@intentius/chant 0.124.39 → 0.124.41

package/src/op/gate-alias.test.ts

@@ -14,7 +14,7 @@ import { runOpLocally } from "./local-executor";
 import { renderHuman } from "./local-output";
 import { stepOutput } from "./step-output-ref";
 import { parseGateLedger, type GateResolutionRecord, type PendingGateRecord } from "../lifecycle/gate-ledger";
-import { gateSealPayload, gateSealVersion } from "../workspace/trust/gate-seal";
+import { gateSealPayload, gateSealVersion } from "../lifecycle/gate-seal";
 import { deriveGateAudit } from "../lifecycle/gate-audit";
 import type { AppliedGateRecord } from "../lifecycle/gate-applied";
 import type { ActivityFn } from "./activity-registry";
@@ -232,7 +232,7 @@ describe("old and new approvals add up toward one quorum", () => {
     });
     const check = await evaluateGate(port, input(quorum));
     expect(check.satisfied).toBe(false);
-    expect(!check.satisfied && check.quorum).toEqual({ approvers: ["alice"], need: 2 });
+    expect(!check.satisfied && check.quorum).toMatchObject({ approvers: ["alice"], need: 2 });
     expect(port.resolved).toHaveLength(0);
   });
 

package/src/op/gate-approval.test.ts

@@ -12,6 +12,7 @@ import { describeApprovalProgress } from "../cli/handlers/operator";
 import { gate } from "./builders";
 import { gateApprovalProblems, gateContextDigest, gatePolicyRequest, gatePolicyVersion, type GatePolicyRef, type ResolvedGateApproval } from "./gate-approval";
 import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger";
+import { rolesOf, type GateQuorumJudge } from "./gate-quorum";
 
 const PLAN_A = `sha256:${"a".repeat(64)}`;
 const PLAN_B = `sha256:${"b".repeat(64)}`;
@@ -33,9 +34,16 @@ function allow(mode: "log-only" | "enforce" = "enforce", context: Record<string,
   return { policy: "ship", version: POLICY.version, mode, contextDigest: gateContextDigest(context), decision: "allow", determining: ["ship-0"], errors: [] };
 }
 
-async function decide(resolutions: GateResolutionRecord[], approvalBlock: ResolvedGateApproval, planDigest = PLAN_A) {
+/**
+ * #4290: roles come from .chant/trust.json at base, for a proven approver.
+ * The tests' judge proves everyone and grants these roles.
+ */
+const ROLES: Record<string, string[]> = { maintainer: ["alex", "sam"], sre: ["sam"], viewer: ["pat"] };
+const provenJudge: GateQuorumJudge = (r) => ({ proven: true, roles: rolesOf(r.resolvedBy, ROLES) });
+
+async function decide(resolutions: GateResolutionRecord[], approvalBlock: ResolvedGateApproval, planDigest = PLAN_A, judge: GateQuorumJudge = provenJudge) {
   const port = memoryGateLedgerPort({ resolutions, pending: [{ ...PENDING, approval: approvalBlock, planDigest }] });
-  const check = await evaluateGate(port, { op: "release", gate: "ship", planDigest, approval: approvalBlock, now: NOW });
+  const check = await evaluateGate(port, { op: "release", gate: "ship", planDigest, approval: approvalBlock, now: NOW, judge });
   return { check, port };
 }
 
@@ -49,7 +57,7 @@ describe("gate approval — quorum (#2508)", () => {
     );
     expect(check.satisfied).toBe(false);
     if (check.satisfied) return;
-    expect(check.quorum).toEqual({ approvers: ["alex"], need: 2 });
+    expect(check.quorum).toMatchObject({ approvers: ["alex"], need: 2 });
     // The standing fact still describes this gate, so nothing new is appended.
     expect(check.recorded).toBe(false);
     expect(port.appended).toHaveLength(0);
@@ -107,10 +115,23 @@ describe("gate approval — quorum (#2508)", () => {
     if (check.satisfied) return;
     expect(check.mismatch?.approved).toBe(PLAN_A);
     expect(check.mismatch?.planned).toBe(PLAN_B);
-    expect(check.quorum).toEqual({ approvers: [], need: 2 });
+    expect(check.quorum).toMatchObject({ approvers: [], need: 2 });
     expect(port.appended).toHaveLength(0);
   });
 
+  test("#4290: a role the approver claims never counts; only trust.json's grant to a proven approver does", async () => {
+    const claimed = [
+      approval({ resolvedBy: "pat", timestamp: "2026-09-01T01:00:00.000Z", approver: { kind: "human", roles: ["maintainer"] } }),
+      approval({ resolvedBy: "kim", timestamp: "2026-09-01T02:00:00.000Z", approver: { kind: "human", roles: ["maintainer"] } }),
+    ];
+    expect((await decide(claimed, twoMaintainers)).check.satisfied).toBe(false);
+    // alex and sam hold the role at base, and nothing proves them.
+    const unproven: GateQuorumJudge = (r) => ({ proven: false, roles: rolesOf(r.resolvedBy, ROLES) });
+    const granted = [approval({ resolvedBy: "alex", timestamp: "2026-09-01T01:00:00.000Z" }), approval({ resolvedBy: "sam", timestamp: "2026-09-01T02:00:00.000Z" })];
+    expect((await decide(granted, twoMaintainers, PLAN_A, unproven)).check.satisfied).toBe(false);
+    expect((await decide(granted, twoMaintainers)).check.satisfied).toBe(true);
+  });
+
   // #2547: a gate still pending, and an approval given, under the bare sha256: prefix
   // keep working once the run computes the same plan's digest as jcs1-sha256:.
   test("a pending gate and an approval recorded under the bare prefix match the jcs1 digest of the same plan", async () => {
@@ -153,7 +174,7 @@ describe("gate approval — policy decisions (#2508)", () => {
     );
     expect(check.satisfied).toBe(false);
     if (check.satisfied) return;
-    expect(check.quorum).toEqual({ approvers: [], need: 1 });
+    expect(check.quorum).toMatchObject({ approvers: [], need: 1 });
   });
 
   test("log-only: a human's approval passes even when the policy recorded a deny", async () => {
@@ -339,7 +360,7 @@ describe("gate approval — a re-recorded pending fact keeps a partly filled quo
     expect(first.satisfied).toBe(false);
     if (first.satisfied) return;
     expect(first.recorded).toBe(true);
-    expect(first.quorum).toEqual({ approvers: ["alex"], need: 2 });
+    expect(first.quorum).toMatchObject({ approvers: ["alex"], need: 2 });
 
     expect(after.satisfied).toBe(true);
     if (!after.satisfied) return;
@@ -356,7 +377,7 @@ describe("gate approval — a re-recorded pending fact keeps a partly filled quo
     const { after } = await switchThenApprove(twoLogOnly, twoEnforce, []);
     expect(after.satisfied).toBe(false);
     if (after.satisfied) return;
-    expect(after.quorum).toEqual({ approvers: ["alex"], need: 2 });
+    expect(after.quorum).toMatchObject({ approvers: ["alex"], need: 2 });
   });
 
   test("a changed policy version starts the count again", async () => {
@@ -365,7 +386,7 @@ describe("gate approval — a re-recorded pending fact keeps a partly filled quo
     const { after } = await switchThenApprove(twoLogOnly, { ...twoLogOnly, policy: edited }, [sam]);
     expect(after.satisfied).toBe(false);
     if (after.satisfied) return;
-    expect(after.quorum).toEqual({ approvers: ["sam"], need: 2 });
+    expect(after.quorum).toMatchObject({ approvers: ["sam"], need: 2 });
   });
 
   test("a fact for another plan in between starts the count again", async () => {
@@ -497,7 +518,7 @@ describe("gate approval — the request a policy is asked (#2508)", () => {
 describe("gate approval — the approval block is checked where it is written (#2508)", () => {
   test("a well-formed block passes, and lands on the step", () => {
     const step = gate("ship", { approval: { quorum: { count: 2, roles: ["maintainer"] }, policy: POLICY, mode: "enforce", context: { risk: "low" } } });
-    expect(step.approval?.quorum?.count).toBe(2);
+    expect((step.approval?.quorum as { count: number } | undefined)?.count).toBe(2);
     expect(gateApprovalProblems(step.approval)).toEqual([]);
   });
 

package/src/op/gate-approval.ts

@@ -5,7 +5,9 @@
  * more than that, as data that survives into the build output:
  *
  * - `quorum`: how many distinct human approvers the gate needs, and
- *   optionally which roles count toward it.
+ *   optionally which roles count toward it. Since #4290 it may be a list of
+ *   rules, each scoped by `targets` globs over the run's environment
+ *   (`./gate-quorum.ts`).
  * - `policy`: a policy set a lexicon rendered (the cedar lexicon's
  *   `gatePolicy()`), evaluated for each approval as a `PassGate` request.
  * - `mode`: `"log-only"` records the policy's decision next to the approval
@@ -30,15 +32,20 @@
  * decision also records the digest of the context it was asked about, and a
  * permit counts only while the run resolves that same context (#3774).
  *
- * The trust boundary is unchanged from `../lifecycle/gate-ledger.ts`: a
- * resolution is a local fact, not a signed one, and roles on it are what the
- * approver claimed.
+ * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
+ * Roles on it are what the approver claimed, and since #4290 the quorum
+ * never reads them: a role counts only when `.chant/trust.json` at base
+ * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
+ * still sees the claimed roles in its request.
  */
 
 import { createHash } from "node:crypto";
 import { lexiconModulePath, importLexiconPackage } from "../lexicon-module";
 import { isStepOutputRef, type StepOutputRef } from "./step-output-ref";
 import { GATE_PLAN_CONTEXT_KEY } from "./gate-plan-context";
+import { quorumProblems, type GateQuorumRule, type GateQuorumSpec } from "./gate-quorum";
+
+export type { GateQuorumRule, GateQuorumSpec } from "./gate-quorum";
 
 /** What a policy's decision does to the gate. */
 export type GateApprovalMode = "log-only" | "enforce";
@@ -62,20 +69,20 @@ export interface GatePolicyRef {
   text: string;
 }
 
-/** How many distinct human approvers a gate needs, and which roles count. */
-export interface GateQuorum {
-  /** At least 1. */
-  count: number;
-  /** When set, only an approver holding one of these roles counts toward {@link GateQuorum.count}. */
-  roles?: string[];
-}
+/**
+ * How many distinct human approvers a gate needs, and which roles count: one
+ * approval rule (#4290, `./gate-quorum.ts`). A role counts only when
+ * `.chant/trust.json` at base grants it to a proven approver.
+ */
+export type GateQuorum = GateQuorumRule;
 
 /** A value a gate hands its policy as context. */
 export type GateContextValue = string | number | boolean | string[] | StepOutputRef;
 
 /** The `approval` block on a `gate` step. */
 export interface GateApproval {
-  quorum?: GateQuorum;
+  /** One rule, or a list of rules scoped by `targets` over the run's environment (#4290). */
+  quorum?: GateQuorumSpec;
   policy?: GatePolicyRef;
   /** Default `"log-only"`, so a new policy is observed against real gate traffic before it binds. */
   mode?: GateApprovalMode;
@@ -96,7 +103,8 @@ export interface GateApproval {
  * actually produced.
  */
 export interface ResolvedGateApproval {
-  quorum?: GateQuorum;
+  /** The rules this run's gate takes (#4290): a list, or one rule on a fact written before. */
+  quorum?: GateQuorumSpec;
   policy?: GatePolicyRef;
   mode: GateApprovalMode;
   context?: Record<string, unknown>;
@@ -197,19 +205,8 @@ export function gateApprovalProblems(approval: unknown): string[] {
   const problems: string[] = [];
 
   if (a.quorum !== undefined) {
-    const q = a.quorum as Record<string, unknown> | null;
-    if (typeof q !== "object" || q === null) {
-      problems.push("`approval.quorum` must be an object");
-    } else {
-      if (typeof q.count !== "number" || !Number.isInteger(q.count) || q.count < 1) {
-        problems.push("`approval.quorum.count` must be an integer of at least 1");
-      }
-      if (q.roles !== undefined) {
-        if (!Array.isArray(q.roles) || q.roles.length === 0 || q.roles.some((r) => typeof r !== "string" || r === "")) {
-          problems.push("`approval.quorum.roles` must be a non-empty list of role names");
-        }
-      }
-    }
+    if (typeof a.quorum !== "object" || a.quorum === null) problems.push("`approval.quorum` must be an object or a list of rules");
+    else problems.push(...quorumProblems(a.quorum, "approval.quorum", { notAuthor: false }));
   }
 
   if (a.policy !== undefined) {

package/src/op/gate-quorum.test.ts

@@ -0,0 +1,139 @@
+import { describe, expect, test } from "vitest";
+import {
+  quorumProblems,
+  quorumRuleLine,
+  quorumRuleProgress,
+  quorumRulesFor,
+  rolesOf,
+  targetGlobMatch,
+  trustQuorumJudge,
+  type GateQuorumJudge,
+  type GateQuorumRule,
+} from "./gate-quorum";
+import { evaluateGate, memoryGateLedgerPort, tallyGateApprovals } from "./gate";
+import { gateApprovalProblems } from "./gate-approval";
+import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger";
+import { gatesInLedger } from "../workspace/status-gates";
+import { resolutionAnswering } from "./gate-resume";
+
+const digest = `sha256:${"a".repeat(64)}`;
+const approval = (who: string, at: string, extra: Partial<GateResolutionRecord> = {}): GateResolutionRecord => ({
+  version: 1,
+  op: "ship",
+  gate: "prod",
+  resolvedBy: who,
+  timestamp: at,
+  planDigest: digest,
+  ...extra,
+});
+
+/** A judge that proves the names in `proven`, gives roles from `roles`, and knows `authors`. */
+const judgeOf = (proven: string[], roles: Record<string, string[]>, authors?: string[]): GateQuorumJudge => (r) => {
+  const ok = proven.includes(r.resolvedBy);
+  return { proven: ok, roles: ok ? rolesOf(r.resolvedBy, roles) : [], ...(authors ? { author: authors.includes(r.resolvedBy) } : {}) };
+};
+
+describe("approval rules (#4290)", () => {
+  test("targets globs read * within a segment and ** across segments", () => {
+    expect(targetGlobMatch("prod-*", "prod-eu")).toBe(true);
+    expect(targetGlobMatch("prod-*", "staging")).toBe(false);
+    expect(targetGlobMatch("envs/prod/**", "envs/prod/eu/db")).toBe(true);
+    expect(targetGlobMatch("envs/*/db", "envs/prod/eu/db")).toBe(false);
+    expect(targetGlobMatch("envs/**/db", "envs/db")).toBe(true);
+  });
+
+  test("a gate takes the rules with no targets, and those a glob of matches one of its targets", () => {
+    const rules: GateQuorumRule[] = [{ count: 1 }, { targets: ["prod-*"], count: 2 }, { targets: ["dev"], count: 3 }];
+    expect(quorumRulesFor(rules, ["prod-eu", "staging"])).toEqual([{ count: 1 }, { targets: ["prod-*"], count: 2 }]);
+    expect(quorumRulesFor(rules, [])).toEqual([{ count: 1 }]);
+  });
+
+  test("a role counts only for a proven approver that trust.json grants it", () => {
+    const rule: GateQuorumRule = { count: 2, roles: ["platform"] };
+    const judge = judgeOf(["github:alice", "github:bob"], { platform: ["github:alice", "github:carol"] });
+    const approvers = ["github:alice", "github:bob", "github:carol"].map((who, i) => ({ who, at: `2026-10-22T0${i}:00:00Z`, judged: judge(approval(who, "")) }));
+    const p = quorumRuleProgress(rule, approvers);
+    // bob is proven but holds no role; carol holds the role but is not proven.
+    expect(p.approvers).toEqual(["github:alice"]);
+    expect(p.met).toBe(false);
+    expect(quorumRuleLine(p)).toBe("every target: 1 of 2 approvals (github:alice), needs 1 more from platform");
+  });
+
+  test("notAuthor needs a proven approver who is not the author, and waits when the author is unknown", () => {
+    const rule: GateQuorumRule = { count: 1, notAuthor: true };
+    const at = "2026-10-22T00:00:00Z";
+    const byAuthor = judgeOf(["github:alice"], {}, ["github:alice"]);
+    expect(quorumRuleProgress(rule, [{ who: "github:alice", at, judged: byAuthor(approval("github:alice", at)) }]).met).toBe(false);
+    const byOther = judgeOf(["github:bob"], {}, ["github:alice"]);
+    expect(quorumRuleProgress(rule, [{ who: "github:bob", at, judged: byOther(approval("github:bob", at)) }]).met).toBe(true);
+    const unknown = judgeOf(["github:bob"], {});
+    const p = quorumRuleProgress(rule, [{ who: "github:bob", at, judged: unknown(approval("github:bob", at)) }]);
+    expect(p).toMatchObject({ met: false, authorUnknown: true });
+    expect(quorumRuleLine(p)).toMatch(/author is not known/);
+  });
+
+  test("the trust judge proves a reviewer of the live review, never a claimed role", () => {
+    const judge = trustQuorumJudge({
+      signers: { base: null, signersPath: ".chant/allowed_signers", active: false, signers: [], problems: [] },
+      roles: { platform: ["github:alice"] },
+      authors: ["github:dana"],
+      review: { head: "h1", approvers: ["github:alice"] },
+    });
+    expect(judge(approval("github:alice", "", { review: { pr: 1, head: "h1", approvers: ["github:alice"] } }))).toEqual({ proven: true, roles: ["platform"], author: false });
+    // A review line for another head proves nothing, and a claimed role is ignored.
+    expect(judge(approval("github:alice", "", { review: { pr: 1, head: "h0", approvers: ["github:alice"] }, approver: { kind: "human", roles: ["platform"] } }))).toEqual({ proven: false, roles: [], author: false });
+  });
+
+  test("the tally passes once every rule is met, each approver once", () => {
+    const rules: GateQuorumRule[] = [{ count: 2 }, { count: 1, roles: ["platform"] }];
+    const judge = judgeOf(["github:alice"], { platform: ["github:alice"] });
+    const records = [approval("github:bob", "2026-10-22T01:00:00Z"), approval("github:bob", "2026-10-22T02:00:00Z")];
+    const one = tallyGateApprovals(records, "prod", "2026-10-22T00:00:00Z", digest, { mode: "log-only", quorum: rules }, undefined, judge);
+    expect(one).toMatchObject({ met: false, need: 2 });
+    expect(one.counted.map((r) => r.resolvedBy)).toEqual(["github:bob"]);
+    const both = tallyGateApprovals([...records, approval("github:alice", "2026-10-22T03:00:00Z")], "prod", "2026-10-22T00:00:00Z", digest, { mode: "log-only", quorum: rules }, undefined, judge);
+    expect(both.met).toBe(true);
+    expect(both.rules?.map((r) => r.met)).toEqual([true, true]);
+  });
+
+  test("an agent never counts toward a rule", () => {
+    const records = [approval("bot", "2026-10-22T01:00:00Z", { approver: { kind: "agent" } })];
+    expect(tallyGateApprovals(records, "prod", "2026-10-22T00:00:00Z", digest, { mode: "log-only", quorum: [{ count: 1 }] }).met).toBe(false);
+  });
+
+  test("evaluateGate asks the port's judge for rules naming roles, and with none no role counts", async () => {
+    const quorum: GateQuorumRule[] = [{ count: 1, roles: ["platform"] }];
+    const seeded = { resolutions: [approval("github:alice", "2026-10-22T01:00:00Z", { approver: { kind: "human", roles: ["platform"] } })] };
+    const input = { op: "ship", gate: "prod", planDigest: digest, approval: { mode: "log-only" as const, quorum }, now: "2026-10-22T02:00:00Z" };
+    const bare = await evaluateGate(memoryGateLedgerPort(seeded), input);
+    expect(bare.satisfied).toBe(false);
+    if (!bare.satisfied) expect(bare.quorum?.rules?.[0]).toMatchObject({ met: false, approvers: [] });
+    const port = { ...memoryGateLedgerPort(seeded), quorumJudge: async () => judgeOf(["github:alice"], { platform: ["github:alice"] }) };
+    expect((await evaluateGate(port, input)).satisfied).toBe(true);
+  });
+
+  test("an Op gate's block takes a list of rules, and refuses notAuthor", () => {
+    expect(gateApprovalProblems({ quorum: [{ targets: ["prod"], count: 2, roles: ["platform"] }, { count: 1 }] })).toEqual([]);
+    expect(gateApprovalProblems({ quorum: [{ count: 1, notAuthor: true }] })).toEqual([expect.stringMatching(/notAuthor` is not read here/)]);
+    expect(gateApprovalProblems({ quorum: [] })).toEqual(["`approval.quorum` must name at least one rule"]);
+    expect(quorumProblems([{ count: 0, targets: [], who: 1 }], "approvals.quorum", { notAuthor: true })).toEqual([
+      "`approvals.quorum[0].count` must be an integer of at least 1",
+      "`approvals.quorum[0].targets` must be a non-empty list of globs",
+      "`approvals.quorum[0].who` is not a quorum field; use targets, count, roles or notAuthor",
+    ]);
+  });
+
+  test("workspace status and the resume check count a role rule with the judge, as the run does", () => {
+    const quorum: GateQuorumRule[] = [{ count: 1, roles: ["platform"] }];
+    const standing: PendingGateRecord = {
+      version: 1, kind: "pending", op: "ship", gate: "prod", timestamp: "2026-10-22T00:00:00Z", expiresAt: "2026-10-24T00:00:00Z", planDigest: digest, approval: { mode: "log-only", quorum },
+    };
+    const alice = approval("github:alice", "2026-10-22T01:00:00Z");
+    const judge = judgeOf(["github:alice"], { platform: ["github:alice"] });
+    const content = [standing, alice].map((r) => JSON.stringify(r)).join("\n") + "\n";
+    expect(gatesInLedger("ship", content, [], "2026-10-22T02:00:00Z").gates[0]?.state).toBe("pending");
+    expect(gatesInLedger("ship", content, [], "2026-10-22T02:00:00Z", () => null, judge).gates[0]?.state).toBe("approved");
+    expect(resolutionAnswering([alice], standing)).toBeUndefined();
+    expect(resolutionAnswering([alice], standing, [standing], judge)?.resolvedBy).toBe("github:alice");
+  });
+});

package/src/op/gate-quorum.ts

@@ -0,0 +1,248 @@
+/**
+ * Approval rules (#4290): a gate's quorum as a list of rules, each with the
+ * targets it covers, how many approvers it needs, the roles that count, and
+ * whether one of them must not be the change's author.
+ *
+ *   quorum: [
+ *     { targets: ["prod-*"], count: 2, roles: ["platform"], notAuthor: true },
+ *     { count: 1 },
+ *   ]
+ *
+ * A gate takes every rule whose `targets` glob matches one of its targets
+ * (a rule with no `targets` covers every target), and passes once each rule
+ * it takes is met by distinct human approvers of its plan. A gate that takes
+ * no rule needs one human approval, the rule every gate had before.
+ *
+ * Roles come from `.chant/trust.json` at base (`roles`: role name to the
+ * principals that hold it), never from the approver's own claim. An
+ * approver counts toward `roles`, and as someone who is not the author, only
+ * when the approval proves who they are: a seal that verifies against the
+ * signers file at base, or under `pr-review` the forge review of the merged
+ * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * with none, no approval proves anything, so a rule naming roles or
+ * `notAuthor` is never met.
+ *
+ * This module is pure: no git, no file reads, no package, so
+ * `@intentius/chant/gate-decision` bundles it. The judge is built by the
+ * caller from the trust policy it read at base ({@link trustQuorumJudge}).
+ */
+
+import { gateSealRefusal, type GateSigners } from "../lifecycle/gate-seal";
+import type { GateResolutionRecord } from "../lifecycle/gate-ledger";
+
+/** One approval rule. */
+export interface GateQuorumRule {
+  /** Globs over the gate's targets (an Op wave's run targets, an Op gate's environment). Absent, the rule covers every target. */
+  targets?: string[];
+  /** Distinct human approvers the rule needs. At least 1. */
+  count: number;
+  /** When set, only an approver `.chant/trust.json` at base gives one of these roles counts, and only with a proven approval. */
+  roles?: string[];
+  /** When true, at least one counted approver is proven and is not the change's author. */
+  notAuthor?: boolean;
+}
+
+/** A gate's quorum: one rule (the form before #4290), or a list of them. */
+export type GateQuorumSpec = GateQuorumRule | readonly GateQuorumRule[];
+
+/** What a judge says about one approval. */
+export interface QuorumJudgement {
+  /** The approval proves who `resolvedBy` is: a verified seal, or the forge's review. */
+  proven: boolean;
+  /** The roles `.chant/trust.json` at base gives the approver. Empty unless `proven`. */
+  roles: string[];
+  /** Whether the approver is the change's author. Undefined when nobody knows who the author is. */
+  author?: boolean;
+}
+
+/** Judges one approval for the rules. */
+export type GateQuorumJudge = (approval: GateResolutionRecord) => QuorumJudgement;
+
+/** The judge with nothing to judge by: no approval proves anyone, and nobody's author is known. */
+export const UNPROVEN_JUDGE: GateQuorumJudge = () => ({ proven: false, roles: [] });
+
+/** How far one rule is met. */
+export interface GateQuorumRuleProgress {
+  targets?: string[];
+  count: number;
+  roles?: string[];
+  notAuthor?: boolean;
+  /** The approvers it counts, oldest first. */
+  approvers: string[];
+  met: boolean;
+  /** Why the author could not be told apart, when `notAuthor` is set and nobody knows the author. */
+  authorUnknown?: boolean;
+}
+
+/** The rules of a quorum, as a list. Absent, none. */
+export function quorumRules(quorum: GateQuorumSpec | undefined): GateQuorumRule[] {
+  if (quorum === undefined) return [];
+  return Array.isArray(quorum) ? [...(quorum as readonly GateQuorumRule[])] : [quorum as GateQuorumRule];
+}
+
+/**
+ * Whether `target` matches `glob`: `*` within a `/` segment, `**` across
+ * segments (and `a/**\/b` across none), `?` one character. The same reading
+ * as the terraform lexicon's unit globs, so a Terragrunt root's glob means
+ * one thing in both.
+ */
+export function targetGlobMatch(glob: string, target: string): boolean {
+  const g = glob.replace(/\\/g, "/").replace(/\/+$/, "");
+  let re = "";
+  for (let i = 0; i < g.length; i++) {
+    const c = g[i]!;
+    if (c === "*" && g[i + 1] === "*") {
+      if (g[i + 2] === "/") {
+        re += "(?:.*/)?";
+        i += 2;
+      } else {
+        re += ".*";
+        i += 1;
+      }
+    } else if (c === "*") re += "[^/]*";
+    else if (c === "?") re += "[^/]";
+    else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`).test(target.replace(/\\/g, "/").replace(/\/+$/, ""));
+}
+
+/** The rules a gate whose targets are `targets` takes: those with no `targets`, and those a glob of matches one. */
+export function quorumRulesFor(rules: readonly GateQuorumRule[], targets: readonly string[]): GateQuorumRule[] {
+  return rules.filter((r) => r.targets === undefined || r.targets.some((g) => targets.some((t) => targetGlobMatch(g, t))));
+}
+
+/** The most approvers any rule needs, 1 with none. */
+export function quorumNeed(rules: readonly GateQuorumRule[]): number {
+  return rules.reduce((n, r) => Math.max(n, r.count), 1);
+}
+
+/**
+ * Everything wrong with a quorum, one line each. `where` names it
+ * (`approval.quorum`). With `notAuthor: false`, a rule naming `notAuthor` is
+ * refused, since that caller has no author to judge by.
+ */
+export function quorumProblems(value: unknown, where: string, opts: { notAuthor: boolean }): string[] {
+  const list = Array.isArray(value) ? value : [value];
+  const problems: string[] = [];
+  if (Array.isArray(value) && value.length === 0) problems.push(`\`${where}\` must name at least one rule`);
+  list.forEach((rule, i) => {
+    const at = Array.isArray(value) ? `${where}[${i}]` : where;
+    if (typeof rule !== "object" || rule === null || Array.isArray(rule)) {
+      problems.push(`\`${at}\` must be an object`);
+      return;
+    }
+    const q = rule as Record<string, unknown>;
+    if (typeof q.count !== "number" || !Number.isInteger(q.count) || q.count < 1) problems.push(`\`${at}.count\` must be an integer of at least 1`);
+    if (q.roles !== undefined && (!Array.isArray(q.roles) || q.roles.length === 0 || q.roles.some((r) => typeof r !== "string" || r === ""))) {
+      problems.push(`\`${at}.roles\` must be a non-empty list of role names`);
+    }
+    if (q.targets !== undefined && (!Array.isArray(q.targets) || q.targets.length === 0 || q.targets.some((t) => typeof t !== "string" || t === ""))) {
+      problems.push(`\`${at}.targets\` must be a non-empty list of globs`);
+    }
+    if (q.notAuthor !== undefined && typeof q.notAuthor !== "boolean") problems.push(`\`${at}.notAuthor\` must be true or false`);
+    if (q.notAuthor === true && !opts.notAuthor) {
+      problems.push(`\`${at}.notAuthor\` is not read here: an Op gate has no author to judge by. An Op waves spec's \`approvals.quorum\` reads it from the merged pull request`);
+    }
+    const known = new Set(["targets", "count", "roles", "notAuthor"]);
+    for (const key of Object.keys(q)) if (!known.has(key)) problems.push(`\`${at}.${key}\` is not a quorum field; use targets, count, roles or notAuthor`);
+  });
+  return problems;
+}
+
+const norm = (s: string): string => s.normalize("NFKC").trim().toLowerCase();
+
+/** Whether two principals name the same person, compared trimmed and lower-cased. */
+export const samePrincipal = (a: string, b: string): boolean => norm(a) === norm(b);
+
+/** The roles `roles` (`.chant/trust.json`'s role grants) gives `who`, sorted. */
+export function rolesOf(who: string, roles: Readonly<Record<string, readonly string[]>>): string[] {
+  return Object.entries(roles)
+    .filter(([, principals]) => principals.some((p) => samePrincipal(p, who)))
+    .map(([role]) => role)
+    .sort();
+}
+
+/** One approver as a rule counts them. */
+export interface QuorumApprover {
+  who: string;
+  at: string;
+  judged: QuorumJudgement;
+}
+
+/** How far `rule` is met by `approvers`: each counted once, by name, oldest first. */
+export function quorumRuleProgress(rule: GateQuorumRule, approvers: readonly QuorumApprover[]): GateQuorumRuleProgress {
+  const seen = new Set<string>();
+  const counted: QuorumApprover[] = [];
+  for (const a of [...approvers].sort((x, y) => Date.parse(x.at) - Date.parse(y.at))) {
+    if (seen.has(norm(a.who))) continue;
+    if (rule.roles?.length && !(a.judged.proven && a.judged.roles.some((r) => rule.roles!.includes(r)))) continue;
+    seen.add(norm(a.who));
+    counted.push(a);
+  }
+  const notAuthor = !rule.notAuthor || counted.some((a) => a.judged.proven && a.judged.author === false);
+  const authorUnknown = rule.notAuthor === true && !notAuthor && counted.some((a) => a.judged.proven && a.judged.author === undefined);
+  return {
+    ...(rule.targets ? { targets: [...rule.targets] } : {}),
+    count: rule.count,
+    ...(rule.roles?.length ? { roles: [...rule.roles] } : {}),
+    ...(rule.notAuthor ? { notAuthor: true } : {}),
+    approvers: counted.map((a) => a.who),
+    met: counted.length >= rule.count && notAuthor,
+    ...(authorUnknown ? { authorUnknown: true } : {}),
+  };
+}
+
+/**
+ * Where a rule stands, in one line: `prod-*: 1 of 2 approvals (github:alice),
+ * needs 1 more from platform`.
+ */
+export function quorumRuleLine(p: GateQuorumRuleProgress): string {
+  const scope = p.targets ? p.targets.join(", ") : "every target";
+  const have = `${p.approvers.length} of ${p.count} approval${p.count === 1 ? "" : "s"}${p.approvers.length ? ` (${p.approvers.join(", ")})` : ""}`;
+  if (p.met) return `${scope}: ${have}, met`;
+  const more = p.count - p.approvers.length;
+  const needs: string[] = [];
+  if (more > 0) needs.push(`${more} more${p.roles?.length ? ` from ${p.roles.join(" or ")}` : ""}`);
+  if (p.notAuthor) needs.push(more > 0 ? "one of them not the author" : "an approver who is not the author");
+  const unknown = p.authorUnknown ? " (the change's author is not known, so no approver can show they are someone else)" : "";
+  return `${scope}: ${have}, needs ${needs.join(", ")}${unknown}`;
+}
+
+/** The rules that are not met, one line each joined by `; `. */
+export function quorumWaiting(progress: readonly GateQuorumRuleProgress[]): string {
+  return progress.filter((p) => !p.met).map(quorumRuleLine).join("; ");
+}
+
+/** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
+export const ruleNeedsProof = (rule: GateQuorumRule): boolean => (rule.roles?.length ?? 0) > 0 || rule.notAuthor === true;
+
+/** What {@link trustQuorumJudge} judges by. */
+export interface TrustQuorumInput {
+  /** The signers at base: an approval whose seal verifies for its approver against them is proven. */
+  signers: GateSigners;
+  /** `.chant/trust.json`'s role grants at base. */
+  roles: Readonly<Record<string, readonly string[]>>;
+  /** The change's authors, as principals. Absent, nobody knows who they are. */
+  authors?: readonly string[];
+  /**
+   * Under `pr-review`, the merged pull request's review, read from the forge
+   * in this run: a resolution that names this review's head and one of its
+   * approvers as `resolvedBy` is proven.
+   */
+  review?: { head: string; approvers: readonly string[] };
+}
+
+/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+export function trustQuorumJudge(input: TrustQuorumInput): GateQuorumJudge {
+  return (r) => {
+    const sealed = r.seal !== undefined && r.seal !== null && gateSealRefusal(input.signers, r) === null;
+    const reviewed =
+      input.review !== undefined && r.review?.head === input.review.head && input.review.approvers.some((a) => samePrincipal(a, r.resolvedBy));
+    const proven = sealed || reviewed;
+    return {
+      proven,
+      roles: proven ? rolesOf(r.resolvedBy, input.roles) : [],
+      ...(input.authors !== undefined ? { author: input.authors.some((a) => samePrincipal(a, r.resolvedBy)) } : {}),
+    };
+  };
+}

package/src/op/gate-resume.ts

@@ -11,6 +11,7 @@
 import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger";
 import { latestResolutionForPlan } from "../lifecycle/gate-ledger";
 import { humanQuorumSince, tallyGateApprovals } from "./gate";
+import type { GateQuorumJudge } from "./gate-quorum";
 
 export {
   isGateRunLocator,
@@ -28,19 +29,21 @@ export {
  * gate ledger's pending facts, which place the human quorum's anchor (#3206);
  * without them it is `standing` itself. A workspace's
  * `identity.gates` rule is not applied here: the resumed job applies it, and
- * waits again when the approval does not count.
+ * waits again when the approval does not count. `judge` proves approvers
+ * for approval rules that name roles (#4290); absent, none is proven.
  */
 export function resolutionAnswering(
   resolutions: readonly GateResolutionRecord[],
   standing: PendingGateRecord,
   pending: readonly PendingGateRecord[] = [standing],
+  judge?: GateQuorumJudge,
 ): GateResolutionRecord | undefined {
   const env = standing.environment;
   const mine = resolutions.filter((r) => env === undefined || r.environment === env);
   if (standing.approval) {
-    const tally = tallyGateApprovals(mine, standing.gate, standing.timestamp, standing.planDigest, standing.approval, humanQuorumSince(pending, standing));
+    const tally = tallyGateApprovals(mine, standing.gate, standing.timestamp, standing.planDigest, standing.approval, humanQuorumSince(pending, standing), judge);
     if (tally.permit) return tally.permit;
-    return tally.counted.length >= tally.need ? tally.counted[tally.counted.length - 1] : undefined;
+    return tally.met ? tally.counted[tally.counted.length - 1] : undefined;
   }
   return latestResolutionForPlan(mine, standing.gate, standing.timestamp, standing.planDigest).resolution;
 }

package/src/op/gate-review.ts

@@ -30,7 +30,7 @@
  */
 
 import { readFileSync } from "node:fs";
-import { gateSealRefusal } from "../workspace/trust/gate-seal";
+import { gateSealRefusal } from "../lifecycle/gate-seal";
 import { readTrustPolicy, type TrustPolicy } from "../workspace/trust/policy";
 import { gitRevisionSource } from "../workspace/record-source";
 import { forgePrincipalOf, ForgeApiError, type ForgeFetch, type ForgeKind } from "../pr-forge";