@intentius/chant 0.124.45 → 0.124.48

package/src/op/local-executor.ts

@@ -35,13 +35,14 @@ import { contentDigest } from "../content-digest";
 import { parseDuration } from "./duration";
 import { stepLabel, withRunConsole, withStepConsole } from "./step-console";
 import { stepTimeoutProblem } from "./activity-profiles";
-import { describeGateMismatch, evaluateGate, gateIsSealed, gitGateLedgerPort, type GateCheck, type GateLedgerPort } from "./gate";
+import { describeGateMismatch, evaluateGate, gateIsSealed, gitGateLedgerPort, type GateApprovalRule, type GateCheck, type GateLedgerPort, type WorkspaceGateStandIn } from "./gate";
+import { resolveWorkspaceRun, type WorkspaceRunCitation } from "./workspace-run-env";
 import { gateName } from "./gate-name";
 import { resolveGateAliases } from "./gate-alias";
 import { gatePointOf } from "./gate-point";
 import { evaluatePointGate, workspaceGatePointAsker, type GatePointAsker } from "./gate-point-run";
 import type { ResolvedGateApproval } from "./gate-approval";
-import { quorumRules, quorumRulesFor } from "./gate-quorum";
+import { quorumRules, quorumRulesFor, type GateQuorumSpec } from "./gate-quorum";
 import { GATE_PLAN_CONTEXT_KEY, gatePlanSummaryOfResult } from "./gate-plan-context";
 import { withOpRunContext, type OpRunContext, type PassedGate } from "./run-context";
 import type { GateAnswerRef, PendingGateRecord } from "../lifecycle/gate-ledger";
@@ -109,8 +110,11 @@ export interface StepRecord {
     /**
      * On a gate with an `approval` block (#2508): whether a quorum or a policy permit passed it. `"point"` on a gate that asks a decision point (#3170).
      * `"alias"` (#3949) when an approval recorded under one of the gate's aliases counted, on any gate.
+     * `"workspace"` (#2554) when a workspace gate's approval stood in for it.
      */
-    via?: "quorum" | "policy" | "point" | "alias" | "empty";
+    via?: "quorum" | "policy" | "point" | "alias" | "empty" | "workspace";
+    /** With `via: "workspace"` (#2554): the workspace gate and the digest of the member plans its approval covers. */
+    workspaceGate?: { gate: string; digest: string };
     /** On a gate with a quorum (#2508): every approver who counted toward it. */
     approvers?: string[];
     /** On a gate that asks a decision point (#3170): the answer record that passed it, which the gate ledger's resolution cites too. */
@@ -612,6 +616,8 @@ interface GateContext {
   onRecord?: (record: StepRecord) => void;
   /** Where the run's events go (#4041): a step's start, its settle and its gate's decision. */
   emit?: RunEventSink;
+  /** A workspace gate that may stand in for this run's gates (#2554). Absent outside a workspace run started with a gate. */
+  workspace?: WorkspaceGateStandIn;
   /** The run context's list of passed gates (#2522). A gate that passes is appended here. */
   passed?: PassedGate[];
   /** The run's hold on its work item's lease (#2748). Absent in compensation phases, which run whatever the lease did. */
@@ -729,14 +735,23 @@ function gateFn(step: GateStep): string {
  * returned, the same walk `plan` goes through. A reference that resolves to
  * nothing is dropped rather than failing the run, so a policy reading it sees
  * the attribute as absent.
+ *
+ * #4324: the quorum is `identity.gates.<gate>.quorum` in the workspace
+ * declaration at base (`atBase`) whenever that sets one, and the Op's own
+ * `approval.quorum` is not read then, so a change can't lower the quorum its
+ * own run needs. The base quorum applies to a gate whose Op declares no
+ * `approval` block too. With none at base, the Op's quorum applies as before.
  */
-function resolveGateApproval(
+export function resolveGateApproval(
   step: GateStep,
   resultsById: ReadonlyMap<string, unknown>,
   env?: string,
+  atBase?: GateQuorumSpec | null,
 ): ResolvedGateApproval | undefined {
-  const authored = step.approval;
+  const baseQuorum = atBase ?? undefined;
+  const authored = step.approval ?? (baseQuorum !== undefined ? {} : undefined);
   if (!authored) return undefined;
+  const quorum = baseQuorum ?? authored.quorum;
   let context: Record<string, unknown> | undefined;
   if (authored.context) {
     context = {};
@@ -755,10 +770,10 @@ function resolveGateApproval(
   // #4290: the rules this run's gate takes, by its environment. A rule with
   // `targets` never covers a run with no environment. One rule with no
   // `targets` keeps its own shape, so a standing pending fact still matches.
-  const single = authored.quorum !== undefined && !Array.isArray(authored.quorum) && (authored.quorum as { targets?: unknown }).targets === undefined;
-  const rules = authored.quorum ? quorumRulesFor(quorumRules(authored.quorum), env !== undefined ? [env] : []) : [];
+  const single = quorum !== undefined && !Array.isArray(quorum) && (quorum as { targets?: unknown }).targets === undefined;
+  const rules = quorum ? quorumRulesFor(quorumRules(quorum), env !== undefined ? [env] : []) : [];
   return {
-    ...(single ? { quorum: authored.quorum } : rules.length > 0 ? { quorum: rules } : {}),
+    ...(single ? { quorum } : rules.length > 0 ? { quorum: rules } : {}),
     ...(authored.policy ? { policy: authored.policy } : {}),
     mode: authored.mode ?? "log-only",
     ...(context ? { context } : {}),
@@ -786,7 +801,16 @@ async function runGateStep(
   // a run over a missing digest.
   const resolvedPlan = resolveStepOutputRefs(step.plan, resultsById);
   const planDigest = typeof resolvedPlan === "string" && resolvedPlan !== "" ? resolvedPlan : undefined;
-  const approval = resolveGateApproval(step, resultsById, gates.env);
+  // #4324: the workspace's rule for this gate at base, read once: its quorum
+  // replaces the Op's, and evaluateGate judges approvals by it. A read that
+  // fails ends the step as a failing record, as a ledger read does below.
+  let rule: GateApprovalRule | null;
+  try {
+    rule = (await gates.port.approvalRule?.(gateName(step))) ?? null;
+  } catch (err) {
+    return { record: { phase: phaseName, fn: gateFn(step), args: {}, status: "fail", durationMs: Date.now() - start, error: errMessage(err) } };
+  }
+  const approval = resolveGateApproval(step, resultsById, gates.env, rule?.requirement.quorum);
   // #3947: a gate that resumes stores the outputs the steps after it read.
   const resumeAt = gates.resume?.gates.get(step);
   let checkpoint: GateCheckpoint | undefined;
@@ -814,9 +838,11 @@ async function runGateStep(
       ...(gates.gitSha ? { gitSha: gates.gitSha } : {}),
       ...(planDigest !== undefined ? { planDigest } : {}),
       ...(approval ? { approval } : {}),
+      rule,
       ...(gates.now ? { now: gates.now } : {}),
       ...(checkpoint ? { checkpoint } : {}),
       ...(step.aliases?.length ? { aliases: resolveGateAliases(step, gates.op) } : {}),
+      ...(gates.workspace ? { workspace: gates.workspace } : {}),
     });
   } catch (err) {
     // Deciding a gate reads and writes the `chant/lifecycle` branch, so it
@@ -847,6 +873,7 @@ async function runGateStep(
       timestamp: resolution.timestamp,
       ...(resolution.url ? { url: resolution.url } : {}),
       ...(check.via ? { via: check.via } : {}),
+      ...(resolution.workspaceGate ? { workspaceGate: resolution.workspaceGate } : {}),
       ...(check.approvals ? { approvers: check.approvals.map((r) => r.resolvedBy) } : {}),
       ...(check.carried?.length
         ? { carriedFrom: check.carried.map((r) => ({ op: r.carriedFrom!.op, gate: r.carriedFrom!.gate, resolvedBy: r.resolvedBy, timestamp: r.carriedFrom!.timestamp })) }
@@ -1278,6 +1305,18 @@ export interface RunOpOptions {
   gates?: GateLedgerPort;
   /** Working directory for the default git-backed gate ledger. */
   cwd?: string;
+  /**
+   * The workspace run that started this run (#2554). Defaults to the one the
+   * environment names (`CHANT_WORKSPACE_RUN`, `./workspace-run-env.ts`). The
+   * run record cites it.
+   */
+  workspaceRun?: WorkspaceRunCitation;
+  /**
+   * The workspace gate that may stand in for this run's gates (#2554). Defaults
+   * to the gate the workspace run names, read from the workspace ledger with
+   * the member's opt-in at base; a test passes a stub.
+   */
+  workspaceGate?: WorkspaceGateStandIn;
   /** ISO-8601 "now", so a gate decision is deterministic under test. */
   now?: string;
   /** Identifies this run on any pending fact it records. */
@@ -1492,6 +1531,8 @@ async function runOpInTurn(
   const commit = options.commit ?? (await resolveCommitSha(options.cwd ? { cwd: options.cwd } : {}));
   // #4020: the CI run this one is in, in the shape a deploy record carries it.
   const ciRun = resolveCiRun();
+  // #2554: the workspace run that started this one, which its record cites.
+  const workspaceRun = options.workspaceRun ?? resolveWorkspaceRun();
   // #4041: the run's events name it the way its run record does: its own id,
   // the commit, and the CI run it is in.
   // #4042: a run that writes to the ledger also keeps its events on this host,
@@ -1535,6 +1576,11 @@ async function runOpInTurn(
     passed: run.passedGates,
     points: options.points ?? workspaceGatePointAsker(options.cwd ?? process.cwd()),
     ...(options.env !== undefined ? { env: options.env } : {}),
+    ...(options.workspaceGate
+      ? { workspace: options.workspaceGate }
+      : workspaceRun?.gate
+        ? { workspace: lazyWorkspaceGate(options.cwd ?? process.cwd(), workspaceRun.gate) }
+        : {}),
   };
 
   // Effect steps are ordered (read-compare-run-write): refuse them in a
@@ -1658,6 +1704,7 @@ async function runOpInTurn(
       ...(resumed ? { resumed } : {}),
       ...(commit ? { gitSha: commit } : {}),
       ...(options.runner ? { runOrigin: options.runner.runOrigin } : ciRun ? { runOrigin: ciRun.runOrigin } : {}),
+      ...(workspaceRun ? { workspaceRun: { id: workspaceRun.id, ...(workspaceRun.gate ? { gate: workspaceRun.gate } : {}) } } : {}),
       phaseDurations,
     });
     if (status === "fail" && options.describeFailure) {
@@ -1954,3 +2001,16 @@ function phaseVerdict(records: readonly StepRecord[]): "ok" | "fail" | "skipped"
 function errMessage(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
 }
+
+/**
+ * The workspace gate stand-in for a member run (#2554), loading the workspace
+ * code only when a gate is asked about it.
+ */
+function lazyWorkspaceGate(cwd: string, gate: string): WorkspaceGateStandIn {
+  return {
+    async standIn(q) {
+      const { memberGateStandIn } = await import("../workspace/workspace-gates");
+      return memberGateStandIn(cwd, gate, q);
+    },
+  };
+}

package/src/op/op-waves-depends-on.test.ts

@@ -0,0 +1,81 @@
+/**
+ * A failed run blocks only the runs that depend on it (#4322): the waves'
+ * jobs pass outcome files, and a later wave's job reads them.
+ */
+
+import { describe, expect, test } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { assertOpWavesSpec, opWaveJobs, type OpWavesSpec } from "./op-waves";
+import { runOpWave, type OpWaveExec, type OpWaveShowAtBase } from "./op-waves-run";
+import { memoryGateLedgerPort } from "./gate";
+
+const spec: OpWavesSpec = {
+  name: "roots",
+  op: "tf",
+  plan: ["tool", "plan", "{target}", "--out", "{plan}"],
+  apply: ["tool", "apply", "{target}", "--plan", "{plan}"],
+  waves: [
+    { name: "base", runs: [{ target: "a" }, { target: "b" }, { target: "b2", dependsOn: ["a"] }], gate: "never" },
+    { name: "app", runs: [{ target: "c", dependsOn: ["b"] }, { target: "d", dependsOn: ["a"] }, { target: "e", dependsOn: ["b2"] }, { target: "f", dependsOn: ["d"] }], gate: "never" },
+  ],
+};
+
+const digest = (n: string) => `sha256:${n.repeat(64)}`;
+
+function harness(failing: string[], s: OpWavesSpec = spec) {
+  const cwd = mkdtempSync(join(tmpdir(), "op-waves-deps-"));
+  const calls: string[] = [];
+  const exec: OpWaveExec = (argv, dir) => {
+    calls.push(argv.join(" "));
+    if (argv[1] === "plan") writeFileSync(join(dir, argv[4]!), JSON.stringify({ planDigest: digest("1") }));
+    if (argv[1] === "apply" && failing.includes(argv[2]!)) return 1;
+    return 0;
+  };
+  const show: OpWaveShowAtBase = () => ({ sha: "b".repeat(40), text: JSON.stringify(s) });
+  const run = (wave: number) => runOpWave({ spec: s, specFile: "waves.json", wave, cwd, exec, show, gates: memoryGateLedgerPort(), log: () => {} });
+  return { cwd, calls, run, done: () => rmSync(cwd, { recursive: true, force: true }) };
+}
+
+describe("run-level dependsOn on Op waves (#4322)", () => {
+  test("two runs in wave 1, one failing: the wave 2 run that depends on the other applies", async () => {
+    const h = harness(["a"]);
+    const one = await h.run(1);
+    expect(one).toMatchObject({ exitCode: 1, applied: ["b"], failed: ["a"], blocked: { b2: "a" } });
+    const two = await h.run(2);
+    expect(two.applied).toEqual(["c"]);
+    expect(two.blocked).toEqual({ d: "a", e: "a", f: "a" });
+    expect(two.exitCode).toBe(1);
+    expect(h.calls.some((c) => c.startsWith("tool apply c "))).toBe(true);
+    expect(h.calls.some((c) => c.startsWith("tool plan d") || c.startsWith("tool apply d"))).toBe(false);
+    h.done();
+  });
+
+  test("with nothing failed every run applies and the wave 2 job exits 0", async () => {
+    const h = harness([]);
+    expect((await h.run(1)).exitCode).toBe(0);
+    const two = await h.run(2);
+    expect(two).toMatchObject({ exitCode: 0, applied: ["c", "d", "e", "f"] });
+    expect(two.blocked).toBeUndefined();
+    h.done();
+  });
+
+  test("a run listed before in its own wave blocks its dependent when it fails", async () => {
+    const h = harness(["c"]);
+    await h.run(1);
+    const two = await h.run(2);
+    expect(two).toMatchObject({ exitCode: 1, failed: ["c"] });
+    expect(two.applied).toEqual(["d", "e", "f"]);
+    h.done();
+  });
+
+  test("a spec whose dependsOn names no earlier or preceding run is refused", () => {
+    const bad: OpWavesSpec = { ...spec, waves: [{ name: "x", runs: [{ target: "a", dependsOn: ["nope"] }], gate: "never" }] };
+    expect(() => assertOpWavesSpec(bad)).toThrow(/depends on "nope"/);
+  });
+
+  test("every wave job names an outcome file", () => {
+    for (const job of opWaveJobs(spec, "waves.json")) expect(job.outcome).toMatch(/^\.chant\/op-waves\/roots\/outcomes\/outcome-wave-\d/);
+  });
+});

package/src/op/op-waves-hook-targets.test.ts

@@ -27,8 +27,10 @@ describe("hook targets and before.observe in the spec (#4288)", () => {
     expect(() => assertOpWaveHooks("w", { before: { observe: [{ command: ["x"], targets: ["prod/**"], onFailure: "approve" }] } })).not.toThrow();
   });
 
-  test("a pull-request job refuses after.gate and apply.runBy", () => {
-    expect(() => assertPrLoopHooks("ci.hooks", { after: { gate: [{ command: ["x"] }] } })).toThrow(/after.gate runs in an Op waves job only/);
+  test("a pull-request job accepts after.gate (#4323) and refuses apply.runBy", () => {
+    expect(() => assertPrLoopHooks("ci.hooks", { after: { gate: [{ command: ["x"] }] } })).not.toThrow();
+    // onFailure "approve" stays refused at after.gate, as in an Op waves job.
+    expect(() => assertPrLoopHooks("ci.hooks", { after: { gate: [{ command: ["x"], onFailure: "approve" }] } })).toThrow(/after.gate/);
     expect(() => assertPrLoopHooks("ci.hooks", { apply: { runBy: "apply" } })).toThrow(/runBy is for an Op waves spec/);
     expect(() => assertPrLoopHooks("ci.hooks", { before: { observe: [{ command: ["x"] }], apply: [{ command: ["y"] }] } })).not.toThrow();
   });

package/src/op/op-waves-quorum-product.test.ts

@@ -0,0 +1,158 @@
+import { describe, expect, test } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { assertOpWavesSpec, type OpWavesSpec } from "./op-waves";
+import { runOpWave, type OpWaveExec, type OpWaveShowAtBase } from "./op-waves-run";
+import { memoryGateLedgerPort, type GateLedgerPort } from "./gate";
+import { changeInvolvement, recordedReviewApprovals, requestedByTrailers, trustQuorumJudge } from "./gate-quorum";
+import { waveSetDigest } from "../gated-waves";
+import type { GateResolutionRecord } from "../lifecycle/gate-ledger";
+import type { TrustPolicy } from "../workspace/trust/policy";
+import type { MergedReview, ReviewSource } from "./gate-review";
+
+// A review a product records itself (terragucci's `tf-apply` ledger under
+// `pr-review`), and everyone involved in a change (#4333), as terragucci's
+// ruleApprovers (apply.ts) and Involved (involved.ts) judge them.
+
+const digest = (n: string) => `sha256:${n.repeat(64)}`;
+const spec: OpWavesSpec = {
+  name: "migrations",
+  op: "migrate",
+  plan: ["tool", "plan", "{target}", "--out", "{plan}"],
+  apply: ["tool", "apply", "{target}", "--plan", "{plan}"],
+  waves: [{ name: "prod", approval: "pr-review", runs: [{ target: "prod-eu" }] }],
+};
+const set = waveSetDigest([{ member: "prod-eu", planDigest: digest("e") }]);
+const atBase: OpWavesSpec = {
+  ...spec,
+  approvals: {
+    quorum: [{ count: 2, roles: ["platform"], notAuthor: true }],
+    reviewLedger: "tf-apply",
+    involved: { agents: ["tg-bot"], exclude: true },
+  },
+};
+const headSha = "r".repeat(40);
+
+function harness(base: OpWavesSpec) {
+  const cwd = mkdtempSync(join(tmpdir(), "op-waves-product-"));
+  const exec: OpWaveExec = (argv, dir) => {
+    if (argv[1] === "plan") writeFileSync(join(dir, argv[4]!), JSON.stringify({ planDigest: digest("e") }));
+    return 0;
+  };
+  const show: OpWaveShowAtBase = () => ({ sha: "b".repeat(40), text: JSON.stringify(base) });
+  return { cwd, exec, show, done: () => rmSync(cwd, { recursive: true, force: true }) };
+}
+
+const trust = (): TrustPolicy =>
+  ({
+    base: "b".repeat(40), signersPath: ".chant/allowed_signers", active: false, signers: [], excluded: [],
+    roles: { platform: ["github:alice", "github:bob", "github:carol", "github:dana", "github:tg-bot"] },
+    adopted: [], runners: [], excludedRunners: [], admitted: {}, problems: [],
+  }) as TrustPolicy;
+
+/** A port whose `read(op)` returns that op's lines, as the lifecycle branch's `_gates/<op>.jsonl` does. */
+function ledgerPort(lines: GateResolutionRecord[]): GateLedgerPort & { resolved: GateResolutionRecord[] } {
+  const inner = memoryGateLedgerPort({ resolutions: lines });
+  return { ...inner, resolved: inner.resolved, async read(op) { const r = await inner.read(op); return { ...r, resolutions: r.resolutions.filter((x) => x.op === op) }; } };
+}
+
+/** What terragucci writes under `pr-review`: one line, every reviewer, none of them `resolvedBy` on their own. */
+const productReview = (reviewers: string[], at: string, o: Partial<Record<string, unknown>> = {}): GateResolutionRecord =>
+  ({ version: 1, kind: "resolution", op: "tf-apply", gate: "migrations-wave-1", resolvedBy: reviewers.join(","), timestamp: at, planDigest: set, via: "pr-review", pr: 7, head: headSha, reviewers, ...o }) as unknown as GateResolutionRecord;
+
+const merged: MergedReview = { pr: 7, head: headSha, author: "github:dana", approvers: [], refused: [] };
+const reviews: ReviewSource = { kind: "github", mergedReview: async () => merged };
+const requestedByBob = () => [{ sha: "abc1234def", message: "feat: widen the pool\n\nRequested-by: bob" }];
+
+const run = (h: ReturnType<typeof harness>, gates: GateLedgerPort, o: Partial<Parameters<typeof runOpWave>[0]> = {}) =>
+  runOpWave({ spec: atBase, specFile: "waves.json", wave: 1, cwd: h.cwd, exec: h.exec, show: h.show, gates, head: "m".repeat(40), reviews, trust: trust, commits: requestedByBob, now: "2026-10-22T02:00:00Z", ...o });
+
+describe("a review a product records, and everyone involved in a change (#4333)", () => {
+  test("the spec checks approvals.reviewLedger and approvals.involved", () => {
+    expect(() => assertOpWavesSpec(atBase)).not.toThrow();
+    expect(() => assertOpWavesSpec({ ...spec, approvals: { reviewLedger: "../x" } })).toThrow(/reviewLedger must name an op/);
+    expect(() => assertOpWavesSpec({ ...spec, approvals: { involved: { agents: [] } } })).toThrow(/involved.agents/);
+    expect(() => assertOpWavesSpec({ ...spec, approvals: { involved: { exclude: "yes" } } } as unknown as OpWavesSpec)).toThrow(/involved.exclude/);
+  });
+
+  test("Requested-by trailers and an agent's account are involved, as terragucci's Involved reads them", () => {
+    expect(requestedByTrailers("fix\n\nRequested-by: bob\nrequested-by: Bob\nRequested-by: not a login!")).toEqual(["bob"]);
+    const principal = (l: string) => `github:${l}`;
+    const inv = changeInvolvement({ author: "github:dana", commits: requestedByBob(), agents: ["github:tg-bot"], principal });
+    expect(inv).toEqual([
+      { who: "github:dana", why: "github:dana opened the change" },
+      { who: "github:bob", why: "bob asked for abc1234" },
+      { who: "github:tg-bot", why: "github:tg-bot is an account an agent acts as" },
+    ]);
+  });
+
+  test("the judge proves a reviewer from a recorded review, and leaves out the involved, as ruleApprovers does", () => {
+    const principal = (l: string) => `github:${l}`;
+    const read = recordedReviewApprovals([productReview(["alice", "bob", "tg-bot"], "2026-10-22T01:00:00Z")], principal);
+    expect(read.records.map((r) => r.resolvedBy)).toEqual(["github:alice", "github:bob", "github:tg-bot"]);
+    const judge = trustQuorumJudge({
+      signers: trust(),
+      roles: trust().roles,
+      authors: ["github:dana"],
+      involved: changeInvolvement({ commits: requestedByBob(), agents: ["github:tg-bot"], principal }),
+      excludeInvolved: true,
+      recorded: read.reviews,
+    });
+    const j = (who: string) => judge(read.records.find((r) => r.resolvedBy === who)!);
+    expect(j("github:alice")).toEqual({ proven: true, roles: ["platform"], author: false });
+    expect(j("github:bob")).toMatchObject({ proven: true, author: true, excluded: "bob asked for abc1234, so github:bob's approval does not count" });
+    expect(j("github:tg-bot").excluded).toMatch(/account an agent acts as/);
+    // Without a recorded review the same approval proves nobody.
+    const none = trustQuorumJudge({ signers: trust(), roles: trust().roles });
+    expect(none(read.records[0]!)).toEqual({ proven: false, roles: [] });
+  });
+
+  test("a wave counts each reviewer of a recorded review, leaves out the requester and the agent, and passes on a second", async () => {
+    const h = harness(atBase);
+    const logs: string[] = [];
+    // alice reviewed with bob (who asked for the change) and the agent's account: only alice counts.
+    const gates = ledgerPort([productReview(["alice", "bob", "tg-bot"], "2026-10-22T01:00:00Z")]);
+    const one = await run(h, gates, { log: (l) => logs.push(l) });
+    expect(one.exitCode).toBe(3);
+    expect(one.decision?.quorumProgress?.[0]).toMatchObject({ approvers: ["github:alice"], met: false });
+    expect(logs.some((l) => /bob asked for abc1234, so github:bob's approval does not count/.test(l))).toBe(true);
+    expect(logs.some((l) => /github:tg-bot is an account an agent acts as/.test(l))).toBe(true);
+    // carol reviews later, in a second line: two distinct, proven, uninvolved approvers.
+    const two = ledgerPort([productReview(["alice", "bob", "tg-bot"], "2026-10-22T01:00:00Z"), productReview(["carol"], "2026-10-22T01:30:00Z")]);
+    const done = await run(h, two);
+    expect(done.exitCode).toBe(0);
+    expect(done.decision?.approvedBy).toBe("github:alice, github:carol");
+    h.done();
+  });
+
+  test("the pull request's author never counts, though a recorded review names them", async () => {
+    const h = harness(atBase);
+    const gates = ledgerPort([productReview(["dana", "alice"], "2026-10-22T01:00:00Z")]);
+    const r = await run(h, gates);
+    expect(r.exitCode).toBe(3);
+    expect(r.decision?.quorumProgress?.[0]?.approvers).toEqual(["github:alice"]);
+    h.done();
+  });
+
+  test("the ledger and the exclusion are read at base: a change that names its own ledger or agents gains nothing", async () => {
+    // Base sets a quorum and nothing else; the change adds reviewLedger and drops involved.
+    const baseOnly: OpWavesSpec = { ...spec, approvals: { quorum: [{ count: 1, roles: ["platform"] }] } };
+    const h = harness(baseOnly);
+    const gates = ledgerPort([productReview(["alice"], "2026-10-22T01:00:00Z")]);
+    const r = await run(h, gates, { spec: { ...baseOnly, approvals: { quorum: [{ count: 1 }], reviewLedger: "tf-apply" } } });
+    expect(r.exitCode).toBe(3);
+    expect(r.decision?.reviewLedger).toBeUndefined();
+    expect(gates.resolved).toEqual([]);
+    h.done();
+  });
+
+  test("a review of another digest, or a ledger line with no reviewers, proves nobody", async () => {
+    const h = harness(atBase);
+    const gates = ledgerPort([productReview(["alice", "carol"], "2026-10-22T01:00:00Z", { planDigest: digest("0") }), productReview([], "2026-10-22T01:10:00Z")]);
+    const r = await run(h, gates);
+    expect(r.exitCode).toBe(3);
+    expect(r.decision?.quorumProgress?.[0]?.approvers).toEqual([]);
+    h.done();
+  });
+});