toolroll 0.9.103 → 0.9.105

package/dist/scope.js

@@ -1,4 +1,3 @@
-// The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
 import { cardShowsScope, cardTermsDigest } from "./chat-terms.js";
 import { mintSecret } from "./secret-mint.js";
@@ -18,31 +17,6 @@ import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
 import { levelOfProfile } from "./policy.js";
 import { canonicalJson } from "./canonical-json.js";
 export { isAcpProfile };
-/**
- * What a task is allowed to become, agreed before anything builds it.
- *
- * The gap this closes is the one an operator notices immediately and a
- * scheduler never does: a task called "fix the payouts flow" is a sentence, and
- * an agent handed it at 3am will decide for itself what that means. It might
- * mean a two-line guard. It might mean rewriting the billing model. Nobody
- * agreed to the second one, and by morning it is a diff.
- *
- * So a scope is written down, and a human opts in to it, and the builder will
- * not run on a task where that has not happened. Not a code review after the
- * fact — an agreement about the goal, before the work.
- *
- * **Approval binds to the words that were approved.** The record keeps a digest
- * of the scope text, and approval stores the digest it saw. Rewriting the scope
- * afterwards does not carry the approval with it; the digests stop matching and
- * the task is unapproved again. Without that, "approved" would mean "was
- * approved once, in some form" — which is exactly the loophole an agent editing
- * its own brief would walk through.
- *
- * The scope is deliberately three plain fields rather than a template. What is
- * the goal, what is explicitly not in it, and which paths it expects to touch.
- * An operator reading that at a glance can tell whether they agree, and that
- * glance is the whole safety property.
- */
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { networkFromValue, networkWords } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
@@ -56,28 +30,18 @@ import { taskArchived, taskCancelled } from "./task-archive.js";
 import { releaseCiHoldOf, releaseCiHoldWords } from "./release-ci-hold.js";
 import { releaseApprovalRefusal } from "./release-refusal.js";
 import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
-/** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
     return mintSecret(32);
 }
 export function hashToken(token) {
     return createHash("sha256").update(token, "utf8").digest("hex");
 }
-/**
- * A person's chosen password gets a real KDF. Bare sha256 is fine for the
- * minted 256-bit tokens — nothing brute-forces that space — but a password a
- * human picked lives in a much smaller one, so it is salted and stretched
- * (scrypt), and the stored string names its own scheme so both generations
- * of credential verify side by side.
- */
 export function hashPassword(password) {
     const salt = randomBytes(16).toString("hex");
     const hash = scryptSync(password, salt, 32).toString("hex");
     return `scrypt$${salt}$${hash}`;
 }
-/** Verify a presented secret against a stored hash of either scheme. */
 export function verifyCredential(stored, presented) {
-    // v100: an account that signs in only with the identity provider has no password to match.
     if (stored.startsWith("sso-only$"))
         return false;
     if (stored.startsWith("scrypt$")) {
@@ -95,20 +59,7 @@ function sameDigest(left, right) {
     const b = Buffer.from(right, "utf8");
     return a.length === b.length && timingSafeEqual(a, b);
 }
-/**
- * The execution profile (Parity II foundations, findings 1/2/13/14/22):
- * WHAT RUNS, bound into what the operator signs. A discriminated union —
- * each variant asserts only what its provider actually supports, with the
- * EFFECTIVE constants the argv will carry, never aspirations. The model
- * is always an exact string and always emitted on the argv: nothing in an
- * approved profile is left for later resolution to decide (ruling 10).
- * providerVersion and resolvedFrom are PROVENANCE and live outside these
- * shapes (finding 20) — they never enter a digest.
- */
 export const CLAUDE_LIMITS = {
-    // The activity watchdog is the real safety rail. Keep a very high turn
-    // breaker only for a pathological loop; ordinary long-horizon work should
-    // finish, checkpoint, or park long before it can reach this number.
     maxTurns: 1_000,
     repairMaxTurns: 4,
     timeoutSeconds: 1_200,
@@ -122,63 +73,41 @@ export const GEMINI_LIMITS = {
     timeoutSeconds: 1200,
     repairTimeoutSeconds: 300,
 };
-/** An ACP agent runs under two clocks at once: the whole attempt, and silence (no line from the agent). */
 export const ACP_LIMITS = {
     timeoutSeconds: 3600,
     idleTimeoutSeconds: 900,
     repairTimeoutSeconds: 900,
     repairIdleTimeoutSeconds: 300,
 };
-/** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */
 export function idleClock(profile) {
     return !isAcpProfile(profile) && profile.timeoutKind === "idle";
 }
-/**
- * The watchdogs an attempt runs under, from its sealed profile and the overall bound the caller resolved: an ACP
- * profile gets both clocks at once (the deadline and its silence window — a repair its own pair); the others one,
- * a no-progress window when the profile says idle, else a deadline.
- */
 export function watchdogsOf(profile, timeoutMs, repair = false) {
     if (isAcpProfile(profile))
         return { timeoutMs, idleTimeoutMs: (repair ? profile.repairIdleTimeoutSeconds : profile.idleTimeoutSeconds) * 1000 };
     return profile.timeoutKind === "idle" ? { idleTimeoutMs: timeoutMs } : { timeoutMs };
 }
 export const PROFILE_DIGEST_VERSION = 2;
-/** The stored snapshot bytes: version embedded IN the snapshot (finding 17). */
 export function canonicalProfileJson(profile) {
     return canonicalJson({ digestVersion: PROFILE_DIGEST_VERSION, profile });
 }
-/** sha256 over a domain-separated canonical encoding, truncated to the
- * same 128 bits every other safety digest here uses (finding 21). */
 export function profileDigestOf(profile) {
     return createHash("sha256")
         .update(`standing-orders:profile:${canonicalProfileJson(profile)}`, "utf8")
         .digest("hex")
         .slice(0, 32);
 }
-// ---- fallback chains (fallback.ts, docs/plans/fallback-chains.md) ----------
-// Version 1 is history (v30-v114): an old approval still decodes and its digest
-// still re-derives, so old tasks verify and render, and it holds no authority.
-// Version 2 is what filing writes now: only it dispatches.
 export const CHAIN_DIGEST_VERSION = 1;
 export const LIVE_CHAIN_VERSION = 2;
-/** The stored snapshot bytes for a chain: the version rides IN the
- * snapshot, exactly like a single profile's. */
 export function canonicalChainJson(entries, version = CHAIN_DIGEST_VERSION) {
     return canonicalJson({ digestVersion: version, chain: entries });
 }
-/** sha256 over a domain-separated canonical chain encoding — a DIFFERENT
- * domain from a single profile ("standing-orders:chain:" vs
- * ":profile:"), so a chain digest can never collide with a profile
- * digest, truncated to the same 128 bits. */
 export function chainDigestOf(entries, version = CHAIN_DIGEST_VERSION) {
     return createHash("sha256")
         .update(`standing-orders:chain:v${version}:${canonicalChainJson(entries, version)}`, "utf8")
         .digest("hex")
         .slice(0, 32);
 }
-/** Strict re-hydration of a stored chain — every entry proved through the
- * single-profile rehydrator; anything unexpected is null. */
 export function chainFromJson(json, version = CHAIN_DIGEST_VERSION) {
     if (json === null)
         return null;
@@ -194,8 +123,6 @@ export function chainFromJson(json, version = CHAIN_DIGEST_VERSION) {
     const wrapper = parsed;
     if (wrapper.digestVersion !== version)
         return null;
-    // Exact keys on the wrapper and on every entry (v48 integrity): a
-    // snapshot carrying anything this code never writes is not one it wrote.
     if (!exactKeys(wrapper, ["digestVersion", "chain"], []))
         return null;
     if (!Array.isArray(wrapper.chain) || wrapper.chain.length === 0 || wrapper.chain.length > 4)
@@ -208,20 +135,13 @@ export function chainFromJson(json, version = CHAIN_DIGEST_VERSION) {
         const e = raw;
         if (!exactKeys(e, ["profile", "authMode"], []))
             return null;
-        // A malformed auth mode is a malformed entry — never a default.
         if (e.authMode !== "subscription" && e.authMode !== "api-key")
             return null;
         if (e.profile === null || typeof e.profile !== "object" || Array.isArray(e.profile))
             return null;
-        // The profile rehydrates through the SAME strict path, wrapped as its
-        // own canonical snapshot so profileFromJson can prove it — and the
-        // canonical bytes must be the stored bytes' own keys (canonicalJson
-        // drops nothing, so an extra key survives into the strict parse).
         const profile = profileFromJson(canonicalProfileJson(e.profile));
         if (profile === null)
             return null;
-        // Duplicate exact entries are rejected (open q i): the key is the
-        // profile digest + auth mode.
         const key = `${profileDigestOf(profile)}:${e.authMode}`;
         if (seen.has(key))
             return null;
@@ -230,15 +150,6 @@ export function chainFromJson(json, version = CHAIN_DIGEST_VERSION) {
     }
     return entries;
 }
-/**
- * THE STRICT RAW TERMS READ (raw authority repair): the stored columns of
- * a scope or a standing order, proved EXACTLY — a JSON list is a list of
- * strings and nothing else, a rubric is a list of whole criteria carrying
- * exactly the keys this code writes and parsing with zero problems, a
- * budget is a safe integer or null. Nothing is filtered, defaulted, or
- * coerced on the way to an authority: the words say what is wrong, and
- * the caller refuses.
- */
 export function exactStringList(value, what) {
     if (typeof value !== "string")
         return { ok: false, problem: `${what} is not stored as text` };
@@ -269,7 +180,6 @@ export function exactAcceptance(value) {
     }
     if (!Array.isArray(parsed))
         return { ok: false, problem: "the rubric is not a JSON list" };
-    // Stored, a criterion carries exactly the keys this code writes: the saved rubric schema is strict about them.
     const strict = parseContract(z.object({ acceptance: storedRubricSchema }), { acceptance: parsed });
     for (const issue of strict.ok ? [] : strict.issues) {
         const entry = /^acceptance\[(\d+)\]$/.exec(issue.path);
@@ -292,35 +202,19 @@ export function exactSafeIntegerOrNull(value, what) {
         return `${what} is not a safe integer`;
     return null;
 }
-/**
- * The longest clock a snapshot may bind, in seconds: a JavaScript timer
- * holds at most 2^31 − 1 milliseconds, and a bound past that fires at
- * once instead of never — a "timeout" that is not one. Every stored
- * clock is proved against this before it is believed (v48 integrity).
- */
 export const MAX_TIMER_SECONDS = Math.floor(2_147_483_647 / 1000);
-/** A positive integer the platform can represent exactly. */
 export function safePositiveInteger(v) {
     return typeof v === "number" && Number.isSafeInteger(v) && v > 0;
 }
-/** A positive whole number of seconds a timer can actually wait. */
 export function timerSafeSeconds(v) {
     return safePositiveInteger(v) && v <= MAX_TIMER_SECONDS;
 }
-/**
- * Whether an object carries exactly the named keys: every required key
- * present, only optional keys otherwise, nothing unknown. Stored snapshots
- * are proved this way so a key this code never writes is a refusal, never
- * an ignorable extra.
- */
 export function exactKeys(value, required, optional) {
     const keys = Object.keys(value);
     if (required.some(key => !keys.includes(key)))
         return false;
     return keys.every(key => required.includes(key) || optional.includes(key));
 }
-/** Strict re-hydration of a stored snapshot — every field type-proved;
- * anything unexpected is null, never a guess. */
 export function profileFromJson(json) {
     if (json === null)
         return null;
@@ -336,42 +230,26 @@ export function profileFromJson(json) {
     const wrapper = parsed;
     if (wrapper.digestVersion !== PROFILE_DIGEST_VERSION)
         return null;
-    // EXACT KEYS (v48 integrity): the wrapper carries the version and the
-    // profile and nothing else, and the profile carries exactly its
-    // provider's fields — a snapshot with a key this code never writes was
-    // not written by this code and rehydrates as nothing, never as "the
-    // known part of it".
     if (!exactKeys(wrapper, ["digestVersion", "profile"], []))
         return null;
     const p = wrapper.profile;
     if (p === null || p === undefined || typeof p !== "object" || Array.isArray(p))
         return null;
-    // STRICT fields (v48 authority repair): a model is an exact id (the same shape every
-    // provider argv accepts), a repair model is `inherit` or an exact id, a
-    // turn bound is a positive SAFE integer, and a clock is a positive whole
-    // number of seconds a timer can actually hold — a snapshot carrying
-    // anything else (a negative turn count, a fractional second, a model
-    // that is not an id, a clock past what setTimeout can wait) was not
-    // written by this code and rehydrates as nothing.
     const str = (v) => exactModelId(v);
     const repairRef = (v) => v === "inherit" || exactModelId(v);
     const num = (v) => safePositiveInteger(v);
     const clock = (v) => timerSafeSeconds(v);
     const PROVIDER_KEYS = ["provider", "model", "maxTurns", "repairMaxTurns", "timeoutSeconds", "repairTimeoutSeconds", "repairModel"];
-    // The network a scope was written with: present and exact, or absent (an approval from before network policies).
     const network = p["network"] === undefined ? undefined : networkFromValue(p["network"]);
     if (network === null)
         return null;
     const writes = p["writes"];
     if (writes !== undefined && !isWritesMode(writes))
         return null;
-    // Check access is sealed only when wider than sandboxed: an explicit "sandboxed", or any other word, is not this code's.
     const sealedAccess = p["checkAccess"];
     if (sealedAccess !== undefined && (sealedAccess === "sandboxed" || !isCheckAccess(sealedAccess)))
         return null;
     const checkAccess = sealedAccess;
-    // Sandbox parity (v133): the policy version is exactly 2 when present; the lists, when present, are non-empty, sorted,
-    // distinct and valid (project-sandbox.ts), as only this code writes them.
     const policy = p["fencePolicy"];
     if (policy !== undefined && policy !== 2)
         return null;
@@ -479,19 +357,8 @@ export function profileFromJson(json) {
     }
     return null;
 }
-/**
- * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
- * console form, a template or a schedule's terms): fail closed, every
- * problem reported at once, each naming its path — the acceptance contract
- * (contracts/scope.ts) reads it. An absent or empty `value` parses to `[]`
- * with no problems: whether that is ALLOWED is a question for the caller
- * (`propose` says yes; every authoring road says no), never for this parser.
- */
 export function parseAcceptanceCriteria(value) {
     const read = readAcceptance(value);
-    // Keep the prose shape plan.ts's existing acceptanceLine consumes. Validation stays in the contract; only this
-    // compatibility boundary formats messages. That mapping takes a field followed by a space, not a colon, and
-    // evidence-array indices belong in the detail because it recognizes only the criterion's index.
     return {
         ...read,
         problems: read.problems.map(problem => ({
@@ -502,37 +369,12 @@ export function parseAcceptanceCriteria(value) {
         })),
     };
 }
-/** The exact bytes a rubric's SIGNED terms reduce to for the digest: sorted
- * by id, `how` dropped (advisory, never signed), evidence kinds sorted so
- * two equivalent lists never digest differently. */
-/**
- * The plain-text rubric encoding shared by every non-JSON authoring
- * surface — the console's rubric textarea (one line each) and the CLI's
- * `--acceptance` flag (one line per `;`-separated entry): one criterion
- * per line, shaped
- *
- *   [id:] statement | evidence,kinds [| how]
- *
- * `id` is optional — auto-numbered `c1`, `c2`, ... in encounter order when
- * every line omits it, so a person can write the rubric without inventing
- * ids by hand. This function never validates; it only turns text into the
- * same plain-object shape `parseAcceptanceCriteria` already validates, so
- * both entry points can never drift on what counts as a valid criterion.
- */
-/** The one criterion a filing may carry when nobody has written the rubric
- * yet: the console's scout follow-ups file with it, and `--acceptance plan`
- * on the command line expands to it. A mode with planAuto sends such a
- * filing to the planner instead of building against it. */
 export const PLACEHOLDER_RUBRIC_STATEMENT = "The operator has reviewed this follow-up and written a real rubric before approving it.";
 export const PLACEHOLDER_RUBRIC = [{ id: "c1", statement: PLACEHOLDER_RUBRIC_STATEMENT, how: null, evidence: ["manual-review"] }];
 export function rubricIsPlaceholder(acceptance) {
     return acceptance.length === 1 && acceptance[0].statement === PLACEHOLDER_RUBRIC_STATEMENT &&
         acceptance[0].evidence.length === 1 && acceptance[0].evidence[0] === "manual-review";
 }
-/** Split a `--acceptance` rubric into criteria. Criteria are `;`-separated,
- * but a `;` inside a statement must not split it: every criterion ends with
- * its `|<evidence kinds>` part, so a segment with no `|` is the front of the
- * next one and is glued back on. The single word `plan` means the placeholder. */
 export function splitAcceptanceRubric(text) {
     if (text.trim().toLowerCase() === "plan")
         return [`${PLACEHOLDER_RUBRIC_STATEMENT}|manual-review`];
@@ -570,8 +412,6 @@ export function acceptanceLinesToInput(lines) {
     }
     return out;
 }
-/** The inverse of `acceptanceLinesToInput`, for pre-filling an editor from
- * a stored rubric — round-trips through `parseAcceptanceCriteria` exactly. */
 export function acceptanceToLines(criteria) {
     return criteria.map(c => `${c.id}: ${c.statement} | ${c.evidence.join(",")}${c.how === null ? "" : ` | ${c.how}`}`);
 }
@@ -581,27 +421,7 @@ export function canonicalAcceptance(criteria) {
         .map(c => ({ id: c.id, statement: c.statement.trim(), evidence: [...c.evidence].sort() }));
 }
 export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried", "auto-check", "auto-green"];
-/**
- * The exact bytes an operator agreed to.
- *
- * Every field that constrains the work goes in. If a change to a field would
- * change what an operator would have said, it has to move the digest, or the
- * approval it invalidates would be an approval of something else.
- */
-export function digestOf(scope, 
-// The execution target: a single profile (legacy v24), OR an explicit
-// fallback chain (v30). BOTH fold through the SAME outer `profileDigest`
-// key — the discriminator lives INSIDE the digest value (a chain digest
-// is domain-separated from a profile digest), NEVER as an outer field
-// (an outer field would change the legacy bytes; C1). A chain-of-one is
-// still an EXPLICIT chain and uses the chain digest, distinct from the
-// single-profile digest by design.
-target, 
-// v47: the phase route. EVERY route filed since v47 folds in — routine
-// shaped ones included — so the approval binds exactly which agent runs
-// each phase. Absent (null) only for a row proven to predate v47, whose
-// digest bytes are therefore untouched.
-route) {
+export function digestOf(scope, target, route) {
     const innerDigest = target == null
         ? null
         : "chain" in target
@@ -612,44 +432,24 @@ route) {
         goal: scope.goal.trim(),
         outOfScope: scope.outOfScope?.trim() ?? null,
         touches: [...scope.touches].sort(),
-        // Absent and null digest identically, so every pre-v15 approval
-        // stays exactly as approved.
         ...(scope.budgetMicrousd == null ? {} : { budget: scope.budgetMicrousd }),
-        // Same absent/[] equivalence as budget, one key up: a rubric-less
-        // scope (every scope before v39, and any road that sends none)
-        // digests identically to today.
         ...(scope.acceptance === undefined || scope.acceptance.length === 0
             ? {}
             : { acceptance: canonicalAcceptance(scope.acceptance) }),
-        // Default is the historical behavior and therefore hashes exactly
-        // like an absent v41 field. Strict is an explicit signed promise.
         ...(scope.qualityMode === "strict" ? { qualityMode: "strict" } : {}),
         ...(scope.candidate ? { candidate: scope.candidate } : {}),
         ...(scope.releaseTerms == null ? {} : { releaseTerms: releaseTermsDigest(scope.releaseTerms) }),
         ...(scope.releaseCheck == null ? {} : { releaseCheck: releaseCheckPurposeDigest(scope.releaseCheck) }),
-        // The single outer key, whichever target produced its inner value:
-        // absent => the golden and every profileless approval are untouched;
-        // a legacy profile => its exact profileDigestOf; an explicit chain
-        // => its chainDigestOf. Same key, discriminated value.
         ...(innerDigest == null ? {} : { profileDigest: innerDigest }),
-        // The route's own domain-separated digest, under its own key —
-        // absent only for a pre-v47 row.
         ...(route == null ? {} : { route: routeDigestOf(route) }),
     }), "utf8")
         .digest("hex")
-        // 128 bits. This is a safety token binding an approval to exact content,
-        // so it has to be well past the reach of a deliberate collision search —
-        // 64 bits is not, and the only cost of the longer one is a longer thing to
-        // paste back.
         .slice(0, 32);
 }
 export function propose(store, input) {
     return store.transact(() => {
         const previous = store.getScope(input.taskId);
         const saved = proposeLocked(store, input);
-        // A rewritten goal, exclusions, touches or rubric on a task that is planning starts its planning again (v119), in
-        // the same transaction: the next planner plans for the new terms, never from the old plan or its answers. An
-        // identical refile changes nothing; the planner's own handoff writes its draft without coming through here.
         const ref = store.lookupRef(input.taskId);
         if (ref !== null && ref.plan !== null && (previous === null || contractChangesOf(previous, saved).length > 0))
             store.restartPlanning(ref.id, input.now);
@@ -665,11 +465,6 @@ function proposeLocked(store, input) {
         ...draft,
         proposedAt: now.toISOString(),
         digest: digestOf(draft),
-        // The previous approval is kept rather than cleared, and is invalidated by
-        // the digest no longer matching. Same safety — `approvalOf` requires them
-        // equal — but it preserves the fact that somebody once agreed to
-        // something, so the refusal can say "this was approved and then rewritten"
-        // instead of the much less useful "this was never approved".
         approvedAt: previous?.approvedAt ?? null,
         approvedBy: previous?.approvedBy ?? null,
         approvedDigest: previous?.approvedDigest ?? null,
@@ -683,35 +478,13 @@ function proposeLocked(store, input) {
         ...(input.releaseCheck === undefined ? {} : { releaseCheck: input.releaseCheck }),
         proposedVia,
     });
-    // The store may have RECOMPUTED the digest to bind the resolved profile
-    // (v24 filing invariant) — what callers display must be what is stored.
     const saved = store.getScope(taskId) ?? scope;
     if (input.author !== undefined && input.author !== "")
         store.recordScopeAuthor(taskId, saved.digest, input.author, now);
     return saved;
 }
-/**
- * A scope edit from a surface where the editor might be stale — two browser
- * tabs, a form submitted after the world moved. `sawDigest` names the version
- * the editor was looking at (null: they saw no scope at all); a mismatch is a
- * refusal, never a silent overwrite of somebody else's words. Edits are also
- * refused while a live claim holds the task: the running build read its scope
- * at start, and rewording the agreement under it would make the digest lie
- * about what the work was agreed to. Field caps and control-character rules
- * live here because every one of these strings will later be rendered.
- *
- * v39: this is a scope-producing ROAD, not the `propose` primitive, so it is
- * where the rubric becomes mandatory — every edit through here (a fresh
- * proposal or a rewrite of an already-approved one) must carry at least one
- * criterion, or it is refused with a clear `acceptance-required` reason
- * rather than silently filing without one. A scope that already carries a
- * live, unrewritten approval from before this code existed never reaches
- * this function again unless somebody edits it — which is exactly when the
- * requirement should start applying.
- */
 export function proposeGuarded(store, input) {
     const touches = [...(input.touches ?? [])].map(one => one.trim()).filter(one => one !== "");
-    // Plain words first for what a person typed (lengths, bytes, hidden text), then the scope contract.
     const badText = validateScopeText({ goal: input.goal, outOfScope: input.outOfScope ?? null, touches });
     if (badText !== null)
         return badText;
@@ -738,35 +511,14 @@ export function proposeGuarded(store, input) {
         return { ok: true, scope };
     });
 }
-export function addApprover(store, name, now, by, newToken = mintToken, mutation = {}, 
-/** A password the person chose. Absent, a token is minted and shown once. */
-password) {
+export function addApprover(store, name, now, by, newToken = mintToken, mutation = {}, password) {
     if (password !== undefined && password.length < 8) {
         return { ok: false, reason: "weak-password" };
     }
-    // The first one bootstraps, because somebody has to be able to create the
-    // first one and there is nobody to ask yet. Every one after it has to be
-    // vouched for by an existing approver.
-    //
-    // Without that second rule the credential is worth nothing: an agent that
-    // can run these commands would simply mint an approver for itself and
-    // approve its own scope with it. The bootstrap window is real and is why
-    // this is the first thing an operator should do, before anything else can
-    // reach the queue.
-    // ONE transaction around detection, vouching, and the write (Codex
-    // people round 2, finding 1): a voucher revoked between the check and
-    // the save must lose — BEGIN IMMEDIATE serializes against the
-    // revocation cascade, so there is no between.
     return store.transact(() => {
         const existing = store.listApprovers();
         const bootstrap = existing.length === 0;
         if (!bootstrap) {
-            // ACTIVE approver standing, not a bare hash match (Codex people round
-            // 1, finding 1): a viewer's or a revoked person's credential is real
-            // and still vouches for nothing — the CLI is a ceremony site like any
-            // other, and this was the one road that forgot.
-            // Creating an approver is a credential act (docs/plans/passwordless.md): a password typed now, never a session or
-            // the CLI's remembered login under Passwordless.
             const vouching = by === undefined ? { ok: false } : proveCredential(store, by.name, by.token);
             if (!vouching.ok) {
                 return { ok: false, reason: "not-an-approver" };
@@ -781,26 +533,9 @@ password) {
         return { ok: true, name, token, bootstrap, chosen: false };
     });
 }
-/**
- * Whether this name-and-token pair is a person the store knows. Shared by
- * every act that requires a human's authority — approving a scope, answering
- * a decision — because "who said yes" must never be a string the caller
- * typed. Fails closed: with no approver registered there is nobody who can
- * agree to anything, and treating that as "authority is not required here"
- * would make the gate optional — which is the same as not having one.
- */
-/**
- * IDENTITY, split from authority (modes chain, D2/E2): who this credential
- * belongs to and what standing they hold. Viewers authenticate here and
- * read; every consequential act goes through authenticateApprover below,
- * which additionally demands ACTIVE approver standing — so the forty
- * ceremony sites enforce the role without one of them changing.
- */
 export function authenticateAccount(store, by, secret) {
     if (store.listApprovers().length === 0)
         return { ok: false, reason: "no-approvers" };
-    // A remote run (runOperateAs) is its token's person: only that run's own credential names them, no password is
-    // checked or counted, and a read token stands as a viewer.
     const remote = activeRemote();
     if (remote !== null) {
         const account = by === remote.account && secret === remote.secret ? store.accountOf(by) : null;
@@ -808,7 +543,6 @@ export function authenticateAccount(store, by, secret) {
             return { ok: false, reason: "unknown" };
         return { ok: true, role: remote.scope === "act" ? account.role : "viewer", generation: account.generation };
     }
-    // A lead token signs in as its owner, only inside a command the lead runs with it (never a console sign-in).
     const acting = currentActor();
     if (acting?.lead === true && parseLeadToken(secret) !== null) {
         const lead = store.leadFor(secret), account = store.accountOf(by);
@@ -816,22 +550,16 @@ export function authenticateAccount(store, by, secret) {
             return { ok: false, reason: "unknown" };
         return { ok: true, role: account.role, generation: account.generation };
     }
-    // v99: wrong passwords in a row lock the name for a while from where they came, whatever road they came by. A
-    // locked or held-back source is refused before the password is checked.
     const guard = passwordGuardOf(store), now = Date.now(), source = currentPasswordSource();
     const account = store.accountOf(by), proof = provenPasswordAccount.getStore();
     const proven = proof?.name === by && account !== null && account.revokedAt === null && proof.generation === account.generation;
     const wait = guard.preflight(by, now, source, proven);
     if (wait > 0)
         return { ok: false, reason: "locked", retryAfterMs: wait };
-    // Unknown names and legacy minted-token/SSO accounts do the same one KDF as a password account. Throttled
-    // attempts above do none, for either name class; never disclose account existence through password work.
     const dummy = `scrypt$${"0".repeat(32)}$${"0".repeat(64)}`;
     const hash = account?.credentialHash ?? dummy;
     if (!hash.startsWith("scrypt$"))
         verifyCredential(dummy, secret);
-    // v147: an account with no password set (a local-mode owner) has a random hash; the KDF still runs (same timing), and
-    // nothing it is given ever matches.
     const matches = verifyCredential(hash, secret) && account !== null && account.passwordSet;
     if (account === null || !matches) {
         guard.failed(by, now, source, account !== null);
@@ -840,28 +568,14 @@ export function authenticateAccount(store, by, secret) {
     guard.succeeded(by, source);
     if (account.revokedAt !== null)
         return { ok: false, reason: "revoked" };
-    // Inside a command, the person who signed in is who acted (their own acts never ping them).
     claimActor(by);
     return { ok: true, role: account.role, generation: account.generation };
 }
-/**
- * The local CLI's remembered login, marked for the one command that read it (operate.ts credentialsFrom): with
- * Passwordless on, a proof made with it records "cli-login" — never a typed password — and no credential act accepts it.
- * Scoped to that command's async chain; a browser request in the console's own process never carries it.
- */
 export const rememberedLogin = new AsyncLocalStorage();
 export const FRESH_WINDOW_MS = 15 * 60_000;
-/** How long an explicit provider re-check stands in for one password typed now. */
 export const SSO_NOW_MS = 5 * 60_000;
 export const freshFacts = new AsyncLocalStorage();
 const refunds = new AsyncLocalStorage();
-/**
- * Run an act a re-check may prove, spending the re-check only if the act happens: when it throws (a rolled-back
- * transaction) or `failed` says it was refused, every re-check it spent is put back. ONLY for acts whose every effect
- * is in one database transaction (an approval, a chat approval proposal, a chat turn opening): there, "refused" and
- * "thrown" prove nothing happened. Every other step-up spends its re-check whatever comes of it (fail-closed: at worst
- * the person confirms with their provider again). Synchronous acts only.
- */
 export function spendingOnlyOnSuccess(act, failed) {
     const spent = [];
     let result;
@@ -876,18 +590,13 @@ export function spendingOnlyOnSuccess(act, failed) {
     if (failed(result))
         for (const refund of spent)
             refund();
-    // Succeeded here, but an enclosing act (an outer transaction, the request itself) may still fail: it owns them now.
     else
         refunds.getStore()?.push(...spent);
     return result;
 }
 const freshScope = new AsyncLocalStorage();
-/** Run an allowlisted act: within it, a fresh password or re-check may stand in for one typed now. */
 export function withFreshness(op, act) { return freshScope.run(op, act); }
 const within = (at, floor, spanMs, now) => at !== null && at > 0 && at > floor && at <= now + 60_000 && now - at < spanMs;
-/** The freshness this act may stand on now, or null: only inside an allowlisted act on an allowlisted route, for this
- * person, on a direct local request, on a live session, within the window, after any Forget. `preview` asks it from a
- * page (a GET) about the allowlisted act its form posts to — for words only, never to authorise. */
 export function freshnessFor(by, now = Date.now(), preview = false) {
     const op = freshScope.getStore(), facts = freshFacts.getStore();
     if (op === undefined || facts == null || facts.actor !== by || !(facts.allowlisted || preview) || !facts.local || !facts.live())
@@ -899,21 +608,12 @@ export function freshnessFor(by, now = Date.now(), preview = false) {
         return { method: "fresh-sso", at: sso };
     return null;
 }
-/** Whether an explicit provider re-check is waiting to stand in for one step-up (the page says "Confirmed with …"). */
 export function ssoNowAvailable(by, now = Date.now()) {
     const facts = freshFacts.getStore();
     return facts != null && facts.actor === by && facts.live() && within(facts.ssoNow(), facts.floor(), SSO_NOW_MS, now);
 }
-/**
- * Proof that this person is here now, for any account step-up (an approver's or not): a password typed now, or an
- * explicit provider re-check (consumed). The core of every console step-up; `authenticateApprover` adds standing.
- */
 export function proveAccountNow(store, by, token, options = {}) {
     const now = Date.now();
-    // Easy-start C1: a local owner is decided FIRST, before Passwordless and freshness, whatever was typed. An allowlisted
-    // act of its own, still standing (re-read here, inside the caller's transaction), is "local-owner"; anything else —
-    // a credential act, a read, another person, local mode moved — proves nothing. It never upgrades to a typed password.
-    // A lead's token or a remote API token in that chain is never the local owner (it stays a machine's proof below).
     const local = activeRemote() === null && currentActor()?.lead !== true ? currentLocalOwner() : null;
     if (local !== null) {
         if (options.credential === true || local.account !== by || local.act === "read" || !localOwnerInFlight(local) || !localOwnerStandsNow(store, local))
@@ -923,11 +623,7 @@ export function proveAccountNow(store, by, token, options = {}) {
     const facts = freshFacts.getStore();
     if (facts != null && facts.actor === by && !facts.live())
         return { ok: false, reason: "not-an-approver" };
-    // An empty password is never checked as a password (and never counts toward a lockout).
     if (token === "") {
-        // Passwordless (read live): the person's own live browser session is the proof. Only a browser request carries facts;
-        // a CLI, a token, a chat bridge or detached work has none, and falls through to the rules below.
-        // A credential act never takes this road, so its own proofs (a one-use provider re-check) are reached and spent.
         if (options.credential !== true && facts != null && facts.actor === by && facts.live() && passwordlessOn(store))
             return { ok: true, method: "session", at: now };
         if (ssoNowAvailable(by, now)) {
@@ -942,7 +638,6 @@ export function proveAccountNow(store, by, token, options = {}) {
     const account = authenticateAccount(store, by, token);
     if (!account.ok)
         return { ok: false, reason: account.reason === "no-approvers" ? "no-approvers" : "not-an-approver" };
-    // A machine credential named the person (authenticateAccount takes it as them): say so, never "a password typed now".
     if (activeRemote() !== null)
         return { ok: true, method: "remote-token", at: now };
     if (currentActor()?.lead === true && parseLeadToken(token) !== null)
@@ -954,17 +649,10 @@ export function proveAccountNow(store, by, token, options = {}) {
         facts.stamp(now);
     return { ok: true, method: "password-now", at: now };
 }
-/**
- * A credential act (docs/plans/passwordless.md, the closed list: one that creates or widens a way in): only a password
- * typed now, or a one-use identity-provider re-check, proves it — never a session, never a remembered password.
- */
-/** Whether an empty password would pass for `by` right now because Passwordless is on and this is their live browser
- * session. Read only — the act itself proves it again inside `proveAccountNow`. */
 export function passwordlessSessionFor(store, by) {
     const facts = freshFacts.getStore();
     return facts != null && facts.actor === by && facts.live() && passwordlessOn(store);
 }
-/** Whether a proof is one a credential act accepts: a password typed now, or a one-use identity-provider re-check. */
 export const credentialProof = (method) => method === "password-now" || method === "sso-now";
 export function proveCredential(store, by, token, repo) {
     const proved = authenticateApprover(store, by, token, repo, { credential: true });
@@ -979,15 +667,8 @@ export function authenticateApprover(store, by, token, repo, options = {}) {
     const standing = approverStanding(store, by, repo);
     return standing.ok ? proved : standing;
 }
-/**
- * What an approval needs besides the password (v100: an identity-provider
- * sign-in moments ago stands in for the password; nothing stands in for
- * this): an active account in the approver role, with access to the project.
- */
 export function approverStanding(store, by, repo) {
     const account = store.accountOf(by);
-    // A viewer's credential is real and still cannot agree to anything —
-    // the words every refused ceremony shows are the viewer words.
     if (account === null || account.revokedAt !== null || account.role !== "approver")
         return { ok: false, reason: "not-an-approver" };
     const context = projectAuthority.getStore();
@@ -996,21 +677,6 @@ export function approverStanding(store, by, repo) {
         return { ok: false, reason: "not-an-approver" };
     return { ok: true };
 }
-/**
- * C1's atomic road: file the scope AND seal its approval in ONE
- * transaction, under a mode the SAME transaction re-proves. The caller
- * has already authenticated the actor and matched channel rules; this
- * function owns the predicate's transactional half — mode active, actor
- * IS the signer, repo matches, and the sealed digest is the filed one
- * (trivially true here: they are the same transaction). Never
- * sealScopeApproval after a filing — that was the TOCTOU.
- */
-/**
- * C1's coverage question, answerable from ANY filing road: does a live
- * mode make THIS actor's credentialed filing auto-approve here, and with
- * which defaults? Callers re-ask INSIDE their filing transaction — an
- * answer carried across transactions would be the TOCTOU again.
- */
 export function modeFilingCoverage(store, repo, actor, now) {
     const mode = repo === null ? null : store.activeMode(repo, now);
     if (mode === null || mode.signedBy !== actor)
@@ -1050,9 +716,6 @@ export function fileAndSealUnderMode(store, input) {
         }
         if (!autoApprove)
             return { ok: false, reason: "not-covered" };
-        // v39: a mode auto-approves a filing with NOBODY reading it at that
-        // instant — of every road, this one can least afford to seal a scope
-        // with no rubric to answer.
         if (parseAcceptanceCriteria(input.acceptance).criteria.length === 0) {
             return { ok: false, reason: "acceptance-required" };
         }
@@ -1061,39 +724,19 @@ export function fileAndSealUnderMode(store, input) {
             ...(input.budgetMicrousd == null && defaultBudget !== null ? { budgetMicrousd: defaultBudget } : {}),
             ...(escalated ? { posture: "escalated" } : {}),
         });
-        // A scope that cannot say exactly which agents run (v47: every phase
-        // exact, the route readable) is never auto-sealed — the words say why.
         if (scope.profileState === "unresolved") {
             return { ok: false, reason: "profile-unresolved", ...(scope.unresolvedReason == null ? {} : { detail: scope.unresolvedReason }) };
         }
         const sealed = store.sealScopeApproval(input.taskId, input.actor, input.now, input.mutation ?? {}, { kind: "mode", modeDigest: mode.digest });
-        // The quarantine speaks through every caller (review finding 7): a
-        // coordinator-filed task is never mode-admitted, and pretending the
-        // seal landed would hide exactly the refusal the operator must see.
         if (!sealed)
             return { ok: false, reason: "coordinator-filed" };
         return { ok: true, scope: store.getScope(input.taskId), basis: "mode" };
     });
 }
-export function approve(store, taskId, by, now, sawDigest, token, mutation = {}, 
-/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it.
- * `typed`: a typed yes to a Start card (one-step-chat.md C5), the message that was the yes, recorded beside the marker. */
-fastStart, 
-/** A person's own yes in chat (owner's decision, docs/plans/toolroll-cards.md): their tap or signed-in click stands in
- * for a password, so `token` is unused. Every rule below still applies. The caller has proved the person is the one
- * tapping. `shown` is what a card that showed its terms whole showed: those words, and the digest kept when it was
- * made. Null when the card showed less: the seal then opens none of the walls a person's reading opens. */
-chat) {
-    // Read and write in one transaction, re-reading inside it — the credential
-    // check included, so a token rotated between authentication and the write
-    // cannot leave an approval signed by an authority that no longer exists.
-    // Apart, a scope rewritten between the read and the write is overwritten by
-    // this approval — which would resurrect the old wording *and* mark it
-    // agreed, the precise opposite of what the digest is for.
+export function approve(store, taskId, by, now, sawDigest, token, mutation = {}, fastStart, chat) {
     return store.transact(() => {
         const repoNow = store.lookupRef(taskId)?.repo ?? null;
         const account = chat === undefined ? null : store.accountOf(by);
-        // A machine never reaches this road, and the person's role and reach are read here, in the seal's transaction.
         if (chat !== undefined && machineActing())
             return { ok: false, reason: "machine-proof" };
         if (chat !== undefined && (account === null || account.revokedAt !== null || account.role !== "approver" || repoNow === null || !store.accountCanAccess(by, repoNow)))
@@ -1101,12 +744,8 @@ chat) {
         const authenticated = chat !== undefined ? { ok: true, method: "chat", at: now.getTime() } : authenticateApprover(store, by, token, repoNow);
         if (!authenticated.ok)
             return authenticated;
-        // ONLY A PERSON APPROVES (docs/plans/approval-policy.md, phase 1): a lead token or a remote API token proves the
-        // credential, not a person at a ceremony. Refused before any vote or proof row is written.
         if (!personProof(authenticated.method))
             return { ok: false, reason: "machine-proof" };
-        // Easy-start C5: a local owner approves only as the approve-plan act, and only eligible work (one shared rule:
-        // localApprovalEligible, read again here inside the seal's transaction).
         const local = authenticated.method === "local-owner" ? currentLocalOwner() : null;
         if (authenticated.method === "local-owner") {
             if (local === null || (local.act !== "approve-plan" && !(local.act === "build-now" && fastStart !== undefined)))
@@ -1118,91 +757,57 @@ chat) {
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
-        // A release takes no yes the release sheet would refuse (put away, CI held or failed, its check failed on this
-        // commit, terms changed after an earlier yes), in the sheet's words, on every road: read here, before any vote.
         const releaseRefusal = releaseApprovalRefusal(store, taskId, scope);
         if (releaseRefusal !== null)
             return { ok: false, reason: "policy", message: releaseRefusal };
-        // A put-away task (v145) is restored first; sealScopeApproval refuses it too, on every road.
         if (taskArchived(store, taskId))
             return { ok: false, reason: "archived" };
-        // A cancelled task takes no yes either — read here, in the seal's transaction, before any vote or proof is
-        // written: an approval page left open while the task was cancelled elsewhere, or the CLI, approves nothing.
         if (taskCancelled(store, taskId))
             return { ok: false, reason: "cancelled" };
-        // The digest is required, not optional. An operator reads a scope, somebody
-        // rewrites it, and an approval that did not name what it saw would agree to
-        // the new one in silence — which is the whole failure this guards.
         if (sawDigest !== scope.digest)
             return { ok: false, reason: "changed" };
-        // What the card showed when it was made is what this yes is to: other words, or words leaving out a widening, aren't.
         const shown = chat?.shown ?? null;
         if (shown !== null && (cardTermsDigest(shown.terms) !== shown.expect || !cardShowsScope(scope, shown.terms)))
             return { ok: false, reason: "changed" };
-        // The "what changed" line a person read describes this exact route, or this yes isn't to what they read (route-change.ts).
         if (routeChangeProblem(store, taskId, scope))
             return { ok: false, reason: "changed" };
-        // A fast start is never a task from outside (github-import.ts): that takes the ordinary ceremony.
         if (fastStart !== undefined && issueImported(store, taskId))
             return { ok: false, reason: "policy", message: "A task from outside takes the ordinary approval." };
-        // An unresolved scope cannot say exactly what would run, so nobody can
-        // agree to it (foundations finding 16) — restatement is the road.
         if (scope.profileState === "unresolved") {
             return { ok: false, reason: "profile-unresolved" };
         }
-        // A row that predates agent routing cannot take a NEW yes (v48): an
-        // approval now names exactly which agent plans, builds, repairs, and
-        // reviews, and this row names none — re-filing routes it.
         if (scope.routeEra == null) {
             return { ok: false, reason: "unrouted" };
         }
-        // SEPARATION OF DUTIES (v102): the project's rules, asked first so the
-        // answer is words, not a silent refusal from the seal. Protected work
-        // keeps each person's yes to these exact bytes and seals on the second.
-        // Sprint 8: the organisation policy, before any vote is kept: a disallowed provider or model, or terms above the
-        // permission ceiling, are refused in words that name the rule.
         const policy = store.scopePolicyRefusal(taskId);
         if (policy !== null)
             return { ok: false, reason: "policy", message: policy };
-        // A release scope's yes opens its authority record (release-once.md); say first why it can't.
         const releaseProblem = scope.releaseTerms == null ? null : releaseSealProblem(store, scope.releaseTerms);
         if (releaseProblem !== null)
             return { ok: false, reason: "policy", message: releaseProblem };
-        // Filed while CI still ran: nobody approves it before the plane read exact-head CI passing (round 1, finding 4).
         const ciHold = releaseCiHoldOf(store, taskId);
         if (ciHold !== null)
             return { ok: false, reason: "policy", message: releaseCiHoldWords(ciHold) };
         const gate = store.approvalGate(taskId, by, "person");
         if (gate.verdict === "refuse")
             return { ok: false, reason: gate.reason };
-        // A remembered password (cockpit B2) approves only everyday work: one approver, standard permissions, terms a
-        // person filed. Protected work, escalated terms and quarantined filings take a password typed now.
         if ((authenticated.method === "fresh-password" || authenticated.method === "fresh-sso") && !freshlyApprovable(store, taskId, scope, gate.verdict === "seal" && !gate.protectedWork)) {
             return { ok: false, reason: "password-now" };
         }
-        // How the person was proved, beside every yes they give (a vote kept for protected work, or the seal): a password
-        // typed now, a re-check now, or a remembered one — with when, the credential generation and the exact digest.
         const proved = () => store.recordAction({ at: now.toISOString(), actor: by, repo: store.lookupRef(taskId)?.repo ?? null, taskId, runId: null, action: APPROVAL_PROOF,
             outcome: authenticated.method, source: "work", detail: (fastStart === undefined ? approvalProofDetail : fastProofDetail(fastStart))(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest, local === null ? undefined : { generation: local.localGeneration, transport: local.transport }) });
         if (gate.verdict === "vote") {
-            // The same person again adds nothing: no new vote, no proof row (and the approval roads refund a re-check).
             if (gate.already)
                 return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: true };
             store.recordApprovalVote(taskId, scope.digest, by, now, authenticated.method);
             proved();
             return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: gate.already };
         }
-        // The vote, the seal and its proof stand or fall together: a seal that is refused takes this yes back with it
-        // (savepoint rolled back), so a refusal leaves nothing written — the approval roads may then refund a re-check.
         const refused = {};
         try {
             return store.savepoint(() => {
                 if (gate.protectedWork)
                     store.recordApprovalVote(taskId, scope.digest, by, now, authenticated.method);
-                // SEAL, never re-resolve: the approval snapshots the stored working
-                // profile — the exact bytes the digest the approver signed was bound
-                // to. Routing saveScope here would re-run resolution and could sign a
-                // profile nobody saw.
                 const sealed = chat === undefined ? store.sealScopeApproval(taskId, by, now, mutation)
                     : store.sealScopeApproval(taskId, by, now, mutation, { kind: "chat", modeDigest: chat.modeDigest, ...(shown === null ? {} : { card: "shown", cardDigest: shown.expect, shownTerms: shown.terms }) }, "person");
                 const approved = sealed ? store.getScope(taskId) : null;
@@ -1221,14 +826,9 @@ chat) {
         }
     });
 }
-/** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
 export const APPROVAL_PROOF = "approval proved";
-/** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
 export const approvalProofDetail = (at, generation, digest, local) => `${new Date(at).toISOString()} · generation ${generation}${local === undefined ? "" : ` · local ${local.generation} ${local.transport}`} · digest ${digest}`;
-/** A fast start's proof: the v1 record proofDetailOf reads, with the marker. `local` keeps the legacy words
- * localSealStandsSql reads, so a local owner's seal stands on the same rule. */
 const fastProofDetail = ({ typed, ...fastStart }) => (at, generation, digest, local) => JSON.stringify({ v: 1, at: new Date(at).toISOString(), generation, digest, fastStart, ...(typed === undefined ? {} : { typed: { provider: typed.provider, event: typed.event } }), ...(local === undefined ? {} : { local: `proof · local ${local.generation} ${local.transport} · seal` }) });
-/** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
 export function approvalProofOf(store, taskId, by, digest) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);
     for (const row of rows) {
@@ -1239,8 +839,6 @@ export function approvalProofOf(store, taskId, by, digest) {
     }
     return null;
 }
-/** Whether a remembered password may approve these terms: one approver (no protected work), standard permissions
- * (never escalated), and not filed by a coordinator, a lead or a scout (those keep their own password ceremony). */
 export function freshlyApprovable(store, taskId, scope, singleApprover) {
     if (!singleApprover)
         return false;
@@ -1252,14 +850,6 @@ export function freshlyApprovable(store, taskId, scope, singleApprover) {
     const via = store.handle.prepare("SELECT proposed_via FROM task_scope WHERE task_id = ?").get(taskId)?.["proposed_via"];
     return !quarantinedAuthor(typeof via === "string" ? via : null);
 }
-/**
- * Whether this task may be built.
- *
- * `changed` is the interesting answer and the reason the digest exists: the
- * scope was approved, and then somebody — possibly an agent, possibly the
- * operator, possibly a different session — rewrote it. The old yes does not
- * transfer.
- */
 export function approvalOf(scope) {
     if (scope === null)
         return { approved: false, reason: "never-proposed" };
@@ -1268,27 +858,13 @@ export function approvalOf(scope) {
     }
     if (scope.approvedDigest !== scope.digest)
         return { approved: false, reason: "changed" };
-    // A seal stands on a known authority (approval-policy plan §1.5): one left out or undefined, null (a row from before
-    // the basis column) or a word this code doesn't write is no approval.
     if (scope.approvalBasis === undefined || scope.approvalBasis === null || !APPROVAL_BASES.includes(scope.approvalBasis)) {
         return { approved: false, reason: "none" };
     }
-    // Phase 1: only people approve, so a lead's seal (including an old one a lead token made through the person's road,
-    // which Store.getScope reads as `lead`) is no approval, and the person sees the Approve control again.
     if (scope.approvalBasis === "lead")
         return { approved: false, reason: "none" };
     return { approved: true, at: scope.approvedAt, by: scope.approvedBy };
 }
-/**
- * THE PARITY every projection proves between a route and the profile and
- * terms it was filed beside (atomic authority closure): the build and
- * repair legs ARE the profile's exact pairs, and the route's signed risk
- * and quality ARE the row's — a row whose risk says high over a route
- * recommended for routine was not filed by this code, and neither the
- * seal, the consent door, nor the dispatch proof believes it. One
- * function, so the working side, the sealed side, and the last-mile
- * dispatch proof cannot drift. Null when everything agrees.
- */
 export function routeParityProblem(route, profile, terms) {
     const buildLeg = legOf(route, "build");
     const repairLeg = legOf(route, "repair");
@@ -1304,12 +880,7 @@ export function routeParityProblem(route, profile, terms) {
     }
     return null;
 }
-// Recovery reuses this exact raw-terms check before considering saved evidence.
-// Decoding authority does not renew approval or authorize a process-custody write.
 export function scopeAuthorityOf(scope, env = {}) {
-    // THE RAW TERMS FIRST (raw authority repair): a row whose stored terms
-    // or metadata do not read back exactly is no authority at all — not
-    // the filtered, defaulted, or coerced reading of it.
     if (scope.termsProblem != null) {
         return { ok: false, reason: "terms", problem: `the scope's stored terms cannot be read exactly (${scope.termsProblem})` };
     }
@@ -1324,8 +895,6 @@ export function scopeAuthorityOf(scope, env = {}) {
     if (profile === null) {
         return { ok: false, reason: "profile", problem: profileJson === null ? "the scope carries no agent profile" : "the scope's agent profile cannot be read exactly (unknown keys, an unsafe number, or a clock no timer can hold)" };
     }
-    // Fallback agents: a current chain whose base IS this profile. An older
-    // chain (v30-v114) holds no authority: saving the scope again re-files it.
     const chain = scope.proposedChainJson == null ? null : liveChainFromJson(scope.proposedChainJson);
     if (scope.proposedChainJson != null && (chain === null || profileDigestOf(chain[0].profile) !== profileDigestOf(profile))) {
         return { ok: false, reason: "chain", problem: "this scope named fallback agents from an older version, or they can't be read — save the scope again to choose its agents" };
@@ -1342,28 +911,17 @@ export function scopeAuthorityOf(scope, env = {}) {
     if (digest !== scope.digest) {
         return { ok: false, reason: "digest", problem: "the scope's reference does not re-derive from its own terms, agents, and route — file it again" };
     }
-    // THE AUTH MODE, strictly (atomic authority closure): the credential the
-    // profile's provider would spend under is read through the caller's
-    // strict reader — a present mode file that says neither word closes
-    // the door in its words, never the default a lenient read would coerce
-    // it to (the spawn reads the same way, so nothing sealed here spends
-    // on a credential the operator never named).
     let authMode = null;
     if (env.authMode !== undefined) {
         const read = env.authMode(profile.provider);
         if (!read.ok)
             return { ok: false, reason: "auth-mode", problem: read.problem };
         authMode = read.mode;
-        // The base was filed under one credential; a yes on another isn't a yes to these terms.
         if (chain !== null && chain[0].authMode !== authMode)
             return { ok: false, reason: "auth-mode", problem: "the agent's sign-in changed since this was filed — save the scope again" };
     }
     return { ok: true, profile, route, digest, authMode, ...(chain === null ? {} : { chain }) };
 }
-/** The rubric's approval-card lines (v39): one per criterion, the id in
- * front (the exact string a proof must answer by) and its required
- * evidence kinds after it — `how` is deliberately absent here, the same way
- * it is absent from the digest: it is guidance, never a signed term. */
 export function acceptanceWords(criteria) {
     if (criteria.length === 0)
         return [];
@@ -1372,17 +930,11 @@ export function acceptanceWords(criteria) {
         ...criteria.slice(1).map(c => `               ${c.id}: ${c.statement} [shown by: ${c.evidence.join(", ")}]`),
     ];
 }
-/** The route's approval-card lines (v47): the WORKING route the digest
- * bound, projected with whatever readiness the caller can see — the same
- * bytes the task page and chat render. Empty on a scope with no route. */
 export function scopeRouteWords(scope, readiness = NO_READINESS) {
     const route = routeFromJson(scope.proposedRouteJson ?? null);
     return route === null ? [] : routeWords(projectRoute(route, readiness));
 }
-/** The scope, in the words an operator has to be able to agree or disagree with. */
-export function describeScope(scope, readiness = NO_READINESS, 
-/** Results routing: the evidence line when an earned rule chose the builder (route-rules.ts taskEvidenceWords). */
-evidence = null) {
+export function describeScope(scope, readiness = NO_READINESS, evidence = null) {
     const approval = approvalOf(scope);
     return [
         `  goal         ${scope.goal}`,
@@ -1393,16 +945,12 @@ evidence = null) {
         ...(scope.budgetMicrousd === null
             ? []
             : [`  budget       $${(scope.budgetMicrousd / 1_000_000).toFixed(2)} per build attempt — the agent is stopped at this figure`]),
-        // The ROUTE, in the words the yes agrees to (v47): posture and every
-        // leg with its reason and readiness — before anyone signs.
         ...scopeRouteWords(scope, readiness),
         ...(evidence === null ? [] : [`  why model    ${evidence.replace(/^Why this model: /, "")}`]),
         ...chainTermsLines(scope).map((line, at) => at === 0 ? `  fallback     ${line}` : `               ${line}`),
-        // What the build may reach (egress.ts), part of what the yes agrees to.
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  network      ${networkWords(scope.profile.network ?? null).replace(/^Network: /, "")}`]),
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  writes       ${writesWords(scope.profile.writes)}`]),
         ...(scope.profile?.checkAccess === undefined ? [] : [`  checks       ${checkAccessWords(scope.profile.checkAccess)}`]),
-        // Its sandbox terms (project-sandbox.ts), part of what the yes agrees to: what it reads, and any widening.
         ...(scope.profile === null || scope.profile === undefined ? [] : ((terms) => [`  reads        ${terms.reads}`, ...(terms.mach === null ? [] : [`  services     ${terms.mach}`])])(sandboxTermsWords(scope.profile))),
         ...releaseTermsWords(scope.releaseTerms ?? null),
         ...(scope.releaseCheck == null ? [] : [`  release      ${releaseCheckSentence(scope.releaseCheck)}`]),
@@ -1410,18 +958,15 @@ evidence = null) {
         `  approved     ${describeApproval(approval)}`,
     ];
 }
-/** The approval sheet's release lines (release-once.md): the release in one sentence, then what asks again. */
 export function releaseTermsSentence(terms) {
     if (!terms.policy.carry)
         return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Every later commit asks for your approval again.`;
     const outside = terms.access === "sandboxed" ? "" : " This project's checks don't run in the sandbox: those later test-only commits will run outside the sandbox without being shown to you first.";
     return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Later commits on this pull request that only change tests, docs or the changelog ship without asking you again, until it merges or for 3 days. You'll see each one in the release summary.${outside}`;
 }
-/** The approval sheet's line for a release check purpose (pipeline-speed.md, P0): a release that can't carry. */
 export function releaseCheckSentence(purpose) {
     return `Release ${purpose.packageVersion} from pull request #${purpose.pr} at ${purpose.approvedSha.slice(0, 7)}. Every later commit asks for your approval again. If Toolroll's own machine fails during the check, it reruns this same commit's check (at most twice).`;
 }
-/** What asks again, in full: the terms behind the sentence. */
 export function releaseAsksAgainWords(terms) {
     const p = terms.policy;
     return [
@@ -1446,18 +991,15 @@ function describeApproval(approval) {
     }
     return "no — nothing will build this until somebody agrees to it";
 }
-// ---- Only a person approves (docs/plans/approval-policy.md, phase 1). Kept last: the freshness tripwire pins places.
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
+import { isProtectedWork, protectedChanges } from "./approval-policy.js";
 import { permissionPlainWords } from "./chat-terms.js";
 import { limitRecognised } from "./exhaustion.js";
 import { SUBSCRIPTION_CAPABLE } from "./keys.js";
 import { releaseCheckPurposeDigest, releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
-/** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, belongsToRelease, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem, releaseStateAt } from "./release-authority.js";
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
-/** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
- * (`{"v":1,"at":…,"digest":…}`, more fields allowed). Any other shape is no proof. */
 export function proofDetailOf(detail) {
     if (typeof detail !== "string")
         return null;
@@ -1475,7 +1017,6 @@ export function proofDetailOf(detail) {
         }
     }
     const parts = detail.split(" · ");
-    // Easy-start C5: a local owner's proof names its local generation and transport between the two (approvalProofDetail).
     const local = parts.length === 4 ? parts.splice(2, 1)[0] : null;
     if (local !== null && !/^local \d+ (browser|terminal)$/.test(local))
         return null;
@@ -1483,12 +1024,6 @@ export function proofDetailOf(detail) {
         return null;
     return { at: parts[0], digest: parts[2].slice("digest ".length) };
 }
-/**
- * A person's approval of this task as it stands: approved, on the current digest, by the ceremony (`password`) or a
- * paired-chat tap (`chat`), with a person's proof recorded for that approver and those exact bytes. Release, deploy
- * and the protected-work counters ask this; a lead, a mode, a grant, a schedule or an approval with no proof is not
- * a person's.
- */
 export function personApprovalOf(store, taskId) {
     const scope = store.getScope(taskId);
     if (scope === null || scope.approvedAt === null || scope.approvedBy === null || scope.approvedDigest === null)
@@ -1509,17 +1044,6 @@ export function personApprovalOf(store, taskId) {
         return { ok: false, why: "no record shows a person approved these exact words; approve it again" };
     return { ok: true, by: scope.approvedBy, at: scope.approvedAt, method: origin.method };
 }
-/**
- * Who made a seal that says it came through a person's road (`password`, `chat`), from the acts recorded AT THAT SEAL
- * (approval policy §1.5): the proof rows its approver left at the seal's own instant, and the lead's task act then.
- * - `machine`: any proof there that isn't a person's (a lead or remote token, or a word this code doesn't know), or the
- *   lead's act — fail closed, whatever its digest says;
- * - `person`: a person's proof there for these exact bytes (parsed, either form);
- * - `automation`: a standing order's firing that no person's proof stands behind;
- * - `unproven`: none of these (a seal from before proof rows): it dispatches as before, and is never a person's yes.
- * An older proof for the same bytes never vouches for a later seal. The dispatch belts ask the same in SQL
- * (approval-authority.ts).
- */
 export function sealOriginOf(store, taskId, by, digest, at) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? AND at = ? ORDER BY id DESC").all(taskId, APPROVAL_PROOF, by, at);
     const leadAct = store.handle.prepare(`SELECT 1 AS hit FROM task_act a JOIN task_ref r ON r.id = a.task_ref AND r.backend = 'built-in'
@@ -1534,33 +1058,18 @@ export function sealOriginOf(store, taskId, by, digest, at) {
         return { origin: "automation" };
     return { origin: "unproven" };
 }
-/** Text another machine wrote (a confirmed chat proposal, a coordinator, a scout): no mode, grant, remembered password
- * or chat tap seals it. The lead's own CLI text (`lead`) is not quarantined. */
 export const quarantinedAuthor = (via) => via === "mate" || via === "coordinator" || via === "scout";
-/** Which states each action may start from (deploy and merge also resume their own reservation). */
 const RELEASE_ACTION_STATES = {
     dispatch: ["open"], complete: ["open"], deploy: ["open", "deploying"], merge: ["deploying", "merge-reserved"],
 };
-/**
- * Whether a task that belongs to a release authority may do `action` now. It applies to EVERY such task, whether its
- * seal is the person's own or `carried`, and requires all of: the authority's current generation (never superseded,
- * revoked or expired before it started); a state that fits the action; the task is the authority's current tip; the
- * anchor's seal is a person's (personApprovalOf, unchanged) on the exact sealed anchor digest; the anchor's approver is
- * still an active approver with access to the project; for a carried task, a carry row for exactly this task, scope
- * digest, candidate and generation; the release check grant and check access as sealed (access only ever the fence);
- * a sealed policy this runtime knows; and, for deploy and merge, no open main-check failure blocking a composed check.
- * A task that belongs to no release reads `applies: false` — the ordinary rules decide it.
- */
 export function liveReleaseOf(store, taskId, action, now = new Date()) {
     const found = releaseAuthorityOfTask(store, taskId);
     if (found === null)
         return { applies: false };
     const { authority: a, carry } = found;
     const refuse = (why) => ({ applies: true, ok: false, why, authority: a });
-    // A put-away task (v145, task-tidy.md), or a put-away anchor, deploys, merges and carries nothing: restore it first.
     if (taskArchived(store, taskId) || taskArchived(store, a.anchorTask))
         return refuse("the release task is put away");
-    // A cancelled task, or a cancelled anchor, the same: cancelling ends what its approval allows.
     if (taskCancelled(store, taskId) || taskCancelled(store, a.anchorTask))
         return refuse("the release task was cancelled");
     const newest = newestReleaseGeneration(store, a.repo, a.version, a.pr);
@@ -1570,7 +1079,6 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
         return refuse("a newer approval of this release replaced this one");
     if (a.state === "revoked")
         return refuse(`${a.endedBy ?? "an approver"} stopped carrying commits for this release`);
-    // Expiry stops every live state (security review): an operation already reserved finishes only through reconciliation.
     if (releaseStateAt(a, now) === "expired")
         return refuse("the release approval expired");
     if (a.state === "merged")
@@ -1580,7 +1088,6 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     if (a.tipTask !== taskId)
         return refuse("this is not the release's current commit");
     const anchor = store.getScope(a.anchorTask);
-    // A person's yes, or the plane's own automatic one while the project still approves releases automatically.
     const person = releaseApprovalOf(store, a.anchorTask, now);
     if (!person.ok)
         return refuse(`the release approval no longer stands: ${person.why}`);
@@ -1602,8 +1109,6 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     const grant = store.liveVerifyCommand(a.repo);
     if (grant === null || grant.id !== a.verifyCommand || grant.digest !== a.verifyDigest)
         return refuse("the release check command changed since the approval");
-    // The checks reach no further than at the approval. Wider than the sandbox, a carried commit stands only while both
-    // the sealed and the current "Carry release approvals when checks aren't sandboxed" allow it (the stricter of the two).
     const access = store.projectCheckAccess(a.repo);
     const sealedWidth = CHECK_ACCESS_WIDTH[a.accessDigest], nowWidth = CHECK_ACCESS_WIDTH[access];
     if (sealedWidth === undefined || nowWidth === undefined || nowWidth > sealedWidth)
@@ -1620,10 +1125,6 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     }
     return { applies: true, ok: true, authority: a, carry };
 }
-/**
- * Open main-check failures (the nightly full check, part 3) block the deploy and the merge of a release whose gate
- * check was composed from a targeted run: a full pass is needed first. Null when nothing blocks.
- */
 export function mainDebtProblem(store, repo, taskId) {
     const open = Number(store.handle.prepare("SELECT COUNT(*) AS n FROM main_check_failure WHERE repo = ? AND cleared_at IS NULL").get(repo)?.["n"] ?? 0);
     if (open === 0)
@@ -1637,31 +1138,12 @@ export function mainDebtProblem(store, repo, taskId) {
         return null;
     return `the nightly full check on main has ${open} open failure${open === 1 ? "" : "s"}, so a check made from a re-run of what failed can't deploy; a full check has to pass first`;
 }
-/**
- * A deploy gate (docs/plans/chat-management.md §0a.5): a scope whose signed terms name a prepared candidate or carry
- * release terms. Both are in the scope digest and written at filing, before any release authority exists, so this is
- * read from the scope alone: a first approval and a fallback gate filed without --release are deploy gates too. From
- * chat it is approved only through the release card.
- */
 export function deployGateScope(scope) {
     return (scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null;
 }
-/**
- * Whether a scope's check is a release's check (docs/plans/pipeline-speed.md, P0): it carries signed release terms, or a
- * release check purpose sealed with it. Read from the scope's signed fields only, independent of whether the release can
- * carry. It makes the check stricter (a complete, valid report; CI never stands in for its units) and, through
- * check-failure.ts recheckReleaseTask, lets the plane rerun the identical candidate after confirmed infrastructure; it
- * never carries a later commit or approves anything.
- */
 export function releaseCheckScope(scope) {
     return scope !== null && ((scope.releaseTerms ?? null) !== null || (scope.releaseCheck ?? null) !== null);
 }
-/**
- * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
- * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
- * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
- * and the person who turned it on still an approver there. Never a person's approval.
- */
 export function autoReleaseApprovalOf(store, taskId, kind) {
     const scope = store.getScope(taskId);
     const ref = store.lookupRef(taskId);
@@ -1683,8 +1165,6 @@ export function autoReleaseApprovalOf(store, taskId, kind) {
         return { ok: false, why: `${scope.approvedBy}, who turned on automatic release approval, can no longer approve in this project` };
     return { ok: true, by: scope.approvedBy, at: scope.approvedAt, evidence };
 }
-/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
- * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
 export function releaseApprovalOf(store, taskId, _now = new Date()) {
     const person = personApprovalOf(store, taskId);
     if (person.ok)
@@ -1694,8 +1174,6 @@ export function releaseApprovalOf(store, taskId, _now = new Date()) {
     const auto = autoReleaseApprovalOf(store, taskId, "auto-green");
     return auto.ok ? { ok: true, by: auto.by, at: auto.at, method: "auto-green" } : auto;
 }
-/** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
- * only: freshnessFor decides whether it stands in, at the moment of use. */
 export function freshUntil(at) {
     const ms = Date.parse(at);
     return Number.isFinite(ms) ? new Date(ms + FRESH_WINDOW_MS).toISOString() : null;
@@ -1709,52 +1187,16 @@ const LOCAL_APPROVAL_WORDS = {
     escalated: "Work with wider permissions needs your password.",
     coordinator: "Work a coordinator filed needs your password.",
     unsandboxed: "This project's checks run without a sandbox, so approving needs your password.",
+    imported: "A task from outside needs your password.",
 };
-/**
- * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
- * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
- * precheck (an empty field passes) and the seal itself (approve(), inside its transaction). Refused: local mode off or
- * another person; no plan; release or deploy terms; protected or two-person work; an escalated profile; work a
- * coordinator filed; a project whose checks are stored as unsandboxed (or a plan that sealed that). Plans a lead or
- * a scout proposed are allowed.
- */
 export function localApprovalEligible(store, by, taskId) {
-    const no = (reason) => ({ ok: false, reason, message: LOCAL_APPROVAL_WORDS[reason] });
-    if (!localModeOn(store))
-        return no("local-mode-off");
-    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
-    if (owner !== by)
-        return no("not-owner");
-    const scope = store.getScope(taskId);
-    if (scope === null)
-        return no("no-scope");
-    if (deployGateScope(scope) || releaseCheckScope(scope))
-        return no("release");
-    const gate = store.approvalGate(taskId, by, "person");
-    if (gate.verdict !== "seal" || gate.protectedWork)
-        return no("protected");
-    if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
-        return no("escalated");
-    const ref = store.handle.prepare("SELECT repo, coordinator_cid FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
-    if (ref === undefined || ref["coordinator_cid"] != null)
-        return no("coordinator");
-    // The stored level, never the launch cap: a project saved as unsandboxed is refused even though local mode confines it.
-    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
-    if (stored === "unsandboxed" || scope.profile.checkAccess === "unsandboxed")
-        return no("unsandboxed");
-    return { ok: true };
+    return localWorkEligible(store, by, taskId, { act: "approve" });
 }
-// ---- Fallback chains (fallback.ts). Kept last too.
-/** A chain that may dispatch: version 2, a base and at least one fallback. An older chain is history, never this. */
 export function liveChainFromJson(json) {
     const chain = chainFromJson(json, LIVE_CHAIN_VERSION);
     return chain === null || chain.length < 2 ? null : chain;
 }
-// The chain's four providers by name, here rather than provider-auth.ts: this file sits under the contracts, and that one
-// loads every adapter.
 const CHAIN_AGENT_NAMES = { claude: "Claude", codex: "Codex", gemini: "Gemini", openrouter: "OpenRouter" };
-/** The chain in full, the words a yes agrees to: order, agent, model, how it bills, what it may do, and whether Toolroll
- * can see it run out. Every approval surface shows these lines; empty for a scope with no chain. */
 export function chainTermsLines(scope) {
     const chain = liveChainFromJson(scope.proposedChainJson ?? null);
     if (chain === null)
@@ -1768,3 +1210,83 @@ export function chainTermsLines(scope) {
         }),
     ];
 }
+const LOCAL_COMPLETION_WORDS = {
+    "local-mode-off": "Local mode is off, so accepting this result needs your password.",
+    "not-owner": "Only this computer's owner accepts results here without a password.",
+    "no-scope": "This task has no plan, so accepting its result needs your password.",
+    release: "Accepting a release needs your password.",
+    protected: "This result is protected work, so accepting it needs your password and a second person.",
+    escalated: "Work with wider permissions needs your password.",
+    coordinator: "Work a coordinator filed needs your password to accept.",
+    unsandboxed: "This project's checks run without a sandbox, so accepting needs your password.",
+    imported: "A task from outside needs your password to accept.",
+};
+const LOCAL_PLAN_WORDS = {
+    "local-mode-off": "Local mode is off, so asking for a plan needs your password.",
+    "not-owner": "Only this computer's owner asks for plans here without a password.",
+    "no-scope": "This task has nothing to plan yet.",
+    release: "Planning a release needs your password.",
+    protected: "This is protected work, so planning it needs your password.",
+    escalated: "Work with wider permissions needs your password to plan.",
+    coordinator: "Work a coordinator filed needs your password to plan.",
+    unsandboxed: "This project's checks run without a sandbox, so planning needs your password.",
+    imported: "A task from outside needs your password to plan.",
+};
+const LOCAL_RETRY_WORDS = {
+    "local-mode-off": "Local mode is off, so retrying needs your password.",
+    "not-owner": "Only this computer's owner retries builds here without a password.",
+    "no-scope": "This task has no approved plan to build again.",
+    release: "Retrying a release needs your password.",
+    protected: "This is protected work, so retrying it needs your password.",
+    escalated: "Work with wider permissions needs your password to retry.",
+    coordinator: "Work a coordinator filed needs your password to retry.",
+    unsandboxed: "This project's checks run without a sandbox, so retrying needs your password.",
+    imported: "A task from outside needs your password to retry.",
+};
+export function localWorkEligible(store, by, taskId, purpose) {
+    const words = purpose.act === "approve" ? LOCAL_APPROVAL_WORDS : purpose.act === "complete" ? LOCAL_COMPLETION_WORDS : purpose.act === "plan" ? LOCAL_PLAN_WORDS : LOCAL_RETRY_WORDS;
+    const no = (reason) => ({ ok: false, reason, message: words[reason] });
+    if (!localModeOn(store))
+        return no("local-mode-off");
+    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
+    if (owner !== by)
+        return no("not-owner");
+    const scope = store.getScope(taskId);
+    if ((purpose.act === "approve" || purpose.act === "retry") && scope === null)
+        return no("no-scope");
+    if (scope !== null && (deployGateScope(scope) || releaseCheckScope(scope)))
+        return no("release");
+    if (purpose.act !== "approve" && (belongsToRelease(store, taskId) || releaseAuthorityOfTask(store, taskId) !== null))
+        return no("release");
+    const ref = store.handle.prepare("SELECT repo, coordinator_cid, permission_mode FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
+    if (purpose.act === "approve" || purpose.act === "retry") {
+        const gate = store.approvalGate(taskId, by, "person");
+        if (gate.verdict !== "seal" || gate.protectedWork)
+            return no("protected");
+        if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
+            return no("escalated");
+    }
+    else if (purpose.act === "plan") {
+        const gate = store.approvalGate(taskId, by, "person");
+        if (gate.verdict !== "seal" || gate.protectedWork)
+            return no("protected");
+        if ((scope?.profile != null && levelOfProfile(scope.profile) === "escalated") || ref?.["permission_mode"] === "bypassPermissions")
+            return no("escalated");
+    }
+    else if (ref !== undefined && ref["repo"] != null) {
+        const rules = store.approvalRules(String(ref["repo"]));
+        if ((rules.protectProject || rules.protectedPaths.length > 0)
+            && (isProtectedWork(rules, scope?.touches ?? []) || purpose.changed === null || protectedChanges(rules, purpose.changed).length > 0))
+            return no("protected");
+    }
+    if (ref === undefined || ref["coordinator_cid"] != null)
+        return no("coordinator");
+    if (purpose.act === "complete")
+        return { ok: true };
+    if ((purpose.act === "plan" || purpose.act === "retry") && issueImported(store, taskId))
+        return no("imported");
+    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
+    if (stored === "unsandboxed" || scope?.profile?.checkAccess === "unsandboxed")
+        return no("unsandboxed");
+    return { ok: true };
+}