@intentius/chant 0.90.0 → 0.93.0

package/src/op/runtime.ts

@@ -18,23 +18,27 @@
 
 import type { OpConfig } from "./types";
 import type { StepRecord, OpRunResult } from "./local-executor";
+import type { WaitingPoint } from "./steward-points";
 import type { GateResolutionRecord } from "../lifecycle/gate-ledger";
 import type { RunComponentsOptions, RunComponentsResult } from "../components/cli-support";
 
 /**
  * How a run ended, or that it has not. `gated` is the state a run reaches when
- * a gate has no recorded resolution — a fact, not a wait (#2119).
+ * a gate has no recorded resolution — a fact, not a wait (#2119). `waiting` is
+ * the state it reaches when an activity asked a decision point that is still
+ * open (#2749), a fact of the same kind: a person answers the question, and
+ * the next run reads the answer.
  *
  * This is the coarse state a *runtime* reports. The ledger records the
  * executor's own three-state outcome instead ({@link OpRunRecord.status}),
  * which has no `running` or `cancelled`: a record is only written once a run
  * has settled.
  */
-export type OpRunState = "running" | "completed" | "failed" | "gated" | "cancelled";
+export type OpRunState = "running" | "completed" | "failed" | "gated" | "waiting" | "cancelled";
 
 /** Map a settled run's ledger status onto the coarser runtime state. */
 export function runStateOf(status: OpRunRecord["status"]): OpRunState {
-  return status === "ok" ? "completed" : status === "gated" ? "gated" : "failed";
+  return status === "ok" ? "completed" : status === "gated" ? "gated" : status === "waiting" ? "waiting" : "failed";
 }
 
 /** One step's outcome as the run ledger keeps it — `StepRecord` minus the fields only a live renderer needs. */
@@ -51,6 +55,10 @@ export interface OpRunStepRecord {
   error?: string;
   /** Why a gate declined a standing approval that was for another plan (#2300) — see {@link StepRecord.refusal}. */
   refusal?: string;
+  /** The open decision point this step asked (#2749), for a step skipped because it is waiting on one. */
+  point?: WaitingPoint;
+  /** The gate this step's command stopped at (#2779), for a step skipped because of it. */
+  gate?: { op: string; gate: string };
 }
 
 /** One phase's steps and the verdict they add up to. */
@@ -81,8 +89,10 @@ export interface OpRunStatus {
   records?: StepRecord[];
   /** The executor's own result, when the runtime is executing in this process. */
   result?: OpRunResult;
-  /** The gate this run is waiting on, when `state` is `gated`. */
-  gate?: { name: string; since: string };
+  /** The gate this run is waiting on, when `state` is `gated`; `op` names the op it is recorded under when that isn't the run's own (#2779). */
+  gate?: { name: string; since: string; op?: string };
+  /** The open decision point this run is waiting on, when `state` is `waiting` (#2749). */
+  point?: WaitingPoint & { since: string };
   /** Free-text detail for a failed run. */
   error?: string;
 }
@@ -117,15 +127,28 @@ export interface OpRunRecord {
    * failure: the run reached a gate nobody has approved, recorded the fact,
    * and stopped (#2119).
    */
-  status: "ok" | "fail" | "gated";
+  status: "ok" | "fail" | "gated" | "waiting";
   /** The Op's own `labels`, copied at run time. */
   labels: Record<string, string>;
   /** Every `outcomeAttribute` the run captured, name → value. */
   outcomes: Record<string, unknown>;
   /** Per-phase, per-step status, in execution order. */
   phases: OpRunPhaseRecord[];
-  /** The gate the run stopped on, for `status: "gated"`. */
-  gate?: { name: string; since: string };
+  /**
+   * The gate the run stopped on, for `status: "gated"`. `op` is set when the
+   * gate is recorded under another op than the run's (#2779): a step whose
+   * command stopped at its own gate, such as `chant workspace upgrade`'s
+   * `workspace-upgrade` / `<scope>`.
+   */
+  gate?: { name: string; since: string; op?: string };
+  /**
+   * The open decision point the run stopped on, for `status: "waiting"`
+   * (#2749): the answer record's id, the point, its state then, and when the
+   * run stopped. `points --open` and hud read the question itself.
+   */
+  point?: WaitingPoint & { since: string };
+  /** The steward whose turn the run was, when a steward ran it (#2749). */
+  steward?: string;
 }
 
 /** An {@link OpRunRecord} before the ledger stamps its version and mints an id. */
@@ -156,6 +179,12 @@ export interface OpRunStartOptions {
   progress?: (record: StepRecord) => void;
   /** Aborts in-flight work (Ctrl-C). */
   signal?: AbortSignal;
+  /**
+   * For an Op that declares `workLease` (#2748): the work item this run is
+   * for (`--work <id>`) and who holds its lease (`--holder`). Only the local
+   * runtime takes it; a hosted run's lease is taken where the run executes.
+   */
+  work?: { item?: string; holder?: string };
 }
 
 /**

package/src/op/runtimes/local.ts

@@ -52,7 +52,8 @@ function statusFrom(
     endedAt: new Date().toISOString(),
     records: result.records,
     result,
-    ...(result.gate ? { gate: { name: result.gate.gate, since: result.gate.timestamp } } : {}),
+    ...(result.gate ? { gate: { name: result.gate.gate, since: result.gate.timestamp, ...(result.gate.op !== op ? { op: result.gate.op } : {}) } } : {}),
+    ...(result.record.point ? { point: result.record.point } : {}),
   };
 }
 
@@ -70,6 +71,7 @@ function statusFromRecord(record: OpRunRecord): OpRunStatus {
     startedAt: record.started,
     endedAt: record.ended,
     ...(record.gate ? { gate: record.gate } : {}),
+    ...(record.point ? { point: record.point } : {}),
   };
 }
 
@@ -166,6 +168,9 @@ export function createLocalOpRuntime(opts: { projectPath?: string } = {}): OpRun
                     `appended to the run ledger: ${err instanceof Error ? err.message : String(err)}\n`,
                 ),
               ...(startOpts.progress ? { onRecord: startOpts.progress } : {}),
+              ...(startOpts.work ? { work: startOpts.work } : {}),
+              onWorkLeaseWarning: (message) =>
+                process.stderr.write(`warning: "${op.name}" could not renew its work lease, retrying at the next beat: ${message}\n`),
             },
           );
           const status = statusFrom(op.name, runId, startedAt, result);

package/src/op/source-archive.ts

@@ -0,0 +1,161 @@
+/**
+ * A source tree as a release artifact (#2782): one directory of a commit,
+ * archived with `git archive`, and read back only when its bytes still hash
+ * to the digest a gate approved.
+ *
+ * `git archive <commit> -- <dir>` gives every entry the commit's own
+ * timestamp, so the same commit always archives to the same bytes, and the
+ * archive's sha256 names the tree exactly. A release plan carries that digest,
+ * the ship gate approves the plan, and whatever ships the release reads the
+ * archive through {@link readSourceArchive}, which refuses bytes that do not
+ * hash to the approved digest.
+ *
+ * Pure except for the git and file reads each function names.
+ */
+
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+
+/** One file of an archived tree. */
+export interface SourceFile {
+  /** Its path inside the archived directory, with `/` separators. */
+  path: string;
+  /** Whether git records it executable. */
+  executable: boolean;
+  data: Buffer;
+}
+
+/** A directory of a commit, archived. */
+export interface SourceArchive {
+  /** `sha256:<hex>` of the archive's bytes. */
+  digest: string;
+  /** Where the archive was written. */
+  archive: string;
+  /** The commit it was archived from. */
+  commit: string;
+  /** The archived directory, relative to the repository root (`.` for the root). */
+  dir: string;
+  /** Files in it. */
+  files: number;
+  /** Size of the archive in bytes. */
+  bytes: number;
+}
+
+export const sha256Digest = (data: Buffer | string): string => `sha256:${createHash("sha256").update(data).digest("hex")}`;
+
+function git(cwd: string, args: string[]): Buffer {
+  return execFileSync("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] });
+}
+
+/**
+ * Archive `dir` (relative to `cwd`) as committed at `ref` (default HEAD) to
+ * `out` (default `<cwd>/dist/releases/<commit>.tar`). Uncommitted changes are
+ * not in it: a release ships what is committed. Running it again for the same
+ * commit writes the same bytes.
+ */
+export function archiveSourceTree(opts: { dir: string; ref?: string; out?: string; cwd?: string }): SourceArchive {
+  const cwd = resolve(opts.cwd ?? process.cwd());
+  // git names the root by its real path, so the directory is resolved the same way.
+  const root = realpathSync(git(cwd, ["rev-parse", "--show-toplevel"]).toString("utf-8").trim());
+  const commit = git(cwd, ["rev-parse", "--verify", `${opts.ref ?? "HEAD"}^{commit}`]).toString("utf-8").trim();
+  const target = resolve(realpathSync(cwd), opts.dir);
+  const dir = relative(root, target).split("\\").join("/") || ".";
+  if (dir.startsWith("..") || isAbsolute(dir)) throw new Error(`${opts.dir} is outside the repository at ${root}`);
+  const spec = dir === "." ? commit : `${commit}:${dir}`;
+  try {
+    git(root, ["cat-file", "-e", spec]);
+  } catch {
+    throw new Error(`${dir} is not in commit ${commit.slice(0, 12)}: commit it before releasing it`);
+  }
+  const data = git(root, ["archive", "--format=tar", commit, "--", dir]);
+  const archive = resolve(cwd, opts.out ?? join("dist", "releases", `${commit}.tar`));
+  mkdirSync(dirname(archive), { recursive: true });
+  writeFileSync(archive, data);
+  const files = tarEntries(data).filter((e) => e.type === "file").length;
+  return { digest: sha256Digest(data), archive, commit, dir, files, bytes: data.length };
+}
+
+interface TarEntry {
+  type: "file" | "dir" | "symlink" | "other";
+  path: string;
+  mode: number;
+  data: Buffer;
+}
+
+const field = (block: Buffer, at: number, len: number): string => {
+  const raw = block.subarray(at, at + len);
+  const end = raw.indexOf(0);
+  return raw.subarray(0, end < 0 ? raw.length : end).toString("utf-8");
+};
+const octal = (block: Buffer, at: number, len: number): number => parseInt(field(block, at, len).trim() || "0", 8);
+
+/** The records of a pax header: `<len> key=value\n`. */
+function paxRecords(data: Buffer): Record<string, string> {
+  const out: Record<string, string> = {};
+  let at = 0;
+  while (at < data.length) {
+    const space = data.indexOf(0x20, at);
+    if (space < 0) break;
+    const len = parseInt(data.subarray(at, space).toString("utf-8"), 10);
+    if (!Number.isFinite(len) || len <= 0) break;
+    const record = data.subarray(space + 1, at + len - 1).toString("utf-8");
+    const eq = record.indexOf("=");
+    if (eq > 0) out[record.slice(0, eq)] = record.slice(eq + 1);
+    at += len;
+  }
+  return out;
+}
+
+/** The entries of a ustar/pax archive, as `git archive` writes one. */
+function tarEntries(tar: Buffer): TarEntry[] {
+  const out: TarEntry[] = [];
+  let at = 0;
+  let pax: Record<string, string> = {};
+  while (at + 512 <= tar.length) {
+    const header = tar.subarray(at, at + 512);
+    if (header.every((b) => b === 0)) break;
+    const size = octal(header, 124, 12);
+    const flag = String.fromCharCode(header[156] || 0x30);
+    const data = tar.subarray(at + 512, at + 512 + size);
+    at += 512 + Math.ceil(size / 512) * 512;
+    if (flag === "x") {
+      pax = paxRecords(data);
+      continue;
+    }
+    if (flag === "g") continue;
+    const prefix = field(header, 345, 155);
+    const name = pax.path ?? (prefix ? `${prefix}/${field(header, 0, 100)}` : field(header, 0, 100));
+    pax = {};
+    const type = flag === "0" || flag === "\0" || flag === "7" ? "file" : flag === "5" ? "dir" : flag === "2" ? "symlink" : "other";
+    out.push({ type, path: name, mode: octal(header, 100, 8), data: Buffer.from(data) });
+  }
+  return out;
+}
+
+/**
+ * The files of an archive `archiveSourceTree` wrote, relative to the directory
+ * it archived, once its bytes hash to `digest`. Throws, naming both digests,
+ * when they do not: whatever would ship them is not what was approved.
+ *
+ * A symbolic link in the tree is refused rather than followed or dropped.
+ */
+export function readSourceArchive(opts: { archive: string; digest: string; dir?: string }): SourceFile[] {
+  const data = readFileSync(opts.archive);
+  const actual = sha256Digest(data);
+  if (actual !== opts.digest) {
+    throw new Error(`${opts.archive} is ${actual}, not the approved ${opts.digest}: it is not the tree the release was planned from`);
+  }
+  const entries = tarEntries(data);
+  const dir = opts.dir && opts.dir !== "." ? `${opts.dir.replace(/\/+$/, "")}/` : "";
+  const files: SourceFile[] = [];
+  for (const e of entries) {
+    if (e.type === "dir") continue;
+    if (!e.path.startsWith(dir)) throw new Error(`${opts.archive} holds ${e.path}, outside ${dir || "its root"}`);
+    const path = e.path.slice(dir.length);
+    if (e.type !== "file") throw new Error(`${opts.archive} holds ${path}, which is not a regular file; a source release ships regular files only`);
+    files.push({ path, executable: (e.mode & 0o111) !== 0, data: e.data });
+  }
+  return files;
+}

package/src/op/step-output-ref.ts

@@ -87,6 +87,7 @@
 
 import { z } from "zod";
 import type { ActivityStep, OpConfig, PhaseDefinition } from "./types";
+import { WORK_LEASE_STEP_ID } from "./types";
 import { pathExistsInSchema, schemaAtPath, primitiveKindOf, type ActivityContract, type ActivityContractIssue } from "./activity-contract";
 
 const STEP_OUTPUT_REF_BRAND = Symbol.for("chant.op.stepOutputRef");
@@ -308,7 +309,7 @@ function indexById(locations: StepLocation[]): { byId: Map<string, StepLocation>
  *    the same parallel phase).
  */
 export function validateStepOutputRefScope(
-  config: Pick<OpConfig, "name" | "phases" | "onFailure">,
+  config: Pick<OpConfig, "name" | "phases" | "onFailure"> & Partial<Pick<OpConfig, "workLease">>,
 ): ActivityContractIssue[] {
   const issues: ActivityContractIssue[] = [];
 
@@ -339,6 +340,9 @@ export function validateStepOutputRefScope(
   for (const consumer of locations) {
     const refs = collectStepOutputRefs(consumer.step.args);
     for (const ref of refs) {
+      // The run's work lease (#2748) is published under a reserved id once it
+      // is claimed; an Op that declares one may reference it from any step.
+      if (config.workLease && ref.step === WORK_LEASE_STEP_ID) continue;
       if (duplicateIds.has(ref.step)) {
         issues.push({
           opName: config.name,
@@ -395,7 +399,7 @@ export function validateStepOutputRefScope(
  *    schema (an empty `path` — the whole return value — is always valid).
  */
 export function validateStepOutputRefs(
-  config: Pick<OpConfig, "name" | "phases" | "onFailure">,
+  config: Pick<OpConfig, "name" | "phases" | "onFailure"> & Partial<Pick<OpConfig, "workLease">>,
   contracts: ReadonlyMap<string, ActivityContract>,
 ): ActivityContractIssue[] {
   const issues = validateStepOutputRefScope(config);

package/src/op/steward-points.test.ts

@@ -0,0 +1,313 @@
+/**
+ * Decision points reached in a steward's turn (#2749): the model call goes
+ * through the steward's brokered capability, an open question stops the run
+ * as `waiting` and stays open in the workspace for a person, the steward's
+ * turn never answers it, and the local steward resumes the Op on the first
+ * round after a person answers.
+ */
+
+import { cpSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, test } from "vitest";
+import { cleanScratch, commitAll, contract, git, REPO, repo } from "../workspace/__fixtures__/contract-repo";
+import statusSchema from "../workspace/status.schema.json";
+import pointsSchema from "../workspace/points.schema.json";
+import { answerPoint, askPoint } from "../workspace/decide";
+import { workspacePoints } from "../workspace/points-cli";
+import type { WireAnswer } from "../workspace/points";
+import { readMemberStewards } from "../workspace/status-stewards";
+import { readRunLedger } from "../lifecycle/run-ledger";
+import type { ActivityFn, ActivityProfile } from "./activity-registry";
+import { runOpLocally } from "./local-executor";
+import { formatRoundLine, runOperatorRound } from "./operator";
+import { declareSteward } from "./steward";
+import { askPointInRun, isPointWait, PointWait, type BrokeredModelAsk } from "./steward-points";
+import { enterStewardTurn, resetStewardTurn, STEWARD_ENV } from "./steward-turn";
+import type { OpConfig } from "./types";
+
+const REF = join(REPO, "reference-workspace");
+const PROFILES: Record<string, ActivityProfile> = {};
+const on = "2026-09-25";
+
+const points = {
+  points: {
+    "ship-now": {
+      title: "Ship this release now",
+      question: { type: "noul", instructions: "Is the release ready to ship?", criteria: { true: "Ship it.", false: "Hold it." } },
+      inputs: { release: "the release, as status lists it" },
+      deciders: [
+        { kind: "table", rows: [{ when: { release: "hotfix" }, answer: true }] },
+        { kind: "model", backend: "systemone", model: "jev-1.13.0", threshold: 0.8 },
+        { kind: "quorum", count: 1 },
+      ],
+    },
+  },
+};
+
+const confident: WireAnswer = { type: "noul", noul: 0.97 };
+
+let root: string;
+
+beforeAll(() => {
+  root = repo(
+    {
+      "chant.workspace.json": JSON.stringify(
+        { name: "studio", schema: 1, members: [{ name: "app", dir: "app", kind: "other", because: "a plain Node server" }], records: [{ kind: "answers/answer.kind.mjs" }] },
+        null,
+        2,
+      ),
+      "app/server.mjs": "export const port = 8080;\n",
+      "decisions/points.json": JSON.stringify(points, null, 2),
+      ".chant/trust.json": JSON.stringify({ schema: 1, roles: { agent: ["bot"] } }),
+    },
+    false,
+  );
+  cpSync(join(REF, "answers", "answer.kind.mjs"), join(root, "answers", "answer.kind.mjs"));
+  cpSync(join(REF, "answers", "answer.schema.json"), join(root, "answers", "answer.schema.json"));
+  // The run ledger and leases are written with git plumbing, which needs an identity.
+  git(root, "config", "user.name", "Steward Test");
+  git(root, "config", "user.email", "steward@example.com");
+  commitAll(root, "c0");
+});
+
+afterEach(() => resetStewardTurn());
+afterAll(cleanScratch);
+
+/** A brokered model call that records what it was asked through. */
+function brokered(answer: WireAnswer, calls: { capability: string }[]): BrokeredModelAsk {
+  return async (req, via) => {
+    calls.push({ capability: via.capability });
+    return { model: req.model, answer };
+  };
+}
+
+/** A steward's question, as held on the lifecycle ledger (#2786). */
+function ledgerText(id: string): string {
+  return git(root, "show", `chant/lifecycle:_answers/answer/${id}.md`);
+}
+
+async function waitOf(p: Promise<unknown>): Promise<PointWait> {
+  try {
+    await p;
+  } catch (err) {
+    if (isPointWait(err)) return err;
+    throw err;
+  }
+  throw new Error("expected the ask to wait");
+}
+
+describe("askPointInRun (#2749)", () => {
+  test("an answered question returns its answer, outside any steward", async () => {
+    const got = await askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "hotfix" }, on });
+    expect(got.answer).toBe(true);
+    expect(got.question).toMatchObject({ state: "answered", askedBy: null });
+  });
+
+  test("in a steward's turn the model call goes through the steward's brokered capability, and a proposal waits for a person", async () => {
+    enterStewardTurn({ steward: "box-steward", capabilities: ["inference"], vault: null, run: "run-1" });
+    const calls: { capability: string }[] = [];
+    const wait = await waitOf(askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-1" }, subject: "r-1", ask: brokered(confident, calls), on }));
+    expect(calls).toEqual([{ capability: "inference" }]);
+    expect(wait.question).toMatchObject({ point: "ship-now", state: "proposed", subject: "r-1", steward: "box-steward" });
+    const text = ledgerText(wait.question.id);
+    expect(text).toContain('harness: "chant-steward"');
+    expect(text).toContain('name: "box-steward"');
+    expect(text).toContain('id: "run-1"');
+    // The question is open in the read contract, naming who waits on it.
+    const doc = await workspacePoints({ cwd: root, open: true });
+    if (!("questions" in doc)) throw new Error(doc.error.message);
+    expect(doc.questions.find((q) => q.id === wait.question.id)).toMatchObject({
+      open: true,
+      state: "proposed",
+      askedBy: { steward: "box-steward", run: "run-1" },
+      ledger: `chant/lifecycle:_answers/answer/${wait.question.id}.md`,
+    });
+  });
+
+  test("a steward that doesn't name the capability makes no model call, and the question goes to people", async () => {
+    enterStewardTurn({ steward: "box-steward", capabilities: ["fountain"], vault: null });
+    const calls: { capability: string }[] = [];
+    const wait = await waitOf(askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-2" }, ask: brokered(confident, calls), on }));
+    expect(calls).toEqual([]);
+    expect(wait.question.state).toBe("escalated");
+    const text = ledgerText(wait.question.id);
+    expect(text).toMatch(/does not name the brokered capability inference \(it names fountain\)/);
+  });
+
+  test("a steward holding a vault makes no model call either", async () => {
+    enterStewardTurn({ steward: "vault-steward", capabilities: [], vault: "creds" });
+    const calls: { capability: string }[] = [];
+    const wait = await waitOf(askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-3" }, ask: brokered(confident, calls), on }));
+    expect(calls).toEqual([]);
+    expect(ledgerText(wait.question.id)).toMatch(/holds the vault creds/);
+  });
+});
+
+describe("a steward's question stays out of the checkout (#2786)", () => {
+  const status = () => git(root, "status", "--porcelain", "--untracked-files=all");
+
+  test("asked in a steward's turn, it is written on chant/lifecycle, the checkout stays clean, and points --open lists it", async () => {
+    // Earlier tests asked outside a turn, into the tree; commit those so the checkout starts clean.
+    commitAll(root, "earlier answers");
+    expect(status()).toBe("");
+    enterStewardTurn({ steward: "box-steward", capabilities: [], vault: null, run: "run-9" });
+    const wait = await waitOf(askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-9" }, subject: "r-9", on }));
+    expect(status()).toBe("");
+    expect(existsSync(join(root, wait.question.path))).toBe(false);
+    expect(ledgerText(wait.question.id)).toContain(`id: "${wait.question.id}"`);
+
+    const doc = await workspacePoints({ cwd: root, open: true });
+    if (!("questions" in doc)) throw new Error(doc.error.message);
+    const listed = doc.questions.find((q) => q.id === wait.question.id);
+    expect(listed).toMatchObject({ state: "escalated", open: true, subject: "r-9", path: wait.question.path, ledger: `chant/lifecycle:_answers/answer/${wait.question.id}.md` });
+    const pointsShape = contract(pointsSchema);
+    pointsShape.expectValid(doc);
+
+    // Asked again in the same turn, the question is found on the ledger, not asked twice.
+    const again = await waitOf(askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-9" }, subject: "r-9", on }));
+    expect(again.question.id).toBe(wait.question.id);
+
+    // A person answers it: the answer goes back on the ledger, and the checkout is still clean.
+    resetStewardTurn();
+    const answered = await answerPoint({ cwd: root, id: wait.question.id, answer: "no", by: ["alice"], on });
+    if ("error" in answered) throw new Error(answered.error.message);
+    expect(answered.question).toMatchObject({ state: "answered", answer: false, ledger: `chant/lifecycle:_answers/answer/${wait.question.id}.md` });
+    expect(status()).toBe("");
+    expect(ledgerText(wait.question.id)).toContain('state: "answered"');
+
+    // The steward's next turn reads the answer and goes on.
+    enterStewardTurn({ steward: "box-steward", capabilities: [], vault: null, run: "run-10" });
+    const got = await askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-9" }, subject: "r-9", on });
+    expect(got.answer).toBe(false);
+    expect(status()).toBe("");
+  });
+
+  test("points ask shelled out from a steward's turn (CHANT_STEWARD) goes on the ledger too, naming the steward", async () => {
+    expect(status()).toBe("");
+    process.env[STEWARD_ENV] = "box-steward";
+    const doc = await askPoint({ cwd: root, point: "ship-now", inputs: { release: "r-11" }, subject: "r-11", on });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.written).toBe(true);
+    expect(doc.question).toMatchObject({ state: "escalated", askedBy: { steward: "box-steward", run: null }, ledger: `chant/lifecycle:_answers/answer/${doc.id}.md` });
+    expect(status()).toBe("");
+  });
+
+  test("outside a steward's turn a question is still written into the answer kind's directory", async () => {
+    const doc = await askPoint({ cwd: root, point: "ship-now", inputs: { release: "r-12" }, on });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.question.ledger).toBeNull();
+    expect(existsSync(join(root, doc.path))).toBe(true);
+    rmSync(join(root, doc.path));
+  });
+});
+
+describe("a steward never answers a question (#2749)", () => {
+  test("points answer is refused inside a steward's turn, and in a process it started", async () => {
+    enterStewardTurn({ steward: "box-steward", capabilities: ["inference"], vault: null });
+    const wait = await waitOf(askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-4" }, on }));
+    const doc = await answerPoint({ cwd: root, id: wait.question.id, answer: "yes", by: ["alice"], on });
+    expect("error" in doc && doc.error.code).toBe("answer-in-steward-turn");
+
+    resetStewardTurn();
+    process.env[STEWARD_ENV] = "box-steward";
+    const child = await answerPoint({ cwd: root, id: wait.question.id, answer: "yes", by: ["alice"], on });
+    expect("error" in child && child.error.code).toBe("answer-in-steward-turn");
+  });
+
+  test("the steward that asked never counts toward the quorum", async () => {
+    enterStewardTurn({ steward: "box-steward", capabilities: [], vault: null });
+    const wait = await waitOf(askPointInRun({ cwd: root, point: "ship-now", inputs: { release: "r-5" }, on }));
+    resetStewardTurn();
+    const doc = await answerPoint({ cwd: root, id: wait.question.id, answer: "yes", by: ["Box-Steward", "bot"], on });
+    if (!("error" in doc)) throw new Error("expected a refusal");
+    expect(doc.error.code).toBe("quorum-not-met");
+    expect(doc.error.message).toMatch(/Box-Steward, who is the steward that asked/);
+    expect(doc.error.message).toMatch(/bot, who holds the agent role/);
+  });
+});
+
+function shipOp(name: string, release: string, cron?: string): OpConfig {
+  return {
+    name,
+    overview: `${name} fixture`,
+    phases: [
+      { name: "Decide", steps: [{ kind: "activity", fn: "askShip", args: { release } }] },
+      { name: "Ship", steps: [{ kind: "activity", fn: "ship", args: {} }] },
+    ],
+    onFailure: [{ name: "Undo", steps: [{ kind: "activity", fn: "undo", args: {} }] }],
+    ...(cron ? { schedule: { cron, overlap: "skip" as const } } : {}),
+  };
+}
+
+function shipActivities(log: string[]): Map<string, ActivityFn> {
+  return new Map<string, ActivityFn>([
+    ["askShip", async (args) => (await askPointInRun({ cwd: root, point: "ship-now", inputs: { release: args.release }, on })).answer],
+    ["ship", async () => { log.push("ship"); return { shipped: true }; }],
+    ["undo", async () => { log.push("undo"); return {}; }],
+  ]);
+}
+
+describe("an Op waiting on a decision point (#2749)", () => {
+  test("stops as waiting, like a gate: no later phase, no compensation, and the ledger names the question", async () => {
+    const log: string[] = [];
+    const result = await runOpLocally(shipOp("ship-once", "r-6"), shipActivities(log), PROFILES, undefined, { ledger: { cwd: root } });
+    expect(result.status).toBe("waiting");
+    expect(log).toEqual([]);
+    expect(result.records.map((r) => [r.fn, r.status])).toEqual([["askShip", "skipped"], ["ship", "skipped"]]);
+    expect(result.point).toMatchObject({ point: "ship-now", state: "escalated", steward: null });
+    const newest = (await readRunLedger("local", "ship-once", { cwd: root })).records.at(-1)!;
+    expect(newest).toMatchObject({ status: "waiting", point: { id: result.point!.id, point: "ship-now", state: "escalated" } });
+    expect(newest.steward).toBeUndefined();
+    expect(newest.phases[0].steps[0]).toMatchObject({ fn: "askShip", status: "skipped", point: { id: result.point!.id } });
+  });
+
+  test("a local steward records the wait, lists it in status, leaves it while open, and resumes once a person answers", async () => {
+    const config = shipOp("box-ship", "r-7", "0 0 1 1 *");
+    const steward = declareSteward({ name: "box-steward", ops: [config], capabilities: ["inference"] });
+    const log: string[] = [];
+    const scheduleState = new Map<string, Date>();
+    // Cron minutes are local time, so the rounds are too.
+    const round = (minute: number) =>
+      runOperatorRound({ cwd: root, steward, activities: shipActivities(log), profiles: PROFILES, holder: "box", now: () => new Date(2027, 0, 1, 0, minute, 10), scheduleState });
+
+    // The cron fires: the Op asks, nobody has answered, the run waits.
+    const first = await round(0);
+    expect(first).toHaveLength(1);
+    expect(first[0]).toMatchObject({ kind: "ticked", op: "box-ship" });
+    const ticked = first[0] as Extract<(typeof first)[number], { kind: "ticked" }>;
+    expect(ticked.result.status).toBe("waiting");
+    const question = ticked.result.point!.id;
+    expect(formatRoundLine(first[0])).toContain(`status=waiting point="${question}"`);
+    const newest = (await readRunLedger("local", "box-ship", { cwd: root })).records.at(-1)!;
+    expect(newest).toMatchObject({ status: "waiting", steward: "box-steward", point: { id: question } });
+
+    // workspace status lists what the steward waits on, beside its Ops.
+    mkdirSync(join(root, "ops"), { recursive: true });
+    writeFileSync(join(root, "chant.config.json"), "{}\n");
+    writeFileSync(join(root, "ops", "steward.op.ts"), `export const steward = ${JSON.stringify(steward)};\n`);
+    const status = await readMemberStewards(root, "local", "2027-01-01T00:01:00Z");
+    expect(status.reasons).toEqual([]);
+    const entry = status.stewards.find((s) => s.name === "box-steward")!;
+    // The entry keeps status.schema.json's steward shape (#2731, #2749).
+    const stewardShape = contract({ $schema: statusSchema.$schema, $id: "urn:test:status-steward", $defs: statusSchema.$defs, $ref: "#/$defs/steward" });
+    stewardShape.expectValid(entry);
+    expect(entry.ops[0].lastRun).toMatchObject({ status: "waiting", point: { id: question, point: "ship-now", state: "escalated" } });
+    expect(entry.waiting).toEqual([
+      { op: "box-ship", run: newest.id, id: question, point: "ship-now", state: "escalated", path: newest.point!.path, subject: null, since: newest.point!.since },
+    ]);
+
+    // Still open: the steward does not run it, and says what it waits on.
+    const second = await round(5);
+    expect(second).toEqual([{ kind: "waiting-on-point", op: "box-ship", env: "local", point: "ship-now", question, state: "escalated" }]);
+    expect(formatRoundLine(second[0])).toBe(`operator: box-ship@local waiting=1(point:${question}:escalated)`);
+
+    // A person answers, through hud or at a shell; the next round resumes the Op.
+    const answered = await answerPoint({ cwd: root, id: question, answer: "yes", by: ["alice"], on });
+    expect("error" in answered).toBe(false);
+    const third = await round(10);
+    expect(third[0]).toMatchObject({ kind: "ticked", op: "box-ship", resumed: question });
+    expect((third[0] as { result: { status: string } }).result.status).toBe("ok");
+    expect(log).toEqual(["ship"]);
+    expect((await readMemberStewards(root, "local", "2027-01-01T00:11:00Z")).stewards[0].waiting).toEqual([]);
+  });
+});