@intentius/chant 0.124.39 → 0.124.41

package/src/cli/handlers/promote.ts

@@ -26,6 +26,7 @@ import { dirname, join, resolve } from "node:path";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { loadChantConfig, type ChantConfig } from "../../config";
 import { promotionOrder } from "../../workspace/promotion-order";
+import { releaseTargetRefusal } from "../../components/pr-environment";
 import { resolvePromotionSource } from "../../components/promote-order";
 import { fetchLifecycle, getHeadCommit, pushLifecycle } from "../../lifecycle/git";
 import {
@@ -68,6 +69,7 @@ import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { GATED_EXIT_CODE } from "./run";
 import type { CommandContext } from "../registry";
+import { withComponentEndpoint } from "../component-endpoint";
 import { redeployLine, releaseRollbackLine, rollbackTarget, unsettledComponents } from "../../lifecycle/mixed-environment";
 
 const PROMOTE_USAGE =
@@ -390,7 +392,20 @@ function approvalLine(r: import("../../lifecycle/merge-record").MergeRecord): st
  * which differ only in how the plan was chosen, whether the publish step runs,
  * and which field names the earlier release on the new record.
  */
-async function deployPlan(
+/** {@link deployPlanIn}, with `plan.to`'s declared endpoint applied (#4281). */
+function deployPlan(
+  ctx: CommandContext,
+  verb: Verb,
+  plan: PromotionPlan,
+  project: { projectPath: string; config: ChantConfig; targets: DriverComponent[] },
+  actor: string | undefined,
+  record: (item: PromotionItem, env: string, run: DeployRunInfo) => ReleaseRecordInput,
+  under?: UnderRelease,
+): Promise<number> {
+  return withComponentEndpoint(ctx, () => deployPlanIn(ctx, verb, plan, project, actor, record, under), { config: project.config, environment: plan.to });
+}
+
+async function deployPlanIn(
   ctx: CommandContext,
   verb: Verb,
   plan: PromotionPlan,
@@ -661,7 +676,7 @@ async function deployPlan(
         const admission = gateAdmission(result);
         const input = record(item, plan.to, { runId, ...(runOrigin ? { runOrigin } : {}), actor: actor!, timestamp, ...(approver ? { approver } : {}), ...(admission ? { admission } : {}) });
         const templates = templateDigests.get(item.component);
-        const { record: written } = await appendReleaseRecord(under ? { ...input, ...(templates ? { digest: templates } : {}), releaseDigest: under.release.releaseDigest } : input);
+        const { record: written } = await appendReleaseRecord(under ? { ...input, ...(templates ? { digest: templates, digestKind: "templates" as const } : {}), releaseDigest: under.release.releaseDigest } : input);
         recorded.push(written);
       }
       if (outcome) await appendDeployOutcome(outcome);
@@ -883,6 +898,14 @@ export async function runComponentsPromote(ctx: CommandContext): Promise<number>
     console.error(formatError({ message: "--to <env> is required", hint: PROMOTE_USAGE }));
     return 1;
   }
+  // #4298: a pull request's environment is neither a release's target nor its source.
+  for (const env of [to, args.migrateFrom]) {
+    const refusal = env ? releaseTargetRefusal(env) : undefined;
+    if (refusal) {
+      console.error(formatError({ message: refusal }));
+      return 1;
+    }
+  }
   const who = actorOrRefuse(ctx);
   if (typeof who === "number") return who;
 

package/src/cli/handlers/query.ts

@@ -0,0 +1,78 @@
+/**
+ * `chant query "<sql>" [dir] [--member <name>] [--json]` (#4297): one
+ * read-only SQL statement over the snapshots, Op runs, gates, deploys and
+ * releases on the local `chant/lifecycle` branch. The tables and the engine
+ * live in `../../lifecycle/query.ts`; this reads the ledgers and prints.
+ *
+ * Inside a workspace every member's ledger is read, each row naming its
+ * member; `--member` keeps the members it names. Outside one the project's
+ * own ledger is read and `member` is NULL. It reads the local branch and
+ * never fetches.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { formatError, formatWarning } from "../format";
+import type { CommandContext } from "../registry";
+import type { QueryLedger } from "../../lifecycle/query";
+import { findWorkspaceRoot } from "../../project-root";
+
+const USAGE = 'chant query "<sql>" [dir] [--member <name>] [--json]';
+
+/** The ledgers `chant query` reads from `cwd`: every member's in a workspace, else the project's own. */
+export async function queryLedgers(cwd: string, members?: readonly string[]): Promise<QueryLedger[]> {
+  const { gitLedgerReadPort } = await import("../../lifecycle/git");
+  const found = findWorkspaceRoot(cwd);
+  if (!found) return [{ member: null, port: gitLedgerReadPort({ cwd }) }];
+  // Workspace code loads only when there is a workspace, so a level-0 project never pays for it.
+  const { readDeclaration, WorkspaceReadError } = await import("../../workspace/declaration");
+  const { workingTree } = await import("../../workspace/tree");
+  const { QueryError } = await import("../../lifecycle/query");
+  let declaration;
+  try {
+    declaration = readDeclaration(workingTree(found.dir), "");
+  } catch (err) {
+    if (err instanceof WorkspaceReadError) throw new QueryError(`${err.code}: ${err.message}`);
+    throw err;
+  }
+  const wanted = members && members.length > 0 ? new Set(members) : null;
+  if (wanted) {
+    const unknown = [...wanted].filter((n) => !declaration.members.some((m) => m.name === n));
+    if (unknown.length > 0) throw new QueryError(`--member ${unknown.join(", ")} names no member of the workspace`);
+  }
+  return declaration.members
+    .filter((m) => !wanted || wanted.has(m.name))
+    .map((m) => ({ member: m.name, port: gitLedgerReadPort({ cwd: found.dir, member: m.dir === "." ? "." : m.name }) }));
+}
+
+export async function runQueryCommand(ctx: CommandContext): Promise<number> {
+  const { args } = ctx;
+  const sql = args.positionals?.[0];
+  if (sql === undefined || sql.trim() === "") {
+    console.error(formatError({ message: "chant query needs a statement", hint: `${USAGE}, such as chant query "SELECT env, count(*) FROM resources GROUP BY env"` }));
+    return 1;
+  }
+  const cwd = resolve(args.positionals?.[1] ?? ".");
+  if (!existsSync(cwd)) {
+    console.error(formatError({ message: `${cwd} does not exist`, hint: USAGE }));
+    return 1;
+  }
+  const { loadQueryData, runQuery, formatQueryResult, QueryError } = await import("../../lifecycle/query");
+  try {
+    const load = await loadQueryData(await queryLedgers(cwd, args.members));
+    const result = await runQuery(sql, load);
+    if (args.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(formatQueryResult(result));
+      const bad = Object.entries(result.malformed).filter(([, n]) => n > 0);
+      if (bad.length > 0) console.error(formatWarning({ message: `left out what could not be read: ${bad.map(([t, n]) => `${n} in ${t}`).join(", ")}` }));
+    }
+    return 0;
+  } catch (err) {
+    if (err instanceof QueryError) {
+      console.error(formatError({ message: err.message, hint: USAGE }));
+      return 1;
+    }
+    throw err;
+  }
+}

package/src/cli/handlers/run.test.ts

@@ -46,7 +46,8 @@ vi.mock("../../config", async () => {
   const actual = await vi.importActual<typeof import("../../config")>("../../config");
   return { ...actual, loadChantConfig: (...args: unknown[]) => loadChantConfigMock(...args) };
 });
-vi.mock("../../components/auto-release", () => ({
+vi.mock("../../components/auto-release", async () => ({
+  ...(await vi.importActual<typeof import("../../components/auto-release")>("../../components/auto-release")),
   maybeRecordAutoRelease: (...args: unknown[]) => maybeRecordAutoReleaseMock(...args),
 }));
 vi.mock("../../components/manifest-persistence", () => ({

package/src/cli/handlers/run.ts

@@ -17,6 +17,7 @@ import { recordGateApproval } from "./operator";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format";
 import { parseParamFlags } from "../build-params-cli";
 import type { CommandContext } from "../registry";
+import { withComponentEndpoint } from "../component-endpoint";
 import { stewardBesideFor, stewardFormFor, stewardTurnLeaseName, DEFAULT_STEWARD_ENV, type StewardDeclaration } from "../../op/steward";
 import { holdBesideLease } from "../../op/steward-beside";
 import { acquireStewardTurn, STEWARD_TURN_WAIT_MS } from "../../op/operator";
@@ -29,11 +30,11 @@ import { ndjsonProgressSink } from "../../components/run-progress";
 import { findStoredRun, readRunEvents } from "../../run-event-store";
 import type { RunEvent } from "../../run-event";
 import { openCliRunEvents, refusesBothStreams, stdoutLine } from "../run-events";
-import { maybeRecordAutoRelease } from "../../components/auto-release";
+import { appliedDigestOf, extractRunDigest, maybeRecordAutoRelease, type AppliedDigest } from "../../components/auto-release";
 import { maybePersistBuildManifest } from "../../components/manifest-persistence";
 import { failedRunExitCode, type DriverComponentResult } from "../../components/driver";
 import { isComponentList, type ComponentRunPlan, type RunComponentsResult } from "../../components/cli-support";
-import { resolveCiRun, type ReleaseRecord, type RunOrigin } from "../../lifecycle/release-ledger";
+import { isApplyRecord, resolveCiRun, type ReleaseRecord, type RunOrigin } from "../../lifecycle/release-ledger";
 import { gateAdmission, gateApprover } from "../../components/promote";
 import { runOpGenerate } from "./run-generate";
 
@@ -935,10 +936,14 @@ export async function recordAutoReleasesForRun(
   releaseDigest?: string,
   /** #4222: the digest of the templates the release records for a component in `env`, for one that publishes no artifact. */
   templatesDigestOf?: (component: string) => string | null,
+  /** #4274: what a component that publishes no artifact applied (`appliedDigestOf`), so it is recorded too. */
+  appliedDigestOf?: (component: string) => AppliedDigest | null,
 ): Promise<ReleaseRecord[]> {
   const recorded: ReleaseRecord[] = [];
   for (const componentResult of results) {
     if (!componentResult.ok) continue;
+    // Hashed only for a component that promoted no artifact, the only one it is recorded for.
+    const applied = appliedDigestOf && !disabled && extractRunDigest(componentResult.records) === undefined ? appliedDigestOf(componentResult.component) : null;
     const outcome = await maybeRecordAutoRelease(
       {
         component: componentResult.component,
@@ -954,6 +959,7 @@ export async function recordAutoReleasesForRun(
         // #4043: the release the deploy was made under, when `--release` named one.
         ...(releaseDigest !== undefined ? { releaseDigest } : {}),
         ...(releaseDigest !== undefined && templatesDigestOf?.(componentResult.component) ? { templatesDigest: templatesDigestOf(componentResult.component)! } : {}),
+        ...(applied ? { appliedDigest: applied } : {}),
       },
       { disabled },
     );
@@ -1023,7 +1029,8 @@ export async function recordAutoReleasesForRun(
  * rather than loaded a second time.
  */
 export function runOpComponents(ctx: CommandContext): Promise<number> {
-  return withRecordingChoice(ctx, () => runComponentSelection(ctx));
+  // #4281: the components run against the environment's declared endpoint.
+  return withRecordingChoice(ctx, () => withComponentEndpoint(ctx, () => runComponentSelection(ctx)));
 }
 
 /**
@@ -1281,7 +1288,11 @@ async function runComponentSelection(ctx: CommandContext): Promise<number> {
     // #3955: a run that records nothing has no release to report either.
     const disabled = resolveAutoReleaseDisabled(config, ctx.args.noReleaseRecord) || ledgerRecordingOff();
     const templatesDigestOf = underRelease ? await releaseTemplatesDigestOf(underRelease.release, env) : undefined;
-    const recorded = await recordAutoReleasesForRun(result.run.results, env, release.runId, disabled, release.runOrigin, underRelease?.releaseDigest, templatesDigestOf);
+    // #4274: a component that publishes nothing is recorded by its deploy-input digest.
+    const appliedOf = result.components ? appliedDigestOf({ components: result.components, env, projectRoot: projectPath }) : undefined;
+    const recorded = await recordAutoReleasesForRun(result.run.results, env, release.runId, disabled, release.runOrigin, underRelease?.releaseDigest, templatesDigestOf, appliedOf);
+    // A generated promote job promotes artifacts; an apply has none to name.
+    const promotable = recorded.filter((r) => !isApplyRecord(r));
     if (underRelease) await warnOnArtifactMismatch(underRelease.release, recorded);
     // `--digest-file` (#2602): the releases this run recorded, one
     // `<component>=<digest>` line each, the form `chant components promote
@@ -1290,7 +1301,7 @@ async function runComponentSelection(ctx: CommandContext): Promise<number> {
     if (ctx.args.digestFile) {
       const digestPath = resolve(ctx.args.digestFile);
       mkdirSync(dirname(digestPath), { recursive: true });
-      writeFileSync(digestPath, recorded.map((r) => `${r.component}=${r.digest}\n`).join(""));
+      writeFileSync(digestPath, promotable.map((r) => `${r.component}=${r.digest}\n`).join(""));
     }
   }
 

package/src/cli/main.ts

@@ -173,6 +173,11 @@ Commands:
                         terms; --live or --at <ref> with --env <name> reads the
                         estate or a recorded snapshot; --show <attr>,
                         --check-live, --check-snapshot, --fail-on-drift)
+  query "<sql>" [dir]   Run one read-only SQL statement over chant/lifecycle:
+                        the resources and snapshots each lexicon observed, Op
+                        runs, gates, deploys, releases and cuts, loaded into
+                        node:sqlite (schema v1, listed in chant_schema).
+                        --member <name> keeps members; --json prints rows
   generate             Generate typed code from sources chant.config declares
                         (k8s.crds, helm.charts) into src/generated/<lexicon>/
                         (codegen.outDir); --check exits 1 when the committed
@@ -558,6 +563,15 @@ Ops:
                         applies it once, if .chant/overriders at base lists
                         --actor
 
+  lock <target>...      Lock targets for a pull request on chant/lifecycle
+                        (--pr <n>, --stage plan|apply|lock, --head <sha>,
+                        --by <who>, --gate <name>, --json). --from-report
+                        <pr-plan.json> locks the components a plan selected.
+                        --forge <kind> reads which holders are still open and
+                        posts chant/lock on --head. Exits 3 when another open
+                        pull request holds a target. --list prints the locks
+  unlock [<target>...]  Release the locks a pull request holds (--pr <n>,
+                        --gate <name>, --json)
   graph                 Show Op dependency graph (--stacks for cross-stack order,
                         --format ir|mermaid|dot|layout for the lint-gated graph IR,
                         a Mermaid flowchart, Graphviz DOT, or node positions;
@@ -1003,11 +1017,26 @@ Component release ledger + status:
                             report and note (--base <ref> --pr <n>
                             [--forge github|gitlab|forgejo] posts them);
                             applies nothing
+  components pr-post       Post the plan note and the chant/plan status
+                            from the report pr-plan --no-status wrote
+                            (--pr <n> --head <sha> --env <env> --forge
+                            <kind>), in a job that runs none of the
+                            change's code (#4295)
   components pr-record     On merge (#4168): plan the same members again,
                             store the change set and write the merge record
                             _merges/<commit>.json; applies and refuses
                             nothing, and a plan that differs from the
                             approved one sets a failing chant/record status
+  components pr-env        An environment per open pull request (#4298): up
+                            --base <ref> --pr <n> applies the change to pr-<n>,
+                            derived from ci.prEnvironment.template, once an
+                            approval of its plan stands (chant approve pr-<n>
+                            pr-env --plan <digest>); post --pr <n> --head
+                            <sha> keeps the record up --no-push handed on and
+                            posts the note; down --pr <n> tears down
+                            only what carries pr-<n>'s ownership marker; sweep
+                            tears down each one whose TTL passed or whose pull
+                            request closed. Never a release target
   components pr-apply      With --apply-on-merge: plan the same members again and apply
                             them only if an approval stands for that digest
                             (chant approve pr-<n> pr-apply --plan <digest>);
@@ -1201,7 +1230,8 @@ Options:
                         chant.config.ts's build.sandbox: true; #1045)
   --param <name=value>  (build, graph, run --components, components fan-out,
                         components promote, components rollback,
-                        components redeploy, release cut) Bind a
+                        components redeploy, components pr-env up,
+                        release cut) Bind a
                         declared build-time parameter (chant.config.ts's buildParams)
                         to a value, for source to read as params.<name>
                         (#1064) instead of process.env — repeatable.
@@ -1213,7 +1243,8 @@ Options:
                         chant.template.json declares instead (#2627).
   --params-file <path>  (build, graph, run --components, components fan-out,
                         components promote, components rollback,
-                        components redeploy, release cut) JSON file
+                        components redeploy, components pr-env up,
+                        release cut) JSON file
                         of { "name": value } build-time parameter values
                         (#1064). Second precedence, after --param.
                         init --from refuses it: pass --param instead.
@@ -1441,6 +1472,8 @@ export const commandRegistry: CommandDef[] = [
   { name: "describe", handler: runDescribe },
   { name: "explain", handler: runExplain },
   { name: "search", handler: runSearch },
+  // #4297 — SQL over the snapshots, runs, gates, deploys and releases on chant/lifecycle. Imported on first use.
+  { name: "query", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/query")).runQueryCommand(ctx) },
   // chant#2591 — `import --agents` and `audit` read chant.config statically
   // and never evaluate it (chant#2589 for audit, which audits code it must not run).
   { name: "import", handler: runImport, runsNoConfig: (args) => args.agents === true },
@@ -1524,6 +1557,9 @@ export const commandRegistry: CommandDef[] = [
   { name: "operator log", handler: runOperatorLog },
   { name: "operator", handler: runOperator },
   { name: "approve", handler: runApprove },
+  // #4293 — target locks a pull request holds on chant/lifecycle. Imported on first use.
+  { name: "lock", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/lock")).runLock(ctx) },
+  { name: "unlock", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/lock")).runUnlock(ctx) },
 
   { name: "graph", handler: runGraph },
   { name: "vendor", handler: runVendor },
@@ -1613,7 +1649,10 @@ export const commandRegistry: CommandDef[] = [
   // #3183 — the pull-request loop the generated CI runs. Imported on first use.
   { name: "components pr-plan", requiresPlugins: true, handler: async (ctx) => (await import("./handlers/pr")).runComponentsPrPlan(ctx) },
   { name: "components pr-apply", requiresPlugins: true, handler: async (ctx) => (await import("./handlers/pr")).runComponentsPrApply(ctx) },
+  // #4295: posts from the plan report in a job that runs none of the change's code, so it loads no plugins.
+  { name: "components pr-post", handler: async (ctx) => (await import("./handlers/pr")).runComponentsPrPost(ctx) },
   { name: "components pr-record", requiresPlugins: true, handler: async (ctx) => (await import("./handlers/pr")).runComponentsPrRecord(ctx) },
+  { name: "components pr-env", requiresPlugins: true, handler: async (ctx) => (await import("./handlers/pr-env")).runComponentsPrEnv(ctx) },
   { name: "components status", requiresPlugins: true, handler: runComponentsStatus },
   { name: "components release", handler: runComponentsReleaseRecord },
   { name: "components export", handler: runComponentsExport },

package/src/cli/parse-args.ts

@@ -43,6 +43,7 @@ const BOOLEAN_FLAGS = new Set([
   "--stacks",
   "--components",
   "--pr-build",
+  "--pr-env",
   "--up",
   "--down",
   "--include-dependents",
@@ -72,6 +73,7 @@ const BOOLEAN_FLAGS = new Set([
   "--in-place",
   "--require-runner-start",
   "--no-push",
+  "--list",
   "--no-require-review",
   "--expire",
   "--check-live",
@@ -396,11 +398,26 @@ export function parseArgs(args: string[]): ParsedArgs {
       if (!result.forge || result.forge.startsWith("-")) throw new Error("--forge needs a forge: --forge github|gitlab|forgejo");
     } else if (arg === "--require-review") {
       result.requireReview = true;
+    } else if (arg === "--list") {
+      // `chant lock --list` (#4293): print the target locks instead of taking any.
+      result.list = true;
+    } else if (arg === "--stage") {
+      // `chant lock --stage plan|apply|lock` (#4293): how the lock was taken.
+      result.lockStage = args[++i];
+      if (!result.lockStage || result.lockStage.startsWith("-")) throw new Error("--stage needs plan, apply or lock: --stage <stage>");
+    } else if (arg === "--from-report") {
+      // `chant lock --from-report <pr-plan.json>` (#4293): lock the components a pull-request report lists.
+      result.fromReport = args[++i];
+      if (!result.fromReport || result.fromReport.startsWith("-")) throw new Error("--from-report needs a report file: --from-report <pr-plan.json>");
     } else if (arg === "--report-url") {
       // `chant components pr-plan|pr-apply --report-url <url>` (#4007).
       const url = args[++i];
       if (!url || url.startsWith("-")) throw new Error("--report-url needs a URL: --report-url s3://<bucket>/<prefix> or file://<directory>");
       result.reportUrl = url;
+    } else if (arg === "--result") {
+      // `chant components pr-post --result <result>` (#4295): the plan job's own result, which fails the status when it failed.
+      result.planResult = args[++i];
+      if (!result.planResult || result.planResult.startsWith("-")) throw new Error("--result needs the plan job's result: --result success|failure|cancelled");
     } else if (arg === "--no-status") {
       // `chant ci run|serve --no-status` (#4097): post no commit status for the job.
       result.noStatus = true;
@@ -422,6 +439,9 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--apply-on-merge") {
       // `chant build --pr-loop --apply-on-merge` and `chant ci serve --apply-on-merge` (#4168): opt into applying on merge.
       result.applyOnMerge = true;
+    } else if (arg === "--pr-env") {
+      // `chant build --pr-loop --pr-env` (#4298): add the pull request environment's jobs.
+      result.prEnv = true;
     } else if (arg === "--pr-build") {
       // `chant build --pr-loop --pr-build` (#4088), and `chant ci run --pr-build` (#4094).
       result.prBuild = true;
@@ -864,8 +884,9 @@ export function parseArgs(args: string[]): ParsedArgs {
     } else if (arg === "--expire") {
       result.expire = true;
     } else if (arg === "--role") {
-      // #2508 — a role the approver holds, for a gate whose quorum names
-      // roles. Repeatable, and a comma list works too.
+      // #2508 — a role the approver claims, which a gate's policy sees. A
+      // quorum reads roles from .chant/trust.json at base instead (#4290).
+      // Repeatable, and a comma list works too.
       const value = args[++i] ?? "";
       result.roles = [...(result.roles ?? []), ...value.split(",").map((r) => r.trim()).filter(Boolean)];
     } else if (arg === "--agent") {

package/src/cli/registry.ts

@@ -302,6 +302,12 @@ export interface ParsedArgs {
    * pr-apply finds it from the commit through `--forge` when omitted.
    */
   pr?: number;
+  /** `chant lock --list` (#4293): print the target locks instead of taking any. */
+  list?: boolean;
+  /** `chant lock --stage plan|apply|lock` (#4293): how the lock is taken. Default `lock`. */
+  lockStage?: string;
+  /** `chant lock --from-report <file>` (#4293): lock the components a `pr-plan.json` lists. */
+  fromReport?: string;
   /** Every `--pr <n>`, in order: `chant release compose` (#4168 4.3) takes several. */
   prs?: number[];
   /** `chant release cut --channel <tag>` (#4168 4.3): the tag a publish of the release moves in place of `latest`. */
@@ -345,6 +351,8 @@ export interface ParsedArgs {
    * approved plans of the merges between or a gate of its own.
    */
   green?: boolean;
+  /** `chant build --pr-loop --pr-env` (#4298) — add the env-up, env-down and env-sweep jobs of a pull request's environment. */
+  prEnv?: boolean;
   /** `chant build --pr-loop --pr-build` (#4088) — build and lint before pr-plan and pr-apply. */
   prBuild?: boolean;
   /** `chant ci serve --build-command <line>` (#4169) — the line that builds a commit a `ci/build/<sha>` tag asks for, in a worktree of it. */
@@ -477,7 +485,7 @@ export interface ParsedArgs {
   records?: boolean;
   /** `chant workspace wip save --label <text>` (#3172): what the caller calls the snapshot, such as a turn id. */
   label?: string;
-  /** `chant workspace wip --branch <branch>` (#3172): list one branch's snapshots. */
+  /** `chant workspace wip --branch <branch>` (#3172): list one branch's snapshots. `chant components pr-apply|pr-record --branch <branch>` (#4292): the branch pushed, which `ci.branches` routes members by; default the forge's GITHUB_REF_NAME or CI_COMMIT_BRANCH. */
   branch?: string;
   /** `chant ci workflow --workflow <name>`, repeatable (#3573): a workflow whose completion triggers a tick, beside those the scan finds. Also `chant ci init --workflow <name>` (#4168 step 6), the prescribed workflow to set up. */
   ciWorkflows?: string[];
@@ -491,6 +499,8 @@ export interface ParsedArgs {
   ciSecrets?: string;
   /** `chant ci workflow --chant <command>` (#3573): the command the tick step runs chant with, in place of the npx pin. Also `chant ci run --chant` (#4094): what runs chant in the job. */
   ciChant?: string;
+  /** `chant components pr-post --result <result>` (#4295): the plan job's own result. `failure` or `cancelled` fails the `chant/plan` status. */
+  planResult?: string;
   /** `chant ci run|serve --no-status` (#4097): post no commit status for the job. `chant components pr-plan|pr-apply --no-status` (#4161): post neither the status nor the note. */
   noStatus?: boolean;
   /** `chant ci run|serve --status-url <template>` (#4097): the link a job's status carries. `{key}` is `<pr>/<commit>[/<member>]`, as `--report-url` keys it. */
@@ -737,7 +747,7 @@ export interface ParsedArgs {
    * on a model-authored channel.
    */
   allowSameOrigin?: boolean;
-  /** `chant approve --role <name>` (#2508) — roles the approver claims, for a gate whose quorum counts only some roles. Repeatable; a comma list also works. */
+  /** `chant approve --role <name>` (#2508) — roles the approver claims, which a gate's policy sees. A quorum never counts them (#4290): its roles come from `.chant/trust.json` at base. Repeatable; a comma list also works. */
   roles?: string[];
   /** `chant approve --agent` (#2508) — record the approval as an agent's. An agent never counts toward a quorum; it passes a gate only through a policy permit in `enforce` mode. */
   agent?: boolean;

package/src/components/auto-release-infra.test.ts

@@ -0,0 +1,131 @@
+/**
+ * #4274: a component that only deploys infrastructure gets a release record
+ * from `pr-apply` and `chant run --components`. Its digest is the plan digest
+ * its approval bound, or its deploy-input digest when nothing planned, and
+ * `digestKind` says which. Written into a workspace member's ledger, under
+ * the member's prefix on chant/lifecycle.
+ */
+
+import { afterAll, afterEach, beforeEach, describe, expect, test } from "vitest";
+import { spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { appliedDigestOf } from "./auto-release";
+import { recordAutoReleasesForRun } from "../cli/handlers/run";
+import { clearMemberLedgerCache } from "../lifecycle/member-ledger";
+import { readReleaseLedger } from "../lifecycle/release-ledger";
+import type { DriverComponent, DriverComponentResult } from "./driver";
+
+const scratch: string[] = [];
+afterAll(() => {
+  for (const d of scratch) rmSync(d, { recursive: true, force: true });
+});
+
+function git(args: string[], cwd: string): string {
+  const r = spawnSync("git", args, { cwd, encoding: "utf-8" });
+  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${r.stderr}`);
+  return r.stdout;
+}
+
+/** A workspace whose member `infra` deploys one CloudFormation template and publishes nothing. */
+function workspace(): { root: string; member: string } {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "chant-infra-record-")));
+  scratch.push(root);
+  const files: Record<string, string> = {
+    "chant.workspace.json": JSON.stringify({ name: "acme", schema: 1, members: [{ name: "infra", dir: "services/infra", kind: "chant" }] }),
+    "services/infra/chant.config.json": JSON.stringify({ lexicons: ["aws"] }),
+    "services/infra/dist/infra.template.json": JSON.stringify({ Resources: {} }),
+  };
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), text);
+  }
+  git(["init", "-q", "-b", "main"], root);
+  git(["config", "user.email", "test@chant.dev"], root);
+  git(["config", "user.name", "Test"], root);
+  git(["add", "-A"], root);
+  git(["commit", "-q", "-m", "init"], root);
+  return { root, member: join(root, "services/infra") };
+}
+
+const infra: DriverComponent = {
+  name: "infra",
+  deploy: [{ name: "Deploy", steps: [{ kind: "cfn-deploy", stackName: "infra", template: "dist/infra.template.json" }] }],
+} as unknown as DriverComponent;
+
+const applied = {
+  component: "infra",
+  ok: true,
+  status: "ok",
+  records: [{ component: "infra", phase: "Deploy", kind: "cfn-deploy", status: "ok", durationMs: 1, output: { stackId: "arn:aws:cloudformation:infra" } }],
+} as unknown as DriverComponentResult;
+
+const planDigest = `jcs1-sha256:${"a".repeat(64)}`;
+
+let cwd: string;
+beforeEach(() => {
+  cwd = process.cwd();
+  clearMemberLedgerCache();
+  process.env.GITHUB_ACTOR = "alice";
+});
+afterEach(() => {
+  process.chdir(cwd);
+  delete process.env.GITHUB_ACTOR;
+});
+
+describe("appliedDigestOf", () => {
+  test("a component with one planned member gets that member's plan digest", () => {
+    const of = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members: [{ member: "infra", component: "infra", planDigest }] });
+    expect(of("infra")).toEqual({ digest: planDigest, kind: "plan" });
+  });
+
+  test("a component with several planned members gets the set digest over them, the same whatever their order", () => {
+    const members = [
+      { member: "infra/a", component: "infra", planDigest },
+      { member: "infra/b", component: "infra", planDigest: `jcs1-sha256:${"b".repeat(64)}` },
+    ];
+    const one = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members })("infra");
+    const two = appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere", members: [...members].reverse() })("infra");
+    expect(one?.kind).toBe("plan");
+    expect(one?.digest).not.toBe(planDigest);
+    expect(two).toEqual(one);
+  });
+
+  test("a component that planned nothing gets its deploy-input digest, which moves with the template it deploys", () => {
+    const { member } = workspace();
+    const before = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member })("infra");
+    expect(before?.kind).toBe("deploy-input");
+    writeFileSync(join(member, "dist/infra.template.json"), JSON.stringify({ Resources: { Bucket: {} } }));
+    const after = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member })("infra");
+    expect(after?.kind).toBe("deploy-input");
+    expect(after?.digest).not.toBe(before?.digest);
+  });
+
+  test("a component the run doesn't know has none", () => {
+    expect(appliedDigestOf({ components: [infra], env: "staging", projectRoot: "/nowhere" })("other")).toBeNull();
+  });
+});
+
+describe("recordAutoReleasesForRun for an infrastructure-only component", () => {
+  test("a pr-apply records the plan digest under the member's prefix", async () => {
+    const { root, member } = workspace();
+    process.chdir(member);
+    const of = appliedDigestOf({ components: [infra], env: "staging", projectRoot: member, members: [{ member: "infra", component: "infra", planDigest }] });
+    const recorded = await recordAutoReleasesForRun([applied], "staging", "run-1", false, { forge: "local" }, undefined, undefined, of);
+    expect(recorded).toHaveLength(1);
+    expect(recorded[0]).toMatchObject({ component: "infra", env: "staging", digest: planDigest, digestKind: "plan", actor: "alice" });
+
+    const files = git(["ls-tree", "-r", "--name-only", "chant/lifecycle"], root).split("\n").filter(Boolean);
+    expect(files).toContain("_members/infra/staging/releases.jsonl");
+    const { records } = await readReleaseLedger("staging", { cwd: member });
+    expect(records).toEqual([expect.objectContaining({ digest: planDigest, digestKind: "plan" })]);
+  });
+
+  test("without an applied digest it records nothing, as before", async () => {
+    const { member } = workspace();
+    process.chdir(member);
+    const recorded = await recordAutoReleasesForRun([applied], "staging", "run-1", false);
+    expect(recorded).toEqual([]);
+  });
+});

package/src/components/auto-release.test.ts

@@ -181,7 +181,46 @@ describe("maybeRecordAutoRelease", () => {
     );
     expect(outcome).toMatchObject({ recorded: true });
     const [input] = appendReleaseRecordMock.mock.calls[0];
-    expect(input).toMatchObject({ digest: "sha256:tpl", releaseDigest: "sha256:rel" });
+    expect(input).toMatchObject({ digest: "sha256:tpl", releaseDigest: "sha256:rel", digestKind: "templates" });
+  });
+
+  test("#4274: a run that published nothing records what it applied, and says which digest that is", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "infra", env: "staging", digest: "sha256:plan", gitSha: "x", runId: "r", timestamp: "t", actor: "alice", digestKind: "plan" },
+    });
+    const outcome = await maybeRecordAutoRelease(
+      { component: "infra", env: "staging", success: true, records: [applyRecord()], runId: "run-1", appliedDigest: { digest: "sha256:plan", kind: "plan" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    expect(outcome).toMatchObject({ recorded: true });
+    expect(appendReleaseRecordMock.mock.calls[0][0]).toMatchObject({ digest: "sha256:plan", digestKind: "plan" });
+  });
+
+  test("#4274: an artifact digest wins over what the run applied, and carries no digestKind", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "svc", env: "prod", digest: "sha256:abc", gitSha: "x", runId: "r", timestamp: "t", actor: "alice" },
+    });
+    await maybeRecordAutoRelease(
+      { component: "svc", env: "prod", success: true, records: [publishRecord("sha256:abc")], runId: "run-1", appliedDigest: { digest: "sha256:in", kind: "deploy-input" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    const [input] = appendReleaseRecordMock.mock.calls[0];
+    expect(input).toMatchObject({ digest: "sha256:abc" });
+    expect(input).not.toHaveProperty("digestKind");
+  });
+
+  test("#4274: a templates digest under a release wins over what the run applied", async () => {
+    appendReleaseRecordMock.mockResolvedValue({
+      commit: "c".repeat(40),
+      record: { version: 1, component: "infra", env: "staging", digest: "sha256:tpl", gitSha: "x", runId: "r", timestamp: "t", actor: "alice" },
+    });
+    await maybeRecordAutoRelease(
+      { component: "infra", env: "staging", success: true, records: [applyRecord()], runId: "run-1", releaseDigest: "sha256:rel", templatesDigest: "sha256:tpl", appliedDigest: { digest: "sha256:in", kind: "deploy-input" } },
+      { actor: "alice", gitSha: "a".repeat(40) },
+    );
+    expect(appendReleaseRecordMock.mock.calls[0][0]).toMatchObject({ digest: "sha256:tpl", digestKind: "templates" });
   });
 
   test("#4222: a templates digest without a release is ignored", async () => {