ctx: CommandContext): Promise<number>;
+export declare function runCiList(ctx: CommandContext): Promise<number>;
 export declare function runCiTick(ctx: CommandContext): Promise<number>;
 export declare function runCiWorkflow(ctx: CommandContext): Promise<number>;
 //# sourceMappingURL=ci-green-cli.d.ts.map

package/dist/workspace/ci-green-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAWtD,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBzE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAUpE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CxE"}
+{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAmE,cAAc,EAAE,MAAM,YAAY,CAAC;AAW7G,OAAO,EAAE,cAAc,EAAE,CAAC;AAe1B,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBpE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAapE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDxE"}

package/dist/workspace/ci-green-cli.js

@@ -1,28 +1,56 @@
 /**
  * `chant ci` (#3573, ws-103): which commits passed CI.
  *
- *   ci last-green [--json]               the newest commit on the branch with a green tag and no revoked tag
- *   ci tick [--dry-run] [--forge github] tag the commits that turned green, revoke the ones that turned red
+ *   ci last-green [--json] [--from <rev>] the newest commit on the branch with a green tag and no revoked tag
+ *   ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs]
+ *                                        the branch's commits within the window, each with its state and phase results
+ *   ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>]
+ *                                        tag the commits that turned green, revoke the ones that turned red
  *   ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>]
- *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
+ *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]
  *                                        write the root CI file that runs the tick
  *
- * `last-green --json` prints `ci-last-green.schema.json`. The tick and the
+ * The tick signs its tags with a runner key (#4031) from `--key <file>` or
+ * the PEM in `CHANT_RUNNER_KEY`, which the generated workflow sets from the
+ * secret `--runner-key-secret` names.
+ *
+ * `--source runs` (or `ci.green.source: "runs"`) reads phase results from
+ * chant's own signed Op runs on `chant/lifecycle` in place of the forge's
+ * check runs (#4044); a tick from runs needs no forge token.
+ *
+ * `last-green --json` prints `ci-last-green.schema.json` and `list --json` prints
+ * `ci-list.schema.json`. The tick and the
  * workflow print text.
  */
-import { existsSync, realpathSync } from "node:fs";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
 import { formatError } from "../cli/format.js";
 import { findWorkspaceRoot } from "../project-root.js";
-import { ciTick, CiGreenError, formatTick, lastGreen } from "./ci-green.js";
+import { ciList, ciTick, CiGreenError, formatList, formatTick, lastGreen, RUNNER_KEY_ENV } from "./ci-green.js";
 import { ciForgeFromEnv } from "./ci-green-forge.js";
 import { ACTIONS_NAME, CI_GREEN_WORKFLOW_FILE, ciGreenHeader, readWorkflowSources, renderCiGreenWorkflow, workflowsHolding, writeWorkflowFile } from "./ci-green-workflow.js";
 import { readDeclaration, readerVersion, WorkspaceReadError } from "./declaration.js";
 import { recordGeneratedFiles, resolveMemberContext, shellArg } from "./member-pipeline.js";
 import { gitTop, workingTree } from "./tree.js";
-const USAGE = "chant ci last-green [--json] | ci tick [--dry-run] [--forge github] | ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>] [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]";
+const USAGE = "chant ci last-green [--json] [--from <rev>] | ci list [--json] [--limit <n>] [--since <rev>] [--forge github] [--source checks|runs] | ci tick [--dry-run] [--forge github] [--source checks|runs] [--key <runner key.pem>] | " +
+    "ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>] [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]";
+export { RUNNER_KEY_ENV };
+/** `--source`, checked (#4044): `checks` or `runs`, or undefined to follow `ci.green.source`. */
+function sourceOf(args) {
+    const v = args.source;
+    if (v === undefined)
+        return undefined;
+    if (v !== "checks" && v !== "runs")
+        throw new Error(`--source takes checks (the forge's check runs) or runs (chant's own Op runs), not ${JSON.stringify(v)}`);
+    return v;
+}
+/** Each ignored tag as a warning line for stderr (#4031). */
+function warnIgnored(ignored) {
+    for (const t of ignored)
+        console.error(`warning: ignored ${t.tag} (${t.status}): ${t.reason}`);
+}
 export async function runCiLastGreen(ctx) {
-    const doc = lastGreen({ cwd: process.cwd() });
+    const doc = lastGreen({ cwd: process.cwd(), ...(ctx.args.migrateFrom !== undefined ? { from: ctx.args.migrateFrom } : {}) });
     if (ctx.args.json) {
         console.log(JSON.stringify(doc, null, 2));
         return "error" in doc ? 1 : 0;
@@ -31,6 +59,7 @@ export async function runCiLastGreen(ctx) {
         console.error(formatError({ message: doc.error.message, hint: USAGE }));
         return 1;
     }
+    warnIgnored(doc.ignored);
     if (!doc.commit) {
         console.error(`No first-parent commit of ${doc.ref} has a ci/green tag without a ci/revoked one. Fetch the tags first: git fetch origin --tags`);
         return 1;
@@ -38,11 +67,39 @@ export async function runCiLastGreen(ctx) {
     console.log(doc.commit.sha);
     return 0;
 }
+export async function runCiList(ctx) {
+    try {
+        const limit = ctx.args.limit;
+        if (limit !== undefined && (!Number.isInteger(limit) || limit < 1))
+            throw new Error("--limit takes a whole number of commits, 1 or more");
+        // Only an explicit --forge reaches the network; without it the list reads local refs and tags.
+        const forge = ctx.args.forge !== undefined ? ciForgeFromEnv(ctx.args.forge) : undefined;
+        const source = sourceOf(ctx.args);
+        const doc = await ciList({ cwd: process.cwd(), limit, since: ctx.args.since, forge, ...(source ? { source } : {}) });
+        if (ctx.args.json) {
+            console.log(JSON.stringify(doc, null, 2));
+            return "error" in doc ? 1 : 0;
+        }
+        if ("error" in doc) {
+            console.error(formatError({ message: doc.error.message, hint: USAGE }));
+            return 1;
+        }
+        console.log(formatList(doc));
+        return 0;
+    }
+    catch (err) {
+        console.error(formatError({ message: `chant ci list: ${describe(err)}`, hint: USAGE }));
+        return 1;
+    }
+}
 const describe = (err) => (err instanceof WorkspaceReadError ? err.describe() : err instanceof Error ? err.message : String(err));
 export async function runCiTick(ctx) {
     try {
-        const forge = ciForgeFromEnv(ctx.args.forge ?? "github");
-        const result = await ciTick({ cwd: process.cwd(), forge, dryRun: ctx.args.dryRun === true });
+        const source = sourceOf(ctx.args);
+        // The forge is made only when the source is check runs, so a tick from chant runs needs no forge token.
+        const forge = () => ciForgeFromEnv(ctx.args.forge ?? "github");
+        const runnerKey = ctx.args.key !== undefined ? readFileSync(resolve(ctx.args.key), "utf-8") : process.env[RUNNER_KEY_ENV] || undefined;
+        const result = await ciTick({ cwd: process.cwd(), forge, dryRun: ctx.args.dryRun === true, ...(source ? { source } : {}), ...(runnerKey !== undefined ? { runnerKey } : {}) });
         console.log(formatTick(result, ctx.args.dryRun === true));
         return 0;
     }
@@ -54,7 +111,7 @@ export async function runCiTick(ctx) {
 /** The push token the flags ask for, or none for the Actions token. Throws on a half-given or clashing pair. */
 function pushToken(args) {
     const { ciTokenSecret: secret, ciAppIdVar: appIdVar, ciAppKeySecret: appKeySecret } = args;
-    for (const [flag, name] of [["--token-secret", secret], ["--app-id-var", appIdVar], ["--app-key-secret", appKeySecret]]) {
+    for (const [flag, name] of [["--token-secret", secret], ["--app-id-var", appIdVar], ["--app-key-secret", appKeySecret], ["--runner-key-secret", args.ciRunnerKeySecret]]) {
         if (name !== undefined && !ACTIONS_NAME.test(name))
             throw new Error(`${flag} takes a secret or variable name, letters, digits and underscores, not ${JSON.stringify(name)}`);
     }
@@ -107,11 +164,17 @@ export async function runCiWorkflow(ctx) {
             parts.push("--token-secret", push.secret);
         if (push && "appIdVar" in push)
             parts.push("--app-id-var", push.appIdVar, "--app-key-secret", push.appKeySecret);
+        const runnerKeySecret = ctx.args.ciRunnerKeySecret;
+        if (runnerKeySecret)
+            parts.push("--runner-key-secret", runnerKeySecret);
+        if (green.signedSince && !runnerKeySecret) {
+            console.error(`warning: ci.green.signedSince is set, so the tick needs a runner key; pass --runner-key-secret <NAME> naming the repository secret that holds it, or every tick will fail`);
+        }
         const command = parts.map(shellArg).join(" ");
         const workspaceRoot = relative(repoRoot, root).split(sep).join("/") || ".";
         // The install runs in the workspace root, so its lockfile there keys setup-node's npm cache.
         const npmLock = ctx.args.ciInstall && existsSync(join(root, "package-lock.json")) ? (workspaceRoot === "." ? "package-lock.json" : `${workspaceRoot}/package-lock.json`) : undefined;
-        const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push });
+        const yaml = renderCiGreenWorkflow({ green, workflows, chantVersion: readerVersion(), workspaceRoot, chant: ctx.args.ciChant, install: ctx.args.ciInstall, npmLock, push, ...(runnerKeySecret ? { runnerKeySecret } : {}) });
         const written = writeWorkflowFile(target, ciGreenHeader(command, member ? "member" : "root") + yaml);
         if (member)
             recordGeneratedFiles(member.memberRoot, [{ path: fromRepo, command }]);

package/dist/workspace/ci-green-forge.d.ts

@@ -6,14 +6,17 @@
  * The tags themselves are git's, pushed to the remote like any other ref, so
  * the forge is asked for check runs and nothing else. GitHub is the one
  * forge implemented. Forgejo reports commit statuses rather than check runs,
- * and GitLab reports pipeline jobs; each can implement {@link CiForge} by
- * mapping those to {@link CheckRun}s, and until one does `--forge` refuses
- * them by name.
+ * and GitLab reports pipeline jobs, and neither gets a reader here (#4021): a
+ * project on either runs its pipelines as chant Ops and sets
+ * `ci.green.source` to `runs`, so the tick reads signed Op runs from the run
+ * ledger instead (#4044, `./ci-green.ts`). `--forge` refuses them by name and
+ * says so.
  *
  * The client takes a `fetch` like the pull-request loop's (`../pr-forge.ts`),
  * so the tests drive it with a recording fake and no network.
  */
 import { type ForgeFetch, type ForgeKind } from "../pr-forge.js";
+import type { OpRunRecord } from "../op/runtime.js";
 /** One attempt of one check run on a commit. */
 export interface CheckRun {
     /** The forge's id. A later attempt of the same check has a larger one. */
@@ -25,6 +28,20 @@ export interface CheckRun {
     conclusion: string | null;
     completedAt: string | null;
     url: string | null;
+    /**
+     * Set when the "check run" is a chant Op run (#4044, `ci.green.source:
+     * "runs"`): the run's id and env, the runner whose statement it carries,
+     * and that statement. `name` is then the Op's name and `id` the run's end
+     * time in milliseconds, which orders a re-run after the run it replaced.
+     */
+    opRun?: OpRunRef;
+}
+/** The Op run a {@link CheckRun} stands for (#4044). */
+export interface OpRunRef {
+    id: string;
+    env: string;
+    signer: string;
+    statement: NonNullable<OpRunRecord["statement"]>;
 }
 export interface CiForge {
     kind: ForgeKind;

package/dist/workspace/ci-green-forge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-forge.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-forge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAwC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAEpG,gDAAgD;AAChD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,MAAM,EAAE,MAAM,CAAC;IACf,8HAA8H;IAC9H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAKD,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAkCjE;AAED,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAI,EAAE,MAAM,EAGvB;CACF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAiB,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,OAAO,CAW9I"}
+{"version":3,"file":"ci-green-forge.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-forge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAwC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,gDAAgD;AAChD,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,MAAM,EAAE,MAAM,CAAC;IACf,8HAA8H;IAC9H,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,+CAA+C;IAC/C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAKD,+GAA+G;AAC/G,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAkCjE;AAED,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,IAAI,EAAE,MAAM,EAKvB;CACF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,GAAE,MAAiB,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,OAAO,CAW9I"}