@lchase/kiln 0.1.0 → 0.4.0

package/README.md

@@ -1,10 +1,10 @@
 # Kiln
 
-Kiln runs a workflow against a git checkout. Register any repo, add a job from a markdown spec, a prompt, a directory of tickets, or a Jira Cloud issue, and tick. Tick launches ready jobs in yak worktrees. Status shows each job. Approve or reject answers a human gate.
+Kiln runs a workflow against a git checkout. Register any repo, add a job from a markdown spec, a prompt, a directory of tickets, or a Jira Cloud issue, and tick. Tick launches ready jobs in yak worktrees. Status shows each job. Approve or reject answers a human gate. `kiln serve` opens that same derived state in a browser on this machine.
 
 A ready spec is the input. Kiln does not build or iterate requirements.
 
-This repository is public. Checkout paths and jobs stay in gitignored `.kiln/` or `~/.kiln/`. Do not commit them.
+This repository is public. Checkout paths and jobs stay in `~/.kiln/` (or `$KILN_HOME` when that is set). Do not commit them.
 
 ## Install
 
@@ -14,6 +14,10 @@ kiln repo add web /absolute/path/to/web --test "npm test"
 kiln repo list
 ```
 
+Run `kiln repo add <name> <path>` from any directory. The first run creates `~/.kiln/kiln.config.json`. Jobs, logs, and deliveries live in that same directory, whichever directory you run `kiln` from. Set `KILN_HOME` or pass `--config <file>` to use a different kiln home.
+
+If `./.kiln/kiln.config.json` is still in the working directory and the home config does not exist, kiln stops. Move it with `mv ./.kiln ~/.kiln`, or pass `--config` / set `KILN_HOME`. Kiln does not move it for you.
+
 `kiln` is the command. The subcommands in the rest of this file are the same ones. Examples that say `npm run kiln --` are the in-checkout form.
 
 ## Develop from a checkout
@@ -47,12 +51,12 @@ npm run kiln -- repo add api /absolute/path/to/api --test "npm test"
 npm run kiln -- repo list
 ```
 
-`npm run kiln` builds first. `npm run kiln -- repo add` writes `./.kiln/kiln.config.json` (or updates `~/.kiln/kiln.config.json` when that file already exists). A relative path is stored relative to the config file's directory. `~` is expanded from the home directory. `test` is optional on the entry and required before tick can launch a job in that repo.
+`npm run kiln` builds first. `kiln repo add <name> <path>` writes `~/.kiln/kiln.config.json`. When `KILN_HOME` is set it writes `$KILN_HOME/kiln.config.json`. `--config <file>` writes that file instead, and jobs live in the file's directory. A relative path is stored absolute, resolved from the working directory at add time. `~` is expanded from the home directory. `test` is optional on the entry and required before tick can launch a job in that repo.
 
 ```json
 {
   "repos": {
-    "web": { "path": "../web", "test": "npm test" },
+    "web": { "path": "/absolute/path/to/web", "test": "npm test" },
     "api": { "path": "~/src/api", "test": "npm test" }
   },
   "maxConcurrent": 2,
@@ -64,7 +68,7 @@ npm run kiln -- repo list
 
 ## Add a job
 
-A job is one workflow run. The workflow name is a file `workflows/<name>.yaml`. `feature` is the factory loop. Bug, investigation, and security workflows are next. A later `pr-review` workflow is not in this repo yet.
+A job is one workflow run. The workflow name is a file `workflows/<name>.yaml`. `feature` is the factory loop. `investigation` answers a spike and stops for a person to approve the findings. Bug and security workflows are next. A later `pr-review` workflow is not in this repo yet.
 
 ```bash
 npm run kiln -- add feature --repo web --spec spec.md --title "Show a Sunday summary"
@@ -72,7 +76,7 @@ npm run kiln -- add feature --repo api --spec api-spec.md --after <job-id>
 npm run kiln -- add feature --repo web --jira PROJ-123
 ```
 
-`--title` defaults to the first `#` heading in the spec, then the file name. `--after` may be repeated. Those jobs must already exist. Kiln copies the spec to `.kiln/specs/<id>.md` and writes `.kiln/jobs/<id>.json`:
+`--title` defaults to the first `#` heading in the spec, then the file name. `--after` may be repeated. Those jobs must already exist. Kiln copies the spec to `~/.kiln/specs/<id>.md` and writes `~/.kiln/jobs/<id>.json`:
 
 ```json
 {
@@ -87,7 +91,7 @@ npm run kiln -- add feature --repo web --jira PROJ-123
 }
 ```
 
-`dependsOn` is omitted when the job has no `--after`. `stack: true` is set by `--stack` and is omitted otherwise. `source` records which intake created the job. Jobs written before intake omit `source` and still run. State is not stored. The pull request url is not stored on the job; Kiln writes it under `.kiln/deliveries/`.
+`dependsOn` is omitted when the job has no `--after`. `stack: true` is set by `--stack` and is omitted otherwise. `source` records which intake created the job. Jobs written before intake omit `source` and still run. State is not stored. The pull request url is not stored on the job; Kiln writes it under `~/.kiln/deliveries/`.
 
 ## Intake
 
@@ -121,7 +125,7 @@ npm run kiln -- import ./tickets --repo web --workflow feature --context spec.md
 
 One file becomes one job. Blocked-by becomes `dependsOn` on the imported job ids. An unknown number is an error that names the ticket file, and no new job is written.
 
-`--workflow` defaults to `feature`. Kiln switches a ticket to `investigation` only when `workflows/investigation.yaml` exists and the ticket is a spike: front matter `type` is `spike`, `investigation`, or `research` (the word after a colon counts, as in `wayfinder:research`), the title contains spike or probe, or the text says "no product code". A body that only mentions an upstream spike stays on the requested workflow. `investigation` is not in this repo, so a spike ticket stays on the requested workflow and Kiln prints a warning.
+`--workflow` defaults to `feature`. Kiln switches a ticket to `investigation` when the ticket is a spike: front matter `type` is `spike`, `investigation`, or `research` (the word after a colon counts, as in `wayfinder:research`), the title contains spike or probe, or the text says "no product code". A body that only mentions an upstream spike stays on the requested workflow.
 
 `--context` defaults to `spec.md` in the parent of the ticket directory when that file is present. The text is appended to every job spec as a `## Background` section. A context file larger than 40KB is not copied in. The spec names its path instead.
 
@@ -136,7 +140,7 @@ npm run kiln -- add feature --repo web --jira PROJ-123 --after <job-id> --dry-ru
 
 `--jira` reads one Jira Cloud issue over REST API v3 and writes the same job as the other intakes. `source.kind` is `jira`. `source.ref` is the issue key (`PROJ-123`). The title is `PROJ-123: <summary>`. The spec is that heading, a `Source:` line with the issue's browse URL, then the description converted from Atlassian document format to markdown.
 
-Set `JIRA_BASE_URL` (for example `https://acme.atlassian.net`), `JIRA_EMAIL`, and `JIRA_API_TOKEN`. Each value falls back to the optional `jira` block in the gitignored kiln config (`./.kiln/kiln.config.json`, or `~/.kiln/kiln.config.json` when the working directory has no config):
+Set `JIRA_BASE_URL` (for example `https://acme.atlassian.net`), `JIRA_EMAIL`, and `JIRA_API_TOKEN`. Each value falls back to the optional `jira` block in the kiln config (`~/.kiln/kiln.config.json`, or `$KILN_HOME/kiln.config.json` when `KILN_HOME` is set, or the file passed with `--config`). Environment variables override the block:
 
 ```json
 "jira": {
@@ -148,10 +152,32 @@ Set `JIRA_BASE_URL` (for example `https://acme.atlassian.net`), `JIRA_EMAIL`, an
 
 Create a token at <https://id.atlassian.com/manage-profile/security/api-tokens>. Kiln sends it as Basic auth and does not write it into the job, the spec, or error text. A missing value is an error that names `JIRA_BASE_URL`, `JIRA_EMAIL`, or `JIRA_API_TOKEN`.
 
-A Blocks link where this issue is blocked by another key becomes `dependsOn` when a kiln job with `source` `jira` and that key already exists. Otherwise Kiln prints a warning naming the key and still creates the job. `--after` is merged with those ids. Issue type Spike or Research uses the same rule as a spike ticket: `investigation` when `workflows/investigation.yaml` exists, and a warning on the requested workflow when it does not. Running add again for the same key prints the existing job id and creates nothing. `--dry-run` prints the job and writes nothing.
+A Blocks link where this issue is blocked by another key becomes `dependsOn` when a kiln job with `source` `jira` and that key already exists. Otherwise Kiln prints a warning naming the key and still creates the job. `--after` is merged with those ids. Issue type Spike or Research uses the same rule as a spike ticket and is imported as `investigation`. Running add again for the same key prints the existing job id and creates nothing. `--dry-run` prints the job and writes nothing.
 
 `examples/spec.md` is a fictional spec you can copy.
 
+## Serve
+
+```bash
+kiln serve
+kiln serve --port 4100 --tick 30
+kiln serve --no-tick
+```
+
+`kiln serve` listens on `127.0.0.1` only (port 4100 unless `--port` is set). It reads the same derived state as `kiln status` and calls the same approve, reject, and retry functions. Nothing new is stored.
+
+`/` is the operator board, using the factory dashboard's dark charcoal layout. Columns are workflow stages taken from the job's yaml steps and the current yak step. Queued is first: jobs whose derived state is queued or blocked, with the subtitle `waiting · deps` and dimmer text. A blocked card names the jobs it is waiting on. Spec holds a job only while the spec step is the one running. Then Build (`builder · opus`), Review (`sec · ux · ui · code`), Approve (`approver · opus`), Land, PR review, Merged, and Needs human. An investigation adds Explore. Needs human stays at the right and holds open gates, dead runs, failures that are not waiting on an automatic retry, invalid job files, and rejections. A failed job with `nextRetryAt` still set stays in the column of the step it was on (Build, Review, and so on), dimmer, with one line `retrying 7:35 PM · attempt 1/3 · stalled` in the browser's local time. It is not in the needs-you count. When that retry starts, the card is a normal running card again. An empty column is a narrow strip with the name written down it. The header clock and any timestamps in the drawer use the browser's local time; stored values stay ISO UTC. The bottom toolbar switches between that and always-expanded columns; the choice is stored in `localStorage`. Repo chips across the top filter the cards. A card shows the job id, repo, title, branch, pull request, and one row per review round (security, ux, ui, code). A blocked card names what it is waiting on. Clicking a card opens a drawer. Approve, Reject, and Retry sit in the drawer header when the job is gated or failed. The drawer lists the spec, build, decision, each review, and investigation findings, and the selected file is rendered on the right. `/board` is the same page. The document title is `(N) Kiln`, where N is the needs-you count from the attention view (gates, dead runs, failures with no automatic retry left, and open pull requests). A job waiting out its backoff is not included, and it does not fire the desktop notification. The page polls every 3 seconds. After you opt in from the toolbar, a desktop notification fires when that count goes up. Kiln does not record factory quality averages, so the header does not invent round or human-fix numbers.
+
+`GET /jobs/<id>/findings` renders the approved findings markdown as text. HTML in that file is escaped. The page is read-only.
+
+`GET /api/jobs` and `GET /api/jobs/<id>` return that view as JSON, including the attention sections. `POST /api/jobs/<id>/approve`, `POST /api/jobs/<id>/reject`, and `POST /api/jobs/<id>/retry` call the same functions as the CLI. A browser POST from another origin is rejected. The page and the stylesheet ship inside the package (`assets/serve.css`, read from the package root).
+
+`kiln retry <jobId>` relaunches a failed or dead job with the same launch tick uses, and clears `<kiln-dir>/attempts/<job-id>.json`. A landed job that only failed to open its pull request is delivered again instead. The board's Retry button calls that same function.
+
+By default, serve runs `kiln tick` once when it starts and then every 30 seconds. `--tick <seconds>` changes the interval. `--no-tick` leaves the factory where it is. The tick uses the same lock as `kiln tick`, so a second tick exits with "another kiln tick is running" instead of launching twice. There is no intake form in this UI yet.
+
+The Jira API token is not rendered. Do not commit checkout paths or job files.
+
 ## Tick, status, approve
 
 ```bash
@@ -169,7 +195,9 @@ while true; do npm run kiln -- tick; sleep 30; done
 
 A job is ready when its dependencies are met and the number of jobs in flight is under `maxConcurrent`. The default is after merged: every job in `dependsOn` is `done`. `--stack` is met when that one upstream has landed. A rejected gate does not unblock the next job. An ok run with no readable approval does not either.
 
-`npm run kiln -- status` lists jobs across repos. When a job has `source`, status prints `source <kind> <ref>`. For `needs-human` it prints `approve: kiln approve <id>` and `reject: kiln reject <id>`. Run those as `npm run kiln -- approve <id>` and `npm run kiln -- reject <id>`. For `done` and `in-review` it prints `branch yak/<run-id>`. For `deliver=pr` it also prints the pull request url once one exists. For `blocked` on a dependency id that has no job file, it prints `blocked on missing job <id>`. While an upstream pull request is open, it prints `waiting for PR #N to merge`.
+`stallTimeoutMs` (default `900000`, 15 minutes) and `maxAttempts` (default `3`) live in the kiln config. `stallTimeoutMs` of `0` or below turns stall detection off. A running job with no yak journal event and no log output for that long is killed, process tree included, and marked failed with reason `stalled`. A process that is already gone when `kiln tick` or `kiln serve` starts is `orphaned`. An agent or launch crash is `crashed`. A non-zero exit that is not a gate rejection is `failed`. Those four retry on their own after `10s × 2^(n-1)`, capped at 5 minutes. A rejected gate, a cancelled run, and an ok run with no readable approval do not. After `maxAttempts` the job is `dead`. Each attempt is a file under `<kiln-dir>/attempts/<job-id>.json`, so state stays derived. Status prints `attempts`, `reason`, and `next retry` from the same view `readStatus` returns. On the board, a dead card in Needs human shows `attempt N/M` and the reason. A failure that still has a scheduled retry stays in its stage column instead, with `retrying` and the local time.
+
+`npm run kiln -- status` lists jobs across repos. When a job has `source`, status prints `source <kind> <ref>`. For `needs-human` it prints `approve: kiln approve <id>` and `reject: kiln reject <id>`. Run those as `npm run kiln -- approve <id>` and `npm run kiln -- reject <id>`. For `done` and `in-review` it prints `branch yak/<run-id>`. For `deliver=pr` it also prints the pull request url once one exists. For an investigation whose findings file exists, it prints `findings <path>`. That path is `findingsPath` on the same status view `kiln serve` renders, and the console links it. For `blocked` on a dependency id that has no job file, it prints `blocked on missing job <id>`. While an upstream pull request is open, it prints `waiting for PR #N to merge`. `npm run kiln -- retry <id>` relaunches a failed or dead job, or delivers again when the only failure is opening the pull request, and clears the attempt ledger.
 
 State is derived from the yak journal, the gate files, and (for `deliver=pr`) `gh pr view`:
 
@@ -181,10 +209,10 @@ State is derived from the yak journal, the gate files, and (for `deliver=pr`) `g
 | `needs-human` | The run is suspended on an open gate |
 | `approved` | The gate says approve and the run has not finished. This still holds a slot |
 | `rejected` | The run finished ok and the gate says reject |
-| `failed` | The run failed, the launch died before a journal, the run finished ok with no readable approval, or a pull request could not be opened |
-| `dead` | The journal's process is gone. Status prints the cancel command |
+| `failed` | The run failed, the launch died before a journal, the run finished ok with no readable approval, a pull request could not be opened, or a transient failure is waiting to retry |
+| `dead` | The attempt budget is used up. Before the next tick, a journal whose process is already gone is also `dead`. Status prints the cancel command when a process is gone, and `kiln retry <id>` once attempts are exhausted |
 | `in-review` | `deliver=pr` and the run has landed. The pull request is open, or the next tick still has to open it |
-| `done` | `deliver=local`: the run finished ok and the gate says approve. `deliver=pr`: that pull request has merged |
+| `done` | `deliver=local`: the run finished ok and the gate says approve. `deliver=pr`: that pull request has merged. An investigation is `done` when the gate says approve, including when the repo is `deliver=pr`. It does not enter `in-review` |
 
 ## What a feature job runs
 
@@ -196,6 +224,18 @@ Verify runs the repo's `test` command with `failOn: never`. Stdout and stderr st
 
 The first launch adds `.runs/` and `.yak/` to that checkout's `.git/info/exclude`.
 
+## What an investigation job runs
+
+A spike, probe, or research ticket runs `workflows/investigation.yaml`. One agent explores the worktree. It may run commands and scripts. It must not change product code: the step has no Write or Edit tool, and the prompt forbids creating, editing, deleting, committing, and pushing. The agent returns a markdown document with four sections: Questions, Answers (each answer includes evidence: file paths and command output), Unconfirmed, and Implications for dependent tickets.
+
+The run then suspends on a human gate. There is no build, review, verify, or land step. `npm run kiln -- approve <job-id>` stores that markdown at `<kiln-dir>/findings/<job-id>.md` and the job is `done`. Writing the same text again does not change the file. `npm run kiln -- reject <job-id>` is `rejected` and writes no findings file. A rejected investigation does not unblock a dependent.
+
+`deliver=pr` does not change this. Kiln does not push the investigation branch and does not run `gh pr create`.
+
+A later job whose `dependsOn` includes that investigation receives the findings in the spec yak sees. Kiln appends a `## Findings from <title>` section for each investigation dependency. The copy under `<kiln-dir>/specs/` is left as it was. After merged still waits until the investigation is `done`. `--stack` onto an investigation is an error: there is no branch to target.
+
+`adapter: "mock"` reads `test/fixtures/kiln-investigation/explore.json` from the checkout. The prompt is `prompts/kiln/investigation.md`. The published package includes `prompts` and `workflows`.
+
 ## Delivery and dependencies
 
 `deliver` is set on the repo. The default is `local`: the job is `done` when the run lands on `yak/<run-id>`, and Kiln does not push. Existing repos and tests stay on that path.
@@ -206,7 +246,7 @@ npm run kiln -- repo add web /absolute/path/to/web --test "npm test" --deliver p
 
 `deliver` is `local` or `pr`. `base` is the pull request base branch. When `base` is omitted, Kiln uses origin's default branch, from `refs/remotes/origin/HEAD` after `git fetch`.
 
-With `deliver=pr`, the tick after an approved land pushes `yak/<run-id>` and runs `gh pr create --draft`. The title is the job title. The body is the spec's first paragraph, the line `Kiln job: <id>`, and the security, ux, ui, code, and approver verdicts. The branch, pull request number, and url are written to `.kiln/deliveries/<job-id>.json`, not the job file. A later tick looks up an existing pull request for that branch and does not push when origin already has the same commit. Kiln does not merge, and it does not push the base branch.
+With `deliver=pr`, the tick after an approved land pushes `yak/<run-id>` and runs `gh pr create --draft`. The title is the job title. The body is the spec's first paragraph, the line `Kiln job: <id>`, and the security, ux, ui, code, and approver verdicts. The branch, pull request number, and url are written to `~/.kiln/deliveries/<job-id>.json`, not the job file. A later tick looks up an existing pull request for that branch and does not push when origin already has the same commit. Kiln does not merge, and it does not push the base branch. An investigation is not delivered this way: approve stores findings and the job is `done`.
 
 If `gh` is missing or not authenticated, that job becomes `failed` and status prints what to run (`gh auth login`, then `kiln tick`). The rest of the tick still runs. The next tick tries again.
 
@@ -216,7 +256,7 @@ If `gh` is missing or not authenticated, that job becomes `failed` and status pr
 
 The default is after merged. A job stays `blocked` until every upstream is `done`. Status says `waiting for PR #N to merge` while an upstream pull request is open. A `deliver=pr` worktree is cut from `origin/<base>` after `git fetch`, not from checkout `HEAD`.
 
-`--stack` on `kiln add` or `kiln import` waits for one upstream to be approved and landed, then cuts the worktree from that upstream branch (`yak/<run-id>`). The pull request targets that branch. `stack` with any count other than one dependency is an error at add time, and the upstream job has to be in the same repo. Stacked work does not wait for the upstream pull request to merge.
+`--stack` on `kiln add` or `kiln import` waits for one upstream to be approved and landed, then cuts the worktree from that upstream branch (`yak/<run-id>`). The pull request targets that branch. `stack` with any count other than one dependency is an error at add time, and the upstream job has to be in the same repo. Stacking onto an investigation is an error, because that job does not land a branch. Stacked work does not wait for the upstream pull request to merge.
 
 ```bash
 npm run kiln -- add feature --repo web --spec spec.md --after <job-id> --stack
@@ -225,4 +265,4 @@ npm run kiln -- import ./tickets --repo web --stack
 
 ## Not included
 
-No requirement refinement. Bug, investigation, security, and pr-review workflows are not in this repo yet. Kiln does not merge pull requests and does not push the base branch.
+No requirement refinement. Bug, security, and pr-review workflows are not in this repo yet. Kiln does not merge pull requests and does not push the base branch.

package/assets/serve.css

@@ -0,0 +1,452 @@
+/* kiln-serve */
+/* Tokens and layout from the factory dashboard (plugins/factory/dashboard). Dark only. */
+:root {
+  --bg: #1c2023;
+  --panel: #24292d;
+  --card: #24292d;
+  --card-hover: #2d3338;
+  --line: #2d3338;
+  --line-strong: #4a5259;
+  --ink: #fcfcfd;
+  --muted: #b7bcc1;
+  --faint: #888e92;
+  --live: #4bc4c9;
+  --pass: #90cea7;
+  --changes: #ffcc61;
+  --human: #ff6300;
+  --merged: #a794ff;
+  --must: #f7a89c;
+  --primary: #5405bd;
+  --code: #beb3ff;
+  --code-bg: #2d3338;
+  --shadow: 0 4px 8px -2px #00000066, 0 8px 16px 0 #00000059;
+  --mono: "Roboto Mono", ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+}
+* { box-sizing: border-box; }
+[hidden] { display: none !important; }
+html, body { margin: 0; }
+html { background: var(--bg); }
+body {
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+  background: var(--bg);
+  color: var(--ink);
+  font: 14px/20px Roboto, -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+  -webkit-font-smoothing: antialiased;
+  padding-bottom: 80px;
+}
+button { font: inherit; color: inherit; }
+a { color: var(--code); }
+
+header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 16px;
+  flex-wrap: wrap;
+  min-height: 56px;
+  padding: 0 24px;
+  border-bottom: 1px solid var(--line);
+}
+.brand { display: flex; align-items: center; gap: 12px; }
+.logo {
+  width: 28px;
+  height: 28px;
+  border-radius: 50%;
+  background: var(--primary);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+}
+.ver { font-size: 12px; line-height: 16px; color: var(--faint); align-self: flex-end; margin: 0 0 4px -4px; }
+h1 { margin: 0; font-size: 18px; line-height: 24px; font-weight: 500; }
+.status { margin-left: auto; font-family: var(--mono); font-size: 12px; line-height: 16px; color: var(--muted); }
+.status::before {
+  content: "";
+  display: inline-block;
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--live);
+  margin-right: 8px;
+  vertical-align: 0;
+  animation: pulse 1.6s ease-in-out infinite;
+}
+.status.err { color: var(--human); }
+.status.err::before { background: var(--human); animation: none; }
+
+.repos { display: flex; gap: 8px; flex-wrap: wrap; padding: 12px 24px 0; }
+.repo-f {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  height: 28px;
+  padding: 0 12px;
+  border: 1px solid var(--line-strong);
+  border-radius: 4px;
+  background: none;
+  color: var(--muted);
+  font: 12px/16px var(--mono);
+  cursor: pointer;
+}
+.repo-f:hover { background: var(--card-hover); color: var(--ink); }
+.repo-f[aria-pressed="true"] {
+  border-color: transparent;
+  background: color-mix(in srgb, var(--merged) 22%, transparent);
+  color: var(--ink);
+}
+.repo-f .n { color: var(--faint); }
+
+.board {
+  flex: 1;
+  display: grid;
+  grid-template-columns: var(--cols, repeat(8, minmax(0, 1fr)));
+  gap: 16px;
+  padding: 24px;
+  align-items: start;
+}
+.col { min-width: 0; }
+.col-head {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+  padding: 0 0 8px;
+  border-bottom: 1px solid var(--line);
+  margin-bottom: 12px;
+}
+.col-head h2 { margin: 0; font-size: 14px; line-height: 20px; font-weight: 500; white-space: nowrap; }
+.col-head .who {
+  font-family: var(--mono);
+  font-size: 12px;
+  line-height: 16px;
+  color: var(--faint);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.col-head .count { margin-left: auto; font-family: var(--mono); font-size: 12px; color: var(--muted); }
+.col.human h2 { color: var(--human); }
+.col.merged h2 { color: var(--merged); }
+.col.queued h2 { color: var(--muted); }
+.col.queued .who,
+.col.queued .count { color: var(--faint); }
+.col:not(.slim) .slim-face { display: none; }
+.col.slim {
+  align-self: stretch;
+  min-height: 320px;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 12px;
+  padding: 12px 0;
+  border: 1px solid var(--line);
+  border-radius: 4px;
+}
+.col.slim .full { display: none; }
+.col.slim .slim-face { display: flex; flex-direction: column; align-items: center; gap: 12px; }
+.col.slim .v { writing-mode: vertical-rl; display: flex; align-items: center; gap: 8px; }
+.col.slim h2 { margin: 0; font-size: 14px; line-height: 20px; font-weight: 500; white-space: nowrap; }
+.col.slim .who { font-family: var(--mono); font-size: 12px; line-height: 16px; color: var(--faint); white-space: nowrap; }
+.col.slim .count { font-family: var(--mono); font-size: 12px; color: var(--muted); }
+.empty {
+  color: var(--faint);
+  font-size: 12px;
+  line-height: 16px;
+  padding: 20px 12px;
+  border: 1px dashed var(--line);
+  border-radius: 4px;
+  text-align: center;
+}
+
+.card {
+  display: block;
+  width: 100%;
+  text-align: left;
+  cursor: pointer;
+  background: var(--card);
+  border: 1px solid var(--line-strong);
+  border-radius: 4px;
+  padding: 12px;
+  margin-bottom: 12px;
+}
+.card:hover { border-color: var(--faint); box-shadow: var(--shadow); }
+.card:focus-visible { outline: none; box-shadow: 0 0 0 2px var(--merged); }
+.card.human { border: 2px solid var(--human); padding: 11px; }
+.card.merged { background: var(--bg); border-color: var(--line); }
+.card.merged .title { color: var(--muted); }
+.card.queued,
+.card.retrying { background: var(--bg); border-color: var(--line); }
+.card.queued .title,
+.card.retrying .title { color: var(--muted); font-weight: 400; }
+.card.queued .num,
+.card.queued .branch,
+.card.queued .note,
+.card.queued .deps,
+.card.retrying .num,
+.card.retrying .branch,
+.card.retrying .note,
+.card.retrying .deps,
+.card.retrying .meta { color: var(--faint); }
+.card.queued:hover,
+.card.retrying:hover { border-color: var(--line-strong); }
+.card-top { display: flex; align-items: center; gap: 8px; margin-bottom: 6px; }
+.num {
+  font-family: var(--mono);
+  font-size: 12px;
+  line-height: 16px;
+  color: var(--muted);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.card-top .num { flex: 1; min-width: 0; }
+.pulse {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--live);
+  flex: none;
+  animation: pulse 1.6s ease-in-out infinite;
+}
+.flag {
+  margin-left: auto;
+  padding: 0 6px;
+  border-radius: 4px;
+  background: color-mix(in srgb, var(--human) 18%, transparent);
+  color: var(--human);
+  font-size: 11px;
+  font-weight: 500;
+  letter-spacing: .02em;
+  text-transform: uppercase;
+  white-space: nowrap;
+}
+.repo { margin: -2px 0 6px; }
+.title { font-size: 14px; line-height: 20px; margin: 0 0 6px; font-weight: 500; }
+.branch {
+  font-family: var(--mono);
+  font-size: 12px;
+  line-height: 16px;
+  color: var(--faint);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+.rounds { margin-top: 12px; display: grid; gap: 4px; }
+.round { display: grid; grid-template-columns: 20px repeat(4, minmax(0, 1fr)); gap: 4px; align-items: center; }
+.round .r { font-family: var(--mono); font-size: 11px; color: var(--faint); }
+.chip {
+  text-align: center;
+  font-family: var(--mono);
+  font-size: 11px;
+  line-height: 16px;
+  padding: 1px 0;
+  border-radius: 4px;
+  border: 1px dashed var(--line-strong);
+  color: var(--muted);
+}
+.chip.wait { animation: pulse 1.6s ease-in-out infinite; }
+.chip.PASS { border-color: transparent; color: var(--pass); background: color-mix(in srgb, var(--pass) 18%, transparent); }
+.chip.CHANGES { border-color: transparent; color: var(--changes); background: color-mix(in srgb, var(--changes) 18%, transparent); }
+.note {
+  margin-top: 8px;
+  padding-top: 8px;
+  border-top: 1px solid var(--line-strong);
+  font-size: 12px;
+  line-height: 16px;
+  color: var(--muted);
+  overflow-wrap: anywhere;
+}
+.deps { margin: 8px 0 0; font-family: var(--mono); font-size: 12px; line-height: 16px; color: var(--muted); overflow-wrap: anywhere; }
+.meta { margin-top: 8px; font-family: var(--mono); font-size: 12px; line-height: 16px; color: var(--muted); overflow-wrap: anywhere; }
+.meta time { font-family: inherit; }
+@keyframes pulse { 0%, 100% { opacity: 1; } 50% { opacity: .3; } }
+@media (prefers-reduced-motion: reduce) {
+  .pulse, .chip.wait, .status::before { animation: none; }
+}
+
+.toolbar {
+  position: fixed;
+  left: 50%;
+  bottom: 16px;
+  transform: translateX(-50%);
+  display: flex;
+  gap: 4px;
+  padding: 6px;
+  background: var(--panel);
+  border: 1px solid var(--line-strong);
+  border-radius: 12px;
+  box-shadow: var(--shadow);
+  z-index: 2;
+}
+.tool {
+  position: relative;
+  width: 40px;
+  height: 40px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  border-radius: 8px;
+  background: none;
+  color: var(--muted);
+  cursor: pointer;
+}
+.tool:hover, .tool:focus-visible { background: var(--card-hover); color: var(--ink); }
+.tool svg { width: 20px; height: 20px; fill: none; stroke: currentColor; stroke-width: 1.8; stroke-linecap: round; stroke-linejoin: round; }
+.tool::after {
+  content: attr(data-tip);
+  position: absolute;
+  bottom: calc(100% + 12px);
+  left: 50%;
+  transform: translateX(-50%);
+  padding: 4px 8px;
+  border-radius: 4px;
+  background: var(--ink);
+  color: var(--bg);
+  font: 12px/16px var(--mono);
+  white-space: nowrap;
+  opacity: 0;
+  pointer-events: none;
+}
+.tool:hover::after, .tool:focus-visible::after { opacity: 1; }
+.toolbar .sep { width: 1px; margin: 6px 4px; background: var(--line-strong); }
+
+.scrim { position: fixed; inset: 0; background: rgba(0, 0, 0, .5); opacity: 0; pointer-events: none; transition: opacity .2s; z-index: 3; }
+.drawer {
+  position: fixed;
+  top: 0;
+  right: 0;
+  bottom: 0;
+  width: min(900px, 100vw);
+  background: var(--panel);
+  border-left: 1px solid var(--line-strong);
+  box-shadow: 0 12px 16px -4px #00000080, 0 24px 32px 0 #00000080;
+  transform: translateX(100%);
+  transition: transform .22s ease;
+  z-index: 4;
+}
+body.open .scrim { opacity: 1; pointer-events: auto; }
+body.open .drawer { transform: none; }
+.sheet { height: 100%; display: grid; grid-template-rows: auto minmax(0, 1fr); }
+.d-head { padding: 20px 24px 16px; border-bottom: 1px solid var(--line-strong); position: relative; }
+.d-head h3 { margin: 4px 48px 4px 0; font-size: 22px; line-height: 28px; font-weight: 500; }
+.d-head .num { white-space: normal; overflow: visible; text-overflow: unset; }
+.close {
+  position: absolute;
+  top: 12px;
+  right: 16px;
+  width: 44px;
+  height: 44px;
+  border-radius: 50%;
+  border: 0;
+  background: none;
+  cursor: pointer;
+  color: var(--ink);
+  font-size: 24px;
+  line-height: 1;
+}
+.close:hover { background: var(--card-hover); }
+.d-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 12px; }
+.d-actions form { margin: 0; }
+.d-actions button {
+  height: 28px;
+  padding: 0 12px;
+  border-radius: 4px;
+  border: 1px solid var(--line-strong);
+  background: transparent;
+  color: var(--ink);
+  font: 12px/16px var(--mono);
+  cursor: pointer;
+}
+.d-actions button:hover { background: var(--card-hover); }
+.d-actions .approve button { color: var(--pass); border-color: transparent; background: color-mix(in srgb, var(--pass) 18%, transparent); }
+.d-actions .reject button { color: var(--human); border-color: transparent; background: color-mix(in srgb, var(--human) 18%, transparent); }
+.d-body { display: grid; grid-template-columns: 200px minmax(0, 1fr); min-height: 0; }
+.files { border-right: 1px solid var(--line-strong); padding: 16px 12px; overflow-y: auto; }
+.group {
+  font-size: 12px;
+  line-height: 16px;
+  font-weight: 500;
+  text-transform: uppercase;
+  letter-spacing: .02em;
+  color: var(--faint);
+  margin: 16px 0 4px;
+  padding: 0 12px;
+}
+.group:first-child { margin-top: 0; }
+.file {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  width: 100%;
+  text-align: left;
+  text-decoration: none;
+  background: none;
+  border: 0;
+  border-radius: 4px;
+  padding: 6px 12px;
+  cursor: pointer;
+  font-family: var(--mono);
+  font-size: 13px;
+  line-height: 20px;
+  color: var(--ink);
+}
+.file:hover { background: var(--card-hover); }
+.file.on { background: var(--code-bg); }
+.dot { width: 8px; height: 8px; border-radius: 50%; background: var(--faint); flex: none; }
+.dot.good { background: var(--pass); }
+.dot.warn { background: var(--changes); }
+.dot.stop { background: var(--human); }
+.doc { overflow-y: auto; padding: 24px 32px 64px; min-width: 0; }
+.src { display: none; }
+
+.md { max-width: 660px; line-height: 20px; }
+.md h1, .md h2, .md h3 { line-height: 1.3; margin: 1.5em 0 .5em; font-weight: 500; }
+.md h1 { font-size: 18px; }
+.md h2 { font-size: 12px; text-transform: uppercase; letter-spacing: .02em; color: var(--muted); }
+.md h3 { font-size: 13px; color: var(--muted); }
+.md > :first-child { margin-top: 0; }
+.md p, .md ul, .md ol, .md pre, .md table { margin: 0 0 1em; }
+.md ul, .md ol { padding-left: 1.3em; }
+.md li { margin: .25em 0; }
+.md code { font-family: var(--mono); font-size: 13px; background: var(--code-bg); color: var(--code); padding: 1px 6px; border-radius: 4px; }
+.md pre { background: var(--bg); border: 1px solid var(--line-strong); border-radius: 4px; padding: 12px 16px; overflow-x: auto; }
+.md pre code { background: none; color: var(--ink); padding: 0; }
+.md table { border-collapse: collapse; font-size: 13px; }
+.md th, .md td { border: 1px solid var(--line-strong); padding: 6px 10px; text-align: left; }
+.verdict {
+  display: inline-flex;
+  align-items: center;
+  height: 24px;
+  font-family: var(--mono);
+  font-size: 12px;
+  font-weight: 500;
+  letter-spacing: .02em;
+  padding: 0 10px;
+  border-radius: 4px;
+  margin-bottom: 16px;
+}
+.verdict.good { color: var(--pass); background: color-mix(in srgb, var(--pass) 18%, transparent); }
+.verdict.warn { color: var(--changes); background: color-mix(in srgb, var(--changes) 18%, transparent); }
+.verdict.stop { color: var(--human); background: color-mix(in srgb, var(--human) 18%, transparent); }
+
+.back { display: inline-block; margin: 24px 24px 0; }
+.page { padding: 0 24px 48px; }
+.text { font-family: var(--mono); font-size: 13px; white-space: pre-wrap; overflow-wrap: anywhere; }
+
+@media (max-width: 1100px) {
+  .board { grid-template-columns: repeat(3, minmax(0, 1fr)); row-gap: 24px; }
+  .col.slim { align-self: start; min-height: 0; flex-direction: row; padding: 8px 12px; }
+  .col.slim .slim-face { flex-direction: row; }
+  .col.slim .v { writing-mode: horizontal-tb; }
+}
+@media (max-width: 640px) {
+  header, .repos { padding-left: 16px; padding-right: 16px; }
+  .board { grid-template-columns: 1fr; padding: 16px; }
+  .d-body { grid-template-columns: 1fr; grid-template-rows: auto minmax(0, 1fr); }
+  .files { border-right: 0; border-bottom: 1px solid var(--line-strong); display: flex; gap: 4px; overflow-x: auto; padding: 8px; }
+  .group { display: none; }
+  .file { width: auto; white-space: nowrap; }
+  .doc { padding: 16px; }
+}