@intentius/chant 0.124.28 → 0.124.29

package/src/workspace/releases.schema.json

@@ -177,6 +177,17 @@
               }
             }
           }
+        },
+        "revoked": {
+          "description": "Added within contract version 1 by #4033, written by chant 0.124.29 and newer. The ci/revoked/<sha> tag on the release's commit, or null when the commit is not revoked. A revoked release is never promoted (chant components promote --release refuses it) and its pending release gates refuse approval. Null too when the ci tags can't be judged, as when ci.green.signedSince names no commit here, which chant workspace check reports.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/revocation"
+            }
+          ]
         }
       }
     },
@@ -280,6 +291,13 @@
           "type": "string",
           "description": "ISO 8601."
         },
+        "runId": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "Added by #4027, written by chant 0.124.29 and newer. The run the cut ran in: the CI run's id in CI (GITHUB_RUN_ID, CI_PIPELINE_ID), or outside CI an id minted on the machine that cut, local-<epoch ms>. Null on a cut written before 0.124.29."
+        },
         "runOrigin": {
           "oneOf": [
             {
@@ -308,7 +326,7 @@
               }
             }
           ],
-          "description": "The CI run the cut ran in: the forge (github for GitHub and Forgejo, gitlab), the repo or project, and a link to the run. Null outside CI."
+          "description": "The run the cut ran in: the forge (github for GitHub and Forgejo, gitlab, or local for an id minted outside CI), the repo or project, and a link to the run. From chant 0.124.29 a cut outside CI writes { forge: local } (#4027); a cut written before reads null outside CI."
         },
         "signature": {
           "type": [
@@ -386,6 +404,110 @@
           }
         }
       }
+    },
+    "revocation": {
+      "type": "object",
+      "description": "A revoked tag on a release's commit (#4033, ws-105), as chant ci list --json shows a commit's revoked tag, with the commit. Read from local tags at read time and judged as release cut judges them: with ci.green.signedSince, a revoked tag without a valid runner statement is ignored and revokes nothing.",
+      "required": [
+        "commit",
+        "tag",
+        "tagged",
+        "phase",
+        "run",
+        "signer"
+      ],
+      "properties": {
+        "commit": {
+          "type": "string",
+          "description": "The release's commit, which the tag names."
+        },
+        "tag": {
+          "type": "string",
+          "description": "ci/revoked/<sha>."
+        },
+        "tagged": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "When the tag was made, ISO 8601, or null for a lightweight tag."
+        },
+        "phase": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The phase the annotation names as failed, or null when the annotation can't be read."
+        },
+        "run": {
+          "description": "The run the annotation names as failed, or null.",
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "type": "object",
+              "required": [
+                "name",
+                "id",
+                "conclusion",
+                "url"
+              ],
+              "properties": {
+                "name": {
+                  "type": "string"
+                },
+                "id": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ],
+                  "description": "The check run's id, or null for a chant Op run."
+                },
+                "conclusion": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "url": {
+                  "type": [
+                    "string",
+                    "null"
+                  ]
+                },
+                "opRun": {
+                  "type": "object",
+                  "required": [
+                    "id",
+                    "env",
+                    "signer"
+                  ],
+                  "properties": {
+                    "id": {
+                      "type": "string"
+                    },
+                    "env": {
+                      "type": "string"
+                    },
+                    "signer": {
+                      "type": "string"
+                    }
+                  },
+                  "description": "Present only when the run is a chant Op run (ci.green.source runs, #4044): its id, the env it is recorded under and the runner whose statement it carries. id above is then null."
+                }
+              }
+            }
+          ]
+        },
+        "signer": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The runner principal whose statement the tag carries, or null when it counts unsigned."
+        }
+      }
     }
   }
 }

package/src/workspace/releases.ts

@@ -8,6 +8,12 @@
  * `releaseDigest`. A promote under a release writes that field; deploys made
  * any other way do not name a release yet (#4043), so they list nowhere.
  *
+ * Each release carries `revoked` (#4033, ws-105): the `ci/revoked/<sha>` tag
+ * on its commit, judged as `release cut` judges it, or null. It is read from
+ * local tags at read time; nothing records it. When the tags can't be judged
+ * (a `ci.green.signedSince` naming no commit here) every release reads null,
+ * and `chant workspace check` reports the declaration.
+ *
  * Each cut carries `signatureCheck` (#4031): whether its signature verifies
  * for its actor against the signers at base, and, when the declaration names
  * a `release` gate with a class, whether the actor is in it.
@@ -24,6 +30,7 @@ import { readAllReleases, readCuts, type Release, type ReleaseCut } from "../lif
 import { resolveMemberLedger } from "../lifecycle/member-ledger";
 import { readerVersion } from "./declaration";
 import { checkReleaseSignature, type GateAdmissionRule, type ReleaseSignatureCheck } from "./identity-gate-rule";
+import { readRevokedCommits, revocationOf, type ReleaseRevocation } from "../lifecycle/release-revocation";
 
 export const RELEASES_CONTRACT_VERSION = 1;
 export const RELEASES_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/releases/v1/releases.schema.json";
@@ -41,6 +48,8 @@ export interface ReleaseEntry extends Omit<Release, "version"> {
   cuts: Array<Omit<ReleaseCut, "version" | "releaseDigest"> & { signatureCheck: ReleaseSignatureCheck }>;
   /** The environments that run it, and in each the components whose latest deploy names it. Sorted by env. */
   environments: Array<{ env: string; components: string[] }>;
+  /** The revoked tag on its commit (#4033), or null when the commit is not revoked. */
+  revoked: ReleaseRevocation | null;
 }
 
 export type ReleasesDocument =
@@ -93,6 +102,7 @@ export async function releasesDocument(req: { cwd: string }): Promise<ReleasesDo
     }
 
     const rule = await releaseRule(req.cwd);
+    const revoked = await readRevokedCommits(req.cwd).catch(() => new Map<string, ReleaseRevocation>());
     const entries: ReleaseEntry[] = releases.map(({ version: _v, ...release }) => {
       const own = cuts.filter((c) => c.releaseDigest === release.releaseDigest);
       return {
@@ -102,6 +112,7 @@ export async function releasesDocument(req: { cwd: string }): Promise<ReleasesDo
         environments: [...(running.get(release.releaseDigest) ?? new Map<string, string[]>())]
           .map(([env, components]) => ({ env, components }))
           .sort((a, b) => (a.env < b.env ? -1 : 1)),
+        revoked: revocationOf(release, revoked),
       };
     });
     const latest = (e: ReleaseEntry): string => e.cuts.map((c) => c.timestamp).sort().at(-1) ?? "";

package/src/workspace/run-event.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://intentius.io/chant/schemas/workspace/run-event/v1/run-event.schema.json",
   "title": "chant run event",
-  "description": "One event of a run's stream (#4019, behold #678): one JSON object per line, written by writeRunEvent and createRunEventWriter in src/run-event.ts. It covers Op runs, component runs and pipeline runs alike. Every event names the run, what it ran, the commit it built from and the runtime it ran on, so a reader shows a run the same way wherever it happened. A run's stream opens with run-start and ends with run-settle, whose status is the run's verdict; seq counts the events from 0. Version 1 of the read contract. Readers ignore fields they do not know; a field is only ever added within a version. The status sets are closed. Contract version 1 of this document is written by chant 0.124.28 and newer; the read contract as a whole by chant 0.81.0 and newer.",
+  "description": "One event of a run's stream (#4019, behold #678): one JSON object per line, written by writeRunEvent and createRunEventWriter in src/run-event.ts. It covers Op runs, component runs and pipeline runs alike. Every event names the run, what it ran, the commit it built from and the runtime it ran on, so a reader shows a run the same way wherever it happened. A run's stream opens with run-start and ends with run-settle, whose status is the run's verdict; seq counts the events from 0. Version 1 of the read contract. Readers ignore fields they do not know; a field is only ever added within a version. A status set gains a value only as an addition within a version, which the read contract lists with the chant that first writes it; a reader treats a status it does not know as a settle it cannot classify and reads on. Contract version 1 of this document is written by chant 0.124.28 and newer; the read contract as a whole by chant 0.81.0 and newer.",
   "oneOf": [
     { "$ref": "#/$defs/run-start" },
     { "$ref": "#/$defs/run-settle" },
@@ -150,13 +150,20 @@
         { "$ref": "#/$defs/envelope" },
         {
           "type": "object",
-          "description": "A component's composition settled, after any rollback the run did for it.",
+          "description": "A component's composition settled, after any rollback the run did for it. A component the run did not start settles too, with no component-start before it: blocked when a dependency failed or stopped at a gate, already-applied when an earlier attempt the run resumed applied it.",
           "required": ["type", "wave", "component", "status"],
           "properties": {
             "type": { "const": "component-settle" },
             "wave": { "type": "integer", "minimum": 1 },
             "component": { "type": "string" },
-            "status": { "$ref": "#/$defs/settleStatus" }
+            "status": {
+              "enum": ["ok", "failed", "gated", "waiting", "blocked", "already-applied"],
+              "description": "The settle statuses of a run, wave or phase, and two more for a component the run did not start, added within contract version 1 by #4007 and written by chant 0.124.29 and newer. blocked: a dependency failed or stopped at a gate, so it never ran; blockedBy names the dependency. already-applied: an earlier attempt the run resumed applied it, so it did not run again; its wave is the wave it had in that attempt's derivation. A reader that knows only the four settle statuses can read either as a component that did not run in this run."
+            },
+            "blockedBy": {
+              "type": "string",
+              "description": "With blocked: the failed or gated component the run reached this one from. Added within contract version 1 by #4007, written by chant 0.124.29 and newer."
+            }
           }
         }
       ]

package/src/workspace/status-contract.test.ts

@@ -478,6 +478,35 @@ describe("commit, run and gate on the records status --json lists (#4020)", () =
   });
 });
 
+describe("the release a deploy was made from, on the records status --json lists (#4043)", () => {
+  test("a release item carries the releaseDigest and the label it was cut with, and null when there is none", async () => {
+    const root = twoLayouts();
+    const rd = `jcs1-sha256:${"e".repeat(64)}`;
+    const cut = JSON.stringify({ version: 1, releaseDigest: rd, label: "v1.2.0", actor: "alice", timestamp: "2026-09-19T00:00:00.000Z", runOrigin: null, signature: null });
+    lifecycle(root, {
+      "_members/web/staging/releases.jsonl": jsonl(release("web", "staging", D("a"), "a".repeat(40), { releaseDigest: rd })),
+      "_members/web/_releases/cuts.jsonl": `${cut}\n`,
+      "staging/releases.jsonl": jsonl(release("api", "staging", D("b"), "b".repeat(40))),
+    });
+    const doc = result(await workspaceStatus({ cwd: root, env: "staging", now: NOW }));
+    expectValid(doc);
+    const [, web, api] = doc.members;
+    expect(web.environments[0].releases[0]).toMatchObject({ releaseDigest: rd, releaseLabel: "v1.2.0" });
+    expect(api.environments[0].releases[0]).toMatchObject({ releaseDigest: null, releaseLabel: null });
+  });
+
+  test("a release with no cut line keeps its digest and has no label", async () => {
+    const root = twoLayouts();
+    const rd = `jcs1-sha256:${"e".repeat(64)}`;
+    lifecycle(root, {
+      "_members/web/staging/releases.jsonl": jsonl(release("web", "staging", D("a"), "a".repeat(40), { releaseDigest: rd })),
+    });
+    const doc = result(await workspaceStatus({ cwd: root, env: "staging", now: NOW }));
+    expectValid(doc);
+    expect(doc.members[1].environments[0].releases[0]).toMatchObject({ releaseDigest: rd, releaseLabel: null });
+  });
+});
+
 describe("gate state in chant workspace status --json (#2674)", () => {
   test("each member lists its gates with state, approvals, quorum and the approve line", async () => {
     const doc = result(await workspaceStatus({ cwd: gated(), env: "staging", compareTo: "prod", now: NOW }));

package/src/workspace/status-gates.ts

@@ -25,6 +25,7 @@ import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-
 import { isPendingGateExpired, latestPendingGate, latestResolutionForPlan, parseGateLedger } from "../lifecycle/gate-ledger";
 import { humanQuorumSince, tallyGateApprovals, type GateApprovalRule } from "../op/gate";
 import type { ReasonCode } from "./reason-codes";
+import type { ReleaseRevocation } from "../lifecycle/release-revocation";
 import { CHANGE_SETS_DIR, changeSetFile } from "../lifecycle/change-set-store";
 
 /** The stored change-set directory beside a gate ledger directory: `<prefix>_change-sets`. */
@@ -73,6 +74,13 @@ export interface StatusGate {
    */
   releaseDigest?: string;
   state: GateState;
+  /**
+   * Set on a release gate whose release was cut from a revoked commit
+   * (#4033, ws-105): the revoked tag on that commit. The gate is then
+   * `superseded` (or `expired`), and `chant approve` refuses it with
+   * `release-revoked`. Added by `workspace status`; absent otherwise.
+   */
+  revoked?: ReleaseRevocation;
   /** When the run recorded the pending fact the state is read against. */
   recordedAt: string;
   /** The commit the run reached the gate at (#4020), from the pending fact. Absent on a fact written before chant 0.124.28. */

package/src/workspace/status-mixed.test.ts

@@ -0,0 +1,152 @@
+/**
+ * #4035: an environment a promote left mixed, as `workspace status --json`
+ * shows it: what each component runs, and the redeploy and rollback lines
+ * that settle it. Against temp repos; nothing is pushed.
+ */
+
+import { describe, expect, test } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Ajv2020 } from "ajv/dist/2020";
+import statusSchema from "./status.schema.json";
+import { formatStatus, workspaceStatus, type StatusDocument } from "./status";
+import { appendCut, makeRelease, persistRelease, type Release } from "../lifecycle/release-store";
+import { appendReleaseRecord, type ReleaseRecordInput } from "../lifecycle/release-ledger";
+import { appendDeployOutcome } from "../lifecycle/deploy-outcome";
+import { contentDigest } from "../content-digest";
+
+const validateStatus = new Ajv2020({ strict: true, allErrors: true }).compile(statusSchema);
+const NOW = "2026-10-17T14:00:00.000Z";
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+function result(doc: StatusDocument): Extract<StatusDocument, { members: unknown }> {
+  if ("error" in doc) throw new Error(`${doc.error.code}: ${doc.error.message}`);
+  expect(validateStatus(doc), JSON.stringify(validateStatus.errors, null, 2)).toBe(true);
+  return doc;
+}
+
+/** A workspace whose root member has releases v1.0.0 and v1.1.0 of api and web, and runs v1.0.0 in prod. */
+async function setup(dir: string): Promise<{ v1: Release; v2: Release; deploy: (input: Partial<ReleaseRecordInput> & { component: string; timestamp: string; releaseDigest: string }) => Promise<void> }> {
+  git(dir, "init", "-q", "-b", "main");
+  git(dir, "config", "user.email", "t@chant.dev");
+  git(dir, "config", "user.name", "T");
+  writeFileSync(
+    join(dir, "chant.workspace.json"),
+    JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the fixture" }] }, null, 2),
+  );
+  git(dir, "add", ".");
+  git(dir, "commit", "-q", "-m", "init");
+  const first = git(dir, "rev-parse", "HEAD");
+  git(dir, "commit", "-q", "--allow-empty", "-m", "next");
+  const second = git(dir, "rev-parse", "HEAD");
+  const at = (commit: string) =>
+    makeRelease({
+      member: null,
+      commit,
+      artifactDigests: ["api", "web"].map((component) => ({ component, kind: "image" as const, path: `${component}.tar`, digest: contentDigest(`${component} ${commit}`) })),
+      targets: [{ env: "prod", templates: [], params: [] }],
+    });
+  const v1 = at(first);
+  const v2 = at(second);
+  for (const [r, label, ts] of [[v1, "v1.0.0", "10"], [v2, "v1.1.0", "11"]] as const) {
+    await persistRelease(r, [], { cwd: dir });
+    await appendCut({ releaseDigest: r.releaseDigest, label, actor: "alice", timestamp: `2026-10-17T${ts}:00:00.000Z`, runOrigin: null }, { cwd: dir });
+  }
+  const deploy = async (input: Partial<ReleaseRecordInput> & { component: string; timestamp: string; releaseDigest: string }) => {
+    await appendReleaseRecord(
+      { env: "prod", digest: contentDigest(`${input.component} ${input.releaseDigest}`), gitSha: first, runId: "r", actor: "ci", ...input },
+      { cwd: dir },
+    );
+  };
+  for (const component of ["api", "web"]) await deploy({ component, timestamp: "2026-10-17T12:00:00.000Z", releaseDigest: v1.releaseDigest });
+  return { v1, v2, deploy };
+}
+
+describe("a mixed environment in workspace status (#4035)", () => {
+  test("a partly applied promote shows the environment mixed, with the redeploy and rollback lines, until it is settled", async () => {
+    await withTestDir(async (dir) => {
+      const { v1, v2, deploy } = await setup(dir);
+
+      // Before the promote: one release, nothing mixed.
+      const before = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW }));
+      expect(before.members[0].environments[0]).not.toHaveProperty("mixed");
+
+      // The promote of v1.1.0 deploys api and fails on web.
+      const at = "2026-10-17T13:00:00.000Z";
+      await deploy({ component: "api", timestamp: at, releaseDigest: v2.releaseDigest, runId: "run-9", promotedFrom: { env: "staging", runId: "run-8", timestamp: "2026-10-17T12:30:00.000Z" } });
+      await appendDeployOutcome(
+        {
+          version: 1, env: "prod", verb: "promote", runId: "run-9", timestamp: at, actor: "bob", releaseDigest: v2.releaseDigest, status: "fail",
+          components: [
+            { component: "api", outcome: "deployed", digest: contentDigest(`api ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest },
+            { component: "web", outcome: "failed", digest: contentDigest(`web ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest },
+          ],
+        },
+        { cwd: dir },
+      );
+
+      const doc = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW }));
+      const prod = doc.members[0].environments[0];
+      expect(prod.mixed).toEqual({
+        components: [
+          { component: "api", digest: contentDigest(`api ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest, releaseLabel: "v1.1.0", state: "settled", attempt: null },
+          {
+            component: "web",
+            digest: contentDigest(`web ${v1.releaseDigest}`),
+            releaseDigest: v1.releaseDigest,
+            releaseLabel: "v1.0.0",
+            state: "failed",
+            attempt: { verb: "promote", runId: "run-9", timestamp: at, digest: contentDigest(`web ${v2.releaseDigest}`), releaseDigest: v2.releaseDigest, releaseLabel: "v1.1.0" },
+          },
+        ],
+        redeploy: ["chant components redeploy prod --component web"],
+        rollback: "chant components rollback prod --release v1.0.0",
+      });
+      expect(formatStatus(doc)).toContain("  prod is mixed: api runs release v1.1.0; web failed (promote run-9), recorded release v1.0.0");
+      expect(formatStatus(doc)).toContain("    redeploy: chant components redeploy prod --component web");
+      expect(formatStatus(doc)).toContain("    roll back: chant components rollback prod --release v1.0.0");
+
+      // A redeploy of web settles it, but prod still runs two releases.
+      await deploy({ component: "web", timestamp: "2026-10-17T13:10:00.000Z", releaseDigest: v1.releaseDigest, redeploys: { env: "prod", runId: "r", timestamp: "2026-10-17T12:00:00.000Z" } });
+      const redeployed = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW })).members[0].environments[0];
+      expect(redeployed.mixed).toMatchObject({
+        components: [{ component: "api", state: "settled", releaseLabel: "v1.1.0" }, { component: "web", state: "settled", releaseLabel: "v1.0.0" }],
+        redeploy: [],
+        rollback: "chant components rollback prod --release v1.0.0",
+      });
+
+      // The same promote run again puts web on v1.1.0: one release, nothing mixed.
+      await deploy({ component: "web", timestamp: "2026-10-17T13:20:00.000Z", releaseDigest: v2.releaseDigest });
+      const settled = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW })).members[0].environments[0];
+      expect(settled).not.toHaveProperty("mixed");
+    });
+  });
+
+  test("a revoked release's rollback line names the release the environment ran before it", async () => {
+    await withTestDir(async (dir) => {
+      const { v2, deploy } = await setup(dir);
+      for (const component of ["api", "web"]) await deploy({ component, timestamp: "2026-10-17T13:00:00.000Z", releaseDigest: v2.releaseDigest });
+      writeFileSync(
+        join(dir, "chant.workspace.json"),
+        JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the fixture" }], ci: { green: { branch: "main", phases: { test: ["test"] }, require: ["test"] } } }, null, 2),
+      );
+      git(dir, "commit", "-q", "-am", "ci.green");
+      const record = { schema: 1, tag: "revoked", commit: v2.commit, branch: "main", at: "2026-10-17T13:30:00.000Z", phase: "test", run: { name: "test", id: 77, conclusion: "failure", url: null } };
+      git(dir, "tag", "-a", "-m", `ci: phase test failed\n\n${JSON.stringify(record, null, 2)}\n`, `ci/revoked/${v2.commit}`, v2.commit);
+
+      const prod = result(await workspaceStatus({ cwd: dir, env: "prod", now: NOW })).members[0].environments[0];
+      expect(prod.releases.map((r) => [r.component, r.revoked?.rollback])).toEqual([
+        ["api", "chant components rollback prod --release v1.0.0"],
+        ["web", "chant components rollback prod --release v1.0.0"],
+      ]);
+      expect(prod).not.toHaveProperty("mixed");
+    });
+  });
+});

package/src/workspace/status-revoked.test.ts

@@ -0,0 +1,153 @@
+/**
+ * #4033 (ws-105): a release cut from a revoked commit, read at read time from
+ * the `ci/revoked/<sha>` tag. `workspace status` flags an environment that
+ * runs it, with the rollback line, and reads its pending gate as superseded;
+ * `release list` marks it. Against temp repos; nothing is pushed.
+ */
+
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Ajv2020 } from "ajv/dist/2020";
+import statusSchema from "./status.schema.json";
+import releasesSchema from "./releases.schema.json";
+import { formatStatus, workspaceStatus, type StatusDocument } from "./status";
+import { releasesDocument } from "./releases";
+import { contract } from "./__fixtures__/contract-repo";
+import { appendCut, makeRelease, persistRelease, type Release } from "../lifecycle/release-store";
+import { appendReleaseRecord } from "../lifecycle/release-ledger";
+import { appendPendingGate } from "../lifecycle/gate-ledger";
+import type { CommandContext } from "../cli/registry";
+import { contentDigest } from "../content-digest";
+
+const validateStatus = new Ajv2020({ strict: true, allErrors: true }).compile(statusSchema);
+const { expectValid: expectValidReleases } = contract(releasesSchema);
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+const DOC = `jcs1-sha256:${"d".repeat(64)}`;
+const NOW = "2026-10-16T14:00:00.000Z";
+
+/** A workspace whose root member runs release v1.0.0 in prod and waits at its staging gate, and a second release v1.1.0 from a later commit. */
+async function setup(dir: string): Promise<{ old: string; release: Release; next: Release }> {
+  git(dir, "init", "-q", "-b", "main");
+  git(dir, "config", "user.email", "t@chant.dev");
+  git(dir, "config", "user.name", "T");
+  writeFileSync(
+    join(dir, "chant.workspace.json"),
+    JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the fixture" }], ci: { green: { branch: "main", phases: { test: ["test"] }, require: ["test"] } } }, null, 2),
+  );
+  git(dir, "add", ".");
+  git(dir, "commit", "-q", "-m", "init");
+  const old = git(dir, "rev-parse", "HEAD");
+  git(dir, "commit", "-q", "--allow-empty", "-m", "next");
+  const later = git(dir, "rev-parse", "HEAD");
+  const at = (commit: string) =>
+    makeRelease({ member: null, commit, artifactDigests: [], targets: ["staging", "prod"].map((env) => ({ env, templates: [{ component: "api", path: "t.json", digest: `sha256:${"c".repeat(64)}` }], params: [] })) });
+  const release = at(old);
+  const next = at(later);
+  for (const [r, label, ts] of [[release, "v1.0.0", "10"], [next, "v1.1.0", "11"]] as const) {
+    await persistRelease(r, [], { cwd: dir });
+    await appendCut({ releaseDigest: r.releaseDigest, label, actor: "alice", timestamp: `2026-10-16T${ts}:00:00.000Z`, runOrigin: null }, { cwd: dir });
+  }
+  const deploy = { component: "api", digest: contentDigest("api image"), runId: "r", actor: "ci" };
+  await appendReleaseRecord({ ...deploy, env: "prod", gitSha: old, timestamp: "2026-10-16T12:00:00.000Z", releaseDigest: release.releaseDigest }, { cwd: dir });
+  await appendReleaseRecord({ ...deploy, env: "staging", gitSha: later, timestamp: "2026-10-16T12:00:00.000Z", releaseDigest: next.releaseDigest }, { cwd: dir });
+  for (const [r, env] of [[release, "staging"], [next, "prod"]] as const) {
+    await appendPendingGate(
+      { op: "release", gate: `${env}-release`, timestamp: "2026-10-16T13:00:00.000Z", expiresAt: "2999-01-01T00:00:00.000Z", planDigest: DOC, environment: env, releaseDigest: r.releaseDigest },
+      { cwd: dir },
+    );
+  }
+  return { old, release, next };
+}
+
+function revoke(dir: string, sha: string): void {
+  const record = { schema: 1, tag: "revoked", commit: sha, branch: "main", at: "2026-10-16T12:30:00.000Z", phase: "test", run: { name: "test", id: 77, conclusion: "failure", url: "https://example.test/runs/77" } };
+  git(dir, "tag", "-a", "-m", `ci: phase test failed in test (failure)\n\n${JSON.stringify(record, null, 2)}\n`, `ci/revoked/${sha}`, sha);
+}
+
+function result(doc: StatusDocument): Extract<StatusDocument, { members: unknown }> {
+  if ("error" in doc) throw new Error(`${doc.error.code}: ${doc.error.message}`);
+  expect(validateStatus(doc), JSON.stringify(validateStatus.errors, null, 2)).toBe(true);
+  return doc;
+}
+
+describe("a revoked release in workspace status and release list (#4033)", () => {
+  test("an environment running a release cut from a revoked commit is flagged with the rollback line, and the release's pending gate is superseded", async () => {
+    await withTestDir(async (dir) => {
+      const { old, release, next } = await setup(dir);
+
+      // Before the revocation nothing is flagged.
+      const before = result(await workspaceStatus({ cwd: dir, env: "prod", compareTo: "staging", now: NOW }));
+      expect(before.members[0].environments[0].releases[0]).not.toHaveProperty("revoked");
+      expect(before.members[0].gates.map((g) => [g.name, g.state])).toEqual([["prod-release", "pending"], ["staging-release", "pending"]]);
+
+      revoke(dir, old);
+      const doc = result(await workspaceStatus({ cwd: dir, env: "prod", compareTo: "staging", now: NOW }));
+      const [prod, staging] = doc.members[0].environments;
+      expect(prod.releases[0].revoked).toEqual({
+        commit: old,
+        tag: `ci/revoked/${old}`,
+        tagged: expect.any(String),
+        phase: "test",
+        run: { name: "test", id: 77, conclusion: "failure", url: "https://example.test/runs/77" },
+        signer: null,
+        releaseDigest: release.releaseDigest,
+        label: "v1.0.0",
+        rollback: "chant components rollback prod --component api",
+      });
+      // staging runs the later release, which is not revoked.
+      expect(staging.releases[0]).not.toHaveProperty("revoked");
+
+      const [prodGate, stagingGate] = doc.members[0].gates;
+      expect(prodGate).toMatchObject({ name: "prod-release", releaseDigest: next.releaseDigest, state: "pending" });
+      expect(prodGate).not.toHaveProperty("revoked");
+      expect(stagingGate).toMatchObject({ name: "staging-release", releaseDigest: release.releaseDigest, state: "superseded", revoked: { commit: old, tag: `ci/revoked/${old}`, phase: "test" } });
+
+      expect(formatStatus(doc)).toContain(
+        `  prod: api runs release v1.0.0, revoked by ci/revoked/${old} (phase test failed in test (run 77)); roll back: chant components rollback prod --component api`,
+      );
+    });
+  });
+
+  test("release list marks the revoked release, in JSON and in text", async () => {
+    await withTestDir(async (dir) => {
+      const { old } = await setup(dir);
+      revoke(dir, old);
+      const doc = await releasesDocument({ cwd: dir });
+      expectValidReleases(doc);
+      if ("error" in doc) throw new Error(doc.error.message);
+      expect(doc.releases.map((r) => [r.label, r.revoked?.tag ?? null])).toEqual([
+        ["v1.1.0", null],
+        ["v1.0.0", `ci/revoked/${old}`],
+      ]);
+
+      const out: string[] = [];
+      const err: string[] = [];
+      vi.spyOn(console, "log").mockImplementation((...m: unknown[]) => { out.push(m.join(" ")); });
+      vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { err.push(m.join(" ")); });
+      const cwd = process.cwd();
+      try {
+        process.chdir(dir);
+        const { runReleaseList } = await import("../cli/handlers/release");
+        expect(await runReleaseList({ args: {} } as unknown as CommandContext)).toBe(0);
+      } finally {
+        process.chdir(cwd);
+      }
+      expect(out.find((l) => l.startsWith("v1.0.0"))).toMatch(/ {2}revoked$/);
+      expect(out.find((l) => l.startsWith("v1.1.0"))).not.toMatch(/revoked/);
+      expect(err).toContain(`  v1.0.0: revoked by ci/revoked/${old}, phase test failed in test (run 77)`);
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+});