toolroll 0.5.0

package/dist/scope.js

@@ -0,0 +1,1176 @@
+import { passwordGuardOf } from "./sign-in-guard.js";
+import { validateScopeText } from "./task-text.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { projectAuthority } from "./project-access.js";
+/**
+ * What a task is allowed to become, agreed before anything builds it.
+ *
+ * The gap this closes is the one an operator notices immediately and a
+ * scheduler never does: a task called "fix the payouts flow" is a sentence, and
+ * an agent handed it at 3am will decide for itself what that means. It might
+ * mean a two-line guard. It might mean rewriting the billing model. Nobody
+ * agreed to the second one, and by morning it is a diff.
+ *
+ * So a scope is written down, and a human opts in to it, and the builder will
+ * not run on a task where that has not happened. Not a code review after the
+ * fact — an agreement about the goal, before the work.
+ *
+ * **Approval binds to the words that were approved.** The record keeps a digest
+ * of the scope text, and approval stores the digest it saw. Rewriting the scope
+ * afterwards does not carry the approval with it; the digests stop matching and
+ * the task is unapproved again. Without that, "approved" would mean "was
+ * approved once, in some form" — which is exactly the loophole an agent editing
+ * its own brief would walk through.
+ *
+ * The scope is deliberately three plain fields rather than a template. What is
+ * the goal, what is explicitly not in it, and which paths it expects to touch.
+ * An operator reading that at a glance can tell whether they agree, and that
+ * glance is the whole safety property.
+ */
+import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { hasForbiddenControls } from "./decision.js";
+import { NO_READINESS, exactModelId, isRiskLevel, legOf, projectRoute, routeDigestOf, routeFromJson, routeWords, } from "./phase-routing.js";
+/** Same shape as a runner's credential, for the same reasons. */
+function mintToken() {
+    return randomBytes(32).toString("base64url");
+}
+export function hashToken(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+/**
+ * A person's chosen password gets a real KDF. Bare sha256 is fine for the
+ * minted 256-bit tokens — nothing brute-forces that space — but a password a
+ * human picked lives in a much smaller one, so it is salted and stretched
+ * (scrypt), and the stored string names its own scheme so both generations
+ * of credential verify side by side.
+ */
+export function hashPassword(password) {
+    const salt = randomBytes(16).toString("hex");
+    const hash = scryptSync(password, salt, 32).toString("hex");
+    return `scrypt$${salt}$${hash}`;
+}
+/** Verify a presented secret against a stored hash of either scheme. */
+export function verifyCredential(stored, presented) {
+    // v100: an account that signs in only with the identity provider has no password to match.
+    if (stored.startsWith("sso-only$"))
+        return false;
+    if (stored.startsWith("scrypt$")) {
+        const [, salt, hex] = stored.split("$");
+        if (salt === undefined || hex === undefined)
+            return false;
+        const known = Buffer.from(hex, "hex");
+        const candidate = scryptSync(presented, salt, 32);
+        return known.length === candidate.length && timingSafeEqual(known, candidate);
+    }
+    return sameDigest(stored, hashToken(presented));
+}
+function sameDigest(left, right) {
+    const a = Buffer.from(left, "utf8");
+    const b = Buffer.from(right, "utf8");
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/**
+ * The execution profile (Parity II foundations, findings 1/2/13/14/22):
+ * WHAT RUNS, bound into what the operator signs. A discriminated union —
+ * each variant asserts only what its provider actually supports, with the
+ * EFFECTIVE constants the argv will carry, never aspirations. The model
+ * is always an exact string and always emitted on the argv: nothing in an
+ * approved profile is left for later resolution to decide (ruling 10).
+ * providerVersion and resolvedFrom are PROVENANCE and live outside these
+ * shapes (finding 20) — they never enter a digest.
+ */
+export const CLAUDE_LIMITS = {
+    // The activity watchdog is the real safety rail. Keep a very high turn
+    // breaker only for a pathological loop; ordinary long-horizon work should
+    // finish, checkpoint, or park long before it can reach this number.
+    maxTurns: 1_000,
+    repairMaxTurns: 4,
+    timeoutSeconds: 1_200,
+    repairTimeoutSeconds: 300,
+};
+export const CODEX_SHAPED_LIMITS = {
+    timeoutSeconds: 1200,
+    repairTimeoutSeconds: 300,
+};
+export const GEMINI_LIMITS = {
+    timeoutSeconds: 1200,
+    repairTimeoutSeconds: 300,
+};
+export const PROFILE_DIGEST_VERSION = 2;
+/** Deterministic JSON: object keys sorted recursively, arrays in order. */
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`);
+        return `{${entries.join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+/** The stored snapshot bytes: version embedded IN the snapshot (finding 17). */
+export function canonicalProfileJson(profile) {
+    return canonicalJson({ digestVersion: PROFILE_DIGEST_VERSION, profile });
+}
+/** sha256 over a domain-separated canonical encoding, truncated to the
+ * same 128 bits every other safety digest here uses (finding 21). */
+export function profileDigestOf(profile) {
+    return createHash("sha256")
+        .update(`standing-orders:profile:${canonicalProfileJson(profile)}`, "utf8")
+        .digest("hex")
+        .slice(0, 32);
+}
+// ---- fallback chains (v30) ------------------------------------------------
+// The version this build stamps into a chain snapshot AND folds into the
+// chain digest. Bumping it is a re-attestation, never a silent change.
+export const CHAIN_DIGEST_VERSION = 1;
+/** The stored snapshot bytes for a chain: the version rides IN the
+ * snapshot, exactly like a single profile's. */
+export function canonicalChainJson(entries) {
+    return canonicalJson({ digestVersion: CHAIN_DIGEST_VERSION, chain: entries });
+}
+/** sha256 over a domain-separated canonical chain encoding — a DIFFERENT
+ * domain from a single profile ("standing-orders:chain:" vs
+ * ":profile:"), so a chain digest can never collide with a profile
+ * digest, truncated to the same 128 bits. */
+export function chainDigestOf(entries) {
+    return createHash("sha256")
+        .update(`standing-orders:chain:v${CHAIN_DIGEST_VERSION}:${canonicalChainJson(entries)}`, "utf8")
+        .digest("hex")
+        .slice(0, 32);
+}
+/**
+ * One chain entry's BINDING digest (E3d): the profile digest + auth mode
+ * under their own domain. A run row pins this at admission (or base-cycle
+ * open), and the dispatch proof re-derives it from the approved chain at
+ * the run's index — so nothing downstream can swap WHICH entry a run
+ * spends as, in model or in credential.
+ */
+export function entryDigestOf(entry) {
+    return createHash("sha256")
+        .update(`standing-orders:chain-entry:v${CHAIN_DIGEST_VERSION}:${profileDigestOf(entry.profile)}:${entry.authMode}`, "utf8")
+        .digest("hex")
+        .slice(0, 32);
+}
+/** Strict re-hydration of a stored chain — every entry proved through the
+ * single-profile rehydrator; anything unexpected is null. */
+export function chainFromJson(json) {
+    if (json === null)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return null;
+    const wrapper = parsed;
+    if (wrapper.digestVersion !== CHAIN_DIGEST_VERSION)
+        return null;
+    // Exact keys on the wrapper and on every entry (v48 integrity): a
+    // snapshot carrying anything this code never writes is not one it wrote.
+    if (!exactKeys(wrapper, ["digestVersion", "chain"], []))
+        return null;
+    if (!Array.isArray(wrapper.chain) || wrapper.chain.length === 0 || wrapper.chain.length > 4)
+        return null;
+    const entries = [];
+    const seen = new Set();
+    for (const raw of wrapper.chain) {
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+            return null;
+        const e = raw;
+        if (!exactKeys(e, ["profile", "authMode"], []))
+            return null;
+        // A malformed auth mode is a malformed entry — never a default.
+        if (e.authMode !== "subscription" && e.authMode !== "api-key")
+            return null;
+        if (e.profile === null || typeof e.profile !== "object" || Array.isArray(e.profile))
+            return null;
+        // The profile rehydrates through the SAME strict path, wrapped as its
+        // own canonical snapshot so profileFromJson can prove it — and the
+        // canonical bytes must be the stored bytes' own keys (canonicalJson
+        // drops nothing, so an extra key survives into the strict parse).
+        const profile = profileFromJson(canonicalProfileJson(e.profile));
+        if (profile === null)
+            return null;
+        // Duplicate exact entries are rejected (open q i): the key is the
+        // profile digest + auth mode.
+        const key = `${profileDigestOf(profile)}:${e.authMode}`;
+        if (seen.has(key))
+            return null;
+        seen.add(key);
+        entries.push({ profile, authMode: e.authMode });
+    }
+    return entries;
+}
+/**
+ * THE STRICT RAW TERMS READ (raw authority repair): the stored columns of
+ * a scope or a standing order, proved EXACTLY — a JSON list is a list of
+ * strings and nothing else, a rubric is a list of whole criteria carrying
+ * exactly the keys this code writes and parsing with zero problems, a
+ * budget is a safe integer or null. Nothing is filtered, defaulted, or
+ * coerced on the way to an authority: the words say what is wrong, and
+ * the caller refuses.
+ */
+export function exactStringList(value, what) {
+    if (typeof value !== "string")
+        return { ok: false, problem: `${what} is not stored as text` };
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return { ok: false, problem: `${what} is not valid JSON` };
+    }
+    if (!Array.isArray(parsed))
+        return { ok: false, problem: `${what} is not a JSON list` };
+    if (!parsed.every(one => typeof one === "string"))
+        return { ok: false, problem: `${what} carries an entry that is not a string` };
+    return { ok: true, list: parsed };
+}
+export function exactAcceptance(value) {
+    if (value === null || value === undefined)
+        return { ok: true, criteria: [] };
+    if (typeof value !== "string")
+        return { ok: false, problem: "the rubric is not stored as text" };
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return { ok: false, problem: "the rubric is not valid JSON" };
+    }
+    if (!Array.isArray(parsed))
+        return { ok: false, problem: "the rubric is not a JSON list" };
+    for (const [index, entry] of parsed.entries()) {
+        if (entry === null || typeof entry !== "object" || Array.isArray(entry))
+            return { ok: false, problem: `rubric entry ${index + 1} is not an object` };
+        if (!exactKeys(entry, ["id", "statement", "evidence"], ["how"]))
+            return { ok: false, problem: `rubric entry ${index + 1} carries a key this code never writes` };
+    }
+    const read = parseAcceptanceCriteria(parsed);
+    if (read.problems.length > 0)
+        return { ok: false, problem: `the rubric does not parse: ${read.problems.map(one => one.message).join("; ")}` };
+    return { ok: true, criteria: read.criteria };
+}
+export function exactSafeIntegerOrNull(value, what) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== "number" || !Number.isSafeInteger(value))
+        return `${what} is not a safe integer`;
+    return null;
+}
+/**
+ * The longest clock a snapshot may bind, in seconds: a JavaScript timer
+ * holds at most 2^31 − 1 milliseconds, and a bound past that fires at
+ * once instead of never — a "timeout" that is not one. Every stored
+ * clock is proved against this before it is believed (v48 integrity).
+ */
+export const MAX_TIMER_SECONDS = Math.floor(2_147_483_647 / 1000);
+/** A positive integer the platform can represent exactly. */
+export function safePositiveInteger(v) {
+    return typeof v === "number" && Number.isSafeInteger(v) && v > 0;
+}
+/** A positive whole number of seconds a timer can actually wait. */
+export function timerSafeSeconds(v) {
+    return safePositiveInteger(v) && v <= MAX_TIMER_SECONDS;
+}
+/**
+ * Whether an object carries exactly the named keys: every required key
+ * present, only optional keys otherwise, nothing unknown. Stored snapshots
+ * are proved this way so a key this code never writes is a refusal, never
+ * an ignorable extra.
+ */
+export function exactKeys(value, required, optional) {
+    const keys = Object.keys(value);
+    if (required.some(key => !keys.includes(key)))
+        return false;
+    return keys.every(key => required.includes(key) || optional.includes(key));
+}
+/** Strict re-hydration of a stored snapshot — every field type-proved;
+ * anything unexpected is null, never a guess. */
+export function profileFromJson(json) {
+    if (json === null)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return null;
+    const wrapper = parsed;
+    if (wrapper.digestVersion !== PROFILE_DIGEST_VERSION)
+        return null;
+    // EXACT KEYS (v48 integrity): the wrapper carries the version and the
+    // profile and nothing else, and the profile carries exactly its
+    // provider's fields — a snapshot with a key this code never writes was
+    // not written by this code and rehydrates as nothing, never as "the
+    // known part of it".
+    if (!exactKeys(wrapper, ["digestVersion", "profile"], []))
+        return null;
+    const p = wrapper.profile;
+    if (p === null || p === undefined || typeof p !== "object" || Array.isArray(p))
+        return null;
+    // STRICT fields (v48 authority repair): a model is an exact id (the same shape every
+    // provider argv accepts), a repair model is `inherit` or an exact id, a
+    // turn bound is a positive SAFE integer, and a clock is a positive whole
+    // number of seconds a timer can actually hold — a snapshot carrying
+    // anything else (a negative turn count, a fractional second, a model
+    // that is not an id, a clock past what setTimeout can wait) was not
+    // written by this code and rehydrates as nothing.
+    const str = (v) => exactModelId(v);
+    const repairRef = (v) => v === "inherit" || exactModelId(v);
+    const num = (v) => safePositiveInteger(v);
+    const clock = (v) => timerSafeSeconds(v);
+    const PROVIDER_KEYS = ["provider", "model", "maxTurns", "repairMaxTurns", "timeoutSeconds", "repairTimeoutSeconds", "repairModel"];
+    if (p["provider"] === "claude") {
+        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind"]) &&
+            str(p["model"]) &&
+            (p["permissionArgv"] === "auto" || p["permissionArgv"] === "acceptEdits" || p["permissionArgv"] === "bypassPermissions") &&
+            num(p["maxTurns"]) && num(p["repairMaxTurns"]) &&
+            clock(p["timeoutSeconds"]) && (p["timeoutKind"] === undefined || p["timeoutKind"] === "idle") && clock(p["repairTimeoutSeconds"]) &&
+            repairRef(p["repairModel"])) {
+            return {
+                provider: "claude",
+                model: p["model"],
+                permissionArgv: p["permissionArgv"],
+                maxTurns: p["maxTurns"],
+                repairMaxTurns: p["repairMaxTurns"],
+                timeoutSeconds: p["timeoutSeconds"],
+                ...(p["timeoutKind"] === "idle" ? { timeoutKind: "idle" } : {}),
+                repairTimeoutSeconds: p["repairTimeoutSeconds"],
+                repairModel: p["repairModel"],
+            };
+        }
+        return null;
+    }
+    if (p["provider"] === "codex" || p["provider"] === "openrouter") {
+        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind"]) &&
+            str(p["model"]) &&
+            (p["sandboxMode"] === "workspace-write" || p["sandboxMode"] === "danger-full-access") &&
+            p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
+            clock(p["timeoutSeconds"]) && (p["timeoutKind"] === undefined || p["timeoutKind"] === "idle") && clock(p["repairTimeoutSeconds"]) &&
+            repairRef(p["repairModel"])) {
+            return {
+                provider: p["provider"],
+                model: p["model"],
+                sandboxMode: p["sandboxMode"],
+                maxTurns: "unsupported",
+                repairMaxTurns: "unsupported",
+                timeoutSeconds: p["timeoutSeconds"],
+                ...(p["timeoutKind"] === "idle" ? { timeoutKind: "idle" } : {}),
+                repairTimeoutSeconds: p["repairTimeoutSeconds"],
+                repairModel: p["repairModel"],
+            };
+        }
+        return null;
+    }
+    if (p["provider"] === "gemini") {
+        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind"]) &&
+            str(p["model"]) &&
+            (p["approvalArgv"] === "auto_edit" || p["approvalArgv"] === "yolo") &&
+            p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
+            clock(p["timeoutSeconds"]) && (p["timeoutKind"] === undefined || p["timeoutKind"] === "idle") && clock(p["repairTimeoutSeconds"]) &&
+            repairRef(p["repairModel"])) {
+            return {
+                provider: "gemini",
+                model: p["model"],
+                approvalArgv: p["approvalArgv"],
+                maxTurns: "unsupported",
+                repairMaxTurns: "unsupported",
+                timeoutSeconds: p["timeoutSeconds"],
+                ...(p["timeoutKind"] === "idle" ? { timeoutKind: "idle" } : {}),
+                repairTimeoutSeconds: p["repairTimeoutSeconds"],
+                repairModel: p["repairModel"],
+            };
+        }
+        return null;
+    }
+    return null;
+}
+export const EVIDENCE_KINDS = ["check", "screenshot", "changed-path", "manual-review"];
+export const ACCEPTANCE_LIMITS = {
+    criteria: 12,
+    id: 40,
+    // A statement is one testable outcome; three hundred bytes forced people to
+    // drop the qualifying clause that made it testable.
+    statement: 1000,
+    how: 500,
+    evidenceKinds: EVIDENCE_KINDS.length,
+};
+function acceptanceDescribe(value) {
+    if (value === undefined)
+        return "nothing";
+    if (value === null)
+        return "null";
+    if (typeof value === "string")
+        return `a ${value.length}-char string`;
+    return `a ${Array.isArray(value) ? "array" : typeof value}`;
+}
+function acceptanceProse(value, field, cap, required, problems) {
+    if (value === undefined || value === null || value === "") {
+        if (required)
+            problems.push({ reason: `missing-${field}`, message: `${field} is required` });
+        return null;
+    }
+    if (typeof value !== "string") {
+        problems.push({ reason: `bad-${field}`, message: `${field} must be a string (got ${acceptanceDescribe(value)})` });
+        return null;
+    }
+    if (Buffer.byteLength(value, "utf8") > cap) {
+        problems.push({ reason: `${field}-too-long`, message: `${field} is over ${cap} bytes` });
+        return null;
+    }
+    if (hasForbiddenControls(value)) {
+        problems.push({ reason: `${field}-controls`, message: `${field} carries control characters that could become terminal escapes` });
+        return null;
+    }
+    return value;
+}
+/**
+ * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
+ * console form, a routine or template definition): fail closed, every
+ * problem reported at once, stable reasons — the same discipline as every
+ * other quoted-data parser in this codebase (`plan.ts`, `proof.ts`). An
+ * absent or empty `value` parses to `[]` with no problems: whether that is
+ * ALLOWED is a question for the caller (`propose` says yes; every authoring
+ * road says no), never for this parser.
+ */
+export function parseAcceptanceCriteria(value) {
+    const problems = [];
+    if (value === undefined || value === null)
+        return { criteria: [], problems };
+    if (!Array.isArray(value)) {
+        problems.push({ reason: "bad-acceptance", message: `acceptance must be an array (got ${acceptanceDescribe(value)})` });
+        return { criteria: [], problems };
+    }
+    if (value.length > ACCEPTANCE_LIMITS.criteria) {
+        problems.push({ reason: "acceptance-too-many", message: `acceptance lists ${value.length} — cap is ${ACCEPTANCE_LIMITS.criteria}` });
+        return { criteria: [], problems };
+    }
+    const criteria = [];
+    const seen = new Set();
+    for (const [index, entry] of value.entries()) {
+        if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+            problems.push({ reason: `acceptance[${index}]-shape`, message: `acceptance[${index}] must be an object` });
+            continue;
+        }
+        const one = entry;
+        const id = acceptanceProse(one["id"], `acceptance[${index}].id`, ACCEPTANCE_LIMITS.id, true, problems);
+        if (id !== null && seen.has(id)) {
+            problems.push({ reason: `acceptance[${index}]-duplicate-id`, message: `criterion id "${id}" appears twice` });
+        }
+        else if (id !== null) {
+            seen.add(id);
+        }
+        const statement = acceptanceProse(one["statement"], `acceptance[${index}].statement`, ACCEPTANCE_LIMITS.statement, true, problems);
+        const how = acceptanceProse(one["how"], `acceptance[${index}].how`, ACCEPTANCE_LIMITS.how, false, problems);
+        const rawEvidence = one["evidence"];
+        let evidence = null;
+        if (!Array.isArray(rawEvidence)) {
+            problems.push({
+                reason: `acceptance[${index}]-bad-evidence`,
+                message: `acceptance[${index}].evidence must be a non-empty array of evidence kinds (got ${acceptanceDescribe(rawEvidence)})`,
+            });
+        }
+        else if (rawEvidence.length === 0 || rawEvidence.length > ACCEPTANCE_LIMITS.evidenceKinds) {
+            problems.push({
+                reason: `acceptance[${index}]-evidence-count`,
+                message: `acceptance[${index}].evidence must name 1-${ACCEPTANCE_LIMITS.evidenceKinds} evidence kinds`,
+            });
+        }
+        else {
+            const kinds = [];
+            const seenKinds = new Set();
+            let bad = false;
+            for (const k of rawEvidence) {
+                if (typeof k !== "string" || !EVIDENCE_KINDS.includes(k)) {
+                    problems.push({
+                        reason: `acceptance[${index}]-bad-evidence-kind`,
+                        message: `acceptance[${index}].evidence must draw from ${EVIDENCE_KINDS.join(", ")} (got ${acceptanceDescribe(k)})`,
+                    });
+                    bad = true;
+                    continue;
+                }
+                if (seenKinds.has(k)) {
+                    problems.push({ reason: `acceptance[${index}]-duplicate-evidence-kind`, message: `evidence kind "${k}" appears twice` });
+                    bad = true;
+                    continue;
+                }
+                seenKinds.add(k);
+                kinds.push(k);
+            }
+            if (!bad)
+                evidence = kinds;
+        }
+        if (id === null || statement === null || evidence === null)
+            continue;
+        criteria.push({ id, statement, how, evidence });
+    }
+    return { criteria, problems };
+}
+/** The exact bytes a rubric's SIGNED terms reduce to for the digest: sorted
+ * by id, `how` dropped (advisory, never signed), evidence kinds sorted so
+ * two equivalent lists never digest differently. */
+/**
+ * The plain-text rubric encoding shared by every non-JSON authoring
+ * surface — the console's rubric textarea (one line each) and the CLI's
+ * `--acceptance` flag (one line per `;`-separated entry): one criterion
+ * per line, shaped
+ *
+ *   [id:] statement | evidence,kinds [| how]
+ *
+ * `id` is optional — auto-numbered `c1`, `c2`, ... in encounter order when
+ * every line omits it, so a person can write the rubric without inventing
+ * ids by hand. This function never validates; it only turns text into the
+ * same plain-object shape `parseAcceptanceCriteria` already validates, so
+ * both entry points can never drift on what counts as a valid criterion.
+ */
+/** The one criterion a filing may carry when nobody has written the rubric
+ * yet: the console's scout follow-ups file with it, and `--acceptance plan`
+ * on the command line expands to it. A mode with planAuto sends such a
+ * filing to the planner instead of building against it. */
+export const PLACEHOLDER_RUBRIC_STATEMENT = "The operator has reviewed this follow-up and written a real rubric before approving it.";
+export const PLACEHOLDER_RUBRIC = [{ id: "c1", statement: PLACEHOLDER_RUBRIC_STATEMENT, how: null, evidence: ["manual-review"] }];
+export function rubricIsPlaceholder(acceptance) {
+    return acceptance.length === 1 && acceptance[0].statement === PLACEHOLDER_RUBRIC_STATEMENT &&
+        acceptance[0].evidence.length === 1 && acceptance[0].evidence[0] === "manual-review";
+}
+/** Split a `--acceptance` rubric into criteria. Criteria are `;`-separated,
+ * but a `;` inside a statement must not split it: every criterion ends with
+ * its `|<evidence kinds>` part, so a segment with no `|` is the front of the
+ * next one and is glued back on. The single word `plan` means the placeholder. */
+export function splitAcceptanceRubric(text) {
+    if (text.trim().toLowerCase() === "plan")
+        return [`${PLACEHOLDER_RUBRIC_STATEMENT}|manual-review`];
+    const out = [];
+    let pending = "";
+    for (const segment of text.split(";")) {
+        const joined = pending === "" ? segment : `${pending};${segment}`;
+        if (joined.includes("|")) {
+            out.push(joined);
+            pending = "";
+        }
+        else
+            pending = joined;
+    }
+    if (pending.trim() !== "")
+        out.push(pending);
+    return out;
+}
+export const isCommitSha = (value) => /^[0-9a-f]{40}$/.test(value);
+export function acceptanceLinesToInput(lines) {
+    const out = [];
+    let auto = 1;
+    for (const raw of lines) {
+        const line = raw.trim();
+        if (line === "")
+            continue;
+        const idMatch = /^([A-Za-z0-9_-]{1,40}):\s*(.*)$/.exec(line);
+        const id = idMatch?.[1];
+        const rest = idMatch ? (idMatch[2] ?? "") : line;
+        const parts = rest.split("|").map(p => p.trim());
+        const statement = parts[0] ?? "";
+        const evidence = (parts[1] ?? "").split(",").map(k => k.trim()).filter(k => k !== "");
+        const how = parts[2] !== undefined && parts[2] !== "" ? parts[2] : null;
+        out.push({ id: id ?? `c${auto++}`, statement, evidence, how });
+    }
+    return out;
+}
+/** The inverse of `acceptanceLinesToInput`, for pre-filling an editor from
+ * a stored rubric — round-trips through `parseAcceptanceCriteria` exactly. */
+export function acceptanceToLines(criteria) {
+    return criteria.map(c => `${c.id}: ${c.statement} | ${c.evidence.join(",")}${c.how === null ? "" : ` | ${c.how}`}`);
+}
+export function canonicalAcceptance(criteria) {
+    return [...criteria]
+        .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
+        .map(c => ({ id: c.id, statement: c.statement.trim(), evidence: [...c.evidence].sort() }));
+}
+/**
+ * The exact bytes an operator agreed to.
+ *
+ * Every field that constrains the work goes in. If a change to a field would
+ * change what an operator would have said, it has to move the digest, or the
+ * approval it invalidates would be an approval of something else.
+ */
+export function digestOf(scope, 
+// The execution target: a single profile (legacy v24), OR an explicit
+// fallback chain (v30). BOTH fold through the SAME outer `profileDigest`
+// key — the discriminator lives INSIDE the digest value (a chain digest
+// is domain-separated from a profile digest), NEVER as an outer field
+// (an outer field would change the legacy bytes; C1). A chain-of-one is
+// still an EXPLICIT chain and uses the chain digest, distinct from the
+// single-profile digest by design.
+target, 
+// v47: the phase route. EVERY route filed since v47 folds in — routine
+// shaped ones included — so the approval binds exactly which agent runs
+// each phase. Absent (null) only for a row proven to predate v47, whose
+// digest bytes are therefore untouched.
+route) {
+    const innerDigest = target == null
+        ? null
+        : "chain" in target
+            ? chainDigestOf(target.chain)
+            : profileDigestOf(target);
+    return createHash("sha256")
+        .update(JSON.stringify({
+        goal: scope.goal.trim(),
+        outOfScope: scope.outOfScope?.trim() ?? null,
+        touches: [...scope.touches].sort(),
+        // Absent and null digest identically, so every pre-v15 approval
+        // stays exactly as approved.
+        ...(scope.budgetMicrousd == null ? {} : { budget: scope.budgetMicrousd }),
+        // Same absent/[] equivalence as budget, one key up: a rubric-less
+        // scope (every scope before v39, and any road that sends none)
+        // digests identically to today.
+        ...(scope.acceptance === undefined || scope.acceptance.length === 0
+            ? {}
+            : { acceptance: canonicalAcceptance(scope.acceptance) }),
+        // Default is the historical behavior and therefore hashes exactly
+        // like an absent v41 field. Strict is an explicit signed promise.
+        ...(scope.qualityMode === "strict" ? { qualityMode: "strict" } : {}),
+        ...(scope.candidate ? { candidate: scope.candidate } : {}),
+        // The single outer key, whichever target produced its inner value:
+        // absent => the golden and every profileless approval are untouched;
+        // a legacy profile => its exact profileDigestOf; an explicit chain
+        // => its chainDigestOf. Same key, discriminated value.
+        ...(innerDigest == null ? {} : { profileDigest: innerDigest }),
+        // The route's own domain-separated digest, under its own key —
+        // absent only for a pre-v47 row.
+        ...(route == null ? {} : { route: routeDigestOf(route) }),
+    }), "utf8")
+        .digest("hex")
+        // 128 bits. This is a safety token binding an approval to exact content,
+        // so it has to be well past the reach of a deliberate collision search —
+        // 64 bits is not, and the only cost of the longer one is a longer thing to
+        // paste back.
+        .slice(0, 32);
+}
+export function propose(store, input) {
+    const { taskId, goal, outOfScope = null, touches = [], budgetMicrousd = null, acceptance = [], qualityMode = "default", now, mutation = {}, profile, permissionMode, posture, proposedVia = null, riskLevel } = input;
+    const draft = { goal, outOfScope, touches: [...touches], budgetMicrousd, acceptance: [...acceptance], qualityMode, candidate: input.candidate ?? null };
+    const previous = store.getScope(taskId);
+    const scope = {
+        taskId,
+        ...draft,
+        proposedAt: now.toISOString(),
+        digest: digestOf(draft),
+        // The previous approval is kept rather than cleared, and is invalidated by
+        // the digest no longer matching. Same safety — `approvalOf` requires them
+        // equal — but it preserves the fact that somebody once agreed to
+        // something, so the refusal can say "this was approved and then rewritten"
+        // instead of the much less useful "this was never approved".
+        approvedAt: previous?.approvedAt ?? null,
+        approvedBy: previous?.approvedBy ?? null,
+        approvedDigest: previous?.approvedDigest ?? null,
+    };
+    store.saveScope(scope, mutation, {
+        ...(profile === undefined ? {} : { profile }),
+        ...(permissionMode === undefined ? {} : { permissionMode }),
+        ...(input.qualityMode === undefined ? {} : { qualityMode: input.qualityMode }),
+        ...(riskLevel === undefined || !isRiskLevel(riskLevel) ? {} : { riskLevel }),
+        ...(posture === undefined ? {} : { posture }),
+        proposedVia,
+    });
+    // The store may have RECOMPUTED the digest to bind the resolved profile
+    // (v24 filing invariant) — what callers display must be what is stored.
+    const saved = store.getScope(taskId) ?? scope;
+    if (input.author !== undefined && input.author !== "")
+        store.recordScopeAuthor(taskId, saved.digest, input.author, now);
+    return saved;
+}
+/**
+ * A scope edit from a surface where the editor might be stale — two browser
+ * tabs, a form submitted after the world moved. `sawDigest` names the version
+ * the editor was looking at (null: they saw no scope at all); a mismatch is a
+ * refusal, never a silent overwrite of somebody else's words. Edits are also
+ * refused while a live claim holds the task: the running build read its scope
+ * at start, and rewording the agreement under it would make the digest lie
+ * about what the work was agreed to. Field caps and control-character rules
+ * live here because every one of these strings will later be rendered.
+ *
+ * v39: this is a scope-producing ROAD, not the `propose` primitive, so it is
+ * where the rubric becomes mandatory — every edit through here (a fresh
+ * proposal or a rewrite of an already-approved one) must carry at least one
+ * criterion, or it is refused with a clear `acceptance-required` reason
+ * rather than silently filing without one. A scope that already carries a
+ * live, unrewritten approval from before this code existed never reaches
+ * this function again unless somebody edits it — which is exactly when the
+ * requirement should start applying.
+ */
+export function proposeGuarded(store, input) {
+    const touches = [...(input.touches ?? [])].map(one => one.trim()).filter(one => one !== "");
+    const badText = validateScopeText({ goal: input.goal, outOfScope: input.outOfScope ?? null, touches });
+    if (badText !== null)
+        return badText;
+    const goal = input.goal.trim();
+    const outOfScope = input.outOfScope?.trim() || null;
+    const acceptanceParse = parseAcceptanceCriteria(input.acceptance);
+    if (acceptanceParse.problems.length > 0) {
+        return { ok: false, reason: "bad-acceptance" };
+    }
+    if (acceptanceParse.criteria.length === 0) {
+        return { ok: false, reason: "acceptance-required" };
+    }
+    return store.transact(() => {
+        if (input.taskRef !== null && store.hasLiveClaim(input.taskRef, input.now)) {
+            return { ok: false, reason: "claimed" };
+        }
+        const previous = store.getScope(input.taskId);
+        if ((previous?.digest ?? null) !== input.sawDigest) {
+            return { ok: false, reason: "changed" };
+        }
+        const scope = propose(store, { ...input, goal, outOfScope, touches, acceptance: acceptanceParse.criteria });
+        return { ok: true, scope };
+    });
+}
+export function addApprover(store, name, now, by, newToken = mintToken, mutation = {}, 
+/** A password the person chose. Absent, a token is minted and shown once. */
+password) {
+    if (password !== undefined && password.length < 8) {
+        return { ok: false, reason: "weak-password" };
+    }
+    // The first one bootstraps, because somebody has to be able to create the
+    // first one and there is nobody to ask yet. Every one after it has to be
+    // vouched for by an existing approver.
+    //
+    // Without that second rule the credential is worth nothing: an agent that
+    // can run these commands would simply mint an approver for itself and
+    // approve its own scope with it. The bootstrap window is real and is why
+    // this is the first thing an operator should do, before anything else can
+    // reach the queue.
+    // ONE transaction around detection, vouching, and the write (Codex
+    // people round 2, finding 1): a voucher revoked between the check and
+    // the save must lose — BEGIN IMMEDIATE serializes against the
+    // revocation cascade, so there is no between.
+    return store.transact(() => {
+        const existing = store.listApprovers();
+        const bootstrap = existing.length === 0;
+        if (!bootstrap) {
+            // ACTIVE approver standing, not a bare hash match (Codex people round
+            // 1, finding 1): a viewer's or a revoked person's credential is real
+            // and still vouches for nothing — the CLI is a ceremony site like any
+            // other, and this was the one road that forgot.
+            const vouching = by === undefined ? { ok: false } : authenticateApprover(store, by.name, by.token);
+            if (!vouching.ok) {
+                return { ok: false, reason: "not-an-approver" };
+            }
+        }
+        if (password !== undefined) {
+            store.saveApprover(name, hashPassword(password), now, mutation);
+            return { ok: true, name, token: password, bootstrap, chosen: true };
+        }
+        const token = newToken();
+        store.saveApprover(name, hashToken(token), now, mutation);
+        return { ok: true, name, token, bootstrap, chosen: false };
+    });
+}
+/**
+ * Whether this name-and-token pair is a person the store knows. Shared by
+ * every act that requires a human's authority — approving a scope, answering
+ * a decision — because "who said yes" must never be a string the caller
+ * typed. Fails closed: with no approver registered there is nobody who can
+ * agree to anything, and treating that as "authority is not required here"
+ * would make the gate optional — which is the same as not having one.
+ */
+/**
+ * IDENTITY, split from authority (modes chain, D2/E2): who this credential
+ * belongs to and what standing they hold. Viewers authenticate here and
+ * read; every consequential act goes through authenticateApprover below,
+ * which additionally demands ACTIVE approver standing — so the forty
+ * ceremony sites enforce the role without one of them changing.
+ */
+export function authenticateAccount(store, by, secret) {
+    if (store.listApprovers().length === 0)
+        return { ok: false, reason: "no-approvers" };
+    // v99: wrong passwords in a row lock the name for a while, whatever road they came by.
+    const guard = passwordGuardOf(store), now = Date.now();
+    if (guard.lockedFor(by, now) > 0)
+        return { ok: false, reason: "locked" };
+    const account = store.accountOf(by);
+    if (account === null || !verifyCredential(account.credentialHash, secret)) {
+        guard.failed(by, now);
+        return { ok: false, reason: "unknown" };
+    }
+    guard.succeeded(by);
+    if (account.revokedAt !== null)
+        return { ok: false, reason: "revoked" };
+    return { ok: true, role: account.role, generation: account.generation };
+}
+/**
+ * v100: someone who signed in with the identity provider moments ago has no
+ * password to type again. The console marks such a request with this, for
+ * that person only, and an EMPTY password then stands for the fresh sign-in
+ * at every step-up that reaches `authenticateApprover` (scope and routine
+ * approval, chat-action review, the console's own ceremonies). A typed
+ * password is always checked, and nothing else stands in.
+ */
+export const freshIdentitySignIn = new AsyncLocalStorage();
+export const hasFreshIdentitySignIn = (by) => freshIdentitySignIn.getStore()?.actor === by;
+export function authenticateApprover(store, by, token, repo) {
+    // An empty password is never checked as a password (and never counts toward a lockout).
+    if (token === "")
+        return hasFreshIdentitySignIn(by) ? approverStanding(store, by, repo) : { ok: false, reason: "not-an-approver" };
+    const account = authenticateAccount(store, by, token);
+    if (!account.ok) {
+        return { ok: false, reason: account.reason === "no-approvers" ? "no-approvers" : "not-an-approver" };
+    }
+    return approverStanding(store, by, repo);
+}
+/**
+ * What an approval needs besides the password (v100: an identity-provider
+ * sign-in moments ago stands in for the password; nothing stands in for
+ * this): an active account in the approver role, with access to the project.
+ */
+export function approverStanding(store, by, repo) {
+    const account = store.accountOf(by);
+    // A viewer's credential is real and still cannot agree to anything —
+    // the words every refused ceremony shows are the viewer words.
+    if (account === null || account.revokedAt !== null || account.role !== "approver")
+        return { ok: false, reason: "not-an-approver" };
+    const context = projectAuthority.getStore();
+    const resource = repo === undefined ? (context?.actor === by ? context.repo : null) : repo;
+    if (!store.accountCanAccess(by, resource))
+        return { ok: false, reason: "not-an-approver" };
+    return { ok: true };
+}
+/**
+ * C1's atomic road: file the scope AND seal its approval in ONE
+ * transaction, under a mode the SAME transaction re-proves. The caller
+ * has already authenticated the actor and matched channel rules; this
+ * function owns the predicate's transactional half — mode active, actor
+ * IS the signer, repo matches, and the sealed digest is the filed one
+ * (trivially true here: they are the same transaction). Never
+ * sealScopeApproval after a filing — that was the TOCTOU.
+ */
+/**
+ * C1's coverage question, answerable from ANY filing road: does a live
+ * mode make THIS actor's credentialed filing auto-approve here, and with
+ * which defaults? Callers re-ask INSIDE their filing transaction — an
+ * answer carried across transactions would be the TOCTOU again.
+ */
+export function modeFilingCoverage(store, repo, actor, now) {
+    const mode = repo === null ? null : store.activeMode(repo, now);
+    if (mode === null || mode.signedBy !== actor)
+        return null;
+    try {
+        const terms = JSON.parse(mode.termsJson);
+        if (terms.autoApproveFiling !== true)
+            return null;
+        return {
+            digest: mode.digest,
+            escalated: terms.permissionDefault === "escalated",
+            defaultBudgetMicrousd: typeof terms.perAttemptBudgetMicrousd === "number" ? terms.perAttemptBudgetMicrousd : null,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function fileAndSealUnderMode(store, input) {
+    return store.transact(() => {
+        const mode = input.repo === null ? null : store.activeMode(input.repo, input.now);
+        if (mode === null)
+            return { ok: false, reason: "no-mode" };
+        if (mode.signedBy !== input.actor)
+            return { ok: false, reason: "not-signer" };
+        let autoApprove = false;
+        let defaultBudget = null;
+        let escalated = false;
+        try {
+            const terms = JSON.parse(mode.termsJson);
+            autoApprove = terms.autoApproveFiling === true;
+            defaultBudget = typeof terms.perAttemptBudgetMicrousd === "number" ? terms.perAttemptBudgetMicrousd : null;
+            escalated = terms.permissionDefault === "escalated";
+        }
+        catch {
+            autoApprove = false;
+        }
+        if (!autoApprove)
+            return { ok: false, reason: "not-covered" };
+        // v39: a mode auto-approves a filing with NOBODY reading it at that
+        // instant — of every road, this one can least afford to seal a scope
+        // with no rubric to answer.
+        if (parseAcceptanceCriteria(input.acceptance).criteria.length === 0) {
+            return { ok: false, reason: "acceptance-required" };
+        }
+        const scope = propose(store, {
+            ...input,
+            ...(input.budgetMicrousd == null && defaultBudget !== null ? { budgetMicrousd: defaultBudget } : {}),
+            ...(escalated ? { posture: "escalated" } : {}),
+        });
+        // A scope that cannot say exactly which agents run (v47: every phase
+        // exact, the route readable) is never auto-sealed — the words say why.
+        if (scope.profileState === "unresolved") {
+            return { ok: false, reason: "profile-unresolved", ...(scope.unresolvedReason == null ? {} : { detail: scope.unresolvedReason }) };
+        }
+        const sealed = store.sealScopeApproval(input.taskId, input.actor, input.now, input.mutation ?? {}, { kind: "mode", modeDigest: mode.digest });
+        // The quarantine speaks through every caller (review finding 7): a
+        // coordinator-filed task is never mode-admitted, and pretending the
+        // seal landed would hide exactly the refusal the operator must see.
+        if (!sealed)
+            return { ok: false, reason: "coordinator-filed" };
+        return { ok: true, scope: store.getScope(input.taskId), basis: "mode" };
+    });
+}
+export function approve(store, taskId, by, now, sawDigest, token, mutation = {}) {
+    // Read and write in one transaction, re-reading inside it — the credential
+    // check included, so a token rotated between authentication and the write
+    // cannot leave an approval signed by an authority that no longer exists.
+    // Apart, a scope rewritten between the read and the write is overwritten by
+    // this approval — which would resurrect the old wording *and* mark it
+    // agreed, the precise opposite of what the digest is for.
+    return store.transact(() => {
+        const authenticated = authenticateApprover(store, by, token, store.lookupRef(taskId)?.repo ?? null);
+        if (!authenticated.ok)
+            return authenticated;
+        const scope = store.getScope(taskId);
+        if (scope === null)
+            return { ok: false, reason: "no-scope" };
+        // The digest is required, not optional. An operator reads a scope, somebody
+        // rewrites it, and an approval that did not name what it saw would agree to
+        // the new one in silence — which is the whole failure this guards.
+        if (sawDigest !== scope.digest)
+            return { ok: false, reason: "changed" };
+        // An unresolved scope cannot say exactly what would run, so nobody can
+        // agree to it (foundations finding 16) — restatement is the road.
+        if (scope.profileState === "unresolved") {
+            return { ok: false, reason: "profile-unresolved" };
+        }
+        // A row that predates agent routing cannot take a NEW yes (v48): an
+        // approval now names exactly which agent plans, builds, repairs, and
+        // reviews, and this row names none — re-filing routes it.
+        if (scope.routeEra == null) {
+            return { ok: false, reason: "unrouted" };
+        }
+        // SEPARATION OF DUTIES (v102): the project's rules, asked first so the
+        // answer is words, not a silent refusal from the seal. Protected work
+        // keeps each person's yes to these exact bytes and seals on the second.
+        // Sprint 8: the organisation policy, before any vote is kept: a disallowed provider or model, or terms above the
+        // permission ceiling, are refused in words that name the rule.
+        const policy = store.scopePolicyRefusal(taskId);
+        if (policy !== null)
+            return { ok: false, reason: "policy", message: policy };
+        const gate = store.approvalGate(taskId, by, "person");
+        if (gate.verdict === "refuse")
+            return { ok: false, reason: gate.reason };
+        if (gate.verdict === "vote") {
+            store.recordApprovalVote(taskId, scope.digest, by, now);
+            return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: gate.already };
+        }
+        if (gate.protectedWork)
+            store.recordApprovalVote(taskId, scope.digest, by, now);
+        // SEAL, never re-resolve: the approval snapshots the stored working
+        // profile — the exact bytes the digest the approver signed was bound
+        // to. Routing saveScope here would re-run resolution and could sign a
+        // profile nobody saw.
+        const sealed = store.sealScopeApproval(taskId, by, now, mutation);
+        if (!sealed)
+            return { ok: false, reason: "changed" };
+        const approved = store.getScope(taskId);
+        if (approved === null)
+            return { ok: false, reason: "no-scope" };
+        return { ok: true, scope: approved };
+    });
+}
+/**
+ * Whether this task may be built.
+ *
+ * `changed` is the interesting answer and the reason the digest exists: the
+ * scope was approved, and then somebody — possibly an agent, possibly the
+ * operator, possibly a different session — rewrote it. The old yes does not
+ * transfer.
+ */
+export function approvalOf(scope) {
+    if (scope === null)
+        return { approved: false, reason: "never-proposed" };
+    if (scope.approvedAt === null || scope.approvedBy === null) {
+        return { approved: false, reason: "none" };
+    }
+    if (scope.approvedDigest !== scope.digest)
+        return { approved: false, reason: "changed" };
+    return { approved: true, at: scope.approvedAt, by: scope.approvedBy };
+}
+/**
+ * THE PARITY every projection proves between a route and the profile and
+ * terms it was filed beside (atomic authority closure): the build and
+ * repair legs ARE the profile's exact pairs, and the route's signed risk
+ * and quality ARE the row's — a row whose risk says high over a route
+ * recommended for routine was not filed by this code, and neither the
+ * seal, the consent door, nor the dispatch proof believes it. One
+ * function, so the working side, the sealed side, and the last-mile
+ * dispatch proof cannot drift. Null when everything agrees.
+ */
+export function routeParityProblem(route, profile, terms) {
+    const buildLeg = legOf(route, "build");
+    const repairLeg = legOf(route, "repair");
+    const repairModel = profile.repairModel === "inherit" ? profile.model : profile.repairModel;
+    if (buildLeg.provider !== profile.provider || buildLeg.model !== profile.model || repairLeg.provider !== profile.provider || repairLeg.model !== repairModel) {
+        return `the route builds on ${buildLeg.provider} · ${buildLeg.model} (repair ${repairLeg.provider} · ${repairLeg.model}) but the agent profile says ${profile.provider} · ${profile.model} (repair ${profile.provider} · ${repairModel})`;
+    }
+    if (route.risk !== terms.riskLevel) {
+        return `the route was recommended for ${route.risk} risk but the scope's risk level is ${terms.riskLevel}`;
+    }
+    if (route.qualityMode !== terms.qualityMode) {
+        return `the route was recommended for ${route.qualityMode} quality but the scope's quality mode is ${terms.qualityMode}`;
+    }
+    return null;
+}
+// Recovery reuses this exact raw-terms check before considering saved evidence.
+// Decoding authority does not renew approval or authorize a process-custody write.
+export function scopeAuthorityOf(scope, env = {}) {
+    // THE RAW TERMS FIRST (raw authority repair): a row whose stored terms
+    // or metadata do not read back exactly is no authority at all — not
+    // the filtered, defaulted, or coerced reading of it.
+    if (scope.termsProblem != null) {
+        return { ok: false, reason: "terms", problem: `the scope's stored terms cannot be read exactly (${scope.termsProblem})` };
+    }
+    if (scope.routeEra == null) {
+        return { ok: false, reason: "unrouted", problem: "this scope predates agent routing — its terms name no agent for any role; re-file it to route it under today's agents" };
+    }
+    if (scope.profileState === "unresolved") {
+        return { ok: false, reason: "unresolved", problem: scope.unresolvedReason ?? "the scope cannot say exactly what would run" };
+    }
+    const profileJson = scope.profileJson === undefined ? (scope.profile == null ? null : canonicalProfileJson(scope.profile)) : scope.profileJson;
+    const profile = profileFromJson(profileJson);
+    if (profile === null) {
+        return { ok: false, reason: "profile", problem: profileJson === null ? "the scope carries no agent profile" : "the scope's agent profile cannot be read exactly (unknown keys, an unsafe number, or a clock no timer can hold)" };
+    }
+    const chainJson = scope.proposedChainJson ?? null;
+    const chain = chainJson === null ? null : chainFromJson(chainJson);
+    if (chainJson !== null && chain === null) {
+        return { ok: false, reason: "chain", problem: "the scope's fallback chain cannot be read exactly (unknown keys, a malformed auth mode, or an entry that is not a whole profile)" };
+    }
+    if (chain !== null) {
+        const base = chain[0];
+        if (base === undefined || profileDigestOf(base.profile) !== profileDigestOf(profile)) {
+            return { ok: false, reason: "parity", problem: "the scope's agent profile is not its fallback chain's first entry" };
+        }
+    }
+    const routeJson = scope.proposedRouteJson ?? null;
+    const route = routeFromJson(routeJson);
+    if (route === null) {
+        return { ok: false, reason: "route", problem: routeJson === null ? "the scope was filed under agent routing but carries no route" : "the scope's agent route cannot be read exactly" };
+    }
+    const parity = routeParityProblem(route, profile, { riskLevel: scope.riskLevel ?? "routine", qualityMode: scope.qualityMode ?? "default" });
+    if (parity !== null)
+        return { ok: false, reason: "parity", problem: parity };
+    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" }, chain !== null ? { chain } : profile, route);
+    if (digest !== scope.digest) {
+        return { ok: false, reason: "digest", problem: "the scope's reference does not re-derive from its own terms, agents, and route — file it again" };
+    }
+    // THE AUTH MODE, strictly (atomic authority closure): the credential the
+    // profile's provider would spend under is read through the caller's
+    // strict reader — a present mode file that says neither word closes
+    // the door in its words, never the default a lenient read would coerce
+    // it to (the spawn reads the same way, so nothing sealed here spends
+    // on a credential the operator never named). A chain filing carries
+    // its base entry's pinned mode and must agree with the live file too.
+    let authMode = null;
+    if (env.authMode !== undefined) {
+        const read = env.authMode(profile.provider);
+        if (!read.ok)
+            return { ok: false, reason: "auth-mode", problem: read.problem };
+        authMode = read.mode;
+        // PINNED AND LIVE AUTH AGREE, or nothing (final authority closure): a
+        // chain filed under one credential for its base entry, read beside a
+        // live mode file that now says the other, is a scope whose signed
+        // words no longer describe what would spend — a subscription chain
+        // approved after the operator moved to an API key would bill the
+        // key. It holds no authority until it is filed again under today's
+        // mode.
+        const base = chain === null ? null : chain[0] ?? null;
+        if (base !== null && base.authMode !== authMode) {
+            return {
+                ok: false,
+                reason: "auth-mode",
+                problem: `the scope's fallback chain pins its base entry to ${base.authMode === "subscription" ? "your subscription" : "your API key"} for ${profile.provider}, but the live auth mode is now ${authMode === "subscription" ? "your subscription" : "your API key"} — re-file the scope under today's mode`,
+            };
+        }
+    }
+    return { ok: true, profile, chain, route, digest, authMode };
+}
+/** The rubric's approval-card lines (v39): one per criterion, the id in
+ * front (the exact string a proof must answer by) and its required
+ * evidence kinds after it — `how` is deliberately absent here, the same way
+ * it is absent from the digest: it is guidance, never a signed term. */
+export function acceptanceWords(criteria) {
+    if (criteria.length === 0)
+        return [];
+    return [
+        `  acceptance   ${criteria[0].id}: ${criteria[0].statement} [requires: ${criteria[0].evidence.join(", ")}]`,
+        ...criteria.slice(1).map(c => `               ${c.id}: ${c.statement} [requires: ${c.evidence.join(", ")}]`),
+    ];
+}
+/** The route's approval-card lines (v47): the WORKING route the digest
+ * bound, projected with whatever readiness the caller can see — the same
+ * bytes the task page and chat render. Empty on a scope with no route. */
+export function scopeRouteWords(scope, readiness = NO_READINESS) {
+    const route = routeFromJson(scope.proposedRouteJson ?? null);
+    return route === null ? [] : routeWords(projectRoute(route, readiness));
+}
+/** The scope, in the words an operator has to be able to agree or disagree with. */
+export function describeScope(scope, readiness = NO_READINESS) {
+    const approval = approvalOf(scope);
+    return [
+        `  goal         ${scope.goal}`,
+        ...(scope.outOfScope === null ? [] : [`  not this     ${scope.outOfScope}`]),
+        ...(scope.candidate ? [`  candidate    ${scope.candidate} — checked out by the machine, no agent runs`] : []),
+        ...(scope.touches.length === 0 ? [] : [`  touches      ${scope.touches.join(", ")}`]),
+        ...acceptanceWords(scope.acceptance),
+        ...(scope.budgetMicrousd === null
+            ? []
+            : [`  budget       $${(scope.budgetMicrousd / 1_000_000).toFixed(2)} per build attempt — the agent is stopped at this figure`]),
+        // The FALLBACK CHAIN, in the words the yes agrees to (Layer F): when
+        // this scope files under configured fallbacks, the digest above binds
+        // the WHOLE ordered chain — so the card says every entry, credential
+        // included, before anyone signs.
+        ...chainWords(chainFromJson(scope.proposedChainJson ?? null)),
+        // The ROUTE, in the words the yes agrees to (v47): risk, posture, and
+        // every leg with its reason and readiness — before anyone signs.
+        ...(scope.riskLevel === undefined || scope.riskLevel === "routine" ? [] : [`  risk         ${scope.riskLevel}`]),
+        ...scopeRouteWords(scope, readiness),
+        `  reference    ${scope.digest}`,
+        `  approved     ${describeApproval(approval)}`,
+    ];
+}
+/** The chain's approval-card lines; empty for a single-profile scope. */
+export function chainWords(chain) {
+    if (chain === null || chain.length < 2)
+        return [];
+    const credential = (mode) => mode === "subscription" ? "your subscription" : "your API key";
+    const lines = [];
+    const base = chain[0];
+    lines.push(`  runs on      ${base.profile.provider} (${base.profile.model}) — ${credential(base.authMode)}`);
+    for (const entry of chain.slice(1)) {
+        lines.push(`  if that runs out  falls back to ${entry.profile.provider} (${entry.profile.model}) — ${credential(entry.authMode)}${entry.authMode === "api-key" ? "; spend moves to that account" : ""}`);
+    }
+    return lines;
+}
+function describeApproval(approval) {
+    if (approval.approved)
+        return `yes, by ${approval.by} at ${approval.at}`;
+    if (approval.reason === "changed") {
+        return "no — it was approved, then the scope was rewritten; approve it again";
+    }
+    return "no — nothing will build this until somebody agrees to it";
+}
+/** Deterministic bytes: sorted keys, undefined dropped — the signed text. */
+export function attendedTermsJson(terms) {
+    return canonicalJson(terms);
+}
+/** The composite digest one password signs (ruling 12), domain-separated. */
+export function attendedDigestOf(terms) {
+    return createHash("sha256")
+        .update(`standing-orders:attended:${attendedTermsJson(terms)}`)
+        .digest("hex")
+        .slice(0, 32);
+}