@intentius/chant 0.94.0 → 0.95.0

package/src/workspace/records-write.ts

@@ -29,6 +29,7 @@ import type { CommandContext } from "../cli/registry";
 import type { ReasonCode } from "./reason-codes";
 import { gitRoot, workingTreeSource, type RecordSource } from "./record-source";
 import {
+  computeQuorum,
   loadRecordKind,
   parseFrontMatter,
   readRecords,
@@ -41,7 +42,8 @@ import {
   type RecordEntry,
   type RecordWarning,
 } from "./records";
-import { declaredKindFiles, pinRoot, realpathOr } from "./records-cli";
+import { declaredKindFiles, pinRoot, quorumOptionsFor, realpathOr } from "./records-cli";
+import { policyAtBase, resolveBase } from "./trust/provenance";
 import { WorkspaceReadError } from "./declaration";
 import { findSessionKinds, headCommit, sessionKindsFor } from "./session-kinds";
 import { workingTree } from "./tree";
@@ -69,6 +71,7 @@ export const NEW_ERROR_CODES = [
   "record-sign-failed",
   "source-harvest-not-proposed",
   "record-state-not-initial",
+  "ratify-quorum-not-met",
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 
@@ -82,6 +85,7 @@ export const AMEND_ERROR_CODES = [
   "record-closed",
   "amend-supersede-instead",
   "record-sign-failed",
+  "ratify-quorum-not-met",
   ...RECORD_REASON_CODES,
 ] as const satisfies readonly ReasonCode[];
 
@@ -386,6 +390,11 @@ export function overlay(base: RecordSource, path: string, text: string): RecordS
  * record's warnings.
  */
 export async function validateWrite(o: Opened, before: RecordEntry[], path: string, text: string, base: RecordSource = o.source): Promise<RecordWarning[]> {
+  return (await validatedEntry(o, before, path, text, base)).warnings;
+}
+
+/** {@link validateWrite}, returning the written record as the read found it. */
+export async function validatedEntry(o: Opened, before: RecordEntry[], path: string, text: string, base: RecordSource = o.source): Promise<RecordEntry> {
   const after = await readAll(o, overlay(base, path, text));
   const written = after.find((e) => e.path === path);
   if (!written) throw new RecordWriteError("record-path-unmatched", `${path} is not a file the kind ${o.view.name} reads`);
@@ -398,7 +407,30 @@ export async function validateWrite(o: Opened, before: RecordEntry[], path: stri
     const gained = e.reasons.find((r) => !had.get(e.path)?.has(`${r.code}\0${r.message}`));
     if (gained) throw new RecordWriteError(gained.code, `writing ${path} would make ${e.path} invalid: ${gained.message}`);
   }
-  return written.warnings;
+  return written;
+}
+
+/**
+ * Refuse a written record in the kind's ratified state (`reviews.ratified`,
+ * #2873) whose quorum is not met. The quorum is computed on the record as
+ * written, the way `records --json` computes it: the need from the
+ * declaration in the working tree, and agents and seals from the policy at
+ * base. A met quorum with open concerns is met, and the concerns stay listed.
+ */
+async function refuseRatifyBelowQuorum(o: Opened, written: RecordEntry, id: string): Promise<void> {
+  const ratified = o.loaded.kind.reviews?.ratified;
+  if (ratified === undefined || written.state !== ratified) return;
+  const top = gitRoot(o.root);
+  const policy = policyAtBase(top ?? o.root, top ? resolveBase(top) : { commit: null, from: null });
+  const tree = workingTree(o.workspaceRoot === "." ? o.root : join(o.root, ...o.workspaceRoot.split("/")));
+  const options = await quorumOptionsFor(o.loaded, tree, policy);
+  const q = options ? computeQuorum(o.loaded.kind, written, options) : null;
+  if (q === null || q.met) return;
+  const notCounted = q.notCounted.length > 0 ? ` (not counted: ${q.notCounted.map((v) => `${v.reviewer}, ${v.reason!.code}`).join("; ")})` : "";
+  throw new RecordWriteError(
+    "ratify-quorum-not-met",
+    `${id} can't be ${ratified} yet: its quorum needs ${q.need} agreeing verdicts that count, and it has ${q.agreed}${notCounted}. Add verdicts with chant workspace records review ${id} --verdict agree --by <reviewer>, then set ${o.loaded.kind.stateField} to ${ratified} again`,
+  );
 }
 
 export function findRecord(entries: RecordEntry[], id: string, kind: string): RecordEntry & { data: Record<string, unknown> } {
@@ -726,7 +758,9 @@ export async function newRecord(opts: NewRecordOptions & ChannelOptions): Promis
     let text = renderRecord(data, title ? `\n# ${title}\n` : "");
     let seal: AuthorSeal | undefined;
     if (opts.sign !== undefined) ({ text, seal } = await sealAuthor(o, text, data, id, opts.sign, opts.cwd));
-    const warnings = await validateWrite(o, before, path, text);
+    const written = await validatedEntry(o, before, path, text);
+    await refuseRatifyBelowQuorum(o, written, id);
+    const warnings = written.warnings;
     if (!opts.dryRun) writeFileSync(abs(o, path), text, { flag: "wx" });
     return {
       $schema: RECORDS_NEW_SCHEMA_ID,
@@ -823,16 +857,26 @@ export async function amendRecord(opts: AmendRecordOptions & ChannelOptions): Pr
     if (opts.sign !== undefined) {
       ({ text, seal } = await sealAuthor(o, text, merged, opts.id, opts.sign, opts.cwd));
       merged[RECORD_SEAL_FIELD] = seal;
-    } else if (sealable && recordTextDigest(text, digestFields(kind), kind.format) !== recordTextDigest(current, digestFields(kind), kind.format)) {
+    } else if (
+      sealable &&
+      (recordTextDigest(text, digestFields(kind), kind.format) !== recordTextDigest(current, digestFields(kind), kind.format) ||
+        (kind.stateField !== undefined && stableJson(old[kind.stateField]) !== stableJson(merged[kind.stateField])))
+    ) {
+      // The seal signs the state as well as the digest, and a kind with reviews.ratified leaves the state out of the digest (#2873).
       const signer = (old[RECORD_SEAL_FIELD] as { signer?: unknown } | null)?.signer;
       delete merged[RECORD_SEAL_FIELD];
       const dropped = removeField(text, RECORD_SEAL_FIELD, merged);
       if (dropped === undefined) throw new RecordWriteError("record-unparseable", `${target.path}: the ${RECORD_SEAL_FIELD} block can't be removed without changing the rest of the file`);
       text = dropped;
-      sealDropped = `${opts.id} was sealed${typeof signer === "string" ? ` by ${signer}` : ""}, and the amendment moves its digest, so the seal was removed: seal it again with records amend ${opts.id} --sign`;
+      sealDropped = `${opts.id} was sealed${typeof signer === "string" ? ` by ${signer}` : ""}, and the amendment moves its digest or its state, so the seal was removed: seal it again with records amend ${opts.id} --sign`;
     }
     if (stableJson(old[RECORD_SEAL_FIELD]) !== stableJson(merged[RECORD_SEAL_FIELD])) changed.push(RECORD_SEAL_FIELD);
-    const warnings = changed.length === 0 ? target.warnings : await validateWrite(o, before, target.path, text);
+    let warnings = target.warnings;
+    if (changed.length > 0) {
+      const written = await validatedEntry(o, before, target.path, text);
+      if (kind.stateField !== undefined && changed.includes(kind.stateField)) await refuseRatifyBelowQuorum(o, written, opts.id);
+      warnings = written.warnings;
+    }
     if (!opts.dryRun && changed.length > 0) writeFileSync(abs(o, target.path), text);
     return {
       $schema: RECORDS_AMEND_SCHEMA_ID,

package/src/workspace/records.ts

@@ -166,10 +166,16 @@ export const RECORD_SEAL_FIELD = "seal";
 /**
  * The top-level fields {@link recordTextDigest} leaves out for a kind: its
  * reviews list and {@link RECORD_SEAL_FIELD} when it has a reviews list, and
- * nothing when it has none (#2672, #2688).
+ * nothing when it has none (#2672, #2688). A kind that names a ratified
+ * state (`reviews.ratified`, #2873) leaves its state field out too, so
+ * moving a record to that state keeps the verdicts that ratified it
+ * counting.
  */
-export function digestFields(kind: Pick<RecordKind, "reviews">): string[] | null {
-  return kind.reviews ? [kind.reviews.field, RECORD_SEAL_FIELD] : null;
+export function digestFields(kind: Pick<RecordKind, "reviews" | "stateField">): string[] | null {
+  if (!kind.reviews) return null;
+  const fields = [kind.reviews.field, RECORD_SEAL_FIELD];
+  if (kind.reviews.ratified !== undefined && kind.stateField !== undefined) fields.push(kind.stateField);
+  return fields;
 }
 
 /** What a verdict's seal establishes (#2687). See `trust/seal.ts`. */
@@ -330,8 +336,14 @@ export const recordKindSchema = z
      * entry holds `reviewer`, `verdict` (agree, dissent or abstain) and
      * optionally `digest`, `note`, `proposes`, `addressed_by` and
      * `withdrawn_on`. Optional.
+     *
+     * `ratified` names the state a record enters only once its quorum is met
+     * (#2873): `records new` and `records amend` refuse it below the quorum,
+     * with ratify-quorum-not-met. With it the digest leaves the state field
+     * out, so the move to that state keeps the verdicts counting. It must be
+     * one of `states`.
      */
-    reviews: z.object({ field: z.string().min(1), decider: z.string().min(1) }).strict().optional(),
+    reviews: z.object({ field: z.string().min(1), decider: z.string().min(1), ratified: z.string().min(1).optional() }).strict().optional(),
     /**
      * The front-matter field a new record's proposer is named on, when the
      * kind opts in (#2756). `records new --by` and the MCP `records-new`
@@ -448,6 +460,10 @@ export const recordKindSchema = z
     message: "a kind without states cannot have proposedBy: there is no first state for a record to open in",
     path: ["proposedBy"],
   })
+  .refine((k) => k.reviews?.ratified === undefined || (k.states ?? []).includes(k.reviews.ratified), {
+    message: "reviews.ratified must be one of states: it names the state a record enters once its quorum is met",
+    path: ["reviews", "ratified"],
+  })
   .refine((k) => (k.closedStates ?? []).every((s) => (k.states ?? []).includes(s)), {
     message: "every closed state must be listed in states",
     path: ["closedStates"],
@@ -731,7 +747,8 @@ function nonJson(v: unknown, at: string, seen: Set<object>): string | undefined
  * kind with a reviews list the list is the reviews field and `seal`, the
  * record's author seal (#2688; {@link digestFields}), so sealing a record
  * leaves its digest where it was too. A record with no `seal` hashes exactly
- * as it did before author seals existed.
+ * as it did before author seals existed. A kind with `reviews.ratified` adds
+ * its state field (#2873).
  *
  * The rule, which a hand-editor can follow with a text editor and
  * `sha256sum`:

package/src/workspace/status-contract.test.ts

@@ -312,10 +312,38 @@ describe("chant workspace status on built workspaces", () => {
         ],
         isolation: null,
         intent: null,
+        services: [],
       },
     ]);
   });
 
+  test("each member's box lists the services its block declares, every field present (#2880)", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration([
+        {
+          name: "box",
+          dir: "box",
+          kind: "other",
+          because: "the box's steward and its Ops",
+          box: {
+            services: [
+              { name: "app", cmd: "${HOME}/box/run-app.sh", duration: "3s", health: "http://127.0.0.1:5173/health" },
+              { name: "door", cmd: "${HOME}/box/run-door.sh", needs: ["app"], httpPort: 8080 },
+              { name: "site", cmd: "${HOME}/box/run-site.sh", optional: true },
+            ],
+          },
+        },
+      ]),
+    });
+    const doc = result(await workspaceStatus({ cwd: root, env: "prod" }));
+    expectValid(doc);
+    expect(doc.members[0].box?.services).toEqual([
+      { name: "app", cmd: "${HOME}/box/run-app.sh", needs: [], httpPort: null, duration: "3s", health: "http://127.0.0.1:5173/health", optional: false },
+      { name: "door", cmd: "${HOME}/box/run-door.sh", needs: ["app"], httpPort: 8080, duration: null, health: null, optional: false },
+      { name: "site", cmd: "${HOME}/box/run-site.sh", needs: [], httpPort: null, duration: null, health: null, optional: true },
+    ]);
+  });
+
   test("every failure validates with its code", async () => {
     const empty = repo({});
     const outside = realpathSync(mkdtempSync(join(tmpdir(), "chant-status-nogit-")));
@@ -600,8 +628,9 @@ describe("stewards in chant workspace status --json (#2731)", () => {
         lastTick: null,
         changesCheckout: false,
         workLease: null,
+        beside: null,
       },
-      { name: "box-release", schedule: null, env: "local", lastRun: null, lastTick: null, changesCheckout: false, workLease: null },
+      { name: "box-release", schedule: null, env: "local", lastRun: null, lastTick: null, changesCheckout: false, workLease: null, beside: null },
       {
         name: "box-dispatch",
         schedule: { cron: "*/5 * * * *", overlap: "skip" },
@@ -622,6 +651,7 @@ describe("stewards in chant workspace status --json (#2731)", () => {
             },
           ],
         },
+        beside: null,
       },
     ]);
     // #2749: nothing the steward runs waits on a decision point.

package/src/workspace/status-stewards.ts

@@ -26,13 +26,17 @@
  *   `chant operator --steward` holds it or until it expires;
  * - an Op's `workLease.held` is the work leases its turns hold (#2748): those
  *   whose holder is `<steward>/<op>@...` (`stewardWorkHolder`), read from the
- *   ledger of the Op's work kind, or the member's own.
+ *   ledger of the Op's work kind, or the member's own;
+ * - an Op the steward runs beside its turns (#2861) has `beside`: whether it
+ *   declares a ready step, and the Op's own lease
+ *   (`refs/chant/lease/[<prefix>]<op>`), which a run of it holds while it runs.
+ *   Its waiting run and its work leases are listed as for any of its Ops.
  */
 
 import { existsSync, realpathSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { discoverOps, discoverStewards } from "../op/discover";
-import { stewardFormFor, stewardLeaseName, type StewardForm } from "../op/steward";
+import { stewardBesideFor, stewardFormFor, stewardLeaseName, type StewardForm } from "../op/steward";
 import { readRunLedger, runEnvOf } from "../lifecycle/run-ledger";
 import { readConvergeLedger, type ConvergeTickRecord } from "../lifecycle/converge-ledger";
 import { leaseRef } from "../lifecycle/lease";
@@ -123,6 +127,21 @@ export interface StatusStewardOp {
    * the steward's turns of this Op hold, a live one while a turn runs.
    */
   workLease: { kind: string | null; held: StatusStewardWorkLease[] } | null;
+  /**
+   * For an Op the steward runs beside its turns (#2861): whether a ready step
+   * says when to start it, and the Op's own lease, which a run of it holds
+   * while it runs (null when none has held it). Null for an Op run as one of
+   * the steward's turns.
+   */
+  beside: { ready: boolean; lease: StatusStewardLease | null } | null;
+}
+
+/** A lease ref as status reads it: locally, never fetched. `live` is false once `expiresAt` has passed. */
+export interface StatusStewardLease {
+  holder: string;
+  acquiredAt: string;
+  expiresAt: string;
+  live: boolean;
 }
 
 /** A work lease a steward's turn holds (#2748). */
@@ -152,7 +171,7 @@ export interface StatusSteward {
    */
   capabilities: { name: string; broker: string | null; declared: boolean }[];
   /** The local steward's own lease, or null when no local operator has held it. */
-  lease: { holder: string; acquiredAt: string; expiresAt: string; live: boolean } | null;
+  lease: StatusStewardLease | null;
   ops: StatusStewardOp[];
   /**
    * The open decision points the steward waits on (#2749): each Op whose
@@ -206,10 +225,11 @@ function isChantProject(dir: string): boolean {
   return existsSync(join(dir, "chant.config.ts")) || existsSync(join(dir, "chant.config.json"));
 }
 
-async function readStewardLease(name: string, memberDir: string, now: string): Promise<StatusSteward["lease"]> {
+/** A lease ref of the member, by its lease name (`_stewards/<name>`, or an Op's). */
+async function readLeaseRef(leaseName: string, memberDir: string, now: string): Promise<StatusStewardLease | null> {
   try {
     const { prefix } = await resolveMemberLedger(memberDir);
-    const sha = await readRefSha(leaseRef(stewardLeaseName(name), prefix), { cwd: memberDir });
+    const sha = await readRefSha(leaseRef(leaseName, prefix), { cwd: memberDir });
     if (!sha) return null;
     const record = JSON.parse((await readBlobBySha(sha, { cwd: memberDir })) ?? "") as Record<string, unknown>;
     if (typeof record.holder !== "string" || typeof record.expiresAt !== "string" || typeof record.acquiredAt !== "string") return null;
@@ -224,6 +244,18 @@ async function readStewardLease(name: string, memberDir: string, now: string): P
   }
 }
 
+/** An Op's `beside` entry (#2861): null for an Op run as one of the steward's turns. */
+async function besideOf(
+  declaration: Parameters<typeof stewardBesideFor>[0],
+  op: string,
+  memberDir: string,
+  now: string,
+): Promise<StatusStewardOp["beside"]> {
+  const beside = stewardBesideFor(declaration, op);
+  if (!beside) return null;
+  return { ready: beside.ready !== null && beside.ready !== undefined, lease: await readLeaseRef(op, memberDir, now) };
+}
+
 /** The work leases `steward`'s turns of `op` hold, from the ledger of the Op's kind or the member's. */
 async function readHeldWorkLeases(steward: string, op: OpConfig, memberDir: string, now: string): Promise<StatusStewardWorkLease[]> {
   try {
@@ -314,6 +346,7 @@ export async function readMemberStewards(
         workLease: op.workLease
           ? { kind: op.workLease.kind ?? null, held: await readHeldWorkLeases(declaration.name, op, memberDir, now) }
           : null,
+        beside: await besideOf(declaration, op.name, memberDir, now),
       });
     }
     stewards.push({
@@ -326,7 +359,7 @@ export async function readMemberStewards(
         const declared = box?.capabilities.find((c) => c.name === name);
         return { name, broker: declared?.broker ?? null, declared: declared !== undefined };
       }),
-      lease: await readStewardLease(declaration.name, memberDir, now),
+      lease: await readLeaseRef(stewardLeaseName(declaration.name), memberDir, now),
       ops,
       waiting,
     });

package/src/workspace/status.schema.json

@@ -200,11 +200,11 @@
           ]
         },
         "ops": {
-          "description": "The Ops it runs, in declaration order.",
+          "description": "The Ops it runs, in declaration order: its turns' Ops, then those it runs beside its turns (#2861).",
           "type": "array",
           "items": {
             "type": "object",
-            "required": ["name", "schedule", "env", "lastRun", "lastTick", "changesCheckout", "workLease"],
+            "required": ["name", "schedule", "env", "lastRun", "lastTick", "changesCheckout", "workLease", "beside"],
             "properties": {
               "name": { "type": "string" },
               "schedule": {
@@ -330,12 +330,40 @@
                     }
                   }
                 ]
+              },
+              "beside": {
+                "description": "For an Op the steward runs beside its turns (#2861), in a process of its own under the Op's own lease: ready is whether a ready step says when the operator starts it, and lease is the Op's lease ref (refs/chant/lease/<op>), held by a run of it while it runs (holder <steward>/<op>@<operator> for a run the operator started), read locally and never fetched, or null when none has held it. live is false once expiresAt has passed. Null for an Op the steward runs as one of its turns.",
+                "oneOf": [
+                  { "type": "null" },
+                  {
+                    "type": "object",
+                    "required": ["ready", "lease"],
+                    "properties": {
+                      "ready": { "type": "boolean" },
+                      "lease": {
+                        "oneOf": [
+                          { "type": "null" },
+                          {
+                            "type": "object",
+                            "required": ["holder", "acquiredAt", "expiresAt", "live"],
+                            "properties": {
+                              "holder": { "type": "string" },
+                              "acquiredAt": { "type": "string" },
+                              "expiresAt": { "type": "string" },
+                              "live": { "type": "boolean" }
+                            }
+                          }
+                        ]
+                      }
+                    }
+                  }
+                ]
               }
             }
           }
         },
         "waiting": {
-          "description": "The open decision points the steward waits on (#2749): one for each Op whose newest run is the steward's own (its ledger record names the steward) and stopped on a question: the steward's own Ops in ops order, then any other Op of the member, such as one the steward's process starts itself (studio#137), by name. The state is the question's when the run stopped; `chant workspace points --open` has its state now, and hud asks a person there. The steward never answers one, and runs an Op it lists again on the first round after it is answered.",
+          "description": "The open decision points the steward waits on (#2749): one for each Op whose newest run is the steward's own (its ledger record names the steward) and stopped on a question: the steward's own Ops in ops order, then any other Op of the member, such as one the steward's process starts itself (studio#137), by name. The state is the question's when the run stopped; `chant workspace points --open` has its state now, and hud asks a person there. The steward never answers one, and runs an Op it lists again on the first round after it is answered (an Op beside its turns, in a process of its own, #2861).",
           "type": "array",
           "items": {
             "allOf": [
@@ -377,8 +405,25 @@
     },
     "box": {
       "type": "object",
-      "required": ["capabilities", "isolation", "intent"],
+      "required": ["capabilities", "isolation", "intent", "services"],
       "properties": {
+        "services": {
+          "description": "The services the box block declares (#2880), in declaration order, or empty when it declares none. A reader has them before any converge tick; a steward's ConvergeOp's lastTick carries each one's verdict. cmd is as declared: its ${VAR} references are left for the process that applies it to expand. Added by chant 0.95.0.",
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["name", "cmd", "needs", "httpPort", "duration", "health", "optional"],
+            "properties": {
+              "name": { "type": "string" },
+              "cmd": { "type": "string", "description": "The command the supervisor runs, as declared." },
+              "needs": { "type": "array", "items": { "type": "string" }, "description": "Services of the same box that start first. Empty when none." },
+              "httpPort": { "type": ["integer", "null"], "description": "The port the supervisor routes the sprite's URL to, or null." },
+              "duration": { "type": ["string", "null"], "description": "How long the service must stay up after a create or start, such as 3s, or null for the supervisor's default." },
+              "health": { "type": ["string", "null"], "description": "A URL that answers 200 while the service works, or null when the supervisor's state decides." },
+              "optional": { "type": "boolean", "description": "True for a service something else creates by name, such as a site a release makes." }
+            }
+          }
+        },
         "intent": {
           "description": "The decision record the box block names as the box's intent (#2850), or null when it names none. A box starts as a question: the record is proposed with a null choice, and decided when the person who answered it amends it. Read from the working tree, from the declared record kinds named decision. When no decision record has the id, every field but id is null and chant workspace check fails (WSP126). Added by chant 0.94.0.",
           "oneOf": [{ "type": "null" }, { "$ref": "#/$defs/intent" }]

package/src/workspace/status.ts

@@ -186,6 +186,19 @@ export interface StatusBox {
    * is null when no decision record has the id (WSP126).
    */
   intent: BoxIntent | null;
+  /** The services the block declares (#2880), in file order, so a reader has them before any converge tick. Empty when it declares none. */
+  services: StatusBoxService[];
+}
+
+/** A declared box service as `status --json` prints it (#2880): every field present, null or false when not declared. */
+export interface StatusBoxService {
+  name: string;
+  cmd: string;
+  needs: string[];
+  httpPort: number | null;
+  duration: string | null;
+  health: string | null;
+  optional: boolean;
 }
 
 /**
@@ -409,6 +422,15 @@ export async function workspaceStatus(query: StatusQuery): Promise<StatusDocumen
                 capabilities: m.box.capabilities.map((c) => ({ name: c.name, broker: c.broker, scope: [...c.scope] })),
                 isolation: isolation.get(m.name) ?? null,
                 intent: intents.get(m.name) ?? null,
+                services: m.box.services.map((s) => ({
+                  name: s.name,
+                  cmd: s.cmd,
+                  needs: [...s.needs],
+                  httpPort: s.httpPort,
+                  duration: s.duration,
+                  health: s.health,
+                  optional: s.optional,
+                })),
               },
         stewards: stewards.stewards,
         stewardReasons: stewards.reasons,

package/src/workspace/trust/record-seal.test.ts

@@ -199,7 +199,7 @@ describe.skipIf(!hasSshKeygen)("author seals under a signers file at base", () =
     const doc = await amend(r, { evidence: [] });
     if ("error" in doc) throw new Error(doc.error.message);
     expect(doc.changed).toEqual(["evidence", "seal"]);
-    expect(doc.sealDropped).toMatch(/ws-003 was sealed by lex00, and the amendment moves its digest, so the seal was removed: seal it again with records amend ws-003 --sign/);
+    expect(doc.sealDropped).toMatch(/ws-003 was sealed by lex00, and the amendment moves its digest or its state, so the seal was removed: seal it again with records amend ws-003 --sign/);
     expect(readFileSync(join(r.dir, FILE), "utf-8")).not.toMatch(/^seal:/m);
     // Changing only the reviews leaves the digest, so the seal stays.
     await amend(r, {}, lex);
@@ -215,6 +215,30 @@ describe.skipIf(!hasSshKeygen)("author seals under a signers file at base", () =
     expect(warningCodes(rec)).toContain("record-unattested");
   });
 
+  test("a move of state alone drops the seal, which signs the state though the digest leaves it out (#2873)", async () => {
+    const { r, lex } = workspace("state");
+    await amend(r, {}, lex);
+    const digest = (await record(r)).digest;
+    const doc = await amend(r, { state: "superseded" });
+    if ("error" in doc) throw new Error(doc.error.message);
+    expect(doc.changed).toEqual(["state", "seal"]);
+    expect(doc.sealDropped).toMatch(/moves its digest or its state/);
+    expect((await record(r)).digest).toBe(digest);
+  });
+
+  test("ratifying counts only verdicts whose seal verifies against the signers at base (#2873)", async () => {
+    const { r, alice, mallory } = workspace("ratify");
+    for (const k of [alice, mallory]) {
+      const by = k === alice ? "alice@example.test" : "mallory";
+      const doc = await reviewRecord({ kind: KIND, id: "ws-003", verdict: "agree", by, sign: k.file, cwd: r.dir });
+      if ("error" in doc) throw new Error(doc.error.message);
+    }
+    const refused = await amend(r, { state: "ratified" });
+    expect("error" in refused && refused.error.code).toBe("ratify-quorum-not-met");
+    expect("error" in refused && refused.error.message).toMatch(/needs 2 agreeing verdicts that count, and it has 1 \(not counted: mallory, review-unattested\)/);
+    expect(readFileSync(join(r.dir, FILE), "utf-8")).toMatch(/^state: "decided"$/m);
+  });
+
   test("a stale seal left by hand fails, and an edited state fails", async () => {
     const { r, lex } = workspace("stale");
     await amend(r, {}, lex);
@@ -308,7 +332,7 @@ describe.skipIf(!hasSshKeygen)("refusals", () => {
     expect("error" in from && from.error.code).toBe("write-input-invalid");
     expect(readFileSync(join(r.dir, FILE), "utf-8")).toBe(before);
 
-    await amend(r, { state: "ratified" });
+    await amend(r, { state: "superseded" });
     const closed = await amend(r, {}, lex);
     expect("error" in closed && closed.error.code).toBe("record-closed");
   });

package/src/workspace/work-evidence.schema.json

@@ -181,6 +181,7 @@
                 "record-closed",
                 "amend-supersede-instead",
                 "record-sign-failed",
+                "ratify-quorum-not-met",
                 "record-unparseable",
                 "record-schema-invalid",
                 "record-id-duplicate",

package/src/workspace/workspace-kinds.schema.json

@@ -72,6 +72,9 @@
             "maxLength": 255,
             "pattern": "^[^\\u0000-\\u001f]+$"
           }
+        },
+        "graph": {
+          "$ref": "#/$defs/graph"
         }
       },
       "patternProperties": {
@@ -128,6 +131,29 @@
       "type": "string",
       "description": "A file name, with no directory part. A * matches any run of characters.",
       "pattern": "^(?!\\.\\.?$)[^/\\\\]+$"
+    },
+    "graph": {
+      "type": "object",
+      "description": "How chant workspace graph reads a member of this kind (#2874). chant writes a reader project of its own outside the workspace, with a chant.config.json that declares lexicon and puts config under that lexicon's key, and runs the member's chant graph there. In every string key and value of config, {member} becomes the member's name, {dir} its absolute directory and {workspace} the absolute workspace root. Without this field a member of the kind is listed with kind-not-run.",
+      "required": [
+        "lexicon",
+        "config"
+      ],
+      "properties": {
+        "lexicon": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9-]{0,39}$",
+          "description": "The lexicon that reads the member, by name. The package that supplies the kind must be @intentius/chant-lexicon-<lexicon>, so the lexicon chant loads is the one the declaration pins."
+        },
+        "config": {
+          "type": "object",
+          "description": "The lexicon's config namespace for the reader project, such as terraform's roots. Placeholders are substituted; nothing else is interpreted."
+        }
+      },
+      "patternProperties": {
+        "^x-": true
+      },
+      "additionalProperties": false
     }
   }
 }