@intentius/chant 0.93.0 → 0.95.0

package/src/workspace/records-formats.test.ts

@@ -3,11 +3,11 @@
  * kinds without a lifecycle, a supersedes field of bare ids, schema files a
  * schema `$ref`s, and content-addressed ids.
  *
- * The fixtures are shaped like chud's records (jhgaylor/chud#78: units,
- * evidence named by the hash of its bytes, sessions, driver closures and
- * Markdown contracts, with draft-07 schemas that `$ref` a shared
- * `defs.schema.json`), trimmed to the fields that matter here. Each one reads
- * through a kind file alone: no reader code.
+ * The fixtures are shaped like a development-model plugin's records (ported
+ * from chud, jhgaylor/chud#78: units, evidence named by the hash of its
+ * bytes, sessions, driver closures and Markdown contracts, with draft-07
+ * schemas that `$ref` a shared `defs.schema.json`), trimmed to the fields
+ * that matter here. Each one reads through a kind file alone: no reader code.
  */
 
 import { execFileSync } from "node:child_process";
@@ -29,7 +29,7 @@ const validateOutput = new Ajv2020({ strict: true, allErrors: true }).compile(sc
 let root: string;
 beforeEach(() => {
   root = realpathSync(mkdtempSync(join(tmpdir(), "chant-record-formats-")));
-  writeChudModel();
+  writeAcmeModel();
 });
 afterEach(() => rmSync(root, { recursive: true, force: true }));
 
@@ -72,9 +72,9 @@ async function failure(kind: string): Promise<{ code: string; message: string }>
 const codes = (r: { reasons: Array<{ code: string }> }) => r.reasons.map((x) => x.code);
 const warned = (r: { warnings: Array<{ code: string }> }) => r.warnings.map((x) => x.code);
 
-// ── chud's model, as kind files ──────────────────────────────────────────────
+// ── acme's model, as kind files ──────────────────────────────────────────────
 
-const BASE = "https://schemas.example.test/chud-runtime/v0";
+const BASE = "https://schemas.example.test/acme-runtime/v0";
 const ref = (name: string) => ({ $ref: `defs.schema.json#/definitions/${name}` });
 
 const DEFS = {
@@ -106,7 +106,7 @@ const UNIT_SCHEMA = {
     scope: { type: "array", minItems: 1, items: ref("text") },
     base_commit: ref("gitId"),
     result: { type: "object", required: ["commit", "ref"], properties: { commit: { type: ["string", "null"] }, ref: { type: ["string", "null"] } } },
-    // A bare hash, as chud writes today, or a pin chant checks.
+    // A bare hash, as acme writes today, or a pin chant checks.
     evidence: {
       type: "array",
       items: { anyOf: [ref("sha256"), { type: "object", required: ["path", "sha256"], properties: { path: ref("text"), sha256: ref("sha256") } }] },
@@ -178,7 +178,7 @@ const CONTRACT_SCHEMA = {
   },
 };
 
-/** A kind file: data only, the way chud's model package would ship it. */
+/** A kind file: data only, the way acme's model package would ship it. */
 function kindFile(kind: Record<string, unknown>): string {
   return `export const recordKind = ${JSON.stringify(kind, null, 2)};\n`;
 }
@@ -235,7 +235,7 @@ const KINDS: Record<string, Record<string, unknown>> = {
   },
 };
 
-function writeChudModel(): void {
+function writeAcmeModel(): void {
   write("design/schemas/defs.schema.json", json(DEFS));
   write("design/schemas/unit.schema.json", json(UNIT_SCHEMA));
   write("design/schemas/evidence.schema.json", json(EVIDENCE_SCHEMA));
@@ -304,7 +304,7 @@ test("the output schema lists exactly the formats a kind file may name", () => {
 });
 
 describe("format json", () => {
-  test("chud's units, sessions and driver closures read through kind files alone", async () => {
+  test("acme's units, sessions and driver closures read through kind files alone", async () => {
     write("design/units/U-0001.json", json(unit("U-0001", { outcome: "done", closed_at: "2026-09-24T11:00:00.000Z" })));
     write("design/units/U-0002.json", json(unit("U-0002")));
     write("design/sessions/S-0001.json", json(SESSION));
@@ -407,7 +407,7 @@ describe("the write commands through a declared kind (#2680)", () => {
   test.each(["unit", "evidence"])("refuse the declared %s kind with write-usage-invalid", async (kind) => {
     write(
       "chant.workspace.json",
-      json({ name: "chud", schema: 1, members: [{ name: "design", dir: "design", kind: "other", because: "chud's records" }], records: [{ kind: `design/${kind}.kind.mjs` }] }),
+      json({ name: "acme", schema: 1, members: [{ name: "design", dir: "design", kind: "other", because: "acme's records" }], records: [{ kind: `design/${kind}.kind.mjs` }] }),
     );
     write("design/units/U-0001.json", json(unit("U-0001")));
     write("fields.json", "{}\n");
@@ -510,7 +510,7 @@ describe("kinds without a lifecycle", () => {
   const contract = (id: string, status: string, supersedes?: string | string[]) =>
     `---\nid: "${id}"\nstatus: "${status}"\n${supersedes === undefined ? "" : `supersedes: ${JSON.stringify(supersedes)}\n`}---\n\n# ${id}\n`;
 
-  test("supersedes as one id, as chud's contracts write it, derives supersededBy under approval ranks", async () => {
+  test("supersedes as one id, as acme's contracts write it, derives supersededBy under approval ranks", async () => {
     write("design/contracts/C-001-first.md", contract("C-001", "approved"));
     write("design/contracts/C-002-second.md", contract("C-002", "approved", "C-001"));
     write("design/contracts/C-003-draft.md", contract("C-003", "draft", "C-002"));
@@ -588,7 +588,7 @@ describe("schema.refs", () => {
 // ── 4. Content-addressed ids ─────────────────────────────────────────────────
 
 describe("idFrom sha256", () => {
-  test("chud's evidence reads with the hash of its bytes as its id, in the tree and under --at", async () => {
+  test("acme's evidence reads with the hash of its bytes as its id, in the tree and under --at", async () => {
     const h = writeEvidence();
     const bytes = readFileSync(join(root, "design", "evidence", `${h}.json`));
     expect(createHash("sha256").update(bytes).digest("hex")).toBe(h);

package/src/workspace/records-new.schema.json

@@ -164,6 +164,7 @@
                 "record-sign-failed",
                 "source-harvest-not-proposed",
                 "record-state-not-initial",
+                "ratify-quorum-not-met",
                 "record-unparseable",
                 "record-schema-invalid",
                 "record-id-duplicate",

package/src/workspace/records-quorum.test.ts

@@ -14,7 +14,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
 import { workingTreeSource } from "./record-source";
-import { computeQuorum, DEFAULT_QUORUM, loadRecordKind, normalisePrincipal, readRecords, recordTextDigest, type QuorumOptions, type RecordEntry } from "./records";
+import { computeQuorum, DEFAULT_QUORUM, loadRecordKind, normalisePrincipal, readRecords, recordTextDigest as rawDigest, type QuorumOptions, type RecordEntry } from "./records";
 
 const REPO = join(import.meta.dirname, "..", "..", "..", "..");
 const DECISIONS = join(REPO, "docs", "design", "decisions");
@@ -34,6 +34,13 @@ function review(reviewer: string, verdict: string, extra: Record<string, string>
     .join("\n");
 }
 
+/**
+ * A decision's digest: the decision kind names a ratified state, so its
+ * state line leaves the digest with the reviews and seal blocks (#2873).
+ * The rule tests below hold for that list as for the reviews block alone.
+ */
+const recordTextDigest = (text: string, fields: string | readonly string[] | null = ["reviews", "seal", "state"]) => rawDigest(text, fields);
+
 const BARE = recordTextDigest(SAMPLE);
 
 describe("recordTextDigest", () => {
@@ -41,7 +48,7 @@ describe("recordTextDigest", () => {
     expect(BARE).toMatch(/^[0-9a-f]{64}$/);
     const lines = SAMPLE.split("\n");
     const without = lines.filter((l) => l !== "reviews: []").join("\n");
-    expect(recordTextDigest(SAMPLE)).toBe(recordTextDigest(without, null));
+    expect(rawDigest(SAMPLE)).toBe(rawDigest(without, null));
   });
 
   test("does not move when a verdict is added, changed or removed", () => {
@@ -78,7 +85,7 @@ describe("recordTextDigest", () => {
       const file = join(dir, "ws-003.md");
       writeFileSync(file, withReviews(`${review("alice", "agree")}\n${review("bob", "dissent")}`));
       // The recipe in docs/src/content/docs/cli/workspace-records.mdx.
-      const awk = `awk 'NR==1&&$0=="---"{fm=1;print;next} fm&&$0=="---"{fm=0;skip=0;print;next} fm&&/^reviews[ \\t]*:/{skip=1;next} fm&&skip&&/^([ \\t#-]|$)/{next} {skip=0;print}' "${file}" | shasum -a 256`;
+      const awk = `awk 'NR==1&&$0=="---"{fm=1;print;next} fm&&$0=="---"{fm=0;skip=0;print;next} fm&&/^(reviews|seal|state)[ \\t]*:/{skip=1;next} fm&&skip&&/^([ \\t#-]|$)/{next} {skip=0;print}' "${file}" | shasum -a 256`;
       const out = execFileSync("sh", ["-c", awk], { encoding: "utf-8" });
       expect(out.split(" ")[0]).toBe(BARE);
     } finally {

package/src/workspace/records-sessions-write.test.ts

@@ -164,7 +164,8 @@ describe("records review --session (#2693)", () => {
     const root = declared();
     const { path } = await opened(root);
     const decision = join(root, "decisions", "ref-001-how-the-app-is-deployed.md");
-    const digest = recordTextDigest(readFileSync(decision, "utf-8"));
+    // The decision kind names a ratified state, so the state leaves the digest too (#2873).
+    const digest = recordTextDigest(readFileSync(decision, "utf-8"), ["reviews", "seal", "state"]);
 
     const dry = await reviewRecord({ kind: DECISIONS_KIND, id: "ref-001", verdict: "agree", by: "alice", session: "S-0002", dryRun: true, cwd: root });
     review.expectValid(dry);

package/src/workspace/records-since.test.ts

@@ -3,7 +3,8 @@
  * and the comparison. The fixture is a repository with commits for a review
  * session's open and close: between them the session closes with two
  * verdicts, ref-001 gains the two reviews that name it and is ratified,
- * a new decision supersedes ref-002, and ref-002's pin moves. Every document
+ * a new decision (ref-004, after the reference workspace's own ref-003)
+ * supersedes ref-002, and ref-002's pin moves. Every document
  * validates against records-since.schema.json.
  */
 
@@ -56,8 +57,8 @@ function sessionHistory(): { root: string; before: string; open: string; close:
   const text = readFileSync(ref002, "utf-8");
   writeFileSync(ref002, text.replace(/sha256: "[0-9a-f]{64}"/, `sha256: "${"a".repeat(64)}"`));
   writeFileSync(
-    join(root, "decisions", "ref-003-a-successor.md"),
-    text.replace(/^id: .*$/m, 'id: "ref-003"').replace(/^supersedes: \[\]$/m, 'supersedes:\n  - decision: "ref-002"'),
+    join(root, "decisions", "ref-004-a-successor.md"),
+    text.replace(/^id: .*$/m, 'id: "ref-004"').replace(/^supersedes: \[\]$/m, 'supersedes:\n  - decision: "ref-002"'),
   );
   const close = commitAll(root, "close S-0002");
   return { root, before, open, close };
@@ -85,11 +86,11 @@ describe("records --since (#2673)", () => {
     expect(doc.at).toBe(h.close);
     expect(doc.kind).toEqual({ name: "decision", schema: "urn:intentius:chant:decision:1", file: "decisions/decision.kind.mjs" });
     expect(doc.changes).toEqual([
-      { change: "new", id: "ref-003", path: "decisions/ref-003-a-successor.md", state: "decided" },
+      { change: "new", id: "ref-004", path: "decisions/ref-004-a-successor.md", state: "decided" },
       { change: "state", id: "ref-001", from: "decided", to: "ratified" },
       { change: "verdict", id: "ref-001", principal: "alice", verdict: "agree", index: 0, session: "S-0002" },
       { change: "verdict", id: "ref-001", principal: "bob", verdict: "agree", index: 1, session: "S-0002" },
-      { change: "supersession", id: "ref-003", supersedes: "ref-002" },
+      { change: "supersession", id: "ref-004", supersedes: "ref-002" },
       { change: "pin", id: "ref-002", path: "design/screens/home.json", from: expect.stringMatching(/^[0-9a-f]{64}$/), to: "a".repeat(64) },
     ]);
     expect(doc.summary).toEqual({ new: 1, removed: 0, state: 1, verdict: 2, supersession: 1, pin: 1 });
@@ -105,11 +106,11 @@ describe("records --since (#2673)", () => {
   });
 
   test("without --at it compares with the working tree, and a record deleted there is removed", async () => {
-    rmSync(join(h.root, "decisions", "ref-003-a-successor.md"));
+    rmSync(join(h.root, "decisions", "ref-004-a-successor.md"));
     try {
       const doc = ok(await since({ kind: DECISIONS_KIND, since: h.close, cwd: h.root }));
       expect(doc.at).toBeNull();
-      expect(doc.changes).toEqual([{ change: "removed", id: "ref-003", path: "decisions/ref-003-a-successor.md", state: "decided" }]);
+      expect(doc.changes).toEqual([{ change: "removed", id: "ref-004", path: "decisions/ref-004-a-successor.md", state: "decided" }]);
     } finally {
       git(h.root, "checkout", "--", "decisions");
     }

package/src/workspace/records-write.test.ts

@@ -10,7 +10,8 @@ import { cpSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, test } from "vitest";
-import { parseFrontMatter, recordTextDigest } from "./records";
+import { parseFrontMatter, recordTextDigest as textDigest } from "./records";
+import { queryRecords } from "./records-cli";
 import { allocateId, amendRecord, newRecord, renderRecord, reviewRecord, toYaml } from "./records-write";
 
 const REPO = join(import.meta.dirname, "..", "..", "..", "..");
@@ -19,6 +20,9 @@ const KIND = "decisions/decision.kind.mjs";
 
 type Data = Record<string, unknown>;
 
+/** The digest of a decision: the kind names a ratified state, so the state leaves the digest with the reviews and seal (#2873). */
+const recordTextDigest = (text: string) => textDigest(text, ["reviews", "seal", "state"]);
+
 const SAMPLE = (() => {
   const fm = parseFrontMatter(readFileSync(join(DECISIONS, "ws-003-seal-scope.md"), "utf-8"));
   if (!fm.ok) throw new Error(fm.message);
@@ -282,6 +286,7 @@ describe("records amend", () => {
   test("a decided record may be ratified, re-pin its evidence and take reviews, but not move down", async () => {
     const evidence = [{ title: "A spec", url: "https://example.com/spec" }];
     expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ evidence }), cwd: dir })).toMatchObject({ changed: ["evidence"] });
+    for (const by of ["alice", "bob"]) await reviewRecord({ kind: KIND, id: "ws-001", verdict: "agree", by, cwd: dir });
     expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ state: "ratified" }), cwd: dir })).toMatchObject({ changed: ["state"] });
     put("ws-006-six.md", decision({ id: "ws-006", title: "Six" }));
     expect(code(await amendRecord({ kind: KIND, id: "ws-006", fields: fields({ state: "withdrawn" }), cwd: dir }))).toBe("amend-supersede-instead");
@@ -319,6 +324,101 @@ describe("records amend", () => {
   });
 });
 
+describe("ratifying against the quorum (#2873)", () => {
+  const ratify = (id = "ws-001") => amendRecord({ kind: KIND, id, fields: fields({ state: "ratified" }), cwd: dir });
+  const agree = (by: string, id = "ws-001") => reviewRecord({ kind: KIND, id, verdict: "agree", by, cwd: dir });
+  async function quorumOf(id: string) {
+    const doc = await queryRecords({ kind: KIND, cwd: dir });
+    if ("error" in doc) throw new Error(doc.error.message);
+    return doc.records.find((r) => r.id === id)!.quorum!;
+  }
+
+  test("below the quorum, ratified is refused with the count and what did not count, and nothing is written", async () => {
+    expect(SAMPLE.decided_by).toBe("lex00");
+    let before = snapshot();
+    let doc = await ratify();
+    expect(code(doc)).toBe("ratify-quorum-not-met");
+    expect("error" in doc && doc.error.message).toMatch(/^ws-001 can't be ratified yet: its quorum needs 2 agreeing verdicts that count, and it has 0\. Add verdicts with chant workspace records review ws-001/);
+    expect(touched(before, snapshot())).toEqual([]);
+    // One agreement and the decider's own: one counts.
+    await agree("alice");
+    await agree("lex00");
+    before = snapshot();
+    doc = await ratify();
+    expect("error" in doc && doc.error.message).toMatch(/it has 1 \(not counted: lex00, review-decider\)/);
+    expect(touched(before, snapshot())).toEqual([]);
+  });
+
+  test("at the quorum, ratified is taken, and the verdicts still count on the ratified record", async () => {
+    await agree("alice");
+    await agree("bob");
+    const judged = recordTextDigest(text("ws-001-one.md"));
+    expect(await ratify()).toMatchObject({ changed: ["state"] });
+    expect(data("ws-001-one.md").state).toBe("ratified");
+    expect(recordTextDigest(text("ws-001-one.md"))).toBe(judged);
+    expect(await quorumOf("ws-001")).toMatchObject({ need: 2, agreed: 2, met: true, notCounted: [] });
+  });
+
+  test("a met quorum with an open concern ratifies, and the concern stays listed", async () => {
+    await agree("alice");
+    await agree("bob");
+    await reviewRecord({ kind: KIND, id: "ws-001", verdict: "dissent", by: "carol", note: "It leaves out X.", cwd: dir });
+    expect(code(await ratify())).toBe("ok");
+    expect(await quorumOf("ws-001")).toMatchObject({ met: true, metWithObjections: true, openConcerns: [{ reviewer: "carol" }] });
+  });
+
+  test("verdicts on text an amendment changed do not count toward ratifying", async () => {
+    await agree("alice");
+    await agree("bob");
+    await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ evidence: [] }), cwd: dir });
+    const doc = await ratify();
+    expect("error" in doc && doc.error.message).toMatch(/it has 0 \(not counted: alice, review-older-digest; bob, review-older-digest\)/);
+  });
+
+  test("the amendment that ratifies is checked as written, with its own changes to the reviews and pins", async () => {
+    await agree("alice");
+    const digest = recordTextDigest(text("ws-001-one.md"));
+    const reviews = [...(data("ws-001-one.md").reviews as Data[]), { reviewer: "bob", verdict: "agree", on: "2026-09-26", digest }];
+    expect(await amendRecord({ kind: KIND, id: "ws-001", fields: fields({ state: "ratified", reviews }), cwd: dir })).toMatchObject({ changed: ["state", "reviews"] });
+    put("ws-006-six.md", decision({ id: "ws-006", title: "Six" }));
+    await agree("alice", "ws-006");
+    await agree("bob", "ws-006");
+    // Re-pinning in the same write moves the digest, so the verdicts no longer match what would be ratified.
+    const doc = await amendRecord({ kind: KIND, id: "ws-006", fields: fields({ state: "ratified", evidence: [] }), cwd: dir });
+    expect(code(doc)).toBe("ratify-quorum-not-met");
+  });
+
+  test("records new refuses a record that opens ratified below its quorum", async () => {
+    const fresh = decision({ title: "Straight in", state: "ratified" });
+    delete fresh.id;
+    const before = snapshot();
+    expect(code(await newRecord({ kind: KIND, fields: fields(fresh), cwd: dir }))).toBe("ratify-quorum-not-met");
+    expect(touched(before, snapshot())).toEqual([]);
+    expect(code(await newRecord({ kind: KIND, fields: fields({ ...fresh, state: "decided" }), cwd: dir }))).toBe("ok");
+  });
+
+  test("a kind without reviews.ratified, or without reviews, takes ratified with no quorum, and its digest keeps the state", async () => {
+    const kindFile = join(dir, "decisions", "decision.kind.mjs");
+    const withRatified = readFileSync(kindFile, "utf-8");
+    expect(withRatified).toContain('reviews: { field: "reviews", decider: "decided_by", ratified: "ratified" },');
+    writeFileSync(kindFile, withRatified.replace(', ratified: "ratified" }', " }"));
+    const judged = textDigest(text("ws-001-one.md"), ["reviews", "seal"]);
+    expect(await ratify()).toMatchObject({ changed: ["state"] });
+    expect(textDigest(text("ws-001-one.md"), ["reviews", "seal"])).not.toBe(judged);
+    writeFileSync(kindFile, withRatified.replace('  reviews: { field: "reviews", decider: "decided_by", ratified: "ratified" },\n', ""));
+    put("ws-006-six.md", decision({ id: "ws-006", title: "Six" }));
+    expect(await ratify("ws-006")).toMatchObject({ changed: ["state"] });
+  });
+
+  test("a kind whose reviews.ratified is not one of its states is refused", async () => {
+    const kindFile = join(dir, "decisions", "decision.kind.mjs");
+    writeFileSync(kindFile, readFileSync(kindFile, "utf-8").replace('ratified: "ratified" }', 'ratified: "approved" }'));
+    const doc = await ratify();
+    expect(code(doc)).toBe("kind-invalid");
+    expect("error" in doc && doc.error.message).toMatch(/reviews\.ratified must be one of states/);
+  });
+});
+
 describe("records review", () => {
   test("appends a dated verdict bound to the digest of the text it judged", async () => {
     const judged = recordTextDigest(text("ws-001-one.md"));

package/src/workspace/records-write.ts

@@ -29,6 +29,7 @@ import type { CommandContext } from "../cli/registry";
 import type { ReasonCode } from "./reason-codes";
 import { gitRoot, workingTreeSource, type RecordSource } from "./record-source";
 import {
+  computeQuorum,
   loadRecordKind,
   parseFrontMatter,
   readRecords,
@@ -41,7 +42,8 @@ import {
   type RecordEntry,
   type RecordWarning,
 } from "./records";
-import { declaredKindFiles, pinRoot, realpathOr } from "./records-cli";
+import { declaredKindFiles, pinRoot, quorumOptionsFor, realpathOr } from "./records-cli";
+import { policyAtBase, resolveBase } from "./trust/provenance";
 import { WorkspaceReadError } from "./declaration";
 import { findSessionKinds, headCommit, sessionKindsFor } from "./session-kinds";
 import { workingTree } from "./tree";
@@ -69,6 +71,7 @@ export const NEW_ERROR_CODES = [
   "record-sign-failed",
   "source-harvest-not-proposed",
   "record-state-not-initial",
+  "ratify-quorum-not-met",
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 
@@ -82,6 +85,7 @@ export const AMEND_ERROR_CODES = [
   "record-closed",
   "amend-supersede-instead",
   "record-sign-failed",
+  "ratify-quorum-not-met",
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 
@@ -386,6 +390,11 @@ export function overlay(base: RecordSource, path: string, text: string): RecordS
  * record's warnings.
  */
 export async function validateWrite(o: Opened, before: RecordEntry[], path: string, text: string, base: RecordSource = o.source): Promise<RecordWarning[]> {
+  return (await validatedEntry(o, before, path, text, base)).warnings;
+}
+
+/** {@link validateWrite}, returning the written record as the read found it. */
+export async function validatedEntry(o: Opened, before: RecordEntry[], path: string, text: string, base: RecordSource = o.source): Promise<RecordEntry> {
   const after = await readAll(o, overlay(base, path, text));
   const written = after.find((e) => e.path === path);
   if (!written) throw new RecordWriteError("record-path-unmatched", `${path} is not a file the kind ${o.view.name} reads`);
@@ -398,7 +407,30 @@ export async function validateWrite(o: Opened, before: RecordEntry[], path: stri
     const gained = e.reasons.find((r) => !had.get(e.path)?.has(`${r.code}\0${r.message}`));
     if (gained) throw new RecordWriteError(gained.code, `writing ${path} would make ${e.path} invalid: ${gained.message}`);
   }
-  return written.warnings;
+  return written;
+}
+
+/**
+ * Refuse a written record in the kind's ratified state (`reviews.ratified`,
+ * #2873) whose quorum is not met. The quorum is computed on the record as
+ * written, the way `records --json` computes it: the need from the
+ * declaration in the working tree, and agents and seals from the policy at
+ * base. A met quorum with open concerns is met, and the concerns stay listed.
+ */
+async function refuseRatifyBelowQuorum(o: Opened, written: RecordEntry, id: string): Promise<void> {
+  const ratified = o.loaded.kind.reviews?.ratified;
+  if (ratified === undefined || written.state !== ratified) return;
+  const top = gitRoot(o.root);
+  const policy = policyAtBase(top ?? o.root, top ? resolveBase(top) : { commit: null, from: null });
+  const tree = workingTree(o.workspaceRoot === "." ? o.root : join(o.root, ...o.workspaceRoot.split("/")));
+  const options = await quorumOptionsFor(o.loaded, tree, policy);
+  const q = options ? computeQuorum(o.loaded.kind, written, options) : null;
+  if (q === null || q.met) return;
+  const notCounted = q.notCounted.length > 0 ? ` (not counted: ${q.notCounted.map((v) => `${v.reviewer}, ${v.reason!.code}`).join("; ")})` : "";
+  throw new RecordWriteError(
+    "ratify-quorum-not-met",
+    `${id} can't be ${ratified} yet: its quorum needs ${q.need} agreeing verdicts that count, and it has ${q.agreed}${notCounted}. Add verdicts with chant workspace records review ${id} --verdict agree --by <reviewer>, then set ${o.loaded.kind.stateField} to ${ratified} again`,
+  );
 }
 
 export function findRecord(entries: RecordEntry[], id: string, kind: string): RecordEntry & { data: Record<string, unknown> } {
@@ -726,7 +758,9 @@ export async function newRecord(opts: NewRecordOptions & ChannelOptions): Promis
     let text = renderRecord(data, title ? `\n# ${title}\n` : "");
     let seal: AuthorSeal | undefined;
     if (opts.sign !== undefined) ({ text, seal } = await sealAuthor(o, text, data, id, opts.sign, opts.cwd));
-    const warnings = await validateWrite(o, before, path, text);
+    const written = await validatedEntry(o, before, path, text);
+    await refuseRatifyBelowQuorum(o, written, id);
+    const warnings = written.warnings;
     if (!opts.dryRun) writeFileSync(abs(o, path), text, { flag: "wx" });
     return {
       $schema: RECORDS_NEW_SCHEMA_ID,
@@ -823,16 +857,26 @@ export async function amendRecord(opts: AmendRecordOptions & ChannelOptions): Pr
     if (opts.sign !== undefined) {
       ({ text, seal } = await sealAuthor(o, text, merged, opts.id, opts.sign, opts.cwd));
       merged[RECORD_SEAL_FIELD] = seal;
-    } else if (sealable && recordTextDigest(text, digestFields(kind), kind.format) !== recordTextDigest(current, digestFields(kind), kind.format)) {
+    } else if (
+      sealable &&
+      (recordTextDigest(text, digestFields(kind), kind.format) !== recordTextDigest(current, digestFields(kind), kind.format) ||
+        (kind.stateField !== undefined && stableJson(old[kind.stateField]) !== stableJson(merged[kind.stateField])))
+    ) {
+      // The seal signs the state as well as the digest, and a kind with reviews.ratified leaves the state out of the digest (#2873).
       const signer = (old[RECORD_SEAL_FIELD] as { signer?: unknown } | null)?.signer;
       delete merged[RECORD_SEAL_FIELD];
       const dropped = removeField(text, RECORD_SEAL_FIELD, merged);
       if (dropped === undefined) throw new RecordWriteError("record-unparseable", `${target.path}: the ${RECORD_SEAL_FIELD} block can't be removed without changing the rest of the file`);
       text = dropped;
-      sealDropped = `${opts.id} was sealed${typeof signer === "string" ? ` by ${signer}` : ""}, and the amendment moves its digest, so the seal was removed: seal it again with records amend ${opts.id} --sign`;
+      sealDropped = `${opts.id} was sealed${typeof signer === "string" ? ` by ${signer}` : ""}, and the amendment moves its digest or its state, so the seal was removed: seal it again with records amend ${opts.id} --sign`;
     }
     if (stableJson(old[RECORD_SEAL_FIELD]) !== stableJson(merged[RECORD_SEAL_FIELD])) changed.push(RECORD_SEAL_FIELD);
-    const warnings = changed.length === 0 ? target.warnings : await validateWrite(o, before, target.path, text);
+    let warnings = target.warnings;
+    if (changed.length > 0) {
+      const written = await validatedEntry(o, before, target.path, text);
+      if (kind.stateField !== undefined && changed.includes(kind.stateField)) await refuseRatifyBelowQuorum(o, written, opts.id);
+      warnings = written.warnings;
+    }
     if (!opts.dryRun && changed.length > 0) writeFileSync(abs(o, target.path), text);
     return {
       $schema: RECORDS_AMEND_SCHEMA_ID,

package/src/workspace/records.test.ts

@@ -311,7 +311,7 @@ describe("a decision that originates in the workspace (#2654)", () => {
 
   test("takes a session and an issue, and nothing else", async () => {
     const base = workspaceDecision("ws-001");
-    write("ws-001-a.md", base.replace('  member: "app"\n', '  member: "app"\n  session: "S-0001"\n  issue: "jhgaylor/chud#77"\n'));
+    write("ws-001-a.md", base.replace('  member: "app"\n', '  member: "app"\n  session: "S-0001"\n  issue: "acme/example#77"\n'));
     write("ws-002-b.md", base.replace('id: "ws-001"', 'id: "ws-002"').replace('  member: "app"\n', '  member: "app"\n  session: null\n'));
     write("ws-003-c.md", base.replace('id: "ws-001"', 'id: "ws-003"').replace('  member: "app"\n', '  member: "app"\n  row: "Sort order"\n'));
     write("ws-004-d.md", base.replace('id: "ws-001"', 'id: "ws-004"').replace('  member: "app"\n', ""));

package/src/workspace/records.ts

@@ -166,10 +166,16 @@ export const RECORD_SEAL_FIELD = "seal";
 /**
  * The top-level fields {@link recordTextDigest} leaves out for a kind: its
  * reviews list and {@link RECORD_SEAL_FIELD} when it has a reviews list, and
- * nothing when it has none (#2672, #2688).
+ * nothing when it has none (#2672, #2688). A kind that names a ratified
+ * state (`reviews.ratified`, #2873) leaves its state field out too, so
+ * moving a record to that state keeps the verdicts that ratified it
+ * counting.
  */
-export function digestFields(kind: Pick<RecordKind, "reviews">): string[] | null {
-  return kind.reviews ? [kind.reviews.field, RECORD_SEAL_FIELD] : null;
+export function digestFields(kind: Pick<RecordKind, "reviews" | "stateField">): string[] | null {
+  if (!kind.reviews) return null;
+  const fields = [kind.reviews.field, RECORD_SEAL_FIELD];
+  if (kind.reviews.ratified !== undefined && kind.stateField !== undefined) fields.push(kind.stateField);
+  return fields;
 }
 
 /** What a verdict's seal establishes (#2687). See `trust/seal.ts`. */
@@ -330,8 +336,14 @@ export const recordKindSchema = z
      * entry holds `reviewer`, `verdict` (agree, dissent or abstain) and
      * optionally `digest`, `note`, `proposes`, `addressed_by` and
      * `withdrawn_on`. Optional.
+     *
+     * `ratified` names the state a record enters only once its quorum is met
+     * (#2873): `records new` and `records amend` refuse it below the quorum,
+     * with ratify-quorum-not-met. With it the digest leaves the state field
+     * out, so the move to that state keeps the verdicts counting. It must be
+     * one of `states`.
      */
-    reviews: z.object({ field: z.string().min(1), decider: z.string().min(1) }).strict().optional(),
+    reviews: z.object({ field: z.string().min(1), decider: z.string().min(1), ratified: z.string().min(1).optional() }).strict().optional(),
     /**
      * The front-matter field a new record's proposer is named on, when the
      * kind opts in (#2756). `records new --by` and the MCP `records-new`
@@ -448,6 +460,10 @@ export const recordKindSchema = z
     message: "a kind without states cannot have proposedBy: there is no first state for a record to open in",
     path: ["proposedBy"],
   })
+  .refine((k) => k.reviews?.ratified === undefined || (k.states ?? []).includes(k.reviews.ratified), {
+    message: "reviews.ratified must be one of states: it names the state a record enters once its quorum is met",
+    path: ["reviews", "ratified"],
+  })
   .refine((k) => (k.closedStates ?? []).every((s) => (k.states ?? []).includes(s)), {
     message: "every closed state must be listed in states",
     path: ["closedStates"],
@@ -731,7 +747,8 @@ function nonJson(v: unknown, at: string, seen: Set<object>): string | undefined
  * kind with a reviews list the list is the reviews field and `seal`, the
  * record's author seal (#2688; {@link digestFields}), so sealing a record
  * leaves its digest where it was too. A record with no `seal` hashes exactly
- * as it did before author seals existed.
+ * as it did before author seals existed. A kind with `reviews.ratified` adds
+ * its state field (#2873).
  *
  * The rule, which a hand-editor can follow with a text editor and
  * `sha256sum`:

package/src/workspace/status-contract.test.ts

@@ -311,10 +311,39 @@ describe("chant workspace status on built workspaces", () => {
           { name: "inference", broker: null, scope: [] },
         ],
         isolation: null,
+        intent: null,
+        services: [],
       },
     ]);
   });
 
+  test("each member's box lists the services its block declares, every field present (#2880)", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration([
+        {
+          name: "box",
+          dir: "box",
+          kind: "other",
+          because: "the box's steward and its Ops",
+          box: {
+            services: [
+              { name: "app", cmd: "${HOME}/box/run-app.sh", duration: "3s", health: "http://127.0.0.1:5173/health" },
+              { name: "door", cmd: "${HOME}/box/run-door.sh", needs: ["app"], httpPort: 8080 },
+              { name: "site", cmd: "${HOME}/box/run-site.sh", optional: true },
+            ],
+          },
+        },
+      ]),
+    });
+    const doc = result(await workspaceStatus({ cwd: root, env: "prod" }));
+    expectValid(doc);
+    expect(doc.members[0].box?.services).toEqual([
+      { name: "app", cmd: "${HOME}/box/run-app.sh", needs: [], httpPort: null, duration: "3s", health: "http://127.0.0.1:5173/health", optional: false },
+      { name: "door", cmd: "${HOME}/box/run-door.sh", needs: ["app"], httpPort: 8080, duration: null, health: null, optional: false },
+      { name: "site", cmd: "${HOME}/box/run-site.sh", needs: [], httpPort: null, duration: null, health: null, optional: true },
+    ]);
+  });
+
   test("every failure validates with its code", async () => {
     const empty = repo({});
     const outside = realpathSync(mkdtempSync(join(tmpdir(), "chant-status-nogit-")));
@@ -599,8 +628,9 @@ describe("stewards in chant workspace status --json (#2731)", () => {
         lastTick: null,
         changesCheckout: false,
         workLease: null,
+        beside: null,
       },
-      { name: "box-release", schedule: null, env: "local", lastRun: null, lastTick: null, changesCheckout: false, workLease: null },
+      { name: "box-release", schedule: null, env: "local", lastRun: null, lastTick: null, changesCheckout: false, workLease: null, beside: null },
       {
         name: "box-dispatch",
         schedule: { cron: "*/5 * * * *", overlap: "skip" },
@@ -621,6 +651,7 @@ describe("stewards in chant workspace status --json (#2731)", () => {
             },
           ],
         },
+        beside: null,
       },
     ]);
     // #2749: nothing the steward runs waits on a decision point.