@joshuafolkken/kit 1.2116.0 → 1.3041.0

package/scripts/agent/codex-agent-argv.ts

@@ -1,9 +1,6 @@
-import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync } from 'node:fs'
 import path from 'node:path'
-import { git_common_directory } from '#scripts/git/git-common-directory'
-import { durable_state } from '#scripts/josh/durable-state'
-import { OBSERVATION_LEDGER_DIRECTORY } from '#scripts/observations/observation-ledger'
-import { agent_role_profile, type AgentProfile } from './agent-role-profile'
+import { agent_profile_schema, type AgentProfile } from './agent-profile-schema'
+import { agent_session_role } from './agent-session-role'
 
 const AGENT_COMMAND = 'codex'
 const AGENT_FLAGS: ReadonlyArray<string> = ['exec']
@@ -12,36 +9,14 @@ const CONFIG_FLAG = '-c'
 const JSON_FLAG = '--json'
 const SQLITE_CACHE_PATH = ['node_modules', '.cache', 'josh', 'openai']
 const EPHEMERAL_FLAG = '--ephemeral'
-const GIT_DIRECTORY = '.git'
-const LEDGER_DIRECTORY = path.dirname(OBSERVATION_LEDGER_DIRECTORY)
-const WORKTREE_REGISTRY = 'worktrees'
-const READ = 'read'
-const WRITE = 'write'
-
-// The sandbox is a Codex permission profile, not `--sandbox workspace-write` with `--add-dir` roots
-// (joshuafolkken/kit#4653). It reads the whole disk and writes the work tree, the temp directories, the
-// network and the common git directory — whose root a ref deletion needs: `git branch -d` and
-// `git stash drop` rewrite `packed-refs` through `packed-refs.lock` there.
-const PERMISSION_PROFILE = 'josh_lane'
-const PROFILE_CONFIG = `default_permissions="${PERMISSION_PROFILE}"`
-const NETWORK_CONFIG = `permissions.${PERMISSION_PROFILE}.network.enabled=true`
-const FILESYSTEM_KEY = `permissions.${PERMISSION_PROFILE}.filesystem`
-const BASE_GRANTS: ReadonlyArray<Grant> = [
-	[':root', READ],
-	[':workspace_roots', WRITE],
-	[':slash_tmp', WRITE],
-	[':tmpdir', WRITE],
+// Trusted local batches keep action authorization in the workflow and hooks (joshuafolkken/kit#5438).
+// This policy cannot remove an OS sandbox inherited from the process that launches the batch.
+const PERMISSION_ARGUMENTS: ReadonlyArray<string> = [
+	CONFIG_FLAG,
+	'default_permissions=":danger-full-access"',
+	CONFIG_FLAG,
+	'approval_policy="never"',
 ]
-// What git runs or follows to another directory stays read-only, so the sandbox cannot plant code that
-// runs outside it the next time anything runs git: `hooks/` and `config`, and the `commondir` and
-// `config.worktree` that would point a git directory at a planted one. An exact read-only path also
-// refuses creating, renaming and deleting it (measured on codex-cli 0.156.1).
-const PINNED_WORKTREE_ENTRIES: ReadonlyArray<string> = ['commondir', 'config.worktree']
-const PINNED_ENTRIES: ReadonlyArray<string> = ['hooks', 'config', ...PINNED_WORKTREE_ENTRIES]
-// Each registered work tree's git directory is pinned the same way; one registered after launch — a
-// later lane, or the detached tree `josh test:red` and `josh metrics` add (`base-tree.ts`) — is not.
-
-type Grant = readonly [string, string]
 
 interface CodexArgv {
 	command: string
@@ -53,119 +28,16 @@ function effort_config(profile: AgentProfile): string {
 	return `model_reasoning_effort="${profile.effort}"`
 }
 
+function role_config(profile: AgentProfile): string {
+	return `shell_environment_policy.set.${agent_session_role.KEY}=${JSON.stringify(profile.role)}`
+}
+
 function sqlite_config(cwd: string): string {
 	return `sqlite_home=${JSON.stringify(path.resolve(cwd, ...SQLITE_CACHE_PATH))}`
 }
 
 function persistence_arguments(profile: AgentProfile): ReadonlyArray<string> {
-	return profile.role === agent_role_profile.WORKER ? [] : [EPHEMERAL_FLAG]
-}
-
-// A granted directory is created up front — it would otherwise be created in a directory the sandbox
-// cannot write — and refused when it is not a real directory, so a symlink cannot widen the grant.
-function ensure_writable_directory(directory: string, mode?: number): void {
-	const current = lstatSync(directory, { throwIfNoEntry: false })
-
-	if (current === undefined) mkdirSync(directory, { recursive: true, mode })
-	else if (!current.isDirectory() || current.isSymbolicLink()) {
-		throw new Error(`Writable root must be a real directory: ${directory}`)
-	}
-}
-
-function pinned(directory: string, entries: ReadonlyArray<string>): ReadonlyArray<Grant> {
-	return entries.map((entry) => [path.join(directory, entry), READ])
-}
-
-function registered_worktrees(common_directory: string): ReadonlyArray<string> {
-	const registry = path.join(common_directory, WORKTREE_REGISTRY)
-	if (!existsSync(registry)) return []
-
-	return readdirSync(registry, { withFileTypes: true })
-		.filter((entry) => entry.isDirectory())
-		.map((entry) => path.join(registry, entry.name))
-}
-
-// Real paths, since the sandbox matches resolved paths: a `.git` reached through a symlink is granted
-// where it lives, and an entry of it that is a symlink is not followed out of it.
-function git_grants(common_directory: string | undefined): ReadonlyArray<Grant> {
-	if (common_directory === undefined) return []
-
-	const root = realpathSync(common_directory)
-
-	return [
-		[root, WRITE],
-		...pinned(root, PINNED_ENTRIES),
-		...registered_worktrees(root).flatMap((worktree) => pinned(worktree, PINNED_WORKTREE_ENTRIES)),
-	]
-}
-
-// Only the ledger's parent directory is writable outside a lane, never the primary checkout root.
-function ledger_grants(
-	common_directory: string | undefined,
-	profile: AgentProfile,
-): ReadonlyArray<Grant> {
-	if (
-		common_directory === undefined ||
-		profile.role !== agent_role_profile.WORKER ||
-		path.basename(common_directory) !== GIT_DIRECTORY
-	) {
-		return []
-	}
-
-	const ledger = path.join(path.dirname(common_directory), LEDGER_DIRECTORY)
-
-	ensure_writable_directory(ledger)
-
-	return [[realpathSync(ledger), WRITE]]
-}
-
-// An inline TOML table; a JSON string is a valid TOML basic string.
-function filesystem_config(grants: ReadonlyArray<Grant>): string {
-	const pairs = grants.map(
-		([target, access]) => `${JSON.stringify(target)}=${JSON.stringify(access)}`,
-	)
-
-	return `${FILESYSTEM_KEY}={${pairs.join(',')}}`
-}
-
-// A `backlogrun` parent runs in the primary checkout, where no common git directory grant is given,
-// so the run-state directory its lanes write through that grant is granted on its own — without it the
-// parent's records would fall back to the temp root, apart from its lanes'.
-function state_grants(cwd: string): ReadonlyArray<Grant> {
-	const repository = git_common_directory.repository(cwd)
-	if (repository === undefined) return []
-
-	const state = durable_state.root_for(repository)
-
-	ensure_writable_directory(state, durable_state.STATE_DIRECTORY_MODE)
-
-	return [[realpathSync(state), WRITE]]
-}
-
-function lane_grants(cwd: string | undefined, profile: AgentProfile): ReadonlyArray<Grant> {
-	if (cwd === undefined) return []
-
-	const common_directory = git_common_directory.resolve(cwd)
-
-	if (common_directory === undefined) return state_grants(cwd)
-
-	return [...git_grants(common_directory), ...ledger_grants(common_directory, profile)]
-}
-
-function permission_arguments(
-	cwd: string | undefined,
-	profile: AgentProfile,
-): ReadonlyArray<string> {
-	const grants = [...BASE_GRANTS, ...lane_grants(cwd, profile)]
-
-	return [
-		CONFIG_FLAG,
-		PROFILE_CONFIG,
-		CONFIG_FLAG,
-		filesystem_config(grants),
-		CONFIG_FLAG,
-		NETWORK_CONFIG,
-	]
+	return profile.role === agent_profile_schema.WORKER ? [] : [EPHEMERAL_FLAG]
 }
 
 function lane_arguments(cwd: string | undefined, profile: AgentProfile): ReadonlyArray<string> {
@@ -183,7 +55,9 @@ function build(invocation: string, profile: AgentProfile, cwd?: string): CodexAr
 			profile.model,
 			CONFIG_FLAG,
 			effort_config(profile),
-			...permission_arguments(cwd, profile),
+			CONFIG_FLAG,
+			role_config(profile),
+			...PERMISSION_ARGUMENTS,
 			...lane_arguments(cwd, profile),
 			JSON_FLAG,
 			invocation,

package/scripts/agent/codex-home-source.ts

@@ -1,7 +1,7 @@
 import os from 'node:os'
 import path from 'node:path'
 
-// Resolve the default Codex home in a read-only module, separate from reviewer state setup.
+// Resolve the default Codex home in a read-only module.
 function default_home(): string {
 	return path.join(os.homedir(), '.codex')
 }

package/scripts/agent/codex-hooks.ts

@@ -7,7 +7,8 @@ import { hook_launch } from '#scripts/init/hook-launch'
 //
 // 1. The pretool and posttool handlers run through the Codex input adapter, which translates the
 //    `apply_patch` payload into the Edit/Write shape the Claude-side guards read.
-// 2. The PreToolUse and PostToolUse matchers also select `apply_patch`, Codex's edit tool.
+// 2. The PreToolUse and PostToolUse matchers also select `apply_patch`, Codex's edit tool, and
+//    `exec_command`, its shell, whose writes the posttool revert reads (`bash-revert.ts`).
 // 3. UserPromptSubmit carries no matcher — Codex documents that the event ignores it.
 
 interface HookHandler {
@@ -27,13 +28,22 @@ interface HookConfig {
 	hooks: HookEvents
 }
 
-const CODEX_EDIT_TOOL = 'apply_patch'
+const CODEX_EDIT_TOOL = 'apply_patch|functions.apply_patch'
+const CODEX_SHELL_TOOLS = 'exec_command|functions.exec_command|exec|functions.exec'
 const TOOL_EVENTS: ReadonlySet<string> = new Set(['PreToolUse', 'PostToolUse'])
 const UNMATCHED_EVENTS: ReadonlySet<string> = new Set(['UserPromptSubmit'])
 const JSON_INDENT = '\t'
+const CLAUDE_SETTINGS_FILE = '.claude/settings.json'
+const CODEX_HOOKS_FILE = '.codex/hooks.json'
+
+// Each committed artifact a build regenerates, keyed to the file it is generated from (repo-relative):
+// `lane:plan` does not count one planned beside its source (`lane-plan-size.ts`).
+const GENERATED_SOURCES: ReadonlyMap<string, string> = new Map([
+	[CODEX_HOOKS_FILE, CLAUDE_SETTINGS_FILE],
+])
 
 function adapter_command(mode: string): string {
-	return hook_launch.hook_launch_command(`codex-hook-adapter ${mode}`)
+	return hook_launch.hook_launch_command(`codex-hook-adapter ${mode}`, hook_launch.CODEX_ROOT)
 }
 
 // Each Claude-side guard command the adapter stands in for, keyed by that command verbatim.
@@ -43,12 +53,18 @@ const ADAPTED_COMMANDS: ReadonlyMap<string, string> = new Map([
 ])
 
 function codex_handler(handler: HookHandler): HookHandler {
-	return { ...handler, command: ADAPTED_COMMANDS.get(handler.command) ?? handler.command }
+	const command =
+		ADAPTED_COMMANDS.get(handler.command) ?? hook_launch.codex_command(handler.command)
+
+	return { ...handler, command }
 }
 
 function codex_matcher(event: string, matcher: string | undefined): string | undefined {
 	if (UNMATCHED_EVENTS.has(event)) return undefined
-	if (matcher !== undefined && TOOL_EVENTS.has(event)) return `${matcher}|${CODEX_EDIT_TOOL}`
+
+	if (matcher !== undefined && TOOL_EVENTS.has(event)) {
+		return `${matcher}|${CODEX_EDIT_TOOL}|${CODEX_SHELL_TOOLS}`
+	}
 
 	return matcher
 }
@@ -77,7 +93,14 @@ function codex_hooks_text(claude_settings_text: string): string {
 	return `${JSON.stringify(codex_hook_config(claude), undefined, JSON_INDENT)}\n`
 }
 
-const codex_hooks = { adapter_command, codex_hook_config, codex_hooks_text }
+const codex_hooks = {
+	adapter_command,
+	codex_hook_config,
+	codex_hooks_text,
+	CLAUDE_SETTINGS_FILE,
+	CODEX_HOOKS_FILE,
+	GENERATED_SOURCES,
+}
 
 export { codex_hooks }
 export type { HookConfig }

package/scripts/agent/judgment-agent-argv.ts

@@ -0,0 +1,49 @@
+import type { AgentArgv, AgentArgvResult } from './agent-argv'
+import { agent_diagnostics } from './agent-diagnostics'
+import type { AgentProfile } from './agent-role-profile'
+import { claude_agent_argv } from './claude-agent-argv'
+
+// **A judgment child reads and answers; it can do nothing else.** `--tools=` launches no built-in
+// tool — one element, because `detached_launch` refuses an empty argv element (`--tools ''`),
+// `--strict-mcp-config` with no `--mcp-config` loads no MCP server, `--restricted` ignores the
+// user, project and local settings files (their hooks and permissions included) and refuses
+// `bypassPermissions`, and `--disable-slash-commands` drops every skill and command. No permission
+// mode and no lane instruction set ride along, so nothing the worker launch grants carries over.
+const JUDGMENT_FLAGS: ReadonlyArray<string> = [
+	'-p',
+	'--verbose',
+	'--output-format',
+	'stream-json',
+	'--tools=',
+	'--strict-mcp-config',
+	'--restricted',
+	'--disable-slash-commands',
+]
+const MODEL_FLAG = '--model'
+const EFFORT_FLAG = '--effort'
+const SUPPORTED_PROVIDER = 'anthropic'
+// **A provider that cannot launch with no tool is refused, never swapped.** The Codex CLI has no
+// argument that stops every tool, and its read-only sandbox still runs shell commands.
+const UNSUPPORTED_NOTE =
+	'judgment launch refused: the openai provider (Codex CLI) has no argument that disables every tool, and a read-only sandbox still runs commands. Retry with JOSH_AGENT_PROVIDER=anthropic.'
+
+function build(invocation: string, profile: AgentProfile): AgentArgv {
+	return {
+		command: claude_agent_argv.AGENT_COMMAND,
+		args: [...JUDGMENT_FLAGS, MODEL_FLAG, profile.model, EFFORT_FLAG, profile.effort, invocation],
+		ends_with_prompt: true,
+	}
+}
+
+function resolve(invocation: string, profile: AgentProfile): AgentArgvResult {
+	if (profile.provider !== SUPPORTED_PROVIDER) return { kind: 'rejected', note: UNSUPPORTED_NOTE }
+
+	const diagnostic = agent_diagnostics.check(profile)
+	if (diagnostic.kind === 'rejected') return diagnostic
+
+	return { kind: 'argv', argv: build(invocation, profile), profile }
+}
+
+const judgment_agent_argv = { UNSUPPORTED_NOTE, build, resolve }
+
+export { judgment_agent_argv }

package/scripts/agent/lane-instructions.ts

@@ -5,6 +5,7 @@ import { document_section } from '#scripts/document/document-section'
 import { distributed_paths } from '#scripts/init/distributed-paths'
 import { find_package_directory } from '#scripts/josh/package-directory'
 import { stamp_file } from '#scripts/josh/stamp-file'
+import { run_park_escalate } from '#scripts/run/park/run-park-escalate'
 
 interface LaneSet {
 	text: string
@@ -17,6 +18,8 @@ interface LaneSet {
 // names the rules a lane does need by `CLAUDE.md` heading or bold label, and each `include` line is
 // expanded from the launch checkout's own `CLAUDE.md` here, so the rule text keeps one source (#3929).
 const LANE_DOCUMENT = 'prompts/collaboration-workflow/lane-instructions.md'
+const WORKFLOW_ENTRY = 'fullrun-lane.md'
+const WORKFLOW_GUIDE = `A headless fullrun lane child runs pnpm josh doc:read ${WORKFLOW_ENTRY} instead of workflow-commands/SKILL.md, fullrun.md or entry-sequence.md. A resumed child follows its resume prompt first. Review sessions do not start a fullrun.`
 const RULES_FILE = 'CLAUDE.md'
 // `AGENTS.md` only points at `CLAUDE.md`, and Claude Code loads it once `CLAUDE.md` is excluded.
 const POINTER_FILE = 'AGENTS.md'
@@ -26,6 +29,14 @@ const SETTINGS_FLAG = '--settings'
 const PROMPT_FILE_PREFIX = 'josh-lane-instructions-'
 const PROMPT_FILE_SUFFIX = '.md'
 const PACKAGE_DIRECTORY = find_package_directory(path.dirname(fileURLToPath(import.meta.url)))
+// Appended only where `josh.worker.escalate` is true, so a repository without it keeps today's text
+// to the byte (joshuafolkken/kit#7356).
+const ESCALATION_GUIDE = [
+	'',
+	'## Escalation',
+	'',
+	'- This Issue needs a stronger model than the one you run on → `pnpm josh run:park <N> --escalate "<reason>"`, then stop. The reason is required and recorded; the lane resumes one profile up, or goes to a person at the top profile.',
+].join('\n')
 
 // An include that resolves to nothing is `undefined`, never an empty string, so a renamed heading
 // fails the whole composition rather than silently dropping a rule.
@@ -42,7 +53,7 @@ function compose(lane_markdown: string, rules: string): string | undefined {
 
 	if (expanded.includes(undefined)) return undefined
 
-	return expanded.join('\n')
+	return [WORKFLOW_GUIDE, ...expanded].join('\n')
 }
 
 // **Where the rules are: the checkout's `CLAUDE.md`, else the package copy it imports.** kit and a
@@ -61,7 +72,7 @@ function composed_from(lane_markdown: string, rules_path: string): string | unde
 	return rules === undefined ? undefined : compose(lane_markdown, rules)
 }
 
-function composed_set(cwd: string, package_directory: string): LaneSet | undefined {
+function rules_set(cwd: string, package_directory: string): LaneSet | undefined {
 	const lane_markdown = document_section.read_optional(path.join(package_directory, LANE_DOCUMENT))
 
 	if (lane_markdown === undefined) return undefined
@@ -75,6 +86,19 @@ function composed_set(cwd: string, package_directory: string): LaneSet | undefin
 	return undefined
 }
 
+// Only a worker can declare an escalation: a review session never parks the Issue it reads.
+function composed_set(
+	cwd: string,
+	package_directory: string,
+	is_worker = false,
+): LaneSet | undefined {
+	const set = rules_set(cwd, package_directory)
+
+	if (set === undefined || !is_worker || !run_park_escalate.is_enabled(cwd)) return set
+
+	return { ...set, text: `${set.text}${ESCALATION_GUIDE}` }
+}
+
 function composed_in(
 	cwd: string,
 	package_directory: string = PACKAGE_DIRECTORY,
@@ -106,8 +130,7 @@ function excluded_settings(rules_path: string, cwd: string): string {
 
 // No flags when the set cannot be composed or safely written: the child then loads `CLAUDE.md` as
 // before, which costs tokens but never loses a rule.
-function flags(cwd: string = process.cwd()): ReadonlyArray<string> {
-	const set = composed_set(cwd, PACKAGE_DIRECTORY)
+function flags_of(set: LaneSet | undefined, cwd: string): ReadonlyArray<string> {
 	const prompt_file = set === undefined ? undefined : written(set.text)
 
 	if (set === undefined || prompt_file === undefined) return []
@@ -115,6 +138,11 @@ function flags(cwd: string = process.cwd()): ReadonlyArray<string> {
 	return [PROMPT_FILE_FLAG, prompt_file, SETTINGS_FLAG, excluded_settings(set.rules_path, cwd)]
 }
 
+// `is_worker` adds the escalation guide where the repository allows one (joshuafolkken/kit#7356).
+function flags(cwd: string = process.cwd(), is_worker = false): ReadonlyArray<string> {
+	return flags_of(composed_set(cwd, PACKAGE_DIRECTORY, is_worker), cwd)
+}
+
 function tokens_of(text: string): string {
 	return cost_tokens.estimate(text).toLocaleString('en-US')
 }
@@ -133,6 +161,7 @@ function resident_line(cwd: string = process.cwd()): string {
 }
 
 const lane_instructions = {
+	WORKFLOW_ENTRY,
 	PROMPT_FILE_FLAG,
 	SETTINGS_FLAG,
 	compose,

package/scripts/auto-ok/auto-ok-author.ts

@@ -1,14 +1,25 @@
 import { epic_graph, type EpicChild } from '#scripts/epic/epic-graph'
-import { gh_author_association } from '#scripts/gh/gh-author-association'
+import {
+	gh_author_association,
+	type Author,
+	type AuthorFields,
+} from '#scripts/gh/gh-author-association'
 import type { OpenIssueData } from '#scripts/git/git-schemas'
 
 // Whether an unattended run may act on an opted-in issue's body. The run takes that body as its
 // specification, and on a public repository anyone can file an issue — the `auto-ok` a person applied
 // says nothing about a body its author rewrote after the label. So only an issue whose author has
 // write access is runnable, and a lookup that failed is not trust; the rest wait on a person.
+//
+// The asks are shared across processes (joshuafolkken/kit#6613): every backlog scan reads the same
+// authors, and a write role read in the last hour stands for the next scan.
+
+function shared_author_of(row: AuthorFields): Author {
+	return { ...gh_author_association.author_of(row), is_shared: true }
+}
 
 async function with_trust(issue: OpenIssueData): Promise<OpenIssueData> {
-	const author = gh_author_association.author_of(issue)
+	const author = shared_author_of(issue)
 
 	return { ...issue, author_trusted: await gh_author_association.is_trusted(author) }
 }
@@ -27,7 +38,7 @@ function is_author_trusted(issue: OpenIssueData): boolean {
 // The write-access lookup asks *this* repository's collaborators, which says nothing about access to
 // another one — so a child elsewhere is asked with no login, which `trust_of` answers for `OWNER` alone.
 async function is_child_trusted(child: EpicChild, repo: string): Promise<boolean> {
-	const author = gh_author_association.author_of(child)
+	const author = shared_author_of(child)
 
 	return await gh_author_association.is_trusted(
 		child.repo === repo ? author : { ...author, login: undefined },

package/scripts/auto-ok/auto-ok-cli.ts

@@ -146,9 +146,10 @@ function parse_options(argv: ReadonlyArray<string>, usage: string = USAGE): Next
 // empty listing: reading a failed read as "none" ends the run reporting a confident absence built on
 // a response nobody parsed. They stay apart from each other because the zod
 // rejection `parse_json_array_or_undefined` deliberately rethrows means the listing's *fields*
-// changed, not that the caller's authentication lapsed.
+// changed, not that the caller's authentication lapsed. `is_unchanged` is whether the listing answered
+// 304 throughout (`IssueListOutcome`), recorded by `backlog:next` (joshuafolkken/kit#7306).
 type OptedInRead =
-	| { kind: 'read'; issues: Array<OpenIssueData>; cutoff: ScanCutoff }
+	| { kind: 'read'; issues: Array<OpenIssueData>; cutoff: ScanCutoff; is_unchanged?: boolean }
 	| { kind: 'unreadable' }
 	| { kind: 'unexpected_shape' }
 	| { kind: 'blockers_unreadable' }
@@ -205,7 +206,7 @@ async function classify_failed_read(): Promise<OptedInRead> {
 }
 
 async function fetch_opted_in(): Promise<OptedInRead> {
-	const { json, is_capped } = await git_gh_command.issue_list_by_label_summary(
+	const { json, is_capped, is_unchanged } = await git_gh_command.issue_list_by_label_summary(
 		AUTO_OK_LABEL,
 		LISTING_LIMIT,
 	)
@@ -218,7 +219,7 @@ async function fetch_opted_in(): Promise<OptedInRead> {
 
 	await issue_sample_prime.prime(issues.map((issue) => issue.body))
 
-	return { ...read, issues }
+	return { ...read, issues, is_unchanged: is_unchanged === true }
 }
 
 // Whether every issue this one declares as a blocker has closed. `blockedBy` is the same native
@@ -336,12 +337,16 @@ async function fetch_tracking(count: number): Promise<TrackingRead> {
 // `tracked` is the narrowed set `epic_index.withheld_children` builds, not
 // every tracked child; this function only applies it.
 // What the issue itself must hold: an author with write access (`auto-ok-author.ts`), every blocker
-// closed, and its declared start date reached.
-function is_ready(issue: OpenIssueData, now: number): boolean {
+// closed and its declared start date reached. Its size is the lane's to settle (joshuafolkken/kit#7074).
+interface RunnableOptions {
+	now?: number
+}
+
+function is_ready(issue: OpenIssueData, options: RunnableOptions): boolean {
 	return (
 		auto_ok_author.is_author_trusted(issue) &&
 		is_unblocked(issue) &&
-		issue_not_before.is_due(issue.body, now)
+		issue_not_before.is_due(issue.body, options.now ?? Date.now())
 	)
 }
 
@@ -349,19 +354,22 @@ function is_runnable(
 	issue: OpenIssueData,
 	tracked: ReadonlyMap<number, number>,
 	exclude: ReadonlyArray<number>,
-	now: number = Date.now(),
+	options: RunnableOptions = {},
 ): boolean {
 	if (tracked.has(issue.number)) return false
 
-	return !exclude.includes(issue.number) && is_ready(issue, now)
+	return !exclude.includes(issue.number) && is_ready(issue, options)
 }
 
 function pick_next(
 	issues: ReadonlyArray<OpenIssueData>,
 	tracked: ReadonlyMap<number, number> = new Map(),
 	exclude: ReadonlyArray<number> = [],
+	options: RunnableOptions = {},
 ): OpenIssueData | undefined {
-	return git_next_issues.order(issues).find((issue) => is_runnable(issue, tracked, exclude))
+	return git_next_issues
+		.order(issues)
+		.find((issue) => is_runnable(issue, tracked, exclude, options))
 }
 
 // Why there is nothing to run. "No open issue carries the label" and "every opted-in issue is
@@ -398,7 +406,7 @@ function warn_gaps(context: PickupContext, has_answer: boolean): void {
 
 // Grouped rather than passed one by one: the pickup now answers from two listings, and the
 // parameter limit is four.
-interface PickupContext {
+interface PickupContext extends RunnableOptions {
 	issues: ReadonlyArray<OpenIssueData>
 	cutoff: ScanCutoff
 	tracked: ReadonlyMap<number, number>
@@ -408,7 +416,7 @@ interface PickupContext {
 
 function report(context: PickupContext): number {
 	const { issues } = context
-	const next = pick_next(issues, context.tracked, context.exclude)
+	const next = pick_next(issues, context.tracked, context.exclude, context)
 
 	warn_gaps(context, next !== undefined)
 

package/scripts/auto-ok/auto-ok-judge-cli.ts

@@ -1,6 +1,6 @@
 import { fileURLToPath } from 'node:url'
-import { RUN_LANE_LABEL, RUN_SOLO_LABEL } from '#scripts/issue/issue-labels'
 import { issue_number_shape } from '#scripts/issue/issue-number-shape'
+import { issue_run_verdict } from '#scripts/issue/issue-run-verdict'
 import { session_cite } from '#scripts/issue/session-cite'
 import { cli_flags } from '#scripts/lib/cli-flags'
 import { auto_ok_judge_read } from './auto-ok-judge-read'
@@ -19,13 +19,12 @@ const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const NONE_TOKEN = 'none'
 const USAGE =
-	'Usage: josh auto-ok:judge [--apply <N> (--lane | --solo) | --decline <N> --reason <text>]'
+	'Usage: josh auto-ok:judge [--apply <N> (--lane | --solo --defect yes --verification yes --every-run yes) | --decline <N> --reason <text>]'
 
 const OPTIONS = {
 	apply: { type: 'string' },
 	decline: { type: 'string' },
-	lane: { type: 'boolean' },
-	solo: { type: 'boolean' },
+	...issue_run_verdict.RUN_LABEL_OPTIONS,
 	reason: { type: 'string' },
 } as const
 
@@ -33,19 +32,13 @@ type Values = NonNullable<ReturnType<typeof cli_flags.values_of<typeof OPTIONS>>
 
 type JudgeRequest =
 	| { kind: 'list' }
-	| { kind: 'apply'; issue: string; run_label: string }
+	| { kind: 'apply'; issue: string; run_label: string; answers: Values }
 	| { kind: 'decline'; issue: string; reason: string }
 
-function run_label_of(values: Values): string | undefined {
-	if (values.lane === values.solo) return undefined
-
-	return values.lane === true ? RUN_LANE_LABEL : RUN_SOLO_LABEL
-}
-
 function apply_request(issue: string, values: Values): JudgeRequest | undefined {
-	const run_label = run_label_of(values)
+	const run_label = issue_run_verdict.run_label_of(values)
 
-	return run_label === undefined ? undefined : { kind: 'apply', issue, run_label }
+	return run_label === undefined ? undefined : { kind: 'apply', issue, run_label, answers: values }
 }
 
 function decline_request(issue: string, values: Values): JudgeRequest | undefined {
@@ -74,6 +67,9 @@ function parse_request(argv: ReadonlyArray<string>): JudgeRequest | undefined {
 }
 
 async function list(): Promise<number> {
+	console.error(
+		'Judge original user instructions separately from automated plans and prior decisions; kickoff planning alone is not an opt-out. Verify the reference and verbatim prohibition under 自動実行の制約 before treating it as a user constraint (docs/how-to/auto-ok-provenance.md).',
+	)
 	const owed = await auto_ok_judge_read.owed()
 
 	if (owed === undefined) {
@@ -98,7 +94,7 @@ async function dispatch(request: JudgeRequest): Promise<number> {
 	if (request.kind === 'list') return await list()
 	if (request.kind === 'decline') return await decline(request.issue, request.reason)
 
-	return await apply(request.issue, request.run_label)
+	return await apply(request.issue, request.run_label, request.answers)
 }
 
 async function run(argv: ReadonlyArray<string>): Promise<number> {

package/scripts/auto-ok/auto-ok-judge-read.ts

@@ -10,9 +10,9 @@ import { auto_ok_judge, type JudgeIssue } from './auto-ok-judge'
 // The reading half of `josh auto-ok:judge`: the open issues that still owe a judgement, shared by the
 // command's listing and the backlog driver's check for a free lane with nothing opted in.
 //
-// **The driver asks once a minute while it watches**, so it hands in a cache it keeps for its process:
-// an issue seen judged is remembered with its `updatedAt`, and its comments are read again only once
-// that moves — a body edit, a comment or a label change. Without it every watch minute would read the
+// **The driver asks every offer interval while it watches**, so it hands in a cache it keeps for its
+// process: an issue seen judged is remembered with its `updatedAt`, and its comments are read again only
+// once that moves — a body edit, a comment or a label change. Without it every watch ask would read the
 // comments of every candidate in the repository.
 
 // The listing cap `auto-ok:next` reads the opted-in pool under; the open backlog is read under the same.