@detergent-software/conductor 3.0.0-dev.8 → 3.0.0

package/build/project-check-cli.js

@@ -9,32 +9,33 @@ import { ConductorError } from "./errors.js";
 import { localCredentials } from "./in-process.js";
 import { checkFailed, checkLines, checkProject, checkReportSchema, noProject, } from "./project-check.js";
 import { openStore } from "./store.js";
-import { routedQueue } from "./trackers.js";
-import { boardsQueue } from "./watchers/boards-queue.js";
-import { issuesQueue } from "./watchers/issues-queue.js";
-import { linearQueue } from "./watchers/linear-queue.js";
+import { projectTracker } from "./trackers.js";
 import { gitWorktrees } from "./worktrees.js";
-// The worktree's create hook may run 10 minutes (pnpm install) and its remove 5, on top of the reads.
+// The worktree's setup may run 10 minutes (pnpm install) and its remove 5, on top of the reads.
 const CHECK_TIMEOUT_MS = 17 * 60_000;
 const refused = z.object({ details: z.array(z.string()).optional(), error: z.string() });
 // `conduct project check <name>`: through the daemon, which checks as its own accounts, else here
 // as the machine's. Returns the exit code: 1 when a check failed, else 0.
 export async function projectCheckCommand(paths, name, options, io) {
-    let report;
+    const report = await projectCheckReport(paths, name, options, io);
+    if (options.json)
+        io.out(JSON.stringify(report, null, 2));
+    else
+        checkLines(report).forEach((line) => io.out(line));
+    return checkFailed(report) ? 1 : 0;
+}
+// The check's report, from the daemon or made here, for a caller that prints it its own way
+// (`conduct init`).
+export async function projectCheckReport(paths, name, options, io) {
     try {
-        report = await checkByDaemon(paths, name, options);
+        return await checkByDaemon(paths, name, options);
     }
     catch (error) {
         if (!(error instanceof NotRunningError))
             throw error;
         io.err('checking here (the conductor is not running)');
-        report = await checkHere(paths, name, options, io);
+        return checkHere(paths, name, options, io);
     }
-    if (options.json)
-        io.out(JSON.stringify(report, null, 2));
-    else
-        checkLines(report).forEach((line) => io.out(line));
-    return checkFailed(report) ? 1 : 0;
 }
 async function checkByDaemon(paths, name, options) {
     const { body, status } = await callApi(paths, {
@@ -75,13 +76,10 @@ function localDeps(paths, store) {
     return {
         claude: claudeCli(),
         credentials,
-        hosts: (project) => projectHosts(credentials, project),
+        hosts: (profile) => projectHosts(credentials, profile.name, { profile }),
+        paths,
         ports: broker({ pool: loadConfig(paths.config).ports, store }),
-        queue: routedQueue({
-            'ado-boards': boardsQueue({ credentials }),
-            'github-issues': issuesQueue({ credentials }),
-            linear: linearQueue({ credentials }),
-        }),
+        queue: projectTracker({ credentials }).queue,
         worktrees: gitWorktrees(),
     };
 }

package/build/project-check-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-check-cli.js","sourceRoot":"","sources":["../src/project-check-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,WAAW,EACX,UAAU,EAEV,YAAY,EAEZ,iBAAiB,EACjB,SAAS,GAEV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,sGAAsG;AACtG,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AASrC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzF,kGAAkG;AAClG,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAqB,EACrB,IAAY,EACZ,OAAyC,EACzC,EAAkB;IAElB,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC;YAAE,MAAM,KAAK,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACvD,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;QACrD,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,IAAY,EAAE,OAAqB;IACrF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE;QAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,aAAa,kBAAkB,CAAC,IAAI,CAAC,QAAQ;QACnD,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IACH,0FAA0F;IAC1F,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC3C,mEAAmE;IACnE,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,cAAc,CAAC,4CAA4C,EAAE;YACrE,gEAAgE;SACjE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,IAAI,oBAAoB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,KAAqB,EACrB,IAAY,EACZ,OAAqB,EACrB,EAAkB;IAElB,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO;YACV,MAAM,SAAS,CACb,IAAI,EACJ,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACxC,CAAC;QACJ,OAAO,MAAM,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,SAAS,CAAC,KAAqB,EAAE,KAAY;IACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO;QACL,MAAM,EAAE,SAAS,EAAE;QACnB,WAAW;QACX,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC;QACtD,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9D,KAAK,EAAE,WAAW,CAAC;YACjB,YAAY,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;YAC1C,eAAe,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;YAC7C,MAAM,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC;SACrC,CAAC;QACF,SAAS,EAAE,YAAY,EAAE;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"project-check-cli.js","sourceRoot":"","sources":["../src/project-check-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,WAAW,EACX,UAAU,EAEV,YAAY,EAEZ,iBAAiB,EACjB,SAAS,GAEV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAc,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,gGAAgG;AAChG,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AASrC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzF,kGAAkG;AAClG,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAqB,EACrB,IAAY,EACZ,OAAyC,EACzC,EAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,IAAI;QAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;QACrD,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,4FAA4F;AAC5F,oBAAoB;AACpB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAqB,EACrB,IAAY,EACZ,OAAqB,EACrB,EAAwC;IAExC,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC;YAAE,MAAM,KAAK,CAAC;QACrD,EAAE,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QACvD,OAAO,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAqB,EAAE,IAAY,EAAE,OAAqB;IACrF,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE;QAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,aAAa,kBAAkB,CAAC,IAAI,CAAC,QAAQ;QACnD,SAAS,EAAE,gBAAgB;KAC5B,CAAC,CAAC;IACH,0FAA0F;IAC1F,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC3C,mEAAmE;IACnE,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,cAAc,CAAC,4CAA4C,EAAE;YACrE,gEAAgE;SACjE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,IAAI,oBAAoB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,KAAqB,EACrB,IAAY,EACZ,OAAqB,EACrB,EAAgC;IAEhC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO;YACV,MAAM,SAAS,CACb,IAAI,EACJ,KAAK,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CACxC,CAAC;QACJ,OAAO,MAAM,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,SAAS,CAAC,KAAqB,EAAE,KAAY;IACpD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO;QACL,MAAM,EAAE,SAAS,EAAE;QACnB,WAAW;QACX,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;QACxE,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9D,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK;QAC5C,SAAS,EAAE,YAAY,EAAE;KAC1B,CAAC;AACJ,CAAC"}

package/build/project-check.js

@@ -1,5 +1,5 @@
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { gt } from 'semver';
 import { z } from 'zod';
 import { portEnv } from "./broker.js";
 import { runGit } from "./checkout.js";
@@ -8,11 +8,17 @@ import { repoKey, repoOf } from "./code-host.js";
 import { TRACKER_API } from "./conditions.js";
 import { ConductorError } from "./errors.js";
 import { answersTo, NotFound } from "./lib/providers/index.js";
+import { projectPaths } from "./paths.js";
 import { pluginSkill, pluginSource, projectSkills, readPluginSkill } from "./plugin.js";
-import { PROFILE_FILE, readProfile } from "./profile.js";
+import { minimumCheck } from "./profile-fields.js";
+import { projectProfile } from "./profile-layers.js";
+import { adoOrganization } from "./profile.js";
 import { PROTOCOL } from "./protocol.js";
+import { registeredByCheckout } from "./registry.js";
+import { RELEASE_KINDS } from "./release-kinds.js";
 import { ciRefusal } from "./runs.js";
-import { BRANCH_PREFIX, SESSION_SETTINGS, worktreePath } from "./worktrees.js";
+import { labelQueue } from "./watchers/linear-queue.js";
+import { BRANCH_PREFIX, SESSION_SETTINGS } from "./worktrees.js";
 // `conduct project check <name>` (ATK-490): whether a registered project can be conducted, checked
 // before the first launch instead of found by a failed one. Each check reads what the launch and the
 // watchers would use, as the project's accounts; only the worktree check writes, and it removes what
@@ -29,6 +35,9 @@ export const CHECKS = [
     'health',
 ];
 const HEALTH_TIMEOUT_MS = 15_000;
+// How the worktree check's summary starts when a skill the profile names is missing after setup:
+// `conduct init` reads it to point at the verify skill's maker.
+export const MISSING_SKILLS = "a new worktree's skills:";
 const SOURCE_WORDS = {
     'cli-login': 'CLI login',
     'machine-token': "the machine's token",
@@ -99,23 +108,26 @@ export async function checkProject(given, project, options) {
     const deps = {
         ...given,
         credentials: {
-            probe: (provider, name) => {
+            ...given.credentials,
+            probe: (provider, name, options) => {
                 const key = `${provider}:${name}`;
-                const known = probes.get(key) ?? given.credentials.probe(provider, name);
+                const known = probes.get(key) ?? given.credentials.probe(provider, name, options);
                 probes.set(key, known);
                 return known;
             },
         },
     };
-    const { profile, result } = profileCheck(project);
+    const resolve = deps.resolveProfile ?? ((name) => projectProfile(deps.paths, name));
+    const { profile, result } = profileCheck(project, deps.paths, () => resolve(project.name));
     const results = [{ check: 'profile', ...result }];
+    const { clone, worktrees: dir } = projectPaths(deps.paths, project.name);
     const steps = [
         ['auth', (p) => authCheck(deps, p)],
         ['tracker', (p) => trackerCheck(deps, p)],
         ['code-host', (p) => codeHostCheck(deps, p)],
         ['ci', (p) => ciCheck(deps, p)],
-        ['worktree', (p) => worktreeCheck(deps, project.root, p, options)],
-        ['skills', (p) => skillsCheck(deps, project.root, p)],
+        ['worktree', (p) => worktreeCheck(deps, { clone, dir }, p, options)],
+        ['skills', (p) => skillsCheck(deps, p, options)],
         ['ports', (p) => portsCheck(deps, p)],
         ['health', (p) => healthCheck(deps, p)],
     ];
@@ -155,50 +167,63 @@ export function differences(a, b, path = '') {
 // The check of a name no project is registered under.
 export function noProject(name, names) {
     return new ConductorError(`no project ${name}`, [
-        names.length > 0 ? `registered: ${names.join(', ')}` : 'register one with `conduct project add <path>`',
+        names.length > 0 ? `registered: ${names.join(', ')}` : 'register one with `conduct project add <url | path>`',
     ]);
 }
-// The profile on disk against this build's schema and the stored copy the daemon works from. The
-// rest of the checks use the file when it reads (the daemon takes it on its next save or start),
-// else the stored copy, else nothing.
-export function profileCheck(project) {
-    let disk;
+// The profile as its layers give it now (the machine file over the repo's at origin/<base>) against
+// this build's schema and the stored copy the daemon works from, and each file's `conductor` minimum
+// against the fields it writes (ATK-580). The rest of the checks use the resolved profile when it
+// reads (the daemon takes it on its next start, save or fetch), else the stored copy, else nothing.
+export function profileCheck(project, paths, resolve) {
+    if (registeredByCheckout(paths, project)) {
+        return {
+            profile: null,
+            result: fail(`${project.name} is registered by the checkout ${project.clone}, which the conductor no longer works in`, `run \`conduct project add "${project.clone}"\`: it clones the checkout's origin into ${projectPaths(paths, project.name).clone} and keeps the registration`),
+        };
+    }
+    let layered;
     try {
-        disk = readProfile(project.root).profile;
+        layered = resolve();
     }
     catch (error) {
         return {
             profile: project.profile,
-            result: fail(messageOf(error), `fix ${project.profilePath} and check again; until then the daemon keeps its stored copy`, detailsOf(error)),
-        };
-    }
-    if (disk.name !== project.name) {
-        return {
-            profile: project.profile ?? disk,
-            result: fail(`${project.profilePath} renames the project to "${disk.name}"`, `put "name": "${project.name}" back: a project keeps the name it was registered under. Or rename it: \`conduct project remove ${project.name}\`, then \`conduct project add "${project.root}"\``),
+            result: fail(messageOf(error), `fix the profile (\`conduct profile ${project.name}\` names its files) and check again; until then the daemon keeps its stored copy`, detailsOf(error)),
         };
     }
+    const { layers, profile: now } = layered;
+    const minimum = combined([layers.machine, layers.repo].flatMap((layer) => layer === null ? [] : [minimumCheck(JSON.stringify(layer.raw), layer.label)]));
+    const files = [layers.machine, layers.repo].flatMap((l) => (l === null ? [] : [l.label])).join(' over ');
+    const moved = [layers.machine, layers.repo].flatMap((l) => l !== null && Object.hasOwn(l.raw, 'workers') ? [l.label] : []);
+    const checked = (outcome) => withMovedWorkers(withMinimum(outcome, minimum), moved);
     if (project.profile === null) {
         return {
-            profile: disk,
-            result: warn(`${PROFILE_FILE} is valid, but the daemon's stored copy is one this build can't read (${project.problem ?? 'unknown'})`, 'the daemon takes the file when it next starts, or on the next save of the file'),
+            profile: now,
+            result: checked(warn(`the profile (${files}) is valid, but the daemon's stored copy is one this build can't read (${project.problem ?? 'unknown'})`, 'the daemon takes the profile when it next starts, or after the next save or fetch')),
         };
     }
-    const changed = differences(project.profile, disk);
+    const changed = differences(project.profile, now);
     if (changed.length > 0) {
         return {
-            profile: disk,
-            result: warn(`${PROFILE_FILE} is valid, but ${changed.length === 1 ? 'a field differs' : `${changed.length} fields differ`} from the daemon's stored copy`, 'the daemon takes the file on its next save, or when it next starts', changed),
+            profile: now,
+            result: checked(warn(`the profile (${files}) is valid, but ${changed.length === 1 ? 'a field differs' : `${changed.length} fields differ`} from the daemon's stored copy`, 'the daemon takes it after the next save of the machine profile or fetch of the clone, or when it next starts', changed)),
         };
     }
-    return { profile: disk, result: ok(`${PROFILE_FILE} is valid (protocol ${PROTOCOL}) and matches the stored copy`) };
+    return {
+        profile: now,
+        result: checked(ok(`the profile (${files}) is valid (protocol ${PROTOCOL}) and matches the stored copy`)),
+    };
 }
 // Which credential each provider the project uses signs in with (credentials.ts: a project token,
 // then the machine's token, then the CLI login), and for each that isn't the project's own token, how
 // to give it one scoped to the project. Advice only: any source that works passes.
 async function authCheck(deps, profile) {
-    const used = [...new Set([repoOf(profile).host, TRACKER_API[profile.tracker.kind]])];
-    const probed = await Promise.all(used.map((provider) => deps.credentials.probe(provider, profile.name)));
+    // Azure Pipelines that build a GitHub repo sign in to Azure DevOps too.
+    const pipelines = profile.ci.kind === 'ado-pipelines' ? ['ado'] : [];
+    const used = [...new Set([repoOf(profile).host, ...pipelines, TRACKER_API[profile.tracker.kind]])];
+    // The checked profile's ADO organization, which the stored one may not have yet.
+    const organization = adoOrganization(profile);
+    const probed = await Promise.all(used.map((provider) => deps.credentials.probe(provider, profile.name, { organization })));
     const failing = probed.find((p) => p.error !== null);
     // No source: nothing was found at all (Linear with no key, which has no CLI login).
     const words = (source) => (source === null ? 'no credential' : SOURCE_WORDS[source]);
@@ -220,8 +245,7 @@ async function authCheck(deps, profile) {
     const scoped = wide.map((provider) => {
         const target = `conductor-${profile.name}-${provider}`;
         const key = provider === 'linear' ? 'linear.credential' : `${provider}.token`;
-        const user = provider === 'linear' ? 'linear' : 'pat';
-        return `for ${provider}, ${SCOPES[provider]}: cmdkey /generic:${target} /user:${user} /pass, then set projects.${profile.name}.${key} to "${target}" in config.json`;
+        return `for ${provider}, ${SCOPES[provider]}: ${deps.credentials.saveCommand(provider, target)}, then set projects.${profile.name}.${key} to "${target}" in config.json`;
     });
     return {
         details: [...details, ...scoped],
@@ -233,11 +257,12 @@ async function authCheck(deps, profile) {
 async function ciCheck(deps, profile) {
     const repo = repoOf(profile);
     const refusal = ciRefusal(profile, repo);
-    if (refusal !== null)
-        return fail(refusal, "set ci to the code host's own: ado-pipelines for Azure DevOps, github-actions for GitHub");
+    if (refusal !== null) {
+        return fail(refusal, 'set ci to ado-pipelines for an Azure DevOps repo; for a GitHub repo, github-actions, or ado-pipelines with the organization and project whose pipelines build it');
+    }
     let pipelines;
     try {
-        pipelines = await deps.hosts(profile.name)(repo).ci.pipelines();
+        pipelines = await deps.hosts(profile)(repo).ci.pipelines();
     }
     catch (error) {
         return fail(`${profile.ci.kind} pipelines of ${repoKey(repo)} can't be listed: ${messageOf(error)}`, 'check that the account can read the pipelines', detailsOf(error));
@@ -259,16 +284,24 @@ async function ciCheck(deps, profile) {
         return fail(problems.join('; '), `name each release's pipeline by its YAML file name, path or name, once; ${repoKey(repo)} has ${known.length > 0 ? known.join(', ') : 'none'}`);
     }
     const releases = resolved.length > 0 ? `; releases: ${resolved.join(', ')}` : '; no release pipelines named';
-    return ok(`${pipelines.length} ${profile.ci.kind} pipelines on ${repoKey(repo)}${releases}`);
+    const found = `${pipelines.length} ${profile.ci.kind} pipelines on ${repoKey(repo)}${releases}`;
+    // Each release waits on a person at its kind's gate (release-kinds.ts), which `gates` should name.
+    const ungated = profile.releases.filter((r) => !profile.gates.includes(RELEASE_KINDS[r.kind].gate));
+    if (ungated.length > 0) {
+        return warn(`${found}, but gates leaves out ${ungated.map((r) => `release ${r.key}'s ${RELEASE_KINDS[r.kind].gate}`).join(', ')}`, `add ${[...new Set(ungated.map((r) => RELEASE_KINDS[r.kind].gate))].join(', ')} to the profile's gates`);
+    }
+    return ok(found);
 }
 async function codeHostCheck(deps, profile) {
     const repo = repoOf(profile);
-    const { account, error } = await deps.credentials.probe(repo.host, profile.name);
+    const { account, error } = await deps.credentials.probe(repo.host, profile.name, {
+        organization: adoOrganization(profile),
+    });
     if (error !== null)
         return fail(`${account.label} doesn't answer: ${error}`, `sign in: ${account.command}`);
     let tip;
     try {
-        tip = await deps.hosts(profile.name)(repo).branchTip(profile.baseBranch);
+        tip = await deps.hosts(profile)(repo).branchTip(profile.baseBranch);
     }
     catch (caught) {
         if (caught instanceof NotFound) {
@@ -280,6 +313,14 @@ async function codeHostCheck(deps, profile) {
         return fail(`${repoKey(repo)} has no branch ${profile.baseBranch}`, "set baseBranch to the repo's base");
     return ok(`${repoKey(repo)} answers as ${account.label}; ${profile.baseBranch} is at ${tip.slice(0, 7)}`);
 }
+// The layers' minimum checks as one: every file's problems, and the newest version that clears them.
+function combined(checks) {
+    let needs = null;
+    for (const check of checks)
+        if (check.needs !== null && (needs === null || gt(check.needs, needs)))
+            needs = check.needs;
+    return { needs, problems: checks.flatMap((c) => c.problems) };
+}
 function detailsOf(error) {
     return error instanceof ConductorError ? error.details : [];
 }
@@ -330,61 +371,38 @@ async function portsCheck(deps, profile) {
         return fail(error.message, error.details[0] ?? '`conduct ports` lists the assignments');
     }
 }
-function readInstalledSkill(root, name) {
-    try {
-        return readFileSync(join(root, '.claude', 'skills', name, 'SKILL.md'), 'utf8');
-    }
-    catch {
-        return null;
-    }
-}
-// The main checkout's skills, read-only: the worktree hooks copy them into each worker's worktree.
-async function skillsCheck(deps, root, profile) {
-    const read = deps.readSkill ?? readInstalledSkill;
-    const { aliases, verify, work } = profile.skills;
+// The skills the profile names, read where a session finds them before any worktree exists: the
+// conductor plugin's (conductor:<skill>), with the work skill's declared protocol. The project's
+// own skills arrive through `setup` in each new worktree, so the worktree check looks for those.
+async function skillsCheck(deps, profile, options) {
+    const { verify, work } = profile.skills;
     const problems = [];
-    const installed = [];
-    // The conductor plugin's skills (conductor:<skill>) come with the package, not the checkout: read
-    // from its plugin and left out of the audit.
     const plugin = deps.pluginDir ?? pluginSource();
-    const readAny = (name) => {
-        const skill = pluginSkill(name);
-        return skill === null ? read(root, name) : readPluginSkill(plugin, skill);
-    };
-    const absent = (name) => pluginSkill(name) === null ? "isn't installed" : "isn't in the conductor plugin";
-    const workSkill = readAny(work);
-    if (workSkill === null)
-        problems.push(`the work skill ${work} ${absent(work)}`);
-    else {
-        if (pluginSkill(work) === null)
-            installed.push(work);
-        const declared = declaredProtocol(workSkill);
+    const fromPlugin = [work, verify].filter((name) => pluginSkill(name) !== null);
+    for (const name of fromPlugin) {
+        const text = readPluginSkill(plugin, pluginSkill(name) ?? name);
+        if (text === null) {
+            problems.push(`${name} isn't in the conductor plugin`);
+            continue;
+        }
+        if (name !== work)
+            continue;
+        const declared = declaredProtocol(text);
         if (declared === null)
             problems.push(`${work} declares no worker protocol (protocol: ${PROTOCOL} in its frontmatter)`);
         else if (declared !== PROTOCOL)
             problems.push(`${work} speaks worker protocol ${declared}; this conductor speaks ${PROTOCOL}`);
     }
-    if (readAny(verify) === null)
-        problems.push(`the verify skill ${verify} ${absent(verify)}`);
-    else if (pluginSkill(verify) === null)
-        installed.push(verify);
-    // Beside a plugin work skill an alias only names older notes' headings: nothing installs it.
-    const checkAliases = pluginSkill(work) === null;
-    const missing = checkAliases ? aliases.filter((alias) => read(root, alias) === null) : [];
-    // Only the installed ones: a missing one is said once, above.
-    const stale = installed.length > 0 ? await deps.worktrees.auditSkills(root, installed) : null;
-    // An audit that couldn't run carries atk's output, JSON over several lines: one line here.
-    if (stale !== null && stale.length > 0)
-        problems.push(`atk audit: ${stale.join(', ').replace(/\s+/g, ' ')}`);
-    if (problems.length > 0) {
-        return fail(problems.join('; '), `atk install in ${root}, or set skills.work and skills.verify to the installed skills' names`);
-    }
-    const audited = stale === null ? '' : ', matching .atk-lock.json';
-    const summary = `${work} (worker protocol ${PROTOCOL}) and ${verify} are installed${audited}`;
-    if (missing.length > 0) {
-        return warn(`${summary}; the alias ${missing.join(', ')} isn't`, 'notes under an alias still count; install it only for launchers that call it (atk install), or drop it from skills.aliases once no item in flight uses it');
-    }
-    return ok(`${summary}${checkAliases && aliases.length > 0 ? `, as is ${aliases.join(', ')}` : ''}`);
+    if (problems.length > 0)
+        return fail(problems.join('; '), 'upgrade the conductor, or set skills.work and skills.verify to skills it has');
+    const own = [work, verify].filter((name) => pluginSkill(name) === null);
+    const plugged = fromPlugin.length > 0
+        ? `${fromPlugin.join(' and ')} ${fromPlugin.length === 1 ? 'comes' : 'come'} with the conductor plugin`
+        : '';
+    const theirs = own.length === 0
+        ? ''
+        : `${own.join(' and ')} ${own.length === 1 ? 'comes' : 'come'} from the project's setup: ${options.worktree ? 'the worktree check looked for' : '--no-worktree, so nothing looked for'} ${own.length === 1 ? 'it' : 'them'}`;
+    return ok([plugged, theirs].filter((s) => s !== '').join('; '));
 }
 // A timestamp safe in a worktree and branch name.
 // To the millisecond, so two checks started together get worktrees of their own.
@@ -393,7 +411,9 @@ function stamp(at) {
 }
 async function trackerCheck(deps, profile) {
     const { tracker } = profile;
-    const { account, error } = await deps.credentials.probe(TRACKER_API[tracker.kind], profile.name);
+    const { account, error } = await deps.credentials.probe(TRACKER_API[tracker.kind], profile.name, {
+        organization: adoOrganization(profile),
+    });
     if (error !== null)
         return fail(`${account.label} doesn't answer: ${error}`, `sign in: ${account.command}`);
     const where = tracker.kind === 'linear'
@@ -417,38 +437,80 @@ async function trackerCheck(deps, profile) {
     const items = `${snapshot.issues.length} open ${snapshot.issues.length === 1 ? 'item' : 'items'}`;
     if (tracker.kind !== 'linear')
         return ok(`${where} lists ${items}, as ${account.label}`);
-    // Linear filters by the team's key, so a key no team has reads as a team with nothing.
-    if (snapshot.projects.length === 0 && snapshot.issues.length === 0) {
-        return fail(`${where} has no projects and no open items`, `check tracker.team: "${tracker.team}" must be the key of a Linear team ${account.label} can see`);
-    }
-    if (snapshot.areaLabels.length === 0) {
-        return warn(`${where} lists ${items}, but no label sits under the Area group "${tracker.areaLabelGroup}"`, "check tracker.areaLabelGroup: the scheduler keeps one item per Area, and with no Areas it can't tell them apart");
-    }
+    const queue = labelQueue(tracker);
+    // Linear filters by the team's key, so a key no team has reads as a team with nothing. A label
+    // queue reads no projects.
+    if ((queue !== null || snapshot.projects.length === 0) && snapshot.issues.length === 0) {
+        return fail(`${where} has ${queue ? '' : 'no projects and '}no open items`, `check tracker.team: "${tracker.team}" must be the key of a Linear team ${account.label} can see`);
+    }
+    // Nothing conducted first: it matters more than the Areas.
+    const queued = queue ? snapshot.issues.filter((i) => i.trackerProject === queue.name).length : 0;
     const prioritized = snapshot.projects.filter((p) => p.priority !== null && p.priority > 0).length;
-    if (prioritized === 0) {
+    if (queue && queued === 0) {
+        return warn(`${where} lists ${items}, but none carries the queue label ${queue.label}, so nothing is conducted`, `label the Linear issues to conduct ${queue.label}, or check tracker.queue.label`);
+    }
+    if (!queue && prioritized === 0) {
         return warn(`${where} lists ${items}, but none of its projects has a priority, so nothing is conducted`, 'give the Linear projects to conduct a priority');
     }
-    return ok(`${where} lists ${items}, and ${prioritized} of its projects have a priority, as ${account.label}`);
+    // No Area group means the team has no Areas (tracker.areaLabelGroup: null).
+    if (tracker.areaLabelGroup !== null && snapshot.areaLabels.length === 0) {
+        return warn(`${where} lists ${items}, but no label sits under the Area group "${tracker.areaLabelGroup}"`, "check tracker.areaLabelGroup: the scheduler keeps one item per Area, and with no Areas it can't tell them apart (null if the team has none)");
+    }
+    return ok(queue
+        ? `${where} lists ${items}, and ${queued} carry the queue label ${queue.label}, as ${account.label}`
+        : `${where} lists ${items}, and ${prioritized} of its projects have a priority, as ${account.label}`);
+}
+// A profile that writes a field newer than its `conductor` minimum reads here, but an older conductor
+// would refuse it with the fields it doesn't know instead of the one line that says to upgrade: a
+// warn, beside whatever else the profile check found.
+function withMinimum(outcome, { needs, problems }) {
+    if (problems.length === 0)
+        return outcome;
+    const below = `its "conductor" minimum is below ${problems.length === 1 ? 'a field' : `${problems.length} fields`} it writes`;
+    const fix = needs === null
+        ? "the conductor's profile-fields.ts records no version for these fields: file it against the conductor"
+        : `raise "conductor" to ${needs}, the oldest conductor that reads every field the file writes`;
+    return {
+        details: [...outcome.details, ...problems],
+        fix: outcome.fix === null ? fix : `${outcome.fix}; ${fix}`,
+        status: 'warn',
+        summary: outcome.status === 'ok' ? `${outcome.summary}, but ${below}` : `${outcome.summary}; ${below}`,
+    };
+}
+// A profile file that still sets `workers`, which moved to the machine's config.json (ATK-529): it
+// is read and ignored, so a warn, beside whatever else the profile check found.
+function withMovedWorkers(outcome, files) {
+    if (files.length === 0)
+        return outcome;
+    const moved = `${files.join(' and ')} ${files.length === 1 ? 'sets' : 'set'} "workers", which moved to the machine's config.json and is ignored here`;
+    const fix = 'set "workers": { "tab": true } in ~/.conductor/config.json on each machine that wants a tab per launch, and drop "workers" from the profile';
+    return {
+        details: outcome.details,
+        fix: outcome.fix === null ? fix : `${outcome.fix}; ${fix}`,
+        status: 'warn',
+        summary: outcome.status === 'ok' ? `${outcome.summary}, but ${moved}` : `${outcome.summary}; ${moved}`,
+    };
 }
 // The launch's worktree stages on a throwaway worktree (manager.ts launchWorker): `git worktree add`
 // from origin/<base>, the local files and setup, with ports as the broker would give them, then the
 // skills check and the trust probe a launch's `claude --bg` meets (ATK-571). Whatever it made is
 // removed, whichever way it went.
-async function worktreeCheck(deps, root, profile, options) {
+async function worktreeCheck(deps, { clone, dir }, profile, options) {
     if (!options.worktree)
         return skip('--no-worktree');
     const name = `conduct-check-${stamp((deps.now ?? (() => new Date()))())}`;
-    const left = worktreePath(root, name);
+    const left = join(dir, name);
     // The ports check reports a pool with too few free; setup then runs without them.
     const env = portEnv(await deps.ports.previewPorts(profile.ports).catch(() => ({})));
     let outcome;
     try {
         const path = await deps.worktrees.create({
             base: profile.baseBranch,
+            clone,
             env: { ...env, CONDUCTOR_ITEM: name, CONDUCTOR_PROJECT: profile.name, CONDUCTOR_WORKTREE: left },
             ...(profile.localFilesFrom === undefined ? {} : { localFilesFrom: profile.localFilesFrom }),
             name,
-            root,
+            path: left,
             sessionEnv: env,
             setup: profile.setup,
         });
@@ -457,7 +519,7 @@ async function worktreeCheck(deps, root, profile, options) {
         const ignored = await (deps.ignores ?? gitIgnores)(path, SESSION_SETTINGS);
         const made = `created ${name} from origin/${profile.baseBranch}${profile.setup.length > 0 ? ` and ran its ${profile.setup.length} setup ${profile.setup.length === 1 ? 'command' : 'commands'}` : ''}, then removed it`;
         if (problem !== null) {
-            outcome = fail(`a new worktree's skills: ${problem}`, "add what installs them to the profile's setup (ATK's runs atk install), or install them in ~/.claude/skills");
+            outcome = fail(`${MISSING_SKILLS} ${problem}`, "add what installs them to the profile's setup, or install them in ~/.claude/skills");
         }
         else {
             // Before the remove below: the probe's session is gone before its directory is.
@@ -470,9 +532,9 @@ async function worktreeCheck(deps, root, profile, options) {
             }
             outcome =
                 'error' in trust
-                    ? fail(`claude --bg couldn't start a session in a new worktree: ${messageOf(trust.error)}`, 'a launch fails the same way: run `claude --bg` in a worktree of the root to see why', detailsOf(trust.error))
+                    ? fail(`claude --bg couldn't start a session in a new worktree: ${messageOf(trust.error)}`, 'a launch fails the same way: run `claude --bg` in a worktree of the clone to see why', detailsOf(trust.error))
                     : !trust.trusted
-                        ? fail(`Claude Code doesn't trust ${root}, so no worker can start in its worktrees`, `${trustStep(root)}, then check again`)
+                        ? fail(`Claude Code doesn't trust ${clone}, so no worker can start in its worktrees`, `${trustStep(clone)}, then check again`)
                         : trust.removeError !== null
                             ? warn(`${made}, but the trust probe's idle session ${trust.session} is still there`, `remove it: claude rm ${trust.session}`, [trust.removeError])
                             : !ignored && Object.keys(env).length > 0
@@ -486,10 +548,10 @@ async function worktreeCheck(deps, root, profile, options) {
     // A create that failed part way can leave its directory or branch behind; with neither, this
     // removes nothing.
     try {
-        await deps.worktrees.remove(root, left, { deleteBranch: true });
+        await deps.worktrees.remove(left, { deleteBranch: true, repo: clone });
     }
     catch (error) {
-        return fail(`${left} is still there: ${messageOf(error)}`, `remove it by hand: delete the directory, then git -C ${root} worktree prune and git -C ${root} branch -D ${BRANCH_PREFIX}${name}`, [
+        return fail(`${left} is still there: ${messageOf(error)}`, `remove it by hand: delete the directory, then git -C ${clone} worktree prune and git -C ${clone} branch -D ${BRANCH_PREFIX}${name}`, [
             `before that: ${outcome.status} ${outcome.summary}`,
             ...outcome.details,
             ...(outcome.fix === null ? [] : [`its fix: ${outcome.fix}`]),