toolroll 0.9.104 → 0.9.105

package/dist/approval-authority.js

@@ -1,25 +1,7 @@
-/**
- * Which approval authorities stand, as ONE SQL predicate every dispatch belt shares (docs/plans/approval-policy.md
- * §1.5): the queue's dispatch query, the work index, and the claim and build belts (`Store.modeApprovalLive`).
- *
- * An allowlist, never a deny-list: a person's yes (`password`, `chat`) stands unless a machine made that seal; a mode
- * or a flow grant stands while its signature does; a standing order's firing (`schedule`, or an old firing stored as
- * `password`) stands while its approver can still approve in the project; an automatic release seal (`auto-check`,
- * `auto-green`: docs/plans/auto-approve-green.md) stands on its own evidence row while the project's setting is on and
- * the person who turned it on can still approve there. Everything else — the lead (`lead`, which
- * phase 1 never lets stand), a null basis, a word this code doesn't write — stands on nothing.
- *
- * The seal's origin is read from the acts recorded AT the seal's own instant, exactly as scope.ts sealOriginOf reads
- * it: an older proof for the same bytes never vouches for a later seal.
- */
 import { grantStandsSql } from "./flow-unattended.js";
 import { accountReachesSql } from "./project-access.js";
 import { autoSealSql } from "./release-authority.js";
-/** The proofs a person gives (src/person-proof.ts), as an SQL list. */
 const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey', 'local-owner')";
-/** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
- * expression, used exactly four times: the mode and grant clauses, the release's expiry and a fast start's window). It never asks whether the row is approved.
- * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
 export function authorityStandsSql(scope, repo, now) {
     return `COALESCE((((COALESCE(${scope}.approval_basis, '') IN ('password', 'chat') AND NOT ${machineSealSql(scope)}
         AND (${personSealSql(scope)} OR NOT ${automationSql(scope)} OR ${approverStandsSql(scope, repo)}))
@@ -34,64 +16,29 @@ export function authorityStandsSql(scope, repo, now) {
     AND ${releaseStandsSql(scope, now)} AND ${localSealStandsSql(scope, repo)} AND ${fastStartStandsSql(scope, now)}
     AND (instr(COALESCE(${scope}.approved_route_json, ''), '"trial"') = 0 OR ${trialSealStandsSql(scope)})), 0)`;
 }
-/**
- * SQL, conjunctive with every alternative above (plain-toolroll.md P2.4): narrow only. A fast start's seal dispatches only
- * inside its start window, and only as what it claims to be: a person's own ceremony yes to these exact bytes, proved at
- * the seal's instant (`password`), or (one-step-chat.md C1) their own yes on a chat Start card (`chat`), which stands only
- * on ONE complete chat proof row at the seal's instant carrying the fast marker (chatFastProofSql). Losing the marker
- * leaves an ordinary person approval; nothing here grants anything.
- */
 export function fastStartStandsSql(scope, now) {
     return `NOT EXISTS (SELECT 1 FROM task_ref fsr WHERE fsr.backend = 'built-in' AND fsr.external_id = ${scope}.task_id AND fsr.fast_start_until IS NOT NULL
       AND (fsr.fast_start_until <= ${now}
         OR NOT (COALESCE(${scope}.approval_basis, '') = 'password' OR (COALESCE(${scope}.approval_basis, '') = 'chat' AND ${chatFastProofSql(scope)}))
         OR ${machineSealSql(scope)} OR NOT ${personSealSql(scope)}))`;
 }
-/**
- * SQL: a chat seal's fast-start proof — ONE `approval proved` row that matches all of: this task, the seal's approver,
- * the seal's instant, outcome `chat`, and a detail that is valid JSON (checked before any json_extract, which would fail
- * on anything else) whose `$.fastStart.rule` is the rule this build writes (fast-start.ts FAST_START_RULE), `$.at` the
- * seal's instant and `$.digest` the approved digest. Facts split across rows never add up to one.
- */
 export const chatFastProofSql = (scope) => `EXISTS (SELECT 1 FROM action_ledger cfp WHERE cfp.task_id = ${scope}.task_id AND cfp.action = 'approval proved'
       AND cfp.actor = ${scope}.approved_by AND cfp.at = ${scope}.approved_at AND cfp.outcome = 'chat'
       AND CASE WHEN json_valid(cfp.detail) THEN json_type(cfp.detail, '$.fastStart.rule') = 'text' AND json_extract(cfp.detail, '$.fastStart.rule') = 'small-v1'
                                              AND json_type(cfp.detail, '$.at') = 'text' AND json_extract(cfp.detail, '$.at') = ${scope}.approved_at
                                              AND json_type(cfp.detail, '$.digest') = 'text' AND json_extract(cfp.detail, '$.digest') = ${scope}.approved_digest
                ELSE 0 END)`;
-/**
- * SQL, conjunctive with every alternative above (results routing slice 3): a task whose sealed route tries a cheaper
- * model (its build leg's selection is a trial) stands only on a PERSON's own yes to these exact bytes — the ceremony
- * (`password`) or their paired-chat tap (`chat`), with that person's proof at the seal's instant, and no machine's.
- * A mode, a grant, a schedule, a carry, an automatic seal or the lead never stand for one, whatever else allows them.
- * The route is matched as text, so a route that can't be read as JSON is held to it too (fail closed).
- */
 export function trialSealStandsSql(scope) {
     return `(COALESCE(${scope}.approval_basis, '') IN ('password', 'chat') AND NOT ${machineSealSql(scope)} AND ${personSealSql(scope)})`;
 }
-/**
- * SQL, conjunctive with every alternative above (easy-start plan C5): a seal a local owner gave (its proof row at the
- * seal's instant says `local-owner`) stands only while local mode is on, for that owner, at the local generation its
- * proof names (approvalProofDetail's " · local <generation> <transport> · "), and while its project's checks aren't
- * stored as unsandboxed. Turning local mode off, or moving its generation, stops every such seal dispatching.
- */
 export const localSealStandsSql = (scope, repo) => `NOT EXISTS (SELECT 1 FROM action_ledger lp WHERE lp.task_id = ${scope}.task_id AND lp.action = 'approval proved'
       AND lp.actor = ${scope}.approved_by AND lp.at = ${scope}.approved_at AND lp.outcome = 'local-owner'
       AND NOT (EXISTS (SELECT 1 FROM local_mode lm WHERE lm.id = 1 AND lm.enabled = 1 AND lm.owner = lp.actor
                    AND lp.detail LIKE '% · local ' || lm.generation || ' %')
                AND NOT EXISTS (SELECT 1 FROM project_check_access lca WHERE lca.repo = ${repo} AND lca.level = 'unsandboxed')))`;
-/** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
- * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */
 export const carrySealSql = (scope) => `EXISTS (SELECT 1 FROM release_carry rc2 JOIN release_authority ra2 ON ra2.id = rc2.authority
       WHERE rc2.task_id = ${scope}.task_id AND rc2.scope_digest = ${scope}.approved_digest AND rc2.to_sha = ${scope}.candidate
         AND ${scope}.mode_digest = ra2.id || ':' || rc2.id)`;
-/**
- * SQL: a task that belongs to a release authority (its anchor, or a carried commit) dispatches only as the current
- * generation's tip while the release is open and unexpired, with the anchor's approver still an active approver who
- * can reach the project and the anchor's approval on its exact sealed digest. A task that belongs to no release passes.
- * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides. "Open and unexpired" here is
- * release-authority.ts releaseStateAt(a, now) === "open", written in SQL.
- */
 export const releaseStandsSql = (scope, now) => `((NOT EXISTS (SELECT 1 FROM release_authority rx WHERE rx.anchor_task = ${scope}.task_id)
       AND NOT EXISTS (SELECT 1 FROM release_carry cx WHERE cx.task_id = ${scope}.task_id))
     OR EXISTS (SELECT 1 FROM release_authority ra WHERE ra.tip_task = ${scope}.task_id AND ra.state = 'open' AND ra.expires_at > ${now}
@@ -100,22 +47,16 @@ export const releaseStandsSql = (scope, now) => `((NOT EXISTS (SELECT 1 FROM rel
         AND EXISTS (SELECT 1 FROM task_scope an JOIN approver ap ON ap.name = an.approved_by
             WHERE an.task_id = ra.anchor_task AND an.approved_digest = ra.anchor_digest AND an.digest = ra.anchor_digest
               AND ap.revoked_at IS NULL AND ap.role = 'approver' AND ${accountReachesSql("ap", "ra.repo")})))`;
-/** SQL: a machine made this seal — any proof at the seal's instant that isn't a person's (whatever its detail says,
- * parsed or not: fail closed), or the lead's own approval act then. */
 export const machineSealSql = (scope) => `(EXISTS (SELECT 1 FROM action_ledger mp WHERE mp.task_id = ${scope}.task_id AND mp.action = 'approval proved'
        AND mp.actor = ${scope}.approved_by AND mp.at = ${scope}.approved_at AND mp.outcome NOT IN ${PERSON_PROOFS})
     OR EXISTS (SELECT 1 FROM task_act la JOIN task_ref lr ON lr.id = la.task_ref AND lr.backend = 'built-in'
        WHERE lr.external_id = ${scope}.task_id AND la.act = 'approved' AND la.lead = 1
          AND la.account = ${scope}.approved_by AND la.at = ${scope}.approved_at))`;
-/** SQL: a person's proof at the seal's instant for these exact bytes, its detail parsed (the versioned JSON record,
- * whitespace and all, or the legacy text). */
 export const personSealSql = (scope) => `EXISTS (SELECT 1 FROM action_ledger pp WHERE pp.task_id = ${scope}.task_id AND pp.action = 'approval proved'
       AND pp.actor = ${scope}.approved_by AND pp.at = ${scope}.approved_at AND pp.outcome IN ${PERSON_PROOFS}
       AND CASE WHEN json_valid(pp.detail) THEN json_extract(pp.detail, '$.v') = 1 AND json_type(pp.detail, '$.digest') = 'text'
                                             AND json_extract(pp.detail, '$.digest') = ${scope}.approved_digest
                ELSE pp.detail LIKE '% · generation % · digest ' || ${scope}.approved_digest END)`;
-/** SQL: the task a standing order's firing filed (its own record of the firing). */
 const automationSql = (scope) => `EXISTS (SELECT 1 FROM flow_trigger_event fe WHERE fe.task = ${scope}.task_id)`;
-/** SQL: the seal's approver can still approve in the project. */
 const approverStandsSql = (scope, repo) => `EXISTS (SELECT 1 FROM approver sched WHERE sched.name = ${scope}.approved_by AND sched.revoked_at IS NULL AND sched.role = 'approver'
       AND ${accountReachesSql("sched", repo)})`;

package/dist/approval-password.js

@@ -1,13 +1,3 @@
-/** When an approval form asks for a password (docs/plans/plain-toolroll.md P1.3): one function every approve form reads,
- * so the task page, the focused chat and the shared-action review never disagree. It only decides what a form shows;
- * approve() proves the person, the freshness, the local owner and the digest again inside its own transaction, with
- * the same two rules this reads (freshlyApprovable, localApprovalEligible).
- *
- * - `none`: Passwordless is on for this session, or this computer's local owner may approve this exact work.
- * - `remembered`: a password typed on this session in the last fifteen minutes may stand for these terms; the field
- *   shows, and may be left empty.
- * - `required`: a password typed now: protected or escalated work, terms an agent wrote, or nothing remembered.
- * - `local-refused`: a local owner who can't approve this here, with where to go instead. */
 import { freshlyApprovable, localApprovalEligible } from "./scope.js";
 import { localOwnerRefusal } from "./local-owner.js";
 export function approvalPasswordField(store, facts) {

package/dist/approval-policy.js

@@ -1,16 +1,3 @@
-/**
- * Separation of duties (v102): a project's approval rules. Two can be on at
- * once, and neither changes a thing until a project turns it on.
- *
- * - The person who filed a task can't approve it ("not the requester").
- * - Protected work (the whole project, or tasks that touch protected paths)
- *   needs two different people to approve the same exact scope, and an AI
- *   subagent or an operating mode can never decide it.
- *
- * The store enforces these at the one place every approval is sealed
- * (`Store.sealScopeApproval`); this module holds the pure parts.
- */
-/** A filer from a name as the ledger writes it: a subagent's ends " (AI)"; a coordinator's starts "coordinator:"; none is automation. */
 export function filerFor(name) {
     if (name == null || name === "")
         return { name: null, kind: "automation" };
@@ -21,8 +8,6 @@ export function filerFor(name) {
     return { name, kind: "person" };
 }
 export const NO_RULES = { notRequester: false, protectProject: false, protectedPaths: [] };
-/** A path as the rules compare it: forward slashes, no "." or "..", lower case (macOS
- * checkouts ignore case). null when it climbs out of the checkout. */
 function normal(path) {
     const parts = [];
     for (const part of path.trim().replace(/\\/g, "/").toLowerCase().split("/")) {
@@ -60,12 +45,6 @@ function globRegex(glob) {
     }
     return new RegExp(`^${out}(?:/.*)?$`);
 }
-/** Whether a task that says it touches `touch` may touch something under
- * `protectedGlob`, or a changed file is protected. A plain path covers
- * itself and everything under it; a pattern with no slash matches at any
- * depth (as in .gitignore); two patterns that could reach the same files
- * count as overlapping; a path that climbs out of the checkout is
- * protected. Every doubt errs toward protecting. */
 export function touchesProtected(touch, protectedGlob) {
     const g = normal(protectedGlob);
     if (g === null || g === "")
@@ -78,11 +57,9 @@ export function touchesProtected(touch, protectedGlob) {
     if (!wild.test(a)) {
         if (pattern.test(a))
             return true;
-        // A protected pattern that lives inside this path (".github" holding ".github/workflows/**") is reached, whatever the name looks like.
         const pb = literalPrefix(b);
         if (pb === a || pb.startsWith(`${a}/`))
             return true;
-        // A file ("docs/readme.md") is only itself; a folder ("infra", or a name with no extension) may hold anything a pattern reaches.
         if (/\.[^/.]+$/.test(a))
             return false;
         return pattern.test(`${a}/x`) || pattern.test(`${a}/x/y.z`) || `${a}/`.startsWith(pb);
@@ -90,14 +67,11 @@ export function touchesProtected(touch, protectedGlob) {
     const pa = literalPrefix(a), pb = literalPrefix(b);
     return pa.startsWith(pb) || pb.startsWith(pa);
 }
-/** The changed files (from a build's diff) that the rules protect. */
 export function protectedChanges(rules, changed) {
     if (rules.protectProject)
         return [...changed];
     return changed.filter(file => rules.protectedPaths.some(glob => touchesProtected(file, glob)));
 }
-/** Whether a task's declared paths reach protected work. A task that
- * declares no paths can't show it stays clear, so it counts as protected. */
 export function isProtectedWork(rules, touches) {
     if (rules.protectProject)
         return true;
@@ -107,7 +81,6 @@ export function isProtectedWork(rules, touches) {
         return true;
     return touches.some(touch => rules.protectedPaths.some(glob => touchesProtected(touch, glob)));
 }
-/** Protected paths as a person types them: one per line or comma separated, trimmed, deduplicated, at most 50. */
 export function parseProtectedPaths(raw) {
     const paths = [...new Set(raw.split(/[\n,]/).map(clean).filter(one => one !== ""))];
     if (paths.length > 50)
@@ -117,7 +90,6 @@ export function parseProtectedPaths(raw) {
         return { ok: false, problem: "A protected path is 200 characters at most." };
     return { ok: true, paths };
 }
-/** The rules in a line, for the ledger's before → after. */
 export function rulesWords(rules) {
     const parts = [
         rules.notRequester ? "requester can't approve" : null,
@@ -125,7 +97,6 @@ export function rulesWords(rules) {
     ].filter((one) => one !== null);
     return parts.length === 0 ? "no rules" : parts.join("; ");
 }
-/** What a person reads when the rules stop an approval. */
 export function gateWords(gate) {
     if (gate.verdict === "vote")
         return gate.already

package/dist/approval-rules-ui.js

@@ -1,9 +1,3 @@
-/**
- * Settings → Approval rules (v102): a project's separation of duties. An
- * instance operator sets them (with their password, or a fresh sign-in with
- * the identity provider); everyone else reads them. Every change is in the
- * ledger, before → after.
- */
 import { joinHtml } from "./html.js";
 import { formRow, note, radios, settingsSection, switchInput, textarea } from "./server/kit.js";
 import { kitSectionForm } from "./settings-kit.js";
@@ -12,10 +6,7 @@ const RULES_CSS = `.approval-rules{max-width:720px;min-width:0}.approval-rules f
     `.approval-rules .choice input{margin:.2rem 0 0}.approval-rules .choice strong{display:block;font-size:.875rem;font-weight:500}.approval-rules .choice small{display:block;color:var(--muted-foreground);font-size:.8125rem;margin-top:2px}` +
     `.approval-rules textarea{min-height:88px;font-family:var(--font-mono);font-size:.8125rem}.approval-rules .paths{margin:4px 0 0 26px}` +
     `.approval-rules .current{margin:0 0 4px}.approval-rules .step-up{margin-top:16px}.approval-rules button[type=submit]{margin-top:14px}`;
-/** The rules' style, and the same for the Releases section under its own class (so a page holds one `.approval-rules`
- * form, not two). */
 export const APPROVAL_RULES_CSS = RULES_CSS + RULES_CSS.replaceAll(".approval-rules", ".release-approval");
-/** The rules in plain words, for anyone who can see the project. */
 export function rulesSummary(rules) {
     const parts = [];
     if (rules.notRequester)

package/dist/assignment-adapters.js

@@ -1,5 +1,3 @@
-/** Assignment reads and delivery acknowledgments. These adapters never start
- * work, answer a decision, accept proof, or change an approval. */
 import { buildReviewLines } from "./review-switch.js";
 import { readFileSync, statSync } from "node:fs";
 import { authenticateCoordinator } from "./coordinator.js";
@@ -12,8 +10,6 @@ import { parseContract } from "./contracts/contract.js";
 import { ASSIGNMENT_INPUTS } from "./contracts/gateway-tools.js";
 export const ASSIGNMENT_ACTIONS = Object.keys(ASSIGNMENT_INPUTS);
 const failure = (reason, message) => ({ ok: false, reason, message });
-/** The gateway's assignment tools: names and words. Each one's input is ASSIGNMENT_INPUTS[operation]
- * (src/contracts/gateway-tools.ts), which `toolroll assignment` reads its flags with too. */
 export const ASSIGNMENT_TOOLS = [
     { name: "get_assignment", operation: "show", description: "Read one assignment's root, current execution, owner, exact result and handoff receipt. Approval, proof and deployment remain separate facts." },
     { name: "list_assignment_updates", operation: "updates", description: "Read the history of assignment handoffs sent to people in your projects, after a cursor. History only: it delivers and acknowledges nothing. To receive your updates, use get_assignment_inbox." },
@@ -23,9 +19,6 @@ export const ASSIGNMENT_TOOLS = [
     { name: "get_assignment_inbox", operation: "inbox", description: "Receive a durable batch of your assignments' status changes. Use a stable consumer name. Until acknowledged, the same batch survives reconnects and restarts. Receiving never completes or reruns work." },
     { name: "acknowledge_assignment_delivery", operation: "ack", description: "Acknowledge receipt of an inbox batch after handling its updates. This advances only your delivery cursor; it never marks work complete, answers a decision or starts a revision." },
 ];
-/** The CLI and MCP read an assignment call with the same schema; MCP reads it before dispatch too, and this protects
- * direct adapter callers. A refusal is its path-named lines; a ref or project path with control characters, which
- * JSON Schema can't say, is refused after parsing. */
 export function readAssignmentArgs(operation, args) {
     if (!ASSIGNMENT_ACTIONS.includes(operation))
         return failure("usage", "Choose show, updates, claim, check, brief, inbox, or ack.");
@@ -47,16 +40,11 @@ function readAssignment(store, operation, args, now, access, root) {
     const assignment = assignmentOf(store, String(args["ref"]), now, access, root);
     return assignment === null ? failure("not-found", "No assignment with that task id is available in your projects.") : { ok: true, body: assignment };
 }
-/** Every read and mutation authenticates inside the same transaction as its
- * projection. A cached name/allowlist cannot keep a revoked identity alive. */
 export function assignmentForCoordinator(store, token, operation, args, now, evidenceRoot) {
     const read = readAssignmentArgs(operation, args);
     if (!read.ok)
         return read;
     args = read.value;
-    // Authenticate before maintenance, then authenticate again inside delivery.
-    // Reconciliation owns one short transaction per family and cannot sit under
-    // the delivery transaction's writer reservation.
     if (operation === 'inbox') {
         const authenticated = authenticateCoordinator(store, token);
         if (!authenticated.ok)
@@ -159,8 +147,6 @@ function resultLines(body) {
         `Next cursor: ${body.nextCursor}${body.hasMore ? " · more updates available" : ""}`,
     ];
 }
-/** Explicit secret source only. Never print secret values or discover default
- * files. A bad explicit credential must not fall back to a local read. */
 export function coordinatorToken(flags, env) {
     const envName = flags.get("token-env"), path = flags.get("token-file");
     if (envName !== undefined && path !== undefined)

package/dist/assignment-brief.js

@@ -1,5 +1,3 @@
-/** A bounded catch-up over saved project/task records, not conversation memory.
- * Callers authenticate first and pass their current project ceiling. */
 import { browserWorkActionHref } from './browser-crew.js';
 import { createHash } from "node:crypto";
 import { workIndexPage } from "./work-index.js";
@@ -7,11 +5,8 @@ import { publicChatText } from "./chat-display.js";
 const sha = (value) => createHash("sha256").update(value).digest("hex");
 const MAX_BYTES = 16_000;
 const RECENT_MS = 7 * 24 * 60 * 60_000;
-/** A full stop, question or exclamation mark followed by a new sentence. */
 const SENTENCE_END = /[.!?](?=\s+["'“(]?([\p{Lu}\p{N}]))/gu;
-/** An abbreviation's full stop ("e.g.", "E.g.", "etc."), in any case; "No." only before a number ("No. 5"). */
 const ABBREVIATION = /\b(?:e\.g|i\.e|etc|vs|cf|approx|incl|mr|mrs|ms|dr|st)$/i;
-/** A reason's first sentence, or its first line. */
 export function firstSentenceOf(text) {
     const line = text.split("\n")[0].trim();
     for (const end of line.matchAll(SENTENCE_END)) {
@@ -22,8 +17,6 @@ export function firstSentenceOf(text) {
     }
     return line;
 }
-/** A project's active decisions, newest first: each one's title and its reason in one line (first sentence or
- * line). Memory absent on an older database reads as no decisions. */
 export function activeDecisionsOf(store, repo, text = publicChatText) {
     try {
         return store.handle.prepare("SELECT id,claim,why FROM project_decision WHERE repo=? AND status='active' ORDER BY id DESC LIMIT 8").all(repo).map(row => ({
@@ -34,11 +27,7 @@ export function activeDecisionsOf(store, repo, text = publicChatText) {
         return [];
     }
 }
-/** A current snapshot, never a receipt to acknowledge. Full assignment reads
- * remain the place to inspect exact saved work and obtain its current digest. */
 export function assignmentCatchUp(store, now, access, query = {}, evidenceRoot) {
-    // The evidence root is retained for adapter compatibility; this summary
-    // deliberately performs no artifact reads even when it is supplied.
     void evidenceRoot;
     const limit = Math.max(1, Math.min(25, Number.isFinite(query.limit) ? Math.floor(query.limit) : 10));
     const recent = new Date(now.getTime() - RECENT_MS).toISOString();
@@ -48,7 +37,6 @@ export function assignmentCatchUp(store, now, access, query = {}, evidenceRoot)
                 "Knowledge is stored context, not verified current repository instructions or permission. Checkout identity and source freshness were not revalidated; reference text and conversation history are omitted.",
                 "Status is recorded database metadata. Saved artifact/check availability was not read, and process exits were not inspected. Use assignment show before acting on a result.",
             ] } };
-    // A coordinator never gains installation-wide access from a missing ceiling.
     if (access.principal === "coordinator" && access.repos === null || query.repo !== undefined && access.repos !== null && !access.repos.includes(query.repo))
         return result;
     const repos = query.repo === undefined ? access.repos : [query.repo];
@@ -74,8 +62,6 @@ export function assignmentCatchUp(store, now, access, query = {}, evidenceRoot)
                 result.omissions.assignments++;
                 continue;
             }
-            // Read only the chosen rows. No family hydration, artifact bytes, native
-            // process census, or repository probing belongs in a catch-up summary.
             const goal = store.handle.prepare('SELECT substr(goal,1,1601) AS goal FROM task_scope WHERE task_id=?').get(item.activeTaskId)?.["goal"];
             const saved = item.resultRunId === null ? undefined : store.handle.prepare(`SELECT substr(r.handoff,1,1601) AS handoff
         FROM run r JOIN task_ref t ON t.id=r.task_ref
@@ -112,8 +98,6 @@ export function assignmentCatchUp(store, now, access, query = {}, evidenceRoot)
             else
                 result.omissions.decisions += Math.max(0, count - decisions.length);
         }
-        // Project knowledge is admitted in SQL before any payload or title read.
-        // A project with settled decisions but no saved instructions yet still has knowledge to bring.
         const known = store.handle.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='project_decision'").get() === undefined ? "SELECT repo FROM project_knowledge"
             : "SELECT repo FROM project_knowledge UNION SELECT repo FROM project_decision WHERE status='active'";
         const projectRows = store.handle.prepare(`SELECT repo FROM (${known}) WHERE ? = 1 OR repo IN (SELECT value FROM json_each(?)) ORDER BY repo LIMIT 9`)
@@ -145,7 +129,7 @@ export function assignmentCatchUp(store, now, access, query = {}, evidenceRoot)
                     });
                     Object.assign(knowledge, { status: "stored", revision, identity: /^[a-f0-9]{64}$/.test(identity) ? identity : null, sha256: String(row["sha"]), instructions: text(saved.instructions, 600), sources });
                 }
-                catch { /* Integrity failures are explicit; never replay an older version as current. */ }
+                catch { }
             knowledge.decisions = activeDecisionsOf(store, repo, text);
             result.projects.push({ repo, knowledge });
             if (!fits()) {

package/dist/assignment-delivery.js

@@ -1,9 +1,3 @@
-/** Durable, explicitly acknowledged delivery of assignment status events.
- * Callers authenticate the raw coordinator credential inside the same Store
- * transaction. Delivery receipts never complete tasks or grant authority.
- * This is the one way results reach a lead: an external coordinator reads its
- * owned assignments' events, and the built-in lead reads its follow grant's
- * (lead-follow.ts) through the same saved pages, replay and acknowledgment. */
 import { createHash, randomBytes } from "node:crypto";
 import { ASSIGNMENT_STATUS_ACTION, followActor, parseAssignmentStatusEvent } from "./assignment-status.js";
 const MAX_PAGE_BYTES = 64 * 1024;
@@ -18,7 +12,6 @@ function coordinatorReader(store, owner) {
         repos: () => admittedRepos(store, owner), admits: { sql: `${ownerSql} = ?`, params: [actor] },
         receives: event => event.assignment.owner?.id === owner.id, gone: "The coordinator is no longer active." };
 }
-/** The built-in lead's follow grant (lead-follow.ts), which its caller has already proved, with the projects it covers. */
 function followReader(grant) {
     return { actor: followActor(grant.id), key: consumer => createHash("sha256").update(JSON.stringify(["follow", grant.id, consumer])).digest("hex"),
         repos: () => [...grant.repos], admits: { sql: "1 = 1", params: [] }, receives: () => true, gone: "Automatic crew updates are off." };
@@ -89,18 +82,9 @@ function pendingBatch(store, reader, key) {
     }
     return previous === batch.nextCursor ? batch : invalid();
 }
-/** A read stages one immutable page. Until ACK, any process using this owner
- * and consumer receives that exact page, regardless of new status events or
- * a changed requested page size. Lost access replaces content with an opaque
- * tombstone; it does not prevent acknowledgment of that already issued page.
- * Consumer names identify independent inboxes. */
 export function assignmentInbox(store, owner, query, now) {
     return inbox(store, coordinatorReader(store, owner), query, now);
 }
-/**
- * What the lead's follow inbox would hand over next, without issuing anything (lead sweeps, docs/plans/lead-fan-out.md):
- * whether a page is already issued (it always replays at once — never held), and the unread events' tasks.
- */
 export function leadFollowUnread(store, grant, consumer) {
     const reader = followReader(grant), key = reader.key(consumer);
     if (pendingBatch(store, reader, key) !== null)
@@ -110,7 +94,6 @@ export function leadFollowUnread(store, grant, consumer) {
         .all(after, reader.actor, ASSIGNMENT_STATUS_ACTION);
     return { issued: false, events: rows.map(row => ({ task: String(row["task_id"]), state: String(row["state"] ?? "") })) };
 }
-/** The built-in lead's inbox: the same page, replay and acknowledgment as a coordinator's, over its follow grant. */
 export function leadFollowInbox(store, grant, query, now) {
     return inbox(store, followReader(grant), query, now);
 }
@@ -161,12 +144,9 @@ function inbox(store, reader, query, now) {
         return { ok: true, batch, replayed: false };
     }));
 }
-/** ACK advances only the exact issued page, atomically. Replaying any prior
- * ACK is harmless, including while a newer page awaits acknowledgment. */
 export function acknowledgeAssignmentDelivery(store, owner, query, now) {
     return acknowledge(store, coordinatorReader(store, owner), query, now);
 }
-/** The built-in lead acknowledges its own page the same way, once it has handled it. */
 export function acknowledgeLeadFollowDelivery(store, grant, query, now) {
     return acknowledge(store, followReader(grant), query, now);
 }
@@ -188,8 +168,6 @@ function acknowledge(store, reader, query, now) {
             return pending;
         if (pending === null || pending.id !== query.batchId || pending.consumer !== query.consumer || pending.after !== cursor)
             return fail("stale-batch", "This batch was not issued to this inbox; its cursor has not advanced.");
-        // Access loss redacts replayed events; the exact issued page remains
-        // acknowledgeable so its inaccessible entries cannot wedge this inbox.
         store.recordAction({ at: now.toISOString(), actor: reader.actor, repo: null, taskId: null, runId: null,
             action, outcome: JSON.stringify({ batchId: pending.id, after: pending.after, cursor: pending.nextCursor }), source: "work" });
         store.setServiceCursor(cursorKey, pending.nextCursor, now);

package/dist/assignment-presentation.js

@@ -1,13 +1,10 @@
 import { GOAL_ASSESSMENT_PENDING, manualReviewCriterionOf } from './proof.js';
 import { failedCheckExit } from './workspace-ui.js';
 import { assignmentStatusFacts, taskStatusOf, workToneOf } from './task-status.js';
-/** Only the retired assessment requirement is history-only. Specific missing
- * material, defects and failed checks remain visible, including reviewer findings. */
 export function historicalAssessmentReason(reason) {
     return reason === GOAL_ASSESSMENT_PENDING || reason === 'no proof was written' || reason === 'No builder proof artifact is recorded.' || /^criterion "[^"]+" awaits independent goal assessment\.?$/.test(reason) ||
         /^semantic coverage: .* — (?:required .*|independent review is optional .*)$/.test(reason);
 }
-/** Known storage-cap notices do not mean the retained bytes are damaged. */
 export function shortenedMaterialReason(detail) {
     return detail === 'The check output was shortened when it was stored; its download holds only the stored part.' ||
         detail === 'The sealed diff was shortened when it was stored; its download holds only the stored part, not the full change.' ||
@@ -16,7 +13,6 @@ export function shortenedMaterialReason(detail) {
         detail === 'The changed-file list was cut short; the counts are complete.' ||
         /^Saved (?:terminal-diff|report) #\d+ is incomplete\.$/.test(detail);
 }
-/** The one shared status (task-status.ts) for this assignment. */
 export function assignmentTaskStatusOf(assignment, options = {}) {
     const work = options.workStatus;
     return taskStatusOf(assignmentStatusFacts(assignment, {
@@ -31,11 +27,8 @@ export function assignmentTaskStatusOf(assignment, options = {}) {
 export function assignmentPresentationOf(assignment, options = {}) {
     const { state } = assignment, work = options.workStatus;
     const taskStatus = assignmentTaskStatusOf(assignment, options);
-    // The headline and its sentence are the shared words; the token, views and
-    // rank stay the existing projection's (pages and tests key off them).
     const shared = { label: taskStatus.headline, tone: workToneOf(taskStatus.headline), detail: taskStatus.sentence, action: null };
     const needsYou = taskStatus.headline === 'Needs you';
-    // Waiting needs no one: never listed under Needs you.
     const waiting = taskStatus.headline === 'Waiting';
     const status = state === 'working'
         ? { ...shared, token: `assignment-${state}`,
@@ -52,8 +45,6 @@ export function assignmentPresentationOf(assignment, options = {}) {
         const saved = /^Saved (check-log|terminal-diff|report) #(\d+)/.exec(detail);
         if (saved) {
             const current = assignment.receipt?.artifacts.filter(one => one.kind === saved[1]) ?? [];
-            // An older attempt's missing file is a distinct limitation. Only the
-            // one exact current file can share its detailed reader's explanation.
             return current.length === 1 && current[0].id === Number(saved[2]) ? saved[1] === 'terminal-diff' ? 'diff' : saved[1] : `artifact:${saved[2]}`;
         }
         if (/^The (?:retained verification log|check log|check output) /.test(detail))
@@ -66,20 +57,15 @@ export function assignmentPresentationOf(assignment, options = {}) {
     };
     const attention = new Map();
     for (const detail of [...assignment.attention, ...(options.additionalAttention ?? [])]) {
-        // A requirement only a person can confirm is not a problem: the result
-        // names it in plain words beside its Accept action.
         if (historicalAssessmentReason(detail) || detail === assignment.detail || manualReviewCriterionOf(detail) !== null)
             continue;
         const material = materialReason(detail);
         const id = checks !== undefined && checkReason(detail) ? 'checks' : material === null ? `detail:${detail}` : `material:${material}`;
-        // A read of the exact machine record owns the check outcome. A legacy
-        // assessment cannot claim failure after the actual check passed.
         if (id === 'checks' && (checks?.status === 'passed' || assignment.detail.includes(checks.detail)))
             continue;
         if ([...attention.values()].some(one => one.detail.includes(detail)))
             continue;
         const previous = attention.get(id);
-        // Damage to the retained bytes outranks their earlier storage limit.
         if (previous !== undefined && shortenedMaterialReason(detail) && !shortenedMaterialReason(previous.detail))
             continue;
         attention.set(id, { id, detail: id === 'checks' ? checks.detail : detail, tone: 'problem' });

package/dist/assignment-status.js

@@ -1,26 +1,14 @@
-/** Private lead catch-up, separate from human notification delivery. These are
- * observed assignment transitions, not a promise to capture every intermediate
- * state between scans. Recording or reading them never dispatches agent work.
- * One stream serves every lead: a coordinator's or team lead's events are
- * recorded under its owner, and the built-in lead's crew updates under its
- * follow grant (`follow:<grant>`, lead-follow.ts); each reads its own through
- * the delivery inbox (assignment-delivery.ts). */
 import { createHash } from "node:crypto";
 import { assignmentOf } from "./assignment.js";
 import { publicChatText } from "./chat-display.js";
 import { sweepIfMoved } from "./sweep-gate.js";
 export const ASSIGNMENT_STATUS_ACTION = "assignment status observed";
-/** A reader's first sight of a task that is not news: the state later events are compared to, never delivered. */
 export const ASSIGNMENT_STATUS_BASELINE = "assignment status baseline";
 export const ASSIGNMENT_STATUS_SOURCE = "work";
-/** The states that wake a lead: a result to check, a question, completion, or cancellation. */
 export const LEAD_WAKE_STATES = ["ready-to-check", "needs-decision", "complete", "cancelled"];
-/** The built-in lead's events, one stream per follow grant. */
 export const followActor = (grant) => `follow:${grant}`;
 const hash = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 const text = publicChatText;
-/** No saved artifact contents, credential bytes, or polling timestamps. Exact
- * IDs and digests identify the full read; display text is deliberately bounded. */
 export function assignmentStatusBrief(assignment) {
     const receipt = assignment.receipt;
     const action = assignment.primaryAction;
@@ -29,8 +17,6 @@ export function assignmentStatusBrief(assignment) {
         title: text(assignment.title, 200), state: assignment.state, detail: text(assignment.detail, 1_000),
         owner: assignment.owner === null ? null : { kind: assignment.owner.kind, id: assignment.owner.id, label: text(assignment.owner.label, 100) },
         runId: assignment.attempts.find(one => one.taskId === assignment.activeTaskId)?.runId ?? receipt?.runId ?? null,
-        // The same state can be read by an operator or a coordinator. Permission
-        // hints are caller-specific, not a transition or a grant to this consumer.
         primaryAction: action === null ? null : { code: action.code, label: text(action.label, 160), target: action.target },
         attention: assignment.attention.slice(0, 8).map(one => text(one, 500)),
         result: receipt === null ? null : { digest: receipt.digest, runId: receipt.runId,
@@ -41,8 +27,6 @@ export function assignmentStatusBrief(assignment) {
             remoteState: assignment.publication.remoteState === null ? null : text(assignment.publication.remoteState, 80) },
     };
 }
-/** An unreadable ledger event is an explicit consumer error, not a cursor that
- * may silently skip the row. This validates the bounded data, not authority. */
 export function parseAssignmentStatusEvent(value) {
     if (Buffer.byteLength(value) > 32_768)
         return null;
@@ -83,9 +67,6 @@ export function parseAssignmentStatusEvent(value) {
         return null;
     }
 }
-/** Call inside the mutation's transaction when possible; independently atomic
- * for worker reconciliation. The latest event, not a permanent digest set,
- * deduplicates retries so Working → Needs decision → Working is retained. */
 export function noteAssignmentStatus(store, snapshot, now) {
     if (!snapshot.owner?.active || snapshot.repo === null)
         return null;
@@ -119,8 +100,6 @@ export function noteAssignmentStatus(store, snapshot, now) {
         return appendStatusEvent(store, `${owner.kind}:${owner.id}`, owner.id, ref.id, snapshot, now);
     });
 }
-/** The built-in lead's crew update (lead-follow.ts): the same event, under its follow grant. The
- * caller has already proved the grant and its projects; the root must still be a placed task. */
 export function noteFollowStatus(store, grant, snapshot, now, action = ASSIGNMENT_STATUS_ACTION) {
     if (snapshot.repo === null)
         return null;
@@ -131,8 +110,6 @@ export function noteFollowStatus(store, grant, snapshot, now, action = ASSIGNMEN
         return appendStatusEvent(store, followActor(grant), followActor(grant), ref.id, snapshot, now, action);
     });
 }
-/** Each reader's latest event or baseline, not a permanent digest set, deduplicates its retries, so Working → Needs
- * decision → Working is retained. One reader's events never suppress or duplicate another's. */
 function appendStatusEvent(store, actor, ownerId, rootRef, snapshot, now, action = ASSIGNMENT_STATUS_ACTION) {
     const assignment = assignmentStatusBrief(snapshot);
     const stateDigest = hash(assignment);
@@ -143,7 +120,7 @@ function appendStatusEvent(store, actor, ownerId, rootRef, snapshot, now, action
             if (JSON.parse(String(previous["outcome"]))?.stateDigest === stateDigest)
                 return null;
         }
-        catch { /* Preserve an unreadable older event; append the current observation. */ }
+        catch { }
     }
     const digest = hash({ rootRef, owner: ownerId, previous: previous === undefined ? null : Number(previous["id"]), stateDigest });
     const event = { version: 1, digest, stateDigest, assignment };
@@ -151,9 +128,6 @@ function appendStatusEvent(store, actor, ownerId, rootRef, snapshot, now, action
         taskId: snapshot.rootId, runId: assignment.runId, action,
         outcome: JSON.stringify(event), source: ASSIGNMENT_STATUS_SOURCE });
 }
-/** At most fifty roots per pass; the cursor survives process restarts. A full
- * pass cycles back, so changes below the cursor are eventually observed too.
- * A pass is skipped when nothing moved since the cycle began (sweep-gate.ts). */
 export function syncAssignmentStatuses(store, now, repos, root) {
     if (repos.length === 0)
         return;
@@ -166,9 +140,6 @@ export function syncAssignmentStatuses(store, now, repos, root) {
       AND (t.coordinator_cid IS NOT NULL OR EXISTS(SELECT 1 FROM team_task_owner o WHERE o.task_ref=t.id) OR EXISTS
         (SELECT 1 FROM action_ledger a WHERE a.task_id=t.external_id AND a.action='assignment claimed' AND a.source='work'))
       ORDER BY t.id LIMIT 50`).all(JSON.stringify(allowed), store.serviceCursor(key));
-        // Release the writer between families. Each observation and its durable
-        // position still commit together; an interrupted sweep resumes after the
-        // last committed family instead of holding every heartbeat behind a batch.
         if (rows.length === 0)
             store.setServiceCursor(key, 0, now);
         for (const [index, row] of rows.entries()) {