toolroll 0.9.103 → 0.9.104

package/dist/operate.js

@@ -89,7 +89,8 @@ import { runKnowledgeApply, runKnowledgeCommand } from "./knowledge-cli.js";
 import { FLOWS_VALUE_FLAGS, runFlowsCommand } from "./flows-cli.js";
 import { runAssignmentCommand } from "./assignment-adapters.js";
 import { applyProjectProfile, runProjectCommand } from "./project-cli.js";
-import { pullRequestLines, runTaskMergeCommand, runTaskOutcomeCommand } from "./task-outcome-cli.js";
+import { proveTaskBuildsStopped, pullRequestLines, runLocalCompletion, runTaskMergeCommand, runTaskOutcomeCommand } from "./task-outcome-cli.js";
+import { requestPlanAsLocalOwner, retryAsLocalOwner } from "./local-owner-acts.js";
 import { withTaskAlias } from "./task-aliases.js";
 import { checklistLines, mergeChecklistOf } from "./merge-checklist.js";
 import { taskReviewBrief, renderReviewBrief } from "./task-review-brief.js";
@@ -821,6 +822,8 @@ export const OPERATE_BOOLEAN_FLAGS = new Set([
     "saved",
     // task complete: also open the result's pull request.
     "pull-request",
+    // task complete as the terminal's local owner: the person says they checked the result themselves.
+    "checked",
     // storage clean --landed: work already in main.
     "landed",
     // up: the exact start-up details (containment) in the terminal too.
@@ -8864,6 +8867,10 @@ function taskAction(action, rest, flags, context) {
     switch (action) {
         case "complete":
         case "revise":
+            // Local-owner slice 1: the terminal's local owner accepts on its own road, which never checks a password; chosen
+            // only inside its chain, where an owner that no longer stands is refused there, never sent down the road below.
+            if (action === "complete" && currentLocalOwner() !== null)
+                return runLocalCompletion(rest, flags, context);
             return runTaskOutcomeCommand(action, rest, flags, { ...context, operator: async () => {
                     const acting = await askCredentials(flags, context);
                     if (acting === null)
@@ -8937,6 +8944,10 @@ function taskAction(action, rest, flags, context) {
         case "require":
             return requireTask(rest, flags, context);
         case "requeue":
+            // Local-owner slice 3: the terminal's local owner retries its own approved build on its own road (no password);
+            // chosen only inside its chain, where an owner that no longer stands is refused there.
+            if (currentLocalOwner() !== null)
+                return localRetryCommand(rest, flags, context);
             return requeueTask(rest, flags, context);
         case "regate":
             return regateTaskCommand(rest, flags, context);
@@ -8947,6 +8958,10 @@ function taskAction(action, rest, flags, context) {
         case "failing-first":
             return failingFirstCommand(rest, followThroughContext(context, flags));
         case "plan":
+            // Local-owner slice 2: the terminal's local owner asks for a plan on its own road (no password, no pins, no mode
+            // pre-authorization); chosen only inside its chain, where an owner that no longer stands is refused there.
+            if (currentLocalOwner() !== null)
+                return localPlanCommand(rest, flags, context);
             return planTaskCommand(rest, flags, context);
         case "review":
             return reviewTaskCommand(rest, flags, context);
@@ -14340,3 +14355,63 @@ function releaseToQueue(store, lease, now) {
         return result;
     });
 }
+// ---- Local owner, slice 2 (docs/plans/local-owner-acts.md §1): ask for a plan in the terminal. Kept last.
+/**
+ * `task plan <id> --digest <planning source>` for the laptop's local owner (the terminal UI's `p`, and `n` on a bigger
+ * task): its own road, which never reaches a password check. The digest is the planning source the screen read
+ * (local-owner-acts.ts planSourceOf), required and only compared. No plan pins (`--provider`, `--model`): choosing which
+ * agent plans needs a password. requestPlanAsLocalOwner proves the rest in one transaction.
+ */
+async function localPlanCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task plan";
+    if (flags.has("provider") || flags.has("model")) {
+        const passwordSet = store.accountOf(currentLocalOwner()?.account ?? "")?.passwordSet === true;
+        return fail(write, json, command, "local-owner", `Choosing which agent plans needs your password. ${passwordSet ? "Sign in with your password to do this." : "Set a password first: run \`toolroll password set\`."}`, EXIT.refused);
+    }
+    for (const name of flags.keys())
+        if (!["json", "db", "digest"].includes(name))
+            return fail(write, json, command, "usage", `--${name} is not a ${command} option.`, EXIT.usage);
+    const id = positional[0], digest = flags.get("digest");
+    const usage = "Use task plan <task> --digest <the plan source you read>.";
+    if (positional.length !== 1 || !id || id.length > 64 || /[\x00-\x1f]/.test(id))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    if (typeof digest !== "string" || !/^[a-f0-9]{64}$/.test(digest))
+        return fail(write, json, command, "usage", `--digest needs the exact task you read. ${usage}`, EXIT.usage);
+    const done = requestPlanAsLocalOwner(store, id, digest, clock());
+    if (!done.ok)
+        return fail(write, json, command, done.reason, done.message, EXIT.refused);
+    return succeed(write, json, command, { id, replayed: done.replayed, autoPlan: false }, () => [
+        done.replayed ? `${id} · Already asked for a plan.` : `${id} · Asked for a plan. You approve the plan before anything is built.`,
+    ]);
+}
+// ---- Local owner, slice 3 (docs/plans/local-owner-acts.md §2): retry its own approved build in the terminal. Kept last.
+/**
+ * `task requeue <id> --run <build> --digest <scope digest>` (and its alias `task retry`) for the laptop's local owner (the
+ * terminal UI's `r`): its own road, which never reaches a password check. Both pins are required and only compared:
+ * the failed build and the approved scope the screen read. Toolroll's own stop proof runs first, as every completion
+ * does; retryAsLocalOwner then proves everything again in one transaction.
+ */
+async function localRetryCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const command = "task requeue";
+    for (const name of flags.keys())
+        if (!["json", "db", "run", "digest"].includes(name))
+            return fail(write, json, command, "usage", `--${name} is not a ${command} option.`, EXIT.usage);
+    const id = positional[0], run = flags.get("run"), digest = flags.get("digest");
+    const usage = "Use task requeue <task> --run <the build you read> --digest <its approved plan>.";
+    if (positional.length !== 1 || !id || id.length > 64 || /[\x00-\x1f]/.test(id))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    if (typeof run !== "string" || !/^[1-9]\d{0,14}$/.test(run))
+        return fail(write, json, command, "usage", `--run needs the exact build you read. ${usage}`, EXIT.usage);
+    // A scope digest (scope.ts digestOf): 32 hexadecimal characters.
+    if (typeof digest !== "string" || !/^[a-f0-9]{32}$/.test(digest))
+        return fail(write, json, command, "usage", `--digest needs the exact plan you read. ${usage}`, EXIT.usage);
+    await proveTaskBuildsStopped(store, id, clock);
+    const done = retryAsLocalOwner(store, id, { run: Number(run), digest }, clock());
+    if (!done.ok)
+        return fail(write, json, command, done.reason, done.message, EXIT.refused);
+    return succeed(write, json, command, { id, replayed: done.replayed, retries: done.retries }, () => [
+        done.replayed ? `${id} · Already retrying build #${run}.` : `${id} · Retrying build #${run}. A builder starts it next.`,
+    ]);
+}

package/dist/plan-auto.js

@@ -1,5 +1,6 @@
 import { releaseUnattendedRun, reserveUnattendedRun, unattendedGrantStands } from "./flow-unattended.js";
 import { modeTermsFromJson } from "./modes.js";
+import { currentLocalOwner } from "./local-owner.js";
 import { plannerContractOf, plannerSourceDigest } from "./planner-source.js";
 import { modeFilingCoverage, propose, quarantinedAuthor } from "./scope.js";
 export const PLAN_AUTO_SCHEMA = `CREATE TABLE IF NOT EXISTS plan_authorization (
@@ -37,6 +38,10 @@ export function applyModeToNewFiling(store, taskId, actor, now) {
  * planner text. Rewrites, mode renewal, expiry and revocation fail closed. */
 export function authorizePlanUnderMode(store, taskId, actor, now) {
     return store.transact(() => {
+        // A laptop's local owner (no password) never pre-authorizes a plan under a mode, on any road (filing, the plan
+        // button, chat, the terminal): its plan waits for its own approval (local-owner slice 0).
+        if (currentLocalOwner() !== null)
+            return false;
         const ref = store.lookupRef(taskId);
         if (ref === null || ref.repo === null || ref.plan !== "requested" || !plainPlan(store, taskId) || store.hasLiveClaim(ref.id, now))
             return false;

package/dist/project-knowledge.d.ts

@@ -23,17 +23,18 @@ export declare function knowledgeVersion(store: Store, repo: string, actor: stri
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
     title?: never;
+    references?: never;
     content?: never;
     revision: number;
     stale: boolean;
     notice: string;
     history?: never;
     instructions?: never;
-    references?: never;
     decisions?: never;
     waiting?: never;
 } | {
     title?: never;
+    references?: never;
     content?: never;
     stale?: never;
     decision: {
@@ -55,10 +56,10 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     revision?: never;
     history?: never;
     instructions?: never;
-    references?: never;
     decisions?: never;
     waiting?: never;
 } | {
+    references?: never;
     stale?: never;
     revision: number;
     title: string;
@@ -66,7 +67,6 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     notice: string;
     history?: never;
     instructions?: never;
-    references?: never;
     decisions?: never;
     waiting?: never;
 } | {

package/dist/public-access.d.ts

@@ -50,3 +50,12 @@ export declare function carriesToken(pathname: string, authorization: string | u
 export declare function plainHttpRefusal(transport: Transport, pathname: string, authorization: string | undefined): string | null;
 /** The Strict-Transport-Security value for a request to the configured public https host that arrived over HTTPS. */
 export declare function hstsFor(publicHost: string | null, host: string | undefined, transport: Transport): string | null;
+/** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no sign of a proxy —
+ * any forwarding header at all disqualifies the request. serve.ts's fromThisComputer, and guards.ts's check on every
+ * request a local owner's session makes (local-owner slice 0), read it here. */
+export declare function requestFromThisComputer(request: {
+    socket: {
+        remoteAddress?: string | undefined;
+    };
+    headers: Record<string, string | string[] | undefined>;
+}): boolean;

package/dist/public-access.js

@@ -89,3 +89,18 @@ export function plainHttpRefusal(transport, pathname, authorization) {
 export function hstsFor(publicHost, host, transport) {
     return publicHost !== null && host === publicHost && transport.https ? HSTS_VALUE : null;
 }
+/** Any forwarding header at all (Forwarded, X-Forwarded-*, X-Real-IP, Via, …): a sign of a proxy in front. */
+const PROXY_HEADER = /^(forwarded|via|x-forwarded-.+|x-real-ip|x-client-ip|x-original-.+|x-cluster-client-ip|true-client-ip|cf-connecting-ip|fastly-client-ip|x-proxyuser-ip)$/i;
+/** This computer, and nothing in front of it: a loopback peer that names a loopback address, with no sign of a proxy —
+ * any forwarding header at all disqualifies the request. serve.ts's fromThisComputer, and guards.ts's check on every
+ * request a local owner's session makes (local-owner slice 0), read it here. */
+export function requestFromThisComputer(request) {
+    const peer = request.socket.remoteAddress ?? "";
+    if (!LOOPBACK_PEERS.has(peer))
+        return false;
+    for (const name of Object.keys(request.headers))
+        if (PROXY_HEADER.test(name))
+            return false;
+    const host = request.headers["host"];
+    return /^(localhost|127\.0\.0\.1|\[::1\]):[0-9]{1,5}$/.test(typeof host === "string" ? host : "");
+}

package/dist/pull-request-flow.js

@@ -23,6 +23,7 @@ import { assignmentOf, checkAssignmentAsOperator } from "./assignment.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
 import { authenticateApprover, personProof } from "./scope.js";
+import { currentLocalOwner } from "./local-owner.js";
 import { BRANCH_PREFIX, headWithin } from "./names.js";
 import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, refArchived, releaseTaskRef } from "./store.js";
 import { belongsToRelease } from "./release-authority.js";
@@ -167,6 +168,11 @@ export function pullRequestBlocker(store, runId) {
  */
 export function completeAndOpenPullRequest(store, input, now) {
     return store.transact(() => {
+        // A laptop's local owner (no password) never opens a pull request: it publishes outside this computer. Refused
+        // before anything is read or written, whatever the result (local-owner slice 0).
+        const local = currentLocalOwner();
+        if (local !== null)
+            return refuse("local-owner", `Opening a pull request needs your password. ${store.accountOf(local.account)?.passwordSet === true ? "Sign in with your password to do this." : "Set a password first: run \`toolroll password set\`."}`);
         const current = assignmentOf(store, input.taskId, now, { principal: "operator", repos: input.who.repos }, input.root);
         const receipt = current?.receipt ?? null;
         if (current === null || receipt === null || receipt.runId !== input.runId || receipt.digest !== input.digest) {
@@ -191,6 +197,9 @@ export function completeAndOpenPullRequest(store, input, now) {
  */
 export function owePullRequest(store, runId, actor, flowCard, now) {
     return store.transact(() => {
+        // The belt under every road that owes one: a local owner's chain never does (local-owner slice 0).
+        if (currentLocalOwner() !== null)
+            throw new Error("Opening a pull request needs your password.");
         const run = store.getRun(runId);
         const ref = store.refById(run.taskRef);
         const grant = publicationGrantOf(store, run.taskRef).grant;

package/dist/release-card.d.ts

@@ -82,10 +82,24 @@ export declare function releaseBaselineRecord(store: Store, repo: string): {
     recorded: true;
     sha: string | null;
 };
+/** How long the change list's settings check may take before the list is unread. */
+export declare const CONFIG_LIST_MS = 60000;
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
  * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
- * history). Null when they can't be read, so a card never shows a shortened list. */
+ * history). When they can't be read, why, in Toolroll's own fixed words (never the repository's text), so a card says
+ * why it shows no list rather than a shortened one. */
+export declare function readCommitsBetween(repo: string, from: string, to: string): {
+    ok: true;
+    commits: {
+        sha: string;
+        subject: string;
+    }[];
+} | {
+    ok: false;
+    why: string;
+};
+/** readCommitsBetween's list, or null when it can't be read. */
 export declare function commitsBetween(repo: string, from: string, to: string): {
     sha: string;
     subject: string;

package/dist/release-card.js

@@ -207,32 +207,52 @@ export function releaseBaselineRecord(store, repo) {
     const ref = row["external_ref"];
     return { recorded: true, sha: typeof ref === "string" && SHA.test(ref) ? ref : null };
 }
+/** How long the change list's settings check may take before the list is unread. */
+export const CONFIG_LIST_MS = 60_000;
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
  * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
- * history). Null when they can't be read, so a card never shows a shortened list. */
-export function commitsBetween(repo, from, to) {
+ * history). When they can't be read, why, in Toolroll's own fixed words (never the repository's text), so a card says
+ * why it shows no list rather than a shortened one. */
+export function readCommitsBetween(repo, from, to) {
     if (!SHA.test(from) || !SHA.test(to))
-        return null;
+        return { ok: false, why: "a commit id isn't a full id" };
     let gitDir;
     try {
         const named = join(realpathSync(repo), ".git");
         if (!lstatSync(named).isDirectory())
-            return null;
+            return { ok: false, why: "the project has no Git folder of its own" };
         gitDir = realpathSync(named);
     }
     catch {
-        return null;
+        return { ok: false, why: "the project's Git folder can't be read" };
     }
     const tools = releaseTools();
     const env = { ...releaseGitEnv(), PATH: RELEASE_PATH };
-    const listing = spawnSync(tools.git, [`--git-dir=${gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env, encoding: "utf8", timeout: 15_000 });
-    if (listing.status !== 0 || releaseConfigProblem(listing.stdout) !== null)
-        return null;
+    // The list's first Git call took over 15 s on GitHub's busy macOS runners (2026-11-12, "timed out after 15 s"; the
+    // same call takes 0.1 s on an idle Mac), and the card lost its change list; the verified range's own Git calls allow
+    // far longer. One minute, then the list is unread, as before.
+    const listing = spawnSync(tools.git, [`--git-dir=${gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env, encoding: "utf8", timeout: CONFIG_LIST_MS });
+    if (listing.status !== 0) {
+        const how = listing.error?.code === "ETIMEDOUT" ? `timed out after ${CONFIG_LIST_MS / 1000} s`
+            : listing.signal !== null ? `stopped by ${listing.signal}` : listing.error !== undefined ? "couldn't start" : `exited ${listing.status}`;
+        return { ok: false, why: `Git couldn't list the project's settings (${how})` };
+    }
+    // The key is the repository's own text: named only by kind, never echoed.
+    if (releaseConfigProblem(listing.stdout) !== null)
+        return { ok: false, why: "the project's Git settings hold an entry a release read refuses" };
     const range = verifiedRange(gitDir, from, to, { git: tools.git, env });
-    if (!range.ok)
-        return null;
-    return range.value.map(one => ({ sha: one.id, subject: subjectText(one.message) }));
+    // commit-extract's own words, made one control-free line like any shown text, in the card's lower-case clause form.
+    if (!range.ok) {
+        const said = subjectText(range.message).replace(/\.$/, "");
+        return { ok: false, why: /^[A-Z][a-z]/.test(said) ? said[0].toLowerCase() + said.slice(1) : said };
+    }
+    return { ok: true, commits: range.value.map(one => ({ sha: one.id, subject: subjectText(one.message) })) };
+}
+/** readCommitsBetween's list, or null when it can't be read. */
+export function commitsBetween(repo, from, to) {
+    const read = readCommitsBetween(repo, from, to);
+    return read.ok ? read.commits : null;
 }
 /** GitHub lists at most this many of a pull request's commits; a longer one is never shown as complete. */
 export const PULL_REQUEST_COMMITS_MAX = 250;
@@ -355,7 +375,10 @@ export function releaseChangeList(store, terms, read) {
     let source;
     let why;
     if (baseline !== null) {
-        commits = commitsBetween(terms.repo, baseline, terms.approvedSha);
+        const read = readCommitsBetween(terms.repo, baseline, terms.approvedSha);
+        commits = read.ok ? read.commits : null;
+        if (!read.ok)
+            why = read.why;
         source = commits === null ? "unread" : "recorded";
     }
     else {

package/dist/result-completion.d.ts

@@ -21,8 +21,12 @@ export declare function familyCompleted(store: Store, taskId: string): boolean;
 export declare function changedFilesOf(store: Store, runId: number, root: string): string[] | null;
 /** Everything a result's branch carries: this build's changes and every build of every task it revises (a
  * revision builds on its source's head, so its branch holds the source's commits too). null when any of
- * them can't be read whole. */
-export declare function familyChangedFiles(store: Store, taskId: string, runId: number, root: string): string[] | null;
+ * them can't be read whole. An earlier build with no recorded diff is skipped by default; with
+ * `missing: "unknown"` (the local owner's boundary) it is skipped only when its run record proves it committed
+ * nothing, and any other one makes the whole answer unknown. */
+export declare function familyChangedFiles(store: Store, taskId: string, runId: number, root: string, options?: {
+    missing?: "skip" | "unknown";
+}): string[] | null;
 /** Why a build's branch must wait before it's pushed (and so before any PR or merge): it (or a task it
  * revises) changed protected files on a one-person approval, and nobody but its approver and requesters
  * has marked it complete. */

package/dist/result-completion.js

@@ -42,10 +42,12 @@ export function changedFilesOf(store, runId, root) {
 }
 /** Everything a result's branch carries: this build's changes and every build of every task it revises (a
  * revision builds on its source's head, so its branch holds the source's commits too). null when any of
- * them can't be read whole. */
-export function familyChangedFiles(store, taskId, runId, root) {
+ * them can't be read whole. An earlier build with no recorded diff is skipped by default; with
+ * `missing: "unknown"` (the local owner's boundary) it is skipped only when its run record proves it committed
+ * nothing, and any other one makes the whole answer unknown. */
+export function familyChangedFiles(store, taskId, runId, root, options = {}) {
     const files = new Set();
-    const runs = new Set([runId]);
+    const runs = new Map([[runId, null]]);
     const chain = store.revisionAncestryStatus(taskId).chain;
     for (const id of chain.length === 0 ? [taskId] : chain) {
         const ref = store.lookupRef(id);
@@ -53,12 +55,16 @@ export function familyChangedFiles(store, taskId, runId, root) {
             continue;
         for (const run of store.runsFor(ref.id))
             if ((run.role === "builder" || run.role === "repair") && (id !== taskId || run.id === runId))
-                runs.add(run.id);
+                runs.set(run.id, run);
     }
-    for (const id of runs) {
+    for (const [id, run] of runs) {
         // A build that never recorded a diff contributed nothing to the branch; one whose diff can't be read counts as protected.
-        if (!store.artifactsFor(id).some(one => one.kind === "diff-stat") && id !== runId)
-            continue;
+        // Under "unknown", a missing inventory proves nothing by itself: only a finished run that committed nothing is skipped.
+        if (!store.artifactsFor(id).some(one => one.kind === "diff-stat") && id !== runId) {
+            if (options.missing !== "unknown" || (run?.committed === false && run.finishedAt !== null))
+                continue;
+            return null;
+        }
         const changed = changedFilesOf(store, id, root);
         if (changed === null)
             return null;

package/dist/scope.d.ts

@@ -1044,7 +1044,7 @@ export declare function releaseApprovalOf(store: Store, taskId: string, _now?: D
 /** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
  * only: freshnessFor decides whether it stands in, at the moment of use. */
 export declare function freshUntil(at: string): string | null;
-export type LocalApprovalRefusal = "local-mode-off" | "not-owner" | "no-scope" | "release" | "protected" | "escalated" | "coordinator" | "unsandboxed";
+export type LocalApprovalRefusal = "local-mode-off" | "not-owner" | "no-scope" | "release" | "protected" | "escalated" | "coordinator" | "unsandboxed" | "imported";
 /**
  * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
  * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
@@ -1065,3 +1065,34 @@ export declare function liveChainFromJson(json: string | null): ChainEntry[] | n
 /** The chain in full, the words a yes agrees to: order, agent, model, how it bills, what it may do, and whether Toolroll
  * can see it run out. Every approval surface shows these lines; empty for a scope with no chain. */
 export declare function chainTermsLines(scope: Pick<Scope, "proposedChainJson">): string[];
+/** The act a local owner's work rule is read for: approving a plan, or completing (accepting) a result whose build
+ * changed `changed` (the build's own diff; null when it can't be read, which counts as protected). */
+export type LocalWorkPurpose = {
+    act: "approve";
+} | {
+    act: "complete";
+    changed: readonly string[] | null;
+} | {
+    act: "plan";
+} | {
+    act: "retry";
+};
+/**
+ * Whether the local owner may do this act on this task without a password: ONE rule (easy-start C5, split out for
+ * local-owner slice 0), read inside the act's own transaction. Both acts refuse: local mode off or another person;
+ * release or deploy work; protected or two-person work; work a coordinator filed (or a task with no built-in record).
+ * Approving also refuses no plan, an escalated profile and a project stored as unsandboxed (what a build may do, which
+ * is what an approval agrees to). Completing reads release work from the release records too, and protected work from
+ * what the result actually changed as well as what its scope declared (v102's rule: declared paths are only a promise).
+ * Asking for a plan (local-owner slice 2) reads approve's rule for a task that may have no scope yet (no declared paths
+ * count as protected; the task's own permission mode counts as escalated), the release records too, and also refuses a
+ * task from outside (an imported issue): a new act, so no existing act changes. Retrying (slice 3) is approve's rule
+ * exactly (work the owner could approve again now), plus the release records and a task from outside.
+ */
+export declare function localWorkEligible(store: Store, by: string, taskId: string, purpose: LocalWorkPurpose): {
+    ok: true;
+} | {
+    ok: false;
+    reason: LocalApprovalRefusal;
+    message: string;
+};

package/dist/scope.js

@@ -1449,11 +1449,12 @@ function describeApproval(approval) {
 // ---- Only a person approves (docs/plans/approval-policy.md, phase 1). Kept last: the freshness tripwire pins places.
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
+import { isProtectedWork, protectedChanges } from "./approval-policy.js";
 import { permissionPlainWords } from "./chat-terms.js";
 import { limitRecognised } from "./exhaustion.js";
 import { SUBSCRIPTION_CAPABLE } from "./keys.js";
 import { releaseCheckPurposeDigest, releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, belongsToRelease, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1709,6 +1710,8 @@ const LOCAL_APPROVAL_WORDS = {
     escalated: "Work with wider permissions needs your password.",
     coordinator: "Work a coordinator filed needs your password.",
     unsandboxed: "This project's checks run without a sandbox, so approving needs your password.",
+    // Not an approve refusal (approve keeps today's rule); the type needs words for it.
+    imported: "A task from outside needs your password.",
 };
 /**
  * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
@@ -1719,30 +1722,8 @@ const LOCAL_APPROVAL_WORDS = {
  * a scout proposed are allowed.
  */
 export function localApprovalEligible(store, by, taskId) {
-    const no = (reason) => ({ ok: false, reason, message: LOCAL_APPROVAL_WORDS[reason] });
-    if (!localModeOn(store))
-        return no("local-mode-off");
-    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
-    if (owner !== by)
-        return no("not-owner");
-    const scope = store.getScope(taskId);
-    if (scope === null)
-        return no("no-scope");
-    if (deployGateScope(scope) || releaseCheckScope(scope))
-        return no("release");
-    const gate = store.approvalGate(taskId, by, "person");
-    if (gate.verdict !== "seal" || gate.protectedWork)
-        return no("protected");
-    if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
-        return no("escalated");
-    const ref = store.handle.prepare("SELECT repo, coordinator_cid FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
-    if (ref === undefined || ref["coordinator_cid"] != null)
-        return no("coordinator");
-    // The stored level, never the launch cap: a project saved as unsandboxed is refused even though local mode confines it.
-    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
-    if (stored === "unsandboxed" || scope.profile.checkAccess === "unsandboxed")
-        return no("unsandboxed");
-    return { ok: true };
+    // The one rule, shared with completing a result (localWorkEligible, below).
+    return localWorkEligible(store, by, taskId, { act: "approve" });
 }
 // ---- Fallback chains (fallback.ts). Kept last too.
 /** A chain that may dispatch: version 2, a base and at least one fallback. An older chain is history, never this. */
@@ -1768,3 +1749,107 @@ export function chainTermsLines(scope) {
         }),
     ];
 }
+// ---- Local owner, slice 0 (docs/plans/local-owner-acts.md): one work rule for a no-password act. Kept last.
+/** What a local owner hears when a result isn't one it may accept without a password. */
+const LOCAL_COMPLETION_WORDS = {
+    "local-mode-off": "Local mode is off, so accepting this result needs your password.",
+    "not-owner": "Only this computer's owner accepts results here without a password.",
+    "no-scope": "This task has no plan, so accepting its result needs your password.",
+    release: "Accepting a release needs your password.",
+    protected: "This result is protected work, so accepting it needs your password and a second person.",
+    escalated: "Work with wider permissions needs your password.",
+    coordinator: "Work a coordinator filed needs your password to accept.",
+    unsandboxed: "This project's checks run without a sandbox, so accepting needs your password.",
+    // Not a completion refusal (completion keeps slice 0's rule); the type needs words for it.
+    imported: "A task from outside needs your password to accept.",
+};
+/** What a local owner hears when a task isn't one it may ask a plan for without a password (local-owner slice 2). */
+const LOCAL_PLAN_WORDS = {
+    "local-mode-off": "Local mode is off, so asking for a plan needs your password.",
+    "not-owner": "Only this computer's owner asks for plans here without a password.",
+    "no-scope": "This task has nothing to plan yet.",
+    release: "Planning a release needs your password.",
+    protected: "This is protected work, so planning it needs your password.",
+    escalated: "Work with wider permissions needs your password to plan.",
+    coordinator: "Work a coordinator filed needs your password to plan.",
+    unsandboxed: "This project's checks run without a sandbox, so planning needs your password.",
+    imported: "A task from outside needs your password to plan.",
+};
+/** What a local owner hears when a build isn't one it may retry without a password (local-owner slice 3). */
+const LOCAL_RETRY_WORDS = {
+    "local-mode-off": "Local mode is off, so retrying needs your password.",
+    "not-owner": "Only this computer's owner retries builds here without a password.",
+    "no-scope": "This task has no approved plan to build again.",
+    release: "Retrying a release needs your password.",
+    protected: "This is protected work, so retrying it needs your password.",
+    escalated: "Work with wider permissions needs your password to retry.",
+    coordinator: "Work a coordinator filed needs your password to retry.",
+    unsandboxed: "This project's checks run without a sandbox, so retrying needs your password.",
+    imported: "A task from outside needs your password to retry.",
+};
+/**
+ * Whether the local owner may do this act on this task without a password: ONE rule (easy-start C5, split out for
+ * local-owner slice 0), read inside the act's own transaction. Both acts refuse: local mode off or another person;
+ * release or deploy work; protected or two-person work; work a coordinator filed (or a task with no built-in record).
+ * Approving also refuses no plan, an escalated profile and a project stored as unsandboxed (what a build may do, which
+ * is what an approval agrees to). Completing reads release work from the release records too, and protected work from
+ * what the result actually changed as well as what its scope declared (v102's rule: declared paths are only a promise).
+ * Asking for a plan (local-owner slice 2) reads approve's rule for a task that may have no scope yet (no declared paths
+ * count as protected; the task's own permission mode counts as escalated), the release records too, and also refuses a
+ * task from outside (an imported issue): a new act, so no existing act changes. Retrying (slice 3) is approve's rule
+ * exactly (work the owner could approve again now), plus the release records and a task from outside.
+ */
+export function localWorkEligible(store, by, taskId, purpose) {
+    const words = purpose.act === "approve" ? LOCAL_APPROVAL_WORDS : purpose.act === "complete" ? LOCAL_COMPLETION_WORDS : purpose.act === "plan" ? LOCAL_PLAN_WORDS : LOCAL_RETRY_WORDS;
+    const no = (reason) => ({ ok: false, reason, message: words[reason] });
+    if (!localModeOn(store))
+        return no("local-mode-off");
+    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
+    if (owner !== by)
+        return no("not-owner");
+    const scope = store.getScope(taskId);
+    if ((purpose.act === "approve" || purpose.act === "retry") && scope === null)
+        return no("no-scope");
+    if (scope !== null && (deployGateScope(scope) || releaseCheckScope(scope)))
+        return no("release");
+    if (purpose.act !== "approve" && (belongsToRelease(store, taskId) || releaseAuthorityOfTask(store, taskId) !== null))
+        return no("release");
+    const ref = store.handle.prepare("SELECT repo, coordinator_cid, permission_mode FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
+    // Retrying spends again under an existing yes: only on work the owner could approve again now (approve's own rule).
+    if (purpose.act === "approve" || purpose.act === "retry") {
+        const gate = store.approvalGate(taskId, by, "person");
+        if (gate.verdict !== "seal" || gate.protectedWork)
+            return no("protected");
+        if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
+            return no("escalated");
+    }
+    else if (purpose.act === "plan") {
+        // Approve's rule, read for a task that may have no scope yet: protected or two-person work (no declared paths count
+        // as protected), and an escalated profile or task-level permission mode.
+        const gate = store.approvalGate(taskId, by, "person");
+        if (gate.verdict !== "seal" || gate.protectedWork)
+            return no("protected");
+        if ((scope?.profile != null && levelOfProfile(scope.profile) === "escalated") || ref?.["permission_mode"] === "bypassPermissions")
+            return no("escalated");
+    }
+    else if (ref !== undefined && ref["repo"] != null) {
+        // Declared (no declared paths counts as protected) or actually changed (an unreadable diff counts as changed).
+        const rules = store.approvalRules(String(ref["repo"]));
+        if ((rules.protectProject || rules.protectedPaths.length > 0)
+            && (isProtectedWork(rules, scope?.touches ?? []) || purpose.changed === null || protectedChanges(rules, purpose.changed).length > 0))
+            return no("protected");
+    }
+    if (ref === undefined || ref["coordinator_cid"] != null)
+        return no("coordinator");
+    // What the build may do was agreed at its approval; a result already built is judged by what it is and changed.
+    if (purpose.act === "complete")
+        return { ok: true };
+    // Asking for a plan (a new act, so no behaviour changes): never a task from outside (a GitHub import, or a revision of one).
+    if ((purpose.act === "plan" || purpose.act === "retry") && issueImported(store, taskId))
+        return no("imported");
+    // The stored level, never the launch cap: a project saved as unsandboxed is refused even though local mode confines it.
+    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
+    if (stored === "unsandboxed" || scope?.profile?.checkAccess === "unsandboxed")
+        return no("unsandboxed");
+    return { ok: true };
+}