@intentius/chant 0.124.31 → 0.124.33

package/dist/cli/handlers/promote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promote.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/promote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+CH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAukBlD,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2E/E;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsChF;AAsCD,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BhF"}
+{"version":3,"file":"promote.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/promote.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA+CH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAulBlD,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2E/E;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsChF;AAsCD,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6BhF"}

package/dist/cli/handlers/promote.js

@@ -34,6 +34,7 @@ import { renderDriverHuman } from "../../components/driver-output.js";
 import { ndjsonProgressSink } from "../../components/run-progress.js";
 import { openCliRunEvents, refusesBothStreams } from "../run-events.js";
 import { parseDigestPins, planPromotion, planRollback, planReleaseRollback, planRedeploy, withoutBuildSteps, runPromotion, promotionRecord, rollbackRecord, redeployRecord, gateApprover, gateAdmission, } from "../../components/promote.js";
+import { failedRunExitCode } from "../../components/driver.js";
 import { summaryLedgerPrefix, writeGatedRunSummary } from "../../op/gate-summary.js";
 import { approveCommand, describeGateMismatch, gateIsSealed, gitGateLedgerPort } from "../../op/gate.js";
 import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli.js";
@@ -246,7 +247,7 @@ async function deployPlan(ctx, verb, plan, project, actor, record, under) {
     if (under) {
         const { pinReleaseTemplates } = await import("../../components/release-promote.js");
         const { readReleaseTemplate } = await import("../../lifecycle/release-store.js");
-        const pinned = await pinReleaseTemplates(prepared, under.release, under.target, (digest) => readReleaseTemplate(digest));
+        const pinned = await pinReleaseTemplates(prepared, under.release, under.target, (digest, encoding) => readReleaseTemplate(digest, undefined, encoding));
         if ("errors" in pinned) {
             for (const message of pinned.errors)
                 console.error(formatError({ message }));
@@ -453,7 +454,8 @@ async function deployPlan(ctx, verb, plan, project, actor, record, under) {
     }
     if (run.status !== "ok") {
         console.error(formatError({ message: `${verb} failed at "${run.failedComponent ?? "unknown"}"` }));
-        return 1;
+        // A step that refused a plan that moved since it was approved exits 3 (#3997).
+        return failedRunExitCode(run.results);
     }
     return 0;
 }
@@ -524,6 +526,21 @@ async function resolveUnderRelease(ref, env, verb, fix) {
         console.error(formatError(revokedRefusal({ releaseDigest: found.release.releaseDigest, label: found.label }, revocation, await fix(found.release))));
         return 1;
     }
+    // #4168: under verified-releases a release deploys only once `chant release verify` passes for it.
+    const { securityGroupsAt } = await import("../../workspace/security.js");
+    if (securityGroupsAt(process.cwd()).has("verified-releases")) {
+        const { verifyRelease, verificationCode } = await import("../../lifecycle/release-verify.js");
+        const name = found.label ?? found.release.releaseDigest;
+        const v = await verifyRelease({ cwd: process.cwd(), ref: found.release.releaseDigest });
+        const code = "error" in v ? v.error.code : verificationCode(v);
+        if (code) {
+            console.error(formatError({
+                message: `${code}: release ${name} does not verify (${"error" in v ? v.error.message : v.reason}), and the workspace opts into verified-releases, so ${verb} deploys only a verified release`,
+                hint: `Check it with: chant release verify ${name}`,
+            }));
+            return 1;
+        }
+    }
     return { release: found.release, label: found.label, target: target.target };
 }
 /**

package/dist/cli/handlers/release.d.ts

@@ -1,7 +1,7 @@
 /**
  * `chant release` (#4026, ws-104): the release is what graduates.
  *
- *   release cut [<label>] [--yes] [--build <command>] [--param k=v]... [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json]
+ *   release cut [<label>] [--at <sha>] [--yes] [--build <command>] [--param k=v]... [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json]
  *       a dry run of a cut of this member from the checkout's HEAD, which must be
  *       clean, on trunk and pushed, and green (#4027); `--yes` cuts, records,
  *       and tags the commit `release/<label>` locally;
@@ -17,6 +17,9 @@
  *   release verify <label|digest> [--json]
  *       check the release's signature offline against .chant/allowed_signers
  *       at the release's commit (#4049)
+ *   release candidates [--env <env>] [--json]
+ *       the green commits of trunk a release can be cut from, each with what it
+ *       would ship, and what each environment runs (#4168 4.2)
  *   release list [--json]
  *       every release of this member with its targets, its cuts and where it runs;
  *       `--json` prints the read contract's `releases` document
@@ -49,6 +52,11 @@ export declare function sameWithYes(argv: readonly string[]): string;
  * would record, build and tag, and what publishes where. With `--yes` it
  * cuts, signs with `--sign`, records the cut with its actor and run id,
  * tags the commit locally and prints the next command.
+ *
+ * `--at <sha>` (#4168 4.2) cuts that commit instead of `HEAD`, from a
+ * temporary worktree (../../lifecycle/release-at.ts), so the checkout need
+ * not be clean or at the commit. The label reaches every compile and
+ * artifact build as `CHANT_RELEASE_LABEL` (decision 5).
  */
 export declare function runReleaseCut(ctx: CommandContext): Promise<number>;
 /**
@@ -76,6 +84,13 @@ export declare function runReleasePublish(ctx: CommandContext): Promise<number>;
  * verifies and 1 when it does not or can't be checked.
  */
 export declare function runReleaseVerify(ctx: CommandContext): Promise<number>;
+/**
+ * `release candidates [--env <env>] [--json]` (#4168 4.2): the green commits
+ * of trunk a release can be cut from, newest first, each with what it would
+ * ship since the previous one, and what each environment runs. `--json`
+ * prints the read contract's `release-candidates` document.
+ */
+export declare function runReleaseCandidates(ctx: CommandContext): Promise<number>;
 export declare function runReleaseList(ctx: CommandContext): Promise<number>;
 /**
  * `release export <label|digest> --env <env> [-o <dir>]` (#4046): write each

package/dist/cli/handlers/release.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAmBlD,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,EAAE,CASX;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAG3D;AAiBD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyMxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2G5E;AAQD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC3E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyC3E;AAED,gHAAgH;AAChH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB5E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E"}
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAyBlD,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,GAAG,EAAE;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uFAAuF;IACvF,YAAY,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,EAAE,CASX;AAED,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAG3D;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwNxE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2G5E;AAQD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkC3E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC/E;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzE;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyC3E;AAED,gHAAgH;AAChH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsB5E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5E"}

package/dist/cli/handlers/release.js

@@ -1,7 +1,7 @@
 /**
  * `chant release` (#4026, ws-104): the release is what graduates.
  *
- *   release cut [<label>] [--yes] [--build <command>] [--param k=v]... [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json]
+ *   release cut [<label>] [--at <sha>] [--yes] [--build <command>] [--param k=v]... [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json]
  *       a dry run of a cut of this member from the checkout's HEAD, which must be
  *       clean, on trunk and pushed, and green (#4027); `--yes` cuts, records,
  *       and tags the commit `release/<label>` locally;
@@ -17,6 +17,9 @@
  *   release verify <label|digest> [--json]
  *       check the release's signature offline against .chant/allowed_signers
  *       at the release's commit (#4049)
+ *   release candidates [--env <env>] [--json]
+ *       the green commits of trunk a release can be cut from, each with what it
+ *       would ship, and what each environment runs (#4168 4.2)
  *   release list [--json]
  *       every release of this member with its targets, its cuts and where it runs;
  *       `--json` prints the read contract's `releases` document
@@ -35,12 +38,13 @@ import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { formatBold, formatError, formatSuccess, formatWarning } from "../format.js";
 import { parseParamFlags } from "../build-params-cli.js";
-const USAGE = "chant release cut [<label>] [--yes] [--build <command>] [--param <k=v>] [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json] | release publish <label|digest> [--yes] [--allow-unsigned] [--require-provenance] [--json] | release verify <label|digest> [--json] | release list [--json] | release export <label|digest> --env <env> [-o <dir>] [--json]";
+const USAGE = "chant release cut [<label>] [--at <sha>] [--yes] [--build <command>] [--param <k=v>] [--params-file <file>] [--src <dir>] [-o <file>] [--lexicon <name>] [--actor <name>] [--sign [<key file>]] [--json] | release publish <label|digest> [--yes] [--allow-unsigned] [--require-provenance] [--json] | release verify <label|digest> [--json] | release candidates [--env <env>] [--json] | release list [--json] | release export <label|digest> --env <env> [-o <dir>] [--json]";
 /** The build inputs `release cut` and `release compile` share. */
-function compileInputs(ctx, params) {
+function compileInputs(ctx, params, projectDir = resolve("."), releaseLabel) {
     const { args } = ctx;
     return {
-        projectDir: resolve("."),
+        projectDir,
+        ...(releaseLabel ? { releaseLabel } : {}),
         ...(args.buildCommand ? { buildCommand: args.buildCommand } : {}),
         ...(params ? { params } : {}),
         ...(args.paramsFile ? { paramsFile: args.paramsFile } : {}),
@@ -87,6 +91,11 @@ function describeActorSource(source) {
  * would record, build and tag, and what publishes where. With `--yes` it
  * cuts, signs with `--sign`, records the cut with its actor and run id,
  * tags the commit locally and prints the next command.
+ *
+ * `--at <sha>` (#4168 4.2) cuts that commit instead of `HEAD`, from a
+ * temporary worktree (../../lifecycle/release-at.ts), so the checkout need
+ * not be clean or at the commit. The label reaches every compile and
+ * artifact build as `CHANT_RELEASE_LABEL` (decision 5).
  */
 export async function runReleaseCut(ctx) {
     const { args } = ctx;
@@ -109,6 +118,8 @@ export async function runReleaseCut(ctx) {
         console.error(formatError({ message: `${message} [${code}]`, ...(fix ? { hint: fix } : {}) }));
         return 1;
     };
+    const at = await import("../../lifecycle/release-at.js");
+    let checkout = null;
     try {
         // The workstation checks come first, in the order #4027 lists them; the
         // green check and the rest are the cut's own.
@@ -124,9 +135,17 @@ export async function runReleaseCut(ctx) {
         let trunk = null;
         let signers = [];
         let member = null;
+        if (args.at !== undefined && !top) {
+            return fail("not-a-git-repository", "--at names a commit, and this directory is not in a git repository");
+        }
         if (top) {
-            commit = await getHeadCommit({ cwd });
-            ws.checkCleanTree(top, commit);
+            if (args.at !== undefined) {
+                commit = at.resolveCutCommit(top, args.at);
+            }
+            else {
+                commit = await getHeadCommit({ cwd });
+                ws.checkCleanTree(top, commit);
+            }
             const { scopeSource } = await import("../../workspace/write-scope.js");
             const { releaseRuleFrom } = await import("../../workspace/identity.js");
             const source = scopeSource(cwd);
@@ -167,8 +186,12 @@ export async function runReleaseCut(ctx) {
         const tag = label !== null && commit !== null && top ? { name: ws.releaseTagName(member, label), state: ws.checkReleaseTag(top, ws.releaseTagName(member, label), commit) } : null;
         const ci = resolveCiRun(process.env);
         const params = parseParamFlags(args.param);
-        const compiler = spawnTargetCompiler(compileInputs(ctx, params));
-        const request = { cwd, compiler, label, actor, ...(args.sign !== undefined ? { sign: args.sign } : {}) };
+        // --at: the cut reads, compiles and builds the commit's tree, not the checkout's.
+        if (args.at !== undefined && top && commit)
+            checkout = at.checkoutCommit(top, cwd, commit);
+        const cutCwd = checkout?.memberDir ?? cwd;
+        const compiler = spawnTargetCompiler(compileInputs(ctx, params, cutCwd, label));
+        const request = { cwd: cutCwd, compiler, label, actor, ...(args.sign !== undefined ? { sign: args.sign } : {}) };
         if (dryRun) {
             const plan = await planRelease(request);
             // Under the release gate, a key the signers file at base lists for someone else is refused now, not after the build.
@@ -178,7 +201,7 @@ export async function runReleaseCut(ctx) {
             const ref = plan.label ?? plan.alreadyCut ?? plan.releaseDigest;
             const provenance = detectProvenance();
             // The targets release publish would run, as the config here declares them; their files are read at publish.
-            const publishTargets = await releasePublishTargets(cwd).then((ts) => ts.map((t) => `${t.name} to ${t.destination}`), (err) => (err instanceof Error ? err : new Error(String(err))));
+            const publishTargets = await releasePublishTargets(cutCwd).then((ts) => ts.map((t) => `${t.name} to ${t.destination}`), (err) => (err instanceof Error ? err : new Error(String(err))));
             const deployRef = plan.label ?? "<label|digest>";
             const doc = {
                 dryRun: true,
@@ -187,6 +210,7 @@ export async function runReleaseCut(ctx) {
                 actorSource: who.source,
                 run: ci ? { runId: ci.runId, runOrigin: ci.runOrigin } : { runId: null, runOrigin: { forge: "local" } },
                 trunk,
+                at: args.at !== undefined ? { ref: args.at, commit } : null,
                 sign: args.sign !== undefined ? { key: publicKey !== null ? publicKey.split(" ")[0] : null, readable: publicKey !== null } : null,
                 tag: tag ? { name: tag.name, exists: tag.state === "present" } : null,
                 publish: { targets: Array.isArray(publishTargets) ? publishTargets : [], provenance },
@@ -286,7 +310,7 @@ export async function runReleaseCut(ctx) {
         return 0;
     }
     catch (err) {
-        if (err instanceof ws.WorkstationCheckError || err instanceof ReleaseCutError) {
+        if (err instanceof ws.WorkstationCheckError || err instanceof ReleaseCutError || err instanceof at.CutAtError) {
             return fail(err.code, err.message, err.fix);
         }
         if (err instanceof ReleaseLabelError)
@@ -297,6 +321,9 @@ export async function runReleaseCut(ctx) {
         }
         throw err;
     }
+    finally {
+        checkout?.remove();
+    }
 }
 /**
  * `release publish <label|digest> [--yes]` (#4027, #4047): publish a cut
@@ -478,6 +505,51 @@ export async function runReleaseVerify(ctx) {
     console.error(formatSuccess(`Verified ${name}: ${result.reason}`));
     return 0;
 }
+/**
+ * `release candidates [--env <env>] [--json]` (#4168 4.2): the green commits
+ * of trunk a release can be cut from, newest first, each with what it would
+ * ship since the previous one, and what each environment runs. `--json`
+ * prints the read contract's `release-candidates` document.
+ */
+export async function runReleaseCandidates(ctx) {
+    const { releaseCandidatesDocument } = await import("../../workspace/release-candidates.js");
+    const doc = await releaseCandidatesDocument({ cwd: resolve("."), ...(ctx.args.env ? { env: ctx.args.env } : {}) });
+    if (ctx.args.json) {
+        console.log(JSON.stringify(doc, null, 2));
+        return "error" in doc ? 1 : 0;
+    }
+    if ("error" in doc) {
+        console.error(formatError({ message: `${doc.error.message} [${doc.error.code}]`, hint: USAGE }));
+        return 1;
+    }
+    for (const e of doc.environments) {
+        const runs = e.running.map((r) => `${r.label ?? r.releaseDigest.slice(0, 19)}${r.commit ? ` at ${r.commit.slice(0, 12)}` : ""}`).join(", ");
+        console.log(`${e.env}: ${runs || "runs no release yet"}`);
+    }
+    if (!doc.tip) {
+        console.error(`No candidates: this clone knows no ${doc.branch}. Fetch it: git fetch origin ${doc.branch} --tags`);
+        return 0;
+    }
+    if (doc.pending.length > 0)
+        console.log(`${doc.pending.length} commit(s) on ${doc.branch} after the newest candidate are not green yet`);
+    if (doc.candidates.length === 0)
+        console.log(`No green commit on ${doc.branch}${doc.since ? ` since ${doc.since.slice(0, 12)}` : ""} to cut from.`);
+    for (const c of doc.candidates) {
+        const tags = [...(c.newFor.length > 0 ? [`new for ${c.newFor.join(", ")}`] : []), ...(c.cut.length > 0 ? [`cut as ${c.cut.join(", ")}`] : [])];
+        console.log(`${c.commit.slice(0, 12)}  ${c.subject}${tags.length > 0 ? `  (${tags.join("; ")})` : ""}`);
+        for (const ch of c.changes) {
+            const links = [...(ch.pr !== null ? [`#${ch.pr}`] : []), ...ch.work.map((w) => `work:${w}`)];
+            console.log(`    ${ch.commit.slice(0, 12)}  ${ch.subject}${links.length > 0 ? `  [${links.join(", ")}]` : ""}`);
+        }
+        for (const f of c.flags)
+            console.log(`    flag ${f.id} (${f.member} ${f.param}) changed`);
+    }
+    for (const sk of doc.skipped)
+        console.log(`skipped ${sk.commit.slice(0, 12)}  ${sk.subject}  (revoked)`);
+    if (doc.candidates.length > 0)
+        console.error(`Cut one: chant release cut <label> --at <sha>`);
+    return 0;
+}
 export async function runReleaseList(ctx) {
     const { releasesDocument } = await import("../../workspace/releases.js");
     const doc = await releasesDocument({ cwd: resolve(".") });
@@ -539,7 +611,7 @@ export async function runReleaseExport(ctx) {
         console.error(formatError({ message: target.error }));
         return 1;
     }
-    const read = await targetFiles(found.release, target.target, (digest) => readReleaseTemplate(digest));
+    const read = await targetFiles(found.release, target.target, (digest, encoding) => readReleaseTemplate(digest, undefined, encoding));
     if ("errors" in read) {
         for (const e of read.errors)
             console.error(formatError({ message: e }));

package/dist/cli/handlers/run.d.ts

@@ -1,8 +1,9 @@
 import { type OpConfig } from "../../op/types.js";
 import { type StepRecord } from "../../op/local-executor.js";
+import type { OpRunRecord } from "../../op/runtime.js";
 import type { CommandContext } from "../registry.js";
 import type { RunEvent } from "../../run-event.js";
-import type { DriverComponentResult } from "../../components/driver.js";
+import { type DriverComponentResult } from "../../components/driver.js";
 import { type ReleaseRecord, type RunOrigin } from "../../lifecycle/release-ledger.js";
 /**
  * The exit code a run that stopped at an unapproved gate uses (#2119).
@@ -170,4 +171,15 @@ export declare function resolveRunRelease(ref: string, env: string, cwd: string)
  */
 export declare function runOpOnRuntime(ctx: CommandContext): Promise<number>;
 export declare function runOpUnknown(ctx: CommandContext): Promise<number>;
+/**
+ * What signs the run's record (#4044): the runner key `--key` names, or the
+ * PEM in `CHANT_RUNNER_KEY`, checked against `.chant/trust.json` at `HEAD`.
+ * Undefined when neither is given. Null, after printing why, when `--key`
+ * is not a runner key, or either is not an Ed25519 PEM. A `CHANT_RUNNER_KEY`
+ * that trust.json does not list leaves the run unsigned (#4156): quietly,
+ * with a line under `--verbose`, unless `ci.green.signedSince` asks for
+ * signed runs, which warns. The variable may be set for `ci tick` in a job
+ * that also runs Ops.
+ */
+export declare function runSignerFor(ctx: CommandContext): Promise<((record: OpRunRecord) => NonNullable<OpRunRecord["statement"]>) | undefined | null>;
 //# sourceMappingURL=run.d.ts.map

package/dist/cli/handlers/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAMA,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAU1G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAWlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAgB,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAIlG;;;;;GAKG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AA+BjC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GAAG,OAAO,CAMjF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChC,eAAe,EAAE,OAAO,GAAG,SAAS,EACpC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GACzC,MAAM,CAQR;AAuLD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAuED,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAetE;AA8BD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAenE;AA2CD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAWrD;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+CtE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvE;AAID,iGAAiG;AACjG,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAsMD,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BhE;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAEvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,qBAAqB,EAAE,EAChC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,EACjB,SAAS,GAAE,SAA8B,EACzC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA+C1B;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAuCD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;GAe5E;AA8MD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AAyPD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAMA,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAI1G,OAAO,KAAK,EAAqB,WAAW,EAAe,MAAM,kBAAkB,CAAC;AAMpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAWlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAgB,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAIlG;;;;;GAKG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AA+BjC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GAAG,OAAO,CAMjF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChC,eAAe,EAAE,OAAO,GAAG,SAAS,EACpC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GACzC,MAAM,CAQR;AAuLD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAuED,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAetE;AA8BD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAenE;AA2CD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAWrD;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+CtE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvE;AAID,iGAAiG;AACjG,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAsMD,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BhE;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAEvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,qBAAqB,EAAE,EAChC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,EACjB,SAAS,GAAE,SAA8B,EACzC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA+C1B;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAuCD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;GAe5E;AAiND;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AA0PD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE;AAKD;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,CAkCpJ"}

package/dist/cli/handlers/run.js

@@ -27,6 +27,7 @@ import { findStoredRun, readRunEvents } from "../../run-event-store.js";
 import { openCliRunEvents, refusesBothStreams, stdoutLine } from "../run-events.js";
 import { maybeRecordAutoRelease } from "../../components/auto-release.js";
 import { maybePersistBuildManifest } from "../../components/manifest-persistence.js";
+import { failedRunExitCode } from "../../components/driver.js";
 import { isComponentList } from "../../components/cli-support.js";
 import { resolveCiRun } from "../../lifecycle/release-ledger.js";
 import { gateAdmission, gateApprover } from "../../components/promote.js";
@@ -639,9 +640,9 @@ function refusesPolicyGateUnderSandbox(ctx, config, opName) {
  * `chant run <op>` for an Op a declared steward lists is one of that
  * steward's turns, not a run beside it (#2750, follow-up to #2731).
  *
- * On fountain, the run belongs on the steward's thread: without `--on
+ * On fountain, the run belongs in the steward's conversation: without `--on
  * fountain` this refuses outright, naming the command that posts it there
- * instead (the fountain runtime's own turn already refuses a busy teammate,
+ * instead (the fountain runtime's own turn already refuses a busy steward,
  * unretried — see chant-fountain-ops).
  *
  * In the local form, the run takes the steward's turn lease
@@ -679,15 +680,15 @@ async function stewardTurnGate(opName, ctx) {
     const env = ctx.args.env ?? DEFAULT_STEWARD_ENV;
     const form = stewardFormFor(owner, env);
     if (form === "fountain") {
-        // `run.on: "fountain"` asks for the steward's thread as much as the flag
+        // `run.on: "fountain"` asks for the steward's conversation as much as the flag
         // does (#2523).
         if ((await chooseOpRuntime(ctx, true))?.on === "fountain")
             return { ok: true };
         return {
             ok: false,
             message: `Op "${opName}" is one of steward "${owner.name}"'s Ops, which runs on fountain in environment "${env}"`,
-            hint: `Run \`chant run ${opName} --on fountain\` so it posts to "${owner.name}"'s thread. ` +
-                `A plain \`chant run ${opName}\` would run it outside that thread, beside the steward instead of one of its turns.`,
+            hint: `Run \`chant run ${opName} --on fountain\` so it posts to "${owner.name}"'s conversation. ` +
+                `A plain \`chant run ${opName}\` would run it outside that conversation, beside the steward instead of one of its turns.`,
         };
     }
     if (stewardBesideFor(owner, opName))
@@ -1171,7 +1172,11 @@ async function runComponentSelection(ctx) {
             writeFileSync(digestPath, recorded.map((r) => `${r.component}=${r.digest}\n`).join(""));
         }
     }
-    return result.success ? 0 : 1;
+    // A step that refused a plan that moved since it was approved exits 3
+    // (#3997). `--gated-exit` doesn't remap it: the run failed.
+    if (result.success)
+        return 0;
+    return result.run ? failedRunExitCode(result.run.results) : 1;
 }
 /**
  * `chant run <name>` on the resolved runtime (#2121) — the built-in `local`
@@ -1239,9 +1244,10 @@ async function runOpOnResolvedRuntime(ctx) {
         await stewardGate?.release?.();
         return 1;
     }
-    // #4044: a runner key signs the run's record as it settles, so `ci tick`
-    // can count the run. `--key` must be a runner key; the PEM in
-    // CHANT_RUNNER_KEY that is not one leaves the run unsigned, with a warning.
+    // #4044: a runner key signs the run's record as it settles, so a reader
+    // can see who ran it. `--key` must be a runner key; the PEM in
+    // CHANT_RUNNER_KEY that trust.json does not list leaves the run unsigned,
+    // with a warning only when ci.green.signedSince asks for signed runs (#4156).
     const signRecord = await runSignerFor(ctx);
     if (signRecord === null) {
         await stewardGate?.release?.();
@@ -1441,10 +1447,13 @@ const RUNNER_KEY_ENV = "CHANT_RUNNER_KEY";
  * What signs the run's record (#4044): the runner key `--key` names, or the
  * PEM in `CHANT_RUNNER_KEY`, checked against `.chant/trust.json` at `HEAD`.
  * Undefined when neither is given. Null, after printing why, when `--key`
- * is not a runner key; an unusable `CHANT_RUNNER_KEY` only warns, since the
- * variable may be set for `ci tick` in a job that also runs Ops.
+ * is not a runner key, or either is not an Ed25519 PEM. A `CHANT_RUNNER_KEY`
+ * that trust.json does not list leaves the run unsigned (#4156): quietly,
+ * with a line under `--verbose`, unless `ci.green.signedSince` asks for
+ * signed runs, which warns. The variable may be set for `ci tick` in a job
+ * that also runs Ops.
  */
-async function runSignerFor(ctx) {
+export async function runSignerFor(ctx) {
     const fromFlag = ctx.args.key !== undefined;
     let pem;
     try {
@@ -1456,9 +1465,18 @@ async function runSignerFor(ctx) {
     }
     if (pem === undefined)
         return undefined;
+    // Loaded only when a key is given, so a run without one loads no workspace code (level 0, #2525).
+    const { opRunSigner, signedRunsRequired } = await import("../../workspace/ci-green.js");
+    const { loadRunnerKey } = await import("../../workspace/trust/dsse.js");
+    try {
+        loadRunnerKey(pem);
+    }
+    catch (err) {
+        // A key that is there and is not one is an error either way: the caller asked to sign (#4156).
+        console.error(formatError({ message: `${fromFlag ? `--key ${ctx.args.key}` : RUNNER_KEY_ENV} is not an Ed25519 private key in PEM: ${err instanceof Error ? err.message : String(err)}` }));
+        return null;
+    }
     try {
-        // Loaded only when a key is given, so a run without one loads no workspace code (level 0, #2525).
-        const { opRunSigner } = await import("../../workspace/ci-green.js");
         return opRunSigner(process.cwd(), pem);
     }
     catch (err) {
@@ -1467,7 +1485,12 @@ async function runSignerFor(ctx) {
             console.error(formatError({ message: `the run would not be signed: ${message}` }));
             return null;
         }
-        console.error(formatWarning({ message: `${RUNNER_KEY_ENV} is set, and the run will not be signed: ${message}` }));
+        // #4156: signing is opt-in, so a key trust.json does not list warns only when ci.green.signedSince asks for signed runs.
+        const required = signedRunsRequired(process.cwd());
+        if (required)
+            console.error(formatWarning({ message: `${RUNNER_KEY_ENV} is set, and the run will not be signed, so ci.green.signedSince (${required}) will not count it: ${message}` }));
+        else if (ctx.args.verbose)
+            console.error(`${RUNNER_KEY_ENV} is set, and the run is not signed: ${message}`);
         return undefined;
     }
 }

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AA6uCzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EAsMvC,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAuzCzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EA4MvC,CAAC"}