@intentius/chant 0.85.0 → 0.87.0

package/dist/workspace/trust/seal.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Sealed verdicts (#2687, part of #2547): a review entry signed by the
+ * principal it names, so the quorum counts it only when that principal
+ * signed it.
+ *
+ * A seal is a detached ssh signature, the same mechanism as the ssh-commit
+ * attestor (./ssh-commit.ts): `ssh-keygen -Y sign` to make it, and
+ * `ssh-keygen -Y verify` against the signers read at base to check it. It is
+ * made in its own namespace, `chant-review`, so neither a commit signature
+ * nor a signer-set signature can stand in for one.
+ *
+ * The signed bytes are the record id, the verdict's digest, the verdict, the
+ * reviewer and the date, each on its own line with no final newline. The
+ * digest is the record's text digest (`recordTextDigest`), so the seal binds
+ * the verdict to the text it judged. The seal lives inside the reviews block,
+ * which the digest leaves out, so sealing a verdict never moves the digest.
+ */
+import type { SealCode } from "../records.js";
+import { type TrustPolicy } from "./policy.js";
+/** The ssh signature namespace of a verdict seal. */
+export declare const REVIEW_SEAL_NAMESPACE = "chant-review";
+/** A seal as a review entry holds it. */
+export interface VerdictSeal {
+    /** The principal who signed: the reviewer, as the signers file names them. */
+    signer: string;
+    /** The signing key's fingerprint, such as `SHA256:...`. Reported, never trusted: the signature is the proof. */
+    key: string;
+    /** The armored ssh signature. */
+    signature: string;
+}
+/** What a verdict's seal establishes. */
+export interface SealCheck {
+    /** true: the seal verifies for the reviewer against the signers at base. false: it is missing under an active policy, or it fails. null: nothing here can say. */
+    attested: boolean | null;
+    /** Why it is not attested. Absent when `attested` is true. */
+    code?: SealCode;
+    message: string;
+    /** The fingerprint of the key that made the signature, when the signature was checked. */
+    key?: string;
+}
+/** The verdict a seal covers. */
+export interface SealedVerdict {
+    record: string | null;
+    reviewer: string;
+    verdict: string;
+    on: unknown;
+    digest: string | null;
+    seal: unknown;
+}
+/** The bytes a verdict seal signs. */
+export declare function reviewSealPayload(record: string, digest: string, verdict: string, reviewer: string, on: string): Buffer;
+/**
+ * Check a verdict's seal. With a signers file active at base, it verifies
+ * against the keys listed there for the reviewer. With none, a seal present
+ * is checked for integrity only (`ssh-keygen -Y check-novalidate`): nothing
+ * says whose key it is.
+ */
+export declare function checkVerdictSeal(policy: TrustPolicy, v: SealedVerdict): SealCheck;
+/** Why a seal could not be made. */
+export declare class SealError extends Error {
+    constructor(message: string);
+}
+/**
+ * The key `--sign` names: the file given, or with none, git's
+ * `user.signingkey` when `gpg.format` is `ssh`, as `git commit -S` reads it.
+ * A literal public key (`key::ssh-...`, or `ssh-...`) signs through the ssh
+ * agent holding its private half. Returns the file to pass to ssh-keygen,
+ * and a cleanup for a temporary one.
+ */
+export declare function resolveSigningKey(sign: string | true, cwd: string): {
+    file: string;
+    cleanup: () => void;
+};
+/**
+ * Seal a verdict with the key in `keyFile` (a private key, or a public key
+ * whose private half the ssh agent holds). Throws a {@link SealError}.
+ */
+export declare function sealVerdict(keyFile: string, v: {
+    record: string;
+    digest: string;
+    verdict: string;
+    reviewer: string;
+    on: string;
+}): VerdictSeal;
+//# sourceMappingURL=seal.d.ts.map

package/dist/workspace/trust/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAMD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CA2BjF;AAyBD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAmB9I"}

package/dist/workspace/trust/ssh-commit.d.ts

@@ -25,6 +25,13 @@ export interface SignedCommit {
  * continuation lines, to get the bytes it signed.
  */
 export declare function splitSignedCommit(raw: Buffer, header?: string): SignedCommit;
+/** Run ssh-keygen; `missing` is true when it is not installed. Shared with the verdict seals (./seal.ts). */
+export declare function sshKeygen(args: string[], input?: Buffer): {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    missing: boolean;
+};
 /**
  * Check a detached ssh signature over `payload` in `namespace` against
  * `signers`. Shared with the rotation check (#2553), which signs signer sets

package/dist/workspace/trust/ssh-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-commit.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/ssh-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAI7D,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,YAAY,CAsB9E;AAmBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBjG;AAED,eAAO,MAAM,iBAAiB,EAAE,cAW/B,CAAC"}
+{"version":3,"file":"ssh-commit.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/ssh-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAI7D,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,YAAY,CAsB9E;AAUD,6GAA6G;AAC7G,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAIrI;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBjG;AAED,eAAO,MAAM,iBAAiB,EAAE,cAW/B,CAAC"}

package/dist/workspace/work.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Work items on read (#2683): a record kind with a `work` block.
+ *
+ * A work item is a record in the workspace, a git-tracked file with its
+ * dependencies written inside it, that people and agents share as one queue
+ * with no server. Most work items come from a gap the intent graph already
+ * reports (`source.finding`), given an id, an owner and a lifecycle.
+ *
+ * `records.ts` calls {@link applyWork} after it has read a work kind's
+ * records, before it sets `valid` and applies `--current`. This module reads
+ * the decision kind the work kind names, at the same revision, and gives each
+ * work record:
+ *
+ * - `ready`: its state is the kind's open state, every need is done, and the
+ *   record is valid and not superseded;
+ * - `blockedBy`: each need that is not done, with its state;
+ * - `implements`: each decision it names, with that decision's state;
+ *
+ * and each decision `implementedBy`, the work records naming it. The
+ * warnings are closed codes. `work-done-gap-open` is not raised here: it
+ * takes a walk of the item's region, which `graph --intent` makes and
+ * `records` asks it for (#2686). It never writes a record.
+ */
+import { type LoadedRecordKind, type ReadRecordsOptions, type RecordEntry } from "./records.js";
+/** Why a work record carries a warning. Closed, like the record warning codes. */
+export declare const WORK_WARNING_CODES: readonly ["work-needs-unknown", "work-implements-unknown", "work-needs-cycle", "work-implements-undecided", "work-done-unpinned", "work-closed-without-date", "work-done-gap-open"];
+export type WorkWarningCode = (typeof WORK_WARNING_CODES)[number];
+/** A link from a work record to another record, with that record's state now. */
+export interface WorkLink {
+    id: string;
+    /** The linked record's state, or null when no record has the id. */
+    state: string | null;
+}
+/** A decision as a work read lists it: its state and the work records implementing it. */
+export interface DecisionWork {
+    id: string;
+    path: string;
+    state: string | null;
+    supersededBy: string | null;
+    implementedBy: WorkLink[];
+}
+/** The strings of a front-matter list, or none. */
+export declare function idList(data: Record<string, unknown> | null, field: string): string[];
+/**
+ * Whether `state` counts as decided in the decision kind: ranked above 0 by
+ * its approval ranks, or, for a kind without them, closed.
+ */
+export declare function isDecided(kind: LoadedRecordKind["kind"], state: string | null): boolean;
+/**
+ * Give each work record its links, ready and blockedBy, and its warnings, in
+ * place. Throws a `RecordReadError` when the decision kind can't be read.
+ */
+export declare function applyWork(loaded: LoadedRecordKind, entries: RecordEntry[], options: ReadRecordsOptions): Promise<{
+    decisions: DecisionWork[];
+}>;
+//# sourceMappingURL=work.d.ts.map

package/dist/workspace/work.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/workspace/work.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAA+B,KAAK,gBAAgB,EAAE,KAAK,kBAAkB,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAE1H,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,qLAeW,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,oEAAoE;IACpE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,QAAQ,EAAE,CAAC;CAC3B;AAED,mDAAmD;AACnD,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAGpF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAGvF;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CAgFrJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -50,6 +50,16 @@
       "default": "./src/cli/index.ts"
     },
     "./workspace/*.schema.json": "./src/workspace/*.schema.json",
+    "./workspace/conformance": {
+      "development": "./src/workspace/conformance/index.ts",
+      "types": "./dist/workspace/conformance/index.d.ts",
+      "default": "./src/workspace/conformance/index.mjs"
+    },
+    "./workspace/conformance/vitest": {
+      "development": "./src/workspace/conformance/vitest.ts",
+      "types": "./dist/workspace/conformance/vitest.d.ts",
+      "default": "./src/workspace/conformance/vitest.ts"
+    },
     "./cli/*": {
       "development": "./src/cli/*.ts",
       "types": "./dist/cli/*.d.ts",
@@ -104,6 +114,14 @@
   "devDependencies": {
     "@cdktn/hcl2json": "^0.24.0"
   },
+  "peerDependencies": {
+    "vitest": ">=2"
+  },
+  "peerDependenciesMeta": {
+    "vitest": {
+      "optional": true
+    }
+  },
   "overrides": {
     "esbuild": "^0.28.1"
   }

package/src/cli/main.ts

@@ -375,6 +375,31 @@ export function parseArgs(args: string[]): ParsedArgs {
       if (!result.intent || result.intent.startsWith("-")) throw new Error("--intent needs a region: --intent <path[:start-end]>");
     } else if (arg === "--current") {
       result.current = true;
+    } else if (arg === "--set") {
+      // `chant workspace records amend <id> --set <file|->` (#2670)
+      result.set = args[++i];
+      if (!result.set || (result.set.startsWith("-") && result.set !== "-")) throw new Error("--set needs a JSON file, or - for standard input: --set <file|->");
+    } else if (arg === "--verdict") {
+      // `chant workspace records review <id> --verdict agree|dissent|abstain` (#2670)
+      result.verdict = args[++i];
+      if (!result.verdict || result.verdict.startsWith("-")) throw new Error("--verdict needs agree, dissent or abstain");
+    } else if (arg === "--by") {
+      // `chant workspace records review <id> --by <principal>` (#2670): whoever the caller says.
+      result.by = args[++i];
+      if (!result.by || result.by.startsWith("-")) throw new Error("--by needs the reviewer: --by <principal>");
+    } else if (arg === "--sign") {
+      // `chant workspace records review <id> --sign [<key file>]` (#2687): seal the verdict.
+      // With no key file, git's user.signingkey, as `git commit -S` reads it.
+      const next = args[i + 1];
+      result.sign = next !== undefined && !next.startsWith("-") ? args[++i] : true;
+    } else if (arg === "--session") {
+      // `chant workspace records review <id> --session <id>` (#2670)
+      result.session = args[++i];
+      if (!result.session || result.session.startsWith("-")) throw new Error("--session needs a session id: --session <id>");
+    } else if (arg === "--prefix") {
+      // `chant workspace records new <kind> --prefix <prefix>` (#2670): the id prefix to allocate under.
+      result.prefix = args[++i];
+      if (!result.prefix || result.prefix.startsWith("-")) throw new Error("--prefix needs an id prefix: --prefix <prefix>");
     } else if (arg === "--require") {
       // `chant workspace records|verify --require attested` (#2547)
       result.require = args[++i];
@@ -721,8 +746,9 @@ Workspace (level 1, #2524):
                         beside it and marks the members whose digests differ.
                         Read only; never fetches. --json prints the
                         read-contract document
-  workspace records --kind <kind file> [--current] [--at <rev>] [--base <rev>] [--require attested] [--json]
-                        Read the records a record kind locates, validated
+  workspace records [--kind <kind file>] [--current] [--at <rev>] [--base <rev>] [--require attested] [--json]
+                        Without --kind, every record kind the declaration
+                        names. Read the records a record kind locates, validated
                         against its schema, with reason codes for invalid
                         ones. --current leaves out superseded records; --at
                         reads a commit's git objects. Needs no workspace file.
@@ -731,9 +757,34 @@ Workspace (level 1, #2524):
                         --require attested exits 2 if any record is not
                         attested. A pinned file that changed is a warning,
                         asset-drift or asset-missing
+  workspace records [--kind <kind file>] --since <rev> [--at <rev>] [--json]
+                        What changed in the records between <rev> and --at
+                        (default: the working tree): new and removed records,
+                        state transitions, new verdicts, new supersessions
+                        and changed pins
   workspace records pin <path>
                         Print the path from the workspace root and the
                         sha256 of a file, for a decision's evidence pin
+  workspace records new [<kind file>] --from <file|-> [--prefix <prefix>] [--dry-run]
+                        Write one new record in the kind's directory from
+                        the JSON fields given, after validating them as
+                        records would read them. Without a kind file, the one
+                        kind the declaration names. Allocates the next id when
+                        the fields hold none. Prints {path, id} as JSON and
+                        never commits
+  workspace records amend <id> [--kind <kind file>] --set <file|-> [--dry-run]
+                        Set top-level fields of one record. A closed record
+                        never changes, and an approved one changes only its
+                        state (upward), pins and reviews; anything else is
+                        refused with amend-supersede-instead. Prints
+                        {path, id, changed}
+  workspace records review <id> [--kind <kind file>] --verdict agree|dissent|abstain --by <principal> [--note <text>] [--session <id>] [--sign [<key file>]] [--dry-run]
+                        Append a review to one record, dated and bound to
+                        the digest of the record text. A dissent needs
+                        --note. --sign seals it with an ssh key (git's
+                        user.signingkey without a file); under a signers
+                        file at base only a sealed verdict counts. Prints
+                        {path, id, review}
   workspace verify [--base <rev>] [--head <rev>] [--require attested]
                         Check the commits in base..head against the signers
                         and roles read from base. A change to the signers file
@@ -784,7 +835,8 @@ Workspace (level 1, #2524):
   workspace graph --intent <path[:start-end]> [--at <rev>] [--kind <kind file>...] [--json]
                         The intent graph over one region: the commits that
                         touched it, the decisions whose constrains cover it,
-                        the artifacts they pin, and findings with closed codes
+                        the artifacts they pin, and findings with closed codes.
+                        Without --kind, every record kind the declaration names
 
 Lifecycle (alias: lc):
   lifecycle snapshot <env>  Query API, save metadata to orphan branch

package/src/cli/registry.ts

@@ -291,6 +291,18 @@ export interface ParsedArgs {
   intent?: string;
   /** `chant workspace records --current` (#2546): leave out records a closed record supersedes. */
   current?: boolean;
+  /** `chant workspace records amend <id> --set <file|->` (#2670): the JSON fields to set. */
+  set?: string;
+  /** `chant workspace records review <id> --verdict <v>` (#2670): agree, dissent or abstain. */
+  verdict?: string;
+  /** `chant workspace records review <id> --by <principal>` (#2670): the reviewer, as the caller names them. */
+  by?: string;
+  /** `chant workspace records review <id> --sign [<key file>]` (#2687): the key that seals the verdict, or true for git's user.signingkey. */
+  sign?: string | true;
+  /** `chant workspace records review <id> --session <id>` (#2670): the review session the verdict was given in. */
+  session?: string;
+  /** `chant workspace records new <kind> --prefix <prefix>` (#2670): the id prefix to allocate under. */
+  prefix?: string;
   /** `chant workspace records|verify --require attested` (#2547): the provenance level a gate requires. */
   require?: string;
   /**
@@ -416,7 +428,7 @@ export interface ParsedArgs {
   plan?: string;
   /** `chant operator log --op <name>` (#2029) — restrict the tick history to one ConvergeOp by name. Omitted, every discovered ConvergeOp's ticks are merged into one timeline. */
   op?: string;
-  /** `chant operator log --since <iso>` (#2029) — only entries at or after this ISO-8601 instant. */
+  /** `chant operator log --since <iso>` (#2029) — only entries at or after this ISO-8601 instant. `chant workspace records --since <rev>` (#2673) — the revision to compare the records with. */
   since?: string;
   /** `chant operator log --limit <n>` (#2029) — keep only the newest n entries (still printed oldest-first). */
   limit?: number;

package/src/lifecycle/gate-ledger.ts

@@ -47,6 +47,9 @@ import type { GateApprover, GatePolicyDecision, ResolvedGateApproval } from "../
 import { readBlobFromPath, readPathSha, readBlobBySha, writeBlobToPath, RefCASConflictError } from "./git";
 
 const DIR = "_gates";
+
+/** The directory on the `chant/lifecycle` branch that holds gate ledgers, under a member's prefix when it has one. */
+export const GATES_DIR = DIR;
 const APPEND_RETRY_ATTEMPTS = 5;
 
 /**
@@ -350,7 +353,18 @@ export async function readGateLedger(
 ): Promise<{ resolutions: GateResolutionRecord[]; pending: PendingGateRecord[]; malformed: number }> {
   const content = await readBlobFromPath(DIR, filename(op), opts);
   if (!content) return { resolutions: [], pending: [], malformed: 0 };
+  return parseGateLedger(content);
+}
 
+/**
+ * Split the text of one gate ledger file into its two kinds of line, oldest
+ * first, the way {@link readGateLedger} reads it. Exported for a reader that
+ * fetches the file itself, such as `chant workspace status` (#2674), which
+ * reads every member's ledger by its full path from the workspace root.
+ */
+export function parseGateLedger(
+  content: string,
+): { resolutions: GateResolutionRecord[]; pending: PendingGateRecord[]; malformed: number } {
   const lines = content.split("\n").map((l) => l.trim()).filter(Boolean);
   const resolutions: GateResolutionRecord[] = [];
   const pending: PendingGateRecord[] = [];

package/src/workspace/__fixtures__/sessions.ts

@@ -0,0 +1,66 @@
+/**
+ * A repository with the reference workspace's decisions and design member,
+ * and helpers that write sessions and review entries into it, for the
+ * session and records --since tests (#2673).
+ */
+
+import { cpSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { sessionSeal } from "../record-sessions";
+import { commitAll, git, REPO, scratchDir } from "./contract-repo";
+
+export const SESSIONS_KIND = "design/sessions/session.kind.mjs";
+export const DECISIONS_KIND = "decisions/decision.kind.mjs";
+
+/** A git repository holding a copy of the reference workspace's decisions and design member. */
+export function sessionsRepo(): string {
+  const root = scratchDir("chant-sessions-");
+  for (const d of ["decisions", "design"]) cpSync(join(REPO, "reference-workspace", d), join(root, d), { recursive: true });
+  git(root, "init", "-q");
+  commitAll(root, "reference");
+  return root;
+}
+
+/** A session file's text, sealed when it is closed. */
+export function sessionText(s: { id: string; state: "open" | "closed"; verdicts?: { record: string; principal: string; verdict: string }[]; agenda?: string[] }): string {
+  const lines = [
+    "---",
+    "schema: 1",
+    `id: "${s.id}"`,
+    `title: "Session ${s.id}"`,
+    `state: "${s.state}"`,
+    "agenda:",
+    ...(s.agenda ?? ["ref-001"]).map((r) => `  - record: "${r}"`),
+    "attendance:",
+    '  - principal: "lex00"',
+    '    class: "person"',
+    '  - principal: "alice"',
+    '    class: "person"',
+    '  - principal: "helper"',
+    '    class: "agent"',
+    'opened: "2026-09-24T18:00:00Z"',
+    `closed: ${s.state === "closed" ? '"2026-09-24T19:00:00Z"' : "null"}`,
+    ...(s.verdicts?.length
+      ? ["verdicts:", ...s.verdicts.flatMap((v) => [`  - record: "${v.record}"`, `    principal: "${v.principal}"`, `    verdict: "${v.verdict}"`])]
+      : ["verdicts: []"]),
+    ...(s.state === "closed" ? ['closed_digest: "SEAL"'] : []),
+    "---",
+    "",
+    `# Session ${s.id}`,
+    "",
+  ];
+  const text = lines.join("\n");
+  return s.state === "closed" ? text.replace('"SEAL"', `"${sessionSeal(text, "closed_digest")}"`) : text;
+}
+
+/** Rewrite ref-001 with the given review entries, each naming `session`. */
+export function reviewed(root: string, reviewers: string[], session: string, state = "decided"): void {
+  const file = join(root, "decisions", "ref-001-how-the-app-is-deployed.md");
+  const reviews = reviewers.map((r) => `  - reviewer: "${r}"\n    verdict: "agree"\n    on: "2026-09-24"\n    session: "${session}"`).join("\n");
+  writeFileSync(
+    file,
+    readFileSync(file, "utf-8")
+      .replace(/^state: .*$/m, `state: "${state}"`)
+      .replace(/^reviews: .*$/m, reviewers.length ? `reviews:\n${reviews}` : "reviews: []"),
+  );
+}

package/src/workspace/checks/records.ts

@@ -13,6 +13,7 @@
  * | WSP112 | a pinned file that does not exist |
  * | WSP113 | a pinned file that a superseding record pins at the old hash: the artifact did not follow the decision |
  * | WSP114 | the records of `--kind` can't be read (fixed) |
+ * | WSP115 | a record kind the declaration names is missing or does not load as one (fixed, #2680) |
  */
 
 import type { WorkspaceCheck, WorkspaceDiagnostic } from "../checks";
@@ -80,4 +81,22 @@ export const RECORD_CHECKS: readonly WorkspaceCheck[] = [
       return [{ checkId: this.id, severity: this.severity, message: `--kind ${facts.kind}: ${facts.error.code}: ${facts.error.message}`, pointer: "" }];
     },
   },
+  {
+    id: "WSP115",
+    name: "record-kind-unloadable",
+    description: "Every record kind the declaration names is a file that exports a valid recordKind, with the schema it names.",
+    severity: "error",
+    configurable: false,
+    check(ctx) {
+      return (ctx.facts?.declaredKinds ?? [])
+        .filter((k) => k.reason !== null)
+        .map((k) => ({
+          checkId: this.id,
+          severity: this.severity,
+          message: `${k.declared.member === null ? "the workspace" : `member ${k.declared.member}`} declares the record kind ${k.declared.kind}, which can't be loaded: ${k.reason!.code}: ${k.reason!.message}`,
+          ...(k.declared.member !== null ? { entity: k.declared.member } : {}),
+          pointer: `${k.declared.pointer}/kind`,
+        }));
+    },
+  },
 ];

package/src/workspace/checks.test.ts

@@ -58,6 +58,8 @@ describe("the WSP catalog", () => {
       "link-kind-unknown",
       // --kind names a record kind, and records that can't be read check nothing (#2549).
       "records-unreadable",
+      // A declared record kind that doesn't load breaks every reader's default (#2680).
+      "record-kind-unloadable",
     ]);
   });
 

package/src/workspace/checks.ts

@@ -27,6 +27,7 @@
  * | WSP091 to WSP097 | member links (#2539) |
  * | WSP101 to WSP106 | generated files |
  * | WSP111 to WSP114 | records read with `--kind` (#2549) |
+ * | WSP115 | the record kinds the declaration names (#2680) |
  */
 
 import { realpathSync } from "node:fs";
@@ -44,6 +45,7 @@ import { gatherGeneratedFacts, GENERATED_CHECKS, type GeneratedFileFacts } from
 import { gatherLedgerFacts, LEDGER_CHECKS, type MemberLedgerFacts } from "./checks/ledgers";
 import { gatherPipelineFacts, PIPELINE_CHECKS, type MemberPipelineFacts } from "./checks/pipelines";
 import { RECORD_CHECKS, type RecordFacts } from "./checks/records";
+import { loadDeclaredKinds, type DeclaredKind } from "./declared-kinds";
 
 /**
  * What the checks beyond the declaration read, gathered from the checkout
@@ -59,6 +61,8 @@ export interface WorkspaceFacts {
   generated?: readonly GeneratedFileFacts[];
   /** The records of the kind named with `--kind`, with their pins checked (#2549). */
   records?: RecordFacts;
+  /** The record kinds the declaration names, each loaded, or only looked for under `--at` (#2680). */
+  declaredKinds?: readonly DeclaredKind[];
 }
 
 /** What every declaration check reads. */
@@ -444,7 +448,9 @@ export async function runDeclarationChecks(
   }
   const { registry, problems } = loadKindRegistry(declaration.pins, root);
   const gathered = options.gather === false || options.tree ? {} : await gatherWorkspaceFacts(root, declaration, options);
-  const facts: WorkspaceFacts = options.records ? { ...gathered, records: options.records } : gathered;
+  // The declared record kinds load from the working tree; under --at only whether each exists at the revision is checked (#2680).
+  const declaredKinds = options.gather === false ? undefined : await loadDeclaredKinds(declaration, tree, root, { load: !options.tree });
+  const facts: WorkspaceFacts = { ...gathered, ...(options.records ? { records: options.records } : {}), ...(declaredKinds ? { declaredKinds } : {}) };
   const ctx: WorkspaceCheckContext = { declaration, tree, groups, kinds: registry, kindProblems: problems, facts };
   const findings = runWorkspaceChecks(ctx);
   const { active, suppressed } = applyCheckSettings(declaration, findings);

package/src/workspace/composites.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://intentius.io/chant/schemas/workspace/composites/v1/composites.schema.json",
   "title": "chant workspace graph --composites output",
-  "description": "What `chant workspace graph --composites` prints: each composite instance the workspace's members declare, joined to the components whose contract can deploy it (#2662). Each member of kind chant is read through its own `chant graph --format ir` and `chant graph --components --format ir`, under its own toolchain. An instance with no component is listed with an empty `components` array. chant supplies the rows and never picks one: each match says how it was made and how it crosses members. Readers ignore fields they do not know; a field is only ever added within a version. The reason and error codes are closed lists. Contract version 1 is written by chant 0.81.0 and newer, and this document was added to it by #2662; a chant without --composites refuses the flag. Every code is in the one closed list of `reason-codes.ts`.",
+  "description": "What `chant workspace graph --composites` prints: each composite instance the workspace's members declare, joined to the components whose contract can deploy it (#2662). Each member of kind chant is read through its own `chant graph --format ir` and `chant graph --components --format ir`, under its own toolchain. An instance with no component is listed with an empty `components` array. chant supplies the rows and never picks one: each match says how it was made and how it crosses members. Readers ignore fields they do not know; a field is only ever added within a version. The reason and error codes are closed lists. Contract version 1 is written by chant 0.81.0 and newer, and this document was added to it by #2662; a chant without --composites refuses the flag. Each component lists the runtimes it can deploy on, read from its member's chant.config.ts (#2674). Every code is in the one closed list of `reason-codes.ts`.",
   "oneOf": [
     {
       "$ref": "#/$defs/result"
@@ -130,7 +130,8 @@
         "kind",
         "status",
         "reason",
-        "chant"
+        "chant",
+        "runtimeReasons"
       ],
       "properties": {
         "name": {
@@ -187,6 +188,28 @@
             "null"
           ],
           "description": "The chant version the member's toolchain reported, or null when a chant older than member-run read it."
+        },
+        "runtimeReasons": {
+          "description": "Why the runtimes of the member's components leave something out: its chant.config.ts, or a lexicon it lists, could not be read. Empty for a member not of kind chant, and when nothing was left out.",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "enum": [
+                  "runtimes-config-unreadable",
+                  "runtimes-lexicon-unreadable"
+                ]
+              },
+              "message": {
+                "type": "string"
+              }
+            }
+          }
         }
       },
       "if": {
@@ -327,7 +350,8 @@
         "member",
         "archetype",
         "composites",
-        "file"
+        "file",
+        "runtimes"
       ],
       "properties": {
         "id": {
@@ -368,6 +392,14 @@
             "null"
           ],
           "description": "The component's file from the workspace root, when the member's chant names it."
+        },
+        "runtimes": {
+          "description": "The runtimes the component can deploy on, the list chant run --components --on accepts in its member: local first, then each lexicon the member's chant.config.ts lists whose opRuntime hosts component runs, in config order.",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/runtime"
+          }
         }
       }
     },
@@ -466,6 +498,36 @@
         },
         "composites": false
       }
+    },
+    "runtime": {
+      "type": "object",
+      "required": [
+        "name",
+        "lexicon",
+        "default",
+        "command"
+      ],
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "What --on takes: local, or the lexicon's name."
+        },
+        "lexicon": {
+          "type": [
+            "string",
+            "null"
+          ],
+          "description": "The lexicon that hosts the runtime, or null for local."
+        },
+        "default": {
+          "type": "boolean",
+          "description": "True for the runtime chant run --components uses without --on. That is local until chant.config.ts can name a default."
+        },
+        "command": {
+          "type": "string",
+          "description": "The command that deploys the component on this runtime, run in the member's directory: chant run --components <name>, with --on <runtime> for any runtime but local."
+        }
+      }
     }
   }
 }