toolroll 0.9.52 → 0.9.53

package/dist/scope.js

@@ -36,7 +36,7 @@ import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
 import { readAcceptance, readScopeTerms, storedRubricSchema } from "./contracts/scope.js";
-import { NO_READINESS, exactModelId, isRiskLevel, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
+import { NO_READINESS, exactModelId, legOf, projectRoute, routeDigestOf, routeFromJson, routeJsonProblem, routeWords, } from "./phase-routing.js";
 /** Same shape as a runner's credential, for the same reasons. */
 function mintToken() {
     return randomBytes(32).toString("base64url");
@@ -129,9 +129,10 @@ export function profileDigestOf(profile) {
         .digest("hex")
         .slice(0, 32);
 }
-// ---- fallback chains (v30) ------------------------------------------------
-// The version this build stamps into a chain snapshot AND folds into the
-// chain digest. Bumping it is a re-attestation, never a silent change.
+// ---- fallback chains (v30-v114; removed in v115) --------------------------
+// History only: an approval sealed over a fallback chain still decodes and
+// its digest still re-derives, so old tasks verify and render. Nothing
+// files, seals, or dispatches a chain any more.
 export const CHAIN_DIGEST_VERSION = 1;
 /** The stored snapshot bytes for a chain: the version rides IN the
  * snapshot, exactly like a single profile's. */
@@ -148,19 +149,6 @@ export function chainDigestOf(entries) {
         .digest("hex")
         .slice(0, 32);
 }
-/**
- * One chain entry's BINDING digest (E3d): the profile digest + auth mode
- * under their own domain. A run row pins this at admission (or base-cycle
- * open), and the dispatch proof re-derives it from the approved chain at
- * the run's index — so nothing downstream can swap WHICH entry a run
- * spends as, in model or in credential.
- */
-export function entryDigestOf(entry) {
-    return createHash("sha256")
-        .update(`standing-orders:chain-entry:v${CHAIN_DIGEST_VERSION}:${profileDigestOf(entry.profile)}:${entry.authMode}`, "utf8")
-        .digest("hex")
-        .slice(0, 32);
-}
 /** Strict re-hydration of a stored chain — every entry proved through the
  * single-profile rehydrator; anything unexpected is null. */
 export function chainFromJson(json) {
@@ -409,7 +397,7 @@ export function profileFromJson(json) {
 }
 /**
  * Parse a rubric from already-JSON-parsed input (the planner's handoff, a
- * console form, a routine or template definition): fail closed, every
+ * console form, a template or a schedule's terms): fail closed, every
  * problem reported at once, each naming its path — the acceptance contract
  * (contracts/scope.ts) reads it. An absent or empty `value` parses to `[]`
  * with no problems: whether that is ALLOWED is a question for the caller
@@ -569,7 +557,7 @@ route) {
         .slice(0, 32);
 }
 export function propose(store, input) {
-    const { taskId, goal, outOfScope = null, touches = [], budgetMicrousd = null, acceptance = [], qualityMode = "default", now, mutation = {}, profile, permissionMode, posture, proposedVia = null, riskLevel } = input;
+    const { taskId, goal, outOfScope = null, touches = [], budgetMicrousd = null, acceptance = [], qualityMode = "default", now, mutation = {}, profile, permissionMode, posture, proposedVia = null } = input;
     const draft = { goal, outOfScope, touches: [...touches], budgetMicrousd, acceptance: [...acceptance], qualityMode, candidate: input.candidate ?? null };
     const previous = store.getScope(taskId);
     const scope = {
@@ -590,7 +578,6 @@ export function propose(store, input) {
         ...(profile === undefined ? {} : { profile }),
         ...(permissionMode === undefined ? {} : { permissionMode }),
         ...(input.qualityMode === undefined ? {} : { qualityMode: input.qualityMode }),
-        ...(riskLevel === undefined || !isRiskLevel(riskLevel) ? {} : { riskLevel }),
         ...(posture === undefined ? {} : { posture }),
         proposedVia,
     });
@@ -755,7 +742,7 @@ export function authenticateAccount(store, by, secret) {
  * v100: someone who signed in with the identity provider moments ago has no
  * password to type again. The console marks such a request with this, for
  * that person only, and an EMPTY password then stands for the fresh sign-in
- * at every step-up that reaches `authenticateApprover` (scope and routine
+ * at every step-up that reaches `authenticateApprover` (scope
  * approval, chat-action review, the console's own ceremonies). A typed
  * password is always checked, and nothing else stands in.
  */
@@ -990,16 +977,10 @@ export function scopeAuthorityOf(scope, env = {}) {
     if (profile === null) {
         return { ok: false, reason: "profile", problem: profileJson === null ? "the scope carries no agent profile" : "the scope's agent profile cannot be read exactly (unknown keys, an unsafe number, or a clock no timer can hold)" };
     }
-    const chainJson = scope.proposedChainJson ?? null;
-    const chain = chainJson === null ? null : chainFromJson(chainJson);
-    if (chainJson !== null && chain === null) {
-        return { ok: false, reason: "chain", problem: "the scope's fallback chain cannot be read exactly (unknown keys, a malformed auth mode, or an entry that is not a whole profile)" };
-    }
-    if (chain !== null) {
-        const base = chain[0];
-        if (base === undefined || profileDigestOf(base.profile) !== profileDigestOf(profile)) {
-            return { ok: false, reason: "parity", problem: "the scope's agent profile is not its fallback chain's first entry" };
-        }
+    // A scope filed with fallback agents (v30-v114) holds no authority now
+    // that fallback chains are gone: saving it again chooses its agents.
+    if (scope.proposedChainJson != null) {
+        return { ok: false, reason: "chain", problem: "this scope named fallback agents, which Toolroll no longer uses — save the scope again to choose its agents" };
     }
     const routeJson = scope.proposedRouteJson ?? null;
     const route = routeFromJson(routeJson);
@@ -1009,7 +990,7 @@ export function scopeAuthorityOf(scope, env = {}) {
     const parity = routeParityProblem(route, profile, { riskLevel: scope.riskLevel ?? "routine", qualityMode: scope.qualityMode ?? "default" });
     if (parity !== null)
         return { ok: false, reason: "parity", problem: parity };
-    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" }, chain !== null ? { chain } : profile, route);
+    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" }, profile, route);
     if (digest !== scope.digest) {
         return { ok: false, reason: "digest", problem: "the scope's reference does not re-derive from its own terms, agents, and route — file it again" };
     }
@@ -1018,31 +999,15 @@ export function scopeAuthorityOf(scope, env = {}) {
     // strict reader — a present mode file that says neither word closes
     // the door in its words, never the default a lenient read would coerce
     // it to (the spawn reads the same way, so nothing sealed here spends
-    // on a credential the operator never named). A chain filing carries
-    // its base entry's pinned mode and must agree with the live file too.
+    // on a credential the operator never named).
     let authMode = null;
     if (env.authMode !== undefined) {
         const read = env.authMode(profile.provider);
         if (!read.ok)
             return { ok: false, reason: "auth-mode", problem: read.problem };
         authMode = read.mode;
-        // PINNED AND LIVE AUTH AGREE, or nothing (final authority closure): a
-        // chain filed under one credential for its base entry, read beside a
-        // live mode file that now says the other, is a scope whose signed
-        // words no longer describe what would spend — a subscription chain
-        // approved after the operator moved to an API key would bill the
-        // key. It holds no authority until it is filed again under today's
-        // mode.
-        const base = chain === null ? null : chain[0] ?? null;
-        if (base !== null && base.authMode !== authMode) {
-            return {
-                ok: false,
-                reason: "auth-mode",
-                problem: `the scope's fallback chain pins its base entry to ${base.authMode === "subscription" ? "your subscription" : "your API key"} for ${profile.provider}, but the live auth mode is now ${authMode === "subscription" ? "your subscription" : "your API key"} — re-file the scope under today's mode`,
-            };
-        }
     }
-    return { ok: true, profile, chain, route, digest, authMode };
+    return { ok: true, profile, route, digest, authMode };
 }
 /** The rubric's approval-card lines (v39): one per criterion, the id in
  * front (the exact string a proof must answer by) and its required
@@ -1075,32 +1040,13 @@ export function describeScope(scope, readiness = NO_READINESS) {
         ...(scope.budgetMicrousd === null
             ? []
             : [`  budget       $${(scope.budgetMicrousd / 1_000_000).toFixed(2)} per build attempt — the agent is stopped at this figure`]),
-        // The FALLBACK CHAIN, in the words the yes agrees to (Layer F): when
-        // this scope files under configured fallbacks, the digest above binds
-        // the WHOLE ordered chain — so the card says every entry, credential
-        // included, before anyone signs.
-        ...chainWords(chainFromJson(scope.proposedChainJson ?? null)),
-        // The ROUTE, in the words the yes agrees to (v47): risk, posture, and
-        // every leg with its reason and readiness — before anyone signs.
-        ...(scope.riskLevel === undefined || scope.riskLevel === "routine" ? [] : [`  risk         ${scope.riskLevel}`]),
+        // The ROUTE, in the words the yes agrees to (v47): posture and every
+        // leg with its reason and readiness — before anyone signs.
         ...scopeRouteWords(scope, readiness),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];
 }
-/** The chain's approval-card lines; empty for a single-profile scope. */
-export function chainWords(chain) {
-    if (chain === null || chain.length < 2)
-        return [];
-    const credential = (mode) => mode === "subscription" ? "your subscription" : "your API key";
-    const lines = [];
-    const base = chain[0];
-    lines.push(`  runs on      ${base.profile.provider} (${base.profile.model}) — ${credential(base.authMode)}`);
-    for (const entry of chain.slice(1)) {
-        lines.push(`  if that runs out  falls back to ${entry.profile.provider} (${entry.profile.model}) — ${credential(entry.authMode)}${entry.authMode === "api-key" ? "; spend moves to that account" : ""}`);
-    }
-    return lines;
-}
 function describeApproval(approval) {
     if (approval.approved)
         return `yes, by ${approval.by} at ${approval.at}`;
@@ -1109,14 +1055,3 @@ function describeApproval(approval) {
     }
     return "no — nothing will build this until somebody agrees to it";
 }
-/** Deterministic bytes: sorted keys, undefined dropped — the signed text. */
-export function attendedTermsJson(terms) {
-    return canonicalJson(terms);
-}
-/** The composite digest one password signs (ruling 12), domain-separated. */
-export function attendedDigestOf(terms) {
-    return createHash("sha256")
-        .update(`standing-orders:attended:${attendedTermsJson(terms)}`)
-        .digest("hex")
-        .slice(0, 32);
-}

package/dist/serve.js

@@ -115,7 +115,7 @@ import { createFlowsHandlers } from './server/flows.js';
 import { createPagesHandlers } from './server/pages.js';
 import { createPeopleHandlers } from './server/people-tokens.js';
 import { createSettingsHandlers } from './server/settings.js';
-import { beatScript, BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
+import { BODY_CAP, chromeScript, decisionsFor, DEMO_BANNER, DEMO_BANNER_SHORT, escape, focusDocument, form, KBD_HELP, LEAD_BY_DEFAULT_FACT, loginHref, matchTaskPath, mateBrowserMessages, mateChatVersion, NO_PROJECT, NO_TOUCH_FRAGMENTS, NONCE_CAP, NONCE_TTL_MS, page, PersistentSessions, pinnedTheme, projectChatHref, QUEUE_VIEW, redactedPath, redirect, refuse, requestContext, respond, safeReturn, screen, SENSITIVE_INPUT, SESSION_ABSOLUTE_MS, SESSION_IDLE_MS, shell, SHUTDOWN_WAIT_MS, sidebarScript, SIGN_IN_LINK_MS, SIGN_IN_LINK_PATH, ssoStepUps, TASK_FORM_BODY_CAP, taskChatHref, teamProposalCardParts, wrongHostPage } from "./server/shared.js";
 import { createTasksHandlers } from './server/tasks.js';
 import { DEFAULT_GUARD_POLICY, passwordGuardOf, provenPasswordAccount, SourceBudget, withPasswordSource } from "./sign-in-guard.js";
 import { sourceKey } from "./source-key.js";
@@ -738,7 +738,7 @@ export function createDecisionServer(options) {
                     }
                     return handlePost(route, url, who, request, response, body);
                 };
-                if (method === "GET" || url.pathname === "/session/attended-beats")
+                if (method === "GET")
                     return projectAuthority.run({ actor: who.name, repo: target.repo }, execute);
                 // Request acceptance is separate from durable work completion. Never
                 // persist a body, query string, token, password, or arbitrary URL.
@@ -797,18 +797,16 @@ export function createDecisionServer(options) {
         const task = matchTaskPath(url.pathname, "(?:/([a-z-]+))?$");
         if (task !== null)
             return { repo: store.lookupRef(task.taskId)?.repo ?? null, taskId: task.taskId, runId: null, action: `task ${task.verb || "view"}` };
-        const resource = /^\/(r|d|i|routines)\/([0-9]{1,15})(?:\/([a-z-]+)(?:\/[0-9]+)?)?$/.exec(url.pathname);
+        const resource = /^\/(r|d|i)\/([0-9]{1,15})(?:\/([a-z-]+)(?:\/[0-9]+)?)?$/.exec(url.pathname);
         if (resource !== null) {
             const id = Number(resource[2]);
-            if (resource[1] === "routines")
-                return { repo: store.getRoutine(id)?.repo ?? null, taskId: null, runId: null, action: `routine ${resource[3] ?? "view"}` };
             const runId = resource[1] === "r" ? id : resource[1] === "d" ? store.getDecision(id)?.run ?? null : store.openIncidents().find(one => one.id === id)?.run ?? null;
             const run = runId === null ? null : store.getRun(runId);
             const ref = run === null ? null : store.refForId(run.taskRef);
             return { repo: ref?.repo ?? null, taskId: ref?.externalId ?? null, runId, action: `${resource[1] === "d" ? "decision" : resource[1] === "i" ? "incident" : "run"} ${resource[3] ?? "view"}` };
         }
-        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/routines/add", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
-        const placed = ["/tasks/add", "/routines/add"].includes(url.pathname) ? body?.get("repo")?.trim() : null;
+        const known = new Set(["/recipes/prepare", "/recipes/preview", "/recipes/import", "/recipes/save", "/recipes/launch", "/tasks/add", "/queue/move", "/queue/note", "/people/invite", "/people/invite-revoke", "/people/revoke", "/people/projects", "/projects/select", "/projects/open", "/mode/confirm", "/mode/sign", "/mode/revoke", "/settings/chat-approval/save", "/settings/chat-approval/off"]);
+        const placed = url.pathname === "/tasks/add" ? body?.get("repo")?.trim() : null;
         return { repo: url.pathname.startsWith("/people/") ? null : placed ? canonicalProject(placed) ?? placed : projectOf(who, request) ?? null, taskId: null, runId: null,
             action: known.has(url.pathname) ? url.pathname.slice(1).replaceAll("/", " ") : "console request" };
     }
@@ -1170,7 +1168,7 @@ export function createDecisionServer(options) {
             { label: "board", href: "/board?scope=all" },
             { label: "queue", href: QUEUE_VIEW },
             { label: "workbench", href: "/workbench" },
-            { label: "routines", href: "/routines" },
+            { label: "flows", href: "/flows" },
             { label: "done", href: "/done" },
             { label: "review cockpit", href: "/review" },
             { label: "task list", href: "/tasks" },
@@ -1188,7 +1186,7 @@ export function createDecisionServer(options) {
             entries.push({ label: `${one.id} — ${one.title}`, href: `/t/${encodeURIComponent(one.id)}` });
         }
         const saturated = open.length > 200;
-        const safeEntries = restricted() ? entries.filter(one => ["/work", "/work?view=needs-you", "/", "/board", "/routines", "/done", "/review", "/tasks", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
+        const safeEntries = restricted() ? entries.filter(one => ["/work", "/work?view=needs-you", "/", "/board", "/flows", "/done", "/review", "/tasks", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
         const json = JSON.stringify(saturated ? [...safeEntries, { label: "… more in the task list", href: "/tasks" }] : safeEntries)
             .replace(/</g, "\\u003c");
         return `<script type="application/json" id="palette-index">${json}</script>`;
@@ -1343,7 +1341,7 @@ export function createDecisionServer(options) {
             // A page with its own view keeps its script; the chat page runs the result script.
             const functional = conversation === null || extras.view ? (s.functional?.script ?? '') : RESULT_REVIEW_SCRIPT;
             const document = shell(s.title, s.body, { chrome: s.chrome, sensitive });
-            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + beatScript(!restricted()) + MOBILE_VIEWPORT_SCRIPT), nonce, true);
+            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT), nonce, true);
         }
         // A one-time secret on screen (a token, an invite link, a pairing code): the
         // page carries no script of any kind, so it leaves the workspace for a
@@ -1352,13 +1350,9 @@ export function createDecisionServer(options) {
             return page(response, status, focusDocument(s.title, s.body));
         const chromeLayer = !sensitive && s.chrome !== undefined;
         const functional = s.functional?.script ?? "";
-        // Sensitive pages strip the palette and keys but keep the MINIMAL beat
-        // (round-1 finding 3): reading a ceremony for a minute must not lapse
-        // every other session. The beat reads no DOM and posts no parameters.
-        const sensitiveChrome = sensitive && s.chrome !== undefined
-            ? beatScript(!restricted()) + sidebarScript()
-            : "";
-        const script = functional + (chromeLayer ? chromeScript(!restricted()) + WORKSPACE_MOTION_SCRIPT : sensitiveChrome);
+        // Sensitive pages strip the palette and keys but keep the sidebar toggle.
+        const sensitiveChrome = sensitive && s.chrome !== undefined ? sidebarScript() : "";
+        const script = functional + (chromeLayer ? chromeScript() + WORKSPACE_MOTION_SCRIPT : sensitiveChrome);
         const nonce = script === "" ? undefined : randomBytes(16).toString("base64");
         const body = chromeLayer
             ? `${s.body}\n${paletteTagCached(s.chrome?.project ?? null)}\n${KBD_HELP}`
@@ -1370,8 +1364,8 @@ export function createDecisionServer(options) {
             ...(s.refreshSeconds === undefined ? {} : { refreshSeconds: s.refreshSeconds }),
             ...(nonce === undefined ? {} : { live: { nonce, script, fallbackRefresh: s.functional?.fetches === true } }),
         });
-        // v28: the chrome layer itself fetches (the attended beat), so any
-        // page that ships it needs connect-src — not only pages whose own
+        // Pages that ship the chrome layer keep connect-src (v28 granted it for
+        // the since-removed watched-session beat), beside pages whose own
         // functional script polls.
         return page(response, status, html, nonce, s.functional?.fetches === true || chromeLayer || sensitiveChrome !== "");
     }
@@ -1462,7 +1456,7 @@ export function createDecisionServer(options) {
                 : {
                     modeBanner: {
                         name: liveMode.name,
-                        words: `${liveMode.name} mode until ${liveMode.absoluteExpiry.slice(0, 16).replace("T", " ")} UTC${liveModeTerms.autoApproveFiling ? ` — every scope ${liveMode.signedBy} files builds without further ceremony` : ""}${liveModeTerms.permissionDefault === "escalated" ? " — FULL permissions by default" : ""}${liveModeTerms.quickMint ? ` — ${liveMode.signedBy} starts watched sessions without a password` : ""}${liveModeTerms.publication === "automerge" ? " — merges fire themselves on green" : ""}`,
+                        words: `${liveMode.name} mode until ${liveMode.absoluteExpiry.slice(0, 16).replace("T", " ")} UTC${liveModeTerms.autoApproveFiling ? ` — every scope ${liveMode.signedBy} files builds without further ceremony` : ""}${liveModeTerms.permissionDefault === "escalated" ? " — FULL permissions by default" : ""}${liveModeTerms.publication === "automerge" ? " — merges fire themselves on green" : ""}`,
                     },
                 }),
             ...(!restricted() && !unscopedMode && managedRepos().length > 0 ? { chat: true } : {}),
@@ -1535,8 +1529,6 @@ export function createDecisionServer(options) {
     };
     async function handlePost(route, url, who, request, response, posted) {
         const early = () => dispatchConsole(route, { url, who, request, response, route, now: clock(), project: projectOf(who, request) ?? null, chosenProject: projectOf(who, request) ?? null, posted });
-        if (route.id === 'session.attended-beats')
-            return early();
         const denied = authorizeMutation(request, who, readForm(posted, CONSOLE_FORMS.mutationGuard));
         if (denied !== null)
             return refuse(response, who, denied.status, denied.message);
@@ -1550,8 +1542,7 @@ export function createDecisionServer(options) {
         // THE CENTRAL VIEWER GATE (modes chain, D2/E2): consequential POSTs
         // require ACTIVE approver standing — cookie and bearer alike — with
         // an EXACT allowlist of session-local acts, never a prefix. /login,
-        // /logout and /join answer before this handler; the attended beat
-        // guards itself (approver-only) above.
+        // /logout and /join answer before this handler.
         if (who.role === "viewer") {
             if (route.viewer !== true) {
                 return refuse(response, who, 403, "your login can watch, not act — ask an approver to upgrade you");

package/dist/server/chat.js

@@ -23,7 +23,7 @@ import { MATE_MESSAGE_MAX_CHARS, runMateTurn } from "../mate.js";
 import { livePin, modelOptions } from "../model-catalog.js";
 import { verifyApproverByPassword, verifyApproverStanding } from "../principal.js";
 import { projectName } from "../project.js";
-import { fileRoutineProposal, fileTaskProposal } from "../proposal.js";
+import { fileTaskProposal } from "../proposal.js";
 import { providerName } from "../provider-auth.js";
 import { validModelId } from "../provider.js";
 import { loadOrCreateVapidKeys, validatePushEndpoint } from "../push.js";
@@ -763,7 +763,7 @@ export function createChatHandlers(runtime) {
                     noteMate(who.session.csrf, null, "that proposal was already acted on");
                 return redirect(response, chatReturnWithLatest(back));
             }
-            const outcome = confirmMateProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, held: options.attended?.coordinator, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
+            const outcome = confirmMateProposal(store, principal, id, now, { chatProvider: teamChatProvider, confirm: body.get("confirm") === "yes", via: "web", evidenceRoot, ...(body.has("nonce") ? { actionReview: { nonce: body.get("nonce") ?? "", password: body.get("token") ?? "" } } : {}) });
             if (cardJson) {
                 if (!outcome.ok)
                     return cardAnswer(outcome.reason === "standing" ? 403 : outcome.reason === "not-yours" ? 404 : 409, false, outcome.said);
@@ -1005,43 +1005,20 @@ export function createChatHandlers(runtime) {
             // Re-validated at the act: the door runs every field check again, and
             // the fields are scanned for secrets before they become durable.
             const acceptanceFields = candidate.draft.acceptance.flatMap(c => [c.statement, ...(c.how === null ? [] : [c.how])]);
-            const fields = candidate.draft.kind === "task"
-                ? [candidate.draft.title, candidate.draft.goal, candidate.draft.outOfScope ?? "", ...candidate.draft.touches, ...acceptanceFields]
-                : [candidate.draft.name, candidate.draft.goal, candidate.draft.outOfScope ?? "", ...candidate.draft.touches, ...acceptanceFields];
+            const fields = [candidate.draft.title, candidate.draft.goal, candidate.draft.outOfScope ?? "", ...candidate.draft.touches, ...acceptanceFields];
             if (scanForSecrets(fields.join("\n")).length > 0) {
                 chat.candidates.delete(key);
                 return refuse(response, who, 400, "that draft contains something credential-shaped — discarded", "/chat");
             }
             const filedVia = `chat:${enabled.config.provider}`;
-            if (candidate.draft.kind === "task") {
-                const made = fileTaskProposal(store, {
-                    title: candidate.draft.title,
-                    repo: candidate.repoPath,
-                    goal: candidate.draft.goal,
-                    outOfScope: candidate.draft.outOfScope,
-                    touches: candidate.draft.touches,
-                    acceptance: candidate.draft.acceptance,
-                    filedVia, filedBy: { name: who.name, kind: "person" },
-                    admittedRepos: managedRepos(),
-                }, now);
-                if (!made.ok) {
-                    candidate.state = "pending";
-                    return refuse(response, who, 400, `the door refused it: ${made.message}`, "/chat");
-                }
-                chat.candidates.delete(key);
-                return redirect(response, taskHref(made.id));
-            }
-            const made = fileRoutineProposal(store, {
-                name: candidate.draft.name,
+            const made = fileTaskProposal(store, {
+                title: candidate.draft.title,
                 repo: candidate.repoPath,
                 goal: candidate.draft.goal,
                 outOfScope: candidate.draft.outOfScope,
                 touches: candidate.draft.touches,
                 acceptance: candidate.draft.acceptance,
-                requirements: [],
-                schedule: candidate.draft.schedule,
-                costCeilingUsd: null,
-                filedVia, createdBy: who.name,
+                filedVia, filedBy: { name: who.name, kind: "person" },
                 admittedRepos: managedRepos(),
             }, now);
             if (!made.ok) {
@@ -1049,7 +1026,7 @@ export function createChatHandlers(runtime) {
                 return refuse(response, who, 400, `the door refused it: ${made.message}`, "/chat");
             }
             chat.candidates.delete(key);
-            return redirect(response, `/routines/${made.id}`);
+            return redirect(response, taskHref(made.id));
         }
         const chatAckPost = /^\/chat\/ack\/([0-9]{1,15})$/.exec(url.pathname);
         if (chatAckPost !== null) {

package/dist/server/flows.js

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import {} from "node:http";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { resolveRoutineAuthority } from "../agentconfig.js";
+import { resolveAgentAuthority } from "../agentconfig.js";
 import { checkResponse, CONSOLE_FORMS, readForm } from "../contracts/console-api.js";
 import { stageReferenceProblems } from "../contracts/stage-output.js";
 import { LIMITS } from "../decision.js";
@@ -17,7 +17,7 @@ import { assignFlowCard, commentOnFlowCard, watchFlowCard } from "../flow-people
 import { saveScript } from "../flow-scripts.js";
 import { chooseFlowCard } from "../flow-send.js";
 import { exportFlow, fetchFlowFile, FlowFileError, importFlow, parseFlowFile, planFlowImport } from "../flow-share.js";
-import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, renewFlowHook, saveHooksBase, saveLinearKey, saveLinearSigningSecret, shareFlowButton, stopSharingFlowButton } from "../flow-triggers.js";
+import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveLinearSigningSecret, shareFlowButton, stopSharingFlowButton } from "../flow-triggers.js";
 import { FLOW_IMPORT_SCRIPT, flowFallbackHtml, flowImportHtml, flowsListHtml, flowView } from "../flows-ui.js";
 import { FLOW_TEMPLATES, FlowContractError, validateFlowDefinition, withZoneNames } from "../flows.js";
 import { keyStatus } from "../keys.js";
@@ -169,11 +169,12 @@ export function createFlowsHandlers(runtime) {
                 const revision = who.via === "cookie" ? who.session.projectRevision : 0;
                 const render = (html) => sendScreen(response, 200, screen("Workflow recipes", html, { chrome: chromeFor(project, "recipes"), functional: { script: recipeScript() } }));
                 if (url.pathname === "/recipes") {
-                    const recent = project === null ? [] : store.handle.prepare("SELECT document,task_id,routine_id FROM workflow_preview WHERE repo=? AND (task_id IS NOT NULL OR routine_id IS NOT NULL) ORDER BY created_at DESC LIMIT 12").all(project).map(row => {
+                    const recent = project === null ? [] : store.handle.prepare("SELECT document,task_id,flow_id FROM workflow_preview WHERE repo=? AND (task_id IS NOT NULL OR flow_id IS NOT NULL) ORDER BY created_at DESC LIMIT 12").all(project).map(row => {
                         const d = importRecipe(String(row["document"]));
                         const task = row["task_id"] === null ? null : store.getTask(String(row["task_id"]));
-                        const routine = row["routine_id"] === null ? null : store.getRoutine(Number(row["routine_id"]));
-                        return { name: d.name, href: task !== null ? taskHref(task.id) : `/routines/${routine?.id}`, state: task?.state ?? (routine?.approvedAt === null ? "Needs approval" : routine?.paused ? "Paused" : "Scheduled") };
+                        const flow = row["flow_id"] === null ? null : store.getFlow(Number(row["flow_id"]));
+                        const on = flow !== null && flow.state === "active" && store.flowTriggers(flow.id).some(one => one.kind === "schedule" && one.state === "active");
+                        return { name: d.name, href: task !== null ? taskHref(task.id) : `/flows/${Number(row["flow_id"])}`, state: task?.state ?? (flow === null || flow.state !== "active" ? "Archived" : on ? "Scheduled" : "Paused") };
                     });
                     return render(recipeLibraryHtml(starterRecipes(), project === null ? [] : savedRecipes(store, who.name, project), project, csrf, revision, recent));
                 }
@@ -215,7 +216,7 @@ export function createFlowsHandlers(runtime) {
                 if (url.pathname === "/recipes/preview" && preview !== null) {
                     if (preview.document.version === 2 || url.searchParams.get("purpose") === "recipe")
                         return render(recipeDefinitionPreviewHtml(preview, csrf, revision));
-                    const agents = resolveRoutineAuthority(store, project, preview.document.acceptance, now);
+                    const agents = resolveAgentAuthority(store, project, preview.document.acceptance, now);
                     const workers = store.listRunners().filter(one => one.retiredAt === null && one.repos.includes(project) && runnerAlive(one, now));
                     const mode = store.activeMode(project, now);
                     const readiness = [
@@ -498,7 +499,7 @@ export function createFlowsHandlers(runtime) {
                     return answer(404, { ok: false, said: "That trigger isn't on this flow." });
                 const verb = triggerPost[3];
                 if (verb === "pause" || verb === "resume") {
-                    store.updateFlowTrigger(trigger.id, { state: verb === "pause" ? "paused" : "active" }, now);
+                    setFlowTriggerOn(store, trigger, verb === "resume", now);
                     return settle(verb === "pause" ? "Trigger paused." : "Trigger on again.");
                 }
                 if (verb === "remove") {
@@ -722,8 +723,8 @@ export function createFlowsHandlers(runtime) {
                     const sourceVersion = body.get("sourceRevision") ?? "1";
                     if (!/^[1-9][0-9]{0,8}$/.test(sourceVersion))
                         throw new RecipeError("Choose a valid recipe version.");
-                    const original = ["custom", "imported", "task-copy", "routine-copy"].includes(source) ? null : findRecipe(store, who.name, project, source, Number(sourceVersion));
-                    if (original === null && !["custom", "imported", "task-copy", "routine-copy"].includes(source))
+                    const original = ["custom", "imported", "task-copy"].includes(source) ? null : findRecipe(store, who.name, project, source, Number(sourceVersion));
+                    if (original === null && !["custom", "imported", "task-copy"].includes(source))
                         throw new RecipeError("That recipe version is not available in this project.", 404);
                     let document;
                     try {
@@ -753,7 +754,7 @@ export function createFlowsHandlers(runtime) {
                     if (context !== undefined)
                         context.createdTask = made.taskId;
                 }
-                return redirect(response, made.taskId === null ? `/routines/${made.routineId}` : taskHref(made.taskId));
+                return redirect(response, made.taskId === null ? `/flows/${made.flowId}` : taskHref(made.taskId));
             }
             catch (error) {
                 if (error instanceof RecipeError)

package/dist/server/guards.js

@@ -152,7 +152,6 @@ export function createSharedGuards(runtime) {
             case 'run': return runRepo(id);
             case 'decision': return runRepo(runtime.store.getDecision(id)?.run);
             case 'incident': return runRepo(runtime.store.openIncidents().find(one => one.id === id)?.run);
-            case 'routine': return runtime.store.getRoutine(id)?.repo ?? null;
             case 'flow': return runtime.store.getFlow(id)?.repo ?? null;
             case 'proposal':
             case 'coding': return runtime.actionTarget(url, who, request, body === null ? null : readForm(body, CONSOLE_FORMS.ledgerTarget)).repo;

package/dist/server/pages-assets.js

@@ -36,7 +36,7 @@ const PWA_MANIFEST = JSON.stringify({
 // paths — the payload URL is data, revalidated, never handed raw to the
 // browser (arc 3 finding 5).
 const PWA_WORKER = `// Toolroll — push only; deliberately NO fetch handler (no offline cache of an authenticated console).
-const SHAPES = [/^\\/next$/, /^\\/review$/, /^\\/system$/, /^\\/routines$/, /^\\/routines\\/[0-9]+$/, /^\\/d\\/[0-9]+$/, /^\\/contest\\/[0-9]+$/, /^\\/r\\/[0-9]+$/];
+const SHAPES = [/^\\/next$/, /^\\/review$/, /^\\/system$/, /^\\/routines$/, /^\\/routines\\/[0-9]+$/, /^\\/d\\/[0-9]+$/, /^\\/r\\/[0-9]+$/];
 self.addEventListener("push", function (event) {
   var data = {};
   try { data = event.data ? event.data.json() : {}; } catch (e) {}

package/dist/server/pages.js

@@ -320,7 +320,6 @@ export function createPagesHandlers(runtime) {
                 settings: options.telegramTokenFile !== undefined,
                 building: store.liveClaims(project, now),
                 runners: store.listRunners(),
-                heldSessions: new Map(store.openHeldSessions().reduce((by, one) => by.set(one.runner, (by.get(one.runner) ?? 0) + 1), new Map())),
                 worktrees: store
                     .listWorktrees()
                     .filter(one => project === null || sameRepo(one.repo, project)),
@@ -346,7 +345,6 @@ export function createPagesHandlers(runtime) {
                 }),
                 building: store.liveClaims(project, now),
                 runners: store.listRunners(),
-                heldSessions: new Map(store.openHeldSessions().reduce((by, one) => by.set(one.runner, (by.get(one.runner) ?? 0) + 1), new Map())),
                 worktrees: store.listWorktrees().filter(one => project === null || sameRepo(one.repo, project)),
                 episode: project === null ? null : store.latestWatchEpisode(project),
                 outboxPending: store.pendingForAttention().length,

package/dist/server/people-tokens.js

@@ -73,7 +73,6 @@ export function createPeopleHandlers(runtime) {
                 `<p class="meta">Operators with all-project access also manage the instance.</p><fieldset><legend>Projects</legend>${projectChoices.length === 0 ? `<p class="meta">Add a project before granting selected access.</p>` : projectChoices.map(repo => `<label class="row"><input type="checkbox" name="projects" value="${escape(repo)}"${selected?.includes(repo) ? " checked" : ""}>${escape(projectName(repo))}</label>`).join("")}</fieldset>`;
             const cards = accounts.map(one => {
                 const seen = lastSeenOf(one.name);
-                const attended = store.openAttendedOf(one.name);
                 const acts = store.recentActsOf(one.name);
                 const standing = one.revokedAt !== null
                     ? `revoked ${escape(one.revokedAt.slice(0, 16).replace("T", " "))} by ${personChip(one.revokedBy ?? "?")}`
@@ -87,9 +86,6 @@ export function createPeopleHandlers(runtime) {
                     approverView && one.revokedAt === null ? `<details><summary>Edit project access</summary><form method="post" action="/people/projects">${hiddenFields({ csrf, name: one.name })}${accessFields(one.projects)}<label>Your password<input type="password" name="token" autocomplete="current-password" required></label><p class="meta">Changing access signs this person out and ends their derived sessions and modes. Previously approved work stays recorded.</p><button type="submit">Save project access</button></form></details>` : "",
                     `<p class="meta">${seen === null ? "not signed in right now" : `signed in \u2014 active ${escape(new Date(seen).toISOString().slice(11, 16))} UTC`} \u00b7 joined ${escape(one.addedAt.slice(0, 10))}</p>`,
                     `<p><a href="${escape(personHref(one.name))}">Tokens and remote activity</a></p>`,
-                    attended.length === 0
-                        ? ""
-                        : `<p class="row">watching now: ${attended.map(session => `<a href="/t/${escape(session.taskId)}">${escape(session.taskId)}</a>`).join(", ")}</p>`,
                     acts.length === 0
                         ? `<p class="meta">No recorded acts yet</p>`
                         : acts.map(act => `<p class="row meta">${escape(act.kind)} ${escape(act.subject)} \u00b7 ${escape(act.at.slice(0, 16).replace("T", " "))}</p>`).join("\n"),

package/dist/server/route-table.d.ts

@@ -17,7 +17,7 @@ export type Caller = "anonymous" | "service" | "cookie" | "bearer" | "oauth" | "
 /** What the caller must hold: nothing, read, act (an approver or an `act` token), or a fresh password/provider check on top. */
 export type RouteScope = "none" | "read" | "act" | "step-up";
 /** Where the request's project comes from. */
-export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "run" | "decision" | "incident" | "routine" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
+export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "run" | "decision" | "incident" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
 /**
  * What a project-limited account may do here:
  * - `deny`: instance access only.

package/dist/server/route-table.js

@@ -120,7 +120,6 @@ get("tasks", "runs", "/runs", { limited: "collection" });
 get("pages", "menu", "/menu", { limited: "collection", ...free });
 get("tasks", "run.page", `^\\/r\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1" });
 get("tasks", "run.evidence", `^\\/r\\/${ID}\\/evidence\\/${ID}$`, { project: "run", limited: "resource", ...free, sample: "/r/1/evidence/2" });
-get("tasks", "contest.page", `^\\/contest\\/${ID}$`, { ...free, sample: "/contest/1" });
 get("pages", "caps", "/caps");
 get("flows", "flows.new", "/flows/new", { limited: "resource", ...free });
 get("flows", "flows.gallery", "^\\/flows\\/new\\/[a-z-]{1,40}$", { limited: "resource", ...free, sample: "/flows/new/triage" });
@@ -139,13 +138,14 @@ for (const one of ["run", "start", "new", "edit", "from-task", "preview", "expor
     get("flows", `recipes.${one}`, `/recipes/${one}`, { limited: "collection" });
 // Any other recipe screen answers the recipe area's own refusal.
 get("flows", "recipes.other", "^\\/recipes\\/.*$", { sample: "/recipes/unknown" });
+// v115: routines became scheduled flows; old links to them land on the flows page.
 get("tasks", "routines", "/routines", { limited: "collection" });
 get("chat", "chat.stream", "/chat/stream", free);
 get("chat", "chat.mate-status", "/chat/mate/status", free);
 get("chat", "chat.demo-live", "/chat/demo/live", free);
 get("chat", "chat.page", "/chat", { project: "conversation", limited: "conversation", ...free });
 get("chat", "chat.ack", `^\\/chat\\/ack\\/${ID}$`, { sample: "/chat/ack/1" });
-get("tasks", "routine.page", `^\\/routines\\/${ID}$`, { project: "routine", limited: "resource", sample: "/routines/1" });
+get("tasks", "routine.page", `^\\/routines\\/${ID}$`, { limited: "resource", sample: "/routines/1" });
 get("settings", "control", "/control");
 get("settings", "control.connection", "/control/connection");
 get("chat", "chat.action", `^\\/chat\\/action\\/${ID}$`, { project: "proposal", limited: "proposal", ...free, sample: "/chat/action/1" });
@@ -166,8 +166,6 @@ get("chat", "lead.status", "/lead/status", free);
 get("chat", "chat.task-status", "/chat/task-status", free);
 get("tasks", "decision.evidence", `^\\/d\\/${ID}\\/evidence\\/${ID}$`, { project: "decision", limited: "resource", ...free, sample: "/d/1/evidence/2" });
 // ---- console actions -------------------------------------------------------------------------------------------
-// The attended beat guards itself (cookie, form type, Sec-Fetch-Site) before the shared mutation guard.
-post("tasks", "session.attended-beats", "/session/attended-beats", { callers: ["cookie"], scopeRefusal: "your login can watch, not keep sessions alive", callerRefusal: { status: 403, type: "text/plain; charset=utf-8", body: "watching is a browser session's act" } });
 // The scripted demo: the handler answers a non-browser caller "no page here".
 post("chat", "chat.demo", "^\\/chat\\/demo\\/(ask|[0-9]{1,9}\\/(approve|change|revise|complete))$", { sample: "/chat/demo/ask" });
 post("settings", "provider.resume", "^\\/providers\\/[a-z]+\\/resume$", { sample: "/providers/codex/resume" });
@@ -243,12 +241,6 @@ post("people", "people.revoke", "/people/revoke", { scope: "step-up" });
 post("pages", "fleet.retire", "/fleet/runner/retire", { scope: "step-up" });
 // Answering a parked decision needs act access and irreversible-choice confirmation, not password step-up.
 post("tasks", "decision.answer", `^\\/d\\/${ID}\\/answer$`, { project: "decision", limited: "resource", scope: "act", sample: "/d/1/answer" });
-post("tasks", "contest.act.arm", `^\\/contest\\/${ID}\\/arm$`, { sample: "/contest/1/arm" });
-post("tasks", "contest.act.pick", `^\\/contest\\/${ID}\\/pick$`, { scope: "step-up", sample: "/contest/1/pick" });
-post("tasks", "contest.act.abandon", `^\\/contest\\/${ID}\\/abandon$`, { scope: "step-up", sample: "/contest/1/abandon" });
-post("tasks", "task.attend.attend-preview", `^\\/t\\/${TASK}\\/attend-preview$`, { callers: ["cookie"], project: "task", sample: "/t/one/attend-preview" });
-post("tasks", "task.attend.attend", `^\\/t\\/${TASK}\\/attend$`, { scope: "step-up", project: "task", sample: "/t/one/attend" });
-post("tasks", "task.attend.attend-revoke", `^\\/t\\/${TASK}\\/attend-revoke$`, { callers: ["cookie"], project: "task", sample: "/t/one/attend-revoke" });
 post("tasks", "task.act.hold", `^\\/t\\/${TASK}\\/hold$`, { project: "task", limited: "resource", sample: "/t/one/hold" });
 post("tasks", "task.act.unhold", `^\\/t\\/${TASK}\\/unhold$`, { project: "task", limited: "resource", sample: "/t/one/unhold" });
 post("tasks", "task.act.requeue", `^\\/t\\/${TASK}\\/requeue$`, { project: "task", limited: "resource", sample: "/t/one/requeue" });
@@ -291,15 +283,8 @@ post("chat", "chat.ack-send", `^\\/chat\\/ack\\/${ID}$`, { scope: "step-up", sam
 for (const one of ["prepare", "preview", "import", "save"])
     post("flows", `recipes.${one}-send`, `/recipes/${one}`, { limited: "collection" });
 post("flows", "recipes.launch-send", "/recipes/launch", { limited: "collection" });
-post("tasks", "routines.add", "/routines/add", { project: "form", limited: "collection" });
-post("tasks", "routine.act.approve", `^\\/routines\\/${ID}\\/approve$`, { scope: "step-up", project: "routine", limited: "resource", sample: "/routines/1/approve" });
-post("tasks", "routine.act.refresh", `^\\/routines\\/${ID}\\/refresh$`, { project: "routine", limited: "resource", sample: "/routines/1/refresh" });
-post("tasks", "routine.act.pause", `^\\/routines\\/${ID}\\/pause$`, { project: "routine", limited: "resource", sample: "/routines/1/pause" });
-post("tasks", "routine.act.resume", `^\\/routines\\/${ID}\\/resume$`, { project: "routine", limited: "resource", sample: "/routines/1/resume" });
-post("tasks", "routine.act.run-now", `^\\/routines\\/${ID}\\/run-now$`, { scope: "step-up", project: "routine", limited: "resource", sample: "/routines/1/run-now" });
 post("tasks", "run.act", `^\\/r\\/${ID}\\/(note|comment|revise|draft-repair|checks|add-tests)$`, { project: "run", limited: "resource", sample: "/r/1/note" });
 post("tasks", "session.editor-links", "/session/editor-links", { viewer: true });
-post("tasks", "run.turn", `^\\/r\\/${ID}\\/turn$`, { project: "run", sample: "/r/1/turn" });
 post("tasks", "incident.resolve", `^\\/i\\/${ID}\\/resolve$`, { project: "incident", sample: "/i/1/resolve" });
 /** The sole route table, in match order. */
 export const ROUTES = Object.freeze(rows.map(one => Object.freeze(one)));