@intentius/chant 0.124.27 → 0.124.29

package/src/__golden__/wave-loop/fan-out-no-members.json

@@ -565,6 +565,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 1 of 3: net",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": ""
       },
       "waves": [
@@ -627,6 +628,7 @@
           "timestamp": "2026-10-11T00:00:00.000Z",
           "expiresAt": "2026-10-13T00:00:00.000Z",
           "description": "wave 1 of 3: net",
+          "gitSha": "1111111111111111111111111111111111111111",
           "planDigest": ""
         }
       ],
@@ -725,6 +727,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 2 of 3: a, b",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:f56bc903abaf2bb2f593fcb6f83b48322c7079deed286c1439d2a4e0310e2bdd"
       },
       "waves": [
@@ -888,6 +891,7 @@
           "timestamp": "2026-10-11T00:00:00.000Z",
           "expiresAt": "2026-10-13T00:00:00.000Z",
           "description": "wave 2 of 3: a, b",
+          "gitSha": "1111111111111111111111111111111111111111",
           "planDigest": "jcs1-sha256:f56bc903abaf2bb2f593fcb6f83b48322c7079deed286c1439d2a4e0310e2bdd"
         }
       ],

package/src/__golden__/wave-loop/fan-out-only.json

@@ -119,6 +119,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 1 of 3: net",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:95bbd78ad48471cefeb1cb32a3f308abde40b2d299eac36ab86b0614f23bcccf"
       },
       "waves": [
@@ -191,6 +192,7 @@
           "timestamp": "2026-10-11T00:00:00.000Z",
           "expiresAt": "2026-10-13T00:00:00.000Z",
           "description": "wave 1 of 3: net",
+          "gitSha": "1111111111111111111111111111111111111111",
           "planDigest": "jcs1-sha256:95bbd78ad48471cefeb1cb32a3f308abde40b2d299eac36ab86b0614f23bcccf"
         }
       ],
@@ -269,6 +271,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 2 of 3: a, b",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:f56bc903abaf2bb2f593fcb6f83b48322c7079deed286c1439d2a4e0310e2bdd"
       },
       "waves": [
@@ -351,6 +354,7 @@
           "timestamp": "2026-10-11T00:00:00.000Z",
           "expiresAt": "2026-10-13T00:00:00.000Z",
           "description": "wave 2 of 3: a, b",
+          "gitSha": "1111111111111111111111111111111111111111",
           "planDigest": "jcs1-sha256:f56bc903abaf2bb2f593fcb6f83b48322c7079deed286c1439d2a4e0310e2bdd"
         }
       ],
@@ -432,6 +436,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 2 of 3: b",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:cdbfa0d8006aa5a0b18a4cd6ca51375882107ad8395f4f12e0f2ae19a95a5483"
       },
       "waves": [
@@ -504,6 +509,7 @@
           "timestamp": "2026-10-11T00:00:00.000Z",
           "expiresAt": "2026-10-13T00:00:00.000Z",
           "description": "wave 2 of 3: b",
+          "gitSha": "1111111111111111111111111111111111111111",
           "planDigest": "jcs1-sha256:cdbfa0d8006aa5a0b18a4cd6ca51375882107ad8395f4f12e0f2ae19a95a5483"
         }
       ],

package/src/__golden__/wave-loop/op-by-apply-hold.json

@@ -104,6 +104,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 1 run, gate never, approval ledger, held by before-apply hook lag (t1)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:bd002be383b5e5991600692d985c09fb3ff0bc3370a8264d1ea8f118518dcc1e"
           },
           "recorded": true,
@@ -122,6 +123,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 1 run, gate never, approval ledger, held by before-apply hook lag (t1)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:bd002be383b5e5991600692d985c09fb3ff0bc3370a8264d1ea8f118518dcc1e"
           }
         ],

package/src/__golden__/wave-loop/op-cost-member.json

@@ -53,6 +53,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (layer): 2 runs, gate always, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:138f28c4ef2e87abe7454a8f47db147636932e106e166a399866b5bf470a21af"
           },
           "recorded": true,
@@ -71,6 +72,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (layer): 2 runs, gate always, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:138f28c4ef2e87abe7454a8f47db147636932e106e166a399866b5bf470a21af"
           }
         ],
@@ -181,6 +183,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 1 (layer): 2 runs, gate always, approval ledger",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:138f28c4ef2e87abe7454a8f47db147636932e106e166a399866b5bf470a21af"
       },
       "recorded": true,

package/src/__golden__/wave-loop/op-held-on-before-apply.json

@@ -140,6 +140,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "move the queues",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "sha256:qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq"
           }
         ],

package/src/__golden__/wave-loop/op-held-on.json

@@ -110,6 +110,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "move the queues",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "sha256:qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq"
           }
         ],
@@ -250,6 +251,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "move the topics",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "sha256:tttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt"
           }
         ],

package/src/__golden__/wave-loop/op-hooks-held.json

@@ -112,6 +112,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by after-plan hook check (t2)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           },
           "recorded": true,
@@ -152,6 +153,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by after-plan hook check (t2)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           }
         ],

package/src/__golden__/wave-loop/op-hooks-hold-before-apply.json

@@ -95,6 +95,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by before-apply hook lag",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           },
           "recorded": true,
@@ -113,6 +114,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by before-apply hook lag",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           }
         ],

package/src/__golden__/wave-loop/op-hooks-refused-at-base.json

@@ -45,6 +45,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by the hooks at base cannot be run (waves.json at bbbbbbbbbbbb: `hooks.before.plan[0].command` must be a command as argv, a non-empty array of strings.)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           },
           "recorded": true,
@@ -63,6 +64,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by the hooks at base cannot be run (waves.json at bbbbbbbbbbbb: `hooks.before.plan[0].command` must be a command as argv, a non-empty array of strings.)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           }
         ],
@@ -138,6 +140,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by the hooks at base cannot be run (waves.json at bbbbbbbbbbbb: `hooks.before.plan[0].command` must be a command as argv, a non-empty array of strings.)",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
       },
       "recorded": true,

package/src/__golden__/wave-loop/op-hooks-share.json

@@ -113,6 +113,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by after-plan hook check (t2)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           },
           "recorded": true,
@@ -153,6 +154,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by after-plan hook check (t2)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           }
         ],
@@ -254,6 +256,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 1 (prod): 2 runs, gate never, approval ledger, held by after-plan hook check (t2)",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:52d1b04601e89971eab0e24094024707e878042be4b79ad476d6230ac5ef383f"
           },
           "recorded": true,

package/src/__golden__/wave-loop/op-per-run.json

@@ -80,6 +80,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           },
           "recorded": true,
@@ -98,6 +99,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -146,6 +148,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           },
           "recorded": true,
@@ -164,6 +167,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -257,6 +261,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate always, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           },
           "recorded": true,
@@ -275,6 +280,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate always, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -508,6 +514,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 2 (staging): 1 run, gate always, approval ledger",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
       },
       "recorded": true,

package/src/__golden__/wave-loop/op-pr-review.json

@@ -56,6 +56,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval pr-review",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -70,6 +71,7 @@
             "approver": {
               "kind": "human"
             },
+            "gitSha": "hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh",
             "note": "approved by the review of #7 at hhhhhhhhhhhh: github:erin",
             "url": "https://example.test/pr/7",
             "review": {
@@ -125,6 +127,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval pr-review",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           },
           "recorded": true,
@@ -149,6 +152,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval pr-review",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -198,6 +202,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval pr-review",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           },
           "recorded": true,
@@ -225,6 +230,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval pr-review",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -378,6 +384,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 2 (staging): 1 run, gate on-destructive, approval pr-review",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
       },
       "recorded": true,

package/src/__golden__/wave-loop/op-sealed.json

@@ -39,6 +39,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval sealed",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           },
           "recorded": true,
@@ -57,6 +58,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval sealed",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -115,6 +117,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 2 (staging): 1 run, gate on-destructive, approval sealed",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
       },
       "recorded": true,

package/src/__golden__/wave-loop/op-spend.json

@@ -50,6 +50,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],
@@ -114,6 +115,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           },
           "recorded": true,
@@ -132,6 +134,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 2 (staging): 1 run, gate on-destructive, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:121fce9fb501cc2872d4239f620d465480edef5fcbe86d290f3b17c017231e8d"
           }
         ],

package/src/__golden__/wave-loop/op-wave-commands.json

@@ -82,6 +82,7 @@
             "gate": "wave-1",
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:e8c434b396fbbce2b501a5fb746548ad4db81a26543b4dc2c757ec148379f853",
             "neverOverMcp": true
           },
@@ -110,6 +111,7 @@
             "gate": "wave-1",
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:e8c434b396fbbce2b501a5fb746548ad4db81a26543b4dc2c757ec148379f853",
             "neverOverMcp": true
           }
@@ -299,6 +301,7 @@
             "gate": "wave-1",
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:e8c434b396fbbce2b501a5fb746548ad4db81a26543b4dc2c757ec148379f853",
             "neverOverMcp": true
           },
@@ -333,6 +336,7 @@
             "gate": "wave-1",
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:e8c434b396fbbce2b501a5fb746548ad4db81a26543b4dc2c757ec148379f853",
             "neverOverMcp": true
           }
@@ -743,6 +747,7 @@
             "gate": "wave-1",
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:e8c434b396fbbce2b501a5fb746548ad4db81a26543b4dc2c757ec148379f853",
             "neverOverMcp": true
           },
@@ -1150,6 +1155,7 @@
             "gate": "wave-1",
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:e8c434b396fbbce2b501a5fb746548ad4db81a26543b4dc2c757ec148379f853",
             "neverOverMcp": true
           },
@@ -1662,6 +1668,7 @@
         "gate": "wave-1",
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:e8c434b396fbbce2b501a5fb746548ad4db81a26543b4dc2c757ec148379f853",
         "neverOverMcp": true
       },

package/src/__golden__/wave-loop/op-wide-waiting.json

@@ -49,6 +49,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 3 (prod): 3 runs, gate always, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
           },
           "recorded": true,
@@ -67,6 +68,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 3 (prod): 3 runs, gate always, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
           }
         ],
@@ -125,6 +127,7 @@
             "timestamp": "2026-10-11T00:00:00.000Z",
             "expiresAt": "2026-10-13T00:00:00.000Z",
             "description": "wave 3 (prod): 3 runs, gate always, approval ledger",
+            "gitSha": "1111111111111111111111111111111111111111",
             "planDigest": "jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
           },
           "recorded": true,
@@ -221,6 +224,7 @@
         "timestamp": "2026-10-11T00:00:00.000Z",
         "expiresAt": "2026-10-13T00:00:00.000Z",
         "description": "wave 3 (prod): 3 runs, gate always, approval ledger",
+        "gitSha": "1111111111111111111111111111111111111111",
         "planDigest": "jcs1-sha256:106d25f35ee6bc02e9aa253d0b2633a764396833c82e0c5ec5a4ad83a2a85b4e"
       },
       "recorded": true,

package/src/build-params.test.ts

@@ -194,3 +194,49 @@ describe("buildParamValues", () => {
     expect(buildParamValues([])).toEqual({});
   });
 });
+
+describe("resolveBuildParams — workspace flags (#4024)", () => {
+  const defs: BuildParamsConfig = { newCheckout: { type: "boolean", default: false, env: "NEW_CHECKOUT" }, tier: { type: "string", default: "light" } };
+  const flags = (value: boolean | undefined, gated = false) => ({ env: "prod", byParam: { newCheckout: { flag: "new-checkout", value } }, ...(gated ? { gated: true } : {}) });
+
+  test("a flag's value for the environment is recorded with source flag:<name>, ahead of the default", () => {
+    const r = resolveBuildParams(defs, { flags: flags(true) });
+    expect(r.errors).toEqual([]);
+    expect(r.provenance).toEqual([
+      { name: "newCheckout", value: true, source: "flag:new-checkout" },
+      { name: "tier", value: "light", source: "default" },
+    ]);
+  });
+
+  test("a flag that gives the environment no value leaves the parameter at its default", () => {
+    expect(resolveBuildParams(defs, { flags: flags(undefined) }).provenance[0]).toEqual({ name: "newCheckout", value: false, source: "default" });
+  });
+
+  test("where the environment has no gate, --param, --params-file and the env var still win over the flag", () => {
+    expect(resolveBuildParams(defs, { cli: { newCheckout: "false" }, flags: flags(true) }).provenance[0].source).toBe("cli");
+    expect(resolveBuildParams(defs, { fromFile: { newCheckout: false }, flags: flags(true) }).provenance[0].source).toBe("params-file");
+    expect(resolveBuildParams(defs, { env: { NEW_CHECKOUT: "false" }, flags: flags(true) }).provenance[0].source).toBe("env");
+  });
+
+  test("where the environment has a gate, --param, --params-file and the env var can't set a flag-backed parameter", () => {
+    const viaCli = resolveBuildParams(defs, { cli: { newCheckout: "true" }, flags: flags(false, true) });
+    expect(viaCli.errors).toEqual([
+      'build parameter "newCheckout" is backed by the flag "new-checkout", and "prod" has a gate, so --param can\'t set it; change the flag record and let the change go through the gate',
+    ]);
+    expect(viaCli.provenance.map((p) => p.name)).toEqual(["tier"]);
+    expect(resolveBuildParams(defs, { fromFile: { newCheckout: true }, flags: flags(false, true) }).errors[0]).toMatch(/so --params-file can't set it/);
+    expect(resolveBuildParams(defs, { env: { NEW_CHECKOUT: "true" }, flags: flags(false, true) }).errors[0]).toMatch(/so the env var NEW_CHECKOUT can't set it/);
+    // A parameter no flag backs is not affected.
+    expect(resolveBuildParams(defs, { cli: { tier: "big" }, flags: flags(false, true) }).errors).toEqual([]);
+  });
+
+  test("a flag that sets a parameter the config does not declare is an error", () => {
+    const r = resolveBuildParams({}, { flags: flags(true) });
+    expect(r.errors).toEqual([`flag "new-checkout" sets build parameter "newCheckout", which chant.config.ts's buildParams does not declare`]);
+  });
+
+  test("a flag value of the wrong type, or outside the enum, fails like any other source", () => {
+    const strict: BuildParamsConfig = { newCheckout: { type: "string", enum: ["a", "b"] } };
+    expect(resolveBuildParams(strict, { flags: { env: "prod", byParam: { newCheckout: { flag: "new-checkout", value: "c" } } } }).errors[0]).toMatch(/must be one of "a", "b", got "c"/);
+  });
+});

package/src/build-params.ts

@@ -73,6 +73,28 @@ export interface BuildParamsInput {
   fromFile?: Record<string, unknown>;
   /** The process environment, consulted only for a parameter that declares an `env` mapping, and only once `cli`/`fromFile` have no value for it. */
   env?: Record<string, string | undefined>;
+  /**
+   * The workspace flags that back parameters in this build's environment
+   * (#4024), read by `./flag-params.ts`. A flag-backed parameter takes the
+   * flag's value for the environment, recorded with `source: "flag:<id>"`,
+   * ahead of its `env` mapping and its default. Absent outside a workspace
+   * and without `--env`.
+   */
+  flags?: BuildParamFlags;
+}
+
+/** The flags that back parameters in one environment (#4024). */
+export interface BuildParamFlags {
+  /** The environment the build is for. */
+  env: string;
+  /** Each flag-backed parameter by name: the flag's name, and its value in `env` (undefined when the flag gives it none). */
+  byParam: Record<string, { flag: string; value: BuildParamValue | undefined }>;
+  /**
+   * The environment has a gate (#4024's precedence rule): a `--param`,
+   * `--params-file` or env-var value for a flag-backed parameter is refused,
+   * so no path flips a flag around the gate.
+   */
+  gated?: boolean;
 }
 
 /** Result of resolving a project's declared parameters against one build invocation's inputs. */
@@ -118,7 +140,11 @@ function coerce(name: string, raw: BuildParamValue, def: BuildParamDef, errors:
  * Resolve a project's declared build-time parameters against one build's
  * supplied inputs. Precedence per parameter, most to least specific:
  * `cli` (`--param name=value`) > `fromFile` (`--params-file`) > the
- * parameter's own declared `env` mapping (only if set) > `def.default`.
+ * parameter's own declared `env` mapping (only if set) > a workspace flag's
+ * value for the build's environment (`input.flags`, #4024) > `def.default`.
+ * When `input.flags.gated` is set, a flag-backed parameter takes none of the
+ * first three: a value from any of them is a build error, so a flag can't be
+ * flipped around the environment's gate.
  *
  * A parameter with no declared `default` and no value from any source is a
  * build error, not a silently-`undefined` value — a build-time parameter
@@ -153,9 +179,26 @@ export function resolveBuildParams(defs: BuildParamsConfig | undefined, input: B
     }
   }
 
+  const flags = input.flags;
+  for (const [name, binding] of Object.entries(flags?.byParam ?? {})) {
+    if (!(name in declared)) {
+      errors.push(`flag "${binding.flag}" sets build parameter "${name}", which chant.config.ts's buildParams does not declare`);
+    }
+  }
+
   for (const [name, def] of Object.entries(declared)) {
     let raw: BuildParamValue | undefined;
     let source: BuildParamProvenance["source"] | undefined;
+    const binding = flags?.byParam[name];
+
+    if (binding && flags?.gated) {
+      // #4024: in an environment with a gate, the flag record is the only way to set the parameter.
+      const around = name in cli ? "--param" : name in fromFile ? "--params-file" : def.env && env[def.env] !== undefined ? `the env var ${def.env}` : null;
+      if (around !== null) {
+        errors.push(flagGateRefusal(name, binding.flag, flags.env, around));
+        continue;
+      }
+    }
 
     if (name in cli) {
       raw = cli[name];
@@ -171,6 +214,9 @@ export function resolveBuildParams(defs: BuildParamsConfig | undefined, input: B
     } else if (def.env && env[def.env] !== undefined) {
       raw = env[def.env];
       source = "env";
+    } else if (binding && binding.value !== undefined) {
+      raw = binding.value;
+      source = `flag:${binding.flag}`;
     } else if (def.default !== undefined) {
       raw = def.default;
       source = "default";
@@ -201,6 +247,14 @@ export function resolveBuildParams(defs: BuildParamsConfig | undefined, input: B
   return { provenance, errors };
 }
 
+/**
+ * The build error for a flag-backed parameter that `around` (`--param`,
+ * `--params-file` or an env var) set in an environment with a gate (#4024).
+ */
+export function flagGateRefusal(name: string, flag: string, env: string, around: string): string {
+  return `build parameter "${name}" is backed by the flag "${flag}", and "${env}" has a gate, so ${around} can't set it; change the flag record and let the change go through the gate`;
+}
+
 /** Project the resolved provenance records down to a plain `{ name: value }` map — what actually gets bound to `params.<name>` (see ./params.ts). */
 export function buildParamValues(provenance: readonly BuildParamProvenance[]): Record<string, BuildParamValue> {
   return Object.fromEntries(provenance.map((p) => [p.name, p.value]));