@intentius/chant 0.124.40 → 0.124.41

package/dist/op/gate-quorum.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Approval rules (#4290): a gate's quorum as a list of rules, each with the
+ * targets it covers, how many approvers it needs, the roles that count, and
+ * whether one of them must not be the change's author.
+ *
+ *   quorum: [
+ *     { targets: ["prod-*"], count: 2, roles: ["platform"], notAuthor: true },
+ *     { count: 1 },
+ *   ]
+ *
+ * A gate takes every rule whose `targets` glob matches one of its targets
+ * (a rule with no `targets` covers every target), and passes once each rule
+ * it takes is met by distinct human approvers of its plan. A gate that takes
+ * no rule needs one human approval, the rule every gate had before.
+ *
+ * Roles come from `.chant/trust.json` at base (`roles`: role name to the
+ * principals that hold it), never from the approver's own claim. An
+ * approver counts toward `roles`, and as someone who is not the author, only
+ * when the approval proves who they are: a seal that verifies against the
+ * signers file at base, or under `pr-review` the forge review of the merged
+ * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * with none, no approval proves anything, so a rule naming roles or
+ * `notAuthor` is never met.
+ *
+ * This module is pure: no git, no file reads, no package, so
+ * `@intentius/chant/gate-decision` bundles it. The judge is built by the
+ * caller from the trust policy it read at base ({@link trustQuorumJudge}).
+ */
+import { type GateSigners } from "../lifecycle/gate-seal.js";
+import type { GateResolutionRecord } from "../lifecycle/gate-ledger.js";
+/** One approval rule. */
+export interface GateQuorumRule {
+    /** Globs over the gate's targets (an Op wave's run targets, an Op gate's environment). Absent, the rule covers every target. */
+    targets?: string[];
+    /** Distinct human approvers the rule needs. At least 1. */
+    count: number;
+    /** When set, only an approver `.chant/trust.json` at base gives one of these roles counts, and only with a proven approval. */
+    roles?: string[];
+    /** When true, at least one counted approver is proven and is not the change's author. */
+    notAuthor?: boolean;
+}
+/** A gate's quorum: one rule (the form before #4290), or a list of them. */
+export type GateQuorumSpec = GateQuorumRule | readonly GateQuorumRule[];
+/** What a judge says about one approval. */
+export interface QuorumJudgement {
+    /** The approval proves who `resolvedBy` is: a verified seal, or the forge's review. */
+    proven: boolean;
+    /** The roles `.chant/trust.json` at base gives the approver. Empty unless `proven`. */
+    roles: string[];
+    /** Whether the approver is the change's author. Undefined when nobody knows who the author is. */
+    author?: boolean;
+}
+/** Judges one approval for the rules. */
+export type GateQuorumJudge = (approval: GateResolutionRecord) => QuorumJudgement;
+/** The judge with nothing to judge by: no approval proves anyone, and nobody's author is known. */
+export declare const UNPROVEN_JUDGE: GateQuorumJudge;
+/** How far one rule is met. */
+export interface GateQuorumRuleProgress {
+    targets?: string[];
+    count: number;
+    roles?: string[];
+    notAuthor?: boolean;
+    /** The approvers it counts, oldest first. */
+    approvers: string[];
+    met: boolean;
+    /** Why the author could not be told apart, when `notAuthor` is set and nobody knows the author. */
+    authorUnknown?: boolean;
+}
+/** The rules of a quorum, as a list. Absent, none. */
+export declare function quorumRules(quorum: GateQuorumSpec | undefined): GateQuorumRule[];
+/**
+ * Whether `target` matches `glob`: `*` within a `/` segment, `**` across
+ * segments (and `a/**\/b` across none), `?` one character. The same reading
+ * as the terraform lexicon's unit globs, so a Terragrunt root's glob means
+ * one thing in both.
+ */
+export declare function targetGlobMatch(glob: string, target: string): boolean;
+/** The rules a gate whose targets are `targets` takes: those with no `targets`, and those a glob of matches one. */
+export declare function quorumRulesFor(rules: readonly GateQuorumRule[], targets: readonly string[]): GateQuorumRule[];
+/** The most approvers any rule needs, 1 with none. */
+export declare function quorumNeed(rules: readonly GateQuorumRule[]): number;
+/**
+ * Everything wrong with a quorum, one line each. `where` names it
+ * (`approval.quorum`). With `notAuthor: false`, a rule naming `notAuthor` is
+ * refused, since that caller has no author to judge by.
+ */
+export declare function quorumProblems(value: unknown, where: string, opts: {
+    notAuthor: boolean;
+}): string[];
+/** Whether two principals name the same person, compared trimmed and lower-cased. */
+export declare const samePrincipal: (a: string, b: string) => boolean;
+/** The roles `roles` (`.chant/trust.json`'s role grants) gives `who`, sorted. */
+export declare function rolesOf(who: string, roles: Readonly<Record<string, readonly string[]>>): string[];
+/** One approver as a rule counts them. */
+export interface QuorumApprover {
+    who: string;
+    at: string;
+    judged: QuorumJudgement;
+}
+/** How far `rule` is met by `approvers`: each counted once, by name, oldest first. */
+export declare function quorumRuleProgress(rule: GateQuorumRule, approvers: readonly QuorumApprover[]): GateQuorumRuleProgress;
+/**
+ * Where a rule stands, in one line: `prod-*: 1 of 2 approvals (github:alice),
+ * needs 1 more from platform`.
+ */
+export declare function quorumRuleLine(p: GateQuorumRuleProgress): string;
+/** The rules that are not met, one line each joined by `; `. */
+export declare function quorumWaiting(progress: readonly GateQuorumRuleProgress[]): string;
+/** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
+export declare const ruleNeedsProof: (rule: GateQuorumRule) => boolean;
+/** What {@link trustQuorumJudge} judges by. */
+export interface TrustQuorumInput {
+    /** The signers at base: an approval whose seal verifies for its approver against them is proven. */
+    signers: GateSigners;
+    /** `.chant/trust.json`'s role grants at base. */
+    roles: Readonly<Record<string, readonly string[]>>;
+    /** The change's authors, as principals. Absent, nobody knows who they are. */
+    authors?: readonly string[];
+    /**
+     * Under `pr-review`, the merged pull request's review, read from the forge
+     * in this run: a resolution that names this review's head and one of its
+     * approvers as `resolvedBy` is proven.
+     */
+    review?: {
+        head: string;
+        approvers: readonly string[];
+    };
+}
+/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+export declare function trustQuorumJudge(input: TrustQuorumInput): GateQuorumJudge;
+//# sourceMappingURL=gate-quorum.d.ts.map

package/dist/op/gate-quorum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAYzE"}

package/dist/op/gate-quorum.js

@@ -0,0 +1,183 @@
+/**
+ * Approval rules (#4290): a gate's quorum as a list of rules, each with the
+ * targets it covers, how many approvers it needs, the roles that count, and
+ * whether one of them must not be the change's author.
+ *
+ *   quorum: [
+ *     { targets: ["prod-*"], count: 2, roles: ["platform"], notAuthor: true },
+ *     { count: 1 },
+ *   ]
+ *
+ * A gate takes every rule whose `targets` glob matches one of its targets
+ * (a rule with no `targets` covers every target), and passes once each rule
+ * it takes is met by distinct human approvers of its plan. A gate that takes
+ * no rule needs one human approval, the rule every gate had before.
+ *
+ * Roles come from `.chant/trust.json` at base (`roles`: role name to the
+ * principals that hold it), never from the approver's own claim. An
+ * approver counts toward `roles`, and as someone who is not the author, only
+ * when the approval proves who they are: a seal that verifies against the
+ * signers file at base, or under `pr-review` the forge review of the merged
+ * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * with none, no approval proves anything, so a rule naming roles or
+ * `notAuthor` is never met.
+ *
+ * This module is pure: no git, no file reads, no package, so
+ * `@intentius/chant/gate-decision` bundles it. The judge is built by the
+ * caller from the trust policy it read at base ({@link trustQuorumJudge}).
+ */
+import { gateSealRefusal } from "../lifecycle/gate-seal.js";
+/** The judge with nothing to judge by: no approval proves anyone, and nobody's author is known. */
+export const UNPROVEN_JUDGE = () => ({ proven: false, roles: [] });
+/** The rules of a quorum, as a list. Absent, none. */
+export function quorumRules(quorum) {
+    if (quorum === undefined)
+        return [];
+    return Array.isArray(quorum) ? [...quorum] : [quorum];
+}
+/**
+ * Whether `target` matches `glob`: `*` within a `/` segment, `**` across
+ * segments (and `a/**\/b` across none), `?` one character. The same reading
+ * as the terraform lexicon's unit globs, so a Terragrunt root's glob means
+ * one thing in both.
+ */
+export function targetGlobMatch(glob, target) {
+    const g = glob.replace(/\\/g, "/").replace(/\/+$/, "");
+    let re = "";
+    for (let i = 0; i < g.length; i++) {
+        const c = g[i];
+        if (c === "*" && g[i + 1] === "*") {
+            if (g[i + 2] === "/") {
+                re += "(?:.*/)?";
+                i += 2;
+            }
+            else {
+                re += ".*";
+                i += 1;
+            }
+        }
+        else if (c === "*")
+            re += "[^/]*";
+        else if (c === "?")
+            re += "[^/]";
+        else
+            re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`^${re}$`).test(target.replace(/\\/g, "/").replace(/\/+$/, ""));
+}
+/** The rules a gate whose targets are `targets` takes: those with no `targets`, and those a glob of matches one. */
+export function quorumRulesFor(rules, targets) {
+    return rules.filter((r) => r.targets === undefined || r.targets.some((g) => targets.some((t) => targetGlobMatch(g, t))));
+}
+/** The most approvers any rule needs, 1 with none. */
+export function quorumNeed(rules) {
+    return rules.reduce((n, r) => Math.max(n, r.count), 1);
+}
+/**
+ * Everything wrong with a quorum, one line each. `where` names it
+ * (`approval.quorum`). With `notAuthor: false`, a rule naming `notAuthor` is
+ * refused, since that caller has no author to judge by.
+ */
+export function quorumProblems(value, where, opts) {
+    const list = Array.isArray(value) ? value : [value];
+    const problems = [];
+    if (Array.isArray(value) && value.length === 0)
+        problems.push(`\`${where}\` must name at least one rule`);
+    list.forEach((rule, i) => {
+        const at = Array.isArray(value) ? `${where}[${i}]` : where;
+        if (typeof rule !== "object" || rule === null || Array.isArray(rule)) {
+            problems.push(`\`${at}\` must be an object`);
+            return;
+        }
+        const q = rule;
+        if (typeof q.count !== "number" || !Number.isInteger(q.count) || q.count < 1)
+            problems.push(`\`${at}.count\` must be an integer of at least 1`);
+        if (q.roles !== undefined && (!Array.isArray(q.roles) || q.roles.length === 0 || q.roles.some((r) => typeof r !== "string" || r === ""))) {
+            problems.push(`\`${at}.roles\` must be a non-empty list of role names`);
+        }
+        if (q.targets !== undefined && (!Array.isArray(q.targets) || q.targets.length === 0 || q.targets.some((t) => typeof t !== "string" || t === ""))) {
+            problems.push(`\`${at}.targets\` must be a non-empty list of globs`);
+        }
+        if (q.notAuthor !== undefined && typeof q.notAuthor !== "boolean")
+            problems.push(`\`${at}.notAuthor\` must be true or false`);
+        if (q.notAuthor === true && !opts.notAuthor) {
+            problems.push(`\`${at}.notAuthor\` is not read here: an Op gate has no author to judge by. An Op waves spec's \`approvals.quorum\` reads it from the merged pull request`);
+        }
+        const known = new Set(["targets", "count", "roles", "notAuthor"]);
+        for (const key of Object.keys(q))
+            if (!known.has(key))
+                problems.push(`\`${at}.${key}\` is not a quorum field; use targets, count, roles or notAuthor`);
+    });
+    return problems;
+}
+const norm = (s) => s.normalize("NFKC").trim().toLowerCase();
+/** Whether two principals name the same person, compared trimmed and lower-cased. */
+export const samePrincipal = (a, b) => norm(a) === norm(b);
+/** The roles `roles` (`.chant/trust.json`'s role grants) gives `who`, sorted. */
+export function rolesOf(who, roles) {
+    return Object.entries(roles)
+        .filter(([, principals]) => principals.some((p) => samePrincipal(p, who)))
+        .map(([role]) => role)
+        .sort();
+}
+/** How far `rule` is met by `approvers`: each counted once, by name, oldest first. */
+export function quorumRuleProgress(rule, approvers) {
+    const seen = new Set();
+    const counted = [];
+    for (const a of [...approvers].sort((x, y) => Date.parse(x.at) - Date.parse(y.at))) {
+        if (seen.has(norm(a.who)))
+            continue;
+        if (rule.roles?.length && !(a.judged.proven && a.judged.roles.some((r) => rule.roles.includes(r))))
+            continue;
+        seen.add(norm(a.who));
+        counted.push(a);
+    }
+    const notAuthor = !rule.notAuthor || counted.some((a) => a.judged.proven && a.judged.author === false);
+    const authorUnknown = rule.notAuthor === true && !notAuthor && counted.some((a) => a.judged.proven && a.judged.author === undefined);
+    return {
+        ...(rule.targets ? { targets: [...rule.targets] } : {}),
+        count: rule.count,
+        ...(rule.roles?.length ? { roles: [...rule.roles] } : {}),
+        ...(rule.notAuthor ? { notAuthor: true } : {}),
+        approvers: counted.map((a) => a.who),
+        met: counted.length >= rule.count && notAuthor,
+        ...(authorUnknown ? { authorUnknown: true } : {}),
+    };
+}
+/**
+ * Where a rule stands, in one line: `prod-*: 1 of 2 approvals (github:alice),
+ * needs 1 more from platform`.
+ */
+export function quorumRuleLine(p) {
+    const scope = p.targets ? p.targets.join(", ") : "every target";
+    const have = `${p.approvers.length} of ${p.count} approval${p.count === 1 ? "" : "s"}${p.approvers.length ? ` (${p.approvers.join(", ")})` : ""}`;
+    if (p.met)
+        return `${scope}: ${have}, met`;
+    const more = p.count - p.approvers.length;
+    const needs = [];
+    if (more > 0)
+        needs.push(`${more} more${p.roles?.length ? ` from ${p.roles.join(" or ")}` : ""}`);
+    if (p.notAuthor)
+        needs.push(more > 0 ? "one of them not the author" : "an approver who is not the author");
+    const unknown = p.authorUnknown ? " (the change's author is not known, so no approver can show they are someone else)" : "";
+    return `${scope}: ${have}, needs ${needs.join(", ")}${unknown}`;
+}
+/** The rules that are not met, one line each joined by `; `. */
+export function quorumWaiting(progress) {
+    return progress.filter((p) => !p.met).map(quorumRuleLine).join("; ");
+}
+/** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
+export const ruleNeedsProof = (rule) => (rule.roles?.length ?? 0) > 0 || rule.notAuthor === true;
+/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+export function trustQuorumJudge(input) {
+    return (r) => {
+        const sealed = r.seal !== undefined && r.seal !== null && gateSealRefusal(input.signers, r) === null;
+        const reviewed = input.review !== undefined && r.review?.head === input.review.head && input.review.approvers.some((a) => samePrincipal(a, r.resolvedBy));
+        const proven = sealed || reviewed;
+        return {
+            proven,
+            roles: proven ? rolesOf(r.resolvedBy, input.roles) : [],
+            ...(input.authors !== undefined ? { author: input.authors.some((a) => samePrincipal(a, r.resolvedBy)) } : {}),
+        };
+    };
+}

package/dist/op/gate-resume.d.ts

@@ -8,6 +8,7 @@
  * `./gate`'s quorum rules.
  */
 import type { GateResolutionRecord, PendingGateRecord } from "../lifecycle/gate-ledger.js";
+import type { GateQuorumJudge } from "./gate-quorum.js";
 export { isGateRunLocator, resolveGateRunLocator, resumeGateRun, resumeTokenFromEnv, type GateResumeOutcome, type GateRunLocator, type ResumeGateRunOptions, } from "../gate-resume-run.js";
 /**
  * The resolution that answers `standing`, read the way a run decides the gate
@@ -15,7 +16,8 @@ export { isGateRunLocator, resolveGateRunLocator, resumeGateRun, resumeTokenFrom
  * gate ledger's pending facts, which place the human quorum's anchor (#3206);
  * without them it is `standing` itself. A workspace's
  * `identity.gates` rule is not applied here: the resumed job applies it, and
- * waits again when the approval does not count.
+ * waits again when the approval does not count. `judge` proves approvers
+ * for approval rules that name roles (#4290); absent, none is proven.
  */
-export declare function resolutionAnswering(resolutions: readonly GateResolutionRecord[], standing: PendingGateRecord, pending?: readonly PendingGateRecord[]): GateResolutionRecord | undefined;
+export declare function resolutionAnswering(resolutions: readonly GateResolutionRecord[], standing: PendingGateRecord, pending?: readonly PendingGateRecord[], judge?: GateQuorumJudge): GateResolutionRecord | undefined;
 //# sourceMappingURL=gate-resume.d.ts.map

package/dist/op/gate-resume.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-resume.d.ts","sourceRoot":"","sources":["../../src/op/gate-resume.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAIxF,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,GACjD,oBAAoB,GAAG,SAAS,CASlC"}
+{"version":3,"file":"gate-resume.d.ts","sourceRoot":"","sources":["../../src/op/gate-resume.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAGxF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,EAClD,KAAK,CAAC,EAAE,eAAe,GACtB,oBAAoB,GAAG,SAAS,CASlC"}

package/dist/op/gate-resume.js

@@ -16,16 +16,17 @@ export { isGateRunLocator, resolveGateRunLocator, resumeGateRun, resumeTokenFrom
  * gate ledger's pending facts, which place the human quorum's anchor (#3206);
  * without them it is `standing` itself. A workspace's
  * `identity.gates` rule is not applied here: the resumed job applies it, and
- * waits again when the approval does not count.
+ * waits again when the approval does not count. `judge` proves approvers
+ * for approval rules that name roles (#4290); absent, none is proven.
  */
-export function resolutionAnswering(resolutions, standing, pending = [standing]) {
+export function resolutionAnswering(resolutions, standing, pending = [standing], judge) {
     const env = standing.environment;
     const mine = resolutions.filter((r) => env === undefined || r.environment === env);
     if (standing.approval) {
-        const tally = tallyGateApprovals(mine, standing.gate, standing.timestamp, standing.planDigest, standing.approval, humanQuorumSince(pending, standing));
+        const tally = tallyGateApprovals(mine, standing.gate, standing.timestamp, standing.planDigest, standing.approval, humanQuorumSince(pending, standing), judge);
         if (tally.permit)
             return tally.permit;
-        return tally.counted.length >= tally.need ? tally.counted[tally.counted.length - 1] : undefined;
+        return tally.met ? tally.counted[tally.counted.length - 1] : undefined;
     }
     return latestResolutionForPlan(mine, standing.gate, standing.timestamp, standing.planDigest).resolution;
 }

package/dist/op/gate-review.js

@@ -29,7 +29,7 @@
  * back. The author's own review never counts.
  */
 import { readFileSync } from "node:fs";
-import { gateSealRefusal } from "../workspace/trust/gate-seal.js";
+import { gateSealRefusal } from "../lifecycle/gate-seal.js";
 import { readTrustPolicy } from "../workspace/trust/policy.js";
 import { gitRevisionSource } from "../workspace/record-source.js";
 import { forgePrincipalOf, ForgeApiError } from "../pr-forge.js";

package/dist/op/gate.d.ts

@@ -34,6 +34,7 @@
 import { type GateResolutionInput, type GateResolutionRecord, type PendingGateInput, type PendingGateRecord } from "../lifecycle/gate-ledger.js";
 import { type AppliedGateRecord } from "../lifecycle/gate-applied.js";
 import { type GateApprover, type ResolvedGateApproval } from "./gate-approval.js";
+import { type GateQuorumJudge, type GateQuorumRuleProgress } from "./gate-quorum.js";
 import { type GateCheckpoint } from "../lifecycle/gate-checkpoint.js";
 import type { ResolvedGateAlias } from "./gate-alias.js";
 /**
@@ -84,6 +85,16 @@ export interface GateLedgerPort {
     approvalRule?(gate: string, at?: {
         base?: string;
     }): Promise<GateApprovalRule | null>;
+    /**
+     * The judge a gate's approval rules are met by (#4290): which approvals
+     * prove their approver (a seal verified against the signers at base) and
+     * the roles `.chant/trust.json` at base gives them. `at.base` as for
+     * {@link GateLedgerPort.approvalRule}. Absent, no approval proves anyone,
+     * so a rule naming roles is never met.
+     */
+    quorumJudge?(gate: string, at?: {
+        base?: string;
+    }): Promise<GateQuorumJudge>;
     /** The approvals a wave applied under (#3784), from `_gates/<op>/applied.jsonl`. Absent on a port that never spends approvals. */
     readApplied?(op: string): Promise<AppliedGateRecord[]>;
     /** Record that a wave is about to apply under an approval (#3784), which spends it. */
@@ -177,6 +188,13 @@ export interface GateCheckInput {
      * it so `chant approve` can evaluate the policy.
      */
     approval?: ResolvedGateApproval;
+    /**
+     * Judges approvals for `approval.quorum`'s rules (#4290). Absent, the
+     * port's {@link GateLedgerPort.quorumJudge} at its default base, else no
+     * approval proves anyone. A wave passes one that knows the change's author
+     * and the merged pull request's review.
+     */
+    judge?: GateQuorumJudge;
     /** ISO-8601 "now" — supplied by the caller, so the decision is deterministic under test. */
     now?: string;
     /**
@@ -264,6 +282,8 @@ export interface GateQuorumProgress {
     /** Approvers whose approval counts toward the quorum, oldest first. */
     approvers: string[];
     need: number;
+    /** Where each approval rule the gate takes stands (#4290). Absent when it takes none. */
+    rules?: GateQuorumRuleProgress[];
 }
 /** Either the gate is answered, or it is a standing fact. */
 export type GateCheck = {
@@ -319,8 +339,12 @@ export declare function approverOf(record: GateResolutionRecord): GateApprover;
 export interface GateTally {
     /** Distinct human approvers of this plan who count toward the quorum, one record each (their newest), oldest first. */
     counted: GateResolutionRecord[];
-    /** The quorum's count, 1 when the gate declares none. */
+    /** The most approvers a rule needs, 1 when the gate declares none. */
     need: number;
+    /** Every rule is met (#4290); with no rules, one human approved. */
+    met: boolean;
+    /** Where each rule stands (#4290). Absent when the gate takes no rule. */
+    rules?: GateQuorumRuleProgress[];
     /** The newest approval whose recorded permit passes the gate on its own. Only in `enforce` mode, only for a permit recorded under `enforce`, and only under the gate's current policy version and resolved context. */
     permit?: GateResolutionRecord;
     /** The newest approval of this gate for a different plan, when the gate binds one. */
@@ -337,8 +361,12 @@ export interface GateTally {
  * pending fact re-recorded for a changed mode or context keeps a partly
  * filled quorum (#3206). It defaults to `sinceIso`.
  *
- * Of those, only a human's counts toward the quorum, once per `resolvedBy`,
- * and only with one of the quorum's roles when it names any. An agent counts
+ * Of those, only a human's counts toward the quorum, once per `resolvedBy`.
+ * The quorum is a list of rules (#4290, `./gate-quorum.ts`), already the ones
+ * the gate takes: each is met by distinct humans, counting toward `roles`
+ * only an approver `judge` proves and gives one of them (roles from
+ * `.chant/trust.json` at base, never the approver's claim), and the gate
+ * passes when every rule is met. With no rule, one human passes it. An agent counts
  * only through a recorded `allow` in `enforce` mode, evaluated under the
  * policy version the gate declares now, recorded while the gate was in
  * `enforce` (#2512), and evaluated under the context the gate resolves now
@@ -346,7 +374,7 @@ export interface GateTally {
  * after the gate switches to `enforce`, and a `deny` never removes a human's approval: a policy can add
  * a way through the gate but cannot take one away.
  */
-export declare function tallyGateApprovals(records: GateResolutionRecord[], gate: string, sinceIso: string, planDigest: string | undefined, approval: ResolvedGateApproval, humansSinceIso?: string): GateTally;
+export declare function tallyGateApprovals(records: GateResolutionRecord[], gate: string, sinceIso: string, planDigest: string | undefined, approval: ResolvedGateApproval, humansSinceIso?: string, judge?: GateQuorumJudge): GateTally;
 /**
  * Where a gate's human quorum starts counting (#3206): the oldest pending fact
  * in the unbroken run of facts, newest first from `standing`, recorded for

package/dist/op/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/op/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAA2D,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE5H,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAMlG,OAAO,EAAyF,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1J,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IACjG,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChI;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtF,kIAAkI;IAClI,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,uFAAuF;IACvF,aAAa,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F;;;;;OAKG;IACH,eAAe,CAAC,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAiEzE;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAClC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAO,GAChH,cAAc,GAAG;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kDAAkD;IAClD,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CA0CA;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4HAA4H;IAC5H,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,UAAQ,GAAG,MAAM,CAgBnH;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GACjB;IACE,SAAS,EAAE,IAAI,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,oBAAoB,CAAC;IACjC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IAC9C,qEAAqE;IACrE,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,yHAAyH;IACzH,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAClC,GAED;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,kFAAkF;IAClF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAAC;AAEN,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iJAAiJ;AACjJ,wBAAgB,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,YAAY,CAGrE;AAED,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,uHAAuH;IACvH,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,yDAAyD;IACzD,IAAI,EAAE,MAAM,CAAC;IACb,uNAAuN;IACvN,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,GAAE,MAAiB,GAChC,SAAS,CAiDX;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAc3G;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,GACjD,oBAAoB,EAAE,CAOxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAuBnH;AAgED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CA+MlG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CAK1H;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9F"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/op/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAA2D,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE5H,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAEL,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAClD,MAAM,eAAe,CAAC;AAMvB,OAAO,EAAyF,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1J,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IACjG,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChI;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,kIAAkI;IAClI,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,uFAAuF;IACvF,aAAa,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F;;;;;OAKG;IACH,eAAe,CAAC,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAuEzE;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAClC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAO,GAChH,cAAc,GAAG;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kDAAkD;IAClD,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CA0CA;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4HAA4H;IAC5H,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,UAAQ,GAAG,MAAM,CAgBnH;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GACjB;IACE,SAAS,EAAE,IAAI,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,oBAAoB,CAAC;IACjC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IAC9C,qEAAqE;IACrE,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,yHAAyH;IACzH,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAClC,GAED;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,kFAAkF;IAClF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAAC;AAEN,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iJAAiJ;AACjJ,wBAAgB,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,YAAY,CAGrE;AAED,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,uHAAuH;IACvH,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACjC,uNAAuN;IACvN,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,GAAE,MAAiB,EACjC,KAAK,GAAE,eAAgC,GACtC,SAAS,CAkDX;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAc3G;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,GACjD,oBAAoB,EAAE,CAOxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAuBnH;AAgED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAmNlG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CAK1H;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9F"}

package/dist/op/gate.js

@@ -37,6 +37,7 @@ import { isModelAuthored } from "../lifecycle/gate-origin.js";
 import { appliedGatePath, isApprovalSpent, parseAppliedGateLines } from "../lifecycle/gate-applied.js";
 import { sortedJsonReplacer } from "../utils.js";
 import { gateContextDigest } from "./gate-approval.js";
+import { quorumNeed, quorumRuleProgress, quorumRules, ruleNeedsProof, samePrincipal, trustQuorumJudge, UNPROVEN_JUDGE, } from "./gate-quorum.js";
 import { pushLifecycleReport, readBlobBySha, readBlobFromPath, readPathSha, requireLifecycleLedger, writeBlobToPath, RefCASConflictError } from "../lifecycle/git.js";
 import { parseDuration } from "./duration.js";
 import { ciRunIdFromEnv, resolveGateRunLocator } from "./gate-run-locator.js";
@@ -74,6 +75,12 @@ export function gitGateLedgerPort(opts) {
             const { gateAdmission } = await import("../workspace/identity.js");
             return gateAdmission(opts?.cwd ?? process.cwd(), gate, at?.base);
         },
+        async quorumJudge(_gate, at) {
+            // #4290: the signers and role grants at base, never the approver's claim.
+            const { scopeSource } = await import("../workspace/write-scope.js");
+            const { policy } = scopeSource(opts?.cwd ?? process.cwd(), at?.base);
+            return trustQuorumJudge({ signers: policy, roles: policy.roles });
+        },
         async appendResolution(input) {
             const { record } = await appendGateResolution(input, opts);
             return { record, ...(await pushLifecycleReport(opts)) };
@@ -209,8 +216,12 @@ export function approverOf(record) {
  * pending fact re-recorded for a changed mode or context keeps a partly
  * filled quorum (#3206). It defaults to `sinceIso`.
  *
- * Of those, only a human's counts toward the quorum, once per `resolvedBy`,
- * and only with one of the quorum's roles when it names any. An agent counts
+ * Of those, only a human's counts toward the quorum, once per `resolvedBy`.
+ * The quorum is a list of rules (#4290, `./gate-quorum.ts`), already the ones
+ * the gate takes: each is met by distinct humans, counting toward `roles`
+ * only an approver `judge` proves and gives one of them (roles from
+ * `.chant/trust.json` at base, never the approver's claim), and the gate
+ * passes when every rule is met. With no rule, one human passes it. An agent counts
  * only through a recorded `allow` in `enforce` mode, evaluated under the
  * policy version the gate declares now, recorded while the gate was in
  * `enforce` (#2512), and evaluated under the context the gate resolves now
@@ -218,12 +229,13 @@ export function approverOf(record) {
  * after the gate switches to `enforce`, and a `deny` never removes a human's approval: a policy can add
  * a way through the gate but cannot take one away.
  */
-export function tallyGateApprovals(records, gate, sinceIso, planDigest, approval, humansSinceIso = sinceIso) {
+export function tallyGateApprovals(records, gate, sinceIso, planDigest, approval, humansSinceIso = sinceIso, judge = UNPROVEN_JUDGE) {
     const since = new Date(sinceIso).getTime();
     const humansSince = Math.min(since, new Date(humansSinceIso).getTime());
     const at = (r) => new Date(r.timestamp).getTime();
-    const roles = approval.quorum?.roles;
+    const rules = quorumRules(approval.quorum);
     const context = gateContextDigest(approval.context);
+    // Each human once: their newest approval, or their newest proven one when they have one.
     const byActor = new Map();
     let permit;
     let mismatched;
@@ -250,22 +262,22 @@ export function tallyGateApprovals(records, gate, sinceIso, planDigest, approval
             decision.contextDigest === context && (!permit || at(r) >= at(permit))) {
             permit = r;
         }
-        const approver = approverOf(r);
-        if (approver.kind !== "human")
-            continue;
-        if (roles && !(approver.roles ?? []).some((role) => roles.includes(role)))
+        if (approverOf(r).kind !== "human")
             continue;
-        const prior = byActor.get(r.resolvedBy);
-        if (!prior || at(r) >= at(prior))
-            byActor.set(r.resolvedBy, r);
+        const key = r.resolvedBy.normalize("NFKC").trim().toLowerCase();
+        const proven = rules.some(ruleNeedsProof) && judge(r).proven;
+        const prior = byActor.get(key);
+        if (!prior || (proven && !prior.proven) || (proven === prior.proven && at(r) >= at(prior.record)))
+            byActor.set(key, { record: r, proven });
     }
-    const counted = [...byActor.values()].sort((a, b) => at(a) - at(b));
-    return {
-        counted,
-        need: approval.quorum?.count ?? 1,
-        ...(permit ? { permit } : {}),
-        ...(mismatched ? { mismatched } : {}),
-    };
+    const humans = [...byActor.values()].map((v) => v.record).sort((a, b) => at(a) - at(b));
+    const extra = { ...(permit ? { permit } : {}), ...(mismatched ? { mismatched } : {}) };
+    if (rules.length === 0)
+        return { counted: humans, need: 1, met: humans.length >= 1, ...extra };
+    const approvers = humans.map((r) => ({ who: r.resolvedBy, at: r.timestamp, judged: judge(r) }));
+    const progress = rules.map((rule) => quorumRuleProgress(rule, approvers));
+    const counted = humans.filter((r) => progress.some((p) => p.approvers.some((a) => samePrincipal(a, r.resolvedBy))));
+    return { counted, need: quorumNeed(rules), met: progress.every((p) => p.met), rules: progress, ...extra };
 }
 /**
  * Where a gate's human quorum starts counting (#3206): the oldest pending fact
@@ -503,11 +515,15 @@ export async function evaluateGate(port, input) {
             standing.approval?.policy?.version === input.approval.policy?.version
             ? humanQuorumSince(pending, standing)
             : since;
-        const tally = tallyGateApprovals(resolutions, input.gate, since, input.planDigest, input.approval, humansSince);
+        // #4290: who an approval proves, and their roles at base, for rules that read them.
+        const judge = quorumRules(input.approval.quorum).some(ruleNeedsProof)
+            ? (input.judge ?? (await port.quorumJudge?.(input.gate)) ?? UNPROVEN_JUDGE)
+            : UNPROVEN_JUDGE;
+        const tally = tallyGateApprovals(resolutions, input.gate, since, input.planDigest, input.approval, humansSince, judge);
         if (tally.permit) {
             return { satisfied: true, resolution: tally.permit, via: "policy", approvals: tally.counted };
         }
-        if (tally.counted.length >= tally.need) {
+        if (tally.met) {
             return {
                 satisfied: true,
                 resolution: tally.counted[tally.counted.length - 1],
@@ -516,19 +532,19 @@ export async function evaluateGate(port, input) {
             };
         }
         mismatched = tally.mismatched;
-        quorum = { approvers: tally.counted.map((r) => r.resolvedBy), need: tally.need };
+        quorum = { approvers: tally.counted.map((r) => r.resolvedBy), need: tally.need, ...(tally.rules ? { rules: tally.rules } : {}) };
         // #3949: old and new approvals add up toward one quorum, each approver once.
         const counted = new Set(tally.counted.map((r) => r.resolvedBy));
         const extra = fromAliases.filter((r) => !counted.has(r.resolvedBy));
         if (extra.length > 0) {
             const asCarried = new Map(extra.map((r) => [{ version: 1, ...carriedApproval(r, input.op, input.gate, now) }, r]));
-            const combined = tallyGateApprovals([...resolutions, ...asCarried.keys()], input.gate, since, input.planDigest, input.approval, humansSince);
-            if (combined.counted.length >= combined.need) {
+            const combined = tallyGateApprovals([...resolutions, ...asCarried.keys()], input.gate, since, input.planDigest, input.approval, humansSince, judge);
+            if (combined.met) {
                 const written = await carry(combined.counted.filter((r) => asCarried.has(r)).map((r) => asCarried.get(r)));
                 const approvals = [...combined.counted.filter((r) => !asCarried.has(r)), ...written];
                 return { satisfied: true, resolution: written[written.length - 1], via: "alias", approvals, carried: written };
             }
-            quorum = { approvers: combined.counted.map((r) => r.resolvedBy), need: combined.need };
+            quorum = { approvers: combined.counted.map((r) => r.resolvedBy), need: combined.need, ...(combined.rules ? { rules: combined.rules } : {}) };
         }
     }
     else {