@volter/world-runtime 2.0.50 → 2.0.51

package/dist/src/changeset.d.ts

@@ -48,7 +48,9 @@ export declare function createWorldChangeset(world: string, name: string, option
     verifiers?: ChangesetVerifier[];
     now?: Date;
     overwrite?: boolean;
-    message?: string;
+    message?: string; /** who cuts it and the person it is owned by, from the cutting grant (a served World's door) */
+    cutBy?: string;
+    owner?: string;
 }): Changeset;
 /** Every changeset in every world under `root` (or one world with `world`), newest first. */
 export declare function listWorldChangesets(options?: WorldRootOptions & {

package/dist/src/changeset.js

@@ -1,3 +1,4 @@
+import { worldChangesetRules } from "./configs.js";
 import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, withAncestryLock, worldPaths } from '@volter/world-core';
 // `volter-world mark` / `diff` / `changeset` — the WORLD-side verbs over the changeset
 // primitive (docs/concepts/the-model.md v0). Thin, exactly like `covers` and `tail` are thin: all
@@ -183,6 +184,8 @@ export function createWorldChangeset(world, name, options = {}) {
         ...(options.verifiers ? { verifiers: options.verifiers } : {}),
         ...(options.now ? { createdAt: options.now.toISOString() } : {}),
         ...(options.message === undefined ? {} : { message: options.message }),
+        ...(options.cutBy === undefined ? {} : { cutBy: options.cutBy }),
+        ...(options.owner === undefined ? {} : { owner: options.owner }),
     });
     getActiveWorldStore().write(path, `${JSON.stringify(changeset, null, 2)}\n`);
     // a changeset records where the log was cut (contract "The model"): the next one starts here
@@ -373,7 +376,7 @@ export function approveWorldChangeset(name, options) {
 export function statusWorldChangeset(name, options = {}) {
     const root = resolveRoot(options.root);
     const located = findWorldChangeset(name, { root, ...(options.world ? { world: options.world } : {}) });
-    return changesetReadiness(located.changeset);
+    return changesetReadiness(located.changeset, worldChangesetRules(root));
 }
 export async function pushWorldChangeset(name, options) {
     // PUSH (docs/concepts/the-model.md): the changeset goes to the served world's push door; its
@@ -541,7 +544,8 @@ export async function pushWorldChangeset(name, options) {
     const receipts = body.receipts.map((r) => ({ actionId: r.actionId, service: r.twin, stateService: located.changeset.actions.find((e) => e.service === r.twin)?.stateService ?? r.twin, status: statusOf(r.status), ...(r.externalId ? { externalId: r.externalId } : {}), ...(r.reason ? { error: r.reason } : {}) }));
     const outcome = receipts.every((r) => r.status !== 'failed') ? 'applied' : receipts.some((r) => r.status === 'confirmed') ? 'partial' : 'refused';
     const application = { at, contentHash: located.changeset.contentHash, outcome, receipts, compensation: [], ...(outcome === 'refused' ? { refusal: receipts.filter((r) => r.error).map((r) => r.error) } : {}) };
-    const changeset = withApplication(located.changeset, application);
+    // the remote's record of who pushed it and who owns it, kept on this copy too (outside the hash)
+    const changeset = { ...withApplication(located.changeset, application), ...(body.owner && !located.changeset.owner ? { owner: body.owner } : {}), ...(body.pushedBy ? { pushedBy: body.pushedBy } : {}) };
     writeChangesetFile(located.path, changeset);
     const unsent = namedFailure ? `records the landed entries name did not reach the origin (${namedFailure instanceof Error ? namedFailure.message : String(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
     return { ...(unsent ? { unsent } : {}), application, changeset, world: located.world, path: located.path, remote: { url, namespace } };

package/dist/src/configs.d.ts

@@ -1,4 +1,4 @@
-import { type WorldConfig } from './schema.js';
+import { type WorldChangesetRules, type WorldConfig } from './schema.js';
 export declare function resolveConfigPath(config: string, root?: string): string;
 export declare function loadWorldConfig(config: string, root?: string): {
     path: string;
@@ -16,3 +16,6 @@ export type WorldConfigMigration = {
 };
 /** Explicit, backed-up, atomic format-1 → format-2 migration. Ordinary reads never call this. */
 export declare function migrateWorldConfig(config: string, root?: string): WorldConfigMigration;
+/** The changeset rules of the World rooted at `root` (its committed `.volter/world.json`, `changesets`); none when it
+ *  has no config or names none, which readiness reads as one approval and a required summary. */
+export declare function worldChangesetRules(root: string): WorldChangesetRules;

package/dist/src/configs.js

@@ -1,6 +1,6 @@
 import { copyFileSync, constants, existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { basename, dirname, resolve } from 'node:path';
-import { getActiveWorldStore } from '@volter/world-core';
+import { basename, dirname, join, resolve } from 'node:path';
+import { getActiveWorldStore, stateDirName } from '@volter/world-core';
 import { assertWorldConfig, LEGACY_WORLD_SELECTION, worldConfigDocument } from "./schema.js";
 export function resolveConfigPath(config, root = process.cwd()) {
     const candidates = config.includes('/') || config.endsWith('.json')
@@ -117,3 +117,16 @@ export function migrateWorldConfig(config, root = process.cwd()) {
         dropped: normalized.resources === undefined ? [] : ['resources (deprecated; retained in backup)'],
     };
 }
+/** The changeset rules of the World rooted at `root` (its committed `.volter/world.json`, `changesets`); none when it
+ *  has no config or names none, which readiness reads as one approval and a required summary. */
+export function worldChangesetRules(root) {
+    const path = join(root, stateDirName(), 'world.json');
+    if (!getActiveWorldStore().exists(path) && !existsSync(path))
+        return {};
+    try {
+        return loadWorldConfig(path, root).config.changesets ?? {};
+    }
+    catch {
+        return {};
+    }
+}

package/dist/src/fixture-env.js

@@ -194,6 +194,10 @@ const CREDENTIAL_SHAPES = [
     { match: /(^|_)STRIPE_[A-Z0-9_]*WEBHOOK_SECRET$/, value: () => 'whsec_twinfake0000000000000000000000000000', source: 'https://docs.stripe.com/webhooks#verify-events' },
     { match: /(^|_)STRIPE_[A-Z0-9_]*(SECRET|PRIVATE|API)(_API)?_KEY$/, value: () => 'sk_test_twinfake000000000000000000000000000000', source: 'https://docs.stripe.com/keys (sk_test_)' },
     { match: /(^|_)STRIPE_[A-Z0-9_]*(PUBLISHABLE|PUBLIC)(_API)?_KEY$/, value: () => 'pk_test_twinfake000000000000000000000000000000', source: 'https://docs.stripe.com/keys (pk_test_)' },
+    // The slack twin answers a bearer that is none of Slack's token kinds with `invalid_auth`, as Slack does; any `xoxb-`
+    // acts as the workspace bot, and an app-level token is `xapp-`.
+    { match: /(^|_)SLACK_[A-Z0-9_]*APP_TOKEN$/, value: () => 'xapp-1-twinfake', source: 'packages/twin/slack/src/slack-server.ts (bearer /^(xox|xapp-)/)' },
+    { match: /(^|_)SLACK_([A-Z0-9_]*_)?BOT_TOKEN$|(^|_)SLACK_TOKEN$/, value: () => 'xoxb-twinfake', source: 'packages/twin/slack/src/slack-server.ts (bearer /^(xox|xapp-)/); GET /twin identity (any other xoxb-* is the workspace bot)' },
     // tavily-auth.ts and firecrawl-auth.ts refuse a key without the vendor's prefix with the vendor's 401
     { match: /(^|_)TAVILY_[A-Z0-9_]*(KEY|TOKEN)$/, value: () => 'tvly-twinfake00000000000000000000', source: 'packages/twin/tavily/src/tavily-auth.ts' },
     { match: /(^|_)FIRECRAWL_[A-Z0-9_]*(KEY|TOKEN)$/, value: () => 'fc-twinfake00000000000000000000000', source: 'packages/twin/firecrawl/src/firecrawl-auth.ts FIRECRAWL_KEY_PREFIX' },

package/dist/src/index.d.ts

@@ -1,6 +1,7 @@
 export type { WorldConfig, WorldInstance, WorldIsolation, WorldMode, WorldServiceConfig, WorldServiceType, WorldExternalServiceConfig, WorldExternalDiscover, WorldExternalDiscoverSource, WorldExternalReadyWhen, WorldRunOutcome, WorldRunRecord, WorldResourceRequirements, WorldManifestV2, WorldSelection, WorldSelectionSelector, WorldUsage, } from './schema.js';
 export { DEFAULT_WORLD_SELECTION, LEGACY_WORLD_SELECTION, WORLD_SCHEMA_VERSION, WORLD_USAGES, worldConfigDocument, worldSelectionIncludes } from './schema.js';
-export { loadWorldConfig, migrateWorldConfig, resolveConfigPath, writeWorldConfig } from './configs.js';
+export type { WorldChangesetRules } from './schema.js';
+export { loadWorldConfig, migrateWorldConfig, resolveConfigPath, worldChangesetRules, writeWorldConfig } from './configs.js';
 export type { WorldConfigMigration } from './configs.js';
 export { upWorld, downWorld, pruneWorlds, listWorlds, statusWorld, doctorWorld, runWithWorldEnv, attachWorld, retireWorldConsumers, activateScript, shellWorld, worldShellEnv, ensureWorldProxy, runProxyDaemon, runWorld, shareWorld, shareWorldServices, unshareWorld, urlsWorld, urlWorld, } from './runtime.js';
 export type { WorldCleanupEntry } from './runtime.js';

package/dist/src/index.js

@@ -1,5 +1,5 @@
 export { DEFAULT_WORLD_SELECTION, LEGACY_WORLD_SELECTION, WORLD_SCHEMA_VERSION, WORLD_USAGES, worldConfigDocument, worldSelectionIncludes } from "./schema.js";
-export { loadWorldConfig, migrateWorldConfig, resolveConfigPath, writeWorldConfig } from "./configs.js";
+export { loadWorldConfig, migrateWorldConfig, resolveConfigPath, worldChangesetRules, writeWorldConfig } from "./configs.js";
 export { upWorld, downWorld, pruneWorlds, listWorlds, statusWorld, doctorWorld, runWithWorldEnv, attachWorld, retireWorldConsumers, activateScript, shellWorld, worldShellEnv, ensureWorldProxy, runProxyDaemon, runWorld, shareWorld, shareWorldServices, unshareWorld, urlsWorld, urlWorld, } from "./runtime.js";
 export { worldResourceReport } from "./resources.js";
 // `volter-world app-url` — the recorded, queryable app endpoint of an instance (see app-url.ts).

package/dist/src/root.js

@@ -12,7 +12,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join, relative, resolve } from 'node:path';
 import { authStrategyFor, currentSealer, destinationOf, sealsThroughVault, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, readRoot, registerStateSystem, stateDirName, stateSystemFor, validateRemoteOrigin, writeRoot, } from '@volter/world-core';
-import { loadWorldConfig, writeWorldConfig } from "./configs.js";
+import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from "./configs.js";
 import { changesetReadiness, collectObservations, foldObservations, loadChecks, openRootCredential, performEntries, rootCustody, protocolStanding } from '@volter/world-core';
 import { findWorldChangeset, listWorldChangesets } from "./changeset.js";
 import { importModule } from "./import-module.js";
@@ -577,7 +577,7 @@ export async function deployWorld(name, opts = {}) {
     const out = [];
     if (!opts.changeset) {
         // no name: every ready changeset, by name, in order — so each outcome says which it was for
-        const ready = listWorldChangesets({ root: worldRoot, world: name }).filter((l) => changesetReadiness(l.changeset).ready && !l.changeset.actions.every((e) => { const r = rootForControlRoot(join(inst.dirs.data, e.service), e.service); return r === null; })).sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
+        const ready = listWorldChangesets({ root: worldRoot, world: name }).filter((l) => changesetReadiness(l.changeset, worldChangesetRules(worldRoot)).ready && !l.changeset.actions.every((e) => { const r = rootForControlRoot(join(inst.dirs.data, e.service), e.service); return r === null; })).sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
         const anyGated = Object.keys(inst.services).some((s) => rootForControlRoot(join(inst.dirs.data, s), s)?.deploy === 'gated');
         if (anyGated || ready.length) {
             for (const l of ready)
@@ -589,7 +589,7 @@ export async function deployWorld(name, opts = {}) {
     const located = opts.changeset ? [findWorldChangeset(opts.changeset, { root: worldRoot, world: name })] : listWorldChangesets({ root: worldRoot, world: name });
     const ready = new Map();
     for (const l of located) {
-        const readiness = changesetReadiness(l.changeset);
+        const readiness = changesetReadiness(l.changeset, worldChangesetRules(worldRoot));
         if (!readiness.ready) {
             const gated = [...new Set(l.changeset.actions.map((e) => e.service))].some((s) => rootForControlRoot(join(inst.dirs.data, s), s)?.deploy === 'gated');
             if (opts.changeset && gated)

package/dist/src/schema.d.ts

@@ -51,6 +51,7 @@ export type WorldManifestV2 = {
         share?: WorldShareConfig;
     };
     remotes?: Record<string, string>;
+    changesets?: WorldChangesetRules;
     scenario?: {
         actors?: Record<string, unknown>;
         fixtures?: Record<string, unknown>;
@@ -268,8 +269,17 @@ export type WorldServiceConfig = {
      *  catalog the world was born against. Exact version or `^major.minor` range. */
     version?: string;
 };
+/** How this World's changesets are made and readied (docs/reference/config.md, `changesets`): how many people must
+ *  approve one's current contents before it deploys, and whether a cut needs its author's summary or takes the one
+ *  generated from its changes. A team's rules, committed with the World, as a repository's are. */
+export type WorldChangesetRules = {
+    approvals?: number;
+    summary?: 'required' | 'generated';
+};
 export type WorldConfig = {
     id: string;
+    /** How changesets are made and readied here; omitted: one approval, a summary required. */
+    changesets?: WorldChangesetRules;
     /** Real external origins; omitted preserves legacy routing, [] explicitly closes egress. */
     network?: WorldNetwork;
     /** Internal normalized source format and saved discovery selection. */
@@ -452,3 +462,5 @@ export declare function assertWorldConfig(value: unknown, path: string): WorldCo
 export declare function worldSelectionIncludes(selection: WorldSelection, vendor: string, usage: WorldUsage): boolean;
 /** Serialize normalized intent as the committed format-2 manifest. */
 export declare function worldConfigDocument(config: WorldConfig, selection?: WorldSelection): WorldManifestV2 & Record<string, unknown>;
+/** A World's changeset rules, strictly: `approvals` a whole number 0–10, `summary` `required` or `generated`, nothing else. */
+export declare function assertChangesetRules(rules: unknown, path: string): asserts rules is WorldChangesetRules;

package/dist/src/schema.js

@@ -132,6 +132,8 @@ function assertLegacyWorldConfig(value, path) {
             if (typeof target !== 'string' || target === '' || !/^[A-Za-z0-9._-]+$/.test(name))
                 throw new Error(`World config remote "${name}" must be a non-empty url or path in ${path}`);
     }
+    if (config.changesets !== undefined)
+        assertChangesetRules(config.changesets, path);
     if (config.isolation !== undefined && config.isolation !== 'process' && config.isolation !== 'colocated' && config.isolation !== 'worker') {
         throw new Error(`World config isolation must be "process", "colocated", or "worker" in ${path}`);
     }
@@ -458,7 +460,7 @@ function serviceV2ToLegacy(value, path) {
     return legacy;
 }
 function normalizeV2(value, path) {
-    assertKeys(value, ['schemaVersion', 'metadata', 'discovery', 'services', 'runtime', 'serving', 'remotes', 'scenario', 'provenance'], 'World manifest', path, true);
+    assertKeys(value, ['schemaVersion', 'metadata', 'discovery', 'services', 'runtime', 'serving', 'remotes', 'changesets', 'scenario', 'provenance'], 'World manifest', path, true);
     for (const name of ['metadata', 'discovery', 'runtime', 'serving', 'scenario', 'provenance'])
         if (value[name] !== undefined && !record(value[name]))
             throw new Error(`${name} must be an object in ${path}`);
@@ -515,6 +517,7 @@ function normalizeV2(value, path) {
         ...(mode === 'bare' ? { bare: { name: serving.name } } : {}),
         ...(serving.share === undefined ? {} : { share: serving.share }),
         ...(value.remotes === undefined ? {} : { remotes: value.remotes }),
+        ...(value.changesets === undefined ? {} : { changesets: value.changesets }),
         ...(scenario.actors === undefined ? {} : { actors: scenario.actors }),
         ...(scenario.fixtures === undefined ? {} : { fixtures: scenario.fixtures }),
         ...(provenance.catalog === undefined ? {} : { catalog: provenance.catalog }),
@@ -604,6 +607,7 @@ export function worldConfigDocument(config, selection = config.selection ?? DEFA
                 ...(config.share === undefined ? {} : { share: config.share }),
             } }),
         ...(config.remotes === undefined ? {} : { remotes: config.remotes }),
+        ...(config.changesets === undefined ? {} : { changesets: config.changesets }),
         ...(config.actors === undefined && config.fixtures === undefined ? {} : { scenario: {
                 ...(config.actors === undefined ? {} : { actors: config.actors }),
                 ...(config.fixtures === undefined ? {} : { fixtures: config.fixtures }),
@@ -612,3 +616,16 @@ export function worldConfigDocument(config, selection = config.selection ?? DEFA
         ...Object.fromEntries(Object.entries(config).filter(([key]) => key.startsWith('//'))),
     };
 }
+/** A World's changeset rules, strictly: `approvals` a whole number 0–10, `summary` `required` or `generated`, nothing else. */
+export function assertChangesetRules(rules, path) {
+    if (typeof rules !== 'object' || rules === null || Array.isArray(rules))
+        throw new Error(`World config changesets must be an object in ${path}`);
+    for (const key of Object.keys(rules))
+        if (key !== 'approvals' && key !== 'summary')
+            throw new Error(`World config changesets has no "${key}" (approvals, summary) in ${path}`);
+    const { approvals, summary } = rules;
+    if (approvals !== undefined && !(Number.isInteger(approvals) && approvals >= 0 && approvals <= 10))
+        throw new Error(`World config changesets.approvals must be a whole number from 0 to 10 in ${path}`);
+    if (summary !== undefined && summary !== 'required' && summary !== 'generated')
+        throw new Error(`World config changesets.summary must be "required" or "generated" in ${path}`);
+}

package/dist/src/served-world.d.ts

@@ -3,7 +3,7 @@ import { type TwinStreamConnection, type TwinStreamSink } from '@volter/world-co
 import { type TrustedIssuer } from '@volter/world-access';
 import { type Changeset, type Receipt } from '@volter/world-core';
 import { rootForControlRoot } from './root.js';
-import type { WorldInstance } from './schema.js';
+import { type WorldInstance } from './schema.js';
 export declare const TOKEN_HEADER = "x-volter-token";
 /** The header the injector carries a hosted World's token in (inject.cjs, VOLTER_TWINS_KEY). */
 export declare const TWINS_KEY_HEADER = "x-twins-key";
@@ -63,7 +63,8 @@ export declare function mountWorld(name: string, opts?: {
     root?: string; /** the host's branches of this World, by its served name */
     branches?: (served: string) => BranchDoors | undefined; /** the origin a browser reaches this World at, when the host gives each World one */
     browserOrigin?: (served: string) => string | null; /** served on this machine's loopback: its own pages need no token (DoorHost.localTrust) */
-    localTrust?: boolean; /** DoorHost.serveBranch */
+    localTrust?: boolean; /** the person signed in on this machine: its own page acts as them (DoorHost.localPerson) */
+    localPerson?: string; /** DoorHost.serveBranch */
     serveBranch?: (branch: string) => Promise<void>;
 }): Promise<MountedWorld>;
 /** Boot the world (state kept) and serve it on its own port. Announces and returns after boot; `stop` downs the world. */
@@ -138,6 +139,8 @@ export type DoorHost = {
      *  loopback name, is given the World's session without a token (`localSession`). A remote host leaves it absent,
      *  and its pages sign in with a token. */
     localTrust?: () => boolean;
+    /** whom this machine's own page acts as: the person `volter login` signed in here, if any ("Who acted is recorded") */
+    localPerson?: () => string | undefined;
     /** The platforms whose passes open this World (docs/contributing/architecture.md, "The hosted product"): a person a
      *  trusted platform signed a pass for is given a session of the pass's scope. Absent, or empty, no pass opens it. */
     passIssuers?: () => TrustedIssuer[];
@@ -220,6 +223,9 @@ export declare class WorldDoors {
      *  revoke every key made by or for a person (their leaving the org). */
     /** The person a key is for: whom it was made for, else the person whose session made it. */
     private keyPerson;
+    /** The person a key acts for, as attribution names them ("Who acted is recorded"): the name it was made for, else the
+     *  person whose session made it, as their session names them (a pass's email, this machine's person). */
+    private keyName;
     /** Revoke the keys `pick` names, and what they reach: the branches whose parent key goes, and the branches (with their
      *  keys) a revoked key made. Answers the revoked keys' ids. */
     private revokeKeys;
@@ -276,6 +282,10 @@ export declare class WorldDoors {
      *  (`person` when it names no one), `token` / `token:read` for the World's own tokens; null when it presented nothing
      *  this World issued. */
     private callerOf;
+    /** The person a request acts for: a session's person, or the person a key is for; none for this machine's page or a
+     *  World's own token. What lands in a World others read must name one. */
+    private personOf;
+    private keyOf;
     /** The session cookie's name where `url` reached this World, or null where a session opens nothing:
      *  on the World's own origin a host-only cookie (`__Host-` over https); without an origin of its own,
      *  the path-scoped cookie a shared origin has always carried. */

package/dist/src/served-world.js

@@ -31,13 +31,14 @@ import { APP_READ_ENDPOINT_ENV } from "./init.js";
 import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass } from '@volter/world-access';
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
-import { appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow, parentEntries, readBranchMeta, rebaseBranch, } from '@volter/world-core';
+import { appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, changesetReadiness, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow, parentEntries, readBranchMeta, rebaseBranch, } from '@volter/world-core';
 import { approveWorldChangeset, createWorldChangeset, diffWorld, findWorldChangeset, listWorldChangesets, pushWorldChangeset, verifyWorldChangeset, worldChangesetsDir } from "./changeset.js";
 import { fetchFromOrigin } from "./origin.js";
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart } from "./console-apart.js";
-import { loadWorldConfig } from "./configs.js";
+import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from "./configs.js";
 import { adaptersFor, credentialPath, packMirror, credentialPayloadFrom, deployTwin, deployWorld, loadWorldChecks, twinSigningSecret, materializeRoots, refreshPosture, refreshTwin, rootForControlRoot, rewrapTwinCredentials, sealTwinCredential, sealedCredentialInfo, bindLegacyCredentials, setTwinRoot, spanMs } from "./root.js";
 import { clockFile, downWorld, listWorlds, statusWorld, upWorld } from "./runtime.js";
+import { assertChangesetRules } from "./schema.js";
 export const TOKEN_HEADER = 'x-volter-token';
 /** The header the injector carries a hosted World's token in (inject.cjs, VOLTER_TWINS_KEY). */
 export const TWINS_KEY_HEADER = 'x-twins-key';
@@ -142,7 +143,7 @@ export async function mountWorld(name, opts = {}) {
         clockPath: () => clockFile(worldRoot, name),
         ...(opts.branches?.(served) ? { branches: opts.branches(served) } : {}),
         ...(opts.browserOrigin ? { browserOrigin: () => opts.browserOrigin(served), originOf: (other) => opts.browserOrigin(other) } : {}),
-        ...(opts.localTrust ? { localTrust: () => true } : {}),
+        ...(opts.localTrust ? { localTrust: () => true, ...(opts.localPerson ? { localPerson: () => opts.localPerson } : {}) } : {}),
         ...(opts.serveBranch ? { serveBranch: opts.serveBranch } : {}),
         ...(opts.passIssuers?.length ? { passIssuers: () => opts.passIssuers } : {}),
         // a local twin is its own process: the wire forwards to the port it listens on
@@ -423,7 +424,7 @@ export class WorldDoors {
     }
     /** A new session of `scope`: its id, the cookie's value. A token's lasts 30 days; a person's from a pass, `who`,
      *  lasts as long as the pass's platform says (twelve hours), so a person removed there loses it within the day. */
-    openSession(scope, person, key) {
+    openSession(scope, person, key, local) {
         const id = mintToken('ses_');
         let held = this.sessions();
         // a person holds at most five sessions here: passes (anyone's with one) never crowd out everyone else's
@@ -435,7 +436,7 @@ export class WorldDoors {
             }
         }
         const until = Math.min(Date.now() + (person?.ttlMs ?? 30 * 86_400_000), key?.until ?? Infinity);
-        this.keepSessions({ ...held, [id]: { scope, until, ...(person ? { who: person.who, issuer: person.issuer, ...(person.sub ? { sub: person.sub } : {}) } : {}), ...(key ? { key: key.id } : {}) } });
+        this.keepSessions({ ...held, [id]: { scope, until, ...(local ? { local: true } : {}), ...(person ? { who: person.who, ...(person.issuer ? { issuer: person.issuer } : {}), ...(person.sub ? { sub: person.sub } : {}) } : {}), ...(key ? { key: key.id } : {}) } });
         return id;
     }
     /** NAMED KEYS: what an app or a script holds (docs/contributing/architecture.md, "The hosted product"), each named
@@ -466,6 +467,9 @@ export class WorldDoors {
      *  revoke every key made by or for a person (their leaving the org). */
     /** The person a key is for: whom it was made for, else the person whose session made it. */
     keyPerson(k) { return k.for ?? (k.createdBy?.via === 'session' ? k.createdBy.sub : undefined); }
+    /** The person a key acts for, as attribution names them ("Who acted is recorded"): the name it was made for, else the
+     *  person whose session made it, as their session names them (a pass's email, this machine's person). */
+    keyName(k) { return k.forName ?? k.for ?? (k.createdBy?.via === 'session' ? k.createdBy.who ?? k.createdBy.sub : undefined); }
     /** Revoke the keys `pick` names, and what they reach: the branches whose parent key goes, and the branches (with their
      *  keys) a revoked key made. Answers the revoked keys' ids. */
     async revokeKeys(pick) {
@@ -491,7 +495,7 @@ export class WorldDoors {
             return Response.json({ error: 'a key manages no keys: use the World\'s token, or its page' }, { status: 403 });
         const now = Date.now();
         const live = () => this.keys().filter((k) => !k.expiresAt || Date.parse(k.expiresAt) > now);
-        const view = (k) => ({ id: k.id, name: k.name, scope: k.scope, createdAt: k.createdAt, lastUsedAt: k.lastUsedAt ?? null, expiresAt: k.expiresAt ?? null, for: k.for ?? null, person: this.keyPerson(k) ?? null, branch: k.branch ?? null, createdBy: k.createdBy?.via === 'session' ? (k.createdBy.who ?? k.createdBy.sub ?? 'a person') : k.createdBy?.via === 'key' ? `the key ${k.createdBy.keyId}` : k.createdBy ? 'the World\'s token' : null });
+        const view = (k) => ({ id: k.id, name: k.name, scope: k.scope, createdAt: k.createdAt, lastUsedAt: k.lastUsedAt ?? null, expiresAt: k.expiresAt ?? null, for: k.for ?? null, person: this.keyName(k) ?? null, branch: k.branch ?? null, createdBy: k.createdBy?.via === 'session' ? (k.createdBy.who ?? k.createdBy.sub ?? 'a person') : k.createdBy?.via === 'key' ? `the key ${k.createdBy.keyId}` : k.createdBy ? 'the World\'s token' : null });
         const person = (k) => this.keyPerson(k);
         if (!id && request.method === 'GET')
             return Response.json({ keys: live().map(view) });
@@ -500,6 +504,9 @@ export class WorldDoors {
             const name = typeof body.name === 'string' ? body.name.trim().slice(0, 80) : '';
             if (!name)
                 return Response.json({ error: 'a key needs a name: what holds it (an app, a CI job, a laptop)' }, { status: 400 });
+            // a key's name is what holds it, never whom it is for: the caller a World records reads `key:<name> for:<person>`
+            if (/\sfor:/i.test(name))
+                return Response.json({ error: 'a key\'s name says what holds it; whom it is for is its own field' }, { status: 400 });
             const keyScope = body.scope === 'read' ? 'read' : 'write';
             // a session a platform's pass opened makes no keys: a key outlives the session, and a script on this origin (a
             // stored page) could make one in the person's name. Keys for a platform's Worlds are made on the platform.
@@ -507,9 +514,10 @@ export class WorldDoors {
             if (opener?.issuer)
                 return Response.json({ error: 'a key for this World is made on the platform it was opened from, not from a browser session here', platform: opener.issuer }, { status: 403 });
             // `for`, `replace` and an end are the token's to give (a platform making a command's key for a person)
-            if ((body.for !== undefined || body.replace !== undefined) && via !== 'token')
+            if ((body.for !== undefined || body.forName !== undefined || body.replace !== undefined) && via !== 'token')
                 return Response.json({ error: 'for and replace are the World token\'s' }, { status: 403 });
             const forWhom = typeof body.for === 'string' && /^[A-Za-z0-9:._@-]{1,160}$/.test(body.for) ? body.for : undefined;
+            const forName = forWhom && typeof body.forName === 'string' && /^[A-Za-z0-9:._@+ -]{1,160}$/.test(body.forName) ? body.forName : undefined;
             let expiresAt;
             if (body.expiresAt !== undefined) {
                 const t = typeof body.expiresAt === 'string' ? Date.parse(body.expiresAt) : NaN;
@@ -526,7 +534,7 @@ export class WorldDoors {
             const opened = via === 'session' && session ? this.sessions()[session] : undefined;
             const createdBy = via === 'session' ? { via: 'session', ...(opened?.sub ? { sub: opened.sub } : {}), ...(opened?.who ? { who: opened.who } : {}), ...(opened?.issuer ? { issuer: opened.issuer } : {}) } : { via: 'token' };
             const key = mintToken('tok_k_');
-            const held = { id: mintToken('key_').slice(0, 20), name, scope: keyScope, hash: keyHash(key), createdAt: new Date(now).toISOString(), createdBy, ...(forWhom ? { for: forWhom } : {}), ...(expiresAt ? { expiresAt } : {}) };
+            const held = { id: mintToken('key_').slice(0, 20), name, scope: keyScope, hash: keyHash(key), createdAt: new Date(now).toISOString(), createdBy, ...(forWhom ? { for: forWhom } : {}), ...(forName ? { forName } : {}), ...(expiresAt ? { expiresAt } : {}) };
             this.keepKeys([...kept, held]);
             return Response.json({ ...view(held), key }, { status: 201, headers: { 'cache-control': 'no-store' } });
         }
@@ -692,15 +700,32 @@ export class WorldDoors {
         const cred = this.credential(request);
         if (cred.scope === null)
             return null;
+        // this machine's own page with no one signed in here is this machine; another session with no name is just that
         if (cred.via === 'session')
-            return cred.who ? `person:${cred.who}` : 'person';
+            return cred.who ? `person:${cred.who}` : cred.session && this.sessions()[cred.session]?.local ? 'machine' : 'person';
+        // a key acts as itself, for its person (docs/contributing/architecture.md, "Who acted is recorded")
         if (cred.via === 'key') {
-            const token = cred.token;
-            const held = token ? this.keys().find((k) => sameSecret(keyHash(token), k.hash)) : undefined;
-            return held ? `key:${held.name}` : 'key';
+            const held = this.keyOf(cred.token);
+            const person = held ? this.keyName(held) : undefined;
+            return held ? `key:${held.name}${person ? ` for:${person}` : ''}` : 'key';
         }
         return cred.scope === 'read' ? 'token:read' : 'token';
     }
+    /** The person a request acts for: a session's person, or the person a key is for; none for this machine's page or a
+     *  World's own token. What lands in a World others read must name one. */
+    personOf(request) {
+        const cred = this.credential(request);
+        if (cred.scope === null)
+            return undefined;
+        if (cred.via === 'session')
+            return cred.who;
+        if (cred.via === 'key') {
+            const held = this.keyOf(cred.token);
+            return held ? this.keyName(held) : undefined;
+        }
+        return undefined;
+    }
+    keyOf(token) { return token ? this.keys().find((k) => sameSecret(keyHash(token), k.hash)) : undefined; }
     /** The session cookie's name where `url` reached this World, or null where a session opens nothing:
      *  on the World's own origin a host-only cookie (`__Host-` over https); without an origin of its own,
      *  the path-scoped cookie a shared origin has always carried. */
@@ -1225,11 +1250,13 @@ export class WorldDoors {
             // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
             if (name) {
                 const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name });
-                return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0] });
+                return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0], readiness: changesetReadiness(l.changeset, worldChangesetRules(this.worldRoot)) });
             }
             const all = listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset);
             const deployed = this.deployedOf(all);
-            return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i] })) });
+            const rules = worldChangesetRules(this.worldRoot);
+            // readiness under this World's rules, as deploy reads it: the console says what the kernel decides
+            return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i], readiness: changesetReadiness(c, rules) })) });
         }
         if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
             const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
@@ -1243,7 +1270,8 @@ export class WorldDoors {
             const held = via === 'session' ? this.sessions()[this.credential(request).session ?? ''] : undefined;
             const named = typeof body.as === 'string' && body.as.trim() ? body.as.trim().slice(0, 80) : undefined;
             const tokenSession = held !== undefined && !held.who && held.key === undefined && held.scope === 'write';
-            const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : named;
+            // a key approves as itself, for its person, whatever it says: it cannot be several approvers by naming several
+            const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : via === 'key' ? this.callerOf(request) ?? undefined : named;
             if (!principal)
                 return Response.json({ error: via === 'session' && !tokenSession ? 'this session names no person to sign as: open the World from its platform, or approve with its token' : 'approve: { as, note? } — name who approves' }, { status: via === 'session' && !tokenSession ? 403 : 400 });
             return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
@@ -1381,11 +1409,53 @@ export class WorldDoors {
                 }));
             }
         }
+        // THE RULES DOOR: how this World's changesets are made and readied (`changesets` in its committed config). Read with any
+        // access; changed by a person, this machine or the World's token, never by a key: a key's holder (an app, an agent)
+        // does not relax the review its own changes go through
+        if (kind === 'rules' && !name) {
+            const path = join(this.worldRoot, stateDirName(), 'world.json');
+            if (request.method === 'GET')
+                return Response.json({ world: this.served, changesets: worldChangesetRules(this.worldRoot) });
+            if (request.method === 'PUT') {
+                if (scope !== 'write')
+                    return Response.json({ error: 'the rules are changed with write access' }, { status: 403 });
+                if (via === 'key')
+                    return Response.json({ error: 'a key changes no rules: a person sets them, or the World\'s token' }, { status: 403 });
+                const body = (await request.json().catch(() => null));
+                try {
+                    assertChangesetRules(body?.changesets, path);
+                }
+                catch (error) {
+                    return Response.json({ error: error instanceof Error ? error.message.replace(` in ${path}`, '') : String(error) }, { status: 400 });
+                }
+                const { config } = loadWorldConfig(path, this.worldRoot);
+                const rules = body.changesets;
+                const next = { ...config, changesets: { ...(rules.approvals === undefined ? {} : { approvals: rules.approvals }), ...(rules.summary === undefined ? {} : { summary: rules.summary }) } };
+                writeWorldConfig(path, next);
+                return Response.json({ world: this.served, changesets: next.changesets });
+            }
+        }
         if (kind === 'changesets' && !name && request.method === 'POST') {
             const body = (await request.json().catch(() => ({})));
             const slug = body.message ? body.message.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 48) : '';
-            const cut = body.name ?? (slug || `changeset-${Date.now()}`);
-            return Response.json(await this.serialized('push', async () => createWorldChangeset(this.name, cut, { root: this.worldRoot, ...(body.message ? { message: body.message } : {}) })));
+            // with no summary to name it, the next free `changeset-<n>`, as the command names one
+            const taken = new Set(listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset.name));
+            let n = taken.size + 1;
+            while (taken.has(`changeset-${n}`))
+                n += 1;
+            const cut = body.name ?? (slug || `changeset-${n}`);
+            // a cut says what it does and why, unless this World's rules take the summary generated from its changes
+            if (!body.message?.trim() && worldChangesetRules(this.worldRoot).summary !== 'generated')
+                return Response.json({ error: 'a cut needs its summary: what it does and why' }, { status: 400 });
+            const cutBy = this.callerOf(request) ?? undefined;
+            const owner = this.personOf(request);
+            return await this.serialized('push', async () => {
+                // with no summary, a cut must have something to say: an empty one is a slip, refused as the command refuses it
+                // (inside the lock, so two cuts at once never both take the same changes)
+                if (!body.message?.trim() && diffWorld(this.name, { root: this.worldRoot }).actions.length === 0)
+                    return Response.json({ error: 'nothing to cut: every change is already in a changeset' }, { status: 400 });
+                return Response.json(createWorldChangeset(this.name, cut, { root: this.worldRoot, ...(body.message?.trim() ? { message: body.message.trim() } : {}), ...(cutBy ? { cutBy } : {}), ...(owner ? { owner } : {}) }));
+            });
         }
         // THE BLOBS DOOR: a twin's resource payloads (uploaded media, file bytes) by their key under its
         // resources directory. A push sends the ones its branch holds and this World lacks before the
@@ -1573,7 +1643,9 @@ export class WorldDoors {
         const own = this.host.browserOrigin?.() ?? null;
         if (this.sessionCookieName(url) === null)
             return Response.json({ error: `${this.served}'s browser session lives at its own origin`, origin: own }, { status: 409 });
-        return Response.json({ world: this.served, scope: 'write', local: true, ...(own ? { origin: own } : {}) }, { headers: { 'set-cookie': this.sessionCookie(url, this.openSession('write')) } });
+        // this machine's page acts as the person signed in here, when one is (`volter login`); else as this machine
+        const person = this.host.localPerson?.();
+        return Response.json({ world: this.served, scope: 'write', local: true, ...(person ? { who: person } : {}), ...(own ? { origin: own } : {}) }, { headers: { 'set-cookie': this.sessionCookie(url, this.openSession('write', person ? { who: person, ttlMs: 30 * 86_400_000 } : undefined, undefined, true)) } });
     }
     session(request, url, scope, key) {
         const own = this.host.browserOrigin?.() ?? null;
@@ -1859,10 +1931,18 @@ export class WorldDoors {
     }
     /** PUSH: see `landChangeset` — the door hands the body to it. */
     async push(request) {
+        // who pushed it is recorded, a person or a service (a key, the World's token): an automation pushes as itself
+        // (docs/contributing/architecture.md, "Who acted is recorded")
+        const person = this.personOf(request);
         const body = (await request.json());
-        const changeset = 'changeset' in body && !('actions' in body) ? body.changeset : body;
-        if (!changeset || !Array.isArray(changeset.actions))
+        const sent = 'changeset' in body && !('actions' in body) ? body.changeset : body;
+        if (!sent || !Array.isArray(sent.actions))
             return Response.json({ error: 'push: a changeset object' }, { status: 400 });
+        // who pushed it, and its owner when it came with none and the pusher names a person: outside its hash, so nothing an
+        // approval bound to moves
+        const pushedBy = this.callerOf(request) ?? undefined;
+        const owner = sent.owner ?? person;
+        const changeset = { ...sent, ...(owner ? { owner } : {}), ...(pushedBy ? { pushedBy } : {}) };
         this.refresh();
         // fast-forward only: the client says where it last saw each twin's log (its fetch cursor); a
         // twin that moved past it refuses with the drift — fetch, rebase, push again
@@ -1872,7 +1952,14 @@ export class WorldDoors {
             const receipts = await landChangeset(this.name, this.worldRoot, this.up(), changeset, expect);
             const position = Object.fromEntries([...new Set(changeset.actions.map((a) => a.service))].map((twin) => [twin, positionOf(twin)]));
             const snapshots = Object.fromEntries(Object.keys(position).map(twin => { const head = captureHistory(this.stateOf(twin), this.controlRoot(twin)); return [twin, { view: head.view, position: head.position }]; }));
-            return Response.json({ world: this.served, changeset: changeset.name, receipts, position, snapshots });
+            // who owns and pushed it, as this World keeps it: a changeset landed before keeps its first record
+            const kept = (() => { try {
+                return JSON.parse(getActiveWorldStore().read(join(worldChangesetsDir(this.name, this.worldRoot), `${changeset.name}.json`)) ?? 'null');
+            }
+            catch {
+                return null;
+            } })();
+            return Response.json({ world: this.served, changeset: changeset.name, receipts, position, snapshots, ...(kept?.owner ? { owner: kept.owner } : {}), ...(kept?.pushedBy ? { pushedBy: kept.pushedBy } : {}) });
         }
         catch (error) {
             return Response.json({ error: error instanceof Error ? error.message : String(error) }, { status: 409 });

package/dist/src/world-view.d.ts

@@ -16,6 +16,7 @@ export type WorldView = {
     stop: () => Promise<void>;
 };
 export declare function serveWorldView(name: string, opts?: {
+    localPerson?: string;
     root?: string;
     port?: number;
     host?: string;

package/dist/src/world-view.js

@@ -48,7 +48,7 @@ export async function serveWorldView(name, opts = {}) {
     // (the first World mounted is the World; every later one is a branch of it)
     let base = null;
     const browserOrigin = origins ? (served) => (proxied && (base === null || served === base) ? proxied.origin : port ? localWorldOrigin(served, port) : null) : undefined;
-    const mountAt = (at) => mountWorld(loadWorldConfig(join(at, stateDirName(), 'world.json'), at).config.id, { root: at, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}) });
+    const mountAt = (at) => mountWorld(loadWorldConfig(join(at, stateDirName(), 'world.json'), at).config.id, { root: at, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true, ...(opts.localPerson ? { localPerson: opts.localPerson } : {}) } : {}) });
     const branches = new LocalBranches({ dir: join(root, stateDirName(), 'branches'), origin: () => loopback, worlds, mount: mountAt, ...(opts.announce ? { announce: opts.announce } : {}) });
     // THE WORLD'S OWN BRANCHES, one served at a time: serving another stops this one's twins and starts that one's under the
     // same served name (its tokens and sessions are the World's, so the page stays open); `.volter/current` follows, as
@@ -90,7 +90,7 @@ export async function serveWorldView(name, opts = {}) {
             switching = false;
         }
     };
-    const mountOpts = { root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}), serveBranch };
+    const mountOpts = { root, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true, ...(opts.localPerson ? { localPerson: opts.localPerson } : {}) } : {}), serveBranch };
     let world = await mountWorld(name, mountOpts);
     base = world.served;
     worlds.set(world.served, world);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "2.0.50",
+  "version": "2.0.51",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -67,14 +67,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "2.0.32",
-    "@volter/world-console": "2.0.13"
+    "@volter/world-core": "2.0.33",
+    "@volter/world-console": "2.0.14"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "2.0.2",
-    "@volter/world-core": "2.0.32",
+    "@volter/world-core": "2.0.33",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0"
   },
@@ -84,6 +84,6 @@
     }
   },
   "optionalDependencies": {
-    "@volter/twin-mongodb": "0.1.32"
+    "@volter/twin-mongodb": "0.1.33"
   }
 }

package/src/changeset.ts

@@ -1,3 +1,4 @@
+import { worldChangesetRules } from './configs.ts';
 import { blobDigest, captureHistory, captureParentHistory, getActiveBlobStore, getActiveWorldStore, originHead, withAncestryLock, worldPaths, type HistoryReference } from '@volter/world-core';
 // `volter-world mark` / `diff` / `changeset` — the WORLD-side verbs over the changeset
 // primitive (docs/concepts/the-model.md v0). Thin, exactly like `covers` and `tail` are thin: all
@@ -202,7 +203,7 @@ export type ChangesetLocation = { changeset: Changeset; world: string; path: str
 export function createWorldChangeset(
   world: string,
   name: string,
-  options: WorldRootOptions & { base?: string; verifiers?: ChangesetVerifier[]; now?: Date; overwrite?: boolean; message?: string } = {},
+  options: WorldRootOptions & { base?: string; verifiers?: ChangesetVerifier[]; now?: Date; overwrite?: boolean; message?: string; /** who cuts it and the person it is owned by, from the cutting grant (a served World's door) */ cutBy?: string; owner?: string } = {},
 ): Changeset {
   const root = resolveRoot(options.root);
   assertSafeChangesetName(name);
@@ -227,6 +228,8 @@ export function createWorldChangeset(
     ...(options.verifiers ? { verifiers: options.verifiers } : {}),
     ...(options.now ? { createdAt: options.now.toISOString() } : {}),
     ...(options.message === undefined ? {} : { message: options.message }),
+    ...(options.cutBy === undefined ? {} : { cutBy: options.cutBy }),
+    ...(options.owner === undefined ? {} : { owner: options.owner }),
   });
   getActiveWorldStore().write(path, `${JSON.stringify(changeset, null, 2)}\n`);
   // a changeset records where the log was cut (contract "The model"): the next one starts here
@@ -447,7 +450,7 @@ export function statusWorldChangeset(
 ): ChangesetReadiness {
   const root = resolveRoot(options.root);
   const located = findWorldChangeset(name, { root, ...(options.world ? { world: options.world } : {}) });
-  return changesetReadiness(located.changeset);
+  return changesetReadiness(located.changeset, worldChangesetRules(root));
 }
 
 // ── governed push: `volter-world changeset push` ─────────────────────────────────────────
@@ -481,7 +484,7 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   const namespace = options.namespace ?? instance.origin?.namespace;
   if (!url || !namespace) throw new Error(`World "${located.world}" has no origin to push to — \`volter remote add origin <url> --token <token>\` names one`);
   // over http to a served world's push door, or straight into a world at a path (git's file transport)
-  let res: { ok: boolean; status: number }; let body: { receipts?: Array<{ actionId: string; twin: string } & Receipt>; error?: string; refusal?: string[]; position?: Record<string, number>; snapshots?: Record<string, HistoryReference> };
+  let res: { ok: boolean; status: number }; let body: { receipts?: Array<{ actionId: string; twin: string } & Receipt>; error?: string; refusal?: string[]; position?: Record<string, number>; snapshots?: Record<string, HistoryReference>; /** whom the remote records as its owner and as who pushed it */ owner?: string; pushedBy?: string };
   const expect: Record<string, HistoryReference> = {};
   for (const a of located.changeset.actions) {
     const meta = readBranchMeta(a.stateService ?? a.service, join(instance.dirs.data, a.service));
@@ -597,7 +600,8 @@ export async function pushWorldChangeset(name: string, options: PushWorldOptions
   const receipts: ApplyReceipt[] = body.receipts.map((r) => ({ actionId: r.actionId, service: r.twin, stateService: located.changeset.actions.find((e) => e.service === r.twin)?.stateService ?? r.twin, status: statusOf(r.status), ...(r.externalId ? { externalId: r.externalId } : {}), ...(r.reason ? { error: r.reason } : {}) }));
   const outcome: ChangesetApplication['outcome'] = receipts.every((r) => r.status !== 'failed') ? 'applied' : receipts.some((r) => r.status === 'confirmed') ? 'partial' : 'refused';
   const application: ChangesetApplication = { at, contentHash: located.changeset.contentHash, outcome, receipts, compensation: [], ...(outcome === 'refused' ? { refusal: receipts.filter((r) => r.error).map((r) => r.error!) } : {}) };
-  const changeset = withApplication(located.changeset, application);
+  // the remote's record of who pushed it and who owns it, kept on this copy too (outside the hash)
+  const changeset = { ...withApplication(located.changeset, application), ...(body.owner && !located.changeset.owner ? { owner: body.owner } : {}), ...(body.pushedBy ? { pushedBy: body.pushedBy } : {}) };
   writeChangesetFile(located.path, changeset);
   const unsent = namedFailure ? `records the landed entries name did not reach the origin (${namedFailure instanceof Error ? namedFailure.message : String(namedFailure)}); the next push from this branch that touches ${twins.map(([t]) => t).join(', ')} sends them` : undefined;
   return { ...(unsent ? { unsent } : {}), application, changeset, world: located.world, path: located.path, remote: { url, namespace } };

package/src/configs.ts

@@ -1,7 +1,7 @@
 import { copyFileSync, constants, existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import { basename, dirname, resolve } from 'node:path';
-import { getActiveWorldStore } from '@volter/world-core';
-import { assertWorldConfig, LEGACY_WORLD_SELECTION, worldConfigDocument, type WorldConfig } from './schema.ts';
+import { basename, dirname, join, resolve } from 'node:path';
+import { getActiveWorldStore, stateDirName } from '@volter/world-core';
+import { assertWorldConfig, LEGACY_WORLD_SELECTION, worldConfigDocument, type WorldChangesetRules, type WorldConfig } from './schema.ts';
 
 export function resolveConfigPath(config: string, root = process.cwd()): string {
   const candidates = config.includes('/') || config.endsWith('.json')
@@ -108,3 +108,11 @@ export function migrateWorldConfig(config: string, root = process.cwd()): WorldC
     dropped: normalized.resources === undefined ? [] : ['resources (deprecated; retained in backup)'],
   };
 }
+
+/** The changeset rules of the World rooted at `root` (its committed `.volter/world.json`, `changesets`); none when it
+ *  has no config or names none, which readiness reads as one approval and a required summary. */
+export function worldChangesetRules(root: string): WorldChangesetRules {
+  const path = join(root, stateDirName(), 'world.json');
+  if (!getActiveWorldStore().exists(path) && !existsSync(path)) return {};
+  try { return loadWorldConfig(path, root).config.changesets ?? {}; } catch { return {}; }
+}

package/src/fixture-env.ts

@@ -210,6 +210,10 @@ const CREDENTIAL_SHAPES: Array<{ match: RegExp; value: (name: string) => string;
   { match: /(^|_)STRIPE_[A-Z0-9_]*WEBHOOK_SECRET$/, value: () => 'whsec_twinfake0000000000000000000000000000', source: 'https://docs.stripe.com/webhooks#verify-events' },
   { match: /(^|_)STRIPE_[A-Z0-9_]*(SECRET|PRIVATE|API)(_API)?_KEY$/, value: () => 'sk_test_twinfake000000000000000000000000000000', source: 'https://docs.stripe.com/keys (sk_test_)' },
   { match: /(^|_)STRIPE_[A-Z0-9_]*(PUBLISHABLE|PUBLIC)(_API)?_KEY$/, value: () => 'pk_test_twinfake000000000000000000000000000000', source: 'https://docs.stripe.com/keys (pk_test_)' },
+  // The slack twin answers a bearer that is none of Slack's token kinds with `invalid_auth`, as Slack does; any `xoxb-`
+  // acts as the workspace bot, and an app-level token is `xapp-`.
+  { match: /(^|_)SLACK_[A-Z0-9_]*APP_TOKEN$/, value: () => 'xapp-1-twinfake', source: 'packages/twin/slack/src/slack-server.ts (bearer /^(xox|xapp-)/)' },
+  { match: /(^|_)SLACK_([A-Z0-9_]*_)?BOT_TOKEN$|(^|_)SLACK_TOKEN$/, value: () => 'xoxb-twinfake', source: 'packages/twin/slack/src/slack-server.ts (bearer /^(xox|xapp-)/); GET /twin identity (any other xoxb-* is the workspace bot)' },
   // tavily-auth.ts and firecrawl-auth.ts refuse a key without the vendor's prefix with the vendor's 401
   { match: /(^|_)TAVILY_[A-Z0-9_]*(KEY|TOKEN)$/, value: () => 'tvly-twinfake00000000000000000000', source: 'packages/twin/tavily/src/tavily-auth.ts' },
   { match: /(^|_)FIRECRAWL_[A-Z0-9_]*(KEY|TOKEN)$/, value: () => 'fc-twinfake00000000000000000000000', source: 'packages/twin/firecrawl/src/firecrawl-auth.ts FIRECRAWL_KEY_PREFIX' },

package/src/index.ts

@@ -18,7 +18,8 @@ export type {
   WorldUsage,
 } from './schema.ts';
 export { DEFAULT_WORLD_SELECTION, LEGACY_WORLD_SELECTION, WORLD_SCHEMA_VERSION, WORLD_USAGES, worldConfigDocument, worldSelectionIncludes } from './schema.ts';
-export { loadWorldConfig, migrateWorldConfig, resolveConfigPath, writeWorldConfig } from './configs.ts';
+export type { WorldChangesetRules } from './schema.ts';
+export { loadWorldConfig, migrateWorldConfig, resolveConfigPath, worldChangesetRules, writeWorldConfig } from './configs.ts';
 export type { WorldConfigMigration } from './configs.ts';
 export {
   upWorld,

package/src/root.ts

@@ -14,7 +14,7 @@ import { basename, dirname, join, relative, resolve } from 'node:path';
 import {
   NO_SECRETS_CHECK, authStrategyFor, currentSealer, destinationOf, sealsThroughVault, openSealedAt, getActiveWorldStore, getPack, buildRemoteExecute, clearRoot, observeAppends, readRoot, registerStateSystem, stateDirName, stateSystemFor, type Check, type CredentialPayload, type PerformAction, type PushReport, type RemoteExecute, type RootConfig, type SealedCredential, type TwinAction, validateRemoteOrigin, writeRoot,
 } from '@volter/world-core';
-import { loadWorldConfig, writeWorldConfig } from './configs.ts';
+import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from './configs.ts';
 import { changesetReadiness, collectObservations, type Observation, foldObservations, loadChecks, openRootCredential, performEntries, rootCustody, protocolStanding, userKek, type DeployReport, type ObserveReport } from '@volter/world-core';
 import { findWorldChangeset, listWorldChangesets } from './changeset.ts';
 import { importModule } from './import-module.ts';
@@ -501,7 +501,7 @@ export async function deployWorld(name: string, opts: { root?: string; changeset
   const out: DeployTwinOutcome[] = [];
   if (!opts.changeset) {
     // no name: every ready changeset, by name, in order — so each outcome says which it was for
-    const ready = listWorldChangesets({ root: worldRoot, world: name }).filter((l) => changesetReadiness(l.changeset).ready && !l.changeset.actions.every((e) => { const r = rootForControlRoot(join(inst.dirs.data, e.service), e.service); return r === null; })).sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
+    const ready = listWorldChangesets({ root: worldRoot, world: name }).filter((l) => changesetReadiness(l.changeset, worldChangesetRules(worldRoot)).ready && !l.changeset.actions.every((e) => { const r = rootForControlRoot(join(inst.dirs.data, e.service), e.service); return r === null; })).sort((a, b) => a.changeset.createdAt.localeCompare(b.changeset.createdAt));
     const anyGated = Object.keys(inst.services).some((s) => rootForControlRoot(join(inst.dirs.data, s), s)?.deploy === 'gated');
     if (anyGated || ready.length) {
       for (const l of ready) out.push(...(await deployWorld(name, { ...opts, changeset: l.changeset.name })).map((o) => ({ ...o, changeset: l.changeset.name })));
@@ -511,7 +511,7 @@ export async function deployWorld(name: string, opts: { root?: string; changeset
   const located = opts.changeset ? [findWorldChangeset(opts.changeset, { root: worldRoot, world: name })] : listWorldChangesets({ root: worldRoot, world: name });
   const ready = new Map<string, string[]>();
   for (const l of located) {
-    const readiness = changesetReadiness(l.changeset);
+    const readiness = changesetReadiness(l.changeset, worldChangesetRules(worldRoot));
     if (!readiness.ready) {
       const gated = [...new Set(l.changeset.actions.map((e) => e.service))].some((s) => rootForControlRoot(join(inst.dirs.data, s), s)?.deploy === 'gated');
       if (opts.changeset && gated) throw new Error(`changeset ${opts.changeset} is not ready: ${readiness.reasons.join('; ')}`);

package/src/schema.ts

@@ -32,6 +32,7 @@ export type WorldManifestV2 = {
   runtime?: { isolation?: WorldIsolation; environment?: { values?: Record<string, string>; strip?: string[] }; network?: WorldNetwork };
   serving?: { mode?: 'app' | 'bare'; name?: string; share?: WorldShareConfig };
   remotes?: Record<string, string>;
+  changesets?: WorldChangesetRules;
   scenario?: { actors?: Record<string, unknown>; fixtures?: Record<string, unknown> };
   provenance?: { catalog?: { sha: string; protocol?: string } };
 };
@@ -238,8 +239,15 @@ export type WorldServiceConfig = {
   version?: string;
 };
 
+/** How this World's changesets are made and readied (docs/reference/config.md, `changesets`): how many people must
+ *  approve one's current contents before it deploys, and whether a cut needs its author's summary or takes the one
+ *  generated from its changes. A team's rules, committed with the World, as a repository's are. */
+export type WorldChangesetRules = { approvals?: number; summary?: 'required' | 'generated' };
+
 export type WorldConfig = {
   id: string;
+  /** How changesets are made and readied here; omitted: one approval, a summary required. */
+  changesets?: WorldChangesetRules;
   /** Real external origins; omitted preserves legacy routing, [] explicitly closes egress. */
   network?: WorldNetwork;
   /** Internal normalized source format and saved discovery selection. */
@@ -512,6 +520,7 @@ function assertLegacyWorldConfig(value: unknown, path: string): WorldConfig {
     if (typeof config.remotes !== 'object' || Array.isArray(config.remotes)) throw new Error(`World config remotes must be an object of name → url|path in ${path}`);
     for (const [name, target] of Object.entries(config.remotes as Record<string, unknown>)) if (typeof target !== 'string' || target === '' || !/^[A-Za-z0-9._-]+$/.test(name)) throw new Error(`World config remote "${name}" must be a non-empty url or path in ${path}`);
   }
+  if (config.changesets !== undefined) assertChangesetRules(config.changesets, path);
   if (config.isolation !== undefined && config.isolation !== 'process' && config.isolation !== 'colocated' && config.isolation !== 'worker') {
     throw new Error(`World config isolation must be "process", "colocated", or "worker" in ${path}`);
   }
@@ -789,7 +798,7 @@ function serviceV2ToLegacy(value: unknown, path: string): WorldServiceConfig {
 }
 
 function normalizeV2(value: Record<string, unknown>, path: string): WorldConfig {
-  assertKeys(value, ['schemaVersion', 'metadata', 'discovery', 'services', 'runtime', 'serving', 'remotes', 'scenario', 'provenance'], 'World manifest', path, true);
+  assertKeys(value, ['schemaVersion', 'metadata', 'discovery', 'services', 'runtime', 'serving', 'remotes', 'changesets', 'scenario', 'provenance'], 'World manifest', path, true);
   for (const name of ['metadata', 'discovery', 'runtime', 'serving', 'scenario', 'provenance'] as const) if (value[name] !== undefined && !record(value[name])) throw new Error(`${name} must be an object in ${path}`);
   const metadata = value.metadata as Record<string, unknown> | undefined;
   if (!metadata) throw new Error(`World manifest must define metadata in ${path}`);
@@ -830,6 +839,7 @@ function normalizeV2(value: Record<string, unknown>, path: string): WorldConfig
     ...(mode === 'bare' ? { bare: { name: serving.name as string } } : {}),
     ...(serving.share === undefined ? {} : { share: serving.share as WorldShareConfig }),
     ...(value.remotes === undefined ? {} : { remotes: value.remotes as Record<string, string> }),
+    ...(value.changesets === undefined ? {} : { changesets: value.changesets as WorldChangesetRules }),
     ...(scenario.actors === undefined ? {} : { actors: scenario.actors as Record<string, unknown> }),
     ...(scenario.fixtures === undefined ? {} : { fixtures: scenario.fixtures as Record<string, unknown> }),
     ...(provenance.catalog === undefined ? {} : { catalog: provenance.catalog as WorldConfig['catalog'] }),
@@ -922,6 +932,7 @@ export function worldConfigDocument(config: WorldConfig, selection: WorldSelecti
       ...(config.share === undefined ? {} : { share: config.share }),
     } }),
     ...(config.remotes === undefined ? {} : { remotes: config.remotes }),
+    ...(config.changesets === undefined ? {} : { changesets: config.changesets }),
     ...(config.actors === undefined && config.fixtures === undefined ? {} : { scenario: {
       ...(config.actors === undefined ? {} : { actors: config.actors }),
       ...(config.fixtures === undefined ? {} : { fixtures: config.fixtures }),
@@ -930,3 +941,12 @@ export function worldConfigDocument(config: WorldConfig, selection: WorldSelecti
     ...Object.fromEntries(Object.entries(config as Record<string, unknown>).filter(([key]) => key.startsWith('//'))),
   };
 }
+
+/** A World's changeset rules, strictly: `approvals` a whole number 0–10, `summary` `required` or `generated`, nothing else. */
+export function assertChangesetRules(rules: unknown, path: string): asserts rules is WorldChangesetRules {
+  if (typeof rules !== 'object' || rules === null || Array.isArray(rules)) throw new Error(`World config changesets must be an object in ${path}`);
+  for (const key of Object.keys(rules)) if (key !== 'approvals' && key !== 'summary') throw new Error(`World config changesets has no "${key}" (approvals, summary) in ${path}`);
+  const { approvals, summary } = rules as Record<string, unknown>;
+  if (approvals !== undefined && !(Number.isInteger(approvals) && (approvals as number) >= 0 && (approvals as number) <= 10)) throw new Error(`World config changesets.approvals must be a whole number from 0 to 10 in ${path}`);
+  if (summary !== undefined && summary !== 'required' && summary !== 'generated') throw new Error(`World config changesets.summary must be "required" or "generated" in ${path}`);
+}

package/src/served-world.ts

@@ -32,16 +32,16 @@ import { grantOf, presentedSecrets, sameSecret, spentPasses, verifyPass, type Tr
 import { createHash } from 'node:crypto';
 import { dirname, join, resolve } from 'node:path';
 import {
-  appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow,
+  appendActionIfAbsent, branchEntries, branchLogPath, branchMetaPath, changesetContentHash, changesetReadiness, confirmAction, parentLogPath, readTree, stateDirName, wholeLog, worldNow,
   parentEntries, readBranchMeta, rebaseBranch, type Changeset, type Entry, type Receipt, type RootConfig,
 } from '@volter/world-core';
 import { approveWorldChangeset, createWorldChangeset, diffWorld, findWorldChangeset, listWorldChangesets, pushWorldChangeset, verifyWorldChangeset, worldChangesetsDir } from './changeset.ts';
 import { fetchFromOrigin } from './origin.ts';
 import { CONSOLE_BASE, consoleRedirect, serveConsoleApart, type ConsoleMount } from './console-apart.ts';
-import { loadWorldConfig } from './configs.ts';
+import { loadWorldConfig, worldChangesetRules, writeWorldConfig } from './configs.ts';
 import { adaptersFor, credentialPath, packMirror, type PackMirror, credentialPayloadFrom, deployTwin, deployWorld, loadWorldChecks, twinSigningSecret, materializeRoots, refreshPosture, refreshTwin, rootForControlRoot, rewrapTwinCredentials, sealTwinCredential, sealedCredentialInfo, bindLegacyCredentials, setTwinRoot, spanMs } from './root.ts';
 import { clockFile, downWorld, listWorlds, statusWorld, upWorld } from './runtime.ts';
-import type { WorldInstance } from './schema.ts';
+import { assertChangesetRules, type WorldChangesetRules, type WorldInstance } from './schema.ts';
 
 export const TOKEN_HEADER = 'x-volter-token';
 /** The header the injector carries a hosted World's token in (inject.cjs, VOLTER_TWINS_KEY). */
@@ -83,8 +83,10 @@ export function keysFile(worldRoot: string): string { return join(worldRoot, sta
 type HeldKey = { id: string; name: string; scope: 'read' | 'write'; hash: string; createdAt: string; lastUsedAt?: string;
   /** who made it: the World's token, or a person's session (the subject a pass named, and its platform) */
   createdBy?: { via: 'token' } | { via: 'session'; sub?: string; who?: string; issuer?: string } | { via: 'key'; keyId: string };
-  /** the person it was made for, when the World's token made it on their behalf (a platform, for a command) */
+  /** the person it was made for, when the World's token made it on their behalf (a platform, for a command): their subject */
   for?: string;
+  /** that person as attribution names them (their email), beside the subject `for` revocation matches */
+  forName?: string;
   /** after this it opens nothing */
   expiresAt?: string;
   /** the branch this key is the parent's key of: the branch reaches its parent with it, and goes when it goes */
@@ -114,9 +116,9 @@ function configRefFor(worldRoot: string, name: string): string {
  *  with the call — and keeps them beside the world like `boot` does. */
 export type MountedWorld = { name: string; served: string; root: string; readonly token: string; readonly readToken: string; twins: () => string[]; rotate: () => { token: string; readToken: string }; handle: (request: Request) => Promise<Response>; boot: (url: string) => Promise<void>; stop: () => Promise<void> };
 /** A browser session a World keeps: its scope, when it ends, and the person a pass named, when one did. */
-type HeldSession = { scope: 'read' | 'write'; until: number; who?: string; /** the platform whose pass opened it */ issuer?: string; /** the person's subject there */ sub?: string; /** the read key a shared link opened it with: it lasts only while that key does */ key?: string };
+type HeldSession = { scope: 'read' | 'write'; until: number; /** opened by this machine's own page (localSession) */ local?: true; who?: string; /** the platform whose pass opened it */ issuer?: string; /** the person's subject there */ sub?: string; /** the read key a shared link opened it with: it lasts only while that key does */ key?: string };
 
-export async function mountWorld(name: string, opts: { /** the platforms whose passes open this World */ passIssuers?: TrustedIssuer[]; root?: string; /** the host's branches of this World, by its served name */ branches?: (served: string) => BranchDoors | undefined; /** the origin a browser reaches this World at, when the host gives each World one */ browserOrigin?: (served: string) => string | null; /** served on this machine's loopback: its own pages need no token (DoorHost.localTrust) */ localTrust?: boolean; /** DoorHost.serveBranch */ serveBranch?: (branch: string) => Promise<void> } = {}): Promise<MountedWorld> {
+export async function mountWorld(name: string, opts: { /** the platforms whose passes open this World */ passIssuers?: TrustedIssuer[]; root?: string; /** the host's branches of this World, by its served name */ branches?: (served: string) => BranchDoors | undefined; /** the origin a browser reaches this World at, when the host gives each World one */ browserOrigin?: (served: string) => string | null; /** served on this machine's loopback: its own pages need no token (DoorHost.localTrust) */ localTrust?: boolean; /** the person signed in on this machine: its own page acts as them (DoorHost.localPerson) */ localPerson?: string; /** DoorHost.serveBranch */ serveBranch?: (branch: string) => Promise<void> } = {}): Promise<MountedWorld> {
   const worldRoot = resolve(opts.root ?? process.cwd());
   const configRef = configRefFor(worldRoot, name);
   if (loadWorldConfig(configRef, worldRoot).config.resources) {
@@ -148,7 +150,7 @@ export async function mountWorld(name: string, opts: { /** the platforms whose p
     clockPath: () => clockFile(worldRoot, name),
     ...(opts.branches?.(served) ? { branches: opts.branches(served)! } : {}),
     ...(opts.browserOrigin ? { browserOrigin: () => opts.browserOrigin!(served), originOf: (other: string) => opts.browserOrigin!(other) } : {}),
-    ...(opts.localTrust ? { localTrust: () => true } : {}),
+    ...(opts.localTrust ? { localTrust: () => true, ...(opts.localPerson ? { localPerson: () => opts.localPerson } : {}) } : {}),
     ...(opts.serveBranch ? { serveBranch: opts.serveBranch } : {}),
     ...(opts.passIssuers?.length ? { passIssuers: () => opts.passIssuers! } : {}),
     // a local twin is its own process: the wire forwards to the port it listens on
@@ -334,6 +336,8 @@ export type DoorHost = {
    *  loopback name, is given the World's session without a token (`localSession`). A remote host leaves it absent,
    *  and its pages sign in with a token. */
   localTrust?: () => boolean;
+  /** whom this machine's own page acts as: the person `volter login` signed in here, if any ("Who acted is recorded") */
+  localPerson?: () => string | undefined;
   /** The platforms whose passes open this World (docs/contributing/architecture.md, "The hosted product"): a person a
    *  trusted platform signed a pass for is given a session of the pass's scope. Absent, or empty, no pass opens it. */
   passIssuers?: () => TrustedIssuer[];
@@ -415,13 +419,13 @@ export class WorldDoors {
   }
   /** A new session of `scope`: its id, the cookie's value. A token's lasts 30 days; a person's from a pass, `who`,
    *  lasts as long as the pass's platform says (twelve hours), so a person removed there loses it within the day. */
-  private openSession(scope: 'read' | 'write', person?: { who: string; ttlMs: number; issuer: string; sub?: string }, key?: { id: string; until: number }): string {
+  private openSession(scope: 'read' | 'write', person?: { who: string; ttlMs: number; issuer?: string; sub?: string }, key?: { id: string; until: number }, local?: boolean): string {
     const id = mintToken('ses_');
     let held = this.sessions();
     // a person holds at most five sessions here: passes (anyone's with one) never crowd out everyone else's
     if (person) { const theirs = Object.entries(held).filter(([, x]) => x.who === person.who).sort(([, a], [, b]) => b.until - a.until); if (theirs.length >= 5) { const drop = new Set(theirs.slice(4).map(([k]) => k)); held = Object.fromEntries(Object.entries(held).filter(([k]) => !drop.has(k))); } }
     const until = Math.min(Date.now() + (person?.ttlMs ?? 30 * 86_400_000), key?.until ?? Infinity);
-    this.keepSessions({ ...held, [id]: { scope, until, ...(person ? { who: person.who, issuer: person.issuer, ...(person.sub ? { sub: person.sub } : {}) } : {}), ...(key ? { key: key.id } : {}) } });
+    this.keepSessions({ ...held, [id]: { scope, until, ...(local ? { local: true as const } : {}), ...(person ? { who: person.who, ...(person.issuer ? { issuer: person.issuer } : {}), ...(person.sub ? { sub: person.sub } : {}) } : {}), ...(key ? { key: key.id } : {}) } });
     return id;
   }
   /** NAMED KEYS: what an app or a script holds (docs/contributing/architecture.md, "The hosted product"), each named
@@ -443,6 +447,9 @@ export class WorldDoors {
    *  revoke every key made by or for a person (their leaving the org). */
   /** The person a key is for: whom it was made for, else the person whose session made it. */
   private keyPerson(k: HeldKey): string | undefined { return k.for ?? (k.createdBy?.via === 'session' ? k.createdBy.sub : undefined); }
+  /** The person a key acts for, as attribution names them ("Who acted is recorded"): the name it was made for, else the
+   *  person whose session made it, as their session names them (a pass's email, this machine's person). */
+  private keyName(k: HeldKey): string | undefined { return k.forName ?? k.for ?? (k.createdBy?.via === 'session' ? k.createdBy.who ?? k.createdBy.sub : undefined); }
   /** Revoke the keys `pick` names, and what they reach: the branches whose parent key goes, and the branches (with their
    *  keys) a revoked key made. Answers the revoked keys' ids. */
   private async revokeKeys(pick: (k: HeldKey) => boolean): Promise<string[]> {
@@ -462,21 +469,24 @@ export class WorldDoors {
     if (via === 'key') return Response.json({ error: 'a key manages no keys: use the World\'s token, or its page' }, { status: 403 });
     const now = Date.now();
     const live = (): HeldKey[] => this.keys().filter((k) => !k.expiresAt || Date.parse(k.expiresAt) > now);
-    const view = (k: HeldKey) => ({ id: k.id, name: k.name, scope: k.scope, createdAt: k.createdAt, lastUsedAt: k.lastUsedAt ?? null, expiresAt: k.expiresAt ?? null, for: k.for ?? null, person: this.keyPerson(k) ?? null, branch: k.branch ?? null, createdBy: k.createdBy?.via === 'session' ? (k.createdBy.who ?? k.createdBy.sub ?? 'a person') : k.createdBy?.via === 'key' ? `the key ${k.createdBy.keyId}` : k.createdBy ? 'the World\'s token' : null });
+    const view = (k: HeldKey) => ({ id: k.id, name: k.name, scope: k.scope, createdAt: k.createdAt, lastUsedAt: k.lastUsedAt ?? null, expiresAt: k.expiresAt ?? null, for: k.for ?? null, person: this.keyName(k) ?? null, branch: k.branch ?? null, createdBy: k.createdBy?.via === 'session' ? (k.createdBy.who ?? k.createdBy.sub ?? 'a person') : k.createdBy?.via === 'key' ? `the key ${k.createdBy.keyId}` : k.createdBy ? 'the World\'s token' : null });
     const person = (k: HeldKey): string | undefined => this.keyPerson(k);
     if (!id && request.method === 'GET') return Response.json({ keys: live().map(view) });
     if (!id && request.method === 'POST') {
-      const body = (await request.json().catch(() => ({}))) as { name?: unknown; scope?: unknown; for?: unknown; expiresAt?: unknown; replace?: unknown };
+      const body = (await request.json().catch(() => ({}))) as { name?: unknown; scope?: unknown; for?: unknown; forName?: unknown; expiresAt?: unknown; replace?: unknown };
       const name = typeof body.name === 'string' ? body.name.trim().slice(0, 80) : '';
       if (!name) return Response.json({ error: 'a key needs a name: what holds it (an app, a CI job, a laptop)' }, { status: 400 });
+      // a key's name is what holds it, never whom it is for: the caller a World records reads `key:<name> for:<person>`
+      if (/\sfor:/i.test(name)) return Response.json({ error: 'a key\'s name says what holds it; whom it is for is its own field' }, { status: 400 });
       const keyScope = body.scope === 'read' ? 'read' : 'write';
       // a session a platform's pass opened makes no keys: a key outlives the session, and a script on this origin (a
       // stored page) could make one in the person's name. Keys for a platform's Worlds are made on the platform.
       const opener = via === 'session' && session ? this.sessions()[session] : undefined;
       if (opener?.issuer) return Response.json({ error: 'a key for this World is made on the platform it was opened from, not from a browser session here', platform: opener.issuer }, { status: 403 });
       // `for`, `replace` and an end are the token's to give (a platform making a command's key for a person)
-      if ((body.for !== undefined || body.replace !== undefined) && via !== 'token') return Response.json({ error: 'for and replace are the World token\'s' }, { status: 403 });
+      if ((body.for !== undefined || body.forName !== undefined || body.replace !== undefined) && via !== 'token') return Response.json({ error: 'for and replace are the World token\'s' }, { status: 403 });
       const forWhom = typeof body.for === 'string' && /^[A-Za-z0-9:._@-]{1,160}$/.test(body.for) ? body.for : undefined;
+      const forName = forWhom && typeof body.forName === 'string' && /^[A-Za-z0-9:._@+ -]{1,160}$/.test(body.forName) ? body.forName : undefined;
       let expiresAt: string | undefined;
       if (body.expiresAt !== undefined) { const t = typeof body.expiresAt === 'string' ? Date.parse(body.expiresAt) : NaN; if (!(t > now)) return Response.json({ error: 'expiresAt: an ISO instant in the future' }, { status: 400 }); expiresAt = new Date(t).toISOString(); }
       // replace: the key of the same name for the same person goes (one command, one key: asking again does not pile them up)
@@ -485,7 +495,7 @@ export class WorldDoors {
       const opened = via === 'session' && session ? this.sessions()[session] : undefined;
       const createdBy: HeldKey['createdBy'] = via === 'session' ? { via: 'session', ...(opened?.sub ? { sub: opened.sub } : {}), ...(opened?.who ? { who: opened.who } : {}), ...(opened?.issuer ? { issuer: opened.issuer } : {}) } : { via: 'token' };
       const key = mintToken('tok_k_');
-      const held: HeldKey = { id: mintToken('key_').slice(0, 20), name, scope: keyScope, hash: keyHash(key), createdAt: new Date(now).toISOString(), createdBy, ...(forWhom ? { for: forWhom } : {}), ...(expiresAt ? { expiresAt } : {}) };
+      const held: HeldKey = { id: mintToken('key_').slice(0, 20), name, scope: keyScope, hash: keyHash(key), createdAt: new Date(now).toISOString(), createdBy, ...(forWhom ? { for: forWhom } : {}), ...(forName ? { forName } : {}), ...(expiresAt ? { expiresAt } : {}) };
       this.keepKeys([...kept, held]);
       return Response.json({ ...view(held), key }, { status: 201, headers: { 'cache-control': 'no-store' } });
     }
@@ -627,10 +637,22 @@ export class WorldDoors {
   private callerOf(request: Request): string | null {
     const cred = this.credential(request);
     if (cred.scope === null) return null;
-    if (cred.via === 'session') return cred.who ? `person:${cred.who}` : 'person';
-    if (cred.via === 'key') { const token = cred.token; const held = token ? this.keys().find((k) => sameSecret(keyHash(token), k.hash)) : undefined; return held ? `key:${held.name}` : 'key'; }
+    // this machine's own page with no one signed in here is this machine; another session with no name is just that
+    if (cred.via === 'session') return cred.who ? `person:${cred.who}` : cred.session && this.sessions()[cred.session]?.local ? 'machine' : 'person';
+    // a key acts as itself, for its person (docs/contributing/architecture.md, "Who acted is recorded")
+    if (cred.via === 'key') { const held = this.keyOf(cred.token); const person = held ? this.keyName(held) : undefined; return held ? `key:${held.name}${person ? ` for:${person}` : ''}` : 'key'; }
     return cred.scope === 'read' ? 'token:read' : 'token';
   }
+  /** The person a request acts for: a session's person, or the person a key is for; none for this machine's page or a
+   *  World's own token. What lands in a World others read must name one. */
+  private personOf(request: Request): string | undefined {
+    const cred = this.credential(request);
+    if (cred.scope === null) return undefined;
+    if (cred.via === 'session') return cred.who;
+    if (cred.via === 'key') { const held = this.keyOf(cred.token); return held ? this.keyName(held) : undefined; }
+    return undefined;
+  }
+  private keyOf(token: string | null): HeldKey | undefined { return token ? this.keys().find((k) => sameSecret(keyHash(token), k.hash)) : undefined; }
   /** The session cookie's name where `url` reached this World, or null where a session opens nothing:
    *  on the World's own origin a host-only cookie (`__Host-` over https); without an origin of its own,
    *  the path-scoped cookie a shared origin has always carried. */
@@ -1066,10 +1088,12 @@ export class WorldDoors {
     }
     if (kind === 'changesets' && request.method === 'GET') {
       // with the body's hash as it stands, so a reader sees an approval or a verification made on other bytes as stale
-      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0] }); }
+      if (name) { const l = findWorldChangeset(name, { root: this.worldRoot, world: this.name }); return Response.json({ ...l.changeset, currentHash: changesetContentHash(l.changeset), deployed: this.deployedOf([l.changeset])[0], readiness: changesetReadiness(l.changeset, worldChangesetRules(this.worldRoot)) }); }
       const all = listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset);
       const deployed = this.deployedOf(all);
-      return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i] })) });
+      const rules = worldChangesetRules(this.worldRoot);
+      // readiness under this World's rules, as deploy reads it: the console says what the kernel decides
+      return Response.json({ changesets: all.map((c, i) => ({ ...c, currentHash: changesetContentHash(c), deployed: deployed[i], readiness: changesetReadiness(c, rules) })) });
     }
     if (kind === 'changesets' && name && verb === 'verify' && request.method === 'POST') {
       const outcome = await this.serialized('changesets', () => verifyWorldChangeset(name, { root: this.worldRoot, world: this.name, ephemeral: true }));
@@ -1083,7 +1107,8 @@ export class WorldDoors {
       const held = via === 'session' ? this.sessions()[this.credential(request).session ?? ''] : undefined;
       const named = typeof body.as === 'string' && body.as.trim() ? body.as.trim().slice(0, 80) : undefined;
       const tokenSession = held !== undefined && !held.who && held.key === undefined && held.scope === 'write';
-      const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : named;
+      // a key approves as itself, for its person, whatever it says: it cannot be several approvers by naming several
+      const principal = via === 'session' ? held?.who ?? (this.host.localTrust?.() ? 'this machine' : tokenSession ? named : undefined) : via === 'key' ? this.callerOf(request) ?? undefined : named;
       if (!principal) return Response.json({ error: via === 'session' && !tokenSession ? 'this session names no person to sign as: open the World from its platform, or approve with its token' : 'approve: { as, note? } — name who approves' }, { status: via === 'session' && !tokenSession ? 403 : 400 });
       return Response.json(approveWorldChangeset(name, { root: this.worldRoot, world: this.name, principal, ...(body.note ? { note: body.note } : {}) }));
     }
@@ -1189,11 +1214,40 @@ export class WorldDoors {
         }));
       }
     }
+    // THE RULES DOOR: how this World's changesets are made and readied (`changesets` in its committed config). Read with any
+    // access; changed by a person, this machine or the World's token, never by a key: a key's holder (an app, an agent)
+    // does not relax the review its own changes go through
+    if (kind === 'rules' && !name) {
+      const path = join(this.worldRoot, stateDirName(), 'world.json');
+      if (request.method === 'GET') return Response.json({ world: this.served, changesets: worldChangesetRules(this.worldRoot) });
+      if (request.method === 'PUT') {
+        if (scope !== 'write') return Response.json({ error: 'the rules are changed with write access' }, { status: 403 });
+        if (via === 'key') return Response.json({ error: 'a key changes no rules: a person sets them, or the World\'s token' }, { status: 403 });
+        const body = (await request.json().catch(() => null)) as { changesets?: unknown } | null;
+        try { assertChangesetRules(body?.changesets, path); } catch (error) { return Response.json({ error: error instanceof Error ? error.message.replace(` in ${path}`, '') : String(error) }, { status: 400 }); }
+        const { config } = loadWorldConfig(path, this.worldRoot);
+        const rules = body!.changesets as WorldChangesetRules;
+        const next = { ...config, changesets: { ...(rules.approvals === undefined ? {} : { approvals: rules.approvals }), ...(rules.summary === undefined ? {} : { summary: rules.summary }) } };
+        writeWorldConfig(path, next);
+        return Response.json({ world: this.served, changesets: next.changesets });
+      }
+    }
     if (kind === 'changesets' && !name && request.method === 'POST') {
       const body = (await request.json().catch(() => ({}))) as { name?: string; message?: string };
       const slug = body.message ? body.message.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 48) : '';
-      const cut = body.name ?? (slug || `changeset-${Date.now()}`);
-      return Response.json(await this.serialized('push', async () => createWorldChangeset(this.name, cut, { root: this.worldRoot, ...(body.message ? { message: body.message } : {}) })));
+      // with no summary to name it, the next free `changeset-<n>`, as the command names one
+      const taken = new Set(listWorldChangesets({ root: this.worldRoot, world: this.name }).map((l) => l.changeset.name));
+      let n = taken.size + 1; while (taken.has(`changeset-${n}`)) n += 1;
+      const cut = body.name ?? (slug || `changeset-${n}`);
+      // a cut says what it does and why, unless this World's rules take the summary generated from its changes
+      if (!body.message?.trim() && worldChangesetRules(this.worldRoot).summary !== 'generated') return Response.json({ error: 'a cut needs its summary: what it does and why' }, { status: 400 });
+      const cutBy = this.callerOf(request) ?? undefined; const owner = this.personOf(request);
+      return await this.serialized('push', async () => {
+        // with no summary, a cut must have something to say: an empty one is a slip, refused as the command refuses it
+        // (inside the lock, so two cuts at once never both take the same changes)
+        if (!body.message?.trim() && diffWorld(this.name, { root: this.worldRoot }).actions.length === 0) return Response.json({ error: 'nothing to cut: every change is already in a changeset' }, { status: 400 });
+        return Response.json(createWorldChangeset(this.name, cut, { root: this.worldRoot, ...(body.message?.trim() ? { message: body.message.trim() } : {}), ...(cutBy ? { cutBy } : {}), ...(owner ? { owner } : {}) }));
+      });
     }
     // THE BLOBS DOOR: a twin's resource payloads (uploaded media, file bytes) by their key under its
     // resources directory. A push sends the ones its branch holds and this World lacks before the
@@ -1339,7 +1393,9 @@ export class WorldDoors {
   private localSession(url: URL): Response {
     const own = this.host.browserOrigin?.() ?? null;
     if (this.sessionCookieName(url) === null) return Response.json({ error: `${this.served}'s browser session lives at its own origin`, origin: own }, { status: 409 });
-    return Response.json({ world: this.served, scope: 'write', local: true, ...(own ? { origin: own } : {}) }, { headers: { 'set-cookie': this.sessionCookie(url, this.openSession('write'))! } });
+    // this machine's page acts as the person signed in here, when one is (`volter login`); else as this machine
+    const person = this.host.localPerson?.();
+    return Response.json({ world: this.served, scope: 'write', local: true, ...(person ? { who: person } : {}), ...(own ? { origin: own } : {}) }, { headers: { 'set-cookie': this.sessionCookie(url, this.openSession('write', person ? { who: person, ttlMs: 30 * 86_400_000 } : undefined, undefined, true))! } });
   }
 
   private session(request: Request, url: URL, scope: 'read' | 'write', key?: { id: string; until: number }): Response {
@@ -1571,9 +1627,17 @@ export class WorldDoors {
 
   /** PUSH: see `landChangeset` — the door hands the body to it. */
   private async push(request: Request): Promise<Response> {
+    // who pushed it is recorded, a person or a service (a key, the World's token): an automation pushes as itself
+    // (docs/contributing/architecture.md, "Who acted is recorded")
+    const person = this.personOf(request);
     const body = (await request.json()) as Changeset | { changeset: Changeset; expect?: Record<string, HistoryReference> };
-    const changeset = 'changeset' in body && !('actions' in body) ? body.changeset : (body as Changeset);
-    if (!changeset || !Array.isArray(changeset.actions)) return Response.json({ error: 'push: a changeset object' }, { status: 400 });
+    const sent = 'changeset' in body && !('actions' in body) ? body.changeset : (body as Changeset);
+    if (!sent || !Array.isArray(sent.actions)) return Response.json({ error: 'push: a changeset object' }, { status: 400 });
+    // who pushed it, and its owner when it came with none and the pusher names a person: outside its hash, so nothing an
+    // approval bound to moves
+    const pushedBy = this.callerOf(request) ?? undefined;
+    const owner = sent.owner ?? person;
+    const changeset: Changeset = { ...sent, ...(owner ? { owner } : {}), ...(pushedBy ? { pushedBy } : {}) };
     this.refresh();
     // fast-forward only: the client says where it last saw each twin's log (its fetch cursor); a
     // twin that moved past it refuses with the drift — fetch, rebase, push again
@@ -1583,7 +1647,9 @@ export class WorldDoors {
       const receipts = await landChangeset(this.name, this.worldRoot, this.up(), changeset, expect);
       const position = Object.fromEntries([...new Set(changeset.actions.map((a) => a.service))].map((twin) => [twin, positionOf(twin)]));
       const snapshots = Object.fromEntries(Object.keys(position).map(twin => { const head = captureHistory(this.stateOf(twin), this.controlRoot(twin)); return [twin, { view: head.view, position: head.position }]; }));
-      return Response.json({ world: this.served, changeset: changeset.name, receipts, position, snapshots });
+      // who owns and pushed it, as this World keeps it: a changeset landed before keeps its first record
+      const kept = ((): Changeset | null => { try { return JSON.parse(getActiveWorldStore().read(join(worldChangesetsDir(this.name, this.worldRoot), `${changeset.name}.json`)) ?? 'null') as Changeset | null; } catch { return null; } })();
+      return Response.json({ world: this.served, changeset: changeset.name, receipts, position, snapshots, ...(kept?.owner ? { owner: kept.owner } : {}), ...(kept?.pushedBy ? { pushedBy: kept.pushedBy } : {}) });
     } catch (error) {
       return Response.json({ error: error instanceof Error ? error.message : String(error) }, { status: 409 });
     }

package/src/world-view.ts

@@ -28,7 +28,7 @@ function branchRoots(dir: string): string[] {
   return out.sort();
 }
 
-export async function serveWorldView(name: string, opts: { root?: string; port?: number; host?: string; console?: ViewConsole; announce?: (line: string) => void; /** each World a browser steps into at an origin of its own (on by default on loopback) */ origins?: boolean; /** the World's own origin as a browser reaches it through a proxy on this machine (a desktop serving it as an app):
+export async function serveWorldView(name: string, opts: { /** the person signed in on this machine (`volter login`): this World's own page acts as them */ localPerson?: string; root?: string; port?: number; host?: string; console?: ViewConsole; announce?: (line: string) => void; /** each World a browser steps into at an origin of its own (on by default on loopback) */ origins?: boolean; /** the World's own origin as a browser reaches it through a proxy on this machine (a desktop serving it as an app):
    *  a request the proxy forwards from that host (X-Forwarded-Host) is answered as at that origin, its local session included */ origin?: string } = {}): Promise<WorldView> {
   const root = resolve(opts.root ?? process.cwd());
   const host = opts.host ?? '127.0.0.1';
@@ -49,7 +49,7 @@ export async function serveWorldView(name: string, opts: { root?: string; port?:
   // (the first World mounted is the World; every later one is a branch of it)
   let base: string | null = null;
   const browserOrigin = origins ? (served: string) => (proxied && (base === null || served === base) ? proxied.origin : port ? localWorldOrigin(served, port) : null) : undefined;
-  const mountAt = (at: string): Promise<MountedWorld> => mountWorld(loadWorldConfig(join(at, stateDirName(), 'world.json'), at).config.id, { root: at, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}) });
+  const mountAt = (at: string): Promise<MountedWorld> => mountWorld(loadWorldConfig(join(at, stateDirName(), 'world.json'), at).config.id, { root: at, branches: (served) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true, ...(opts.localPerson ? { localPerson: opts.localPerson } : {}) } : {}) });
   const branches: LocalBranches = new LocalBranches({ dir: join(root, stateDirName(), 'branches'), origin: () => loopback, worlds, mount: mountAt, ...(opts.announce ? { announce: opts.announce } : {}) });
   // THE WORLD'S OWN BRANCHES, one served at a time: serving another stops this one's twins and starts that one's under the
   // same served name (its tokens and sessions are the World's, so the page stays open); `.volter/current` follows, as
@@ -80,7 +80,7 @@ export async function serveWorldView(name: string, opts: { root?: string; port?:
       if (branch === loadWorldConfig(join(root, stateDirName(), 'world.json'), root).config.id) rmSync(current, { force: true }); else writeFileSync(current, `${branch}\n`);
     } finally { switching = false; }
   };
-  const mountOpts = { root, branches: (served: string) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true } : {}), serveBranch };
+  const mountOpts = { root, branches: (served: string) => branches.doorsFor(served), ...(browserOrigin ? { browserOrigin } : {}), ...(local ? { localTrust: true, ...(opts.localPerson ? { localPerson: opts.localPerson } : {}) } : {}), serveBranch };
   let world = await mountWorld(name, mountOpts);
   base = world.served;
   worlds.set(world.served, world);