@joshuafolkken/kit 1.1471.0 → 1.1784.0

package/scripts/issue/issue-release-main.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { issue_release_cli } from './issue-release-cli'
+
+// The `josh issue:release` entry, kept apart from `issue-release-cli.ts` because other modules import
+// that one: a bundle is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186). `process.exitCode` rather than `process.exit()`, so the report on standard
+// output drains first.
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = await issue_release_cli.run(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/issue/issue-release.ts

@@ -1,4 +1,5 @@
-import { DEPTH_0_LABEL, RELEASE_LABEL } from './issue-labels'
+import { json_value } from '#scripts/lib/json-value'
+import { RELEASE_LABEL } from './issue-labels'
 
 // The decisions behind `josh issue:release`, kept apart from the command
 // that reads the network so each is a pure answer a test can pin. An Issue whose change reaches a
@@ -20,14 +21,9 @@ function is_listing_row(value: unknown): value is ListingRow {
 // release Issue at a time; were a person to open a second, the oldest is the one the next release
 // closes, so it is the one every new blocker joins.
 function open_release_of(json: string): number | undefined {
-	try {
-		const parsed: unknown = JSON.parse(json)
-		const rows = Array.isArray(parsed) ? parsed.filter((row) => is_listing_row(row)) : []
-
-		return rows.length === 0 ? undefined : Math.min(...rows.map((row) => row.number))
-	} catch {
-		return undefined
-	}
+	const rows = (json_value.parse_array(json) ?? []).filter((row) => is_listing_row(row))
+
+	return rows.length === 0 ? undefined : Math.min(...rows.map((row) => row.number))
 }
 
 function title_of(repo: string): string {
@@ -51,9 +47,8 @@ function body_of(repo: string): string {
 	].join('\n')
 }
 
-// The release label and a depth: the subject of a release is what a consumer touches.
-// Never `auto-ok`.
-const RELEASE_LABELS: ReadonlyArray<string> = [RELEASE_LABEL, DEPTH_0_LABEL]
+// The release label alone — never `auto-ok`.
+const RELEASE_LABELS: ReadonlyArray<string> = [RELEASE_LABEL]
 
 const issue_release = { RELEASE_LABELS, open_release_of, title_of, body_of }
 

package/scripts/issue/issue-sample-gate.ts

@@ -0,0 +1,192 @@
+import { read_pull } from '#scripts/gh/git-gh-pr-read'
+import { git_closes_keyword } from '#scripts/git/git-closes-keyword'
+import { lane_ledger } from '#scripts/lane/lane-ledger'
+import { issue_cite } from './issue-cite'
+import { markdown_section } from './markdown-section'
+
+// joshuafolkken/kit#4414: a follow-up measurement waits on samples, not on the calendar — a busy day
+// collects enough merges before a dated start time, a quiet one not even after it. The body names the
+// pull request whose effect it measures and how many merges the lane ledger must record after that
+// pull request merged; the pickup holds the issue until then. The pull request's own merge is not a
+// sample: `run:merge` records it, keyed by the issue it closes, after GitHub stamps `merged_at`.
+//
+// The readers that hold an issue back are synchronous and see only the body, so the one network fact
+// the wait needs — when the pull request merged — is read ahead by `prime`, once per pull request per
+// process, wherever bodies first arrive. A body nobody primed reads as waiting: offering it early is
+// the defect this guards, and the next primed read releases it.
+
+const BACKGROUND_HEADING = '## 背景'
+const PREFIX = '- 実施可能条件:'
+const CONDITION_PATTERN = /^#(?<pr>[1-9]\d*) のマージ後 (?<count>[1-9]\d*) マージ$/u
+const VALUE_FORMAT = '#<PR> のマージ後 <K> マージ'
+const DECLARATION = `${PREFIX} ${VALUE_FORMAT}`
+const MALFORMED = `\`${PREFIX}\` must read \`${VALUE_FORMAT}\` with K at least 1`
+
+interface Condition {
+	pr: number
+	count: number
+}
+
+type SampleWait =
+	| { kind: 'unread'; pr: number }
+	| { kind: 'unmerged'; pr: number }
+	| { kind: 'short'; pr: number; counted: number; needed: number }
+
+// One pull request as read: `merged_at` absent is one found unmerged, read again as it may merge since.
+// `closes` is the issue its body closes, whose ledger merge is the pull request's own.
+interface PullRead {
+	merged_at: string | undefined
+	closes: number | undefined
+}
+
+interface PrimePorts {
+	pull: (pr: number) => Promise<PullRead>
+	ledger_path: () => Promise<string | undefined>
+}
+
+interface LedgerState {
+	path: string | undefined
+}
+
+// A pull request with no entry was never read.
+
+const pull_by_number = new Map<number, PullRead>()
+const ledger: LedgerState = { path: undefined }
+
+function declared_value(body: string): string | undefined {
+	const background = markdown_section.section_lines(body, BACKGROUND_HEADING).join('\n')
+	const line = markdown_section
+		.unfenced_lines(background)
+		.map((text) => text.trim())
+		.find((text) => text.startsWith(PREFIX))
+
+	return line?.slice(PREFIX.length).trim()
+}
+
+// The declared condition, or `undefined` when there is none or it does not parse — a malformed one is
+// refused by `issue:lint`, and holding a hand-edited one forever would lose the issue silently.
+function condition_of(body = ''): Condition | undefined {
+	const groups = CONDITION_PATTERN.exec(declared_value(body) ?? '')?.groups
+
+	if (groups === undefined) return undefined
+
+	return { pr: Number(groups['pr']), count: Number(groups['count']) }
+}
+
+// The number the declared condition cites, or `undefined` when there is none or it does not parse.
+function cited_number(body: string): number | undefined {
+	return condition_of(body)?.pr
+}
+
+function problems(body: string): ReadonlyArray<string> {
+	const value = declared_value(body)
+
+	return value === undefined || CONDITION_PATTERN.test(value) ? [] : [MALFORMED]
+}
+
+async function read_source(pr: number): Promise<PullRead> {
+	const pull = await read_pull(pr)
+	const closes = git_closes_keyword.parse_closes_issue_number(pull.body ?? undefined)
+
+	return {
+		merged_at: pull.merged_at ?? undefined,
+		closes: closes === undefined ? undefined : Number(closes),
+	}
+}
+
+const DEFAULT_PORTS: PrimePorts = { pull: read_source, ledger_path: lane_ledger.target }
+
+// A failed read stays unread, so the next prime asks again.
+async function remember(pr: number, ports: PrimePorts): Promise<void> {
+	try {
+		pull_by_number.set(pr, await ports.pull(pr))
+	} catch {
+		pull_by_number.delete(pr)
+	}
+}
+
+function is_merge_known(pr: number): boolean {
+	return pull_by_number.get(pr)?.merged_at !== undefined
+}
+
+// Reads ahead what the bodies' conditions need. Nothing is read for bodies that declare none.
+async function prime(
+	bodies: ReadonlyArray<string | undefined>,
+	ports: PrimePorts = DEFAULT_PORTS,
+): Promise<void> {
+	const unread = bodies
+		.map((body) => condition_of(body)?.pr)
+		.filter((pr): pr is number => pr !== undefined && !is_merge_known(pr))
+
+	if (unread.length === 0) return
+
+	ledger.path = await ports.ledger_path()
+	await Promise.all(
+		[...new Set(unread)].map(async (pr) => {
+			await remember(pr, ports)
+		}),
+	)
+}
+
+function merges_after({ merged_at, closes }: PullRead & { merged_at: string }): number {
+	if (ledger.path === undefined) return 0
+
+	const since = Date.parse(merged_at)
+
+	return lane_ledger
+		.read_entries(ledger.path)
+		.filter(
+			(entry) =>
+				entry.kind === lane_ledger.KIND.MERGE &&
+				entry.issue !== closes &&
+				Date.parse(entry.at) > since,
+		).length
+}
+
+// What the body still waits on, or `undefined` when it declares nothing or has its samples.
+function wait_of(body?: string): SampleWait | undefined {
+	const condition = condition_of(body)
+
+	if (condition === undefined) return undefined
+
+	const { pr, count } = condition
+	const pull = pull_by_number.get(pr)
+
+	if (pull === undefined) return { kind: 'unread', pr }
+
+	const { merged_at, closes } = pull
+
+	if (merged_at === undefined) return { kind: 'unmerged', pr }
+
+	const counted = merges_after({ merged_at, closes })
+
+	return counted >= count ? undefined : { kind: 'short', pr, counted, needed: count }
+}
+
+// Why the body waits, for a reader that cites the issue itself.
+function reason_of(wait: SampleWait): string {
+	const pr = issue_cite.plain(wait.pr)
+
+	if (wait.kind === 'unread') return `until the merge of ${pr} is read`
+	if (wait.kind === 'unmerged') return `until ${pr} merges`
+
+	return `${String(wait.counted)}/${String(wait.needed)} merges after ${pr}`
+}
+
+function reset(): void {
+	pull_by_number.clear()
+	ledger.path = undefined
+}
+
+const issue_sample_gate = {
+	DECLARATION,
+	cited_number,
+	prime,
+	problems,
+	reason_of,
+	reset,
+	wait_of,
+}
+
+export type { PrimePorts, SampleWait }
+export { issue_sample_gate }

package/scripts/issue/issue-sample-source.ts

@@ -0,0 +1,76 @@
+import { git_gh_api_path } from '#scripts/gh/git-gh-api-path'
+import { git_gh_exec } from '#scripts/gh/git-gh-exec'
+import { git_gh_issue_rest } from '#scripts/gh/git-gh-issue-rest'
+import { issue_closing_pr } from './issue-closing-pr'
+import { issue_sample_gate } from './issue-sample-gate'
+import { session_cite } from './session-cite'
+
+// joshuafolkken/kit#4460: the start condition cites the pull request whose merge it waits on. An issue
+// number passes the format check, then reads as a pull request that is never found, so the issue waits
+// forever. The filing reads what the number names and refuses an issue, citing the merged pull request
+// that closed it when there is one. An unreadable number passes — an outage is no reason to stop.
+//
+// `repo` is the filing's target, `undefined` for this checkout. The closing pull request is looked up
+// only here: `issue_closing_pr` reads this checkout's timeline, so a foreign target gets the plain hint.
+
+interface SourcePorts {
+	is_pull: (number: number, repo: string | undefined) => Promise<boolean | undefined>
+	closing_pr: (issue: number) => Promise<string | undefined>
+}
+
+async function read_is_pull(
+	number: number,
+	repo: string | undefined,
+): Promise<boolean | undefined> {
+	try {
+		const json = await git_gh_exec.exec_gh_api({
+			path: git_gh_api_path.issue_api_path(String(number), repo),
+		})
+
+		return git_gh_issue_rest.is_pull_request(git_gh_issue_rest.parse_rest_issue(json))
+	} catch {
+		return undefined
+	}
+}
+
+// The closing pull request's number, read off the URL `read_closing_pr` answers.
+async function read_closing_pr(issue: number): Promise<string | undefined> {
+	const url = await issue_closing_pr.read_closing_pr(String(issue))
+
+	return url?.slice(url.lastIndexOf('/') + 1)
+}
+
+const DEFAULT_PORTS: SourcePorts = { is_pull: read_is_pull, closing_pr: read_closing_pr }
+
+async function hint_of(
+	issue: number,
+	repo: string | undefined,
+	ports: SourcePorts,
+): Promise<string> {
+	const closing = repo === undefined ? await ports.closing_pr(issue) : undefined
+
+	if (closing === undefined) return 'cite the pull request whose merge it waits on'
+
+	return `cite the pull request that closed it: ${session_cite.issue(closing)}`
+}
+
+// The refusal for a condition citing an issue, or `undefined` when it cites a pull request, cites
+// nothing, or cannot be read.
+async function problem(
+	body: string,
+	repo?: string,
+	ports: SourcePorts = DEFAULT_PORTS,
+): Promise<string | undefined> {
+	const number = issue_sample_gate.cited_number(body)
+
+	if (number === undefined || (await ports.is_pull(number, repo)) !== false) return undefined
+	const cited = session_cite.issue(number, undefined, repo)
+	const hint = await hint_of(number, repo, ports)
+
+	return `\`- 実施可能条件:\` cites ${cited}, an issue, not a pull request — ${hint}`
+}
+
+const issue_sample_source = { problem }
+
+export type { SourcePorts }
+export { issue_sample_source }

package/scripts/issue/issue-scout-cli.ts

@@ -1,6 +1,4 @@
-#!/usr/bin/env tsx
 import { readFile } from 'node:fs/promises'
-import { fileURLToPath } from 'node:url'
 import { epic_audit_logic } from '#scripts/epic/epic-audit'
 import { epic_bundle, type BacklogIssue, type BundleDecision } from '#scripts/epic/epic-bundle'
 import { epic_bundle_cli } from '#scripts/epic/epic-bundle-cli'
@@ -34,7 +32,6 @@ const { CLOSED_CEILING_LINE, CLOSED_UNREADABLE_LINE, read_recently_closed, warn_
 
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
-const ARGV_OFFSET = 2
 const SCORE_DIGITS = 2
 const USAGE = 'Usage: josh issue:scout "<title>" [--body "<draft>" | --body-file <path>]'
 const UNKNOWN_REPO_MESSAGE =
@@ -103,7 +100,7 @@ function draft_of(args: ScoutArguments, repo: string): BacklogIssue {
 }
 
 // The epic beside a candidate is the placement answer for a draft that cites nothing: the epic half
-// below decides from prose references, and a title-only draft has none to give it.
+// below decides from signal references, and a title-only draft has none to give it.
 function format_duplicate(candidate: DuplicateCandidate): string {
 	const score = candidate.is_referenced === true ? 'ref' : candidate.score.toFixed(SCORE_DIGITS)
 	const epic = candidate.epic === undefined ? '' : ` (epic ${session_cite.issue(candidate.epic)})`
@@ -162,12 +159,13 @@ function format_epic(decision: BundleDecision): Array<string> {
 	return lines
 }
 
-// A draft cites nothing, so the epic half has nothing to decide from: its two signals are prose
-// references and recorded dependencies, and a title carries neither. Saying "file it standalone" there
-// reports a scan that found nothing when none was possible — the confident wrong answer the gap
+// A draft cites nothing where a citation counts, so the epic half has nothing to decide from: its two
+// signals are references in the acceptance criteria or the `parent: #N` line and recorded
+// dependencies, and a title or a background mention carries neither. Saying "file it standalone"
+// there reports a scan that found nothing when none was possible — the confident wrong answer the gap
 // warnings exist to prevent everywhere else in this command.
 const NO_REFERENCE_LINE =
-	'Epic: not asked — no issue number in the summary. Pass --body "…#<N>…", or take the epic printed beside a duplicate above.'
+	'Epic: not asked — no issue number in the summary\'s acceptance criteria or parent line. Pass --body "parent: #<N>", or take the epic printed beside a duplicate above.'
 
 // Every placing verdict above asserts that no epic already tracks the draft's relatives, and a cut
 // epic listing cannot support that: `epic:bundle` withholds them for it,
@@ -195,18 +193,22 @@ function format_epic_decision(
 	return format_epic(decision).join('\n')
 }
 
-// Whether the summary names an issue at all, read through the same parser the decision itself uses —
-// a second reading of "does this body cite anything" could disagree with the one that matters.
-function has_reference(draft: BacklogIssue): boolean {
-	return epic_audit_logic.parse_references(draft.body, draft.repo).length > 0
+// The issue numbers the summary names where `decide_bundle` counts a reference — its acceptance
+// criteria and its `parent: #N` line — read through the same parser the decision itself uses: a
+// second reading of "does this body cite anything" could disagree with the one that matters, and an
+// issue cited only as the background of the filing is not one the draft belongs with.
+function signal_numbers(draft: BacklogIssue): Array<number> {
+	return epic_audit_logic
+		.signal_references(draft.body, draft.repo)
+		.map((reference) => reference.number)
 }
 
 // The open epics the summary names outright. `decide_bundle` excludes an epic from the candidate pool
-// — a container is not a sibling — so a draft saying "part of epic #1153", which is the phrasing the
-// workflow documents themselves suggest, otherwise reaches `none` and is told to file standalone with
-// the epic it named never mentioned.
+// — a container is not a sibling — so a draft whose `parent: #1153` line names the epic, which is the
+// phrasing the workflow documents themselves suggest, otherwise reaches `none` and is told to file
+// standalone with the epic it named never mentioned.
 function named_epics(draft: BacklogIssue, issues: ReadonlyArray<BacklogIssue>): Array<number> {
-	const named = new Set(epic_audit_logic.parse_references(draft.body, draft.repo))
+	const named = new Set(signal_numbers(draft))
 
 	return issues
 		.filter((issue) => issue.is_epic === true && named.has(issue.number))
@@ -241,7 +243,7 @@ function format_epic_answer(
 
 	if (named.length > 0) return format_named_epics(named, decision).join('\n')
 
-	return format_epic_decision(decision, has_reference(draft), is_membership_established)
+	return format_epic_decision(decision, signal_numbers(draft).length > 0, is_membership_established)
 }
 
 // The closed rows reach the duplicate half only. `decide_bundle` places a draft among issues that
@@ -389,12 +391,6 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 	return await report(args, repo)
 }
 
-// `process.exitCode` rather than `process.exit()`: the answer goes to standard output and a write to
-// a pipe is asynchronous on macOS, so exiting can tear the process down before it drains.
-async function main(argv: ReadonlyArray<string>): Promise<void> {
-	process.exitCode = await run(argv)
-}
-
 const issue_scout_cli = {
 	USAGE,
 	UNKNOWN_REPO_MESSAGE,
@@ -410,7 +406,5 @@ const issue_scout_cli = {
 	run,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
-
 export type { ScoutArguments, ScoutOutcome }
 export { issue_scout_cli }

package/scripts/issue/issue-scout-main.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { issue_scout_cli } from './issue-scout-cli'
+
+// The `josh issue:scout` entry, kept apart from `issue-scout-cli.ts` because other modules import
+// that one: a bundle is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186). `process.exitCode` rather than `process.exit()`: the answer goes to
+// standard output and a write to a pipe is asynchronous on macOS, so exiting can tear the process
+// down before it drains.
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = await issue_scout_cli.run(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/issue/issue-state-cli.ts

@@ -1,5 +1,3 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import type { IssueReadReason } from '#scripts/gh/git-gh-issue-read'
 import { issue_number_shape } from '#scripts/issue/issue-number-shape'
@@ -29,7 +27,6 @@ import { issue_state, type IssueState } from './issue-state'
 // are told apart here and neither is a state.
 
 const FAILURE_EXIT_CODE = 1
-const ARGV_OFFSET = 2
 const USAGE = 'Usage: josh issue:state <issue-number> [<issue-number> ...] [--repo <owner/repo>]'
 // A blank line between the blocks of a multi-number report, so a person sees where one issue ends
 // while a reader matching `issue: ` still finds each block by its first line.
@@ -172,21 +169,14 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 	return issue_report_failures.report_failures(reports, FAILURE_TERMS)
 }
 
-async function main(argv: ReadonlyArray<string>): Promise<void> {
-	process.exitCode = await run(argv)
-}
-
 const issue_state_cli = {
 	READ_CONCURRENCY,
 	STATE_FIELDS,
 	USAGE,
-	main,
 	parse_request,
 	read_issue,
 	run,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
-
 export type { StateRead }
 export { issue_state_cli }

package/scripts/issue/issue-state-main.ts

@@ -0,0 +1,12 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { issue_state_cli } from './issue-state-cli'
+
+// The `josh issue:state` entry, kept apart from `issue-state-cli.ts` because other modules import
+// that one: a bundle is one file, so a main guard there would fire for every command that carries it
+// (joshuafolkken/kit#4186).
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+	const ARGV_OFFSET = 2
+
+	process.exitCode = await issue_state_cli.run(process.argv.slice(ARGV_OFFSET))
+}

package/scripts/issue/issue-watch-diff.ts

@@ -1,9 +1,11 @@
+import { gh_author_association } from '#scripts/gh/gh-author-association'
 import { read_json_listing } from '#scripts/git/parse-json-array'
 import { z } from 'zod'
 
-// What a person changed on an issue since a run last read it, as the one pure answer the hook, the
-// review attestation, `josh issue:ack` and `josh followup` all print. Kept free of I/O so the four
-// callers cannot each draw the line between "a person's update" and "noise" differently.
+// What a person changed on an issue since a run last read it, as the one answer the hook, the review
+// attestation, `josh issue:ack` and `josh followup` all print. Kept in one place so the four callers
+// cannot each draw the line between "a person's update" and "noise" differently; its only I/O is the
+// write-access lookup `gh_author_association` makes for a `MEMBER` / `COLLABORATOR`.
 //
 // **A person's update is a body edit or a comment nobody automated.** A bot's comment (`type: Bot`,
 // or a `[bot]` login) is not one. A run's own comment is posted under the person's own `gh` login,
@@ -12,6 +14,13 @@ import { z } from 'zod'
 // through a raw `gh api` counts as a person's — the direction that costs one `josh issue:ack`, never a
 // missed correction.
 //
+// **Only an author with write access is a person here** (`gh_author_association`). On a public
+// repository anyone can comment, so a comment from anyone else is never handed to a run as an update,
+// and its `RUN_MARKER` is not taken as josh's own. A `MEMBER` / `COLLABORATOR` whose lookup failed
+// (`is_trusted: undefined` — the hook's timeout fired) is neither: their comment is announced with its
+// body withheld, costing one `josh issue:ack` rather than a missed correction, and its marker is not
+// trusted.
+//
 // **Comment edits are out of scope.** A new comment carries an id above the baseline's; an edited
 // one keeps its id and is not seen. The body is compared whole, so its edits are.
 
@@ -21,6 +30,8 @@ const BOT_SUFFIX = '[bot]'
 const NO_COMMENT_ID = 0
 const UNKNOWN_AUTHOR = '(unknown)'
 const UNKNOWN_TIME = '(undated)'
+const UNVERIFIED_BODY =
+	"(body withheld — the author's write access could not be checked; read it with `josh issue:read`)"
 
 const BODY_HEADING = 'Body edited:'
 const REMOVED_PREFIX = '- '
@@ -36,11 +47,14 @@ const comment_schema = z.looseObject({
 	user: z.looseObject({ login: z.string(), type: z.string().optional() }).nullish(),
 	created_at: z.string().optional(),
 	body: z.string().nullish(),
+	author_association: z.string().nullish(),
 })
 
 interface WatchComment {
 	id: number
 	author: string
+	// `undefined` when the write-access lookup failed.
+	is_trusted: boolean | undefined
 	is_automated: boolean
 	created_at: string
 	body: string
@@ -60,26 +74,48 @@ function is_bot(user: z.infer<typeof comment_schema>['user']): boolean {
 	return user?.type === BOT_TYPE || (user?.login.endsWith(BOT_SUFFIX) ?? false)
 }
 
-function is_automated(user: z.infer<typeof comment_schema>['user'], body: string): boolean {
-	return is_bot(user) || body.includes(RUN_MARKER)
+function is_automated(
+	raw: z.infer<typeof comment_schema>,
+	is_trusted: boolean | undefined,
+): boolean {
+	return is_bot(raw.user) || (is_trusted === true && (raw.body?.includes(RUN_MARKER) ?? false))
 }
 
-function to_comment(raw: z.infer<typeof comment_schema>): WatchComment {
-	const body = raw.body ?? ''
-	const author = raw.user?.login ?? UNKNOWN_AUTHOR
-	const created_at = raw.created_at ?? UNKNOWN_TIME
+async function to_comment(
+	raw: z.infer<typeof comment_schema>,
+	timeout_ms?: number,
+): Promise<WatchComment> {
+	const login = raw.user?.login
+	const is_trusted = await gh_author_association.trust_of({
+		login,
+		association: raw.author_association,
+		timeout_ms,
+	})
 
-	return { id: raw.id, author, is_automated: is_automated(raw.user, body), created_at, body }
+	return {
+		id: raw.id,
+		author: login ?? UNKNOWN_AUTHOR,
+		is_trusted,
+		is_automated: is_automated(raw, is_trusted),
+		created_at: raw.created_at ?? UNKNOWN_TIME,
+		body: raw.body ?? '',
+	}
 }
 
 // `undefined` — never `[]` — for a listing that could not be read, so a failed read is never taken
-// for "nobody commented".
-function parse_comments(json: string | undefined): ReadonlyArray<WatchComment> | undefined {
+// for "nobody commented". `timeout_ms` bounds each write-access lookup, which run concurrently, so a
+// hook's read stays inside its own timeout.
+async function parse_comments(
+	json: string | undefined,
+	timeout_ms?: number,
+): Promise<ReadonlyArray<WatchComment> | undefined> {
 	if (json === undefined) return undefined
 
 	const listing = read_json_listing(json, comment_schema)
 
-	return listing.kind === 'read' ? listing.rows.map((row) => to_comment(row)) : undefined
+	if (listing.kind !== 'read') return undefined
+
+	return await Promise.all(listing.rows.map(async (row) => await to_comment(row, timeout_ms)))
 }
 
 function last_comment_id(comments: ReadonlyArray<WatchComment>): number {
@@ -118,7 +154,9 @@ function body_section(previous_raw: string, current_raw: string): string | undef
 }
 
 function comment_section(comment: WatchComment): string {
-	return `${COMMENT_HEADING}${comment.author}${AT}${comment.created_at}${LINE_SEPARATOR}${comment.body}`
+	const body = comment.is_trusted === true ? comment.body : UNVERIFIED_BODY
+
+	return `${COMMENT_HEADING}${comment.author}${AT}${comment.created_at}${LINE_SEPARATOR}${body}`
 }
 
 function new_person_comments(
@@ -126,7 +164,10 @@ function new_person_comments(
 	snapshot: WatchSnapshot,
 ): ReadonlyArray<WatchComment> {
 	return snapshot.comments.filter(
-		(comment) => comment.id > baseline.last_comment_id && !comment.is_automated,
+		(comment) =>
+			comment.id > baseline.last_comment_id &&
+			comment.is_trusted !== false &&
+			!comment.is_automated,
 	)
 }
 

package/scripts/issue/issue-watch.ts

@@ -76,8 +76,9 @@ async function read_snapshot(
 	body: string,
 	etag: string | undefined,
 ): Promise<Fetched> {
-	const comments = issue_watch_diff.parse_comments(
+	const comments = await issue_watch_diff.parse_comments(
 		await git_gh_issue_read.issue_list_comments(request.issue, request.timeout_ms),
+		request.timeout_ms,
 	)
 
 	return comments === undefined ? UNREADABLE : { kind: 'read', snapshot: { body, comments }, etag }

package/scripts/issue/issue-wip.ts

@@ -1,3 +1,4 @@
+import { json_value } from '#scripts/lib/json-value'
 import { INTERRUPT_ROUTE_LABEL, SPLIT_ROUTE_LABEL, TIER_A_ROUTE_LABEL } from './issue-labels'
 
 // The WIP cap at the call that files. `josh issue:file` reads the count and asks the exemption
@@ -55,13 +56,7 @@ function count_line(count: number, repo: string, verdict: WipVerdict): string {
 // The listing's JSON is an array of rows; anything else is unreadable rather than zero, because zero
 // would pass every filing as within the cap.
 function count_of(json: string): number | undefined {
-	try {
-		const parsed: unknown = JSON.parse(json)
-
-		return Array.isArray(parsed) ? parsed.length : undefined
-	} catch {
-		return undefined
-	}
+	return json_value.parse_array(json)?.length
 }
 
 const issue_wip = { WIP_CAP, HELD, HELD_MESSAGE, UNREAD_MESSAGE, verdict_of, count_line, count_of }