@amenophis1er/foreman 0.1.16 → 0.1.18

package/src/crew.ts

@@ -0,0 +1,330 @@
+/**
+ * Crew presets, and the reviewer gate that stands between a run and "done".
+ *
+ * A mission that runs unattended has nobody reading its diff. The director is
+ * the same kind of agent as the workers, judging its own homework, and asking
+ * it nicely to fetch a second opinion is worth exactly as much as any other
+ * instruction in a prompt. So a crew preset — a named role a human opts into
+ * at compose time — can be marked `requiredForDone`, and Foreman itself refuses
+ * to record the run as done until that reviewer has returned PASS on the diff
+ * the run actually ends with.
+ *
+ * Everything here is pure on purpose: the gate is a rule about a run, not a
+ * conversation with a model, and a rule that decides whether work counts as
+ * finished has to be provable by a test rather than observed in a log.
+ */
+import { createHash } from 'node:crypto';
+import type { ModelChoice, ToolPolicy } from './types.js';
+
+export type CrewKind = 'reviewer' | 'specialist';
+
+export interface CrewPreset {
+  id: string;
+  name: string;
+  kind: CrewKind;
+  model?: ModelChoice;
+  providerId?: string;
+  brief: string;
+  toolPolicy?: 'read-only' | 'default';
+  requiredForDone: boolean;
+}
+
+/** One reviewer's answer about one diff. `at` is what makes a later one later. */
+export interface ReviewVerdict {
+  presetId: string;
+  name: string;
+  pass: boolean;
+  findings: string;
+  diffHash: string;
+  workerId: string;
+  costUsd?: number;
+  at: number;
+}
+
+const REVIEWER_BRIEF = [
+  'You are the reviewer on this mission. Review the diff below against MISSION.md and the',
+  'mission brief the way a demanding senior engineer reviews a colleague\'s pull request.',
+  'Look for correctness first — does this actually do what was asked, and does it break',
+  'anything that already worked. Then missing or shallow tests, security, and anything the',
+  'DONE WHEN criteria did not name but a careful reader would insist on.',
+  'The verdict is PASS only when you would merge this yourself.',
+].join(' ');
+
+const SECURITY_BRIEF = [
+  'You are the security reviewer on this mission. Review the diff below for the ways this',
+  'change could be abused: secrets or tokens committed or logged, injection of any kind',
+  '(shell, SQL, HTML, prompt), path handling that can escape its intended root, and',
+  'permissions — anything newly reachable without authentication, or granted more access',
+  'than the task needs. Ignore style; say plainly what an attacker could do.',
+  'The verdict is PASS only when you would ship this yourself.',
+].join(' ');
+
+/**
+ * The crew a human sees before they have edited anything. Defaults, not law:
+ * the moment they change one, their list replaces this one whole.
+ *
+ * Frozen, and every path out of this module hands back copies, because these
+ * objects are shared by every project on the server — a caller that "just"
+ * flipped requiredForDone on one would be rewriting the gate for all of them.
+ */
+export const BUILT_IN_PRESETS: readonly CrewPreset[] = Object.freeze([
+  Object.freeze({
+    id: 'reviewer',
+    name: 'Reviewer',
+    kind: 'reviewer' as const,
+    model: 'opus',
+    toolPolicy: 'read-only' as const,
+    requiredForDone: true,
+    brief: REVIEWER_BRIEF,
+  }),
+  Object.freeze({
+    id: 'security-review',
+    name: 'Security review',
+    kind: 'reviewer' as const,
+    model: 'opus',
+    toolPolicy: 'read-only' as const,
+    requiredForDone: false,
+    brief: SECURITY_BRIEF,
+  }),
+]) as readonly CrewPreset[];
+
+/**
+ * What "read-only" means for a reviewer: these four tools denied outright, and
+ * nothing else configured.
+ *
+ * The alternative — letting Bash through and classifying each command — is the
+ * kind of rule that is right until someone writes `sh -c 'cat > f'`. A flat
+ * deny is something a test can prove. It costs the reviewer nothing it needs:
+ * AUTO_ALLOW_TOOLS in src/policy.ts already lets Read/Glob/Grep/WebFetch/
+ * WebSearch through, and the diff it is judging arrives in its brief, so the
+ * only thing it loses is the ability to change the code it is judging.
+ */
+export const REVIEWER_TOOL_POLICY: ToolPolicy = Object.freeze({
+  Write: 'deny',
+  Edit: 'deny',
+  NotebookEdit: 'deny',
+  Bash: 'deny',
+}) as ToolPolicy;
+
+function copy(p: CrewPreset): CrewPreset {
+  const out: CrewPreset = { id: p.id, name: p.name, kind: p.kind, brief: p.brief, requiredForDone: p.requiredForDone };
+  if (p.model) out.model = p.model;
+  if (p.providerId) out.providerId = p.providerId;
+  if (p.toolPolicy) out.toolPolicy = p.toolPolicy;
+  return out;
+}
+
+function nonEmptyString(v: unknown): string | undefined {
+  return typeof v === 'string' && v.trim() !== '' ? v : undefined;
+}
+
+/**
+ * A `crewPresets` value read off settings JSON, which nobody validated on the
+ * way in. Anything shaped wrongly is dropped rather than repaired: a preset
+ * with no id cannot be referenced by a run, and a preset with no name has
+ * nothing to put in the sentence that blocks the run.
+ *
+ * null and [] mean different things, and that difference is why this returns
+ * null at all: null is "not configured, fall back", [] is "the human deleted
+ * every preset", and answering [] with the built-ins would resurrect a
+ * reviewer they had just removed.
+ */
+export function normalizePresets(raw: unknown): CrewPreset[] | null {
+  if (!Array.isArray(raw)) return null;
+  const out: CrewPreset[] = [];
+  const seen = new Set<string>();
+  for (const entry of raw) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) continue;
+    const e = entry as Record<string, unknown>;
+    const id = nonEmptyString(e.id);
+    const name = nonEmptyString(e.name);
+    if (!id || !name || seen.has(id)) continue;
+    seen.add(id);
+    const preset: CrewPreset = {
+      id,
+      name,
+      // A preset of an unknown kind is still a worker with a brief; reviewer is
+      // the safe reading, since the only thing kind decides is how it is run.
+      kind: e.kind === 'specialist' ? 'specialist' : 'reviewer',
+      brief: typeof e.brief === 'string' ? e.brief : '',
+      // Anything other than a literal true is not consent to block a run.
+      requiredForDone: e.requiredForDone === true,
+    };
+    const model = nonEmptyString(e.model);
+    if (model) preset.model = model;
+    const providerId = nonEmptyString(e.providerId);
+    if (providerId) preset.providerId = providerId;
+    if (e.toolPolicy === 'read-only' || e.toolPolicy === 'default') preset.toolPolicy = e.toolPolicy;
+    out.push(preset);
+  }
+  return out;
+}
+
+/**
+ * The crew presets in force for a project. A project's list replaces the
+ * global one whole rather than merging with it — the same way the rest of
+ * Settings overlays — because a merge would make "I removed the reviewer here"
+ * unsayable.
+ */
+export function crewPresetsFrom(global: unknown, project: unknown): CrewPreset[] {
+  const read = (blob: unknown): CrewPreset[] | null => {
+    if (!blob || typeof blob !== 'object') return null;
+    return normalizePresets((blob as Record<string, unknown>).crewPresets);
+  };
+  return (read(project) ?? read(global) ?? BUILT_IN_PRESETS).map(copy);
+}
+
+/**
+ * The crew a run starts with, copied onto the run record. Deep copies, because
+ * editing a preset next week must not change what a run that is still going —
+ * or one that finished in March — was reviewed against.
+ */
+export function freezeCrew(ids: readonly string[], presets: readonly CrewPreset[]): CrewPreset[] {
+  const wanted = new Set(ids);
+  const taken = new Set<string>();
+  const out: CrewPreset[] = [];
+  for (const p of presets) {
+    if (!wanted.has(p.id) || taken.has(p.id)) continue;
+    taken.add(p.id);
+    out.push(copy(p));
+  }
+  return out;
+}
+
+/** Past this, findings are a wall of text nobody reads and a row nobody wants to store. */
+const MAX_FINDINGS = 8000;
+
+/**
+ * The reviewer's verdict, dug out of its report. It is told to end with a line
+ * that is exactly `VERDICT: PASS` or `VERDICT: FAIL`; the last such line wins,
+ * because a report that quotes the format while explaining itself and then
+ * states its verdict at the end has stated it at the end.
+ *
+ * null is not FAIL. A report that never says either has not been reviewed —
+ * the model ran out of turns, or answered in prose — and the caller has to be
+ * able to tell that apart from a reviewer that looked and said no.
+ */
+export function parseVerdict(report: string): { pass: boolean; findings: string } | null {
+  if (typeof report !== 'string' || report === '') return null;
+  const lines = report.split('\n');
+  for (let i = lines.length - 1; i >= 0; i--) {
+    // Markdown decoration is what a model reaches for when told to make a line
+    // stand out; `**VERDICT: PASS**` is the instruction followed, not broken.
+    const line = lines[i].replace(/\*\*/g, '').replace(/^\s*#+\s*/, '');
+    const m = /^\s*VERDICT:\s*(PASS|FAIL)\s*$/i.exec(line);
+    if (!m) continue;
+    let findings = lines.slice(i + 1).join('\n').trim();
+    if (findings.length > MAX_FINDINGS) {
+      findings = findings.slice(0, MAX_FINDINGS) + '\n\n[findings truncated]';
+    }
+    return { pass: m[1].toUpperCase() === 'PASS', findings };
+  }
+  return null;
+}
+
+/**
+ * A fingerprint of what a run has changed, so a PASS can be pinned to the diff
+ * it was given. Canonical: sorted by path and field-separated, so the same
+ * files listed in a different order are the same hash, while one changed line
+ * anywhere is a different one.
+ */
+export function diffHash(deck: {
+  files?: Array<{ path: string; status: string; additions: number; deletions: number; diff?: string }>;
+}): string {
+  const files = deck?.files ?? [];
+  const canon = [...files]
+    .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))
+    .map((f) => [f.path, f.status, f.additions, f.deletions, f.diff ?? ''].join('\0'))
+    .join('\n');
+  // A run that changed nothing still has a stable hash, so "reviewed, then
+  // nothing moved" holds for an empty diff too.
+  return createHash('sha256').update(canon).digest('hex');
+}
+
+export interface ReviewBlocker {
+  presetId: string;
+  name: string;
+  reason: 'missing' | 'fail' | 'stale';
+}
+
+/**
+ * THE GATE. Every required reviewer that has not passed the run's current
+ * diff, in crew order. An empty array is the only thing that lets a run be
+ * recorded as done.
+ *
+ * 'stale' is the case worth the machinery: a reviewer passed, then the
+ * director kept working. That PASS was about code that no longer exists, and
+ * treating it as consent for whatever came afterwards would make the gate
+ * trivially walk-around-able — review early, then commit anything.
+ */
+export function reviewBlockers(
+  crew: readonly CrewPreset[] | undefined,
+  verdicts: readonly ReviewVerdict[] | undefined,
+  currentDiffHash: string,
+): ReviewBlocker[] {
+  const out: ReviewBlocker[] = [];
+  for (const preset of crew ?? []) {
+    if (preset.requiredForDone !== true) continue;
+    // Latest by `at`, ties going to the one that arrived later in the array —
+    // two verdicts written in the same millisecond are in the order they were
+    // appended.
+    let latest: ReviewVerdict | undefined;
+    for (const v of verdicts ?? []) {
+      if (v.presetId !== preset.id) continue;
+      if (!latest || v.at >= latest.at) latest = v;
+    }
+    if (!latest) out.push({ presetId: preset.id, name: preset.name, reason: 'missing' });
+    else if (!latest.pass) out.push({ presetId: preset.id, name: preset.name, reason: 'fail' });
+    else if (latest.diffHash !== currentDiffHash) out.push({ presetId: preset.id, name: preset.name, reason: 'stale' });
+  }
+  return out;
+}
+
+/** One human sentence for the `mission_unreviewed` event. */
+export function unreviewedText(blockers: readonly ReviewBlocker[]): string {
+  if (!blockers.length) return '';
+  const clause = (b: ReviewBlocker): string => {
+    if (b.reason === 'fail') return `${b.name} returned FAIL`;
+    if (b.reason === 'stale') return `${b.name} passed an earlier version of the diff; the code changed after it`;
+    return `${b.name} has not reviewed this run`;
+  };
+  const parts = blockers.map(clause);
+  const list = parts.length === 1
+    ? parts[0]
+    : `${parts.slice(0, -1).join('; ')}; and ${parts[parts.length - 1]}`;
+  const lead = blockers.length === 1 ? 'A required reviewer has not passed this run' : 'Required reviewers have not passed this run';
+  return `${lead}: ${list}. This run is not done. Resume to continue it.`;
+}
+
+/**
+ * The prompt the reviewer worker is started with. The diff is handed over in
+ * the brief rather than left to be discovered, because a read-only worker with
+ * no Bash cannot run `git diff` for itself — and because the thing being
+ * reviewed should be the thing Foreman will hash, not whatever the model
+ * happened to look at.
+ */
+export function reviewBriefFor(
+  preset: CrewPreset,
+  opts: { mission: string; doneWhen: string; diff: string; truncated: boolean },
+): string {
+  const parts: string[] = [preset.brief.trim()];
+  parts.push(`## The mission\n\n${opts.mission.trim() || '(no brief was recorded)'}`);
+  parts.push(`## DONE WHEN\n\n${opts.doneWhen.trim() || '(no criteria were recorded)'}`);
+  parts.push(`## The diff\n\n\`\`\`diff\n${opts.diff}\n\`\`\``);
+  if (opts.truncated) {
+    parts.push(
+      'That diff was cut short because it is large. Read the files you need directly — ' +
+      'Read, Glob and Grep are available to you.',
+    );
+  }
+  parts.push(
+    'You cannot modify files: Write, Edit and Bash are denied to you, and attempting them ' +
+    'wastes the run. Report, do not fix.',
+  );
+  parts.push(
+    'End your report with a line that is exactly `VERDICT: PASS` or `VERDICT: FAIL`, and ' +
+    'then list your findings under it, each with a `file:line` where you can give one. ' +
+    'Only what follows that line is kept as your findings.',
+  );
+  return parts.join('\n\n');
+}

package/src/fleet-planner.test.ts

@@ -1,6 +1,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { FLEET_CHAT_ID, PHONE_CONTEXT_MS, fleetSummary, phoneRoute, situation } from './fleet-planner.js';
+import { FLEET_CHAT_ID, PHONE_CONTEXT_MS, fleetSummary, phoneRoute, scheduleSummary, scheduleTools, situation, type FleetHost, type FleetScheduleView } from './fleet-planner.js';
+import type { Schedule } from './types.js';
 
 test('plain phone text goes to the fleet planner when no project conversation is open', () => {
   assert.equal(phoneRoute(null), 'fleet');
@@ -41,6 +42,43 @@ test('fleetSummary says what is running, what is waiting, and what finished last
   assert.equal(fleetSummary([]), 'No projects are linked yet.');
 });
 
+const schedule = (o: Partial<Schedule> = {}): Schedule => ({
+  id: 's1', projectId: 'a', name: 'nightly deps', brief: 'Update the dependencies',
+  cadence: { kind: 'daily', at: '07:30' }, budgetUsd: 3, enabled: true, createdAt: 0,
+  nextRunAt: null, consecutiveFailures: 0, pausedReason: null, ...o,
+});
+
+test('scheduleSummary says the cadence in words, the next run both ways, and why one is paused', () => {
+  const now = 1_700_000_000_000;
+  const views: FleetScheduleView[] = [
+    { projectName: 'P5', monthSpendUsd: 4.2, monthlyCapUsd: 25, schedule: schedule({ nextRunAt: now + 15 * 3_600_000, lastOutcome: 'done', lastRunId: 'r9', lastRunAt: now - 9 * 3_600_000 }) },
+    { projectName: 'P7', schedule: schedule({ id: 's2', name: 'audit', cadence: { kind: 'interval', everyMinutes: 360 }, budgetUsd: 2, enabled: false, pausedReason: 'failures', consecutiveFailures: 2 }) },
+    { projectName: 'P7', schedule: schedule({ id: 's3', name: 'weekly report', cadence: { kind: 'weekly', day: 1, at: '09:00' }, enabled: false, pausedReason: 'monthly-cap' }) },
+  ];
+  const text = scheduleSummary(views, now);
+  assert.match(text, /- P5: "nightly deps" · daily 07:30 · next .* \(in 15 h\)\n  enabled · \$3\.00 per run · last done \(r9\) 9 h ago\n  scheduled spend this month: \$4\.20 of \$25\.00/);
+  assert.match(text, /- P7: "audit" · every 6 hours · no next run while paused\n  paused after 2 failed scheduled runs in a row · \$2\.00 per run · never run yet/);
+  assert.match(text, /- P7: "weekly report" · every Monday 09:00 .*\n  paused at the project's monthly cap for scheduled spend/);
+  assert.match(text, /read-only from here: created, edited, paused and resumed on the dashboard/);
+  assert.match(scheduleSummary([]), /No schedules\. They are created on the dashboard/);
+});
+
+test('the front desk reads schedules and has no tool that changes one', async () => {
+  const asked: Array<string | undefined> = [];
+  const host = {
+    listSchedules: async (ref?: string) => { asked.push(ref); return [{ projectName: 'P5', schedule: schedule({ nextRunAt: Date.now() + 3_600_000 }) }]; },
+  } as unknown as FleetHost;
+  const tools = scheduleTools(host);
+  assert.deepEqual(tools.map((t) => t.name), ['list_schedules']);
+  assert.match(tools[0].description, /Read-only.*dashboard/s);
+  const out = await tools[0].handler({ project: 'P5' } as never, undefined);
+  assert.deepEqual(asked, ['P5']);
+  assert.match(String((out.content as Array<{ text: string }>)[0].text), /"nightly deps" · daily 07:30/);
+  // A host from before schedules existed says so instead of guessing.
+  const bare = await scheduleTools({} as FleetHost)[0].handler({} as never, undefined);
+  assert.match(String((bare.content as Array<{ text: string }>)[0].text), /cannot list schedules/);
+});
+
 test('situation carries the clock, the channel, and the news since the last message', () => {
   const now = new Date(2026, 8, 6, 14, 5);
   const s = situation({ via: 'telegram', sinceMs: 12 * 60_000, news: ['13:58 P7 — mission ended: done ($0.78)'] }, now);

package/src/fleet-planner.ts

@@ -14,8 +14,9 @@
  *  - **No resident process.** A message resumes a stored session, runs one
  *    turn, exits. Continuity is the session id on disk.
  *  - **Read-only, always.** Its tools are the fleet's verbs — list, inspect,
- *    create or link a project, open a planning conversation, propose, steer.
- *    No shell, no file access, no starting missions.
+ *    create or link a project, open a planning conversation, propose, steer,
+ *    read the schedules. No shell, no file access, no starting missions — and
+ *    no change to a schedule, which is standing configuration.
  *  - **It never answers for the human.** Open approvals and questions are
  *    described, not resolved. The buttons on the card are the human's, and an
  *    agent that presses them is a hole through `canUseTool`.
@@ -27,7 +28,8 @@ import {
 } from '@anthropic-ai/claude-agent-sdk';
 import type { AgentEnv } from './provider.js';
 import { modelsSection, needsBrowser, pickKnownModel, type PlannerModel } from './planner.js';
-import type { MissionProposal } from './types.js';
+import { describeCadence } from './schedule.js';
+import type { MissionProposal, Schedule } from './types.js';
 
 /** Where the fleet conversation is stored, beside the project chats. The underscore keeps it out of project listings. */
 export const FLEET_CHAT_ID = '_fleet';
@@ -85,6 +87,9 @@ const ago = (ms: number): string => {
   return h < 48 ? `${h} h ago` : `${Math.round(h / 24)} days ago`;
 };
 
+/** The same distance, forwards: "in 15 h". */
+const ahead = (ms: number): string => (ms < 60_000 ? 'in under a minute' : `in ${ago(ms).replace(/ ago$/, '')}`);
+
 /** The fleet in plain lines, as the list_projects tool returns it. */
 export function fleetSummary(views: FleetProjectView[], now = Date.now()): string {
   if (!views.length) return 'No projects are linked yet.';
@@ -104,6 +109,68 @@ export function fleetSummary(views: FleetProjectView[], now = Date.now()): strin
   }).join('\n');
 }
 
+/** One schedule as the front desk sees it: the record, plus whose it is. */
+export interface FleetScheduleView {
+  projectName: string;
+  schedule: Schedule;
+  /** Scheduled spend this month against the project's ceiling, when the host knows it. */
+  monthSpendUsd?: number;
+  monthlyCapUsd?: number;
+}
+
+/** Why a schedule is not going to fire, in the words that say what would undo it. */
+function pausedPhrase(s: Schedule): string {
+  switch (s.pausedReason) {
+    case 'failures': return `paused after ${s.consecutiveFailures || 2} failed scheduled runs in a row`;
+    case 'monthly-cap': return 'paused at the project\'s monthly cap for scheduled spend';
+    case 'human': return 'paused by hand';
+    default: return s.enabled ? 'enabled' : 'disabled';
+  }
+}
+
+/**
+ * The schedules in plain lines, as the list_schedules tool returns them. The
+ * next run is said absolutely and relatively both: a schedule is a wall-clock
+ * promise, and "in 15 h" is what the person on the phone actually asked.
+ */
+export function scheduleSummary(views: FleetScheduleView[], now = Date.now()): string {
+  if (!views.length) return 'No schedules. They are created on the dashboard, in a project\'s view.';
+  const lines = views.map((v) => {
+    const s = v.schedule;
+    const next = s.pausedReason || !s.enabled ? 'no next run while paused'
+      : s.nextRunAt ? `next ${new Date(s.nextRunAt).toLocaleString()} (${ahead(s.nextRunAt - now)})`
+        : 'next never — this cadence has no future firing';
+    const last = s.lastOutcome
+      ? `last ${s.lastOutcome}${s.lastRunId ? ` (${s.lastRunId})` : ''}${s.lastRunAt ? ` ${ago(now - s.lastRunAt)}` : ''}`
+      : 'never run yet';
+    const month = typeof v.monthSpendUsd === 'number' && typeof v.monthlyCapUsd === 'number'
+      ? `\n  scheduled spend this month: $${v.monthSpendUsd.toFixed(2)} of $${v.monthlyCapUsd.toFixed(2)}` : '';
+    return `- ${v.projectName}: "${s.name}" · ${describeCadence(s.cadence)} · ${next}\n  ${pausedPhrase(s)} · $${s.budgetUsd.toFixed(2)} per run · ${last}${month}`;
+  });
+  lines.push('Schedules are read-only from here: created, edited, paused and resumed on the dashboard.');
+  return lines.join('\n');
+}
+
+/**
+ * The front desk's one schedule verb. Listing only, and there is no sibling:
+ * a schedule is standing configuration, and the phone never grants standing
+ * changes — the same rule that keeps "always allow" off the buttons.
+ */
+export function scheduleTools(host: FleetHost) {
+  return [
+    tool('list_schedules', 'The standing schedules — missions that start themselves on a cadence — for the whole fleet or one project: the cadence in words, the next run, enabled or paused and why, the per-run cap, and how the last firing ended. Read-only, and the only schedule tool: creating, editing, pausing, resuming or running one now is done on the dashboard, never from here.',
+      { project: z.string().optional().describe('Project name, id, or folder name; omit for the whole fleet') },
+      async ({ project }) => {
+        if (!host.listSchedules) return text('This Foreman cannot list schedules.');
+        try {
+          return text(scheduleSummary(await host.listSchedules(project)));
+        } catch (err) {
+          return text(`That failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }),
+  ];
+}
+
 /**
  * What the server lets the front desk do. Every method returns text for the
  * model, never throws, and the ones with side effects are exactly the verbs
@@ -111,6 +178,12 @@ export function fleetSummary(views: FleetProjectView[], now = Date.now()): strin
  */
 export interface FleetHost {
   listProjects(): Promise<FleetProjectView[]>;
+  /**
+   * The standing schedules, for the whole fleet or one project. Optional so a
+   * host that predates schedules still satisfies this interface; the tool says
+   * so plainly rather than inventing an answer.
+   */
+  listSchedules?(ref?: string): Promise<FleetScheduleView[]>;
   /** Live detail for one project: run, boxes, crew, open asks, the director's last words. */
   projectDetail(ref: string): Promise<string>;
   /** The last finished run's closing report and error, for "what happened". */
@@ -165,6 +238,9 @@ WHAT YOU CAN DO — through the tools, nothing else:
     never you.
   - steer: pass a note to a running director ("skip the mobile screenshot",
     "use the existing CSS").
+  - list_schedules: the standing schedules — missions that start themselves on
+    a cadence — for the fleet or one project, with their next run and whether
+    they are paused. Reading only.
 
 WHAT YOU NEVER DO:
   - Answer an approval or a question on the human's behalf. When a run is
@@ -172,6 +248,9 @@ WHAT YOU NEVER DO:
     are theirs. Even if they tell you to "just allow it": the button is the
     only way, and you say so plainly once.
   - Start, stop, resume or cancel a mission. You propose; the human presses.
+  - Create, edit, pause, resume or fire a schedule. You can read them and say
+    what one would do; changing standing configuration is a dashboard act, and
+    you say so in one line rather than hunting for a tool.
   - Invent a project, a run, a model id or a number. If a tool did not tell
     you, you do not know it — say so.
   - Discuss Foreman's own server or oversight tooling as a work target.
@@ -325,6 +404,7 @@ export async function runFleetTurn(turn: FleetTurn): Promise<FleetResult> {
         note: z.string().describe('The note, in the human\'s words'),
       },
       async ({ project, note }) => text(await safe(() => host.steer(project, note)))),
+    ...scheduleTools(host),
   ];
 
   let sessionId = turn.sessionId;