@saadnvd1/agent-os 0.3.671 → 0.3.673

package/lib/db/migrations/20261018T2130_project_tier.ts

@@ -0,0 +1,38 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261018T2130_project_tier",
+  up: (db) => {
+    // A project's tier: "production" tasks pass every merge gate, "fast"
+    // ones merge as soon as their PR opens (orchestrator/fast-lane.ts). The
+    // LumifyHub and Workstak projects start production, in the same step as
+    // the column, so running this again never overwrites a tier Saad changed.
+    const cols = db.prepare(`PRAGMA table_info(projects)`).all() as {
+      name: string;
+    }[];
+    if (!cols.some((c) => c.name === "tier")) {
+      db.exec(
+        `ALTER TABLE projects ADD COLUMN tier TEXT NOT NULL DEFAULT 'fast'`
+      );
+      db.exec(
+        `UPDATE projects SET tier = 'production'
+         WHERE lower(name) LIKE 'lumifyhub%' OR lower(name) LIKE 'workstak%'
+            OR workspace_id IN (
+              SELECT id FROM workspaces WHERE lower(name) IN ('lumifyhub', 'workstak')
+            )`
+      );
+    }
+    // What the fast lane has done to a task: the PR it armed (so a disarm
+    // sticks) and the merge whose CI it still watches.
+    db.exec(`CREATE TABLE IF NOT EXISTS fast_lane_tasks (
+      session_id TEXT PRIMARY KEY,
+      workspace_id TEXT NOT NULL,
+      auto_armed_pr INTEGER,
+      merged_sha TEXT,
+      merged_pr INTEGER,
+      merged_at TEXT,
+      ci_checked_at TEXT,
+      ci_done_at TEXT
+    )`);
+  },
+} satisfies Migration;

package/lib/db/migrations/20261019T1200_chat_queue_files.ts

@@ -0,0 +1,14 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261019T1200_chat_queue_files",
+  up: (db) => {
+    // Files attached to a queued message, as a JSON list of references to
+    // the session's attachments folder (never the bytes).
+    const cols = db.prepare(`PRAGMA table_info(chat_queue)`).all() as {
+      name: string;
+    }[];
+    if (!cols.some((c) => c.name === "files"))
+      db.exec(`ALTER TABLE chat_queue ADD COLUMN files TEXT`);
+  },
+} satisfies Migration;

package/lib/db/types.ts

@@ -175,6 +175,9 @@ export interface Group {
   created_at: string;
 }
 
+// production: every merge gate applies. fast: a task's PR merges when it opens.
+export type ProjectTier = "production" | "fast";
+
 export interface Project {
   id: string;
   name: string;
@@ -190,6 +193,7 @@ export interface Project {
   lh_board_id: string | null;
   lh_board_name: string | null;
   lh_board_page_id: string | null;
+  tier: ProjectTier;
   // What its tasks need from a machine (JSON array), and where that came from.
   machine_needs?: string | null;
   machine_needs_source?: string | null;

package/lib/file-upload.ts

@@ -1,34 +1,68 @@
-/**
- * Upload a file to temporary storage and return its path.
- * Converts the file to base64 and POSTs to /api/files/upload-temp.
- *
- * @param file - The file to upload
- * @returns The path to the uploaded file, or null if upload failed
- */
-export async function uploadFileToTemp(file: File): Promise<string | null> {
-  const buffer = await file.arrayBuffer();
-  const base64 = btoa(
-    new Uint8Array(buffer).reduce(
-      (data, byte) => data + String.fromCharCode(byte),
-      ""
-    )
-  );
+import type { AttachmentKind } from "./attachments/policy";
+import type { ChatFile } from "./attachments/types";
 
-  const res = await fetch("/api/files/upload-temp", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      filename: file.name || `file-${Date.now()}`,
-      base64,
-      mimeType: file.type || "application/octet-stream",
-    }),
+export type UploadResult =
+  | { ok: true; file: ChatFile; kind: AttachmentKind }
+  | { ok: false; error: string };
+
+function toBase64(file: File): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const reader = new FileReader();
+    reader.onload = () => resolve(String(reader.result).split(",")[1] ?? "");
+    reader.onerror = () => reject(reader.error);
+    reader.readAsDataURL(file);
   });
+}
 
-  const data = await res.json();
-  if (data.path) {
-    return data.path;
+/**
+ * Upload a file through /api/files/upload-temp. With a `sessionId` (or
+ * "draft") the server checks it against its attachment limits and keeps it in
+ * that session's attachments folder; without one it goes to temp storage.
+ * The error is the server's own message, ready to show.
+ */
+export async function uploadFile(
+  file: File,
+  sessionId?: string
+): Promise<UploadResult> {
+  try {
+    const res = await fetch("/api/files/upload-temp", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        filename: file.name || `file-${Date.now()}`,
+        base64: await toBase64(file),
+        mimeType: file.type || "application/octet-stream",
+        sessionId,
+      }),
+    });
+    const data = await res.json().catch(() => ({}));
+    if (res.ok && data.path)
+      return {
+        ok: true,
+        kind: data.kind,
+        file: {
+          path: data.path,
+          name: data.name,
+          size: data.size,
+          mediaType: data.mediaType,
+        },
+      };
+    return {
+      ok: false,
+      error: data.error ?? `Couldn't upload ${file.name} (${res.status})`,
+    };
+  } catch {
+    return { ok: false, error: `Couldn't upload ${file.name}` };
   }
+}
 
-  console.error("Upload failed:", data.error);
+/** The saved path, or null when the upload failed (terminal and picker). */
+export async function uploadFileToTemp(
+  file: File,
+  sessionId?: string
+): Promise<string | null> {
+  const r = await uploadFile(file, sessionId);
+  if (r.ok) return r.file.path;
+  console.error("Upload failed:", r.error);
   return null;
 }

package/lib/intake/intake.ts

@@ -8,6 +8,7 @@ import { getWorkspace } from "../workspaces";
 import { INTAKE_LIMITS, MAX_INLINE_IMAGE_BYTES } from "./limits";
 import { buildIntakeMessage, type IntakeMeta } from "./message";
 import { sniff } from "./sniff";
+import { safeName } from "../attachments/store";
 
 export class IntakeError extends Error {
   constructor(
@@ -39,23 +40,7 @@ const day = (t: number) => new Date(t).toISOString().slice(0, 10);
 const workspaceRoot = (workspaceId: string) =>
   path.join(dataRoot(), "intake", segment(workspaceId));
 
-/** A phone's filename as one safe path segment. */
-export function safeName(name: string, taken: Set<string>, n: number): string {
-  let base = path.basename(name.replace(/\\/g, "/"));
-  base = base
-    .replace(/[^a-zA-Z0-9.-]/g, "_")
-    .replace(/^\.+/, "")
-    .slice(0, 80);
-  if (!base) base = `file-${n}`;
-  let out = base;
-  for (let i = 2; taken.has(out); i++) {
-    const dot = base.lastIndexOf(".");
-    out =
-      dot > 0 ? `${base.slice(0, dot)}-${i}${base.slice(dot)}` : `${base}-${i}`;
-  }
-  taken.add(out);
-  return out;
-}
+export { safeName };
 
 function checkMeta(meta: IntakeMeta) {
   if (!meta || typeof meta !== "object") throw new IntakeError(400, "Bad meta");

package/lib/intake/sniff.ts

@@ -9,7 +9,7 @@ const BLOCKED_NAME =
 const starts = (b: Buffer, sig: number[], at = 0) =>
   sig.every((v, i) => b[at + i] === v);
 
-function isText(b: Buffer): boolean {
+export function isText(b: Buffer): boolean {
   const head = b.subarray(0, 8192);
   if (head.includes(0)) return false;
   try {

package/lib/orchestrator/armed.test-helpers.ts

@@ -125,6 +125,10 @@ export function setup() {
     workingDirectory: repo,
   });
   setProjectWorkspace(project.id, workspace.id);
+  // These tests judge today's gates; fast-lane.test.ts flips it.
+  db.prepare(`UPDATE projects SET tier = 'production' WHERE id = ?`).run(
+    project.id
+  );
   ensureOrchestrator(workspace.id);
   const task = seedSession({
     projectId: project.id,

package/lib/orchestrator/armed.ts

@@ -26,6 +26,7 @@ import { getOrchestrator } from "./home";
 import { isPaused } from "./pause";
 import { review } from "./review";
 import { judge, mergeJudged } from "./signoff";
+import { isFast } from "../project-tier/getProjectTier";
 import { workspaceTask } from "./targets";
 import { markStatusDirty } from "../status/dirty";
 import { setPr } from "../db/session-parts";
@@ -88,9 +89,10 @@ export const anyArmed = (workspaceId: string) =>
   armedTasks(workspaceId).length > 0;
 
 // The orchestrator's `arm` and `disarm`.
-export function arm(workspaceId: string, ref: string): string {
+export async function arm(workspaceId: string, ref: string): Promise<string> {
   const task = workspaceTask(workspaceId, ref);
   armTask(task);
+  if (isFast(task)) return armedNow(workspaceId, task);
   return `Armed ${task.name}: AgentOS merges its PR the moment every sign_off gate passes at its head, and tells you with one event. A gate failure also comes as one event; it stays armed for the fix, unless the failure goes to Saad. No need to call sign_off.`;
 }
 
@@ -124,6 +126,17 @@ export function armTask(task: Session): void {
   setArmed(task.id, true);
 }
 
+// A fast task merges the moment it's armed, if its PR is open.
+async function armedNow(workspaceId: string, task: Session): Promise<string> {
+  const verdict = await judge(workspaceId, task, false, { count: false });
+  if (!verdict.ok)
+    return `Armed ${task.name} (fast project); not merged yet.\n${verdict.text}\nIt stays armed and merges once that is fixed.`;
+  await merge(workspaceId, task, verdict, defaults);
+  return stillArmed(workspaceId, task.id)
+    ? `Armed ${task.name} (fast project); the merge was refused, see the event. It stays armed.`
+    : `Merged ${task.name} (fast project): PR #${verdict.pr} at ${short(verdict.sha)}, no CI wait or review.`;
+}
+
 export function disarm(workspaceId: string, ref: string): string {
   const task = workspaceTask(workspaceId, ref);
   setArmed(task.id, false);

package/lib/orchestrator/brief.ts

@@ -28,6 +28,7 @@ export interface BriefProject {
   path: string;
   board: string | null;
   defaultBranch: string;
+  tier?: "production" | "fast";
 }
 
 // Read when the brief is built, so a switch flipped in Settings reaches the
@@ -121,7 +122,7 @@ Reading:
 Acting:
 - \`${TOOL_NAMES.send}\` (session, message, scope_change?): message a session; it arrives as its next prompt. scope_change records it on the task's brief for its review.
 - \`${TOOL_NAMES.message_orchestrator}\` (workspace, message): message another workspace's orchestrator, the only thing you reach outside this workspace. Use it to hand over a bug or ask for something in its projects; it decides what to do there.
-- \`${TOOL_NAMES.start_task}\` (project, prompt, base?, name?, view?, after?, priority?, machine?, now?, now_reason?, model?, plan, plan_only?, plan_reason): a task in its own worktree that ends in a PR. priority (urgent, blocking, normal, background) sets where it stands in the queue; machine mac pins work that needs this Mac. A busy or loaded machine holds a queued start and says why; don't retry it. Write the prompt as a full brief; name it in 2-6 words, or it's named from the prompt. It runs as a chat; pass view terminal only when the job needs a TUI. Pass after (a task's id or name, or "any") to hold it until that task finishes, instead of remembering it in your notes. Over the workspace's running task limit it's queued too: the result says "Queued (position N)", it starts by itself, and you get an event when it does. now true (with now_reason, not with after) starts it at once past the limit instead; it's logged for Saad, so use it only when it can't wait. Its models follow the role settings (it plans on the planning model, then implements on the implementation one); State plan and plan_reason for every task (see "Triage every job"). Pass model ("provider/model", or a map of role to one) only when Saad asks for one, or to put implementation on Opus when the work needs deep reasoning (say why in plan_reason or a note); another provider than anthropic only when Saad asks.
+- \`${TOOL_NAMES.start_task}\` (project, prompt, base?, name?, view?, after?, priority?, machine?, now?, now_reason?, model?, plan, plan_only?, plan_reason): a task in its own worktree that ends in a PR. priority (urgent, blocking, normal, background) sets where it stands in the queue; machine mac pins work that needs this Mac. A busy or loaded machine holds a queued start and says why; don't retry it. Write the prompt as a full brief; name it in 2-6 words, or it's named from the prompt. It runs as a chat; pass view terminal only when the job needs a TUI. Pass after (a task's id or name, or "any") to hold it until that task finishes, instead of remembering it in your notes. Over the workspace's running task limit it's queued too: the result says "Queued (position N)", it starts by itself, and you get an event when it does. now true (with now_reason, not with after) starts it at once past the limit instead; it's logged for Saad, so use it only when it can't wait. Its models follow the role settings (it plans on the planning model, then implements on the implementation one); State plan and plan_reason for every task in a production project (see "Triage every job"); a fast project skips the plan unless you pass plan true. Pass model ("provider/model", or a map of role to one) only when Saad asks for one, or to put implementation on Opus when the work needs deep reasoning (say why in plan_reason or a note); another provider than anthropic only when Saad asks.
 - \`${TOOL_NAMES.plan_pieces}\` (task, merge?, drop?): when a plan split into pieces (the plan-done event names them), list them; merge or drop edits the ones still waiting. A piece starts by itself once what it waits on has merged (or deployed); you don't start it.
 - \`${TOOL_NAMES.approve_plan}\` (task, message?): continue a plan_only task whose plan is ready; it implements on the implementation model, once. message amends the plan and is recorded on the task's brief as a scope change. Reject a plan with drop.
 - \`${TOOL_NAMES.set_task_model}\` (task, model, message?): move a paused task to another model and carry on in the same conversation and worktree; it keeps that model from then on. Only when Saad asks.
@@ -145,6 +146,7 @@ Acting:
 - \`${TOOL_NAMES.done}\` (session): finish a session whose work is complete. A task with an open PR merges through the same gates as sign_off first (refused naming the gate otherwise); then the agent stops, the worktree goes only if nothing in it would be lost, and the session lands on the sidebar's Done shelf (it is not archived). Not a rejection: use drop for that.
 - \`${TOOL_NAMES.archive}\` (session): put a session away, out of the sidebar, when Saad asks. Nothing is merged or cleaned up; refused while it works or has an open PR.
 - \`${TOOL_NAMES.resurrect}\` (session, reason): bring a dropped, done or archived session back with its conversation and worktree, in the state it had (a plan-only task waits for approval again). Use it when a drop or done was a mistake, or when Saad asks; refused for a merged PR, a missing conversation or a removed project. A restored task counts against the running limit and the brakes like a start.
+- \`${TOOL_NAMES.project_tier}\` (project?, tier?): read the workspace's projects with their tiers, or one's; with tier (production or fast) set it. Only when Saad says to.
 - \`${TOOL_NAMES.add_project}\` (path, name?): make a git repository on this machine a project of this workspace, or move the project already at that path in when it's in no workspace. Use it rather than sending Saad steps. It refuses a folder that isn't a git repository or holds secrets, and a project another workspace has: moving that is Saad's call, so ask_saad.
 - \`${TOOL_NAMES.note}\` (text): a line in this workspace's decision log, shown in your chat. Note each decision that matters, with why.
 - \`${TOOL_NAMES.rule_add}\` (text): keep a standing rule for this workspace, in your brief on every start. Saad sees and edits them in Settings → Workspaces.
@@ -166,11 +168,15 @@ Act through these tools, not the shell: they're scoped to this workspace and bra
 
 ## Untrusted text
 
+### Tiers
+
+Every project has a tier (shown on its line above; \`project_tier\` reads or sets it, and you set it only when Saad says to). production: everything above applies. fast (the default, for Saad's internal tools and AgentOS itself): a task's PR merges as soon as it opens or is pushed, so rigorous testing and CI don't hold it. AgentOS arms a fast task by itself when its PR opens, and \`arm\` on one merges it right away. Only these still apply: base, stack order, no AI attribution in the PR body, Saad's hold (BLOCKED, an open ask, a draft), the rules on the diff (no secrets, nothing outside the repository, not only lockfiles), merge approvals for sensitive files, and the hard lines. There is no ci or review gate, no card scope check and no loop guard, \`review\` doesn't start a reviewer, and a fast task skips the plan step unless you pass plan true. If CI fails after a fast merge you get one event; fix it forward with a task.
+
 ${UNTRUSTED_RULE}`;
 
 function projectLine(p: BriefProject): string {
   const board = p.board ? `, LumifyHub board "${p.board}"` : "";
-  return `- ${p.name}: \`${p.path}\` (default branch ${p.defaultBranch}${board})`;
+  return `- ${p.name}: \`${p.path}\` (default branch ${p.defaultBranch}${board}, tier ${p.tier ?? "production"})`;
 }
 
 export function orchestratorBrief(input: {
@@ -217,6 +223,7 @@ export async function loadOrchestratorBrief(session: Session): Promise<string> {
       defaultBranch: await getDefaultBranch(p.working_directory).catch(
         () => "main"
       ),
+      tier: p.tier,
     }))
   );
   return orchestratorBrief({

package/lib/orchestrator/fast-lane-state.ts

@@ -0,0 +1,69 @@
+import { db } from "../db";
+
+const now = () => new Date().toISOString().slice(0, 19).replace("T", " ");
+
+export interface FastLaneRow {
+  session_id: string;
+  workspace_id: string;
+  auto_armed_pr: number | null;
+  merged_sha: string | null;
+  merged_pr: number | null;
+  merged_at: string | null;
+  ci_checked_at: string | null;
+  ci_done_at: string | null;
+}
+
+export function fastLaneRow(sessionId: string): FastLaneRow | undefined {
+  return db
+    .prepare(`SELECT * FROM fast_lane_tasks WHERE session_id = ?`)
+    .get(sessionId) as FastLaneRow | undefined;
+}
+
+export function noteAutoArmed(
+  sessionId: string,
+  workspaceId: string,
+  pr: number
+): void {
+  db.prepare(
+    `INSERT INTO fast_lane_tasks (session_id, workspace_id, auto_armed_pr)
+     VALUES (?, ?, ?)
+     ON CONFLICT(session_id) DO UPDATE SET auto_armed_pr = excluded.auto_armed_pr`
+  ).run(sessionId, workspaceId, pr);
+}
+
+// A fast merge: the PR whose CI is watched for a while afterwards.
+export function recordFastMerge(
+  sessionId: string,
+  workspaceId: string,
+  pr: number,
+  sha: string
+): void {
+  db.prepare(
+    `INSERT INTO fast_lane_tasks (session_id, workspace_id, merged_sha, merged_pr, merged_at)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(session_id) DO UPDATE SET
+       merged_sha = excluded.merged_sha, merged_pr = excluded.merged_pr,
+       merged_at = excluded.merged_at, ci_checked_at = NULL, ci_done_at = NULL`
+  ).run(sessionId, workspaceId, sha, pr, now());
+}
+
+export function markCiChecked(sessionId: string, done: boolean): void {
+  db.prepare(
+    `UPDATE fast_lane_tasks SET ci_checked_at = ?, ci_done_at = CASE WHEN ? THEN ? ELSE ci_done_at END
+     WHERE session_id = ?`
+  ).run(now(), done ? 1 : 0, now(), sessionId);
+}
+
+// Merges still inside their CI watch.
+export function watchedMerges(
+  workspaceId: string,
+  sinceHours: number
+): FastLaneRow[] {
+  return db
+    .prepare(
+      `SELECT * FROM fast_lane_tasks
+       WHERE workspace_id = ? AND merged_at IS NOT NULL AND ci_done_at IS NULL
+         AND merged_at > datetime('now', ?)`
+    )
+    .all(workspaceId, `-${sinceHours} hours`) as FastLaneRow[];
+}

package/lib/orchestrator/fast-lane.ts

@@ -0,0 +1,96 @@
+/**
+ * The fast lane: a project whose tier is "fast" (project-tier) has no CI
+ * wait, independent review or scope check on a task's PR. Its gates are
+ * trimmed in gates.ts and signoff.ts; this arms each fast task once when its
+ * PR opens, so armed.ts merges it on the same pass, and watches the CI of
+ * what it merged for a while, telling the orchestrator once if that fails.
+ */
+
+import { db, type Session } from "../db";
+import { run } from "../tasks/gh";
+import { checksVerdict, failingCheck, type RollupEntry } from "../tasks/state";
+import { armTask } from "./armed";
+import { queueEventOnce } from "./events";
+import type { SessionFacts } from "./facts";
+import { isPaused } from "./pause";
+import { repoOf } from "./repo";
+import { isFast } from "../project-tier/getProjectTier";
+import {
+  fastLaneRow,
+  markCiChecked,
+  noteAutoArmed,
+  watchedMerges,
+} from "./fast-lane-state";
+
+const CI_WATCH_HOURS = 3;
+const CI_RECHECK_MS = 2 * 60 * 1000;
+
+export async function autoArmFast(
+  workspaceId: string,
+  facts: SessionFacts[]
+): Promise<void> {
+  if (isPaused(workspaceId)) return;
+  for (const f of facts) {
+    const pr = f.task?.pr;
+    if (!pr || pr.state !== "OPEN") continue;
+    const task = db
+      .prepare(
+        `SELECT * FROM session_rows WHERE id = ? AND task_status = 'running'
+           AND merge_armed_at IS NULL`
+      )
+      .get(f.id) as Session | undefined;
+    if (!task || !isFast(task)) continue;
+    if (fastLaneRow(task.id)?.auto_armed_pr === pr.number) continue;
+    try {
+      armTask(task);
+      noteAutoArmed(task.id, workspaceId, pr.number);
+    } catch {
+      // With Saad, or no orchestrator to tell: retried next pass.
+    }
+  }
+}
+
+async function ghRollup(task: Session, pr: number): Promise<RollupEntry[]> {
+  const out = await run(
+    "gh",
+    ["pr", "view", String(pr), "--json", "statusCheckRollup"],
+    repoOf(task),
+    15000
+  );
+  return (JSON.parse(out).statusCheckRollup ?? []) as RollupEntry[];
+}
+
+export async function followFastMerges(
+  workspaceId: string,
+  rollupOf: typeof ghRollup = ghRollup
+): Promise<void> {
+  const now = Date.now();
+  for (const row of watchedMerges(workspaceId, CI_WATCH_HOURS)) {
+    const checked = row.ci_checked_at
+      ? Date.parse(row.ci_checked_at.replace(" ", "T") + "Z")
+      : 0;
+    if (now - checked < CI_RECHECK_MS) continue;
+    const task = db
+      .prepare(`SELECT * FROM session_rows WHERE id = ?`)
+      .get(row.session_id) as Session | undefined;
+    if (!task || !row.merged_pr) {
+      markCiChecked(row.session_id, true);
+      continue;
+    }
+    try {
+      const rollup = await rollupOf(task, row.merged_pr);
+      const verdict = checksVerdict(rollup);
+      if (verdict === "fail") {
+        queueEventOnce(
+          workspaceId,
+          `fast-ci:${row.session_id}:${row.merged_sha}`,
+          row.session_id,
+          `task ${task.name}: merged on the fast lane (PR #${row.merged_pr}), but CI failed after the merge${failingCheck(rollup) ? ` (${failingCheck(rollup)})` : ""}. Fix forward with a task.`
+        );
+      }
+      markCiChecked(row.session_id, verdict !== "pending");
+    } catch {
+      markCiChecked(row.session_id, false);
+    }
+  }
+}

package/lib/orchestrator/gates.ts

@@ -165,7 +165,12 @@ export function checkGate(
   return { gate, state: "pass" };
 }
 
-export function evaluateGates(i: GateInput): GateOutcome[] {
+// `fast`: the fast lane keeps Saad's hold, the rules on the diff, the stack
+// and the PR body's attribution; no CI, review or card scope check.
+export function evaluateGates(
+  i: GateInput,
+  opts: { fast?: boolean } = {}
+): GateOutcome[] {
   const blocked: GateOutcome = i.prBlocked
     ? { gate: "blocked", state: "fail", reason: i.prBlocked }
     : i.prDraft
@@ -185,7 +190,7 @@ export function evaluateGates(i: GateInput): GateOutcome[] {
           : { gate: "blocked", state: "pass" };
   const scope: GateOutcome = i.ruleBreaks.length
     ? { gate: "scope", state: "fail", reason: i.ruleBreaks.join("; ") }
-    : i.fromCard
+    : i.fromCard && !opts.fast
       ? checkGate("scope", i.scope, i.sha)
       : { gate: "scope", state: "pass" };
   const stack: GateOutcome = i.stackRefusal
@@ -197,6 +202,7 @@ export function evaluateGates(i: GateInput): GateOutcome[] {
   const codeReview: GateOutcome = i.codeReview.refusal
     ? { gate: "code-review", state: "fail", reason: i.codeReview.refusal }
     : { gate: "code-review", state: "pass" };
+  if (opts.fast) return [codeReview, blocked, scope, stack];
   return [
     ciGate(i),
     checkGate("review", i.review, i.sha),

package/lib/orchestrator/project-tier-tool.ts

@@ -0,0 +1,33 @@
+import {
+  PROJECT_TIERS,
+  setProjectTier,
+  type ProjectTier,
+} from "../project-tier";
+import { addNote } from "./notes";
+import { workspaceProjects } from "./brief";
+import { workspaceProject } from "./targets";
+
+const line = (name: string, tier: ProjectTier) =>
+  `- ${name}: ${tier}${tier === "fast" ? " (merges when its PR opens)" : " (CI, review and scope gate its merges)"}`;
+
+// project_tier: read one project's tier, or all of the workspace's; with a
+// tier, set it (Saad's call: only when he says so).
+export function projectTierTool(
+  workspaceId: string,
+  projectRef?: string,
+  tier?: (typeof PROJECT_TIERS)[number]
+): string {
+  if (!projectRef) {
+    if (tier) throw new Error("Say which project to set");
+    const all = workspaceProjects(workspaceId);
+    return all.length
+      ? all.map((p) => line(p.name, p.tier)).join("\n")
+      : "No projects in this workspace.";
+  }
+  const project = workspaceProject(workspaceId, projectRef);
+  if (!tier) return line(project.name, project.tier);
+  if (tier === project.tier) return line(project.name, project.tier);
+  setProjectTier(project.id, tier);
+  addNote(workspaceId, `Set ${project.name} to ${tier}.`);
+  return `Set ${project.name} to ${tier}.\n${line(project.name, tier)}`;
+}

package/lib/orchestrator/review.ts

@@ -55,6 +55,7 @@ import {
 import { noteQuickReview } from "./quick";
 import { workspaceTask } from "./targets";
 import { untrusted } from "./untrusted";
+import { isFast } from "../project-tier/getProjectTier";
 
 const short = (sha: string) => sha.slice(0, 7);
 // The most diff one reviewer is given, and the most parts a change too big
@@ -267,6 +268,8 @@ export async function reviewAt(
   sha: string,
   opts: ReviewOpts = {}
 ): Promise<string> {
+  if (target.task && isFast(target.task))
+    return `${target.task.name} is in a fast project: no independent review; it merges through the fast gates.`;
   const known = getCheck(target.id, sha, "review");
   // A card task's scope check runs after its review; one never stored (a
   // restart between the two) means running the job again.

package/lib/orchestrator/serve.ts

@@ -26,6 +26,7 @@ import { sessionFacts } from "./facts";
 import { describeExternal, externalSessions } from "./external-sessions";
 import { resolveStaleAsks } from "./ask-settle";
 import { addNote } from "./notes";
+import { projectTierTool } from "./project-tier-tool";
 import { addProject } from "./add-project";
 import { addRule, removeRule } from "./rules";
 import { askSaad } from "./ask-tool";
@@ -237,6 +238,10 @@ export async function runTool(
       const a = p(tool, raw);
       return addProject(w, a.path, a.name);
     }
+    case "project_tier": {
+      const a = p(tool, raw);
+      return projectTierTool(w, a.project, a.tier);
+    }
     case "note":
       addNote(w, p(tool, raw).text);
       return "Noted.";
@@ -277,7 +282,7 @@ export async function runTool(
       return signOffTarget(w, a.task, { direct: a.direct, reason: a.reason });
     }
     case "arm":
-      return arm(w, p(tool, raw).task);
+      return await arm(w, p(tool, raw).task);
     case "disarm":
       return disarm(w, p(tool, raw).task);
     case "ask_saad":

package/lib/orchestrator/signoff.test-helpers.ts

@@ -231,6 +231,9 @@ export function setup(
     workingDirectory: repo,
   });
   setProjectWorkspace(project.id, workspace.id);
+  db.prepare(`UPDATE projects SET tier = 'production' WHERE id = ?`).run(
+    project.id
+  );
   ensureOrchestrator(workspace.id);
   const task = seedSession({
     projectId: project.id,