@intentius/chant 0.72.2 → 0.72.3

package/src/discovery/fold-executing-mode.test.ts

@@ -0,0 +1,115 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { foldProject, foldExecutionCounts, resetFoldExecutionCounts } from "../index";
+
+/**
+ * chant#2455 — `ι = executing`, the third isolation mode (spec `1.8`).
+ *
+ * chant#2453 made the default strict: a declarator call to a declared project
+ * function whose body cannot fold refuses the file rather than importing and
+ * invoking it. That closed a real leak — the fold of a file reading
+ * `process.env` carried the folding shell's environment, under a `fold`
+ * verdict that read as "determined statically".
+ *
+ * The old behaviour is worth having when the caller means it, so it comes back
+ * as a mode. What it cannot be is implicit. `open` is the default and is
+ * strict; a build that wants what a run would compute has to ask, and the
+ * asking is what makes the environment dependence visible.
+ */
+describe("the executing isolation mode (chant#2455)", () => {
+  let root: string;
+  let app: string;
+  let params: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "chant-executing-"));
+    params = join(root, "params.ts");
+    app = join(root, "app.ts");
+    writeFileSync(
+      params,
+      'export function fromEnv() {\n  return { prefix: process.env.CHANT_TEST_MODE ?? "fallback" };\n}\n',
+    );
+    writeFileSync(app, 'import { fromEnv } from "./params";\nexport const v = fromEnv();\n');
+    resetFoldExecutionCounts();
+    process.env.CHANT_TEST_MODE = "from-the-environment";
+  });
+
+  afterEach(() => {
+    delete process.env.CHANT_TEST_MODE;
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  test("the default refuses, and nothing of the project runs", async () => {
+    const verdict = (await foldProject([app, params], [], {})).get(app)!;
+
+    expect(verdict.verdict).toBe("run");
+    expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+  });
+
+  test("executing invokes it, and the fold carries what a run would compute", async () => {
+    const verdict = (await foldProject([app, params], [], { executing: true })).get(app)!;
+
+    expect(verdict.verdict).toBe("fold");
+    expect(JSON.parse(JSON.stringify(Object.fromEntries(verdict.exports!)))).toEqual({
+      v: { prefix: "from-the-environment" },
+    });
+    // The counter is how the mode is observable from outside: this is a
+    // project-owned invocation, which is what F-Call step 6 counts.
+    expect(foldExecutionCounts().projectFactoryInvocations).toBe(1);
+  });
+
+  test("the environment dependence is real, which is why the mode has to be asked for", async () => {
+    process.env.CHANT_TEST_MODE = "one";
+    const first = (await foldProject([app, params], [], { executing: true })).get(app)!;
+    process.env.CHANT_TEST_MODE = "two";
+    const second = (await foldProject([app, params], [], { executing: true })).get(app)!;
+
+    // Under `executing` the same source folds to different values in different
+    // environments. That is the mode behaving as specified, not a defect — and
+    // it is exactly what must not happen by default.
+    expect(JSON.stringify([...first.exports!])).not.toBe(JSON.stringify([...second.exports!]));
+  });
+
+  test("sandbox still refuses, and is unchanged by the new mode", async () => {
+    const verdict = (await foldProject([app, params], [], { sandbox: true })).get(app)!;
+
+    expect(verdict.verdict).toBe("run");
+    expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+  });
+
+  test("asking for both sandbox and executing is refused rather than resolved", async () => {
+    // Not a preference between two readings — a contradiction. One refuses to
+    // import project code, the other exists to invoke it, and silently picking
+    // either would make the fold's meaning depend on which.
+    await expect(foldProject([app, params], [], { sandbox: true, executing: true })).rejects.toThrow(
+      /mutually exclusive/,
+    );
+  });
+
+  test("the default's reason names the mode that would have folded it", async () => {
+    const reason = (await foldProject([app, params], [], {})).get(app)!.reason!;
+
+    // The body's own diagnostic is kept — it is the actionable half, and here
+    // it says to use a build parameter rather than reach for the new mode.
+    expect(reason).toContain('ambient "process" read is not foldable');
+    expect(reason).toContain("executing");
+  });
+
+  test("a function whose body folds is untouched by the mode", async () => {
+    const helper = join(root, "helper.ts");
+    writeFileSync(helper, 'export function j() {\n  return { j: ["a", "b"].join("-") };\n}\n');
+    const caller = join(root, "caller.ts");
+    writeFileSync(caller, 'import { j } from "./helper";\nexport const v = j();\n');
+
+    for (const options of [{}, { executing: true }]) {
+      resetFoldExecutionCounts();
+      const verdict = (await foldProject([caller, helper], [], options)).get(caller)!;
+      expect(verdict.verdict).toBe("fold");
+      // Interpreted in both modes: `executing` is a fallback for a body that
+      // did NOT fold, not a shortcut past interpretation.
+      expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+    }
+  });
+});

package/src/discovery/fold-import.ts

@@ -261,6 +261,8 @@ export interface FoldSession {
    * only the fold half would buy nothing there.
    */
   readonly sandbox: boolean;
+  /** chant#2455 — `ι = executing`: invoke a declared project function whose body did not fold. */
+  readonly executing: boolean;
   /**
    * chant #1023 — per-build memo for {@link readFactoryModule}, keyed by the
    * resolved absolute path of a module that DEFINES a composite. A composite
@@ -322,6 +324,8 @@ export function createFoldSession(
    * named as a specifier rather than only as a lexicon.
    */
   lexiconPackages: readonly string[] = [],
+  /** chant#2455 — `ι = executing`. Mutually exclusive with `sandbox`. */
+  executing = false,
 ): FoldSession {
   return {
     intrinsics,
@@ -332,6 +336,7 @@ export function createFoldSession(
     buildParams,
     lexiconPackages: new Set([...lexicons.map(lexiconPackageName), ...lexiconPackages]),
     sandbox,
+    executing,
     factoryModules: new Map(),
   };
 }
@@ -1275,6 +1280,8 @@ interface ResolveCtx {
   lexiconPackages: ReadonlySet<string>;
   /** chant #1093 — see {@link FoldSession.sandbox}. */
   sandbox: boolean;
+  /** chant#2455 — see {@link FoldSession.executing}. */
+  executing: boolean;
   /**
    * chant #1023 — the whole build session, for the two things composite-factory
    * interpretation needs that a per-file context cannot carry: the
@@ -1458,24 +1465,57 @@ async function resolveCallExpression(node: ts.CallExpression, ctx: ResolveCtx):
       if (!(err instanceof Error)) throw err;
       foldFailure = err;
     }
-    if (!binding) throw foldFailure;
-    // chant#2441 — `F-Div-Depth` is a refusal, not a failure to try hard
-    // enough. The fallback below imports the callee and invokes it, which is
-    // right when its body merely did not fold; here the folder has DECLINED,
-    // and invoking anyway produces exactly the envelope the specification says
-    // must not appear — a value the file's own declarators never produced.
+    // chant#2453 — a DECLARED function is judged by its body, and that is the
+    // whole answer. There is no invocation arm here any more.
     //
-    // Every other `F-Div` row is a fallback and `divergence.md` says so
-    // outright, which is what makes the direction safe. This one is not, so it
-    // propagates and the file runs, which is what the reference does.
-    if (foldFailure instanceof FoldError && foldFailure.refusedAtDepth) throw foldFailure;
-    try {
-      return await resolveImportedCall(node, calleeName, binding, ctx);
-    } catch (err) {
+    // There used to be: when the body did not fold, an imported callee was
+    // imported and invoked instead. chant#2441 narrowed that to stop it
+    // rescuing a depth refusal. The external corpus then showed what the rest
+    // of it does, in a project nobody here maintains
+    // (jhgaylor/infisical-chant, INTENTIUS/typescript-as-data#129):
+    //
+    //     export const namingParams = namingParamsFromEnv();
+    //
+    // whose body reads `process.env`. `F-Eval-Ident` step 4 rejects `process`,
+    // so the body does not fold — and chant imported the module and ran it,
+    // folding the file to whatever the FOLDING PROCESS's environment held. The
+    // file reported `fold`, which reads as "determined statically". Two people
+    // folding the same source got different output and nothing said so.
+    //
+    // That is wrong in chant's own terms before it is wrong in J1's: `--fold`
+    // is the value you would get by running, WITHOUT running, and this ran. So
+    // the rejection propagates and the file runs, carrying the reason
+    // `F-Eval-CallLocal` gives.
+    //
+    // `F-Call` step 6's invocation is for a binding that is neither a declared
+    // function nor an interpretable composite, and it still happens — below,
+    // in the arm this one is not. A composite factory is not a
+    // `FoldableFunction`, so `resolveImportedCall` still interprets it and
+    // still invokes it when interpretation declines.
+    //
+    // chant#2455 — unless the caller asked for `ι = executing` (spec 1.8),
+    // which is this behaviour as a MODE rather than as a silent default. The
+    // value is then what a run would compute in this process, environment and
+    // all, which is exactly why it cannot be implicit.
+    if (ctx.executing && binding) {
+      try {
+        return await resolveImportedCall(node, calleeName, binding, ctx);
+      } catch (err) {
+        throw cheapError(
+          `${foldFailure.message}; invoking it instead failed: ${err instanceof Error ? err.message : String(err)}`,
+        );
+      }
+    }
+    // Name the mode that would have folded it, so the reason is actionable
+    // rather than only correct. Not under `sandbox`, where `executing` is not
+    // an option the caller could take.
+    if (binding && !ctx.sandbox) {
       throw cheapError(
-        `${foldFailure.message}; invoking it instead failed: ${err instanceof Error ? err.message : String(err)}`,
+        `${foldFailure.message} (the default mode does not invoke a declared project function; ` +
+          "`executing` would run it and fold what it returns)",
       );
     }
+    throw foldFailure;
   }
 
   if (!binding) {
@@ -2356,6 +2396,7 @@ async function interpretCompositeFactory(
     resolvePathCache: ctx.resolvePathCache,
     lexiconPackages: ctx.lexiconPackages,
     sandbox: ctx.sandbox,
+    executing: ctx.executing,
     session: ctx.session,
     interpretDepth: ctx.interpretDepth + 1,
     // chant #2161 — set unconditionally, and NOT inherited from `ctx`: a nested
@@ -3668,6 +3709,7 @@ async function tryFoldFileCore(file: string, session: FoldSession): Promise<Fold
       resolvePathCache: session.resolvePathCache,
       lexiconPackages: session.lexiconPackages,
       sandbox: session.sandbox,
+      executing: session.executing,
       session,
       interpretDepth: 0,
       // chant#2423 — filled by the pre-build below, read by
@@ -4102,6 +4144,25 @@ export interface FoldProjectOptions {
   readonly buildParams?: Readonly<Record<string, BuildParamValue>>;
   /** chant #1093: this build asked for the sandbox, so fold may not reach outside the trusted allowlist. */
   readonly sandbox?: boolean;
+  /**
+   * chant#2455 — opt in to `ι = executing`, the third isolation mode
+   * (typescript-as-data spec `1.8`).
+   *
+   * Under it, a declarator call to a declared project function whose body
+   * cannot fold continues at `F-Call` step 6 and is invoked, so the fold's
+   * value is what a run would compute **in the folding process's
+   * environment**. That is the behaviour chant had before #2453, where it was
+   * the silent default and leaked the folding shell's `process.env` into the
+   * output of a file reported as `fold`.
+   *
+   * It is here as a mode rather than gone, because the value is real when the
+   * caller means it. What it cannot be is implicit: `open` is the default and
+   * is strict, so a build that wants a run's answer has to say so.
+   *
+   * Mutually exclusive with {@link sandbox}, which refuses to import project
+   * code at all. Asking for both is a contradiction and refuses.
+   */
+  readonly executing?: boolean;
   /**
    * chant#2438 — package specifiers to follow a bare import into, verbatim,
    * alongside whatever `lexicons` names.
@@ -4158,12 +4219,24 @@ export async function foldProject(
   intrinsics: readonly IntrinsicDef[] = [],
   options: FoldProjectOptions = {},
 ): Promise<Map<string, FoldProjectVerdict>> {
+  // chant#2455 — `sandbox` refuses to import project code at all and
+  // `executing` exists to invoke it. Asking for both is not a preference
+  // between two readings, it is a contradiction, and silently picking one would
+  // make the fold's meaning depend on which.
+  if (options.sandbox === true && options.executing === true) {
+    throw new Error(
+      "foldProject: `sandbox` and `executing` are mutually exclusive — the first refuses to import " +
+        "project code and the second exists to invoke it. Pass one.",
+    );
+  }
+
   const session = createFoldSession(
     intrinsics,
     options.buildParams,
     options.lexicons ?? [],
     options.sandbox ?? false,
     options.lexiconPackages ?? [],
+    options.executing ?? false,
   );
   const attempts = new Map<string, FoldFileResult>();
   for (const file of files) attempts.set(file, await tryFoldFile(file, intrinsics, session));

package/src/discovery/fold-no-invoke-declared.test.ts

@@ -0,0 +1,118 @@
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { foldProject, foldExecutionCounts, resetFoldExecutionCounts } from "../index";
+
+/**
+ * chant#2453 — a declared function is judged by its body, never invoked.
+ *
+ * `resolveCallExpression` used to catch a fold failure on an imported callee
+ * and fall back to importing and invoking it. chant#2441 stopped that rescuing
+ * a depth refusal. The external corpus then showed what the rest of it did, in
+ * a project nobody here maintains (jhgaylor/infisical-chant, via
+ * INTENTIUS/typescript-as-data#129):
+ *
+ *     export const namingParams = namingParamsFromEnv();
+ *
+ * whose body reads `process.env`. `F-Eval-Ident` step 4 rejects `process`, so
+ * the body does not fold — and chant imported the module and ran it, folding
+ * the file to whatever the FOLDING PROCESS's environment held.
+ *
+ * The reason this is a correctness bug and not only a conformance divergence:
+ * the file reported `fold`, which reads as "determined statically". Two people
+ * folding the same source got different output, and nothing said so. `--fold`
+ * is the value you would get by running, without running. This ran.
+ */
+describe("a declared function is folded or refused, never invoked (chant#2453)", () => {
+  let root: string;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "chant-no-invoke-"));
+    resetFoldExecutionCounts();
+  });
+
+  afterEach(() => rmSync(root, { recursive: true, force: true }));
+
+  const write = (name: string, source: string): string => {
+    const p = join(root, name);
+    writeFileSync(p, source);
+    return p;
+  };
+
+  test("an ambient read inside an imported function refuses, rather than folding the shell's environment in", async () => {
+    const params = write(
+      "params.ts",
+      'export function namingParamsFromEnv() {\n  return { prefix: process.env.CHANT_TEST_PREFIX ?? "fallback" };\n}\n',
+    );
+    const app = write(
+      "app.ts",
+      'import { namingParamsFromEnv } from "./params";\nexport const namingParams = namingParamsFromEnv();\n',
+    );
+
+    process.env.CHANT_TEST_PREFIX = "leaked-from-the-test-runner";
+    try {
+      const verdict = (await foldProject([app, params], [], {})).get(app)!;
+
+      // Before the fix this was `fold` with prefix "leaked-from-the-test-runner".
+      expect(verdict.verdict).toBe("run");
+      expect(verdict.reason).toContain("namingParamsFromEnv");
+
+      // The counter is the direct evidence: nothing of the project was run.
+      expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+    } finally {
+      delete process.env.CHANT_TEST_PREFIX;
+    }
+  });
+
+  test("the folded output never depends on the environment, which is the property at stake", async () => {
+    const params = write(
+      "params.ts",
+      'export function fromEnv() {\n  return { v: process.env.CHANT_TEST_SWING ?? "d" };\n}\n',
+    );
+    const app = write("app.ts", 'import { fromEnv } from "./params";\nexport const c = fromEnv();\n');
+
+    // Fold the same source twice under different environments. Before the fix
+    // these disagreed, which is the part no reader of a `fold` verdict could
+    // have known.
+    process.env.CHANT_TEST_SWING = "one";
+    const first = (await foldProject([app, params], [], {})).get(app)!;
+    process.env.CHANT_TEST_SWING = "two";
+    const second = (await foldProject([app, params], [], {})).get(app)!;
+    delete process.env.CHANT_TEST_SWING;
+
+    expect(first.verdict).toBe(second.verdict);
+    expect(first.verdict).toBe("run");
+  });
+
+  test("a function whose body does fold still folds, so this narrows nothing it should not", async () => {
+    const helper = write(
+      "helper.ts",
+      'export function joined() {\n  const parts = ["a", "b"];\n  return { joined: parts.join("-") };\n}\n',
+    );
+    const app = write("app.ts", 'import { joined } from "./helper";\nexport const v = joined();\n');
+
+    const verdict = (await foldProject([app, helper], [], {})).get(app)!;
+
+    expect(verdict.verdict).toBe("fold");
+    expect(JSON.parse(JSON.stringify(Object.fromEntries(verdict.exports!)))).toEqual({
+      v: { joined: "a-b" },
+    });
+    // Folded by interpretation, not by running it.
+    expect(foldExecutionCounts().projectFactoryInvocations).toBe(0);
+  });
+
+  test("a same-file callee behaves the same as an imported one", async () => {
+    // Before the fix these two differed for no reason a reader could defend: a
+    // same-file callee had nothing to import, so its rejection was the verdict,
+    // while the identical function one file over got invoked instead.
+    const app = write(
+      "app.ts",
+      'function fromEnv() {\n  return { v: process.env.CHANT_TEST_SAME ?? "d" };\n}\nexport const c = fromEnv();\n',
+    );
+
+    const verdict = (await foldProject([app], [], {})).get(app)!;
+
+    expect(verdict.verdict).toBe("run");
+  });
+});

package/src/graph-ir.ts

@@ -725,7 +725,7 @@ export function buildLiveGraphIr(observations: LiveObservation[]): GraphIR {
   for (const observation of observations) {
     for (const edge of observation.edges ?? []) {
       if (!observedIds.has(edge.from) || !observedIds.has(edge.to)) continue;
-      const key = `${edge.from}${edge.to}${edge.viaAttr ?? ""}${edge.toAttr ?? ""}`;
+      const key = `${edge.from}\u0000${edge.to}\u0000${edge.viaAttr ?? ""}\u0000${edge.toAttr ?? ""}`;
       if (seen.has(key)) continue;
       seen.add(key);
       edges.push(edge);

package/src/lifecycle/gate-ledger.ts

@@ -42,6 +42,7 @@
  * `"resolution"` is the default reading).
  */
 import { sortedJsonReplacer } from "../utils";
+import { currentGateOrigin, type GateOrigin } from "./gate-origin";
 import { readBlobFromPath, readPathSha, readBlobBySha, writeBlobToPath, RefCASConflictError } from "./git";
 
 const DIR = "_gates";
@@ -138,6 +139,27 @@ export interface GateResolutionRecord {
    * such a record proves is that somebody approved *something*.
    */
   planDigest?: string;
+  /**
+   * The channel this resolution was authored on (chant#2384) — set by the
+   * writer, never by the caller. `chant approve` records `"cli"`, the
+   * `op-approve` MCP tool records `"mcp"`, an ACP-driven approve records
+   * `"acp"`.
+   *
+   * Absent on every resolution written before chant#2384, and absent is not
+   * `"cli"`: an old record simply does not say. `sameOriginRefusal`
+   * (./gate-origin.ts) refuses only on a positive match, so an unlabelled
+   * record is never refused on this ground.
+   */
+  origin?: GateOrigin;
+  /**
+   * This resolution was recorded from the same channel that reached the gate,
+   * deliberately (chant#2384's `--allow-same-origin`).
+   *
+   * On the record rather than only in the console, because the point of the
+   * refusal is that someone chose to bypass it. A reader auditing the ledger
+   * later should see which approvals had a second party and which did not.
+   */
+  sameOriginOverride?: boolean;
 }
 
 export type GateResolutionInput = Omit<GateResolutionRecord, "version" | "kind">;
@@ -183,6 +205,13 @@ export interface PendingGateRecord {
    * step with no `plan`), which is the shape every gate had before #2300.
    */
   planDigest?: string;
+  /**
+   * The channel the run that reached this gate was driven from (chant#2384).
+   *
+   * This is the half a resolution is compared against: a gate reached over MCP
+   * and resolved over MCP has one author, not two.
+   */
+  origin?: GateOrigin;
 }
 
 export type PendingGateInput = Omit<PendingGateRecord, "version" | "kind">;
@@ -233,7 +262,16 @@ export async function appendPendingGate(
   input: PendingGateInput,
   opts?: { cwd?: string },
 ): Promise<{ commit: string; record: PendingGateRecord }> {
-  const record: PendingGateRecord = { version: 1, kind: "pending", ...input };
+  // chant#2384 — stamped here rather than at each caller, because every pending
+  // fact goes through this function and a channel is a property of the process
+  // rather than of the call. An explicit `origin` on the input still wins, so a
+  // caller that knows better can say so.
+  const record: PendingGateRecord = {
+    version: 1,
+    kind: "pending",
+    origin: currentGateOrigin(),
+    ...input,
+  };
   const commit = await appendGateLine(record, "Pending gate record", opts);
   return { commit, record };
 }

package/src/lifecycle/gate-origin.test.ts

@@ -0,0 +1,93 @@
+import { describe, test, expect, afterEach } from "vitest";
+import {
+  currentGateOrigin,
+  setGateOrigin,
+  resetGateOrigin,
+  isModelAuthored,
+  sameOriginRefusal,
+  UNATTESTED_APPROVER,
+} from "./gate-origin";
+
+/**
+ * chant#2384 — the gate's two halves must have different authors.
+ *
+ * The gate as a durable, plan-bound fact is the strongest thing chant says
+ * about agent-driven change: a run reaching an unapproved gate records a
+ * pending fact and exits 3, and since #2300 a resolution counts only for the
+ * plan it names. All of that rests on the run and the approval being authored
+ * by different parties.
+ *
+ * At a shell they are, and the ledger's existing stance is right there: anyone
+ * who can run `chant approve` can also run `chant run`, the same trust boundary
+ * a local commit has. On MCP and ACP it stops being right, because the person's
+ * only act was launching the server — `op-run` returns the gate it stopped on
+ * and `op-approve` resolves it, both authored by the same model in the same
+ * session, and #2300's plan binding does not close it because the digest comes
+ * off the pending fact that same caller produced one tool call earlier.
+ */
+describe("gate origin (chant#2384)", () => {
+  afterEach(() => resetGateOrigin());
+
+  test("the process serves one channel, and it is the CLI unless an entry point says otherwise", () => {
+    expect(currentGateOrigin()).toBe("cli");
+    setGateOrigin("mcp");
+    expect(currentGateOrigin()).toBe("mcp");
+    resetGateOrigin();
+    expect(currentGateOrigin()).toBe("cli");
+  });
+
+  test("only MCP and ACP are model-authored", () => {
+    expect(isModelAuthored("mcp")).toBe(true);
+    expect(isModelAuthored("acp")).toBe(true);
+    // The distinction the whole rule rests on: at a shell a person typed each
+    // command, so the two halves already have different authors.
+    expect(isModelAuthored("cli")).toBe(false);
+    expect(isModelAuthored(undefined)).toBe(false);
+  });
+
+  describe("the same-origin rule", () => {
+    test("refuses a gate reached and resolved on the same model-authored channel", () => {
+      expect(sameOriginRefusal("mcp", "mcp")).toContain("the same caller wrote both halves");
+      expect(sameOriginRefusal("acp", "acp")).toContain("the same caller wrote both halves");
+    });
+
+    test("allows run-then-approve at a shell, which is the intended workflow", () => {
+      // Both halves are `cli` and that is fine. This is the case the issue is
+      // explicit about keeping: `chant approve` typed at a shell followed by
+      // `chant run` still walks through.
+      expect(sameOriginRefusal("cli", "cli")).toBeUndefined();
+    });
+
+    test("allows a model's run approved by a person, which is the separation the gate is for", () => {
+      expect(sameOriginRefusal("mcp", "cli")).toBeUndefined();
+      expect(sameOriginRefusal("acp", "cli")).toBeUndefined();
+    });
+
+    test("allows a person's run approved over MCP, since a person still authored one half", () => {
+      expect(sameOriginRefusal("cli", "mcp")).toBeUndefined();
+    });
+
+    test("refuses across the two model channels only when they are the same one", () => {
+      // Distinct model channels are two sessions, not one caller writing both
+      // halves — so this is permitted, and deliberately so.
+      expect(sameOriginRefusal("mcp", "acp")).toBeUndefined();
+      expect(sameOriginRefusal("acp", "mcp")).toBeUndefined();
+    });
+
+    test("an unlabelled pending fact is never refused, so old ledgers keep working", () => {
+      // Every record written before this change has no origin. Absent is not
+      // "cli" and not a wildcard: the rule fires on a positive match only, so a
+      // pre-#2384 pending fact cannot start refusing approvals retroactively.
+      expect(sameOriginRefusal(undefined, "mcp")).toBeUndefined();
+      expect(sameOriginRefusal(undefined, "acp")).toBeUndefined();
+      expect(sameOriginRefusal(undefined, "cli")).toBeUndefined();
+    });
+  });
+
+  test("the unattested approver is a fixed marker, not a name anyone chose", () => {
+    // `op-approve` took a free-text `approver` on a channel that cannot verify
+    // one, so the model named itself whatever it liked and the ledger recorded
+    // it indistinguishably from a name a person gave.
+    expect(UNATTESTED_APPROVER).toBe("unattested");
+  });
+});