dsh-tower 2.5.0 → 2.6.0

package/scripts/check-pack.mjs

@@ -16,6 +16,9 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const REQUIRED_FILES = [
   'cordis.patch.yml',
   'index.js',
+  // #M40: the core Web Client half carries the Plugins-page review policy
+  // control; it is part of the published bundle like ui-bundle/.
+  'client.js',
   'locale/en.json',
   'locale/zh.json',
   // #121: every optional capability row and both preset-declaring rows explain

package/scripts/component-surface.json

@@ -1,12 +1,12 @@
 {
   "schema": 1,
-  "date": "2026-10-23",
+  "date": "2026-11-01",
   "adr": "docs/adr/0005-component-surface.md",
   "classes": {
     "core": "Removing it breaks the Tower contract. It is never a switch.",
     "optional-component": "A capability whose off state leaves the rest of Tower intact. It must be a user-visible switch with a documented fallback.",
     "optional-config": "A tuning knob, not a capability. It stays in the config form and never hides a component.",
-    "forbidden-to-disable": "The host, the health contract, the recovery escape, the review contract and the merge gates. No group, row or boolean key may turn it off."
+    "forbidden-to-disable": "The host, the health contract, the recovery escape and the merge gates. No group, row or boolean key may turn it off."
   },
   "components": [
     {
@@ -88,7 +88,7 @@
       "id": "preset-tower-reviewer",
       "scope": "visible",
       "kind": "row",
-      "fallback": "Declared by dsh-tower/preset-reviewer: the reviewer cannot be dispatched. Supported while review.requireReview is false (merge is unaffected); with the gate on planning/mode entry is locked with an explanatory error."
+      "fallback": "Declared by dsh-tower/preset-reviewer: the reviewer cannot be dispatched. Supported while review.mode is off or optional (merge is unaffected; off does not use the preset at all); with review.mode required, planning/mode entry is locked with an explanatory error."
     },
     {
       "id": "tower-ui",
@@ -99,6 +99,7 @@
   ],
   "gateableTools": {},
   "behaviorKnobs": [
+    "review.mode",
     "spawn.requireLease",
     "tests.admission"
   ],
@@ -221,10 +222,15 @@
       "class": "optional-config",
       "note": "Bounded wait for the cross-process mode lock."
     },
+    {
+      "name": "review.mode",
+      "class": "core",
+      "note": "The review policy: off, optional (default) or required, selected by one tri-state control on the plugin-page configuration form. It is configuration, not a component row and not three mutually exclusive rows. off intentionally removes tower_review, refuses reviewer spawn and makes the merge gate ignore review; optional never blocks a merge; required makes a clean tip-bound review a merge blocker. The reviewer preset row stays a capability the mode may leave unused."
+    },
     {
       "name": "review.requireReview",
-      "class": "forbidden-to-disable",
-      "note": "Turns independent review into a merge blocker; no component may switch it off. With it on, the preset-tower-reviewer row may not be off (planning/mode entry refuse the combination)."
+      "class": "core",
+      "note": "Deprecated one-release boolean alias for review.mode (true -> required, false -> optional; default optional). It is policy configuration and a deprecated alias, not a switch a row may own; false never overrides an explicit mode. Kept so 2.5 configurations keep working; remove after the 2.6 alias window."
     },
     {
       "name": "review.maxRoundsPerReviewer",
@@ -435,11 +441,11 @@
     },
     {
       "id": "review",
-      "capability": "the review contract",
-      "reason": "review.requireReview is a merge blocker, not a component; a row may not switch it off. The reviewer row is conditional, not a way to weaken the gate.",
-      "tools": ["tower_diff", "tower_preflight", "tower_review"],
-      "rowIds": ["tower-review"],
-      "gatedBy": ["review.requireReview", "review.maxRoundsPerReviewer"]
+      "capability": "the review gate in required mode",
+      "reason": "The policy is one tri-state configuration control on the plugin-page form, not a component row: review.mode is off, optional (default) or required, and off is a documented mode that removes tower_review and makes the merge gate ignore review. What no group, row or boolean key may switch off is the gate once the mode is required: a completed mission still needs a clean review bound to the branch tip, and the exemption path stays explicit. review.requireReview is a deprecated one-release alias, not a switch. The reviewer preset row remains a capability the policy may leave unused, never a way to weaken required mode.",
+      "tools": [],
+      "rowIds": [],
+      "gatedBy": ["review.mode", "review.maxRoundsPerReviewer", "gates.allowReviewExemption"]
     },
     {
       "id": "merge-gates",

package/scripts/pack-manifest.txt

@@ -46,6 +46,7 @@ app/spawn-support.js
 app/spawn.js
 app/teardown.js
 app/tower.js
+client.js
 cordis.patch.yml
 docs/README.md
 docs/adr/0001-ports-adapters-as-data.md

package/scripts/surface-baseline.json

@@ -4,7 +4,7 @@
   "surfaces": {
     "configKeys": {
       "seed": 64,
-      "value": 53,
+      "value": 54,
       "decisions": [
         {
           "from": 64,
@@ -12,6 +12,13 @@
           "date": "2026-11-03",
           "adr": "docs/adr/0005-component-surface.md",
           "note": "Recorded contraction, not a free ratchet (#138). #121 removed the seven tools.expose* keys plus dev.hotReload, #136 replaced tests.enabled with the tower-tests row, and #133/#135 replaced docs.board/archive.enabled with the tower-board/tower-archive rows. The chain now continues here: the config-key surface is two-way like components, so any later increase or decrease needs its own dated decision."
+        },
+        {
+          "from": 53,
+          "to": 54,
+          "date": "2026-11-03",
+          "adr": "docs/adr/0005-component-surface.md",
+          "note": "#M39: one new key, review.mode (off/optional/required), replaces the deprecated review.requireReview boolean as the review policy. It is not a fifth component row: the reviewer preset row stays a capability, and the mode decides whether it is required (required) or unused (off). review.requireReview remains accepted for one release as a normalized alias, so it is a deprecated key rather than a removed one and the surface grows by exactly one."
         }
       ]
     },

package/scripts/types-coverage.mjs

@@ -14,6 +14,9 @@
 // changing the tsconfig is enough and this gate follows.
 //
 // Excluded tiers are data with a reason, not silent gaps:
+//   - `client.js` is the core Web Client half (#M40): a browser artifact checked
+//     by tests/plugin-config-client.test.mjs and the client rules, not by the
+//     Node tsc program;
 //   - `ui-bundle/**` is the optional Web client: a browser artifact with DOM
 //     types and no Node runtime, checked by tests/ui-bundle.test.mjs and the
 //     architecture client rules instead of the Node tsc program;
@@ -30,6 +33,10 @@ const WALK_SKIP = new Set(['node_modules', '.git', '.dsh-tower-worktrees', 'cove
 
 /** Shipped `.js` tiers that are deliberately outside the Node tsc program. */
 export const NOT_CHECKED_TIERS = [
+  {
+    pattern: 'client.js',
+    reason: 'core Web client: browser artifact, checked by tests/plugin-config-client.test.mjs',
+  },
   {
     pattern: 'ui-bundle/**',
     reason: 'optional Web client: browser artifact, checked by tests/ui-bundle.test.mjs and the client architecture rules',

package/tools/preflight.js

@@ -12,7 +12,7 @@ export function registerPreflightTool(ctx, deps) {
   define(ctx, {
     name: 'tower_preflight',
     description:
-      'Read-only merge gate for one mission: returns ok plus stable blocker codes (branch-missing, deps-unmerged, read-only-survey, stale-base, out-of-scope, base-dirty, branch-owned-by-closed-missions, and mission/worker guards). Review blockers (no-review, review-hold, not-clean, review-not-approved, tip-moved, review-mission-mismatch) apply only when review.requireReview is on. Never changes anything.',
+      'Read-only merge gate for one mission: returns ok plus stable blocker codes (branch-missing, deps-unmerged, read-only-survey, stale-base, out-of-scope, base-dirty, branch-owned-by-closed-missions, and mission/worker guards). Review blockers (no-review, review-hold, not-clean, review-not-approved, tip-moved, review-mission-mismatch) apply only when review.mode is required; review.mode off and optional skip them. Never changes anything.',
     parameters: PreflightInput,
     aliases: {"missionId":["id"]},
     requiresMissionId: true,

package/tools/review.js

@@ -13,7 +13,7 @@ export function registerReviewTool(ctx, deps) {
   define(ctx, {
     name: 'tower_review',
     description:
-      'Submit an independent review verdict bound to the current branch tip: a completed mission starts a review round, and while the mission is active a later route may still record a verdict for that same reviewed tip, appending to the same round without changing the status (a moved tip is rejected with an explanation). status is "clean", "p1-Nitems", or "p2-Nitems"; merge is "merge", "fix-then-merge", or "hold" (only clean + merge is later approval). Non-clean returns the mission to active. Reviewers are capped at 5 rounds per branch; a tower-submitted review is break-glass and requires breakGlassReason.',
+      'Submit an independent review verdict bound to the current branch tip: a completed mission starts a review round, and while the mission is active a later route may still record a verdict for that same reviewed tip, appending to the same round without changing the status (a moved tip is rejected with an explanation). status is "clean", "p1-Nitems", or "p2-Nitems"; merge is "merge", "fix-then-merge", or "hold" (only clean + merge is later approval). Non-clean returns the mission to active. Reviewers are capped at 5 rounds per branch; a tower-submitted review is break-glass and requires breakGlassReason. The tool is not registered when review.mode is off.',
     parameters: ReviewInput,
     aliases: {"missionId":["id"]},
     requiresMissionId: true,

package/tools/spawn.js

@@ -37,7 +37,7 @@ export function registerSpawnTool(ctx, deps) {
   define(ctx, {
     name: 'tower_spawn',
     description:
-      'Spawn a worker or reviewer for a mission. Workers use the tower-worker preset; reviewers require a completed mission and use the read-only tower-reviewer preset. Provisions (or reuses) the mission git worktree and branch, generates a self-contained briefing, and starts a background subagent in that worktree. The child final report is delivered back to this session; tower_roster shows authoritative activity. Records the agent in the roster; reviewer spawns record the branch tip so a reviewer that modifies the branch cannot submit a review. Returns immediately unless wait=true.',
+      'Spawn a worker or reviewer for a mission. Workers use the tower-worker preset; reviewers require a completed mission and use the read-only tower-reviewer preset, and the reviewer role is refused when review.mode is off. Provisions (or reuses) the mission git worktree and branch, generates a self-contained briefing, and starts a background subagent in that worktree. The child final report is delivered back to this session; tower_roster shows authoritative activity. Records the agent in the roster; reviewer spawns record the branch tip so a reviewer that modifies the branch cannot submit a review. Returns immediately unless wait=true.',
     parameters: SpawnInput,
     aliases: {"missionId":["id"],"waitMs":["wait_ms"]},
     requiresMissionId: true,
@@ -54,7 +54,7 @@ export function registerSpawnTool(ctx, deps) {
       const preset = isReviewerRole(role) ? config.spawn.reviewerPreset : config.spawn.workerPreset
       const model = isReviewerRole(role) ? config.spawn.reviewerModel : config.spawn.workerModel
       const context = await tower.missionContext(args.missionId)
-      assertSpawnableMission({ role, context })
+      assertSpawnableMission({ role, context, config })
       const spawned = await enqueueSpawn(tower.root, async () => {
         const observed = await observeActivity(ctx, tower)
         await tower.reconcileObservedInactive(observed.activity)

package/tools/status.js

@@ -4,6 +4,7 @@ import { classifyError } from '../domain/errors.js'
 import { StatusInput } from '../domain/contracts/tool-inputs/index.js'
 import { ROSTER_INACTIVE_STATES, isMarkdownFormat, isReservedState, isWorkerRole } from '../domain/vocabulary.js'
 import { archiveView } from '../app/archive.js'
+import { reviewPolicyView } from '../domain/integration/review.js'
 
 /**
  * @param {any} ctx
@@ -21,7 +22,7 @@ export function registerStatusTool(ctx, deps) {
   define(ctx, {
     name: 'tower_status',
     description:
-      'Read the Tower dashboard for a repository: state path, base branch, revision, mission status counts, paged mission summaries (scope/deps/tasks/worktree/owner), roster size, findings, archive count, config path and the activity tail. Also reports the repo-scoped git lock holder (`gitLock: {held,pid,phase,heldMs}`) so a merge holding the mutex is visible. Pass missionId for one full mission (tasks, notes, reviews, findings, completion report; archived missions are loaded from their year file); offset/limit page the mission list (default 20, max 100); includeGate adds preflight gate digests for the page; includeArchived appends compact archived summaries after the active page; format:"markdown" returns the human-readable mission board (active missions plus an archived count). Read-only.',
+      'Read the Tower dashboard for a repository: state path, base branch, revision, mission status counts, paged mission summaries (scope/deps/tasks/worktree/owner), roster size, findings, archive count, config path and the activity tail. Also reports the repo-scoped git lock holder (`gitLock: {held,pid,phase,heldMs}`) so a merge holding the mutex is visible, and the resolved review policy (`review: {mode, available, required, detail}`; mode off means review is intentionally unavailable). Pass missionId for one full mission (tasks, notes, reviews, findings, completion report; archived missions are loaded from their year file); offset/limit page the mission list (default 20, max 100); includeGate adds preflight gate digests for the page; includeArchived appends compact archived summaries after the active page; format:"markdown" returns the human-readable mission board (active missions plus an archived count). Read-only.',
     parameters: StatusInput,
     aliases: { mission_id: ['missionId'], include_gate: ['includeGate'], include_archived: ['includeArchived'] },
     output: output(SCHEMAS.status),
@@ -38,6 +39,10 @@ export function registerStatusTool(ctx, deps) {
         (entry) => isWorkerRole(entry.role) && !ROSTER_INACTIVE_STATES.includes(entry.state) && !isReservedState(entry.state),
       ).length
       const spawn = spawnBackoffView(tower.root, tower.config.spawn?.maxLiveWorkers, inflight)
+      // #M39: the resolved review policy (`{mode, available, required, detail}`)
+      // is a first-class dashboard fact. In `off` the detail says review is
+      // intentionally unavailable rather than leaving it as a silent absence.
+      const review = reviewPolicyView(tower.config)
       if (args.missionId) {
         const [status, detail] = await Promise.all([
           tower.status({ missionIds: [args.missionId] }),
@@ -51,6 +56,7 @@ export function registerStatusTool(ctx, deps) {
           boardPath,
           mode,
           spawn,
+          review,
           components,
         }
       }
@@ -96,6 +102,7 @@ export function registerStatusTool(ctx, deps) {
         boardPath,
         mode,
         spawn,
+        review,
         components,
       }
       if (isMarkdownFormat(args.format)) {

package/types/index.d.ts

@@ -57,6 +57,7 @@ export type ErrorCode =
   | 'provider-cooldown'
   | 'preset-missing'
   | 'reviewer-prerequisite'
+  | 'review-disabled'
   | 'not-authorized'
   | 'workspace-busy'
   | 'worker-limit'
@@ -73,6 +74,15 @@ export type ErrorCode =
   | 'tool-internal'
 // generated:vocabulary:end
 
+/**
+ * Review policy mode (#M39): `off` (review intentionally unavailable),
+ * `optional` (available, never required; default) or `required` (a clean review
+ * bound to the branch tip is a merge blocker). The deprecated
+ * `review.requireReview` boolean normalizes to this: true -> required,
+ * false -> optional.
+ */
+export type ReviewMode = 'off' | 'optional' | 'required'
+
 /** One machine-readable gate/completion blocker: a stable code plus a detail. */
 export interface Blocker {
   code: string