@intentius/chant 0.124.45 → 0.124.48

package/dist/op/builders.js

@@ -348,9 +348,11 @@ export const composeChangeSet = (args) => {
     return activity("composeChangeSet", rest, { profile: profile ?? "fastIdempotent", ...(id ? { id } : {}) });
 };
 /**
- * A model reviews the pull request's title and description against a change
- * set and posts one sticky note (#4299): `reviewAgent({ op: "pr-review",
- * changeSet: changeSet.out.document })`. It never approves and never gates.
+ * A model reviews the pull request's title and description against its diff
+ * and a change set and posts one sticky note (#4299): `reviewAgent({ op:
+ * "pr-review", changeSet: changeSet.out.document })`. It never approves and
+ * never gates. `mode: "handoff"` (#4326) writes the review for a separate job
+ * to post, so the model's job holds no forge write token.
  * Defaults to the `longInfra` profile, since the model command may take
  * minutes.
  */
@@ -810,8 +812,10 @@ export const policyGate = (opts) => {
  * Attach evidence to an acceptance criterion of the work item the run holds
  * the lease on (#2772), for an Op that declares `workLease`. The run's lease
  * is passed for it, so the write happens only while the lease is still the
- * run's. `opts` takes the `result` (pass or fail), a `title`, and a `url` or a
- * workspace `path` to pin by hash. A `manual` criterion is refused: the run
+ * run's. `opts` takes the `result` (pass or fail), a `title`, and a `url`, a
+ * workspace `path` to pin by hash, or an `ops` result to cite (#3171): a run,
+ * deploy, gate answer or release plan on `chant/lifecycle`, verified against
+ * its ledger. A `manual` criterion is refused: the run
  * is the item's implementer. The `atMostOnce` profile: each attempt appends.
  */
 export const workEvidence = (criterion, opts) => {

package/dist/op/composites/apply-op.d.ts

@@ -5,7 +5,11 @@
  * stays with the platform (the CloudFormation stack, the Kubernetes API
  * server, the ARM resource group) — chant never hosts a state file.
  *
- * Phases: build → plan → [approve] → apply. Deletes ride the native
+ * Phases: build → plan → [preflight] → [approve] → apply → [verify] (#3370).
+ * `preflight` steps run after the plan and before the approval, and a failing
+ * one stops the run before anything is approved or applied. `verify` steps
+ * run after the apply, and a failing one fails the run, which runs `onFailure`
+ * (the Rollback phase, when there is one). Deletes ride the native
  * prune path, whose bound is per target: the ownership marker on `kubectl`,
  * the ownership tag on `arm` (chant #1448 — previously `--mode Complete`, which
  * removed resources chant never applied), the ownership label on `gcp`
@@ -51,12 +55,21 @@
  *   target: "kubectl",
  *   gate: { gate: "approve-apply", point: "prod-apply" },
  * });
+ *
+ * // validate before, check after (#3370), for any target
+ * export const { op } = ApplyOp({
+ *   name: "collector-rollout",
+ *   env: "prod",
+ *   target: "kubectl",
+ *   preflight: [shell("otelcol-contrib validate --config dist/collector.yaml")],
+ *   verify: [activity("rulesLoadedObserve", { env: "prod" })],
+ * });
  * ```
  *
  * @see #112 — stateless-authoritative state model + live import
  */
 import type { OpResource } from "../resource.js";
-import type { GateStep } from "../types.js";
+import type { GateStep, StepDefinition } from "../types.js";
 import { type ApplyTarget, type DeleteMode } from "../activities/apply.js";
 export interface ApplyOpConfig {
     /** Op name (kebab-case). */
@@ -140,6 +153,20 @@ export interface ApplyOpConfig {
      * created is the usual case).
      */
     forceConflicts?: boolean;
+    /**
+     * Steps run after the Plan phase and before the approval gate (#3370), as a
+     * `Preflight` phase: a config validation, a dry run, a policy check. A
+     * failing step stops the run there, so nothing is approved or applied.
+     * Omitted or empty, the Op has no Preflight phase.
+     */
+    preflight?: StepDefinition[];
+    /**
+     * Steps run after the apply (#3370), as a `Verify` phase: a readiness
+     * check, an observation that the new config loaded. A failing step fails
+     * the run, so `onFailure` runs (the Rollback phase, when the Op has one).
+     * Omitted or empty, the Op has no Verify phase.
+     */
+    verify?: StepDefinition[];
 }
 export interface ApplyOpResources {
     /** Op resource — the build→plan→[approve]→apply Op. */

package/dist/op/composites/apply-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1G,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb;;;gBAGY;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;uBAImB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,0FAA0F;QAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC3B,CAAC;IACF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CA4G/D"}
+{"version":3,"file":"apply-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1G,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb;;;gBAGY;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;uBAImB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,0FAA0F;QAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC3B,CAAC;IACF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAoH/D"}

package/dist/op/composites/apply-op.js

@@ -5,7 +5,11 @@
  * stays with the platform (the CloudFormation stack, the Kubernetes API
  * server, the ARM resource group) — chant never hosts a state file.
  *
- * Phases: build → plan → [approve] → apply. Deletes ride the native
+ * Phases: build → plan → [preflight] → [approve] → apply → [verify] (#3370).
+ * `preflight` steps run after the plan and before the approval, and a failing
+ * one stops the run before anything is approved or applied. `verify` steps
+ * run after the apply, and a failing one fails the run, which runs `onFailure`
+ * (the Rollback phase, when there is one). Deletes ride the native
  * prune path, whose bound is per target: the ownership marker on `kubectl`,
  * the ownership tag on `arm` (chant #1448 — previously `--mode Complete`, which
  * removed resources chant never applied), the ownership label on `gcp`
@@ -51,6 +55,15 @@
  *   target: "kubectl",
  *   gate: { gate: "approve-apply", point: "prod-apply" },
  * });
+ *
+ * // validate before, check after (#3370), for any target
+ * export const { op } = ApplyOp({
+ *   name: "collector-rollout",
+ *   env: "prod",
+ *   target: "kubectl",
+ *   preflight: [shell("otelcol-contrib validate --config dist/collector.yaml")],
+ *   verify: [activity("rulesLoadedObserve", { env: "prod" })],
+ * });
  * ```
  *
  * @see #112 — stateless-authoritative state model + live import
@@ -79,6 +92,9 @@ export function ApplyOp(config) {
             },
         ]),
     ];
+    if (config.preflight !== undefined && config.preflight.length > 0) {
+        phases.push(phase("Preflight", config.preflight));
+    }
     if (gated) {
         phases.push(phase("Approve", [
             gate(gateName(config.gate ?? {}) || `approve-${config.name}`, {
@@ -106,6 +122,9 @@ export function ApplyOp(config) {
             ...(config.forceConflicts !== undefined ? { forceConflicts: config.forceConflicts } : {}),
         }, "longInfra"),
     ]));
+    if (config.verify !== undefined && config.verify.length > 0) {
+        phases.push(phase("Verify", config.verify));
+    }
     // Compensation is total or refused (#1449). A rollback path is either the
     // target's mapped native rollback (cloudformation's rollbackStack) or an
     // explicit command; without one there is nothing a Rollback phase could run,

package/dist/op/gate-approval.d.ts

@@ -33,10 +33,10 @@
  * permit counts only while the run resolves that same context (#3774).
  *
  * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
- * Roles on it are what the approver claimed, and since #4290 the quorum
- * never reads them: a role counts only when `.chant/trust.json` at base
- * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
- * still sees the claimed roles in its request.
+ * Roles on it are what the approver claimed, and nothing trusts them: since
+ * #4290 the quorum counts a role only when `.chant/trust.json` at base grants
+ * it and a seal proves the approver (`./gate-quorum.ts`), and since #4324 a
+ * policy's request carries those same roles, never the claimed ones.
  */
 import { type StepOutputRef } from "./step-output-ref.js";
 import { type GateQuorumRule, type GateQuorumSpec } from "./gate-quorum.js";
@@ -165,12 +165,18 @@ export declare function isGatePolicyRef(value: unknown): value is GatePolicyRef;
 export declare function gateApprovalProblems(approval: unknown): string[];
 /** Import `lexicon`'s evaluator. Throws a message that names the package when it is not installed or exports none. */
 export declare function loadGatePolicyEvaluator(lexicon: string): Promise<GatePolicyEvaluator>;
-/** The request a policy is asked about one approval. */
+/**
+ * The request a policy is asked about one approval. `roles` are the ones
+ * `.chant/trust.json` at base gives a proven approver (#4324), as a quorum
+ * judge reads them (`trustQuorumJudge` in `./gate-quorum.ts`). The roles the
+ * approver claims on `approver` are never read. Absent, the principal has none.
+ */
 export declare function gatePolicyRequest(input: {
     op: string;
     gate: string;
     resolvedBy: string;
     approver: GateApprover;
+    roles?: readonly string[];
     planDigest?: string;
     context?: Record<string, unknown>;
 }): GatePolicyRequest;

package/dist/op/gate-approval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAED,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAyDhE;AASD,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}
+{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAED,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAyDhE;AASD,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}

package/dist/op/gate-approval.js

@@ -33,10 +33,10 @@
  * permit counts only while the run resolves that same context (#3774).
  *
  * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
- * Roles on it are what the approver claimed, and since #4290 the quorum
- * never reads them: a role counts only when `.chant/trust.json` at base
- * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
- * still sees the claimed roles in its request.
+ * Roles on it are what the approver claimed, and nothing trusts them: since
+ * #4290 the quorum counts a role only when `.chant/trust.json` at base grants
+ * it and a seal proves the approver (`./gate-quorum.ts`), and since #4324 a
+ * policy's request carries those same roles, never the claimed ones.
  */
 import { createHash } from "node:crypto";
 import { lexiconModulePath, importLexiconPackage } from "../lexicon-module.js";
@@ -153,10 +153,15 @@ export async function loadGatePolicyEvaluator(lexicon) {
     }
     return mod;
 }
-/** The request a policy is asked about one approval. */
+/**
+ * The request a policy is asked about one approval. `roles` are the ones
+ * `.chant/trust.json` at base gives a proven approver (#4324), as a quorum
+ * judge reads them (`trustQuorumJudge` in `./gate-quorum.ts`). The roles the
+ * approver claims on `approver` are never read. Absent, the principal has none.
+ */
 export function gatePolicyRequest(input) {
     return {
-        principal: { kind: input.approver.kind, name: input.resolvedBy, roles: input.approver.roles ?? [] },
+        principal: { kind: input.approver.kind, name: input.resolvedBy, roles: [...(input.roles ?? [])] },
         action: "PassGate",
         resource: { op: input.op, gate: input.gate },
         context: {

package/dist/op/gate-quorum.d.ts

@@ -18,10 +18,16 @@
  * approver counts toward `roles`, and as someone who is not the author, only
  * when the approval proves who they are: a seal that verifies against the
  * signers file at base, or under `pr-review` the forge review of the merged
- * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * pull request, or a review a product recorded on a ledger the spec at base
+ * names (#4333). The judge of a gate decides that ({@link GateQuorumJudge});
  * with none, no approval proves anything, so a rule naming roles or
  * `notAuthor` is never met.
  *
+ * `notAuthor` reads who was involved in the change (#4333): the pull
+ * request's author, each login a `Requested-by:` trailer on its commits
+ * names, and the accounts an agent acts as. With `excludeInvolved`, an
+ * approval by any of them does not count at all.
+ *
  * This module is pure: no git, no file reads, no package, so
  * `@intentius/chant/gate-decision` bundles it. The judge is built by the
  * caller from the trust policy it read at base ({@link trustQuorumJudge}).
@@ -47,8 +53,14 @@ export interface QuorumJudgement {
     proven: boolean;
     /** The roles `.chant/trust.json` at base gives the approver. Empty unless `proven`. */
     roles: string[];
-    /** Whether the approver is the change's author. Undefined when nobody knows who the author is. */
+    /**
+     * Whether the approver was involved in the change: its author, or anyone
+     * else {@link TrustQuorumInput.involved} names. Undefined when nobody knows
+     * who the author is and the approver is not named as involved otherwise.
+     */
     author?: boolean;
+    /** Why the approval does not count at all (#4333): the approver was involved and the judge excludes everyone involved. */
+    excluded?: string;
 }
 /** Judges one approval for the rules. */
 export type GateQuorumJudge = (approval: GateResolutionRecord) => QuorumJudgement;
@@ -108,6 +120,68 @@ export declare function quorumRuleLine(p: GateQuorumRuleProgress): string;
 export declare function quorumWaiting(progress: readonly GateQuorumRuleProgress[]): string;
 /** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
 export declare const ruleNeedsProof: (rule: GateQuorumRule) => boolean;
+/** Someone involved in a change (#4333), and why: `github:bob asked for abc1234`. */
+export interface QuorumInvolvement {
+    who: string;
+    why: string;
+}
+/**
+ * The logins `Requested-by:` trailers on a commit message name, each once.
+ * Any line of the message counts, since a squash merge keeps the trailers of
+ * the commits it squashed in its body.
+ */
+export declare function requestedByTrailers(message: string): string[];
+/**
+ * The names a principal goes by: itself, and for a forge principal
+ * (`github:alice`, `gitlab@gitlab.acme.com:bob`) the login after the colon,
+ * so a trailer's bare login and an approval's principal name one person.
+ */
+export declare function principalNames(who: string): string[];
+/** Why `who` was involved in the change, or undefined when `involved` does not name them. */
+export declare function involvedWhy(involved: readonly QuorumInvolvement[], who: string): string | undefined;
+/**
+ * Everyone involved in a change (#4333): the pull request's `author`, each
+ * login a `Requested-by:` trailer on `commits` names, and the `agents`'
+ * accounts. `principal` turns a trailer's login into the principal the
+ * forge's approvals name (`github:<login>`); absent, the login stands.
+ */
+export declare function changeInvolvement(o: {
+    author?: string;
+    commits?: readonly {
+        sha: string;
+        message: string;
+    }[];
+    agents?: readonly string[];
+    principal?: (login: string) => string;
+}): QuorumInvolvement[];
+/**
+ * A review a product recorded on its own ledger (#4333), as terragucci does
+ * under `pr-review`: a resolution with `via: "pr-review"`, the reviewed
+ * `head`, and the `reviewers` who approved it, by forge login. One line
+ * names every reviewer, so `resolvedBy` is not one person.
+ */
+export interface RecordedReview {
+    pr?: number;
+    head: string;
+    reviewers: string[];
+}
+/** The review a ledger line records, when it is a product's review line; null otherwise. */
+export declare function recordedReviewOf(r: GateResolutionRecord): RecordedReview | null;
+/**
+ * The approvals a product's review lines stand for (#4333): each line
+ * {@link recordedReviewOf} reads becomes one approval per reviewer, named by
+ * `principal(login)` (the login itself when absent), a human's, with the
+ * review on it. A seal on the line is dropped: it signs the line, not any
+ * one reviewer. Every other line is kept as it is. `reviews` lists the
+ * reviews read, for {@link TrustQuorumInput.recorded}.
+ */
+export declare function recordedReviewApprovals(records: readonly GateResolutionRecord[], principal?: (login: string) => string): {
+    records: GateResolutionRecord[];
+    reviews: {
+        head: string;
+        approvers: string[];
+    }[];
+};
 /** What {@link trustQuorumJudge} judges by. */
 export interface TrustQuorumInput {
     /** The signers at base: an approval whose seal verifies for its approver against them is proven. */
@@ -116,6 +190,25 @@ export interface TrustQuorumInput {
     roles: Readonly<Record<string, readonly string[]>>;
     /** The change's authors, as principals. Absent, nobody knows who they are. */
     authors?: readonly string[];
+    /**
+     * Everyone else involved in the change (#4333), from {@link
+     * changeInvolvement}: an approver named here is judged as an author, for
+     * `notAuthor`, whether or not `authors` is known.
+     */
+    involved?: readonly QuorumInvolvement[];
+    /** An approval by an author or anyone `involved` names does not count at all (#4333), toward any rule. */
+    excludeInvolved?: boolean;
+    /**
+     * Reviews a product recorded on the ledger the spec at base names (#4333),
+     * from {@link recordedReviewApprovals}: a resolution that names one's head
+     * and one of its approvers as `resolvedBy` is proven, as for `review`. Pass
+     * them only under `pr-review`, as the product proves its reviewers only
+     * then.
+     */
+    recorded?: readonly {
+        head: string;
+        approvers: readonly string[];
+    }[];
     /**
      * Under `pr-review`, the merged pull request's review, read from the forge
      * in this run: a resolution that names this review's head and one of its
@@ -126,6 +219,10 @@ export interface TrustQuorumInput {
         approvers: readonly string[];
     };
 }
-/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+/**
+ * The judge a gate's rules are met by: proof from a seal, the live review or
+ * a review a product recorded, roles from trust.json at base, and the
+ * change's authors and everyone else involved in it left out.
+ */
 export declare function trustQuorumJudge(input: TrustQuorumInput): GateQuorumJudge;
 //# sourceMappingURL=gate-quorum.d.ts.map

package/dist/op/gate-quorum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAYzE"}
+{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0HAA0H;IAC1H,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAKD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpD;AAED,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGnG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,GAAG,iBAAiB,EAAE,CAWtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,cAAc,GAAG,IAAI,CAK/E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,oBAAoB,EAAE,EACxC,SAAS,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAyB,GACtD;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;CAAE,CAgBvF;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACxC,0GAA0G;IAC1G,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAgBzE"}

package/dist/op/gate-quorum.js

@@ -18,10 +18,16 @@
  * approver counts toward `roles`, and as someone who is not the author, only
  * when the approval proves who they are: a seal that verifies against the
  * signers file at base, or under `pr-review` the forge review of the merged
- * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * pull request, or a review a product recorded on a ledger the spec at base
+ * names (#4333). The judge of a gate decides that ({@link GateQuorumJudge});
  * with none, no approval proves anything, so a rule naming roles or
  * `notAuthor` is never met.
  *
+ * `notAuthor` reads who was involved in the change (#4333): the pull
+ * request's author, each login a `Requested-by:` trailer on its commits
+ * names, and the accounts an agent acts as. With `excludeInvolved`, an
+ * approval by any of them does not count at all.
+ *
  * This module is pure: no git, no file reads, no package, so
  * `@intentius/chant/gate-decision` bundles it. The judge is built by the
  * caller from the trust policy it read at base ({@link trustQuorumJudge}).
@@ -125,7 +131,7 @@ export function quorumRuleProgress(rule, approvers) {
     const seen = new Set();
     const counted = [];
     for (const a of [...approvers].sort((x, y) => Date.parse(x.at) - Date.parse(y.at))) {
-        if (seen.has(norm(a.who)))
+        if (seen.has(norm(a.who)) || a.judged.excluded !== undefined)
             continue;
         if (rule.roles?.length && !(a.judged.proven && a.judged.roles.some((r) => rule.roles.includes(r))))
             continue;
@@ -168,16 +174,112 @@ export function quorumWaiting(progress) {
 }
 /** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
 export const ruleNeedsProof = (rule) => (rule.roles?.length ?? 0) > 0 || rule.notAuthor === true;
-/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+/** A login as a forge allows it, and a GitHub App's `[bot]` suffix. */
+const LOGIN = /^[A-Za-z0-9][A-Za-z0-9._-]*(\[bot\])?$/;
+/**
+ * The logins `Requested-by:` trailers on a commit message name, each once.
+ * Any line of the message counts, since a squash merge keeps the trailers of
+ * the commits it squashed in its body.
+ */
+export function requestedByTrailers(message) {
+    const out = [];
+    for (const line of message.replace(/\r\n/g, "\n").split("\n")) {
+        const m = /^requested-by:\s*(\S+)\s*$/i.exec(line.trim());
+        if (m && LOGIN.test(m[1]) && !out.some((o) => samePrincipal(o, m[1])))
+            out.push(m[1]);
+    }
+    return out;
+}
+/**
+ * The names a principal goes by: itself, and for a forge principal
+ * (`github:alice`, `gitlab@gitlab.acme.com:bob`) the login after the colon,
+ * so a trailer's bare login and an approval's principal name one person.
+ */
+export function principalNames(who) {
+    const m = /^(?:github|gitlab|forgejo|gitea|codeberg)(?:@[^:\s]+)?:(.+)$/i.exec(who.trim());
+    return m ? [who, m[1]] : [who];
+}
+/** Why `who` was involved in the change, or undefined when `involved` does not name them. */
+export function involvedWhy(involved, who) {
+    const names = principalNames(who);
+    return involved.find((p) => principalNames(p.who).some((a) => names.some((b) => samePrincipal(a, b))))?.why;
+}
+/**
+ * Everyone involved in a change (#4333): the pull request's `author`, each
+ * login a `Requested-by:` trailer on `commits` names, and the `agents`'
+ * accounts. `principal` turns a trailer's login into the principal the
+ * forge's approvals name (`github:<login>`); absent, the login stands.
+ */
+export function changeInvolvement(o) {
+    const out = [];
+    const add = (who, why) => {
+        if (who.trim() && !out.some((p) => samePrincipal(p.who, who)))
+            out.push({ who, why });
+    };
+    if (o.author)
+        add(o.author, `${o.author} opened the change`);
+    for (const c of o.commits ?? []) {
+        for (const login of requestedByTrailers(c.message))
+            add(o.principal ? o.principal(login) : login, `${login} asked for ${c.sha.slice(0, 7)}`);
+    }
+    for (const a of o.agents ?? [])
+        add(a, `${a} is an account an agent acts as`);
+    return out;
+}
+/** The review a ledger line records, when it is a product's review line; null otherwise. */
+export function recordedReviewOf(r) {
+    const x = r;
+    if (x.via !== "pr-review" || typeof x.head !== "string" || x.head === "")
+        return null;
+    if (!Array.isArray(x.reviewers) || x.reviewers.length === 0 || x.reviewers.some((v) => typeof v !== "string" || v === ""))
+        return null;
+    return { ...(typeof x.pr === "number" ? { pr: x.pr } : {}), head: x.head, reviewers: [...x.reviewers] };
+}
+/**
+ * The approvals a product's review lines stand for (#4333): each line
+ * {@link recordedReviewOf} reads becomes one approval per reviewer, named by
+ * `principal(login)` (the login itself when absent), a human's, with the
+ * review on it. A seal on the line is dropped: it signs the line, not any
+ * one reviewer. Every other line is kept as it is. `reviews` lists the
+ * reviews read, for {@link TrustQuorumInput.recorded}.
+ */
+export function recordedReviewApprovals(records, principal = (login) => login) {
+    const out = [];
+    const reviews = [];
+    for (const r of records) {
+        const review = recordedReviewOf(r);
+        if (!review) {
+            out.push(r);
+            continue;
+        }
+        const approvers = review.reviewers.map(principal);
+        reviews.push({ head: review.head, approvers });
+        const { seal: _seal, ...rest } = r;
+        const base = Object.fromEntries(Object.entries(rest).filter(([k]) => !["via", "reviewers", "head", "pr", "excluded"].includes(k)));
+        for (const who of approvers)
+            out.push({ ...base, resolvedBy: who, approver: { kind: "human" }, review: { pr: review.pr ?? 0, head: review.head, approvers } });
+    }
+    return { records: out, reviews };
+}
+/**
+ * The judge a gate's rules are met by: proof from a seal, the live review or
+ * a review a product recorded, roles from trust.json at base, and the
+ * change's authors and everyone else involved in it left out.
+ */
 export function trustQuorumJudge(input) {
+    const named = (list, who) => list.some((a) => samePrincipal(a, who));
     return (r) => {
         const sealed = r.seal !== undefined && r.seal !== null && gateSealRefusal(input.signers, r) === null;
-        const reviewed = input.review !== undefined && r.review?.head === input.review.head && input.review.approvers.some((a) => samePrincipal(a, r.resolvedBy));
-        const proven = sealed || reviewed;
+        const reviewed = input.review !== undefined && r.review?.head === input.review.head && named(input.review.approvers, r.resolvedBy);
+        const recorded = r.review !== undefined && (input.recorded ?? []).some((x) => x.head === r.review.head && named(x.approvers, r.resolvedBy));
+        const proven = sealed || reviewed || recorded;
+        const authored = input.authors !== undefined && input.authors.some((a) => samePrincipal(a, r.resolvedBy));
+        const why = authored ? `${r.resolvedBy} wrote the change` : involvedWhy(input.involved ?? [], r.resolvedBy);
         return {
             proven,
             roles: proven ? rolesOf(r.resolvedBy, input.roles) : [],
-            ...(input.authors !== undefined ? { author: input.authors.some((a) => samePrincipal(a, r.resolvedBy)) } : {}),
+            ...(why !== undefined ? { author: true } : input.authors !== undefined ? { author: false } : {}),
+            ...(why !== undefined && input.excludeInvolved ? { excluded: `${why}, so ${r.resolvedBy}'s approval does not count` } : {}),
         };
     };
 }

package/dist/op/gate-review.d.ts

@@ -85,6 +85,15 @@ export declare function gitlabReviews(opts: ReviewSourceOptions): ReviewSource;
  * Throws naming what is missing.
  */
 export declare function reviewSourceFromEnv(env?: Record<string, string | undefined>, fetchImpl?: ForgeFetch): ReviewSource;
+/**
+ * The principal a forge login on the CI job's forge goes by (#4333):
+ * `github:<login>` on github.com, `gitlab@<host>:<login>` on another host,
+ * as {@link reviewSourceFromEnv}'s reviews name their approvers. A product
+ * records its reviewers and its `Requested-by:` trailers by login, and this
+ * reads them as the approvals they stand beside. A value that already has a
+ * forge's prefix is kept.
+ */
+export declare function forgePrincipalFromEnv(env?: Record<string, string | undefined>): (login: string) => string;
 /**
  * The head of the pull request a CI job runs for, from its environment: the
  * event payload's `pull_request.head.sha` on GitHub and Forgejo (whose

package/dist/op/gate-review.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-review.d.ts","sourceRoot":"","sources":["../../src/op/gate-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAmC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAI5E,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAOtF;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAIzG;AAKD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGxF,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iDAAiD;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,kGAAkG;IAClG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD;AAuBD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAoFD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAErE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAEtE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAsDrE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,YAAY,CAiB/H;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,GAAG,SAAS,CAahH"}
+{"version":3,"file":"gate-review.d.ts","sourceRoot":"","sources":["../../src/op/gate-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAmC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAI5E,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAOtF;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAIzG;AAKD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGxF,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iDAAiD;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,kGAAkG;IAClG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD;AAuBD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAoFD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAErE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAEtE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAsDrE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,YAAY,CAiB/H;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAItH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,GAAG,SAAS,CAahH"}

package/dist/op/gate-review.js

@@ -265,6 +265,19 @@ export function reviewSourceFromEnv(env = process.env, fetchImpl) {
     const opts = { apiBase: env.GITHUB_API_URL ?? (forgejo ? `${trimSlash(env.GITHUB_SERVER_URL ?? "")}/api/v1` : "https://api.github.com"), repo: env.GITHUB_REPOSITORY, token, host, ...f };
     return forgejo ? forgejoReviews(opts) : githubReviews(opts);
 }
+/**
+ * The principal a forge login on the CI job's forge goes by (#4333):
+ * `github:<login>` on github.com, `gitlab@<host>:<login>` on another host,
+ * as {@link reviewSourceFromEnv}'s reviews name their approvers. A product
+ * records its reviewers and its `Requested-by:` trailers by login, and this
+ * reads them as the approvals they stand beside. A value that already has a
+ * forge's prefix is kept.
+ */
+export function forgePrincipalFromEnv(env = process.env) {
+    const kind = env.GITLAB_CI === "true" ? "gitlab" : env.FORGEJO_ACTIONS === "true" || env.GITEA_ACTIONS === "true" ? "forgejo" : "github";
+    const host = kind === "gitlab" ? (env.CI_SERVER_HOST ?? hostOf(env.CI_SERVER_URL, "gitlab.com")) : hostOf(env.GITHUB_SERVER_URL, "github.com");
+    return (login) => (/^(?:github|gitlab|forgejo|gitea|codeberg)(?:@[^:\s]+)?:/i.test(login.trim()) ? login : forgePrincipalOf(kind, host, login));
+}
 /**
  * The head of the pull request a CI job runs for, from its environment: the
  * event payload's `pull_request.head.sha` on GitHub and Forgejo (whose