@intentius/chant 0.124.46 → 0.124.49

package/src/gate-decision-bundle.test.ts

@@ -45,17 +45,20 @@ describe("the gate-decision bundle", () => {
       "packages/core/src/lifecycle/plan-digest.ts",
       "packages/core/src/notify-verify.ts",
       "packages/core/src/notify.ts",
+      "packages/core/src/op/gate-approval-base.ts",
+      "packages/core/src/op/gate-plan-context.ts",
       "packages/core/src/op/gate-point.ts",
       "packages/core/src/op/gate-quorum.ts",
       "packages/core/src/op/op-waves.ts",
+      "packages/core/src/wave-blocked.ts",
       "packages/core/src/wave-layout.ts",
       "packages/core/src/workspace/class-data.ts",
       "packages/core/src/workspace/identity-gate-rule.ts",
       "packages/core/src/workspace/jsonc.ts",
       "packages/core/src/workspace/trust/trust-files.ts",
     ]);
-    // About 49 KB unminified today: 7 KB of it the pinned classes read as data (#3888), 6 KB the approval rules (#4290).
+    // About 49 KB unminified today: 7 KB of it the pinned classes read as data (#3888), 6 KB the approval rules (#4290), and the base approval checks (#4404) bring it to about 55 KB.
     const bytes = result.outputFiles.reduce((n, f) => n + f.contents.byteLength, 0);
-    expect(bytes).toBeLessThan(54 * 1024);
+    expect(bytes).toBeLessThan(58 * 1024);
   });
 });

package/src/gate-decision-identity.test.ts

@@ -19,6 +19,7 @@ import {
 import { gateAdmission } from "./workspace/identity";
 import { hasSshKeygen, TestRepo, type Key } from "./workspace/trust/test-repo";
 import { evaluateGate, memoryGateLedgerPort } from "./op/gate";
+import { gatePolicyVersion } from "./op/gate-approval";
 
 const D1 = "sha256:" + "a".repeat(64);
 const GATES = { ship: {}, deploy: { class: "human" }, release: { class: "runner" }, ops: { class: "operator" } };
@@ -218,6 +219,25 @@ describe.skipIf(!hasSshKeygen)("identity.gates read at base, as chant reads it",
       expect(decided.status === "approved" && decided.via === "ledger" ? decided.resolution : null).toEqual(check.satisfied ? check.resolution : null);
     }
   });
+
+  test("a gate's quorum at base, as chant reads it (#4324)", () => {
+    const rules = [{ targets: ["prod"], count: 2, roles: ["platform"] }, { count: 1 }];
+    const { r, base } = setup(() => ({}), { identity: { gates: { ship: { quorum: rules }, deploy: { class: "human" } } } });
+    const here = identityGateAdmissionAt(r.dir, base, "ship")!;
+    expect(here.requirement.quorum).toEqual(rules);
+    expect(here.requirement.quorum).toEqual(gateAdmission(r.dir, "ship", base)!.requirement.quorum);
+    expect(identityGateAdmissionAt(r.dir, base, "deploy")!.requirement).toEqual({ gate: "deploy", class: "human" });
+  });
+
+  test("a gate's policy, mode and context at base, as chant reads them (#4404)", () => {
+    const text = "permit (principal, action, resource);";
+    const policy = { kind: "gate-policy", lexicon: "cedar", name: "ship", version: gatePolicyVersion(text), text };
+    const { r, base } = setup(() => ({}), { identity: { gates: { ship: { policy, mode: "enforce", context: { risk: "high" } } } } });
+    const here = identityGateAdmissionAt(r.dir, base, "ship")!.requirement;
+    const theirs = gateAdmission(r.dir, "ship", base)!.requirement;
+    expect(here).toMatchObject({ policy, mode: "enforce", context: { risk: "high" } });
+    expect({ policy: here.policy, mode: here.mode, context: here.context }).toEqual({ policy: theirs.policy, mode: theirs.mode, context: theirs.context });
+  });
 });
 
 describe("admitApprover", () => {

package/src/gate-decision.ts

@@ -30,7 +30,10 @@
  * Approval rules (#4290), a quorum as a list of `{ targets, count, roles,
  * notAuthor }`, are judged with `./op/gate-quorum.ts`, re-exported here:
  * {@link trustRolesAt} and {@link gateSignersAt} read what
- * `trustQuorumJudge` judges by, at base.
+ * `trustQuorumJudge` judges by, at base. A product's own review lines
+ * (#4333) become one approval per reviewer with `recordedReviewApprovals`,
+ * and `changeInvolvement` names everyone involved in a change for the
+ * judge to leave out.
  *
  * The module reads the ledger lines and the review it is handed; reading
  * them is the caller's. It imports no TypeScript, esbuild, zod, ajv, lint,
@@ -63,6 +66,9 @@ import { CORE_CLASSES, admitApprover, type ClassGrant, type GateAdmissionRule, t
 import { diskFiles, findInstalledPackage, mergePinClasses, parseClassDataByHand, readClassFiles, type PinClassRead } from "./workspace/class-data";
 import type { GateResolutionRecord, PendingGateRecord } from "./lifecycle/gate-ledger";
 import type { MergedReview } from "./op/gate-review";
+import { quorumProblems as quorumProblemsOf, type GateQuorumSpec as QuorumSpec } from "./op/gate-quorum";
+import { gateBaseApprovalProblems } from "./op/gate-approval-base";
+import type { GateApprovalMode, GatePolicyRef } from "./op/gate-approval";
 import type { GateApprovalSource } from "./op/op-waves";
 
 export { GATE_APPROVAL_SOURCES, type GateApprovalSource } from "./op/op-waves";
@@ -124,6 +130,14 @@ export {
   targetGlobMatch,
   trustQuorumJudge,
   UNPROVEN_JUDGE,
+  changeInvolvement,
+  involvedWhy,
+  principalNames,
+  recordedReviewApprovals,
+  recordedReviewOf,
+  requestedByTrailers,
+  type QuorumInvolvement,
+  type RecordedReview,
   type GateQuorumJudge,
   type GateQuorumRule,
   type GateQuorumRuleProgress,
@@ -213,6 +227,19 @@ export function trustRolesAt(repo: string, base: string): Record<string, string[
 export interface IdentityGate {
   gate: string;
   class: string | null;
+  /**
+   * `identity.gates.<gate>.quorum` (#4324): the approval rules an Op gate of
+   * this name takes in place of its own. Absent when the entry sets none.
+   */
+  quorum?: QuorumSpec;
+  /**
+   * `identity.gates.<gate>.policy`, `.mode` and `.context` (#4404): what an Op
+   * gate of this name takes in place of its own `approval` fields. Each is
+   * absent when the entry sets none.
+   */
+  policy?: GatePolicyRef;
+  mode?: GateApprovalMode;
+  context?: Record<string, string | number | boolean | string[]>;
 }
 
 /** The declaration at `base`, parsed, or null when there is none. Throws when it cannot be parsed. */
@@ -228,8 +255,24 @@ function declarationAt(repo: string, base: string): { file: string; value: unkno
 }
 
 function identityGatesOf(declaration: unknown): IdentityGate[] {
-  const gates = (declaration as { identity?: { gates?: Record<string, { class?: unknown } | null> } } | null)?.identity?.gates ?? {};
-  return Object.entries(gates).map(([gate, entry]) => ({ gate, class: typeof entry?.class === "string" ? entry.class : null }));
+  const gates = (declaration as { identity?: { gates?: Record<string, { class?: unknown; quorum?: unknown; policy?: unknown; mode?: unknown; context?: unknown } | null> } } | null)?.identity?.gates ?? {};
+  return Object.entries(gates).map(([gate, entry]) => {
+    const out: IdentityGate = { gate, class: typeof entry?.class === "string" ? entry.class : null };
+    if (!entry) return out;
+    if (entry.quorum !== undefined) {
+      // #4324: a quorum chant would refuse leaves the gate undecidable, as chant's own read does.
+      const [problem] = quorumProblemsOf(entry.quorum, `identity.gates.${gate}.quorum`, { notAuthor: false });
+      if (problem) throw new Error(`chant.workspace.json at base: ${problem.replace(/`/g, "")}, so the gate cannot be decided`);
+      out.quorum = structuredClone(entry.quorum) as QuorumSpec;
+    }
+    // #4404: the same for the policy, mode and context.
+    const [rest] = gateBaseApprovalProblems(entry, `identity.gates.${gate}`);
+    if (rest) throw new Error(`chant.workspace.json at base: ${rest.replace(/`/g, "")}, so the gate cannot be decided`);
+    if (entry.policy !== undefined) out.policy = structuredClone(entry.policy) as GatePolicyRef;
+    if (entry.mode !== undefined) out.mode = entry.mode as GateApprovalMode;
+    if (entry.context !== undefined) out.context = structuredClone(entry.context) as NonNullable<IdentityGate["context"]>;
+    return out;
+  });
 }
 
 /**

package/src/graph-ir.ts

@@ -210,6 +210,33 @@ export interface LexiconWorkspaceOutputs {
   gaps?: string[];
 }
 
+/**
+ * One link a lexicon reads from its own declarations (#4397): an output of
+ * another member that a declaration depends on, such as a table an otel
+ * `clickhouse` exporter writes.
+ */
+export interface LexiconWorkspaceLink {
+  /** The producer's output the declaration reads or writes: `default.otel_logs`, `default.otel_logs.Body`. */
+  output: string;
+  /**
+   * The output that picks the producer when `member` is unset; unset, the
+   * output itself. A column is anchored on its table, so a dropped column is
+   * missing from the member that still has the table.
+   */
+  anchor?: string;
+  /** The producer, when the declaration names it. Unset, the one member exposing `anchor`. */
+  member?: string;
+  /** The entity key that states the link, for the finding's file and line. */
+  entity: string;
+}
+
+/** What a lexicon's `workspaceLinks` hook returns (#4397). */
+export interface LexiconWorkspaceLinks {
+  links: LexiconWorkspaceLink[];
+  /** Places the hook could not read without the environment, one line each. Their links are left out. */
+  gaps?: string[];
+}
+
 /** What a lexicon's `graphEdges` hook returns (#3910). */
 export interface LexiconGraphEdges {
   references: LexiconGraphReference[];

package/src/graph-walk.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from "vitest";
+import { adjacencyOf, walkBreadthFirst } from "./graph-walk";
+
+const edges = [
+  { from: "a", to: "b" },
+  { from: "b", to: "c" },
+  { from: "c", to: "a" },
+  { from: "c", to: "d" },
+];
+const idx = adjacencyOf(edges);
+const out = (id: string) => (idx.out.get(id) ?? []).map((e) => ({ far: e.to, hops: [e] }));
+
+describe("walkBreadthFirst", () => {
+  test("offers every node at its shortest depth first, and ends on a cycle", () => {
+    const first = new Map<string, number>();
+    const found = walkBreadthFirst("a", {
+      steps: out,
+      arrive: ({ id, depth }) => {
+        if (!first.has(id)) first.set(id, depth);
+        return false;
+      },
+    });
+    expect(found).toBeNull();
+    expect([...first]).toEqual([["b", 1], ["c", 2], ["a", 3], ["d", 3]]);
+  });
+
+  test("stops on the first accepted arrival and returns its hops", () => {
+    const found = walkBreadthFirst("a", { steps: out, arrive: ({ id }) => id === "d" });
+    expect(found?.depth).toBe(3);
+    expect(found?.hops.map((h) => `${h.from}->${h.to}`)).toEqual(["a->b", "b->c", "c->d"]);
+  });
+
+  test("min and max bound which arrivals are offered and how far it steps", () => {
+    const offered: string[] = [];
+    walkBreadthFirst("a", { steps: out, min: 2, max: 2, arrive: ({ id }) => (offered.push(id), false) });
+    expect(offered).toEqual(["c"]);
+  });
+
+  test("walks from several starts at once", () => {
+    const offered = new Set<string>();
+    walkBreadthFirst(["c", "b"], { steps: out, arrive: ({ id }) => (offered.add(id), false) });
+    expect([...offered].sort()).toEqual(["a", "b", "c", "d"]);
+  });
+});

package/src/graph-walk.ts

@@ -0,0 +1,102 @@
+/**
+ * The one breadth-first edge walk in core.
+ *
+ * `chant search`'s transitive edge terms (#4359) walk the graph IR, and carve's
+ * reachability (#2325) and reference-closed sets (#3909) walk a `TfGraph`. The
+ * two graphs have different node and edge shapes but the same walk: an index of
+ * each node's edges by direction, built once, and a frontier that steps along
+ * it. This module is that walk, generic over what a step carries, so neither
+ * caller keeps a traversal of its own.
+ *
+ * Pure: no IR or Terraform types, no filesystem.
+ */
+
+/** Edges grouped by the node they leave (`out`) and the node they enter (`in`). */
+export interface Adjacency<E> {
+  out: Map<string, E[]>;
+  in: Map<string, E[]>;
+}
+
+/**
+ * Index edges by both ends, once. Looking a node's edges up in here is O(1),
+ * where filtering the edge list for them is O(E) per node and O(V·E) per walk
+ * (#2325 measured 21 s against 52 ms at 6 000 nodes).
+ */
+export function adjacencyOf<E extends { from: string; to: string }>(edges: Iterable<E>): Adjacency<E> {
+  const idx: Adjacency<E> = { out: new Map(), in: new Map() };
+  for (const e of edges) {
+    let out = idx.out.get(e.from);
+    if (!out) idx.out.set(e.from, (out = []));
+    out.push(e);
+    let inn = idx.in.get(e.to);
+    if (!inn) idx.in.set(e.to, (inn = []));
+    inn.push(e);
+  }
+  return idx;
+}
+
+/** One step out of a node: where it lands, and the hops (edges) it took to get there. */
+export interface WalkStep<H> {
+  far: string;
+  hops: readonly H[];
+}
+
+/** A node reached by the walk: its id, how many steps from the start, and the hops on the way. */
+export interface WalkArrival<H> {
+  id: string;
+  depth: number;
+  hops: H[];
+}
+
+export interface WalkOptions<H> {
+  /** The steps out of a node. The walk follows exactly these; filter here. */
+  steps: (id: string) => readonly WalkStep<H>[];
+  /** Arrivals shallower than this are walked through but not offered. Default 1. */
+  min?: number;
+  /** No step is taken from a node this deep. Default unbounded. */
+  max?: number;
+  /**
+   * Called for each arrival at a depth of at least `min`, in breadth-first
+   * order, so a node's first arrival is at its shortest depth. A node can
+   * arrive more than once (by several edges, or again past `min` on a cycle);
+   * return true to stop the walk and return this arrival.
+   */
+  arrive?: (arrival: WalkArrival<H>) => boolean;
+}
+
+/**
+ * Walk breadth-first from one or more start nodes (#4359, #2325).
+ *
+ * Termination on a cycle: a state is (node, depth capped at `min`). Past the
+ * minimum, arriving at a node again by a longer walk can reach nothing the
+ * first arrival could not, so it is not queued twice. The state space is
+ * finite and the walk always ends, which matters for carve: chant never runs
+ * Terraform, so a `depends_on` cycle in a malformed estate reaches it
+ * unvalidated.
+ *
+ * Returns the arrival `arrive` stopped on, or null when the walk ran out.
+ */
+export function walkBreadthFirst<H>(start: string | Iterable<string>, opts: WalkOptions<H>): WalkArrival<H> | null {
+  const min = opts.min ?? 1;
+  const max = opts.max ?? Infinity;
+  const starts = typeof start === "string" ? [start] : [...start];
+  const seen = new Set<string>(starts.map((id) => `${id}|0`));
+  let frontier: WalkArrival<H>[] = starts.map((id) => ({ id, depth: 0, hops: [] }));
+  while (frontier.length > 0) {
+    const next: WalkArrival<H>[] = [];
+    for (const s of frontier) {
+      if (s.depth >= max) continue;
+      for (const step of opts.steps(s.id)) {
+        const depth = s.depth + 1;
+        const arrival: WalkArrival<H> = { id: step.far, depth, hops: step.hops.length ? [...s.hops, ...step.hops] : s.hops };
+        if (depth >= min && opts.arrive?.(arrival)) return arrival;
+        const key = `${step.far}|${Math.min(depth, min)}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        next.push(arrival);
+      }
+    }
+    frontier = next;
+  }
+  return null;
+}

package/src/import/parser.ts

@@ -57,6 +57,24 @@ export interface OutputIR {
   readonly condition?: string;
 }
 
+/**
+ * A finding a parser reports about the translation it made (#4398): a
+ * judgment call the author must confirm, or something it could not carry.
+ * `chant import --report <path>` writes these as SARIF and `--strict` fails
+ * while any `warning` or `error` is open, as `chant migrate` does.
+ */
+export interface ImportDiagnostic {
+  readonly ruleId: string;
+  readonly severity: "error" | "warning" | "info";
+  readonly message: string;
+  /** 1-based line in the template, when the parser knows it. */
+  readonly line?: number;
+  /** 1-based column in the template. */
+  readonly column?: number;
+  /** The object the finding is about, as the source names it. */
+  readonly entity?: string;
+}
+
 /**
  * Intermediate representation of a parsed template
  */
@@ -71,6 +89,8 @@ export interface TemplateIR {
   /** Sections or keys the parser read but import cannot carry, named so the
    * import surfaces them instead of dropping them silently (#2069). */
   readonly warnings?: string[];
+  /** Findings for `--report` and `--strict` (#4398); a parser that has none leaves it out. */
+  readonly diagnostics?: ImportDiagnostic[];
 }
 
 /**

package/src/lexicon.ts

@@ -3,8 +3,8 @@ import type { Serializer } from "./serializer";
 import type { Declarable } from "./declarable";
 import type { LintRule } from "./lint/rule";
 import type { RuleSpec } from "./lint/declarative";
-import type { PostSynthCheck } from "./lint/post-synth";
-import type { TemplateParser, TemplateIR, ParseContext, ParserOptions, ParserOptionSpec } from "./import/parser";
+import type { CrossRootCheck, PostSynthCheck } from "./lint/post-synth";
+import type { TemplateParser, TemplateIR, ParseContext, ParserOptions, ParserOptionSpec, ImportDiagnostic } from "./import/parser";
 import type { TypeScriptGenerator } from "./import/generator";
 import type { EmbeddedContentImporter } from "./import/embedded";
 import type { AgentConfigImporter } from "./agents/importer";
@@ -24,7 +24,7 @@ import type { OwnershipChannel, OwnershipMarker } from "./ownership";
 import type { LexiconConfigSchema } from "./lexicon-config";
 import type { RuleMeta } from "./audit/catalog";
 import type { ReferenceCatalog } from "./graph-refs";
-import type { IREdge, LexiconGraphEdges, LexiconUnreadSource, LexiconWorkspaceOutputs } from "./graph-ir";
+import type { IREdge, LexiconGraphEdges, LexiconUnreadSource, LexiconWorkspaceLinks, LexiconWorkspaceOutputs } from "./graph-ir";
 import type { DescribeResourcesResult, UnobservedReason } from "./observation";
 import type { DescribeIdentityOptions, DescribeIdentityResult } from "./identity";
 import type { DeepNormalizationHooks, DeepObservationResult } from "./deep-observation";
@@ -382,8 +382,11 @@ export function intrinsicCallFoldsEagerly(def: { isTag?: boolean; foldsEagerly?:
  * Options passed to a MigrationSource by `chant migrate`.
  */
 export interface MigrateOptions {
-  /** Output format. */
-  emit?: "yaml" | "ts";
+  /**
+   * Output format. `yaml` and `ts` are the gitlab pair's; `sql` writes plain
+   * DDL for a pair whose target is a database (#4399).
+   */
+  emit?: "yaml" | "ts" | "sql";
   /** Recognise composite patterns when emitting. */
   useComposites?: boolean;
   /** Source file path (for provenance display only). */
@@ -411,6 +414,20 @@ export interface MigrationResult {
   diagnostics: Array<Record<string, unknown>>;
   /** Markdown "Security posture" section, when security analysis ran (#306). */
   securityPosture?: string;
+  /**
+   * Outputs of the source member that the rendered output reads, by the names
+   * a workspace link takes (#4399). In a workspace, `chant migrate` writes
+   * them as `links` of the member the output lands in, so a source that drops
+   * or renames one fails `chant workspace check`.
+   */
+  links?: string[];
+  /**
+   * The checks that need the target's own server, run for `--validate`
+   * instead of the external linter (#4399). Returns the diagnostics found,
+   * `error` severity for a refusal. Throws when the server cannot start, which
+   * `chant migrate` reports as a validation that did not run.
+   */
+  validate?(): Promise<Array<Record<string, unknown>>>;
 }
 
 /**
@@ -420,6 +437,12 @@ export interface MigrationResult {
 export interface MigrationSource {
   /** Lightweight detector: does this content look like the expected source? */
   detect(content: string): boolean;
+  /**
+   * The source may be a directory, which `transform` reads itself from
+   * `opts.sourceFile` (a workspace member, #4399). `chant migrate` then skips
+   * `detect` and passes empty content.
+   */
+  directory?: boolean;
   /** Run the translation. */
   transform(content: string, opts: MigrateOptions): Promise<MigrationResult>;
 }
@@ -870,6 +893,19 @@ export interface ScheduledOpSpec {
    * per-job environment mapping to put a value in.
    */
   variables?: Record<string, string>;
+  /**
+   * The Op runs a `reviewAgent` step in `handoff` mode (#4326): generate the
+   * review as two jobs. The first runs `chant run <name>` with no forge write
+   * token (the checkout's fetches get the job's token and nothing after
+   * them does) and hands the review on as job outputs. The second checks
+   * nothing out, takes the review as data and posts it as one note with the
+   * write token (`postReviewNote`). GitHub and Forgejo only: a GitLab merge
+   * request pipeline hands every job the project's unprotected variables, so
+   * the gitlab generator refuses this by name. The trigger must be
+   * `pull_request` and the finding-mode `report`, since the first job posts
+   * nothing.
+   */
+  reviewAgent?: boolean;
 }
 
 /**
@@ -1191,6 +1227,14 @@ export interface LexiconPlugin {
   /** Return post-synthesis checks for build validation */
   postSynthChecks?(): PostSynthCheck[];
 
+  /**
+   * Checks that read across build roots (chant #1939). Only a cross-root run
+   * (`runCrossRootChecks`, ./lint/post-synth.ts) calls this; `chant build`
+   * and `chant lint` never do, so a lexicon that adds one costs a
+   * single-build project nothing.
+   */
+  crossRootChecks?(): CrossRootCheck[];
+
   /**
    * Activity contracts (`ActivityContract`, `./op/activity-contract.ts`) for
    * the activities this lexicon implements, so another lexicon's post-synth
@@ -1305,6 +1349,15 @@ export interface LexiconPlugin {
    */
   parserOptions?(): ParserOptionSpec[];
 
+  /**
+   * `chant import --validate` (#4398): check what the import would write
+   * against the lexicon's own emulator, and return one diagnostic per
+   * failure (severity `error`). Called with the parsed IR and the checked
+   * parser options. A lexicon without an emulator leaves this out, and
+   * `--validate` then fails the import with a message saying so.
+   */
+  validateImport?(ir: TemplateIR, options: ParserOptions): Promise<ImportDiagnostic[]>;
+
   /** Return a generator for converting IR to TypeScript */
   templateGenerator?(): TypeScriptGenerator;
 
@@ -1499,6 +1552,17 @@ export interface LexiconPlugin {
    */
   workspaceOutputs?(entities: ReadonlyMap<string, Declarable>, unread?: readonly LexiconUnreadSource[]): LexiconWorkspaceOutputs | undefined;
 
+  /**
+   * The outputs of other workspace members this lexicon's declarations read
+   * or write (#4397), such as the ClickHouse tables an otel `clickhouse`
+   * exporter writes. `chant workspace check` calls it offline on the member's
+   * folded source, as it calls `workspaceOutputs`, and checks each link like
+   * one a kind's reader found (WSP093 to WSP095, WSP099 for `gaps`), naming
+   * the file and line of the declaring entity. Pure: no I/O. Return
+   * `undefined` when the project declares nothing that links.
+   */
+  workspaceLinks?(entities: ReadonlyMap<string, Declarable>, unread?: readonly LexiconUnreadSource[]): LexiconWorkspaceLinks | undefined;
+
   // LSP
   /** Provide completions for LSP */
   completionProvider?(ctx: CompletionContext): CompletionItem[];
@@ -1544,10 +1608,14 @@ export interface LexiconPlugin {
    * Return a migration source for translating from another lexicon's
    * format into this lexicon. Returns undefined if `from` is not supported.
    *
+   * `to` is the target as `--to` names it. A side may add a dialect after the
+   * lexicon, `sql/clickhouse` (#4399); `from` is passed as written, and a
+   * lexicon with one target ignores `to`.
+   *
    * Example: the gitlab lexicon implements `migrationSource("github")` to
    * translate `.github/workflows/*.yml` into `.gitlab-ci.yml`.
    */
-  migrationSource?(from: string): MigrationSource | undefined;
+  migrationSource?(from: string, to?: string): MigrationSource | undefined;
 
   // State
   /**
@@ -1674,6 +1742,30 @@ export interface LexiconPlugin {
     changes: DisruptionQuery[];
   }): Record<string, DisruptionVerdict> | Promise<Record<string, DisruptionVerdict>>;
 
+  /**
+   * Classify the migration files a pull request adds (#4407), offline. Core
+   * lists the new files of a migration-directory workspace member (goose,
+   * golang-migrate, clickhouse-migrations, Flyway) and asks the lexicon whose
+   * dialect they are written in; the lexicon reads each file's up statements
+   * and gives each the class its schema-diff classifier gives the same change.
+   * A statement that alone cannot decide a class comes back `undecided`,
+   * naming the candidate rules. The answer is shown in the plan note; nothing
+   * is applied and no server is contacted. Omit for a lexicon with no
+   * migration dialect.
+   */
+  classifyMigrations?(options: {
+    /** The member's kind reader: `goose-dir`, `golang-migrate-dir`, `clickhouse-migrations-dir` or `flyway-dir`. */
+    reader: string;
+    /** The SQL dialect the member's migrations are written in. A lexicon answers only for its own dialects (an empty list otherwise). */
+    dialect: string;
+    /** The tree the files are read from (the pull request's head), rooted at the workspace root. */
+    tree: import("./workspace/tree").WorkspaceTree;
+    /** The member's directory in that tree; "" for the root. */
+    dir: string;
+    /** The new files to classify, relative to the workspace root. */
+    files: string[];
+  }): import("./pr-migrations").MigrationFileClassification[] | Promise<import("./pr-migrations").MigrationFileClassification[]>;
+
   /**
    * Report the undeclared resources this estate *depends on* (#1273), as
    * opposed to the ones it manages.

package/src/lifecycle/gate-ledger.ts

@@ -181,6 +181,14 @@ export interface GateResolutionRecord {
    * other resolution.
    */
   empty?: true;
+  /**
+   * The workspace gate that stood in for this member gate (#2554, ws-039):
+   * its name and the digest of the member plans it covers. Set only on the
+   * resolution a run builds when a workspace approval passes the gate; it is
+   * never written to the member's ledger, where the approval stays the
+   * workspace's (`_members/_workspace/_gates/`).
+   */
+  workspaceGate?: { gate: string; digest: string };
   /**
    * The channel this resolution was authored on (chant#2384) — set by the
    * writer, never by the caller. `chant approve` records `"cli"`, the

package/src/lifecycle/git.ts

@@ -148,7 +148,7 @@ export async function writeBlobToPath(
   filename: string,
   content: string,
   commitMessage: string,
-  opts?: { cwd?: string; expectPriorPathSha?: string | null },
+  opts?: LedgerLocation & { expectPriorPathSha?: string | null },
 ): Promise<string> {
   const dir = await ledgerDir(environment, opts);
   return writeLedgerFiles(
@@ -447,7 +447,7 @@ export async function readBlobFromPath(
 export async function readPathSha(
   environment: string,
   filename: string,
-  opts?: { cwd?: string },
+  opts?: LedgerLocation,
 ): Promise<string | null> {
   const rt = getRuntime();
   const dir = await ledgerDir(environment, opts);