@hasna/todos 0.11.65 → 0.11.67

package/README.md

@@ -283,7 +283,7 @@ todos extract-watch . --dry-run --max-runs 1 --json
 
 Created tasks are tagged with `extracted` and linked back to the source file.
 MCP clients can call `extract_todos` and `watch_source_todos` for the same
-offline workflow; no hosted code search, cloud sync, or telemetry is used.
+offline workflow; no hosted code search, hosted sync, or telemetry is used.
 
 ## Local Editor Integrations
 
@@ -339,6 +339,34 @@ MCP clients can use `require_approval_gate`, `approve_approval_gate`,
 `list_approval_gates`. Gate events are written to task audit history and, when
 a run is linked, to the local run ledger.
 
+### OpenAutomations Approval And Evidence Handoff
+
+OpenAutomations approval gates can be mirrored to Todos approval gates when an
+automation action affects external systems, spends money, mutates production
+state, or needs human consent. Use the automation run id as the linked run or
+metadata reference, and keep the approval decision id in task/run evidence:
+
+```bash
+todos approvals require <task-id> automation:<action-id> \
+  --requester automations \
+  --reviewer operator \
+  --reason "OpenAutomations action requires consent"
+todos approvals approve <task-id> automation:<action-id> \
+  --reviewer operator \
+  --note "Approved action execution"
+todos record-verification <task-id> "automations queue complete <action-id>" \
+  --status passed \
+  --summary "Action completed by runner open-loops:<worker-id>"
+```
+
+Todos owns task approvals, task comments, verification evidence, audit-ledger
+checkpoints, and release evidence. OpenAutomations owns automation specs,
+action queue leases, DLQ/replay, and action approval state. Store only redacted
+summaries, action ids, run ids, decision ids, artifact paths, and verification
+commands in Todos; do not store raw event payloads, secret values, connector
+tokens, or full action inputs unless the task explicitly requires them and they
+have been redacted.
+
 ## Local Review Queues
 
 Review queues turn local task review into an explicit agent workflow: request a
@@ -401,52 +429,53 @@ MCP clients can use `set_local_event_hook`, `list_local_event_hooks`,
 `test_local_event_hook`, and `remove_local_event_hook`. Hook delivery is
 local-only; it does not call hosted webhooks or cloud automation services.
 
-## Shared Event Webhooks
-
-Task lifecycle changes also emit shared `@hasna/events` events with source
-`todos`. Use `todos webhooks` for durable command or webhook subscriptions. This
-is the preferred bridge for automation that should react to new tasks without
-polling:
-
-```bash
-todos webhooks add loops \
-  --id openloops-task-created \
-  --transport command \
-  --source todos \
-  --type task.created \
-  --metadata 'project_path=/home/hasna/workspace/hasna/opensource/*' \
-  --metadata-json 'route_enabled=true' \
-  --metadata-json 'automation.no_auto!=true' \
-  --metadata-json 'automation.manual_required!=true' \
-  --metadata-json 'automation.requires_approval!=true' \
-  --metadata-json 'automation.approval_required!=true' \
-  --arg=events \
-  --arg=handle \
-  --arg=todos-task \
-  --arg=--provider \
-  --arg=codewith \
-  --arg=--auth-profile-pool \
-  --arg=account004,account005,account006 \
-  --arg=--permission-mode \
-  --arg=bypass \
-  --arg=--sandbox \
-  --arg=danger-full-access \
-  --arg=--worktree-mode \
-  --arg=required \
-  --timeout-ms 900000 \
+## Shared Task Events And Route State
+
+Task lifecycle changes emit shared `@hasna/events` events with source `todos`.
+Todos is the human-visible task ledger: it emits task intent, routing gates, and
+workflow artifact pointers. OpenEvents owns durable channel delivery/replay, and
+OpenLoops owns workflow admission, work-item leases, agent execution, evaluator
+cycles, and run manifests.
+
+Use `project-bootstrap --route-enabled` to opt a project task list into
+task-created routing, then inspect route state with deterministic JSON before a
+route or workflow starts:
+
+```bash
+todos project-bootstrap . --route-enabled --json
+todos ready --json
+todos task route-state <task-id> --json
+```
+
+`todos ready --json` includes a `route_state` object for each pending unblocked
+task. `route_state.schema_version` is `todos.task_route_state.v1`. It exposes
+`eligible`, denial `reasons`, dependency blockers, route context, boolean gates,
+and compact OpenLoops pointers:
+
+- `current_workflow_invocation_id`
+- `current_run_id`
+- `latest_manifest_path`
+- `latest_evaluation_path`
+- `workflow_state`
+
+OpenLoops updates those pointers after admission or evaluator progress:
+
+```bash
+todos task workflow-pointers <task-id> \
+  --invocation <workflow-invocation-id> \
+  --run <workflow-run-id> \
+  --manifest /home/hasna/.hasna/loops/runs/<project>/<subject>/<run>/manifest.json \
+  --state working \
   --json
 ```
 
-When a task is created, `@hasna/events` sends the event JSON on stdin and in
-`HASNA_EVENT_JSON`. OpenLoops uses that event to create a deduped one-shot
-worker/verifier workflow for the task. Use account-profile pools instead of a
-single pinned profile, and require isolated worktrees for repo-mutating routes.
-The event data includes task identity,
-title, description, project/list ids, working directory, tags, metadata, status,
-priority, approval state, and timestamps. Event metadata includes routing-safe
-project/list/path fields, `route_enabled` when the task metadata opts in, and an
-`automation` object containing only boolean routing gates such as `no_auto`,
-`manual_required`, `requires_approval`, and `approval_required`.
+Shared task event data includes task identity, title, description, project/list
+ids, working directory, tags, metadata, status, priority, approval state, and
+timestamps. Event metadata includes routing-safe project/list/path fields,
+`route_enabled` when task or task-list metadata opts in, route-state schema
+version, compact workflow pointers, and an `automation` object containing only
+boolean routing gates such as `no_auto`, `manual_required`,
+`requires_approval`, and `approval_required`.
 
 Production task-created routes should fail closed:
 
@@ -454,14 +483,14 @@ Production task-created routes should fail closed:
   approved routing tag such as `auto:route`.
 - Add negative automation predicates so `no_auto`, manual, and approval-gated
   tasks do not invoke the route.
-- Scope by project path, task list, tags, or repo metadata before invoking
-  OpenLoops.
+- Scope by project path, task list, tags, or repo metadata before invoking an
+  OpenLoops route.
 - Avoid overlapping opt-in channels for the same task family unless the target
-  handler is idempotent. `loops events handle todos-task` dedupes by task id and
+  handler is idempotent. OpenLoops task-event admission dedupes by task id and
   event type, but a narrower subscription still avoids wasted invocations.
 
 For tag opt-in, use a second route with the same deny predicates and
-`--data 'tags=auto:route'` instead of `--metadata-json 'route_enabled=true'`.
+`tags=auto:route` instead of `route_enabled=true`.
 Tasks without one of those opt-ins are intentionally no-route. Local event hooks
 remain available for local-only JSONL/socket/script integrations.
 
@@ -1048,7 +1077,7 @@ todos calendar import team.ics --json
 
 Recurring task rules are mapped into ICS `RRULE` values when possible, and task
 SLA thresholds appear as local calendar events without any Google Calendar,
-hosted API, or cloud sync dependency. MCP clients use `create_calendar_item`,
+hosted API, or hosted sync dependency. MCP clients use `create_calendar_item`,
 `list_calendar_events`, `export_calendar_ics`, and `import_calendar_ics`.
 
 ## Local Saved Search Views