@intentius/chant 0.89.0 → 0.91.0

package/src/workspace/reason-codes.ts

@@ -57,6 +57,10 @@ export const REASONS = {
   "gates-no-ledger": "The checkout has no chant/lifecycle branch, so there is no gate ledger to read.",
   "gates-no-gate-ledger": "The branch has no gate ledger for the member: no run of it has reached a gate.",
   "gates-ledger-unreadable": "Reading the member's gate ledger failed, so no gate is listed.",
+  // A member's stewards status can't fully list (status, #2731).
+  "stewards-unreadable": "An *.op.ts file could not be imported, so a steward it declares may be missing.",
+  "stewards-conflict": "A steward was dropped: its name, or an Op it lists, belongs to another steward.",
+  "steward-runs-unreadable": "Reading an Op's run ledger failed, so its last run is null.",
   // A record that isn't valid (records).
   "record-unparseable": "No front matter, a YAML error or a value outside the JSON subset of YAML, or for a JSON kind a file that is not one object or repeats a member name.",
   "record-schema-invalid": "The record's front matter, or its JSON object, does not match the kind's schema.",
@@ -73,6 +77,7 @@ export const REASONS = {
   "record-supersedes-pending": "A supersedes link from a record whose state is weaker than the record it names, so the link has no effect yet.",
   "record-no-evidence": "The record's evidence list is empty: it cites nothing and pins no file. Information for a reviewer, never an error.",
   "review-undigested": "A verdict names no digest of the text it judged. It still counts, and an amendment does not stop it counting.",
+  "source-transcript-drift": "The record's source block pins a transcript by hash, the file it names can be read here, and its bytes hash to something else: it is not the transcript the record means.",
   // A work record that is valid but warned about (records and graph --intent, #2683).
   "work-needs-unknown": "A work record's needs list names a work id no record has, so the item stays blocked.",
   "work-implements-unknown": "A work record's implements list names a decision id no decision has.",
@@ -81,6 +86,10 @@ export const REASONS = {
   "work-done-unpinned": "A work record is done and its evidence list is empty: nothing shows the work was done.",
   "work-closed-without-date": "A work record is done or dropped and has no closing date.",
   "work-done-gap-open": "A work record is done, and the finding it came from still fires on its region. graph --intent raises it, and records does by walking that region.",
+  // An answer to a decision point that is valid but warned about (records, points, ws-058, #2739).
+  "answer-points-unreadable": "The points file the answer kind names can't be read, or is not valid.",
+  "answer-point-unknown": "The answer's point is not declared in the points file the answer kind names.",
+  "answer-point-changed": "The point's declaration changed since the question was asked, so the answer is to an older version of the question.",
   // A verdict the quorum does not count (records, #2671, #2672).
   "review-decider": "The verdict is the decider's own, and the quorum counts verdicts besides the decider's.",
   "review-agent": "The reviewer holds the agent role in the trust policy at base.",
@@ -114,10 +123,20 @@ export const REASONS = {
   "review-unsupported": "The kind's schema has no reviews field, so its records take no review.",
   "review-note-required": "A dissent was given with no note: a dissent needs a reason.",
   "review-sign-failed": "--sign was given and no seal could be made: the key can't be read or used, git names no ssh signing key, or ssh-keygen is not installed.",
+  "record-state-not-initial": "A record written through chant serve mcp gives a state other than the kind's first: a new record opens proposed, and a person moves it on.",
+  "source-harvest-not-proposed": "A harvested record (source.via harvest) was written in a state other than the kind's first: a harvest proposes, and a person decides.",
   "record-sign-failed": "--sign was given and no author seal could be made: the record names no author, the key can't be read or used, git names no ssh signing key, or ssh-keygen is not installed.",
   // A review given in a session (records review --session, #2693).
   "session-unknown": "--session names no session of a session kind whose subjects are the record's kind.",
   "session-not-open": "--session names a session in a closed state, which takes no more verdicts.",
+  // Decision points (points, points ask, points answer, ws-058, #2739).
+  "points-undeclared": "No record kind with an answers block is declared, or given with --kind, so there is no points file to ask.",
+  "points-invalid": "The points file an answer kind names can't be read, or does not match decision-points.schema.json and the rules checked in code.",
+  "point-unknown": "No points file declares the point asked, or the one an answer names.",
+  "point-inputs-invalid": "The inputs given to an ask are not a JSON object of the point's declared inputs.",
+  "point-decider-failed": "A model decider that fails closed (unreachable: fail) could not answer, so the ask wrote nothing.",
+  "answer-not-candidate": "The people's answer is not one of the question's candidates.",
+  "quorum-not-met": "Too few of the people who answered count toward the point's quorum: distinct, not holding the agent role, and holding one of its roles when it names any.",
   // records --since that fails (#2673).
   "since-rev-unknown": "--since names no commit, or a session with no opening revision and no commit that added it.",
   "since-session-unknown": "--since has the shape of a session id and names no commit, and no session the kind or the declaration reads has that id.",
@@ -156,6 +175,23 @@ export const REASONS = {
   "environments-none-declared": "The member's chant.config.ts declares no environments, so only local and the environments in its ledger are listed.",
   "environments-ledger-undeclared": "The member's ledger has releases in an environment its config's environments don't cover, so chant run --env would refuse it and it is not listed.",
   "environments-ledger-unreadable": "The chant/lifecycle branch exists and the member's ledger environments could not be listed.",
+  // A box that holds a credential (check, #2726). Each is also a WSP finding.
+  "box-credential-declared": "A file in a box member's directory carries a literal secret: a credential's shape, or a literal where a credential goes. A variable or secret-manager reference is not one.",
+  "box-capability-unbrokered": "A capability in a member's box block names no broker, so the box would hold its credential.",
+  // The work lease (chant workspace work claim|renew|release, #2732): why the command could not run.
+  "work-kind-missing": "No work kind to find the item in: --kind names a kind with no work block, or the declaration names no work kind.",
+  "work-kind-ambiguous": "More than one declared work kind has a record with the id, so --kind must name one.",
+  "work-item-unknown": "No work record has the id, so there is nothing to lease.",
+  "work-item-closed": "A claim on a work item in a closed state, such as done or dropped: there is no work left to claim.",
+  // The work lease: why a claim, renew or release was refused (exit 2).
+  "lease-held": "Someone holds a live lease on the work item: another worker, or, for a claim, the same one.",
+  "lease-not-held": "Nobody holds a live lease on the work item: it expired, was released or was never claimed.",
+  "lease-token-mismatch": "The live lease on the work item carries another fencing token than the one given.",
+  "lease-race": "Another writer changed the lease between this command's read and its write.",
+  "lease-push-rejected": "The remote refused the lease push: another clone claimed the item first, or the remote could not be reached.",
+  // A box whose isolation fails (check, #2727). Each is also a WSP finding.
+  "box-isolation-collision": "Two boxes on one host resolve to the same port, state path or cookie name, or two ports in one box share an offset.",
+  "box-isolation-literal": "A host's stateRoot or a box's state entry is a literal machine path instead of one derived from an environment reference and the box's name.",
   // The lineage lock (check).
   "lock-invalid": "The lineage lock can't be read.",
   "manual-step-open": "A scope in the lineage lock has an open manual step.",

package/src/workspace/record-assets.test.ts

@@ -18,6 +18,7 @@ import { constraintCovers, isWorkspacePath, memberHolding, WORKSPACE_PATH_PATTER
 import { pinFile, queryRecords, type RecordsDocument } from "./records-cli";
 import { parseFrontMatter, RECORD_WARNING_CODES, SEAL_WARNING_CODES } from "./records";
 import { WORK_WARNING_CODES } from "./work";
+import { ANSWER_WARNING_CODES } from "./points";
 import { workspaceGraph } from "./graph-cli";
 import graphSchema from "./graph.schema.json";
 import recordsSchema from "./records.schema.json";
@@ -170,8 +171,8 @@ describe("chant workspace records checks each pin", () => {
 
   test("the schema lists exactly the warning codes", () => {
     // A work kind's records carry the work warnings too (#2683), work-done-gap-open included since records walks a done item's region (#2686),
-    // and records adds record-unattested for an author seal under a signers file at base (#2688).
-    expect(recordsSchema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...SEAL_WARNING_CODES]);
+    // an answer kind's the answer warnings (ws-058), and records adds record-unattested for an author seal under a signers file at base (#2688).
+    expect(recordsSchema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...ANSWER_WARNING_CODES, ...SEAL_WARNING_CODES]);
   });
 
   test("records pin <path> prints the entry's path from the workspace root and the file's hash", () => {

package/src/workspace/record-assets.ts

@@ -81,7 +81,10 @@ export function checkPins(pins: { path: string; sha256: string }[], tree: Worksp
     const state: PinState = actual === null ? "missing" : actual === pin.sha256 ? "pinned" : "drifted";
     assets.push({ ...pin, actual, state });
     if (state === "missing") {
-      warnings.push({ code: "asset-missing", message: `evidence pins ${pin.path}, which does not exist${tree.label}` });
+      // Worded the same for the working tree and a revision (#2745): a missing
+      // file is missing either way, and `tree.label` would otherwise make the
+      // same finding read differently depending on which one was read.
+      warnings.push({ code: "asset-missing", message: `evidence pins ${pin.path}, which does not exist` });
     } else if (state === "drifted") {
       warnings.push({
         code: "asset-drift",

package/src/workspace/records-amend.schema.json

@@ -129,7 +129,8 @@
             "asset-stale",
             "record-supersedes-pending",
             "record-no-evidence",
-            "review-undigested"
+            "review-undigested",
+            "source-transcript-drift"
           ]
         },
         "message": {

package/src/workspace/records-cli.ts

@@ -92,6 +92,13 @@ export type RecordView = RecordEntry & {
   /** true when the record's seal verifies for its author against the signers at base; false when it fails, or is missing under an active policy; null when nothing here can say (#2688). */
   attested?: boolean | null;
   attestation?: VerdictAttestation;
+  /**
+   * For a work kind read in the working tree (#2732): the item's active work
+   * lease, or null when nobody holds one. Read from the local lease refs of
+   * the ledger owning the kind, without fetching. Absent under `--at`, since a
+   * lease is live state and not part of a revision.
+   */
+  lease?: { holder: string; token: string; acquiredAt: string; expiresAt: string } | null;
 };
 
 /** The role in the trust policy whose holders' verdicts the quorum does not count (#2671). */
@@ -304,6 +311,11 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
       ...(seals ? authorSeal(loaded.kind, r, policy, seals.checkRecordSeal) : {}),
     }));
     if (loaded.kind.work && query.workGaps !== false && top) await raiseWorkGaps(loaded, records, { root, workspaceRoot, at: query.at });
+    if (loaded.kind.work && at === null && top) {
+      const { activeWorkLeases } = await import("../lifecycle/work-lease");
+      const leases = await activeWorkLeases(loaded.file);
+      for (const r of records) if (r.id !== null) r.lease = leases.get(r.id) ?? null;
+    }
     return {
       $schema: RECORDS_OUTPUT_SCHEMA_ID,
       contract: RECORDS_CONTRACT_VERSION,
@@ -596,7 +608,8 @@ function formatRecords(records: RecordView[], summary: { total: number; valid: n
     if (r.ready !== undefined) {
       const blocked = (r.blockedBy ?? []).map((b) => `${b.id} (${b.state ?? "unknown"})`).join(", ");
       const implemented = (r.implements ?? []).map((d) => `${d.id} (${d.state ?? "unknown"})`).join(", ");
-      const status = [r.ready ? "ready" : blocked ? `blocked by ${blocked}` : "", implemented ? `implements ${implemented}` : ""].filter(Boolean).join("; ");
+      const held = r.lease ? `held by ${r.lease.holder} until ${r.lease.expiresAt}` : "";
+      const status = [r.ready ? "ready" : blocked ? `blocked by ${blocked}` : "", implemented ? `implements ${implemented}` : "", held].filter(Boolean).join("; ");
       if (status) lines.push(`${" ".repeat(idWidth + 2)}${status}`);
     }
     for (const reason of r.reasons) lines.push(`${" ".repeat(idWidth + 2)}${reason.code}: ${reason.message} (${r.path})`);
@@ -620,7 +633,7 @@ export async function runWorkspaceUnknown(ctx: CommandContext): Promise<number>
   console.error(
     formatError({
       message: sub ? `Unknown workspace subcommand: ${sub}` : "chant workspace needs a subcommand",
-      hint: `Workspace subcommands: audit, build, check, graph, init, lineage, lint, ls, records, status, upgrade, verify. Run "chant --help" for their options.`,
+      hint: `Workspace subcommands: audit, build, check, graph, init, lineage, lint, ls, records, status, upgrade, verify, work. Run "chant --help" for their options.`,
     }),
   );
   return 1;

package/src/workspace/records-close.schema.json

@@ -129,7 +129,8 @@
             "asset-stale",
             "record-supersedes-pending",
             "record-no-evidence",
-            "review-undigested"
+            "review-undigested",
+            "source-transcript-drift"
           ]
         },
         "message": {

package/src/workspace/records-contract.test.ts

@@ -13,6 +13,7 @@ import { afterAll, describe, expect, test } from "vitest";
 import { queryRecords, RECORDS_CONTRACT_VERSION, RECORDS_OUTPUT_SCHEMA_ID, type RecordsDocument } from "./records-cli";
 import { READ_ERROR_CODES, RECORD_REASON_CODES, RECORD_WARNING_CODES, recordTextDigest, REVIEW_REASON_CODES, SEAL_WARNING_CODES } from "./records";
 import { WORK_WARNING_CODES } from "./work";
+import { ANSWER_WARNING_CODES } from "./points";
 import schema from "./records.schema.json";
 import { PROVENANCE_LEVELS } from "./trust/attestor";
 
@@ -149,8 +150,8 @@ describe("records output schema", () => {
 
   test("lists exactly the warning codes the code can return", () => {
     // A work kind's records carry the work warnings too (#2683), work-done-gap-open included since records walks a done item's region (#2686),
-    // and records adds record-unattested for an author seal under a signers file at base (#2688).
-    expect(schema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...SEAL_WARNING_CODES]);
+    // an answer kind's the answer warnings (ws-058), and records adds record-unattested for an author seal under a signers file at base (#2688).
+    expect(schema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...ANSWER_WARNING_CODES, ...SEAL_WARNING_CODES]);
   });
 
   test("every failure validates with its code", async () => {

package/src/workspace/records-new.schema.json

@@ -117,7 +117,8 @@
             "asset-stale",
             "record-supersedes-pending",
             "record-no-evidence",
-            "review-undigested"
+            "review-undigested",
+            "source-transcript-drift"
           ]
         },
         "message": {
@@ -161,6 +162,8 @@
                 "record-id-unallocatable",
                 "record-path-unmatched",
                 "record-sign-failed",
+                "source-harvest-not-proposed",
+                "record-state-not-initial",
                 "record-unparseable",
                 "record-schema-invalid",
                 "record-id-duplicate",

package/src/workspace/records-review.schema.json

@@ -212,7 +212,8 @@
             "asset-stale",
             "record-supersedes-pending",
             "record-no-evidence",
-            "review-undigested"
+            "review-undigested",
+            "source-transcript-drift"
           ]
         },
         "message": {

package/src/workspace/records-write.ts

@@ -67,6 +67,8 @@ export const NEW_ERROR_CODES = [
   "record-id-unallocatable",
   "record-path-unmatched",
   "record-sign-failed",
+  "source-harvest-not-proposed",
+  "record-state-not-initial",
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 
@@ -354,7 +356,7 @@ export async function readAll(o: Opened, source: RecordSource): Promise<RecordEn
     const subjectKind = await loadRecordKind(resolve(dirname(o.loaded.file), o.loaded.kind.session.subjects.kind), o.root);
     subjects = { records: (await readRecords(subjectKind, { root: o.root, source })).records, reviews: subjectKind.kind.reviews?.field ?? "reviews" };
   }
-  return (await readRecords(o.loaded, { root: o.root, source, assets, ...(subjects ? { subjects } : {}) })).records;
+  return (await readRecords(o.loaded, { root: o.root, source, assets, workspaceRoot: o.workspaceRoot, ...(subjects ? { subjects } : {}) })).records;
 }
 
 /** `base` with the file at `path` holding `text`, added to its directory when new. */
@@ -441,6 +443,24 @@ function refuseRevisionFields(kind: LoadedRecordKind["kind"], fields: Record<str
   }
 }
 
+/**
+ * Refuse a harvested record in any state but the kind's first (#2708): a
+ * record whose source block says `via: "harvest"` came out of a transcript
+ * after the fact, so it is a proposal, and a person decides it.
+ */
+function refuseHarvestedDecision(kind: LoadedRecordKind["kind"], fields: Record<string, unknown>): void {
+  if (!kind.source || !kind.states || kind.stateField === undefined) return;
+  const block = fields[kind.source.field];
+  if (block === null || typeof block !== "object" || Array.isArray(block) || (block as Record<string, unknown>).via !== "harvest") return;
+  const opens = kind.states[0];
+  const state = fields[kind.stateField];
+  if (state === opens) return;
+  throw new RecordWriteError(
+    "source-harvest-not-proposed",
+    `${kind.source.field}.via is harvest, and a harvested ${kind.name} opens ${opens}, not ${JSON.stringify(state ?? null)}: write it with ${kind.stateField} "${opens}", and let the person who decides it move it on with chant workspace records amend or review`,
+  );
+}
+
 /**
  * `text`, the record `data` holds, with its author sealed (#2688): an ssh
  * signature by the key `sign` names over the record id, the digest of
@@ -594,14 +614,71 @@ export interface NewRecordOptions {
   sign?: string | true;
 }
 
+/**
+ * A write made through a channel other than the command line (#2707), such
+ * as `chant serve mcp`. The CLI never sets one.
+ */
+export interface WriteChannel {
+  /**
+   * Laid over the kind's source block (#2708) when the kind declares one:
+   * `via` and `client`. A new record gets the block, made when the fields
+   * give none; an amendment only when its fields set the block.
+   */
+  source: Record<string, unknown>;
+  /** A new record opens in the kind's first state: filled in when the fields give no state, and refused with record-state-not-initial when they give another. */
+  opensInitial?: boolean;
+}
+
+/** What a channel's write adds to the command line's: who the author is, and how it came. */
+export interface ChannelOptions {
+  /** The record's author, written to the kind's `reviews.decider` field: the person or agent that decided. */
+  by?: string;
+  through?: WriteChannel;
+}
+
+/** `fields` with the channel's author and source laid over them (#2707). `isNew` for `records new`. */
+function applyChannel(o: Opened, fields: Record<string, unknown>, opts: ChannelOptions, isNew: boolean, flag: string): Record<string, unknown> {
+  const { kind } = o.loaded;
+  const out = { ...fields };
+  if (opts.by !== undefined) {
+    if (!kind.reviews) throw new RecordWriteError("write-usage-invalid", `by names a record's author, the kind's reviews.decider field, and the ${kind.name} kind declares no reviews`);
+    if (opts.by.trim() === "") throw new RecordWriteError("write-usage-invalid", "by needs the name of the person or agent that decided");
+    const f = kind.reviews.decider;
+    if (out[f] !== undefined && out[f] !== null && out[f] !== opts.by) {
+      throw new RecordWriteError("write-input-invalid", `the fields given with ${flag} set ${f} to ${JSON.stringify(out[f])}, and by names ${JSON.stringify(opts.by)}: give one author`);
+    }
+    out[f] = opts.by;
+  }
+  const through = opts.through;
+  if (!through) return out;
+  if (isNew && through.opensInitial && kind.states && kind.stateField !== undefined) {
+    const first = kind.states[0];
+    const state = out[kind.stateField];
+    if (state === undefined) out[kind.stateField] = first;
+    else if (state !== first) {
+      throw new RecordWriteError(
+        "record-state-not-initial",
+        `a new ${kind.name} opens ${first}, and the fields give ${kind.stateField} ${JSON.stringify(state)}: write it ${first}, and let the person who decides it move it on with a review or an amendment`,
+      );
+    }
+  }
+  if (kind.source && (isNew || kind.source.field in out)) {
+    const f = kind.source.field;
+    const block = out[f];
+    if (block === undefined || block === null) out[f] = { ...through.source };
+    else if (typeof block === "object" && !Array.isArray(block)) out[f] = { ...(block as Record<string, unknown>), ...through.source };
+  }
+  return out;
+}
+
 /** `records new`: write one new record from validated fields, sealed by its author with `sign`. */
-export async function newRecord(opts: NewRecordOptions): Promise<NewDocument> {
+export async function newRecord(opts: NewRecordOptions & ChannelOptions): Promise<NewDocument> {
   try {
     if (opts.prefix !== undefined && !/^[A-Za-z][A-Za-z0-9]*$/.test(opts.prefix)) {
       throw new RecordWriteError("write-usage-invalid", `--prefix takes letters and digits, starting with a letter, not ${JSON.stringify(opts.prefix)}`);
     }
-    const fields = parseFields(opts.fields, "--from");
     const o = await open(opts.kind, opts.cwd);
+    const fields = applyChannel(o, parseFields(opts.fields, "--from"), opts, true, "--from");
     const { kind, schema } = o.loaded;
     refuseSealField(o, fields, "--from");
     refuseRevisionFields(kind, fields, {}, "--from");
@@ -617,6 +694,7 @@ export async function newRecord(opts: NewRecordOptions): Promise<NewDocument> {
       if (taken) throw new RecordWriteError("record-id-taken", `id ${given} is already used by ${taken.path}; ids are never reused, so leave ${idField} out to have the next one allocated`);
       id = given;
     }
+    refuseHarvestedDecision(kind, fields);
     // A session records the commit it opened at (#2693): HEAD now, or null before the first commit.
     const opened = kind.session?.openedRev ? { [kind.session.openedRev]: headCommit(o.root) } : {};
     const full = { ...fields, ...opened, [idField]: id };
@@ -676,10 +754,10 @@ export interface AmendRecordOptions {
  * changes only the reviews leaves the digest, and the seal, as they were.
  * `--sign` with nothing to change seals the record as it is.
  */
-export async function amendRecord(opts: AmendRecordOptions): Promise<AmendDocument> {
+export async function amendRecord(opts: AmendRecordOptions & ChannelOptions): Promise<AmendDocument> {
   try {
-    const given = parseFields(opts.fields, "--set");
     const o = await open(opts.kind, opts.cwd);
+    const given = applyChannel(o, parseFields(opts.fields, "--set"), opts, false, "--set");
     const { kind } = o.loaded;
     refuseSealField(o, given, "--set");
     const before = await readAll(o, o.source);
@@ -922,7 +1000,7 @@ function usage(schema: string, message: string): WriteFailure<"write-usage-inval
  * message the verb has always given; several are refused, since a write
  * never guesses which kind it means.
  */
-function declaredWriteKind(schema: string, cwd: string, missing: string): string | WriteFailure<"write-usage-invalid"> {
+export function declaredWriteKind(schema: string, cwd: string, missing: string): string | WriteFailure<"write-usage-invalid"> {
   let kinds: ReturnType<typeof declaredKindFiles>;
   try {
     kinds = declaredKindFiles(cwd);
@@ -978,7 +1056,7 @@ function readInput(schema: string, flag: string, value: string | undefined, cwd:
  * The session kind `records close` goes through when none is named (#2693):
  * the one session kind the declaration names.
  */
-async function declaredSessionKind(schema: string, cwd: string): Promise<string | WriteFailure<"write-usage-invalid">> {
+export async function declaredSessionKind(schema: string, cwd: string): Promise<string | WriteFailure<"write-usage-invalid">> {
   const kinds = (await findSessionKinds(cwd)).map((k) => k.file);
   if (kinds.length === 1) return kinds[0];
   if (kinds.length === 0) return usage(schema, "--kind <session kind file> is required: the declaration names no session kind");

package/src/workspace/records.schema.json

@@ -177,6 +177,10 @@
           "description": "Added in contract 1 by #2683, on every parsed record of a work kind. Each decision the record implements, with its state now; null for an id no decision has.",
           "type": "array",
           "items": { "$ref": "#/$defs/workLink" }
+        },
+        "lease": {
+          "description": "Added in contract 1 by #2732, on every record of a work kind with an id, read in the working tree (absent under --at). The item's active work lease (chant workspace work claim), or null when nobody holds one live. Read from the local lease refs, refs/chant/lease/[_members/<member>/]work/<id> and the remote's as last fetched, of the ledger owning the work kind file; records never fetches.",
+          "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/workLease" }]
         }
       },
       "allOf": [
@@ -187,6 +191,16 @@
         }
       ]
     },
+    "workLease": {
+      "type": "object",
+      "required": ["holder", "token", "acquiredAt", "expiresAt"],
+      "properties": {
+        "holder": { "type": "string", "description": "Who holds the lease, as --holder gave it." },
+        "token": { "type": "string", "description": "The fencing token: new on every claim, kept by every renew." },
+        "acquiredAt": { "type": "string", "description": "When the lease was claimed, ISO 8601." },
+        "expiresAt": { "type": "string", "description": "When the lease expires unless renewed, ISO 8601." }
+      }
+    },
     "asset": {
       "type": "object",
       "required": ["path", "sha256", "actual", "state"],
@@ -209,6 +223,7 @@
             "record-supersedes-pending",
             "record-no-evidence",
             "review-undigested",
+            "source-transcript-drift",
             "work-needs-unknown",
             "work-implements-unknown",
             "work-needs-cycle",
@@ -216,6 +231,9 @@
             "work-done-unpinned",
             "work-closed-without-date",
             "work-done-gap-open",
+            "answer-points-unreadable",
+            "answer-point-unknown",
+            "answer-point-changed",
             "record-unattested"
           ]
         },

package/src/workspace/records.ts

@@ -29,8 +29,10 @@ import type { ReasonCode } from "./reason-codes";
 import { checkPins, pinEntries, type AssetPin } from "./record-assets";
 import { joinSessions, type SessionCitation } from "./record-sessions";
 import type { RecordSource } from "./record-source";
+import { sourceBlock, sourceBlockProblems, transcriptDrift } from "./source-block";
 import type { WorkspaceTree } from "./tree";
 import type { DecisionWork, WorkLink, WorkWarningCode } from "./work";
+import type { AnswerWarningCode } from "./points";
 
 // ── Reason codes ─────────────────────────────────────────────────────────────
 
@@ -84,6 +86,12 @@ export const RECORD_WARNING_CODES = [
    * amendment does not stop it counting (#2672).
    */
   "review-undigested",
+  /**
+   * The kind's source block pins a transcript by hash, the file it names can
+   * be read here, and its bytes hash to something else: it is not the
+   * transcript the record means (#2708).
+   */
+  "source-transcript-drift",
 ] as const satisfies readonly ReasonCode[];
 export type RecordWarningCode = (typeof RECORD_WARNING_CODES)[number];
 
@@ -168,8 +176,8 @@ export interface VerdictAttestation {
 }
 
 export interface RecordWarning {
-  /** A work kind's records also carry the codes of `WORK_WARNING_CODES` (#2683), and `records` adds `SEAL_WARNING_CODES` (#2688). */
-  code: RecordWarningCode | WorkWarningCode | SealWarningCode;
+  /** A work kind's records also carry the codes of `WORK_WARNING_CODES` (#2683), an answer kind's those of `ANSWER_WARNING_CODES` (#2739), and `records` adds `SEAL_WARNING_CODES` (#2688). */
+  code: RecordWarningCode | WorkWarningCode | SealWarningCode | AnswerWarningCode;
   message: string;
 }
 
@@ -299,6 +307,15 @@ export const recordKindSchema = z
      * `withdrawn_on`. Optional.
      */
     reviews: z.object({ field: z.string().min(1), decider: z.string().min(1) }).strict().optional(),
+    /**
+     * The front-matter object that says where a record came from, opted in
+     * to the stored source block (#2708): `via`, `client`, `harness`,
+     * `model`, `session`, `turns` and `transcript`, beside the kind's own
+     * fields in the same object. With it, those fields are checked for their
+     * shapes, a write with `via: "harvest"` must open in the kind's first
+     * state, and `records` warns `source-transcript-drift`. Optional.
+     */
+    source: z.object({ field: z.string().min(1) }).strict().optional(),
     /**
      * A review-session kind (#2673, #2650 C10): the front-matter list of the
      * verdicts a session produced, the field that seals a closed session, and
@@ -344,6 +361,17 @@ export const recordKindSchema = z
       })
       .strict()
       .optional(),
+    /**
+     * An answer kind (ws-058, #2739): the decision points file its records
+     * answer, relative to this kind file. The records are written by `chant
+     * workspace points ask` and `points answer` in the shape of
+     * `point-answer.schema.json`, with an `id`, the states `escalated`,
+     * `proposed` and `answered`, and `answered` closed. With it, `records`
+     * warns about an answer whose point is gone or changed, `check` validates
+     * the points file (WSP116), and `points` lists the open questions.
+     * Optional.
+     */
+    answers: z.object({ points: z.string().min(1) }).strict().optional(),
   })
   .strict()
   .refine((k) => (k.idField === undefined) !== (k.idFrom === undefined), {
@@ -377,7 +405,23 @@ export const recordKindSchema = z
   .refine((k) => !k.work || (k.states !== undefined && k.states.includes(k.work.open) && k.states.includes(k.work.done)), {
     message: "a work kind must have states, and its work open and done states must be listed in them",
     path: ["work"],
-  });
+  })
+  .refine(
+    (k) =>
+      !k.answers ||
+      (k.format === "markdown-front-matter" &&
+        k.idField === "id" &&
+        k.stateField === "state" &&
+        ANSWER_STATES.every((s) => k.states?.includes(s)) &&
+        (k.closedStates ?? []).includes("answered")),
+    {
+      message: 'an answer kind is markdown-front-matter with idField "id", stateField "state", the states escalated, proposed and answered, and answered closed',
+      path: ["answers"],
+    },
+  );
+
+/** The states of an answer kind's records (ws-058): open for people, proposed by a model, answered by a table, people, or a confirmed proposal. */
+export const ANSWER_STATES = ["escalated", "proposed", "answered"] as const;
 
 export type RecordKind = z.infer<typeof recordKindSchema>;
 
@@ -1076,6 +1120,8 @@ export async function readRecords(loaded: LoadedRecordKind, options: ReadRecords
   const match = new RegExp(kind.location.match);
   const validate = await compileSchema(loaded.schema, loaded.refs);
   const workspaceRoot = options.workspaceRoot ?? ".";
+  // Where a relative transcript path resolves (#2708): the workspace root in the working tree.
+  const workspaceDir = workspaceRoot === "." ? options.root : resolve(options.root, ...workspaceRoot.split("/"));
 
   const entries: RecordEntry[] = [];
   const texts = new Map<string, string>();
@@ -1127,6 +1173,16 @@ export async function readRecords(loaded: LoadedRecordKind, options: ReadRecords
     if (!result.ok) {
       entry.reasons.push({ code: "record-schema-invalid", message: result.errors.join("; ") });
     }
+    if (kind.source) {
+      // The stored source block (#2708): its proposal fields' shapes, and the transcript it pins.
+      const block = sourceBlock(fm.value, kind.source.field);
+      if (block) {
+        const problems = sourceBlockProblems(block, kind.source.field);
+        if (problems.length > 0) entry.reasons.push({ code: "record-schema-invalid", message: problems.join("; ") });
+        const drift = transcriptDrift(block, kind.source.field, workspaceDir);
+        if (drift) entry.warnings.push({ code: "source-transcript-drift", message: drift });
+      }
+    }
     if (kind.pins) {
       const cited = fm.value[kind.pins.field];
       if (Array.isArray(cited) && cited.length === 0) {
@@ -1222,6 +1278,8 @@ export async function readRecords(loaded: LoadedRecordKind, options: ReadRecords
   joinSessions(kind, entries, texts, options.subjects ?? null);
   // A work kind's links, ready and blocked (#2683), from every record before --current.
   const work = kind.work ? await (await import("./work")).applyWork(loaded, entries, options) : undefined;
+  // An answer kind's points (ws-058): an answer whose point is gone or changed is warned about.
+  if (kind.answers) (await import("./points")).applyAnswers(loaded, entries, options);
 
   for (const e of entries) e.valid = e.reasons.length === 0;
   const records = options.current ? entries.filter((e) => e.supersededBy === null) : entries;