@intentius/chant 0.124.46 → 0.124.49

package/src/op/gate-approval-at-base.test.ts

@@ -0,0 +1,97 @@
+/**
+ * #4404: an Op gate's `policy`, `mode` and `context` are fields of
+ * `identity.gates.<gate>` in the workspace declaration at base, as the quorum
+ * is (#4324), so a change can't switch its own gate to `log-only` or swap in a
+ * permissive policy and be judged by that.
+ */
+
+import { afterEach, describe, expect, test } from "vitest";
+import type { GateStep, OpConfig } from "./types";
+import type { ActivityFn } from "./activity-registry";
+import { resolveGateApproval, runOpLocally } from "./local-executor";
+import { gitGateLedgerPort, memoryGateLedgerPort, type GateLedgerPort } from "./gate";
+import { gatePolicyVersion, type GatePolicyRef } from "./gate-approval";
+import { stepOutput } from "./step-output-ref";
+import { resetGateOrigin } from "../lifecycle/gate-origin";
+import { hasSshKeygen, TestRepo } from "../workspace/trust/test-repo";
+
+const policy = (name: string, text: string): GatePolicyRef => ({ kind: "gate-policy", lexicon: "cedar", name, version: gatePolicyVersion(text), text });
+const STRICT = policy("strict", "forbid unless maintainer");
+const PERMISSIVE = policy("permissive", "permit all");
+
+const step = (approval?: GateStep["approval"]): GateStep => ({ kind: "gate", gate: "ship", ...(approval ? { approval } : {}) }) as GateStep;
+
+describe("resolveGateApproval reads policy, mode and context at base (#4404)", () => {
+  test("the base policy and mode replace the Op's own", () => {
+    const opSide = step({ policy: PERMISSIVE, mode: "log-only" });
+    const got = resolveGateApproval(opSide, new Map(), undefined, null, { policy: STRICT, mode: "enforce" });
+    expect(got).toEqual({ policy: STRICT, mode: "enforce" });
+  });
+
+  test("a gate whose Op dropped its approval block still takes the base policy and mode", () => {
+    expect(resolveGateApproval(step(), new Map(), undefined, null, { policy: STRICT, mode: "enforce" })).toEqual({ policy: STRICT, mode: "enforce" });
+  });
+
+  test("a field the entry leaves out comes from the Op", () => {
+    const opSide = step({ policy: PERMISSIVE, mode: "enforce" });
+    expect(resolveGateApproval(opSide, new Map(), undefined, null, { mode: "log-only" })).toEqual({ policy: PERMISSIVE, mode: "log-only" });
+    expect(resolveGateApproval(opSide, new Map(), undefined, null, { policy: STRICT })).toEqual({ policy: STRICT, mode: "enforce" });
+  });
+
+  test("the base context wins key by key, and a key only the Op sets still reaches the policy", () => {
+    const opSide = step({ policy: STRICT, context: { risk: "low", team: "payments" } });
+    const got = resolveGateApproval(opSide, new Map(), undefined, null, { context: { risk: "high" } });
+    expect(got?.context).toEqual({ risk: "high", team: "payments" });
+  });
+
+  test("a step output reference in the Op's context still resolves beside a base key", () => {
+    const opSide = step({ policy: STRICT, context: { rows: stepOutput("verify", "rows") } });
+    const got = resolveGateApproval(opSide, new Map([["verify", { rows: 12 }]]), undefined, null, { context: { risk: "high" } });
+    expect(got?.context).toEqual({ risk: "high", rows: 12 });
+  });
+
+  test("with nothing at base, the Op's own applies", () => {
+    expect(resolveGateApproval(step({ policy: PERMISSIVE, mode: "enforce" }), new Map(), undefined, null, { policy: null, mode: null, context: null })).toEqual({ policy: PERMISSIVE, mode: "enforce" });
+    expect(resolveGateApproval(step(), new Map(), undefined, null, { policy: null, mode: null, context: null })).toBeUndefined();
+  });
+});
+
+describe.skipIf(!hasSshKeygen)("an Op gate's policy and mode at base (#4404)", () => {
+  const repos: TestRepo[] = [];
+  afterEach(() => {
+    resetGateOrigin();
+    while (repos.length) repos.pop()!.cleanup();
+  });
+
+  const declaration = (gate: Record<string, unknown>): string => JSON.stringify({ name: "acme", schema: 1, members: [], identity: { gates: { ship: gate } } });
+  const config = (approval: NonNullable<GateStep["approval"]>): OpConfig => ({
+    name: "release",
+    overview: "",
+    phases: [
+      { name: "Gate", steps: [{ kind: "gate", gate: "ship", approval }] },
+      { name: "Apply", steps: [{ kind: "activity", fn: "ship", args: {} }] },
+    ],
+  });
+  const activities = new Map<string, ActivityFn>([["ship", async () => ({})]]);
+
+  test("a change that switches its gate to a permissive log-only policy is judged by the base's", async () => {
+    const r = new TestRepo("4404-policy");
+    repos.push(r);
+    r.git(["config", "user.email", "t@example.test"]);
+    r.git(["config", "user.name", "t"]);
+    r.git(["config", "commit.gpgsign", "false"]);
+    r.write("chant.workspace.json", declaration({ policy: STRICT, mode: "enforce", context: { risk: "high" } }));
+    r.commit("base");
+    // The pull request rewrites the declaration's entry too; only base counts.
+    r.git(["checkout", "-q", "-b", "loosen"]);
+    r.write("chant.workspace.json", declaration({ policy: PERMISSIVE, mode: "log-only", context: { risk: "low" } }));
+    r.commit("loosen the gate");
+
+    const git = gitGateLedgerPort({ cwd: r.dir });
+    const gates: GateLedgerPort = { ...memoryGateLedgerPort(), approvalRule: git.approvalRule };
+    // The Op the change builds says permissive, log-only and low risk.
+    const run = await runOpLocally(config({ policy: PERMISSIVE, mode: "log-only", context: { risk: "low" } }), activities, {}, undefined, { gates, now: "2026-10-23T12:00:00.000Z" });
+    expect(run.status).toBe("gated");
+    expect(run.gate?.approval).toMatchObject({ policy: STRICT, mode: "enforce", context: { risk: "high" } });
+  });
+});

package/src/op/gate-approval-base.ts

@@ -0,0 +1,72 @@
+/**
+ * The parts of an Op gate's approval that an `identity.gates.<gate>` entry
+ * also carries (#4404): the modes, the policy check and the entry check. Its
+ * only runtime import is `node:crypto`, so `gate-decision.ts` (which checks an
+ * entry) bundles without the Op runtime or zod (gate-decision-bundle.test.ts).
+ * `gate-approval.ts` re-exports everything here.
+ */
+
+import { createHash } from "node:crypto";
+import { GATE_PLAN_CONTEXT_KEY } from "./gate-plan-context";
+import type { GateApprovalMode, GatePolicyRef } from "./gate-approval";
+
+export const GATE_APPROVAL_MODES: readonly GateApprovalMode[] = ["log-only", "enforce"];
+
+// The brand `stepOutput()` stamps (`step-output-ref.ts`), as a global symbol so
+// this module need not import that file and its zod schemas; the same copy
+// `activity-contract.ts` keeps for the same reason.
+const STEP_OUTPUT_REF_BRAND = Symbol.for("chant.op.stepOutputRef");
+function isStepOutputRef(value: unknown): boolean {
+  return typeof value === "object" && value !== null && (value as Record<symbol, unknown>)[STEP_OUTPUT_REF_BRAND] === true;
+}
+
+/** The version of a gate policy: `sha256:` and the hex digest of its text. A lexicon's helper stamps it, and OPS015 checks it still matches. */
+export function gatePolicyVersion(text: string): string {
+  return `sha256:${createHash("sha256").update(text).digest("hex")}`;
+}
+
+export function isGatePolicyRef(value: unknown): value is GatePolicyRef {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value as Record<string, unknown>;
+  return (
+    v.kind === "gate-policy" &&
+    typeof v.lexicon === "string" && v.lexicon !== "" &&
+    typeof v.name === "string" && v.name !== "" &&
+    typeof v.version === "string" && v.version !== "" &&
+    typeof v.text === "string" && v.text.trim() !== ""
+  );
+}
+
+/**
+ * What is wrong with the `policy`, `mode` and `context` of an
+ * `identity.gates.<gate>` entry (#4404), one line each, named by `at`. Each
+ * field stands alone: base `mode: "enforce"` with no base `policy` is fine, as
+ * the Op's own policy then applies. `chant workspace check` (WSP153) says so.
+ */
+export function gateBaseApprovalProblems(entry: { policy?: unknown; mode?: unknown; context?: unknown }, at: string): string[] {
+  const problems: string[] = [];
+  if (entry.policy !== undefined) {
+    if (!isGatePolicyRef(entry.policy)) problems.push(`\`${at}.policy\` does not resolve to a gate policy set: it needs kind "gate-policy", lexicon, name, version and text`);
+    else if (entry.policy.version !== gatePolicyVersion(entry.policy.text)) problems.push(`\`${at}.policy\` "${entry.policy.name}" has a version that is not the digest of its text`);
+  }
+  if (entry.mode !== undefined && !GATE_APPROVAL_MODES.includes(entry.mode as GateApprovalMode)) {
+    problems.push(`\`${at}.mode\` must be one of ${GATE_APPROVAL_MODES.map((m) => `"${m}"`).join(", ")}`);
+  }
+  if (entry.context !== undefined) {
+    if (typeof entry.context !== "object" || entry.context === null || Array.isArray(entry.context)) problems.push(`\`${at}.context\` must be an object of plan attributes`);
+    else {
+      for (const [key, value] of Object.entries(entry.context)) {
+        if (key === GATE_PLAN_CONTEXT_KEY) problems.push(`\`${at}.context.${key}\` is reserved: the run fills it with the plan's change-set summary (#3182)`);
+        else if (isStepOutputRef(value) || !isContextValue(value)) problems.push(`\`${at}.context.${key}\` must be a string, number, boolean or list of strings`);
+      }
+    }
+  }
+  return problems;
+}
+
+export function isContextValue(value: unknown): boolean {
+  if (typeof value === "string" || typeof value === "boolean") return true;
+  if (typeof value === "number") return Number.isFinite(value);
+  if (Array.isArray(value)) return value.every((v) => typeof v === "string");
+  return isStepOutputRef(value);
+}

package/src/op/gate-approval.test.ts

@@ -504,7 +504,7 @@ describe("gate approval — a permit counts only under the context it was given
 describe("gate approval — the request a policy is asked (#2508)", () => {
   test("carries the approver, the gate and the context, with the plan digest", () => {
     expect(gatePolicyRequest({
-      op: "release", gate: "ship", resolvedBy: "release-bot", approver: { kind: "agent", roles: ["deployer"] },
+      op: "release", gate: "ship", resolvedBy: "release-bot", approver: { kind: "agent" }, roles: ["deployer"],
       planDigest: PLAN_A, context: { risk: "low" },
     })).toEqual({
       principal: { kind: "agent", name: "release-bot", roles: ["deployer"] },
@@ -513,6 +513,11 @@ describe("gate approval — the request a policy is asked (#2508)", () => {
       context: { risk: "low", planDigest: PLAN_A },
     });
   });
+
+  test("never carries the roles the approver claims (#4324)", () => {
+    const request = gatePolicyRequest({ op: "release", gate: "ship", resolvedBy: "github:sam", approver: { kind: "human", roles: ["maintainer"] } });
+    expect(request.principal.roles).toEqual([]);
+  });
 });
 
 describe("gate approval — the approval block is checked where it is written (#2508)", () => {

package/src/op/gate-approval.ts

@@ -33,16 +33,19 @@
  * permit counts only while the run resolves that same context (#3774).
  *
  * A resolution is a local fact, not a signed one (`../lifecycle/gate-ledger.ts`).
- * Roles on it are what the approver claimed, and since #4290 the quorum
- * never reads them: a role counts only when `.chant/trust.json` at base
- * grants it and a seal proves the approver (`./gate-quorum.ts`). A policy
- * still sees the claimed roles in its request.
+ * Roles on it are what the approver claimed, and nothing trusts them: since
+ * #4290 the quorum counts a role only when `.chant/trust.json` at base grants
+ * it and a seal proves the approver (`./gate-quorum.ts`), and since #4324 a
+ * policy's request carries those same roles, never the claimed ones.
  */
 
 import { createHash } from "node:crypto";
 import { lexiconModulePath, importLexiconPackage } from "../lexicon-module";
 import { isStepOutputRef, type StepOutputRef } from "./step-output-ref";
 import { GATE_PLAN_CONTEXT_KEY } from "./gate-plan-context";
+import { GATE_APPROVAL_MODES, gateBaseApprovalProblems, gatePolicyVersion, isContextValue, isGatePolicyRef } from "./gate-approval-base";
+
+export { GATE_APPROVAL_MODES, gateBaseApprovalProblems, gatePolicyVersion, isGatePolicyRef } from "./gate-approval-base";
 import { quorumProblems, type GateQuorumRule, type GateQuorumSpec } from "./gate-quorum";
 
 export type { GateQuorumRule, GateQuorumSpec } from "./gate-quorum";
@@ -50,7 +53,6 @@ export type { GateQuorumRule, GateQuorumSpec } from "./gate-quorum";
 /** What a policy's decision does to the gate. */
 export type GateApprovalMode = "log-only" | "enforce";
 
-export const GATE_APPROVAL_MODES: readonly GateApprovalMode[] = ["log-only", "enforce"];
 
 /**
  * A policy set a lexicon rendered for a gate — plain data, so it lands in the
@@ -159,10 +161,6 @@ export interface GatePolicyEvaluator {
   evaluateGatePolicy(policy: GatePolicyRef, request: GatePolicyRequest): Promise<GatePolicyAnswer> | GatePolicyAnswer;
 }
 
-/** The version of a gate policy: `sha256:` and the hex digest of its text. A lexicon's helper stamps it, and OPS015 checks it still matches. */
-export function gatePolicyVersion(text: string): string {
-  return `sha256:${createHash("sha256").update(text).digest("hex")}`;
-}
 
 /**
  * The digest of a gate's resolved approval context (#3774): `sha256:` and the
@@ -180,17 +178,6 @@ function sortedKeys(_key: string, value: unknown): unknown {
   return value;
 }
 
-export function isGatePolicyRef(value: unknown): value is GatePolicyRef {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value as Record<string, unknown>;
-  return (
-    v.kind === "gate-policy" &&
-    typeof v.lexicon === "string" && v.lexicon !== "" &&
-    typeof v.name === "string" && v.name !== "" &&
-    typeof v.version === "string" && v.version !== "" &&
-    typeof v.text === "string" && v.text.trim() !== ""
-  );
-}
 
 /**
  * Everything wrong with an `approval` block, one line each. The `gate()`
@@ -256,13 +243,15 @@ export function gateApprovalProblems(approval: unknown): string[] {
   return problems;
 }
 
-function isContextValue(value: unknown): boolean {
-  if (typeof value === "string" || typeof value === "boolean") return true;
-  if (typeof value === "number") return Number.isFinite(value);
-  if (Array.isArray(value)) return value.every((v) => typeof v === "string");
-  return isStepOutputRef(value);
+/** A gate's `policy`, `mode` and `context` as `identity.gates.<gate>` declares them at base (#4404). A step output reference is not data a declaration can hold, so a context value is a plain one. */
+export interface GateBaseApproval {
+  policy?: GatePolicyRef | null;
+  mode?: GateApprovalMode | null;
+  context?: Record<string, string | number | boolean | string[]> | null;
 }
 
+
+
 /** Import `lexicon`'s evaluator. Throws a message that names the package when it is not installed or exports none. */
 export async function loadGatePolicyEvaluator(lexicon: string): Promise<GatePolicyEvaluator> {
   // chant #2520 — a lexicon declared by module path exports its evaluator from that module.
@@ -282,17 +271,23 @@ export async function loadGatePolicyEvaluator(lexicon: string): Promise<GatePoli
   return mod as GatePolicyEvaluator;
 }
 
-/** The request a policy is asked about one approval. */
+/**
+ * The request a policy is asked about one approval. `roles` are the ones
+ * `.chant/trust.json` at base gives a proven approver (#4324), as a quorum
+ * judge reads them (`trustQuorumJudge` in `./gate-quorum.ts`). The roles the
+ * approver claims on `approver` are never read. Absent, the principal has none.
+ */
 export function gatePolicyRequest(input: {
   op: string;
   gate: string;
   resolvedBy: string;
   approver: GateApprover;
+  roles?: readonly string[];
   planDigest?: string;
   context?: Record<string, unknown>;
 }): GatePolicyRequest {
   return {
-    principal: { kind: input.approver.kind, name: input.resolvedBy, roles: input.approver.roles ?? [] },
+    principal: { kind: input.approver.kind, name: input.resolvedBy, roles: [...(input.roles ?? [])] },
     action: "PassGate",
     resource: { op: input.op, gate: input.gate },
     context: {

package/src/op/gate-name.ts

@@ -37,6 +37,21 @@ export const FAN_OUT_GATE_OP = "fan-out";
  */
 export const WORKSPACE_UPGRADE_GATE_OP = "workspace-upgrade";
 
+/**
+ * The op name a `chant workspace exit` gate is recorded under (#3177). The gate
+ * is the exit's scope (`workspace`, or the member names joined with `+`), and
+ * it binds the digest of the exit's patch. Like an upgrade it is a command
+ * with no `*.op.ts` behind it, and leaving is a person's decision.
+ */
+export const WORKSPACE_EXIT_GATE_OP = "workspace-exit";
+
+/**
+ * The op name a `chant workspace promote` gate is recorded under (#3178). The
+ * gate is the member, and it binds the digest of the promotion's patch. A
+ * command with no `*.op.ts` behind it, like the upgrade.
+ */
+export const WORKSPACE_PROMOTE_GATE_OP = "workspace-promote";
+
 /**
  * The op name the override gate records denials and overrides under (#3760):
  * `_gates/policy-override.jsonl`, gate the subject a policy denied. Like a
@@ -69,7 +84,7 @@ const PR_GATE_OP = /^pr-\d+(?:-[a-z0-9][a-z0-9-]*)?$/;
  * no Op config to read `neverOverMcp` from, the pending record carries it.
  */
 export function isNeverOverMcpGateOp(op: string): boolean {
-  return op === FAN_OUT_GATE_OP || op === WORKSPACE_UPGRADE_GATE_OP || op === OVERRIDE_GATE_OP || op === RELEASE_GATE_OP || PR_GATE_OP.test(op);
+  return op === FAN_OUT_GATE_OP || op === WORKSPACE_UPGRADE_GATE_OP || op === WORKSPACE_EXIT_GATE_OP || op === OVERRIDE_GATE_OP || op === RELEASE_GATE_OP || PR_GATE_OP.test(op);
 }
 
 /** Either spelling of a gate step's name. `gate` since #2202; `signalName` through 0.59.0. */

package/src/op/gate-quorum-at-base.test.ts

@@ -0,0 +1,211 @@
+/**
+ * #4324: an Op gate's quorum is `identity.gates.<gate>.quorum` in the
+ * workspace declaration at base, so a change can't lower the quorum its own
+ * run needs, and a gate policy's `principal.roles` come from
+ * `.chant/trust.json` at base for a proven approver, never from `chant
+ * approve --role`.
+ */
+
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "vitest";
+import type { GateStep, OpConfig } from "./types";
+import type { ActivityFn } from "./activity-registry";
+import { resolveGateApproval, runOpLocally } from "./local-executor";
+import { gitGateLedgerPort, memoryGateLedgerPort, type GateLedgerPort } from "./gate";
+import type { GatePolicyEvaluator, GatePolicyRef, GatePolicyRequest } from "./gate-approval";
+import { appendPendingGate, type GateResolutionInput } from "../lifecycle/gate-ledger";
+import { resetGateOrigin } from "../lifecycle/gate-origin";
+import { sealGateApproval } from "../workspace/trust/seal";
+import { hasSshKeygen, TestRepo, type Key } from "../workspace/trust/test-repo";
+import { recordGateApproval } from "../cli/handlers/approve";
+
+const repos: TestRepo[] = [];
+const home = process.cwd();
+afterEach(() => {
+  process.chdir(home);
+  resetGateOrigin();
+  while (repos.length) repos.pop()!.cleanup();
+});
+
+let keys: TestRepo;
+let alice: Key;
+let bob: Key;
+beforeAll(() => {
+  if (!hasSshKeygen) return;
+  keys = new TestRepo("4324-keys");
+  alice = keys.key("alice");
+  bob = keys.key("bob");
+});
+afterAll(() => keys?.cleanup());
+
+/** A repository whose `main` is the base, with a git identity the ledger writes can use. */
+function repo(label: string, files: Record<string, string>): TestRepo {
+  const r = new TestRepo(label);
+  repos.push(r);
+  r.git(["config", "user.email", "t@example.test"]);
+  r.git(["config", "user.name", "t"]);
+  r.git(["config", "commit.gpgsign", "false"]);
+  for (const [path, text] of Object.entries(files)) r.write(path, text);
+  r.commit("base");
+  return r;
+}
+
+const declaration = (gates: Record<string, unknown>): string =>
+  JSON.stringify({ name: "acme", schema: 1, members: [], identity: { gates } });
+
+describe("resolveGateApproval reads the quorum at base (#4324)", () => {
+  const step = (approval?: GateStep["approval"]): GateStep => ({ kind: "gate", gate: "ship", ...(approval ? { approval } : {}) }) as GateStep;
+
+  test("the base quorum replaces the Op's own", () => {
+    expect(resolveGateApproval(step({ quorum: { count: 1 } }), new Map(), undefined, { count: 2 })).toEqual({ quorum: { count: 2 }, mode: "log-only" });
+  });
+
+  test("a gate whose Op dropped its approval block still takes the base quorum", () => {
+    expect(resolveGateApproval(step(), new Map(), undefined, { count: 2 })).toEqual({ quorum: { count: 2 }, mode: "log-only" });
+  });
+
+  test("a base list is matched against the run's environment", () => {
+    const atBase = [{ targets: ["prod"], count: 2 }, { count: 1 }];
+    expect(resolveGateApproval(step({ quorum: { count: 1 } }), new Map(), "prod", atBase)?.quorum).toEqual(atBase);
+    expect(resolveGateApproval(step({ quorum: { count: 1 } }), new Map(), "dev", atBase)?.quorum).toEqual([{ count: 1 }]);
+  });
+
+  test("with no quorum at base, the Op's own applies", () => {
+    expect(resolveGateApproval(step({ quorum: { count: 3 } }), new Map(), undefined, null)).toEqual({ quorum: { count: 3 }, mode: "log-only" });
+    expect(resolveGateApproval(step(), new Map(), undefined, null)).toBeUndefined();
+  });
+});
+
+describe.skipIf(!hasSshKeygen)("an Op gate's quorum at base (#4324)", () => {
+  const NOW = "2026-10-23T12:00:00.000Z";
+  const config = (count: number): OpConfig => ({
+    name: "release",
+    overview: "",
+    phases: [
+      { name: "Gate", steps: [{ kind: "gate", gate: "ship", approval: { quorum: { count } } }] },
+      { name: "Apply", steps: [{ kind: "activity", fn: "ship", args: {} }] },
+    ],
+  });
+  const activities = new Map<string, ActivityFn>([["ship", async () => ({})]]);
+
+  test("a change that lowers its own quorum still needs the quorum at base", async () => {
+    const r = repo("4324-quorum", {
+      "chant.workspace.json": declaration({ ship: { quorum: { count: 2 } } }),
+      ".chant/allowed_signers": `github:alice ${alice.pub}\ngithub:bob ${bob.pub}\n`,
+    });
+    // The pull request lowers both the declaration's quorum and the Op's.
+    r.git(["checkout", "-q", "-b", "lower-quorum"]);
+    r.write("chant.workspace.json", declaration({ ship: { quorum: { count: 1 } } }));
+    r.commit("lower the quorum");
+
+    const memory = memoryGateLedgerPort();
+    const git = gitGateLedgerPort({ cwd: r.dir });
+    const gates: GateLedgerPort = { ...memory, approvalRule: git.approvalRule, quorumJudge: git.quorumJudge };
+    const approve = async (by: string, key: Key, timestamp: string) => {
+      const line = { op: "release", gate: "ship", resolvedBy: by, timestamp, approver: { kind: "human" as const } };
+      const input: GateResolutionInput = { ...line, seal: sealGateApproval(key.file, line) };
+      await memory.appendResolution!(input);
+    };
+
+    const first = await runOpLocally(config(1), activities, {}, undefined, { gates, now: NOW });
+    expect(first.status).toBe("gated");
+    expect(first.gate?.approval?.quorum).toEqual({ count: 2 });
+    expect(memory.appended[0]?.approval?.quorum).toEqual({ count: 2 });
+
+    await approve("github:alice", alice, "2026-10-23T12:01:00.000Z");
+    const second = await runOpLocally(config(1), activities, {}, undefined, { gates, now: "2026-10-23T12:02:00.000Z" });
+    expect(second.status).toBe("gated");
+
+    await approve("github:bob", bob, "2026-10-23T12:03:00.000Z");
+    const third = await runOpLocally(config(1), activities, {}, undefined, { gates, now: "2026-10-23T12:04:00.000Z" });
+    expect(third.status).toBe("ok");
+    expect(third.records.find((rec) => rec.fn === "gate:ship")?.approval).toMatchObject({ via: "quorum", approvers: ["github:alice", "github:bob"] });
+  });
+
+  test("a gate the declaration names with no quorum keeps the Op's", async () => {
+    const r = repo("4324-no-quorum", {
+      "chant.workspace.json": declaration({ ship: {} }),
+      ".chant/allowed_signers": `github:alice ${alice.pub}\n`,
+    });
+    const git = gitGateLedgerPort({ cwd: r.dir });
+    const gates: GateLedgerPort = { ...memoryGateLedgerPort(), approvalRule: git.approvalRule };
+    const run = await runOpLocally(config(3), activities, {}, undefined, { gates, now: NOW });
+    expect(run.gate?.approval?.quorum).toEqual({ count: 3 });
+  });
+});
+
+describe.skipIf(!hasSshKeygen)("a gate policy's roles come from trust.json at base (#4324)", () => {
+  const POLICY: GatePolicyRef = { kind: "gate-policy", lexicon: "cedar", name: "ship", version: "sha256:v1", text: "permit when maintainer" };
+  /** Permits only a principal with the maintainer role, and remembers what it was asked. */
+  function maintainersOnly(): GatePolicyEvaluator & { asked: GatePolicyRequest[] } {
+    const asked: GatePolicyRequest[] = [];
+    return {
+      asked,
+      evaluateGatePolicy: (_policy, request) => {
+        asked.push(request);
+        return request.principal.roles.includes("maintainer")
+          ? { decision: "allow", determining: ["maintainers"], errors: [] }
+          : { decision: "deny", determining: [], errors: [] };
+      },
+    };
+  }
+
+  async function gated(): Promise<TestRepo> {
+    const r = repo("4324-policy", {
+      "README.md": "x\n",
+      ".chant/allowed_signers": `github:alice ${alice.pub}\n`,
+      ".chant/trust.json": JSON.stringify({ schema: 1, roles: { maintainer: ["github:alice"] } }),
+    });
+    await appendPendingGate(
+      {
+        op: "release",
+        gate: "ship",
+        timestamp: "2026-10-23T12:00:00.000Z",
+        origin: "cli",
+        expiresAt: "2999-01-01T00:00:00.000Z",
+        approval: { policy: POLICY, mode: "enforce" },
+      },
+      { cwd: r.dir },
+    );
+    process.chdir(r.dir);
+    return r;
+  }
+
+  test("a claimed --role the trust file does not grant fails a policy that requires it", async () => {
+    const r = await gated();
+    const evaluator = maintainersOnly();
+    const outcome = await recordGateApproval("release", "ship", { origin: "cli", actor: "github:sam", roles: ["maintainer"], evaluator, cwd: r.dir });
+    expect(outcome.ok).toBe(true);
+    expect(evaluator.asked[0]?.principal).toEqual({ kind: "human", name: "github:sam", roles: [] });
+    if (!outcome.ok) return;
+    expect(outcome.record.policyDecision?.decision).toBe("deny");
+    // The claim is still recorded, as data nothing trusts.
+    expect(outcome.record.approver).toEqual({ kind: "human", roles: ["maintainer"] });
+  });
+
+  test("an unsealed approval by a granted principal gets no roles either", async () => {
+    const r = await gated();
+    const evaluator = maintainersOnly();
+    const outcome = await recordGateApproval("release", "ship", { origin: "cli", actor: "github:alice", roles: ["maintainer"], evaluator, cwd: r.dir });
+    expect(evaluator.asked[0]?.principal.roles).toEqual([]);
+    expect(outcome.ok && outcome.record.policyDecision?.decision).toBe("deny");
+  });
+
+  test("a sealed approval gets the roles trust.json at base grants, and only those", async () => {
+    const r = await gated();
+    const evaluator = maintainersOnly();
+    const outcome = await recordGateApproval("release", "ship", { origin: "cli", actor: "github:alice", roles: ["admin"], sign: alice.file, evaluator, cwd: r.dir });
+    expect(evaluator.asked[0]?.principal).toEqual({ kind: "human", name: "github:alice", roles: ["maintainer"] });
+    expect(outcome.ok && outcome.record.policyDecision?.decision).toBe("allow");
+  });
+
+  test("a grant the change adds to trust.json does not count until it is at base", async () => {
+    const r = await gated();
+    r.git(["checkout", "-q", "-b", "grant-sam"]);
+    r.write(".chant/allowed_signers", `github:alice ${alice.pub}\ngithub:bob ${bob.pub}\n`);
+    r.write(".chant/trust.json", JSON.stringify({ schema: 1, roles: { maintainer: ["github:alice", "github:bob"] } }));
+    r.commit("grant bob");
+    const evaluator = maintainersOnly();
+    await recordGateApproval("release", "ship", { origin: "cli", actor: "github:bob", sign: bob.file, evaluator, cwd: r.dir });
+    expect(evaluator.asked[0]?.principal.roles).toEqual([]);
+  });
+});