@arjunkhera/atlas 0.4.19 → 0.4.21

package/door/lib/signed-act.mjs

@@ -0,0 +1,332 @@
+// The signed act: the owner's one act that an agent cannot make (roadmap R72,
+// tracker item 0c68a105; design docs/design-docs/signed-act/).
+//
+// Agents work under the owner's own GitHub login, so GitHub cannot tell his
+// act from theirs. The signed act is an SSH signature made with a security
+// key: a hardware key, or a Secure Enclave key that needs Touch ID. The
+// signature carries the "user present" flag of the key, so a valid one proves
+// a touch. This file holds the parts that need no GitHub:
+//
+//   parseSigners(text)            the public keys of atlas/owner-signers
+//   payloadText(acts, signedAt)   the exact text that one touch signs
+//   parseBlocks(text)             the signed blocks in a comment or a file
+//   verifyBlock(block, signers)   the acts of one block, or the reason it fails
+//   findAct(verified, want)       the first verified act that names `want`
+//
+// The verifier reads the SSH signature format (OpenSSH PROTOCOL.sshsig) and
+// the security key form (PROTOCOL.u2f) with node:crypto alone. It runs no
+// program, so the gate job needs nothing but Node.
+//
+// Rules that hold everywhere here:
+// 1. Only a security key counts: sk-ssh-ed25519 or sk-ecdsa-sha2-nistp256.
+//    A plain key can sign with no touch, so it is refused.
+// 2. A signature counts only with the "user present" flag. A key line with
+//    `verify-required` also needs the "user verified" flag.
+// 3. The key must be one of the signers that the caller read from the base.
+// 4. It fails closed: any field that does not read is a refusal.
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+
+export const NAMESPACE = 'atlas-signed-act';
+export const FORMAT = 'atlas signed act 1';
+export const SIGNERS_FILE = 'atlas/owner-signers';
+export const BEGIN = '-----BEGIN ATLAS SIGNED ACT-----';
+export const END = '-----END ATLAS SIGNED ACT-----';
+const SIG_BEGIN = '-----BEGIN SSH SIGNATURE-----';
+const SIG_END = '-----END SSH SIGNATURE-----';
+export const MARKER = '<!-- atlas:signed-act -->';
+// One touch signs at most this many acts, and a text holds at most this many blocks.
+export const MAX_ACTS = 50;
+export const MAX_BLOCKS = 20;
+const MAX_TEXT = 256 * 1024;
+
+// The two security key types. The names are joined from pieces, so the
+// package holds no text that reads as an email address (test/package D3).
+const AT_OPENSSH = (name) => [name, 'openssh.com'].join('@');
+export const ED25519_SK = AT_OPENSSH('sk-ssh-ed25519');
+export const ECDSA_SK = AT_OPENSSH('sk-ecdsa-sha2-nistp256');
+export const KEY_TYPES = Object.freeze([ED25519_SK, ECDSA_SK]);
+const FLAG_USER_PRESENT = 0x01;
+const FLAG_USER_VERIFIED = 0x04;
+const FLAG_EXTENSIONS = 0x80;
+
+export class SignedActError extends Error {}
+
+// ------------------------------------------------------------------ the acts
+
+const REPO = '[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+';
+const SHA = '[0-9a-f]{40}';
+const ID = '[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}';
+const HASH = '[0-9a-f]{64}';
+const NUMBER = '[1-9][0-9]{0,8}';
+// A branch name: plain characters only, so a line never holds a space.
+const BRANCH = '[A-Za-z0-9._/-]{1,100}';
+export const BRANCH_FORM = new RegExp(`^${BRANCH}$`);
+
+// Each kind of act, its fields, and the exact form of its line. The order of
+// the fields is the order of the words after the kind. A check name can hold
+// spaces, so it is the last field of a waiver and takes the rest of the line.
+export const ACTS = Object.freeze({
+  // A pull request head that the gate sent to the owner (done line 4). It
+  // names the base branch and the merge base too, so a change of the base
+  // after the touch does not carry the act onto a diff the owner never saw
+  // (security review S1, 26 October 2026).
+  merge: { fields: ['repo', 'pr', 'base', 'merge_base', 'head'], form: `(${REPO}) (${NUMBER}) (${BRANCH}) (${SHA}) (${SHA})` },
+  // The end of a brake before its time (R13 line 6). The commit is the one
+  // that set the brake, so one clear never ends a later brake.
+  'brake-clear': { fields: ['repo', 'commit'], form: `(${REPO}) (${SHA})` },
+  // A ready mark for the runner (R25 line 3). It holds no nonce: R25 must
+  // say what stops a replay when an item is reopened, before its reader ships.
+  ready: { fields: ['repo', 'item'], form: `(${REPO}) (${ID})` },
+  // An owner lock: the item and the fingerprint of its card (R27 line 2).
+  lock: { fields: ['item', 'card'], form: `(${ID}) (${HASH})` },
+  // A decision: the item and the fingerprint of the owner's words.
+  decision: { fields: ['item', 'words'], form: `(${ID}) (${HASH})` },
+  // A waiver of one red check on one pull request head (R17 line 6).
+  waiver: { fields: ['repo', 'pr', 'head', 'decision', 'check'], form: `(${REPO}) (${NUMBER}) (${SHA}) (${ID}) ([^\\s].{0,99})` },
+});
+
+// The fingerprint that a lock or a decision act names: sha256 of the text,
+// with line ends made plain.
+export const fingerprint = (text) => createHash('sha256').update(String(text).replace(/\r\n?/g, '\n')).digest('hex');
+
+// One act line from its fields, checked against its form.
+export function actLine(act) {
+  const spec = ACTS[act?.kind];
+  if (!spec) throw new SignedActError(`there is no act "${act?.kind}". Use ${Object.keys(ACTS).join(', ')}.`);
+  const line = `act ${act.kind} ${spec.fields.map((field) => String(act[field] ?? '')).join(' ')}`;
+  if (!new RegExp(`^act ${act.kind} ${spec.form}$`).test(line)) throw new SignedActError(`the ${act.kind} act does not read: ${line.slice(0, 200)}`);
+  return line;
+}
+
+// The exact text that one touch signs. It ends with one line end.
+export function payloadText(acts, signedAt) {
+  if (!Array.isArray(acts) || !acts.length) throw new SignedActError('a signed act names at least one act.');
+  if (acts.length > MAX_ACTS) throw new SignedActError(`one touch signs at most ${MAX_ACTS} acts.`);
+  const at = new Date(signedAt);
+  if (Number.isNaN(at.getTime())) throw new SignedActError('the time of the signature does not read.');
+  return `${[FORMAT, `signed ${at.toISOString()}`, ...acts.map(actLine)].join('\n')}\n`;
+}
+
+// The acts of a payload text, or a refusal. Every line must read.
+export function parsePayload(text) {
+  const lines = String(text).split('\n');
+  if (lines.at(-1) === '') lines.pop();
+  if (lines[0] !== FORMAT) throw new SignedActError(`the first line is not "${FORMAT}".`);
+  const at = /^signed (\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z)$/.exec(lines[1] ?? '');
+  if (!at || Number.isNaN(Date.parse(at[1]))) throw new SignedActError('the second line is not "signed <time>".');
+  const rows = lines.slice(2);
+  if (!rows.length) throw new SignedActError('the block names no act.');
+  if (rows.length > MAX_ACTS) throw new SignedActError(`the block names more than ${MAX_ACTS} acts.`);
+  const acts = rows.map((line) => {
+    const kind = /^act ([a-z-]+) /.exec(line)?.[1];
+    const spec = kind && Object.hasOwn(ACTS, kind) ? ACTS[kind] : null;
+    const hit = spec && new RegExp(`^act ${kind} ${spec.form}$`).exec(line);
+    if (!hit) throw new SignedActError(`an act line does not read: ${line.slice(0, 120)}`);
+    const act = { kind };
+    spec.fields.forEach((field, index) => { act[field] = field === 'pr' ? Number(hit[index + 1]) : hit[index + 1]; });
+    return act;
+  });
+  return { signed_at: at[1], acts };
+}
+
+// ------------------------------------------------------------------ the SSH wire form
+
+function reader(buffer) {
+  let at = 0;
+  const need = (n) => { if (at + n > buffer.length) throw new SignedActError('the signature is cut short.'); };
+  return {
+    u8() { need(1); return buffer[at++]; },
+    u32() { need(4); const value = buffer.readUInt32BE(at); at += 4; return value; },
+    raw(n) { need(n); const out = buffer.subarray(at, at + n); at += n; return out; },
+    string() { const n = this.u32(); return this.raw(n); },
+    text() { return this.string().toString('latin1'); },
+    done() { return at === buffer.length; },
+  };
+}
+
+const sshString = (value) => {
+  const body = Buffer.isBuffer(value) ? value : Buffer.from(String(value), 'latin1');
+  const size = Buffer.alloc(4);
+  size.writeUInt32BE(body.length);
+  return Buffer.concat([size, body]);
+};
+
+// The node:crypto key of one security key blob, and its application.
+function keyOf(blob) {
+  const read = reader(blob);
+  const type = read.text();
+  if (type === ED25519_SK) {
+    const raw = read.string();
+    const application = read.text();
+    if (raw.length !== 32 || !read.done()) throw new SignedActError('the ed25519 key does not read.');
+    return { type, application, key: createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: raw.toString('base64url') }, format: 'jwk' }) };
+  }
+  if (type === ECDSA_SK) {
+    const curve = read.text();
+    const point = read.string();
+    const application = read.text();
+    if (curve !== 'nistp256' || point.length !== 65 || point[0] !== 4 || !read.done()) throw new SignedActError('the ecdsa key does not read.');
+    return { type, application, key: createPublicKey({ key: { kty: 'EC', crv: 'P-256', x: point.subarray(1, 33).toString('base64url'), y: point.subarray(33).toString('base64url') }, format: 'jwk' }) };
+  }
+  throw new SignedActError(`the key type ${type.slice(0, 60)} is not a security key, so it needs no touch.`);
+}
+
+export const keyFingerprint = (blob) => `SHA256:${createHash('sha256').update(blob).digest('base64').replace(/=+$/, '')}`;
+
+// The keys of an allowed-signers text: one key on each line,
+// `<name> [options] <type> <base64> [comment]`. The one option that counts is
+// `verify-required`. `no-touch-required` and a plain key are refused, with
+// the line number, and the other lines still count.
+export function parseSigners(text) {
+  const keys = [];
+  const refused = [];
+  String(text ?? '').split('\n').forEach((raw, index) => {
+    const line = raw.trim();
+    if (!line || line.startsWith('#')) return;
+    const words = line.split(/\s+/);
+    const name = words.shift();
+    let options = '';
+    if (!KEY_TYPES.includes(words[0]) && !/^(ssh-|ecdsa-|sk-)/.test(words[0] ?? '')) options = words.shift() ?? '';
+    const [type, base64] = words;
+    const opts = options ? options.split(',') : [];
+    const why = (reason) => refused.push({ line: index + 1, why: reason });
+    if (opts.some((opt) => opt === 'no-touch-required')) return why('no-touch-required: a signature with no touch proves nothing');
+    const unknown = opts.filter((opt) => opt !== 'verify-required');
+    if (unknown.length) return why(`an option that the gate does not read: ${unknown[0].slice(0, 40)}`);
+    if (!KEY_TYPES.includes(type)) return why(`${String(type).slice(0, 40)} is not a security key`);
+    let blob;
+    try { blob = Buffer.from(base64 ?? '', 'base64'); keyOf(blob); } catch (error) { return why(error.message); }
+    if (blob.toString('base64').replace(/=+$/, '') !== String(base64).replace(/=+$/, '')) return why('the key is not plain base64');
+    keys.push({ name, type, blob, verify_required: opts.includes('verify-required'), fingerprint: keyFingerprint(blob) });
+  });
+  return { keys, refused };
+}
+
+// The parts of an armored SSH signature.
+function sshsigParts(armored) {
+  const body = String(armored).replace(SIG_BEGIN, '').replace(SIG_END, '').replace(/\s+/g, '');
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(body)) throw new SignedActError('the SSH signature is not base64.');
+  const read = reader(Buffer.from(body, 'base64'));
+  if (read.raw(6).toString('latin1') !== 'SSHSIG') throw new SignedActError('the signature does not start with SSHSIG.');
+  if (read.u32() !== 1) throw new SignedActError('the signature is not version 1.');
+  const key = read.string();
+  const namespace = read.text();
+  const reserved = read.string();
+  const hash = read.text();
+  const signature = read.string();
+  if (!read.done()) throw new SignedActError('the signature has data after its end.');
+  return { key, namespace, reserved, hash, signature };
+}
+
+// Verify one SSH signature of `message` against the signers. The answer names
+// the key and the flags, or throws the reason.
+export function verifySignature(message, armored, signers, namespace = NAMESPACE) {
+  const parts = sshsigParts(armored);
+  if (parts.namespace !== namespace) throw new SignedActError(`the signature is for "${parts.namespace.slice(0, 40)}", not "${namespace}".`);
+  if (parts.reserved.length) throw new SignedActError('the reserved field of the signature is not empty.');
+  if (!['sha256', 'sha512'].includes(parts.hash)) throw new SignedActError(`the hash ${parts.hash.slice(0, 20)} is not sha256 or sha512.`);
+  const signer = signers.find((each) => each.blob.equals(parts.key));
+  if (!signer) throw new SignedActError(`the key ${keyFingerprint(parts.key)} is not in ${SIGNERS_FILE} on the base.`);
+  const { type, application, key } = keyOf(signer.blob);
+  // The text that the key signed: PROTOCOL.sshsig, then PROTOCOL.u2f.
+  const signed = Buffer.concat([Buffer.from('SSHSIG', 'latin1'), sshString(namespace), sshString(''), sshString(parts.hash), sshString(createHash(parts.hash).update(message).digest())]);
+  const read = reader(parts.signature);
+  const sigType = read.text();
+  if (sigType !== type) throw new SignedActError(`the signature type ${sigType.slice(0, 60)} does not match the key.`);
+  const inner = read.string();
+  const flags = read.u8();
+  const counter = read.u32();
+  if (!read.done()) throw new SignedActError('the security key signature has data after its end.');
+  if (flags & FLAG_EXTENSIONS) throw new SignedActError('the security key signature carries extensions, which the gate does not read.');
+  const counterBytes = Buffer.alloc(4);
+  counterBytes.writeUInt32BE(counter);
+  const original = Buffer.concat([createHash('sha256').update(application).digest(), Buffer.from([flags]), counterBytes, createHash('sha256').update(signed).digest()]);
+  let good;
+  if (type === ED25519_SK) {
+    if (inner.length !== 64) throw new SignedActError('the ed25519 signature does not read.');
+    good = cryptoVerify(null, original, key, inner);
+  } else {
+    const ecdsa = reader(inner);
+    // A canonical mpint only: no needless leading zero, and never negative.
+    // Nothing relies on one signature per text; ECDSA allows two.
+    const fixed = (n) => {
+      if (!n.length || (n[0] & 0x80) || (n[0] === 0 && (n.length === 1 || !(n[1] & 0x80)))) throw new SignedActError('the ecdsa signature does not read.');
+      const bytes = n[0] === 0 ? n.subarray(1) : n;
+      if (bytes.length > 32) throw new SignedActError('the ecdsa signature does not read.');
+      return Buffer.concat([Buffer.alloc(32 - bytes.length), bytes]);
+    };
+    const r = fixed(ecdsa.string());
+    const s = fixed(ecdsa.string());
+    if (!ecdsa.done()) throw new SignedActError('the ecdsa signature does not read.');
+    good = cryptoVerify('sha256', original, { key, dsaEncoding: 'ieee-p1363' }, Buffer.concat([r, s]));
+  }
+  if (!good) throw new SignedActError('the signature does not match the text.');
+  const touched = Boolean(flags & FLAG_USER_PRESENT);
+  const verified = Boolean(flags & FLAG_USER_VERIFIED);
+  if (!touched) throw new SignedActError('the key made this signature with no touch.');
+  if (signer.verify_required && !verified) throw new SignedActError('the key line says verify-required, and the key did not verify the owner (no Touch ID or PIN).');
+  return { key: signer.fingerprint, name: signer.name, touched, verified, counter };
+}
+
+// ------------------------------------------------------------------ blocks
+
+// The block that a comment or a file carries: the marker, the payload and
+// the signature, in a fence so GitHub shows it as it is.
+export const blockText = (payload, signature) => [MARKER, '```text', BEGIN, payload.replace(/\n$/, ''), END, signature.trim(), '```', ''].join('\n');
+
+// Each signed block of a text: { payload, signature }. Line ends are made
+// plain, so a copy from a page with CR LF still reads. A text with no marker
+// holds no block. The scan is linear: each marker is found once with indexOf.
+export function parseBlocks(text) {
+  const raw = String(text ?? '');
+  if (!raw.includes(MARKER)) return [];
+  const plain = raw.slice(0, MAX_TEXT).replace(/\r\n?/g, '\n');
+  const out = [];
+  let from = 0;
+  while (out.length < MAX_BLOCKS) {
+    const begin = plain.indexOf(`${BEGIN}\n`, from);
+    if (begin < 0) break;
+    const end = plain.indexOf(`\n${END}\n`, begin);
+    if (end < 0) break;
+    const sigStart = end + END.length + 2;
+    const sigEnd = plain.indexOf(SIG_END, sigStart);
+    if (sigEnd < 0) break;
+    from = sigEnd + SIG_END.length;
+    const signature = plain.slice(sigStart, from);
+    if (!signature.startsWith(`${SIG_BEGIN}\n`) || !/^[A-Za-z0-9+/=\n]+$/.test(signature.slice(SIG_BEGIN.length + 1, -SIG_END.length))) continue;
+    out.push({ payload: `${plain.slice(begin + BEGIN.length + 1, end)}\n`, signature });
+  }
+  return out;
+}
+
+// One block, verified: { acts, signed_at, key, verified }, or { error }.
+export function verifyBlock(block, signers) {
+  try {
+    const parsed = parsePayload(block.payload);
+    const proof = verifySignature(Buffer.from(block.payload, 'utf8'), block.signature, signers);
+    return { ...parsed, ...proof };
+  } catch (error) {
+    if (error instanceof SignedActError) return { error: error.message };
+    throw error;
+  }
+}
+
+// Every block of each text, verified. `texts` is a list of strings, such as
+// the comments of a pull request.
+export function verifyTexts(texts, signers) {
+  const rows = [];
+  for (const text of texts) for (const block of parseBlocks(text)) rows.push(verifyBlock(block, signers));
+  return rows;
+}
+
+// The first verified act that matches every field of `want`, with its block.
+// Repo names match with no case, as GitHub does.
+export function findAct(verified, want) {
+  const same = (field, a, b) => (field === 'repo' ? String(a).toLowerCase() === String(b).toLowerCase() : String(a) === String(b));
+  for (const row of verified) {
+    if (row.error) continue;
+    const act = row.acts.find((each) => Object.entries(want).every(([field, value]) => same(field, each[field], value)));
+    if (act) return { act, signed_at: row.signed_at, key: row.key, verified: row.verified };
+  }
+  return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.19",
+  "version": "0.4.21",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/skills/lead/SKILL.md

@@ -112,6 +112,7 @@ set. A test keeps the two lists equal.
 | `atlas jobs` | The `atlas-jobs` workflow calls `check`, then `file`, once a day. A session calls it only to see what the watcher would file: `check`, then `file --dry-run` |
 | `atlas upkeep` | `check` before you ask for a merge. It reads the docs index, dead doc links, the code each doc names, and the tracker item of a pull request. The daily upkeep run calls it on the main branch. `replay` before the doc-sources rule changes how it gates |
 | `atlas gate` | `apply` once per repo, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge, `check` in the `atlas-gate` workflow, `replay` before a change to the owner-only list. `audit` in the daily upkeep run, and with `--commit` in the push job of a repo that has one |
+| `atlas approve` | Never from a session. Only the owner runs it, on his Mac, with his key's touch. When the gate says "owner" for a pull request, ask him once for the signed act: name each pull request, its class and its cause. Put the owner pull requests of one day in one ask, so one touch signs them. `act`, `verify` and `key-check` work the same way |
 | `atlas judge` | In the fresh-agent test only, as the `atlas:fresh-agent-test` skill says. `seal` after the pick, `brief` to read a sealed ask, `run` for each sealed task, `check` after the grade |
 
 A person merges every file that `atlas tooling` writes.

package/skills/upkeep/SKILL.md

@@ -21,8 +21,8 @@ Design: `docs/design-docs/upkeep-routine/` in the Atlas repo.
 
 The run never calls these verbs. They are the owner's acts.
 
-1. `item_lock`, `item_propose`, `item_split`, `item_adopt`.
-2. `decision_record`, `question_answer`, `question_ask`, `receipt_keep`.
+1. `item_lock`, `item_propose`, `item_split`.
+2. `decision_record`, `question_answer`, `question_ask`.
 3. `item_drop`, `item_park`, `item_resume`, `item_reopen`.
 4. `product_add`, `product_edit`, `repo_add`, `repo_edit`, `setup`.
 
@@ -62,9 +62,8 @@ Pass the product to every read. Show no other product.
    that a tracker item links, or that names an item id. Comment the item id
    and its state, and close the issue as completed. Owner rule, 21 October
    2026: an issue is not kept open once its item exists.
-4. **Read only, report only.** Call `sweep_check` and `needs_me` for the
-   product. Put any mismatch, and any question older than seven days, in the
-   report. Do not act on them.
+4. **Read only, report only.** Call `needs_me` for the product. Put any
+   question older than seven days in the report. Do not act on it.
 5. **Red merges.** When `atlas.yaml` lists `required_checks`, run
    `atlas gate` with the verb `audit`, `--repo` and `--since` set to
    yesterday's date. Put each merge it names in the report, under "Left for

package/work/lib/activity.mjs

@@ -17,7 +17,7 @@ export const ACTIVITY_READ_VERBS = Object.freeze(['item_activity']);
 export const VOICES = Object.freeze(['agent', 'owner']);
 // The item verbs whose writes carry a diff (step 9). item_propose writes a
 // "created" diff when it makes the item.
-export const LOG_VERBS = Object.freeze(['item_lock', 'item_split', 'item_park', 'item_resume', 'item_drop', 'item_edit', 'item_stage', 'item_link', 'item_block', 'item_unblock', 'item_done', 'item_reopen', 'item_adopt']);
+export const LOG_VERBS = Object.freeze(['item_lock', 'item_split', 'item_park', 'item_resume', 'item_drop', 'item_edit', 'item_stage', 'item_link', 'item_block', 'item_unblock', 'item_done', 'item_reopen']);
 export const ENTRY_VERBS = Object.freeze(['item_propose', ...LOG_VERBS]);
 const MAX_COMMENT = 4000;
 const PREVIEW = 300;
@@ -207,9 +207,14 @@ export function createActivityVerbs(core) {
         if (row.fields?.item !== item.id) continue;
         rows.push({ at: row.fields.marked_at, kind: 'mark', mark_id: row.id, mark_kind: row.fields.kind, verdict: row.fields.verdict ?? null });
       }
-      const pieces = await Promise.all((Array.isArray(fields.split_children) ? fields.split_children : []).map((id) => client.getEntity(id).catch(() => null)));
+      // A piece the feed cannot read keeps its row, with the reason, so a
+      // split never hides a piece (roadmap R70 line 1).
+      const pieces = await Promise.all((Array.isArray(fields.split_children) ? fields.split_children : []).map((id) => client.getEntity(id).catch((error) => ({ unreadable: id, reason: oneLine(String(error?.message ?? error), 200) }))));
       for (const piece of pieces) {
-        if (!piece) continue;
+        if (!piece || piece.unreadable) {
+          rows.push({ at: null, kind: 'piece', item: piece?.unreadable ?? null, title: null, split_order: null, unreadable: true, reason: piece?.reason ?? 'the graph returned nothing' });
+          continue;
+        }
         // The piece's date is the split that made it, not its last write.
         const made = Object.values(piece.fields?.atlas_receipts ?? {}).filter((receipt) => receipt?.verb === 'item_split').map((receipt) => receipt.at).sort()[0] ?? piece.created_at ?? null;
         rows.push({ at: made, kind: 'piece', item: piece.id, title: oneLine(piece.title ?? '', 200), split_order: piece.fields?.split_order ?? null });
@@ -239,7 +244,7 @@ function lineOf(row) {
     case 'question': return oneLine(`${when}  question (${row.status})  ${row.text}`);
     case 'decision': return oneLine(`${when}  decision (${row.decision_kind})  "${row.text}"`);
     case 'mark': return oneLine(`${when}  mark  ${row.mark_kind}${row.verdict ? `: ${row.verdict}` : ''}`);
-    case 'piece': return oneLine(`${when}  piece  ${row.title} · ${row.item}`);
+    case 'piece': return row.unreadable ? oneLine(`${when}  piece  ${row.item} could not be read: ${row.reason}`) : oneLine(`${when}  piece  ${row.title} · ${row.item}`);
     case 'link': return oneLine(`${when}  link (${row.link_kind})  ${row.url}`);
     default: return oneLine(`${when}  ${row.kind}`);
   }

package/work/lib/delivery.mjs

@@ -809,7 +809,11 @@ export function createDeliveryVerbs(core) {
         const { last, days } = movementOf({ item, marks: own, pulls: mine, legacy, readAt });
         const state = fields.lifecycle === 'done' ? 'delivered' : (fields.delivery_state === 'reopened' ? 'reopened' : fields.lifecycle);
 
-        const inScope = fields.lifecycle === 'active' || fields.lifecycle === 'done';
+        // Only active work feeds "merged, not marked". A done item's other
+        // pull requests (its design, its lock) are history, not a gap; a
+        // reopened item is active again, so its pull requests come back
+        // (roadmap R70 line 5).
+        const inScope = fields.lifecycle === 'active';
         for (const pull of (inScope ? open : [])) notMarked.push({ item: item.id, item_title: oneLine(item.title, 120), product: fields.product, pr: pull.url, title: pull.title, merged_at: pull.merged_at, days: daysBetween(pull.merged_at, readAt), matched_by: pull.matched_by, note: 'merged, not marked' });
         for (const mark of deliveries) if (!since || String(mark.fields.marked_at ?? '') >= since) delivered.push({ item: item.id, item_title: oneLine(item.title, 120), product: fields.product, mark_id: mark.id, verdict: correctedBy.has(mark.id) ? 'corrected' : (mark.fields.verdict ?? 'delivered'), ...(correctedBy.has(mark.id) ? { corrected_by: correctedBy.get(mark.id) } : {}), delivered_at: mark.fields.marked_at, prs: (mark.fields.prs ?? []).map((pull) => pull.url), deployed_commit: mark.fields.deployed?.commit ?? null, gate_warnings: mark.fields.gate_warnings ?? [] });
         if (legacy && (!since || String(legacy.marked_at) >= since)) delivered.push({ item: item.id, item_title: oneLine(item.title, 120), product: fields.product, mark_id: null, verdict: 'legacy', delivered_at: legacy.marked_at, prs: [], deployed_commit: null, source: legacy.source });

package/work/lib/questions.mjs

@@ -16,7 +16,7 @@ export { COSTS, COST_MEANING, ROW_LINE_MAX, oneLine, CLEARED_LIFECYCLES, blocker
 // any other: the owner's words, dated, listing the items (design finding R7).
 export const DECISION_KINDS = Object.freeze(['decision', 'priority', 'answer', 'sweep']);
 export const QUESTION_STATUS = Object.freeze(['open', 'answered']);
-export const QUESTION_WRITE_VERBS = Object.freeze(['question_ask', 'question_answer', 'decision_record', 'receipt_keep']);
+export const QUESTION_WRITE_VERBS = Object.freeze(['question_ask', 'question_answer', 'decision_record']);
 export const QUESTION_READ_VERBS = Object.freeze(['needs_me']);
 
 // R8: the row budget. Three visible lines; everything else folds under it.
@@ -131,10 +131,9 @@ export function createQuestionVerbs(core) {
     return entity;
   }
 
-  // The sweep of slice L5 lists every active item of a product, so this cap is
-  // the sweep's real ceiling, and work/lib/sweep.mjs reads back the same
-  // number (architect review of Batch 15, finding 5). Every id is verified,
-  // so a long list costs one read each.
+  // A sweep record of slice L5 lists every active item of a product, so this
+  // cap is the sweep's real ceiling (architect review of Batch 15, finding 5).
+  // Every id is verified, so a long list costs one read each.
   async function itemsTouched(value, reg, fallback) {
     if (value === undefined) return fallback ? [fallback] : [];
     const ids = stringList(value, 'items', { max: 200 });
@@ -148,7 +147,7 @@ export function createQuestionVerbs(core) {
     const type = await typeNamed('receipt');
     const prior = (await findCreated(type, requestId))[0];
     if (prior) return prior;
-    const entity = await create(type, requestId, meta?.verb ?? 'receipt_keep', {
+    const entity = await create(type, requestId, meta?.verb ?? 'decision_record', {
       digest: meta?.digest,
       title: `Receipt · ${oneLine(view || 'answer', 80)} · ${(question ?? decision).id.slice(0, 8)}`,
       body: clean.text,
@@ -260,19 +259,6 @@ export function createQuestionVerbs(core) {
       return { verb: 'decision_record', decision_id: decision.id, version: decision.version, kind: decision.fields.kind, date: decision.fields.date, items: decision.fields.items ?? [], receipt_id: receipt?.id ?? null, redactions: receipt?.fields.redactions ?? 0, ...(prior ? { replayed_from_graph: true } : {}) };
     },
 
-    // Keep the rendered answer the owner acted on. D2: refuses with no decision to attach to.
-    async receipt_keep(args, requestId, meta) {
-      requireOwner('receipt keep');
-      const decision = await recordOfKind(args.decision_id, 'decision', 'decision_id');
-      const rendered = text(args.rendered, 'rendered', { max: MAX_RENDERED });
-      const view = text(args.view, 'view', { optional: true, max: 200 }) ?? '';
-      const type = await typeNamed('receipt');
-      const prior = await landed(type, requestId, meta);
-      if (prior) { await edge(decision, prior, 'references', requestId); return { verb: 'receipt_keep', receipt_id: prior.id, version: prior.version, decision_id: decision.id, redactions: prior.fields.redactions ?? 0, replayed_from_graph: true }; }
-      const receipt = await writeReceipt({ decision, question: null, rendered, view, requestId, meta, product: decision.fields?.product ?? '' });
-      return { verb: 'receipt_keep', receipt_id: receipt.id, version: receipt.version, decision_id: decision.id, redactions: receipt.fields.redactions ?? 0 };
-    },
-
     // D3: the "Needs me" view. Computed at question time, per product, never stored.
     async needs_me(args = {}) {
       const reg = await registry();

package/work/lib/verbs.mjs

@@ -4,9 +4,9 @@
 // Slice L3 adds the done and reopen verbs and the "In flight" view from
 // delivery.mjs, through the same door again. Slice L4 adds the code-read
 // brief, the six-part answer and the "Built, pending, possible" view from
-// capability.mjs: three read verbs that write nothing. Slice L5 adds the
-// sweep from sweep.mjs: item_adopt, which gives an existing item a product,
-// and sweep_check, which reads the sweep record against the "In flight" view.
+// capability.mjs: three read verbs that write nothing. Slice L5 added the
+// one-time sweep and its two verbs. The sweep was done, and the verbs left
+// the server on 26 October 2026 (roadmap R70 line 3).
 // Design: the Atlas M1 study, pages D1, D2, D3 and D6,
 // lock block L1, L2 and L3. Every write carries request_id and writer. The
 // server, not the caller, supplies the session. Unknown ids are refused.
@@ -19,7 +19,6 @@ import { VerbError, refuse, canonicalJson, sha256, text, oneOf, origin, url, str
 import { createQuestionVerbs, COSTS, QUESTION_WRITE_VERBS, QUESTION_READ_VERBS, oneLine, scrubSecrets } from './questions.mjs';
 import { createDeliveryVerbs, DELIVERY_WRITE_VERBS, DELIVERY_READ_VERBS } from './delivery.mjs';
 import { createCapabilityVerbs, CAPABILITY_READ_VERBS, hubOf } from './capability.mjs';
-import { createSweepVerbs, SWEEP_WRITE_VERBS, SWEEP_READ_VERBS } from './sweep.mjs';
 import { createRoundupVerbs, ROUNDUP_READ_VERBS } from './roundup.mjs';
 import { createActivityVerbs, diffOf, LOG_VERBS, ENTRY_VERBS, ACTIVITY_WRITE_VERBS, ACTIVITY_READ_VERBS } from './activity.mjs';
 import { createStepInVerbs, STEP_IN_WRITE_VERBS, STEP_IN_READ_VERBS } from './step-ins.mjs';
@@ -452,15 +451,15 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
       const reg = await registry();
       const product = await requireProduct(args.product, reg);
       const repos = await requireRepos(args.repos, reg, product.fields.registry_id);
-      if (!args.scope || typeof args.scope !== 'object' || Array.isArray(args.scope)) refuse('scope is required: { text, design_doc?, acceptance_criteria_hash? }');
+      if (!args.scope || typeof args.scope !== 'object' || Array.isArray(args.scope)) refuse('scope is required: { text, design_doc? }');
+      // A design doc once carried a hash of its criteria. The definition of
+      // done is the scope text now, and the verb keeps its own fingerprint.
+      // A new lock never takes a hash; an old record that holds one still
+      // reads (roadmap R70 line 4).
+      if (args.scope.acceptance_criteria_hash !== undefined) refuse('scope.acceptance_criteria_hash is for old records only: a new lock takes no hash. Put the definition of done in scope.text, and the verb keeps its fingerprint');
       const scope = { text: text(args.scope.text, 'scope.text') };
       if (args.scope.design_doc !== undefined) scope.design_doc = url(args.scope.design_doc, 'scope.design_doc');
-      if (args.scope.acceptance_criteria_hash !== undefined) {
-        text(args.scope.acceptance_criteria_hash, 'scope.acceptance_criteria_hash', { max: 64 });
-        if (!/^[a-f0-9]{64}$/.test(args.scope.acceptance_criteria_hash)) refuse('scope.acceptance_criteria_hash must be a 64-hex sha256');
-        scope.acceptance_criteria_hash = args.scope.acceptance_criteria_hash;
-      }
-      const scopeHash = scope.acceptance_criteria_hash ?? sha256(scope.text);
+      const scopeHash = sha256(scope.text);
       const stage = oneOf(args.stage, 'stage', STAGES, fields.lifecycle === 'active' && fields.stage ? fields.stage : 'build');
       const change = {
         lifecycle: 'active', stage, product: product.fields.registry_id, repos, tier: oneOf(args.tier, 'tier', TIERS, fields.tier ?? 'standard'),
@@ -743,16 +742,11 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
   // reopen verbs and the four views share this door, this journal, this
   // registry and this writer stamp. The delivery verbs also get the two
   // read-only readers: GitHub through the gh CLI, and one GET against the
-  // deployed app. Slice L4 adds three read verbs, which write nothing. Slice
-  // L5 adds item_adopt, the one verb that gives an existing item a product,
-  // and sweep_check, which reads the sweep record against the "In flight"
-  // view. The sweep record itself is written by decision_record with kind
-  // "sweep": slice L5 adds no second way to write a decision.
+  // deployed app. Slice L4 adds three read verbs, which write nothing.
   const core = { client, label, now, typeNamed, kindOf, registry, requireProduct, requireItem, requireOwner, patch, create, edge, landed, alreadyPatched, findCreated };
   Object.assign(verbs, createQuestionVerbs(core));
   Object.assign(verbs, createDeliveryVerbs({ ...core, ownerPresent, readGitHub, readLive }));
   Object.assign(verbs, createCapabilityVerbs({ ...core, readGitHub }));
-  Object.assign(verbs, createSweepVerbs({ ...core, requireRepos, inFlight: (args) => verbs.in_flight(args), stages: STAGES, tiers: TIERS, drivers: DRIVERS }));
   Object.assign(verbs, createRoundupVerbs({ ...core, readGitHub, inFlight: (args) => verbs.in_flight(args), needsMe: (args) => verbs.needs_me(args) }));
   const activity = createActivityVerbs(core);
   Object.assign(verbs, activity.verbs);
@@ -761,8 +755,8 @@ export function createVerbs({ client, store, writer, session, agent = 'lead', bo
   const stepIns = createStepInVerbs(core);
   Object.assign(verbs, stepIns.verbs);
 
-  const WRITE_VERBS = Object.freeze(['setup', 'product_add', 'product_edit', 'repo_add', 'repo_edit', 'item_propose', 'item_lock', 'item_split', 'item_park', 'item_resume', 'item_drop', 'item_edit', 'item_block', 'item_unblock', 'item_stage', 'item_link', ...QUESTION_WRITE_VERBS, ...DELIVERY_WRITE_VERBS, ...SWEEP_WRITE_VERBS, ...ACTIVITY_WRITE_VERBS, ...STEP_IN_WRITE_VERBS]);
-  const READ_VERBS = Object.freeze(['registry_list', ...QUESTION_READ_VERBS, ...DELIVERY_READ_VERBS, ...CAPABILITY_READ_VERBS, ...SWEEP_READ_VERBS, ...ROUNDUP_READ_VERBS, ...ACTIVITY_READ_VERBS, ...STEP_IN_READ_VERBS]);
+  const WRITE_VERBS = Object.freeze(['setup', 'product_add', 'product_edit', 'repo_add', 'repo_edit', 'item_propose', 'item_lock', 'item_split', 'item_park', 'item_resume', 'item_drop', 'item_edit', 'item_block', 'item_unblock', 'item_stage', 'item_link', ...QUESTION_WRITE_VERBS, ...DELIVERY_WRITE_VERBS, ...ACTIVITY_WRITE_VERBS, ...STEP_IN_WRITE_VERBS]);
+  const READ_VERBS = Object.freeze(['registry_list', ...QUESTION_READ_VERBS, ...DELIVERY_READ_VERBS, ...CAPABILITY_READ_VERBS, ...ROUNDUP_READ_VERBS, ...ACTIVITY_READ_VERBS, ...STEP_IN_READ_VERBS]);
 
   async function run(verb, args = {}) {
     if (!verbs[verb]) refuse(`unknown verb: ${verb}`);