@joshuafolkken/kit 1.1471.0 → 1.1784.0

package/scripts/agent/agent-safe-text.ts

@@ -0,0 +1,60 @@
+// The text an agent launch may carry: a model id, an effort and a prompt, refused when empty, over
+// length or carrying a control character, so nothing a value holds can inject a further argument.
+
+const FIRST_PRINTABLE_CODE = 0x20
+const DELETE_CODE = 0x7f
+const FIRST_CODE_POINT = 0
+const EMPTY_LENGTH = 0
+const MAX_VALUE_LENGTH = 4096
+const LINE_FEED = '\n'
+const SPACE = ' '
+
+function is_control_character(character: string): boolean {
+	const code = character.codePointAt(FIRST_CODE_POINT) ?? FIRST_PRINTABLE_CODE
+
+	return code < FIRST_PRINTABLE_CODE || code === DELETE_CODE
+}
+
+function is_line_feed(character: string): boolean {
+	return character === LINE_FEED
+}
+
+function is_never_allowed(): boolean {
+	return false
+}
+
+function is_refused(character: string, is_allowed: (character: string) => boolean): boolean {
+	return is_control_character(character) && !is_allowed(character)
+}
+
+function is_safe_text(value: string, is_allowed: (character: string) => boolean): boolean {
+	if (value.length === EMPTY_LENGTH || value.length > MAX_VALUE_LENGTH) return false
+
+	for (const character of value) if (is_refused(character, is_allowed)) return false
+
+	return true
+}
+
+function is_safe_value(value: string): boolean {
+	return is_safe_text(value, is_never_allowed)
+}
+
+// **An agent's prompt is the one value a line break belongs in.** A ship-stop prompt carries the failed
+// output's lines (joshuafolkken/kit#3964); every other control character is refused as in any value.
+function is_safe_prompt(value: string): boolean {
+	return is_safe_text(value, is_line_feed)
+}
+
+function printable_character(character: string): string {
+	return is_refused(character, is_line_feed) ? SPACE : character
+}
+
+// Command output made fit for a prompt: every control character but a line break becomes a space, so
+// the text passes `is_safe_prompt` whatever the command printed.
+function printable(text: string): string {
+	return Array.from(text, printable_character).join('')
+}
+
+const agent_safe_text = { MAX_VALUE_LENGTH, is_safe_prompt, is_safe_value, printable }
+
+export { agent_safe_text }

package/scripts/agent/api-auth.ts

@@ -0,0 +1,41 @@
+import { agent_exit_record } from './agent-exit-record'
+import type { ClaudeResultEvent } from './claude-result-event'
+
+// Whether a Claude session's exit record is an authentication failure — measured on 2026-10-19, when
+// an expired OAuth session ended three lane children with `Failed to authenticate: OAuth session
+// expired and could not be refreshed` and the parent parked each as a child that stopped on its own
+// (joshuafolkken/kit#4216).
+//
+// **Kept apart from `api-outage.ts`**: an outage clears on its own, so its child is re-dispatched; an
+// authentication failure lasts until a person runs `/login`, so every dispatch fails the same way and
+// the run has to stop instead. The read is the same mechanical one — the error flag AND a fixed
+// marker in the harness's own `reason`, never the marker alone.
+
+// Matched against `reason`, which carries the record's `result` text — the observed record's
+// `error: 'authentication_failed'` code is not decoded, so it is no marker here.
+const AUTH_MARKERS: ReadonlyArray<string> = ['failed to authenticate']
+
+// The fixed sentence a stop caused by an authentication failure carries, so the tooling that reads a
+// stop back (`run-ship-stop-cause.ts`) tells it from a review finding by this text, not by guessing.
+const AUTH_FAILURE_NOTE = 'the session could not authenticate — a person has to run /login'
+
+function is_auth_failure(record: ClaudeResultEvent | undefined): boolean {
+	if (record === undefined || !record.is_error || record.reason === undefined) return false
+
+	const lower = record.reason.toLowerCase()
+
+	return AUTH_MARKERS.some((marker) => lower.includes(marker))
+}
+
+// The same read over a whole stream-json transcript, such as a reviewer's log: its last exit record.
+// The log is appended across launches, so it is read only when it ends on an exit record: a later
+// session that died before writing its own leaves an earlier session's record behind it — not read.
+function is_auth_failed_transcript(transcript: string | undefined): boolean {
+	if (transcript === undefined || !agent_exit_record.ends_on_exit_record(transcript)) return false
+
+	return is_auth_failure(agent_exit_record.read_exit_record(transcript))
+}
+
+const api_auth = { AUTH_FAILURE_NOTE, is_auth_failed_transcript, is_auth_failure }
+
+export { api_auth }

package/scripts/agent/api-outage.ts

@@ -4,7 +4,7 @@ import type { ClaudeResultEvent } from './claude-result-event'
 // stopped mid-implementation on its own. Measured twice: on 2026-09-15 four
 // children ended `The socket connection was closed unexpectedly`, and on 2026-09-21 a child spent all
 // ten connection retries on `Unable to connect to API (ConnectionRefused)`. The parent read both as
-// ordinary failures — `in-progress` stripped, `needs-decision` applied, counted against the
+// ordinary failures — `in-progress` stripped, a park label applied, counted against the
 // consecutive-failure guard — when the child never reached the API at all.
 //
 // **The read is mechanical, never a similarity judgement.** A terminal `result` event that ends in

package/scripts/agent/claude-agent-argv.ts

@@ -6,6 +6,7 @@ import {
 	type AgentProfile,
 	type AgentRole,
 } from './agent-role-profile'
+import { lane_instructions } from './lane-instructions'
 
 const AGENT_COMMAND = 'claude'
 // **The permission mode is passed, not left to the checkout's `.claude/settings.json`.** Claude Code
@@ -63,6 +64,7 @@ const PROJECT_MCP_FILE = '.mcp.json'
 interface ClaudeArgv {
 	command: string
 	args: ReadonlyArray<string>
+	ends_with_prompt: true
 }
 
 type ClaudeArgvResult =
@@ -87,6 +89,14 @@ function tool_flags(cwd: string = process.cwd()): ReadonlyArray<string> {
 	return [TOOLS_FLAG, LAUNCHED_TOOLS.join(','), ...mcp_flags]
 }
 
+// **A lane child and a review session start from the lane instruction set** (`lane-instructions.ts`);
+// the scheduler keeps `CLAUDE.md`, because it is the one that stops and asks a person.
+function instruction_flags(profile: AgentProfile, cwd?: string): ReadonlyArray<string> {
+	if (profile.role === agent_role_profile.SCHEDULER) return []
+
+	return lane_instructions.flags(cwd)
+}
+
 function build(
 	invocation: string,
 	profile: AgentProfile,
@@ -98,6 +108,7 @@ function build(
 		args: [
 			...AGENT_FLAGS,
 			...tool_flags(cwd),
+			...instruction_flags(profile, cwd),
 			...session_id_flags(session_id),
 			MODEL_FLAG,
 			profile.model,
@@ -105,6 +116,7 @@ function build(
 			profile.effort,
 			invocation,
 		],
+		ends_with_prompt: true,
 	}
 }
 
@@ -121,6 +133,7 @@ function build_resume(
 		args: [
 			...AGENT_FLAGS,
 			...tool_flags(cwd),
+			...instruction_flags(profile, cwd),
 			RESUME_FLAG,
 			session_id,
 			MODEL_FLAG,
@@ -129,6 +142,7 @@ function build_resume(
 			profile.effort,
 			invocation,
 		],
+		ends_with_prompt: true,
 	}
 }
 

package/scripts/agent/codex-agent-argv.ts

@@ -19,6 +19,7 @@ const LEDGER_DIRECTORY = path.dirname(OBSERVATION_LEDGER_DIRECTORY)
 interface CodexArgv {
 	command: string
 	args: ReadonlyArray<string>
+	ends_with_prompt: true
 }
 
 function effort_config(profile: AgentProfile): string {
@@ -91,6 +92,7 @@ function build(invocation: string, profile: AgentProfile, cwd?: string): CodexAr
 			JSON_FLAG,
 			invocation,
 		],
+		ends_with_prompt: true,
 	}
 }
 

package/scripts/agent/lane-instructions.ts

@@ -0,0 +1,144 @@
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { cost_tokens } from '#scripts/cost-runtime/cost-tokens'
+import { document_section } from '#scripts/document/document-section'
+import { distributed_paths } from '#scripts/init/distributed-paths'
+import { find_package_directory } from '#scripts/josh/package-directory'
+import { stamp_file } from '#scripts/josh/stamp-file'
+
+interface LaneSet {
+	text: string
+	rules_path: string
+}
+
+// **A headless lane child or review session starts from the lane instruction set, not `CLAUDE.md`.**
+// `CLAUDE.md` carries rules only an interactive session can act on — consultation versus execution,
+// explicit workflow invocation, stop notifications — and every request re-reads it. The lane document
+// names the rules a lane does need by `CLAUDE.md` heading or bold label, and each `include` line is
+// expanded from the launch checkout's own `CLAUDE.md` here, so the rule text keeps one source (#3929).
+const LANE_DOCUMENT = 'prompts/collaboration-workflow/lane-instructions.md'
+const RULES_FILE = 'CLAUDE.md'
+// `AGENTS.md` only points at `CLAUDE.md`, and Claude Code loads it once `CLAUDE.md` is excluded.
+const POINTER_FILE = 'AGENTS.md'
+const INCLUDE_PATTERN = /^<!-- include: CLAUDE\.md → "(?<wanted>.+)" -->$/u
+const PROMPT_FILE_FLAG = '--append-system-prompt-file'
+const SETTINGS_FLAG = '--settings'
+const PROMPT_FILE_PREFIX = 'josh-lane-instructions-'
+const PROMPT_FILE_SUFFIX = '.md'
+const PACKAGE_DIRECTORY = find_package_directory(path.dirname(fileURLToPath(import.meta.url)))
+
+// An include that resolves to nothing is `undefined`, never an empty string, so a renamed heading
+// fails the whole composition rather than silently dropping a rule.
+function expand_line(line: string, rules: string): string | undefined {
+	const wanted = INCLUDE_PATTERN.exec(line)?.groups?.['wanted']
+
+	if (wanted === undefined) return line
+
+	return document_section.section(rules, wanted)?.text
+}
+
+function compose(lane_markdown: string, rules: string): string | undefined {
+	const expanded = lane_markdown.split('\n').map((line) => expand_line(line, rules))
+
+	if (expanded.includes(undefined)) return undefined
+
+	return expanded.join('\n')
+}
+
+// **Where the rules are: the checkout's `CLAUDE.md`, else the package copy it imports.** kit and a
+// consumer holding a full copy keep them in `CLAUDE.md`; a consumer written by `josh init` imports
+// them from the package, and its own `CLAUDE.md` — the bootstrap note and the project's additions —
+// stays loaded, because only the file the set was composed from is excluded.
+function rules_sources(cwd: string): ReadonlyArray<string> {
+	const imported = distributed_paths.CLAUDE_MD_IMPORT_LINE.replace(/^@/u, '')
+
+	return [path.join(cwd, RULES_FILE), path.join(cwd, imported)]
+}
+
+function composed_from(lane_markdown: string, rules_path: string): string | undefined {
+	const rules = document_section.read_optional(rules_path)
+
+	return rules === undefined ? undefined : compose(lane_markdown, rules)
+}
+
+function composed_set(cwd: string, package_directory: string): LaneSet | undefined {
+	const lane_markdown = document_section.read_optional(path.join(package_directory, LANE_DOCUMENT))
+
+	if (lane_markdown === undefined) return undefined
+
+	for (const rules_path of rules_sources(cwd)) {
+		const text = composed_from(lane_markdown, rules_path)
+
+		if (text !== undefined) return { text, rules_path }
+	}
+
+	return undefined
+}
+
+function composed_in(
+	cwd: string,
+	package_directory: string = PACKAGE_DIRECTORY,
+): string | undefined {
+	return composed_set(cwd, package_directory)?.text
+}
+
+// Named by its content and this account, so concurrent launches of the same text share one file and a
+// changed `CLAUDE.md` never reuses a stale one. The name is predictable in a temp directory other
+// accounts may write to, so an existing file is reused only when it is this account's own regular file
+// holding exactly this text; anything else is replaced through `stamp_file`, which refuses another
+// account's file and renames a new one into place whole. A file rather than the text itself, because
+// the launcher refuses a line break in any argv element but the prompt.
+function written(text: string): string | undefined {
+	const file_path = stamp_file.stamp_path(PROMPT_FILE_PREFIX, text, PROMPT_FILE_SUFFIX)
+
+	if (stamp_file.read_stamp_text(file_path) === text) return file_path
+
+	try {
+		return stamp_file.replace_text_stamp(file_path, text)
+	} catch {
+		return undefined
+	}
+}
+
+function excluded_settings(rules_path: string, cwd: string): string {
+	return JSON.stringify({ claudeMdExcludes: [rules_path, path.join(cwd, POINTER_FILE)] })
+}
+
+// No flags when the set cannot be composed or safely written: the child then loads `CLAUDE.md` as
+// before, which costs tokens but never loses a rule.
+function flags(cwd: string = process.cwd()): ReadonlyArray<string> {
+	const set = composed_set(cwd, PACKAGE_DIRECTORY)
+	const prompt_file = set === undefined ? undefined : written(set.text)
+
+	if (set === undefined || prompt_file === undefined) return []
+
+	return [PROMPT_FILE_FLAG, prompt_file, SETTINGS_FLAG, excluded_settings(set.rules_path, cwd)]
+}
+
+function tokens_of(text: string): string {
+	return cost_tokens.estimate(text).toLocaleString('en-US')
+}
+
+// `read:set lane-child`'s resident line: what each lane request carries in place of the rules file.
+function rules_tokens(rules_path: string): string {
+	return tokens_of(document_section.read_optional(rules_path) ?? '')
+}
+
+function resident_line(cwd: string = process.cwd()): string {
+	const set = composed_set(cwd, PACKAGE_DIRECTORY)
+	const rules = rules_tokens(set?.rules_path ?? path.join(cwd, RULES_FILE))
+	const lane_tokens = set === undefined ? 'not composed' : `${tokens_of(set.text)} tok`
+
+	return `  resident: lane instructions ${lane_tokens} in place of ${RULES_FILE} ${rules} tok`
+}
+
+const lane_instructions = {
+	PROMPT_FILE_FLAG,
+	SETTINGS_FLAG,
+	compose,
+	composed_in,
+	flags,
+	resident_line,
+}
+
+export { lane_instructions }

package/scripts/auto-ok/auto-ok-cli.ts

@@ -1,5 +1,3 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
 import { epic_bundle_gaps } from '#scripts/epic/epic-bundle-gaps'
 import { epic_index, type FetchedEpics } from '#scripts/epic/epic-index'
 import { epic_issue } from '#scripts/epic/epic-issue'
@@ -10,6 +8,8 @@ import { cutoff_cause, cutoff_of, type ScanCutoff } from '#scripts/git/listing-c
 import { read_json_listing } from '#scripts/git/parse-json-array'
 import { git_next_issues } from '#scripts/issue/git-next-issues'
 import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
+import { issue_not_before } from '#scripts/issue/issue-not-before'
+import { issue_sample_gate } from '#scripts/issue/issue-sample-gate'
 import { session_cite } from '#scripts/issue/session-cite'
 
 // `josh auto-ok:next` — which issue outside the epic an unattended run picks up next.
@@ -20,7 +20,6 @@ import { session_cite } from '#scripts/issue/session-cite'
 // nothing checks it. The contract is `epic:next`'s: one token on standard output, every explanation
 // on standard error, so `answer=$(pnpm josh auto-ok:next)` reads it.
 
-const ARGV_OFFSET = 2
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const EXCLUDE_FLAG = '--exclude'
@@ -210,7 +209,11 @@ async function fetch_opted_in(): Promise<OptedInRead> {
 		LISTING_LIMIT,
 	)
 
-	return json === undefined ? await classify_failed_read() : parse_listing(json, is_capped)
+	const read = json === undefined ? await classify_failed_read() : parse_listing(json, is_capped)
+
+	if (read.kind === 'read') await issue_sample_gate.prime(read.issues.map((issue) => issue.body))
+
+	return read
 }
 
 // Whether every issue this one declares as a blocker has closed. `blockedBy` is the same native
@@ -331,10 +334,15 @@ function is_runnable(
 	issue: OpenIssueData,
 	tracked: ReadonlyMap<number, number>,
 	exclude: ReadonlyArray<number>,
+	now: number = Date.now(),
 ): boolean {
 	if (tracked.has(issue.number)) return false
 
-	return is_unblocked(issue) && !exclude.includes(issue.number)
+	return (
+		is_unblocked(issue) &&
+		!exclude.includes(issue.number) &&
+		issue_not_before.is_due(issue.body, now)
+	)
 }
 
 function pick_next(
@@ -351,7 +359,7 @@ function pick_next(
 function none_reason(count: number): string {
 	if (count === 0) return NONE_OPTED_IN_MESSAGE
 
-	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, blocked by an open issue, or the one just merged.`
+	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, blocked by an open issue, not due until its start time, or the one just merged.`
 }
 
 // Said only when the cap actually bit, and worded from the answer rather than before it: the one run
@@ -457,14 +465,6 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 	return await answer(read, options.exclude)
 }
 
-// `process.exitCode` rather than `process.exit()`: the answer is written with `console.info`, and on
-// macOS a write to a pipe is asynchronous — `process.exit()` can tear the process down before it has
-// drained, and this command's whole contract is `answer=$(pnpm josh auto-ok:next)`. The same shape
-// is already in `scripts/cost-runtime/cost-cli.ts`, which met the truncation first.
-async function main(argv: ReadonlyArray<string>): Promise<void> {
-	process.exitCode = await run(argv)
-}
-
 const auto_ok_cli = {
 	USAGE,
 	NONE_TOKEN,
@@ -486,7 +486,5 @@ const auto_ok_cli = {
 	run,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
-
 export { auto_ok_cli }
 export type { NextOptions, OptedInRead, PickupContext, TrackingRead }

package/scripts/auto-ok/auto-ok-judge-read.ts

@@ -1,3 +1,4 @@
+import { gh_author_association } from '#scripts/gh/gh-author-association'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { issue_label_schema } from '#scripts/git/git-schemas'
 import { read_json_listing } from '#scripts/git/parse-json-array'
@@ -25,6 +26,8 @@ const row_schema = z.looseObject({
 	body: z.string().nullish(),
 	labels: z.array(issue_label_schema),
 	updatedAt: z.string(),
+	author_association: z.string().nullish(),
+	user: z.looseObject({ login: z.string() }).nullish(),
 })
 
 interface JudgeRow extends JudgeIssue {
@@ -35,13 +38,17 @@ interface JudgeRow extends JudgeIssue {
 // An issue's number to the `updatedAt` it was last seen judged at.
 type JudgedCache = Map<number, string>
 
-function to_row(raw: z.infer<typeof row_schema>): JudgeRow {
+async function to_row(raw: z.infer<typeof row_schema>): Promise<JudgeRow> {
 	return {
 		number: raw.number,
 		title: raw.title,
 		body: raw.body ?? '',
 		labels: raw.labels.map((label) => label.name),
 		updated_at: raw.updatedAt,
+		is_trusted: await gh_author_association.is_trusted({
+			login: raw.user?.login,
+			association: raw.author_association,
+		}),
 	}
 }
 
@@ -55,7 +62,9 @@ async function read_candidates(): Promise<ReadonlyArray<JudgeRow> | undefined> {
 
 	if (listing.kind !== 'read') return undefined
 
-	return listing.rows.map((raw) => to_row(raw)).filter((row) => auto_ok_judge.is_candidate(row))
+	const rows = await Promise.all(listing.rows.map(async (raw) => await to_row(raw)))
+
+	return rows.filter((row) => auto_ok_judge.is_candidate(row))
 }
 
 // `true` only for an issue known to owe a judgement: a failed comment read learns nothing, so it is
@@ -63,7 +72,7 @@ async function read_candidates(): Promise<ReadonlyArray<JudgeRow> | undefined> {
 async function owes_judgement(row: JudgeRow, cache: JudgedCache): Promise<boolean> {
 	if (cache.get(row.number) === row.updated_at) return false
 
-	const comments = issue_watch_diff.parse_comments(
+	const comments = await issue_watch_diff.parse_comments(
 		await git_gh_command.issue_list_comments(String(row.number)),
 	)
 

package/scripts/auto-ok/auto-ok-judge-write.ts

@@ -2,11 +2,8 @@ import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { issue_label_schema } from '#scripts/git/git-schemas'
 import { parse_json_object_or_undefined } from '#scripts/git/parse-json-array'
 import { issue_auto_ok, type AutoOkDecision } from '#scripts/issue/issue-auto-ok'
-import { issue_cite } from '#scripts/issue/issue-cite'
-import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
+import { AUTO_OK_LABEL, has_label_name } from '#scripts/issue/issue-labels'
 import { session_cite } from '#scripts/issue/session-cite'
-import { run_event_stream } from '#scripts/run/event/run-event-stream'
-import { run_event_stream_emit } from '#scripts/run/event/run-event-stream-emit'
 import { z } from 'zod'
 import { auto_ok_judge } from './auto-ok-judge'
 
@@ -14,17 +11,30 @@ import { auto_ok_judge } from './auto-ok-judge'
 //
 // **An applied judgement still passes the mechanical exclusions** — `issue_auto_ok.exclusion_of` is
 // re-read against the labels as they stand, so a label added since the listing refuses the write
-// rather than racing it. **The run label lands before `auto-ok`**, so the pool never holds an opted-in
-// issue that `backlog:next` would withhold as untriaged. Both answers leave the judgement comment the
-// next listing reads as the record, and an applied one is a `note` on the board's 📌.
+// rather than racing it. **The judgement comment lands before the labels**: a re-run skips an issue
+// that already carries `auto-ok`, so a comment failing after the labels would never be retried, while
+// a label failing after the comment leaves `auto-ok` off and the issue open to an explicit
+// `--apply <N>` — the refusal names it, since the listing reads the comment as judged. **The
+// run label lands before `auto-ok`**, so the pool never holds an opted-in issue that `backlog:next`
+// would withhold as untriaged. Both answers leave the judgement comment the next listing reads as the
+// record; an applied one writes nothing to the run board, which shows the issue once it is dispatched
+// (joshuafolkken/kit#4133).
 
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const UNREADABLE = 'the issue could not be read'
+const CLOSED_STATE = 'CLOSED'
+// The judgement comment is already posted, so the listing will not offer the issue again.
+const RETRY_HINT = 're-run `pnpm josh auto-ok:judge --apply <N>` to finish it'
 
-const issue_schema = z.object({ labels: z.array(issue_label_schema), body: z.string().nullish() })
+const issue_schema = z.object({
+	state: z.string().nullish(),
+	labels: z.array(issue_label_schema),
+	body: z.string().nullish(),
+})
 
 interface IssueRead {
+	is_closed: boolean
 	labels: ReadonlyArray<string>
 	body: string
 }
@@ -35,7 +45,21 @@ async function read_issue(issue: string): Promise<IssueRead | undefined> {
 
 	if (parsed === undefined) return undefined
 
-	return { labels: parsed.labels.map((label) => label.name), body: parsed.body ?? '' }
+	return {
+		is_closed: parsed.state === CLOSED_STATE,
+		labels: parsed.labels.map((label) => label.name),
+		body: parsed.body ?? '',
+	}
+}
+
+// Why an apply has nothing to write: a closed issue is past the pool, and one already opted in was
+// judged once — writing again would repeat the comment (joshuafolkken/kit#4097).
+function settled_of(read: IssueRead): string | undefined {
+	if (read.is_closed) return 'the issue is closed'
+
+	return has_label_name(read.labels, AUTO_OK_LABEL)
+		? `\`${AUTO_OK_LABEL}\` is already applied`
+		: undefined
 }
 
 async function apply_labels(issue: string, run_label: string): Promise<string | undefined> {
@@ -74,18 +98,15 @@ async function apply_to(issue: string, run_label: string, read: IssueRead): Prom
 
 	if (exclusion !== undefined) return refused(issue, issue_auto_ok.line_of(exclusion))
 
-	const problem = await apply_labels(issue, run_label)
-
-	if (problem !== undefined) return refused(issue, problem)
-
 	const reason = `judged by backlogrun: no exclusion holds and no person's judgement is needed (${run_label})`
 
-	await run_event_stream_emit.emit(
-		run_event_stream.EVENT_KIND.NOTE,
-		`${issue_cite.plain(issue)} auto-ok applied (${run_label})`,
-	)
+	if ((await record(issue, { is_applied: true, reason }, read.body)) !== SUCCESS_EXIT_CODE) {
+		return FAILURE_EXIT_CODE
+	}
+
+	const problem = await apply_labels(issue, run_label)
 
-	return await record(issue, { is_applied: true, reason }, read.body)
+	return problem === undefined ? SUCCESS_EXIT_CODE : refused(issue, `${problem}; ${RETRY_HINT}`)
 }
 
 async function apply(issue: string, run_label: string): Promise<number> {
@@ -93,7 +114,13 @@ async function apply(issue: string, run_label: string): Promise<number> {
 
 	if (read === undefined) return refused(issue, UNREADABLE)
 
-	return await apply_to(issue, run_label, read)
+	const settled = settled_of(read)
+
+	if (settled === undefined) return await apply_to(issue, run_label, read)
+
+	console.info(`${session_cite.issue(issue)}: nothing to apply — ${settled}`)
+
+	return SUCCESS_EXIT_CODE
 }
 
 async function decline(issue: string, reason: string): Promise<number> {

package/scripts/auto-ok/auto-ok-judge.ts

@@ -14,11 +14,16 @@ import type { WatchComment } from '#scripts/issue/issue-watch-diff'
 // **The record is the judgement comment itself.** It carries a digest of the body it judged, so an
 // issue is judged again only when its body changed or a person commented after it — the same line
 // `issue_watch_diff` draws between a person's update and an automated one.
+//
+// **Only an author with write access is read** (`gh_author_association`, joshuafolkken/kit#4021): an
+// issue anyone else filed is never a candidate, and a judgement comment or a later comment from anyone
+// else is not counted, so a third party can neither opt an issue in nor mark one judged.
 
 interface JudgeIssue {
 	number: number
 	labels: ReadonlyArray<string>
 	body: string
+	is_trusted: boolean
 }
 
 const MARKER_PREFIX = '<!-- josh:auto-ok-judged body='
@@ -29,7 +34,7 @@ const CRLF = '\r\n'
 const LF = '\n'
 
 function is_candidate(issue: JudgeIssue): boolean {
-	if (has_label_name(issue.labels, AUTO_OK_LABEL)) return false
+	if (!issue.is_trusted || has_label_name(issue.labels, AUTO_OK_LABEL)) return false
 
 	return issue_auto_ok.exclusion_of(issue.labels) === undefined
 }
@@ -42,9 +47,15 @@ function body_digest(body: string): string {
 }
 
 function digest_of(comment: WatchComment): string | undefined {
+	if (!comment.is_trusted) return undefined
+
 	return MARKER_PATTERN.exec(comment.body)?.groups?.['digest']
 }
 
+function is_person_comment(comment: WatchComment): boolean {
+	return comment.is_trusted === true && !comment.is_automated
+}
+
 // Judged when the newest judgement comment covers the body as it stands and no person has commented
 // since. A failed comment read never reaches here — the caller treats it as nothing learned.
 function is_judged(body: string, comments: ReadonlyArray<WatchComment>): boolean {
@@ -52,7 +63,7 @@ function is_judged(body: string, comments: ReadonlyArray<WatchComment>): boolean
 
 	if (judgement === undefined || digest_of(judgement) !== body_digest(body)) return false
 
-	return comments.every((comment) => comment.id <= judgement.id || comment.is_automated)
+	return comments.every((comment) => comment.id <= judgement.id || !is_person_comment(comment))
 }
 
 function comment_of(decision: AutoOkDecision, body: string): string {

package/scripts/auto-ok/auto-ok-main.ts

@@ -0,0 +1,17 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { auto_ok_cli } from './auto-ok-cli'
+
+// The `josh auto-ok:next` entry, kept apart from `auto-ok-cli.ts` because other modules import that
+// one: a bundle is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186).
+//
+// `process.exitCode` rather than `process.exit()`: the answer is written with `console.info`, and on
+// macOS a write to a pipe is asynchronous — `process.exit()` can tear the process down before it has
+// drained, and this command's whole contract is `answer=$(pnpm josh auto-ok:next)`. The same shape
+// is already in `scripts/cost-runtime/cost-main.ts`, which met the truncation first.
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = await auto_ok_cli.run(process.argv.slice(ARGV_OFFSET))
+}