@intentius/chant 0.85.0 → 0.87.0

package/src/workspace/records-amend.schema.json

@@ -0,0 +1,167 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://intentius.io/chant/schemas/workspace/records-amend/v1/records-amend.schema.json",
+  "title": "chant workspace records amend output",
+  "description": "What `chant workspace records amend <id> --kind <kind file> --set <file|->` prints (#2670): the record's path and id and the top-level fields the amendment changed, or the reason it wrote nothing. Version 1 of the write contract for records. The command writes one file or none and never commits. Readers ignore fields they do not know; a field is only ever added within a version. The error codes are a closed list, each in the one closed list of `reason-codes.ts`. Contract version 1 of this document is written by chant 0.86.0 and newer.",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/result"
+    },
+    {
+      "$ref": "#/$defs/failure"
+    }
+  ],
+  "$defs": {
+    "result": {
+      "description": "The record was written, or would be with --dry-run. Exit code 0.",
+      "type": "object",
+      "required": [
+        "$schema",
+        "contract",
+        "kind",
+        "path",
+        "id",
+        "changed",
+        "dryRun",
+        "warnings"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/records-amend/v1/records-amend.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "kind": {
+          "type": "object",
+          "required": [
+            "name",
+            "schema",
+            "file"
+          ],
+          "properties": {
+            "name": {
+              "type": "string",
+              "description": "The kind's name, such as \"decision\"."
+            },
+            "schema": {
+              "type": "string",
+              "description": "The `$id` of the schema the record was validated against."
+            },
+            "file": {
+              "type": "string",
+              "description": "The kind file, relative to the repository root, with / separators."
+            }
+          }
+        },
+        "path": {
+          "type": "string",
+          "description": "The record file, relative to the repository root (the working directory outside git), with / separators."
+        },
+        "id": {
+          "type": "string",
+          "description": "The record's id."
+        },
+        "changed": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "The top-level fields whose value differs from the record as it was, in the record's order. Empty when the fields set change nothing, and then nothing is written."
+        },
+        "dryRun": {
+          "type": "boolean",
+          "description": "True when --dry-run was given and nothing was written."
+        },
+        "warnings": {
+          "type": "array",
+          "description": "The written record's warnings, as chant workspace records reports them. A warning never refuses a write.",
+          "items": {
+            "$ref": "#/$defs/warning"
+          }
+        },
+        "text": {
+          "type": "string",
+          "description": "With --dry-run only: the whole text of the file the command would write."
+        },
+        "error": false
+      }
+    },
+    "warning": {
+      "type": "object",
+      "required": [
+        "code",
+        "message"
+      ],
+      "properties": {
+        "code": {
+          "enum": [
+            "asset-drift",
+            "asset-missing",
+            "asset-stale",
+            "record-supersedes-pending",
+            "record-no-evidence",
+            "review-undigested"
+          ]
+        },
+        "message": {
+          "type": "string"
+        }
+      }
+    },
+    "failure": {
+      "description": "Nothing was written. Exit code 1.",
+      "type": "object",
+      "required": [
+        "$schema",
+        "contract",
+        "error"
+      ],
+      "properties": {
+        "$schema": {
+          "const": "https://intentius.io/chant/schemas/workspace/records-amend/v1/records-amend.schema.json"
+        },
+        "contract": {
+          "const": 1
+        },
+        "error": {
+          "type": "object",
+          "required": [
+            "code",
+            "message"
+          ],
+          "properties": {
+            "code": {
+              "enum": [
+                "kind-unreadable",
+                "kind-invalid",
+                "schema-unreadable",
+                "schema-id-mismatch",
+                "schema-invalid",
+                "location-missing",
+                "write-usage-invalid",
+                "write-input-invalid",
+                "record-not-found",
+                "amend-id-immutable",
+                "record-closed",
+                "amend-supersede-instead",
+                "record-unparseable",
+                "record-schema-invalid",
+                "record-id-duplicate",
+                "record-supersedes-unknown",
+                "record-supersedes-conflict",
+                "session-seal-mismatch",
+                "session-verdict-unknown-record"
+              ]
+            },
+            "message": {
+              "type": "string",
+              "description": "What was wrong, and what to do instead when there is something, such as writing a new record that supersedes this one."
+            }
+          }
+        },
+        "path": false
+      }
+    }
+  }
+}

package/src/workspace/records-cli.ts

@@ -8,8 +8,13 @@
  * the exit code is 0 whenever the read itself worked. Only a kind, schema or
  * revision that cannot be read exits 1.
  *
- * It needs no `chant.workspace.json`. The kind is passed explicitly, so
- * nothing is inferred (#2525 rule 1).
+ * It needs no `chant.workspace.json`. The kind is passed explicitly, or,
+ * without `--kind`, it is every record kind the declaration names (#2680), so
+ * nothing is inferred (#2525 rule 1). Several kinds print one document per
+ * kind, in the declaration's order, inside one set.
+ *
+ * With `--since <rev>` it prints what changed between two revisions instead,
+ * through `records-since.ts` (#2673).
  */
 
 import { execFileSync } from "node:child_process";
@@ -20,8 +25,27 @@ import type { CommandContext } from "../cli/registry";
 import { findWorkspaceRoot } from "../project-root";
 import { fileDigest, isWorkspacePath } from "./record-assets";
 import { gitRevisionSource, gitRoot, resolveRevision, workingTreeSource } from "./record-source";
-import { loadRecordKind, readRecords, RecordReadError, type LoadedRecordKind, type ReadErrorCode, type ReadRecordsResult, type RecordEntry, type RecordHistory } from "./records";
-import { gitTree, workingTree } from "./tree";
+import { declaredRecordKinds, readDeclaration, WorkspaceReadError, type RecordKindDeclaration } from "./declaration";
+import { declaredKindFile } from "./declared-kinds";
+import { locateWorkspace } from "./which-chant";
+import {
+  computeQuorum,
+  DEFAULT_QUORUM,
+  loadRecordKind,
+  normalisePrincipal,
+  readRecords,
+  RecordReadError,
+  type LoadedRecordKind,
+  type Quorum,
+  type ReadErrorCode,
+  type ReadRecordsResult,
+  type RecordEntry,
+  type RecordFormat,
+  type RecordHistory,
+  type SealInput,
+} from "./records";
+import { gitTree, workingTree, type WorkspaceTree } from "./tree";
+import type { DecisionWork } from "./work";
 import { activeAttestors, type ProvenanceLevel } from "./trust/attestor";
 import { policyAtBase, recordProvenance, resolveBase, type BaseSource, type RecordProvenance } from "./trust/provenance";
 
@@ -31,7 +55,8 @@ export const RECORDS_CONTRACT_VERSION = 1;
 /** `$id` of the JSON Schema for the `--json` output, shipped beside this file. */
 export const RECORDS_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/records/v1/records.schema.json";
 
-const USAGE = "chant workspace records --kind <kind file> [--current] [--at <rev>] [--base <rev>] [--require attested] [--json] | chant workspace records pin <path>";
+const USAGE =
+  "chant workspace records [--kind <kind file>] [--current] [--at <rev>] [--base <rev>] [--require attested] [--json] | chant workspace records [--kind <kind file>] --since <rev> [--at <rev>] [--json] | chant workspace records pin <path> | chant workspace records new|amend|review (#2670)";
 
 /** Exit code when the read worked and a record falls below `--require`. */
 export const EXIT_BELOW_REQUIRED = 2;
@@ -44,10 +69,22 @@ export interface RecordsQuery {
   base?: string;
   /** Where `kind` is resolved from and the repository is found. */
   cwd: string;
+  /**
+   * For a work kind: walk the region of each done item's `source` and raise
+   * `work-done-gap-open` when its finding still fires (#2686). On unless
+   * false; the intent graph passes false, since it raises the warning itself.
+   */
+  workGaps?: boolean;
 }
 
-/** A record as the output carries it: the entry plus its provenance (#2547). */
-export type RecordView = RecordEntry & { provenance: RecordProvenance };
+/**
+ * A record as the output carries it: the entry plus its provenance (#2547),
+ * and its quorum when the kind has a reviews list (#2671).
+ */
+export type RecordView = RecordEntry & { provenance: RecordProvenance; quorum?: Quorum | null };
+
+/** The role in the trust policy whose holders' verdicts the quorum does not count (#2671). */
+export const AGENT_ROLE = "agent";
 
 /** Where provenance was judged from (#2547). */
 export interface TrustView {
@@ -65,7 +102,7 @@ export type RecordsDocument =
   | {
       $schema: string;
       contract: number;
-      kind: { name: string; schema: string; file: string };
+      kind: { name: string; schema: string; file: string; format: RecordFormat };
       at: string | null;
       /** The directory pinned paths resolve in, from the repository root: the workspace holding the kind file, or the repository root (#2549). */
       workspaceRoot: string;
@@ -73,9 +110,58 @@ export type RecordsDocument =
       trust: TrustView;
       records: RecordView[];
       summary: { total: number; valid: number; invalid: number; superseded: number };
+      /** For a work kind (#2683): each decision its decision kind reads, with the work records implementing it. */
+      decisions?: DecisionWork[];
     }
   | { $schema: string; contract: number; error: { code: ReadErrorCode; message: string } };
 
+/** Where a document in a {@link RecordsSetDocument} comes from: the declaration's entry for its kind (#2680). */
+export interface DeclaredKindView {
+  /** The member that declares the kind, or null for the workspace's own. */
+  member: string | null;
+  /** The kind file from the workspace root. */
+  path: string;
+  /** The name the declaration gives the kind, or null. */
+  name: string | null;
+}
+
+/**
+ * The `records` output without `--kind` when the declaration names record
+ * kinds (#2680): one {@link RecordsDocument} per kind, in the declaration's
+ * order, each with the entry that declares it.
+ */
+export interface RecordsSetDocument {
+  $schema: string;
+  contract: number;
+  kinds: (RecordsDocument & { declared: DeclaredKindView })[];
+}
+
+/**
+ * The record kinds the declaration nearest above `cwd` names, in the tree
+ * `at` reads, with each kind file on disk. Empty when there is no declaration.
+ * Throws a {@link WorkspaceReadError} for one that can't be read.
+ */
+export function declaredKindFiles(cwd: string, at?: string): { declared: RecordKindDeclaration; file: string }[] {
+  let located;
+  try {
+    located = locateWorkspace(cwd, at);
+  } catch (err) {
+    if (err instanceof WorkspaceReadError && err.code === "declaration-missing") return [];
+    throw err;
+  }
+  return declaredRecordKinds(readDeclaration(located.tree)).map((declared) => ({ declared, file: declaredKindFile(declared, located.rootOnDisk) }));
+}
+
+/** Read every declared kind in `kinds`, as {@link queryRecords} reads one. */
+export async function queryDeclaredRecords(kinds: { declared: RecordKindDeclaration; file: string }[], query: Omit<RecordsQuery, "kind">): Promise<RecordsSetDocument> {
+  const out: RecordsSetDocument["kinds"] = [];
+  for (const k of kinds) {
+    const doc = await queryRecords({ ...query, kind: k.file });
+    out.push({ ...doc, declared: { member: k.declared.member, path: k.declared.path, name: k.declared.name } });
+  }
+  return { $schema: RECORDS_OUTPUT_SCHEMA_ID, contract: RECORDS_CONTRACT_VERSION, kinds: out };
+}
+
 /** A records read, before provenance. */
 export interface RecordsRead {
   loaded: LoadedRecordKind;
@@ -86,15 +172,32 @@ export interface RecordsRead {
   at: string | null;
   /** Where pinned paths resolve, relative to `root` ("." for the root itself). */
   workspaceRoot: string;
+  /** The workspace root's tree, as read: the working tree, or the revision under `--at`. */
+  tree: WorkspaceTree;
   result: ReadRecordsResult;
 }
 
+/**
+ * The quorum the workspace declares: the declaration at the workspace root
+ * of the tree read, or the default when there is none, or when it can't be
+ * read (#2671). Records need no declaration, so neither does this.
+ */
+function declaredQuorum(tree: WorkspaceTree): { need: number; needFrom: "declaration" | "default" } {
+  try {
+    const q = readDeclaration(tree).quorum;
+    if (q !== null) return { need: q, needFrom: "declaration" };
+  } catch {
+    // No declaration, or one this read can't use: the default applies.
+  }
+  return { need: DEFAULT_QUORUM, needFrom: "default" };
+}
+
 /**
  * Where a kind's pinned paths resolve: the workspace whose declaration sits
  * nearest above the kind file, when it is inside the repository, or else the
  * repository root. Relative to `root`, with / separators.
  */
-function pinRoot(kindFile: string, root: string): string {
+export function pinRoot(kindFile: string, root: string): string {
   const found = findWorkspaceRoot(dirname(kindFile));
   if (!found) return ".";
   const rel = relative(root, realpathOr(found.dir)).split(sep).join("/");
@@ -146,14 +249,20 @@ export async function readRecordsFor(query: Omit<RecordsQuery, "base">): Promise
     assets = gitTree(top, at, workspaceRoot === "." ? "" : workspaceRoot);
   }
   const history = top ? gitHistory(top, at ?? "HEAD", workspaceRoot) : undefined;
-  const result = await readRecords(loaded, { root, source, current: !!query.current, assets, ...(history ? { history } : {}) });
-  return { loaded, root, top, at, workspaceRoot, result };
+  // A session kind's verdicts name records of another kind, read from the same tree (#2673).
+  let subjects: { records: RecordEntry[]; reviews: string } | undefined;
+  if (loaded.kind.session) {
+    const subjectKind = await loadRecordKind(resolve(dirname(loaded.file), loaded.kind.session.subjects.kind), cwd);
+    subjects = { records: (await readRecords(subjectKind, { root, source })).records, reviews: subjectKind.kind.reviews?.field ?? "reviews" };
+  }
+  const result = await readRecords(loaded, { root, source, current: !!query.current, assets, workspaceRoot, ...(history ? { history } : {}), ...(subjects ? { subjects } : {}) });
+  return { loaded, root, top, at, workspaceRoot, tree: assets, result };
 }
 
 /** Run the query and build the document `--json` prints. Never throws a {@link RecordReadError}. */
 export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument> {
   try {
-    const { loaded, root, top, at, workspaceRoot, result } = await readRecordsFor(query);
+    const { loaded, root, top, at, workspaceRoot, tree, result } = await readRecordsFor(query);
     // Provenance, judged by the policy at base and never by the tree read (#2547).
     const base = top ? resolveBase(top, query.base) : { commit: null, from: null };
     const policy = top ? policyAtBase(top, base) : policyAtBase(root, base);
@@ -164,6 +273,24 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
       paths: result.records.map((r) => r.path),
       attestors: policy.active ? await activeAttestors() : [],
     });
+    // The quorum: the need from the declaration in the tree read, agents,
+    // whether verdicts need a seal, and the keys a seal verifies against,
+    // all from the policy at base (#2671, #2687).
+    const checkVerdictSeal = loaded.kind.reviews ? (await import("./trust/seal")).checkVerdictSeal : undefined;
+    const quorumOptions = checkVerdictSeal
+      ? {
+          ...declaredQuorum(tree),
+          agents: new Set((policy.roles[AGENT_ROLE] ?? []).map(normalisePrincipal)),
+          attestation: policy.active,
+          verifySeal: (v: SealInput) => checkVerdictSeal(policy, v),
+        }
+      : undefined;
+    const records: RecordView[] = result.records.map((r) => ({
+      ...r,
+      provenance: provenance.get(r.path)!,
+      ...(quorumOptions ? { quorum: computeQuorum(loaded.kind, r, quorumOptions) } : {}),
+    }));
+    if (loaded.kind.work && query.workGaps !== false && top) await raiseWorkGaps(loaded, records, { root, workspaceRoot, at: query.at });
     return {
       $schema: RECORDS_OUTPUT_SCHEMA_ID,
       contract: RECORDS_CONTRACT_VERSION,
@@ -171,13 +298,15 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
         name: loaded.kind.name,
         schema: loaded.kind.schema.id,
         file: relative(root, loaded.file).split("\\").join("/"),
+        format: loaded.kind.format,
       },
       at,
       workspaceRoot,
       current: !!query.current,
       trust: { base: base.commit, baseFrom: base.from, active: policy.active, signersPath: policy.signersPath, problems: policy.problems },
-      records: result.records.map((r) => ({ ...r, provenance: provenance.get(r.path)! })),
+      records,
       summary: result.summary,
+      ...(result.decisions ? { decisions: result.decisions } : {}),
     };
   } catch (err) {
     if (!(err instanceof RecordReadError)) throw err;
@@ -185,6 +314,56 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
   }
 }
 
+/**
+ * `work-done-gap-open` on a records read (#2686): for each done work record
+ * whose `source` names a finding and a region, walk that region with the
+ * intent graph, at the same revision, and copy the warning the walk raises
+ * on the record. One walk per region, and only a region some done item names.
+ * The walk reads the record kinds the declaration names, and the work kind
+ * and its decision kind if it names neither. It needs git and a workspace
+ * declaration; when the walk can't be made, for one without them or a region
+ * that no longer exists, the record is left as it was.
+ */
+async function raiseWorkGaps(loaded: LoadedRecordKind, records: RecordView[], opts: { root: string; workspaceRoot: string; at: string | undefined }): Promise<void> {
+  const work = loaded.kind.work!;
+  const byRegion = new Map<string, RecordView[]>();
+  for (const r of records) {
+    if (r.id === null || r.state !== work.done) continue;
+    const src = r.data?.source;
+    if (src === null || typeof src !== "object" || Array.isArray(src)) continue;
+    const { finding, region } = src as Record<string, unknown>;
+    if (typeof finding !== "string" || typeof region !== "string") continue;
+    byRegion.set(region, [...(byRegion.get(region) ?? []), r]);
+  }
+  if (byRegion.size === 0) return;
+  const cwd = opts.workspaceRoot === "." ? opts.root : join(opts.root, ...opts.workspaceRoot.split("/"));
+  let declared: string[];
+  try {
+    declared = declaredKindFiles(cwd, opts.at).map((k) => k.file);
+  } catch (err) {
+    if (err instanceof WorkspaceReadError) return;
+    throw err;
+  }
+  const kinds: string[] = [];
+  const seen = new Set<string>();
+  for (const file of [...declared, resolve(dirname(loaded.file), work.decisions), loaded.file]) {
+    const real = realpathOr(file);
+    if (seen.has(real)) continue;
+    seen.add(real);
+    kinds.push(file);
+  }
+  const { intentGraph } = await import("./intent");
+  for (const [region, items] of byRegion) {
+    const { doc } = await intentGraph({ cwd, region, at: opts.at, kinds });
+    if ("error" in doc) continue;
+    for (const r of items) {
+      const node = doc.nodes.find((n) => n.kind === "work" && n.id === `record:${loaded.kind.name}/${r.id}`);
+      const warning = node?.kind === "work" ? node.warnings.find((w) => w.code === "work-done-gap-open") : undefined;
+      if (warning && !r.warnings.some((w) => w.code === warning.code)) r.warnings.push(warning);
+    }
+  }
+}
+
 /**
  * `chant workspace records pin <path>`: the `{path, sha256}` a decision's
  * evidence entry holds for a file, with the path from the workspace root
@@ -204,6 +383,9 @@ export function pinFile(file: string, cwd: string): { path: string; sha256: stri
 
 export async function runWorkspaceRecords(ctx: CommandContext): Promise<number> {
   const { args } = ctx;
+  if (args.extraPositional === "new" || args.extraPositional === "amend" || args.extraPositional === "review") {
+    return (await import("./records-write")).runRecordsWrite(ctx);
+  }
   if (args.extraPositional === "pin") {
     if (!args.extraPositional2) {
       console.error(formatError({ message: "pin needs the path of a file", hint: USAGE }));
@@ -218,17 +400,27 @@ export async function runWorkspaceRecords(ctx: CommandContext): Promise<number>
     return 0;
   }
   if (args.extraPositional) {
-    console.error(formatError({ message: `chant workspace records takes no argument but pin (got ${args.extraPositional})`, hint: USAGE }));
-    return 1;
-  }
-  if (!args.kind) {
-    console.error(formatError({ message: "--kind <kind file> is required", hint: USAGE }));
+    console.error(formatError({ message: `chant workspace records takes no argument but pin, new, amend or review (got ${args.extraPositional})`, hint: USAGE }));
     return 1;
   }
+  if (!args.kind) return runDeclaredRecords(args);
   if (args.require !== undefined && args.require !== "attested") {
     console.error(formatError({ message: `--require takes one level, attested, not ${JSON.stringify(args.require)}`, hint: USAGE }));
     return 1;
   }
+  if (args.since !== undefined) {
+    if (args.current || args.require !== undefined || args.base !== undefined) {
+      console.error(formatError({ message: "--since compares two revisions and takes no --current, --require or --base", hint: USAGE }));
+      return 1;
+    }
+    // Loaded here, so a plain records read never loads it (#2673).
+    const { formatSince, queryRecordsSince } = await import("./records-since");
+    const since = await queryRecordsSince({ kind: args.kind, since: args.since, at: args.at, cwd: process.cwd() });
+    if (args.json) console.log(JSON.stringify(since, null, 2));
+    else if ("error" in since) console.error(formatError({ message: `${since.error.code}: ${since.error.message}`, hint: USAGE }));
+    else console.log(formatSince(since));
+    return "error" in since ? 1 : 0;
+  }
   const doc = await queryRecords({ kind: args.kind, current: args.current, at: args.at, base: args.base, cwd: process.cwd() });
   if (args.json) {
     console.log(JSON.stringify(doc, null, 2));
@@ -256,7 +448,92 @@ export async function runWorkspaceRecords(ctx: CommandContext): Promise<number>
   return 0;
 }
 
-function realpathOr(dir: string): string {
+/**
+ * `records` without `--kind` (#2680): every record kind the declaration
+ * names, or, when it names none or there is no declaration, the error it has
+ * always been. A kind whose read fails is listed with its error, the others
+ * are still read, and the exit code is 1.
+ */
+async function runDeclaredRecords(args: CommandContext["args"]): Promise<number> {
+  if (args.require !== undefined && args.require !== "attested") {
+    console.error(formatError({ message: `--require takes one level, attested, not ${JSON.stringify(args.require)}`, hint: USAGE }));
+    return 1;
+  }
+  let declared: { declared: RecordKindDeclaration; file: string }[];
+  try {
+    declared = declaredKindFiles(process.cwd(), args.at);
+  } catch (err) {
+    if (!(err instanceof WorkspaceReadError)) throw err;
+    console.error(formatError({ message: `${err.code}: ${err.describe()}; without --kind, the declaration names the record kinds`, hint: USAGE }));
+    return 1;
+  }
+  if (declared.length === 0) {
+    console.error(formatError({ message: "--kind <kind file> is required", hint: USAGE }));
+    return 1;
+  }
+  if (args.since !== undefined) return runDeclaredSince(declared, args);
+  const set = await queryDeclaredRecords(declared, { current: args.current, at: args.at, base: args.base, cwd: process.cwd() });
+  if (args.json) console.log(JSON.stringify(set, null, 2));
+  for (const doc of args.json ? [] : set.kinds) {
+    if ("error" in doc) {
+      console.error(formatError({ message: `${doc.declared.path}: ${doc.error.code}: ${doc.error.message}`, hint: USAGE }));
+      continue;
+    }
+    console.log(`${doc.declared.name ?? doc.kind.name} (${doc.declared.path})`);
+    console.log(formatRecords(doc.records, doc.summary, doc.at));
+  }
+  if (set.kinds.some((d) => "error" in d)) return 1;
+  if (args.require) {
+    const results = set.kinds.filter((d): d is Extract<typeof d, { records: unknown }> => !("error" in d));
+    const all = results.flatMap((d) => d.records);
+    const below = belowRequired(all, args.require);
+    if (below.length > 0) {
+      const inactive = results.find((d) => !d.trust.active);
+      console.error(
+        formatError({
+          message: `${below.length} of ${all.length} records are not ${args.require}: ${below
+            .slice(0, 5)
+            .map((r) => `${r.path} (${r.provenance.level})`)
+            .join(", ")}${below.length > 5 ? ", ..." : ""}`,
+          hint: inactive ? `there is no signers file (${inactive.trust.signersPath}) at base` : "run with --json to see each record's reason",
+        }),
+      );
+      return EXIT_BELOW_REQUIRED;
+    }
+  }
+  return 0;
+}
+
+/**
+ * `records --since` without `--kind` (#2680): what changed in every declared
+ * kind, one `records-since` document per kind inside one set, in the
+ * declaration's order. A kind whose read fails is listed with its error, and
+ * the exit code is 1.
+ */
+async function runDeclaredSince(declared: { declared: RecordKindDeclaration; file: string }[], args: CommandContext["args"]): Promise<number> {
+  if (args.current || args.require !== undefined || args.base !== undefined) {
+    console.error(formatError({ message: "--since compares two revisions and takes no --current, --require or --base", hint: USAGE }));
+    return 1;
+  }
+  const { formatSince, queryRecordsSince, RECORDS_SINCE_OUTPUT_SCHEMA_ID } = await import("./records-since");
+  const kinds = [];
+  for (const k of declared) {
+    const doc = await queryRecordsSince({ kind: k.file, since: args.since!, at: args.at, cwd: process.cwd() });
+    kinds.push({ ...doc, declared: { member: k.declared.member, path: k.declared.path, name: k.declared.name } });
+  }
+  if (args.json) console.log(JSON.stringify({ $schema: RECORDS_SINCE_OUTPUT_SCHEMA_ID, contract: RECORDS_CONTRACT_VERSION, kinds }, null, 2));
+  for (const doc of args.json ? [] : kinds) {
+    if ("error" in doc) {
+      console.error(formatError({ message: `${doc.declared.path}: ${doc.error.code}: ${doc.error.message}`, hint: USAGE }));
+      continue;
+    }
+    console.log(`${doc.declared.name ?? doc.kind.name} (${doc.declared.path})`);
+    console.log(formatSince(doc));
+  }
+  return kinds.some((d) => "error" in d) ? 1 : 0;
+}
+
+export function realpathOr(dir: string): string {
   try {
     return realpathSync(dir);
   } catch {
@@ -279,8 +556,20 @@ function formatRecords(records: RecordView[], summary: { total: number; valid: n
     const superseded = r.supersededBy ? `  superseded by ${r.supersededBy}` : "";
     const attested = r.provenance.level === "attested" ? `  attested by ${r.provenance.principal}` : "";
     lines.push(`${(r.id ?? "-").padEnd(idWidth)}  ${(r.state ?? "-").padEnd(stateWidth)}  ${title}${superseded}${attested}${flag}`);
+    if (r.ready !== undefined) {
+      const blocked = (r.blockedBy ?? []).map((b) => `${b.id} (${b.state ?? "unknown"})`).join(", ");
+      const implemented = (r.implements ?? []).map((d) => `${d.id} (${d.state ?? "unknown"})`).join(", ");
+      const status = [r.ready ? "ready" : blocked ? `blocked by ${blocked}` : "", implemented ? `implements ${implemented}` : ""].filter(Boolean).join("; ");
+      if (status) lines.push(`${" ".repeat(idWidth + 2)}${status}`);
+    }
     for (const reason of r.reasons) lines.push(`${" ".repeat(idWidth + 2)}${reason.code}: ${reason.message} (${r.path})`);
     for (const warning of r.warnings) lines.push(`${" ".repeat(idWidth + 2)}warning ${warning.code}: ${warning.message} (${r.path})`);
+    const q = r.quorum;
+    if (q && q.counted.length + q.notCounted.length > 0) {
+      const verdict = q.metWithObjections ? "met with objections" : q.met ? "met" : "not met";
+      const concerns = q.openConcerns.length > 0 ? `, ${q.openConcerns.length} open ${q.openConcerns.length === 1 ? "concern" : "concerns"}` : "";
+      lines.push(`${" ".repeat(idWidth + 2)}quorum ${q.agreed} of ${q.need} agreed, ${verdict}; ${q.notCounted.length} not counted${concerns}`);
+    }
   }
   lines.push(
     `${summary.total} records${at ? ` at ${at.slice(0, 8)}` : ""}: ${summary.valid} valid, ${summary.invalid} invalid, ${summary.superseded} superseded`,