@intentius/chant 0.86.0 → 0.87.0

package/src/workspace/records-write.ts

@@ -80,6 +80,7 @@ export const REVIEW_ERROR_CODES = [
   "review-unsupported",
   "record-closed",
   "review-note-required",
+  "review-sign-failed",
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 
@@ -562,7 +563,7 @@ export interface ReviewRecordOptions {
   kind: string;
   id: string;
   verdict: string;
-  /** The reviewer, as the caller names them. chant does not check who it is; attestation does (#2547). */
+  /** The reviewer, as the caller names them. chant does not check who it is; a seal does, on read (#2687). */
   by: string;
   note?: string;
   /** The review session the verdict was given in. */
@@ -571,11 +572,18 @@ export interface ReviewRecordOptions {
   cwd: string;
   /** The date written as `on`, YYYY-MM-DD. Defaults to today, in UTC. */
   on?: string;
+  /**
+   * Seal the verdict (#2687): a key file, resolved against `cwd`, or true for
+   * git's `user.signingkey`. Without it the verdict is written unsealed.
+   */
+  sign?: string | true;
 }
 
 /**
  * `records review`: append one verdict to a record's reviews, with the date
  * and the digest of the record text it judged ({@link recordTextDigest}).
+ * With `sign`, the verdict carries a seal: an ssh signature over the record
+ * id, the digest, the verdict, the reviewer and the date (`trust/seal.ts`).
  */
 export async function reviewRecord(opts: ReviewRecordOptions): Promise<ReviewDocument> {
   try {
@@ -609,6 +617,7 @@ export async function reviewRecord(opts: ReviewRecordOptions): Promise<ReviewDoc
       digest: recordTextDigest(current, field),
       ...(opts.session !== undefined ? { session: opts.session } : {}),
     };
+    if (opts.sign !== undefined) review.seal = await seal(opts.sign, opts.cwd, { record: opts.id, digest: review.digest as string, verdict: opts.verdict, reviewer: opts.by, on: review.on as string });
     // Only the reviews block changes, so the digest the verdict names stays the record's digest (#2672).
     const list = [...reviews, review];
     const text = replaceFields(current, { [field]: list }, { ...target.data, [field]: list });
@@ -631,12 +640,28 @@ export async function reviewRecord(opts: ReviewRecordOptions): Promise<ReviewDoc
   }
 }
 
+/** A seal over one verdict, or a refusal with review-sign-failed. Loaded only when --sign is given. */
+async function seal(sign: string | true, cwd: string, v: { record: string; digest: string; verdict: string; reviewer: string; on: string }): Promise<Record<string, unknown>> {
+  const { resolveSigningKey, sealVerdict, SealError } = await import("./trust/seal");
+  try {
+    const key = resolveSigningKey(sign, cwd);
+    try {
+      return { ...sealVerdict(key.file, v) };
+    } finally {
+      key.cleanup();
+    }
+  } catch (err) {
+    if (err instanceof SealError) throw new RecordWriteError("review-sign-failed", err.message);
+    throw err;
+  }
+}
+
 // ── The command ──────────────────────────────────────────────────────────────
 
 export const WRITE_USAGE = [
   "chant workspace records new [<kind file or declared kind>] --from <file|-> [--prefix <prefix>] [--dry-run]",
   "chant workspace records amend <id> [--kind <kind file>] --set <file|-> [--dry-run]",
-  "chant workspace records review <id> [--kind <kind file>] --verdict agree|dissent|abstain --by <principal> [--note <text>] [--session <id>] [--dry-run]",
+  "chant workspace records review <id> [--kind <kind file>] --verdict agree|dissent|abstain --by <principal> [--note <text>] [--session <id>] [--sign [<key file>]] [--dry-run]",
 ].join("\n");
 
 function usage(schema: string, message: string): WriteFailure<"write-usage-invalid"> {
@@ -710,6 +735,10 @@ export async function runRecordsWrite(ctx: CommandContext): Promise<number> {
     console.log(JSON.stringify(doc, null, 2));
     return "error" in doc ? 1 : 0;
   };
+  if (args.sign !== undefined && verb !== "review") {
+    const schema = verb === "new" ? RECORDS_NEW_SCHEMA_ID : RECORDS_AMEND_SCHEMA_ID;
+    return print(usage(schema, `--sign seals a review verdict; sealing a record's author on ${verb} is not supported yet (#2688)`));
+  }
   if (verb === "new") {
     const named = args.extraPositional2 ?? args.kind;
     const kind = named !== undefined ? resolveWriteKind(named, cwd) : declaredWriteKind(RECORDS_NEW_SCHEMA_ID, cwd, "new needs the kind file");
@@ -731,6 +760,6 @@ export async function runRecordsWrite(ctx: CommandContext): Promise<number> {
   if (args.verdict === undefined) return print(usage(schema, "--verdict agree|dissent|abstain is required"));
   if (args.by === undefined) return print(usage(schema, "--by <principal> is required"));
   return print(
-    await reviewRecord({ kind, id, verdict: args.verdict, by: args.by, note: args.note, session: args.session, dryRun: args.dryRun, cwd }),
+    await reviewRecord({ kind, id, verdict: args.verdict, by: args.by, note: args.note, session: args.session, sign: args.sign, dryRun: args.dryRun, cwd }),
   );
 }

package/src/workspace/records.schema.json

@@ -206,7 +206,8 @@
             "work-needs-cycle",
             "work-implements-undecided",
             "work-done-unpinned",
-            "work-closed-without-date"
+            "work-closed-without-date",
+            "work-done-gap-open"
           ]
         },
         "message": { "type": "string" }
@@ -248,6 +249,20 @@
         "reviewer": { "type": "string", "description": "The reviewer as the record writes it." },
         "verdict": { "enum": ["agree", "dissent", "abstain"] },
         "digest": { "type": ["string", "null"], "description": "The digest the verdict names, or null when it names none (a warning review-undigested on the record)." },
+        "attested": {
+          "type": ["boolean", "null"],
+          "description": "Added in contract 1 by #2687. true when the verdict's seal verifies for its reviewer against the signers file at base. false when a signers file is active at base and the verdict has no seal, or when a seal fails, with or without one. null when nothing here can say: no seal and no signers file, a seal checked with no signers file (its signature is intact, and nothing says whose key it is), or no ssh-keygen. Under an active signers file only true counts."
+        },
+        "attestation": {
+          "description": "Added in contract 1 by #2687. What the verdict's seal establishes, and why when it is not attested.",
+          "type": "object",
+          "required": ["message"],
+          "properties": {
+            "code": { "enum": ["seal-missing", "seal-signer-unlisted", "seal-signature-invalid", "seal-unverifiable"], "description": "Absent exactly when attested is true." },
+            "message": { "type": "string" },
+            "key": { "type": "string", "description": "The fingerprint of the key that made the signature, when the signature was checked." }
+          }
+        },
         "reason": {
           "description": "Why the verdict does not count. Present exactly on the entries in notCounted.",
           "type": "object",

package/src/workspace/records.ts

@@ -100,11 +100,41 @@ export const REVIEW_REASON_CODES = [
   "review-duplicate",
   /** The verdict's digest is not the digest of the record's text now: the record changed after the verdict (#2672). */
   "review-older-digest",
-  /** An attestation policy is active at base, and the verdict carries no seal. */
+  /**
+   * An attestation policy is active at base, and the verdict's seal does not
+   * verify for its reviewer: it has none, the reviewer has no key in the
+   * signers file, or the signature fails (#2687).
+   */
   "review-unattested",
 ] as const satisfies readonly ReasonCode[];
 export type ReviewReasonCode = (typeof REVIEW_REASON_CODES)[number];
 
+/**
+ * Why a verdict's seal is not attested (#2687). Closed, like the reason
+ * codes. Every verdict in the quorum carries one of these in its
+ * `attestation`, unless its seal verified.
+ */
+export const SEAL_REASON_CODES = [
+  /** The verdict carries no seal. */
+  "seal-missing",
+  /** The reviewer has no key in the signers file at base. */
+  "seal-signer-unlisted",
+  /** The seal is malformed, names another signer, or its signature does not verify over the verdict. */
+  "seal-signature-invalid",
+  /** Nothing here can say whose seal it is: there is no signers file at base, or ssh-keygen is not installed. */
+  "seal-unverifiable",
+] as const satisfies readonly ReasonCode[];
+export type SealCode = (typeof SEAL_REASON_CODES)[number];
+
+/** What a verdict's seal establishes (#2687). See `trust/seal.ts`. */
+export interface VerdictAttestation {
+  /** Why the verdict is not attested. Absent when its seal verified. */
+  code?: SealCode;
+  message: string;
+  /** The fingerprint of the key that made the signature, when it was checked. */
+  key?: string;
+}
+
 export interface RecordWarning {
   /** A work kind's records also carry the codes of `WORK_WARNING_CODES` (#2683). */
   code: RecordWarningCode | WorkWarningCode;
@@ -664,6 +694,13 @@ export interface QuorumVerdict {
   verdict: "agree" | "dissent" | "abstain";
   /** The digest the verdict names, or null when it names none. */
   digest: string | null;
+  /**
+   * true when its seal verifies for the reviewer against the signers at base;
+   * false when a seal is missing under an active policy, or fails; null when
+   * nothing here can say (#2687).
+   */
+  attested: boolean | null;
+  attestation: VerdictAttestation;
   /** Why it does not count. Absent on a counted verdict. */
   reason?: { code: ReviewReasonCode; message: string };
 }
@@ -703,6 +740,30 @@ export interface QuorumOptions {
   agents: ReadonlySet<string>;
   /** Whether an attestation policy is active, so a verdict needs a seal to count. */
   attestation: boolean;
+  /**
+   * Checks one verdict's seal (#2687), as `trust/seal.ts` does against the
+   * policy at base. Without it no seal is checked: a sealed verdict is
+   * `seal-unverifiable`, so under an active policy none counts.
+   */
+  verifySeal?: (v: SealInput) => { attested: boolean | null } & VerdictAttestation;
+}
+
+/** What a seal check reads of one verdict. */
+export interface SealInput {
+  record: string | null;
+  reviewer: string;
+  verdict: string;
+  on: unknown;
+  digest: string | null;
+  seal: unknown;
+}
+
+/** The check used when {@link QuorumOptions.verifySeal} is not given. */
+function uncheckedSeal(attestation: boolean, v: SealInput): { attested: boolean | null } & VerdictAttestation {
+  if (v.seal === undefined || v.seal === null) {
+    return { attested: attestation ? false : null, code: "seal-missing", message: `the verdict by ${v.reviewer} carries no seal` };
+  }
+  return { attested: null, code: "seal-unverifiable", message: `the seal by ${v.reviewer} was not checked` };
 }
 
 const VERDICTS = new Set(["agree", "dissent", "abstain"]);
@@ -713,28 +774,36 @@ const VERDICTS = new Set(["agree", "dissent", "abstain"]);
  * Malformed entries are skipped; the schema reports them.
  *
  * A verdict is not counted when its reviewer is the decider, holds the agent
- * role, names a digest other than the record's own now, or carries no seal
- * under an active attestation policy, in that order. Of the rest, the latest
- * verdict per principal counts and each earlier one is a duplicate. No
- * verdict carries a seal yet (#2546), so under an active policy none counts.
+ * role, names a digest other than the record's own now, or, under an active
+ * attestation policy, carries no seal that verifies for its reviewer (#2687),
+ * in that order. Of the rest, the latest verdict per principal counts and
+ * each earlier one is a duplicate. Every verdict reports its seal's check in
+ * `attested` and `attestation`, whether it counts or not.
  */
-export function computeQuorum(kind: RecordKind, entry: Pick<RecordEntry, "data" | "digest">, options: QuorumOptions): Quorum | null {
+export function computeQuorum(kind: RecordKind, entry: Pick<RecordEntry, "data" | "digest"> & { id?: string | null }, options: QuorumOptions): Quorum | null {
   if (!kind.reviews || entry.data === null) return null;
   const list = entry.data[kind.reviews.field];
   const decidedBy = entry.data[kind.reviews.decider];
   const decider = typeof decidedBy === "string" ? normalisePrincipal(decidedBy) : null;
+  const idValue = entry.id !== undefined ? entry.id : kind.idField !== undefined ? entry.data[kind.idField] : null;
+  const record = typeof idValue === "string" ? idValue : null;
   const verdicts: QuorumVerdict[] = [];
   const openConcerns: OpenConcern[] = [];
   (Array.isArray(list) ? list : []).forEach((raw, index) => {
     if (raw === null || typeof raw !== "object") return;
     const r = raw as Record<string, unknown>;
     if (typeof r.reviewer !== "string" || typeof r.verdict !== "string" || !VERDICTS.has(r.verdict)) return;
+    const digest = typeof r.digest === "string" ? r.digest : null;
+    const input: SealInput = { record, reviewer: r.reviewer, verdict: r.verdict, on: r.on, digest, seal: r.seal };
+    const { attested, ...attestation } = options.verifySeal ? options.verifySeal(input) : uncheckedSeal(options.attestation, input);
     const v: QuorumVerdict = {
       index,
       principal: normalisePrincipal(r.reviewer),
       reviewer: r.reviewer,
       verdict: r.verdict as QuorumVerdict["verdict"],
-      digest: typeof r.digest === "string" ? r.digest : null,
+      digest,
+      attested,
+      attestation,
     };
     if (v.principal === decider) {
       v.reason = { code: "review-decider", message: `${v.reviewer} decided this record, and the quorum counts verdicts besides the decider's` };
@@ -742,8 +811,8 @@ export function computeQuorum(kind: RecordKind, entry: Pick<RecordEntry, "data"
       v.reason = { code: "review-agent", message: `${v.reviewer} holds the agent role in the trust policy at base, and an agent's verdict does not count` };
     } else if (v.digest !== null && v.digest !== entry.digest) {
       v.reason = { code: "review-older-digest", message: `${v.reviewer} judged the text at digest ${v.digest.slice(0, 12)}, and the record's text is now at ${entry.digest.slice(0, 12)}` };
-    } else if (options.attestation) {
-      v.reason = { code: "review-unattested", message: `an attestation policy is active at base, and the verdict by ${v.reviewer} carries no seal` };
+    } else if (options.attestation && attested !== true) {
+      v.reason = { code: "review-unattested", message: `an attestation policy is active at base, and ${attestation.message}` };
     }
     verdicts.push(v);
     if (v.verdict === "dissent" && r.addressed_by == null && r.withdrawn_on == null) {

package/src/workspace/trust/seal.test.ts

@@ -0,0 +1,232 @@
+/**
+ * #2687: sealed verdicts. A review counts under a signers file at base only
+ * when its reviewer signed it.
+ *
+ * Each case writes verdicts through `records review` and reads them back
+ * through the real `records` query, in a git repository whose base (`main`)
+ * holds the signers file, or doesn't. Every document is checked against its
+ * published schema.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import Ajv2020 from "ajv/dist/2020";
+import { afterEach, describe, expect, test } from "vitest";
+import { parseArgs } from "../../cli/main";
+import recordsSchema from "../records.schema.json";
+import reviewSchema from "../records-review.schema.json";
+import { queryRecords, type RecordView } from "../records-cli";
+import { amendRecord, reviewRecord, runRecordsWrite, type ReviewDocument } from "../records-write";
+import type { QuorumVerdict } from "../records";
+import { REVIEW_SEAL_NAMESPACE, reviewSealPayload } from "./seal";
+import { hasSshKeygen, TestRepo, type Key } from "./test-repo";
+
+const REPO = join(import.meta.dirname, "..", "..", "..", "..", "..");
+const DECISIONS = join(REPO, "docs", "design", "decisions");
+const KIND = "decisions/decision.kind.mjs";
+const FILE = "decisions/ws-003-seal-scope.md";
+
+const ajv = new Ajv2020({ strict: true, allErrors: true });
+const validateRecords = ajv.compile(recordsSchema);
+const validateReview = ajv.compile(reviewSchema);
+
+const repos: TestRepo[] = [];
+afterEach(() => {
+  while (repos.length) repos.pop()!.cleanup();
+});
+
+/**
+ * A repository whose main holds ws-003 (decided by lex00) and, unless
+ * `signers` is false, a signers file listing alice and bob. The work happens
+ * on a branch, so main stays the base.
+ */
+function workspace(label: string, opts: { signers?: boolean } = {}) {
+  const r = new TestRepo(`seal-${label}`);
+  repos.push(r);
+  const alice = r.key("alice");
+  const bob = r.key("bob");
+  const mallory = r.key("mallory");
+  r.write(KIND, readFileSync(join(DECISIONS, "decision.kind.mjs"), "utf-8"));
+  r.write("decisions/decision.schema.json", readFileSync(join(DECISIONS, "decision.schema.json"), "utf-8"));
+  r.write(FILE, readFileSync(join(DECISIONS, "ws-003-seal-scope.md"), "utf-8"));
+  if (opts.signers !== false) r.write(".chant/allowed_signers", `alice@example.test ${alice.pub}\nbob@example.test ${bob.pub}\n`);
+  r.commit("base", alice);
+  r.git(["checkout", "-q", "-b", "change"]);
+  return { r, alice, bob, mallory };
+}
+
+async function review(r: TestRepo, by: string, sign?: Key | string | true, verdict = "agree"): Promise<ReviewDocument> {
+  const doc = await reviewRecord({ kind: KIND, id: "ws-003", verdict, by, cwd: r.dir, on: "2026-09-24", ...(sign !== undefined ? { sign: typeof sign === "object" ? sign.file : sign } : {}) });
+  expect(validateReview(doc), JSON.stringify(validateReview.errors)).toBe(true);
+  return doc;
+}
+
+async function record(r: TestRepo): Promise<RecordView> {
+  const doc = await queryRecords({ kind: KIND, cwd: r.dir, base: "main" });
+  expect(validateRecords(doc), JSON.stringify(validateRecords.errors)).toBe(true);
+  if ("error" in doc) throw new Error(doc.error.message);
+  const rec = doc.records.find((x) => x.id === "ws-003")!;
+  expect(rec.reasons).toEqual([]);
+  return rec;
+}
+
+/** Every verdict, counted or not, in list order, as `reviewer:reason code:seal code`. */
+function verdicts(rec: RecordView): string[] {
+  const q = rec.quorum!;
+  return [...q.counted, ...q.notCounted]
+    .sort((a, b) => a.index - b.index)
+    .map((v: QuorumVerdict) => `${v.reviewer}:${v.reason?.code ?? "counted"}:${v.attestation.code ?? "attested"}`);
+}
+
+function verdict(rec: RecordView, index: number): QuorumVerdict {
+  const q = rec.quorum!;
+  return [...q.counted, ...q.notCounted].find((v) => v.index === index)!;
+}
+
+describe.skipIf(!hasSshKeygen)("sealed verdicts under a signers file at base", () => {
+  test("a sealed agree counts; an unsealed one, one by an unlisted principal and one signed with another's key do not", async () => {
+    const { r, alice, bob, mallory } = workspace("active");
+    const sealed = await review(r, "alice@example.test", alice);
+    if ("error" in sealed) throw new Error(sealed.error.message);
+    expect(sealed.review.seal).toMatchObject({ signer: "alice@example.test", key: expect.stringMatching(/^SHA256:/) });
+    await review(r, "bob@example.test");
+    await review(r, "mallory@example.test", mallory);
+    // alice's key, claiming to be bob.
+    await review(r, "Bob@Example.test ", alice);
+
+    const rec = await record(r);
+    expect(verdicts(rec)).toEqual([
+      "alice@example.test:counted:attested",
+      "bob@example.test:review-unattested:seal-missing",
+      "mallory@example.test:review-unattested:seal-signer-unlisted",
+      "Bob@Example.test :review-unattested:seal-signature-invalid",
+    ]);
+    const a = verdict(rec, 0);
+    expect(a.attested).toBe(true);
+    expect(a.attestation.key).toBe((sealed.review.seal as { key: string }).key);
+    expect(verdict(rec, 1)).toMatchObject({ attested: false, reason: { message: expect.stringMatching(/carries no seal/) } });
+    expect(verdict(rec, 2).reason!.message).toMatch(/mallory@example\.test has no key in \.chant\/allowed_signers at base/);
+    expect(verdict(rec, 3).reason!.message).toMatch(/does not verify for Bob@Example\.test/);
+    expect(rec.quorum).toMatchObject({ agreed: 1, met: false });
+    expect(bob).toBeDefined();
+  });
+
+  test("two sealed agrees meet the quorum", async () => {
+    const { r, alice, bob } = workspace("met");
+    await review(r, "alice@example.test", alice);
+    await review(r, "bob@example.test", bob);
+    const rec = await record(r);
+    expect(rec.quorum).toMatchObject({ agreed: 2, met: true, notCounted: [] });
+  });
+
+  test("an amendment leaves a sealed verdict on the older digest, and rewriting its digest breaks the seal", async () => {
+    const { r, alice } = workspace("amend");
+    await review(r, "alice@example.test", alice);
+    const before = await record(r);
+    const amended = await amendRecord({ kind: KIND, id: "ws-003", fields: JSON.stringify({ evidence: [] }), cwd: r.dir });
+    expect("error" in amended ? amended.error : null).toBeNull();
+
+    const after = await record(r);
+    expect(after.digest).not.toBe(before.digest);
+    // The seal still verifies over the text it judged; the verdict stops counting because the text moved.
+    expect(verdicts(after)).toEqual(["alice@example.test:review-older-digest:attested"]);
+
+    // Bringing the verdict up to date by hand, without a new signature.
+    const path = join(r.dir, FILE);
+    writeFileSync(path, readFileSync(path, "utf-8").replace(before.digest, after.digest));
+    const forged = await record(r);
+    expect(forged.digest).toBe(after.digest);
+    expect(verdicts(forged)).toEqual(["alice@example.test:review-unattested:seal-signature-invalid"]);
+    expect(verdict(forged, 0).attested).toBe(false);
+  });
+
+  test("attack: a seal lifted from another verdict, or made in the commit namespace, does not verify", async () => {
+    const { r, alice } = workspace("lift");
+    // An abstain, turned into an agree by hand: the seal covers the verdict.
+    await review(r, "alice@example.test", alice, "abstain");
+    const path = join(r.dir, FILE);
+    writeFileSync(path, readFileSync(path, "utf-8").replace('verdict: "abstain"', 'verdict: "agree"'));
+    let rec = await record(r);
+    expect(verdicts(rec)).toEqual(["alice@example.test:review-unattested:seal-signature-invalid"]);
+
+    // A good signature by alice over the right bytes, in the git namespace.
+    const text = readFileSync(path, "utf-8");
+    const payload = reviewSealPayload("ws-003", rec.digest, "agree", "alice@example.test", "2026-09-24");
+    const gitSig = r.sshSign(alice, payload, "git");
+    const current = /signature: ("[^"]*")/.exec(text)![1];
+    writeFileSync(path, text.replace(current, JSON.stringify(gitSig)));
+    rec = await record(r);
+    expect(verdicts(rec)).toEqual(["alice@example.test:review-unattested:seal-signature-invalid"]);
+
+    // The same bytes in the review namespace do verify, which shows it was the namespace.
+    writeFileSync(path, text.replace(current, JSON.stringify(r.sshSign(alice, payload, REVIEW_SEAL_NAMESPACE))));
+    rec = await record(r);
+    expect(verdicts(rec)).toEqual(["alice@example.test:counted:attested"]);
+  });
+
+  test("--sign with no file uses git's ssh user.signingkey", async () => {
+    const { r, bob } = workspace("gitkey");
+    r.git(["config", "gpg.format", "ssh"]);
+    r.git(["config", "user.signingkey", bob.file]);
+    const doc = await review(r, "bob@example.test", true);
+    expect("error" in doc ? doc.error : null).toBeNull();
+    expect(verdicts(await record(r))).toEqual(["bob@example.test:counted:attested"]);
+  });
+
+  test("a key that can't sign is refused with review-sign-failed, and nothing is written", async () => {
+    const { r } = workspace("nokey");
+    const before = readFileSync(join(r.dir, FILE), "utf-8");
+    const doc = await review(r, "alice@example.test", join(r.dir, "no-such-key"));
+    expect("error" in doc && doc.error.code).toBe("review-sign-failed");
+    r.git(["config", "gpg.format", "openpgp"]);
+    const git = await review(r, "alice@example.test", true);
+    expect("error" in git && git.error.message).toMatch(/gpg\.format openpgp/);
+    expect(readFileSync(join(r.dir, FILE), "utf-8")).toBe(before);
+  });
+});
+
+describe.skipIf(!hasSshKeygen)("sealed verdicts with no signers file at base", () => {
+  test("an unsealed verdict counts, and a seal is checked for integrity and reported without gating", async () => {
+    const { r, alice, bob } = workspace("inactive", { signers: false });
+    await review(r, "carol");
+    await review(r, "alice@example.test", alice);
+    await review(r, "bob@example.test", bob, "abstain");
+    const path = join(r.dir, FILE);
+    // bob's abstain turned into an agree by hand: its seal no longer covers it.
+    writeFileSync(path, readFileSync(path, "utf-8").replace('verdict: "abstain"', 'verdict: "agree"'));
+    const rec = await record(r);
+    expect(verdicts(rec)).toEqual([
+      "carol:counted:seal-missing",
+      "alice@example.test:counted:seal-unverifiable",
+      "bob@example.test:counted:seal-signature-invalid",
+    ]);
+    expect(verdict(rec, 0).attested).toBeNull();
+    expect(verdict(rec, 1)).toMatchObject({ attested: null, attestation: { key: expect.stringMatching(/^SHA256:/), message: expect.stringMatching(/intact/) } });
+    expect(verdict(rec, 2).attested).toBe(false);
+    expect(rec.quorum).toMatchObject({ agreed: 3, met: true });
+  });
+});
+
+describe("--sign on the command line", () => {
+  test("takes a key file, or nothing for git's key", () => {
+    expect(parseArgs(["workspace", "records", "review", "ws-003", "--sign", "~/.ssh/id_ed25519", "--by", "a"]).sign).toBe("~/.ssh/id_ed25519");
+    expect(parseArgs(["workspace", "records", "review", "ws-003", "--sign", "--by", "a"]).sign).toBe(true);
+    expect(parseArgs(["workspace", "records", "review", "ws-003", "--by", "a", "--sign"]).sign).toBe(true);
+    expect(parseArgs(["workspace", "records", "review", "ws-003", "--by", "a"]).sign).toBeUndefined();
+  });
+
+  test("records new and amend refuse it: author seals are #2688", async () => {
+    const lines: string[] = [];
+    const log = console.log;
+    console.log = (s: string) => lines.push(s);
+    try {
+      for (const verb of ["new", "amend"]) {
+        const code = await runRecordsWrite({ args: { ...parseArgs(["workspace", "records", verb, "x", "--sign"]), extraPositional: verb, extraPositional2: "x" } } as never);
+        expect(code).toBe(1);
+      }
+    } finally {
+      console.log = log;
+    }
+    for (const l of lines) expect(JSON.parse(l).error).toMatchObject({ code: "write-usage-invalid", message: expect.stringMatching(/#2688/) });
+  });
+});