@intentius/chant 0.124.29 → 0.124.31

package/dist/workspace/trust-write.schema.json

@@ -0,0 +1,265 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/workspace/trust-write/v1/trust-write.schema.json",
+  "title": "chant workspace trust runner add|remove output",
+  "description": "What `chant workspace trust runner add <principal> --key <key>` and `trust runner remove <principal>` print (#3510): the runner entry before and after the write, the digest of .chant/trust.json after it, or the reason it wrote nothing. Each write edits .chant/trust.json in the working tree in place and never commits. Readers ignore fields they do not know; a field is only ever added within a version. The error codes are a closed list, each in the one closed list of `reason-codes.ts`. Contract version 1 of this document is written by chant 0.124.31 and newer.",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/result"
+    },
+    {
+      "$ref": "#/$defs/failure"
+    }
+  ],
+  "$defs": {
+    "runner": {
+      "type": "object",
+      "required": [
+        "principal",
+        "class",
+        "key"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "principal": {
+          "type": "string",
+          "minLength": 1
+        },
+        "class": {
+          "enum": [
+            "runner",
+            "service"
+          ]
+        },
+        "key": {
+          "type": "string",
+          "pattern": "^ssh-ed25519 [A-Za-z0-9+/]+={0,2}$",
+          "description": "The runner's public key, as an ssh-ed25519 line with no comment."
+        }
+      }
+    },
+    "digest": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "A SHA-256 of the file's bytes, in lowercase hex. A file that is not there has the digest of empty text."
+    },
+    "result": {
+      "description": "The entry was written, or would be with --dry-run, or the file already held it (changed false). Exit code 0.",
+      "type": "object",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "action",
+        "name",
+        "path",
+        "digest",
+        "previousDigest",
+        "paths",
+        "changed",
+        "dryRun",
+        "previous",
+        "entry",
+        "runnerRole"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/trust-write/v1/trust-write.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string",
+          "description": "The chant that wrote it."
+        },
+        "action": {
+          "enum": [
+            "runner add",
+            "runner remove"
+          ]
+        },
+        "name": {
+          "type": "string",
+          "description": "The runner's principal."
+        },
+        "path": {
+          "const": ".chant/trust.json",
+          "description": "The trust config, relative to the repository root."
+        },
+        "digest": {
+          "$ref": "#/$defs/digest",
+          "description": "The file's digest after the write, or as it would be with --dry-run: what the caller passes as --expect to its next trust write."
+        },
+        "previousDigest": {
+          "$ref": "#/$defs/digest",
+          "description": "The file's digest before the write."
+        },
+        "paths": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The trust config when the write changed it or would with --dry-run; empty when it already held what was given."
+        },
+        "changed": {
+          "type": "boolean",
+          "description": "Whether the file changed: paths is not empty."
+        },
+        "dryRun": {
+          "type": "boolean",
+          "description": "True when --dry-run was given: nothing was written, and the document says what would have been."
+        },
+        "previous": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/runner"
+            }
+          ],
+          "description": "The principal's runner entry before the write, or null when there was none."
+        },
+        "entry": {
+          "oneOf": [
+            {
+              "type": "null"
+            },
+            {
+              "$ref": "#/$defs/runner"
+            }
+          ],
+          "description": "The principal's runner entry after the write, or null after runner remove."
+        },
+        "runnerRole": {
+          "type": "boolean",
+          "description": "Whether the principal holds the runner role after the write. runner add grants it for class runner; runner remove takes it away."
+        }
+      }
+    },
+    "failure": {
+      "type": "object",
+      "description": "Nothing was written. Exit code 1.",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "action",
+        "name",
+        "error"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/trust-write/v1/trust-write.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string"
+        },
+        "action": {
+          "enum": [
+            "runner add",
+            "runner remove"
+          ]
+        },
+        "name": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "error": {
+          "type": "object",
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "enum": [
+                "not-a-git-repository",
+                "write-usage-invalid",
+                "trust-config-invalid",
+                "trust-conflict",
+                "runner-key-invalid",
+                "runner-key-is-signer",
+                "runner-exists",
+                "runner-unknown",
+                "write-scope-member",
+                "write-scope-protected",
+                "write-scope-class-unknown",
+                "agent-unknown",
+                "principal-unidentified",
+                "write-lock-timeout",
+                "write-lock-not-held"
+              ]
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        },
+        "conflict": {
+          "type": "object",
+          "description": "With trust-conflict: the digest --expect named, the one the file has now, and its last chant write when the write journal knows it.",
+          "required": [
+            "path",
+            "expected",
+            "digest",
+            "lastWrite"
+          ],
+          "properties": {
+            "path": {
+              "type": "string"
+            },
+            "expected": {
+              "$ref": "#/$defs/digest"
+            },
+            "digest": {
+              "$ref": "#/$defs/digest"
+            },
+            "lastWrite": {
+              "oneOf": [
+                {
+                  "type": "null"
+                },
+                {
+                  "type": "object",
+                  "required": [
+                    "verb",
+                    "by",
+                    "agent",
+                    "at"
+                  ],
+                  "properties": {
+                    "verb": {
+                      "type": "string"
+                    },
+                    "by": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "agent": {
+                      "type": [
+                        "string",
+                        "null"
+                      ]
+                    },
+                    "at": {
+                      "type": "string"
+                    }
+                  }
+                }
+              ]
+            }
+          }
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.124.29",
+  "version": "0.124.31",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/handlers/build.test.ts

@@ -148,6 +148,21 @@ describe("runBuild --components --generate (chant #1108 build-time parameters)",
     vi.restoreAllMocks();
   });
 
+  test("--pr-build and --pr-build-command become the prLoop build options (#4088)", async () => {
+    generateComponentsPipelineMock.mockResolvedValue({ success: true, yaml: "jobs: {}", stages: [], jobs: [] });
+    vi.spyOn(console, "log").mockImplementation(() => {});
+
+    const exit = await runBuild({
+      args: makeArgs({ generate: "github", prLoop: true, prBuild: true, prBuildCommand: "npm run build" }),
+      plugins: [],
+      serializers: [],
+    });
+
+    expect(exit).toBe(0);
+    expect(generateComponentsPipelineMock).toHaveBeenCalledWith(".", "github", { env: undefined, prLoop: { build: true, buildCommand: "npm run build" } }, undefined, []);
+    vi.restoreAllMocks();
+  });
+
   test("chant.config.ts's declared buildParams resolve, log, and are forwarded to generateComponentsPipeline", async () => {
     loadChantConfigUpwardMock.mockResolvedValue({
       config: { buildParams: { tier: { type: "string", default: "light" } } },

package/src/cli/handlers/build.ts

@@ -13,7 +13,8 @@ import type { PrLoopPipelineOptions } from "../../components/pr-pipeline";
 /**
  * The `prLoop` generator option from `--pr-loop`'s flags (#3183): the gate
  * and the branch, and with `--events-json` and `--report-url` (#4007) the
- * flags the generated jobs pass to pr-plan and pr-apply.
+ * flags the generated jobs pass to pr-plan and pr-apply. `--pr-build` and
+ * `--pr-build-command` (#4088) add the build and lint steps before both.
  */
 function prLoopOption(args: CommandContext["args"]): PrLoopPipelineOptions {
   return {
@@ -21,6 +22,8 @@ function prLoopOption(args: CommandContext["args"]): PrLoopPipelineOptions {
     ...(args.branch ? { branch: args.branch } : {}),
     ...(args.eventsJson ? { events: true } : {}),
     ...(args.reportUrl ? { reportUrl: args.reportUrl } : {}),
+    ...(args.prBuild ? { build: true } : {}),
+    ...(args.prBuildCommand ? { buildCommand: args.prBuildCommand } : {}),
   };
 }
 

package/src/cli/handlers/fan-out.test.ts

@@ -84,6 +84,13 @@ let inputs: Record<string, Record<string, unknown>> = {};
 let stepOutputs: Record<string, Record<string, unknown>> = {};
 /** Called as a component's step starts, before it applies. */
 let onStart: (component: string) => void = () => {};
+/**
+ * What each stack exposes in the deployed estate, read through the step's
+ * `outputs` as cfn-deploy's `describeStack` does (#4104). `undefined` leaves
+ * the capability with no `outputs`; an `Error` makes the read fail.
+ */
+let liveOutputs: Record<string, Record<string, unknown> | Error> | undefined;
+let outputsRead: string[] = [];
 
 function makeArgs(overrides: Partial<ParsedArgs>): ParsedArgs {
   return {
@@ -114,6 +121,8 @@ beforeEach(() => {
   inputs = {};
   stepOutputs = {};
   onStart = () => {};
+  liveOutputs = undefined;
+  outputsRead = [];
   gateLedger = memoryGateLedgerPort();
   stderrLines = [];
   stdoutLines = [];
@@ -149,6 +158,16 @@ beforeEach(() => {
         if (failing.includes(runCtx.component)) throw new Error(`${runCtx.component} failed`);
         return { ok: true, ...(stepOutputs[runCtx.component] ? { outputs: stepOutputs[runCtx.component] } : {}) };
       },
+      ...(liveOutputs
+        ? {
+            async outputs(readCtx: { component: string }) {
+              outputsRead.push(readCtx.component);
+              const live = liveOutputs![readCtx.component];
+              if (live instanceof Error) throw live;
+              return { ...(live ?? {}) };
+            },
+          }
+        : {}),
     } as never);
     return Promise.resolve(registry);
   });
@@ -849,3 +868,66 @@ describe("progress carries only for an unchanged input (#4081)", () => {
     expect(stderr()).toContain("does not record what each component applied, so none of its progress carries");
   });
 });
+
+describe("a seed's outputs, read from the deployed estate (#4104)", () => {
+  /** cluster-a reads net's TopicArn, and the change touches cluster-a alone. */
+  function wireClusterA(): void {
+    const wired: Component = {
+      name: "cluster-a",
+      dependsOn: ["net"],
+      deploy: [
+        {
+          phase: "Apply",
+          steps: [{ kind: "cfn-deploy", stack: "cluster-a-stack", inputs: { topic: { stackOutput: { stack: "net", name: "TopicArn" } } } }],
+        },
+      ],
+    };
+    const estate = ESTATE.map((c) => (c.name === "cluster-a" ? wired : c));
+    discoverComponentsMock.mockResolvedValue({
+      components: new Map(estate.map((c) => [c.name, { component: c, exportName: c.name, filePath: `${c.name}.component.ts` }])),
+      sourceFiles: [],
+      errors: [],
+    });
+    affectedStacksMock.mockResolvedValue({ changed: ["cluster-a-stack"], dependents: [], indeterminate: [] });
+  }
+
+  test("a cluster-a-only change runs cluster-a with net's deployed outputs, and says it read them", async () => {
+    wireClusterA();
+    liveOutputs = { net: { TopicArn: "arn:aws:sns:us-east-1:000000000000:net", QueueUrl: "http://q" } };
+    expect(await runComponentsFanOut(ctx({ base: "main", env: "test" }))).toBe(0);
+    expect(ran).not.toContain("net");
+    expect(outputsRead).toEqual(["net"]);
+    expect(inputs["cluster-a"]).toEqual(expect.objectContaining({ inputs: { topic: "arn:aws:sns:us-east-1:000000000000:net" } }));
+    expect(stderr()).toContain("net: outputs read from the deployed estate (QueueUrl, TopicArn)");
+  });
+
+  test("--seed-outputs wins: a seed it gives is not read", async () => {
+    wireClusterA();
+    liveOutputs = { net: { TopicArn: "arn:deployed" } };
+    const dir = await mkdtemp(join(tmpdir(), "fan-out-"));
+    try {
+      const seed = join(dir, "seed.json");
+      await writeFile(seed, JSON.stringify({ net: { TopicArn: "arn:seeded" } }));
+      expect(await runComponentsFanOut(ctx({ base: "main", env: "test", seedOutputs: [seed] }))).toBe(0);
+      expect(outputsRead).toEqual([]);
+      expect(inputs["cluster-a"]).toEqual(expect.objectContaining({ inputs: { topic: "arn:seeded" } }));
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("a read that fails stops the fan-out before anything runs, naming the seed", async () => {
+    wireClusterA();
+    liveOutputs = { net: new Error("ExpiredToken") };
+    expect(await runComponentsFanOut(ctx({ base: "main", env: "test" }))).toBe(1);
+    expect(ran).toEqual([]);
+    expect(stderr()).toContain("could not read the deployed outputs of net: ExpiredToken");
+  });
+
+  test("--dry-run reads nothing", async () => {
+    wireClusterA();
+    liveOutputs = { net: { TopicArn: "arn:deployed" } };
+    expect(await runComponentsFanOut(ctx({ base: "main", env: "test", dryRun: true }))).toBe(0);
+    expect(outputsRead).toEqual([]);
+  });
+});

package/src/cli/handlers/fan-out.ts

@@ -67,6 +67,8 @@ import { summaryLedgerPrefix, writeGatedRunSummary } from "../../op/gate-summary
 import { approveCommand, gateIsSealed } from "../../op/gate";
 import { getHeadCommit } from "../../lifecycle/git";
 import { remainingFanOut, type ChangedUnits, type FanOutProgress } from "../../components/fan-out";
+import { readDeployedOutputs } from "../../components/wave-plan";
+import { deployContext } from "../../components/driver";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 import { formatError, formatInfo, formatWarning } from "../format";
 import { FAN_OUT_GATE_OP } from "../../op/gate-name";
@@ -343,6 +345,36 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   }
 
   const registry = await fanOutRegistry(projectPath, config);
+  const env = args.env ?? "local";
+
+  // A completed component's recorded outputs win over a `--seed-outputs`
+  // entry for the same name, as a fresh apply's outputs merge over a seed in
+  // the driver: the record holds what this fan-out itself applied. A seed
+  // neither gives is read from the deployed estate (#4104), through its
+  // capability's `outputs`, as pr-plan reads a dependency outside the change.
+  // One that cannot be read leaves its dependents' references unresolved.
+  const componentOutputs: Record<string, Record<string, unknown>> = { ...seededOutputs, ...priorOutputs };
+  const seeds = (progress ? remainingFanOut(derived.plan, derived.components, progress) : derived.plan).seeds;
+  let deployedSeeds: Record<string, string[]>;
+  try {
+    deployedSeeds = await readDeployedOutputs(
+      seeds,
+      new Map(derived.components.map((c) => [c.name, c])),
+      registry,
+      (name) => deployContext({ env }, name),
+      componentOutputs,
+    );
+  } catch (err) {
+    console.error(formatError({
+      message: `could not read the deployed outputs of ${seeds.filter((s) => !(s in componentOutputs)).join(", ")}: ${err instanceof Error ? err.message : String(err)}`,
+      hint: "Nothing ran. --seed-outputs <file> gives a component's outputs instead of reading them.",
+    }));
+    return 1;
+  }
+  for (const [name, keys] of Object.entries(deployedSeeds)) {
+    console.error(formatInfo(`${name}: outputs read from the deployed estate (${keys.length > 0 ? keys.join(", ") : "none yet"})`));
+  }
+
   // #3061: the commit this run deploys, for the workloads' vcs.ref.head.revision.
   const revision = await getHeadCommit().catch(() => undefined);
 
@@ -378,12 +410,9 @@ export async function runComponentsFanOut(ctx: CommandContext): Promise<number>
   let result;
   try {
     result = await runFanOut(derived.plan, derived.components, registry, {
-      env: args.env ?? "local",
+      env,
       releaseIdentity: () => (revision ? { revision } : {}),
-      // A completed component's recorded outputs win over a `--seed-outputs`
-      // entry for the same name, as a fresh apply's outputs merge over a seed in
-      // the driver: the record holds what this fan-out itself applied.
-      componentOutputs: { ...seededOutputs, ...priorOutputs },
+      componentOutputs,
       ...(gate ? { gate } : {}),
       ...(waveGate ? { waveGate } : {}),
       ...(waveGate

package/src/cli/handlers/pr.ts

@@ -112,6 +112,11 @@ interface Prepared {
   head: string;
   gate: string;
   forge?: PrForge;
+  /**
+   * Every component in the project, not the selection (`deriveFanOut`), so
+   * the plan reads the deployed outputs of a dependency the change did not
+   * select (#4104).
+   */
   components: DriverComponent[];
   plan: FanOutPlan;
   signal: ComponentChangeSignal;

package/src/cli/main.test.ts

@@ -836,6 +836,7 @@ describe("workspace init and ls (#2534)", () => {
       "workspace runs",
       "workspace signers",
       "workspace status",
+      "workspace trust",
       "workspace upgrade",
       "workspace verify",
       "workspace versions",

package/src/cli/main.ts

@@ -249,6 +249,56 @@ CI:
                         chant/lifecycle that a runner key signed. Pushes the
                         tags. --key, or the PEM in CHANT_RUNNER_KEY, signs
                         each tag with a runner key.
+  ci run plan|apply --env <env> --base <sha> [--pr <n>] [--commit <sha>]
+              [--forge github|gitlab|forgejo] [--gate <name>] [--branch <name>]
+              [--events-json] [--report-url <url>] [--image <image>]
+              [--before-script <line>]... [--pr-build]
+              [--pr-build-command <line>] [--chant <command>]
+              [--pass-env <NAME>]... [--secrets <file>] [--key <runner key.pem>]
+              [-o <dir>]
+              [--no-status] [--status-url <url template>]
+                        Run the pull-request pipeline's plan or apply job as
+                        a pipeline Op in a fresh worktree of --commit (default
+                        HEAD) with a clean environment. --base and --pr stand
+                        in for the forge's event values. --pr-build runs
+                        the job's build and lint lines first. Records the run as
+                        pr-plan or pr-apply on chant/lifecycle, signed with
+                        --key or CHANT_RUNNER_KEY, so ci tick from runs counts
+                        it, and copies the report to -o (default .chant/pr). With a forge
+                        token it sets a chant/pr-plan or chant/pr-apply commit
+                        status (pending, then success or failure); --no-status
+                        turns that off, and --status-url links it.
+                        --secrets (or CHANT_CI_SECRETS) names a dotenv or
+                        JSON file only its owner can read whose values the
+                        job gets, and which are shown as *** in the events,
+                        the record, the report and the output.
+                        With --report-url it also adds the run to
+                        <url>/runs/index.json, newest first, cut to the
+                        newest --run-index-limit entries (default 200).
+  ci runs --report-url <url> [--json]
+                        List the runs in the index at the report URL, newest
+                        first.
+  ci serve --forge forgejo|github --repo <owner/repo> --env <env>
+              [--interval <s>] [--max-jobs <n>] [--state <dir>]
+              [--author <login>]... [--once] [--rerun-failed] [--unsigned]
+              [ci run's job flags]
+                        Poll the forge for open pull requests and the target
+                        branch's head, and run ci run plan for each new pull
+                        request head and ci run apply for each new commit on
+                        the branch. Dedupes on job and commit in a state file
+                        under --state, takes a lease per apply group, keeps
+                        each apply's resume record there, and runs at most
+                        --max-jobs (default 1) jobs at once. --once runs one
+                        poll and waits for its jobs. --rerun-failed runs a
+                        failed apply or plan again. Refuses to start when its
+                        runner key is not listed in .chant/trust.json at the
+                        target's head, unless --unsigned
+  ci serve|run --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>]
+                        Make the host's runner key (Ed25519, mode 0600) in the
+                        state directory when there is none and print its public
+                        key. --trust commits its runner entry on a branch of its
+                        own and pushes it for review; the target branch is never
+                        written
   ci workflow [--workflow <name>]... [--output <file>]  Write
               [--chant <command>] [--install <command>]
               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
@@ -674,6 +724,13 @@ Workspace (level 1, #2524):
                         threshold of the old one. A commit an agent run made
                         is attested by the run's signed statement; with
                         attested-runs, only those commits must be
+  workspace trust runner add <principal> --key <ssh-ed25519 line or file> [--class runner|service] [--by <principal>] [--expect <digest>] [--dry-run]
+  workspace trust runner remove <principal> [--by <principal>] [--expect <digest>] [--dry-run]
+                        List a runner's key under runners in .chant/trust.json,
+                        granting a runner the runner role, or take both away,
+                        editing the file in place. --expect refuses the write
+                        when the file's digest has changed. Prints the
+                        trust-write document and the new digest; never commits
   workspace signers [--json] [rotate [--threshold <n>] | sign --key <file>]
                         Show the signer history at base, or propose the next
                         signer set and sign it with a current signer's key
@@ -1306,6 +1363,11 @@ export const commandRegistry: CommandDef[] = [
   { name: "ci list", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-green-cli")).runCiList(ctx) },
   { name: "ci tick", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-green-cli")).runCiTick(ctx) },
   { name: "ci workflow", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-green-cli")).runCiWorkflow(ctx) },
+  // #4094: one pull-request job as a pipeline Op in a fresh checkout, the chant runner's first slice.
+  { name: "ci run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-run")).runCiRun(ctx) },
+  // #4098: the run index at the report URL.
+  { name: "ci runs", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-run-index")).runCiRuns(ctx) },
+  { name: "ci serve", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-serve")).runCiServe(ctx) },
   // #4026: the release cut from a green commit (ws-104). Imported on first use.
   { name: "release cut", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/release")).runReleaseCut(ctx) },
   // #4027: publish a cut release, to the targets #4047 declares.
@@ -1409,6 +1471,8 @@ export const commandRegistry: CommandDef[] = [
   // #2548 — an agent session's member, write scope and spec, for a session that resumes.
   { name: "workspace agent", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/agent-cli")).runWorkspaceAgent(ctx) },
   { name: "workspace verify", handler: async (ctx) => (await import("../workspace/trust/verify-cli")).runWorkspaceVerify(ctx) },
+  // #3510 — a runner entry of .chant/trust.json, written through chant so a box repo never edits it by hand (ws-074).
+  { name: "workspace trust", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/trust/trust-write")).runWorkspaceTrust(ctx) },
   { name: "workspace signers", handler: async (ctx) => (await import("../workspace/trust/signers-cli")).runWorkspaceSigners(ctx) },
   { name: "workspace evidence", handler: async (ctx) => (await import("../workspace/trust/evidence-cli")).runWorkspaceEvidence(ctx) },