@intentius/chant 0.124.46 → 0.124.49

package/dist/op/builders.js

@@ -348,9 +348,11 @@ export const composeChangeSet = (args) => {
     return activity("composeChangeSet", rest, { profile: profile ?? "fastIdempotent", ...(id ? { id } : {}) });
 };
 /**
- * A model reviews the pull request's title and description against a change
- * set and posts one sticky note (#4299): `reviewAgent({ op: "pr-review",
- * changeSet: changeSet.out.document })`. It never approves and never gates.
+ * A model reviews the pull request's title and description against its diff
+ * and a change set and posts one sticky note (#4299): `reviewAgent({ op:
+ * "pr-review", changeSet: changeSet.out.document })`. It never approves and
+ * never gates. `mode: "handoff"` (#4326) writes the review for a separate job
+ * to post, so the model's job holds no forge write token.
  * Defaults to the `longInfra` profile, since the model command may take
  * minutes.
  */
@@ -810,8 +812,10 @@ export const policyGate = (opts) => {
  * Attach evidence to an acceptance criterion of the work item the run holds
  * the lease on (#2772), for an Op that declares `workLease`. The run's lease
  * is passed for it, so the write happens only while the lease is still the
- * run's. `opts` takes the `result` (pass or fail), a `title`, and a `url` or a
- * workspace `path` to pin by hash. A `manual` criterion is refused: the run
+ * run's. `opts` takes the `result` (pass or fail), a `title`, and a `url`, a
+ * workspace `path` to pin by hash, or an `ops` result to cite (#3171): a run,
+ * deploy, gate answer or release plan on `chant/lifecycle`, verified against
+ * its ledger. A `manual` criterion is refused: the run
  * is the item's implementer. The `atMostOnce` profile: each attempt appends.
  */
 export const workEvidence = (criterion, opts) => {

package/dist/op/composites/apply-op.d.ts

@@ -5,7 +5,11 @@
  * stays with the platform (the CloudFormation stack, the Kubernetes API
  * server, the ARM resource group) — chant never hosts a state file.
  *
- * Phases: build → plan → [approve] → apply. Deletes ride the native
+ * Phases: build → plan → [preflight] → [approve] → apply → [verify] (#3370).
+ * `preflight` steps run after the plan and before the approval, and a failing
+ * one stops the run before anything is approved or applied. `verify` steps
+ * run after the apply, and a failing one fails the run, which runs `onFailure`
+ * (the Rollback phase, when there is one). Deletes ride the native
  * prune path, whose bound is per target: the ownership marker on `kubectl`,
  * the ownership tag on `arm` (chant #1448 — previously `--mode Complete`, which
  * removed resources chant never applied), the ownership label on `gcp`
@@ -51,12 +55,21 @@
  *   target: "kubectl",
  *   gate: { gate: "approve-apply", point: "prod-apply" },
  * });
+ *
+ * // validate before, check after (#3370), for any target
+ * export const { op } = ApplyOp({
+ *   name: "collector-rollout",
+ *   env: "prod",
+ *   target: "kubectl",
+ *   preflight: [shell("otelcol-contrib validate --config dist/collector.yaml")],
+ *   verify: [activity("rulesLoadedObserve", { env: "prod" })],
+ * });
  * ```
  *
  * @see #112 — stateless-authoritative state model + live import
  */
 import type { OpResource } from "../resource.js";
-import type { GateStep } from "../types.js";
+import type { GateStep, StepDefinition } from "../types.js";
 import { type ApplyTarget, type DeleteMode } from "../activities/apply.js";
 export interface ApplyOpConfig {
     /** Op name (kebab-case). */
@@ -140,6 +153,20 @@ export interface ApplyOpConfig {
      * created is the usual case).
      */
     forceConflicts?: boolean;
+    /**
+     * Steps run after the Plan phase and before the approval gate (#3370), as a
+     * `Preflight` phase: a config validation, a dry run, a policy check. A
+     * failing step stops the run there, so nothing is approved or applied.
+     * Omitted or empty, the Op has no Preflight phase.
+     */
+    preflight?: StepDefinition[];
+    /**
+     * Steps run after the apply (#3370), as a `Verify` phase: a readiness
+     * check, an observation that the new config loaded. A failing step fails
+     * the run, so `onFailure` runs (the Rollback phase, when the Op has one).
+     * Omitted or empty, the Op has no Verify phase.
+     */
+    verify?: StepDefinition[];
 }
 export interface ApplyOpResources {
     /** Op resource — the build→plan→[approve]→apply Op. */

package/dist/op/composites/apply-op.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1G,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb;;;gBAGY;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;uBAImB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,0FAA0F;QAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC3B,CAAC;IACF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CA4G/D"}
+{"version":3,"file":"apply-op.d.ts","sourceRoot":"","sources":["../../../src/op/composites/apply-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAAoC,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE1G,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb;;;gBAGY;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;uBAImB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,0FAA0F;QAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;KAC3B,CAAC;IACF;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,CAoH/D"}

package/dist/op/composites/apply-op.js

@@ -5,7 +5,11 @@
  * stays with the platform (the CloudFormation stack, the Kubernetes API
  * server, the ARM resource group) — chant never hosts a state file.
  *
- * Phases: build → plan → [approve] → apply. Deletes ride the native
+ * Phases: build → plan → [preflight] → [approve] → apply → [verify] (#3370).
+ * `preflight` steps run after the plan and before the approval, and a failing
+ * one stops the run before anything is approved or applied. `verify` steps
+ * run after the apply, and a failing one fails the run, which runs `onFailure`
+ * (the Rollback phase, when there is one). Deletes ride the native
  * prune path, whose bound is per target: the ownership marker on `kubectl`,
  * the ownership tag on `arm` (chant #1448 — previously `--mode Complete`, which
  * removed resources chant never applied), the ownership label on `gcp`
@@ -51,6 +55,15 @@
  *   target: "kubectl",
  *   gate: { gate: "approve-apply", point: "prod-apply" },
  * });
+ *
+ * // validate before, check after (#3370), for any target
+ * export const { op } = ApplyOp({
+ *   name: "collector-rollout",
+ *   env: "prod",
+ *   target: "kubectl",
+ *   preflight: [shell("otelcol-contrib validate --config dist/collector.yaml")],
+ *   verify: [activity("rulesLoadedObserve", { env: "prod" })],
+ * });
  * ```
  *
  * @see #112 — stateless-authoritative state model + live import
@@ -79,6 +92,9 @@ export function ApplyOp(config) {
             },
         ]),
     ];
+    if (config.preflight !== undefined && config.preflight.length > 0) {
+        phases.push(phase("Preflight", config.preflight));
+    }
     if (gated) {
         phases.push(phase("Approve", [
             gate(gateName(config.gate ?? {}) || `approve-${config.name}`, {
@@ -106,6 +122,9 @@ export function ApplyOp(config) {
             ...(config.forceConflicts !== undefined ? { forceConflicts: config.forceConflicts } : {}),
         }, "longInfra"),
     ]));
+    if (config.verify !== undefined && config.verify.length > 0) {
+        phases.push(phase("Verify", config.verify));
+    }
     // Compensation is total or refused (#1449). A rollback path is either the
     // target's mapped native rollback (cloudformation's rollbackStack) or an
     // explicit command; without one there is nothing a Rollback phase could run,

package/dist/op/gate-approval-base.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The parts of an Op gate's approval that an `identity.gates.<gate>` entry
+ * also carries (#4404): the modes, the policy check and the entry check. Its
+ * only runtime import is `node:crypto`, so `gate-decision.ts` (which checks an
+ * entry) bundles without the Op runtime or zod (gate-decision-bundle.test.ts).
+ * `gate-approval.ts` re-exports everything here.
+ */
+import type { GateApprovalMode, GatePolicyRef } from "./gate-approval.js";
+export declare const GATE_APPROVAL_MODES: readonly GateApprovalMode[];
+/** The version of a gate policy: `sha256:` and the hex digest of its text. A lexicon's helper stamps it, and OPS015 checks it still matches. */
+export declare function gatePolicyVersion(text: string): string;
+export declare function isGatePolicyRef(value: unknown): value is GatePolicyRef;
+/**
+ * What is wrong with the `policy`, `mode` and `context` of an
+ * `identity.gates.<gate>` entry (#4404), one line each, named by `at`. Each
+ * field stands alone: base `mode: "enforce"` with no base `policy` is fine, as
+ * the Op's own policy then applies. `chant workspace check` (WSP153) says so.
+ */
+export declare function gateBaseApprovalProblems(entry: {
+    policy?: unknown;
+    mode?: unknown;
+    context?: unknown;
+}, at: string): string[];
+export declare function isContextValue(value: unknown): boolean;
+//# sourceMappingURL=gate-approval-base.d.ts.map

package/dist/op/gate-approval-base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-approval-base.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval-base.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEvE,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAUxF,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB7H;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKtD"}

package/dist/op/gate-approval-base.js

@@ -0,0 +1,71 @@
+/**
+ * The parts of an Op gate's approval that an `identity.gates.<gate>` entry
+ * also carries (#4404): the modes, the policy check and the entry check. Its
+ * only runtime import is `node:crypto`, so `gate-decision.ts` (which checks an
+ * entry) bundles without the Op runtime or zod (gate-decision-bundle.test.ts).
+ * `gate-approval.ts` re-exports everything here.
+ */
+import { createHash } from "node:crypto";
+import { GATE_PLAN_CONTEXT_KEY } from "./gate-plan-context.js";
+export const GATE_APPROVAL_MODES = ["log-only", "enforce"];
+// The brand `stepOutput()` stamps (`step-output-ref.ts`), as a global symbol so
+// this module need not import that file and its zod schemas; the same copy
+// `activity-contract.ts` keeps for the same reason.
+const STEP_OUTPUT_REF_BRAND = Symbol.for("chant.op.stepOutputRef");
+function isStepOutputRef(value) {
+    return typeof value === "object" && value !== null && value[STEP_OUTPUT_REF_BRAND] === true;
+}
+/** The version of a gate policy: `sha256:` and the hex digest of its text. A lexicon's helper stamps it, and OPS015 checks it still matches. */
+export function gatePolicyVersion(text) {
+    return `sha256:${createHash("sha256").update(text).digest("hex")}`;
+}
+export function isGatePolicyRef(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const v = value;
+    return (v.kind === "gate-policy" &&
+        typeof v.lexicon === "string" && v.lexicon !== "" &&
+        typeof v.name === "string" && v.name !== "" &&
+        typeof v.version === "string" && v.version !== "" &&
+        typeof v.text === "string" && v.text.trim() !== "");
+}
+/**
+ * What is wrong with the `policy`, `mode` and `context` of an
+ * `identity.gates.<gate>` entry (#4404), one line each, named by `at`. Each
+ * field stands alone: base `mode: "enforce"` with no base `policy` is fine, as
+ * the Op's own policy then applies. `chant workspace check` (WSP153) says so.
+ */
+export function gateBaseApprovalProblems(entry, at) {
+    const problems = [];
+    if (entry.policy !== undefined) {
+        if (!isGatePolicyRef(entry.policy))
+            problems.push(`\`${at}.policy\` does not resolve to a gate policy set: it needs kind "gate-policy", lexicon, name, version and text`);
+        else if (entry.policy.version !== gatePolicyVersion(entry.policy.text))
+            problems.push(`\`${at}.policy\` "${entry.policy.name}" has a version that is not the digest of its text`);
+    }
+    if (entry.mode !== undefined && !GATE_APPROVAL_MODES.includes(entry.mode)) {
+        problems.push(`\`${at}.mode\` must be one of ${GATE_APPROVAL_MODES.map((m) => `"${m}"`).join(", ")}`);
+    }
+    if (entry.context !== undefined) {
+        if (typeof entry.context !== "object" || entry.context === null || Array.isArray(entry.context))
+            problems.push(`\`${at}.context\` must be an object of plan attributes`);
+        else {
+            for (const [key, value] of Object.entries(entry.context)) {
+                if (key === GATE_PLAN_CONTEXT_KEY)
+                    problems.push(`\`${at}.context.${key}\` is reserved: the run fills it with the plan's change-set summary (#3182)`);
+                else if (isStepOutputRef(value) || !isContextValue(value))
+                    problems.push(`\`${at}.context.${key}\` must be a string, number, boolean or list of strings`);
+            }
+        }
+    }
+    return problems;
+}
+export function isContextValue(value) {
+    if (typeof value === "string" || typeof value === "boolean")
+        return true;
+    if (typeof value === "number")
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.every((v) => typeof v === "string");
+    return isStepOutputRef(value);
+}

package/dist/op/gate-approval.d.ts

@@ -33,17 +33,17 @@
  * permit counts only while the run resolves that same context (#3774).
  *
  * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
- * Roles on it are what the approver claimed, and since #4290 the quorum
- * never reads them: a role counts only when `.chant/trust.json` at base
- * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
- * still sees the claimed roles in its request.
+ * Roles on it are what the approver claimed, and nothing trusts them: since
+ * #4290 the quorum counts a role only when `.chant/trust.json` at base grants
+ * it and a seal proves the approver (`./gate-quorum.ts`), and since #4324 a
+ * policy's request carries those same roles, never the claimed ones.
  */
 import { type StepOutputRef } from "./step-output-ref.js";
+export { GATE_APPROVAL_MODES, gateBaseApprovalProblems, gatePolicyVersion, isGatePolicyRef } from "./gate-approval-base.js";
 import { type GateQuorumRule, type GateQuorumSpec } from "./gate-quorum.js";
 export type { GateQuorumRule, GateQuorumSpec } from "./gate-quorum.js";
 /** What a policy's decision does to the gate. */
 export type GateApprovalMode = "log-only" | "enforce";
-export declare const GATE_APPROVAL_MODES: readonly GateApprovalMode[];
 /**
  * A policy set a lexicon rendered for a gate — plain data, so it lands in the
  * Op's build output unchanged. Build one with the owning lexicon's helper
@@ -148,29 +148,38 @@ export interface GatePolicyDecision extends GatePolicyAnswer {
 export interface GatePolicyEvaluator {
     evaluateGatePolicy(policy: GatePolicyRef, request: GatePolicyRequest): Promise<GatePolicyAnswer> | GatePolicyAnswer;
 }
-/** The version of a gate policy: `sha256:` and the hex digest of its text. A lexicon's helper stamps it, and OPS015 checks it still matches. */
-export declare function gatePolicyVersion(text: string): string;
 /**
  * The digest of a gate's resolved approval context (#3774): `sha256:` and the
  * hex digest of its JSON with keys sorted at every level. No context and an
  * empty one digest the same.
  */
 export declare function gateContextDigest(context: Record<string, unknown> | undefined): string;
-export declare function isGatePolicyRef(value: unknown): value is GatePolicyRef;
 /**
  * Everything wrong with an `approval` block, one line each. The `gate()`
  * builder throws on the first; OPS015 reports all of them over the build
  * output, where a block could have been written without the builder.
  */
 export declare function gateApprovalProblems(approval: unknown): string[];
+/** A gate's `policy`, `mode` and `context` as `identity.gates.<gate>` declares them at base (#4404). A step output reference is not data a declaration can hold, so a context value is a plain one. */
+export interface GateBaseApproval {
+    policy?: GatePolicyRef | null;
+    mode?: GateApprovalMode | null;
+    context?: Record<string, string | number | boolean | string[]> | null;
+}
 /** Import `lexicon`'s evaluator. Throws a message that names the package when it is not installed or exports none. */
 export declare function loadGatePolicyEvaluator(lexicon: string): Promise<GatePolicyEvaluator>;
-/** The request a policy is asked about one approval. */
+/**
+ * The request a policy is asked about one approval. `roles` are the ones
+ * `.chant/trust.json` at base gives a proven approver (#4324), as a quorum
+ * judge reads them (`trustQuorumJudge` in `./gate-quorum.ts`). The roles the
+ * approver claims on `approver` are never read. Absent, the principal has none.
+ */
 export declare function gatePolicyRequest(input: {
     op: string;
     gate: string;
     resolvedBy: string;
     approver: GateApprover;
+    roles?: readonly string[];
     planDigest?: string;
     context?: Record<string, unknown>;
 }): GatePolicyRequest;

package/dist/op/gate-approval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAEtD,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAA4B,CAAC;AAExF;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAED,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AASD,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAyDhE;AASD,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}
+{"version":3,"file":"gate-approval.d.ts","sourceRoot":"","sources":["../../src/op/gate-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIxE,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACzH,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEzF,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpE,iDAAiD;AACjD,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAAC;AAGtD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,cAAc,CAAC;AAExC,kDAAkD;AAClD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;AAEpF,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,mGAAmG;IACnG,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6FAA6F;IAC7F,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uHAAuH;AACvH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACzE,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,wDAAwD;IACxD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,EAAE,gBAAgB,CAAC;IACvB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,gBAAgB,CAAC;CACrH;AAGD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAEtF;AAUD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAyDhE;AAED,uMAAuM;AACvM,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;CACvE;AAID,sHAAsH;AACtH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB3F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,iBAAiB,CAUpB"}

package/dist/op/gate-approval.js

@@ -33,21 +33,17 @@
  * permit counts only while the run resolves that same context (#3774).
  *
  * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
- * Roles on it are what the approver claimed, and since #4290 the quorum
- * never reads them: a role counts only when `.chant/trust.json` at base
- * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
- * still sees the claimed roles in its request.
+ * Roles on it are what the approver claimed, and nothing trusts them: since
+ * #4290 the quorum counts a role only when `.chant/trust.json` at base grants
+ * it and a seal proves the approver (`./gate-quorum.ts`), and since #4324 a
+ * policy's request carries those same roles, never the claimed ones.
  */
 import { createHash } from "node:crypto";
 import { lexiconModulePath, importLexiconPackage } from "../lexicon-module.js";
-import { isStepOutputRef } from "./step-output-ref.js";
 import { GATE_PLAN_CONTEXT_KEY } from "./gate-plan-context.js";
+import { GATE_APPROVAL_MODES, gatePolicyVersion, isContextValue, isGatePolicyRef } from "./gate-approval-base.js";
+export { GATE_APPROVAL_MODES, gateBaseApprovalProblems, gatePolicyVersion, isGatePolicyRef } from "./gate-approval-base.js";
 import { quorumProblems } from "./gate-quorum.js";
-export const GATE_APPROVAL_MODES = ["log-only", "enforce"];
-/** The version of a gate policy: `sha256:` and the hex digest of its text. A lexicon's helper stamps it, and OPS015 checks it still matches. */
-export function gatePolicyVersion(text) {
-    return `sha256:${createHash("sha256").update(text).digest("hex")}`;
-}
 /**
  * The digest of a gate's resolved approval context (#3774): `sha256:` and the
  * hex digest of its JSON with keys sorted at every level. No context and an
@@ -62,16 +58,6 @@ function sortedKeys(_key, value) {
     }
     return value;
 }
-export function isGatePolicyRef(value) {
-    if (typeof value !== "object" || value === null)
-        return false;
-    const v = value;
-    return (v.kind === "gate-policy" &&
-        typeof v.lexicon === "string" && v.lexicon !== "" &&
-        typeof v.name === "string" && v.name !== "" &&
-        typeof v.version === "string" && v.version !== "" &&
-        typeof v.text === "string" && v.text.trim() !== "");
-}
 /**
  * Everything wrong with an `approval` block, one line each. The `gate()`
  * builder throws on the first; OPS015 reports all of them over the build
@@ -127,15 +113,6 @@ export function gateApprovalProblems(approval) {
     }
     return problems;
 }
-function isContextValue(value) {
-    if (typeof value === "string" || typeof value === "boolean")
-        return true;
-    if (typeof value === "number")
-        return Number.isFinite(value);
-    if (Array.isArray(value))
-        return value.every((v) => typeof v === "string");
-    return isStepOutputRef(value);
-}
 /** Import `lexicon`'s evaluator. Throws a message that names the package when it is not installed or exports none. */
 export async function loadGatePolicyEvaluator(lexicon) {
     // chant #2520 — a lexicon declared by module path exports its evaluator from that module.
@@ -153,10 +130,15 @@ export async function loadGatePolicyEvaluator(lexicon) {
     }
     return mod;
 }
-/** The request a policy is asked about one approval. */
+/**
+ * The request a policy is asked about one approval. `roles` are the ones
+ * `.chant/trust.json` at base gives a proven approver (#4324), as a quorum
+ * judge reads them (`trustQuorumJudge` in `./gate-quorum.ts`). The roles the
+ * approver claims on `approver` are never read. Absent, the principal has none.
+ */
 export function gatePolicyRequest(input) {
     return {
-        principal: { kind: input.approver.kind, name: input.resolvedBy, roles: input.approver.roles ?? [] },
+        principal: { kind: input.approver.kind, name: input.resolvedBy, roles: [...(input.roles ?? [])] },
         action: "PassGate",
         resource: { op: input.op, gate: input.gate },
         context: {

package/dist/op/gate-name.d.ts

@@ -33,6 +33,19 @@ export declare const FAN_OUT_GATE_OP = "fan-out";
  * behind it, so `chant approve` must not warn that it found none.
  */
 export declare const WORKSPACE_UPGRADE_GATE_OP = "workspace-upgrade";
+/**
+ * The op name a `chant workspace exit` gate is recorded under (#3177). The gate
+ * is the exit's scope (`workspace`, or the member names joined with `+`), and
+ * it binds the digest of the exit's patch. Like an upgrade it is a command
+ * with no `*.op.ts` behind it, and leaving is a person's decision.
+ */
+export declare const WORKSPACE_EXIT_GATE_OP = "workspace-exit";
+/**
+ * The op name a `chant workspace promote` gate is recorded under (#3178). The
+ * gate is the member, and it binds the digest of the promotion's patch. A
+ * command with no `*.op.ts` behind it, like the upgrade.
+ */
+export declare const WORKSPACE_PROMOTE_GATE_OP = "workspace-promote";
 /**
  * The op name the override gate records denials and overrides under (#3760):
  * `_gates/policy-override.jsonl`, gate the subject a policy denied. Like a

package/dist/op/gate-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-name.d.ts","sourceRoot":"","sources":["../../src/op/gate-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAmC,MAAM,SAAS,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AASzC;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAEhD;AAED,oEAAoE;AACpE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAE9D;AAED,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,QAE0B,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CASjE"}
+{"version":3,"file":"gate-name.d.ts","sourceRoot":"","sources":["../../src/op/gate-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAmC,MAAM,SAAS,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,mBAAmB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,oBAAoB,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,YAAY,CAAC;AASzC;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,8FAA8F;AAC9F,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAEhD;AAED,oEAAoE;AACpE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAE9D;AAED,kFAAkF;AAClF,eAAO,MAAM,2BAA2B,QAE0B,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CASjE"}

package/dist/op/gate-name.js

@@ -32,6 +32,19 @@ export const FAN_OUT_GATE_OP = "fan-out";
  * behind it, so `chant approve` must not warn that it found none.
  */
 export const WORKSPACE_UPGRADE_GATE_OP = "workspace-upgrade";
+/**
+ * The op name a `chant workspace exit` gate is recorded under (#3177). The gate
+ * is the exit's scope (`workspace`, or the member names joined with `+`), and
+ * it binds the digest of the exit's patch. Like an upgrade it is a command
+ * with no `*.op.ts` behind it, and leaving is a person's decision.
+ */
+export const WORKSPACE_EXIT_GATE_OP = "workspace-exit";
+/**
+ * The op name a `chant workspace promote` gate is recorded under (#3178). The
+ * gate is the member, and it binds the digest of the promotion's patch. A
+ * command with no `*.op.ts` behind it, like the upgrade.
+ */
+export const WORKSPACE_PROMOTE_GATE_OP = "workspace-promote";
 /**
  * The op name the override gate records denials and overrides under (#3760):
  * `_gates/policy-override.jsonl`, gate the subject a policy denied. Like a
@@ -61,7 +74,7 @@ const PR_GATE_OP = /^pr-\d+(?:-[a-z0-9][a-z0-9-]*)?$/;
  * no Op config to read `neverOverMcp` from, the pending record carries it.
  */
 export function isNeverOverMcpGateOp(op) {
-    return op === FAN_OUT_GATE_OP || op === WORKSPACE_UPGRADE_GATE_OP || op === OVERRIDE_GATE_OP || op === RELEASE_GATE_OP || PR_GATE_OP.test(op);
+    return op === FAN_OUT_GATE_OP || op === WORKSPACE_UPGRADE_GATE_OP || op === WORKSPACE_EXIT_GATE_OP || op === OVERRIDE_GATE_OP || op === RELEASE_GATE_OP || PR_GATE_OP.test(op);
 }
 /**
  * The gate's name, from whichever key carries it. One place reads the old key,

package/dist/op/gate-quorum.d.ts

@@ -18,10 +18,16 @@
  * approver counts toward `roles`, and as someone who is not the author, only
  * when the approval proves who they are: a seal that verifies against the
  * signers file at base, or under `pr-review` the forge review of the merged
- * pull request. The judge of a gate decides that ({@link GateQuorumJudge});
+ * pull request, or a review a product recorded on a ledger the spec at base
+ * names (#4333). The judge of a gate decides that ({@link GateQuorumJudge});
  * with none, no approval proves anything, so a rule naming roles or
  * `notAuthor` is never met.
  *
+ * `notAuthor` reads who was involved in the change (#4333): the pull
+ * request's author, each login a `Requested-by:` trailer on its commits
+ * names, and the accounts an agent acts as. With `excludeInvolved`, an
+ * approval by any of them does not count at all.
+ *
  * This module is pure: no git, no file reads, no package, so
  * `@intentius/chant/gate-decision` bundles it. The judge is built by the
  * caller from the trust policy it read at base ({@link trustQuorumJudge}).
@@ -47,8 +53,14 @@ export interface QuorumJudgement {
     proven: boolean;
     /** The roles `.chant/trust.json` at base gives the approver. Empty unless `proven`. */
     roles: string[];
-    /** Whether the approver is the change's author. Undefined when nobody knows who the author is. */
+    /**
+     * Whether the approver was involved in the change: its author, or anyone
+     * else {@link TrustQuorumInput.involved} names. Undefined when nobody knows
+     * who the author is and the approver is not named as involved otherwise.
+     */
     author?: boolean;
+    /** Why the approval does not count at all (#4333): the approver was involved and the judge excludes everyone involved. */
+    excluded?: string;
 }
 /** Judges one approval for the rules. */
 export type GateQuorumJudge = (approval: GateResolutionRecord) => QuorumJudgement;
@@ -108,6 +120,68 @@ export declare function quorumRuleLine(p: GateQuorumRuleProgress): string;
 export declare function quorumWaiting(progress: readonly GateQuorumRuleProgress[]): string;
 /** Whether a rule needs a proven approver: it names roles, or `notAuthor`. */
 export declare const ruleNeedsProof: (rule: GateQuorumRule) => boolean;
+/** Someone involved in a change (#4333), and why: `github:bob asked for abc1234`. */
+export interface QuorumInvolvement {
+    who: string;
+    why: string;
+}
+/**
+ * The logins `Requested-by:` trailers on a commit message name, each once.
+ * Any line of the message counts, since a squash merge keeps the trailers of
+ * the commits it squashed in its body.
+ */
+export declare function requestedByTrailers(message: string): string[];
+/**
+ * The names a principal goes by: itself, and for a forge principal
+ * (`github:alice`, `gitlab@gitlab.acme.com:bob`) the login after the colon,
+ * so a trailer's bare login and an approval's principal name one person.
+ */
+export declare function principalNames(who: string): string[];
+/** Why `who` was involved in the change, or undefined when `involved` does not name them. */
+export declare function involvedWhy(involved: readonly QuorumInvolvement[], who: string): string | undefined;
+/**
+ * Everyone involved in a change (#4333): the pull request's `author`, each
+ * login a `Requested-by:` trailer on `commits` names, and the `agents`'
+ * accounts. `principal` turns a trailer's login into the principal the
+ * forge's approvals name (`github:<login>`); absent, the login stands.
+ */
+export declare function changeInvolvement(o: {
+    author?: string;
+    commits?: readonly {
+        sha: string;
+        message: string;
+    }[];
+    agents?: readonly string[];
+    principal?: (login: string) => string;
+}): QuorumInvolvement[];
+/**
+ * A review a product recorded on its own ledger (#4333), as terragucci does
+ * under `pr-review`: a resolution with `via: "pr-review"`, the reviewed
+ * `head`, and the `reviewers` who approved it, by forge login. One line
+ * names every reviewer, so `resolvedBy` is not one person.
+ */
+export interface RecordedReview {
+    pr?: number;
+    head: string;
+    reviewers: string[];
+}
+/** The review a ledger line records, when it is a product's review line; null otherwise. */
+export declare function recordedReviewOf(r: GateResolutionRecord): RecordedReview | null;
+/**
+ * The approvals a product's review lines stand for (#4333): each line
+ * {@link recordedReviewOf} reads becomes one approval per reviewer, named by
+ * `principal(login)` (the login itself when absent), a human's, with the
+ * review on it. A seal on the line is dropped: it signs the line, not any
+ * one reviewer. Every other line is kept as it is. `reviews` lists the
+ * reviews read, for {@link TrustQuorumInput.recorded}.
+ */
+export declare function recordedReviewApprovals(records: readonly GateResolutionRecord[], principal?: (login: string) => string): {
+    records: GateResolutionRecord[];
+    reviews: {
+        head: string;
+        approvers: string[];
+    }[];
+};
 /** What {@link trustQuorumJudge} judges by. */
 export interface TrustQuorumInput {
     /** The signers at base: an approval whose seal verifies for its approver against them is proven. */
@@ -116,6 +190,25 @@ export interface TrustQuorumInput {
     roles: Readonly<Record<string, readonly string[]>>;
     /** The change's authors, as principals. Absent, nobody knows who they are. */
     authors?: readonly string[];
+    /**
+     * Everyone else involved in the change (#4333), from {@link
+     * changeInvolvement}: an approver named here is judged as an author, for
+     * `notAuthor`, whether or not `authors` is known.
+     */
+    involved?: readonly QuorumInvolvement[];
+    /** An approval by an author or anyone `involved` names does not count at all (#4333), toward any rule. */
+    excludeInvolved?: boolean;
+    /**
+     * Reviews a product recorded on the ledger the spec at base names (#4333),
+     * from {@link recordedReviewApprovals}: a resolution that names one's head
+     * and one of its approvers as `resolvedBy` is proven, as for `review`. Pass
+     * them only under `pr-review`, as the product proves its reviewers only
+     * then.
+     */
+    recorded?: readonly {
+        head: string;
+        approvers: readonly string[];
+    }[];
     /**
      * Under `pr-review`, the merged pull request's review, read from the forge
      * in this run: a resolution that names this review's head and one of its
@@ -126,6 +219,10 @@ export interface TrustQuorumInput {
         approvers: readonly string[];
     };
 }
-/** The judge a gate's rules are met by: proof from a seal or the live review, roles from trust.json at base. */
+/**
+ * The judge a gate's rules are met by: proof from a seal, the live review or
+ * a review a product recorded, roles from trust.json at base, and the
+ * change's authors and everyone else involved in it left out.
+ */
 export declare function trustQuorumJudge(input: TrustQuorumInput): GateQuorumJudge;
 //# sourceMappingURL=gate-quorum.d.ts.map

package/dist/op/gate-quorum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED,gHAAgH;AAChH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAYzE"}
+{"version":3,"file":"gate-quorum.d.ts","sourceRoot":"","sources":["../../src/op/gate-quorum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAErE,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,gIAAgI;IAChI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,+HAA+H;IAC/H,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yFAAyF;IACzF,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,SAAS,cAAc,EAAE,CAAC;AAExE,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,0HAA0H;IAC1H,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,oBAAoB,KAAK,eAAe,CAAC;AAElF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,eAAsD,CAAC;AAEpF,+BAA+B;AAC/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,EAAE,OAAO,CAAC;IACb,mGAAmG;IACnG,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,EAAE,CAGhF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBrE;AAED,oHAAoH;AACpH,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,EAAE,CAE7G;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CA0BpG;AAID,qFAAqF;AACrF,eAAO,MAAM,aAAa,MAAO,MAAM,KAAK,MAAM,KAAG,OAA8B,CAAC;AAEpF,iFAAiF;AACjF,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAKjG;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,sBAAsB,CAoBrH;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAUhE;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,GAAG,MAAM,CAEjF;AAED,8EAA8E;AAC9E,eAAO,MAAM,cAAc,SAAU,cAAc,KAAG,OAAmE,CAAC;AAE1H,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAKD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAO7D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpD;AAED,6FAA6F;AAC7F,wBAAgB,WAAW,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGnG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC,GAAG,iBAAiB,EAAE,CAWtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,GAAG,cAAc,GAAG,IAAI,CAK/E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,SAAS,oBAAoB,EAAE,EACxC,SAAS,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAyB,GACtD;IAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;CAAE,CAgBvF;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,oGAAoG;IACpG,OAAO,EAAE,WAAW,CAAC;IACrB,iDAAiD;IACjD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACxC,0GAA0G;IAC1G,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC;IACrE;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CACzD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,CAgBzE"}