@arjunkhera/atlas 0.4.61 → 0.4.62

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.61",
+  "version": "0.4.62",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/door/lib/brake.mjs

@@ -168,7 +168,14 @@ export function clearOf(root, base, trip, clears) {
 // and 3, which the gate reads from GitHub; with no GitHub read it is empty.
 // `clears` reads the owner's signed clears (line 6); a cleared trip holds
 // nothing, and the answer lists it under `cleared`.
-export function brakeState({ root, base, now = new Date(), ci = [], clears = null }) {
+//
+// Normal mode (`strict_mode` off, item bca1e8fb): a trip also ends at the first
+// first-parent commit of the base, at or after the commit that set the trip,
+// that has its check green. `green` is read from GitHub (see greenRead); with none read, no trip ends this way. A
+// live trip ends only on a later commit, because its own commit ran the check
+// that failed. The answer lists each ended trip under `ended`. Strict mode
+// (the default here) keeps every trip for its days.
+export function brakeState({ root, base, now = new Date(), ci = [], clears = null, strict = true, green = null }) {
   const sha = fullSha(root, base);
   if (!sha) throw new BrakeError(`the base "${base}" is not a commit in this repo.`);
   const text = git(root, ['show', `${sha}:atlas.yaml`], { allowFail: true });
@@ -187,9 +194,27 @@ export function brakeState({ root, base, now = new Date(), ci = [], clears = nul
   const bySha = new Map();
   for (const trip of all) if (!bySha.has(trip.sha)) bySha.set(trip.sha, clearOf(root, sha, trip, clears));
   for (const found of bySha.values()) if (found) cleared.push(found);
-  const trips = all.filter((trip) => !bySha.get(trip.sha));
+  let trips = all.filter((trip) => !bySha.get(trip.sha));
+  const ended = [];
+  if (!strict && green && trips.length) {
+    // `green` maps a commit of main to { ok, checks }: ok when at least one
+    // required check ran there and each one that ran is green, and checks as
+    // the names of the green checks. A plain set of commits means ok only.
+    const entry = (sha) => (green instanceof Map ? green.get(sha) : green.has?.(sha) ? { ok: true, checks: new Set() } : null);
+    trips = trips.filter((trip) => {
+      const at = commits.findIndex((commit) => commit.sha === trip.sha);
+      if (at < 0) return true;
+      // A trip set by a red check ends only where that check ran and is green.
+      // A live trip needs a later commit, because its own commit ran the check that failed.
+      const own = trip.check !== undefined && trip.check !== null;
+      const found = commits.slice(0, trip.cause === 'live' ? at : at + 1).find((commit) => { const one = entry(commit.sha); return own ? Boolean(one?.checks?.has(trip.check)) : Boolean(one?.ok); });
+      if (!found) return true;
+      ended.push({ sha: trip.sha, green: found.sha });
+      return false;
+    });
+  }
   const until = trips.length ? new Date(Date.parse(trips[0].time) + facts.days * 864e5).toISOString() : null;
-  return { on: trips.length > 0, days: facts.days, since: since.toISOString(), until, trips, cleared };
+  return { on: trips.length > 0, days: facts.days, since: since.toISOString(), until, trips, cleared, ended };
 }
 
 // The patch id of a diff, or null for an empty diff. --verbatim keeps every

package/door/lib/gate-check.mjs

@@ -44,6 +44,7 @@ import { parseYaml, SECRET_PATTERNS } from '../../shape/check.mjs';
 import { parseSigners, verifyTexts, findAct, SIGNERS_FILE, BRANCH_FORM } from './signed-act.mjs';
 import { brakeState, undoOf, tripText } from './brake.mjs';
 import { kindsAt, nameKinds, kindRows } from './kinds.mjs';
+import { strictAt, reviewHeads, insider } from './strict.mjs';
 import { windowOn, protectedSet, clearable, windowActs, openAt, holdsCommit, WINDOW_KEY } from './window.mjs';
 
 export const VERSION = 1;
@@ -51,7 +52,7 @@ export const GATE_CHECK = 'gate';
 export const GATE_WORKFLOW = '.github/workflows/atlas-gate.yml';
 export const TEST_CHECKS = Object.freeze(['fails-before', 'passes-after']);
 export const RESULTS = Object.freeze(['success', 'owner', 'red']);
-export const ANSWER_KEYS = Object.freeze(['gate', 'base', 'merge_base', 'head', 'result', 'class', 'rows', 'signed_act', 'brake', 'signed', 'kinds']);
+export const ANSWER_KEYS = Object.freeze(['gate', 'base', 'merge_base', 'head', 'result', 'class', 'rows', 'signed_act', 'brake', 'signed', 'kinds', 'mode', 'review', 'author']);
 export const SIGNED_ACT = "Clears with the owner's signed act: atlas approve <pr> (roadmap R72).";
 // A file over this size is not scanned for secrets, and comes to the owner.
 export const SCAN_LIMIT = 1024 * 1024;
@@ -274,12 +275,12 @@ function testRows({ root, mergeBase, head, body, redMain, rules, undo = null })
 // request, read for a signed act, and baseRef is the name of its base branch.
 // `terms` is the list of private terms, or undefined to skip that rule (the
 // replay, which has no secret).
-export function judge({ root, base, head, body = '', redMain = [], rules = null, brake = {}, now = new Date(), signed = null, terms = undefined }) {
+export function judge({ root, base, head, body = '', redMain = [], rules = null, brake = {}, now = new Date(), signed = null, terms = undefined, marks = null, author = null, fixes = true }) {
   const top = resolve(root);
   const baseSha = commitOf(top, base);
   if (!baseSha) throw new GateCheckError(`the base "${base}" is not a commit in this repo.`);
   const headSha = commitOf(top, head);
-  const answer = { gate: VERSION, base: baseSha, merge_base: null, head: headSha || String(head), result: 'red', class: null, rows: [], signed_act: null, brake: null, signed: null, kinds: null };
+  const answer = { gate: VERSION, base: baseSha, merge_base: null, head: headSha || String(head), result: 'red', class: null, rows: [], signed_act: null, brake: null, signed: null, kinds: null, mode: 'normal', review: null, author: 'outsider' };
   if (!headSha) {
     answer.rows.push({ kind: 'red', class: 'gate', cause: 'the head commit is not readable in this clone' });
     return finish(answer);
@@ -295,29 +296,89 @@ export function judge({ root, base, head, body = '', redMain = [], rules = null,
   const list = kindsAt(top, baseSha);
   const named = nameKinds(list, changes.map((change) => change.path));
   answer.kinds = { listed: list.listed, names: named.names, unlisted: list.listed ? named.unlisted : [] };
-  let undo = null;
-  if (brake !== false) {
-    const state = brakeState({ root: top, base: baseSha, now, ci: brake?.ci ?? [], clears: brake?.clears ?? null });
-    undo = undoOf(top, mergeBase, headSha, state.trips);
-    answer.brake = { on: state.on, until: state.until, days: state.days, trips: state.trips, undo: undo?.culprit ?? null, cleared: state.cleared };
-    for (const one of state.cleared) answer.rows.push({ kind: 'note', class: 'brake', cause: `the owner's signed clear ended the trip set by ${one.sha.slice(0, 7)} (key ${one.key}, ${one.signed_at})` });
-    answer.rows.push(...brakeRows(state, undo, list.listed ? named : null));
-  }
   // The rules come from the base commit, never from the merge base. An agent
   // picks the merge base when it picks where its branch starts, also a middle
   // commit of a merged pull request that weakened the list and then took the
   // change back (item d56a9c03). The diff stays merge base to head.
   const ruleRef = rules ?? baseSha;
+  // The mode comes from the same ref as the rules: the base, never the head.
+  const strict = strictAt(top, ruleRef);
+  answer.mode = strict ? 'strict' : 'normal';
+  // Normal mode is lenient (review mark, atlas-fix) only for a pull request
+  // that an insider opened: author association OWNER, MEMBER or COLLABORATOR.
+  // With no author read, the author is an outsider, and the controls of strict
+  // mode hold: owner rows stay owner, and the signed act path still works.
+  const lenient = !strict && insider(author);
+  answer.author = insider(author) ? 'insider' : 'outsider';
+  let undo = null;
+  if (brake !== false) {
+    const state = brakeState({ root: top, base: baseSha, now, ci: brake?.ci ?? [], clears: brake?.clears ?? null, strict, green: brake?.green ?? null });
+    undo = undoOf(top, mergeBase, headSha, state.trips);
+    const fixed = lenient && fixes ? fixOf(body, state.trips) : [];
+    answer.brake = { on: state.on, until: state.until, days: state.days, trips: state.trips, undo: undo?.culprit ?? null, cleared: state.cleared, ended: state.ended ?? [], fix: fixed[0]?.culprit ?? null };
+    for (const one of state.cleared) answer.rows.push({ kind: 'note', class: 'brake', cause: `the owner's signed clear ended the trip set by ${one.sha.slice(0, 7)} (key ${one.key}, ${one.signed_at})` });
+    for (const one of state.ended ?? []) answer.rows.push({ kind: 'note', class: 'brake', cause: `the trip set by ${one.sha.slice(0, 7)} ended: ${one.green.slice(0, 7)} on main has every required check green` });
+    answer.rows.push(...brakeRows(state, undo, list.listed ? named : null, { lenient, fixed }));
+  }
   for (const row of classify({ root: top, base: mergeBase, head: headSha, rules: ruleRef }).rows) answer.rows.push({ kind: 'owner', class: row.class ?? 'unlisted', path: row.path, cause: row.cause });
   answer.rows.push(...kindRows(list, named));
   answer.rows.push(...jobRows(top, ruleRef, headSha, changes));
   answer.rows.push(...secretRows(top, mergeBase, headSha, changes));
   if (terms !== undefined) answer.rows.push(...termRows(top, baseSha, headSha, changes, terms));
   answer.rows.push(...testRows({ root: top, mergeBase, head: headSha, body, redMain, rules: ruleRef, undo }));
-  if (signed) signedRows(top, baseSha, headSha, signed, answer, ruleRef, now);
+  if (lenient) reviewRows(top, baseSha, headSha, marks, answer);
+  else if (signed) signedRows(top, baseSha, headSha, signed, answer, ruleRef, now);
   return finish(answer);
 }
 
+// Normal mode (item bca1e8fb): no owner row stays. A head job named like a
+// check and a brake hold are red. Each other owner row is red with class
+// `review` until a second agent posts a review mark for this head. The mark
+// counts from an author with the association OWNER, MEMBER or COLLABORATOR.
+// It carries over a clean merge of the base, by the rule of the signed act. The
+// mark proves that a review ran. It does not stop a session that forges it.
+function reviewRows(root, baseSha, headSha, marks, answer) {
+  for (const row of answer.rows) if (row.kind === 'owner' && (row.class === 'gate-checks' || row.class === 'brake' || row.class === 'too-large')) row.kind = 'red';
+  const owner = answer.rows.filter((row) => row.kind === 'owner');
+  if (!owner.length) return;
+  const note = (cause) => answer.rows.push({ kind: 'note', class: 'review', cause });
+  const turn = (why) => { for (const row of owner) { row.cause = `${why}: ${row.class}: ${row.cause}`; row.class = 'review'; row.kind = 'red'; } };
+  let list = marks;
+  if (typeof marks === 'function') { try { list = marks(); } catch { list = null; } }
+  const heads = reviewHeads(list);
+  if (heads.includes(headSha)) {
+    for (const row of owner) row.kind = 'signed';
+    answer.review = { head: headSha };
+    note(`a review mark names this head ${headSha.slice(0, 7)}`);
+    return;
+  }
+  for (const old of heads.slice(0, CARRY_TRIES)) {
+    if (commitOf(root, old) !== old || !contains(root, old, headSha)) continue;
+    const base = (git(root, [MERGE_BASE, '--end-of-options', baseSha, old], { allowFail: true }) ?? '').trim();
+    if (!base) continue;
+    const result = carryOne(root, baseSha, headSha, answer.merge_base, { head: old, merge_base: base }, null);
+    if (!result.ok) continue;
+    for (const row of owner) row.kind = 'signed';
+    answer.review = { head: headSha, carried_from: old };
+    note(`a review mark names head ${old.slice(0, 7)}, and this head only adds ${result.merges} clean merge(s) of the base`);
+    return;
+  }
+  turn(heads.length ? 'the review mark names another head, so a new review is needed' : 'no review mark for this head, so a second agent must review it');
+}
+
+// Normal mode: a pull request whose text says `atlas-fix: <sha>` names the
+// trips of the brake at that commit: at least 7 hex, a prefix of the sha or
+// the culprit of the trip. The brake lets the pull request pass for those
+// trips only. Other trips still hold. Returns the trips that it names.
+export function fixOf(body, trips) {
+  const text = String(body ?? '').replace(/<!--[\s\S]*?-->/g, '');
+  const named = new Set();
+  for (const hit of text.matchAll(/^atlas-fix:[ \t]*([0-9a-f]{7,40})[ \t]*$/gim)) {
+    for (const trip of trips) if ([trip.sha, trip.culprit].some((sha) => sha && sha.startsWith(hit[1].toLowerCase()))) named.add(trip);
+  }
+  return [...named];
+}
+
 // Done line 4 of R72: a valid signed act for this head clears each owner row.
 // It never clears red: the pull request must be fixed first. The key file is
 // read from the base commit, so a key that the pull request adds does not count.
@@ -568,9 +629,11 @@ function offPages(root, a, b, built, pages, checks) {
 // holds as before.
 const holds = (trip, named) => !named || !trip.kinds || named.unlisted.length > 0 || trip.kinds.some((kind) => named.names.includes(kind));
 
-function brakeRows(state, undo, named = null) {
+function brakeRows(state, undo, named = null, { lenient = false, fixed = [] } = {}) {
   if (!state.on) return [];
-  const holding = state.trips.filter((trip) => holds(trip, named));
+  const holding = state.trips.filter((trip) => holds(trip, named) && !fixed.includes(trip));
+  const fixNote = fixed.length ? [{ kind: 'note', class: 'brake', cause: `the fix of the trip set by ${fixed[0].sha.slice(0, 7)} (atlas-fix in the text): ${tripText(fixed[0])}` }] : [];
+  if (lenient && !undo && fixed.length && !holding.length) return fixNote;
   if (!undo && !holding.length) {
     const kinds = [...new Set(state.trips.flatMap((trip) => trip.kinds))].join(', ');
     return [{ kind: 'note', class: 'brake', cause: `the brake is on until ${state.until.slice(0, 16).replace('T', ' ')} UTC for ${kinds}; this pull request is ${named.names.join(', ') || 'no kind'}` }];
@@ -579,6 +642,7 @@ function brakeRows(state, undo, named = null) {
   const more = holding.length > 1 ? `; ${holding.length} trips in ${state.days} days` : '';
   if (undo) return [{ kind: 'note', class: 'brake', cause: `the exact undo of ${undo.culprit.slice(0, 7)}, which tripped the brake: ${tripText(undo)}` }];
   const until = new Date(Date.parse(newest.time) + state.days * 864e5).toISOString();
+  if (lenient) return [...fixNote, { kind: 'red', class: 'brake', cause: `the brake is on: ${tripText(newest)}${more}. It ends at the first commit on main after it where its check is green. The exact undo, or a pull request whose text says atlas-fix: ${newest.sha.slice(0, 7)}, may merge` }];
   const owner = { kind: 'owner', class: 'brake', cause: `the brake is on until ${until.slice(0, 16).replace('T', ' ')} UTC: ${tripText(newest)}${more}` };
   // Done line 6: one signed clear for each trip, as a comment on its commit.
   const clear = (holding.length ? holding : [newest]).map((trip) => ({ kind: 'note', class: 'brake', cause: `to end the trip now: atlas approve act brake-clear --repo <owner/repo> --commit ${trip.sha}, then post the block as a comment on commit ${trip.sha.slice(0, 7)} and run the atlas-brake-clear workflow` }));
@@ -610,6 +674,8 @@ export function renderText(answer) {
   }
   if (answer.result === 'red') out.push(`RED: ${oneLine(answer.rows.find((row) => row.kind === 'red').cause)}. Fix it; red wins over owner.`);
   else if (answer.result === 'owner') out.push(`OWNER: ${oneLine(answer.class)}. ${answer.signed_act}`);
+  else if (answer.review?.carried_from) out.push(`SUCCESS: a review mark names head ${oneLine(answer.review.carried_from).slice(0, 7)}, and this head only merges in the base.`);
+  else if (answer.review) out.push('SUCCESS: a second agent reviewed this head.');
   else if (answer.signed?.carried_from) out.push(`SUCCESS: the owner signed head ${oneLine(answer.signed.carried_from).slice(0, 7)}, and this head only merges in the base.`);
   else if (answer.signed?.window) out.push(`SUCCESS: the owner's signing window covers this pull request until ${oneLine(answer.signed.window.ends)}.`);
   else if (answer.signed) out.push('SUCCESS: the owner signed this head.');
@@ -623,7 +689,7 @@ export function renderText(answer) {
 // job runs with --repo. `comments` gives the comment texts of the pull request
 // when it also runs with --pr, so a signed act can clear owner. Exit 0 on
 // success, 1 on owner or red, 2 on a usage error.
-export function checkCommand({ root, base, head, body: bodyFile, json = false, summary, output, repo = null, pr = null, baseRef = null }, line, read = null, comments = null) {
+export function checkCommand({ root, base, head, body: bodyFile, json = false, summary, output, repo = null, pr = null, baseRef = null }, line, read = null, comments = null, reviews = null, authorOf = null) {
   try {
     if (!base || base === true) throw Object.assign(new GateCheckError('atlas gate check needs --base <ref>.'), { usage: true });
     if (!head || head === true) throw Object.assign(new GateCheckError('atlas gate check needs --head <sha>.'), { usage: true });
@@ -638,8 +704,13 @@ export function checkCommand({ root, base, head, body: bodyFile, json = false, s
       try { texts = comments(); } catch { texts = null; }
       signed = { repo, pr: Number(pr), baseRef: baseRef && baseRef !== true ? String(baseRef) : null, texts };
     }
+    
+    // A function, so the gate reads them only in normal mode when a row needs them.
+    const marks = reviews && repo && pr ? reviews : null;
     const { terms } = termsFromEnv();
-    const answer = hideTerms(judge({ root, base, head, body, redMain, brake: Array.isArray(got) ? {} : got.brake ?? {}, signed, terms }), terms);
+    let author = null;
+    if (authorOf && repo && pr) { try { author = authorOf(); } catch { author = null; } }
+    const answer = hideTerms(judge({ root, base, head, body, redMain, brake: Array.isArray(got) ? {} : got.brake ?? {}, signed, terms, marks, author }), terms);
     const text = renderText(answer);
     if (json) process.stdout.write(`${JSON.stringify(answer, null, 2)}\n`);
     else for (const each of text) line(each);

package/door/lib/gate.mjs

@@ -25,6 +25,7 @@ import { keepFindings, gateErrors, pinCode, slug, AUDIT_JOB } from './gate-audit
 import { MARKER as SIGNED_MARKER, SIGNERS_FILE, AUDIT_CHECK, parseSigners, verifyTexts, findAct, auditCodeDiff } from './signed-act.mjs';
 import { WINDOW_LABEL } from './window.mjs';
 import { brakeFacts, windowCommits, ciTrips, BrakeError } from './brake.mjs';
+import { strictAt, insider, REVIEW_MARKER } from './strict.mjs';
 
 export const BRANCH_RULESET = 'atlas gate';
 export const TAG_RULESET = 'atlas release tags';
@@ -608,7 +609,7 @@ export function ownerUnsigned({ root, repo, pull, parent }, gh) {
   if (!/^[0-9a-f]{40}$/.test(String(head)) || !/^[0-9a-f]{40}$/.test(String(parent)) || !has(head) || !has(parent)) return 'unread';
   let texts = null;
   try { texts = [...prComments(gh, repo, pull.number), ...windowComments(gh, repo)]; } catch { texts = null; }
-  const answer = judge({ root, base: parent, head, body: String(pull.body ?? ''), now: new Date(pull.merged_at), signed: { repo, pr: Number(pull.number), baseRef: pull.base?.ref ?? null, texts } });
+  const answer = judge({ root, base: parent, head, body: String(pull.body ?? ''), now: new Date(pull.merged_at), author: pull.author_association ?? null, fixes: false, signed: { repo, pr: Number(pull.number), baseRef: pull.base?.ref ?? null, texts } });
   return answer.result === 'owner' ? 'owner' : null;
 }
 
@@ -714,6 +715,30 @@ export function prComments(gh, repo, pr) {
   return kept;
 }
 
+// The review marks of one pull request (item bca1e8fb): each comment that
+// holds the review marker, as { body, association }. GitHub states the
+// association of the author itself. At most ten pages of a hundred, newest
+// first, and at most 2 MB of text in all. The gate reads them as data only.
+// Only a comment of an insider (OWNER, MEMBER or COLLABORATOR) is kept, and it
+// is kept before the size cap, so an outsider cannot push a mark out. Each
+// mark keeps its created_at, so the release hold can drop a late mark.
+export function reviewComments(gh, repo, pr) {
+  const marks = [];
+  for (let page = 1; page <= 10; page += 1) {
+    const rows = gh('GET', `repos/${repo}/issues/${pr}/comments?per_page=100&page=${page}`) ?? [];
+    for (const row of Array.isArray(rows) ? rows : []) if (typeof row?.body === 'string' && row.body.includes(REVIEW_MARKER) && insider(row.author_association)) marks.push({ body: row.body, association: String(row.author_association), created_at: String(row.created_at ?? '') });
+    if (!Array.isArray(rows) || rows.length < 100) break;
+  }
+  const kept = [];
+  let bytes = 0;
+  for (const mark of marks.reverse()) {
+    bytes += mark.body.length;
+    if (bytes > 2 * 1024 * 1024) break;
+    kept.push(mark);
+  }
+  return kept;
+}
+
 // The comment texts of the window issues that carry the signed-act marker:
 // where `atlas approve window` posts each window act (item 4af66381). The
 // newest five issues with the label, open or closed, and three pages of
@@ -804,9 +829,13 @@ export function holdRow({ repo, root, sha }, gh, git) {
   let answer;
   try {
     const at = new Date(pull.merged_at);
-    const brake = { ci: brakeRead({ root, base: parent, now: at }, gh, repo), clears: { repo, commentsOf: (one) => commitComments(gh, repo, one) } };
+    const brake = brakeInput({ root, base: parent, now: at }, gh, repo);
+    // In normal mode the hold reads the review marks too: only a red row holds the release.
+    // A mark counts only when it came before the merge. The hold reads no atlas-fix line.
+    let marks = null;
+    if (!strictAt(root, parent)) { try { marks = reviewComments(gh, repo, pull.number).filter((mark) => mark.created_at && Date.parse(mark.created_at) <= at.getTime()); } catch { marks = null; } }
     // The red main checks of its parent, as the gate read them, so a fix of a red main check is judged as the gate judged it.
-    answer = judge({ root, base: parent, head, body: String(pull.body ?? ''), now: at, brake, redMain: redMain({ root, base: parent }, gh, repo), signed: { repo, pr: Number(pull.number), baseRef: pull.base?.ref ?? null, texts } });
+    answer = judge({ root, base: parent, head, body: String(pull.body ?? ''), now: at, brake, redMain: redMain({ root, base: parent }, gh, repo), marks, author: pull.author_association ?? null, fixes: false, signed: { repo, pr: Number(pull.number), baseRef: pull.base?.ref ?? null, texts } });
   } catch (error) { return `#${pull.number}: it cannot be judged (${String(error?.message ?? error).split('\n')[0].slice(0, 160)})`; }
   if (answer.result === 'success') return null;
   // The gate did not say success. An accept act, or an accept-code act for a
@@ -883,6 +912,43 @@ export function brakeRead({ root, base, now = new Date() }, gh, repo, pages = 3)
   return ciTrips({ commits, runs, homes, checks, live: facts.live, liveChecks }, jobsOf);
 }
 
+// Normal mode (item bca1e8fb): the first-parent commits of the base, in the
+// brake window, that have every required check green. The brake ends a trip
+// at the first of them, at or after the trip. A commit whose checks cannot be
+// read counts as not green. The `gate` check is left out, as in brakeRead.
+// Some required checks run only on a pull request (fails-before, the upkeep
+// check), so a commit of main never has them. The answer maps each commit to
+// { ok, checks }: ok when at least one required check ran on it and each one
+// that ran is green, and checks as the names of the green checks. The live
+// checks of the brake (`live: deploy`) are read too, for a live trip.
+export function greenRead({ root, base, now = new Date() }, gh, repo) {
+  const git = (args) => execFileSync('git', ['-C', root, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+  const sha = git(['rev-parse', '--verify', '--end-of-options', `${base}^{commit}`]);
+  let facts;
+  try { facts = brakeFacts(git(['show', `${sha}:atlas.yaml`])); } catch { return new Map(); }
+  const checks = facts.checks.filter((name) => name !== GATE_CHECK);
+  if (!checks.length) return new Map();
+  const live = facts.live === 'deploy' ? facts.liveChecks.filter((name) => !checks.includes(name)) : [];
+  const green = new Map();
+  for (const commit of windowCommits(root, sha, new Date(now.getTime() - facts.days * 864e5))) {
+    try {
+      const runs = checkRuns(gh, repo, commit.sha);
+      const ran = checkStates(checks, runs).filter((row) => row.state !== 'missing');
+      const states = checkStates([...checks, ...live], runs);
+      green.set(commit.sha, { ok: ran.length > 0 && ran.every((row) => row.state === 'green'), checks: new Set(states.filter((row) => row.state === 'green').map((row) => row.name)) });
+    } catch { /* not green */ }
+  }
+  return green;
+}
+
+// What the brake reads from GitHub for one judgment: the trips, the signed
+// clears, and in normal mode the green commits of main.
+export function brakeInput({ root, base, now }, gh, repo) {
+  const input = { ci: brakeRead({ root, base, now }, gh, repo), clears: { repo, commentsOf: (sha) => commitComments(gh, repo, sha) } };
+  if (!strictAt(root, base)) input.green = greenRead({ root, base, now }, gh, repo);
+  return input;
+}
+
 // `atlas gate apply|ready|audit|check|replay|hold`. Returns the exit code.
 export function gateCommand({ what, repo, root, dryRun = false, off = false, on = false, pr, since, commit, from, base, baseRef, head, body, json = false, summary, output, days, branch, errors = false, forced = false, findings, home = homedir() }, line, gh = ghApi) {
   if (!['apply', 'ready', 'audit', 'check', 'replay', 'hold'].includes(what)) throw new GateError(`there is no gate verb "${what ?? ''}". Use apply, ready, audit, check, replay or hold.`);
@@ -890,7 +956,7 @@ export function gateCommand({ what, repo, root, dryRun = false, off = false, on
   const named = repo && repo !== true && /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repo) && !repo.split('/').some((part) => /^\.+$/.test(part));
   if (what === 'check') {
     const number = /^[1-9][0-9]{0,8}$/.test(String(pr ?? '')) ? Number(pr) : null;
-    return checkCommand({ root, base, head, body, json, summary, output, repo: named ? repo : null, pr: pr === undefined ? null : pr, baseRef: baseRef ?? null }, line, named ? () => ({ redMain: redMain({ root, base }, gh, repo), brake: { ci: brakeRead({ root, base }, gh, repo), clears: { repo, commentsOf: (sha) => commitComments(gh, repo, sha) } } }) : null, named && number ? () => [...prComments(gh, repo, number), ...windowComments(gh, repo)] : null);
+    return checkCommand({ root, base, head, body, json, summary, output, repo: named ? repo : null, pr: pr === undefined ? null : pr, baseRef: baseRef ?? null }, line, named ? () => ({ redMain: redMain({ root, base }, gh, repo), brake: brakeInput({ root, base }, gh, repo) }) : null, named && number ? () => [...prComments(gh, repo, number), ...windowComments(gh, repo)] : null, named && number ? () => reviewComments(gh, repo, number) : null, named && number ? () => gh('GET', `repos/${repo}/pulls/${number}`)?.author_association ?? null : null);
   }
   if (what === 'replay') return replayCommand({ root, days, branch, json }, line);
   if (!named) throw new GateError(`atlas gate ${what} needs --repo <owner/name>.`);

package/door/lib/runner.mjs

@@ -38,6 +38,7 @@ import { jobMarker, typedFindings, JOBS_LABEL, atlasJobs } from './jobs.mjs';
 import { repoOk, TOKEN_SHAPE, DEFAULT_BOT, api, apiBase } from './issues.mjs';
 import { ghApi } from './gate.mjs';
 import { PACKAGE_NAME } from './gate-audit.mjs';
+import { strictMode } from './strict.mjs';
 
 const usage = (message) => Object.assign(new Error(message), { usage: true });
 const DAY = 24 * 60 * 60 * 1000;
@@ -47,6 +48,9 @@ const HOUR = 60 * 60 * 1000;
 // request that the gate sends to him.
 export const RUNNER_REPOS = Object.freeze(['Arjunkhera/atlas-scratch']);
 export const RELEASE_DAYS = 2;
+// Normal mode (item bca1e8fb): the repo's atlas.yaml has no `strict_mode: on`,
+// so the runner waits no days for a release.
+export const NORMAL_RELEASE_DAYS = 0;
 export const MAX_OPEN = 5;
 export const MAX_WAITING = 3;
 export const CLAIM_HOURS = 6;
@@ -65,13 +69,13 @@ export function repoAllowed(repo, allowed = RUNNER_REPOS) {
 
 // The newest version that is RELEASE_DAYS old, from the npm document of the
 // package. `newest` is npm latest; `use` is what the runner may load.
-export function releaseToUse(doc, now = Date.now()) {
+export function releaseToUse(doc, now = Date.now(), days = RELEASE_DAYS) {
   const times = doc?.time ?? {};
   const newest = doc?.['dist-tags']?.latest ?? null;
   const versions = Object.keys(doc?.versions ?? {})
     .filter((version) => Number.isFinite(Date.parse(times[version])))
     .sort((a, b) => Date.parse(times[b]) - Date.parse(times[a]));
-  const use = versions.find((version) => now - Date.parse(times[version]) >= RELEASE_DAYS * DAY) ?? null;
+  const use = versions.find((version) => now - Date.parse(times[version]) >= days * DAY) ?? null;
   return { newest, use, newest_age_days: newest && times[newest] ? Math.floor((now - Date.parse(times[newest])) / DAY) : null };
 }
 
@@ -190,6 +194,16 @@ export function capsOf({ gh, repo }) {
 
 // ------------------------------------------------------------ start
 
+// True unless atlas.yaml on the branch is readable and does not say
+// `strict_mode: on`.
+export function strictRepo({ gh, repo, branch }) {
+  try {
+    const file = gh('GET', `repos/${repo}/contents/atlas.yaml?ref=${encodeURIComponent(branch)}`);
+    if (typeof file?.content !== 'string') return true;
+    return strictMode(Buffer.from(file.content, 'base64').toString('utf8'));
+  } catch { return true; }
+}
+
 export async function runnerStart({ repo, gh = ghApi, env = process.env, now = Date.now(), fetchImpl = fetch, allowed = RUNNER_REPOS, jobs = atlasJobs() }) {
   const stop = (why, extra = {}) => ({ repo, go: false, stop: why, ...extra });
   if (!repoAllowed(repo, allowed)) return stop(`${repo} is not a runner repo. Until the owner records the A2 exit test, the runner works on ${allowed.join(', ')} only (R25 line 13)`);
@@ -203,8 +217,11 @@ export async function runnerStart({ repo, gh = ghApi, env = process.env, now = D
   const audit = auditOnTip({ gh, repo, branch: main });
   if (!audit.ok) return stop(`${audit.why} (R25 line 11)`, { audit });
   let release;
-  try { release = releaseToUse(await npmDoc(fetchImpl), now); } catch (error) { return stop(`npm could not be read: ${error.message}`); }
-  if (!release.use) return stop(`no release of ${PACKAGE_NAME} is ${RELEASE_DAYS} days old yet`, { release });
+  // The wait comes from the target repo's atlas.yaml on its main branch. A
+  // file that GitHub cannot give counts as strict: the longer wait.
+  const days = strictRepo({ gh, repo, branch: main }) ? RELEASE_DAYS : NORMAL_RELEASE_DAYS;
+  try { release = releaseToUse(await npmDoc(fetchImpl), now, days); } catch (error) { return stop(`npm could not be read: ${error.message}`); }
+  if (!release.use) return stop(`no release of ${PACKAGE_NAME} is ${days} days old yet`, { release });
   const { inputs, outside, held } = readInputs({ gh, repo, branch: main, now, jobs });
   const caps = capsOf({ gh, repo });
   return { repo, go: true, stop: null, branch: main, release, audit, caps, inputs, outside, held };

package/door/lib/strict.mjs

@@ -0,0 +1,67 @@
+// Strict mode (item bca1e8fb; design docs/design-docs/pipeline/controls-off.md).
+// The owner controls are off by default. A repo turns them on with one key in
+// atlas.yaml: `strict_mode: on`. With no key, or with `off` or `false`, the
+// repo is in normal mode. Any other value, or a file that does not read, is
+// strict mode. The gate reads the key from the base commit, never from the
+// head. The key is on the fixed list of the owner-only floor, so only the
+// owner turns the mode off in a strict repo.
+//
+//   strictMode(text)                    true unless the key is missing, off or false
+//   strictAt(root, ref)                 the same, from the file at one commit
+//   insider(association)                true for OWNER, MEMBER or COLLABORATOR
+//   reviewHeads(marks)                  the heads that a valid review mark names
+//
+// Do not confuse this key with the `strict` option of parseYaml in
+// shape/check.mjs. That option makes the reader refuse odd YAML.
+import { spawnSync } from 'node:child_process';
+import { parseYaml } from '../../shape/check.mjs';
+
+export const STRICT_KEY = 'strict_mode';
+// The marker line of a review mark, and the line that names the reviewed head.
+export const REVIEW_MARKER = '<!-- atlas:review -->';
+// Only these authors count. GitHub states the association itself; a session
+// cannot set it on a comment.
+export const REVIEW_AUTHORS = Object.freeze(['OWNER', 'MEMBER', 'COLLABORATOR']);
+
+// Fail closed. A missing key, `off` or `false` gives normal mode. Any other
+// value (on, ON, yes, true, odd text) gives strict mode. A text that does not
+// read gives strict mode.
+export function strictMode(text) {
+  if (typeof text !== 'string') return true;
+  let facts;
+  try { facts = parseYaml(text) ?? {}; } catch { return true; }
+  if (typeof facts !== 'object' || Array.isArray(facts)) return true;
+  if (!(STRICT_KEY in facts)) return false;
+  const value = facts[STRICT_KEY];
+  return !(value === false || value === 'off');
+}
+
+// The mode at one commit. A commit with no atlas.yaml is normal mode. A
+// commit that git cannot read is strict mode.
+export function strictAt(root, ref) {
+  const r = spawnSync('git', ['show', `${ref}:atlas.yaml`], { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (r.status === 0) return strictMode(r.stdout);
+  const has = spawnSync('git', ['cat-file', '-e', `${ref}^{commit}`], { cwd: root });
+  return has.status !== 0 || r.error !== undefined;
+}
+
+// True for an author association that counts as an insider.
+export const insider = (association) => REVIEW_AUTHORS.includes(String(association));
+
+// The marks that count: each is { body, association }. A mark needs the marker
+// line, and the next non-empty line is the pass line with the 40 hex of a head.
+// A comment with more than one pass line counts for nothing. The author needs
+// the association OWNER, MEMBER or COLLABORATOR. Newest first when the input is.
+export function reviewHeads(marks) {
+  const heads = [];
+  for (const mark of Array.isArray(marks) ? marks : []) {
+    if (!mark || typeof mark.body !== 'string' || !insider(mark.association)) continue;
+    const lines = mark.body.split('\n').map((line) => line.trim());
+    const at = lines.indexOf(REVIEW_MARKER);
+    if (at < 0 || lines.filter((line) => /^atlas-review:\s*pass\b/.test(line)).length !== 1) continue;
+    const next = lines.slice(at + 1).find(Boolean) ?? '';
+    const hit = /^atlas-review: pass ([0-9a-f]{40})$/.exec(next);
+    if (hit && !heads.includes(hit[1])) heads.push(hit[1]);
+  }
+  return heads;
+}

package/owner-only.yaml

@@ -246,3 +246,4 @@ atlas_yaml:
     - verbatim
     - private_terms
     - signing_window
+    - strict_mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.61",
+  "version": "0.4.62",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/skills/lead/SKILL.md

@@ -127,10 +127,19 @@ set. A test keeps the two lists equal.
 | `atlas jobs` | The `atlas-jobs` workflow calls `check`, then `file`, once a day. A session calls it only to see what the watcher would file: `check`, then `file --dry-run` |
 | `atlas runner` | Only in a runner run, as the `atlas:runner` skill says: `start` first, `claim` before each build, `line` last. A lead session never runs the runner |
 | `atlas upkeep` | `check` before you ask for a merge. It reads the docs index, dead doc links, the code each doc names and stale pages. In a pull request it also reads the tracker item, the changed designs, and STE on the changed lines. The daily upkeep run calls it on the main branch. `replay` before the doc-sources rule changes how it gates. `procedures` runs the procedure steps tagged `atlas-run`; CI runs it with `--base` on each pull request |
-| `atlas gate` | `apply` once per repo, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge, `check` in the `atlas-gate` workflow, `replay` before a change to the owner-only list, `hold` only in the release job. `audit` in the daily upkeep run, and with `--commit` in the push job of a repo that has one |
-| `atlas approve` | Only the owner runs it, never a session, on his Mac with his key's touch. When the gate says "owner" for a pull request, ask him once for the signed act: name each pull request, its class and its cause. Put the owner pull requests of one day in one ask, so one touch signs them. `act`, `verify` and `key-check` work the same way. Each morning with open audit issues, ask him for `audit`, and `audit-code <pr>` per audit-code merge; record its words as one decision, then close each issue. Where `signing_window: on`, ask him each evening for `window`: one touch sees the list of merges and opens a window of up to 12 hours |
+| `atlas gate` | `apply` once per repo, only where `strict_mode: on`, by the owner on his Mac, after the repo's `required_checks` exist. `--dry-run` first. `--off` and `--on` are the break glass. On a plan with no rulesets it reports advisory mode. `ready` before each merge, `check` in the `atlas-gate` workflow, `replay` before a change to the owner-only list, `hold` only in the release job. `audit` in the daily upkeep run, and with `--commit` in the push job of a repo that has one |
+| `atlas approve` | Only the owner runs it, never a session, and only where `strict_mode: on`, on his Mac with his key's touch. When the gate says "owner" for a pull request, ask him once for the signed act: name each pull request, its class and its cause. Put the owner pull requests of one day in one ask, so one touch signs them. `act`, `verify` and `key-check` work the same way. Each morning with open audit issues, ask him for `audit`, and `audit-code <pr>` per audit-code merge; record its words as one decision, then close each issue. Where `signing_window: on`, ask him each evening for `window`: one touch sees the list of merges and opens a window of up to 12 hours |
 | `atlas judge` | In the fresh-agent test only, as the `atlas:fresh-agent-test` skill says. `seal` after the pick, `brief` to read a sealed ask, `run` for each sealed task, `check` after the grade |
 
+**Strict mode** (item bca1e8fb, 14 November 2026): `atlas.yaml` holds
+`strict_mode: on` or `off`, and no key means off. The gate reads the key from
+the base commit. In normal mode a pull request merges on green. A change to
+the rules of Atlas needs a review mark: a second agent posts a comment with
+`<!-- atlas:review -->` and `atlas-review: pass <head sha>`. The signed act,
+the window, `atlas approve`, the gate `apply` verb, the audit accept and the
+runner wait hold only where the mode is on. Design:
+`docs/design-docs/pipeline/controls-off.md`.
+
 A person merges every file that `atlas tooling` writes.
 A person merges every file that `atlas tests write` writes.
 

package/skills/sdlc-task/SKILL.md

@@ -163,6 +163,12 @@ A lock is the owner's approval of a short design.
       It refuses a push to the main branch and a force push. It refuses the
       auto-merge tool; `gh pr merge --auto --match-head-commit` names the
       head. When it refuses, do what its reason says. Never work around it.
+   6. In normal mode (`strict_mode` off or missing), a pull request merges
+      on green. A change to the rules of Atlas needs a review mark. Send a
+      reviewer crew with a fresh context. When it finds no S1, post a comment
+      with `<!-- atlas:review -->` and `atlas-review: pass <head sha>`. Never
+      ask for a signed act. The signed act, the window, `atlas approve` and
+      the gate `apply` verb hold only where `strict_mode: on`.
 
 ## pause