@warren-dean/code-kit 0.20.0 → 0.22.0

package/hooks/guard-bash.mjs

@@ -21,6 +21,12 @@ import { laneOfBranch, storyOfBranch, teamOf, teamProvider, whoami } from './lib
 import { matchesAny } from './lib/glob.mjs';
 import { noteBefore } from './lane-audit.mjs';
 import { TESTS_APPROVAL, commitWeakenings } from './lib/regression.mjs';
+import {
+  STANDARDS_APPROVAL,
+  noteFor,
+  standardsFile,
+  standardsWeakenings,
+} from './lib/standards.mjs';
 import {
   APPROVAL_LOG,
   actorFor,
@@ -30,8 +36,10 @@ import {
   askHowTo,
   currentBranch,
   decidedBy,
+  delegatedMark,
   dependencyChange,
   dependencyGrants,
+  leadDecides,
   useApproval,
   owns,
   protectedEntry,
@@ -176,7 +184,9 @@ for (const { pattern, why, person, command } of config.shell.block) {
     person && actor.kind === 'lead'
       ? '\nTo let the lead run it when the person says so in chat, a person sets "approvals": { "lead": true } in the config.'
       : '';
-  block(`Blocked: ${why}${hint}\nCommand: ${cmd}`);
+  block(
+    `Blocked: ${why}${noteFor(project, config, { kind: 'shell', name: why })}${hint}\nCommand: ${cmd}`,
+  );
 }
 
 if (approves && actor.kind !== 'lead')
@@ -208,10 +218,14 @@ if (runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+loop\s+(pause|resume)\b`)))
   block(
     `Blocked: pausing or resuming the lead loop is the person's own act, from the code-kit band or their terminal. Ask them, and stop.\nCommand: ${cmd}`,
   );
-// LOOP-10: which session runs the loop is the mod's to record, and moving it the person's.
-if (runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+loop\s+(lead|release)\b`)))
+// LOOP-10, SESS-2: which session leads is recorded by code-kit's hooks and band, and choosing it is
+// the person's own act.
+if (
+  runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+loop\s+(lead|release)\b`)) ||
+  runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+sessions\s+(lead|beat)\b`))
+)
   block(
-    `Blocked: which session runs the lead loop is recorded by the code-kit band, and moving it is the person's own act (Lead from here, in the band). Carry on with your work.\nCommand: ${cmd}`,
+    `Blocked: which session leads the project is recorded by code-kit, and choosing it is the person's own act (Lead from here, in the code-kit band, or \`code-kit sessions lead\` in their terminal). Carry on with your work.\nCommand: ${cmd}`,
   );
 // TEAM-9: handing someone's claim to someone else is the tech lead's own decision too.
 if (runs(cmd, new RegExp(String.raw`^${CODE_KIT}\s+team\s+reassign\b`)))
@@ -273,7 +287,7 @@ if (delegatedMerge && !config.approvals.delegate?.merge)
 const delegating = /\s--delegated\b/.test(cmd);
 if (approves && delegating && !config.approvals.delegate)
   block(
-    `Blocked: this project doesn't delegate approvals to the lead ("approvals.delegate" isn't set). Ask the person to approve it with the \`!\` command from the refusal.\nCommand: ${cmd}`,
+    `Blocked: this project keeps every approval for the person ("approvals.delegate" is false). Ask the person to approve it with the \`!\` command from the refusal.\nCommand: ${cmd}`,
   );
 if (approves && !delegating && !forPerson)
   block(
@@ -302,7 +316,9 @@ if (packages.length) {
     // HELM-2, HELM-3: a lane asks the lead, which judges the package on its merits where it decides.
     const names = unapproved.map(dependencyApproval);
     const whose =
-      decidedBy(names, config) === 'lead' ? "is the lead's decision" : "needs a person's approval";
+      decidedBy(names, config, actor) === 'lead'
+        ? "is the lead's decision"
+        : "needs a person's approval";
     block(
       `Blocked: a new dependency (${unapproved.join(', ')}) ${whose}. ${askHowTo(names, actor, sessionIn ?? project, config, { allows: 'installing it, and the manifest and lockfile changes that makes,' })}\nCommand: ${cmd}`,
     );
@@ -471,16 +487,47 @@ function recordApprovals() {
         session: input.session_id ?? null,
       }),
     );
+  // STD-5: removing a standard, or weakening a required one, is the person's own call, never the lead's,
+  // delegated or not. The commit waits for their `standards` approval, which records what it weakened.
+  const stdFile = standardsFile(config);
+  const stdWeak =
+    files.includes(stdFile) && !arrivesWithMerge(root, stdFile, { staged: true })
+      ? standardsWeakenings(
+          git('show', `HEAD:${stdFile}`),
+          existsSync(join(root, stdFile)) ? readFileSync(join(root, stdFile), 'utf8') : '',
+        )
+      : [];
+  if (stdWeak.length) {
+    const granted = approval(root, STANDARDS_APPROVAL, actor);
+    if (!granted || granted.reason.includes(delegatedMark('').slice(0, -1))) {
+      recordRequest(
+        root,
+        actor,
+        STANDARDS_APPROVAL,
+        stdFile,
+        `Standards weakened: ${stdWeak.join('; ')}.`,
+      );
+      const personOnly = { ...config, approvals: { ...config.approvals, delegate: null } };
+      block(
+        `Blocked: this commit weakens the project's standards in ${stdFile}: ${stdWeak.join('; ')}. Removing a standard, or weakening a required one, is the person's call, never the lead's. Ask them, with what the standard costs the project and your recommendation; they approve it with\n${approvalHowTo(STANDARDS_APPROVAL, actor, root, 'weakening the standards in one commit', personOnly)}`,
+      );
+    }
+  }
   for (const file of files) {
     // Concluding a merge: what arrives as the other branch has it was logged there, with its approvals.
     if (arrivesWithMerge(root, file, { staged: true })) continue;
-    const entry = protectedEntry(file, config);
+    // A weakened standards file is the person's even where the config doesn't protect it.
+    const entry =
+      protectedEntry(file, config) ??
+      (file === stdFile && stdWeak.length
+        ? { approval: STANDARDS_APPROVAL, why: "the project's standards" }
+        : null);
     const granted = entry && approval(root, entry.approval, actor);
     const byDependency = actor.kind === 'lane' && dependencyChange(actor, file, root, config);
     if (entry && !granted && actor.kind !== 'lead' && !byDependency) {
       recordRequest(root, actor, entry.approval, file, entry.why);
       block(
-        `Blocked: ${file} is ${entry.why}; committing it needs ${decidedBy(entry.approval, config) === 'lead' ? "the lead's" : "a person's"} approval in force. ${askHowTo(entry.approval, actor, root, config)}`,
+        `Blocked: ${file} is ${entry.why}; committing it needs ${decidedBy(entry.approval, config, actor) === 'lead' ? "the lead's" : "a person's"} approval in force.${noteFor(root, config, { kind: 'protected', name: entry.approval, glob: entry.glob })} ${askHowTo(entry.approval, actor, root, config)}`,
       );
     }
     if (granted)
@@ -488,6 +535,7 @@ function recordApprovals() {
         approval: entry.approval,
         reason: granted.reason,
         grantedAt: granted.grantedAt,
+        ...(file === stdFile && stdWeak.length ? { weakened: stdWeak } : {}),
       });
     else if (byDependency && (entry || !owns(actor, file, config))) {
       const grants = dependencyGrants(root, actor);
@@ -504,8 +552,9 @@ function recordApprovals() {
         grantedAt: null,
       });
   }
-  // REG-2: a commit that weakens a test waits for the person's `tests` approval, which nobody else can
-  // give; it's recorded in the log, so verify accepts the branch, and used up by this commit.
+  // REG-2: a commit that weakens a test waits for a `tests` approval: WHO-2, the lead's on a lane's
+  // branch where tests are delegated, otherwise the person's (always on the lead's own). It's recorded in
+  // the log, so verify accepts the branch, and used up by this commit.
   const weakened = commitWeakenings(
     root,
     files.filter((f) => !arrivesWithMerge(root, f, { staged: true })),
@@ -517,16 +566,20 @@ function recordApprovals() {
     if (!granted) {
       const [w, ...more] = weakened;
       recordRequest(root, actor, TESTS_APPROVAL, w.file, `A weakened test: ${said(w)}.`);
+      const leads = leadDecides(TESTS_APPROVAL, config, actor);
       const personOnly = { ...config, approvals: { ...config.approvals, delegate: null } };
       block(
-        `Blocked: ${w.file} is a weakened test (${said(w)}); committing it needs a person's approval in force.
+        `Blocked: ${w.file} is a weakened test (${said(w)}); committing it needs ${leads ? "the lead's" : "a person's"} approval in force.
 ` +
           (more.length
             ? `Also weakened: ${more.map((x) => `${x.file} (${said(x)})`).join('; ')}.
 `
             : '') +
-          `A weakened test can hide a regression. Fix the code so the test passes as it was. If the test itself is wrong, ask the person: neither the lead nor a lane can approve it. They run
-${approvalHowTo(TESTS_APPROVAL, actor, root, 'weakening tests in one commit', personOnly)}`,
+          `A weakened test can hide a regression. Fix the code so the test passes as it was. ` +
+          (leads
+            ? `If the test itself is wrong, the lead decides after reviewing it: ${askHowTo(TESTS_APPROVAL, actor, root, config, { allows: 'weakening tests in one commit', need: 'the test, what you weakened and why the test was wrong, and the story' })}`
+            : `If the test itself is wrong, ask the person: ${actor.kind === 'lead' ? "on your own branch nobody else reviews it, so you can't approve it." : "the lead can't approve it here."} They run
+${approvalHowTo(TESTS_APPROVAL, actor, root, 'weakening tests in one commit', personOnly)}`),
       );
     }
     for (const w of weakened)
@@ -538,6 +591,7 @@ ${approvalHowTo(TESTS_APPROVAL, actor, root, 'weakening tests in one commit', pe
       });
     useApproval(root, TESTS_APPROVAL, actor);
   }
+  if (stdWeak.length) useApproval(root, STANDARDS_APPROVAL, actor);
   // A dependency approval is used up by the commit that adds its package to a manifest or lockfile.
   const manifests = files.filter((f) => isDependencyFile(f));
   if (manifests.length && actor.kind !== 'readonly') {

package/hooks/guard-paths.mjs

@@ -6,9 +6,11 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { loadBaseline, newProblems } from './lib/baseline.mjs';
 import { CONFIG_FILE } from './lib/config.mjs';
-import { layerProblems } from './lib/layers.mjs';
+import { brokenLayerRule, layerProblems } from './lib/layers.mjs';
+import { noteFor } from './lib/standards.mjs';
 import { block, start } from './lib/hook.mjs';
 import { teamOf, teamProvider, teamRefusal, whoami } from './lib/team.mjs';
+import { sessionWriteProblem } from './lib/sessions.mjs';
 import { spawnSync } from 'node:child_process';
 import {
   actorFor,
@@ -37,6 +39,16 @@ if (error) {
 const problem = writeProblem(actorFor(input, root, config), rel, root, config);
 if (problem) block(`Blocked: ${problem}`);
 
+// SESS-4, SESS-5: another session's task leases the path, or a working session writes where it shouldn't.
+const shared = sessionWriteProblem({
+  project,
+  root,
+  rel,
+  actor: actorFor(input, root, config),
+  session: input.session_id ?? null,
+});
+if (shared) block(`Blocked: ${shared}`);
+
 // TEAM-1, TEAM-4: in a team, the tech lead's paths, other people's lanes, claims and leases.
 const team = teamOf(config);
 if (team) {
@@ -83,7 +95,7 @@ if (after !== null) {
   );
   if (added.length)
     block(
-      `Blocked: this edit would break the layer rules (.claude/code-kit.json › layers):\n  ${added.join('\n  ')}\nDepend only on the layers listed, or ask the lead to change the rule.`,
+      `Blocked: this edit would break the layer rules (.claude/code-kit.json › layers):\n  ${added.join('\n  ')}\nDepend only on the layers listed, or ask the lead to change the rule.${noteFor(root, config, added.map(brokenLayerRule))}`,
     );
 }
 process.exit(0);

package/hooks/hooks.json

@@ -22,6 +22,16 @@
             "timeout": 30
           }
         ]
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/guard-agent.mjs\"",
+            "timeout": 10
+          }
+        ]
       }
     ],
     "PostToolUse": [
@@ -53,6 +63,11 @@
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/team-session.mjs\" start",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\" start",
+            "timeout": 10
           }
         ]
       }
@@ -64,6 +79,11 @@
             "type": "command",
             "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/team-session.mjs\" end",
             "timeout": 10
+          },
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/hooks/session.mjs\" end",
+            "timeout": 10
           }
         ]
       }

package/hooks/lane-audit.mjs

@@ -79,6 +79,26 @@ function takeNote(input) {
   }
 }
 
+/**
+ * SESS-5: the files git said a command's checkout, merge or rebase would overwrite, when it refused for
+ * uncommitted work: [] when it didn't.
+ */
+export function overwrittenFiles(response) {
+  const text = typeof response === 'string' ? response : JSON.stringify(response ?? '');
+  const said = text.replace(/\\n/g, '\n').replace(/\\t/g, '\t');
+  const files = [];
+  for (const m of said.matchAll(
+    /(?:local changes to the following files|untracked working tree files) would be (?:overwritten|removed) by [\w-]+:\n((?:\t[^\n]+\n?)+)/g,
+  ))
+    files.push(
+      ...m[1]
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean),
+    );
+  return [...new Set(files)];
+}
+
 export function auditProblems(input, config) {
   const root = actorRoot(input);
   if (!root) return [];
@@ -99,8 +119,25 @@ export function auditProblems(input, config) {
 
 if (import.meta.url === `file://${process.argv[1]}`) {
   const { block, start } = await import('./lib/hook.mjs');
-  const { input, config, error } = start();
+  const { input, project, config, error } = start();
   if (error) process.exit(0); // guard-paths and stop-check report an invalid config
+  // SESS-5: git refused because of uncommitted files another session wrote: say whose they are.
+  const overwritten = overwrittenFiles(input.tool_response);
+  if (overwritten.length) {
+    const { memberOf, writersOf } = await import('./lib/sessions.mjs');
+    const whose = Object.entries(writersOf(project, overwritten, input.session_id ?? null));
+    if (whose.length)
+      block(
+        `Git refused because of uncommitted files another session wrote in this checkout:\n  ${whose
+          .map(
+            ([f, w]) =>
+              `${f}: ${w.map((s) => `${memberOf(s)}${s.task ? `, working on "${s.task.title}"` : ''}${s.live ? '' : ' (ended)'}`).join('; ')}`,
+          )
+          .join(
+            '\n  ',
+          )}\nAsk that session to commit or stash them; don't stash or discard another session's work. Better, work in a worktree of your own, where no other session's files can block you.`,
+      );
+  }
   const problems = auditProblems(input, config);
   if (problems.length) {
     block(

package/hooks/lib/adapters/hub/client.mjs

@@ -40,6 +40,7 @@ const OPS = [
   'intent',
   'since',
   'report',
+  'standards',
 ];
 /** What to run again to sign in: code-kit's own command for the client. */
 const SIGN_IN = 'code-kit team provider signin';
@@ -158,6 +159,20 @@ export async function provide(op, input, root = process.cwd()) {
   }
   const { team: _team, ...body } = input;
   try {
+    // STD-6: the organisation's standards are read, not posted. A hub without them answers none.
+    if (op === 'standards') {
+      const { status, json } = await hub('GET', `/v1/repos/${repo}/standards`);
+      markUp(root);
+      if (status === 401) return unreachable(json.why ?? `Sign in to the hub again: ${SIGN_IN}.`);
+      if (status === 404 || status === 405 || !Array.isArray(json?.standards))
+        return { ok: true, standards: [], waivers: [] };
+      return {
+        ok: true,
+        version: json.version ?? null,
+        standards: json.standards,
+        waivers: Array.isArray(json.waivers) ? json.waivers : [],
+      };
+    }
     const { status, json } = await hub('POST', `/v1/repos/${repo}/${op}`, body);
     markUp(root);
     if (status === 401) return unreachable(json.why ?? `Sign in to the hub again: ${SIGN_IN}.`);

package/hooks/lib/checks.mjs

@@ -16,13 +16,14 @@ function directories(check, files, root) {
 }
 
 /**
- * The first failure as { title, output }, or null. `actor` decides `owners`; the lead always may. A
+ * The first failure as { check, title, output }, or null. `actor` decides `owners`; the lead always may. A
  * command that isn't installed skips the rest of the check, unless `ifMissing` is "fail", and is
  * added to `skipped` as { check, command, where }, so a pass never hides a check that didn't run.
  */
 function runCheck(check, files, root, actor, skipped) {
   if (check.owners && !(actor.kind === 'lead' || check.owners.includes(actor.lane))) {
     return {
+      check: check.name,
       title: `The ${actor.label} changed ${check.name} files it does not own:`,
       output: files.join('\n'),
     };
@@ -39,6 +40,7 @@ function runCheck(check, files, root, actor, skipped) {
       if (res.status === 127) {
         if (check.ifMissing === 'fail')
           return {
+            check: check.name,
             title: `${check.name}: \`${command}\` is not installed${where}. Install it so the check can run.`,
           };
         skipped.push({ check: check.name, command, where: where.replace(/^ in /, '') || null });
@@ -46,10 +48,12 @@ function runCheck(check, files, root, actor, skipped) {
       }
       if (res.error || res.status === null)
         return {
+          check: check.name,
           title: `${check.name}: \`${command}\` did not finish${where} (${res.error?.code ?? res.signal}).`,
         };
       if (res.status !== 0)
         return {
+          check: check.name,
           title: `${check.name}: \`${command}\` fails${where}. Fix it:`,
           output: res.stdout + res.stderr,
         };

package/hooks/lib/config.mjs

@@ -96,20 +96,38 @@ export function withDefaults(c) {
     tests: c.tests ?? [],
     regression: { prepare: c.regression?.prepare ?? null },
     branches: { protected: c.branches?.protected ?? ['main', 'master'] },
-    approvals: { lead: c.approvals?.lead === true, delegate: delegateRules(c.approvals?.delegate) },
+    approvals: {
+      lead: c.approvals?.lead === true,
+      delegate: delegateRules(c.approvals?.delegate, c.protected ?? []),
+    },
     harness: harnessSettings(c.harness),
   };
 }
 
+/** WHO-1: the approvals the person keeps when the config says nothing: product, design, CI and the kit. */
+export const PERSON_KEEPS = ['spec', 'design', 'ci', 'kit'];
+
 /**
  * The rules within which the lead approves on its own (`approvals.delegate`), or null when it may not:
- * the protected approvals it may grant, and the dependency rule packages must meet.
+ * the protected approvals it may grant, the dependency rule packages must meet, merges, and weakened
+ * tests on a lane's branch. WHO-1: with no `approvals.delegate`, the lead decides everything technical:
+ * every protected approval but the person's (PERSON_KEEPS), dependencies within the registry's
+ * defaults, merges and weakened tests. `false` keeps everything for the person.
  */
-function delegateRules(d) {
-  if (!d) return null;
+function delegateRules(given, protectedPaths = []) {
+  if (given === false) return null;
+  const d = given ?? {
+    protected: [...new Set(protectedPaths.map((p) => p.approval))].filter(
+      (a) => a && !PERSON_KEEPS.includes(a),
+    ),
+    merge: true,
+    tests: true,
+    dependencies: {},
+  };
   return {
     protected: d.protected ?? [],
     merge: d.merge === true,
+    tests: d.tests === true,
     dependencies: d.dependencies
       ? {
           licences: d.dependencies.licences ?? [
@@ -149,6 +167,129 @@ const isRegExp = (v) => {
  * security reviewer (ONB-7, spec 17). A project set up before (no `setup`, or a lower one) is told what
  * re-running init adds.
  */
+/**
+ * WHO-3: who decides each approval, as the Settings tab's Approvals rows: one per protected approval
+ * (but the kit, which is always the person's), dependencies with the registry's rules, merges and
+ * weakened tests. Each row: { key, value, default, about, choices?, section: 'Approvals' }.
+ */
+export function approvalSettings(config) {
+  const rules = config.approvals.delegate;
+  const who = (lead) => (lead ? 'lead' : 'person');
+  const names = [...new Set(config.protected.map((p) => p.approval))].filter((n) => n !== 'kit');
+  const fallback = delegateRules(undefined, config.protected) ?? {};
+  const deps = rules?.dependencies ?? delegateRules({ dependencies: {} }).dependencies;
+  const row = (key, value, dflt, about, choices) => ({
+    key,
+    value,
+    default: dflt,
+    about,
+    section: 'Approvals',
+    ...(choices ? { choices } : {}),
+  });
+  return [
+    ...names.map((n) =>
+      row(
+        `approvals.${n}`,
+        who(rules?.protected.includes(n)),
+        who(fallback.protected?.includes(n)),
+        `Who approves a lane's change to what's protected as "${n}"`,
+        ['lead', 'person'],
+      ),
+    ),
+    row(
+      'approvals.dependencies',
+      who(Boolean(rules?.dependencies)),
+      'lead',
+      "Who approves a lane's new package: the lead within the registry's rules, or you",
+      ['lead', 'person'],
+    ),
+    row(
+      'approvals.dependencies.licences',
+      deps.licences.join(','),
+      'MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC',
+      'The licences a package the lead approves may have, comma-separated',
+    ),
+    row(
+      'approvals.dependencies.minWeeklyDownloads',
+      deps.minWeeklyDownloads,
+      10_000,
+      'The weekly downloads a package the lead approves must have, at least',
+    ),
+    row(
+      'approvals.dependencies.maxMonthsSinceRelease',
+      deps.maxMonthsSinceRelease,
+      18,
+      "Months since a package's last release, at most, for the lead to approve it",
+    ),
+    row(
+      'approvals.dependencies.allowInstallScripts',
+      Array.isArray(deps.allowInstallScripts)
+        ? deps.allowInstallScripts.join(',')
+        : deps.allowInstallScripts,
+      false,
+      'Install scripts a package the lead approves may run: true, false, or kinds (binary, build, other)',
+    ),
+    row(
+      'approvals.merge',
+      who(Boolean(rules?.merge)),
+      'lead',
+      'Who merges a reviewed branch into the base: merging is not releasing',
+      ['lead', 'person'],
+    ),
+    row(
+      'approvals.tests',
+      who(Boolean(rules?.tests)),
+      'lead',
+      "Who approves a weakened test on a lane's branch, after review; on the lead's own branches it is always you",
+      ['lead', 'person'],
+    ),
+  ];
+}
+
+/** WHO-3: the raw config with one approval setting changed (a copy), the rules written out in full. */
+export function withApprovalSetting(raw, config, key, text) {
+  const rules = config.approvals.delegate;
+  const deps = rules?.dependencies ?? null;
+  const delegate = {
+    protected: [...(rules?.protected ?? [])],
+    merge: Boolean(rules?.merge),
+    tests: Boolean(rules?.tests),
+    ...(deps ? { dependencies: { ...deps } } : {}),
+  };
+  const lead = text === 'lead' ? true : text === 'person' ? false : null;
+  const rule = key.replace(/^approvals\./, '');
+  const depRule = rule.startsWith('dependencies.') ? rule.slice('dependencies.'.length) : null;
+  if (depRule) {
+    const base = delegate.dependencies ?? delegateRules({ dependencies: {} }).dependencies;
+    const list = String(text)
+      .split(',')
+      .map((x) => x.trim())
+      .filter(Boolean);
+    const value =
+      depRule === 'licences'
+        ? list
+        : depRule === 'allowInstallScripts'
+          ? text === 'true' || (text === 'false' ? false : list)
+          : /^\d+$/.test(text)
+            ? Number(text)
+            : text;
+    delegate.dependencies = { ...base, [depRule]: value };
+  } else if (lead === null) return null;
+  else if (rule === 'dependencies')
+    lead
+      ? (delegate.dependencies = deps ?? delegateRules({ dependencies: {} }).dependencies)
+      : delete delegate.dependencies;
+  else if (rule === 'merge' || rule === 'tests') delegate[rule] = lead;
+  else if (config.protected.some((p) => p.approval === rule) && rule !== 'kit')
+    delegate.protected = lead
+      ? [...new Set([...delegate.protected, rule])]
+      : delegate.protected.filter((n) => n !== rule);
+  else return null;
+  const copy = structuredClone(raw);
+  copy.approvals = { ...(copy.approvals ?? {}), delegate };
+  return copy;
+}
+
 export const SETUP_VERSION = 3;
 
 /** Every problem with a parsed config, as readable sentences; empty when it is valid. */
@@ -174,7 +315,7 @@ export function validate(c) {
   );
   // A brownfield project may have no specs yet: then there is no spec-check gate.
   need(c.docs === undefined || isObj(c.docs), '"docs" must be an object');
-  for (const k of ['specs', 'principles', 'plan', 'decisions'])
+  for (const k of ['specs', 'principles', 'plan', 'decisions', 'standards'])
     need(c.docs?.[k] === undefined || isStr(c.docs[k]), `"docs.${k}" must be a path`);
   need(isObj(c.lead) && isList(c.lead?.paths), '"lead.paths" must be a list of globs');
   need(
@@ -236,9 +377,11 @@ export function validate(c) {
   const isCount = (v) => v === undefined || (Number.isInteger(v) && v >= 0);
   need(
     d === undefined ||
+      d === false ||
       (isObj(d) &&
         (d.protected === undefined || isList(d.protected)) &&
         [undefined, true, false].includes(d.merge) &&
+        [undefined, true, false].includes(d.tests) &&
         (dep === undefined ||
           (isObj(dep) &&
             (dep.licences === undefined || isList(dep.licences)) &&
@@ -247,7 +390,7 @@ export function validate(c) {
             ([undefined, true, false].includes(dep.allowInstallScripts) ||
               (isList(dep.allowInstallScripts) &&
                 dep.allowInstallScripts.every((k) => ['binary', 'build', 'other'].includes(k))))))),
-    '"approvals.delegate" must be { protected?: [approval names], merge?: true|false, dependencies?: { licences?, minWeeklyDownloads?, maxMonthsSinceRelease?, allowInstallScripts?: true|false|["binary","build","other"] } }',
+    '"approvals.delegate" must be false, or { protected?: [approval names], merge?: true|false, tests?: true|false, dependencies?: { licences?, minWeeklyDownloads?, maxMonthsSinceRelease?, allowInstallScripts?: true|false|["binary","build","other"] } }',
   );
   need(
     c.branches === undefined || isList(c.branches?.protected),

package/hooks/lib/decisionstore.mjs

@@ -0,0 +1,89 @@
+// Decisions owned by the session that raised them (docs/specs/23-the-team.md, OWN-1 to OWN-4). What the
+// person settles comes from two logs code-kit already keeps, each record now carrying its session: the
+// lead's questions (lib/questions.mjs) and the approvals a refusal asked for (lib/rules.mjs). This reads
+// both as one list, each decision with its member, subject and context, so a session sees, asks and
+// answers only its own, and the others only a count. A decision from before sessions were recorded
+// belongs to no session and shows in any.
+import { openQuestions } from './questions.mjs';
+import { openRequests } from './rules.mjs';
+import { memberOf, readSession, sessions, shortSession } from './sessions.mjs';
+
+/** The stories that are done: a decision about one of them has lost its cause (OWN-4). */
+const doneIn = (stories) =>
+  new Set((stories ?? []).filter((s) => s.state === 'done').map((s) => s.id));
+
+/**
+ * Every open decision, oldest first: [{ id, kind, session, member, subject, what, context, options,
+ * blocks, count, opened, source }]. `kind` is `answer` (a question for the person) or `approve`.
+ */
+export function openDecisions(root, { stories = [] } = {}, now = Date.now()) {
+  const done = doneIn(stories);
+  const byId = new Map(sessions(root, now).map((s) => [s.id, s]));
+  const member = (session) =>
+    session ? (memberOf(byId.get(session)) ?? shortSession(session)) : null;
+  const questions = openQuestions(root)
+    .filter((q) => !(q.story && done.has(q.story)))
+    .map((q) => ({
+      id: q.id,
+      kind: 'answer',
+      session: q.session ?? null,
+      member: member(q.session),
+      subject: q.story ?? null,
+      what: q.question,
+      context: q.why ?? null,
+      options: q.options ?? [],
+      blocks: Boolean(q.blocks),
+      count: q.count ?? 1,
+      opened: q.at,
+      source: q,
+    }));
+  const requests = openRequests(root, now).map((r) => ({
+    id: `R:${r.at}`,
+    kind: 'approve',
+    session: r.session ?? null,
+    member: member(r.session),
+    subject: r.lane ?? null,
+    what: r.what,
+    context: r.why ?? null,
+    options: [],
+    blocks: true,
+    count: 1,
+    opened: r.at,
+    source: r,
+  }));
+  return [...questions, ...requests].sort((a, b) => Date.parse(a.opened) - Date.parse(b.opened));
+}
+
+/** The sessions whose decisions `session` answers for: its own, and those whose task it took over. */
+function ownedBy(root, session) {
+  const me = readSession(root, session);
+  return new Set([session, ...(me?.took ?? [])]);
+}
+
+/**
+ * OWN-1: the decisions `session` sees and answers ({ mine }), and the count waiting in each other live
+ * session ({ elsewhere: [{ session, member, count }] }). A decision of a session that has ended stays with
+ * it: it isn't handed to another session's lead.
+ */
+export function decisionsFor(root, session, context = {}, now = Date.now()) {
+  const all = openDecisions(root, context, now);
+  const own = ownedBy(root, session);
+  const live = new Set(
+    sessions(root, now)
+      .filter((s) => s.live)
+      .map((s) => s.id),
+  );
+  const mine = all.filter((d) => !d.session || own.has(d.session));
+  const counts = new Map();
+  for (const d of all)
+    if (d.session && !own.has(d.session) && live.has(d.session))
+      counts.set(d.session, (counts.get(d.session) ?? 0) + 1);
+  return {
+    mine,
+    elsewhere: [...counts].map(([s, count]) => ({
+      session: s,
+      member: all.find((d) => d.session === s)?.member ?? shortSession(s),
+      count,
+    })),
+  };
+}