@intentius/chant 0.124.32 → 0.124.33

package/src/workspace/declaration.ts

@@ -23,6 +23,7 @@ import { expandGlob } from "./glob";
 import { EXAMPLES_KIND, holdsChantProject } from "./kinds";
 import { parseJsonText, pointerToken, type TextLocation } from "./jsonc";
 import type { ReasonCode } from "./reason-codes";
+import type { SecurityGroup } from "./security";
 import { joinPath, type WorkspaceTree } from "./tree";
 import { loadAjv2020 } from "./ajv2020";
 import { readChantPackageVersion } from "../package-version";
@@ -184,6 +185,13 @@ export interface AgentDeclaration {
 /** What a check run that finished as skipped counts as in a CI phase (#3573). */
 export type CiSkipped = "pass" | "fail";
 
+/**
+ * Which commits a phase runs on (#4169): `every` first-parent commit of the
+ * branch, or only the `newest` one when a runner frees, the commits between
+ * left unbuilt and a red one bisected.
+ */
+export type CiBuild = "every" | "newest";
+
 /** One phase of `ci.green`: the check runs that make it up (#3573, ws-103). */
 export interface CiPhase {
   name: string;
@@ -191,6 +199,12 @@ export interface CiPhase {
   runs: string[];
   /** `fail` (the default): a skipped run never passes. `pass`: it passes, for a job a path filter runs only on some commits. */
   skipped: CiSkipped;
+  /**
+   * Which commits the phase runs on (#4169), when the declaration says.
+   * Absent means `every`, and `ci workflow` then leaves the phase's
+   * workflows as they are.
+   */
+  build?: CiBuild;
   pointer: string;
 }
 
@@ -557,6 +571,8 @@ export interface Member {
   because: string | null;
   /** Whether `chant workspace export` takes the member (#2552, D10). False when the entry does not say. */
   travel: boolean;
+  /** The security groups this member adds to the declaration's top-level `security` (#4168 step 7), in file order; empty when it names none. */
+  security: SecurityGroup[];
   suppress: Suppression[];
   /** The entry's JSON Pointer in the file, for messages. */
   pointer: string;
@@ -624,6 +640,8 @@ export interface Declaration {
    * then uses 7.
    */
   metrics: { failureWindowDays?: number } | null;
+  /** The security groups the workspace opts into (#4168 section 8, ./security.ts), in file order; empty when the declaration has no `security` key. */
+  security: SecurityGroup[];
   /** The file, relative to the workspace root's tree (`chant.workspace.json` or `.jsonc`). */
   file: string;
 }
@@ -850,6 +868,7 @@ export function parseDeclaration(text: string, file: string, reader: string = re
       upstream: (e.upstream as string | undefined) ?? null,
       because: (e.because as string | undefined) ?? null,
       travel: e.travel === true,
+      security: [...((e.security as SecurityGroup[] | undefined) ?? [])],
       suppress,
       pointer,
     };
@@ -1002,6 +1021,7 @@ export function parseDeclaration(text: string, file: string, reader: string = re
     ci,
     retention: retentionOf(obj.retention),
     metrics: metricsOf(obj.metrics),
+    security: [...((obj.security as SecurityGroup[] | undefined) ?? [])],
     file,
   };
   written.set(declaration, raw);
@@ -1096,7 +1116,7 @@ function retentionOf(raw: unknown): RetentionOverride | null {
 
 function ciOf(raw: unknown, at: (pointer: string, key?: boolean) => ErrorLocation): CiDeclaration | null {
   if (raw === undefined) return null;
-  const block = raw as { reportUrl?: string; green?: { branch: string; window?: string; phases: Record<string, string[] | { runs: string[]; skipped?: CiSkipped }>; require: string[]; signedSince?: string; source?: CiSource } };
+  const block = raw as { reportUrl?: string; green?: { branch: string; window?: string; phases: Record<string, string[] | { runs: string[]; skipped?: CiSkipped; build?: CiBuild }>; require: string[]; signedSince?: string; source?: CiSource } };
   let reportUrl: string | null = null;
   if (block.reportUrl !== undefined) {
     // #4160: refused here as pr-plan and ci run refuse the flag, so a reader never gets a URL no job can write to.
@@ -1110,6 +1130,7 @@ function ciOf(raw: unknown, at: (pointer: string, key?: boolean) => ErrorLocatio
     name,
     runs: [...(Array.isArray(p) ? p : p.runs)],
     skipped: Array.isArray(p) ? "fail" : (p.skipped ?? "fail"),
+    ...(!Array.isArray(p) && p.build !== undefined ? { build: p.build } : {}),
     pointer: `/ci/green/phases/${pointerToken(name)}`,
   }));
   for (const [i, name] of g.require.entries()) {

package/src/workspace/ls.schema.json

@@ -21,7 +21,8 @@
             "properties": {
               "name": { "type": "string" },
               "runs": { "type": "array", "items": { "type": "string" }, "description": "Check-run name patterns, * standing for any run of characters." },
-              "skipped": { "enum": ["pass", "fail"], "description": "What a run that finished as skipped counts as." }
+              "skipped": { "enum": ["pass", "fail"], "description": "What a run that finished as skipped counts as." },
+              "build": { "enum": ["every", "newest"], "description": "Added in contract 1 by #4169, written by chant 0.124.33 and newer, and only when the declaration sets it: whether the phase runs on every first-parent commit or only the newest one when a runner frees. Absent means every." }
             }
           }
         },

package/src/workspace/ls.ts

@@ -142,7 +142,8 @@ export interface LsDiagram {
 export interface LsCiGreen {
   branch: string;
   window: string;
-  phases: { name: string; runs: string[]; skipped: "pass" | "fail" }[];
+  /** `build` is present only when the declaration sets it (#4169). */
+  phases: { name: string; runs: string[]; skipped: "pass" | "fail"; build?: "every" | "newest" }[];
   require: string[];
   /** The first commit whose ci tags need a signed statement (#4031). Present only when the declaration sets it. */
   signedSince?: string;
@@ -328,7 +329,7 @@ function readListing(query: LsQuery): { doc: LsDocument; declaration?: Declarati
               ? {
                   branch: declaration.ci.green.branch,
                   window: declaration.ci.green.window,
-                  phases: declaration.ci.green.phases.map((p) => ({ name: p.name, runs: p.runs, skipped: p.skipped })),
+                  phases: declaration.ci.green.phases.map((p) => ({ name: p.name, runs: p.runs, skipped: p.skipped, ...(p.build ? { build: p.build } : {}) })),
                   require: declaration.ci.green.require,
                   ...(declaration.ci.green.signedSince !== null ? { signedSince: declaration.ci.green.signedSince } : {}),
                   ...(declaration.ci.green.source === "runs" ? { source: "runs" as const } : {}),

package/src/workspace/member-pipeline.ts

@@ -212,7 +212,7 @@ export interface ComponentPlanInput {
   params?: string[];
   paramsFile?: string;
   /** `--pr-loop`, with its `--gate` and `--branch` (#3465). */
-  prLoop?: { gate?: string; branch?: string };
+  prLoop?: { gate?: string; branch?: string; applyOnMerge?: boolean };
   /** `--wave-gate` with its `--canary` and `--base` (#3049). */
   waveGate?: { gate: string; canary?: string[]; base?: string };
   /** `--image` (#4002). */
@@ -258,6 +258,7 @@ export function planMemberComponentPipeline(input: ComponentPlanInput): MemberCo
     parts.push("--pr-loop");
     if (input.prLoop.gate) parts.push("--gate", input.prLoop.gate);
     if (input.prLoop.branch) parts.push("--branch", input.prLoop.branch);
+    if (input.prLoop.applyOnMerge) parts.push("--apply-on-merge");
   }
   if (input.image) parts.push("--image", input.image);
   for (const line of input.beforeScript ?? []) parts.push("--before-script", line);

package/src/workspace/merge-record.schema.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/workspace/merge-record/v1/merge-record.schema.json",
+  "title": "chant merge record",
+  "description": "What landed on the target branch, keyed by commit: _merges/<commit>.json on chant/lifecycle (#4168, chant 0.124.33 and newer). The record job writes it on merge. It applies nothing; a release that carries the commit deploys it.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "contract", "commit", "base", "env", "source", "op", "gate", "digest", "plan", "approvedBy", "components", "recordedAt"],
+  "properties": {
+    "$schema": { "const": "https://intentius.io/chant/schemas/workspace/merge-record/v1/merge-record.schema.json" },
+    "contract": { "const": 1 },
+    "commit": { "type": "string", "pattern": "^[0-9a-f]{40,64}$", "description": "The merged commit." },
+    "base": { "type": "string", "pattern": "^[0-9a-f]{40,64}$", "description": "The commit the change is measured from." },
+    "env": { "type": "string", "minLength": 1 },
+    "member": { "type": "string", "minLength": 1, "description": "The workspace member whose pipeline wrote it." },
+    "source": {
+      "description": "Where the change came from: the pull request that merged it, else the work items its Chant-Record: work:<id> trailers name, else a direct push.",
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["kind", "pr"], "properties": { "kind": { "const": "pull-request" }, "pr": { "type": "integer", "minimum": 1 } } },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "records"],
+          "properties": {
+            "kind": { "const": "work-item" },
+            "records": {
+              "type": "array",
+              "minItems": 1,
+              "items": { "type": "object", "additionalProperties": false, "required": ["kind", "id"], "properties": { "kind": { "const": "work" }, "id": { "type": "string", "minLength": 1 } } }
+            }
+          }
+        },
+        { "type": "object", "additionalProperties": false, "required": ["kind"], "properties": { "kind": { "const": "direct-push" } } }
+      ]
+    },
+    "op": { "type": ["string", "null"], "description": "The pull request's gate op, pr-<n> or pr-<n>-<member>; null without a pull request." },
+    "gate": { "type": "string", "minLength": 1 },
+    "digest": { "type": ["string", "null"], "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$", "description": "The change-set digest planned on the merged commit; null when nothing was planned. The change set is stored under _change-sets/." },
+    "plan": {
+      "enum": ["approved", "changed", "unapproved", "nothing", "plan-failed"],
+      "description": "approved: an approval stands for digest. changed: one stands for approvedDigest, so the plan moved after review; the record job's chant/record status fails. unapproved: none stands. nothing: no component deploys what the change touches. plan-failed: a member failed to plan."
+    },
+    "approvedDigest": { "type": "string", "pattern": "^(?:jcs1-)?sha256:[0-9a-f]{64}$" },
+    "approvedBy": { "type": "array", "items": { "type": "string" } },
+    "authorApproved": { "type": "array", "items": { "type": "string" }, "description": "Approvers who wrote the change (#4000), read with a forge." },
+    "components": { "type": "array", "items": { "type": "string" } },
+    "recordedAt": { "type": "string", "minLength": 1, "description": "ISO 8601." }
+  }
+}

package/src/workspace/pr-report.schema.json

@@ -8,7 +8,7 @@
   "properties": {
     "$schema": { "const": "https://intentius.io/chant/schemas/workspace/pr-report/v1/pr-report.schema.json" },
     "contract": { "const": 1 },
-    "stage": { "enum": ["plan", "apply"] },
+    "stage": { "enum": ["plan", "apply", "record"], "description": "plan: on the pull request. record (#4168, chant 0.124.33 and newer): on merge, the default; it plans the merged commit and writes the merge record, applying nothing. apply: on merge with --apply-on-merge." },
     "pr": {
       "type": ["integer", "null"],
       "minimum": 1,
@@ -33,8 +33,8 @@
       "description": "The change-set digest of what this stage planned: computePlanDigest(\"change-set\", ...) over every member's { member, planDigest }. What the gate binds."
     },
     "status": {
-      "enum": ["planned", "plan-failed", "nothing", "applied", "failed", "wave-applied", "refused", "waiting"],
-      "description": "planned: every member planned (plan stage). plan-failed: a member failed to plan, so nothing can apply. nothing: no component deploys what the change touches. applied: every member applied. failed: a member failed to apply and its dependents did not run. wave-applied (#4003, chant 0.124.32 and newer): with --wave-gate and --wave, the wave applied and a later wave is still to run. refused: nothing applied, see refusal. waiting (#3999): the approved plans applied except members held back after an upstream applied, which wait on an approval of the plan the last of rounds made."
+      "enum": ["planned", "recorded", "plan-failed", "nothing", "applied", "failed", "wave-applied", "refused", "waiting"],
+      "description": "planned: every member planned (plan stage). recorded (#4168, chant 0.124.33 and newer): every member planned on the merged commit and the merge record was written (record stage); approval says whether the plan is the approved one, and nothing applied. plan-failed: a member failed to plan, so nothing can apply. nothing: no component deploys what the change touches. applied: every member applied. failed: a member failed to apply and its dependents did not run. wave-applied (#4003, chant 0.124.32 and newer): with --wave-gate and --wave, the wave applied and a later wave is still to run. refused: nothing applied, see refusal. waiting (#3999): the approved plans applied except members held back after an upstream applied, which wait on an approval of the plan the last of rounds made."
     },
     "refusal": {
       "enum": ["not-approved", "plan-changed", "not-a-reviewer", "author-approved", "no-pull-request", "wave-not-approved", "wave-plan-changed", "earlier-wave"],

package/src/workspace/reason-codes.test.ts

@@ -28,6 +28,7 @@ import { STATUS_ERROR_CODES, STATUS_GATE_REASON_CODES, STATUS_REASON_CODES, STAT
 import { WORK_WARNING_CODES } from "./work";
 import { BOX_FINDING_CODES } from "./checks/boxes";
 import { DIAGRAM_FINDING_CODES } from "./checks/diagrams";
+import { SECURITY_FINDING_CODES } from "./checks/security";
 import { WORK_ERROR_CODES, WORK_HISTORY_ERROR_CODES, WORK_LEASE_REFUSALS } from "./work-cli";
 import { RUN_STATEMENT_ERROR_CODES, RUNS_ERROR_CODES, RUNS_REASON_CODES, RUNS_WRITE_ERROR_CODES } from "./runs-cli";
 import { RUN_STATEMENT_FAILURE_CODES } from "./trust/run-statement";
@@ -66,6 +67,7 @@ const PER_COMMAND: Record<string, readonly string[]> = {
   CHECK_ERROR_CODES,
   BOX_FINDING_CODES,
   DIAGRAM_FINDING_CODES,
+  SECURITY_FINDING_CODES,
   STATUS_REASON_CODES,
   STATUS_ERROR_CODES,
   STATUS_GATE_REASON_CODES,

package/src/workspace/reason-codes.ts

@@ -229,6 +229,24 @@ export const REASONS = {
   "diagram-source-missing": "A declared diagram's source file does not exist in the tree read.",
   "diagram-render-missing": "A declared diagram's render file does not exist in the tree read.",
   "diagram-render-drift": "A declared diagram records a sourceHash, and the source's bytes now hash to something else: the render is stale for its source.",
+  // The security group checklists (check, #4168 step 7). Each is also a WSP finding.
+  "security-signers-missing": "The workspace opts into verified-releases, and there is no .chant/allowed_signers to verify a release's signature against.",
+  "security-release-gate-missing": "Under verified-releases, identity.gates has no release entry, or it names no class, so a cut is not held to a class of signers.",
+  "security-publish-allows-unsigned": "Under verified-releases, a pipeline file runs release publish with --allow-unsigned.",
+  "security-sbom-disabled": "Under supply-chain, a member's chant.config.ts sets sbom: false on a publish target.",
+  "security-sbom-unsourced": "Under supply-chain, a member publishes, names no sbom file and has no package-lock.json, pom.xml or Cargo.lock to write one from.",
+  "security-publish-no-provenance": "Under supply-chain, a pipeline file runs release publish without --require-provenance.",
+  "security-component-no-sbom": "Under supply-chain, a member's components have no generate-sbom step.",
+  "security-component-no-verify": "Under supply-chain, a member's components have no verify step.",
+  "security-signed-since-unset": "Under who-ran-it, ci.green sets no signedSince, or there is no ci.green block.",
+  "security-runner-untrusted": "Under who-ran-it, .chant/trust.json lists no runner key.",
+  "security-tick-no-key": "Under who-ran-it, a pipeline file runs ci tick with no runner key.",
+  "security-review-not-required": "Under review-rules, an apply job passes --no-require-review, which the group overrides.",
+  "security-attribution-any": "Under review-rules, identity.attribution is not identified.",
+  "security-gate-unsigned": "Under review-rules, an apply job names a gate identity.gates does not list, or identity.gates lists none.",
+  "security-runner-start-no-key": "Under isolated-runners, .chant/trust.json lists no key under runners for a provisioner to sign runner-start statements with.",
+  "security-runner-start-no-role": "Under isolated-runners, no principal under runners in .chant/trust.json holds the runner role.",
+  "security-trust-unreadable": "Under isolated-runners, .chant/trust.json can't be read, so no runner-start statement can be checked.",
   // A box that holds a credential (check, #2726). Each is also a WSP finding.
   "box-credential-declared": "A file in a box member's directory carries a literal secret: a credential's shape, or a literal where a credential goes. A variable or secret-manager reference is not one.",
   "box-capability-unbrokered": "A capability in a member's box block names no broker, so the box would hold its credential.",

package/src/workspace/release-candidates.schema.json

@@ -0,0 +1,353 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/workspace/release-candidates/v1/release-candidates.schema.json",
+  "title": "chant release candidates output",
+  "description": "What `chant release candidates --json` prints (#4168 4.2): the green commits of trunk a release can be cut from, newest first, each with the commits, work items, pull requests, merge records and flags it would ship since the previous candidate, and what each environment of the member runs. It reads local refs and tags and never fetches. Version 1 of the read contract. Readers ignore fields they do not know; a field is only ever added within a version. The codes are a closed list, each in the one closed list of `reason-codes.ts`. Contract version 1 of this document is written by chant 0.124.33 and newer.",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/result"
+    },
+    {
+      "$ref": "#/$defs/failure"
+    }
+  ],
+  "$defs": {
+    "result": {
+      "type": "object",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "member",
+        "branch",
+        "tip",
+        "environments",
+        "since",
+        "candidates",
+        "skipped",
+        "pending"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/release-candidates/v1/release-candidates.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string"
+        },
+        "error": false,
+        "member": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The workspace member read, or null for a project outside a workspace."
+        },
+        "branch": {
+          "type": "string",
+          "description": "The trunk walked: ci.green.branch, else what origin/HEAD names."
+        },
+        "tip": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The branch's tip as this clone knows it, or null when it knows none."
+        },
+        "environments": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/environment"
+          },
+          "description": "The member's environments in promotion order, or the one --env names."
+        },
+        "since": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The oldest commit an environment runs, where the walk stopped, or null when it read its limit of commits."
+        },
+        "candidates": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/candidate"
+          },
+          "description": "Green commits that are not revoked, newest first."
+        },
+        "skipped": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": [
+              "commit",
+              "subject",
+              "reason"
+            ],
+            "properties": {
+              "commit": {
+                "type": "string"
+              },
+              "subject": {
+                "type": "string"
+              },
+              "reason": {
+                "enum": [
+                  "revoked"
+                ]
+              }
+            }
+          },
+          "description": "Revoked green commits, newest first. Their changes are in the next candidate."
+        },
+        "pending": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/change"
+          },
+          "description": "Commits after the newest candidate, newest first: not green yet, or red."
+        }
+      },
+      "description": "Exit code 0, with or without candidates."
+    },
+    "failure": {
+      "type": "object",
+      "required": [
+        "$schema",
+        "contract",
+        "chant",
+        "error"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/release-candidates/v1/release-candidates.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "chant": {
+          "type": "string"
+        },
+        "error": {
+          "type": "object",
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "enum": [
+                "not-a-git-repository",
+                "ledger-unreadable"
+              ]
+            },
+            "message": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "description": "Exit code 1."
+    },
+    "environment": {
+      "type": "object",
+      "required": [
+        "env",
+        "running"
+      ],
+      "properties": {
+        "env": {
+          "type": "string"
+        },
+        "running": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/running"
+          },
+          "description": "The releases the environment's latest deploys name, newest cut first."
+        }
+      }
+    },
+    "running": {
+      "type": "object",
+      "required": [
+        "releaseDigest",
+        "label",
+        "commit",
+        "components"
+      ],
+      "properties": {
+        "releaseDigest": {
+          "type": "string"
+        },
+        "label": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "commit": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The commit it was cut from, or null when its release file is not on this clone's branch."
+        },
+        "components": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "candidate": {
+      "type": "object",
+      "required": [
+        "commit",
+        "subject",
+        "date",
+        "newFor",
+        "cut",
+        "changes",
+        "flags"
+      ],
+      "properties": {
+        "commit": {
+          "type": "string"
+        },
+        "subject": {
+          "type": "string"
+        },
+        "date": {
+          "type": "string"
+        },
+        "newFor": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The environments that run neither this commit nor a later one."
+        },
+        "cut": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The labels of releases already cut from it."
+        },
+        "changes": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/change"
+          },
+          "description": "The first-parent commits after the previous candidate, up to and including this one, newest first."
+        },
+        "flags": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/flag"
+          },
+          "description": "The flags of the declared flag kinds whose record files those commits change."
+        }
+      }
+    },
+    "change": {
+      "type": "object",
+      "required": [
+        "commit",
+        "subject",
+        "date",
+        "work",
+        "records",
+        "pr",
+        "merge"
+      ],
+      "properties": {
+        "commit": {
+          "type": "string"
+        },
+        "subject": {
+          "type": "string"
+        },
+        "date": {
+          "type": "string",
+          "description": "Author date, ISO 8601."
+        },
+        "work": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The ids its `Chant-Record: work:<id>` trailers name."
+        },
+        "records": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Every `Chant-Record` trailer, as `<kind>:<id>`."
+        },
+        "pr": {
+          "type": [
+            "integer",
+            "null"
+          ],
+          "description": "The pull request the merge record or the squash subject (`(#123)` at its end) names, or null."
+        },
+        "merge": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "description": "The merge record `_merges/<sha>.json` on chant/lifecycle (#4168 4.1), as stored, or null when there is none."
+        }
+      },
+      "description": "One first-parent commit."
+    },
+    "flag": {
+      "type": "object",
+      "required": [
+        "id",
+        "member",
+        "param",
+        "path",
+        "values"
+      ],
+      "properties": {
+        "id": {
+          "type": "string"
+        },
+        "member": {
+          "type": "string"
+        },
+        "param": {
+          "type": "string"
+        },
+        "path": {
+          "type": "string",
+          "description": "The record file from the workspace root."
+        },
+        "values": {
+          "type": "object",
+          "additionalProperties": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "number"
+              },
+              {
+                "type": "boolean"
+              }
+            ]
+          },
+          "description": "The value per environment, as the working tree's record writes it."
+        }
+      }
+    }
+  }
+}