toolroll 0.9.51 → 0.9.53

package/dist/scope.d.ts

@@ -123,14 +123,6 @@ export declare function canonicalChainJson(entries: readonly ChainEntry[]): stri
  * ":profile:"), so a chain digest can never collide with a profile
  * digest, truncated to the same 128 bits. */
 export declare function chainDigestOf(entries: readonly ChainEntry[]): string;
-/**
- * One chain entry's BINDING digest (E3d): the profile digest + auth mode
- * under their own domain. A run row pins this at admission (or base-cycle
- * open), and the dispatch proof re-derives it from the approved chain at
- * the run's index — so nothing downstream can swap WHICH entry a run
- * spends as, in model or in credential.
- */
-export declare function entryDigestOf(entry: ChainEntry): string;
 /** Strict re-hydration of a stored chain — every entry proved through the
  * single-profile rehydrator; anything unexpected is null. */
 export declare function chainFromJson(json: string | null): ChainEntry[] | null;
@@ -182,7 +174,7 @@ export declare function profileFromJson(json: string | null): ExecutionProfile |
 export type { AcceptanceCriterion, AcceptanceProblem };
 /**
  * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
- * console form, a routine or template definition): fail closed, every
+ * console form, a template or a schedule's terms): fail closed, every
  * problem reported at once, each naming its path — the acceptance contract
  * (contracts/scope.ts) reads it. An absent or empty `value` parses to `[]`
  * with no problems: whether that is ALLOWED is a question for the caller
@@ -281,13 +273,10 @@ export type Scope = SavedScopeTerms & {
     profileJson?: string | null;
     approvedProfileJson?: string | null;
     digestVersion?: number;
-    /** v30 fallback chains. `proposedChainJson` is the WORKING chain snapshot
-     * the digest bound (present only when the repo has configured fallbacks);
-     * `approvedChainJson` is the immutable snapshot the seal COPIED from it;
-     * `approvalKind` names which the approval sealed. All undefined/null on a
-     * legacy single-profile scope — every scope until an operator configures a
-     * fallback chain. The runtime re-derives the active entry from
-     * `approvedChainJson`, never from mutable config. */
+    /** v30-v114 fallback chains (history): the working and sealed chain
+     * snapshots and which kind the approval sealed. Never written since v115
+     * (a re-approval writes `profile` and clears the sealed chain); an old
+     * chain approval still decodes and verifies. */
     proposedChainJson?: string | null;
     approvedChainJson?: string | null;
     approvalKind?: "profile" | "chain";
@@ -336,8 +325,8 @@ export type ScopeInput = {
     goal: string;
     outOfScope?: string | null;
     touches?: readonly string[];
-    /** v24: an EXPLICIT profile skips resolution in the store (routine
-     * firings and the demo's illustrative scopes use this road). */
+    /** v24: an EXPLICIT profile skips resolution in the store (a schedule's
+     * approved firings and the demo's illustrative scopes use this road). */
     profile?: ExecutionProfile;
     /** A task-level permission choice. When absent, the task's stored choice
      * (if any), then the installation default, decides the concrete profile. */
@@ -347,9 +336,6 @@ export type ScopeInput = {
     qualityMode?: QualityMode;
     /** v69: a prepared commit to install as this attempt — no agent runs. */
     candidate?: string | null;
-    /** v47: the task's declared risk. When absent, the task's stored choice
-     * (if any), else routine. A durable TASK choice, like qualityMode. */
-    riskLevel?: RiskLevel;
     /** Integer micro-dollars per build attempt; digest-bound when present. */
     budgetMicrousd?: number | null;
     /** The mode road's escalated filing default (C7): the resolved profile
@@ -504,7 +490,7 @@ export declare function authenticateAccount(store: Store, by: string, secret: st
  * v100: someone who signed in with the identity provider moments ago has no
  * password to type again. The console marks such a request with this, for
  * that person only, and an EMPTY password then stands for the fresh sign-in
- * at every step-up that reaches `authenticateApprover` (scope and routine
+ * at every step-up that reaches `authenticateApprover` (scope
  * approval, chat-action review, the console's own ceremonies). A typed
  * password is always checked, and nothing else stands in.
  */
@@ -574,12 +560,10 @@ export declare function approvalOf(scope: Scope | null): Approval;
 /**
  * THE STRICT STORED-SCOPE PROJECTION (v48 integrity): the ONE reading of
  * a filed scope that a seal and every consent surface believe. Nothing
- * lenient stands in for it — the working profile, chain, and route are
+ * lenient stands in for it — the working profile and route are
  * re-parsed from their raw bytes with exact keys, safe integers, and
- * timer-safe clocks; the chain's entries carry a well-formed auth mode;
- * the route's build and repair legs ARE the profile's exact pairs; on a
- * chain filing the profile IS the chain's entry zero; and the row's
- * digest re-derives, complete, from these very values. A legacy row (no
+ * timer-safe clocks; the route's build and repair legs ARE the profile's
+ * exact pairs; and the row's digest re-derives, complete, from these very values. A legacy row (no
  * route era) has no authority a person can newly agree to. One
  * disagreement is the words, and nothing — no nonce, no password field,
  * no approve action, no seal — is exposed on it.
@@ -587,7 +571,6 @@ export declare function approvalOf(scope: Scope | null): Approval;
 export type ScopeAuthority = {
     ok: true;
     profile: ExecutionProfile;
-    chain: ChainEntry[] | null;
     route: PhaseRoute;
     digest: string;
     authMode: AuthMode | null;
@@ -637,40 +620,3 @@ export declare function acceptanceWords(criteria: readonly AcceptanceCriterion[]
 export declare function scopeRouteWords(scope: Pick<Scope, "proposedRouteJson">, readiness?: ReadinessLookup): string[];
 /** The scope, in the words an operator has to be able to agree or disagree with. */
 export declare function describeScope(scope: Scope, readiness?: ReadinessLookup): string[];
-/** The chain's approval-card lines; empty for a single-profile scope. */
-export declare function chainWords(chain: ChainEntry[] | null): string[];
-/**
- * EVERY rendered term of one watched attempt — what the form shows is what
- * the password signs, byte for byte. The subset the dispatch proof
- * re-derives (scopeDigest, profileDigest, profileJson, repo, head) is read
- * back by the builder and the coordinator; the rest are the product terms
- * the ceremony renders in words: the budget as a STOP THRESHOLD, the turn
- * cap, the per-turn clock whose expiry is SESSION-FATAL, and the absolute
- * expiry. Continuation carries the parent attempt and the follow-up text
- * INSIDE the signed terms (v3 R7).
- */
-export type AttendedTerms = {
-    taskId: string;
-    /** v28: HOW liveness is renewed — a SIGNED term, because liveness is an
-     * admission predicate, not decoration. "console-visible" = any open
-     * console page of this server renews use. Legacy terms lack the field
-     * and beat-all refuses them (they were signed as page-bound). */
-    attentionMode: "console-visible";
-    scopeDigest: string;
-    profileDigest: string;
-    profileJson: string;
-    repo: string;
-    runner: string;
-    runnerGeneration: number;
-    head: string;
-    maxSessionTurns: number;
-    budgetMicrousd: number;
-    turnTimeoutSeconds: number;
-    absoluteExpiry: string;
-    parentRun?: number | null;
-    followup?: string | null;
-};
-/** Deterministic bytes: sorted keys, undefined dropped — the signed text. */
-export declare function attendedTermsJson(terms: AttendedTerms): string;
-/** The composite digest one password signs (ruling 12), domain-separated. */
-export declare function attendedDigestOf(terms: AttendedTerms): string;

package/dist/scope.js

@@ -36,7 +36,7 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
-import { NO_READINESS, exactModelId, isRiskLevel, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
+import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
     return randomBytes(32).toString("base64url");
@@ -129,9 +129,10 @@ export function profileDigestOf(profile) {
         .digest("hex")
         .slice(0, 32);
 }
-// ---- fallback chains (v30) ------------------------------------------------
-// The version this build stamps into a chain snapshot AND folds into the
-// chain digest. Bumping it is a re-attestation, never a silent change.
+// ---- fallback chains (v30-v114; removed in v115) --------------------------
+// History only: an approval sealed over a fallback chain still decodes and
+// its digest still re-derives, so old tasks verify and render. Nothing
+// files, seals, or dispatches a chain any more.
 export const CHAIN_DIGEST_VERSION = 1;
 /** The stored snapshot bytes for a chain: the version rides IN the
  * snapshot, exactly like a single profile's. */
@@ -148,19 +149,6 @@ export function chainDigestOf(entries) {
         .digest("hex")
         .slice(0, 32);
 }
-/**
- * One chain entry's BINDING digest (E3d): the profile digest + auth mode
- * under their own domain. A run row pins this at admission (or base-cycle
- * open), and the dispatch proof re-derives it from the approved chain at
- * the run's index — so nothing downstream can swap WHICH entry a run
- * spends as, in model or in credential.
- */
-export function entryDigestOf(entry) {
-    return createHash("sha256")
-        .update(`standing-orders:chain-entry:v${CHAIN_DIGEST_VERSION}:${profileDigestOf(entry.profile)}:${entry.authMode}`, "utf8")
-        .digest("hex")
-        .slice(0, 32);
-}
 /** Strict re-hydration of a stored chain — every entry proved through the
  * single-profile rehydrator; anything unexpected is null. */
 export function chainFromJson(json) {
@@ -409,7 +397,7 @@ export function profileFromJson(json) {
 }
 /**
  * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
- * console form, a routine or template definition): fail closed, every
+ * console form, a template or a schedule's terms): fail closed, every
  * problem reported at once, each naming its path — the acceptance contract
  * (contracts/scope.ts) reads it. An absent or empty `value` parses to `[]`
  * with no problems: whether that is ALLOWED is a question for the caller
@@ -569,7 +557,7 @@ route) {
         .slice(0, 32);
 }
 export function propose(store, input) {
-    const { taskId, goal, outOfScope = null, touches = [], budgetMicrousd = null, acceptance = [], qualityMode = "default", now, mutation = {}, profile, permissionMode, posture, proposedVia = null, riskLevel } = input;
+    const { taskId, goal, outOfScope = null, touches = [], budgetMicrousd = null, acceptance = [], qualityMode = "default", now, mutation = {}, profile, permissionMode, posture, proposedVia = null } = input;
     const draft = { goal, outOfScope, touches: [...touches], budgetMicrousd, acceptance: [...acceptance], qualityMode, candidate: input.candidate ?? null };
     const previous = store.getScope(taskId);
     const scope = {
@@ -590,7 +578,6 @@ export function propose(store, input) {
         ...(profile === undefined ? {} : { profile }),
         ...(permissionMode === undefined ? {} : { permissionMode }),
         ...(input.qualityMode === undefined ? {} : { qualityMode: input.qualityMode }),
-        ...(riskLevel === undefined || !isRiskLevel(riskLevel) ? {} : { riskLevel }),
         ...(posture === undefined ? {} : { posture }),
         proposedVia,
     });
@@ -755,7 +742,7 @@ export function authenticateAccount(store, by, secret) {
  * v100: someone who signed in with the identity provider moments ago has no
  * password to type again. The console marks such a request with this, for
  * that person only, and an EMPTY password then stands for the fresh sign-in
- * at every step-up that reaches `authenticateApprover` (scope and routine
+ * at every step-up that reaches `authenticateApprover` (scope
  * approval, chat-action review, the console's own ceremonies). A typed
  * password is always checked, and nothing else stands in.
  */
@@ -990,16 +977,10 @@ export function scopeAuthorityOf(scope, env = {}) {
     if (profile === null) {
         return { ok: false, reason: "profile", problem: profileJson === null ? "the scope carries no agent profile" : "the scope's agent profile cannot be read exactly (unknown keys, an unsafe number, or a clock no timer can hold)" };
     }
-    const chainJson = scope.proposedChainJson ?? null;
-    const chain = chainJson === null ? null : chainFromJson(chainJson);
-    if (chainJson !== null && chain === null) {
-        return { ok: false, reason: "chain", problem: "the scope's fallback chain cannot be read exactly (unknown keys, a malformed auth mode, or an entry that is not a whole profile)" };
-    }
-    if (chain !== null) {
-        const base = chain[0];
-        if (base === undefined || profileDigestOf(base.profile) !== profileDigestOf(profile)) {
-            return { ok: false, reason: "parity", problem: "the scope's agent profile is not its fallback chain's first entry" };
-        }
+    // A scope filed with fallback agents (v30-v114) holds no authority now
+    // that fallback chains are gone: saving it again chooses its agents.
+    if (scope.proposedChainJson != null) {
+        return { ok: false, reason: "chain", problem: "this scope named fallback agents, which Toolroll no longer uses — save the scope again to choose its agents" };
     }
     const routeJson = scope.proposedRouteJson ?? null;
     const route = routeFromJson(routeJson);
@@ -1009,7 +990,7 @@ export function scopeAuthorityOf(scope, env = {}) {
     const parity = routeParityProblem(route, profile, { riskLevel: scope.riskLevel ?? "routine", qualityMode: scope.qualityMode ?? "default" });
     if (parity !== null)
         return { ok: false, reason: "parity", problem: parity };
-    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" }, chain !== null ? { chain } : profile, route);
+    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" }, profile, route);
     if (digest !== scope.digest) {
         return { ok: false, reason: "digest", problem: "the scope's reference does not re-derive from its own terms, agents, and route — file it again" };
     }
@@ -1018,31 +999,15 @@ export function scopeAuthorityOf(scope, env = {}) {
     // strict reader — a present mode file that says neither word closes
     // the door in its words, never the default a lenient read would coerce
     // it to (the spawn reads the same way, so nothing sealed here spends
-    // on a credential the operator never named). A chain filing carries
-    // its base entry's pinned mode and must agree with the live file too.
+    // on a credential the operator never named).
     let authMode = null;
     if (env.authMode !== undefined) {
         const read = env.authMode(profile.provider);
         if (!read.ok)
             return { ok: false, reason: "auth-mode", problem: read.problem };
         authMode = read.mode;
-        // PINNED AND LIVE AUTH AGREE, or nothing (final authority closure): a
-        // chain filed under one credential for its base entry, read beside a
-        // live mode file that now says the other, is a scope whose signed
-        // words no longer describe what would spend — a subscription chain
-        // approved after the operator moved to an API key would bill the
-        // key. It holds no authority until it is filed again under today's
-        // mode.
-        const base = chain === null ? null : chain[0] ?? null;
-        if (base !== null && base.authMode !== authMode) {
-            return {
-                ok: false,
-                reason: "auth-mode",
-                problem: `the scope's fallback chain pins its base entry to ${base.authMode === "subscription" ? "your subscription" : "your API key"} for ${profile.provider}, but the live auth mode is now ${authMode === "subscription" ? "your subscription" : "your API key"} — re-file the scope under today's mode`,
-            };
-        }
     }
-    return { ok: true, profile, chain, route, digest, authMode };
+    return { ok: true, profile, route, digest, authMode };
 }
 /** The rubric's approval-card lines (v39): one per criterion, the id in
  * front (the exact string a proof must answer by) and its required
@@ -1075,32 +1040,13 @@ export function describeScope(scope, readiness = NO_READINESS) {
         ...(scope.budgetMicrousd === null
             ? []
             : [`  budget       $${(scope.budgetMicrousd / 1_000_000).toFixed(2)} per build attempt — the agent is stopped at this figure`]),
-        // The FALLBACK CHAIN, in the words the yes agrees to (Layer F): when
-        // this scope files under configured fallbacks, the digest above binds
-        // the WHOLE ordered chain — so the card says every entry, credential
-        // included, before anyone signs.
-        ...chainWords(chainFromJson(scope.proposedChainJson ?? null)),
-        // The ROUTE, in the words the yes agrees to (v47): risk, posture, and
-        // every leg with its reason and readiness — before anyone signs.
-        ...(scope.riskLevel === undefined || scope.riskLevel === "routine" ? [] : [`  risk         ${scope.riskLevel}`]),
+        // The ROUTE, in the words the yes agrees to (v47): posture and every
+        // leg with its reason and readiness — before anyone signs.
         ...scopeRouteWords(scope, readiness),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];
 }
-/** The chain's approval-card lines; empty for a single-profile scope. */
-export function chainWords(chain) {
-    if (chain === null || chain.length < 2)
-        return [];
-    const credential = (mode) => mode === "subscription" ? "your subscription" : "your API key";
-    const lines = [];
-    const base = chain[0];
-    lines.push(`  runs on      ${base.profile.provider} (${base.profile.model}) — ${credential(base.authMode)}`);
-    for (const entry of chain.slice(1)) {
-        lines.push(`  if that runs out  falls back to ${entry.profile.provider} (${entry.profile.model}) — ${credential(entry.authMode)}${entry.authMode === "api-key" ? "; spend moves to that account" : ""}`);
-    }
-    return lines;
-}
 function describeApproval(approval) {
     if (approval.approved)
         return `yes, by ${approval.by} at ${approval.at}`;
@@ -1109,14 +1055,3 @@ function describeApproval(approval) {
     }
     return "no — nothing will build this until somebody agrees to it";
 }
-/** Deterministic bytes: sorted keys, undefined dropped — the signed text. */
-export function attendedTermsJson(terms) {
-    return canonicalJson(terms);
-}
-/** The composite digest one password signs (ruling 12), domain-separated. */
-export function attendedDigestOf(terms) {
-    return createHash("sha256")
-        .update(`standing-orders:attended:${attendedTermsJson(terms)}`)
-        .digest("hex")
-        .slice(0, 32);
-}

package/dist/serve.js

@@ -115,7 +115,7 @@ import { createFlowsHandlers } from './server/flows.js';
 import { createPagesHandlers } from './server/pages.js';
 import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
-import { beatScript, BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
+import { BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
 import { createTasksHandlers } from './server/tasks.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
@@ -429,7 +429,7 @@ export function createDecisionServer(options) {
     /** One-click connections on their way: the service's sign-in page and back, 15 minutes at most. */
     const connectVisits = new Map();
     /** Flows open in a browser (v88): who's here, and a nudge when one changes. */
-    // Live views push on write (live-bus.ts): the revision triggers move, the rooms hear it.
+    // Live views push on write (live-bus.ts): each commit moves the workspace revision, the rooms hear it.
     const liveBus = createLiveBus();
     const liveFollower = followWorkspace(store, () => workspaceRevision.current(), liveBus, { file: store.databaseFile() });
     const flowRooms = createFlowRooms(flow => flowFingerprint(store, flow), { bus: liveBus });
@@ -738,7 +738,7 @@ export function createDecisionServer(options) {
                     }
                     return handlePost(route, url, who, request, response, body);
                 };
-                if (method === "GET" || url.pathname === "/session/attended-beats")
+                if (method === "GET")
                     return projectAuthority.run({ actor: who.name, repo: target.repo }, execute);
                 // Request acceptance is separate from durable work completion. Never
                 // persist a body, query string, token, password, or arbitrary URL.
@@ -797,18 +797,16 @@ export function createDecisionServer(options) {
         const task = matchTaskPath(url.pathname, "(?:/([a-z-]+))?$");
         if (task !== null)
             return { repo: store.lookupRef(task.taskId)?.repo ?? null, taskId: task.taskId, runId: null, action: `task ${task.verb || "view"}` };
-        const resource = /^\/(r|d|i|routines)\/([0-9]{1,15})(?:\/([a-z-]+)(?:\/[0-9]+)?)?$/.exec(url.pathname);
+        const resource = /^\/(r|d|i)\/([0-9]{1,15})(?:\/([a-z-]+)(?:\/[0-9]+)?)?$/.exec(url.pathname);
         if (resource !== null) {
             const id = Number(resource[2]);
-            if (resource[1] === "routines")
-                return { repo: store.getRoutine(id)?.repo ?? null, taskId: null, runId: null, action: `routine ${resource[3] ?? "view"}` };
             const runId = resource[1] === "r" ? id : resource[1] === "d" ? store.getDecision(id)?.run ?? null : store.openIncidents().find(one => one.id === id)?.run ?? null;
             const run = runId === null ? null : store.getRun(runId);
             const ref = run === null ? null : store.refForId(run.taskRef);
             return { repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId, action: `${resource[1] === "d" ? "decision" : resource[1] === "i" ? "incident" : "run"} ${resource[3] ?? "view"}` };
         }
-        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
-        const placed = ["/tasks/add", "/routines/add"].includes(url.pathname) ? body?.get("repo")?.trim() : null;
+        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
+        const placed = url.pathname === "/tasks/add" ? body?.get("repo")?.trim() : null;
         return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
     }
@@ -1170,7 +1168,7 @@ export function createDecisionServer(options) {
             { label: "board", href: "/board?scope=all" },
             { label: "queue", href: QUEUE_VIEW },
             { label: "workbench", href: "/workbench" },
-            { label: "routines", href: "/routines" },
+            { label: "flows", href: "/flows" },
             { label: "done", href: "/done" },
             { label: "review cockpit", href: "/review" },
             { label: "task list", href: "/tasks" },
@@ -1188,7 +1186,7 @@ export function createDecisionServer(options) {
             entries.push({ label: `${one.id} — ${one.title}`, href: `/t/${encodeURIComponent(one.id)}` });
         }
         const saturated = open.length > 200;
-        const safeEntries = restricted() ? entries.filter(one => ["/work", "/work?view=needs-you", "/", "/board", "/routines", "/done", "/review", "/tasks", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
+        const safeEntries = restricted() ? entries.filter(one => ["/work", "/work?view=needs-you", "/", "/board", "/flows", "/done", "/review", "/tasks", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
         const json = JSON.stringify(saturated ? [...safeEntries, { label: "… more in the task list", href: "/tasks" }] : safeEntries)
             .replace(/</g, "\\u003c");
         return `<script type="application/json" id="palette-index">${json}</script>`;
@@ -1343,7 +1341,7 @@ export function createDecisionServer(options) {
             // A page with its own view keeps its script; the chat page runs the result script.
             const functional = conversation === null || extras.view ? (s.functional?.script ?? '') : RESULT_REVIEW_SCRIPT;
             const document = shell(s.title, s.body, { chrome: s.chrome, sensitive });
-            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + beatScript(!restricted()) + MOBILE_VIEWPORT_SCRIPT), nonce, true);
+            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT), nonce, true);
         }
         // A one-time secret on screen (a token, an invite link, a pairing code): the
         // page carries no script of any kind, so it leaves the workspace for a
@@ -1352,13 +1350,9 @@ export function createDecisionServer(options) {
             return page(response, status, focusDocument(s.title, s.body));
         const chromeLayer = !sensitive && s.chrome !== undefined;
         const functional = s.functional?.script ?? "";
-        // Sensitive pages strip the palette and keys but keep the MINIMAL beat
-        // (round-1 finding 3): reading a ceremony for a minute must not lapse
-        // every other session. The beat reads no DOM and posts no parameters.
-        const sensitiveChrome = sensitive && s.chrome !== undefined
-            ? beatScript(!restricted()) + sidebarScript()
-            : "";
-        const script = functional + (chromeLayer ? chromeScript(!restricted()) + WORKSPACE_MOTION_SCRIPT : sensitiveChrome);
+        // Sensitive pages strip the palette and keys but keep the sidebar toggle.
+        const sensitiveChrome = sensitive && s.chrome !== undefined ? sidebarScript() : "";
+        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT : sensitiveChrome);
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
         const body = chromeLayer
             ? `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
@@ -1370,8 +1364,8 @@ export function createDecisionServer(options) {
             ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: s.refreshSeconds }),
             ...(nonce === undefined ? {} : { live: { nonce, script, fallbackRefresh: s.functional?.fetches === true } }),
         });
-        // v28: the chrome layer itself fetches (the attended beat), so any
-        // page that ships it needs connect-src — not only pages whose own
+        // Pages that ship the chrome layer keep connect-src (v28 granted it for
+        // the since-removed watched-session beat), beside pages whose own
         // functional script polls.
         return page(response, status, html, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
@@ -1462,7 +1456,7 @@ export function createDecisionServer(options) {
                 : {
                     modeBanner: {
                         name: liveMode.name,
-                        words: `${liveMode.name} mode until ${liveMode.absoluteExpiry.slice(0, 16).replace("T", " ")} UTC${liveModeTerms.autoApproveFiling ? ` — every scope ${liveMode.signedBy} files builds without further ceremony` : ""}${liveModeTerms.permissionDefault === "escalated" ? " — FULL permissions by default" : ""}${liveModeTerms.quickMint ? ` — ${liveMode.signedBy} starts watched sessions without a password` : ""}${liveModeTerms.publication === "automerge" ? " — merges fire themselves on green" : ""}`,
+                        words: `${liveMode.name} mode until ${liveMode.absoluteExpiry.slice(0, 16).replace("T", " ")} UTC${liveModeTerms.autoApproveFiling ? ` — every scope ${liveMode.signedBy} files builds without further ceremony` : ""}${liveModeTerms.permissionDefault === "escalated" ? " — FULL permissions by default" : ""}${liveModeTerms.publication === "automerge" ? " — merges fire themselves on green" : ""}`,
                     },
                 }),
             ...(!restricted() && !unscopedMode && managedRepos().length > 0 ? { chat: true } : {}),
@@ -1535,8 +1529,6 @@ export function createDecisionServer(options) {
     };
     async function handlePost(route, url, who, request, response, posted) {
         const early = () => dispatchConsole(route, { url, who, request, response, route, now: clock(), project: projectOf(who, request) ?? null, chosenProject: projectOf(who, request) ?? null, posted });
-        if (route.id === 'session.attended-beats')
-            return early();
         const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
             return refuse(response, who, denied.status, denied.message);
@@ -1550,8 +1542,7 @@ export function createDecisionServer(options) {
         // THE CENTRAL VIEWER GATE (modes chain, D2/E2): consequential POSTs
         // require ACTIVE approver standing — cookie and bearer alike — with
         // an EXACT allowlist of session-local acts, never a prefix. /login,
-        // /logout and /join answer before this handler; the attended beat
-        // guards itself (approver-only) above.
+        // /logout and /join answer before this handler.
         if (who.role === "viewer") {
             if (route.viewer !== true) {
                 return refuse(response, who, 403, "your login can watch, not act — ask an approver to upgrade you");

package/dist/server/chat.js

@@ -23,7 +23,7 @@ import { MATE_MESSAGE_MAX_CHARS, runMateTurn } from "../mate.js";
 import { livePin, modelOptions } from "../model-catalog.js";
 import { verifyApproverByPassword, verifyApproverStanding } from "../principal.js";
 import { projectName } from "../project.js";
-import { fileRoutineProposal, fileTaskProposal } from "../proposal.js";
+import { fileTaskProposal } from "../proposal.js";
 import { providerName } from "../provider-auth.js";
 import { validModelId } from "../provider.js";
 import { loadOrCreateVapidKeys, validatePushEndpoint } from "../push.js";
@@ -763,7 +763,7 @@ export function createChatHandlers(runtime) {
                     noteMate(who.session.csrf, null, "that proposal was already acted on");
                 return redirect(response, chatReturnWithLatest(back));
             }
-            const outcome = confirmMateProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, held: options.attended?.coordinator, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+            const outcome = confirmMateProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
             if (cardJson) {
                 if (!outcome.ok)
                     return cardAnswer(outcome.reason === "standing" ? 403 : outcome.reason === "not-yours" ? 404 : 409, false, outcome.said);
@@ -1005,43 +1005,20 @@ export function createChatHandlers(runtime) {
             // Re-validated at the act: the door runs every field check again, and
             // the fields are scanned for secrets before they become durable.
             const acceptanceFields = candidate.draft.acceptance.flatMap(c => [c.statement, ...(c.how === null ? [] : [c.how])]);
-            const fields = candidate.draft.kind === "task"
-                ? [candidate.draft.title, candidate.draft.goal, candidate.draft.outOfScope ?? "", ...candidate.draft.touches, ...acceptanceFields]
-                : [candidate.draft.name, candidate.draft.goal, candidate.draft.outOfScope ?? "", ...candidate.draft.touches, ...acceptanceFields];
+            const fields = [candidate.draft.title, candidate.draft.goal, candidate.draft.outOfScope ?? "", ...candidate.draft.touches, ...acceptanceFields];
             if (scanForSecrets(fields.join("\n")).length > 0) {
                 chat.candidates.delete(key);
                 return refuse(response, who, 400, "that draft contains something credential-shaped — discarded", "/chat");
             }
             const filedVia = `chat:${enabled.config.provider}`;
-            if (candidate.draft.kind === "task") {
-                const made = fileTaskProposal(store, {
-                    title: candidate.draft.title,
-                    repo: candidate.repoPath,
-                    goal: candidate.draft.goal,
-                    outOfScope: candidate.draft.outOfScope,
-                    touches: candidate.draft.touches,
-                    acceptance: candidate.draft.acceptance,
-                    filedVia, filedBy: { name: who.name, kind: "person" },
-                    admittedRepos: managedRepos(),
-                }, now);
-                if (!made.ok) {
-                    candidate.state = "pending";
-                    return refuse(response, who, 400, `the door refused it: ${made.message}`, "/chat");
-                }
-                chat.candidates.delete(key);
-                return redirect(response, taskHref(made.id));
-            }
-            const made = fileRoutineProposal(store, {
-                name: candidate.draft.name,
+            const made = fileTaskProposal(store, {
+                title: candidate.draft.title,
                 repo: candidate.repoPath,
                 goal: candidate.draft.goal,
                 outOfScope: candidate.draft.outOfScope,
                 touches: candidate.draft.touches,
                 acceptance: candidate.draft.acceptance,
-                requirements: [],
-                schedule: candidate.draft.schedule,
-                costCeilingUsd: null,
-                filedVia, createdBy: who.name,
+                filedVia, filedBy: { name: who.name, kind: "person" },
                 admittedRepos: managedRepos(),
             }, now);
             if (!made.ok) {
@@ -1049,7 +1026,7 @@ export function createChatHandlers(runtime) {
                 return refuse(response, who, 400, `the door refused it: ${made.message}`, "/chat");
             }
             chat.candidates.delete(key);
-            return redirect(response, `/routines/${made.id}`);
+            return redirect(response, taskHref(made.id));
         }
         const chatAckPost = /^\/chat\/ack\/([0-9]{1,15})$/.exec(url.pathname);
         if (chatAckPost !== null) {

package/dist/server/flows.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import {} from "node:http";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { resolveRoutineAuthority } from "../agentconfig.js";
+import { resolveAgentAuthority } from "../agentconfig.js";
 import { checkResponse, CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { stageReferenceProblems } from "../contracts/stage-output.js";
 import { LIMITS } from "../decision.js";
@@ -17,7 +17,7 @@ import { assignFlowCard, commentOnFlowCard, watchFlowCard } from "../flow-people
 import { saveScript } from "../flow-scripts.js";
 import { chooseFlowCard } from "../flow-send.js";
 import { exportFlow, fetchFlowFile, FlowFileError, importFlow, parseFlowFile, planFlowImport } from "../flow-share.js";
-import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, renewFlowHook, saveHooksBase, saveLinearKey, saveLinearSigningSecret, shareFlowButton, stopSharingFlowButton } from "../flow-triggers.js";
+import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveLinearSigningSecret, shareFlowButton, stopSharingFlowButton } from "../flow-triggers.js";
 import { FLOW_IMPORT_SCRIPT, flowFallbackHtml, flowImportHtml, flowsListHtml, flowView } from "../flows-ui.js";
 import { FLOW_TEMPLATES, FlowContractError, validateFlowDefinition, withZoneNames } from "../flows.js";
 import { keyStatus } from "../keys.js";
@@ -169,11 +169,12 @@ export function createFlowsHandlers(runtime) {
                 const revision = who.via === "cookie" ? who.session.projectRevision : 0;
                 const render = (html) => sendScreen(response, 200, screen("Workflow recipes", html, { chrome: chromeFor(project, "recipes"), functional: { script: recipeScript() } }));
                 if (url.pathname === "/recipes") {
-                    const recent = project === null ? [] : store.handle.prepare("SELECT document,task_id,routine_id FROM workflow_preview WHERE repo=? AND (task_id IS NOT NULL OR routine_id IS NOT NULL) ORDER BY created_at DESC LIMIT 12").all(project).map(row => {
+                    const recent = project === null ? [] : store.handle.prepare("SELECT document,task_id,flow_id FROM workflow_preview WHERE repo=? AND (task_id IS NOT NULL OR flow_id IS NOT NULL) ORDER BY created_at DESC LIMIT 12").all(project).map(row => {
                         const d = importRecipe(String(row["document"]));
                         const task = row["task_id"] === null ? null : store.getTask(String(row["task_id"]));
-                        const routine = row["routine_id"] === null ? null : store.getRoutine(Number(row["routine_id"]));
-                        return { name: d.name, href: task !== null ? taskHref(task.id) : `/routines/${routine?.id}`, state: task?.state ?? (routine?.approvedAt === null ? "Needs approval" : routine?.paused ? "Paused" : "Scheduled") };
+                        const flow = row["flow_id"] === null ? null : store.getFlow(Number(row["flow_id"]));
+                        const on = flow !== null && flow.state === "active" && store.flowTriggers(flow.id).some(one => one.kind === "schedule" && one.state === "active");
+                        return { name: d.name, href: task !== null ? taskHref(task.id) : `/flows/${Number(row["flow_id"])}`, state: task?.state ?? (flow === null || flow.state !== "active" ? "Archived" : on ? "Scheduled" : "Paused") };
                     });
                     return render(recipeLibraryHtml(starterRecipes(), project === null ? [] : savedRecipes(store, who.name, project), project, csrf, revision, recent));
                 }
@@ -215,7 +216,7 @@ export function createFlowsHandlers(runtime) {
                 if (url.pathname === "/recipes/preview" && preview !== null) {
                     if (preview.document.version === 2 || url.searchParams.get("purpose") === "recipe")
                         return render(recipeDefinitionPreviewHtml(preview, csrf, revision));
-                    const agents = resolveRoutineAuthority(store, project, preview.document.acceptance, now);
+                    const agents = resolveAgentAuthority(store, project, preview.document.acceptance, now);
                     const workers = store.listRunners().filter(one => one.retiredAt === null && one.repos.includes(project) && runnerAlive(one, now));
                     const mode = store.activeMode(project, now);
                     const readiness = [
@@ -498,7 +499,7 @@ export function createFlowsHandlers(runtime) {
                     return answer(404, { ok: false, said: "That trigger isn't on this flow." });
                 const verb = triggerPost[3];
                 if (verb === "pause" || verb === "resume") {
-                    store.updateFlowTrigger(trigger.id, { state: verb === "pause" ? "paused" : "active" }, now);
+                    setFlowTriggerOn(store, trigger, verb === "resume", now);
                     return settle(verb === "pause" ? "Trigger paused." : "Trigger on again.");
                 }
                 if (verb === "remove") {
@@ -722,8 +723,8 @@ export function createFlowsHandlers(runtime) {
                     const sourceVersion = body.get("sourceRevision") ?? "1";
                     if (!/^[1-9][0-9]{0,8}$/.test(sourceVersion))
                         throw new RecipeError("Choose a valid recipe version.");
-                    const original = ["custom", "imported", "task-copy", "routine-copy"].includes(source) ? null : findRecipe(store, who.name, project, source, Number(sourceVersion));
-                    if (original === null && !["custom", "imported", "task-copy", "routine-copy"].includes(source))
+                    const original = ["custom", "imported", "task-copy"].includes(source) ? null : findRecipe(store, who.name, project, source, Number(sourceVersion));
+                    if (original === null && !["custom", "imported", "task-copy"].includes(source))
                         throw new RecipeError("That recipe version is not available in this project.", 404);
                     let document;
                     try {
@@ -753,7 +754,7 @@ export function createFlowsHandlers(runtime) {
                     if (context !== undefined)
                         context.createdTask = made.taskId;
                 }
-                return redirect(response, made.taskId === null ? `/routines/${made.routineId}` : taskHref(made.taskId));
+                return redirect(response, made.taskId === null ? `/flows/${made.flowId}` : taskHref(made.taskId));
             }
             catch (error) {
                 if (error instanceof RecipeError)

package/dist/server/guards.js

@@ -152,7 +152,6 @@ export function createSharedGuards(runtime) {
             case 'run': return runRepo(id);
             case 'decision': return runRepo(runtime.store.getDecision(id)?.run);
             case 'incident': return runRepo(runtime.store.openIncidents().find(one => one.id === id)?.run);
-            case 'routine': return runtime.store.getRoutine(id)?.repo ?? null;
             case 'flow': return runtime.store.getFlow(id)?.repo ?? null;
             case 'proposal':
             case 'coding': return runtime.actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget)).repo;