toolroll 0.9.56 → 0.9.58

package/dist/task-status.d.ts

@@ -56,6 +56,24 @@ export type ChecksFact = {
     running?: "quick" | "full" | null;
     /** A batch check (batch-checks.ts): waiting for its batch, or how it was checked. */
     batch?: ChecksBatch | null;
+    /** Off: the passing full release check whose commit contains this one (release-coverage.ts), read at read time. */
+    release?: {
+        run: number;
+        head: string;
+    } | null;
+};
+/** What checks Off leaves for a release: `pending` until a passing full release check contains the commit, then
+ * `covered`. `running`: a check is waiting for its batch or running on this commit. */
+export type ReleaseState = "pending" | "covered" | "running";
+export declare const CHECKED_AT_RELEASE = "Checked at release";
+export declare function releaseStateOf(checks: Pick<ChecksFact, "status" | "level" | "release"> | null | undefined): ReleaseState | undefined;
+/** How the project check stands for requirements that rest on it, read now: `covered` once a check passed on this
+ * commit (its own, a follow-up, or a release check containing it), `pending` while checks Off wait for a release. */
+export declare function checkBackingOf(checks: Pick<ChecksFact, "status" | "level" | "release" | "running" | "batch"> | null | undefined): ReleaseState | undefined;
+/** What stands between a finished result and Complete (`completionBlockersOf`): each with the exact next step. */
+export type CompletionBlocker = {
+    key: "check-failed" | "check-missing" | "criteria" | "high";
+    message: string;
 };
 /** `waiting`: the result waits to be checked with others. Otherwise how its check ran: `together` on the
  * temporary batch commit `tested` with `peers`; `split` (its batch failed), `conflict` or `alone` on its own commit. */
@@ -94,14 +112,22 @@ export type TaskStatusFacts = {
     checks?: ChecksFact | null;
     pullRequest?: PullRequestFact | null;
     /** `unverified`: the report is refuted, so no requirement counts as met however it was marked. `missed`: the ones it
-     * failed or left unanswered. */
+     * failed or left unanswered. `atRelease`: checks Off, waiting for a release check. `unshown`: a required screenshot
+     * is missing. `ask`: what a person is asked to look at first (a requirement they check, or a missing screenshot). */
     requirements?: {
         met: number;
         total: number;
         yours: number;
         missed?: number;
         unverified?: boolean;
+        atRelease?: number;
+        unshown?: number;
+        ask?: string | null;
     } | null;
+    /** A person accepted this result's proof: their own check and a recorded exception need nothing more. */
+    accepted?: boolean;
+    /** What refuses Complete (`completionBlockersOf`); the first one is the sentence when it holds the result back. */
+    blockers?: readonly CompletionBlocker[];
     evidence?: {
         shortened: number;
         missing: number;
@@ -124,11 +150,14 @@ export type TaskStatusFacts = {
     /** What the person calls their lead (Settings → Lead); "Lead" when unnamed. */
     leadName?: string;
 };
-export declare function headlineOf(facts: Pick<TaskStatusFacts, "stage" | "checks" | "report">): Headline;
+export declare function headlineOf(facts: Pick<TaskStatusFacts, "stage" | "checks" | "report" | "requirements" | "accepted" | "blockers">): Headline;
 /** What the lead's claim says, in place of "waits for you" (lead-voice.ts). */
 export declare const leadOnIt: (name?: string) => string;
 export declare const leadLapsed: (name?: string) => string;
-export declare function taskStatusOf(facts: TaskStatusFacts): TaskStatus;
+/** The one status every surface shows (console list, task and result pages, CLI, chat, phone, `status`). */
+export declare function statusOf(facts: TaskStatusFacts): TaskStatus;
+/** The name most surfaces already import. */
+export declare const taskStatusOf: typeof statusOf;
 export declare function plainReasonOf(stage: TaskStage, code: string, detail: string | null | undefined): string | null;
 export declare function stageOfCode(code: string, options?: {
     needsPerson?: boolean;
@@ -165,18 +194,41 @@ export declare function assignmentStageOf(assignment: Pick<AssignmentSnapshot, "
     wait?: WaitKey;
 };
 type RequirementRow = {
+    id?: string;
+    statement?: string;
     state: string;
+    requiredEvidence?: readonly string[];
+    answered?: readonly {
+        kind: string;
+    }[];
+    detail?: readonly string[];
     assessment?: {
         evidenceState?: string;
+        detail?: readonly string[];
     } | undefined;
     review?: unknown;
 };
 /** One requirement's state in words: the card's Requirements row and the Checks tab read this one source, so they
- * can't disagree. A refuted report verifies none of its requirements, so each reads Unverified, as the card does. */
-export type RequirementWord = "Met" | "You check" | "Not shown yet" | "Not met" | "Unverified";
-export declare function requirementWordOf(row: RequirementRow, verdict?: string | null): RequirementWord;
+ * can't disagree. A refuted report verifies none of its requirements, so each reads Unverified, as the card does.
+ * With checks Off, a requirement that waits only on the check reads Checked at release, then Met once a passing full
+ * release check contains the commit. */
+export type RequirementWord = "Met" | "You check" | "Not shown yet" | "Checked at release" | "Waiting for checks" | "Not met" | "Unverified";
+export declare function requirementWordOf(row: RequirementRow, verdict?: string | null, release?: ReleaseState): RequirementWord;
 /** Requirements from the stored matrix: met, the ones only a person confirms, and the total. */
-export declare function requirementsOf(matrix: readonly RequirementRow[] | null | undefined): NonNullable<TaskStatusFacts["requirements"]> | null;
+export declare function requirementsOf(matrix: readonly RequirementRow[] | null | undefined, release?: ReleaseState): NonNullable<TaskStatusFacts["requirements"]> | null;
+/** What refuses Complete, for `task complete`, the console and chat completion and deploy-candidate alike: a failed
+ * check; a required check that is missing (checks deliberately Off are not missing: they are checked at release);
+ * an unresolved requirement (a person's own check is theirs to give by completing; a recorded acceptance resolves
+ * the rest); an unresolved HIGH review finding. A release check that covers the commit counts as passed. */
+export declare function completionBlockersOf(f: {
+    report: boolean;
+    checks: Pick<ChecksFact, "status" | "exitCode" | "level" | "release" | "running" | "batch"> | null;
+    checkRequired: boolean;
+    matrix: readonly RequirementRow[] | null | undefined;
+    verdict: string | null | undefined;
+    accepted: boolean;
+    high: number;
+}): CompletionBlocker[];
 /** A refuted report verifies none of its requirements, whatever it marked met (a person's acceptance doesn't change that). */
 export declare function unverifiedWhenRefuted(requirements: NonNullable<TaskStatusFacts["requirements"]> | null, verdict: string | null | undefined): NonNullable<TaskStatusFacts["requirements"]> | null;
 /** Saved evidence health from the receipt's artifact list and its caveats. */

package/dist/task-status.js

@@ -27,6 +27,17 @@ export const CHECKS_LABEL = "Project checks";
 export const PR_CI_LABEL = "PR CI";
 /** The one verb for opening a saved result, on every surface. */
 export const OPEN_RESULT = "Open result";
+export const CHECKED_AT_RELEASE = "Checked at release";
+export function releaseStateOf(checks) {
+    if (checks?.level !== "off" || checks.status === "passed" || checks.status === "failed")
+        return undefined;
+    return checks.release != null ? "covered" : "pending";
+}
+/** How the project check stands for requirements that rest on it, read now: `covered` once a check passed on this
+ * commit (its own, a follow-up, or a release check containing it), `pending` while checks Off wait for a release. */
+export function checkBackingOf(checks) {
+    return checks?.status === "passed" ? "covered" : checksUnderway(checks) ? "running" : releaseStateOf(checks);
+}
 /** "T2", "T2 and T3", "T2, T3 and 2 more": short enough for one line. The full list is on the result. */
 export function peerWords(peers, shown = 2) {
     if (peers.length <= shown)
@@ -43,6 +54,23 @@ const BATCH_WHY = {
     conflict: "It conflicted with another result when merged for a batch check, so it was checked on its own.",
 };
 const short = (sha) => sha !== null && /^[a-f0-9]{7,40}$/.test(sha) ? sha.slice(0, 7) : null;
+/** A check waiting for its batch or running on this commit: the result reads Ready meanwhile, not Needs you. */
+const checksUnderway = (checks) => checks?.batch?.state === "waiting" || checks?.running != null;
+/** A finished result a person still has to act on before it can be complete: an unresolved HIGH finding or unmet
+ * requirement, a missing check, or a requirement only they can confirm. Failed checks read Failed instead. */
+function resultAsk(facts) {
+    if (facts.report || facts.checks?.status === "failed")
+        return null;
+    const blocker = facts.blockers?.find(one => one.key !== "check-failed" && !(one.key === "check-missing" && checksUnderway(facts.checks)));
+    if (blocker !== undefined)
+        return blocker.message;
+    const req = facts.requirements;
+    if (req == null || facts.accepted === true || req.unverified === true)
+        return null;
+    if ((req.yours > 0 || (req.unshown ?? 0) > 0) && req.ask != null)
+        return req.ask;
+    return null;
+}
 export function headlineOf(facts) {
     switch (facts.stage) {
         case "queued": return "Queued";
@@ -57,7 +85,10 @@ export function headlineOf(facts) {
                 return "Ready for review";
             if (facts.checks?.status === "failed")
                 return "Failed";
-            // Off: ready like any build; the sentence and the Checks row say no check ran.
+            // A requirement a person checks, a missing screenshot, an unmet requirement or a HIGH finding: Needs you, with the ask.
+            if (resultAsk(facts) !== null)
+                return "Needs you";
+            // Off: ready like any build; the sentence and the Checks row say it is checked at release.
             return "Ready for review";
         case "complete": return "Complete";
         case "failed": return "Failed";
@@ -71,15 +102,17 @@ function sentenceOf(headline, facts) {
         case "Queued": return reason ?? "Waiting for a worker.";
         case "Planning": return reason ?? "The lead is writing the plan.";
         // One plain sentence per need (needs-you.ts); a recorded reason only where the need keeps one.
-        case "Needs you": return needSentence(facts.need ?? "other", reason, facts.needContext);
+        case "Needs you": return facts.stage === "finished" ? resultAsk(facts) ?? needSentence("review-result", reason, facts.needContext) : needSentence(facts.need ?? "other", reason, facts.needContext);
         case "Waiting": return waitSentence(facts.wait, reason, facts.needContext);
         case "Building": return facts.stage === "checking" ? "Checks are running on the change."
             : facts.stage === "reviewing" ? "Reviewing the change before it reaches you." : reason ?? "An agent is working on it.";
         case "Ready for review":
             if (facts.report)
                 return "The report is ready to read. Read it, then mark it complete.";
+            if (releaseStateOf(facts.checks) === "covered")
+                return `Checked at release on ${short(facts.checks.release.head) ?? "its release"}. Review the change, then mark it complete.`;
             if (facts.checks?.level === "off" && facts.checks.status !== "passed")
-                return "Checks are off for this project. Review the change, then mark it complete.";
+                return "Checked at release. Review the change, then mark it complete.";
             if (facts.checks?.status === "passed") {
                 // The Checks row names the others and the batch commit; the sentence doesn't repeat them.
                 const peers = facts.checks.batch?.state === "together" ? facts.checks.batch.peers.length : 0;
@@ -135,8 +168,10 @@ function detailsOf(headline, facts) {
             row("checks", CHECKS_LABEL, `${quick ? "Quick checks failed" : "Failed"}${checks.exitCode === null ? "" : ` (exit ${checks.exitCode})`}`, problem(headline), headline === "Failed" ? { href: checksHref } : { action: { label: "See what failed", href: checksHref } });
         else if (checks.status === "running")
             row("checks", CHECKS_LABEL, "Running", "running");
+        else if (checks.level === "off" && checks.release != null)
+            row("checks", CHECKS_LABEL, `Passed at release on ${short(checks.release.head) ?? `build #${checks.release.run}`}`, "ok", { href: checksHref });
         else if (checks.level === "off")
-            row("checks", CHECKS_LABEL, "Off for this project", "none", runChecks === null ? {} : { action: runChecks });
+            row("checks", CHECKS_LABEL, CHECKED_AT_RELEASE, "none", runChecks === null ? {} : { action: runChecks });
         else if (checks.status === "not-run")
             row("checks", CHECKS_LABEL, "Didn't run", "none", runChecks === null ? {} : { action: runChecks });
         // A saved check that can't be read is run again where that is possible.
@@ -173,8 +208,9 @@ function detailsOf(headline, facts) {
     else if (req != null && req.total > 0 && req.unverified === true)
         row("requirements", "Requirements", "Unverified", "none");
     else if (req != null && req.total > 0) {
-        const unmet = req.total - req.met - req.yours;
-        const text = `${req.met} of ${req.total} met${req.yours > 0 ? ` · You check ${req.yours}` : ""}`;
+        const atRelease = req.atRelease ?? 0;
+        const unmet = req.total - req.met - req.yours - atRelease;
+        const text = `${req.met} of ${req.total} met${atRelease > 0 ? ` · ${atRelease} at release` : ""}${req.yours > 0 ? ` · You check ${req.yours}` : ""}`;
         row("requirements", "Requirements", text, unmet > 0 ? problem(headline) : req.met === req.total ? "ok" : "none", unmet > 0 && headline !== "Failed" ? { action: { label: "See which", href: facts.links?.checks ?? facts.links?.result ?? null } } : {});
     }
     const evidence = facts.evidence;
@@ -203,19 +239,23 @@ function leadSentence(headline, facts) {
         return `${facts.checks.level === "quick" ? "Quick checks" : "Checks"} failed${sha === null ? "" : ` on ${sha}`}. ${leadOnIt(facts.leadName)}`;
     return leadOnIt(facts.leadName);
 }
-export function taskStatusOf(facts) {
+/** The one status every surface shows (console list, task and result pages, CLI, chat, phone, `status`). */
+export function statusOf(facts) {
     const read = headlineOf(facts);
     const lead = facts.lead != null && LEAD_HEADLINES.has(read) ? facts.lead : null;
     // The lead has it: nothing waits on the person, so a Needs you reads Waiting.
     const headline = lead === "on-it" && read === "Needs you" ? "Waiting" : read;
-    // Every Needs you carries the one action that resolves it, worded the same everywhere.
-    const need = headline === "Needs you" ? { key: facts.need ?? "other", action: NEEDS[facts.need ?? "other"].action } : null;
+    // Every Needs you carries the one action that resolves it, worded the same everywhere; a finished result's is Open result.
+    const needKey = facts.stage === "finished" ? "review-result" : facts.need ?? "other";
+    const need = headline === "Needs you" ? { key: needKey, action: NEEDS[needKey].action } : null;
     const ownWords = need !== null && (need.key === "other" || need.key === "review-result") && facts.action != null;
     const primaryAction = need === null || ownWords ? facts.action ?? null : { label: need.action.label, href: facts.action?.href ?? null };
     const sentence = lead === "on-it" ? leadSentence(headline, facts) : lead === "lapsed" ? `${leadLapsed(facts.leadName)} ${sentenceOf(headline, facts)}` : sentenceOf(headline, facts);
     return { headline, tone: HEADLINE_TONE[headline], sentence, details: detailsOf(headline, facts),
         primaryAction, why: [...new Set(facts.why ?? [])].filter(one => one.trim() !== ""), need };
 }
+/** The name most surfaces already import. */
+export const taskStatusOf = statusOf;
 // ---- reading the existing projections ----------------------------------------
 /** Every dispatch or work-index code, as the stage it means. Unknown codes that
  * wait on a person stay Needs you; everything else waits in the queue. */
@@ -316,19 +356,93 @@ export function assignmentStageOf(assignment, work, planning = false) {
 }
 /** Evidence that passed and only awaits the retired assessment step is met. */
 const requirementMet = (row) => row.state === "pass" || (row.assessment?.evidenceState === "pass" && (row.review ?? null) === null);
-export function requirementWordOf(row, verdict) {
+/** A requirement whose only gap is the project check: every other kind it needs was shown, none is a person's check. */
+const onlyCheckMissing = (row) => {
+    const needs = row.requiredEvidence ?? [];
+    const answered = new Set((row.answered ?? []).map(one => one.kind));
+    if (row.state !== "missing" || row.review != null || row.assessment?.evidenceState === "failed" ||
+        !needs.includes("check") || needs.includes("manual-review") || !needs.every(kind => kind === "check" || answered.has(kind)))
+        return false;
+    // `answered` contains claims, not validated evidence. In legacy matrices a missing
+    // check takes precedence over an invalid screenshot/changed path in `state`.
+    // Only the stored validator's check-only gaps establish that every other
+    // reference resolved. Direct assessment keeps these outcomes in its own detail.
+    const detail = row.assessment?.detail ?? row.detail ?? [];
+    const checkGaps = new Set([
+        `criterion "${row.id}" requires check evidence, which the proof does not reference`,
+        `criterion "${row.id}" is waiting for the final check`,
+        `criterion "${row.id}" needs a passing approved project check`,
+    ]);
+    return (needs.every(kind => kind === "check") || detail.length > 0) && detail.every(one => checkGaps.has(one));
+};
+/** A required screenshot nobody captured. */
+const screenshotMissing = (row) => (row.requiredEvidence ?? []).includes("screenshot") && !(row.answered ?? []).some(one => one.kind === "screenshot");
+export function requirementWordOf(row, verdict, release) {
     if (verdict === "refuted")
         return "Unverified";
     if (requirementMet(row))
         return "Met";
-    return row.state === "manual-review" ? "You check" : row.state === "missing" ? "Not shown yet" : "Not met";
+    if (release !== undefined && onlyCheckMissing(row))
+        return release === "covered" ? "Met" : release === "running" ? "Waiting for checks" : CHECKED_AT_RELEASE;
+    if (row.state === "manual-review")
+        return "You check";
+    return row.state === "missing" || screenshotMissing(row) ? "Not shown yet" : "Not met";
+}
+const ASK_STATEMENT = 140;
+const quoted = (statement) => {
+    const one = (statement ?? "").replace(/\s+/g, " ").trim();
+    return one.length > ASK_STATEMENT ? `${one.slice(0, ASK_STATEMENT - 1)}…` : one;
+};
+/** The ask for one unresolved requirement: what is wrong with it, and the two ways on. */
+function unresolvedAsk(row, word) {
+    const what = word === "Not shown yet" && screenshotMissing(row) ? "A screenshot is missing for"
+        : word === "Not shown yet" ? "Nothing shows this requirement is met" : word === "Unverified" ? "This requirement couldn't be verified" : "This requirement isn't met";
+    return `${what}: ${quoted(row.statement) || row.id || "a requirement"}. Ask for changes, or accept the result with a reason.`;
 }
 /** Requirements from the stored matrix: met, the ones only a person confirms, and the total. */
-export function requirementsOf(matrix) {
+export function requirementsOf(matrix, release) {
     if (!matrix || matrix.length === 0)
         return null;
-    return { met: matrix.filter(requirementMet).length, total: matrix.length, yours: matrix.filter(row => requirementWordOf(row) === "You check").length,
-        missed: matrix.filter(row => !requirementMet(row) && (row.state === "failed" || row.state === "missing")).length };
+    const words = matrix.map(row => requirementWordOf(row, null, release));
+    const yours = matrix.find((_, index) => words[index] === "You check");
+    const unshown = matrix.filter((row, index) => words[index] === "Not shown yet" && screenshotMissing(row));
+    const ask = yours !== undefined ? `Check this requirement yourself, then mark it complete: ${quoted(yours.statement)}`
+        : unshown.length > 0 ? unresolvedAsk(unshown[0], "Not shown yet") : null;
+    return { met: words.filter(word => word === "Met").length, total: matrix.length, yours: words.filter(word => word === "You check").length,
+        missed: words.filter(word => word === "Not met" || word === "Not shown yet").length,
+        ...(release !== "pending" ? {} : { atRelease: words.filter(word => word === CHECKED_AT_RELEASE).length }),
+        ...(unshown.length === 0 ? {} : { unshown: unshown.length }),
+        ...(ask === null ? {} : { ask }) };
+}
+/** What refuses Complete, for `task complete`, the console and chat completion and deploy-candidate alike: a failed
+ * check; a required check that is missing (checks deliberately Off are not missing: they are checked at release);
+ * an unresolved requirement (a person's own check is theirs to give by completing; a recorded acceptance resolves
+ * the rest); an unresolved HIGH review finding. A release check that covers the commit counts as passed. */
+export function completionBlockersOf(f) {
+    const blockers = [];
+    const release = releaseStateOf(f.checks);
+    const backing = checkBackingOf(f.checks);
+    if (!f.report && f.checks?.status === "failed") {
+        blockers.push({ key: "check-failed", message: `Checks failed${f.checks.exitCode === null ? "" : ` (exit ${f.checks.exitCode})`}. Fix them and run checks again, or ask for changes.` });
+    }
+    else if (!f.report && f.checkRequired && f.checks?.status !== "passed" && release === undefined) {
+        blockers.push({ key: "check-missing", message: checksUnderway(f.checks) ? "Its project check hasn't finished yet. Mark it complete once it passes."
+                : "No passing project check is recorded for this result. Run checks on it, then mark it complete." });
+    }
+    if (!f.accepted && f.checks?.status !== "failed") {
+        const refuted = f.verdict === "refuted";
+        const unresolved = (f.matrix ?? []).map(row => ({ row, word: requirementWordOf(row, refuted ? "refuted" : null, backing) }))
+            .filter(one => one.word === "Not met" || one.word === "Not shown yet" || one.word === "Unverified");
+        if (unresolved.length === 1)
+            blockers.push({ key: "criteria", message: unresolvedAsk(unresolved[0].row, unresolved[0].word) });
+        else if (unresolved.length > 1) {
+            const ids = unresolved.map(one => one.row.id ?? "?");
+            blockers.push({ key: "criteria", message: `${unresolved.length} requirements ${unresolved.every(one => one.word === "Unverified") ? "couldn't be verified" : "aren't met yet"} (${ids.slice(0, 6).join(", ")}${ids.length > 6 ? ", …" : ""}). Ask for changes, or accept the result with a reason.` });
+        }
+    }
+    if (f.high > 0)
+        blockers.push({ key: "high", message: `The automatic review found ${f.high === 1 ? "a high-severity problem" : `${f.high} high-severity problems`}. Ask for changes before marking it complete.` });
+    return blockers;
 }
 /** A refuted report verifies none of its requirements, whatever it marked met (a person's acceptance doesn't change that). */
 export function unverifiedWhenRefuted(requirements, verdict) {
@@ -355,7 +469,7 @@ export function assignmentStatusFacts(assignment, options = {}) {
     const checks = receipt === null || !withResult ? null
         : { status: receipt.checks.status, exitCode: receipt.checks.exitCode, head: receipt.head,
             ...(receipt.checks.level == null ? {} : { level: receipt.checks.level }), ...(receipt.checks.running == null ? {} : { running: receipt.checks.running }),
-            ...(receipt.checks.batch == null ? {} : { batch: receipt.checks.batch }) };
+            ...(receipt.checks.batch == null ? {} : { batch: receipt.checks.batch }), ...(receipt.checks.release == null ? {} : { release: receipt.checks.release }) };
     const publication = assignment.publication;
     const pullRequest = options.pullRequest !== undefined ? options.pullRequest
         : publication === null ? (withResult && !report ? { state: "none", number: null, url: null, ci: null, error: null } : null)
@@ -368,7 +482,9 @@ export function assignmentStatusFacts(assignment, options = {}) {
         stage, ...(need === undefined ? {} : { need }), ...(wait === undefined ? {} : { wait }), ...(build === null ? {} : { needContext: { build } }), reason, report,
         checks,
         pullRequest: withResult ? pullRequest : null,
-        requirements: withResult ? unverifiedWhenRefuted(requirementsOf(receipt?.proof?.matrix), receipt?.proof?.verdict) : null,
+        requirements: withResult ? unverifiedWhenRefuted(requirementsOf(receipt?.proof?.matrix, checkBackingOf(checks)), assignment.readiness?.verdict ?? receipt?.proof?.verdict) : null,
+        ...(withResult && receipt?.proofAcceptance != null ? { accepted: true } : {}),
+        ...(withResult && (assignment.readiness?.blockers.length ?? 0) > 0 ? { blockers: assignment.readiness.blockers } : {}),
         evidence: withResult ? options.evidence ?? evidenceOf(receipt, [...(receipt?.caveats ?? []), ...assignment.attention]) : null,
         completedBy: assignment.completion === null ? null : assignment.completion.lead === true ? "the lead" : assignment.completion.actor.replace(/^(?:operator|coordinator|lead):/, ""),
         action: options.action ?? null,

package/dist/team-cli.d.ts

@@ -14,6 +14,9 @@ export type TeamCliOptions = {
 export declare const TEAM_CLI_ACTIONS: readonly ['connect', 'lead list', 'lead create', 'lead update', 'lead member', 'lead transfer', 'conversation list', 'conversation create', 'conversation show', 'conversation member', 'conversation edit', 'conversation withdraw', 'conversation read', 'conversation follow', 'conversation stop'];
 export declare class UsageError extends Error {
 }
+/** Credentials are never sent to a URL with embedded authority, an API path, query, fragment or an insecure remote
+ * host. Fetch cannot follow redirects. */
+export declare function serviceOrigin(raw: string): string;
 type Profile = {
     origin: string;
     account: string;

package/dist/team-cli.js

@@ -5,11 +5,11 @@ import { randomBytes } from 'node:crypto';
 import { createInterface } from 'node:readline/promises';
 import { setTimeout as delay } from 'node:timers/promises';
 import { envelopeJson } from './envelope.js';
-import { sessionServiceOrigin } from './session-cli.js';
 import { databasePath } from './store.js';
 import { configBase, namedPath } from './names.js';
 import { parseApiToken } from './api-tokens.js';
 import { deprecationWarning } from './deprecations.js';
+import { PASSWORD_PROFILE_WARNING } from './password-bearer.js';
 /** The central service's own lead verbs; every other `lead …` (token, say, or none) is the local lead's. */
 const CENTRAL_LEAD_ACTIONS = ['list', 'create', 'update', 'member', 'transfer'];
 /** D5: deprecated (deprecations.ts). Each still runs this release, hidden from help and the contract, with one warning on stderr. */
@@ -45,6 +45,22 @@ existing local commands. Credentials stay in a private file, never in URLs or ar
 Reads and attachment do not start model work. Server permissions remain authoritative.`;
 export class UsageError extends Error {
 }
+/** Credentials are never sent to a URL with embedded authority, an API path, query, fragment or an insecure remote
+ * host. Fetch cannot follow redirects. */
+export function serviceOrigin(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new UsageError('The service origin must be HTTPS or loopback HTTP.');
+    }
+    if (url.username || url.password || url.search || url.hash || url.pathname !== '/')
+        throw new UsageError('The service origin must contain only the origin, with no credentials, path, query or fragment.');
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)))
+        throw new UsageError('The service origin requires HTTPS except for loopback HTTP.');
+    return url.origin;
+}
 /** Transport metadata stays local to the CLI; only an actual HTTP 429 permits a follower read retry. */
 const RETRY_AFTER_MS = Symbol('retry-after-ms');
 function retryDelay(header) {
@@ -104,7 +120,7 @@ function profiles(options) {
         if (!record(parsed) || parsed.version !== 1 || typeof parsed.active !== 'string' || !record(parsed.profiles))
             throw new Error();
         for (const [name, one] of Object.entries(parsed.profiles)) {
-            if (!/^[A-Za-z0-9_-]{1,64}$/.test(name) || !record(one) || typeof one.origin !== 'string' || sessionServiceOrigin(one.origin) !== one.origin || typeof one.account !== 'string' || !accountValid(one.account) || typeof one.token !== 'string' || !tokenValid(one.token))
+            if (!/^[A-Za-z0-9_-]{1,64}$/.test(name) || !record(one) || typeof one.origin !== 'string' || serviceOrigin(one.origin) !== one.origin || typeof one.account !== 'string' || !accountValid(one.account) || typeof one.token !== 'string' || !tokenValid(one.token))
                 throw new Error();
         }
         if (!Object.hasOwn(parsed.profiles, parsed.active))
@@ -387,7 +403,7 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (command === 'connect') {
             let origin;
             try {
-                origin = sessionServiceOrigin(parsed.positions[0]);
+                origin = serviceOrigin(parsed.positions[0]);
             }
             catch {
                 throw new UsageError('Use an HTTPS service origin (loopback HTTP is allowed), without credentials, paths, query or fragment.');
@@ -408,6 +424,8 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
                 secret = (flags['token-file'] ? privateFile(value(flags, 'token-file'), 8192) : await (options.readStdin ?? stdinSecret)()).trim();
             if (!accountValid(account) || !tokenValid(secret))
                 throw new UsageError('Provide an account name and a valid sign-in secret from your selected source.');
+            if (parseApiToken(secret) === null)
+                stderr(PASSWORD_PROFILE_WARNING);
             const profile = { origin, account, token: secret }, checked = await perform(profile, { operation: 'list', args: {} }, options);
             if (!checked.ok) {
                 emit(checked);
@@ -421,6 +439,8 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (!profile || !Object.hasOwn(saved.profiles, profileName))
             throw new UsageError('No saved connection. Use connect with your individual sign-in first.');
         secret = profile.token;
+        if (parseApiToken(secret) === null)
+            stderr(PASSWORD_PROFILE_WARNING);
         const call = (operation, args, signal) => perform(profile, { operation, args }, { ...options, ...(signal === undefined ? {} : { signal }) });
         if (command === 'chat' || command === 'brief')
             return await chat(command, flags, profile.account, call, emit, options, stderr);

package/dist/team-runtime.js

@@ -58,7 +58,7 @@ export function createTeamRuntime(options) {
         const previous = pages.get(key);
         if (revision && previous?.revision === revision && previous.expires > now.getTime())
             return previous.page;
-        const page = workIndexPage(store, now, { principal: 'operator', repos: selected.projects }, { leadId: selected.leadId, limit: 40 });
+        const page = workIndexPage(store, now, { principal: 'operator', repos: selected.projects }, { leadId: selected.leadId, limit: 40, root: options.evidenceRoot });
         if (revision && options.workspaceRevision) {
             if (pages.size >= 64)
                 pages.delete(pages.keys().next().value);

package/dist/telegram-status.d.ts

@@ -17,9 +17,16 @@ export declare const PHONE_HELP: string;
 /** The same display scrub for every phone-bound string a person or a model authored. */
 export declare const phoneText: typeof publicChatText;
 export declare function projectLabel(repo: string): string;
+/** The phone's reading of saved results: `root` lets a finished result read its saved checks, requirements and
+ * review exactly as the console does. Without it, the dispatch diagnosis speaks. */
+export type PhoneRead = {
+    root?: string | undefined;
+    now?: Date;
+    repos?: readonly string[];
+};
 /** repos is the transport's explicit enrollment ceiling, never opened-project
  * history. This snapshot is intentionally bounded and advertises that bound. */
-export declare function phoneStatus(store: Store, repos: readonly string[], now: Date, focused?: string | null): string;
+export declare function phoneStatus(store: Store, repos: readonly string[], now: Date, focused?: string | null, root?: string): string;
 /** One task a person can pick to talk about from a chat app. */
 export type PhoneTaskChoice = {
     id: string;
@@ -31,7 +38,7 @@ export type PhoneTaskChoice = {
  * then work in progress, waiting work and recent results; one entry per
  * task (its revisions share it), optionally narrowed by words in the id or
  * title. Bounded, within the chat's own project ceiling. */
-export declare function phoneTaskChoices(store: Store, repos: readonly string[], now: Date, query?: string | null, limit?: number): PhoneTaskChoice[];
+export declare function phoneTaskChoices(store: Store, repos: readonly string[], now: Date, query?: string | null, limit?: number, root?: string): PhoneTaskChoice[];
 /** `id` keys the chat's choice (the task's first version, where its chat
  * lives); `view` is what to show: the exact version named, else the current one. */
 export type PhoneTaskPick = {
@@ -63,10 +70,10 @@ export type PhoneTaskLink = {
 };
 /** Where the rest lives when no button can say so: the closing line of an unlinked `/task`. */
 export declare const PHONE_CONSOLE_FOOTER = "Read-only status. Saved files and full actions are in the console.";
-export declare function phoneTask(store: Store, repos: readonly string[], id: string, now: Date): string;
+export declare function phoneTask(store: Store, repos: readonly string[], id: string, now: Date, root?: string): string;
 /** One task's status for a chat app: the words, its one console link, and
  * the saved result it shows (a reply to it is about that result). */
-export declare function phoneTaskView(store: Store, repos: readonly string[], id: string, now: Date): {
+export declare function phoneTaskView(store: Store, repos: readonly string[], id: string, now: Date, root?: string): {
     text: string;
     link: PhoneTaskLink | null;
     run: number | null;

package/dist/telegram-status.js

@@ -4,7 +4,8 @@ import { manualReviewOnly } from "./proof.js";
  * No provider calls, repository access, new workflow state, or inferred success. */
 import { diagnoseTaskDispatch, withDispatchDiagnoses } from "./dispatch.js";
 import { familyCompleted } from "./result-completion.js";
-import { plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
+import { assignmentStatusFacts, plainReasonOf, stageOfDispatch, taskStatusOf } from "./task-status.js";
+import { assignmentOf } from "./assignment.js";
 import { CHAT_CONTROLS, chatControlHref, chatResultHref } from "./chat-controls.js";
 export function phoneCommand(text) {
     // Slash forms everywhere; the bare words too, because Slack and Discord
@@ -53,10 +54,16 @@ export function projectLabel(repo) {
     return plain(repo.split(/[\\/]/).filter(Boolean).pop() ?? "project", 48);
 }
 /** The shared headline (task-status.ts) for a dispatch diagnosis on the phone. */
-function headlineFor(store, id, d) {
+function headlineFor(store, id, d, read_ = {}) {
     // Any version of a completed family reads Complete, as taskWaitSnapshot says.
     const completed = d.code === "complete" && familyCompleted(store, id);
     const read = stageOfDispatch(d, { completed });
+    // A finished result reads the console's own facts: its requirements, checks Off at release, and what holds it back.
+    if (read.stage === "finished" && read_.root !== undefined && read_.now !== undefined && read_.repos !== undefined) {
+        const assignment = assignmentOf(store, id, read_.now, { principal: "operator", repos: read_.repos }, read_.root);
+        if (assignment !== null && assignment.state === "ready-to-check")
+            return taskStatusOf(assignmentStatusFacts(assignment));
+    }
     const finished = read.stage === "finished" || read.stage === "complete" || read.stage === "failed";
     return taskStatusOf({ stage: read.stage, ...(read.need === undefined ? {} : { need: read.need }), reason: finished ? null : plainReasonOf(read.stage, d.code, d.detail),
         checks: read.stage === "failed" && d.code === "proof-refuted" ? { status: "failed", exitCode: null, head: null } : null });
@@ -95,7 +102,7 @@ function nextStep(d) {
 }
 /** repos is the transport's explicit enrollment ceiling, never opened-project
  * history. This snapshot is intentionally bounded and advertises that bound. */
-export function phoneStatus(store, repos, now, focused = null) {
+export function phoneStatus(store, repos, now, focused = null, root) {
     if (repos.length === 0)
         return "No connected projects are available to this bridge. Add a project in Toolroll, then send /status again.";
     return store.transact(() => {
@@ -111,7 +118,7 @@ export function phoneStatus(store, repos, now, focused = null) {
                 continue;
             lines.push(`${group} · ${rows.length}${snapshot.tasksSaturated ? " in this snapshot" : ""}`);
             for (const task of rows.slice(0, 2)) {
-                lines.push(`${plain(task.id, 64)} · ${projectLabel(repos[task.repoIndex])}`, `  ${plain(task.title, 64)} — ${headlineFor(store, task.id, task.dispatch).headline}`);
+                lines.push(`${plain(task.id, 64)} · ${projectLabel(repos[task.repoIndex])}`, `  ${plain(task.title, 64)} — ${headlineFor(store, task.id, task.dispatch, { root, now, repos }).headline}`);
             }
             if (rows.length > 2)
                 lines.push(`  +${rows.length - 2} more in the console`);
@@ -126,7 +133,7 @@ const PICK_GROUPS = ["Needs attention", "Working", "Waiting / next up", "Finishe
  * then work in progress, waiting work and recent results; one entry per
  * task (its revisions share it), optionally narrowed by words in the id or
  * title. Bounded, within the chat's own project ceiling. */
-export function phoneTaskChoices(store, repos, now, query = null, limit = 8) {
+export function phoneTaskChoices(store, repos, now, query = null, limit = 8, root) {
     if (repos.length === 0)
         return [];
     return store.transact(() => {
@@ -142,7 +149,7 @@ export function phoneTaskChoices(store, repos, now, query = null, limit = 8) {
             if (seen.has(id) || !words.every(word => `${id} ${row.title}`.toLowerCase().includes(word)))
                 continue;
             seen.add(id);
-            choices.push({ id, title: plain(row.title, 64), label: headlineFor(store, row.id, row.dispatch).headline, group: groupOf(row.dispatch) });
+            choices.push({ id, title: plain(row.title, 64), label: headlineFor(store, row.id, row.dispatch, { root, now, repos }).headline, group: groupOf(row.dispatch) });
             if (choices.length >= limit)
                 break;
         }
@@ -210,12 +217,12 @@ function taskLinkFor(id, d, result) {
         default: return control("task");
     }
 }
-export function phoneTask(store, repos, id, now) {
-    return phoneTaskView(store, repos, id, now).text;
+export function phoneTask(store, repos, id, now, root) {
+    return phoneTaskView(store, repos, id, now, root).text;
 }
 /** One task's status for a chat app: the words, its one console link, and
  * the saved result it shows (a reply to it is about that result). */
-export function phoneTaskView(store, repos, id, now) {
+export function phoneTaskView(store, repos, id, now, root) {
     return store.transact(() => {
         const ref = store.lookupRef(id);
         // Check admission before reading a title, run, proof, or diagnosis.
@@ -225,7 +232,7 @@ export function phoneTaskView(store, repos, id, now) {
         const d = diagnoseTaskDispatch(store, id, now);
         if (d === null)
             return { text: "This task's status is unavailable. Open it in the console before retrying.", link: null, run: null };
-        const shared = headlineFor(store, id, d);
+        const shared = headlineFor(store, id, d, { root, now, repos });
         const lines = [plain(task.title, 140), `${plain(id, 64)} · ${projectLabel(ref.repo)}`, `As of ${now.toISOString().replace("T", " ").slice(0, 19)} UTC`, "", shared.headline];
         const blocker = d.blockerTaskId === null ? null : store.lookupRef(d.blockerTaskId);
         const hiddenDependency = blocker !== null && (blocker.repo === null || !repos.includes(blocker.repo));

package/dist/telegram.js

@@ -1884,9 +1884,9 @@ function applyPhoneRead(context, update, effects) {
                 const repos = telegramConversationRepos(store, binding.approver, registry);
                 const focused = focusedTitle(store, binding);
                 if (command.kind === "status")
-                    response = phoneStatus(store, repos, clock(), focused?.title ?? null);
+                    response = phoneStatus(store, repos, clock(), focused?.title ?? null, context.conversation?.evidenceRoot);
                 else if (command.kind === "tasks") {
-                    const choices = phoneTaskChoices(store, repos, clock());
+                    const choices = phoneTaskChoices(store, repos, clock(), null, 8, context.conversation?.evidenceRoot);
                     response = choices.length === 0 ? phoneTaskListText([], null) : `${focused === null ? "" : `Talking about: ${focused.title}\n\n`}Pick a task to talk about:`;
                     if (choices.length > 0)
                         keyboard = pickKeyboard(store, choices, focused !== null);
@@ -1901,7 +1901,7 @@ function applyPhoneRead(context, update, effects) {
                         response = PHONE_NO_MATCH;
                     else {
                         store.setChatFocus("telegram", binding.id, pick.id, clock());
-                        const view = phoneTaskView(store, repos, pick.view, clock());
+                        const view = phoneTaskView(store, repos, pick.view, clock(), context.conversation?.evidenceRoot);
                         shown = { task: pick.view, run: view.run };
                         button = phoneLinkButton(context.conversation?.phoneOrigin?.() ?? null, view.link);
                         // A destination with no trusted origin to carry it: the words say where instead.
@@ -2124,7 +2124,7 @@ function applyCallback(context, update, effects) {
         store.setChatFocus("telegram", binding.id, id, clock());
         ack(`Talking about: ${title}`.slice(0, 190));
         const current = store.taskFamilyOf(taskId, repos, false)?.current.id ?? id;
-        const view = phoneTaskView(store, repos, current, clock());
+        const view = phoneTaskView(store, repos, current, clock(), context.conversation?.evidenceRoot);
         store.recordTelegramTaskMessage(binding, String(message.message_id), current, view.run, clock());
         editText(phoneFocusText(view.text), [[telegramButton("Back to the lead", "pick:lead")]]);
         return;