@intentius/chant 0.124.28 → 0.124.29

package/src/build-params.test.ts

@@ -194,3 +194,49 @@ describe("buildParamValues", () => {
     expect(buildParamValues([])).toEqual({});
   });
 });
+
+describe("resolveBuildParams — workspace flags (#4024)", () => {
+  const defs: BuildParamsConfig = { newCheckout: { type: "boolean", default: false, env: "NEW_CHECKOUT" }, tier: { type: "string", default: "light" } };
+  const flags = (value: boolean | undefined, gated = false) => ({ env: "prod", byParam: { newCheckout: { flag: "new-checkout", value } }, ...(gated ? { gated: true } : {}) });
+
+  test("a flag's value for the environment is recorded with source flag:<name>, ahead of the default", () => {
+    const r = resolveBuildParams(defs, { flags: flags(true) });
+    expect(r.errors).toEqual([]);
+    expect(r.provenance).toEqual([
+      { name: "newCheckout", value: true, source: "flag:new-checkout" },
+      { name: "tier", value: "light", source: "default" },
+    ]);
+  });
+
+  test("a flag that gives the environment no value leaves the parameter at its default", () => {
+    expect(resolveBuildParams(defs, { flags: flags(undefined) }).provenance[0]).toEqual({ name: "newCheckout", value: false, source: "default" });
+  });
+
+  test("where the environment has no gate, --param, --params-file and the env var still win over the flag", () => {
+    expect(resolveBuildParams(defs, { cli: { newCheckout: "false" }, flags: flags(true) }).provenance[0].source).toBe("cli");
+    expect(resolveBuildParams(defs, { fromFile: { newCheckout: false }, flags: flags(true) }).provenance[0].source).toBe("params-file");
+    expect(resolveBuildParams(defs, { env: { NEW_CHECKOUT: "false" }, flags: flags(true) }).provenance[0].source).toBe("env");
+  });
+
+  test("where the environment has a gate, --param, --params-file and the env var can't set a flag-backed parameter", () => {
+    const viaCli = resolveBuildParams(defs, { cli: { newCheckout: "true" }, flags: flags(false, true) });
+    expect(viaCli.errors).toEqual([
+      'build parameter "newCheckout" is backed by the flag "new-checkout", and "prod" has a gate, so --param can\'t set it; change the flag record and let the change go through the gate',
+    ]);
+    expect(viaCli.provenance.map((p) => p.name)).toEqual(["tier"]);
+    expect(resolveBuildParams(defs, { fromFile: { newCheckout: true }, flags: flags(false, true) }).errors[0]).toMatch(/so --params-file can't set it/);
+    expect(resolveBuildParams(defs, { env: { NEW_CHECKOUT: "true" }, flags: flags(false, true) }).errors[0]).toMatch(/so the env var NEW_CHECKOUT can't set it/);
+    // A parameter no flag backs is not affected.
+    expect(resolveBuildParams(defs, { cli: { tier: "big" }, flags: flags(false, true) }).errors).toEqual([]);
+  });
+
+  test("a flag that sets a parameter the config does not declare is an error", () => {
+    const r = resolveBuildParams({}, { flags: flags(true) });
+    expect(r.errors).toEqual([`flag "new-checkout" sets build parameter "newCheckout", which chant.config.ts's buildParams does not declare`]);
+  });
+
+  test("a flag value of the wrong type, or outside the enum, fails like any other source", () => {
+    const strict: BuildParamsConfig = { newCheckout: { type: "string", enum: ["a", "b"] } };
+    expect(resolveBuildParams(strict, { flags: { env: "prod", byParam: { newCheckout: { flag: "new-checkout", value: "c" } } } }).errors[0]).toMatch(/must be one of "a", "b", got "c"/);
+  });
+});

package/src/build-params.ts

@@ -73,6 +73,28 @@ export interface BuildParamsInput {
   fromFile?: Record<string, unknown>;
   /** The process environment, consulted only for a parameter that declares an `env` mapping, and only once `cli`/`fromFile` have no value for it. */
   env?: Record<string, string | undefined>;
+  /**
+   * The workspace flags that back parameters in this build's environment
+   * (#4024), read by `./flag-params.ts`. A flag-backed parameter takes the
+   * flag's value for the environment, recorded with `source: "flag:<id>"`,
+   * ahead of its `env` mapping and its default. Absent outside a workspace
+   * and without `--env`.
+   */
+  flags?: BuildParamFlags;
+}
+
+/** The flags that back parameters in one environment (#4024). */
+export interface BuildParamFlags {
+  /** The environment the build is for. */
+  env: string;
+  /** Each flag-backed parameter by name: the flag's name, and its value in `env` (undefined when the flag gives it none). */
+  byParam: Record<string, { flag: string; value: BuildParamValue | undefined }>;
+  /**
+   * The environment has a gate (#4024's precedence rule): a `--param`,
+   * `--params-file` or env-var value for a flag-backed parameter is refused,
+   * so no path flips a flag around the gate.
+   */
+  gated?: boolean;
 }
 
 /** Result of resolving a project's declared parameters against one build invocation's inputs. */
@@ -118,7 +140,11 @@ function coerce(name: string, raw: BuildParamValue, def: BuildParamDef, errors:
  * Resolve a project's declared build-time parameters against one build's
  * supplied inputs. Precedence per parameter, most to least specific:
  * `cli` (`--param name=value`) > `fromFile` (`--params-file`) > the
- * parameter's own declared `env` mapping (only if set) > `def.default`.
+ * parameter's own declared `env` mapping (only if set) > a workspace flag's
+ * value for the build's environment (`input.flags`, #4024) > `def.default`.
+ * When `input.flags.gated` is set, a flag-backed parameter takes none of the
+ * first three: a value from any of them is a build error, so a flag can't be
+ * flipped around the environment's gate.
  *
  * A parameter with no declared `default` and no value from any source is a
  * build error, not a silently-`undefined` value — a build-time parameter
@@ -153,9 +179,26 @@ export function resolveBuildParams(defs: BuildParamsConfig | undefined, input: B
     }
   }
 
+  const flags = input.flags;
+  for (const [name, binding] of Object.entries(flags?.byParam ?? {})) {
+    if (!(name in declared)) {
+      errors.push(`flag "${binding.flag}" sets build parameter "${name}", which chant.config.ts's buildParams does not declare`);
+    }
+  }
+
   for (const [name, def] of Object.entries(declared)) {
     let raw: BuildParamValue | undefined;
     let source: BuildParamProvenance["source"] | undefined;
+    const binding = flags?.byParam[name];
+
+    if (binding && flags?.gated) {
+      // #4024: in an environment with a gate, the flag record is the only way to set the parameter.
+      const around = name in cli ? "--param" : name in fromFile ? "--params-file" : def.env && env[def.env] !== undefined ? `the env var ${def.env}` : null;
+      if (around !== null) {
+        errors.push(flagGateRefusal(name, binding.flag, flags.env, around));
+        continue;
+      }
+    }
 
     if (name in cli) {
       raw = cli[name];
@@ -171,6 +214,9 @@ export function resolveBuildParams(defs: BuildParamsConfig | undefined, input: B
     } else if (def.env && env[def.env] !== undefined) {
       raw = env[def.env];
       source = "env";
+    } else if (binding && binding.value !== undefined) {
+      raw = binding.value;
+      source = `flag:${binding.flag}`;
     } else if (def.default !== undefined) {
       raw = def.default;
       source = "default";
@@ -201,6 +247,14 @@ export function resolveBuildParams(defs: BuildParamsConfig | undefined, input: B
   return { provenance, errors };
 }
 
+/**
+ * The build error for a flag-backed parameter that `around` (`--param`,
+ * `--params-file` or an env var) set in an environment with a gate (#4024).
+ */
+export function flagGateRefusal(name: string, flag: string, env: string, around: string): string {
+  return `build parameter "${name}" is backed by the flag "${flag}", and "${env}" has a gate, so ${around} can't set it; change the flag record and let the change go through the gate`;
+}
+
 /** Project the resolved provenance records down to a plain `{ name: value }` map — what actually gets bound to `params.<name>` (see ./params.ts). */
 export function buildParamValues(provenance: readonly BuildParamProvenance[]): Record<string, BuildParamValue> {
   return Object.fromEntries(provenance.map((p) => [p.name, p.value]));

package/src/change-set-graph.ts

@@ -13,7 +13,8 @@
  * {@link changeSetNodeCandidates} lists the ids an entry's address can have,
  * by planner. {@link mapChangeSetToGraph} keeps the first that the graph
  * holds and puts the member's name in front, as `chant workspace graph`
- * does. An entry whose address the graph does not hold gets `node: null`:
+ * does, with the node's source file as `source` when the graph gives one
+ * (#4025). An entry whose address the graph does not hold gets `node: null`:
  * a delete of a block the source no longer declares, or a warden or sql
  * change outside the graph.
  *
@@ -31,6 +32,12 @@ export interface ChangeSetGraphNodes {
   at: string | null;
   /** Every node id of the member's `chant graph --format ir`, without the member in front. */
   ids: Iterable<string>;
+  /**
+   * The source file of each node that has one (#4025), by the same ids, as a
+   * path from the repository root. An entry mapped onto such a node gets it
+   * as `source`.
+   */
+  sources?: ReadonlyMap<string, string>;
 }
 
 /**
@@ -126,7 +133,8 @@ export function mapChangeSetToGraph(doc: ChangeSetDocument, graph: ChangeSetGrap
     ...doc,
     entries: doc.entries.map((e) => {
       const id = changeSetNodeCandidates(e).find((c) => ids.has(c));
-      return { ...e, node: id === undefined ? null : `${prefix}${id}` };
+      const source = id === undefined ? undefined : graph.sources?.get(id);
+      return { ...e, node: id === undefined ? null : `${prefix}${id}`, ...(source !== undefined ? { source } : {}) };
     }),
     graph: { member: graph.member, at: graph.at },
   };

package/src/change-set.ts

@@ -122,6 +122,16 @@ export interface ChangeSetEntry {
    * part of the digest.
    */
   node?: string | null;
+  /**
+   * The source file that declares the entry's node, from the repository
+   * root (#4025): the node's `sourceLoc.file` in the member's graph IR, with
+   * the member's directory in front. Set beside `node` when a stored change
+   * set is mapped onto a graph whose node has a source location, absent
+   * otherwise. Like `node`, never part of the digest. The overlap report
+   * attributes the entry to a work item through the commits that changed
+   * this file.
+   */
+  source?: string;
 }
 
 /** Something a planner could not read, so the plan says nothing about it. */
@@ -288,12 +298,13 @@ export function changeSetDocumentDigest(
     .filter((m) => !provisional.has(m.member))
     .map((m) => ({ member: m.member, status: m.status, holes: m.holes }))
     .sort((a, b) => byString(a.member, b.member));
-  // An entry's graph node (#4022) says where on the graph the change is,
-  // not what the plan does, so it stays outside the digest: mapping a stored
+  // An entry's graph node (#4022) and its source file (#4025) say where on
+  // the graph the change is, not what the plan does, so they stay outside
+  // the digest: mapping a stored
   // document onto a graph never moves the value its gate bound.
   const entries = doc.entries
     .filter((e) => !provisional.has(e.member))
-    .map(({ node: _node, ...e }) => e)
+    .map(({ node: _node, source: _source, ...e }) => e)
     .sort((a, b) => byString(entryKey(a), entryKey(b)));
   const sideEffects = (doc.sideEffects ?? []).filter((s) => !provisional.has(s.member)).sort(bySideEffect);
   const planned =

package/src/cli/build-params-cli.ts

@@ -1,6 +1,6 @@
 import { readFileSync } from "fs";
 import { resolve } from "path";
-import { resolveBuildParams, type BuildParamsConfig } from "../build-params";
+import { resolveBuildParams, type BuildParamFlags, type BuildParamsConfig } from "../build-params";
 import type { BuildParamProvenance } from "../provenance";
 import { formatError, formatInfo } from "./format";
 
@@ -40,6 +40,10 @@ export interface CliBuildParamsArgs {
   paramsFile?: string;
   /** `--verbose` — list every resolved parameter one per line instead of the one-line count (#1424). */
   verbose?: boolean;
+  /** The workspace flags backing parameters in this build's environment (#4024), from `../flag-params.ts`. */
+  flags?: BuildParamFlags;
+  /** `false` to resolve without printing the summary line, for a caller that checks more before it prints ({@link echoBuildParams}). */
+  echo?: boolean;
 }
 
 export interface CliBuildParamsResolution {
@@ -94,6 +98,7 @@ export function resolveCliBuildParams(
     cli: args.cli,
     fromFile,
     env: process.env,
+    ...(args.flags ? { flags: args.flags } : {}),
   });
   for (const message of resolution.errors) {
     errors.push(formatError({ message }));
@@ -103,21 +108,25 @@ export function resolveCliBuildParams(
     return { success: false, provenance: [], errors };
   }
 
+  if (args.echo !== false) echoBuildParams(resolution.provenance, args.verbose);
+  return { success: true, provenance: resolution.provenance, errors: [] };
+}
+
+/** Print a successful resolution: the one-line summary, or every value under `--verbose` or `CHANT_PARAM_ECHO=all` (#1424). */
+export function echoBuildParams(provenance: readonly BuildParamProvenance[], verboseFlag?: boolean): void {
   // #1424 — one line by default. A project with two dozen declared
   // parameters printed two dozen grey lines on every build, ahead of the
   // warnings the reader actually needed. The count by source still answers
   // "did my override reach the build" (the failure mode
   // warnIfParamsCannotReachProject exists for); --verbose names every value.
-  const verbose = args.verbose === true || process.env.CHANT_PARAM_ECHO === "all";
+  const verbose = verboseFlag === true || process.env.CHANT_PARAM_ECHO === "all";
   if (verbose) {
-    for (const p of resolution.provenance) {
+    for (const p of provenance) {
       console.error(formatInfo(`[param] ${p.name} = ${JSON.stringify(p.value)} (${p.source})`));
     }
-  } else if (resolution.provenance.length > 0) {
-    console.error(formatInfo(summarizeBuildParams(resolution.provenance)));
+  } else if (provenance.length > 0) {
+    console.error(formatInfo(summarizeBuildParams(provenance)));
   }
-
-  return { success: true, provenance: resolution.provenance, errors: [] };
 }
 
 /**
@@ -127,8 +136,12 @@ export function resolveCliBuildParams(
  */
 export function summarizeBuildParams(provenance: readonly { source: string }[]): string {
   const counts = new Map<string, number>();
-  for (const p of provenance) counts.set(p.source, (counts.get(p.source) ?? 0) + 1);
-  const order = ["cli", "params-file", "env", "default"];
+  // Every flag source (`flag:<name>`, #4024) counts as one, "from flags".
+  for (const p of provenance) {
+    const source = p.source.startsWith("flag:") ? "flags" : p.source;
+    counts.set(source, (counts.get(source) ?? 0) + 1);
+  }
+  const order = ["cli", "params-file", "env", "flags", "default"];
   const rank = (s: string) => (order.includes(s) ? order.indexOf(s) : order.length);
   const parts = [...counts.keys()]
     .sort((a, b) => rank(a) - rank(b))

package/src/cli/commands/build.ts

@@ -12,7 +12,7 @@ import { resolveTelemetryAttribution } from "../../telemetry-attribution";
 import { loadOkfBundle } from "../../okf-read";
 import { unknownEnvError } from "../../env";
 import type { OwnershipMarker } from "../../ownership";
-import { resolveCliBuildParams } from "../build-params-cli";
+import { resolveFlaggedBuildParams } from "../../flag-params";
 import type { Serializer, SerializerResult } from "../../serializer";
 import type { LexiconPlugin } from "../../lexicon";
 import { runPostSynthChecks, type PostSynthDiagnostic } from "../../lint/post-synth";
@@ -297,11 +297,14 @@ export async function buildCommand(options: BuildOptions): Promise<BuildResult>
   // project's own `params.ts` does before migrating to this mechanism). Also
   // logs a one-line count on success, or every resolved value (`[param] name =
   // value (source)`) under --verbose (#1424).
-  const paramsResolution = resolveCliBuildParams(config.buildParams, {
+  // #4024: in a workspace member, a build for an environment also reads the
+  // flag records that back its parameters, and refuses an override of one
+  // where the environment has a gate (../../flag-params.ts).
+  const paramsResolution = await resolveFlaggedBuildParams(configDir, config.buildParams, {
     cli: options.params,
     paramsFile: options.paramsFile,
     verbose: options.verbose,
-  });
+  }, options.env);
   if (!paramsResolution.success) {
     errors.push(...paramsResolution.errors);
     return { success: false, resourceCount: 0, fileCount: 0, errors, warnings };

package/src/cli/handlers/approve-release.test.ts

@@ -11,6 +11,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { appendPendingGate, readGateLedger } from "../../lifecycle/gate-ledger";
 import { resetGateOrigin } from "../../lifecycle/gate-origin";
+import { makeRelease, persistRelease } from "../../lifecycle/release-store";
 
 vi.mock("../../op/discover", () => ({ discoverOps: async () => ({ errors: [], ops: new Map() }) }));
 
@@ -20,7 +21,9 @@ function git(args: string[], cwd: string): void {
   spawnSync("git", args, { cwd, encoding: "utf-8" });
 }
 
-const RELEASE = `jcs1-sha256:${"a".repeat(64)}`;
+/** The release the gate binds. #4033: approve reads it to check its commit isn't revoked, so it is stored. */
+const STORED = makeRelease({ member: null, commit: "1".repeat(40), artifactDigests: [], targets: [{ env: "prod", templates: [], params: [] }] });
+const RELEASE = STORED.releaseDigest;
 const DOC = `jcs1-sha256:${"d".repeat(64)}`;
 
 async function repoWithReleaseGate(dir: string): Promise<void> {
@@ -30,6 +33,7 @@ async function repoWithReleaseGate(dir: string): Promise<void> {
   writeFileSync(join(dir, "README.md"), "x\n");
   git(["add", "."], dir);
   git(["commit", "-q", "-m", "init"], dir);
+  await persistRelease(STORED, [], { cwd: dir });
   await appendPendingGate(
     {
       op: "release",

package/src/cli/handlers/approve-revoked.test.ts

@@ -0,0 +1,155 @@
+/**
+ * #4033 (ws-105): when a commit is revoked, the release cut from it is
+ * revoked, and its pending release gate refuses approval. Against temp repos;
+ * nothing is pushed.
+ */
+
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { appendPendingGate, readGateLedger } from "../../lifecycle/gate-ledger";
+import { resetGateOrigin } from "../../lifecycle/gate-origin";
+import { appendCut, makeRelease, persistRelease, type Release } from "../../lifecycle/release-store";
+
+vi.mock("../../op/discover", () => ({ discoverOps: async () => ({ errors: [], ops: new Map() }) }));
+
+const { recordGateApproval } = await import("./approve");
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+const DOC = `jcs1-sha256:${"d".repeat(64)}`;
+const GREEN = { branch: "main", phases: { test: ["test"] }, require: ["test"] };
+
+function declaration(dir: string, green: Record<string, unknown>): void {
+  writeFileSync(
+    join(dir, "chant.workspace.json"),
+    JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the release fixture" }], ci: { green } }, null, 2),
+  );
+}
+
+/** A green commit, a release cut from it as v1.0.0, and a release gate pending for it in prod. */
+async function releaseWaitingAtGate(dir: string): Promise<{ sha: string; release: Release }> {
+  git(dir, "init", "-q", "-b", "main");
+  git(dir, "config", "user.email", "t@chant.dev");
+  git(dir, "config", "user.name", "T");
+  declaration(dir, GREEN);
+  git(dir, "add", ".");
+  git(dir, "commit", "-q", "-m", "init");
+  const sha = git(dir, "rev-parse", "HEAD");
+  git(dir, "tag", "-a", "-m", "ci: green", `ci/green/${sha}`, sha);
+  const release = makeRelease({
+    member: null,
+    commit: sha,
+    artifactDigests: [],
+    targets: [{ env: "prod", templates: [{ component: "api", path: "t.json", digest: `sha256:${"c".repeat(64)}` }], params: [] }],
+  });
+  await persistRelease(release, [], { cwd: dir });
+  await appendCut({ releaseDigest: release.releaseDigest, label: "v1.0.0", actor: "alice", timestamp: "2026-10-16T10:00:00.000Z", runOrigin: null }, { cwd: dir });
+  await appendPendingGate(
+    {
+      op: "release",
+      gate: "prod-release",
+      timestamp: "2026-10-16T11:00:00.000Z",
+      expiresAt: "2999-01-01T00:00:00.000Z",
+      planDigest: DOC,
+      environment: "prod",
+      releaseDigest: release.releaseDigest,
+      gitSha: sha,
+    },
+    { cwd: dir },
+  );
+  return { sha, release };
+}
+
+/** ci tick's revoked tag for a run from chant runs (#4044): the run's id is null and the Op run is named in opRun. */
+function revoke(dir: string, sha: string): void {
+  const record = {
+    schema: 1,
+    tag: "revoked",
+    commit: sha,
+    branch: "main",
+    at: "2026-10-16T12:00:00.000Z",
+    source: "runs",
+    phase: "test",
+    run: { name: "smoke", id: null, conclusion: "failure", url: null, opRun: { id: "r-12", env: "staging", signer: "runner:ci", statement: null } },
+  };
+  git(dir, "tag", "-a", "-m", `ci: phase test failed in smoke (failure)\n\n${JSON.stringify(record, null, 2)}\n`, `ci/revoked/${sha}`, sha);
+}
+
+describe("chant approve on the gate of a revoked release (#4033)", () => {
+  const cwd = process.cwd();
+  afterEach(() => {
+    process.chdir(cwd);
+    resetGateOrigin();
+    vi.restoreAllMocks();
+  });
+
+  test("revoke a commit, and its release's pending gate refuses approval with release-revoked and the fix line", async () => {
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { errors.push(m.join(" ")); });
+    await withTestDir(async (dir) => {
+      const { sha } = await releaseWaitingAtGate(dir);
+      process.chdir(dir);
+      revoke(dir, sha);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(false);
+      const said = errors.join("\n");
+      expect(said).toContain(`release v1.0.0 was cut from commit ${sha.slice(0, 12)}, which ci/revoked/${sha} revokes (phase test failed in smoke (Op run r-12 in staging))`);
+      expect(said).toContain("[release-revoked]");
+      expect(said).toContain("chant approve release prod-release --expire");
+      expect((await readGateLedger("release", { cwd: dir })).resolutions).toEqual([]);
+
+      // Naming the plan outright doesn't get round it.
+      const named = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod", plan: DOC });
+      expect(named.ok).toBe(false);
+      expect((await readGateLedger("release", { cwd: dir })).resolutions).toEqual([]);
+    });
+  });
+
+  test("before the commit is revoked, the same gate takes the approval", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    await withTestDir(async (dir) => {
+      const { release } = await releaseWaitingAtGate(dir);
+      process.chdir(dir);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(true);
+      expect((await readGateLedger("release", { cwd: dir })).resolutions).toEqual([expect.objectContaining({ releaseDigest: release.releaseDigest })]);
+    });
+  });
+
+  test("with ci.green.signedSince, a hand-pushed revoked tag is ignored and revokes nothing", async () => {
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    await withTestDir(async (dir) => {
+      const { sha } = await releaseWaitingAtGate(dir);
+      // The release's own commit is the pivot, so a tag on it needs a statement; this one has none.
+      declaration(dir, { ...GREEN, signedSince: sha });
+      git(dir, "commit", "-q", "-am", "require signed ci tags");
+      revoke(dir, sha);
+      process.chdir(dir);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(true);
+    });
+  });
+
+  test("a gate whose release can't be read refuses, since whether it is revoked is unknown", async () => {
+    const errors: string[] = [];
+    vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { errors.push(m.join(" ")); });
+    await withTestDir(async (dir) => {
+      await releaseWaitingAtGate(dir);
+      await appendPendingGate(
+        { op: "release", gate: "prod-release", timestamp: "2026-10-16T13:00:00.000Z", expiresAt: "2999-01-01T00:00:00.000Z", planDigest: DOC, environment: "prod", releaseDigest: `jcs1-sha256:${"e".repeat(64)}` },
+        { cwd: dir },
+      );
+      process.chdir(dir);
+      const outcome = await recordGateApproval("release", "prod-release", { origin: "cli", actor: "alice", cwd: dir, environment: "prod" });
+      expect(outcome.ok).toBe(false);
+      expect(errors.join("\n")).toContain("[release-unreadable]");
+    });
+  });
+});

package/src/cli/handlers/approve.ts

@@ -255,6 +255,46 @@ export type GateApprovalOutcome =
   | { ok: true; record: GateResolutionRecord; pushed: boolean }
   | { ok: false };
 
+/**
+ * Refuse the approval of a release gate whose release is revoked (#4033,
+ * ws-105): its commit carries a `ci/revoked/<sha>` tag that counts, read from
+ * local tags as `release cut` reads them. Prints the refusal and returns true
+ * when it refuses. A release file that can't be read, or tags that can't be
+ * judged, refuse too, since whether the release is revoked is then unknown.
+ */
+async function refuseRevokedRelease(opName: string, gate: string, releaseDigest: string, cwd: string): Promise<boolean> {
+  const { readRelease, readCuts, labelsByDigest } = await import("../../lifecycle/release-store");
+  const { readRevokedCommits, revocationOf, revokedRefusal } = await import("../../lifecycle/release-revocation");
+  const release = await readRelease(releaseDigest, { cwd }).catch(() => null);
+  if (!release) {
+    console.error(formatError({
+      message: `Gate "${gate}" on "${opName}" binds release ${releaseDigest}, which can't be read from ${LIFECYCLE_BRANCH}, so whether it is revoked is unknown [release-unreadable]`,
+      hint: `Fetch the ledger branch (git fetch origin ${LIFECYCLE_BRANCH}:${LIFECYCLE_BRANCH}) and approve again from the member's directory.`,
+    }));
+    return true;
+  }
+  let revoked: Awaited<ReturnType<typeof readRevokedCommits>>;
+  try {
+    revoked = await readRevokedCommits(cwd);
+  } catch (err) {
+    console.error(formatError({
+      message: `Gate "${gate}" on "${opName}" binds release ${releaseDigest}, and the ci tags can't be judged: ${err instanceof Error ? err.message : String(err)} [declaration-invalid]`,
+      hint: "Fix ci.green in chant.workspace.json at base; chant workspace check names the problem.",
+    }));
+    return true;
+  }
+  const r = revocationOf(release, revoked);
+  if (!r) return false;
+  const label = labelsByDigest((await readCuts({ cwd }).catch(() => ({ cuts: [] }))).cuts).get(releaseDigest) ?? null;
+  console.error(formatError(revokedRefusal(
+    { releaseDigest, label },
+    r,
+    `Clear the pending gate with \`chant approve ${opName} ${gate} --expire\`, then promote a release cut from a green commit: ` +
+      "`chant ci last-green` names the newest, and `chant release list` marks the revoked releases.",
+  )));
+  return true;
+}
+
 /**
  * The ledger write behind `chant approve` — extracted so `chant run approve`
  * (#2121) records the identical fact before waking the runtime that hosts the
@@ -400,6 +440,13 @@ export async function recordGateApproval(
   // approval of another plan names none, and no release gate counts it.
   const releaseDigest =
     standing?.releaseDigest !== undefined && samePlanDigest(planDigest, standing.planDigest) ? standing.releaseDigest : undefined;
+  // #4033 (ws-105): a release gate whose release was cut from a revoked
+  // commit is superseded. Its promote refuses the release, so an approval of
+  // it would count for nothing; refuse it here, whatever plan is named.
+  if (standing?.releaseDigest !== undefined) {
+    const refused = await refuseRevokedRelease(opName, gate, standing.releaseDigest, opts.cwd ?? process.cwd());
+    if (refused) return { ok: false };
+  }
 
   // chant#2384 — the gate's whole value is that its two halves have different
   // authors. At a shell they do: a person runs, reads the plan, and approves.

package/src/cli/handlers/build.test.ts

@@ -133,6 +133,21 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
     vi.restoreAllMocks();
   });
 
+  test("--pr-loop with --events-json and --report-url asks the generated jobs for both (#4007)", async () => {
+    generateComponentsPipelineMock.mockResolvedValue({ success: true, yaml: "stages: []", stages: [], jobs: [] });
+    vi.spyOn(console, "log").mockImplementation(() => {});
+
+    const exit = await runBuild({
+      args: makeArgs({ generate: "github", prLoop: true, eventsJson: true, reportUrl: "s3://reports/acme" }),
+      plugins: [],
+      serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(generateComponentsPipelineMock).toHaveBeenCalledWith(".", "github", { env: undefined, prLoop: { events: true, reportUrl: "s3://reports/acme" } }, undefined, []);
+    vi.restoreAllMocks();
+  });
+
   test("chant.config.ts's declared buildParams resolve, log, and are forwarded to generateComponentsPipeline", async () => {
     loadChantConfigUpwardMock.mockResolvedValue({
       config: { buildParams: { tier: { type: "string", default: "light" } } },

package/src/cli/handlers/build.ts

@@ -8,6 +8,21 @@ import { loadChantConfigUpward, type ChantConfig } from "../../config";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 import { findWorkspaceRoot } from "../../project-root";
 import { resolvePromotionSource } from "../../components/promote-order";
+import type { PrLoopPipelineOptions } from "../../components/pr-pipeline";
+
+/**
+ * The `prLoop` generator option from `--pr-loop`'s flags (#3183): the gate
+ * and the branch, and with `--events-json` and `--report-url` (#4007) the
+ * flags the generated jobs pass to pr-plan and pr-apply.
+ */
+function prLoopOption(args: CommandContext["args"]): PrLoopPipelineOptions {
+  return {
+    ...(args.gate ? { gate: args.gate } : {}),
+    ...(args.branch ? { branch: args.branch } : {}),
+    ...(args.eventsJson ? { events: true } : {}),
+    ...(args.reportUrl ? { reportUrl: args.reportUrl } : {}),
+  };
+}
 
 /**
  * `chant build --components --generate <lexicon>` — generate mode (#563,
@@ -86,7 +101,7 @@ async function runGenerateComponents(ctx: CommandContext): Promise<number> {
         params: args.param,
         paramsFile: args.paramsFile,
         ...(args.waveGate ? { waveGate: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } } : {}),
-        ...(args.prLoop ? { prLoop: { ...(args.gate ? { gate: args.gate } : {}), ...(args.branch ? { branch: args.branch } : {}) } } : {}),
+        ...(args.prLoop ? { prLoop: prLoopOption(args) } : {}),
         ...(args.image ? { image: args.image } : {}),
         ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),
       });
@@ -116,9 +131,7 @@ async function runGenerateComponents(ctx: CommandContext): Promise<number> {
         ? { gatedWaves: { gate: args.waveGate, ...(args.canary?.length ? { canary: args.canary } : {}), ...(args.base ? { base: args.base } : {}) } }
         : {}),
       // #3183: a plan job per pull request and an apply job per merge.
-      ...(args.prLoop
-        ? { prLoop: { ...(args.gate ? { gate: args.gate } : {}), ...(args.branch ? { branch: args.branch } : {}) } }
-        : {}),
+      ...(args.prLoop ? { prLoop: prLoopOption(args) } : {}),
       // #4002: the job image and the lines that install what it lacks, chant itself included.
       ...(args.image ? { image: args.image } : {}),
       ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),