@intentius/chant 0.124.46 → 0.124.48

package/dist/op/gate-approval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAED,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAyDhE;AASD,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}
+{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAED,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAyDhE;AASD,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}

package/dist/op/gate-approval.js

@@ -33,10 +33,10 @@
  * permit counts only while the run resolves that same context (#3774).
  *
  * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
- * Roles on it are what the approver claimed, and since #4290 the quorum
- * never reads them: a role counts only when `.chant/trust.json` at base
- * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
- * still sees the claimed roles in its request.
+ * Roles on it are what the approver claimed, and nothing trusts them: since
+ * #4290 the quorum counts a role only when `.chant/trust.json` at base grants
+ * it and a seal proves the approver (`./gate-quorum.ts`), and since #4324 a
+ * policy's request carries those same roles, never the claimed ones.
  */
 import { createHash } from "node:crypto";
 import { lexiconModulePath, importLexiconPackage } from "../lexicon-module.js";
@@ -153,10 +153,15 @@ export async function loadGatePolicyEvaluator(lexicon) {
     }
     return mod;
 }
-/** The request a policy is asked about one approval. */
+/**
+ * The request a policy is asked about one approval. `roles` are the ones
+ * `.chant/trust.json` at base gives a proven approver (#4324), as a quorum
+ * judge reads them (`trustQuorumJudge` in `./gate-quorum.ts`). The roles the
+ * approver claims on `approver` are never read. Absent, the principal has none.
+ */
 export function gatePolicyRequest(input) {
     return {
-        principal: { kind: input.approver.kind, name: input.resolvedBy, roles: input.approver.roles ?? [] },
+        principal: { kind: input.approver.kind, name: input.resolvedBy, roles: [...(input.roles ?? [])] },
         action: "PassGate",
         resource: { op: input.op, gate: input.gate },
         context: {

package/dist/op/gate-quorum.d.ts

@@ -18,10 +18,16 @@
  * approver counts toward `roles`, and as someone who is not the author, only
  * when the approval proves who they are: a seal that verifies against the
  * signers file at base, or under `pr-review` the forge review of the merged
- * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * pull request, or a review a product recorded on a ledger the spec at base
+ * names (#4333). The judge of a gate decides that ({@link GateQuorumJudge});
  * with none, no approval proves anything, so a rule naming roles or
  * `notAuthor` is never met.
  *
+ * `notAuthor` reads who was involved in the change (#4333): the pull
+ * request's author, each login a `Requested-by:` trailer on its commits
+ * names, and the accounts an agent acts as. With `excludeInvolved`, an
+ * approval by any of them does not count at all.
+ *
  * This module is pure: no git, no file reads, no package, so
  * `@intentius/chant/gate-decision` bundles it. The judge is built by the
  * caller from the trust policy it read at base ({@link trustQuorumJudge}).
@@ -47,8 +53,14 @@ export interface QuorumJudgement {
     proven: boolean;
     /** The roles `.chant/trust.json` at base gives the approver. Empty unless `proven`. */
     roles: string[];
-    /** Whether the approver is the change's author. Undefined when nobody knows who the author is. */
+    /**
+     * Whether the approver was involved in the change: its author, or anyone
+     * else {@link TrustQuorumInput.involved} names. Undefined when nobody knows
+     * who the author is and the approver is not named as involved otherwise.
+     */
     author?: boolean;
+    /** Why the approval does not count at all (#4333): the approver was involved and the judge excludes everyone involved. */
+    excluded?: string;
 }
 /** Judges one approval for the rules. */
 export type GateQuorumJudge = (approval: GateResolutionRecord) => QuorumJudgement;
@@ -108,6 +120,68 @@ export declare function quorumRuleLine(p: GateQuorumRuleProgress): string;
 export declare function quorumWaiting(progress: readonly GateQuorumRuleProgress[]): string;
 /** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
 export declare const ruleNeedsProof: (rule: GateQuorumRule) => boolean;
+/** Someone involved in a change (#4333), and why: `github:bob asked for abc1234`. */
+export interface QuorumInvolvement {
+    who: string;
+    why: string;
+}
+/**
+ * The logins `Requested-by:` trailers on a commit message name, each once.
+ * Any line of the message counts, since a squash merge keeps the trailers of
+ * the commits it squashed in its body.
+ */
+export declare function requestedByTrailers(message: string): string[];
+/**
+ * The names a principal goes by: itself, and for a forge principal
+ * (`github:alice`, `gitlab@gitlab.acme.com:bob`) the login after the colon,
+ * so a trailer's bare login and an approval's principal name one person.
+ */
+export declare function principalNames(who: string): string[];
+/** Why `who` was involved in the change, or undefined when `involved` does not name them. */
+export declare function involvedWhy(involved: readonly QuorumInvolvement[], who: string): string | undefined;
+/**
+ * Everyone involved in a change (#4333): the pull request's `author`, each
+ * login a `Requested-by:` trailer on `commits` names, and the `agents`'
+ * accounts. `principal` turns a trailer's login into the principal the
+ * forge's approvals name (`github:<login>`); absent, the login stands.
+ */
+export declare function changeInvolvement(o: {
+    author?: string;
+    commits?: readonly {
+        sha: string;
+        message: string;
+    }[];
+    agents?: readonly string[];
+    principal?: (login: string) => string;
+}): QuorumInvolvement[];
+/**
+ * A review a product recorded on its own ledger (#4333), as terragucci does
+ * under `pr-review`: a resolution with `via: "pr-review"`, the reviewed
+ * `head`, and the `reviewers` who approved it, by forge login. One line
+ * names every reviewer, so `resolvedBy` is not one person.
+ */
+export interface RecordedReview {
+    pr?: number;
+    head: string;
+    reviewers: string[];
+}
+/** The review a ledger line records, when it is a product's review line; null otherwise. */
+export declare function recordedReviewOf(r: GateResolutionRecord): RecordedReview | null;
+/**
+ * The approvals a product's review lines stand for (#4333): each line
+ * {@link recordedReviewOf} reads becomes one approval per reviewer, named by
+ * `principal(login)` (the login itself when absent), a human's, with the
+ * review on it. A seal on the line is dropped: it signs the line, not any
+ * one reviewer. Every other line is kept as it is. `reviews` lists the
+ * reviews read, for {@link TrustQuorumInput.recorded}.
+ */
+export declare function recordedReviewApprovals(records: readonly GateResolutionRecord[], principal?: (login: string) => string): {
+    records: GateResolutionRecord[];
+    reviews: {
+        head: string;
+        approvers: string[];
+    }[];
+};
 /** What {@link trustQuorumJudge} judges by. */
 export interface TrustQuorumInput {
     /** The signers at base: an approval whose seal verifies for its approver against them is proven. */
@@ -116,6 +190,25 @@ export interface TrustQuorumInput {
     roles: Readonly<Record<string, readonly string[]>>;
     /** The change's authors, as principals. Absent, nobody knows who they are. */
     authors?: readonly string[];
+    /**
+     * Everyone else involved in the change (#4333), from {@link
+     * changeInvolvement}: an approver named here is judged as an author, for
+     * `notAuthor`, whether or not `authors` is known.
+     */
+    involved?: readonly QuorumInvolvement[];
+    /** An approval by an author or anyone `involved` names does not count at all (#4333), toward any rule. */
+    excludeInvolved?: boolean;
+    /**
+     * Reviews a product recorded on the ledger the spec at base names (#4333),
+     * from {@link recordedReviewApprovals}: a resolution that names one's head
+     * and one of its approvers as `resolvedBy` is proven, as for `review`. Pass
+     * them only under `pr-review`, as the product proves its reviewers only
+     * then.
+     */
+    recorded?: readonly {
+        head: string;
+        approvers: readonly string[];
+    }[];
     /**
      * Under `pr-review`, the merged pull request's review, read from the forge
      * in this run: a resolution that names this review's head and one of its
@@ -126,6 +219,10 @@ export interface TrustQuorumInput {
         approvers: readonly string[];
     };
 }
-/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+/**
+ * The judge a gate's rules are met by: proof from a seal, the live review or
+ * a review a product recorded, roles from trust.json at base, and the
+ * change's authors and everyone else involved in it left out.
+ */
 export declare function trustQuorumJudge(input: TrustQuorumInput): GateQuorumJudge;
 //# sourceMappingURL=gate-quorum.d.ts.map

package/dist/op/gate-quorum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAYzE"}
+{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0HAA0H;IAC1H,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAKD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpD;AAED,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGnG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,GAAG,iBAAiB,EAAE,CAWtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,cAAc,GAAG,IAAI,CAK/E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,oBAAoB,EAAE,EACxC,SAAS,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAyB,GACtD;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;CAAE,CAgBvF;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACxC,0GAA0G;IAC1G,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAgBzE"}

package/dist/op/gate-quorum.js

@@ -18,10 +18,16 @@
  * approver counts toward `roles`, and as someone who is not the author, only
  * when the approval proves who they are: a seal that verifies against the
  * signers file at base, or under `pr-review` the forge review of the merged
- * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * pull request, or a review a product recorded on a ledger the spec at base
+ * names (#4333). The judge of a gate decides that ({@link GateQuorumJudge});
  * with none, no approval proves anything, so a rule naming roles or
  * `notAuthor` is never met.
  *
+ * `notAuthor` reads who was involved in the change (#4333): the pull
+ * request's author, each login a `Requested-by:` trailer on its commits
+ * names, and the accounts an agent acts as. With `excludeInvolved`, an
+ * approval by any of them does not count at all.
+ *
  * This module is pure: no git, no file reads, no package, so
  * `@intentius/chant/gate-decision` bundles it. The judge is built by the
  * caller from the trust policy it read at base ({@link trustQuorumJudge}).
@@ -125,7 +131,7 @@ export function quorumRuleProgress(rule, approvers) {
     const seen = new Set();
     const counted = [];
     for (const a of [...approvers].sort((x, y) => Date.parse(x.at) - Date.parse(y.at))) {
-        if (seen.has(norm(a.who)))
+        if (seen.has(norm(a.who)) || a.judged.excluded !== undefined)
             continue;
         if (rule.roles?.length && !(a.judged.proven && a.judged.roles.some((r) => rule.roles.includes(r))))
             continue;
@@ -168,16 +174,112 @@ export function quorumWaiting(progress) {
 }
 /** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
 export const ruleNeedsProof = (rule) => (rule.roles?.length ?? 0) > 0 || rule.notAuthor === true;
-/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+/** A login as a forge allows it, and a GitHub App's `[bot]` suffix. */
+const LOGIN = /^[A-Za-z0-9][A-Za-z0-9._-]*(\[bot\])?$/;
+/**
+ * The logins `Requested-by:` trailers on a commit message name, each once.
+ * Any line of the message counts, since a squash merge keeps the trailers of
+ * the commits it squashed in its body.
+ */
+export function requestedByTrailers(message) {
+    const out = [];
+    for (const line of message.replace(/\r\n/g, "\n").split("\n")) {
+        const m = /^requested-by:\s*(\S+)\s*$/i.exec(line.trim());
+        if (m && LOGIN.test(m[1]) && !out.some((o) => samePrincipal(o, m[1])))
+            out.push(m[1]);
+    }
+    return out;
+}
+/**
+ * The names a principal goes by: itself, and for a forge principal
+ * (`github:alice`, `gitlab@gitlab.acme.com:bob`) the login after the colon,
+ * so a trailer's bare login and an approval's principal name one person.
+ */
+export function principalNames(who) {
+    const m = /^(?:github|gitlab|forgejo|gitea|codeberg)(?:@[^:\s]+)?:(.+)$/i.exec(who.trim());
+    return m ? [who, m[1]] : [who];
+}
+/** Why `who` was involved in the change, or undefined when `involved` does not name them. */
+export function involvedWhy(involved, who) {
+    const names = principalNames(who);
+    return involved.find((p) => principalNames(p.who).some((a) => names.some((b) => samePrincipal(a, b))))?.why;
+}
+/**
+ * Everyone involved in a change (#4333): the pull request's `author`, each
+ * login a `Requested-by:` trailer on `commits` names, and the `agents`'
+ * accounts. `principal` turns a trailer's login into the principal the
+ * forge's approvals name (`github:<login>`); absent, the login stands.
+ */
+export function changeInvolvement(o) {
+    const out = [];
+    const add = (who, why) => {
+        if (who.trim() && !out.some((p) => samePrincipal(p.who, who)))
+            out.push({ who, why });
+    };
+    if (o.author)
+        add(o.author, `${o.author} opened the change`);
+    for (const c of o.commits ?? []) {
+        for (const login of requestedByTrailers(c.message))
+            add(o.principal ? o.principal(login) : login, `${login} asked for ${c.sha.slice(0, 7)}`);
+    }
+    for (const a of o.agents ?? [])
+        add(a, `${a} is an account an agent acts as`);
+    return out;
+}
+/** The review a ledger line records, when it is a product's review line; null otherwise. */
+export function recordedReviewOf(r) {
+    const x = r;
+    if (x.via !== "pr-review" || typeof x.head !== "string" || x.head === "")
+        return null;
+    if (!Array.isArray(x.reviewers) || x.reviewers.length === 0 || x.reviewers.some((v) => typeof v !== "string" || v === ""))
+        return null;
+    return { ...(typeof x.pr === "number" ? { pr: x.pr } : {}), head: x.head, reviewers: [...x.reviewers] };
+}
+/**
+ * The approvals a product's review lines stand for (#4333): each line
+ * {@link recordedReviewOf} reads becomes one approval per reviewer, named by
+ * `principal(login)` (the login itself when absent), a human's, with the
+ * review on it. A seal on the line is dropped: it signs the line, not any
+ * one reviewer. Every other line is kept as it is. `reviews` lists the
+ * reviews read, for {@link TrustQuorumInput.recorded}.
+ */
+export function recordedReviewApprovals(records, principal = (login) => login) {
+    const out = [];
+    const reviews = [];
+    for (const r of records) {
+        const review = recordedReviewOf(r);
+        if (!review) {
+            out.push(r);
+            continue;
+        }
+        const approvers = review.reviewers.map(principal);
+        reviews.push({ head: review.head, approvers });
+        const { seal: _seal, ...rest } = r;
+        const base = Object.fromEntries(Object.entries(rest).filter(([k]) => !["via", "reviewers", "head", "pr", "excluded"].includes(k)));
+        for (const who of approvers)
+            out.push({ ...base, resolvedBy: who, approver: { kind: "human" }, review: { pr: review.pr ?? 0, head: review.head, approvers } });
+    }
+    return { records: out, reviews };
+}
+/**
+ * The judge a gate's rules are met by: proof from a seal, the live review or
+ * a review a product recorded, roles from trust.json at base, and the
+ * change's authors and everyone else involved in it left out.
+ */
 export function trustQuorumJudge(input) {
+    const named = (list, who) => list.some((a) => samePrincipal(a, who));
     return (r) => {
         const sealed = r.seal !== undefined && r.seal !== null && gateSealRefusal(input.signers, r) === null;
-        const reviewed = input.review !== undefined && r.review?.head === input.review.head && input.review.approvers.some((a) => samePrincipal(a, r.resolvedBy));
-        const proven = sealed || reviewed;
+        const reviewed = input.review !== undefined && r.review?.head === input.review.head && named(input.review.approvers, r.resolvedBy);
+        const recorded = r.review !== undefined && (input.recorded ?? []).some((x) => x.head === r.review.head && named(x.approvers, r.resolvedBy));
+        const proven = sealed || reviewed || recorded;
+        const authored = input.authors !== undefined && input.authors.some((a) => samePrincipal(a, r.resolvedBy));
+        const why = authored ? `${r.resolvedBy} wrote the change` : involvedWhy(input.involved ?? [], r.resolvedBy);
         return {
             proven,
             roles: proven ? rolesOf(r.resolvedBy, input.roles) : [],
-            ...(input.authors !== undefined ? { author: input.authors.some((a) => samePrincipal(a, r.resolvedBy)) } : {}),
+            ...(why !== undefined ? { author: true } : input.authors !== undefined ? { author: false } : {}),
+            ...(why !== undefined && input.excludeInvolved ? { excluded: `${why}, so ${r.resolvedBy}'s approval does not count` } : {}),
         };
     };
 }

package/dist/op/gate-review.d.ts

@@ -85,6 +85,15 @@ export declare function gitlabReviews(opts: ReviewSourceOptions): ReviewSource;
  * Throws naming what is missing.
  */
 export declare function reviewSourceFromEnv(env?: Record<string, string | undefined>, fetchImpl?: ForgeFetch): ReviewSource;
+/**
+ * The principal a forge login on the CI job's forge goes by (#4333):
+ * `github:<login>` on github.com, `gitlab@<host>:<login>` on another host,
+ * as {@link reviewSourceFromEnv}'s reviews name their approvers. A product
+ * records its reviewers and its `Requested-by:` trailers by login, and this
+ * reads them as the approvals they stand beside. A value that already has a
+ * forge's prefix is kept.
+ */
+export declare function forgePrincipalFromEnv(env?: Record<string, string | undefined>): (login: string) => string;
 /**
  * The head of the pull request a CI job runs for, from its environment: the
  * event payload's `pull_request.head.sha` on GitHub and Forgejo (whose

package/dist/op/gate-review.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-review.d.ts","sourceRoot":"","sources":["../../src/op/gate-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAmC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAI5E,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAOtF;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAIzG;AAKD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGxF,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iDAAiD;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,kGAAkG;IAClG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD;AAuBD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAoFD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAErE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAEtE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAsDrE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,YAAY,CAiB/H;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,GAAG,SAAS,CAahH"}
+{"version":3,"file":"gate-review.d.ts","sourceRoot":"","sources":["../../src/op/gate-review.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE9E,OAAO,EAAmC,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,KAAK,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAI5E,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAEpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAOtF;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,gBAAgB,GAAG,IAAI,CAIzG;AAKD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGxF,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iDAAiD;IACjD,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,CAAC;IAChB,kGAAkG;IAClG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACzD;AAuBD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAoFD,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAErE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAEtE;AAED,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,YAAY,CAsDrE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EAAE,SAAS,CAAC,EAAE,UAAU,GAAG,YAAY,CAiB/H;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAItH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,GAAG,SAAS,CAahH"}

package/dist/op/gate-review.js

@@ -265,6 +265,19 @@ export function reviewSourceFromEnv(env = process.env, fetchImpl) {
     const opts = { apiBase: env.GITHUB_API_URL ?? (forgejo ? `${trimSlash(env.GITHUB_SERVER_URL ?? "")}/api/v1` : "https://api.github.com"), repo: env.GITHUB_REPOSITORY, token, host, ...f };
     return forgejo ? forgejoReviews(opts) : githubReviews(opts);
 }
+/**
+ * The principal a forge login on the CI job's forge goes by (#4333):
+ * `github:<login>` on github.com, `gitlab@<host>:<login>` on another host,
+ * as {@link reviewSourceFromEnv}'s reviews name their approvers. A product
+ * records its reviewers and its `Requested-by:` trailers by login, and this
+ * reads them as the approvals they stand beside. A value that already has a
+ * forge's prefix is kept.
+ */
+export function forgePrincipalFromEnv(env = process.env) {
+    const kind = env.GITLAB_CI === "true" ? "gitlab" : env.FORGEJO_ACTIONS === "true" || env.GITEA_ACTIONS === "true" ? "forgejo" : "github";
+    const host = kind === "gitlab" ? (env.CI_SERVER_HOST ?? hostOf(env.CI_SERVER_URL, "gitlab.com")) : hostOf(env.GITHUB_SERVER_URL, "github.com");
+    return (login) => (/^(?:github|gitlab|forgejo|gitea|codeberg)(?:@[^:\s]+)?:/i.test(login.trim()) ? login : forgePrincipalOf(kind, host, login));
+}
 /**
  * The head of the pull request a CI job runs for, from its environment: the
  * event payload's `pull_request.head.sha` on GitHub and Forgejo (whose

package/dist/op/gate.d.ts

@@ -34,7 +34,7 @@
 import { type GateResolutionInput, type GateResolutionRecord, type PendingGateInput, type PendingGateRecord } from "../lifecycle/gate-ledger.js";
 import { type AppliedGateRecord } from "../lifecycle/gate-applied.js";
 import { type GateApprover, type ResolvedGateApproval } from "./gate-approval.js";
-import { type GateQuorumJudge, type GateQuorumRuleProgress } from "./gate-quorum.js";
+import { type GateQuorumJudge, type GateQuorumRuleProgress, type GateQuorumSpec } from "./gate-quorum.js";
 import { type GateCheckpoint } from "../lifecycle/gate-checkpoint.js";
 import type { ResolvedGateAlias } from "./gate-alias.js";
 /**
@@ -114,9 +114,15 @@ export interface GateLedgerPort {
 }
 /** A workspace's rule for which approvals of a gate count (#3163): a signed approval, from a class when it names one. */
 export interface GateApprovalRule {
+    /**
+     * `quorum` (#4324) is the entry's `identity.gates.<gate>.quorum` at base:
+     * the rules an Op gate of that name takes in place of its own. Absent or
+     * null when the entry sets none.
+     */
     requirement: {
         gate: string;
         class: string | null;
+        quorum?: GateQuorumSpec | null;
     };
     /** Why `approval` doesn't count, or null when it does. */
     refuses(approval: GateResolutionRecord): string | null;
@@ -195,6 +201,12 @@ export interface GateCheckInput {
      * and the merged pull request's review.
      */
     judge?: GateQuorumJudge;
+    /**
+     * The port's {@link GateLedgerPort.approvalRule} for this gate, when the
+     * caller already read it (#4324): the Op executor reads it first, for the
+     * quorum at base. Absent, it is read here; null means none applies.
+     */
+    rule?: GateApprovalRule | null;
     /** ISO-8601 "now" — supplied by the caller, so the decision is deterministic under test. */
     now?: string;
     /**
@@ -248,6 +260,34 @@ export interface GateCheckInput {
      * no `empty` resolution counts.
      */
     verifyEmpty?: (planDigest: string) => Promise<boolean>;
+    /**
+     * A workspace gate that may stand in for this gate (#2554, #2524 D17,
+     * ws-039). Read only on a gate bound to a plan, and only when the gate's
+     * own approvals don't pass it. The stand-in decides: it answers an approval
+     * only when the member opted in at base and the workspace approval's
+     * digest covers this member's plan. Absent, a workspace gate never
+     * satisfies this gate.
+     */
+    workspace?: WorkspaceGateStandIn;
+}
+/** What a workspace gate approval that stands in for a member gate names (#2554). */
+export interface WorkspaceGateStood {
+    /** The workspace gate's name. */
+    gate: string;
+    /** The digest of the member plans the approval covers. */
+    digest: string;
+    approvedBy: string;
+    /** When the workspace approval was recorded. */
+    timestamp: string;
+}
+/** See {@link GateCheckInput.workspace}. */
+export interface WorkspaceGateStandIn {
+    standIn(q: {
+        op: string;
+        gate: string;
+        planDigest: string;
+        environment?: string;
+    }): Promise<WorkspaceGateStood | null>;
 }
 /**
  * A standing resolution that answers this gate but not this plan (#2300) —
@@ -297,9 +337,10 @@ export type GateCheck = {
      * under one of the gate's aliases counted, on any gate. `"empty"`
      * (#4045) when a release gate passed over an empty change set, on the
      * `empty: true` resolution the promote wrote, after the stored
-     * document was read back and found empty.
+     * document was read back and found empty. `"workspace"` (#2554) when a
+     * workspace gate's approval stood in for it ({@link GateCheckInput.workspace}).
      */
-    via?: "quorum" | "policy" | "alias" | "empty";
+    via?: "quorum" | "policy" | "alias" | "empty" | "workspace";
     /** Every approval that counted toward the quorum. Set with `via`. */
     approvals?: GateResolutionRecord[];
     /** The approvals this run carried from an alias and wrote under the gate's name (#3949). Set when `via` is `"alias"`. */

package/dist/op/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/op/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAA2D,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE5H,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAEL,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAClD,MAAM,eAAe,CAAC;AAMvB,OAAO,EAAyF,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1J,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IACjG,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChI;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,kIAAkI;IAClI,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,uFAAuF;IACvF,aAAa,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F;;;;;OAKG;IACH,eAAe,CAAC,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAuEzE;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAClC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAO,GAChH,cAAc,GAAG;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kDAAkD;IAClD,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CA0CA;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4HAA4H;IAC5H,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,UAAQ,GAAG,MAAM,CAgBnH;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GACjB;IACE,SAAS,EAAE,IAAI,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,oBAAoB,CAAC;IACjC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IAC9C,qEAAqE;IACrE,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,yHAAyH;IACzH,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAClC,GAED;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,kFAAkF;IAClF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAAC;AAEN,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iJAAiJ;AACjJ,wBAAgB,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,YAAY,CAGrE;AAED,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,uHAAuH;IACvH,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACjC,uNAAuN;IACvN,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,GAAE,MAAiB,EACjC,KAAK,GAAE,eAAgC,GACtC,SAAS,CAkDX;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAc3G;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,GACjD,oBAAoB,EAAE,CAOxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAuBnH;AAgED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAmNlG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CAK1H;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9F"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/op/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAA2D,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE5H,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAClG,OAAO,EAEL,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAAE,KAAK,cAAc,EACvE,MAAM,eAAe,CAAC;AAMvB,OAAO,EAAyF,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1J,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,iBAAiB,CAAC;IAC1B;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IACjG,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjE;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,oBAAoB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChI;;;;;;OAMG;IACH,YAAY,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACtF;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,kIAAkI;IAClI,WAAW,CAAC,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,uFAAuF;IACvF,aAAa,CAAC,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9F;;;;;OAKG;IACH,eAAe,CAAC,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,cAAc,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACpE;AAED,yHAAyH;AACzH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,WAAW,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAA;KAAE,CAAC;IACpF,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,IAAI,CAAC;CACxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAuEzE;AAED,4HAA4H;AAC5H,wBAAgB,oBAAoB,CAClC,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,CAAA;CAAO,GAChH,cAAc,GAAG;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,kDAAkD;IAClD,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,CA0CA;AAED,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,EAAE,EAAE,MAAM,CAAC;IACX,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mHAAmH;IACnH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4HAA4H;IAC5H,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+GAA+G;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC/B,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8EAA8E;IAC9E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,oBAAoB,CAAC;CAClC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACxH;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,oHAAoH;IACpH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,UAAQ,GAAG,MAAM,CAgBnH;AAED,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,MAAM,SAAS,GACjB;IACE,SAAS,EAAE,IAAI,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,oBAAoB,CAAC;IACjC;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IAC5D,qEAAqE;IACrE,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC,yHAAyH;IACzH,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;CAClC,GAED;IACE,SAAS,EAAE,KAAK,CAAC;IACjB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kCAAkC;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,kFAAkF;IAClF,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAAC;AAEN,yFAAyF;AACzF,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,iJAAiJ;AACjJ,wBAAgB,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,YAAY,CAGrE;AAED,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,uHAAuH;IACvH,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,GAAG,EAAE,OAAO,CAAC;IACb,0EAA0E;IAC1E,KAAK,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACjC,uNAAuN;IACvN,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,sFAAsF;IACtF,UAAU,CAAC,EAAE,oBAAoB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,QAAQ,EAAE,oBAAoB,EAC9B,cAAc,GAAE,MAAiB,EACjC,KAAK,GAAE,eAAgC,GACtC,SAAS,CAkDX;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAc3G;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,SAAS,oBAAoB,EAAE,EAC5C,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,SAAS,iBAAiB,EAAe,GACjD,oBAAoB,EAAE,CAOxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAuBnH;AAgED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,CAyOlG;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,UAAQ,GAAG,MAAM,CAK1H;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9F"}

package/dist/op/gate.js

@@ -447,7 +447,7 @@ export async function evaluateGate(port, input) {
     // newest one since the standing fact comes back as a mismatch instead.
     const forOtherRelease = (r) => r.gate === input.gate && r.releaseDigest !== input.releaseDigest;
     // #3163: a gate the workspace's identity.gates names counts only signed approvals from its class.
-    const rule = (await port.approvalRule?.(input.gate)) ?? null;
+    const rule = input.rule !== undefined ? input.rule : ((await port.approvalRule?.(input.gate)) ?? null);
     const standing = latestPendingGate(pending, input.gate);
     const since = standing?.timestamp ?? EPOCH;
     // #4045: a pass over an empty change set. The promote wrote it, and it
@@ -516,9 +516,8 @@ export async function evaluateGate(port, input) {
             ? humanQuorumSince(pending, standing)
             : since;
         // #4290: who an approval proves, and their roles at base, for rules that read them.
-        const judge = quorumRules(input.approval.quorum).some(ruleNeedsProof)
-            ? (input.judge ?? (await port.quorumJudge?.(input.gate)) ?? UNPROVEN_JUDGE)
-            : UNPROVEN_JUDGE;
+        // #4333: a caller's judge applies to every rule, since it may leave out everyone involved in the change.
+        const judge = input.judge ?? (quorumRules(input.approval.quorum).some(ruleNeedsProof) ? ((await port.quorumJudge?.(input.gate)) ?? UNPROVEN_JUDGE) : UNPROVEN_JUDGE);
         const tally = tallyGateApprovals(resolutions, input.gate, since, input.planDigest, input.approval, humansSince, judge);
         if (tally.permit) {
             return { satisfied: true, resolution: tally.permit, via: "policy", approvals: tally.counted };
@@ -559,6 +558,28 @@ export async function evaluateGate(port, input) {
         }
         mismatched = found.mismatched;
     }
+    // #2554, ws-039: a workspace gate stands in only when the member opted in
+    // at base and the workspace approval's digest covers this plan.
+    if (input.workspace && input.planDigest !== undefined) {
+        const stood = await input.workspace.standIn({ op: input.op, gate: input.gate, planDigest: input.planDigest, ...(env !== undefined ? { environment: env } : {}) });
+        if (stood) {
+            return {
+                satisfied: true,
+                via: "workspace",
+                resolution: {
+                    version: 1,
+                    kind: "resolution",
+                    op: input.op,
+                    gate: input.gate,
+                    resolvedBy: stood.approvedBy,
+                    timestamp: stood.timestamp,
+                    planDigest: input.planDigest,
+                    ...(env !== undefined ? { environment: env } : {}),
+                    workspaceGate: { gate: stood.gate, digest: stood.digest },
+                },
+            };
+        }
+    }
     // #4045: an approval of this gate for another release stands as a mismatch
     // when nothing closer does, so the refusal says an approval exists.
     if (!mismatched && input.planDigest !== undefined) {

package/dist/op/index.d.ts

@@ -21,7 +21,7 @@ export type { DiscoveredOp, OpDiscoveryResult } from "./discover.js";
 export { generateOpsPipeline, generateOpWavesPipeline, withOpSchedules } from "./generate-pipeline.js";
 export type { GenerateOpsPipelineResult, GenerateOpWavesPipelineResult } from "./generate-pipeline.js";
 export { OP_WAVE_APPLY_HOOKS_RUNNERS, OP_WAVE_DEFAULT_APPLY, OP_WAVE_DEFAULT_GATE_NAME, OP_WAVE_GATE_POLICIES, OP_WAVE_HOOK_MOMENTS, PR_LOOP_HOOK_MOMENTS, assertOpWaveHooks, assertOpWavesSpec, assertPrLoopHooks, opWaveApplyHooksRunBy, opWaveGateName, opWaveHookRuns, opWaveHooksAt, opWaveJobs, opWaveRecordPath, opWaveShare, } from "./op-waves.js";
-export type { OpWave, OpWaveApplyHooksRunner, OpWaveGatePolicy, OpWaveHook, OpWaveHookFailure, OpWaveHookMoment, OpWaveHooks, OpWaveJob, OpWaveRun, OpWavesDigest, OpWavesOverride, OpWavesSpec } from "./op-waves.js";
+export type { OpWave, OpWaveApplyHooksRunner, OpWaveGatePolicy, OpWaveHook, OpWaveHookFailure, OpWaveHookMoment, OpWaveHooks, OpWaveJob, OpWaveRun, OpWavesApprovals, OpWavesDigest, OpWavesInvolved, OpWavesOverride, OpWavesSpec } from "./op-waves.js";
 export { OP_WAVE_APPLY_OUTCOMES, OP_WAVE_MAX_REPLANS, opWaveHooksAtBase, runStageHooks, runStageHooksAsync, spawnExecAsync, opWaveNeedsApproval, opWavePlansPath, opWaveRunsPath, opWaveSetDigest, parseOpWavesSpec, recordOpWaveHeadPlans, readOpWaveHooksFile, readOpWavePolicy, runOpWave, runOpWaveApplyHooks, } from "./op-waves-run.js";
 export type { OpWaveBaseRules, OpWaveDecision, OpWaveApplyHooksRun, OpWaveApplyOutcome, OpWaveAsyncExec, OpWaveExec, OpWaveHeldOn, OpWaveHoldRequest, OpWaveHookOutcome, OpWaveHookRun, OpWaveHooksFile, OpWaveHooksResult, OpWaveMember, OpWavePlanFile, OpWavePlansFile, OpWavePolicySource, OpWaveRunsFile, OpWaveShowAtBase, RecordHeadPlansOptions, RunOpWaveApplyHooksOptions, RunStageHooksAsyncOptions, RunStageHooksOptions, StageHooksRun, RunOpWaveOptions, RunOpWaveResult, } from "./op-waves-run.js";
 export { notifyOpWave, opWaveNotifyFields } from "./op-waves-notify.js";
@@ -44,8 +44,8 @@ export { planGateResumes, standingGateFacts } from "./gate-resume-plan.js";
 export type { GateResumeCandidate, GateResumeReason, GateAnswering, PlanGateResumesInput } from "./gate-resume-plan.js";
 export { gateApprovalProblems, gateContextDigest, gatePolicyRequest, gatePolicyVersion, isGatePolicyRef, loadGatePolicyEvaluator, GATE_APPROVAL_MODES, } from "./gate-approval.js";
 export type { GateApproval, GateApprovalMode, GateApprover, GateContextValue, GatePolicyAnswer, GatePolicyDecision, GatePolicyEvaluator, GatePolicyRef, GatePolicyRequest, GateQuorum, ResolvedGateApproval, } from "./gate-approval.js";
-export { quorumRules, quorumRulesFor, quorumNeed, quorumProblems, quorumRuleProgress, quorumRuleLine, quorumWaiting, rolesOf, trustQuorumJudge, UNPROVEN_JUDGE, } from "./gate-quorum.js";
-export type { GateQuorumRule, GateQuorumSpec, GateQuorumJudge, GateQuorumRuleProgress, QuorumJudgement, QuorumApprover, TrustQuorumInput, } from "./gate-quorum.js";
+export { quorumRules, quorumRulesFor, quorumNeed, quorumProblems, quorumRuleProgress, quorumRuleLine, quorumWaiting, rolesOf, trustQuorumJudge, UNPROVEN_JUDGE, changeInvolvement, involvedWhy, principalNames, recordedReviewApprovals, recordedReviewOf, requestedByTrailers, } from "./gate-quorum.js";
+export type { GateQuorumRule, GateQuorumSpec, GateQuorumJudge, GateQuorumRuleProgress, QuorumJudgement, QuorumApprover, TrustQuorumInput, QuorumInvolvement, RecordedReview, } from "./gate-quorum.js";
 export { gatePlanSummary, gatePlanSummaryOfResult, changeSetOfResult, GATE_PLAN_CONTEXT_KEY, GATE_PLAN_ADDRESS_LIMIT, } from "./gate-plan-context.js";
 export type { GatePlanSummary } from "./gate-plan-context.js";
 export { computePlanDigest, isPlanDigest, describePlanDigest, samePlanDigest, PLAN_DIGEST_ALGORITHM, PLAN_DIGEST_PREFIX, } from "../lifecycle/plan-digest.js";