@nanocollective/roster 0.1.0-alpha.6 → 0.1.0-alpha.7

package/templates/portal/js/views/app.js

@@ -6,8 +6,8 @@
  * it is one browser, one origin, and nothing extra to explain.
  *
  * What it still cannot do is install the App. Installing is a grant of access to specific
- * repositories and GitHub asks a human to choose them, which is correct behaviour and should not
- * be worked around. */
+ * repositories and GitHub asks a human to confirm them, which is correct behaviour and should not
+ * be worked around. The link it hands back has the right repos already selected. */
 
 import { appResult, startApp } from "../api.js";
 import { el } from "../dom.js";
@@ -48,6 +48,11 @@ export function appPanel(opts) {
          it: an App that exists is not a problem, it is a step you have already done. */
       const note = el("div");
       note.append(el("p", { className: "err", textContent: String(err.message || err) }));
+      if (err.data?.install) {
+        note.append(
+          el("a", { className: "btn", href: err.data.install, target: "_blank", textContent: "Install it" }),
+        );
+      }
       out.replaceChildren(note);
       return;
     }
@@ -102,9 +107,21 @@ export function appPanel(opts) {
         el("p", {
           className: "sub",
           textContent:
-            "Grant it every tracker this staff member writes to, not just their own: the token " +
-            "is minted organisation-wide and a peer's board is where a brief lands.",
+            "The link opens GitHub's install page with the org and the repos already selected: " +
+            "this staff member's brain, every peer tracker it writes to, and the product repos. " +
+            "Check the list and confirm.",
         }),
+        ...((result.preselected ?? []).length
+          ? [el("p", { className: "sub", textContent: "Selected: " + result.preselected.join(", ") })]
+          : []),
+        ...((result.missing ?? []).length
+          ? [
+              el("p", {
+                className: "err",
+                textContent: "Tick these yourself, their ids could not be read: " + result.missing.join(", "),
+              }),
+            ]
+          : []),
         el("a", {
           className: "btn primary",
           href: result.install,
@@ -115,7 +132,8 @@ export function appPanel(opts) {
           className: "sub",
           textContent:
             "Do not verify this by reading the API. It reports what an App declares separately " +
-            "from what an installation was granted. Only a run that finished proves the chain.",
+            "from what an installation was granted. Only a run that finished proves the chain, " +
+            "which is what Run once now on the staff card is for.",
         }),
       );
       out.replaceChildren(done);

package/templates/portal/js/views/credential.js

@@ -0,0 +1,93 @@
+/* The agent's credential, stored once for the org.
+ *
+ * The value goes from this box to the local server in a POST, and from there to gh on its
+ * standard input. It is not kept in the page after it is sent, and nothing echoes it back. */
+
+import { getCredential, storeCredential } from "../api.js";
+import { el } from "../dom.js";
+
+export function credentialPanel() {
+  const box = el("div", { className: "manual" });
+  box.append(el("b", { textContent: "Your agent's credential, once" }));
+  const body = el("div");
+  box.append(body);
+  body.append(el("p", { className: "sub", textContent: "Looking at where it would go…" }));
+
+  getCredential()
+    .then((c) => draw(body, c))
+    .catch((err) => body.replaceChildren(el("p", { className: "err", textContent: String(err.message || err) })));
+  return box;
+}
+
+function draw(body, c) {
+  body.replaceChildren();
+  if (c.howTo) body.append(el("p", { textContent: "Where to get one: " + c.howTo }));
+
+  if (!c.brains.length) {
+    body.append(
+      el("p", {
+        className: "sub",
+        textContent:
+          "Nothing reads it until somebody is hired, so this box opens once there is a staff " +
+          "member. It is asked for once, not once per hire.",
+      }),
+    );
+    return;
+  }
+
+  if (c.orgSecret) {
+    body.append(
+      el("p", {
+        className: "sub",
+        textContent:
+          c.name + " is already an org secret, shared with " + c.orgSecret.visibility + " repos. " +
+          "Each hire adds its brain to it. Paste a new one only to replace it.",
+      }),
+    );
+  }
+
+  body.append(
+    el("p", {
+      className: "sub",
+      textContent:
+        (c.plan.mode === "org"
+          ? "Stored as one org secret, " + c.name + ", shared with " + c.brains.join(", ") + ". "
+          : "Stored as " + c.name + " on each of " + c.brains.join(", ") + ", because " + c.plan.reason + ". ") +
+        "It goes to gh on standard input and is never written to disk.",
+    }),
+  );
+
+  const input = el("input", { type: "password", placeholder: c.name, autocomplete: "off" });
+  input.style.width = "100%";
+  const go = el("button", { className: "btn primary", textContent: "Store it" });
+  const out = el("div", { style: "margin-top:9px" });
+  body.append(input, el("div", { className: "row", style: "margin-top:9px" }, [go]), out);
+
+  go.onclick = async () => {
+    const value = input.value.trim();
+    if (!value) {
+      input.focus();
+      return;
+    }
+    go.disabled = true;
+    out.replaceChildren(el("p", { className: "sub", textContent: "Storing…" }));
+    try {
+      const r = await storeCredential(value, false);
+      input.value = "";
+      if (!r.ok) throw new Error(r.error);
+      out.replaceChildren(
+        ...(r.fellBack ? [el("p", { className: "err", textContent: "The org secret was refused: " + r.fellBack })] : []),
+        el("p", {
+          textContent:
+            r.mode === "org"
+              ? "Stored once for the org, shared with " + r.repos.length + " brains."
+              : "Stored on " + r.repos.join(", ") + ".",
+        }),
+      );
+    } catch (err) {
+      out.replaceChildren(el("p", { className: "err", textContent: String(err.message || err) }));
+    } finally {
+      go.disabled = false;
+    }
+  };
+}

package/templates/portal/js/views/health.js

@@ -7,6 +7,7 @@ import { render } from "../router.js";
 import { S, staff } from "../state.js";
 import { checklist } from "./checklist.js";
 import { copyAmendBrief } from "./prompt.js";
+import { runOnce } from "./runonce.js";
 
 const DAYS = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
 
@@ -81,7 +82,18 @@ export function viewHealth(m) {
      doctor, bordered boxes for the prompt audit, cards with two buttons each for lint. Same
      question in all three, so one shape: a heading that carries its own count, a line saying
      what the section is, the findings as rows, and the section's actions at the end. */
-  const doctor = section(m, "The org, from roster doctor", "doctor");
+  /* A workflow that has never run is unproven, and the way to prove it is to run it. Here
+     because Health is where "unproven" is read; a success re-runs the checks below. */
+  let doctor = null;
+  m.append(
+    runOnce({
+      staff: s.handle,
+      name: s.name,
+      onDone: (ok) => ok && doctor && checklist(doctor.body, { shell: doctor }),
+    }),
+  );
+
+  doctor = section(m, "The org, from roster doctor", "doctor");
   checklist(doctor.body, { shell: doctor });
 
   /* What is wrong with what this agent is sent. It used to sit in the tree on the Prompt
@@ -132,7 +144,7 @@ function memoryProblems({ body, actions, say }, s) {
     const { row, body: text } = finding(
       p.level === "error" ? "error" : "warning",
       { html: inline(p.message) },
-      [p.rule, p.line ? "INDEX.md:" + p.line : ""],
+      [p.rule, p.line ? "INDEX.md:" + p.line : (p.file ?? "")],
     );
     const status = el("span", { className: "meta" });
     const btn = el("button", { className: "ghbtn", textContent: "Ask " + s.handle.toUpperCase() + " to fix" });
@@ -263,7 +275,7 @@ export async function askToFix(s, problems, btn, status) {
     "",
     "| rule | where | what |",
     "|---|---|---|",
-    ...problems.map((p) => "| `" + p.rule + "` | " + (p.line ? "INDEX.md:" + p.line : "—") + " | " +
+    ...problems.map((p) => "| `" + p.rule + "` | " + (p.line ? "INDEX.md:" + p.line : (p.file ?? "—")) + " | " +
       String(p.message).replace(/\|/g, "\\|") + " |"),
     "",
     "Fix in your next session and close this.",

package/templates/portal/js/views/org.js

@@ -27,6 +27,8 @@ const KNOWN = {
   "org.yaml": "Who and what: the humans, the repos, the defaults, which agent runs them.",
   "org/business.md":
     "What the business actually is. Every prompt is composed on top of it, and it is the file that stops the agents writing generic slop.",
+  "org/priorities.md":
+    "What matters this month, ranked, and what is out of scope. Every daily run reads it, and every PR says which priority it serves.",
   "org/operating.md":
     "The autonomy contract: what they do without asking, what they escalate, how a run starts and ends.",
   "org/guardrails.md":

package/templates/portal/js/views/paste.js

@@ -20,6 +20,12 @@ export function paste(opts) {
   const status = el("p", { className: "sub", textContent: "Building the prompt…" });
   box.append(status);
 
+  /* A charter brief carries a worked example to model the shape on, matched to the role. The
+     choice is on the page because the match is a guess, and "none" is a fair answer. */
+  const model = el("select", { hidden: true });
+  const modelRow = el("label", { className: "sub", hidden: true }, ["Model it on: ", model]);
+  box.append(modelRow);
+
   const actions = el("div", { className: "row" });
   const copy = el("button", { className: "btn primary", textContent: "Copy the prompt" });
   const show = el("button", { className: "btn", textContent: "Show it" });
@@ -42,10 +48,33 @@ export function paste(opts) {
 
   let brief = null;
 
+  const NAMES = { cto: "the CTO example", cmo: "the CMO example", support: "the support example", none: "no example" };
+  model.onchange = () => {
+    copy.disabled = true;
+    getBrief(opts.kind, opts.staff, model.value)
+      .then((data) => {
+        if (data.error) throw new Error(data.error);
+        brief = data;
+        if (!preview.hidden) preview.textContent = brief.text;
+      })
+      .catch((err) => {
+        status.className = "err";
+        status.textContent = String(err.message || err);
+      })
+      .finally(() => {
+        copy.disabled = false;
+      });
+  };
+
   getBrief(opts.kind, opts.staff)
     .then((data) => {
       if (data.error) throw new Error(data.error);
       brief = data;
+      if (data.examples) {
+        model.replaceChildren(...data.examples.map((e) => el("option", { value: e, textContent: NAMES[e] ?? e })));
+        model.value = data.example ?? "none";
+        model.hidden = modelRow.hidden = false;
+      }
       status.textContent =
         "Paste this into Claude, ChatGPT or anything else. It carries every file it refers to, " +
         "so there is nothing to attach and nothing for it to ask you for. It will interview you " +

package/templates/portal/js/views/runonce.js

@@ -0,0 +1,88 @@
+/* One daily run, now, followed to the end.
+ *
+ * The last step of setting anybody up. Doctor calls a workflow that has never run unproven,
+ * because nothing short of a finished run shows the App, its grant, the secrets and the
+ * callers all work together. This starts one, and says how it ended. */
+
+import { runStatus, startRun } from "../api.js";
+import { el } from "../dom.js";
+
+/**
+ * @param {{staff: string, name: string, onDone?: (ok: boolean) => void}} opts
+ */
+export function runOnce(opts) {
+  const box = el("div", { className: "manual" });
+  box.append(
+    el("b", { textContent: "Run " + opts.name + " once, now" }),
+    el("p", {
+      className: "sub",
+      textContent:
+        "A real daily run: it does a day's work and spends what a scheduled one would. " +
+        "When it finishes you get the outcome and the log.",
+    }),
+  );
+  const go = el("button", { className: "btn primary", textContent: "Run once now" });
+  const out = el("div", { style: "margin-top:9px" });
+  box.append(el("div", { className: "row" }, [go]), out);
+
+  go.onclick = async () => {
+    if (!confirm("Start a daily run for " + opts.name + " now?\n\nIt is a real run, and it costs what one does.")) return;
+    go.disabled = true;
+    const say = (text, cls) => out.replaceChildren(el("p", { className: cls ?? "sub", textContent: text }));
+    say("Starting…");
+    let run;
+    try {
+      run = await startRun(opts.staff);
+    } catch (err) {
+      say(String(err.message || err), "err");
+      go.disabled = false;
+      return;
+    }
+    const link = el("a", { href: run.url, target: "_blank", rel: "noopener", textContent: "the log" });
+    if (!run.id) {
+      out.replaceChildren(el("p", { className: "sub" }, ["Started. It has not shown up yet; follow it at ", link, "."]));
+      go.disabled = false;
+      return;
+    }
+
+    /* Polled rather than streamed: a run takes minutes, the status changes a handful of times,
+       and a clock beside it is what shows the page has not hung. */
+    const began = Date.now();
+    const tick = async () => {
+      let now;
+      try {
+        now = await runStatus(opts.staff, run.id);
+        if (now.error) throw new Error(now.error);
+      } catch (err) {
+        say(String(err.message || err), "err");
+        go.disabled = false;
+        return;
+      }
+      const mins = Math.floor((Date.now() - began) / 60000);
+      if (now.status !== "completed") {
+        out.replaceChildren(
+          el("p", { className: "sub" }, [now.status.replace("_", " ") + ", " + mins + " min so far. ", link]),
+        );
+        setTimeout(tick, 15000);
+        return;
+      }
+      go.disabled = false;
+      const ok = now.conclusion === "success";
+      const done = el("div");
+      done.append(
+        el("p", { className: ok ? "" : "err" }, [
+          ok
+            ? "It worked. The App, its grant, the secrets and the callers are proven, and Health now says so. "
+            : "It ended " + (now.conclusion || "without a conclusion") + ". ",
+          el("a", { href: now.url, target: "_blank", rel: "noopener", textContent: "The log" }),
+        ]),
+      );
+      for (const f of now.failedAt ?? []) done.append(el("p", { className: "sub", textContent: "Failed at " + f }));
+      if (!ok) done.append(el("p", { className: "sub", textContent: "Troubleshooting, in the docs, has what each failure usually means." }));
+      out.replaceChildren(done);
+      opts.onDone?.(ok);
+    };
+    tick();
+  };
+  return box;
+}

package/templates/portal/js/views/runs.js

@@ -0,0 +1,165 @@
+/* Every staff member's recent runs, and what the last 30 days cost.
+ *
+ * The one screen that is only ever on GitHub: runs are not in any repo, so offline it says so
+ * rather than drawing an empty table that reads as "nothing ran". */
+
+import { getRuns } from "../api.js";
+import { ago, el, esc, skeleton } from "../dom.js";
+import { render } from "../router.js";
+import { S } from "../state.js";
+
+/** How many runs a staff member's table shows. The spend covers all of the last 30 days. */
+const SHOWN = 15;
+
+export function viewRuns(m) {
+  m.append(el("h1", { textContent: "Runs" }));
+  m.append(
+    el("p", {
+      className: "sub",
+      textContent:
+        "What each staff member ran in the last 30 days, how it ended, and what it cost where " +
+        "the agent said. Read from GitHub through your own gh.",
+    }),
+  );
+
+  if (!S.runs) {
+    const wait = el("div", { className: "runs" }, skeleton("row", 4));
+    m.append(wait);
+    load(false);
+    return;
+  }
+  paint(m, S.runs);
+}
+
+let asking = false;
+
+async function load(force) {
+  if (asking) return;
+  asking = true;
+  try {
+    S.runs = await getRuns(force);
+  } catch (e) {
+    S.runs = { online: false, error: e.message, staff: [] };
+  } finally {
+    asking = false;
+  }
+  if (S.view === "runs") render();
+}
+
+function paint(m, data) {
+  const again = el("button", { className: "ghbtn", textContent: "Ask GitHub again" });
+  again.onclick = () => {
+    S.runs = null;
+    load(true);
+    render();
+  };
+
+  if (!data.online) {
+    const box = el("div", { className: "notice" });
+    box.innerHTML =
+      "<b>Runs live on GitHub, and it could not be reached.</b><br>" +
+      esc(data.error ?? "gh is unavailable") +
+      "<br>Everything else in the portal reads from disk and still works.";
+    m.append(box, el("div", { className: "row hacts" }, [again]));
+    return;
+  }
+
+  const g = el("div", { className: "grid runsum" });
+  g.append(tile("Last 30 days", money(data.spend), priced(data.spend), over(data.spend, data.budget)));
+  if (data.budget) {
+    g.append(tile("Budget", "$" + data.budget, "org.yaml · 30 days, all staff", over(data.spend, data.budget)));
+  }
+  g.append(tile("Runs", String(data.spend?.runs ?? 0), "skipped mentions are not counted"));
+  m.append(g);
+
+  for (const s of data.staff ?? []) m.append(...staffSection(s));
+
+  m.append(
+    el("div", { className: "row hacts" }, [
+      again,
+      el("span", { className: "meta", textContent: data.fetchedAt ? "read " + ago(data.fetchedAt) : "" }),
+    ]),
+  );
+}
+
+function staffSection(s) {
+  const head = el("div", { className: "hsect" });
+  head.append(el("span", { textContent: s.name }));
+  const total = el("i", {
+    textContent: money(s.spend) + (s.budget ? " of $" + s.budget : "") + " · 30 days",
+  });
+  if (over(s.spend, s.budget)) total.className = "warn";
+  head.append(total);
+
+  const body = el("div", { className: "hbody runs" });
+  for (const e of s.errors ?? []) body.append(el("p", { className: "hnote err", textContent: e }));
+  if (!(s.runs ?? []).length) {
+    body.append(el("p", { className: "hnote", textContent: "No runs in the last 30 days." }));
+    return [head, body];
+  }
+
+  const table = el("table", { className: "runtable" });
+  table.innerHTML =
+    "<thead><tr><th>When</th><th>Kind</th><th>Outcome</th><th>Took</th><th>Turns</th>" +
+    "<th>Cost</th><th></th></tr></thead>";
+  const rows = el("tbody");
+  for (const r of s.runs.slice(0, SHOWN)) rows.append(row(r));
+  table.append(rows);
+  body.append(table);
+  if (s.runs.length > SHOWN) {
+    body.append(
+      el("p", {
+        className: "hnote",
+        textContent: s.runs.length - SHOWN + " older runs count towards the total and are not listed.",
+      }),
+    );
+  }
+  return [head, body];
+}
+
+function row(r) {
+  const tr = el("tr");
+  const out = outcome(r);
+  const rec = r.record ?? {};
+  const mins = rec.duration_s != null ? rec.duration_s / 60 : r.minutes;
+  tr.innerHTML =
+    '<td title="' + esc(r.createdAt) + '">' + esc(ago(r.createdAt)) + "</td>" +
+    "<td>" + esc(r.kind) + "</td>" +
+    '<td><span class="chip ' + out.tone + '">' + esc(out.word) + "</span></td>" +
+    "<td>" + (mins != null ? Math.round(mins) + "m" : "–") + "</td>" +
+    "<td>" + (rec.turns ?? "–") + "</td>" +
+    "<td>" + (typeof rec.cost_usd === "number" ? "$" + rec.cost_usd.toFixed(2) : "–") + "</td>" +
+    '<td><a class="ref" href="' + esc(r.url) + '" target="_blank" rel="noopener">log</a></td>';
+  return tr;
+}
+
+/** The record's word when there is one, which knows a setup failure from an agent failure. */
+function outcome(r) {
+  if (r.status !== "completed") return { word: r.status.replace("_", " "), tone: "" };
+  const word = r.record?.outcome ?? r.conclusion ?? "unknown";
+  const tone = word === "success" ? "ok" : word === "cancelled" ? "warm" : "hot";
+  return { word, tone };
+}
+
+function money(spend) {
+  return "$" + (spend?.usd ?? 0).toFixed(2);
+}
+
+/** A total is only as good as the runs it could price, so it says how many that was. */
+function priced(spend) {
+  if (!spend?.runs) return "no runs";
+  if (spend.known === spend.runs) return "every run priced";
+  return "cost known for " + spend.known + " of " + spend.runs + " runs";
+}
+
+function over(spend, budget) {
+  return !!budget && (spend?.usd ?? 0) > budget;
+}
+
+function tile(k, v, sub, bad) {
+  const d = el("div", { className: "kv" + (bad ? " bad" : "") });
+  d.innerHTML =
+    '<div class="k">' + esc(k) + '</div><div class="v">' + esc(v) +
+    (sub ? "<small>" + esc(sub) + "</small>" : "") + "</div>";
+  return d;
+}

package/templates/portal/js/views/setup.js

@@ -5,9 +5,10 @@
  * is rather than as it was left. Setup cannot be finished in one sitting, so it must survive
  * being abandoned halfway. */
 
-import { checkOrg, createTenant, getSetup, joinOrg, planTenant } from "../api.js";
+import { checkOrg, createTenant, getAccess, getSetup, joinOrg, planTenant, setAccess } from "../api.js";
 import { $, el, esc, toClipboard } from "../dom.js";
 import { checklist } from "./checklist.js";
+import { credentialPanel } from "./credential.js";
 import { repoPicker } from "./repos.js";
 import { paste } from "./paste.js";
 
@@ -30,8 +31,9 @@ function render(main) {
     el("p", {
       className: "sub",
       textContent:
-        "Four things here, then two that GitHub insists a human does. Nothing is created until " +
-        "you have read the plan.",
+        "Three things here, then what is left: a setting roster tries for you, the repos your " +
+        "staff work in, and the one file only you can write. Nothing is created until you have " +
+        "read the plan.",
     }),
   );
 
@@ -259,7 +261,10 @@ function stepOrg(main) {
       out.replaceChildren();
       out.append(
         el("p", {
-          textContent: `${result.files.length} files in ${result.dir}, and one private repo, ${p.org}/roster-ops.`,
+          textContent:
+            `${result.files.length} files in ${result.dir}, and one private repo, ${p.org}/roster-ops, ` +
+            "with its Actions access set so every repo in the org can call its workflow. If GitHub " +
+            "refuses that, you get the reason and the page to click.",
         }),
       );
       const list = el("div", { className: "filelist" });
@@ -307,30 +312,12 @@ function afterCreate() {
   card.append(
     el("p", {
       textContent:
-        "None of these can be done for you, and the first fails in a way that wastes an " +
-        "afternoon if you skip it.",
+        "The first is a setting roster tries for you. The last is the file that decides whether " +
+        "any of this is worth running, and only you can write it.",
     }),
   );
-
-  const one = el("div", { className: "manual" });
-  one.append(
-    el("b", { textContent: "Let the ops repo's workflow be called" }),
-    el("p", {
-      textContent:
-        "Settings → Actions → General → Access → “Accessible from repositories in the " +
-        "organisation”, on roster-ops.",
-    }),
-    el("small", {
-      textContent:
-        "Skip it and every workflow fails with “workflow not found”, which reads like a typo in " +
-        "a path and is not one. It is an org permission on a repo, so it is yours to click.",
-    }),
-  );
-  if (S.tenant.org) {
-    const url = `https://github.com/${S.tenant.org}/roster-ops/settings/actions`;
-    one.append(el("a", { className: "btn", href: url, target: "_blank", textContent: "Open that page" }));
-  }
-  card.append(one);
+  card.append(accessStep());
+  card.append(credentialPanel());
 
   if (S.tenant.org) {
     card.append(repoPicker({ org: S.tenant.org, known: S.tenant.repos ?? [] }));
@@ -352,6 +339,60 @@ function afterCreate() {
   return card;
 }
 
+/**
+ * The ops repo's Actions access. Read on arrival, so a page reloaded after it was set says it
+ * is done without anybody pressing anything; the button asks the server to set it, and a
+ * refusal comes back with GitHub's reason and the page to click instead.
+ *
+ * Skipped, every workflow fails with "workflow not found", which reads like a typo in a path.
+ */
+function accessStep() {
+  const box = el("div", { className: "manual" });
+  box.append(el("b", { textContent: "Let every repo in the org call the ops repo's workflow" }));
+  const out = el("div");
+  box.append(out);
+  const say = (text, cls) => el("p", { className: cls ?? "sub", textContent: text });
+
+  const offer = (why) => {
+    const go = el("button", { className: "btn primary", textContent: "Set it for me" });
+    out.replaceChildren(
+      say(
+        (why ? why + " " : "") +
+          "Settings → Actions → General → Access on roster-ops. Skip it and every workflow fails " +
+          "with “workflow not found”.",
+      ),
+      el("div", { className: "row" }, [go]),
+    );
+    go.onclick = async () => {
+      go.disabled = true;
+      try {
+        const r = await setAccess();
+        if (r.ok) {
+          out.replaceChildren(say("Set. Every repo in the org can call roster-ops."));
+          return;
+        }
+        out.replaceChildren(
+          say("GitHub refused: " + r.error + ".", "err"),
+          el("a", { className: "btn", href: r.link, target: "_blank", textContent: "Set it by hand" }),
+          say("Access → “Accessible from repositories in the organisation”."),
+        );
+      } catch (err) {
+        out.replaceChildren(say(String(err.message || err), "err"));
+        go.disabled = false;
+      }
+    };
+  };
+
+  out.replaceChildren(say("Checking…"));
+  getAccess()
+    .then((r) => {
+      if (r.ok) out.replaceChildren(say("Done. Every repo in the org can call roster-ops."));
+      else offer(r.level ? "It is set to “" + r.level + "”." : "");
+    })
+    .catch(() => offer(""));
+  return box;
+}
+
 /* ---------------------------------- furniture ---------------------------------- */
 
 function step(n, title, done) {