@intentius/chant 0.124.32 → 0.124.34

package/dist/workspace/checks.d.ts

@@ -37,6 +37,8 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
+ * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
+ * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import type { LintDiagnostic, LintRule, Severity } from "../lint/rule.js";
 import type { PostSynthDiagnostic } from "../lint/post-synth.js";

package/dist/workspace/checks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAiMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../src/workspace/checks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAsD,KAAK,WAAW,EAAkC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACzJ,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAiE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AACjI,OAAO,EAA6D,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,QAAQ,CAAC;AAEjE,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAA0C,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACrG,OAAO,EAAoC,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAwC,KAAK,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpG,OAAO,EAAoC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKnE,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAqB,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAwB,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC3C,kFAAkF;IAClF,SAAS,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC1C,oFAAoF;IACpF,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oGAAoG;IACpG,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,8EAA8E;IAC9E,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,uFAAuF;IACvF,UAAU,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC1C,kHAAkH;IAClH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAC5D;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,WAAW,CAAC;IACzB,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,aAAa,EAAE,CAAC;IACxB,KAAK,EAAE,YAAY,CAAC;IACpB,+CAA+C;IAC/C,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,yGAAyG;IACzG,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,eAAe,EAAE,CAAC;IAClC,gDAAgD;IAChD,KAAK,CAAC,EAAE,cAAc,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mJAAmJ;IACnJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,QAAQ,CAAC;IACnB,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAAC;CAC1D;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mJAAmJ;IACnJ,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IAChC,8EAA8E;IAC9E,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,0FAA0F;IAC1F,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,EAAE,CAAA;KAAE,CAAC;IACzC,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;CACb;AAqBD,iHAAiH;AACjH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,eAAO,MAAM,gBAAgB,EAAE,SAAS,cAAc,EAqMrD,CAAC;AAWF;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,QAAQ,EAAE,CAShD;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,qBAAqB,GAAG,mBAAmB,EAAE,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,mBAAmB,EAAE,GAC9B;IAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAAC,UAAU,EAAE,CAAC,mBAAmB,GAAG;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;CAAE,CAkB7F;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sHAAsH;IACtH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CASrJ;AAUD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAiB,EAC5C,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAqEjC"}

package/dist/workspace/checks.js

@@ -37,6 +37,8 @@
  * | WSP126, WSP127 | box intent: the decision record a box names exists, and constrains a member or path of this workspace (#2850, #2857) |
  * | WSP141, WSP142 | member links resolved against a live read, with `--live` (#2549) |
  * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
+ * | WSP151 | what a member under `ci.workflow` still lacks (#4168 step 6) |
+ * | WSP161 to WSP165 | the security groups the declaration opts into: what each still lacks (#4168 step 7) |
  */
 import { realpathSync } from "node:fs";
 import { relative, sep } from "node:path";
@@ -53,6 +55,8 @@ import { gatherLiveLinkFacts, LIVE_CHECKS } from "./checks/live.js";
 import { RECORD_CHECKS } from "./checks/records.js";
 import { BOX_CHECKS } from "./checks/boxes.js";
 import { DIAGRAM_CHECKS } from "./checks/diagrams.js";
+import { SECURITY_CHECKS } from "./checks/security.js";
+import { CI_WORKFLOW_CHECKS } from "./checks/ci-workflow.js";
 import { loadDeclaredKinds } from "./declared-kinds.js";
 import { resolveBoxIntents } from "./box-intent.js";
 import { gatherLexiconOutputs } from "./lexicon-outputs.js";
@@ -270,6 +274,10 @@ export const WORKSPACE_CHECKS = [
     ...DIAGRAM_CHECKS,
     // Links resolved against a live read, with --live (#2549), WSP141 and WSP142.
     ...LIVE_CHECKS,
+    // What a member under ci.workflow still lacks (#4168 step 6), WSP151.
+    ...CI_WORKFLOW_CHECKS,
+    // The security groups the declaration opts into (#4168 step 7), WSP161 to WSP165.
+    ...SECURITY_CHECKS,
 ];
 const BY_ID = new Map(WORKSPACE_CHECKS.map((c) => [c.id, c]));
 function settingProblem(id) {

package/dist/workspace/ci-builds.d.ts

@@ -0,0 +1,163 @@
+/**
+ * Which commits get built, and what each one ends with (#4169).
+ *
+ * A `ci.green` phase declares `build: "every"` (the default) or
+ * `build: "newest"`. Under `newest` the phase's workflow keeps one run
+ * waiting and drops the rest, so only the newest commit is built when a
+ * runner frees. This module does the tick's part of that, given the
+ * verdicts {@link planTick} (./ci-green.ts) judged:
+ *
+ * - Superseded. A commit with no run of a `newest` phase, below a newer
+ *   commit that has one, is `unbuilt` for that phase, covered by the newer
+ *   commit. A cancelled run makes any phase `unbuilt` (`phaseVerdictOf`).
+ * - Retry. A failed run with one attempt is run again once before the
+ *   commit counts red: through the forge's re-run (`CiForge.rerun`) for
+ *   check runs, or a build request for chant runs. A retry that has not
+ *   started an hour on counts as the failure it was.
+ * - Bisect. When the newest built commit of a `newest` phase is red, the
+ *   unbuilt commits back to the last one the phase passed on are built, one
+ *   request per tick: the commit halfway when more than four are left, else
+ *   the one just below the red. The first red commit found is the culprit,
+ *   and it and every commit after it name it.
+ * - Requests. A build is asked for with an annotated tag,
+ *   `ci/build/<sha>`, whose record names the phases and why. The tick
+ *   starts a workflow at that tag on GitHub (`CiForge.dispatch`), and `ci
+ *   serve --build-command` serves it for chant runs. A phase a request
+ *   waits on is `pending`. A request no runner served in six hours leaves
+ *   the phase `unbuilt`, and once its phases are decided the tick deletes
+ *   the tag.
+ * - Records. Every first-parent commit the tick judged gets
+ *   `_ci/<sha>.json` on `chant/lifecycle`, rewritten only when what it says
+ *   changes: `green`, `red`, `unbuilt` or `pending`, with each required
+ *   phase's verdict, runs, reason, the commit that covers it and the culprit.
+ *   A commit that leaves the window still `pending` is rewritten `unbuilt`,
+ *   for the reason `aged-out`. The `ci/green` and `ci/revoked` tags stay
+ *   what decides a release; the records say what happened to the rest.
+ */
+import type { CiBuild, CiGreen } from "./declaration.js";
+import type { CheckRun } from "./ci-green-forge.js";
+import { type PhaseReason, type TickCommit, type Verdict } from "./ci-green.js";
+export declare const CI_BUILD_TAG_PREFIX = "ci/build/";
+/** The directory on `chant/lifecycle` holding one record per commit. */
+export declare const CI_RECORDS_DIR = "_ci";
+/** How long a build request may wait for a runner before its phases count as unbuilt. */
+export declare const BUILD_REQUEST_TTL_MS: number;
+/** How long a retry may take to start before the failure it was counts. */
+export declare const RETRY_TTL_MS = 3600000;
+/** Above this many unbuilt commits a bisect halves the range; at or below it, it steps back one commit at a time. */
+export declare const BISECT_HALVE_ABOVE = 4;
+export type BuildRequestReason = "bisect" | "retry" | "requested";
+/** A `ci/build/<sha>` tag's record: the phases to build at the commit, and why. */
+export interface BuildRequest {
+    schema: 1;
+    tag: string;
+    commit: string;
+    branch: string;
+    phases: string[];
+    reason: BuildRequestReason;
+    /** When it was asked for, ISO 8601. */
+    at: string;
+}
+/** One record, `_ci/<sha>.json` on `chant/lifecycle`. */
+export interface CiRecord {
+    schema: 1;
+    commit: string;
+    branch: string;
+    /** `green` and `red` follow the tags: a green tag, or a failed phase or a revoked tag. */
+    state: "green" | "red" | "unbuilt" | "pending";
+    /** When this content was written, ISO 8601. Not compared when deciding whether to write again. */
+    at: string;
+    /** Set when the commit has a revoked tag. */
+    revoked?: true;
+    phases: Record<string, CiRecordPhase>;
+    /** The first required phase that failed, and its run, when the state is red. */
+    failure?: {
+        phase: string;
+        run: CiRecordRun;
+    };
+    /** The retries asked for, by run name: the run that failed and when. */
+    retried?: Record<string, {
+        run: number;
+        at: string;
+    }>;
+    /** The build request waiting on this commit, when there is one. */
+    request?: {
+        tag: string;
+        reason: BuildRequestReason;
+        phases: string[];
+        at: string;
+        dispatched?: true;
+    };
+}
+export interface CiRecordRun {
+    name: string;
+    id: number | null;
+    conclusion: string | null;
+    url: string | null;
+}
+export interface CiRecordPhase {
+    verdict: Verdict;
+    build: CiBuild;
+    runs: CiRecordRun[];
+    reason?: PhaseReason | "aged-out";
+    coveredBy?: string;
+    culprit?: string;
+}
+/** How a tick can run a failed job again: the forge's re-run, a build request, or not at all. */
+export type RetryVia = "forge" | "request" | null;
+export interface BuildsInput {
+    green: CiGreen;
+    /** Newest first, as {@link planTick} returns them. */
+    commits: TickCommit[];
+    /** Every attempt of every run, by commit. */
+    runs: ReadonlyMap<string, readonly CheckRun[]>;
+    requests: ReadonlyMap<string, BuildRequest>;
+    records: ReadonlyMap<string, CiRecord>;
+    now: Date;
+    retryVia: RetryVia;
+}
+export interface BuildsPlan {
+    /** Requests to make: bisect steps, and retries of chant runs. */
+    requests: BuildRequest[];
+    /** Failed check runs to run again through the forge, by commit. */
+    retries: {
+        sha: string;
+        run: CheckRun;
+    }[];
+    /** Request tags whose phases are decided, or that waited too long, or whose commit left the window. */
+    resolved: string[];
+}
+/**
+ * Apply supersession, retries, requests and bisection to the judged commits,
+ * in place, and say what the tick has to ask for. Pure: it reads and writes
+ * nothing but its input.
+ */
+export declare function planBuilds(input: BuildsInput): BuildsPlan;
+/** The record a judged commit gets, carrying the retries asked for before and now. */
+export declare function recordOf(input: {
+    green: CiGreen;
+    commit: TickCommit;
+    previous?: CiRecord;
+    retries: readonly {
+        sha: string;
+        run: CheckRun;
+    }[];
+    requests: ReadonlyMap<string, BuildRequest>;
+    now: Date;
+}): CiRecord;
+/** The record a commit that left the window still pending gets: each pending phase `unbuilt`, `aged-out`. */
+export declare function agedOut(record: CiRecord, now: Date): CiRecord;
+/** Whether two records say the same thing, the time each was written aside. */
+export declare function sameRecord(a: CiRecord | undefined, b: CiRecord): boolean;
+export declare const recordPath: (sha: string) => string;
+/** One commit's record, from the local `chant/lifecycle`. */
+export declare function readCiRecord(top: string, sha: string): CiRecord | undefined;
+/** Every record on the local `chant/lifecycle`, by commit. Empty when the branch or the directory is missing. */
+export declare function readCiRecords(top: string): Map<string, CiRecord>;
+/** Every `ci/build/<sha>` tag with a record this reads, from local refs, by commit. */
+export declare function readBuildRequests(top: string): Map<string, BuildRequest>;
+/** The annotation of a request tag: a subject line, then the record. */
+export declare function buildRequestAnnotation(r: BuildRequest): string;
+/** A request for `ci run --at <sha>`: every required phase, asked for by a person. */
+export declare function requestedBuild(green: CiGreen, commit: string, phases: readonly string[], now: Date): BuildRequest;
+//# sourceMappingURL=ci-builds.d.ts.map

package/dist/workspace/ci-builds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-builds.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-builds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAmC,KAAK,WAAW,EAAqB,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEjI,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,wEAAwE;AACxE,eAAO,MAAM,cAAc,QAAQ,CAAC;AAGpC,yFAAyF;AACzF,eAAO,MAAM,oBAAoB,QAAgB,CAAC;AAClD,2EAA2E;AAC3E,eAAO,MAAM,YAAY,UAAY,CAAC;AACtC,qHAAqH;AACrH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;AAElE,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,CAAC,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,CAAC,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0FAA0F;IAC1F,KAAK,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;IAC/C,kGAAkG;IAClG,EAAE,EAAE,MAAM,CAAC;IACX,6CAA6C;IAC7C,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtC,gFAAgF;IAChF,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,WAAW,CAAA;KAAE,CAAC;IAC9C,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtD,mEAAmE;IACnE,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;CACxG;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,GAAG,UAAU,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAID,iGAAiG;AACjG,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,sDAAsD;IACtD,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,6CAA6C;IAC7C,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC;IAC/C,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC5C,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvC,GAAG,EAAE,IAAI,CAAC;IACV,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,mEAAmE;IACnE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,QAAQ,CAAA;KAAE,EAAE,CAAC;IAC1C,uGAAuG;IACvG,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAeD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAuGzD;AAUD,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,QAAQ,CAAA;KAAE,EAAE,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAAC,GAAG,EAAE,IAAI,CAAA;CAAE,GAAG,QAAQ,CAqCjN;AAED,6GAA6G;AAC7G,wBAAgB,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,GAAG,QAAQ,CAI7D;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,CAAC,EAAE,QAAQ,GAAG,SAAS,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAKxE;AAED,eAAO,MAAM,UAAU,QAAS,MAAM,WAAoC,CAAC;AAoB3E,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAE3E;AAED,iHAAiH;AACjH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAWhE;AAID,uFAAuF;AACvF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAgBxE;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAE9D;AAED,sFAAsF;AACtF,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,GAAG,YAAY,CAEjH"}

package/dist/workspace/ci-builds.js

@@ -0,0 +1,315 @@
+/**
+ * Which commits get built, and what each one ends with (#4169).
+ *
+ * A `ci.green` phase declares `build: "every"` (the default) or
+ * `build: "newest"`. Under `newest` the phase's workflow keeps one run
+ * waiting and drops the rest, so only the newest commit is built when a
+ * runner frees. This module does the tick's part of that, given the
+ * verdicts {@link planTick} (./ci-green.ts) judged:
+ *
+ * - Superseded. A commit with no run of a `newest` phase, below a newer
+ *   commit that has one, is `unbuilt` for that phase, covered by the newer
+ *   commit. A cancelled run makes any phase `unbuilt` (`phaseVerdictOf`).
+ * - Retry. A failed run with one attempt is run again once before the
+ *   commit counts red: through the forge's re-run (`CiForge.rerun`) for
+ *   check runs, or a build request for chant runs. A retry that has not
+ *   started an hour on counts as the failure it was.
+ * - Bisect. When the newest built commit of a `newest` phase is red, the
+ *   unbuilt commits back to the last one the phase passed on are built, one
+ *   request per tick: the commit halfway when more than four are left, else
+ *   the one just below the red. The first red commit found is the culprit,
+ *   and it and every commit after it name it.
+ * - Requests. A build is asked for with an annotated tag,
+ *   `ci/build/<sha>`, whose record names the phases and why. The tick
+ *   starts a workflow at that tag on GitHub (`CiForge.dispatch`), and `ci
+ *   serve --build-command` serves it for chant runs. A phase a request
+ *   waits on is `pending`. A request no runner served in six hours leaves
+ *   the phase `unbuilt`, and once its phases are decided the tick deletes
+ *   the tag.
+ * - Records. Every first-parent commit the tick judged gets
+ *   `_ci/<sha>.json` on `chant/lifecycle`, rewritten only when what it says
+ *   changes: `green`, `red`, `unbuilt` or `pending`, with each required
+ *   phase's verdict, runs, reason, the commit that covers it and the culprit.
+ *   A commit that leaves the window still `pending` is rewritten `unbuilt`,
+ *   for the reason `aged-out`. The `ci/green` and `ci/revoked` tags stay
+ *   what decides a release; the records say what happened to the rest.
+ */
+import { execFileSync } from "node:child_process";
+import { commitVerdictOf, phaseVerdictOf } from "./ci-green.js";
+export const CI_BUILD_TAG_PREFIX = "ci/build/";
+/** The directory on `chant/lifecycle` holding one record per commit. */
+export const CI_RECORDS_DIR = "_ci";
+const LEDGER_REF = "refs/heads/chant/lifecycle";
+/** How long a build request may wait for a runner before its phases count as unbuilt. */
+export const BUILD_REQUEST_TTL_MS = 6 * 3600000;
+/** How long a retry may take to start before the failure it was counts. */
+export const RETRY_TTL_MS = 3600000;
+/** Above this many unbuilt commits a bisect halves the range; at or below it, it steps back one commit at a time. */
+export const BISECT_HALVE_ABOVE = 4;
+const iso = (d) => d.toISOString().replace(/\.\d{3}Z$/, "Z");
+const phaseOf = (green, name) => green.phases.find((p) => p.name === name);
+const buildOf = (green, name) => phaseOf(green, name).build ?? "every";
+const decided = (v) => v === "pass" || v === "fail";
+const age = (at, now) => now.getTime() - Date.parse(at);
+function setPhase(c, phase, fn) {
+    const v = c.verdict;
+    if (!v)
+        return;
+    c.verdict = commitVerdictOf(v.phases.map((p) => (p.phase === phase ? fn(p) : p)));
+}
+const phaseIn = (c, phase) => c.verdict?.phases.find((p) => p.phase === phase);
+/**
+ * Apply supersession, retries, requests and bisection to the judged commits,
+ * in place, and say what the tick has to ask for. Pure: it reads and writes
+ * nothing but its input.
+ */
+export function planBuilds(input) {
+    const { green, commits, now } = input;
+    const plan = { requests: [], retries: [], resolved: [] };
+    const inWindow = new Set(commits.map((c) => c.sha));
+    const live = (sha, phase) => {
+        const r = input.requests.get(sha);
+        return r && r.phases.includes(phase) && age(r.at, now) < BUILD_REQUEST_TTL_MS ? r : undefined;
+    };
+    // A request waits on a phase with no run yet; one no runner served in time leaves it unbuilt.
+    for (const c of commits) {
+        const r = input.requests.get(c.sha);
+        if (!r || !c.verdict)
+            continue;
+        for (const name of r.phases) {
+            const p = phaseIn(c, name);
+            if (!p || p.runs.length > 0)
+                continue;
+            setPhase(c, name, (q) => (live(c.sha, name) ? { ...q, verdict: "pending", reason: "requested" } : { ...q, verdict: "unbuilt", reason: "request-unserved" }));
+        }
+    }
+    // Superseded: newest first, a newest phase with no run below a commit with one.
+    for (const name of green.require) {
+        if (buildOf(green, name) !== "newest")
+            continue;
+        let cover;
+        for (const c of commits) {
+            const p = phaseIn(c, name);
+            if (!p)
+                continue;
+            if (p.runs.length > 0) {
+                cover = c.sha;
+                continue;
+            }
+            if (cover && p.reason !== "requested" && p.reason !== "request-unserved")
+                setPhase(c, name, (q) => ({ ...q, verdict: "unbuilt", reason: "superseded", coveredBy: cover }));
+        }
+    }
+    // Retry once: a commit with no tag whose failed run has one attempt.
+    if (input.retryVia) {
+        for (const c of commits) {
+            if (c.before !== "none" || c.verdict?.verdict !== "fail")
+                continue;
+            const all = input.runs.get(c.sha) ?? [];
+            const retried = input.records.get(c.sha)?.retried ?? {};
+            for (const p of c.verdict.phases) {
+                for (const run of p.runs.filter((r) => r.verdict === "fail")) {
+                    if (all.filter((r) => r.name === run.name).length > 1)
+                        continue;
+                    const asked = retried[run.name];
+                    if (asked && asked.run === run.id && age(asked.at, now) >= RETRY_TTL_MS)
+                        continue;
+                    if (!asked || asked.run !== run.id) {
+                        const checkRun = all.find((r) => r.name === run.name && r.id === run.id);
+                        if (input.retryVia === "forge")
+                            plan.retries.push({ sha: c.sha, run: checkRun });
+                        else if (!input.requests.has(c.sha) && !plan.requests.some((q) => q.commit === c.sha))
+                            plan.requests.push(request(green, c.sha, [p.phase], "retry", now));
+                    }
+                    setPhase(c, p.phase, (q) => {
+                        const runs = q.runs.map((r) => (r.name === run.name && r.id === run.id ? { ...r, verdict: "pending" } : r));
+                        return { ...q, runs, ...phaseVerdictOf(runs, q.unmatched), reason: "retrying" };
+                    });
+                }
+            }
+        }
+    }
+    // Culprits for every phase, and a bisect request for a newest one.
+    for (const name of green.require) {
+        const verdicts = commits.map((c) => phaseIn(c, name));
+        const top = verdicts.findIndex((p) => decided(p?.verdict));
+        if (top < 0 || verdicts[top].verdict !== "fail")
+            continue;
+        let oldestRed = top;
+        let between = [];
+        let passed = -1;
+        for (let i = top + 1; i < commits.length; i++) {
+            const v = verdicts[i]?.verdict;
+            if (v === "fail") {
+                oldestRed = i;
+                between = [];
+            }
+            else if (v === "pass") {
+                passed = i;
+                break;
+            }
+            else if (v !== undefined)
+                between.push(i);
+        }
+        if (between.length === 0) {
+            if (passed < 0)
+                continue;
+            const culprit = commits[oldestRed].sha;
+            for (let i = oldestRed; i >= 0; i--) {
+                if (verdicts[i]?.verdict === "pass")
+                    break;
+                if (verdicts[i])
+                    setPhase(commits[i], name, (q) => ({ ...q, culprit }));
+            }
+            continue;
+        }
+        if (buildOf(green, name) !== "newest")
+            continue;
+        if (between.some((i) => live(commits[i].sha, name)))
+            continue;
+        const pick = between.length > BISECT_HALVE_ABOVE ? between[Math.floor(between.length / 2)] : between[0];
+        const sha = commits[pick].sha;
+        if (input.requests.has(sha) || plan.requests.some((q) => q.commit === sha))
+            continue;
+        plan.requests.push(request(green, sha, [name], "bisect", now));
+        setPhase(commits[pick], name, (q) => ({ ...q, verdict: "pending", reason: "requested", coveredBy: undefined }));
+    }
+    // A request is done once its phases are decided, it has waited too long, or its commit left the window.
+    for (const [sha, r] of input.requests) {
+        const c = commits.find((x) => x.sha === sha);
+        const done = !inWindow.has(sha) || age(r.at, now) >= BUILD_REQUEST_TTL_MS || (c !== undefined && (c.before === "revoked" || r.phases.every((name) => decided(phaseIn(c, name)?.verdict))));
+        if (done)
+            plan.resolved.push(r.tag);
+    }
+    return plan;
+}
+function request(green, commit, phases, reason, now) {
+    return { schema: 1, tag: `${CI_BUILD_TAG_PREFIX}${commit}`, commit, branch: green.branch, phases, reason, at: iso(now) };
+}
+// ── Records ──────────────────────────────────────────────────────────────────
+const recordRun = (r) => ({ name: r.name, id: r.opRun ? null : r.id, conclusion: r.conclusion, url: r.url });
+/** The record a judged commit gets, carrying the retries asked for before and now. */
+export function recordOf(input) {
+    const { green, commit: c, previous, now } = input;
+    const retried = { ...(previous?.retried ?? {}) };
+    for (const r of input.retries)
+        if (r.sha === c.sha)
+            retried[r.run.name] = { run: r.run.id, at: iso(now) };
+    const req = input.requests.get(c.sha);
+    const extras = {
+        ...(Object.keys(retried).length > 0 ? { retried } : {}),
+        ...(req ? { request: { tag: req.tag, reason: req.reason, phases: req.phases, at: req.at } } : {}),
+    };
+    if (c.before === "revoked" || !c.verdict) {
+        return { schema: 1, commit: c.sha, branch: green.branch, state: "red", at: iso(now), revoked: true, phases: previous?.phases ?? {}, ...(previous?.failure ? { failure: previous.failure } : {}), ...extras };
+    }
+    const v = c.verdict;
+    // A pass whose tag an ignored tag blocks (#4031) is not green until a person clears the name.
+    const state = c.before === "green" ? (v.verdict === "fail" ? "red" : "green") : v.verdict === "pass" ? (c.made ? "green" : "pending") : v.verdict === "fail" ? "red" : v.verdict;
+    const phases = {};
+    for (const p of v.phases) {
+        phases[p.phase] = {
+            verdict: p.verdict,
+            build: buildOf(green, p.phase),
+            runs: p.runs.map(recordRun),
+            ...(p.reason ? { reason: p.reason } : {}),
+            ...(p.coveredBy ? { coveredBy: p.coveredBy } : {}),
+            ...(p.culprit ? { culprit: p.culprit } : {}),
+        };
+    }
+    return {
+        schema: 1,
+        commit: c.sha,
+        branch: green.branch,
+        state,
+        at: iso(now),
+        phases,
+        ...(v.failure ? { failure: { phase: v.failure.phase, run: recordRun(v.failure.run) } } : {}),
+        ...extras,
+    };
+}
+/** The record a commit that left the window still pending gets: each pending phase `unbuilt`, `aged-out`. */
+export function agedOut(record, now) {
+    const phases = Object.fromEntries(Object.entries(record.phases).map(([k, p]) => [k, p.verdict === "pending" ? { ...p, verdict: "unbuilt", reason: "aged-out" } : p]));
+    const { request: _request, ...rest } = record;
+    return { ...rest, state: "unbuilt", at: iso(now), phases };
+}
+/** Whether two records say the same thing, the time each was written aside. */
+export function sameRecord(a, b) {
+    if (!a)
+        return false;
+    const { at: _a, ...x } = a;
+    const { at: _b, ...y } = b;
+    return JSON.stringify(x) === JSON.stringify(y);
+}
+export const recordPath = (sha) => `${CI_RECORDS_DIR}/${sha}.json`;
+function tryGit(top, args) {
+    try {
+        return execFileSync("git", args, { cwd: top, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer: 256 * 1024 * 1024 }).trimEnd();
+    }
+    catch {
+        return null;
+    }
+}
+function parseRecord(text) {
+    if (!text)
+        return undefined;
+    try {
+        const r = JSON.parse(text);
+        return r && r.schema === 1 && typeof r.commit === "string" && typeof r.state === "string" ? r : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** One commit's record, from the local `chant/lifecycle`. */
+export function readCiRecord(top, sha) {
+    return parseRecord(tryGit(top, ["show", `${LEDGER_REF}:${recordPath(sha)}`]));
+}
+/** Every record on the local `chant/lifecycle`, by commit. Empty when the branch or the directory is missing. */
+export function readCiRecords(top) {
+    const out = new Map();
+    const names = tryGit(top, ["ls-tree", "--name-only", `${LEDGER_REF}:${CI_RECORDS_DIR}`]);
+    if (!names)
+        return out;
+    for (const name of names.split("\n")) {
+        const m = /^([0-9a-f]{40,64})\.json$/.exec(name);
+        if (!m)
+            continue;
+        const r = readCiRecord(top, m[1]);
+        if (r)
+            out.set(m[1], r);
+    }
+    return out;
+}
+// ── Requests ─────────────────────────────────────────────────────────────────
+/** Every `ci/build/<sha>` tag with a record this reads, from local refs, by commit. */
+export function readBuildRequests(top) {
+    const out = new Map();
+    const raw = tryGit(top, ["for-each-ref", "--format=%(refname:lstrip=2)%00%(objecttype)%00%(contents)%01", `refs/tags/${CI_BUILD_TAG_PREFIX}`]);
+    if (!raw)
+        return out;
+    for (const entry of raw.split("\u0001")) {
+        const [tag, type, contents] = entry.replace(/^\n/, "").split("\u0000");
+        if (!tag || type !== "tag" || !contents?.includes("{"))
+            continue;
+        try {
+            const r = JSON.parse(contents.slice(contents.indexOf("{")));
+            const sha = tag.slice(CI_BUILD_TAG_PREFIX.length);
+            if (r.schema === 1 && r.commit === sha && Array.isArray(r.phases) && typeof r.at === "string")
+                out.set(sha, { ...r, tag });
+        }
+        catch {
+            // A tag whose record does not parse asks for nothing.
+        }
+    }
+    return out;
+}
+/** The annotation of a request tag: a subject line, then the record. */
+export function buildRequestAnnotation(r) {
+    return `ci: build ${r.phases.join(", ")} at this commit (${r.reason})\n\n${JSON.stringify(r, null, 2)}\n`;
+}
+/** A request for `ci run --at <sha>`: every required phase, asked for by a person. */
+export function requestedBuild(green, commit, phases, now) {
+    return request(green, commit, [...phases], "requested", now);
+}

package/dist/workspace/ci-green-cli.d.ts

@@ -8,7 +8,8 @@
  *                                        tag the commits that turned green, revoke the ones that turned red
  *   ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>]
  *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]
- *                                        write the root CI file that runs the tick
+ *                                        write the root CI file that runs the tick, and the triggers and
+ *                                        concurrency of the workflows holding a phase that sets build (#4169)
  *
  * The tick signs its tags with a runner key (#4031) from `--key <file>` or
  * the PEM in `CHANT_RUNNER_KEY`, which the generated workflow sets from the

package/dist/workspace/ci-green-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAmE,cAAc,EAAE,MAAM,YAAY,CAAC;AAW7G,OAAO,EAAE,cAAc,EAAE,CAAC;AAe1B,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBpE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAapE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkDxE"}
+{"version":3,"file":"ci-green-cli.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-green-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAmE,cAAc,EAAE,MAAM,YAAY,CAAC;AAW7G,OAAO,EAAE,cAAc,EAAE,CAAC;AAe1B,wBAAsB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBzE;AAED,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBpE;AAID,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAoBpE;AAeD,wBAAsB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+DxE"}

package/dist/workspace/ci-green-cli.js

@@ -8,7 +8,8 @@
  *                                        tag the commits that turned green, revoke the ones that turned red
  *   ci workflow [--workflow <name>]... [--output <file>] [--chant <command>] [--install <command>]
  *               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>] [--runner-key-secret <NAME>]
- *                                        write the root CI file that runs the tick
+ *                                        write the root CI file that runs the tick, and the triggers and
+ *                                        concurrency of the workflows holding a phase that sets build (#4169)
  *
  * The tick signs its tags with a runner key (#4031) from `--key <file>` or
  * the PEM in `CHANT_RUNNER_KEY`, which the generated workflow sets from the
@@ -28,7 +29,7 @@ import { formatError } from "../cli/format.js";
 import { findWorkspaceRoot } from "../project-root.js";
 import { ciList, ciTick, CiGreenError, formatList, formatTick, lastGreen, RUNNER_KEY_ENV } from "./ci-green.js";
 import { ciForgeFromEnv } from "./ci-green-forge.js";
-import { ACTIONS_NAME, CI_GREEN_WORKFLOW_FILE, ciGreenHeader, readWorkflowSources, renderCiGreenWorkflow, workflowsHolding, writeWorkflowFile } from "./ci-green-workflow.js";
+import { ACTIONS_NAME, buildTriggerEdits, CI_GREEN_WORKFLOW_FILE, ciGreenHeader, readWorkflowSources, renderCiGreenWorkflow, workflowsHolding, writeWorkflowFile } from "./ci-green-workflow.js";
 import { readDeclaration, readerVersion, WorkspaceReadError } from "./declaration.js";
 import { recordGeneratedFiles, resolveMemberContext, shellArg } from "./member-pipeline.js";
 import { gitTop, workingTree } from "./tree.js";
@@ -99,6 +100,13 @@ export async function runCiTick(ctx) {
         // The forge is made only when the source is check runs, so a tick from chant runs needs no forge token.
         const forge = () => ciForgeFromEnv(ctx.args.forge ?? "github");
         const runnerKey = ctx.args.key !== undefined ? readFileSync(resolve(ctx.args.key), "utf-8") : process.env[RUNNER_KEY_ENV] || undefined;
+        // #4168: under who-ran-it every tag the tick makes is signed, so a tick without a key makes none.
+        if (runnerKey === undefined && ctx.args.dryRun !== true) {
+            const { securityGroupsAt } = await import("./security.js");
+            if (securityGroupsAt(process.cwd()).has("who-ran-it")) {
+                throw new Error(`the workspace opts into who-ran-it, so the tick signs every tag it makes and needs a runner key; pass --key <runner key.pem> or set ${RUNNER_KEY_ENV}`);
+            }
+        }
         const result = await ciTick({ cwd: process.cwd(), forge, dryRun: ctx.args.dryRun === true, ...(source ? { source } : {}), ...(runnerKey !== undefined ? { runnerKey } : {}) });
         console.log(formatTick(result, ctx.args.dryRun === true));
         return 0;
@@ -142,7 +150,10 @@ export async function runCiWorkflow(ctx) {
         const member = resolveMemberContext(cwd, found);
         const target = ctx.args.output ? resolve(realpathSync(cwd), ctx.args.output) : join(repoRoot, CI_GREEN_WORKFLOW_FILE);
         const fromRepo = relative(repoRoot, target).split(sep).join("/");
-        const scan = workflowsHolding(green, readWorkflowSources(repoRoot, fromRepo));
+        const sources = readWorkflowSources(repoRoot, fromRepo);
+        const scan = workflowsHolding(green, sources);
+        // #4169: the triggers and concurrency of the workflows holding a phase that sets build. Refused before anything is written.
+        const edits = buildTriggerEdits(green, sources);
         const extra = ctx.args.ciWorkflows ?? [];
         const workflows = [...new Set([...scan.workflows, ...extra])].sort();
         for (const f of scan.unreadable)
@@ -167,8 +178,9 @@ export async function runCiWorkflow(ctx) {
         const runnerKeySecret = ctx.args.ciRunnerKeySecret;
         if (runnerKeySecret)
             parts.push("--runner-key-secret", runnerKeySecret);
-        if (green.signedSince && !runnerKeySecret) {
-            console.error(`warning: ci.green.signedSince is set, so the tick needs a runner key; pass --runner-key-secret <NAME> naming the repository secret that holds it, or every tick will fail`);
+        const { securityGroupsAt } = await import("./security.js");
+        if ((green.signedSince || securityGroupsAt(root).has("who-ran-it")) && !runnerKeySecret) {
+            console.error(`warning: ci.green.signedSince is set or the workspace opts into who-ran-it, so the tick needs a runner key; pass --runner-key-secret <NAME> naming the repository secret that holds it, or every tick will fail`);
         }
         const command = parts.map(shellArg).join(" ");
         const workspaceRoot = relative(repoRoot, root).split(sep).join("/") || ".";
@@ -179,6 +191,14 @@ export async function runCiWorkflow(ctx) {
         if (member)
             recordGeneratedFiles(member.memberRoot, [{ path: fromRepo, command }]);
         console.log(`Wrote ${written}: ticks when ${workflows.join(", ")} complete${workflows.length === 1 ? "s" : ""} on ${green.branch}, and every 15 minutes.`);
+        for (const e of edits) {
+            if (!e.changed)
+                continue;
+            const path = writeWorkflowFile(join(repoRoot, e.path), e.text);
+            console.log(e.build === "newest"
+                ? `Wrote ${path}'s triggers and concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} the newest commit on ${green.branch} when a run ends, and a ci/build/<sha> tag by hand.`
+                : `Wrote ${path}'s concurrency: ${e.phases.join(", ")} build${e.phases.length === 1 ? "s" : ""} every commit on ${green.branch}, none cancelled.`);
+        }
         return 0;
     }
     catch (err) {

package/dist/workspace/ci-green-forge.d.ts

@@ -51,6 +51,18 @@ export interface CiForge {
     kind: ForgeKind;
     /** Every check run on `sha`, every attempt. */
     checkRuns(sha: string): Promise<CheckRun[]>;
+    /**
+     * Run a failed check run's job again (#4169), so a flake costs one more
+     * run before the commit counts red. Absent on a forge chant can't ask.
+     */
+    rerun?(run: CheckRun): Promise<void>;
+    /**
+     * Start a workflow at a ref (#4169), for a build the tick asks for: a
+     * bisect step, or `chant ci run --at`. `workflow` is the file's name in
+     * `.github/workflows/`, and `ref` a branch or tag. Absent on a forge chant
+     * can't ask.
+     */
+    dispatch?(workflow: string, ref: string): Promise<void>;
 }
 export interface GithubCiForgeOptions {
     /** `$GITHUB_API_URL`: `https://api.github.com` or `<host>/api/v3`. */