@intentius/chant 0.91.0 → 0.93.0

package/src/workspace/checks/diagrams.ts

@@ -0,0 +1,108 @@
+/**
+ * The diagram checks, WSP131 to WSP133 (#2764).
+ *
+ * A declared diagram names a source and a render, pinned to the renderer
+ * its render was made with. chant never runs a renderer (ws-052), on a read
+ * path or here: these checks read the declaration and the tree checked
+ * only, and a render's drift is caught by comparing a recorded content hash,
+ * never by re-rendering the source.
+ *
+ * | Id | Code | Fails when |
+ * |---|---|---|
+ * | WSP131 | `diagram-source-missing` | a diagram names a source, and it does not exist in the tree read |
+ * | WSP132 | `diagram-render-missing` | a diagram's render does not exist in the tree read |
+ * | WSP133 | `diagram-render-drift` | a diagram records a `sourceHash`, and the source's bytes now hash to something else |
+ *
+ * WSP133 is opt-in per diagram: without a recorded `sourceHash` there is
+ * nothing to compare, so the entry is silently not checked for drift. A
+ * declaration records one by hashing the source when it commits a fresh
+ * render, the way a decision's evidence pins a file by hash
+ * (`../record-assets.ts`). Comparing that one recorded hash against the
+ * source in the tree read is cheap and deterministic, unlike shelling out to
+ * the pinned renderer and diffing its output, which chant does nowhere.
+ */
+
+import { sha256Hex } from "../../content-digest";
+import type { WorkspaceCheck, WorkspaceCheckContext, WorkspaceDiagnostic } from "../checks";
+import { declaredDiagrams, type DiagramDeclaration } from "../declaration";
+import type { ReasonCode } from "../reason-codes";
+
+/** The read contract's codes for the diagram findings, carried as `code` on each. */
+export const DIAGRAM_FINDING_CODES = ["diagram-source-missing", "diagram-render-missing", "diagram-render-drift"] as const satisfies readonly ReasonCode[];
+
+export const WSP_DIAGRAM_SOURCE_MISSING = "WSP131";
+export const WSP_DIAGRAM_RENDER_MISSING = "WSP132";
+export const WSP_DIAGRAM_RENDER_DRIFT = "WSP133";
+
+const where = (d: DiagramDeclaration) => (d.member === null ? "the workspace's own" : `member ${d.member}'s`);
+
+function diagramFinding(check: WorkspaceCheck, d: DiagramDeclaration, field: "source" | "render" | "sourceHash", code: (typeof DIAGRAM_FINDING_CODES)[number], message: string): WorkspaceDiagnostic {
+  return {
+    checkId: check.id,
+    severity: check.severity,
+    code,
+    message: `${code}: ${message}`,
+    entity: d.member ?? undefined,
+    pointer: `${d.pointer}/${field}`,
+  };
+}
+
+export const DIAGRAM_CHECKS: readonly WorkspaceCheck[] = [
+  {
+    id: WSP_DIAGRAM_SOURCE_MISSING,
+    name: "diagram-source-missing",
+    description: "A diagram's source file, when it names one, exists in the tree read.",
+    severity: "error",
+    configurable: true,
+    check(ctx: WorkspaceCheckContext) {
+      const out: WorkspaceDiagnostic[] = [];
+      for (const d of declaredDiagrams(ctx.declaration)) {
+        if (d.source === null || ctx.tree.stat(d.source) === "file") continue;
+        out.push(diagramFinding(this, d, "source", "diagram-source-missing", `${where(d)} diagram ${d.name} names the source ${d.source}, which does not exist${ctx.tree.label}`));
+      }
+      return out;
+    },
+  },
+  {
+    id: WSP_DIAGRAM_RENDER_MISSING,
+    name: "diagram-render-missing",
+    description: "A diagram's render exists in the tree read.",
+    severity: "error",
+    configurable: true,
+    check(ctx: WorkspaceCheckContext) {
+      const out: WorkspaceDiagnostic[] = [];
+      for (const d of declaredDiagrams(ctx.declaration)) {
+        if (ctx.tree.stat(d.render) === "file") continue;
+        out.push(diagramFinding(this, d, "render", "diagram-render-missing", `${where(d)} diagram ${d.name} names the render ${d.render}, which does not exist${ctx.tree.label}`));
+      }
+      return out;
+    },
+  },
+  {
+    id: WSP_DIAGRAM_RENDER_DRIFT,
+    name: "diagram-render-drift",
+    description: "A diagram that records a sourceHash is unchanged since its render was made: the source's bytes still hash to it. Runs no renderer.",
+    severity: "error",
+    configurable: true,
+    check(ctx: WorkspaceCheckContext) {
+      const out: WorkspaceDiagnostic[] = [];
+      for (const d of declaredDiagrams(ctx.declaration)) {
+        if (d.sourceHash === null || d.source === null) continue;
+        if (ctx.tree.stat(d.source) !== "file") continue; // diagram-source-missing already reports it
+        const bytes = ctx.tree.bytes ? ctx.tree.bytes(d.source) : Buffer.from(ctx.tree.read(d.source), "utf-8");
+        const actual = sha256Hex(bytes);
+        if (actual === d.sourceHash) continue;
+        out.push(
+          diagramFinding(
+            this,
+            d,
+            "sourceHash",
+            "diagram-render-drift",
+            `${where(d)} diagram ${d.name}'s source ${d.source} changed since ${d.render} was rendered from it: recorded sourceHash ${d.sourceHash.slice(0, 12)} does not match the source's current hash ${actual.slice(0, 12)}${ctx.tree.label}; rerun the renderer and commit the result, or update sourceHash`,
+          ),
+        );
+      }
+      return out;
+    },
+  },
+];

package/src/workspace/checks/records.ts

@@ -15,11 +15,20 @@
  * | WSP114 | the records of `--kind` can't be read (fixed) |
  * | WSP115 | a record kind the declaration names is missing or does not load as one (fixed, #2680) |
  * | WSP116 | an answer kind's decision points file is missing or not valid (fixed, ws-058, #2738) |
+ * | WSP117 | a done work item has an acceptance criterion no passing evidence meets (#2772) |
+ *
+ * WSP117 reads the records of every declared work kind with acceptance
+ * criteria, in the working tree, and the records of `--kind`. It carries the
+ * reason code `work-acceptance-unmet`.
  */
 
 import type { WorkspaceCheck, WorkspaceDiagnostic } from "../checks";
+import type { ReasonCode } from "../reason-codes";
 import type { ReadErrorCode, RecordEntry } from "../records";
 
+/** The read contract's codes the record checks carry as `code`: WSP117's (#2772). */
+export const RECORD_FINDING_CODES = ["work-acceptance-unmet"] as const satisfies readonly ReasonCode[];
+
 /** The records `check --kind` read, or why they could not be read. */
 export type RecordFacts =
   | { kind: string; records: readonly (RecordEntry & { file: string })[] }
@@ -124,4 +133,42 @@ export const RECORD_CHECKS: readonly WorkspaceCheck[] = [
       return out;
     },
   },
+  {
+    id: "WSP117",
+    name: "work-acceptance-unmet",
+    description:
+      "Every done work item meets its acceptance criteria: each has evidence that names it, passed, and has the verification the criterion expects, and a manual verdict is from someone other than the implementer (#2772).",
+    severity: "error",
+    configurable: true,
+    check(ctx) {
+      const out: WorkspaceDiagnostic[] = [];
+      const seen = new Set<string>();
+      const facts = ctx.facts?.records;
+      if (facts && !("error" in facts)) {
+        for (const r of facts.records) {
+          if (r.supersededBy !== null) continue;
+          const w = r.warnings.find((x) => x.code === "work-acceptance-unmet");
+          if (!w || seen.has(r.file)) continue;
+          seen.add(r.file);
+          out.push({ checkId: this.id, severity: this.severity, message: w.message, pointer: "", file: r.file, code: "work-acceptance-unmet" });
+        }
+      }
+      for (const k of ctx.facts?.declaredKinds ?? []) {
+        for (const a of k.acceptance ?? []) {
+          if (a.unmet === null || seen.has(a.file)) continue;
+          seen.add(a.file);
+          out.push({
+            checkId: this.id,
+            severity: this.severity,
+            message: a.unmet,
+            ...(k.declared.member !== null ? { entity: k.declared.member } : {}),
+            pointer: "",
+            file: a.file,
+            code: "work-acceptance-unmet",
+          });
+        }
+      }
+      return out;
+    },
+  },
 ];

package/src/workspace/checks.ts

@@ -29,8 +29,11 @@
  * | WSP111 to WSP114 | records read with `--kind` (#2549) |
  * | WSP115 | the record kinds the declaration names (#2680) |
  * | WSP116 | the decision points file of each declared answer kind (ws-058) |
+ * | WSP117 | a done work item's acceptance criteria all met (#2772) |
  * | WSP121, WSP122 | boxes: no literal credential, every capability brokered (#2726) |
  * | WSP123, WSP124 | box isolation: no shared port, state path or cookie, no literal machine path (#2727) |
+ * | WSP125 | boxes: a fountain Box declares the callback token fountain gives its sandbox (#2780) |
+ * | WSP131 to WSP133 | diagram artifacts: source and render exist, a recorded source hash still matches (#2764) |
  */
 
 import { realpathSync } from "node:fs";
@@ -49,6 +52,7 @@ import { gatherLedgerFacts, LEDGER_CHECKS, type MemberLedgerFacts } from "./chec
 import { gatherPipelineFacts, PIPELINE_CHECKS, type MemberPipelineFacts } from "./checks/pipelines";
 import { RECORD_CHECKS, type RecordFacts } from "./checks/records";
 import { BOX_CHECKS } from "./checks/boxes";
+import { DIAGRAM_CHECKS } from "./checks/diagrams";
 import { loadDeclaredKinds, type DeclaredKind } from "./declared-kinds";
 
 /**
@@ -319,6 +323,8 @@ export const WORKSPACE_CHECKS: readonly WorkspaceCheck[] = [
   ...RECORD_CHECKS,
   // Boxes and their brokered capabilities (#2726).
   ...BOX_CHECKS,
+  // Diagram artifacts (#2764).
+  ...DIAGRAM_CHECKS,
 ];
 
 const BY_ID = new Map(WORKSPACE_CHECKS.map((c) => [c.id, c]));
@@ -461,7 +467,8 @@ export async function runDeclarationChecks(
   const { registry, problems } = loadKindRegistry(declaration.pins, root);
   const gathered = options.gather === false || options.tree ? {} : await gatherWorkspaceFacts(root, declaration, options);
   // The declared record kinds load from the working tree; under --at only whether each exists at the revision is checked (#2680).
-  const declaredKinds = options.gather === false ? undefined : await loadDeclaredKinds(declaration, tree, root, { load: !options.tree });
+  // A declared work kind's acceptance criteria are counted in the working tree too (#2772).
+  const declaredKinds = options.gather === false ? undefined : await loadDeclaredKinds(declaration, tree, root, { load: !options.tree, acceptance: !options.tree });
   const facts: WorkspaceFacts = { ...gathered, ...(options.records ? { records: options.records } : {}), ...(declaredKinds ? { declaredKinds } : {}) };
   const ctx: WorkspaceCheckContext = { declaration, tree, groups, kinds: registry, kindProblems: problems, facts };
   const findings = runWorkspaceChecks(ctx);

package/src/workspace/compose-graph.ts

@@ -113,6 +113,8 @@ export interface GraphRecord {
   state: string | null;
   valid: boolean;
   supersededBy: string | null;
+  /** The ids of records whose remediates link names this one (#2774). */
+  remediatedBy: string[];
 }
 
 /** Read one member's `chant graph --format ir` output, upgrading an unversioned (v1) IR in place. */

package/src/workspace/conformance/__fixture__/decisions/decision.kind.mjs

@@ -17,6 +17,9 @@ export const recordKind = {
   // Sealed once reached (#2555).
   closedStates: ["ratified", "superseded"],
   supersedes: { field: "supersedes", key: "decision" },
+  // A remediates link names a closed decision this one fixes the consequence
+  // of, without replacing it: the target's state never changes (#2774).
+  remediates: { field: "remediates", key: "decision" },
   // A supersedes link takes effect under an equal or stricter approval rule
   // (#2524 D4): from a record ranked above 0 and at least as high as the one it
   // names. A decided record supersedes a decided or proposed one, a ratified
@@ -26,9 +29,16 @@ export const recordKind = {
   pins: { field: "evidence" },
   // member:<name> and path:<path> entries are the record's links in workspace graph (#2549).
   constrains: { field: "constrains" },
+  // Workspace paths a change carrying the decision out must not touch
+  // (#2773): chant workspace check --changes reports change-out-of-scope.
+  outOfScope: { field: "out_of_scope" },
   // Verdicts, and the field naming the decider, for each record's digest and
   // quorum (#2671, #2672).
   reviews: { field: "reviews", decider: "decided_by" },
+  // records new --by and the MCP records-new tool's by name a proposal's
+  // proposer here, apart from decided_by, which stays null until the
+  // decision is decided (#2756).
+  proposedBy: { field: "proposed_by" },
   // source is where a decision came from, and says where its proposal came
   // from too: via, client, harness, model, session, turns and a transcript
   // pinned by hash (#2708).

package/src/workspace/conformance/__fixture__/decisions/decision.schema.json

@@ -116,6 +116,19 @@
         ]
       }
     },
+    "remediates": {
+      "description": "Closed decisions this one fixes the consequence of, without replacing them: each names the decision by id and may say why (#2774). The named decision's status never changes because of a remediates link; a decision still open is amended instead, never remediated. Optional: most decisions remediate nothing.",
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["decision"],
+        "properties": {
+          "decision": { "$ref": "#/definitions/decisionId" },
+          "reason": { "type": ["string", "null"] }
+        }
+      }
+    },
     "evidence": {
       "description": "The research, audits, design sections and workspace files behind the decision. A public link carries a url; a file in the workspace carries a path and the hash of its bytes (#2549). May be empty when the decision cites nothing; chant workspace records then warns decision-no-evidence (#2654).",
       "type": "array",
@@ -127,6 +140,10 @@
       "description": "Who chose. A forge login. Null in state proposed or withdrawn.",
       "type": ["string", "null"]
     },
+    "proposed_by": {
+      "description": "Who proposed this decision: the name chant workspace records new --by or the MCP records-new tool's by wrote, for a decision that opened proposed (#2756). Null or absent when nobody named a proposer, or the decision opened straight into a later state. Never cleared by a later decide, ratify or supersede.",
+      "type": ["string", "null"]
+    },
     "decided_on": {
       "description": "When the choice was made, as YYYY-MM-DD. Quoted, so YAML reads it as a string.",
       "type": ["string", "null"],
@@ -218,6 +235,15 @@
         "type": "string",
         "pattern": "^([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+#[0-9]+|[a-z][a-z0-9]{0,15}-[0-9]{3,}|member:[a-z0-9][a-z0-9-]{0,39}|path:(?!/)(?!(?:[^/]*/)*\\.{1,2}(?:/|$))(?!.*//)[^\\\\\\u0000-\\u001f]*[^/\\\\\\u0000-\\u001f])$"
       }
+    },
+    "out_of_scope": {
+      "description": "Workspace paths this decision puts out of scope (#2773): files or directories, from the workspace root, that a change carrying out the decision must not touch. chant workspace check --changes reports a change to one as change-out-of-scope while the decision is in hand, and the decision does not cover it even where its constrains would. Optional.",
+      "type": "array",
+      "items": {
+        "type": "string",
+        "pattern": "^(?!/)(?!(?:[^/]*/)*\\.{1,2}(?:/|$))(?!.*//)[^\\\\\\u0000-\\u001f]*[^/\\\\\\u0000-\\u001f]$"
+      },
+      "uniqueItems": true
     }
   },
   "allOf": [

package/src/workspace/conformance/index.ts

@@ -346,6 +346,9 @@ export function mcpToolCall(argv: readonly string[]): { name: string; arguments:
     else if (a === "--since") args.since = value();
     else if (a === "--compare-to") args.compareTo = value();
     else if (a === "--intent") args.intent = value();
+    else if (a === "--changes") args.range = value();
+    else if (a === "--work") args.work = value();
+    else if (a === "--severity") args.severity = value();
     else if (a === "--current") args.current = true;
     else if (a === "--composites") args.composites = true;
     else if (a.startsWith("-")) return undefined;
@@ -358,6 +361,8 @@ export function mcpToolCall(argv: readonly string[]): { name: string; arguments:
       return positional.length === 1 && kinds.length === 0 ? { name: "workspace-status", arguments: { ...args, env: positional[0] } } : undefined;
     case "records":
       return positional.length === 0 && kinds.length <= 1 ? { name: "workspace-records", arguments: { ...args, ...(kinds.length ? { kind: kinds[0] } : {}) } } : undefined;
+    case "check":
+      return positional.length === 0 && args.range !== undefined ? { name: "workspace-changes", arguments: { ...args, ...(kinds.length ? { kind: kinds } : {}) } } : undefined;
     case "graph":
       return positional.length === 0 ? { name: "workspace-graph", arguments: { ...args, ...(kinds.length ? { kind: kinds } : {}) } } : undefined;
     default:

package/src/workspace/decide.test.ts

@@ -134,7 +134,7 @@ describe("points ask (#2739)", () => {
     expect(q).toMatchObject({ state: "escalated", open: true, current: true, model: { answer: "medium", confidence: 0.175, threshold: 0.8, model: "bosun-v3.1-1.7b", observed: false } });
     expect(q.escalations.map((e) => e.reason)).toEqual(["no row matches these inputs", "not observed: confidence 0.175 is below the threshold 0.8"]);
     expect(listed.questions.every((x) => x.open)).toBe(true);
-    expect(listed.points.map((p) => p.name)).toEqual(["slice-tier", "ship-skip", "needs-decision"]);
+    expect(listed.points.map((p) => p.name)).toEqual(["slice-tier", "ship-skip", "finding-triage", "needs-a-decision", "needs-decision"]);
     expect(listed.points[0].inputs[0]).toEqual({ name: "work-item.criteria", output: "work-item", description: "acceptance criteria in the work item" });
 
     // A later ask still escalating keeps the standing record; one a model answers rewrites it, as proposed.

package/src/workspace/decide.ts

@@ -66,6 +66,10 @@ import { policyAtBase, resolveBase } from "./trust/provenance";
 import { emptyPolicy, type TrustPolicy } from "./trust/policy";
 import { AGENT_ROLE } from "./records-cli";
 import type { SourceVia } from "./source-block";
+import type { RecordSource } from "./record-source";
+import { currentStewardTurn } from "../op/steward-turn";
+import { RefCASConflictError } from "../lifecycle/git";
+import { readLedgerAnswers, refreshLedger, withLedgerAnswers, writeLedgerAnswer, type LedgerAnswers } from "./answers-ledger";
 
 /** The version of the write documents `points ask` and `points answer` print. */
 export const POINTS_WRITE_CONTRACT_VERSION = 1;
@@ -93,6 +97,8 @@ export const POINTS_WRITE_ERROR_CODES = [
   "record-not-found",
   "record-closed",
   "record-id-taken",
+  /** The answer was given during a steward's turn (#2749): a steward never answers a question, its own or another's. */
+  "answer-in-steward-turn",
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 export type PointsWriteErrorCode = (typeof POINTS_WRITE_ERROR_CODES)[number];
@@ -141,12 +147,47 @@ export interface QuestionView {
   answeredBy: string[];
   askedOn: string | null;
   answeredOn: string | null;
+  /**
+   * The steward whose turn asked the question (#2749), and the run it was in,
+   * or null when no steward asked it. The steward waits on the question and
+   * never answers it: a person does, through hud or `points answer`.
+   */
+  askedBy: { steward: string; run: string | null } | null;
+  /**
+   * Where the record is held when it is on the lifecycle ledger rather than
+   * in the working tree (#2786): `chant/lifecycle:<path>`, which `git show`
+   * reads. A question asked in a steward's turn is held there, since a
+   * steward never writes the checkout. null for a record in the tree; `path`
+   * is where the record reads as being either way.
+   */
+  ledger: string | null;
   valid: boolean;
   warnings: RecordWarning[];
 }
 
-/** One answer record as a {@link QuestionView}, or null when its front matter can't be read. `point` is its point as declared now, when there is one. */
-export function questionView(entry: RecordEntry, point: Point | undefined): QuestionView | null {
+/** The harness a steward's question names in its source block (#2749). */
+export const STEWARD_HARNESS = "chant-steward";
+
+/** The steward that asked, from a record's source block, or null. */
+export function askedByOf(data: Record<string, unknown>): QuestionView["askedBy"] {
+  const source = data.source;
+  if (source === null || typeof source !== "object" || Array.isArray(source)) return null;
+  const s = source as Record<string, unknown>;
+  if (s.harness !== STEWARD_HARNESS) return null;
+  const client = s.client as Record<string, unknown> | undefined;
+  const steward = client && typeof client.name === "string" ? client.name : null;
+  if (steward === null) return null;
+  const session = s.session as Record<string, unknown> | string | undefined;
+  const run = typeof session === "string" ? session : session && typeof session === "object" && typeof session.id === "string" ? session.id : null;
+  return { steward, run };
+}
+
+/**
+ * One answer record as a {@link QuestionView}, or null when its front matter
+ * can't be read. `point` is its point as declared now, when there is one, and
+ * `ledger` where the record is held when it is on the lifecycle ledger.
+ */
+export function questionView(entry: RecordEntry, point: Point | undefined, ledger: string | null = null): QuestionView | null {
   const d = entry.data;
   if (d === null || entry.id === null) return null;
   const str = (v: unknown): string | null => (typeof v === "string" ? v : null);
@@ -187,6 +228,8 @@ export function questionView(entry: RecordEntry, point: Point | undefined): Ques
     answeredBy: Array.isArray(d.answered_by) ? d.answered_by.filter((b): b is string => typeof b === "string") : [],
     askedOn: str(d.asked_on),
     answeredOn: str(d.answered_on),
+    askedBy: askedByOf(d),
+    ledger,
     valid: entry.valid,
     warnings: entry.warnings,
   };
@@ -276,6 +319,21 @@ export interface AskPointOptions {
   via?: SourceVia;
   /** The client that asked, for its source block. */
   client?: { name: string; version?: string };
+  /**
+   * The steward whose turn asks (#2749), and its run. Recorded in the source
+   * block (harness `chant-steward`, the steward as the client, the run as the
+   * session), so the question says who is waiting on it and `points answer`
+   * never counts the steward toward its quorum. Takes the place of `client`.
+   */
+  steward?: { name: string; run?: string };
+  /**
+   * Where a new record goes: the answer kind's directory in the working tree,
+   * or the lifecycle ledger (#2786). Defaults to the ledger in a steward's
+   * turn (`steward` given, or this process a steward's turn), since a steward
+   * never writes the checkout, and to the tree otherwise. A question already
+   * held on the ledger is rewritten there whatever this says.
+   */
+  store?: "tree" | "ledger";
   /** The date written as asked_on, and answered_on for a table's answer, YYYY-MM-DD. Defaults to today, in UTC. */
   on?: string;
   dryRun?: boolean;
@@ -319,9 +377,34 @@ function checkInputs(name: string, point: Point, inputs: unknown): Record<string
   return inputs as Record<string, unknown>;
 }
 
-/** Write `data` as the record at `path`, after reading it back with every other record. */
-async function write(o: Opened, before: RecordEntry[], path: string, text: string, create: boolean, dryRun: boolean): Promise<RecordWarning[]> {
-  const warnings = await validateWrite(o, before, path, text);
+/** Where a write goes: the working tree, or the lifecycle ledger (#2786). */
+interface WriteTarget {
+  /** The records as read: the tree with the ledger's answers laid over it. */
+  source: RecordSource;
+  ledger: LedgerAnswers;
+  /** Write to the ledger rather than the tree. */
+  onLedger: boolean;
+  message: string;
+}
+
+/**
+ * Write `text` as the record at `path`, after reading it back with every
+ * other record: into the working tree, or onto the ledger. Returns the
+ * record's warnings and, for a ledger write, where it went.
+ */
+async function write(o: Opened, before: RecordEntry[], path: string, text: string, create: boolean, dryRun: boolean, target: WriteTarget): Promise<{ warnings: RecordWarning[]; ledger: string | null }> {
+  const warnings = await validateWrite(o, before, path, text, target.source);
+  const held = target.ledger.byPath.get(path);
+  if (target.onLedger) {
+    if (dryRun) return { warnings, ledger: held?.ledger ?? null };
+    try {
+      const { ledger } = await writeLedgerAnswer(target.ledger, path, text, target.message, held?.sha ?? null);
+      return { warnings, ledger };
+    } catch (err) {
+      if (err instanceof RefCASConflictError) throw new PointsWriteError("record-id-taken", `${path} was written on chant/lifecycle by another ask or answer at the same time: ask again to read it`);
+      throw err;
+    }
+  }
   if (!dryRun) {
     try {
       writeFileSync(abs(o, path), text, create ? { flag: "wx" } : undefined);
@@ -330,7 +413,14 @@ async function write(o: Opened, before: RecordEntry[], path: string, text: strin
       throw err;
     }
   }
-  return warnings;
+  return { warnings, ledger: null };
+}
+
+/** The kind's answers on the ledger, and its records read with them laid over the tree. */
+async function readWithLedger(o: Opened): Promise<{ ledger: LedgerAnswers; source: RecordSource; before: RecordEntry[] }> {
+  const ledger = await readLedgerAnswers({ file: o.loaded.file, name: o.loaded.kind.name, dirRel: o.dirRel });
+  const source = withLedgerAnswers(o.source, ledger);
+  return { ledger, source, before: await readAll(o, source) };
 }
 
 function recordData(o: Opened, fields: Record<string, unknown>): Record<string, unknown> {
@@ -355,15 +445,21 @@ function resultFields(result: ChainResult): Record<string, unknown> {
  */
 export async function askPoint(opts: AskPointOptions): Promise<PointsWriteDocument> {
   try {
+    // A steward's turn (#2749): named by the caller, or this process's, as when an Op shells out to `points ask`.
+    const turn = opts.steward ? undefined : currentStewardTurn();
+    const steward = opts.steward ?? (turn ? { name: turn.steward, ...(turn.run ? { run: turn.run } : {}) } : undefined);
+    const toLedger = opts.store !== undefined ? opts.store === "ledger" : steward !== undefined;
     const kinds = await answerKindFiles(opts.cwd, opts.kind);
     const { o, point } = await findPoint(kinds, opts.point, opts.cwd);
     const inputs = checkInputs(opts.point, point, opts.inputs);
     const version = pointVersion(point);
     const hash = inputsHash(opts.point, version, inputs);
     const id = answerId(opts.point, hash);
-    const before = await readAll(o, o.source);
+    if (toLedger && !opts.dryRun) await refreshLedger(o.loaded.file);
+    const { ledger, source: read, before } = await readWithLedger(o);
     const existing = before.find((e) => e.id === id);
-    const done = (entry: RecordEntry, extra: { reused: boolean; written: boolean; text?: string }): PointsWriteDocument => ({
+    const heldAt = (entry: RecordEntry): string | null => ledger.byPath.get(entry.path)?.ledger ?? null;
+    const done = (entry: RecordEntry, extra: { reused: boolean; written: boolean; text?: string; ledger?: string | null }): PointsWriteDocument => ({
       $schema: POINTS_WRITE_SCHEMA_ID,
       contract: POINTS_WRITE_CONTRACT_VERSION,
       verb: "ask",
@@ -373,7 +469,7 @@ export async function askPoint(opts: AskPointOptions): Promise<PointsWriteDocume
       reused: extra.reused,
       written: extra.written,
       dryRun: !!opts.dryRun,
-      question: questionView(entry, point)!,
+      question: questionView(entry, point, extra.ledger !== undefined ? extra.ledger : heldAt(entry))!,
       ...(extra.text !== undefined ? { text: extra.text } : {}),
     });
     if (existing && existing.data !== null && (existing.state === "answered" || existing.state === "proposed")) return done(existing, { reused: true, written: false });
@@ -393,7 +489,14 @@ export async function askPoint(opts: AskPointOptions): Promise<PointsWriteDocume
     const answer = result.status === "escalated" ? undefined : result.answer;
     const title = titleFor(point, opts.subject, state, answer);
     const modelId = result.status === "proposed" ? result.decider.model : undefined;
-    const source = { via: opts.via ?? "cli", ...(opts.client ? { client: opts.client } : {}), ...(modelId ? { model: modelId } : {}) };
+    const client = steward ? { name: steward.name } : opts.client;
+    const source = {
+      via: opts.via ?? "cli",
+      ...(steward ? { harness: STEWARD_HARNESS } : {}),
+      ...(client ? { client } : {}),
+      ...(modelId ? { model: modelId } : {}),
+      ...(steward?.run ? { session: { id: steward.run } } : {}),
+    };
     const data = recordData(o, {
       id,
       title,
@@ -411,16 +514,19 @@ export async function askPoint(opts: AskPointOptions): Promise<PointsWriteDocume
     });
     const path = existing ? existing.path : o.dirRel === "." ? `${id}.md` : `${o.dirRel}/${id}.md`;
     const text = renderRecord(data, body(point, title));
-    const warnings = await write(o, before, path, text, !existing, !!opts.dryRun);
-    const entry: RecordEntry = { ...(existing ?? emptyEntry(path)), id, path, state, data, valid: true, reasons: [], warnings };
-    return done(entry, { reused: false, written: !opts.dryRun, ...(opts.dryRun ? { text } : {}) });
+    // A steward's question goes on the ledger, and one already held there stays there (#2786).
+    const onLedger = toLedger || ledger.byPath.has(path);
+    const message = `Decision point ${opts.point}: ${state}${opts.subject ? ` (${opts.subject})` : ""}${steward ? `, asked by ${steward.name}` : ""}`;
+    const wrote = await write(o, before, path, text, !existing, !!opts.dryRun, { source: read, ledger, onLedger, message });
+    const entry: RecordEntry = { ...(existing ?? emptyEntry(path)), id, path, state, data, valid: true, reasons: [], warnings: wrote.warnings };
+    return done(entry, { reused: false, written: !opts.dryRun, ledger: wrote.ledger, ...(opts.dryRun ? { text } : {}) });
   } catch (err) {
     return failure("ask", err);
   }
 }
 
 function emptyEntry(path: string): RecordEntry {
-  return { id: null, path, state: null, valid: true, reasons: [], supersededBy: null, data: null, assets: [], warnings: [], digest: "" };
+  return { id: null, path, state: null, valid: true, reasons: [], supersededBy: null, remediatedBy: [], data: null, assets: [], warnings: [], digest: "" };
 }
 
 // ── points answer ────────────────────────────────────────────────────────────
@@ -453,9 +559,16 @@ function policyFor(root: string): TrustPolicy {
  * leaving out anyone holding the agent role in the trust policy at base, and,
  * when the quorum names roles, anyone holding none of them.
  */
-export function tallyQuorum(by: string[], quorum: { count: number; roles?: string[] }, policy: TrustPolicy): { counted: string[]; left: { name: string; why: string }[]; met: boolean } {
+export function tallyQuorum(
+  by: string[],
+  quorum: { count: number; roles?: string[] },
+  policy: TrustPolicy,
+  /** The steward that asked the question (#2749): it never counts toward the answer. */
+  steward?: string,
+): { counted: string[]; left: { name: string; why: string }[]; met: boolean } {
   const holders = (role: string) => new Set((policy.roles[role] ?? []).map(normalisePrincipal));
   const agents = holders(AGENT_ROLE);
+  const asker = steward !== undefined ? normalisePrincipal(steward) : undefined;
   const counted: string[] = [];
   const seen = new Set<string>();
   const left: { name: string; why: string }[] = [];
@@ -463,6 +576,10 @@ export function tallyQuorum(by: string[], quorum: { count: number; roles?: strin
     const p = normalisePrincipal(name);
     if (p === "" || seen.has(p)) continue;
     seen.add(p);
+    if (asker !== undefined && p === asker) {
+      left.push({ name, why: "is the steward that asked" });
+      continue;
+    }
     if (agents.has(p)) {
       left.push({ name, why: "holds the agent role" });
       continue;
@@ -484,20 +601,34 @@ export function tallyQuorum(by: string[], quorum: { count: number; roles?: strin
  */
 export async function answerPoint(opts: AnswerPointOptions): Promise<PointsWriteDocument> {
   try {
+    // A steward waits on a question and never answers one (#2749), as it never
+    // clears a gate: the answer has to come from a person, through hud or a
+    // shell, not from the steward's own turn or a process it started.
+    const turn = currentStewardTurn();
+    if (turn) {
+      throw new PointsWriteError(
+        "answer-in-steward-turn",
+        `this is the steward ${turn.steward}'s turn, and a steward never answers a decision point: a person answers ${opts.id} through hud or \`chant workspace points answer\` at a shell`,
+      );
+    }
     const kinds = await answerKindFiles(opts.cwd, opts.kind);
     if (kinds.length === 0) throw new PointsWriteError("points-undeclared", "no record kind with an answers block is declared: name one with --kind, or declare one in chant.workspace.json");
-    let found: { opened: OpenedPoints; before: RecordEntry[]; target: RecordEntry & { data: Record<string, unknown> } } | undefined;
+    let found:
+      | { opened: OpenedPoints; before: RecordEntry[]; read: Awaited<ReturnType<typeof readWithLedger>>; target: RecordEntry & { data: Record<string, unknown> } }
+      | undefined;
     for (const k of kinds) {
       const opened = await openAnswers(k, opts.cwd);
-      const before = await readAll(opened.o, opened.o.source);
-      const target = before.find((e) => e.id === opts.id);
+      // A question a steward asked is on the ledger (#2786), and people's answer goes back there.
+      const read = await readWithLedger(opened.o);
+      const target = read.before.find((e) => e.id === opts.id);
       if (target && target.data !== null) {
-        found = { opened, before, target: target as RecordEntry & { data: Record<string, unknown> } };
+        found = { opened, before: read.before, read, target: target as RecordEntry & { data: Record<string, unknown> } };
         break;
       }
     }
     if (!found) throw new PointsWriteError("record-not-found", `no answer record has id ${opts.id}`);
     const { opened, before, target } = found;
+    const ledger = found.read.ledger;
     const { o } = opened;
     const d = target.data;
     if (target.state === "answered") throw new PointsWriteError("record-closed", `${opts.id} is answered, and an answer never changes: ask again with other inputs, or change the point, which asks the question anew`);
@@ -511,7 +642,7 @@ export async function answerPoint(opts: AnswerPointOptions): Promise<PointsWrite
       throw new PointsWriteError("answer-not-candidate", `${opts.id} takes one of ${allowed.map((c) => JSON.stringify(c)).join(", ")}, not ${JSON.stringify(opts.answer)}`);
     }
     const quorum = quorumOf(point);
-    const tally = tallyQuorum(opts.by, quorum, policyFor(o.root));
+    const tally = tallyQuorum(opts.by, quorum, policyFor(o.root), askedByOf(d)?.steward);
     if (!tally.met) {
       const got = tally.counted.length;
       const left = tally.left.length ? `; not counted: ${tally.left.map((l) => `${l.name}, who ${l.why}`).join("; ")}` : "";
@@ -555,8 +686,10 @@ export async function answerPoint(opts: AnswerPointOptions): Promise<PointsWrite
     fields.title = titleFor(point, subject, "answered", value);
     const data = recordData(o, fields);
     const text = renderRecord(data, body(point, String(fields.title)));
-    const warnings = await write(o, before, target.path, text, false, !!opts.dryRun);
-    const entry: RecordEntry = { ...target, state: "answered", data, valid: true, reasons: [], warnings };
+    const onLedger = ledger.byPath.has(target.path);
+    const message = `Decision point ${name}: answered ${show(value, type)} by ${tally.counted.join(", ")}`;
+    const wrote = await write(o, before, target.path, text, false, !!opts.dryRun, { source: found.read.source, ledger, onLedger, message });
+    const entry: RecordEntry = { ...target, state: "answered", data, valid: true, reasons: [], warnings: wrote.warnings };
     return {
       $schema: POINTS_WRITE_SCHEMA_ID,
       contract: POINTS_WRITE_CONTRACT_VERSION,
@@ -567,7 +700,7 @@ export async function answerPoint(opts: AnswerPointOptions): Promise<PointsWrite
       reused: false,
       written: !opts.dryRun,
       dryRun: !!opts.dryRun,
-      question: questionView(entry, point)!,
+      question: questionView(entry, point, onLedger ? (wrote.ledger ?? ledger.byPath.get(target.path)?.ledger ?? null) : null)!,
       ...(opts.dryRun ? { text } : {}),
     };
   } catch (err) {