@intentius/chant 0.90.0 → 0.93.0

package/src/workspace/reason-codes.ts

@@ -57,12 +57,18 @@ export const REASONS = {
   "gates-no-ledger": "The checkout has no chant/lifecycle branch, so there is no gate ledger to read.",
   "gates-no-gate-ledger": "The branch has no gate ledger for the member: no run of it has reached a gate.",
   "gates-ledger-unreadable": "Reading the member's gate ledger failed, so no gate is listed.",
+  // A member's stewards status can't fully list (status, #2731).
+  "stewards-unreadable": "An *.op.ts file could not be imported, so a steward it declares may be missing.",
+  "stewards-conflict": "A steward was dropped: its name, or an Op it lists, belongs to another steward.",
+  "steward-runs-unreadable": "Reading an Op's run ledger, or a ConvergeOp's converge ledger, failed, so its last run or last tick is null.",
   // A record that isn't valid (records).
   "record-unparseable": "No front matter, a YAML error or a value outside the JSON subset of YAML, or for a JSON kind a file that is not one object or repeats a member name.",
   "record-schema-invalid": "The record's front matter, or its JSON object, does not match the kind's schema.",
   "record-id-duplicate": "Another record earlier in path order has the same id.",
   "record-supersedes-unknown": "A supersedes link names an id no record has.",
   "record-supersedes-conflict": "A second closed record supersedes a record another one already superseded.",
+  "record-remediates-unknown": "A remediates link names an id no record has.",
+  "record-remediates-not-closed": "A remediates link names a record that isn't closed; a record still open is amended instead.",
   // A review session that isn't valid (records, #2673).
   "session-seal-mismatch": "A closed session's seal is not the digest of its text: the session changed after it closed.",
   "session-verdict-unknown-record": "A session's verdict names a record that none of the session kind's subject records has.",
@@ -82,6 +88,12 @@ export const REASONS = {
   "work-done-unpinned": "A work record is done and its evidence list is empty: nothing shows the work was done.",
   "work-closed-without-date": "A work record is done or dropped and has no closing date.",
   "work-done-gap-open": "A work record is done, and the finding it came from still fires on its region. graph --intent raises it, and records does by walking that region.",
+  "work-acceptance-unmet": "A work record is done, and one of its acceptance criteria has no passing evidence of the verification it expects. check fails on it (WSP117).",
+  "work-acceptance-self-verified": "A passing manual verdict on a work record's criterion names the record's implementer, so it does not count: a manual verdict comes from someone else.",
+  // An answer to a decision point that is valid but warned about (records, points, ws-058, #2739).
+  "answer-points-unreadable": "The points file the answer kind names can't be read, or is not valid.",
+  "answer-point-unknown": "The answer's point is not declared in the points file the answer kind names.",
+  "answer-point-changed": "The point's declaration changed since the question was asked, so the answer is to an older version of the question.",
   // A verdict the quorum does not count (records, #2671, #2672).
   "review-decider": "The verdict is the decider's own, and the quorum counts verdicts besides the decider's.",
   "review-agent": "The reviewer holds the agent role in the trust policy at base.",
@@ -121,6 +133,15 @@ export const REASONS = {
   // A review given in a session (records review --session, #2693).
   "session-unknown": "--session names no session of a session kind whose subjects are the record's kind.",
   "session-not-open": "--session names a session in a closed state, which takes no more verdicts.",
+  // Decision points (points, points ask, points answer, ws-058, #2739).
+  "points-undeclared": "No record kind with an answers block is declared, or given with --kind, so there is no points file to ask.",
+  "points-invalid": "The points file an answer kind names can't be read, or does not match decision-points.schema.json and the rules checked in code.",
+  "point-unknown": "No points file declares the point asked, or the one an answer names.",
+  "point-inputs-invalid": "The inputs given to an ask are not a JSON object of the point's declared inputs.",
+  "point-decider-failed": "A model decider that fails closed (unreachable: fail) could not answer, so the ask wrote nothing.",
+  "answer-not-candidate": "The people's answer is not one of the question's candidates.",
+  "quorum-not-met": "Too few of the people who answered count toward the point's quorum: distinct, not holding the agent role, not the steward that asked, and holding one of its roles when it names any.",
+  "answer-in-steward-turn": "The answer was given during a steward's turn, or by a process it started: a steward never answers a decision point, and a person answers it through hud or at a shell.",
   // records --since that fails (#2673).
   "since-rev-unknown": "--since names no commit, or a session with no opening revision and no commit that added it.",
   "since-session-unknown": "--since has the shape of a session id and names no commit, and no session the kind or the declaration reads has that id.",
@@ -148,6 +169,9 @@ export const REASONS = {
   "intent-decision-unimplemented": "A decided decision constrains the region, no work item that is not dropped implements it, and no commit falls in its window.",
   "intent-work-blocked": "A work item constraining the region has commits in its window while a work item it needs is not done.",
   "intent-work-open-decided-code": "Commits in the region are a decision's own work while the work item implementing that decision is still open.",
+  // The forward coverage check (check --changes, #2773): findings, one per changed path.
+  "change-uncovered": "A path the diff changes is covered by no current decided record and no open work item, by path or by its member.",
+  "change-out-of-scope": "A record in hand for the change, such as the work item it is for or a decision that item implements, lists a path the diff changes in its out_of_scope.",
   // Composite instances joined to components (graph --composites, #2662): why the list is empty or has no component.
   "composites-no-chant-member": "No member of kind chant was read, so nothing declares a composite instance or a component.",
   "composites-none-declared": "The members read declare no composite instance.",
@@ -159,6 +183,31 @@ export const REASONS = {
   "environments-none-declared": "The member's chant.config.ts declares no environments, so only local and the environments in its ledger are listed.",
   "environments-ledger-undeclared": "The member's ledger has releases in an environment its config's environments don't cover, so chant run --env would refuse it and it is not listed.",
   "environments-ledger-unreadable": "The chant/lifecycle branch exists and the member's ledger environments could not be listed.",
+  // A declared diagram's source or render (check, #2764). Each is also a WSP finding.
+  "diagram-source-missing": "A declared diagram's source file does not exist in the tree read.",
+  "diagram-render-missing": "A declared diagram's render file does not exist in the tree read.",
+  "diagram-render-drift": "A declared diagram records a sourceHash, and the source's bytes now hash to something else: the render is stale for its source.",
+  // A box that holds a credential (check, #2726). Each is also a WSP finding.
+  "box-credential-declared": "A file in a box member's directory carries a literal secret: a credential's shape, or a literal where a credential goes. A variable or secret-manager reference is not one.",
+  "box-capability-unbrokered": "A capability in a member's box block names no broker, so the box would hold its credential.",
+  // The credential fountain itself hands a persistent box (check, #2780). Also a WSP finding.
+  "box-fountain-callback-undeclared": "A box member builds a fountain Box, whose persistent sandbox fountain gives a callback token scoped to its owner, and the member's box block does not declare the fountain-callback capability brokered by fountain with scope owner.",
+  // The work lease (chant workspace work claim|renew|release, #2732): why the command could not run.
+  "work-kind-missing": "No work kind to find the item in: --kind names a kind with no work block, or the declaration names no work kind.",
+  "work-kind-ambiguous": "More than one declared work kind has a record with the id, so --kind must name one.",
+  "work-item-unknown": "No work record has the id, so there is nothing to lease.",
+  "work-item-closed": "A claim on a work item in a closed state, such as done or dropped: there is no work left to claim.",
+  // Evidence attached to a criterion under the run's work lease (#2772): why it was refused. Nothing is written.
+  "work-criterion-unknown": "The work record lists no acceptance criterion with the id the evidence names, or its kind has no acceptance criteria.",
+  // The work lease: why a claim, renew or release was refused (exit 2).
+  "lease-held": "Someone holds a live lease on the work item: another worker, or, for a claim, the same one.",
+  "lease-not-held": "Nobody holds a live lease on the work item: it expired, was released or was never claimed.",
+  "lease-token-mismatch": "The live lease on the work item carries another fencing token than the one given.",
+  "lease-race": "Another writer changed the lease between this command's read and its write.",
+  "lease-push-rejected": "The remote refused the lease push: another clone claimed the item first, or the remote could not be reached.",
+  // A box whose isolation fails (check, #2727). Each is also a WSP finding.
+  "box-isolation-collision": "Two boxes on one host resolve to the same port, state path or cookie name, or two ports in one box share an offset.",
+  "box-isolation-literal": "A host's stateRoot or a box's state entry is a literal machine path instead of one derived from an environment reference and the box's name.",
   // The lineage lock (check).
   "lock-invalid": "The lineage lock can't be read.",
   "manual-step-open": "A scope in the lineage lock has an open manual step.",

package/src/workspace/record-assets.test.ts

@@ -18,6 +18,7 @@ import { constraintCovers, isWorkspacePath, memberHolding, WORKSPACE_PATH_PATTER
 import { pinFile, queryRecords, type RecordsDocument } from "./records-cli";
 import { parseFrontMatter, RECORD_WARNING_CODES, SEAL_WARNING_CODES } from "./records";
 import { WORK_WARNING_CODES } from "./work";
+import { ANSWER_WARNING_CODES } from "./points";
 import { workspaceGraph } from "./graph-cli";
 import graphSchema from "./graph.schema.json";
 import recordsSchema from "./records.schema.json";
@@ -170,8 +171,8 @@ describe("chant workspace records checks each pin", () => {
 
   test("the schema lists exactly the warning codes", () => {
     // A work kind's records carry the work warnings too (#2683), work-done-gap-open included since records walks a done item's region (#2686),
-    // and records adds record-unattested for an author seal under a signers file at base (#2688).
-    expect(recordsSchema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...SEAL_WARNING_CODES]);
+    // an answer kind's the answer warnings (ws-058), and records adds record-unattested for an author seal under a signers file at base (#2688).
+    expect(recordsSchema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...ANSWER_WARNING_CODES, ...SEAL_WARNING_CODES]);
   });
 
   test("records pin <path> prints the entry's path from the workspace root and the file's hash", () => {

package/src/workspace/record-assets.ts

@@ -81,7 +81,10 @@ export function checkPins(pins: { path: string; sha256: string }[], tree: Worksp
     const state: PinState = actual === null ? "missing" : actual === pin.sha256 ? "pinned" : "drifted";
     assets.push({ ...pin, actual, state });
     if (state === "missing") {
-      warnings.push({ code: "asset-missing", message: `evidence pins ${pin.path}, which does not exist${tree.label}` });
+      // Worded the same for the working tree and a revision (#2745): a missing
+      // file is missing either way, and `tree.label` would otherwise make the
+      // same finding read differently depending on which one was read.
+      warnings.push({ code: "asset-missing", message: `evidence pins ${pin.path}, which does not exist` });
     } else if (state === "drifted") {
       warnings.push({
         code: "asset-drift",

package/src/workspace/records-amend.schema.json

@@ -180,6 +180,8 @@
                 "record-id-duplicate",
                 "record-supersedes-unknown",
                 "record-supersedes-conflict",
+                "record-remediates-unknown",
+                "record-remediates-not-closed",
                 "session-seal-mismatch",
                 "session-verdict-unknown-record"
               ]

package/src/workspace/records-cli.ts

@@ -24,7 +24,7 @@ import { formatError } from "../cli/format";
 import type { CommandContext } from "../cli/registry";
 import { findWorkspaceRoot } from "../project-root";
 import { fileDigest, isWorkspacePath } from "./record-assets";
-import { gitRevisionSource, gitRoot, resolveRevision, workingTreeSource } from "./record-source";
+import { gitRevisionSource, gitRoot, resolveRevision, workingTreeSource, type RecordSource } from "./record-source";
 import { declaredRecordKinds, readDeclaration, WorkspaceReadError, type RecordKindDeclaration } from "./declaration";
 import { declaredKindFile } from "./declared-kinds";
 import { locateWorkspace } from "./which-chant";
@@ -92,6 +92,13 @@ export type RecordView = RecordEntry & {
   /** true when the record's seal verifies for its author against the signers at base; false when it fails, or is missing under an active policy; null when nothing here can say (#2688). */
   attested?: boolean | null;
   attestation?: VerdictAttestation;
+  /**
+   * For a work kind read in the working tree (#2732): the item's active work
+   * lease, or null when nobody holds one. Read from the local lease refs of
+   * the ledger owning the kind, without fetching. Absent under `--at`, since a
+   * lease is live state and not part of a revision.
+   */
+  lease?: { holder: string; token: string; acquiredAt: string; expiresAt: string } | null;
 };
 
 /** The role in the trust policy whose holders' verdicts the quorum does not count (#2671). */
@@ -242,7 +249,15 @@ function gitHistory(top: string, rev: string, prefix: string): RecordHistory {
  * with each pin checked in the same tree. Throws a {@link RecordReadError}.
  * `chant workspace graph` and `check` read records through this too.
  */
-export async function readRecordsFor(query: Omit<RecordsQuery, "base">): Promise<RecordsRead> {
+export async function readRecordsFor(
+  query: Omit<RecordsQuery, "base"> & {
+    /**
+     * Lay more records over a working-tree read, such as the answer records a
+     * steward keeps on the lifecycle ledger (#2786). Not called with `at`.
+     */
+    overlay?: (source: RecordSource, kind: { loaded: LoadedRecordKind; root: string }) => Promise<RecordSource>;
+  },
+): Promise<RecordsRead> {
   // git reports its top through symlinks resolved (/var is /private/var on
   // macOS), so the directory has to be too, or record paths leave the repository.
   const cwd = realpathOr(query.cwd);
@@ -259,6 +274,7 @@ export async function readRecordsFor(query: Omit<RecordsQuery, "base">): Promise
     source = gitRevisionSource(top, at);
     assets = gitTree(top, at, workspaceRoot === "." ? "" : workspaceRoot);
   }
+  if (at === null && query.overlay) source = await query.overlay(source, { loaded, root });
   const history = top ? gitHistory(top, at ?? "HEAD", workspaceRoot) : undefined;
   // A session kind's verdicts name records of another kind, read from the same tree (#2673).
   let subjects: { records: RecordEntry[]; reviews: string } | undefined;
@@ -304,6 +320,11 @@ export async function queryRecords(query: RecordsQuery): Promise<RecordsDocument
       ...(seals ? authorSeal(loaded.kind, r, policy, seals.checkRecordSeal) : {}),
     }));
     if (loaded.kind.work && query.workGaps !== false && top) await raiseWorkGaps(loaded, records, { root, workspaceRoot, at: query.at });
+    if (loaded.kind.work && at === null && top) {
+      const { activeWorkLeases } = await import("../lifecycle/work-lease");
+      const leases = await activeWorkLeases(loaded.file);
+      for (const r of records) if (r.id !== null) r.lease = leases.get(r.id) ?? null;
+    }
     return {
       $schema: RECORDS_OUTPUT_SCHEMA_ID,
       contract: RECORDS_CONTRACT_VERSION,
@@ -590,13 +611,15 @@ function formatRecords(records: RecordView[], summary: { total: number; valid: n
     const title = typeof r.data?.title === "string" ? r.data.title : r.path;
     const flag = r.valid ? "" : "  INVALID";
     const superseded = r.supersededBy ? `  superseded by ${r.supersededBy}` : "";
+    const remediated = r.remediatedBy.length > 0 ? `  remediated by ${r.remediatedBy.join(", ")}` : "";
     const attested = r.provenance.level === "attested" ? `  attested by ${r.provenance.principal}` : "";
     const sealed = r.attested === true ? `  sealed by ${(r.data?.[RECORD_SEAL_FIELD] as { signer: string }).signer}` : "";
-    lines.push(`${(r.id ?? "-").padEnd(idWidth)}  ${(r.state ?? "-").padEnd(stateWidth)}  ${title}${superseded}${attested}${sealed}${flag}`);
+    lines.push(`${(r.id ?? "-").padEnd(idWidth)}  ${(r.state ?? "-").padEnd(stateWidth)}  ${title}${superseded}${remediated}${attested}${sealed}${flag}`);
     if (r.ready !== undefined) {
       const blocked = (r.blockedBy ?? []).map((b) => `${b.id} (${b.state ?? "unknown"})`).join(", ");
       const implemented = (r.implements ?? []).map((d) => `${d.id} (${d.state ?? "unknown"})`).join(", ");
-      const status = [r.ready ? "ready" : blocked ? `blocked by ${blocked}` : "", implemented ? `implements ${implemented}` : ""].filter(Boolean).join("; ");
+      const held = r.lease ? `held by ${r.lease.holder} until ${r.lease.expiresAt}` : "";
+      const status = [r.ready ? "ready" : blocked ? `blocked by ${blocked}` : "", implemented ? `implements ${implemented}` : "", held].filter(Boolean).join("; ");
       if (status) lines.push(`${" ".repeat(idWidth + 2)}${status}`);
     }
     for (const reason of r.reasons) lines.push(`${" ".repeat(idWidth + 2)}${reason.code}: ${reason.message} (${r.path})`);
@@ -620,7 +643,7 @@ export async function runWorkspaceUnknown(ctx: CommandContext): Promise<number>
   console.error(
     formatError({
       message: sub ? `Unknown workspace subcommand: ${sub}` : "chant workspace needs a subcommand",
-      hint: `Workspace subcommands: audit, build, check, graph, init, lineage, lint, ls, records, status, upgrade, verify. Run "chant --help" for their options.`,
+      hint: `Workspace subcommands: audit, build, check, graph, init, lineage, lint, ls, records, status, upgrade, verify, work. Run "chant --help" for their options.`,
     }),
   );
   return 1;

package/src/workspace/records-close.schema.json

@@ -176,6 +176,8 @@
                 "record-id-duplicate",
                 "record-supersedes-unknown",
                 "record-supersedes-conflict",
+                "record-remediates-unknown",
+                "record-remediates-not-closed",
                 "session-seal-mismatch",
                 "session-verdict-unknown-record"
               ]

package/src/workspace/records-contract.test.ts

@@ -13,6 +13,7 @@ import { afterAll, describe, expect, test } from "vitest";
 import { queryRecords, RECORDS_CONTRACT_VERSION, RECORDS_OUTPUT_SCHEMA_ID, type RecordsDocument } from "./records-cli";
 import { READ_ERROR_CODES, RECORD_REASON_CODES, RECORD_WARNING_CODES, recordTextDigest, REVIEW_REASON_CODES, SEAL_WARNING_CODES } from "./records";
 import { WORK_WARNING_CODES } from "./work";
+import { ANSWER_WARNING_CODES } from "./points";
 import schema from "./records.schema.json";
 import { PROVENANCE_LEVELS } from "./trust/attestor";
 
@@ -149,8 +150,8 @@ describe("records output schema", () => {
 
   test("lists exactly the warning codes the code can return", () => {
     // A work kind's records carry the work warnings too (#2683), work-done-gap-open included since records walks a done item's region (#2686),
-    // and records adds record-unattested for an author seal under a signers file at base (#2688).
-    expect(schema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...SEAL_WARNING_CODES]);
+    // an answer kind's the answer warnings (ws-058), and records adds record-unattested for an author seal under a signers file at base (#2688).
+    expect(schema.$defs.warning.properties.code.enum).toEqual([...RECORD_WARNING_CODES, ...WORK_WARNING_CODES, ...ANSWER_WARNING_CODES, ...SEAL_WARNING_CODES]);
   });
 
   test("every failure validates with its code", async () => {

package/src/workspace/records-new.schema.json

@@ -169,6 +169,8 @@
                 "record-id-duplicate",
                 "record-supersedes-unknown",
                 "record-supersedes-conflict",
+                "record-remediates-unknown",
+                "record-remediates-not-closed",
                 "session-seal-mismatch",
                 "session-verdict-unknown-record"
               ]

package/src/workspace/records-review.schema.json

@@ -264,6 +264,8 @@
                 "record-id-duplicate",
                 "record-supersedes-unknown",
                 "record-supersedes-conflict",
+                "record-remediates-unknown",
+                "record-remediates-not-closed",
                 "session-seal-mismatch",
                 "session-verdict-unknown-record"
               ]

package/src/workspace/records-sessions-write.e2e.test.ts

@@ -0,0 +1,77 @@
+/**
+ * Sessions from a UI (#2693), through the command line: `records close` with
+ * the declared session kind, and `records --since <session id>` without
+ * --kind. Four CLI spawns put it near 13s on CI, close to the unit shards'
+ * per-test budget, so it runs in the test-e2e job (#2817). The rest of #2693
+ * is in records-sessions-write.test.ts.
+ */
+
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { afterAll, describe, expect, test } from "vitest";
+import { cleanScratch, commitAll, contract, git, REPO } from "./__fixtures__/contract-repo";
+import { declareSessions, newSessionFields, sessionsRepo, SESSIONS_KIND } from "./__fixtures__/sessions";
+import closeSchema from "./records-close.schema.json";
+import { type RecordsSinceDocument } from "./records-since";
+import sinceSchema from "./records-since.schema.json";
+import { newRecord } from "./records-write";
+import newSchema from "./records-new.schema.json";
+
+afterAll(cleanScratch);
+
+const close = contract(closeSchema);
+const since = contract(sinceSchema);
+const created = contract(newSchema);
+
+/** The reference fixture with a declaration, committed. */
+function declared(): string {
+  const root = sessionsRepo();
+  declareSessions(root);
+  commitAll(root, "declare");
+  return root;
+}
+
+/** Open S-0002 through records new, and commit it. */
+async function opened(root: string): Promise<{ path: string; head: string }> {
+  const head = git(root, "rev-parse", "HEAD");
+  const doc = await newRecord({ kind: SESSIONS_KIND, fields: newSessionFields(), cwd: root });
+  created.expectValid(doc);
+  if ("error" in doc) throw new Error(`${doc.error.code}: ${doc.error.message}`);
+  expect(doc.id).toBe("S-0002");
+  commitAll(root, "open S-0002");
+  return { path: doc.path, head };
+}
+
+describe("records --since <session id> (#2693)", () => {
+  test(
+    "through the CLI: close with the declared session kind, and --since <session id> without --kind",
+    async () => {
+      const root = declared();
+      await opened(root);
+      const run = (...args: string[]) =>
+        spawnSync(process.execPath, ["--import", pathToFileURL(join(REPO, "node_modules/tsx/dist/loader.mjs")).href, join(REPO, "packages/core/src/cli/main.ts"), "workspace", "records", ...args], {
+          cwd: root,
+          encoding: "utf-8",
+          env: { ...process.env, NO_COLOR: "1" },
+          timeout: 60_000,
+        });
+      const closed = run("close", "S-0002");
+      expect(closed.status, closed.stderr).toBe(0);
+      close.expectValid(JSON.parse(closed.stdout));
+      const again = run("close", "S-0002");
+      expect(again.status).toBe(1);
+      expect(JSON.parse(again.stdout).error.code).toBe("record-closed");
+      commitAll(root, "close");
+      const set = run("--since", "S-0002", "--json");
+      expect(set.status, set.stderr).toBe(0);
+      const kinds = JSON.parse(set.stdout).kinds as RecordsSinceDocument[];
+      for (const k of kinds) since.expectValid(k);
+      expect(kinds.map((k) => ("session" in k ? k.session?.id : null))).toEqual(["S-0002", "S-0002"]);
+      const text = run("--kind", SESSIONS_KIND, "--since", "S-0002");
+      expect(text.stdout).toContain("session S-0002 (closed)");
+      expect(text.stdout).toContain("S-0002  new, closed");
+    },
+    120_000,
+  );
+});

package/src/workspace/records-sessions-write.test.ts

@@ -5,13 +5,12 @@
  * is not open and appends the verdict to the session too, and
  * `records --since <session id>` compares the session's own revisions. The
  * fixture is a copy of the reference workspace's decisions and design
- * member with a declaration naming both kinds.
+ * member with a declaration naming both kinds. The CLI run of close and
+ * --since is in records-sessions-write.e2e.test.ts (#2817).
  */
 
-import { spawnSync } from "node:child_process";
 import { cpSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { pathToFileURL } from "node:url";
 import { afterAll, describe, expect, test } from "vitest";
 import { cleanScratch, commitAll, contract, git, REPO, scratchDir } from "./__fixtures__/contract-repo";
 import { declareSessions, DECISIONS_KIND, newSessionFields, sessionsRepo, SESSIONS_KIND } from "./__fixtures__/sessions";
@@ -240,35 +239,4 @@ describe("records --since <session id> (#2693)", () => {
     git(root, "tag", "v-1");
     expect((await sinceDoc({ kind: DECISIONS_KIND, since: "v-1", cwd: root })).session).toBeUndefined();
   });
-
-  test(
-    "through the CLI: close with the declared session kind, and --since <session id> without --kind",
-    async () => {
-      const root = declared();
-      await opened(root);
-      const run = (...args: string[]) =>
-        spawnSync(process.execPath, ["--import", pathToFileURL(join(REPO, "node_modules/tsx/dist/loader.mjs")).href, join(REPO, "packages/core/src/cli/main.ts"), "workspace", "records", ...args], {
-          cwd: root,
-          encoding: "utf-8",
-          env: { ...process.env, NO_COLOR: "1" },
-          timeout: 60_000,
-        });
-      const closed = run("close", "S-0002");
-      expect(closed.status, closed.stderr).toBe(0);
-      close.expectValid(JSON.parse(closed.stdout));
-      const again = run("close", "S-0002");
-      expect(again.status).toBe(1);
-      expect(JSON.parse(again.stdout).error.code).toBe("record-closed");
-      commitAll(root, "close");
-      const set = run("--since", "S-0002", "--json");
-      expect(set.status, set.stderr).toBe(0);
-      const kinds = JSON.parse(set.stdout).kinds as RecordsSinceDocument[];
-      for (const k of kinds) since.expectValid(k);
-      expect(kinds.map((k) => ("session" in k ? k.session?.id : null))).toEqual(["S-0002", "S-0002"]);
-      const text = run("--kind", SESSIONS_KIND, "--since", "S-0002");
-      expect(text.stdout).toContain("session S-0002 (closed)");
-      expect(text.stdout).toContain("S-0002  new, closed");
-    },
-    120_000,
-  );
 });

package/src/workspace/records-write.e2e.test.ts

@@ -0,0 +1,108 @@
+/**
+ * `chant workspace records new|amend|review` (#2670) through the command
+ * line: standard input, exit codes and the refusal document, from the CLI a
+ * user runs. Each test spawns the CLI several times, which put them near 20s
+ * on CI, over the unit shards' per-test budget, so they run in the test-e2e
+ * job (#2817). The commands' own behaviour is covered in records-write.test.ts.
+ */
+
+import { execFileSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { parseFrontMatter } from "./records";
+import { renderRecord } from "./records-write";
+
+const REPO = join(import.meta.dirname, "..", "..", "..", "..");
+const DECISIONS = join(REPO, "docs", "design", "decisions");
+const KIND = "decisions/decision.kind.mjs";
+
+type Data = Record<string, unknown>;
+
+const SAMPLE = (() => {
+  const fm = parseFrontMatter(readFileSync(join(DECISIONS, "ws-003-seal-scope.md"), "utf-8"));
+  if (!fm.ok) throw new Error(fm.message);
+  return fm.value;
+})();
+
+/** A decided decision like ws-003, with `over` laid on top. */
+function decision(over: Data = {}): Data {
+  return { ...structuredClone(SAMPLE), ...over };
+}
+
+/** A proposed decision: no choice, nobody decided. */
+function proposal(over: Data = {}): Data {
+  return decision({ state: "proposed", choice: null, decided_by: null, decided_on: null, ...over });
+}
+
+let dir: string;
+beforeEach(() => {
+  dir = realpathSync(mkdtempSync(join(tmpdir(), "chant-records-write-")));
+  mkdirSync(join(dir, "decisions"));
+  cpSync(join(DECISIONS, "decision.kind.mjs"), join(dir, "decisions", "decision.kind.mjs"));
+  cpSync(join(DECISIONS, "decision.schema.json"), join(dir, "decisions", "decision.schema.json"));
+  put("ws-001-one.md", decision({ id: "ws-001", title: "One" }));
+  put("ws-002-two.md", proposal({ id: "ws-002", title: "Two" }));
+  put("ws-003-three.md", decision({ id: "ws-003", title: "Three", state: "ratified" }));
+});
+afterEach(() => rmSync(dir, { recursive: true, force: true }));
+
+function put(name: string, data: Data): void {
+  writeFileSync(join(dir, "decisions", name), renderRecord(data, `\n# ${String(data.title)}\n`));
+}
+
+describe("the command line", () => {
+  const cli = (args: string[], input?: string) => {
+    const loader = pathToFileURL(join(REPO, "node_modules", "tsx", "dist", "loader.mjs")).href;
+    try {
+      const out = execFileSync(process.execPath, ["--import", loader, join(REPO, "packages", "core", "src", "cli", "main.ts"), "workspace", "records", ...args], {
+        cwd: dir,
+        input,
+        encoding: "utf-8",
+        env: { ...process.env, TSX_DISABLE_CACHE: "1" },
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      return { status: 0, doc: JSON.parse(out) };
+    } catch (err) {
+      const e = err as { status: number; stdout: string };
+      return { status: e.status, doc: JSON.parse(e.stdout) };
+    }
+  };
+
+  test(
+    "new reads fields from standard input, review appends, and a refusal exits 1 with its code",
+    () => {
+      const { id: _id, ...rest } = decision({ title: "From stdin" });
+      const made = cli(["new", KIND, "--from", "-"], JSON.stringify(rest));
+      expect(made).toMatchObject({ status: 0, doc: { id: "ws-004", path: "decisions/ws-004-from-stdin.md" } });
+      expect(existsSync(join(dir, "decisions", "ws-004-from-stdin.md"))).toBe(true);
+      const reviewed = cli(["review", "ws-004", "--kind", KIND, "--verdict", "agree", "--by", "alice"]);
+      expect(reviewed).toMatchObject({ status: 0, doc: { review: { reviewer: "alice", verdict: "agree" } } });
+      const refused = cli(["review", "ws-004", "--kind", KIND, "--verdict", "dissent", "--by", "bob"]);
+      expect(refused).toMatchObject({ status: 1, doc: { error: { code: "review-note-required" } } });
+      writeFileSync(join(dir, "patch.json"), JSON.stringify({ title: "Changed" }));
+      expect(cli(["amend", "ws-004", "--kind", KIND, "--set", "patch.json"])).toMatchObject({ status: 1, doc: { error: { code: "amend-supersede-instead" } } });
+      expect(cli(["amend", "ws-004", "--set", "patch.json"])).toMatchObject({ status: 1, doc: { error: { code: "write-usage-invalid" } } });
+    },
+    120_000,
+  );
+
+  test(
+    "new --by writes the proposer, not the decider, and amend --by is refused rather than dropped (#2756)",
+    () => {
+      const { id: _id, ...rest } = decision({ title: "Kept by a session", state: "proposed", choice: null, decided_by: null, decided_on: null });
+      const made = cli(["new", KIND, "--from", "-", "--by", "hud-session"], JSON.stringify(rest));
+      expect(made).toMatchObject({ status: 0, doc: { id: "ws-004" } });
+      const fm = parseFrontMatter(readFileSync(join(dir, "decisions", "ws-004-kept-by-a-session.md"), "utf-8"));
+      if (!fm.ok) throw new Error(fm.message);
+      expect(fm.value).toMatchObject({ proposed_by: "hud-session", decided_by: null });
+
+      writeFileSync(join(dir, "patch.json"), JSON.stringify({ title: "Changed" }));
+      const refused = cli(["amend", "ws-004", "--kind", KIND, "--set", "patch.json", "--by", "alice"]);
+      expect(refused).toMatchObject({ status: 1, doc: { error: { code: "write-usage-invalid", message: expect.stringContaining("--by is not taken by amend") } } });
+    },
+    120_000,
+  );
+});

package/src/workspace/records-write.test.ts

@@ -2,14 +2,13 @@
  * `chant workspace records new|amend|review` (#2670): each command validates
  * before it writes, writes exactly one file or none, and refuses with a closed
  * code. Run in a directory outside git holding a copy of the decision kind.
+ * The same commands through the CLI are in records-write.e2e.test.ts (#2817).
  */
 
-import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { cpSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { pathToFileURL } from "node:url";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
 import { parseFrontMatter, recordTextDigest } from "./records";
 import { allocateId, amendRecord, newRecord, renderRecord, reviewRecord, toYaml } from "./records-write";
@@ -187,7 +186,7 @@ describe("records new", () => {
   });
 
   test("keeps the width of the ids it follows", () => {
-    const entry = (id: string) => ({ id, path: `d/${id}-x.md`, state: null, valid: true, reasons: [], supersededBy: null, data: {}, digest: "", assets: [], warnings: [] });
+    const entry = (id: string) => ({ id, path: `d/${id}-x.md`, state: null, valid: true, reasons: [], supersededBy: null, remediatedBy: [], data: {}, digest: "", assets: [], warnings: [] });
     expect(allocateId([entry("s-0009"), entry("s-0010")], undefined, "k")).toBe("s-0011");
     expect(allocateId([entry("s-999")], undefined, "k")).toBe("s-1000");
     // Case and padding come from the records (#2683).
@@ -225,6 +224,35 @@ describe("records new", () => {
   test("a kind that can't be read is its read error", async () => {
     expect(code(await newRecord({ kind: "missing.kind.mjs", fields: fields(fresh()), cwd: dir }))).toBe("kind-unreadable");
   });
+
+  test("--by names the proposer of a record that opens proposed, apart from decided_by (#2756)", async () => {
+    const { id: _id, ...freshProposal } = proposal({ title: "Filed by someone" });
+    const proposed = await newRecord({ kind: KIND, fields: fields(freshProposal), by: "carol", cwd: dir });
+    expect(code(proposed)).toBe("ok");
+    const proposedPath = (proposed as { path: string }).path.replace("decisions/", "");
+    expect(data(proposedPath)).toMatchObject({ proposed_by: "carol", decided_by: null });
+
+    // A conflicting proposed_by given in the fields is refused, same as a conflicting decided_by is today.
+    const conflict = await newRecord({ kind: KIND, fields: fields({ ...freshProposal, title: "Two proposers", proposed_by: "dave" }), by: "carol", cwd: dir });
+    expect(code(conflict)).toBe("write-input-invalid");
+  });
+
+  test("--by names the decider when a new record opens straight into a later state", async () => {
+    const { id: _id, decided_by: _db, ...freshDecided } = decision({ title: "Decided at once" });
+    const decidedDoc = await newRecord({ kind: KIND, fields: fields({ ...freshDecided, decided_by: null }), by: "dana", cwd: dir });
+    expect(code(decidedDoc)).toBe("ok");
+    const decidedPath = (decidedDoc as { path: string }).path.replace("decisions/", "");
+    expect(data(decidedPath)).toMatchObject({ decided_by: "dana" });
+    expect(data(decidedPath)).not.toHaveProperty("proposed_by");
+  });
+
+  test("--by is refused for a kind whose new record opens decided and declares no reviews", async () => {
+    const kindFile = join(dir, "decisions", "decision.kind.mjs");
+    writeFileSync(kindFile, readFileSync(kindFile, "utf-8").replace(/^\s*reviews: \{[^}]*\},?\n/m, ""));
+    const { id: _id, decided_by: _db, ...freshDecided } = decision({ title: "No reviews declared" });
+    const doc = await newRecord({ kind: KIND, fields: fields({ ...freshDecided, decided_by: null }), by: "erin", cwd: dir });
+    expect(code(doc)).toBe("write-usage-invalid");
+  });
 });
 
 describe("records amend", () => {
@@ -336,40 +364,3 @@ describe("records review", () => {
     expect(code(await reviewRecord({ kind: KIND, id: "ws-001", verdict: "agree", by: "a", cwd: dir }))).toBe("review-unsupported");
   });
 });
-
-describe("the command line", () => {
-  const cli = (args: string[], input?: string) => {
-    const loader = pathToFileURL(join(REPO, "node_modules", "tsx", "dist", "loader.mjs")).href;
-    try {
-      const out = execFileSync(process.execPath, ["--import", loader, join(REPO, "packages", "core", "src", "cli", "main.ts"), "workspace", "records", ...args], {
-        cwd: dir,
-        input,
-        encoding: "utf-8",
-        env: { ...process.env, TSX_DISABLE_CACHE: "1" },
-        stdio: ["pipe", "pipe", "pipe"],
-      });
-      return { status: 0, doc: JSON.parse(out) };
-    } catch (err) {
-      const e = err as { status: number; stdout: string };
-      return { status: e.status, doc: JSON.parse(e.stdout) };
-    }
-  };
-
-  test(
-    "new reads fields from standard input, review appends, and a refusal exits 1 with its code",
-    () => {
-      const { id: _id, ...rest } = decision({ title: "From stdin" });
-      const made = cli(["new", KIND, "--from", "-"], JSON.stringify(rest));
-      expect(made).toMatchObject({ status: 0, doc: { id: "ws-004", path: "decisions/ws-004-from-stdin.md" } });
-      expect(existsSync(join(dir, "decisions", "ws-004-from-stdin.md"))).toBe(true);
-      const reviewed = cli(["review", "ws-004", "--kind", KIND, "--verdict", "agree", "--by", "alice"]);
-      expect(reviewed).toMatchObject({ status: 0, doc: { review: { reviewer: "alice", verdict: "agree" } } });
-      const refused = cli(["review", "ws-004", "--kind", KIND, "--verdict", "dissent", "--by", "bob"]);
-      expect(refused).toMatchObject({ status: 1, doc: { error: { code: "review-note-required" } } });
-      writeFileSync(join(dir, "patch.json"), JSON.stringify({ title: "Changed" }));
-      expect(cli(["amend", "ws-004", "--kind", KIND, "--set", "patch.json"])).toMatchObject({ status: 1, doc: { error: { code: "amend-supersede-instead" } } });
-      expect(cli(["amend", "ws-004", "--set", "patch.json"])).toMatchObject({ status: 1, doc: { error: { code: "write-usage-invalid" } } });
-    },
-    120_000,
-  );
-});