toolroll 0.9.103 → 0.9.105

package/dist/assignment-ui.js

@@ -4,8 +4,6 @@ import { chatResultHref } from './chat-controls.js';
 import { startBuilderHref } from './needs-you.js';
 import { statusDetailsHtml, statusWhyHtml } from './task-status.js';
 import { html } from './html.js';
-/** The existing verified receipt reader may discover damage after a verdict
- * was saved. Keep the limitation visible without inventing another work stage. */
 export function assignmentWithEvidence(assignment, resultStatus, resultRunId = assignment.receipt?.runId ?? null) {
     if (resultStatus?.token !== 'evidence-damaged')
         return assignment;
@@ -18,7 +16,6 @@ export function assignmentStatusOf(assignment, workStatus) {
     return assignmentPresentationOf(assignment, workStatus === undefined ? {} : { workStatus }).status;
 }
 const taskHref = (assignment, taskId) => `/t/${encodeURIComponent(assignment.rootId)}?version=${encodeURIComponent(taskId)}`;
-/** Navigation only. A control action still opens its existing exact ceremony. */
 export function assignmentActionHref(assignment) {
     const action = assignment.primaryAction;
     if (action === null)
@@ -32,7 +29,6 @@ export function assignmentActionHref(assignment) {
         return '/';
     if (action.code === 'sign-in')
         return '/settings/agents#providers';
-    // The confirmation sits on the task page, behind the password.
     if (action.code === 'recheck-stopped')
         return `/t/${encodeURIComponent(assignment.rootId)}#recheck-stopped`;
     if (action.code === 'open-pr' && /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/pull\/\d+$/.test(assignment.publication?.prUrl ?? ''))
@@ -42,19 +38,16 @@ export function assignmentActionHref(assignment) {
     }
     if (runId !== null && (action.code === 'inspect-run' || action.code === 'reconcile-run'))
         return `/r/${runId}`;
-    // The task page only repeats that no builder is connected: lead to the command that connects one.
     if (action.code === 'start-worker')
         return startBuilderHref(taskId);
     const anchor = action.code === 'approve-scope' ? '#approve'
         : action.code === 'inspect-stop' || action.code === 'resume-run' ? '#task-control'
-            // Retry (and Build again) is the task's status card itself, at the top: no anchor to its options.
             : action.code === 'unhold' ? '#task-actions'
                 : action.code === 'write-scope' || action.code === 'select-agent' ? '#scope'
                     : action.code === 'inspect-hold' ? '#holds'
                         : action.code === 'repair-dependency' ? '#run-status' : '';
     return taskHref(assignment, taskId) + anchor;
 }
-/** Every version of the assignment, oldest first, as the card lists them. */
 export function assignmentAttemptsOf(assignment) {
     return assignment.attempts.map((attempt, index) => ({
         taskId: attempt.taskId, label: `${index === 0 ? 'Original' : `Correction ${index}`} · ${attempt.label}`,
@@ -67,8 +60,6 @@ export function assignmentAttemptsHtml(assignment) {
         return html ``;
     return html `<details class="assignment-attempts"><summary>Attempts <span class="meta">${assignment.attempts.length}</span></summary><ol>${assignmentAttemptsOf(assignment).map(attempt => html `<li data-attempt-task="${attempt.taskId}" data-history-version="${attempt.taskId}"><a href="${attempt.href}">${attempt.label}</a>${attempt.runId === null ? '' : html ` <a href="/r/${attempt.runId}">Build #${attempt.runId}</a>`}${attempt.detail === null ? '' : html `<p class="meta">${attempt.detail}</p>`}</li>`)}</ol>${assignment.owner === null ? '' : html `<p class="meta">Lead: ${assignment.owner.label}${assignment.owner.active ? '' : ' · access ended'}</p>`}<p class="work-meta work-id">Task <span class="mono">${assignment.rootId}</span></p></details>`;
 }
-/** Only recognized storage limits and explicitly identified older records are
- * secondary. Unknown findings and damaged current material stay in view. */
 function savedMaterialNotice(detail, assignment) {
     if (shortenedMaterialReason(detail))
         return 'partial';
@@ -78,8 +69,6 @@ function savedMaterialNotice(detail, assignment) {
 }
 export function assignmentCardOf(assignment, options = {}) {
     const receipt = assignment.receipt;
-    // The checks live on the one result page (a failed build has one too), where Run checks runs in place; never Chat,
-    // which would only lead back to this card.
     const checksPage = receipt === null ? null : `/review?result=${encodeURIComponent(receipt.taskId)}&run=${receipt.runId}&tab=checks`;
     const links = receipt === null ? {} : { result: options.resultHref ?? chatResultHref(receipt.taskId, receipt.runId), checks: checksPage,
         pullRequest: `/t/${encodeURIComponent(assignment.rootId)}#merge`,
@@ -108,5 +97,4 @@ export function assignmentSummaryHtml(assignment, options = {}) {
     const tone = card.status.tone;
     return html `<section class="${options.compact ? 'assignment-summary' : 'card assignment-summary'}" aria-label="assignment progress" data-assignment="${assignment.rootId}" data-work-status="${card.token}" data-tone="${card.tone}" data-headline="${card.status.headline}" data-headline-tone="${tone}"${options.compact ? '' : html ` data-task-status`}>${options.compact ? html `<span class="status-line" data-work-status="${card.token}" data-tone="${card.tone}"><i class="status-dot" aria-hidden="true"></i><span class="status-label">${card.label}</span></span>` : html `<h2 class="assignment-state status-headline"><i aria-hidden="true"></i>${card.label}</h2>`}<p class="meta assignment-detail status-sentence">${options.sentence ?? card.status.sentence}</p>${card.action === null ? '' : html `<a class="${options.compact ? 'work-action' : 'button-link'}" href="${card.action.href}"${card.action.openResult ? html ` data-open-result` : ''}${options.compact ? '' : html ` data-primary-action`}>${card.action.label}${options.compact ? ' →' : ''}</a>`}${options.compact ? '' : statusDetailsHtml(card.status)}${statusWhyHtml(card.status, card.reasons, card.diagnostics)}${card.notices === null ? '' : html `<details class="assignment-notices"><summary>${card.notices.summary}</summary>${card.notices.lines.map(one => html `<p class="meta">${one}</p>`)}</details>`}${assignmentAttemptsHtml(assignment)}</section>`;
 }
-/** Shared assignment layout; actions remain comfortable on touch screens. */
 export const ASSIGNMENT_CSS = `.assignment-summary{min-width:0;overflow-wrap:anywhere}.assignment-summary .assignment-state{font-weight:600;margin:0}.assignment-summary h2.assignment-state{font-size:1.125rem;color:var(--foreground)}.assignment-summary>.assignment-attempts,.assignment-summary>.assignment-notices{border:0;box-shadow:none;padding:0;margin:.25rem 0 0;background:transparent}.assignment-summary>.button-link{margin-top:.7rem;min-height:44px}.assignment-summary>.work-action{display:inline-flex;margin-inline-start:.6rem;min-height:44px;align-items:center}.assignment-detail{margin:.55rem 0}.assignment-attempts summary,.assignment-notices summary{min-height:44px;display:list-item;align-content:center;cursor:pointer}.assignment-notices summary{font-size:.8125rem;color:var(--foreground)}.assignment-notices p{margin:.25rem 0 .5rem}.assignment-attempts ol{padding-left:1.4rem}.assignment-attempts li{margin:.4rem 0}.assignment-attempts li a{display:inline-flex;align-items:center;min-height:44px;margin-right:.7rem}.assignment-attempts li p{margin:0 0 .4rem}`;

package/dist/assignment.js

@@ -1,6 +1,3 @@
-/** One assignment follows the existing task family. It owns no execution,
- * approval or proof state. Lead ownership and exact receipt acknowledgments
- * are append-only actions; handoffs use the existing durable outbox. */
 import { fastCompletionProblem } from "./fast-start.js";
 import { createHash } from "node:crypto";
 import { currentActor, withActor } from "./actor.js";
@@ -8,12 +5,13 @@ import { replacedWords } from "./task-status.js";
 import { COMPLETER_ACTOR, COMPLETION_ACTION, COMPLETION_BY_MACHINE, COMPLETION_BY_PERSON, familyChangedFiles, landedReasonOf, personCompletionOwed } from "./result-completion.js";
 import { homedir } from "node:os";
 import { readSchemaVersion, refArchived, stopFactOf } from "./store.js";
-import { approvalOf, liveReleaseOf, machineActing } from "./scope.js";
+import { approvalOf, liveReleaseOf, localWorkEligible, machineActing } from "./scope.js";
+import { LOCAL_OWNER_LAPSED, currentLocalOwner, localActNow, localOwnerInFlight, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
 import { openWorkDecisionOf, taskWorkSummaryOf, workDecisionAction } from "./work-summary.js";
 import { evidenceRoot, readVerifiedArtifact, readVerifiedReport, verifyArtifact } from "./evidence.js";
 import { sweepIfMoved } from "./sweep-gate.js";
 import { verificationEvidence } from "./verification-evidence.js";
-import { reproveApprover } from "./principal.js";
+import { reproveApprover, verifyApproverStanding } from "./principal.js";
 import { noteAssignmentStatus } from "./assignment-status.js";
 import { historicalAssessmentReason } from "./assignment-presentation.js";
 import { manualReviewOnly, shownVerdictOf } from "./proof.js";
@@ -25,8 +23,6 @@ import { NEEDS, WAITS, processNeedOf, resultHoldUpSentence } from "./needs-you.j
 import { assignmentStageOf, checkBackingOf, completionBlockersOf, receiptChecksOf, requirementWordOf } from "./task-status.js";
 import { releaseCoverageOf } from "./release-coverage.js";
 import { leadClaimOf } from "./lead-voice.js";
-/** Status-first handoff for routine reads. Fetch get_assignment only when
- * inspecting its exact evidence; do not repeat a full proof in every poll. */
 export function assignmentBrief(assignment) {
     if (assignment === null)
         return null;
@@ -41,8 +37,6 @@ export function assignmentBrief(assignment) {
         publication: assignment.publication, review: assignment.review, deployment: assignment.deployment, readiness: assignment.readiness ?? null };
 }
 const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
-/** A lookup added with lead-quiet, read safely: a deploy proves completion with this code over the INSTALLED runtime's
- * store, before this version's migration, so the method (or its table) may not exist yet. Absent reads as none. */
 function olderStoreSafe(read, absent) {
     try {
         return read();
@@ -53,14 +47,11 @@ function olderStoreSafe(read, absent) {
         throw error;
     }
 }
-/** A check as the receipt digest seals it: presentation-only fields (check-levels.ts) left out. */
 const sealedChecks = ({ level: _level, running: _running, batch: _batch, release: _release, cause: _cause, ...proof }) => proof;
 const OWNER_ACTION = "assignment claimed";
 const CHECK_ACTION = COMPLETION_ACTION;
 const actorOf = (owner) => `${owner.kind}:${owner.id}`;
 function ownerOf(store, rootId, repo) {
-    // The release verifier reads the new projection against the still-running
-    // v70 Store before migrating a backup. That read cannot invent team tables.
     const hasTeam = store.handle.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='team_task_owner'").get() !== undefined;
     if (!hasTeam) {
         const version = readSchemaVersion(store.handle);
@@ -75,18 +66,15 @@ function ownerOf(store, rootId, repo) {
     const id = claim === undefined ? origin : String(claim["actor"]).replace(/^coordinator:/, "");
     if (!id)
         return null;
-    // A ledger actor names a coordinator by the id it had when it acted (v118 keeps that as public_id).
     const credential = store.handle.prepare("SELECT name,projects_json AS repos,revoked_at FROM credential WHERE kind = 'coordinator' AND (id = ? OR public_id = ?) ORDER BY id = ? DESC LIMIT 1").get(id, id, id);
     let repos = [];
     try {
         repos = JSON.parse(String(credential?.["repos"] ?? "[]"));
     }
-    catch { /* unavailable owner stays inactive */ }
+    catch { }
     return { kind: "coordinator", id, label: String(credential?.["name"] ?? "Former lead"),
         active: credential !== undefined && credential["revoked_at"] === null && repo !== null && Array.isArray(repos) && repos.includes(repo) };
 }
-// Report the recorded check outcome, never turn a model verdict into a check.
-// Follow-up checks on the same commit (Run checks) upgrade a pass and show a failure.
 export function assignmentChecksForRun(store, root, runId, now) {
     const own = recordedFailureStands(store, runId, buildChecks(store, root, runId));
     const run = store.getRun(runId);
@@ -97,7 +85,6 @@ export function assignmentChecksForRun(store, root, runId, now) {
     const latest = [...followUps].reverse().find(one => one.state === "passed" || one.state === "failed");
     const changed = read.status !== own.status || read.level !== (own.level ?? null) || read.exitCode !== own.exitCode;
     const words = read.level === "quick" ? "Quick checks" : "Checks";
-    // A batch check: waiting for its batch, or how the latest finished one was checked and on which commit.
     const waitingBatch = followUps.some(one => one.why === "batch" && one.state === "waiting");
     const sealedBatch = latest?.batch ?? null;
     const batch = waitingBatch ? { state: "waiting", tested: null, peers: [] }
@@ -107,8 +94,6 @@ export function assignmentChecksForRun(store, root, runId, now) {
         ...(changed ? { status: read.status, level: read.level, exitCode: read.exitCode, logArtifactId: latest?.logArtifactId ?? own.logArtifactId,
             detail: read.status === "passed" ? `${words} passed.` : `${words} failed (exit ${read.exitCode}).` } : {}) };
 }
-/** A failure the builder recorded (run_check) stands when its saved receipt can't be read now or says nothing ran:
- * fail closed, every surface reads the same known failure and its exit code (task-status.ts approvedCheckOf). */
 function recordedFailureStands(store, runId, own) {
     if (own.status !== "unavailable" && own.status !== "not-run")
         return own;
@@ -127,7 +112,6 @@ function buildChecks(store, root, runId) {
     try {
         const gate = verificationEvidence(store, root, runId);
         if (!gate.ok) {
-            // The approved command changed since this check ran: nothing is missing, the check just no longer binds to it.
             const run = store.getRun(runId), repo = run === null ? null : store.refById(run.taskRef)?.repo ?? null;
             const live = repo === null ? null : store.liveVerifyCommand(repo);
             const changed = gate.problem === COMMAND_MISSING_OR_CHANGED && live !== null && run !== null && live.approvedAt > run.startedAt;
@@ -137,14 +121,12 @@ function buildChecks(store, root, runId) {
         if (receipt === null)
             return { ...unavailable(level === "off" ? "Checks were off for this build." : "No machine check is recorded."), status: "not-run" };
         const ran = receipt.result.ran === true, exitCode = ran ? receipt.result.exitCode : null;
-        // A release check whose coverage fell short (release-once.md) failed, whatever its command exited with.
         if (receipt.result.failure === "coverage-incomplete")
             return { status: "failed", exitCode: null, command: receipt.command.command, logArtifactId: receipt.log.artifactId, level,
                 detail: "Checks didn't cover everything this release owed, or a required test went missing." };
         if (receipt.result.failure === "no-result")
             return { status: "failed", exitCode: null, command: receipt.command.command, logArtifactId: receipt.log.artifactId, level,
                 detail: "Checks gave no complete result, so they can't count as a pass." };
-        // The sealed receipt names the grant that ran: the quick one, or the full one.
         const sealedLevel = typeof receipt.command?.repo === "string" && receipt.command.repo.startsWith("quick:") ? "quick" : "full";
         const words = sealedLevel === "quick" ? "Quick checks" : "Checks";
         return { status: ran ? exitCode === 0 ? "passed" : "failed" : "not-run", exitCode,
@@ -169,18 +151,13 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
     const scope = store.getScope(current.id);
     const owner = ownerOf(store, family.root.id, current.repo);
     const attention = family.problem === null ? [] : [family.problem];
-    // Family admission above precedes question bodies. The newest result
-    // does not settle an unanswered question on any earlier version.
-    // A put-away earlier version (v145) is history: its question and its queue place never hold the current one up.
     const questions = [current, ...family.versions.filter(version => version.id !== current.id && !refArchived(store, version.refId))].flatMap(version => {
         const decision = openWorkDecisionOf(store, version.refId, now);
         return decision === null ? [] : [{ taskId: version.id, decision }];
     });
-    // A finished task label cannot hide a lease or an unfinished process record.
     const busy = (version) => version.state === "running" || store.currentLiveLease(version.refId, now) !== null ||
         store.runsFor(version.refId).some(run => run.outcome === null || store.stopQuiescenceProblem(run.id) !== null);
     const earlierActive = family.versions.filter(version => version.id !== current.id && ((version.state === "queued" && !refArchived(store, version.refId)) || busy(version)));
-    // Of those, how many have work under way (the rest only wait in the queue).
     const earlierRunning = earlierActive.filter(busy).length;
     const unfinished = store.runsFor(current.refId).find(run => run.outcome === null) ?? null;
     const attempts = family.versions.map(version => {
@@ -193,13 +170,10 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
     const unavailable = family.versions.flatMap(version => store.runsFor(version.refId).flatMap(run => store.artifactsFor(run.id).filter(artifact => root === undefined || !verifyArtifact(root, artifact).ok)
         .map(artifact => `Saved ${artifact.kind} #${artifact.id} (run ${run.id}) is unavailable or changed.`)));
     const ownChecks = result === null ? null : assignmentChecksForRun(store, root, result.id, now);
-    // Checks Off: a passing full release check that contains this commit covers it, read now from the existing receipts.
     const checks = ownChecks === null || ownChecks.level !== "off" || ownChecks.status === "passed" || ownChecks.status === "failed" ? ownChecks
         : { ...ownChecks, release: releaseCoverageOf(store, root, current.repo, result.headRevision, memo === undefined ? {} : { memo }) };
     const finishedBuild = result?.role === "builder" && (result.outcome === "built" || result.outcome === "no-change") &&
         result.finishedAt !== null && /^[a-f0-9]{40}$/.test(result.headRevision ?? "");
-    // Finished work returns to its lead or user. Strict terms and previous model
-    // judgments stay recorded; neither is a second execution stage for handoff.
     const completionKind = result?.role === "scout" && result.outcome === "built" && result.finishedAt !== null ? "research-report"
         : finishedBuild && acceptance !== null ? "accepted-exception"
             : finishedBuild ? checks?.status === "passed" ? "checked-build" : "finished-build" : null;
@@ -208,17 +182,12 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
         head: result.headRevision, scopeDigest: result.scopeDigest ?? null, proof, completionKind, proofAcceptance: acceptance, checks: checks,
         artifacts: artifacts.map(a => ({ id: a.id, kind: a.kind, sha256: a.sha256, bytes: a.bytesStored,
             complete: !a.truncated && a.captureStatus !== "failed" })),
-        // Stored verdict limitations are separate from the agent's outcome.
-        // Full agent caveats remain in the referenced proof artifact.
         caveats: [...(proof?.reasons ?? []), ...unavailable,
             ...(completionKind === "research-report" && reports.length !== 1 ? ["The report artifact is missing or ambiguous."] : []), ...(completionKind === "accepted-exception" && !artifacts.some(a => a.kind === "proof") ? ["No builder proof artifact is recorded."] : []),
             ...(artifacts.some(a => a.kind === "check-log" && a.truncated) ? ["The check log was shortened when stored; only the retained output is available."] : []),
             ...artifacts.filter(a => a.kind !== "check-log" && (a.truncated || a.captureStatus === "failed")).map(a => `Saved ${a.kind} #${a.id} is ${a.captureStatus === "failed" ? "a failed capture" : "incomplete"}.`)],
         agentReport: result.handoff, evidence: "recorded",
     };
-    // The digest seals the proof, not how it is shown: the check's `level` (read from its sealed command) and `running`
-    // (a follow-up in flight) stay out of it, so a result completed before check levels keeps its completion, and a
-    // follow-up check that is still running never unseals one.
     const sealedBody = receiptBody === null ? null : { ...receiptBody, checks: sealedChecks(receiptBody.checks) };
     const receipt = receiptBody === null ? null : { ...receiptBody, digest: digest({ receipt: sealedBody,
             scope: scope === null ? null : { digest: scope.digest, approved: approvalOf(scope).approved, termsProblem: scope.termsProblem ?? null },
@@ -231,12 +200,7 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
     const processFact = result === null ? null : stopFactOf(store, result.id);
     const processProblem = processFact?.problem ?? null;
     let need = null;
-    // The exact completed result, scope, family and custody fences apply to
-    // every deliverable. Human acceptance remains its own recorded authority;
-    // it never changes a machine verdict or supplies a missing report.
-    // Kept out of the sealed receipt (sealedChecks): the review never changes the result's digest.
     const review = result === null ? null : olderStoreSafe(() => buildReviewOf(store, result.id), null);
-    // A result under its one automatic review has not reached the person yet.
     const reviewing = review?.state === "pending" && current.state === "done";
     const ready = !reviewing && current.state === "done" && result !== null && completionKind !== null &&
         scope !== null && scope.termsProblem == null && approvalOf(scope).approved && scope.digest === result.scopeDigest &&
@@ -253,9 +217,6 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
             : { code: "inspect-task", label: `Open ${successor}`, target: { taskId: successor, runId: null, decisionId: null }, access: "read", retry: "read-again" };
     }
     else if (!live && processFact !== null && result !== null) {
-        // Toolroll hasn't yet proven the build stopped. It proves that itself
-        // (stop-proof.ts), so the work waits, needing no one; only when this
-        // computer can't look is it held, offering Check again — never a vouch.
         const process = processNeedOf(processFact);
         if ("need" in process) {
             state = "needs-decision";
@@ -292,9 +253,6 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
         primaryAction = { code: "open-result", label: completionKind === "research-report" ? "Read report" : "Open result", target: { taskId: current.id, runId: result.id, decisionId: null }, access: "read", retry: "read-again" };
         const checked = store.handle.prepare("SELECT actor,at,detail FROM action_ledger WHERE task_id = ? AND run_id = ? AND action = ? AND outcome = ? AND source = 'work' ORDER BY id DESC")
             .all(family.root.id, result.id, CHECK_ACTION, receipt.digest).find(row => COMPLETER_ACTOR.test(String(row["actor"])));
-        // This ledger fact was authorized when written. Credential rotation,
-        // membership changes and ownership transfer cannot revoke past completion.
-        // The exact result digest still fences changes to work, scope and history.
         if (checked !== undefined) {
             const rootRef = store.lookupRef(family.root.id);
             const byLead = rootRef !== null && olderStoreSafe(() => store.taskActs(rootRef.id), []).filter(one => one.act === "completed").at(-1)?.lead === true;
@@ -319,7 +277,6 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
                     unapproved: scope === null || scope.termsProblem != null || !approvalOf(scope).approved, question: questions.length > 0,
                     running: store.currentLiveLease(current.refId, now) !== null, unfinished: unfinished !== null,
                     noCommit: result === null || completionKind === null });
-        // Built to an earlier plan: the result page can't resolve it (accepting would leave it stuck), building again can.
         if (current.state === "done" && result !== null && scope !== null && scope.termsProblem == null && approvalOf(scope).approved && !!result.scopeDigest && scope.digest !== result.scopeDigest &&
             store.activeHolds(current.refId, now).length === 0 && unfinished === null && store.currentLiveLease(current.refId, now) === null && store.finalResultReason(result.id) === null) {
             detail = NEEDS.rebuild.sentence({ build: result.id });
@@ -327,9 +284,6 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
                 access: access.principal === "operator" ? "operator-control" : "operator-handoff", retry: "refresh-before-acting" };
             need = { key: "rebuild", build: result.id };
         }
-        // Rewritten after the build and not approved yet: Build again can't start an unapproved plan, so the yes is the
-        // one action (approve-scope opens the approval on the task page); Build again follows it.
-        // Builds only (a scout's report is not built again), and never ahead of an open question: approving answers neither.
         else if (current.state === "done" && result !== null && result.role === "builder" && questions.length === 0 &&
             scope !== null && scope.termsProblem == null && !approvalOf(scope).approved && !!result.scopeDigest && scope.digest !== result.scopeDigest &&
             store.activeHolds(current.refId, now).length === 0 && unfinished === null && store.currentLiveLease(current.refId, now) === null && store.finalResultReason(result.id) === null) {
@@ -345,7 +299,6 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
             state = "needs-decision";
             detail = "Earlier work is still active. Resolve it before completing this assignment.";
             const earlier = earlierActive[0];
-            // The earlier version's act replaces this one's, and with it this version's need (its rebuild or replan).
             need = null;
             primaryAction = taskWorkSummaryOf(store, earlier.id, now, access)?.primaryAction ?? {
                 code: "inspect-task", label: "Review active work", target: { taskId: earlier.id, runId: null, decisionId: null }, access: "read", retry: "read-again",
@@ -354,10 +307,8 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
     }
     if (state === "needs-decision")
         attention.push(detail);
-    // Every Needs you action wears its need's own words (needs-you.ts), on every surface.
     if (state === "needs-decision" && primaryAction !== null && need === null) {
         const read = assignmentStageOf({ state, primaryAction, review }, { token: work.status.token, views: work.status.views });
-        // A result review keeps its own, more specific words (See what is missing, Open the failed check).
         if (read.stage === "needs-you" && read.need !== undefined && read.need !== "other" && read.need !== "review-result")
             primaryAction = { ...primaryAction, label: NEEDS[read.need].action.label };
     }
@@ -388,8 +339,6 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
     const publication = result === null ? null : store.publicationForRun(result.id);
     const lead = state === "complete" || state === "cancelled" || access.principal !== "operator" ? null : leadClaimOf(store, family.root.id, now, access.viewer);
     const readiness = receipt === null ? null : readinessOf(store, receipt, current.repo, review);
-    // Existing saved inputs and output, read only after family admission. Keep
-    // polling briefs small; full reads disclose exactly which excerpts are shortened.
     const planId = result?.planRevision == null ? null : store.getPlanRevision(result.planRevision)?.artifact;
     const plan = planId == null ? store.latestPlanArtifact(current.refId) : store.getArtifact(planId);
     const selected = [plan, ...["terminal-diff", "check-log", "report", "handoff"].map(kind => artifacts.filter(artifact => artifact.kind === kind).at(-1) ?? null)].filter((one) => one !== null);
@@ -406,14 +355,11 @@ export function assignmentOf(store, taskId, now, access, root, memo) {
         publication: publication === null ? null : { state: publication.state, prUrl: publication.prUrl, remoteState: publication.remoteState },
         review, deployment: { status: "not-recorded" }, readiness, ...(need === null ? {} : { need }), ...(lead === null ? {} : { lead }), ...(earlierActive.length === 0 ? {} : { earlierActive: earlierActive.length, earlierRunning }) };
 }
-/** The result's shown verdict and completion blockers (task-status.ts), from the receipt, the project's approved check
- * and the automatic review. A HIGH finding a revision already took is resolved there. */
 function readinessOf(store, receipt, repo, review) {
     const report = receipt.completionKind === "research-report";
     const high = review === null || review.sentBackAs !== null || review.state !== "reviewed" ? 0 : review.high.length;
     const checkRequired = olderStoreSafe(() => requiredCheckCommandFor(store, repo, receipt.taskId, receipt.checks.level), null) !== null;
     const matrix = receipt.proof?.matrix ?? [];
-    // The approved check as every surface reads it: a recorded pass the saved receipt can't show doesn't count.
     const checks = receiptChecksOf(receipt);
     const backing = checkBackingOf(checks);
     const verdict = shownVerdictOf(receipt.proof?.verdict ?? null, { checkFailed: !report && checks?.status === "failed", highFindings: high,
@@ -424,7 +370,7 @@ function readinessOf(store, receipt, repo, review) {
 }
 function admittedOwner(store, taskId, owner, now, root) {
     if (owner.kind !== "coordinator")
-        return null; // A stable lead is identity, not a bearer credential.
+        return null;
     const row = store.handle.prepare("SELECT projects_json AS repos, revoked_at FROM credential WHERE id = ? AND kind = 'coordinator'").get(owner.id);
     if (row === undefined || row["revoked_at"] !== null)
         return null;
@@ -457,8 +403,6 @@ export function claimAssignment(store, taskId, owner, now, root) {
         return { ok: true, assignment };
     });
 }
-/** Diagnostic only: artifact availability does not authorize or block a human
- * handoff. Deployment independently validates its actual native check. */
 export function assignmentEvidenceIntact(store, root, receipt) {
     try {
         const family = store.taskFamilyOf(receipt.taskId, null, true);
@@ -479,50 +423,40 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
     if (!/^[a-f0-9]{64}$/.test(receiptDigest) || current.receipt?.digest !== receiptDigest)
         return { ok: false, reason: "stale", message: "The result changed. Read the current assignment before checking it." };
     const receipt = current.receipt;
-    // The nightly check of main is a check only (release-once.md, part 3): nobody completes it.
     if (store.handle.prepare("SELECT 1 AS hit FROM nightly_check WHERE task = ?").get(current.receipt.taskId) !== undefined)
         return { ok: false, reason: "check-only", message: "The nightly check of main is only a check; it isn't completed." };
-    // Toolroll is still proving its build stopped (stop-proof.ts): a wait that clears on its own, said as one, so a
-    // release waits for it instead of stopping.
     if (current.state !== "ready-to-check" && current.state !== "complete" && current.need != null && "wait" in current.need && STOP_WAITS.has(current.need.wait)) {
         return { ok: false, reason: "stopping", message: `Toolroll is still making sure ${current.need.build === null ? "the build" : `build #${current.need.build}`} stopped. This clears on its own.` };
     }
     if (current.state !== "ready-to-check" && current.state !== "complete")
         return { ok: false, reason: "not-ready", message: "This assignment still has unresolved execution, scope or decisions." };
-    // A release task completes only while its release approval stands for it (release-once.md, liveReleaseOf).
     const release = liveReleaseOf(store, current.receipt.taskId, "complete", now);
     if (release.applies && !release.ok)
         return { ok: false, reason: "release", message: `This release can't be completed: ${release.why}.` };
-    // Who is completing, from trusted context (approval policy §1.7a): a person, or a machine credential (the lead's
-    // token, a remote API run) that may complete ordinary work but is never the second person on protected work.
+    const local = localCompletionRefusal(store, actor, [receipt.taskId, current.rootId], receipt.runId, root);
+    if (local !== null)
+        return local;
     const person = actor.startsWith("operator:") && !machineActing() ? actor.slice("operator:".length) : null;
     const marked = actor.startsWith("operator:") ? (person === null ? COMPLETION_BY_MACHINE : COMPLETION_BY_PERSON) : null;
-    // A fast start's Accept backstop (fast-start.ts): a person only, and only a change that stayed small.
     const grown = fastCompletionProblem(store, receipt.taskId, receipt.runId, person);
     if (grown !== null)
         return { ok: false, reason: "not-ready", message: grown };
     if (current.state !== "complete") {
-        // The one readiness guard: a failed or missing required check, an unresolved requirement or HIGH finding refuses.
         const blockers = current.readiness?.blockers ?? [];
         if (blockers.length > 0)
             return { ok: false, reason: "not-ready", message: blockers.map(one => one.message).join(" ") };
-        // v102: declared paths are only a promise. A result whose actual diff reaches protected files, on a
-        // scope one person approved, completes only by someone else — two people have then seen the work.
         const problem = store.protectedResultProblem(receipt.taskId, familyChangedFiles(store, receipt.taskId, receipt.runId, root), person);
         if (problem !== null)
             return { ok: false, reason: "approval-rules", message: problem };
         store.recordAction({ at: now.toISOString(), actor, repo: current.repo,
             taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work", detail: marked });
         const ref = store.lookupRef(current.rootId);
-        // Whose act this is, even outside a command that named its person: the operator who marked it.
         const by = currentActor() ?? (actor.startsWith("operator:") ? { account: actor.slice("operator:".length), lead: false } : null);
         if (ref !== null)
             store.noteTaskAct(ref.id, "completed", now, undefined, by);
         store.bumpWake();
     }
     else if (person !== null && personCompletionOwed(store, receipt.taskId, receipt.runId, receiptDigest, person, root)) {
-        // Already complete, but no person's completion is on record that lets protected work publish (a machine's, or one
-        // from before completions said who made them): this person's completion is recorded now (approval policy §1.7a).
         store.recordAction({ at: now.toISOString(), actor, repo: current.repo,
             taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work", detail: COMPLETION_BY_PERSON });
         store.bumpWake();
@@ -541,10 +475,7 @@ export function checkAssignment(store, taskId, receiptDigest, owner, now, root =
         return acknowledgeCurrent(store, current, receiptDigest, actorOf(owner), now, root, { principal: "coordinator", repos: [current.repo] });
     });
 }
-/** The signed-in user can mark the same exact receipt handled without taking
- * lead ownership. This records review, never check success or new authority. */
 export function checkAssignmentAsOperator(store, taskId, receiptDigest, who, now, root = evidenceRoot(homedir())) {
-    // Completing is this person's act (or their lead's): it never pings them.
     return withActor(currentActor() ?? { account: who.name, lead: false }, () => store.transact(() => {
         if (!reproveApprover(store, who).ok)
             return { ok: false, reason: "unauthenticated", message: "Sign in again before marking this result complete." };
@@ -555,9 +486,7 @@ export function checkAssignmentAsOperator(store, taskId, receiptDigest, who, now
         return acknowledgeCurrent(store, current, receiptDigest, `operator:${who.name}`, now, root, access);
     }));
 }
-/** The acceptance's own ledger act, as a separate Accept request records it. */
 export const ACCEPT_ACTION = "task accept-proof";
-/** Only a person's check stands between this result and done: its proof is short for that alone, and nobody accepted it. */
 export function personCheckPending(receipt) {
     return receipt !== null && receipt.proofAcceptance === null && manualReviewOnly(receipt.proof === null ? null : { verdict: receipt.proof.verdict, reasons: receipt.proof.reasons, matrix: receipt.proof.matrix });
 }
@@ -568,31 +497,18 @@ class Undone extends Error {
         this.result = result;
     }
 }
-/** An acceptance this receipt owes before it finishes, by the result page's own rule: the person's own check
- * (no reason needed), or an exception a report that doesn't match its changes needs a reason for. Null when
- * Accept and finish is a plain completion: nothing is owed (no proof, a failed check, or a verified result),
- * or it was already accepted. */
 export function owedAcceptance(receipt, blockers = []) {
     if (receipt === null || receipt.proofAcceptance !== null)
         return null;
     if (personCheckPending(receipt))
         return "person-check";
-    // An unresolved requirement is resolved only by an acceptance that says why.
     if (blockers.some(one => one.key === "criteria"))
         return "exception";
     return cantAcceptYetOf(receipt.proof?.verdict ?? null, receipt.proof?.reasons ?? [], false) === ACCEPT_NEEDS_REASON ? "exception" : null;
 }
-/** Accept and finish: the person's acceptance of the exact result they read and its completion, in one
- * transaction. Whether an acceptance is owed is decided here, against the receipt as it stands: only a
- * person's own check or a reasoned exception records one (with its ledger act); an exception without its
- * reason is refused; anything else is the plain completion Mark complete always was. The completion names the receipt the acceptance produced, under the
- * same digest a separate Accept then Mark complete leave. `receiptDigest` is the receipt as read, before
- * accepting (`runId`, when named, must be its run); any other change refuses both, and a refused completion
- * keeps no acceptance. `finish` completes the receipt (Mark complete by default; Complete and open a pull
- * request passes its own). */
 export function acceptAndCompleteAsOperator(store, taskId, input, who, now, root = evidenceRoot(homedir()), finish = digest => checkAssignmentAsOperator(store, taskId, digest, who, now, root)) {
     try {
-        return withActor(currentActor() ?? { account: who.name, lead: false }, () => store.transact(() => {
+        return withActor(currentActor() ?? { account: who.name, lead: false }, () => store.transact(() => store.savepoint(() => {
             if (!reproveApprover(store, who).ok)
                 return { ok: false, reason: "unauthenticated", message: "Sign in again before accepting this result." };
             const access = { principal: "operator", repos: who.repos };
@@ -603,11 +519,14 @@ export function acceptAndCompleteAsOperator(store, taskId, input, who, now, root
             if (receipt === null || (input.runId !== null && receipt.runId !== input.runId) || !/^[a-f0-9]{64}$/.test(input.receiptDigest) || receipt.digest !== input.receiptDigest) {
                 return { ok: false, reason: "stale", message: "This result changed. Open the current result before accepting it." };
             }
-            // Already complete, or nothing owed: the plain completion of the receipt as read.
+            const local = localCompletionRefusal(store, `operator:${who.name}`, [receipt.taskId, taskId, before.rootId], receipt.runId, root);
+            if (local !== null)
+                return local;
             const owed = before.state === "ready-to-check" ? owedAcceptance(receipt, before.readiness?.blockers ?? []) : null;
-            // An exception is accepted only with its reason: never a completion that skips it.
             if (owed === "exception" && input.note === null)
                 return { ok: false, reason: "needs-reason", message: `${ACCEPT_NEEDS_REASON}.` };
+            if (owed === "person-check" && machineActing())
+                return { ok: false, reason: "person-required", message: MACHINE_CANT_CHECK };
             let digest = receipt.digest;
             if (owed !== null) {
                 store.acceptProof(receipt.runId, who.name, input.note, now);
@@ -621,7 +540,7 @@ export function acceptAndCompleteAsOperator(store, taskId, input, who, now, root
             if (!done.ok)
                 throw new Undone(done);
             return done;
-        }));
+        })));
     }
     catch (error) {
         if (error instanceof Undone)
@@ -639,9 +558,6 @@ function noteAssignmentHandoff(store, assignment, now) {
         kind: "assignment-handoff", source: { taskRef: ref.id }, subject: assignment.state === "cancelled" ? "Assignment cancelled" : assignment.state === "ready-to-check" ? "Ready" : "Assignment needs a decision",
         body: assignment.detail, link: `/t/${encodeURIComponent(assignment.rootId)}` }, now);
 }
-/** The ordinary worker reconciles at most 50 owned roots per pass, and skips a
- * pass when nothing moved (sweep-gate.ts). A lost wakeup is recovered after
- * restart; immutable notification keys dedupe it. */
 export function syncAssignmentHandoffs(store, now, repos, root) {
     if (repos.length === 0)
         return;
@@ -662,9 +578,6 @@ export function syncAssignmentHandoffs(store, now, repos, root) {
         store.setServiceCursor(key, rows.length < 50 ? 0 : Number(rows.at(-1)["id"]), now);
     }));
 }
-/** The history of assignment handoffs sent to people (the `assignment-handoff` notifications), read by cursor. It is
- * not a delivery path: nothing is saved, replayed or acknowledged here. Leads receive their updates through the
- * assignment inbox (assignment-delivery.ts), the one road results take to a lead. */
 export function assignmentUpdates(store, now, access, query, root) {
     const after = Number.isSafeInteger(query.after) && query.after >= 0 ? query.after : 0;
     const limit = Math.max(1, Math.min(100, Math.floor(query.limit) || 50));
@@ -685,5 +598,106 @@ export function assignmentUpdates(store, now, access, query, root) {
     });
     return { events, nextCursor: page.length === 0 ? after : Number(page.at(-1)["id"]), hasMore: rows.length > limit };
 }
-/** The waits of a build Toolroll is still proving stopped by itself (needs-you.ts processNeedOf). */
 const STOP_WAITS = new Set(["build-finishing", "build-checking", "build-stopping"]);
+export function personCompletionRefusal(store, taskId, runId, person, root, local = null) {
+    const own = local === null || person === null ? null : localOwnerCompletionProblem(store, person, [taskId, local.rootId], runId, root);
+    return own ?? fastCompletionProblem(store, taskId, runId, person) ?? store.protectedResultProblem(taskId, familyChangedFiles(store, taskId, runId, root), person);
+}
+function localCompletionRefusal(store, actor, taskIds, runId, root) {
+    const local = currentLocalOwner();
+    if (local === null)
+        return null;
+    if (!localOwnerInFlight(local) || !localOwnerStandsNow(store, local))
+        return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+    if (local.act !== "complete-task" || actor !== `operator:${local.account}`)
+        return { ok: false, reason: "local-owner", message: `This needs your password. ${localOwnerThen(store, local.account)}` };
+    const problem = localOwnerCompletionProblem(store, local.account, taskIds, runId, root);
+    return problem === null ? null : { ok: false, reason: "local-owner", message: problem };
+}
+function localOwnerThen(store, account) {
+    const instead = localOwnerRefusal(store.accountOf(account)?.passwordSet === true, "/");
+    return instead.action === "Set a password" ? "Set a password first: run `toolroll password set`." : instead.message;
+}
+export function localOwnerCompletionProblem(store, account, taskIds, runId, root) {
+    const changed = familyChangedFiles(store, taskIds[0], runId, root, { missing: "unknown" });
+    for (const taskId of new Set(taskIds)) {
+        const eligible = localWorkEligible(store, account, taskId, { act: "complete", changed });
+        if (!eligible.ok)
+            return `${eligible.message} ${localOwnerThen(store, account)}`;
+    }
+    return null;
+}
+export const MACHINE_CANT_CHECK = "Only a person can say they checked this result. Open it in Toolroll and accept it there.";
+export const LOCAL_ACCEPT_ACTION = "task complete (local owner)";
+const LOCAL_STALE = { ok: false, reason: "stale", message: "This result changed. Look at the new one before accepting it." };
+function localAcceptanceOf(store, rootId, account, runId, digest, request) {
+    const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE action = ? AND task_id = ? AND actor = ? AND run_id = ? ORDER BY id DESC")
+        .all(LOCAL_ACCEPT_ACTION, rootId, `operator:${account}`, runId);
+    for (const row of rows) {
+        let detail;
+        try {
+            detail = JSON.parse(String(row["detail"] ?? ""));
+        }
+        catch {
+            continue;
+        }
+        const bound = detail;
+        if (bound.v !== 1 || bound.digest !== digest || typeof bound.completed !== "string")
+            continue;
+        const outcome = String(row["outcome"]);
+        const same = bound.checked === request.checked && (bound.reason ?? null) === request.reason;
+        return { completed: bound.completed, accepted: outcome === "person-check" || outcome === "exception" ? outcome : null, same };
+    }
+    return null;
+}
+export function completeAsLocalOwner(store, taskId, input, now, root = evidenceRoot(homedir())) {
+    try {
+        return store.transact(() => {
+            const local = localActNow(store, "complete-task");
+            if (local === null)
+                return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+            const standing = verifyApproverStanding(store, local.account, local.accountGeneration, store.knownRepos().filter(repo => store.accountCanAccess(local.account, repo)));
+            if (!standing.ok)
+                return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+            const who = standing.who;
+            const access = { principal: "operator", repos: who.repos };
+            const before = assignmentOf(store, taskId, now, access, root);
+            if (before === null || !store.accountCanAccess(who.name, before.repo))
+                return { ok: false, reason: "not-found", message: "That task is unavailable in your projects." };
+            const bound = localAcceptanceOf(store, before.rootId, who.name, input.runId, input.receiptDigest, { checked: input.checked, reason: input.reason });
+            if (bound !== null && !bound.same)
+                return { ok: false, reason: "already-complete", message: "This result is already accepted." };
+            if (bound !== null) {
+                return before.state === "complete" && before.receipt?.runId === input.runId && before.receipt.digest === bound.completed
+                    ? { ok: true, replayed: true, accepted: bound.accepted, assignment: before } : LOCAL_STALE;
+            }
+            const receipt = before.receipt;
+            if (receipt === null || receipt.runId !== input.runId || receipt.digest !== input.receiptDigest)
+                return LOCAL_STALE;
+            if (before.state === "complete")
+                return { ok: false, reason: "already-complete", message: "This result is already accepted." };
+            const owed = before.state === "ready-to-check" ? owedAcceptance(receipt, before.readiness?.blockers ?? []) : null;
+            if (owed === "person-check" && !input.checked)
+                return { ok: false, reason: "needs-check", message: "This result needs your own check. Look at it, then say you checked it." };
+            if (owed === "exception" && input.reason === null)
+                return { ok: false, reason: "needs-reason", message: `${ACCEPT_NEEDS_REASON}.` };
+            const done = acceptAndCompleteAsOperator(store, taskId, { runId: input.runId, receiptDigest: input.receiptDigest, note: owed === null ? null : input.reason }, who, now, root);
+            if (!done.ok)
+                throw new Undone(done);
+            const after = assignmentOf(store, taskId, now, access, root);
+            if (after === null || after.state !== "complete" || after.receipt?.runId !== input.runId)
+                throw new Undone(LOCAL_STALE);
+            store.recordAction({ at: now.toISOString(), actor: `operator:${who.name}`, repo: after.repo, taskId: after.rootId, runId: input.runId, action: LOCAL_ACCEPT_ACTION,
+                outcome: owed ?? "completed", source: "request",
+                detail: JSON.stringify({ v: 1, digest: input.receiptDigest, completed: after.receipt.digest, checked: input.checked, reason: input.reason, via: local.transport }) });
+            return { ok: true, replayed: false, accepted: owed, assignment: after };
+        });
+    }
+    catch (error) {
+        if (error instanceof Undone)
+            return error.result;
+        if (error instanceof Error && error.message === LOCAL_OWNER_LAPSED)
+            return { ok: false, reason: "local-owner", message: LOCAL_OWNER_LAPSED };
+        throw error;
+    }
+}