atris 3.74.4 → 3.74.6

package/lib/yes-lock.js

@@ -64,6 +64,8 @@ function handoffParent(stateDir, missionId) {
 
 // Yes cards for held handed-off runs: every lock record under the handoff
 // seal, asked and not yet answered, with the job it was handed off from.
+// The card says who wants what to go where, in plain words; the raw command
+// stays in the lock record (command).
 function handoffYesCards(stateDir) {
   let files = [];
   try { files = fs.readdirSync(path.join(stateDir, 'yes-locks')).filter(f => f.endsWith('.json')); } catch { return []; }
@@ -73,12 +75,180 @@ function handoffYesCards(stateDir) {
     try { data = JSON.parse(fs.readFileSync(path.join(stateDir, 'yes-locks', name), 'utf8')); } catch { continue; }
     if (!data || !data.mission_id || !Array.isArray(data.locks) || !data.locks.length || !data.locks.every(l => l && l.text === HANDOFF_SEAL_TEXT)) continue;
     for (const lock of askedYesLocks(stateDir, data.mission_id)) {
-      cards.push({ mission_id: data.mission_id, parent_mission_id: data.parent_mission_id || null, step: lock.step, hash: lock.hash, command: lock.held_command || null, ask: handoffAsk(lock.held_command || 'run a held command') });
+      const who = data.owner || 'a handed-off job';
+      cards.push({ mission_id: data.mission_id, parent_mission_id: data.parent_mission_id || null, who, step: lock.step, hash: lock.hash, command: lock.held_command || null, ask: `${who} wants to ${plainWhat(lock.held_key, who)}` });
     }
   }
   return cards;
 }
 
+// What a held command would do, for the owner's yes card: what goes out and
+// where, with no flags, settings, or paths. key is the request's record of
+// the exact command ({ tool, args, cwd }).
+function plainWhat(key, who = '') {
+  let cmd = {};
+  try { cmd = JSON.parse(key); } catch { return 'run a command the lock holds'; }
+  const name = path.basename(String(cmd.tool || ''));
+  const args = (Array.isArray(cmd.args) ? cmd.args : []).map(String);
+  const cwd = cmd.cwd || process.cwd();
+  if (name === 'git') {
+    const p = parseGit(args);
+    if (p.sub === 'push') return plainPush(p, cwd, who);
+    if (p.sub === 'send-pack' || p.sub === 'http-push') return 'push to another computer';
+    return 'use a setting that could let a push skip the lock';
+  }
+  // gh: said exactly, verb and target, or else where it goes and the words
+  // it names; a delete never reads as a release
+  if (name === 'gh') return describeGh(args) || `run a command that changes GitHub: "${args.join(' ')}"`;
+  if (name === 'npm' || name === 'yarn' || name === 'pnpm') {
+    const [sub = '', folder = ''] = packageWords(args).words.map(String);
+    // the package it names: a folder given to publish, else this folder
+    let pkg = 'a package';
+    for (const dir of [folder && path.resolve(cwd, folder), cwd].filter(Boolean)) {
+      try { pkg = JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).name || pkg; break; } catch { /* not a package folder */ }
+    }
+    if (PKG_PUBLISH.has(sub)) return sub.startsWith('dist-tag') ? `change which version of ${pkg} npm installs` : `publish ${pkg} to npm`;
+    if (sub === 'version') return `make a new version of ${pkg}`;
+    return `run ${name} in a way the lock does not know`;
+  }
+  if (name === 'npx' || name === 'pnpx' || name === 'bunx') return 'run a tool downloaded from npm';
+  if (name === 'atris') {
+    const [verb = ''] = positionals(args, new Set(['--account', '--as', '--from', '--to', '--channel']));
+    const read = readAtris(args);
+    if (read.cats.includes('spend')) return `spend Atris credits on ${verb}`;
+    // one phrase, the weightiest kind it touches
+    const phrase = { deploy: 'deploy a site', publish: 'publish something', merge: 'land work on master', tag: 'push a version tag', post: 'post in public', send: 'send a message' };
+    const kind = ['deploy', 'publish', 'merge', 'tag', 'post', 'send'].find(c => read.cats.includes(c));
+    if (kind) return phrase[kind];
+    if (ATRIS_REFUSED.has(verb)) return 'answer one of your asks for you';
+    return `run atris ${verb}`;
+  }
+  return 'run a command the lock holds';
+}
+
+// "push its job deck branch to GitHub": the branch in words, and the host
+function plainPush(p, cwd, who) {
+  const words = positionals(p.rest, PUSH_VALUE_FLAGS);
+  const remote = words[0] || 'origin';
+  let url = '';
+  try { url = String(spawnSync('git', [...p.prefix, 'remote', 'get-url', '--push', remote], { cwd, encoding: 'utf8', timeout: 5000 }).stdout || '').trim(); } catch { /* no repo */ }
+  const host = (url.match(/^[a-z+]+:\/\/(?:[^@/]+@)?([^/:]+)/i) || url.match(/^[^@/:]+@([^:/]+):/) || [])[1] || '';
+  const where = /github\.com$/i.test(host) ? 'GitHub' : /gitlab\.com$/i.test(host) ? 'GitLab' : host ? host : (url ? 'a folder on this computer' : 'its remote');
+  if (p.rest.some(a => /^--(tags|follow-tags|mirror|all)/.test(a))) return `push tags or every branch to ${where}`;
+  const ref = String(words[1] || '');
+  const dst = ref.replace(/^\+/, '').split(':').pop().replace(/^refs\/(heads|tags)\//, '');
+  // a delete is said as a delete, with the name it removes
+  if (p.rest.some(a => a === '--delete' || a === '-d') || /^\+?:/.test(ref)) return dst ? `delete ${dst} on ${where}` : `delete something on ${where}`;
+  const force = /^\+/.test(ref) || p.rest.some(a => /^(--force|-f|--force-with-lease|--force-if-includes)(=|$)/.test(a));
+  const said = pushWords(dst, ref, where, who);
+  return force ? `force ${said}, replacing what is there` : said;
+}
+
+function pushWords(dst, ref, where, who) {
+  if (!dst) return `push to ${where}`;
+  if (isMainRef(dst)) return `push to master on ${where}`;
+  if (/^refs\/tags\//.test(ref.split(':').pop()) || /^v?\d+\.\d+/.test(dst)) return `push the tag ${dst} to ${where}`;
+  const first = String(who).toLowerCase();
+  const plain = dst.split('/').pop().replace(/[-_]\d{8}(?:[-_]\d{4,6})?$/, '').split(/[-_.]+/).filter((w, i) => w && !(i === 0 && w.toLowerCase() === first)).join(' ');
+  return plain ? `push its ${plain} branch to ${where}` : `push a branch to ${where}`;
+}
+
+// One command's flags as it takes them: known switches, known options with
+// one value each, and the words left over. Anything else is null.
+function readArgs(words, { switches = [], values = [] } = {}) {
+  const out = { flags: new Set(), opts: {}, rest: [] };
+  for (let i = 0; i < words.length; i += 1) {
+    const w = words[i];
+    if (!w.startsWith('-') || w === '-') { out.rest.push(w); continue; }
+    const eq = w.indexOf('=');
+    const name = eq > 0 ? w.slice(0, eq) : w;
+    if (values.includes(name)) {
+      const v = eq > 0 ? w.slice(eq + 1) : words[(i += 1)];
+      if (!v || v.startsWith('-')) return null;
+      out.opts[name] = v;
+    } else if (eq < 0 && switches.includes(w)) out.flags.add(w);
+    else return null;
+  }
+  return out;
+}
+
+const NAME = /^[\w.@+-]+$/;
+const REPO = /^[\w.-]+\/[\w.-]+$/;
+
+// Exact words for a held command, verb and target, or null when it
+// cannot be said exactly. words: the tool, then its arguments.
+function describeCommand(words) {
+  if (words[0] === 'gh') return describeGh(words.slice(1));
+  if (words[0] === 'git' && words[1] === 'push') return describePush(words.slice(2));
+  if ((words[0] === 'npm' || words[0] === 'pnpm') && words[1] === 'publish') return describePublish(words.slice(2));
+  return null;
+}
+
+function describeGh([group, verb, ...more]) {
+  const repo = a => {
+    const r = a.opts['-R'] || a.opts['--repo'];
+    if (!r) return 'in this repo';
+    return REPO.test(r) ? `in ${r}` : null;
+  };
+  const has = (a, ...names) => names.some(n => a.flags.has(n));
+  if (group === 'release' && verb === 'delete') {
+    const a = readArgs(more, { switches: ['--yes', '-y', '--cleanup-tag'], values: ['-R', '--repo'] });
+    if (!a || a.rest.length !== 1 || !NAME.test(a.rest[0]) || !repo(a)) return null;
+    return `delete the GitHub release ${a.rest[0]}${has(a, '--cleanup-tag') ? ' and its tag' : ''} ${repo(a)}`;
+  }
+  if (group === 'release' && verb === 'create') {
+    const a = readArgs(more, { switches: ['--draft', '-d', '--prerelease', '-p', '--generate-notes'], values: ['-R', '--repo', '--title', '-t', '--notes', '-n', '--target'] });
+    if (!a || a.rest.length !== 1 || !NAME.test(a.rest[0]) || !repo(a)) return null;
+    const target = a.opts['--target'];
+    if (target && !NAME.test(target)) return null;
+    const kind = [has(a, '--draft', '-d') && ' as a draft', has(a, '--prerelease', '-p') && ' as a prerelease'].filter(Boolean).join(' and');
+    return `create the GitHub release ${a.rest[0]}${kind}${target ? ` from ${target}` : ''} ${repo(a)}`;
+  }
+  if (group === 'pr' && (verb === 'merge' || verb === 'close')) {
+    const a = readArgs(more, { switches: verb === 'merge' ? ['--merge', '-m', '--squash', '-s', '--rebase', '-r', '--delete-branch', '-d'] : ['--delete-branch', '-d'], values: ['-R', '--repo'] });
+    if (!a || a.rest.length > 1 || !repo(a)) return null;
+    const which = a.rest[0];
+    if (which && !NAME.test(which)) return null;
+    const pr = !which ? 'the pull request for this branch' : /^\d+$/.test(which) ? `pull request ${which}` : `the pull request for ${which}`;
+    const how = [has(a, '--merge', '-m') && 'merge', has(a, '--squash', '-s') && 'squash and merge', has(a, '--rebase', '-r') && 'rebase and merge'].filter(Boolean);
+    if (how.length > 1) return null;
+    const act = verb === 'close' ? 'close' : how[0] || 'merge';
+    return `${act} ${pr}${has(a, '--delete-branch', '-d') ? ' and delete its branch' : ''} ${repo(a)}`;
+  }
+  return null;
+}
+
+function describePush(args) {
+  const a = readArgs(args, { switches: ['--tags', '--force', '-f', '--delete', '-d', '--set-upstream', '-u'] });
+  if (!a || a.rest.length > 2) return null;
+  const [remote, ref] = a.rest;
+  if (remote && !NAME.test(remote)) return null;
+  const to = remote || 'the default remote';
+  const force = a.flags.has('--force') || a.flags.has('-f');
+  const del = a.flags.has('--delete') || a.flags.has('-d');
+  if (a.flags.has('--tags')) return ref || force || del ? null : `push every tag to ${to}`;
+  if (!ref) return del ? null : `${force ? 'force push' : 'push'} this branch to ${to}${force ? ', replacing what is there' : ''}`;
+  const plus = ref.startsWith('+');
+  const parts = (plus ? ref.slice(1) : ref).split(':');
+  if (parts.length > 2 || parts.some(x => x && !/^[\w./-]+$/.test(x))) return null;
+  const [src, dst] = parts;
+  if (del || (parts.length === 2 && !src)) return del && parts.length === 2 ? null : plus || force ? null : `delete ${dst || src} on ${to}`;
+  if (parts.length === 2 && !dst) return null;
+  const strong = force || plus;
+  return `${strong ? 'force push' : 'push'} ${dst ? `${src} to ${dst} on ${to}` : `${src} to ${to}`}${strong ? ', replacing what is there' : ''}`;
+}
+
+function describePublish(args) {
+  const a = readArgs(args, { values: ['--tag', '--access'] });
+  if (!a || a.rest.length > 1) return null;
+  const access = a.opts['--access'];
+  if (access && access !== 'public' && access !== 'restricted') return null;
+  const tag = a.opts['--tag'];
+  if (tag && !NAME.test(tag)) return null;
+  const extra = [tag && `under the ${tag} tag`, access].filter(Boolean).join(', ');
+  return `publish ${a.rest.length ? `the package in "${a.rest[0]}"` : 'this package'} to npm${extra ? ` ${extra}` : ''}`;
+}
+
 // ---- what an owner step locks ------------------------------------------------------
 
 const STEP_WORDS = [
@@ -133,9 +303,9 @@ function writeState(stateDir, missionId, data) {
   fs.renameSync(tmp, file);
 }
 
-function writeYesLocks(stateDir, missionId, { betId = null, seal = [], parentMissionId = null } = {}) {
+function writeYesLocks(stateDir, missionId, { betId = null, seal = [], parentMissionId = null, owner = null } = {}) {
   const locks = normalizeSeal(seal).map(s => ({ ...s, asked_at: null, approved_at: null, consumed_at: null }));
-  writeState(stateDir, missionId, { mission_id: missionId, bet_id: betId, ...(parentMissionId ? { parent_mission_id: parentMissionId } : {}), locks });
+  writeState(stateDir, missionId, { mission_id: missionId, bet_id: betId, ...(parentMissionId ? { parent_mission_id: parentMissionId } : {}), ...(owner ? { owner } : {}), locks });
   return locks;
 }
 
@@ -152,7 +322,7 @@ function rowRequests(row) {
 // What a step looks like from outside: its newest waiting command, and its
 // yes that is given and not used yet.
 function stepSummary(requests) {
-  const pending = requests.filter(r => !r.approved_at && !r.used_at);
+  const pending = requests.filter(r => !r.approved_at && !r.used_at && !r.denied_at);
   const open = requests.find(r => r.approved_at && !r.used_at) || null;
   const used = requests.filter(r => r.used_at);
   const last = pending[pending.length - 1] || null;
@@ -190,7 +360,7 @@ function claimFile(stateDir, missionId, lock, request) {
 function saveLocks(stateDir, missionId, locks, betId) {
   const prior = readState(stateDir, missionId);
   const rows = locks.map(l => ({ step: l.step, text: l.text, categories: l.categories, requests: rowRequests(l) }));
-  writeState(stateDir, missionId, { mission_id: missionId, bet_id: (prior && prior.bet_id) || betId || null, ...(prior && prior.parent_mission_id ? { parent_mission_id: prior.parent_mission_id } : {}), locks: rows });
+  writeState(stateDir, missionId, { mission_id: missionId, bet_id: (prior && prior.bet_id) || betId || null, ...(prior && prior.parent_mission_id ? { parent_mission_id: prior.parent_mission_id } : {}), ...(prior && prior.owner ? { owner: prior.owner } : {}), locks: rows });
 }
 
 // The yes covers the one command on the card the owner answered: the waiting
@@ -200,7 +370,7 @@ function approveYesLock(stateDir, missionId, step, seal, at = new Date().toISOSt
   const { locks } = effectiveLocks(stateDir, missionId, seal || sealFromState(stateDir, missionId));
   const lock = locks.find(l => l.step === step);
   if (!lock) return null;
-  const waiting = lock.requests.filter(r => !r.approved_at && !r.used_at);
+  const waiting = lock.requests.filter(r => !r.approved_at && !r.used_at && !r.denied_at);
   const target = hash ? waiting.find(r => r.hash === hash) : waiting[waiting.length - 1];
   if (!target) return null;
   target.approved_at = at || new Date().toISOString();
@@ -208,6 +378,20 @@ function approveYesLock(stateDir, missionId, step, seal, at = new Date().toISOSt
   return { ...lock, ...stepSummary(lock.requests), approved: target };
 }
 
+// The owner's no: the one waiting request with that hash is told no for good.
+// It never runs, its card is gone, and asking again only hears the no.
+// Without a hash (an older caller), the newest waiting request on the step.
+function denyYesLock(stateDir, missionId, step, { hash = null, at = new Date().toISOString() } = {}) {
+  const { locks } = effectiveLocks(stateDir, missionId, sealFromState(stateDir, missionId));
+  const lock = locks.find(l => l.step === step);
+  const waiting = lock ? lock.requests.filter(r => !r.approved_at && !r.used_at && !r.denied_at) : [];
+  const target = hash ? waiting.find(r => r.hash === hash) : waiting[waiting.length - 1];
+  if (!target) return null;
+  target.denied_at = at;
+  saveLocks(stateDir, missionId, locks);
+  return { ...lock, denied: target };
+}
+
 // For readers that have no mission record at hand (the desk), the state file
 // is its own seal: it is only ever used to show and answer cards, never to let
 // a command through.
@@ -223,7 +407,7 @@ function askedYesLocks(stateDir, missionId) {
   const cards = [];
   for (const row of data.locks) {
     for (const r of rowRequests(row)) {
-      if (r.approved_at || r.used_at) continue;
+      if (r.approved_at || r.used_at || r.denied_at) continue;
       cards.push({ step: row.step, text: row.text, categories: row.categories, held_command: r.command, held_key: r.key, hash: r.hash, asked_at: r.asked_at });
     }
   }
@@ -553,11 +737,15 @@ const ONTO_BRANCH = new Set(['merge', 'commit', 'cherry-pick', 'rebase', 'am', '
 
 function readGit(args, ctx, depth = 0) {
   const p = parseGit(args);
-  const risky = [...p.configs.map(configKey), ...ctx.envConfigKeys()].find(k => RISKY_GIT_CONFIG.test(k));
-  if (risky) return refused(`git config ${risky} can change where a push goes, so it is closed while owner steps wait`);
   const repo = ctx.forRepo(p.prefix);
   const sub = p.sub;
   if (!sub) return CLEAR;
+  // config that can reroute matters to a push, or a command that reaches a
+  // network remote; local work passes whatever config it runs with
+  const risky = [...p.configs.map(configKey), ...ctx.envConfigKeys()].find(k => RISKY_GIT_CONFIG.test(k));
+  // an alias given with -c can turn any command into a push
+  const reaches = ['push', 'send-pack', 'http-push'].includes(sub) || /^alias\./i.test(risky || '') || talksToNetwork(sub, p.rest, repo);
+  if (risky && reaches) return refused(`git config ${risky} can change where a push goes, so it is closed while owner steps wait`);
   // git never applies an alias named after one of its own commands, so
   // neither does this: a stored alias.push is ignored and push is push
   const alias = isGitBuiltin(sub, repo) ? null : repo.alias(sub);
@@ -642,6 +830,7 @@ function gitContext(gitBin, cwd, env = process.env, prefix = []) {
     config: key => out(['config', '--get', key]) || '',
     configBool: key => out(['config', '--bool', '--get', key]) || '',
     configAll: key => (out(['config', '--get-all', key]) || '').split('\n').filter(Boolean),
+    remoteNames: () => (out(['remote']) || '').split('\n').filter(Boolean),
     // with insteadOf, pushInsteadOf and pushurl applied, as git push sees them
     remoteUrls: (remote, { push = false } = {}) => (out(['remote', 'get-url', ...(push ? ['--push'] : []), '--all', remote]) || '').split('\n').filter(Boolean),
     alias: name => out(['config', '--get', `alias.${name}`]),
@@ -656,38 +845,34 @@ function gitContext(gitBin, cwd, env = process.env, prefix = []) {
   };
 }
 
-// ---- the handoff seal: an allowlist --------------------------------------------------
+// ---- the handoff seal --------------------------------------------------------------
 //
-// A run woken by a handoff is trusted least, so it does not get the kind-by-
-// kind reading above. Only the commands named here run without a yes;
-// anything else, including every tool, verb, or option this code does not
-// name, is held as a yes card. Reading commands by kind kept missing outward
-// ones (Codex review round 7 on #1483: business deploy, followTags, a mirror
-// remote, symbolic-ref); an allowlist cannot miss a command it never names.
-// A bet's owner steps still lock by kind (analyze above), since a bet locks
-// only the kinds its steps name.
+// A run woken by a handoff guards git push, not every git command. Nothing
+// local publishes anything, and landing goes through origin/master, not
+// local master; the engines and test suites run far more git than any list
+// can name (3.74.0 to 3.74.4 held 546 harmless commands). What stays guarded
+// is what can reach a network remote: a push, and the -c or environment that
+// could run a push past the wrapper, since git runs a program named in its
+// config with its own folder first on PATH. gh and npm, yarn, pnpm keep their
+// lists below, and atris holds its outward and spend verbs. A bet's owner
+// steps still lock by kind (analyze above).
 
 const pass = (args = null) => ({ ok: true, args });
 const hold = why => ({ ok: false, why });
 const isHandoffSeal = sealed => sealed.some(s => s.text === HANDOFF_SEAL_TEXT);
 const PUSH_HINT = 'a branch push runs without a yes as: git push origin <branch>';
 
-// git reads, plus local work that cannot move a ref other than the branch it is on
-const GIT_SEALED_READS = new Set(['status', 'diff', 'log', 'show', 'blame', 'rev-parse', 'ls-files', 'grep', 'describe', 'rev-list', 'merge-base', 'cat-file', 'ls-tree', 'show-ref', 'for-each-ref', 'shortlog', 'check-ignore', 'help', 'version']);
-const GIT_SEALED_LOCAL = new Set(['add', 'rm', 'mv', 'restore', 'update-index', 'write-tree']);
-const GIT_SEALED_GLOBALS = new Set(['--no-pager', '-P', '--no-optional-locks', '--literal-pathspecs', '--version', '--help', '-h']);
 // the shape of a branch name git accepts, without the corners that read as something else
 const BRANCH_NAME = /^(?!-)(?!\.)(?!.*\.\.)(?!.*\/\/)(?!.*\/\.)(?!.*@\{)(?!.*\.lock(?:\/|$))[A-Za-z0-9._/-]+(?<![./])$/;
 
 // -c a woken run may pass: a value that only turns something off, or a key
-// that only changes how output looks. The engines harden their own git calls
-// this way (hooks, fsmonitor, askpass, protocols, gc all off). A -c that
-// names a program, path, command, alias, helper, pager, editor, or route is
-// held, since git runs that program with its own folder first on PATH, where
-// a git inside it skips the wrapper; so are the keys whose value is a name,
-// URL, or refspec (alias, remote, url, push, include, credential, branch
-// routing), where even an empty value can reroute (url.<x>.insteadOf=).
-const GIT_DISPLAY_KEYS = new Set(['format.pretty', 'log.showsignature', 'status.showuntrackedfiles', 'core.quotepath', 'core.safecrlf', 'safe.barerepository', 'color.ui']);
+// that only changes how output looks or who a commit is by. The engines
+// harden their own git calls this way. A -c that names a program, path,
+// command, alias, helper, pager, editor, or route is held, and so are the
+// keys whose value is a name, URL, or refspec (alias, remote, url, push,
+// include, credential, branch routing), where even an empty value can
+// reroute (url.<x>.insteadOf=).
+const GIT_DISPLAY_KEYS = new Set(['format.pretty', 'log.showsignature', 'status.showuntrackedfiles', 'core.quotepath', 'core.safecrlf', 'safe.barerepository', 'color.ui', 'user.name', 'user.email']);
 const GIT_ROUTE_KEYS = /^(alias|remote|url|push|include|includeif|credential)\.|^branch\..+\.(remote|pushremote|merge)$/;
 
 function sealedGitConfigOk(pair) {
@@ -700,228 +885,163 @@ function sealedGitConfigOk(pair) {
   return /^(|false|never|0|no|off)$/i.test(value);
 }
 
-// Only -C, -c that turns something off, and a few output switches go before
-// the command. --config-env and --exec-path are held.
+// The same, set through the environment. GIT_CONFIG_NOSYSTEM only turns the
+// system file off, so it adds nothing git could run.
+function gitEnvProblem(env) {
+  const names = Object.keys(env || {}).filter(k => env[k] !== undefined && env[k] !== '');
+  return names.find(k => (/^GIT_CONFIG/.test(k) && k !== 'GIT_CONFIG_NOSYSTEM') || k === 'GIT_EXEC_PATH') || null;
+}
+
+// git prints these and stops without running the command after them
+const GIT_PRINT_AND_EXIT = new Set(['--exec-path', '--version', '--help', '-h', '--html-path', '--man-path', '--info-path']);
+
+// The options before the command. -C, --git-dir, --work-tree, and
+// --namespace pick the repo; a -c that fails the reading above, --config-env,
+// and --exec-path=<dir> are noted as bad, which matters only for a command
+// that talks to a network remote.
 function sealedGitPrefix(args) {
   const prefix = [];
+  let bad = null;
   for (let i = 0; i < args.length; i += 1) {
     const a = args[i];
-    if (a === '-C' || a === '-c') {
+    if (['-C', '-c', '--git-dir', '--work-tree', '--namespace'].includes(a)) {
       const value = String(args[i + 1] === undefined ? '' : args[i + 1]);
-      if (a === '-c' && !sealedGitConfigOk(value)) return { bad: `-c ${value}` };
+      if (a === '-c' && !sealedGitConfigOk(value)) bad = bad || `-c ${value}`;
       prefix.push(a, value);
       i += 1;
       continue;
     }
-    if (GIT_SEALED_GLOBALS.has(a)) { prefix.push(a); continue; }
-    if (a.startsWith('-')) return { bad: a };
-    return { prefix, sub: a, rest: args.slice(i + 1) };
+    if (/^--config-env(=|$)/.test(a) || a.startsWith('--exec-path=')) bad = bad || a;
+    if (a.startsWith('-')) { prefix.push(a); continue; }
+    return { prefix, bad, sub: a, rest: args.slice(i + 1) };
   }
-  return { prefix, sub: '', rest: [] };
+  return { prefix, bad, sub: '', rest: [] };
 }
 
-// The same, set through the environment. GIT_CONFIG_NOSYSTEM only turns the
-// system file off, so it adds nothing git could run.
-function gitEnvProblem(env) {
-  const names = Object.keys(env || {}).filter(k => env[k] !== undefined && env[k] !== '');
-  return names.find(k => (/^GIT_CONFIG/.test(k) && k !== 'GIT_CONFIG_NOSYSTEM') || k === 'GIT_EXEC_PATH') || null;
-}
-
-// A ref a command writes or switches to must be a plain branch name that is
-// not master and does not resolve to master: no @{-1}, @, HEAD~, ^, refs/,
-// and no name that is a symbolic ref to master.
-function targetProblem(name, repo) {
-  const n = String(name === undefined ? '' : name);
-  if (n === 'HEAD' || n.startsWith('refs/') || !BRANCH_NAME.test(n)) return `${n || '(no name)'} is not a plain branch name`;
-  if (isMainRef(n)) return `${n} is master`;
-  const full = typeof repo.fullRefName === 'function' ? repo.fullRefName(n) : '';
-  if (full && isMainRef(full)) return `${n} resolves to master`;
-  return null;
+// Does this git command talk to a network remote? Pushes, fetches, pulls,
+// ls-remote, and clones to a remote on disk are local work. When the remote
+// cannot be read, it counts as a network one.
+const GIT_REMOTE_SUBS = new Set(['push', 'send-pack', 'http-push', 'fetch', 'pull', 'ls-remote', 'clone']);
+const GIT_REMOTE_VALUE_FLAGS = new Set(['--depth', '--deepen', '--shallow-since', '--shallow-exclude', '-j', '--jobs', '--upload-pack', '--negotiation-tip', '--refmap', '--filter', '-o', '--server-option', '--push-option', '--receive-pack', '--exec', '-s', '--strategy', '-X', '--strategy-option', '-b', '--branch', '--origin', '--template', '--reference', '--separate-git-dir', '-c', '--config']);
+
+function talksToNetwork(sub, rest, repo) {
+  if (!GIT_REMOTE_SUBS.has(sub)) return false;
+  if (sub === 'http-push') return true;
+  if (typeof repo.remoteUrls !== 'function') return true;
+  const isPush = sub === 'push' || sub === 'send-pack';
+  const repoFlag = rest.find(a => /^--repo=/.test(String(a)));
+  const words = positionals(rest, GIT_REMOTE_VALUE_FLAGS);
+  const branch = repo.currentBranch();
+  const targets = sub === 'fetch' && rest.some(a => a === '--all' || a === '--multiple')
+    ? (repo.remoteNames ? repo.remoteNames() : ['origin'])
+    : [repoFlag ? repoFlag.slice('--repo='.length) : words[0]
+      || (isPush && (repo.config(`branch.${branch}.pushRemote`) || repo.config('remote.pushDefault')))
+      || repo.config(`branch.${branch}.remote`) || 'origin'];
+  return targets.some((target) => {
+    const urls = repo.remoteUrls(target, { push: isPush });
+    if (urls.length) return !urls.every(isLocalUrl);
+    // no URL read: a path is local; a remote name git could not read counts as network
+    return !/^(file:\/\/|\/|\.\.?(\/|$)|~)/.test(String(target));
+  });
 }
 
-function sealedGit(args, ctx) {
+function sealedGit(args, ctx, depth = 0) {
   const p = sealedGitPrefix(args);
-  if (p.bad) return hold(`git ${p.bad} is not an option a handed-off job may use`);
+  if (!p.sub || p.prefix.some(a => GIT_PRINT_AND_EXIT.has(a))) return pass();
+  // the lock's own questions leave out options that could break them
+  const repo = ctx.forRepo(p.prefix.filter(a => !GIT_PRINT_AND_EXIT.has(a) && !/^--(config-env|exec-path=)/.test(a)));
+  // an alias that turns into a push is a push; one that runs a shell could
+  // run a git that skips the wrapper
+  const alias = isGitBuiltin(p.sub, repo) ? null : repo.alias(p.sub);
+  if (alias !== null && alias !== undefined) {
+    if (depth >= 5 || alias.startsWith('!')) return hold(`git ${p.sub} is an alias that runs a shell command`);
+    return sealedGit([...p.prefix, ...alias.trim().split(/\s+/), ...p.rest], ctx, depth + 1);
+  }
+  // local work passes in any folder, whatever config the test suite or
+  // engine runs git with; only a command that reaches a network remote is read
+  if (!talksToNetwork(p.sub, p.rest, repo)) return pass();
+  if (p.bad) return hold(`git ${p.bad} can run a program that skips the wrapper`);
   const envName = gitEnvProblem(typeof ctx.env === 'function' ? ctx.env() : {});
   if (envName) return hold(`git with ${envName} set can run a program that skips the wrapper`);
-  if (!p.sub) return pass();
-  if (GIT_SEALED_READS.has(p.sub) || GIT_SEALED_LOCAL.has(p.sub)) return pass();
-  // the questions below are asked of the repo the command names
-  const repo = ctx.forRepo(p.prefix.filter((a, i, all) => a === '-C' || a === '-c' || all[i - 1] === '-C' || all[i - 1] === '-c'));
-  const rest = p.rest;
-  switch (p.sub) {
-    // a new repo has no remote; a template or a git folder elsewhere could bring hooks
-    case 'init': return rest.some(a => /^--(template|separate-git-dir)(=|$)/.test(a)) ? hold('git init with a template or a git folder elsewhere can bring hooks') : pass();
-    case 'push': return sealedPush(p, repo);
-    case 'fetch': return sealedFetch(rest, repo);
-    case 'commit': return isMainRef(repo.currentBranch()) ? hold('a commit here would land on master') : pass();
-    case 'stash': {
-      if (rest[0] !== 'branch') return pass();
-      const why = targetProblem(positionals(rest.slice(1), new Set())[0], repo);
-      return why ? hold(`git stash branch: ${why}`) : pass();
-    }
-    case 'checkout': case 'switch': return sealedSwitch(p.sub, rest, repo);
-    case 'branch': return sealedBranch(rest, repo);
-    case 'config': return sealedConfig(rest);
-    case 'remote': {
-      const op = rest.filter(a => a !== '-v' && a !== '--verbose')[0] || '';
-      return op === '' || op === 'get-url' ? pass() : hold(`git remote ${op} changes where git sends things`);
-    }
-    case 'worktree': return sealedWorktree(rest, repo);
-    default: return hold(`git ${p.sub} is not on the list a handed-off job may run`);
-  }
+  // the low-level ways to update a remote are push too
+  if (['send-pack', 'http-push'].includes(p.sub)) return hold(`git ${p.sub} updates a remote without git push`);
+  if (p.sub !== 'push') return pass();
+  return sealedPush(p, repo);
 }
 
-// One branch, to origin, by name or as HEAD:refs/heads/<branch>, with no
-// option but -u and quiet or verbose. It runs with followTags off, origin's
-// mirror off, and push options cleared, and with the refspec written out in
-// full, so origin's own push lines cannot send it anywhere else.
-function sealedPush(p, repo) {
-  let upstream = false;
-  const quiet = [];
-  const words = [];
-  for (const a of p.rest) {
-    if (a === '-u' || a === '--set-upstream') { upstream = true; continue; }
-    if (['-q', '--quiet', '-v', '--verbose', '--progress', '--no-progress'].includes(a)) { quiet.push(a); continue; }
-    if (a.startsWith('-')) return hold(`git push ${a} is not an option a handed-off job may use; ${PUSH_HINT}`);
-    words.push(a);
-  }
-  if (words.length !== 2 || words[0] !== 'origin') return hold(`a handed-off job pushes one branch to origin; ${PUSH_HINT}`);
-  // HEAD:<branch> is written out as HEAD:refs/heads/<branch>, so a name that
-  // matches a tag on origin can never update the tag
-  const head = words[1].match(/^HEAD:(?:refs\/heads\/(?=.))?(?!refs\/)(.+)$/);
-  const branch = head ? head[1] : words[1];
-  if (!head && (branch.includes(':') || branch.startsWith('refs/'))) return hold(`git push ${words[1]} names more than a branch; ${PUSH_HINT}`);
-  if (isMainRef(branch)) return hold(`git push to master lands on master; ${PUSH_HINT}`);
-  const why = targetProblem(branch, repo);
-  if (why) return hold(`git push ${words[1]}: ${why}; ${PUSH_HINT}`);
-  if (!head && repo.isTag(branch) && !repo.isBranch(branch)) return hold(`git push ${branch} names a tag; ${PUSH_HINT}`);
-  const fetchUrls = repo.remoteUrls('origin');
-  const pushUrls = repo.remoteUrls('origin', { push: true });
-  if (!fetchUrls.length) return hold('origin is not a remote here');
-  if (pushUrls.length !== 1 || pushUrls[0] !== fetchUrls[0]) return hold('origin pushes somewhere other than where it fetches from');
-  if (repo.configBool('remote.origin.mirror') === 'true') return hold('origin is set up as a mirror, which pushes every branch and tag');
-  const prefix = p.prefix;
-  return pass([...prefix, '-c', 'push.followTags=false', '-c', 'remote.origin.mirror=false', '-c', 'push.pushOption=', 'push', '--no-follow-tags',
-    ...(upstream ? ['--set-upstream'] : []), ...quiet, 'origin', `${head ? 'HEAD' : `refs/heads/${branch}`}:refs/heads/${branch}`]);
+// a remote that is a folder on this computer: a path, a file:// URL, or a
+// remote whose every push URL is one
+function isLocalUrl(url) {
+  const u = String(url || '');
+  if (/^file:\/\//.test(u) || /^(\/|\.\.?(\/|$)|~)/.test(u)) return true;
+  return !u.includes(':');
 }
 
-const FETCH_FLAGS = new Set(['-q', '--quiet', '-v', '--verbose', '--progress', '--no-progress', '-p', '--prune', '-P', '--prune-tags', '-t', '--tags', '-n', '--no-tags', '--dry-run', '--unshallow', '--no-write-fetch-head', '--write-fetch-head']);
+const PUSH_FLAGS_OK = new Set(['-u', '--set-upstream', '-q', '--quiet', '-v', '--verbose', '--progress', '--no-progress', '-f', '--force', '--force-if-includes', '--no-force-if-includes', '--no-verify', '--verify', '-n', '--dry-run', '--porcelain', '--atomic', '--no-atomic', '--thin', '--no-thin', '--no-follow-tags']);
 
-function sealedFetch(rest, repo) {
-  const words = [];
-  for (const a of rest) {
-    if (FETCH_FLAGS.has(a) || /^--(depth|deepen|shallow-since|shallow-exclude|filter|jobs)=/.test(a)) continue;
-    if (a.startsWith('-')) return hold(`git fetch ${a} is not an option a handed-off job may use`);
-    words.push(a);
+// A push to a remote on disk runs as written: tests push tags and master to
+// scratch repos. To a network remote it runs only as branch pushes that are
+// not master, with followTags, the remote's mirror setting, and push options
+// off, and each refspec written out in full, so the remote's own push lines
+// cannot send it anywhere else. Tags, master, mirror, --all, --prune, a
+// matching push (":"), and deleting master are held.
+function sealedPush(p, repo) {
+  const words = positionals(p.rest, PUSH_VALUE_FLAGS);
+  const repoFlag = p.rest.find(a => /^--repo=/.test(a));
+  const named = repoFlag ? repoFlag.slice('--repo='.length) : words[0];
+  const remote = named || repo.config(`branch.${repo.currentBranch()}.pushRemote`) || repo.config('remote.pushDefault') || repo.config(`branch.${repo.currentBranch()}.remote`) || 'origin';
+  const configured = repo.remoteUrls(remote, { push: true });
+  if (configured.length ? configured.every(isLocalUrl) : isLocalUrl(remote)) return pass();
+  if (isGitTrue(repo.configBool(`remote.${remote}.mirror`))) return hold(`${remote} is set up as a mirror, which pushes every branch and tag`);
+  const kept = [];
+  let deleting = false;
+  for (const a of p.rest) {
+    if (a === '-d' || a === '--delete') { deleting = true; continue; }
+    if (PUSH_FLAGS_OK.has(a) || /^--force-with-lease(=|$)/.test(a)) { kept.push(a); continue; }
+    if (a.startsWith('-')) return hold(`git push ${a} to a network remote can move master or tags; ${PUSH_HINT}`);
   }
-  const remote = words[0] || repo.config(`branch.${repo.currentBranch()}.remote`) || 'origin';
-  if (remote !== 'origin') return hold('a handed-off job fetches from origin only');
-  if (words.slice(1).some(w => /[:+*^]/.test(w))) return hold('a fetch refspec can write a local branch');
-  // origin's own fetch lines may only fill remote-tracking refs and tags
-  for (const spec of repo.configAll('remote.origin.fetch')) {
-    const dest = spec.includes(':') ? spec.split(':').pop() : '';
-    if (dest && !/^refs\/(remotes|tags)\//.test(dest)) return hold('origin is set up to fetch into local branches');
+  const specs = repoFlag ? words : words.slice(1);
+  const current = repo.currentBranch();
+  const out = [];
+  if (!specs.length) {
+    // no refspec: the branch's own push target, as one branch
+    const dest = String(repo.pushDest() || '').replace(/^[^/]+\//, '');
+    if (!dest || deleting) return hold(`git push with no branch named could push more than one; ${PUSH_HINT}`);
+    specs.push(`HEAD:${dest}`);
   }
-  return pass();
-}
-
-const SWITCH_FLAGS = new Set(['-q', '--quiet', '-f', '--force', '--detach', '-d', '-t', '--track', '--no-track', '--guess', '--no-guess', '-m', '--merge', '--ours', '--theirs', '-p', '--patch', '--progress', '--no-progress', '--overlay', '--no-overlay', '--discard-changes', '--ignore-skip-worktree-bits', '--recurse-submodules', '--no-recurse-submodules', '--ignore-other-worktrees']);
-
-function sealedSwitch(sub, rest, repo) {
-  const create = sub === 'checkout' ? new Set(['-b', '-B', '--orphan']) : new Set(['-c', '-C', '--create', '--force-create', '--orphan']);
-  const words = [];
-  let creating = false;
-  let paths = false;
-  for (let i = 0; i < rest.length; i += 1) {
-    const a = rest[i];
-    if (a === '--') { paths = true; break; }
-    const inline = a.match(/^(--orphan|--create|--force-create)=(.*)$/);
-    if (create.has(a) || inline) {
-      const name = inline ? inline[2] : String(rest[i + 1] === undefined ? '' : rest[i + 1]);
-      if (!inline) i += 1;
-      const why = targetProblem(name, repo);
-      if (why) return hold(`git ${sub} ${a}: ${why}`);
-      creating = true;
-      continue;
+  for (const spec of specs) {
+    const force = spec.startsWith('+') ? '+' : '';
+    const body = spec.replace(/^\+/, '');
+    if (body === ':' || body.includes('*')) return hold(`git push ${spec} pushes many branches at once; ${PUSH_HINT}`);
+    let src;
+    let dst;
+    if (deleting) { src = ''; dst = body; } else if (body.includes(':')) {
+      [src, dst] = [body.slice(0, body.indexOf(':')), body.slice(body.indexOf(':') + 1)];
+    } else if (body === 'HEAD' || body === '@') { src = 'HEAD'; dst = current; } else {
+      if (body.startsWith('refs/tags/') || (repo.isTag(body) && !repo.isBranch(body))) return hold(`git push ${spec} pushes a tag; ${PUSH_HINT}`);
+      dst = body.replace(/^refs\/heads\//, '');
+      src = `refs/heads/${dst}`;
     }
-    if (SWITCH_FLAGS.has(a) || /^--(conflict|track|pathspec-from-file)=/.test(a)) continue;
-    if (a.startsWith('-') && a !== '-') return hold(`git ${sub} ${a} is not an option a handed-off job may use`);
-    words.push(a);
-  }
-  if (creating || !words.length) return pass();
-  const target = words[0];
-  // a checkout with paths restores files from the named commit; it moves no branch
-  if (sub === 'checkout' && (paths || words.length > 1)) return pass();
-  const why = targetProblem(target, repo);
-  return why ? hold(`git ${sub} ${target}: ${why}`) : pass();
-}
-
-function sealedBranch(rest, repo) {
-  const LIST_VALUE = new Set(['--contains', '--no-contains', '--merged', '--no-merged', '--points-at', '--format', '--sort']);
-  const LIST = new Set(['-a', '--all', '-r', '--remotes', '-v', '-vv', '--verbose', '-l', '--list', '--show-current', '--color', '--no-color', '--column', '--no-column', '-i', '--ignore-case', '--no-abbrev', '-q', '--quiet', '--omit-empty']);
-  const CREATE = new Set(['-t', '--track', '--no-track', '-f', '--force', '--create-reflog', '--recurse-submodules']);
-  let listing = false;
-  let deleting = false;
-  const words = [];
-  for (let i = 0; i < rest.length; i += 1) {
-    const a = rest[i];
-    if (a === '--') { words.push(...rest.slice(i + 1)); break; }
-    if (LIST_VALUE.has(a)) { listing = true; i += 1; continue; }
-    if (/^--(contains|no-contains|merged|no-merged|points-at|format|sort)=/.test(a)) { listing = true; continue; }
-    if (a === '-l' || a === '--list' || a === '--show-current') { listing = true; continue; }
-    if (LIST.has(a) || CREATE.has(a) || /^--(color|column|abbrev|track)=/.test(a)) continue;
-    if (a === '-d' || a === '-D' || a === '--delete') { deleting = true; continue; }
-    if (a.startsWith('-')) return hold(`git branch ${a} is not an option a handed-off job may use`);
-    words.push(a);
-  }
-  if (deleting) {
-    const why = words.map(w => targetProblem(w, repo)).find(Boolean);
-    return why ? hold(`git branch -d: ${why}`) : pass();
+    const name = String(dst || '').replace(/^refs\/heads\/(?=.)/, '');
+    if (String(dst || '').startsWith('refs/') && !String(dst).startsWith('refs/heads/')) return hold(`git push ${spec} does not go to a branch; ${PUSH_HINT}`);
+    if (isMainRef(name)) return hold(`git push to master lands on master; ${PUSH_HINT}`);
+    const why = targetProblem(name, repo);
+    if (why) return hold(`git push ${spec}: ${why}; ${PUSH_HINT}`);
+    out.push(`${force}${src}:refs/heads/${name}`);
   }
-  if (listing || !words.length) return pass();
-  // git branch <new> [<start>]: the start can be anything, the name it writes cannot
-  const why = targetProblem(words[0], repo);
-  return why ? hold(`git branch ${words[0]}: ${why}`) : pass();
-}
-
-// git config reads only
-function sealedConfig(rest) {
-  if (rest.some(a => /^(--add|--unset|--unset-all|--replace-all|--rename-section|--remove-section|-e|--edit)$/.test(String(a).split('=')[0]))) return hold('git config writes change what git does');
-  if (rest.some(a => /^(--get|--get-all|--get-regexp|--get-urlmatch|--list|-l|--get-color|--get-colorbool)$/.test(String(a).split('=')[0]))) return pass();
-  const words = positionals(rest, new Set(['--file', '-f', '--blob', '--type', '--default']));
-  if (words[0] === 'get' || words[0] === 'list' || words.length === 1) return pass();
-  return hold('git config writes change what git does');
+  const mirrorOff = /^[A-Za-z0-9._-]+$/.test(remote) ? ['-c', `remote.${remote}.mirror=false`] : [];
+  return pass([...p.prefix, '-c', 'push.followTags=false', ...mirrorOff, '-c', 'push.pushOption=', 'push', '--no-follow-tags', ...kept, remote, ...out]);
 }
 
-function sealedWorktree(rest, repo) {
-  const [op = '', ...more] = rest;
-  if (op === 'list') return pass();
-  if (op !== 'add') return hold(`git worktree ${op} changes another working folder`);
-  const words = [];
-  let named = false;
-  let detached = false;
-  for (let i = 0; i < more.length; i += 1) {
-    const a = more[i];
-    if (a === '-b' || a === '-B') {
-      const name = String(more[i + 1] === undefined ? '' : more[i + 1]);
-      i += 1;
-      const why = targetProblem(name, repo);
-      if (why) return hold(`git worktree add ${a}: ${why}`);
-      named = true;
-      continue;
-    }
-    if (a === '--detach' || a === '-d') { detached = true; continue; }
-    if (a === '--reason') { i += 1; continue; }
-    if (['-f', '--force', '--checkout', '--no-checkout', '--lock', '-q', '--quiet', '--track', '--no-track', '--guess-remote', '--no-guess-remote', '--orphan'].includes(a) || a.startsWith('--reason=')) continue;
-    if (a.startsWith('-')) return hold(`git worktree add ${a} is not an option a handed-off job may use`);
-    words.push(a);
-  }
-  if (named || detached) return pass();
-  // with no -b, git checks out the named branch, or one named after the folder
-  const target = words[1] !== undefined ? words[1] : path.basename(String(words[0] || ''));
-  const why = targetProblem(target, repo);
-  return why ? hold(`git worktree add ${target}: ${why}`) : pass();
+// A ref a push writes must be a plain branch name that is not master and
+// does not resolve to master: no @{-1}, @, HEAD~, ^, refs/.
+function targetProblem(name, repo) {
+  const n = String(name === undefined ? '' : name);
+  if (n === 'HEAD' || n.startsWith('refs/') || !BRANCH_NAME.test(n)) return `${n || '(no name)'} is not a plain branch name`;
+  if (isMainRef(n)) return `${n} is master`;
+  const full = typeof repo.fullRefName === 'function' ? repo.fullRefName(n) : '';
+  if (full && isMainRef(full)) return `${n} resolves to master`;
+  return null;
 }
 
 // gh: reads, plus opening, reading, and commenting on a PR
@@ -967,37 +1087,19 @@ function sealedPackage(name, args) {
   return PKG_SEALED[name].includes(sub) ? pass() : hold(`${name} ${sub || '(no command)'} is not on the list a handed-off job may run`);
 }
 
-// atris: the run's own machinery and plain reads. A verb names every sub it
-// allows (true: every sub stays local; a function: the subs it allows).
-// Anything else is held: business, site, pay, feed, deploy, release, task
-// accept, sweep and review runs (they land work), member run and wake,
-// mission start and run, and every unknown word (which atris reads as a
-// request to start work).
-const ATRIS_SEALED = {
-  task: ['list', 'ls', 'show', 'inspect', 'status', 'events', 'where', 'lineage', 'note', 'say', 'claim', 'start', 'result', 'receipt', 'ready', 'done', 'finish', 'new', 'add'],
-  member: ['status', 'handoff'],
-  mission: ['status', 'tick'],
-  slop: true,
-  verify: true,
-  status: true,
-  log: sub => sub !== 'sync',
-  youtube: (sub, args) => sub === 'search' && !args.includes('--paid'),
-  help: true,
-  version: true,
-};
-
-function sealedAtris(args, missionId) {
-  const [cmd = '', sub = ''] = args;
-  if (args.length === 1 && ['--version', '-v', '--help', '-h'].includes(cmd)) return pass();
-  // the boot read: atris prints the welcome screen for its spec file and stops
-  if (args.length === 1 && (cmd === 'atris.md' || cmd.endsWith('/atris.md'))) return pass();
-  const allowed = Object.prototype.hasOwnProperty.call(ATRIS_SEALED, cmd) ? ATRIS_SEALED[cmd] : null;
-  if (!allowed) return hold(`atris ${cmd} is not on the list a handed-off job may run`);
-  const subOk = allowed === true || ['help', '--help', '-h'].includes(sub)
-    || (typeof allowed === 'function' ? allowed(sub, args) : allowed.includes(sub));
-  if (!subOk) return hold(`atris ${cmd} ${sub} is not on the list a handed-off job may run`);
-  // a tick of another job would run that job's work without this seal
-  if (cmd === 'mission' && sub === 'tick' && positionals(args.slice(2), new Set())[0] !== missionId) return hold('atris mission tick runs only this job');
+// atris in a woken run: every verb runs except the outward and spend ones,
+// read the same way a bet reads them (readAtris), plus these by name and
+// accepting a task, which lands it.
+const ATRIS_SEALED_HELD = new Set(['spend', 'publish', 'deploy', 'release', 'land', 'merge', 'accept', 'business', 'site', 'pay', 'feed']);
+const TASK_ACCEPT = new Set(['accept', 'auto-accept-certified', 'auto-accept', 'accept-group']);
+
+function sealedAtris(args) {
+  const [cmd = '', sub = ''] = positionals(args, new Set(['--account', '--as', '--from', '--to', '--channel']));
+  if (ATRIS_SEALED_HELD.has(cmd)) return hold(`atris ${cmd} goes out, lands, or spends`);
+  if (cmd === 'task' && (TASK_ACCEPT.has(sub) || args.some(a => a === '--accept' || a === '--auto-accept'))) return hold('accepting a task lands it');
+  const read = readAtris(args);
+  if (read.cats.length) return hold(`atris ${cmd} would ${read.cats.map(c => CATEGORY_WORDS[c]).join(' and ')}`);
+  if (read.refuse && ATRIS_REFUSED.has(cmd)) return hold(read.refuse);
   return pass();
 }
 
@@ -1006,7 +1108,7 @@ function sealedVerdict(tool, args, ctx, missionId) {
   if (name === 'git') return sealedGit(args, ctx);
   if (name === 'gh') return sealedGh(args);
   if (name === 'npm' || name === 'yarn' || name === 'pnpm') return sealedPackage(name, args);
-  if (name === 'atris') return sealedAtris(args, missionId);
+  if (name === 'atris') return sealedAtris(args);
   return hold(`${name} is not on the list a handed-off job may run`);
 }
 
@@ -1068,6 +1170,10 @@ function check({ stateDir, missionId, seal, tool, args = [], gitBin = null, cwd
     saveLocks(stateDir, missionId, locks);
     return { consume: owners.map(l => l.step), claims };
   }
+  // the owner said no to this exact command: it stays held, and no new card is asked
+  if (owners.some(l => l.requests.some(r => r.hash === hash && r.denied_at && !r.approved_at))) {
+    return { hold: true, steps: owners.map(l => l.step), message: `held: the owner said no to "${shown}". do not run it again; leave it undone and go on with the rest.` };
+  }
   // held: a request on each step still missing a yes, one per exact command
   owners.forEach((lock, n) => {
     if (ready[n]) return;
@@ -1092,6 +1198,8 @@ function check({ stateDir, missionId, seal, tool, args = [], gitBin = null, cwd
 function consume() {}
 
 module.exports = {
+  describeCommand,
+  plainWhat,
   HELD_EXIT,
   handoffParent,
   handoffSeal,
@@ -1100,6 +1208,7 @@ module.exports = {
   gitContext,
   approveYesLock,
   askedYesLocks,
+  denyYesLock,
   check,
   consume,
   effectiveLocks,