@intentius/chant 0.124.39 → 0.124.41

package/src/components/pr-policy.ts

@@ -0,0 +1,211 @@
+/**
+ * Gate-time policy on the pull-request path (#4294): `ci.policy` in the
+ * workspace declaration, run by `chant components pr-plan` and `pr-apply`
+ * over the change-set document the gate binds (`CapabilityPlan.changeSet`,
+ * composed by `planPrSet`).
+ *
+ * The settings and the policy directory are both read at the base the job
+ * measures the change from, so a pull request cannot loosen, edit or delete
+ * the policy that judges it. The engine and its result shapes are
+ * `../gate-policy.ts`.
+ *
+ * - deny: pr-apply applies nothing unless an override counts
+ *   (`../override-gate.ts`, subject the gate's op, such as `pr-12`). The
+ *   first refusal records the denial on `_gates/policy-override.jsonl`, so
+ *   `chant approve policy-override <op> --rule <id> --reason <text>` can
+ *   answer it. The gate's own approval is still needed. The override is
+ *   spent just before anything applies.
+ * - hold: the plan needs a person's approval of its own digest. pr-apply
+ *   always asks for one, so a hold changes one path: a green commit's plan
+ *   no longer applies under the approvals of the merges it carries.
+ * - error: the policy did not run or gave no readable answer. pr-apply
+ *   applies nothing.
+ */
+
+import { readDeclaration, WorkspaceReadError } from "../workspace/declaration";
+import { locateWorkspace } from "../workspace/which-chant";
+import type { WorkspaceTree } from "../workspace/tree";
+import {
+  checkGatePolicy,
+  DEFAULT_POLICY_PATH,
+  exportGatePolicy,
+  type GatePolicyExec,
+  type GatePolicySettings,
+  type GatePolicyVerdict,
+} from "../gate-policy";
+import type { ChangeSetDocument } from "../change-set";
+import type { GateLedgerPort } from "../op/gate";
+import type { PrPolicyReport } from "../pr-loop";
+
+/** `ci.policy` as read at base. */
+export interface PrLoopPolicy {
+  /** Absent when the declaration at base sets none. */
+  settings?: GatePolicySettings;
+  /** The commit it was read at. */
+  base: string;
+  /** The tree of the declaration's directory at base, where the policy directory is read. */
+  tree?: WorkspaceTree;
+  /** A line for the log when no policy runs because the base has no declaration, or could not be read. */
+  note?: string;
+}
+
+/** Whether the working tree's declaration names a `ci.policy`. */
+function checkoutNamesPolicy(cwd: string): boolean {
+  try {
+    return readDeclaration(locateWorkspace(cwd).tree).ci?.policy !== undefined;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The policy a pull-request job in `cwd` runs, from the declaration at
+ * `base`. Throws when the declaration at base cannot be read and the
+ * working tree's names a policy: running none would let the change waive it.
+ */
+export function prLoopPolicyAt(cwd: string, base: string): PrLoopPolicy {
+  try {
+    const located = locateWorkspace(cwd, base);
+    const settings = readDeclaration(located.tree).ci?.policy;
+    return { base, ...(settings ? { settings, tree: located.tree } : {}) };
+  } catch (err) {
+    const missing = err instanceof WorkspaceReadError && (err.code === "declaration-missing" || err.code === "not-a-git-repository");
+    const why = err instanceof Error ? err.message : String(err);
+    if (checkoutNamesPolicy(cwd)) {
+      if (missing) return { base, note: `ci.policy: the base ${base.slice(0, 12)} has no workspace declaration, so the policy this change declares runs once it merges` };
+      throw new Error(`ci.policy is read from the workspace declaration at ${base.slice(0, 12)}, and it could not be read (${why}), so the policy cannot be run`);
+    }
+    return missing ? { base } : { base, note: `ci.policy: the declaration at ${base.slice(0, 12)} could not be read (${why}); this checkout names no policy, so none runs` };
+  }
+}
+
+/** What the engine reads as `input`. */
+export interface PrPolicyInput {
+  version: 1;
+  stage: "plan" | "apply";
+  /** The gate's op, `pr-<n>`. */
+  op: string;
+  gate: string;
+  env: string;
+  pr: number | null;
+  base: string;
+  head: string;
+  /** The change-set document the gate binds. Its `entries` are every change the plan proposes. */
+  changeSet: ChangeSetDocument;
+}
+
+/** Run the policy over `input`. Undefined when the base sets no policy. */
+export function runPrPolicy(read: PrLoopPolicy, input: PrPolicyInput, exec?: GatePolicyExec): GatePolicyVerdict | undefined {
+  if (!read.settings || !read.tree) return undefined;
+  const engine = read.settings.engine ?? "conftest";
+  const path = read.settings.path ?? DEFAULT_POLICY_PATH;
+  const exported = exportGatePolicy(read.tree, path);
+  if ("error" in exported) return { result: "error", engine, denials: [], rules: [], holds: [], warnings: [], error: exported.error };
+  try {
+    return checkGatePolicy({ settings: read.settings, input, policyDir: exported.dir, cwd: process.cwd(), ...(exec ? { exec } : {}) });
+  } finally {
+    exported.cleanup();
+  }
+}
+
+/** The verdict as the report keeps it. */
+export function prPolicyReport(verdict: GatePolicyVerdict, base: string): PrPolicyReport {
+  return {
+    result: verdict.result,
+    engine: verdict.engine,
+    base,
+    denials: verdict.denials,
+    ...(verdict.rules.length > 0 ? { rules: verdict.rules } : {}),
+    holds: verdict.holds,
+    warnings: verdict.warnings,
+    ...(verdict.error !== undefined ? { error: verdict.error } : {}),
+  };
+}
+
+export interface PrPolicyOverrideInput {
+  port: GateLedgerPort;
+  /** The override's subject: the gate's op. */
+  subject: string;
+  /** The digest the gate binds: the change-set document's. */
+  digest: string;
+  rules: readonly string[];
+  /** The commit the overriders and signers are read at. */
+  base: string;
+  cwd: string;
+  /** Count only sealed overrides, as a sealed gate counts only sealed approvals. */
+  sealed: boolean;
+  /** Record the denial when no override counts and none stands. The plan stage records nothing. */
+  record: boolean;
+  description?: string;
+  now?: string;
+}
+
+/** Where an override of a denial stands. */
+export type PrPolicyOverride =
+  | { status: "overridden"; override: NonNullable<PrPolicyReport["override"]> }
+  | { status: "none"; refusals: string[]; command: string; overriders: string[]; recorded: boolean; moved?: { by: string } };
+
+/**
+ * Decide a denied plan against the override ledger, as an Op waves job
+ * decides a denied run (`settleDenials` in `../op/op-waves-run.ts`).
+ */
+export async function decidePrPolicyOverride(input: PrPolicyOverrideInput): Promise<PrPolicyOverride> {
+  const og = await import("../override-gate");
+  const overriders = og.overridersAt(input.cwd, input.base).principals;
+  const signers = input.sealed ? (await import("../gate-decision")).gateSignersAt(input.cwd, input.base) : undefined;
+  const ledger = await input.port.read(og.OVERRIDE_OP);
+  const applied = ((await input.port.readApplied?.(og.OVERRIDE_OP)) ?? []) as unknown as import("../override-gate").AppliedOverrideRecord[];
+  const now = input.now ?? new Date().toISOString();
+  const verdict = og.decideOverride({
+    ledger,
+    applied,
+    subject: input.subject,
+    planDigest: input.digest,
+    rules: input.rules,
+    overriders,
+    mode: input.sealed ? "sealed" : "ledger",
+    ...(signers ? { signers } : {}),
+    now,
+  });
+  if (verdict.status === "overridden") {
+    const o = verdict.override;
+    return { status: "overridden", override: { by: o.by, at: o.at, reason: o.reason, digest: o.digest } };
+  }
+  let recorded = false;
+  if (input.record && !verdict.standing) {
+    const { version: _v, kind: _k, ...fact } = og.overridePending({
+      subject: input.subject,
+      planDigest: input.digest,
+      rules: input.rules,
+      timestamp: now,
+      expiresAt: new Date(new Date(now).getTime() + 48 * 3600 * 1000).toISOString(),
+      ...(input.description ? { description: input.description } : {}),
+    });
+    await input.port.appendPending(fact);
+    recorded = true;
+  }
+  return {
+    status: "none",
+    refusals: verdict.refusals,
+    command: og.overrideCommand(input.subject, input.rules, input.sealed),
+    overriders,
+    recorded,
+    ...(verdict.status === "moved" ? { moved: { by: verdict.by } } : {}),
+  };
+}
+
+/**
+ * Spend the override the apply runs under: append its applied record before
+ * anything applies. Throws when it could not be written or did not reach the
+ * remote, and the caller applies nothing.
+ */
+export async function spendPrPolicyOverride(port: GateLedgerPort, subject: string, override: NonNullable<PrPolicyReport["override"]>, at: { now?: string; commit?: string } = {}): Promise<void> {
+  const og = await import("../override-gate");
+  if (!port.appendApplied) throw new Error("this gate ledger cannot record an applied override");
+  const record = og.appliedOverride({ subject, digest: override.digest, at: override.at, by: override.by }, { timestamp: at.now ?? new Date().toISOString(), ...(at.commit ? { commit: at.commit } : {}) });
+  const pushed = await port.appendApplied(record as unknown as Parameters<NonNullable<GateLedgerPort["appendApplied"]>>[0]);
+  const { isLifecycleLocalNote } = await import("../lifecycle/local-note");
+  if (!pushed.pushed && !isLifecycleLocalNote(pushed.pushWarning)) {
+    throw new Error(`the applied record did not reach the remote the next run reads: ${pushed.pushWarning ?? "the push did not land"}`);
+  }
+}

package/src/components/pr-run.ts

@@ -514,7 +514,7 @@ export async function applyPrSet(options: PrApplyOptions): Promise<PrApplyResult
 
   const completed = new Set(run.completed);
   const held = new Map((run.held ?? []).map((h) => [h.component, h]));
-  const blocked = new Set(run.blocked.map((b) => b.component));
+  const blocked = new Map(run.blocked.map((b) => [b.component, b.blockedBy]));
   const errorOf = (component: string): string | undefined => {
     const result = [...run.results].reverse().find((r) => r.component === component);
     if (result?.status === "gated") return `stopped at its own gate ${result.gate?.gate ?? ""}`.trim();
@@ -529,7 +529,10 @@ export async function applyPrSet(options: PrApplyOptions): Promise<PrApplyResult
     const h = held.get(m.component);
     if (h) return { ...asPlanned, status: "waiting", held: h.heldBy ? `${h.heldBy} is held: ${h.reason}` : h.reason };
     if (fresh?.status === "plan-failed") return { ...asPlanned, status: "plan-failed", ...(fresh.error ? { error: fresh.error } : {}) };
-    if (blocked.has(m.component)) return { ...asPlanned, status: "blocked" };
+    if (blocked.has(m.component)) {
+      const by = blocked.get(m.component);
+      return { ...asPlanned, status: "blocked", ...(by ? { blockedBy: by } : {}) };
+    }
     const error = errorOf(m.component);
     return { ...asPlanned, status: "failed", ...(error ? { error } : {}) };
   });

package/src/components/promote.test.ts

@@ -108,6 +108,45 @@ describe("planning", () => {
   });
 });
 
+describe("records of an apply, not an artifact (#4274)", () => {
+  const apply = (component: string, timestamp: string, digestKind: "plan" | "deploy-input" = "plan"): ReleaseRecord => ({
+    ...rec(component, "staging", `jcs1-sha256:${timestamp.slice(0, 10)}`, timestamp),
+    digestKind,
+  });
+  const records = [
+    rec("api", "staging", "sha256:api", "2026-01-02T00:00:00Z"),
+    apply("infra", "2026-01-02T00:00:00Z"),
+    apply("infra", "2026-01-03T00:00:00Z", "deploy-input"),
+  ];
+
+  test("promoting every component leaves an infrastructure component out and says why", () => {
+    const plan = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared: ["api", "infra"] }) as PromotionPlan;
+    expect(plan.items.map((i) => i.component)).toEqual(["api"]);
+    expect(plan.notPromoted).toEqual([{ component: "infra", reason: expect.stringMatching(/only applies are recorded/) }]);
+  });
+
+  test("a newer apply never hides the artifact release before it", () => {
+    const mixed = [rec("api", "staging", "sha256:api", "2026-01-01T00:00:00Z"), apply("api", "2026-01-05T00:00:00Z")];
+    const picked = selectRelease(mixed, "api", "staging");
+    expect("record" in picked && picked.record.digest).toBe("sha256:api");
+  });
+
+  test("promote, rollback and redeploy of a component with only applies are refused by name", () => {
+    const promote = planPromotion({ from: "staging", to: "prod", sourceRecords: records, declared: ["api", "infra"], component: "infra" });
+    expect("error" in promote && promote.error).toMatch(/"infra" has only applies recorded in "staging"/);
+    const rollback = planRollback({ env: "staging", records, declared: ["infra"], component: "infra" });
+    expect("error" in rollback && rollback.error).toMatch(/only applies recorded/);
+    const redeploy = planRedeploy({ env: "staging", records, declared: ["infra"], component: "infra" });
+    expect("error" in redeploy && redeploy.error).toMatch(/only applies recorded/);
+  });
+
+  test("a rollback or redeploy carries a templates digest's kind forward", () => {
+    const source: ReleaseRecord = { ...rec("infra", "staging", "sha256:tpl", "2026-01-02T00:00:00Z"), digestKind: "templates" };
+    const run = { runId: "r2", actor: "ci", timestamp: "2026-01-04T00:00:00Z" };
+    expect(rollbackRecord({ component: "infra", digest: "sha256:tpl", source }, "staging", run)).toMatchObject({ digestKind: "templates" });
+  });
+});
+
 describe("pinning each component to a digest (#2602)", () => {
   // api's pinned release is older than its latest one: another pipeline
   // recorded sha256:newer while this one ran.

package/src/components/promote.ts

@@ -39,7 +39,7 @@
  */
 
 import { parseWiringRef, type WiringRef } from "../lint/rules/comp/support";
-import { latestPerComponent, type ReleaseRecord, type ReleaseRecordInput, type ReleaseAdmission, type RunOrigin } from "../lifecycle/release-ledger";
+import { isApplyRecord, latestPerComponent, type ReleaseRecord, type ReleaseRecordInput, type ReleaseAdmission, type RunOrigin } from "../lifecycle/release-ledger";
 import { CapabilityRegistry, type Capability } from "./capability";
 import {
   runInterpretDriver,
@@ -109,19 +109,35 @@ export function selectRelease(
   env: string,
   digest?: string,
 ): { record: ReleaseRecord } | { error: string } {
-  const own = records.filter((r) => r.component === component);
-  if (own.length === 0) return { error: `no release of "${component}" is recorded in "${env}"` };
-  if (digest === undefined) return { record: latestPerComponent(own).get(component)! };
-  const matching = own.filter((r) => r.digest === digest);
+  const own = deployableRecords(records, component, env);
+  if ("error" in own) return own;
+  if (digest === undefined) return { record: latestPerComponent(own.records).get(component)! };
+  const matching = own.records.filter((r) => r.digest === digest);
   if (matching.length === 0) {
     return {
       error: `digest ${digest} is not recorded for "${component}" in "${env}"; ` +
-        `its recorded digests are ${[...new Set(own.map((r) => r.digest))].join(", ")}`,
+        `its recorded digests are ${[...new Set(own.records.map((r) => r.digest))].join(", ")}`,
     };
   }
   return { record: latestPerComponent(matching).get(component)! };
 }
 
+/**
+ * The records of `component` a promote, rollback or redeploy can deploy from
+ * (#4274): every one but those that only say it applied ({@link isApplyRecord}),
+ * whose digest is a plan or deploy-input digest and names no artifact.
+ */
+function deployableRecords(records: ReleaseRecord[], component: string, env: string): { records: ReleaseRecord[] } | { error: string } {
+  const own = records.filter((r) => r.component === component);
+  if (own.length === 0) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = own.filter((r) => !isApplyRecord(r));
+  if (deployable.length === 0) return { error: appliesOnly(component, env) };
+  return { records: deployable };
+}
+
+const appliesOnly = (component: string, env: string): string =>
+  `"${component}" has only applies recorded in "${env}", each by a plan or deploy-input digest, so no artifact of it can be deployed again`;
+
 /**
  * Read `--digest <component>=<digest>` values (#2602) into a component-to-
  * digest map. A value with no `=` is left to the single-component form
@@ -198,13 +214,17 @@ export function planPromotion(input: {
     return { from, to, items: [{ component, digest: picked.record.digest, source: picked.record }], notPromoted: [] };
   }
 
-  const latest = latestPerComponent(sourceRecords);
+  const latest = latestPerComponent(sourceRecords.filter((r) => !isApplyRecord(r)));
   const items: PromotionItem[] = [];
   const notPromoted: PromotionPlan["notPromoted"] = [];
   for (const [name, record] of [...latest].sort(([a], [b]) => a.localeCompare(b))) {
     if (declared.includes(name)) items.push({ component: name, digest: record.digest, source: record });
     else notPromoted.push({ component: name, reason: "recorded but not declared in this checkout" });
   }
+  // #4274: a component that only applied (infrastructure, no artifact) has nothing to promote.
+  for (const name of [...new Set(sourceRecords.filter((r) => isApplyRecord(r) && !latest.has(r.component)).map((r) => r.component))].sort()) {
+    notPromoted.push({ component: name, reason: "only applies are recorded, by a plan or deploy-input digest; there is no artifact to promote" });
+  }
   if (items.length === 0) {
     return { error: `nothing to promote: no component declared here has a release recorded in "${from}"` };
   }
@@ -228,9 +248,10 @@ export function planRollback(input: {
   if (!declared.includes(component)) {
     return { error: `component "${component}" is not declared in this checkout` };
   }
-  const own = records.filter((r) => r.component === component);
-  const current = latestPerComponent(own).get(component);
-  if (!current) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = deployableRecords(records, component, env);
+  if ("error" in deployable) return deployable;
+  const own = deployable.records;
+  const current = latestPerComponent(own).get(component)!;
 
   let target: ReleaseRecord;
   if (digest !== undefined) {
@@ -284,7 +305,7 @@ export function planReleaseRollback(input: {
       notPromoted.push({ component, reason: `in release ${name} but not declared in this checkout` });
       continue;
     }
-    const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest);
+    const ran = records.filter((r) => r.component === component && r.releaseDigest === release.releaseDigest && !isApplyRecord(r));
     if (ran.length === 0) {
       neverRan.push(component);
       continue;
@@ -299,7 +320,7 @@ export function planReleaseRollback(input: {
     };
   }
   if (items.length === 0) return { error: `release ${name} has no component declared in this checkout` };
-  const current = latestPerComponent(records);
+  const current = latestPerComponent(records.filter((r) => !isApplyRecord(r)));
   const already = items.every((i) => {
     const now = current.get(i.component);
     return now !== undefined && now.releaseDigest === release.releaseDigest && now.digest === i.digest && !input.unsettled?.has(i.component);
@@ -329,8 +350,9 @@ export function planRedeploy(input: {
   if (!declared.includes(component)) {
     return { error: `component "${component}" is not declared in this checkout` };
   }
-  const current = latestPerComponent(records.filter((r) => r.component === component)).get(component);
-  if (!current) return { error: `no release of "${component}" is recorded in "${env}"` };
+  const deployable = deployableRecords(records, component, env);
+  if ("error" in deployable) return deployable;
+  const current = latestPerComponent(deployable.records).get(component)!;
   if (digest !== undefined && digest !== current.digest) {
     return {
       error: `${digest} is not the current release of "${component}" in "${env}" (that is ${current.digest}); ` +
@@ -699,6 +721,8 @@ function sharedRecord(item: PromotionItem, env: string, run: DeployRunInfo): Rel
     ...(run.admission ? { admission: run.admission } : {}),
     ...(source.manifestDigest ? { manifestDigest: source.manifestDigest } : {}),
     ...(source.inputDigest ? { inputDigest: source.inputDigest } : {}),
+    // #4274: a release's templates digest stays one when it is deployed again.
+    ...(source.digestKind ? { digestKind: source.digestKind } : {}),
   };
 }
 

package/src/gate-decision-bundle.test.ts

@@ -41,20 +41,21 @@ describe("the gate-decision bundle", () => {
       "packages/core/src/intrinsic.ts",
       "packages/core/src/lifecycle/gate-applied.ts",
       "packages/core/src/lifecycle/gate-ledger-select.ts",
+      "packages/core/src/lifecycle/gate-seal.ts",
       "packages/core/src/lifecycle/plan-digest.ts",
       "packages/core/src/notify-verify.ts",
       "packages/core/src/notify.ts",
       "packages/core/src/op/gate-point.ts",
+      "packages/core/src/op/gate-quorum.ts",
       "packages/core/src/op/op-waves.ts",
       "packages/core/src/wave-layout.ts",
       "packages/core/src/workspace/class-data.ts",
       "packages/core/src/workspace/identity-gate-rule.ts",
       "packages/core/src/workspace/jsonc.ts",
-      "packages/core/src/workspace/trust/gate-seal.ts",
       "packages/core/src/workspace/trust/trust-files.ts",
     ]);
-    // About 43 KB unminified today, 7 KB of it the pinned classes read as data (#3888).
+    // About 49 KB unminified today: 7 KB of it the pinned classes read as data (#3888), 6 KB the approval rules (#4290).
     const bytes = result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0);
-    expect(bytes).toBeLessThan(48 * 1024);
+    expect(bytes).toBeLessThan(54 * 1024);
   });
 });

package/src/gate-decision.ts

@@ -27,6 +27,11 @@
  * counts for nothing, as terragucci's wave gate has it: the caller hands in
  * the lines of `_gates/<op>/applied.jsonl` ({@link parseAppliedGateLines}).
  *
+ * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
+ * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
+ * {@link trustRolesAt} and {@link gateSignersAt} read what
+ * `trustQuorumJudge` judges by, at base.
+ *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
  * fold or codegen module, no package's code, and none of chant's git ledger
@@ -46,7 +51,7 @@ import {
 } from "./lifecycle/gate-ledger-select";
 import { samePlanDigest } from "./lifecycle/plan-digest";
 import { isApprovalSpent, type AppliedGateRecord } from "./lifecycle/gate-applied";
-import { gateSealRefusal, type GateSigners, type SealedGateApproval } from "./workspace/trust/gate-seal";
+import { gateSealRefusal, type GateSigners, type SealedGateApproval } from "./lifecycle/gate-seal";
 import {
   DEFAULT_SIGNERS_PATH,
   TRUST_CONFIG_PATH,
@@ -79,7 +84,7 @@ export {
   type GateSigners,
   type SealedGateApproval,
   type SshSignatureCheck,
-} from "./workspace/trust/gate-seal";
+} from "./lifecycle/gate-seal";
 export {
   DEFAULT_SIGNERS_PATH,
   TRUST_CONFIG_PATH,
@@ -105,6 +110,28 @@ export {
   type AppliedGateRecord,
 } from "./lifecycle/gate-applied";
 export type { MergedReview } from "./op/gate-review";
+export {
+  quorumNeed,
+  quorumProblems,
+  quorumRuleLine,
+  quorumRuleProgress,
+  quorumRules,
+  quorumRulesFor,
+  quorumWaiting,
+  rolesOf,
+  ruleNeedsProof,
+  samePrincipal,
+  targetGlobMatch,
+  trustQuorumJudge,
+  UNPROVEN_JUDGE,
+  type GateQuorumJudge,
+  type GateQuorumRule,
+  type GateQuorumRuleProgress,
+  type GateQuorumSpec,
+  type QuorumApprover,
+  type QuorumJudgement,
+  type TrustQuorumInput,
+} from "./op/gate-quorum";
 
 // ── reading at base ──────────────────────────────────────────────────────
 
@@ -172,6 +199,16 @@ export function gateSignersAt(repo: string, base: string): GateSigners {
   return trustAt(repo, base).signers;
 }
 
+/**
+ * The role grants of `.chant/trust.json` at `base` (#4290): role name to the
+ * principals that hold it, as chant reads them. A missing file gives none,
+ * and so does one that is not valid, which turns chant's trust off.
+ * {@link trustQuorumJudge} takes them with {@link gateSignersAt}'s signers.
+ */
+export function trustRolesAt(repo: string, base: string): Record<string, string[]> {
+  return trustAt(repo, base).roles;
+}
+
 /** A gate the declaration at base names under `identity.gates`, and the principal class its signer must be in, if any. */
 export interface IdentityGate {
   gate: string;

package/src/gate-policy-bundle.test.ts

@@ -0,0 +1,28 @@
+/**
+ * The gate policy bundles alone (#4294), as the override gate does: a
+ * product runs the engine and reads its answer from one bundled file with
+ * no TypeScript toolchain. This bundles `@intentius/chant/gate-policy` and
+ * reads esbuild's list of what went in.
+ */
+
+import { join } from "node:path";
+import { build } from "esbuild";
+import { describe, expect, test } from "vitest";
+import { REPO } from "./workspace/__fixtures__/contract-repo";
+
+describe("the gate-policy bundle", () => {
+  test("holds the policy module and nothing else", async () => {
+    const result = await build({
+      entryPoints: [join(REPO, "packages", "core", "src", "gate-policy.ts")],
+      bundle: true,
+      platform: "node",
+      format: "esm",
+      write: false,
+      metafile: true,
+      outdir: "out",
+      logLevel: "silent",
+    });
+    expect(Object.keys(result.metafile.inputs).map((i) => i.replace(/^.*?packages\//, "packages/"))).toEqual(["packages/core/src/gate-policy.ts"]);
+    expect(result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0)).toBeLessThan(16 * 1024);
+  });
+});