@joshuafolkken/kit 1.3000.0 → 1.3044.0

package/scripts/hooks/implementation-shell-deny.ts

@@ -1,103 +1,18 @@
 import { canonical_command } from '#scripts/josh/josh-aliases'
 import { josh_read_only } from '#scripts/josh/josh-read-only'
 import { gh_api } from '#scripts/rules/gh-api'
-import { git_argv, type ProgramCall } from '#scripts/rules/git-argv'
+import type { ProgramCall } from '#scripts/rules/git-argv'
+import {
+	implementation_shell_deny_expansion as expansion,
+	type Refusal,
+} from './implementation-shell-deny-expansion'
+import { implementation_shell_deny_git } from './implementation-shell-deny-git'
 
 // The calls a consultation scope refuses before execution (joshuafolkken/kit#6586): the ones no
 // later check can take back. Every other call runs — a runtime file it changes is restored after the
 // call (`bash-revert.ts`), but a ref, the shared stash, a GitHub record or an installed dependency is
 // not a runtime file.
 
-type Refusal = string | undefined
-
-// Subcommands that move a ref, the index, the worktree or the shared stash in every spelling.
-const GIT_WRITES: ReadonlySet<string> = new Set([
-	'add',
-	'am',
-	'apply',
-	'bisect',
-	'checkout',
-	'checkout-index',
-	'cherry-pick',
-	'clean',
-	'commit',
-	'credential',
-	'fetch',
-	'filter-branch',
-	'gc',
-	'init',
-	'maintenance',
-	'merge',
-	'mv',
-	'pack-refs',
-	'prune',
-	'prune-packed',
-	'pull',
-	'push',
-	'read-tree',
-	'rebase',
-	'repack',
-	'replace',
-	'reset',
-	'restore',
-	'revert',
-	'rm',
-	'send-email',
-	'sparse-checkout',
-	'stage',
-	'submodule',
-	'switch',
-	'symbolic-ref',
-	'update-index',
-	'update-ref',
-])
-const BRANCH_CHANGE =
-	/^--(?:delete|move|copy|force|set-upstream-to|unset-upstream|edit-description)/u
-const BRANCH_CHANGE_LETTERS = 'dDmMcCfu'
-const CONFIG_READ = /^(?:--get|--list$|-l$)/u
-// The flags that put `git branch` / `git tag` in list mode, where a name is a pattern, not a new ref.
-const LIST_MODE =
-	/^(?:-l$|--list$|-n\d*$|--contains|--no-contains|--points-at|--merged|--no-merged)/u
-// List flags whose value is the next word, so the value is not read as a new ref's name.
-const LIST_VALUE_FLAGS: ReadonlySet<string> = new Set(['--sort', '--format'])
-const REFLOG_WRITES: ReadonlySet<string> = new Set(['expire', 'delete'])
-// A global that rewrites git's configuration or launcher, or an option that writes a file or runs one.
-const GIT_WRITE_FLAGS = /^-c$|^--(?:config-env|exec-path|output|ext-diff|textconv)/u
-// A word the shell expands before the call, so it may spell any subcommand or flag.
-const DYNAMIC = /[$`]/u
-const QUOTES = /['"\\]/gu
-
-function is_dynamic(word: string): boolean {
-	return DYNAMIC.test(word)
-}
-
-function is_branch_change(argument: string): boolean {
-	return BRANCH_CHANGE.test(argument) || git_argv.short_cluster_has(argument, BRANCH_CHANGE_LETTERS)
-}
-
-function names_a_reference(args: ReadonlyArray<string>): boolean {
-	return args.some(
-		(argument, index) => !argument.startsWith('-') && !LIST_VALUE_FLAGS.has(args[index - 1] ?? ''),
-	)
-}
-
-// `git branch` / `git tag` only list when no word names a new ref, or a flag puts them in list mode.
-function is_listing(args: ReadonlyArray<string>): boolean {
-	return !names_a_reference(args) || args.some((argument) => LIST_MODE.test(argument))
-}
-
-// Subcommands with a read spelling: the predicate says whether the arguments only read.
-const GIT_READ_FORMS: ReadonlyMap<string, (args: ReadonlyArray<string>) => boolean> = new Map([
-	['branch', (args) => is_listing(args) && args.every((argument) => !is_branch_change(argument))],
-	['stash', (args) => ['list', 'show'].includes(args[0] ?? '')],
-	['worktree', (args) => args[0] === 'list'],
-	['notes', (args) => ['list', 'show'].includes(args[0] ?? '')],
-	['remote', (args) => ['', '-v', 'show', 'get-url'].includes(args[0] ?? '')],
-	['config', (args) => args.some((argument) => CONFIG_READ.test(argument))],
-	['tag', is_listing],
-	['reflog', (args) => !REFLOG_WRITES.has(args[0] ?? '')],
-])
-
 // A verb that changes a GitHub record or the checkout. The first verb after the group is the call's,
 // so a flag between the group and the verb (`gh issue -R o/r close`) does not hide it, and a read
 // verb's argument (`gh issue list --search close`) is not read as one.
@@ -218,45 +133,6 @@ const JOSH_SHARED_WRITES: ReadonlySet<string> = new Set([
 	'uninstall',
 ])
 
-function expansion_refusal(program: string, word: string): string {
-	return `\`${program} ${word}\`, an expansion that may spell a write`
-}
-
-// A read spelling holds only when every argument is literal: an expanded one may be `-D` or `expire`.
-function is_git_write(subcommand: string, args: ReadonlyArray<string>): boolean {
-	if (GIT_WRITES.has(subcommand)) return true
-
-	const read_form = GIT_READ_FORMS.get(subcommand)
-	if (read_form === undefined) return false
-
-	return args.some((argument) => is_dynamic(argument)) || !read_form(args)
-}
-
-// A quoted program runs as the bare one: `"git" push` is `git push`.
-function parsed_git(segment: string): ReturnType<typeof git_argv.parse> {
-	return git_argv.parse(segment) ?? git_argv.parse(segment.replaceAll(QUOTES, ''))
-}
-
-// A quoted subcommand runs as the bare one too: `git 'push'` is `git push`.
-function subcommand_refusal(segment: string): Refusal {
-	const call = parsed_git(segment)
-	if (call?.subcommand === undefined) return undefined
-	if (is_dynamic(call.subcommand)) return expansion_refusal('git', call.subcommand)
-
-	const subcommand = call.subcommand.replaceAll(QUOTES, '')
-	const args = call.args.map((argument) => argument.replaceAll(QUOTES, ''))
-
-	return is_git_write(subcommand, args) ? `\`git ${subcommand}\`, a git write` : undefined
-}
-
-function git_refusal(segment: string, args: ReadonlyArray<string>): Refusal {
-	if (args.some((argument) => GIT_WRITE_FLAGS.test(argument))) {
-		return 'a git option that rewrites its configuration, runs a program or writes a file'
-	}
-
-	return subcommand_refusal(segment)
-}
-
 function is_gh_api_write(args: ReadonlyArray<string>): boolean {
 	if (args.includes('graphql')) return args.some((argument) => GRAPHQL_MUTATION.test(argument))
 
@@ -264,15 +140,15 @@ function is_gh_api_write(args: ReadonlyArray<string>): boolean {
 }
 
 function is_gh_verb(argument: string): boolean {
-	return GH_WRITES.has(argument) || GH_READS.has(argument) || is_dynamic(argument)
+	return GH_WRITES.has(argument) || GH_READS.has(argument) || expansion.is_dynamic(argument)
 }
 
 function verb_refusal(group: string, args: ReadonlyArray<string>): Refusal {
 	const verb = args.slice(1).find((argument) => is_gh_verb(argument))
 	if (verb === undefined || GH_READS.has(verb)) return undefined
 
-	return is_dynamic(verb)
-		? expansion_refusal(`gh ${group}`, verb)
+	return expansion.is_dynamic(verb)
+		? expansion.refusal(`gh ${group}`, verb)
 		: `\`gh ${group} ${verb}\`, a GitHub write`
 }
 
@@ -280,7 +156,7 @@ function gh_refusal(args: ReadonlyArray<string>): Refusal {
 	const group = args[0] ?? ''
 	if (group === 'api') return is_gh_api_write(args) ? 'a `gh api` call other than GET' : undefined
 
-	return is_dynamic(group) ? expansion_refusal('gh', group) : verb_refusal(group, args)
+	return expansion.is_dynamic(group) ? expansion.refusal('gh', group) : verb_refusal(group, args)
 }
 
 function is_flag(argument: string): boolean {
@@ -308,7 +184,7 @@ function package_actions(call: ProgramCall): Array<string> {
 }
 
 function action_refusal(manager: string, action: string): Refusal {
-	if (is_dynamic(action)) return expansion_refusal(manager, action)
+	if (expansion.is_dynamic(action)) return expansion.refusal(manager, action)
 
 	return PACKAGE_WRITES.has(action) ? `\`${action}\`, a dependency change` : undefined
 }
@@ -321,7 +197,7 @@ function package_refusal(call: ProgramCall): Refusal {
 
 function josh_refusal(args: ReadonlyArray<string>): Refusal {
 	const command = canonical_command(args[0] ?? '')
-	if (is_dynamic(command)) return expansion_refusal('josh', command)
+	if (expansion.is_dynamic(command)) return expansion.refusal('josh', command)
 	if (!JOSH_SHARED_WRITES.has(command)) return undefined
 
 	const rule = josh_read_only.refusal(args)
@@ -331,8 +207,8 @@ function josh_refusal(args: ReadonlyArray<string>): Refusal {
 
 // The irreversible operation the call is, or `undefined` when it runs.
 function refusal(segment: string, call: ProgramCall): Refusal {
-	if (is_dynamic(call.name)) return `\`${call.name}\`, a program an expansion names`
-	if (call.name === 'git') return git_refusal(segment, call.args)
+	if (expansion.is_dynamic(call.name)) return `\`${call.name}\`, a program an expansion names`
+	if (call.name === 'git') return implementation_shell_deny_git.refusal(segment, call.args)
 	if (call.name === 'gh') return gh_refusal(call.args)
 	if (call.name === 'josh') return josh_refusal(call.args)
 

package/scripts/hooks/implementation-shell.ts

@@ -35,10 +35,27 @@ const DYNAMIC_PATH = /[$`*?{}\\]/u
 // runs: `if x; then git push; fi` and `(cd x && git push)` launch `git push`.
 const COMPOUND_HEAD = /^\s*(?:[({!]\s*|(?:if|then|else|elif|while|until|do)\s+)+/u
 const COMPOUND_CLOSERS = new Set([')', '}', ' ', '\t', '\n'])
-const KEYWORDS: ReadonlySet<string> = new Set(['for', 'do', 'done', 'then', 'else', 'fi', 'esac'])
-// A `case` arm or a function body sits behind a pattern or a name the cut does not read, so the line is
-// refused rather than guessed.
-const UNREAD_BODY = /^(?:case|select|function)\s|^[\w.:-]+\s*\(\s*\)/u
+const KEYWORDS: ReadonlySet<string> = new Set([
+	'for',
+	'do',
+	'done',
+	'then',
+	'else',
+	'fi',
+	'case',
+	'select',
+	'function',
+	'esac',
+])
+// The shared cut reads a `case` arm and a `{` function body as segments of their own
+// (joshuafolkken/kit#7340). What it leaves unread — a function head with another body, or an arm
+// pattern still on its segment — is refused rather than guessed.
+const FUNCTION_START = /^(?:function\s|[\w.:-]+\s*\(\s*\))/u
+// `body_of` has stripped the head's closing `)` and trailing blanks with the other closers.
+const FUNCTION_HEAD = /^(?:function\s+)?[\w.:-]+(?:\s*\()?$/u
+// An arm's command may touch its `)` (`b)git push`), so a `)` anywhere in the first word, outside an
+// expansion, is a pattern.
+const UNREAD_ARMS: ReadonlyArray<RegExp> = [/^case\s[\s\S]*\)/u, /^[^\s$`]*\)/u]
 const ARGUMENT_QUOTES = /['"\\]/gu
 const TIME_PROGRAM = /(?:^|\/)time$/u
 const TIME_WRITE = /^-(?:[A-Za-z]*o|-o)/u
@@ -174,9 +191,15 @@ function command_refusal(segment: string, root: string): Refusal {
 	return call === undefined ? undefined : call_refusal(body_of(segment), call, root)
 }
 
+function is_unread_body(body: string): boolean {
+	if (FUNCTION_START.test(body)) return !FUNCTION_HEAD.test(body)
+
+	return UNREAD_ARMS.some((pattern) => pattern.test(body))
+}
+
 function segment_refusal(segment: string, root: string): Refusal {
 	if (wrapper_writes(segment)) return 'a time output file'
-	if (UNREAD_BODY.test(body_of(segment))) return 'a `case` arm or function body'
+	if (is_unread_body(body_of(segment))) return 'a `case` arm or function body'
 
 	const target = redirected_paths(segment).find((redirected) => unsafe_path(redirected, root))
 

package/scripts/hooks/step-zero-notice.ts

@@ -12,9 +12,9 @@ import { test_declared_logic } from '#scripts/test/test-declared-logic'
 // code", so the hook that delivers it is the one that sees that write: the first `Edit` / `Write` of a
 // runtime file in the session.
 //
-// **A runtime file only.** What counts is `test_declared_logic.is_exempt`, the same classification
-// `pnpm josh test:declared` answers at the commit, so a doc or prompt edit neither shows the notice nor
-// spends it. A path outside the working tree (a memory file, a scratchpad) is not this project's code.
+// **A runtime file only.** `test_declared_logic.is_exempt` shares the commit-time classification;
+// project scratch records in `.josh/tmp` are also non-runtime. A doc, prompt or scratch record neither
+// shows the notice nor spends it. A path outside the working tree is not this project's code.
 //
 // **Once per session**, on a stamp keyed by the transcript like every other guard record here. A stamp
 // that cannot be written stays silent rather than repeating the notice on every edit.
@@ -44,8 +44,8 @@ function is_external(relative: string): boolean {
 	return relative.startsWith(PARENT_PREFIX) || path.isAbsolute(relative)
 }
 
-function is_scratch_record(file_path: string): boolean {
-	const relative = path.relative(tmpdir(), file_path)
+function is_scratch_record(file_path: string, scratch_root = tmpdir()): boolean {
+	const relative = path.relative(scratch_root, file_path)
 	const is_scratch = !is_external(relative)
 
 	return is_scratch && ['.md', '.json', '.txt'].includes(path.extname(file_path))
@@ -66,7 +66,10 @@ function is_runtime_file(
 ): boolean {
 	const relative = path.relative(root, path.resolve(root, file_path))
 
-	if (should_skip_external(relative, path.resolve(root, file_path), should_include_external)) {
+	if (
+		is_scratch_record(path.resolve(root, file_path), path.join(root, '.josh/tmp')) ||
+		should_skip_external(relative, path.resolve(root, file_path), should_include_external)
+	) {
 		return false
 	}
 

package/scripts/hooks/stop-actions.ts

@@ -2,6 +2,7 @@ import { git_gh_repo } from '#scripts/gh/git-gh-repo'
 import { issue_cite } from '#scripts/issue/issue-cite'
 import { session_cite } from '#scripts/issue/session-cite'
 import { bounded_pool } from '#scripts/lib/bounded-pool'
+import { home_tilde } from '#scripts/lib/home-tilde'
 import { stdout_on_stderr } from '#scripts/lib/stdout-on-stderr'
 import { telegram_test } from '#scripts/notify/telegram-test'
 import type { CliValues } from '#scripts/notify/telegram-test-logic'
@@ -71,13 +72,14 @@ async function issue_url_of(issue: string): Promise<string | undefined> {
 	}
 }
 
-// The body is the reply's opening copied into a Telegram, so its bare `#N` are linked (`issue-citation.md`).
+// The body is the reply's opening copied into a Telegram, so its bare `#N` are linked (`issue-citation.md`)
+// and its home directory is written as `~` before the cut (joshuafolkken/kit#7342).
 // The choices are the reply's own decision lines (joshuafolkken/kit#3961).
 function notify_values(issue_url: string | undefined, action: NotifyAction): CliValues {
 	const { recommended, alternative } = action.decision
 	const values: CliValues = {
 		'task-type': 'confirmation',
-		body: session_cite.text(summary_of(action.message)),
+		body: session_cite.text(summary_of(home_tilde.mask(action.message))),
 		recommended,
 		...(alternative !== undefined && { alternative: [alternative] }),
 	}

package/scripts/init/init-logic-workspace.ts

@@ -155,7 +155,7 @@ function carry_npmrc_setting(template: string, npmrc: string, setting: MovedNpmr
 }
 
 // Lines kit's own install needs but a consumer must not receive, fenced by `# kit-only:start` and
-// `# kit-only:end` — e.g. an override that only works with a patch kit does not publish (#5500).
+// `# kit-only:end` — e.g. a cross-major override of ESLint's dependencies (#5500).
 const KIT_ONLY_REGION_PATTERN =
 	/^[ \t]*# kit-only:start\b.*\n(?:.*\n)*?[ \t]*# kit-only:end\b.*\n/gmu
 

package/scripts/issue/issue-auto-ok.ts

@@ -16,11 +16,11 @@ import { markdown_section } from './markdown-section'
 // of an Issue already open reuses `exclusion_of` rather than a second list (joshuafolkken/kit#3854).
 // The order: `--no-auto-ok`, a filing to another repository (whose own `backlogrun` would implement
 // and merge it though nobody opted that repository in), a label that keeps a person in the loop, and
-// last the body's judgement declaration (`JUDGEMENT_NEEDED` / `JUDGEMENT_NOT_NEEDED`): whether a
+// last the body's recorded user prohibition or judgement declaration (`JUDGEMENT_NEEDED` / `JUDGEMENT_NOT_NEEDED`): whether a
 // policy decision, an external account or a human visual check is needed.
 
 interface AutoOkFiling {
-	// `--no-auto-ok`: the filer declared the Issue needs a person's judgement.
+	// `--no-auto-ok`: an existing exclusion or a verified original user prohibition.
 	is_opted_out: boolean
 	is_cross_repository: boolean
 	// Every label the filing carries, including the ones the body's declarations add.
@@ -53,6 +53,26 @@ const APPLIED: AutoOkDecision = {
 	is_applied: true,
 	reason: 'no exclusion holds and the body declares no judgement is needed',
 }
+const CONSTRAINT_HEADING = issue_body_keys.heading('auto_execution_constraint')
+const CONSTRAINT_SOURCE = `${issue_body_keys.prefix('constraint_source')} user`
+const CONSTRAINT_REFERENCE = `${issue_body_keys.prefix('constraint_reference')} `
+const CONSTRAINT_INSTRUCTION = `${issue_body_keys.prefix('constraint_instruction')} `
+const CONSTRAINT_FIELDS = [CONSTRAINT_REFERENCE, CONSTRAINT_INSTRUCTION]
+const CONSTRAINT_PROBLEM = `--no-auto-ok without an exclusion needs ${CONSTRAINT_HEADING}: ${CONSTRAINT_SOURCE}, ${CONSTRAINT_REFERENCE}<original user prompt or comment URL>, ${CONSTRAINT_INSTRUCTION}<verbatim prohibition>; verify the cited user instruction, not an agent inference or a later judgement. Kickoff ending at planning is not an opt-out.`
+const USER_CONSTRAINT: AutoOkDecision = {
+	is_applied: false,
+	reason: 'a user prohibition is recorded under 自動実行の制約',
+}
+
+function user_constraint_of(body: string): AutoOkDecision | undefined {
+	const section = markdown_section.section_lines(body, CONSTRAINT_HEADING).join('\n')
+	const lines = markdown_section.unfenced_lines(section).map((line) => line.trim())
+	const has_fields = CONSTRAINT_FIELDS.every((prefix) =>
+		lines.some((line) => line.startsWith(prefix) && line.slice(prefix.length).trim() !== ''),
+	)
+
+	return has_fields && lines.includes(CONSTRAINT_SOURCE) ? USER_CONSTRAINT : undefined
+}
 
 // The labels that keep a person in the loop, each with the reason it withholds `auto-ok`. A
 // `breaking-change` declared in the body arrives here as its label, added before the decision.
@@ -102,18 +122,37 @@ function decision_problem(body: string): string | undefined {
 	return has_rule ? DECISION_PROBLEM : undefined
 }
 
+function body_decision(body: string): AutoOkDecision {
+	return user_constraint_of(body) ?? (judgement_of(body) === false ? APPLIED : JUDGEMENT)
+}
+
 function decide(filing: AutoOkFiling): AutoOkDecision {
 	if (filing.is_opted_out) return OPTED_OUT
 	if (filing.is_cross_repository) return CROSS_REPOSITORY
 
-	return exclusion_of(filing.labels) ?? (judgement_of(filing.body) === false ? APPLIED : JUDGEMENT)
+	return exclusion_of(filing.labels) ?? body_decision(filing.body)
+}
+
+function opt_out_problem(filing: AutoOkFiling): string | undefined {
+	if (!filing.is_opted_out || user_constraint_of(filing.body) !== undefined) return undefined
+	const without_opt_out = decide({ ...filing, is_opted_out: false })
+
+	return without_opt_out.is_applied ? CONSTRAINT_PROBLEM : undefined
 }
 
 function line_of(decision: AutoOkDecision): string {
 	return `auto-ok: ${decision.is_applied ? 'applied' : 'not applied'} — ${decision.reason}`
 }
 
-const issue_auto_ok = { declaration_problem, decide, decision_problem, exclusion_of, line_of }
+const issue_auto_ok = {
+	declaration_problem,
+	decide,
+	decision_problem,
+	exclusion_of,
+	line_of,
+	opt_out_problem,
+	user_constraint_of,
+}
 
 export type { AutoOkDecision, AutoOkFiling }
 export { issue_auto_ok }

package/scripts/issue/issue-body-keys.ts

@@ -42,6 +42,9 @@ const KEYS = {
 	sample_gate: { ja: '実施可能条件', en: 'Sample gate' },
 	not_before: { ja: '実施可能日', en: 'Not before' },
 	source: { ja: '出どころ', en: 'Source' },
+	constraint_source: { ja: '出所', en: 'Constraint source' },
+	constraint_reference: { ja: '参照', en: 'Constraint reference' },
+	constraint_instruction: { ja: '指示', en: 'Constraint instruction' },
 } as const satisfies Record<string, Row>
 
 const VALUES = {
@@ -72,6 +75,7 @@ const HEADINGS = {
 	baseline: { ja: 'ベースライン', en: 'Baseline' },
 	reproduction: { ja: '再現', en: 'Reproduction' },
 	expected_effect: { ja: '期待効果', en: 'Expected effect' },
+	auto_execution_constraint: { ja: '自動実行の制約', en: 'Automatic execution constraint' },
 } as const satisfies Record<string, Row>
 
 // The size estimate's value: `<files>` and `<lines>` stand for its counts.

package/scripts/issue/issue-comment-cli.ts

@@ -3,6 +3,7 @@ import { issue_number_shape } from '#scripts/issue/issue-number-shape'
 import { cli_body } from '#scripts/josh/cli-body'
 import { cli_flags } from '#scripts/lib/cli-flags'
 import { error_text } from '#scripts/lib/error-message'
+import { issue_outcome } from './issue-outcome'
 
 // `josh issue:comment <N> --body <text> | --body-file <path>` — post one comment to an issue (a PR
 // comment is an issue comment over REST) and print the comment URL.
@@ -28,7 +29,12 @@ interface CommentRequest {
 
 // The read is strict: an unknown flag refuses the call rather than being
 // ignored. `cli_body.resolve` owns the both-flags-at-once refusal and the file read.
-const OPTIONS = { body: { type: 'string' }, 'body-file': { type: 'string' } } as const
+const OPTIONS = {
+	body: { type: 'string' },
+	'body-file': { type: 'string' },
+	outcome: { type: 'string' },
+	'evidence-url': { type: 'string' },
+} as const
 
 // `resolve` may throw when both body flags are given, which `run` reports — the message names the two
 // flags a caller must pick between.
@@ -47,7 +53,14 @@ function parse_request(argv: ReadonlyArray<string>): CommentRequest | undefined
 
 	if (body === undefined || body.length === 0) return undefined
 
-	return { issue_number, body }
+	return {
+		issue_number,
+		body: issue_outcome.body_of({
+			body,
+			summary: parsed.values.outcome,
+			url: parsed.values['evidence-url'],
+		}),
+	}
 }
 
 // A both-flags refusal and a file-read failure both surface as an `Error` from `resolve`, and its

package/scripts/issue/issue-evidence-exit.ts

@@ -4,6 +4,7 @@ import { cli_body } from '#scripts/josh/cli-body'
 import { cli_flags } from '#scripts/lib/cli-flags'
 import { error_text } from '#scripts/lib/error-message'
 import { run_hold_cli } from '#scripts/run/hold/run-hold-cli'
+import { issue_outcome } from './issue-outcome'
 
 // The shape every evidence exit shares — `josh issue:already-done` and `josh issue:measured`: the
 // evidence comment, the exit's own finishing write, then the `run:release`, in that order.
@@ -14,7 +15,7 @@ import { run_hold_cli } from '#scripts/run/hold/run-hold-cli'
 
 const FAILURE_EXIT_CODE = 1
 const EVIDENCE_FILE_FLAG = '--evidence-file'
-const OPTIONS = { 'evidence-file': { type: 'string' } } as const
+const OPTIONS = { 'evidence-file': { type: 'string' }, outcome: { type: 'string' } } as const
 
 interface EvidenceRequest {
 	issue_number: string
@@ -41,7 +42,10 @@ function parse_request(argv: ReadonlyArray<string>): EvidenceRequest | undefined
 	const evidence = cli_body.read_file_or_stdin(file_path).trim()
 	if (evidence.length === 0) throw new Error(`Evidence file is empty: ${file_path}`)
 
-	return { issue_number, evidence }
+	return {
+		issue_number,
+		evidence: issue_outcome.body_of({ body: evidence, summary: parsed.values.outcome }),
+	}
 }
 
 // A file-read failure or an empty file is an `Error` naming the path, printed as-is; every other

package/scripts/issue/issue-file-cli.ts

@@ -23,6 +23,7 @@ import { issue_file_deferral } from './issue-file-deferral'
 import { issue_file_fold } from './issue-file-fold'
 import { issue_file_interrupt } from './issue-file-interrupt'
 import { issue_file_pass, type Filing } from './issue-file-pass'
+import { issue_file_worker } from './issue-file-worker'
 import { has_label_name, has_parked_label, RUN_SOLO_LABEL } from './issue-labels'
 import { issue_priority } from './issue-priority'
 import { issue_release_cli } from './issue-release-cli'
@@ -72,7 +73,10 @@ function party_refusal(target: string): string | undefined {
 // rather than printed, so it is printed here — otherwise the filing fails with no reason given. A label
 // the create applies is provisioned first, so it never arrives with a generated color.
 async function create(filing: Filing, labels: ReadonlyArray<string>): Promise<string | undefined> {
-	repository_labels.ensure_labels(filing.target)
+	repository_labels.ensure_labels(
+		filing.target,
+		issue_file_worker.label_definitions(filing, labels),
+	)
 	const request = git_gh_issue_write.issue_create_request({
 		title: filing.args.title,
 		body: filing.body,

package/scripts/issue/issue-file-pass.ts

@@ -2,10 +2,11 @@ import { git_gh_issue_list, MAX_SCANNED } from '#scripts/gh/git-gh-issue-list'
 import type { ImplementRate } from '#scripts/lane/lane-implement-rate'
 import { lane_net_read } from '#scripts/lane/lane-net-read'
 import type { SizeRatios } from '#scripts/lane/lane-size-stats'
-import { issue_auto_ok } from './issue-auto-ok'
+import { issue_auto_ok, type AutoOkFiling } from './issue-auto-ok'
 import { issue_cap_files } from './issue-cap-files'
 import { issue_file, type FileArguments } from './issue-file'
 import { issue_file_lane_hint } from './issue-file-lane-hint'
+import { issue_file_worker } from './issue-file-worker'
 import { issue_lint_cli } from './issue-lint-cli'
 import { issue_priority } from './issue-priority'
 import { issue_sample_required } from './issue-sample-required'
@@ -32,6 +33,15 @@ interface Filing {
 	scouted?: ScoutOutcome | undefined
 }
 
+function auto_ok_filing(filing: Filing): AutoOkFiling {
+	return {
+		is_opted_out: filing.args.is_auto_ok_opted_out,
+		is_cross_repository: !issue_file.is_same_repository(filing.target, filing.current),
+		labels: issue_file.labels_of(filing.args, filing.body),
+		body: filing.body,
+	}
+}
+
 // Every refusal the body and the arguments carry, read locally — `[]` when the body is admitted.
 function refusals_of(
 	filing: Filing,
@@ -43,6 +53,7 @@ function refusals_of(
 		size_estimate.guide_problem(filing.body, filing.args.route, rate, growth),
 		issue_sample_required.problem(filing.body),
 		issue_auto_ok.declaration_problem(filing.body),
+		issue_auto_ok.opt_out_problem(auto_ok_filing(filing)),
 		issue_priority.problem(filing.body, filing.args.labels),
 		issue_file.origin_problem(filing.body, filing.target, filing.current),
 	]
@@ -157,12 +168,7 @@ async function is_scout_clear(filing: Filing): Promise<boolean> {
 // The decision reads the labels the body's declarations add, so a declared breaking change is excluded
 // like its label.
 function labels_of(filing: Filing): ReadonlyArray<string> | undefined {
-	const auto_ok = issue_auto_ok.decide({
-		is_opted_out: filing.args.is_auto_ok_opted_out,
-		is_cross_repository: !issue_file.is_same_repository(filing.target, filing.current),
-		labels: issue_file.labels_of(filing.args, filing.body),
-		body: filing.body,
-	})
+	const auto_ok = issue_auto_ok.decide(auto_ok_filing(filing))
 
 	console.info(issue_auto_ok.line_of(auto_ok))
 	const labels = issue_file.labels_of(filing.args, filing.body, auto_ok.is_applied)
@@ -224,6 +230,7 @@ async function labels_in_one_pass(filing: Filing): Promise<ReadonlyArray<string>
 	const verdicts = [
 		is_body_clear,
 		labels !== undefined,
+		issue_file_worker.is_worker_clear(filing, labels ?? filing.args.labels),
 		await is_source_clear(filing),
 		await is_wip_clear(filing),
 		await is_scout_clear(filing),