@intentius/chant 0.124.28 → 0.124.30

package/src/workspace/status-revoked.test.ts

@@ -0,0 +1,153 @@
+/**
+ * #4033 (ws-105): a release cut from a revoked commit, read at read time from
+ * the `ci/revoked/<sha>` tag. `workspace status` flags an environment that
+ * runs it, with the rollback line, and reads its pending gate as superseded;
+ * `release list` marks it. Against temp repos; nothing is pushed.
+ */
+
+import { afterEach, describe, expect, test, vi } from "vitest";
+import { withTestDir } from "@intentius/chant-test-utils";
+import { spawnSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { Ajv2020 } from "ajv/dist/2020";
+import statusSchema from "./status.schema.json";
+import releasesSchema from "./releases.schema.json";
+import { formatStatus, workspaceStatus, type StatusDocument } from "./status";
+import { releasesDocument } from "./releases";
+import { contract } from "./__fixtures__/contract-repo";
+import { appendCut, makeRelease, persistRelease, type Release } from "../lifecycle/release-store";
+import { appendReleaseRecord } from "../lifecycle/release-ledger";
+import { appendPendingGate } from "../lifecycle/gate-ledger";
+import type { CommandContext } from "../cli/registry";
+import { contentDigest } from "../content-digest";
+
+const validateStatus = new Ajv2020({ strict: true, allErrors: true }).compile(statusSchema);
+const { expectValid: expectValidReleases } = contract(releasesSchema);
+
+function git(cwd: string, ...args: string[]): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout.trim();
+}
+
+const DOC = `jcs1-sha256:${"d".repeat(64)}`;
+const NOW = "2026-10-16T14:00:00.000Z";
+
+/** A workspace whose root member runs release v1.0.0 in prod and waits at its staging gate, and a second release v1.1.0 from a later commit. */
+async function setup(dir: string): Promise<{ old: string; release: Release; next: Release }> {
+  git(dir, "init", "-q", "-b", "main");
+  git(dir, "config", "user.email", "t@chant.dev");
+  git(dir, "config", "user.name", "T");
+  writeFileSync(
+    join(dir, "chant.workspace.json"),
+    JSON.stringify({ name: "acme", schema: 1, members: [{ name: "root", dir: ".", kind: "other", because: "the fixture" }], ci: { green: { branch: "main", phases: { test: ["test"] }, require: ["test"] } } }, null, 2),
+  );
+  git(dir, "add", ".");
+  git(dir, "commit", "-q", "-m", "init");
+  const old = git(dir, "rev-parse", "HEAD");
+  git(dir, "commit", "-q", "--allow-empty", "-m", "next");
+  const later = git(dir, "rev-parse", "HEAD");
+  const at = (commit: string) =>
+    makeRelease({ member: null, commit, artifactDigests: [], targets: ["staging", "prod"].map((env) => ({ env, templates: [{ component: "api", path: "t.json", digest: `sha256:${"c".repeat(64)}` }], params: [] })) });
+  const release = at(old);
+  const next = at(later);
+  for (const [r, label, ts] of [[release, "v1.0.0", "10"], [next, "v1.1.0", "11"]] as const) {
+    await persistRelease(r, [], { cwd: dir });
+    await appendCut({ releaseDigest: r.releaseDigest, label, actor: "alice", timestamp: `2026-10-16T${ts}:00:00.000Z`, runOrigin: null }, { cwd: dir });
+  }
+  const deploy = { component: "api", digest: contentDigest("api image"), runId: "r", actor: "ci" };
+  await appendReleaseRecord({ ...deploy, env: "prod", gitSha: old, timestamp: "2026-10-16T12:00:00.000Z", releaseDigest: release.releaseDigest }, { cwd: dir });
+  await appendReleaseRecord({ ...deploy, env: "staging", gitSha: later, timestamp: "2026-10-16T12:00:00.000Z", releaseDigest: next.releaseDigest }, { cwd: dir });
+  for (const [r, env] of [[release, "staging"], [next, "prod"]] as const) {
+    await appendPendingGate(
+      { op: "release", gate: `${env}-release`, timestamp: "2026-10-16T13:00:00.000Z", expiresAt: "2999-01-01T00:00:00.000Z", planDigest: DOC, environment: env, releaseDigest: r.releaseDigest },
+      { cwd: dir },
+    );
+  }
+  return { old, release, next };
+}
+
+function revoke(dir: string, sha: string): void {
+  const record = { schema: 1, tag: "revoked", commit: sha, branch: "main", at: "2026-10-16T12:30:00.000Z", phase: "test", run: { name: "test", id: 77, conclusion: "failure", url: "https://example.test/runs/77" } };
+  git(dir, "tag", "-a", "-m", `ci: phase test failed in test (failure)\n\n${JSON.stringify(record, null, 2)}\n`, `ci/revoked/${sha}`, sha);
+}
+
+function result(doc: StatusDocument): Extract<StatusDocument, { members: unknown }> {
+  if ("error" in doc) throw new Error(`${doc.error.code}: ${doc.error.message}`);
+  expect(validateStatus(doc), JSON.stringify(validateStatus.errors, null, 2)).toBe(true);
+  return doc;
+}
+
+describe("a revoked release in workspace status and release list (#4033)", () => {
+  test("an environment running a release cut from a revoked commit is flagged with the rollback line, and the release's pending gate is superseded", async () => {
+    await withTestDir(async (dir) => {
+      const { old, release, next } = await setup(dir);
+
+      // Before the revocation nothing is flagged.
+      const before = result(await workspaceStatus({ cwd: dir, env: "prod", compareTo: "staging", now: NOW }));
+      expect(before.members[0].environments[0].releases[0]).not.toHaveProperty("revoked");
+      expect(before.members[0].gates.map((g) => [g.name, g.state])).toEqual([["prod-release", "pending"], ["staging-release", "pending"]]);
+
+      revoke(dir, old);
+      const doc = result(await workspaceStatus({ cwd: dir, env: "prod", compareTo: "staging", now: NOW }));
+      const [prod, staging] = doc.members[0].environments;
+      expect(prod.releases[0].revoked).toEqual({
+        commit: old,
+        tag: `ci/revoked/${old}`,
+        tagged: expect.any(String),
+        phase: "test",
+        run: { name: "test", id: 77, conclusion: "failure", url: "https://example.test/runs/77" },
+        signer: null,
+        releaseDigest: release.releaseDigest,
+        label: "v1.0.0",
+        rollback: "chant components rollback prod --component api",
+      });
+      // staging runs the later release, which is not revoked.
+      expect(staging.releases[0]).not.toHaveProperty("revoked");
+
+      const [prodGate, stagingGate] = doc.members[0].gates;
+      expect(prodGate).toMatchObject({ name: "prod-release", releaseDigest: next.releaseDigest, state: "pending" });
+      expect(prodGate).not.toHaveProperty("revoked");
+      expect(stagingGate).toMatchObject({ name: "staging-release", releaseDigest: release.releaseDigest, state: "superseded", revoked: { commit: old, tag: `ci/revoked/${old}`, phase: "test" } });
+
+      expect(formatStatus(doc)).toContain(
+        `  prod: api runs release v1.0.0, revoked by ci/revoked/${old} (phase test failed in test (run 77)); roll back: chant components rollback prod --component api`,
+      );
+    });
+  });
+
+  test("release list marks the revoked release, in JSON and in text", async () => {
+    await withTestDir(async (dir) => {
+      const { old } = await setup(dir);
+      revoke(dir, old);
+      const doc = await releasesDocument({ cwd: dir });
+      expectValidReleases(doc);
+      if ("error" in doc) throw new Error(doc.error.message);
+      expect(doc.releases.map((r) => [r.label, r.revoked?.tag ?? null])).toEqual([
+        ["v1.1.0", null],
+        ["v1.0.0", `ci/revoked/${old}`],
+      ]);
+
+      const out: string[] = [];
+      const err: string[] = [];
+      vi.spyOn(console, "log").mockImplementation((...m: unknown[]) => { out.push(m.join(" ")); });
+      vi.spyOn(console, "error").mockImplementation((...m: unknown[]) => { err.push(m.join(" ")); });
+      const cwd = process.cwd();
+      try {
+        process.chdir(dir);
+        const { runReleaseList } = await import("../cli/handlers/release");
+        expect(await runReleaseList({ args: {} } as unknown as CommandContext)).toBe(0);
+      } finally {
+        process.chdir(cwd);
+      }
+      expect(out.find((l) => l.startsWith("v1.0.0"))).toMatch(/ {2}revoked$/);
+      expect(out.find((l) => l.startsWith("v1.1.0"))).not.toMatch(/revoked/);
+      expect(err).toContain(`  v1.0.0: revoked by ci/revoked/${old}, phase test failed in test (run 77)`);
+    });
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+});

package/src/workspace/status-stewards.ts

@@ -82,6 +82,8 @@ export interface StatusStewardRun {
   gitSha?: string;
   /** The CI run the Op ran in (#4020), when it ran in CI: the shape a release's `runOrigin` has. */
   runOrigin?: OpRunRecord["runOrigin"];
+  /** Why the run failed (#4094), for a failed run whose record says. Absent otherwise, and on a record written before chant 0.124.30. */
+  failure?: OpRunRecord["failure"];
   /**
    * The gate the run stopped at, for a `gated` run: its name, when the run
    * stopped there, the op it is recorded under (the Op's own, or the
@@ -417,6 +419,7 @@ export async function readMemberStewards(
             ended: newest.ended,
             ...(newest.gitSha ? { gitSha: newest.gitSha } : {}),
             ...(newest.runOrigin ? { runOrigin: newest.runOrigin } : {}),
+            ...(newest.failure ? { failure: newest.failure } : {}),
             gate: newest.gate ? gateOf(newest.gate, op.name) : null,
             point: point?.wait ?? null,
             phases: newest.phases.map((p) => ({

package/src/workspace/status.schema.json

@@ -123,6 +123,10 @@
           "type": "array",
           "items": { "$ref": "#/$defs/acceptance" }
         },
+        "overlap": {
+          "description": "Added in contract 1 by #4025, written by chant 0.124.29 and newer; absent from older output, so a reader treats a missing field as unknown. Overlap between in-flight work items: a work item (a current record of a declared work kind) is in flight unless it implements at least one decision and every one is confirmed (in one of its kind's closed states and superseded by nothing, as featureFlags reads it). Its commits are the ones linked to it as #4029 defines linked (a Chant-Record: <work kind>:<id> trailer, or a Chant-Lease trailer that resolves to it), read from every local and remote-tracking branch and HEAD, the chant/ ledger branches left out, merges skipped, and never fetched. Two items overlap when their commits touch the same file, or when one entry of a change set a pending or approved gate binds is attributed to both: an entry is attributed to an item when a commit linked to the item changed the entry's source file (recorded on the stored change set) and that commit is in the history the change set was planned from. A report only: nothing is locked or refused. Null when the workspace declares no work kind, or the work records or history can't be read.",
+          "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/overlap" }]
+        },
         "summary": {
           "type": "object",
           "required": ["members", "released", "unreadable", "differing"],
@@ -266,9 +270,97 @@
               }
             }
           }
+        },
+        "featureFlags": {
+          "description": "The member's feature flags (#4024): each record of a declared flag kind whose member field names this member, sorted by id. A flag is a workspace record the member's build reads as one build-time parameter, with chant build --env <env>; its value in an environment is recorded on the build, and on a release's target, as a param whose source is flag:<id>. Named featureFlags because a release record's flags already holds legacy-digest. Empty when no flag names the member, and null when the flag records could not be read. Optional: written from chant 0.124.29, absent from older output.",
+          "type": ["array", "null"],
+          "items": { "$ref": "#/$defs/featureFlag" }
         }
       }
     },
+    "overlap": {
+      "type": "object",
+      "required": ["items", "pairs", "changeSets", "unattributed"],
+      "properties": {
+        "items": {
+          "type": "array",
+          "description": "Each in-flight work item with at least one linked commit, sorted by item.",
+          "items": {
+            "type": "object",
+            "required": ["item", "path", "state", "commits"],
+            "properties": {
+              "item": { "type": "string", "description": "<work kind>:<id>, as a Chant-Record trailer names it." },
+              "path": { "type": "string", "description": "The work record file, from the repository root." },
+              "state": { "type": ["string", "null"] },
+              "commits": { "type": "array", "items": { "type": "string" }, "description": "The commits linked to the item, newest first." }
+            }
+          }
+        },
+        "pairs": {
+          "type": "array",
+          "description": "Each pair of items that share a file or a change-set entry, sorted by the first item and then the second. Empty when nothing overlaps.",
+          "items": {
+            "type": "object",
+            "required": ["items", "files", "addresses"],
+            "properties": {
+              "items": { "type": "array", "items": { "type": "string" }, "minItems": 2, "maxItems": 2, "description": "The two items, in sorted order." },
+              "files": { "type": "array", "items": { "type": "string" }, "description": "The paths, from the repository root, that both items' linked commits add, change or delete, sorted. A rename counts as a delete and an add." },
+              "addresses": {
+                "type": "array",
+                "description": "The change-set entries attributed to both items, by change set, member and address.",
+                "items": {
+                  "type": "object",
+                  "required": ["changeSet", "ledgerMember", "member", "address", "node", "source"],
+                  "properties": {
+                    "changeSet": { "type": "string", "description": "The change set's digest, for chant change-set show." },
+                    "ledgerMember": { "type": ["string", "null"], "description": "The workspace member whose ledger stores the change set, or null for the flat ledger." },
+                    "member": { "type": "string", "description": "The entry's change-set member." },
+                    "address": { "type": "string", "description": "The entry's planner address." },
+                    "node": { "type": ["string", "null"], "description": "The entry's graph node." },
+                    "source": { "type": "string", "description": "The entry's source file, from the repository root, that both items' commits changed." }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "changeSets": { "type": "array", "items": { "type": "string" }, "description": "The digests of the stored change sets read: those a pending or approved gate binds, sorted." },
+        "unattributed": { "type": "integer", "minimum": 0, "description": "Entries of those change sets with no source (stored by a chant before 0.124.29, or mapped onto no node with a source location), so attributed to no item." }
+      }
+    },
+    "featureFlag": {
+      "type": "object",
+      "required": ["id", "param", "owner", "values", "work", "implements", "stale", "kind", "path"],
+      "properties": {
+        "id": { "type": "string", "description": "The flag's name, its record's id." },
+        "param": { "type": "string", "description": "The build parameter of the member the flag sets: a key of buildParams in its chant.config.ts." },
+        "owner": { "type": "string", "description": "Who owns the flag, and removes it when its work is settled." },
+        "values": {
+          "type": "object",
+          "description": "The flag's value per environment, as the record writes it. An environment it leaves out builds with the parameter's declared default.",
+          "additionalProperties": { "oneOf": [{ "type": "string" }, { "type": "number" }, { "type": "boolean" }] }
+        },
+        "work": {
+          "description": "The work item the flag hides, with that item's state, which is null when no record of the flag kind's work kind has the id. Null when the record names none.",
+          "oneOf": [
+            { "type": "null" },
+            { "type": "object", "required": ["id", "state"], "properties": { "id": { "type": "string" }, "state": { "type": ["string", "null"] } } }
+          ]
+        },
+        "implements": {
+          "type": "array",
+          "description": "Each decision the work item implements, with its state, and confirmed: true when the decision is in one of its kind's closed states and nothing supersedes it.",
+          "items": {
+            "type": "object",
+            "required": ["id", "state", "confirmed"],
+            "properties": { "id": { "type": "string" }, "state": { "type": ["string", "null"] }, "confirmed": { "type": "boolean" } }
+          }
+        },
+        "stale": { "type": "boolean", "description": "True when the work item implements at least one decision and every one is confirmed: the flag is due for removal, and chant workspace check reports it (WSP118)." },
+        "kind": { "type": "string", "description": "The flag kind file, from the workspace root." },
+        "path": { "type": "string", "description": "The flag record file, from the workspace root." }
+      }
+    },
     "stewardForm": { "enum": ["local", "fountain"] },
     "steward": {
       "type": "object",
@@ -357,11 +449,22 @@
                         "required": ["forge"],
                         "description": "Added in contract 1 by #4020, written by chant 0.124.28 and newer. The CI run the Op ran in, the shape a release's runOrigin has: the forge (github for GitHub and Forgejo, gitlab), the repo or project, and a link to the run. Absent outside CI.",
                         "properties": {
-                          "forge": { "enum": ["github", "gitlab", "op", "local"] },
+                          "forge": { "enum": ["github", "gitlab", "op", "local", "chant"], "description": "chant: a pull-request job the chant runner ran (chant ci run, #4094), added within contract 1 and written by chant 0.124.30 and newer." },
                           "repo": { "type": "string" },
                           "url": { "type": "string" }
                         }
                       },
+                      "failure": {
+                        "type": "object",
+                        "required": ["code", "reason"],
+                        "description": "Added in contract 1 by #4094, written by chant 0.124.30 and newer. Why a failed run failed: code is a pull-request report's refusal or status (not-approved, plan-changed, not-a-reviewer, no-pull-request, plan-failed, failed, refused) or command-failed, setup-failed or build-failed, and a reader keeps a case for a code it does not know. reason is one line for a person, phase the phase that failed, exitCode the failed command's exit code. chant ci run writes it on every failed job; absent otherwise.",
+                        "properties": {
+                          "code": { "type": "string", "minLength": 1 },
+                          "reason": { "type": "string" },
+                          "phase": { "type": "string" },
+                          "exitCode": { "type": "integer" }
+                        }
+                      },
                       "gate": {
                         "oneOf": [
                           { "type": "null" },
@@ -874,13 +977,14 @@
         "planDigest": { "type": ["string", "null"], "description": "The plan the run reached the gate with (#2300), or null for a gate that binds no plan. An approval counts only for this plan." },
         "state": {
           "enum": ["pending", "approved", "expired", "superseded"],
-          "description": "Read from the newest pending fact for the gate in env, as a run reads it. approved: the approvals recorded since it, for its plan, pass the gate (its quorum, or a policy permit in enforce mode). expired: not approved, and the pending fact is past expiresAt, so the next run records a fresh one. superseded: not approved, and an approval recorded since it names a different plan, so it doesn't count. pending: none of these."
+          "description": "Read from the newest pending fact for the gate in env, as a run reads it. approved: the approvals recorded since it, for its plan, pass the gate (its quorum, or a policy permit in enforce mode). expired: not approved, and the pending fact is past expiresAt, so the next run records a fresh one. superseded: not approved, and an approval recorded since it names a different plan, so it doesn't count; or, on a release gate that is not expired, its release was cut from a revoked commit (#4033, ws-105), so chant approve refuses it with release-revoked and revoked is set. pending: none of these."
         },
         "recordedAt": { "type": "string", "description": "When the run recorded the pending fact." },
         "gitSha": { "type": "string", "description": "Added in contract 1 by #4020, written by chant 0.124.28 and newer. The commit the run reached the gate at, from the pending fact. Absent on a fact recorded by an older chant, and when the run knew no commit. It joins the gate to a release's gitSha and to a run's." },
         "runId": { "type": "string", "description": "Added in contract 1 by #4020, written by chant 0.124.28 and newer. The run that reached the gate: an Op run id, or the CI run id for a component gate that ran in CI. Absent when the run had none." },
         "changeSet": { "type": "string", "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "Added in contract 1 by #4022, written by chant 0.124.28 and newer. The change set the gate binds: planDigest, when a change-set document is stored under it in the member's _change-sets/ on chant/lifecycle, as a pull-request gate's apply and a release gate (#4045) store it. chant change-set show <changeSet> --json prints it, each entry with its graph node. Absent when none is stored, as for a component gate, which binds a lifecycle-plan digest." },
         "releaseDigest": { "type": "string", "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "Added in contract 1 by #4045, written by chant 0.124.28 and newer. The release the gate binds, from the pending fact: set on a release gate, the gate chant components promote --release passes for an environment, whose component is the op release. An approval counts toward it only when it was recorded for this release, environment and planDigest. Absent on every other gate." },
+        "revoked": { "$ref": "#/$defs/revocation", "description": "Added in contract 1 by #4033 (ws-105), written by chant 0.124.29 and newer. Set on a release gate whose release was cut from a commit with a ci/revoked/<sha> tag, judged as release cut judges it: the tag. The gate's state is then superseded, or expired when its pending fact has expired. Absent otherwise." },
         "expiresAt": { "type": "string" },
         "approvals": {
           "description": "The approvals that count toward the gate for its plan, oldest first.",
@@ -957,6 +1061,59 @@
               }
             }
           ]
+        },
+        "mixed": { "$ref": "#/$defs/mixed" }
+      }
+    },
+    "mixed": {
+      "type": "object",
+      "description": "Added in contract 1 by #4035, written by chant 0.124.29 and newer. Set when the environment runs a mix: a components promote, rollback or redeploy left a component failed or gated (its <env>/outcomes.jsonl on chant/lifecycle says so) and the release ledger has recorded nothing for it since, or the latest records of its components name more than one release, a record of no release counting as one, with at least one naming a release. Derived when read. Absent otherwise.",
+      "required": ["components", "redeploy", "rollback"],
+      "properties": {
+        "components": {
+          "description": "Every component the ledger records in the environment or a run left unsettled, sorted by name.",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["component", "digest", "releaseDigest", "releaseLabel", "state", "attempt"],
+            "properties": {
+              "component": { "type": "string" },
+              "digest": { "type": ["string", "null"], "description": "The digest the release ledger records the component running, or null when it has no record in the environment." },
+              "releaseDigest": { "type": ["string", "null"], "description": "The release that record names, or null." },
+              "releaseLabel": { "type": ["string", "null"], "description": "That release's label, or null." },
+              "state": {
+                "enum": ["settled", "failed", "gated"],
+                "description": "settled: the record is what the component runs. failed or gated: the newest run that named it failed on it or stopped at its gate after the steps before the gate ran, and nothing has been recorded for it since, so what it runs is not known."
+              },
+              "attempt": {
+                "description": "For an unsettled component, the run that left it so and what it was deploying. Null when settled.",
+                "oneOf": [
+                  { "type": "null" },
+                  {
+                    "type": "object",
+                    "required": ["verb", "runId", "timestamp", "digest", "releaseDigest", "releaseLabel"],
+                    "properties": {
+                      "verb": { "enum": ["promote", "rollback", "redeploy"] },
+                      "runId": { "type": "string" },
+                      "timestamp": { "type": "string" },
+                      "digest": { "type": "string" },
+                      "releaseDigest": { "type": ["string", "null"] },
+                      "releaseLabel": { "type": ["string", "null"] }
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        },
+        "redeploy": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "chant components redeploy <env> --component <component> for each unsettled component the ledger records, run in the member's directory: it puts the component's recorded release back. Empty when no component is unsettled."
+        },
+        "rollback": {
+          "type": ["string", "null"],
+          "description": "chant components rollback <env> --release <label|digest>, run in the member's directory: it restores every component of the newest release the environment ran, other than the one it was moving to, that is still kept and not revoked. Null when there is none."
         }
       }
     },
@@ -987,13 +1144,64 @@
             }
           ]
         },
+        "releaseDigest": { "type": ["string", "null"], "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The release this deploy was made from: the releaseDigest of _releases/<releaseDigest>.json. A promote with --release writes it, a run --components with --release writes it, and a rollback or redeploy copies it from the record it restores. Null for a deploy that named no release. With the item's environment it names the release target." },
+        "releaseLabel": { "type": ["string", "null"], "description": "Added in contract 1 by #4043, written by chant 0.124.29 and newer. The label that release was cut with, from _releases/cuts.jsonl. Null when releaseDigest is null, when the release has no label, and when the cuts can't be read." },
         "flags": { "type": "array", "items": { "enum": ["legacy-digest"] } },
         "plan": {
           "type": ["object", "null"],
           "description": "The release plan digest names, read from _plans/<digest>.json on chant/lifecycle (ws-055, #2733): the work items and evidence this release shipped. Null when this checkout has no plan stored under that digest — most releases carry no plan, and a plan not yet fetched also reads null."
+        },
+        "revoked": {
+          "description": "Added in contract 1 by #4033 (ws-105), written by chant 0.124.29 and newer. Set when the deploy record names a release in releaseDigest and that release was cut from a commit with a ci/revoked/<sha> tag: the environment runs a revoked release. Read from local tags at read time and judged as release cut judges them, so with ci.green.signedSince an unsigned revoked tag is ignored. Absent when the release is not revoked, when the record names no release, and when the ci tags can't be judged.",
+          "allOf": [
+            { "$ref": "#/$defs/revocation" },
+            {
+              "type": "object",
+              "required": ["releaseDigest", "label", "rollback"],
+              "properties": {
+                "releaseDigest": { "type": "string", "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "The revoked release the environment runs." },
+                "label": { "type": ["string", "null"], "description": "The release's label, or null when its cuts gave it none." },
+                "rollback": { "type": "string", "description": "The line that rolls the environment back, run in the member's directory. Since #4035 (chant 0.124.29): chant components rollback <env> --release <label|digest>, naming the newest release the environment ran before this one that is still kept and not revoked. When there is none, and from chant 0.124.28: chant components rollback <env> --component <component>." }
+              }
+            }
+          ]
         }
       }
     },
+    "revocation": {
+      "type": "object",
+      "description": "The ci/revoked/<sha> tag on a release's commit (#4033, ws-105), as chant ci list --json shows a commit's revoked tag, with the commit.",
+      "required": ["commit", "tag", "tagged", "phase", "run", "signer"],
+      "properties": {
+        "commit": { "type": "string", "description": "The release's commit, which the tag names." },
+        "tag": { "type": "string", "description": "ci/revoked/<sha>." },
+        "tagged": { "type": ["string", "null"], "description": "When the tag was made, ISO 8601, or null for a lightweight tag." },
+        "phase": { "type": ["string", "null"], "description": "The phase the annotation names as failed, or null when the annotation can't be read." },
+        "run": {
+          "description": "The run the annotation names as failed, or null.",
+          "oneOf": [
+            { "type": "null" },
+            {
+              "type": "object",
+              "required": ["name", "id", "conclusion", "url"],
+              "properties": {
+                "name": { "type": "string" },
+                "id": { "type": ["integer", "null"], "description": "The check run's id, or null for a chant Op run." },
+                "conclusion": { "type": ["string", "null"] },
+                "url": { "type": ["string", "null"] },
+                "opRun": {
+                  "type": "object",
+                  "required": ["id", "env", "signer"],
+                  "properties": { "id": { "type": "string" }, "env": { "type": "string" }, "signer": { "type": "string" } },
+                  "description": "Present only when the run is a chant Op run (ci.green.source runs, #4044): its id, the env it is recorded under and the runner whose statement it carries. id is then null."
+                }
+              }
+            }
+          ]
+        },
+        "signer": { "type": ["string", "null"], "description": "The runner principal whose statement the tag carries, or null when it counts unsigned." }
+      }
+    },
     "compare": {
       "type": "object",
       "required": ["differs", "components"],