toolroll 0.9.6 → 0.9.8

package/CHANGELOG.md

@@ -1,6 +1,69 @@
 # Changelog
 
-## Unreleased
+## 0.9.8 — 2026-10-01
+
+- **One automatic review per build.** When a build's checks pass (or it
+  finishes, with checks Off) in a project with review on, one read-only
+  reviewer reads the scope, acceptance and diff and grades each finding HIGH,
+  MEDIUM or LOW. Any HIGH sends the task back once, with the findings as its
+  note; a HIGH on that revision comes to you. MEDIUM and LOW never block: they
+  show on the result as suggested follow-ups. A review that fails or times
+  out never blocks: the result reaches you marked Not reviewed. Turn it on or
+  off per project in Settings or with `toolroll review on|off --repo <path>`;
+  it's on by default under a hands-off mode. Release candidate checks are
+  never reviewed.
+- **Evidence is kept 1, 7, 14 or 28 days, or forever.** Settings →
+  Retention and `toolroll retention set evidence 1d` take any of them. Until
+  someone chooses, evidence is kept 28 days: **after upgrading, the daily
+  sweep starts removing finished tasks' evidence older than 28 days.** A
+  period chosen before stays as it was; one the page no longer offers shows
+  as "30 days (custom)".
+  Nothing a task still needs is removed: unfinished tasks, results Ready for
+  review, anything on hold, live runs and release candidates.
+- **A run whose process never started no longer blocks updates.** A spawn
+  that fails now settles its own record, and Toolroll settles a finished run's
+  leftover record once its processes are provably gone, noting it in the
+  ledger. For the rare record that can't be proven either way, an approver
+  can run `toolroll run settle <run> --why "<reason>"`; it refuses while
+  anything of the run is alive.
+
+## 0.9.7 — 2026-10-01
+
+- **Onboarding without a password or a form.** `toolroll up` prints three
+  lines and opens the console already signed in, through a one-time link that
+  works once, for ten minutes, from this computer only. The lead turns on by
+  itself with the agent that's signed in (Claude Code, else Codex); the old
+  setup form moved to Settings → Lead → Advanced. With no agent signed in,
+  Chat shows the command to install and sign in, and checks again on its own.
+  A short "how it works", a live Plan → Ready timeline on your first task, a
+  card for pairing your phone, and a "wrong host" page that says what to run.
+- **The task page is one conversation.** The status stays on top; below it
+  the plan, the agent's notes and results, questions and your replies, in
+  order, ending in a box to message the agent (Build, Plan only, or Just
+  answer). Details (scope, attempts, audit) moved to a side panel, or a sheet
+  on phones. The Chat home shows who is working now and four counts, and
+  Catch up and the Inbox have tabs: Needs you, Ready, Running, All.
+- **Checks: quick while building, easy to turn off.** Each project has a
+  check level: Quick (the default for new projects), Full or Off, and a task
+  can override it ("skip the tests"). With checks Off a result is still
+  Ready for review, and says no check ran. Any result can run its checks again or file a task to add tests.
+- **A flow gallery, and flows as files.** Flows → New is a gallery of
+  templates grouped by what they're for, with new ones for developers
+  (Overnight bug bash, Flaky test hunter, Release notes writer, Docs follow
+  the code, Error to fix, PR second opinion and more). Export any flow as a
+  `.toolroll-flow.json` file and import one from a file or a link, with a
+  preview; secrets never leave, and imported triggers start switched off.
+- **Several builds at once on one project.** The service builds up to two
+  tasks of a project at a time (Settings → Projects, `toolroll project
+  concurrency`), within the machine's limit. Stopping the service mid-build
+  saves the work and resumes it next time.
+- **The lead's housekeeping stays quiet.** An agent acting as your lead gets
+  its own credential (`toolroll lead token`); its work pings nobody unless it
+  hands something to you. Your own actions never ping you, a replaced task
+  reads "Replaced by", and a whole project can be muted.
+- **A faster release check.** Flow journeys run in parallel groups, browser
+  journeys are rebalanced, and a version-only bump no longer forces every
+  test.
 
 ## 0.9.6 — 2026-10-01
 

package/dist/actor.d.ts

@@ -0,0 +1,21 @@
+export type Actor = {
+    account: string;
+    lead: boolean;
+};
+/** Run `fn` with this actor (or an empty slot a verified sign-in may fill). */
+export declare function withActor<T>(actor: Actor | null, fn: () => T): T;
+export declare function currentActor(): Actor | null;
+/** A person verified their password inside this command: their acts are now theirs. A lead keeps its own label. */
+export declare function claimActor(account: string): void;
+/** How the ledger names an actor. */
+export declare function actorLabel(actor: Actor): string;
+export declare function mintLeadToken(): {
+    id: string;
+    token: string;
+    hash: string;
+};
+export declare function parseLeadToken(presented: string): {
+    id: string;
+    secret: string;
+} | null;
+export declare function leadSecretMatches(secret: string, keptHash: string): boolean;

package/dist/actor.js

@@ -0,0 +1,48 @@
+/**
+ * Who is acting right now, for pings that follow responsibility.
+ *
+ * A lead is an agent acting for one person under a lead token (`toolroll lead
+ * token`): it signs in as that person, and its acts are recorded as "lead for
+ * <owner>". A person acting for themselves is recorded by name. Work whose
+ * actor is the lead pings nobody, and nobody is pinged about their own act.
+ *
+ * The actor is held for one command or one console request, never for a
+ * long-running service: a worker's facts are nobody's act.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+/** The slot is mutable so a command can name its person after it has verified their password. */
+const slot = new AsyncLocalStorage();
+/** Run `fn` with this actor (or an empty slot a verified sign-in may fill). */
+export function withActor(actor, fn) {
+    return slot.run({ actor }, fn);
+}
+export function currentActor() {
+    return slot.getStore()?.actor ?? null;
+}
+/** A person verified their password inside this command: their acts are now theirs. A lead keeps its own label. */
+export function claimActor(account) {
+    const held = slot.getStore();
+    if (held !== undefined && held.actor === null)
+        held.actor = { account, lead: false };
+}
+/** How the ledger names an actor. */
+export function actorLabel(actor) {
+    return actor.lead ? `lead for ${actor.account}` : actor.account;
+}
+// ---- the lead token ---------------------------------------------------------
+/** `lt_<id>_<secret>`: shown once, only its hash kept. */
+const SHAPE = /^lt_([a-f0-9]{12})_([A-Za-z0-9_-]{43})$/;
+export function mintLeadToken() {
+    const id = randomBytes(6).toString("hex"), secret = randomBytes(32).toString("base64url");
+    return { id, token: `lt_${id}_${secret}`, hash: hashLeadSecret(secret) };
+}
+const hashLeadSecret = (secret) => createHash("sha256").update(secret, "utf8").digest("hex");
+export function parseLeadToken(presented) {
+    const match = SHAPE.exec(presented.trim());
+    return match === null ? null : { id: match[1], secret: match[2] };
+}
+export function leadSecretMatches(secret, keptHash) {
+    const a = Buffer.from(hashLeadSecret(secret), "hex"), b = Buffer.from(keptHash, "hex");
+    return a.length === b.length && timingSafeEqual(a, b);
+}

package/dist/assignment-adapters.d.ts

@@ -117,6 +117,7 @@ export declare function assignmentForCoordinator(store: Store, token: string, op
                     actor: string;
                     at: string;
                     digest: string;
+                    lead?: true;
                 } | null;
                 result: {
                     digest: string;
@@ -139,6 +140,7 @@ export declare function assignmentForCoordinator(store: Store, token: string, op
                     prUrl: string | null;
                     remoteState: string | null;
                 } | null;
+                review: import("./review-switch.js").BuildReviewView | null;
                 deployment: {
                     status: "not-recorded";
                 };

package/dist/assignment-adapters.js

@@ -1,5 +1,6 @@
 /** Assignment reads and delivery acknowledgments. These adapters never start
  * work, answer a decision, accept proof, or change an approval. */
+import { buildReviewLines } from "./review-switch.js";
 import { readFileSync, statSync } from "node:fs";
 import { authenticateCoordinator } from "./coordinator.js";
 import { assignmentOf, assignmentUpdates, claimAssignment, checkAssignment } from "./assignment.js";
@@ -113,6 +114,7 @@ function assignmentLines(assignment) {
             ...(receipt.agentReport === null ? [] : [`Agent report: ${receipt.agentReport}`]),
             `Receipt: ${receipt.digest}`,
         ]),
+        ...buildReviewLines(assignment.review ?? null).map(line => line.trimStart().replace(/^review: /, "Review: ")),
         ...(assignment.savedContext === undefined ? [] : [
             ...(assignment.savedContext.goal === null ? [] : [`Goal: ${assignment.savedContext.goal}`]),
             ...(assignment.savedContext.outOfScope === null ? [] : [`Out of scope: ${assignment.savedContext.outOfScope}`]),

package/dist/assignment-ui.js

@@ -67,7 +67,9 @@ function savedMaterialNotice(detail, assignment) {
 export function assignmentCardOf(assignment, options = {}) {
     const receipt = assignment.receipt;
     const links = receipt === null ? {} : { result: options.resultHref ?? chatResultHref(receipt.taskId, receipt.runId), checks: chatResultHref(receipt.taskId, receipt.runId, 'checks'),
-        pullRequest: `/t/${encodeURIComponent(assignment.rootId)}#merge` };
+        pullRequest: `/t/${encodeURIComponent(assignment.rootId)}#merge`,
+        // Run checks lives with the result's checks; the row's action leads there.
+        ...(receipt.completionKind === 'research-report' ? {} : { runChecks: `${chatResultHref(receipt.taskId, receipt.runId, 'checks')}#follow-ups` }) };
     const presentation = assignmentPresentationOf(assignment, { ...options, links });
     const { status, diagnostics, taskStatus } = presentation;
     const href = assignment.primaryAction?.code === 'open-result' && options.resultHref !== undefined ? options.resultHref : assignmentActionHref(assignment);

package/dist/assignment.d.ts

@@ -1,6 +1,8 @@
 import { type Store, type ProofVerdictRow, type ProofAcceptanceRow } from "./store.js";
 import { type WorkAction, type WorkSummaryAccess } from "./work-summary.js";
 import { type VerifiedApprover } from "./principal.js";
+import { type CheckLevel } from "./check-levels.js";
+import { type BuildReviewView } from "./review-switch.js";
 export type AssignmentAccess = WorkSummaryAccess;
 export type AssignmentOwner = {
     kind: "coordinator" | "lead";
@@ -13,6 +15,10 @@ export type AssignmentChecks = {
     command: string | null;
     logArtifactId: number | null;
     detail: string;
+    /** Which check this is (check-levels.ts): quick, full, or off; null before levels. */
+    level?: CheckLevel | null;
+    /** A follow-up check waiting or running on this commit. */
+    running?: "quick" | "full" | null;
 };
 export type AssignmentReceipt = {
     digest: string;
@@ -70,10 +76,12 @@ export type AssignmentSnapshot = {
             problem: string | null;
         }[];
     };
+    /** `lead`: marked complete by the person's lead (`toolroll lead token`), shown as "by the lead". */
     completion: {
         actor: string;
         at: string;
         digest: string;
+        lead?: true;
     } | null;
     handoff: {
         kind: "result" | "decision" | "attention";
@@ -85,6 +93,9 @@ export type AssignmentSnapshot = {
         prUrl: string | null;
         remoteState: string | null;
     } | null;
+    /** The result's one automatic review, when its project had review on:
+     * pending, HIGH findings, suggested follow-ups (MEDIUM/LOW), or not reviewed. */
+    review: BuildReviewView | null;
     deployment: {
         status: "not-recorded";
     };
@@ -112,6 +123,7 @@ export declare function assignmentBrief(assignment: AssignmentSnapshot | null):
         actor: string;
         at: string;
         digest: string;
+        lead?: true;
     } | null;
     result: {
         digest: string;
@@ -134,6 +146,7 @@ export declare function assignmentBrief(assignment: AssignmentSnapshot | null):
         prUrl: string | null;
         remoteState: string | null;
     } | null;
+    review: BuildReviewView | null;
     deployment: {
         status: "not-recorded";
     };
@@ -189,6 +202,7 @@ export declare function assignmentUpdates(store: Store, now: Date, access: Assig
                 actor: string;
                 at: string;
                 digest: string;
+                lead?: true;
             } | null;
             result: {
                 digest: string;
@@ -211,6 +225,7 @@ export declare function assignmentUpdates(store: Store, now: Date, access: Assig
                 prUrl: string | null;
                 remoteState: string | null;
             } | null;
+            review: BuildReviewView | null;
             deployment: {
                 status: "not-recorded";
             };

package/dist/assignment.js

@@ -2,6 +2,8 @@
  * approval or proof state. Lead ownership and exact receipt acknowledgments
  * are append-only actions; handoffs use the existing durable outbox. */
 import { createHash } from "node:crypto";
+import { currentActor, withActor } from "./actor.js";
+import { replacedWords } from "./task-status.js";
 import { COMPLETION_ACTION, familyChangedFiles } from "./result-completion.js";
 import { homedir } from "node:os";
 import { readSchemaVersion } from "./store.js";
@@ -12,6 +14,9 @@ import { verificationEvidence } from "./verification-evidence.js";
 import { reproveApprover } from "./principal.js";
 import { noteAssignmentStatus } from "./assignment-status.js";
 import { historicalAssessmentReason } from "./assignment-presentation.js";
+import { runCheckLevel } from "./check-levels.js";
+import { followUpChecksOf, withFollowUps } from "./result-follow-ups.js";
+import { buildReviewOf, findingWords } from "./review-switch.js";
 /** Status-first handoff for routine reads. Fetch get_assignment only when
  * inspecting its exact evidence; do not repeat a full proof in every poll. */
 export function assignmentBrief(assignment) {
@@ -25,9 +30,23 @@ export function assignmentBrief(assignment) {
             base: receipt.base, head: receipt.head, completionKind: receipt.completionKind,
             checks: receipt.checks, proofAcceptance: receipt.proofAcceptance, verdict: receipt.proof?.verdict ?? null,
             criteria: { passed: receipt.proof?.matrix.filter(row => row.state === "pass").length ?? 0, total: receipt.proof?.matrix.length ?? 0 }, evidence: receipt.evidence },
-        publication: assignment.publication, deployment: assignment.deployment };
+        publication: assignment.publication, review: assignment.review, deployment: assignment.deployment };
 }
 const digest = (value) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+/** A lookup added with lead-quiet, read safely: a deploy proves completion with this code over the INSTALLED runtime's
+ * store, before this version's migration, so the method (or its table) may not exist yet. Absent reads as none. */
+function olderStoreSafe(read, absent) {
+    try {
+        return read();
+    }
+    catch (error) {
+        if (error instanceof TypeError || /no such (table|column)/.test(String(error)))
+            return absent;
+        throw error;
+    }
+}
+/** A check as the receipt digest seals it: presentation-only fields (check-levels.ts) left out. */
+const sealedChecks = ({ level: _level, running: _running, ...proof }) => proof;
 const OWNER_ACTION = "assignment claimed";
 const CHECK_ACTION = COMPLETION_ACTION;
 const actorOf = (owner) => `${owner.kind}:${owner.id}`;
@@ -58,8 +77,24 @@ function ownerOf(store, rootId, repo) {
         active: credential !== undefined && credential["revoked_at"] === null && repo !== null && Array.isArray(repos) && repos.includes(repo) };
 }
 // Report the recorded check outcome, never turn a model verdict into a check.
-function nativeChecks(store, root, runId) {
-    const unavailable = (detail) => ({ status: "unavailable", exitCode: null, command: null, logArtifactId: null, detail });
+// Follow-up checks on the same commit (Run checks) upgrade a pass and show a failure.
+function nativeChecks(store, root, runId, now) {
+    const own = buildChecks(store, root, runId);
+    const run = store.getRun(runId);
+    const followUps = followUpChecksOf(store, runId, now, root);
+    if (followUps.length === 0)
+        return own;
+    const read = withFollowUps({ status: own.status, level: own.level ?? null, exitCode: own.exitCode, head: run?.headRevision ?? null }, followUps);
+    const latest = [...followUps].reverse().find(one => one.state === "passed" || one.state === "failed");
+    const changed = read.status !== own.status || read.level !== (own.level ?? null) || read.exitCode !== own.exitCode;
+    const words = read.level === "quick" ? "Quick checks" : "Checks";
+    return { ...own, running: read.running,
+        ...(changed ? { status: read.status, level: read.level, exitCode: read.exitCode, logArtifactId: latest?.logArtifactId ?? own.logArtifactId,
+            detail: read.status === "passed" ? `${words} passed.` : `${words} failed (exit ${read.exitCode}).` } : {}) };
+}
+function buildChecks(store, root, runId) {
+    const level = runCheckLevel(store, runId);
+    const unavailable = (detail) => ({ status: "unavailable", exitCode: null, command: null, logArtifactId: null, detail, level });
     if (root === undefined)
         return unavailable("Saved checks are unavailable.");
     try {
@@ -68,11 +103,14 @@ function nativeChecks(store, root, runId) {
             return unavailable(gate.problem);
         const receipt = gate.bytes === null ? null : JSON.parse(gate.bytes);
         if (receipt === null)
-            return { ...unavailable("No machine check is recorded."), status: "not-run" };
+            return { ...unavailable(level === "off" ? "Checks were off for this build." : "No machine check is recorded."), status: "not-run" };
         const ran = receipt.result.ran === true, exitCode = ran ? receipt.result.exitCode : null;
+        // The sealed receipt names the grant that ran: the quick one, or the full one.
+        const sealedLevel = typeof receipt.command?.repo === "string" && receipt.command.repo.startsWith("quick:") ? "quick" : "full";
+        const words = sealedLevel === "quick" ? "Quick checks" : "Checks";
         return { status: ran ? exitCode === 0 ? "passed" : "failed" : "not-run", exitCode,
-            command: receipt.command.command, logArtifactId: receipt.log.artifactId,
-            detail: ran ? exitCode === 0 ? "Checks passed." : `Checks failed (exit ${exitCode}).` : "Checks did not finish." };
+            command: receipt.command.command, logArtifactId: receipt.log.artifactId, level: level === null ? null : sealedLevel,
+            detail: ran ? exitCode === 0 ? `${words} passed.` : `${words} failed (exit ${exitCode}).` : `${words} did not finish.` };
     }
     catch {
         return unavailable("Saved checks could not be read.");
@@ -112,7 +150,7 @@ export function assignmentOf(store, taskId, now, access, root) {
     const reports = artifacts.filter(a => a.kind === "report");
     const unavailable = family.versions.flatMap(version => store.runsFor(version.refId).flatMap(run => store.artifactsFor(run.id).filter(artifact => root === undefined || !readVerifiedArtifact(root, artifact).ok)
         .map(artifact => `Saved ${artifact.kind} #${artifact.id} (run ${run.id}) is unavailable or changed.`)));
-    const checks = result === null ? null : nativeChecks(store, root, result.id);
+    const checks = result === null ? null : nativeChecks(store, root, result.id, now);
     const finishedBuild = result?.role === "builder" && (result.outcome === "built" || result.outcome === "no-change") &&
         result.finishedAt !== null && /^[a-f0-9]{40}$/.test(result.headRevision ?? "");
     // Finished work returns to its lead or user. Strict terms and previous model
@@ -133,7 +171,11 @@ export function assignmentOf(store, taskId, now, access, root) {
             ...artifacts.filter(a => a.kind !== "check-log" && (a.truncated || a.captureStatus === "failed")).map(a => `Saved ${a.kind} #${a.id} is ${a.captureStatus === "failed" ? "a failed capture" : "incomplete"}.`)],
         agentReport: result.handoff, evidence: "recorded",
     };
-    const receipt = receiptBody === null ? null : { ...receiptBody, digest: digest({ receipt: receiptBody,
+    // The digest seals the proof, not how it is shown: the check's `level` (read from its sealed command) and `running`
+    // (a follow-up in flight) stay out of it, so a result completed before check levels keeps its completion, and a
+    // follow-up check that is still running never unseals one.
+    const sealedBody = receiptBody === null ? null : { ...receiptBody, checks: sealedChecks(receiptBody.checks) };
+    const receipt = receiptBody === null ? null : { ...receiptBody, digest: digest({ receipt: sealedBody,
             scope: scope === null ? null : { digest: scope.digest, approved: approvalOf(scope).approved, termsProblem: scope.termsProblem ?? null },
             versions: family.versions.map(v => ({ id: v.id, state: v.state })) }) };
     let completion = null;
@@ -145,7 +187,11 @@ export function assignmentOf(store, taskId, now, access, root) {
     // The exact completed result, scope, family and custody fences apply to
     // every deliverable. Human acceptance remains its own recorded authority;
     // it never changes a machine verdict or supplies a missing report.
-    const ready = current.state === "done" && result !== null && completionKind !== null &&
+    // Kept out of the sealed receipt (sealedChecks): the review never changes the result's digest.
+    const review = result === null ? null : olderStoreSafe(() => buildReviewOf(store, result.id), null);
+    // A result under its one automatic review has not reached the person yet.
+    const reviewing = review?.state === "pending" && current.state === "done";
+    const ready = !reviewing && current.state === "done" && result !== null && completionKind !== null &&
         scope !== null && scope.termsProblem == null && approvalOf(scope).approved && scope.digest === result.scopeDigest &&
         store.activeHolds(current.refId, now).length === 0 && store.applicableStopFor(result.id) === null &&
         processProblem === null &&
@@ -154,8 +200,10 @@ export function assignmentOf(store, taskId, now, access, root) {
         state = "needs-decision";
     else if (current.state === "cancelled") {
         state = "cancelled";
-        detail = "This assignment was cancelled.";
-        primaryAction = { code: "inspect-task", label: "View assignment", target: { taskId: current.id, runId: null, decisionId: null }, access: "read", retry: "read-again" };
+        const successor = olderStoreSafe(() => store.replacementOf(current.id) ?? store.replacementOf(family.root.id), null);
+        detail = successor === null ? "This assignment was cancelled." : `${replacedWords(successor)}.`;
+        primaryAction = successor === null ? { code: "inspect-task", label: "View assignment", target: { taskId: current.id, runId: null, decisionId: null }, access: "read", retry: "read-again" }
+            : { code: "inspect-task", label: `Open ${successor}`, target: { taskId: successor, runId: null, decisionId: null }, access: "read", retry: "read-again" };
     }
     else if (!live && processProblem !== null && result !== null) {
         state = "needs-decision";
@@ -170,6 +218,11 @@ export function assignmentOf(store, taskId, now, access, root) {
         detail = question.decision.question;
         primaryAction = workDecisionAction(question.taskId, question.decision, access.principal);
     }
+    else if (reviewing && result !== null) {
+        state = "checking";
+        detail = "An automatic review is reading this result before it reaches you.";
+        primaryAction = { code: "inspect-run", label: "Open result", target: { taskId: current.id, runId: result.id, decisionId: null }, access: "read", retry: "read-again" };
+    }
     else if (ready && receipt !== null) {
         state = "ready-to-check";
         detail = completionKind === "research-report" ? "The research report is ready for the lead to read."
@@ -182,10 +235,12 @@ export function assignmentOf(store, taskId, now, access, root) {
         // membership changes and ownership transfer cannot revoke past completion.
         // The exact result digest still fences changes to work, scope and history.
         if (checked !== undefined) {
-            completion = { actor: String(checked["actor"]), at: String(checked["at"]), digest: receipt.digest };
+            const rootRef = store.lookupRef(family.root.id);
+            const byLead = rootRef !== null && olderStoreSafe(() => store.taskActs(rootRef.id), []).filter(one => one.act === "completed").at(-1)?.lead === true;
+            completion = { actor: String(checked["actor"]), at: String(checked["at"]), digest: receipt.digest, ...(byLead ? { lead: true } : {}) };
             state = "complete";
             primaryAction = { ...primaryAction, label: completionKind === "research-report" ? "Read report" : "Open result" };
-            const label = completion.actor.startsWith("operator:") ? completion.actor.slice(9) : owner && completion.actor === actorOf(owner) ? owner.label : "the previous lead";
+            const label = byLead ? "the lead" : completion.actor.startsWith("operator:") ? completion.actor.slice(9) : owner && completion.actor === actorOf(owner) ? owner.label : "the previous lead";
             detail = completionKind === "research-report" ? `Research report checked by ${label}. No deployment is implied.`
                 : `Handled by ${label}. ${receipt.checks.detail} Publication and deployment are separate.`;
         }
@@ -218,6 +273,11 @@ export function assignmentOf(store, taskId, now, access, root) {
             attention.push(...(proof?.reasons ?? []).filter(reason => !historicalAssessmentReason(reason)));
         attention.push(...receipt.caveats.filter(reason => !proof?.reasons.includes(reason)));
     }
+    if (review !== null && review.sentBackAs === null) {
+        if (review.state === "not-reviewed")
+            attention.push(`Not reviewed: ${review.reason ?? "the automatic review did not finish"}.`);
+        attention.push(...review.high.map(one => `Review: ${findingWords(one)}`));
+    }
     if (state !== "complete")
         completion = null;
     if (current.state !== "cancelled")
@@ -247,7 +307,7 @@ export function assignmentOf(store, taskId, now, access, root) {
     return { version: 1, rootId: family.root.id, activeTaskId: current.id, repo: current.repo, title: family.root.title,
         state, detail, primaryAction, attention: [...new Set(attention)], attempts, owner, receipt, savedContext, completion, handoff,
         publication: publication === null ? null : { state: publication.state, prUrl: publication.prUrl, remoteState: publication.remoteState },
-        deployment: { status: "not-recorded" } };
+        review, deployment: { status: "not-recorded" } };
 }
 function admittedOwner(store, taskId, owner, now, root) {
     if (owner.kind !== "coordinator")
@@ -316,6 +376,9 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
             return { ok: false, reason: "approval-rules", message: problem };
         store.recordAction({ at: now.toISOString(), actor, repo: current.repo,
             taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work" });
+        const ref = store.lookupRef(current.rootId);
+        if (ref !== null)
+            store.noteTaskAct(ref.id, "completed", now);
         store.bumpWake();
     }
     const assignment = assignmentOf(store, current.rootId, now, access, root);
@@ -335,7 +398,8 @@ export function checkAssignment(store, taskId, receiptDigest, owner, now, root =
 /** The signed-in user can mark the same exact receipt handled without taking
  * lead ownership. This records review, never check success or new authority. */
 export function checkAssignmentAsOperator(store, taskId, receiptDigest, who, now, root = evidenceRoot(homedir())) {
-    return store.transact(() => {
+    // Completing is this person's act (or their lead's): it never pings them.
+    return withActor(currentActor() ?? { account: who.name, lead: false }, () => store.transact(() => {
         if (!reproveApprover(store, who).ok)
             return { ok: false, reason: "unauthenticated", message: "Sign in again before marking this result complete." };
         const access = { principal: "operator", repos: who.repos };
@@ -343,7 +407,7 @@ export function checkAssignmentAsOperator(store, taskId, receiptDigest, who, now
         if (current === null || !store.accountCanAccess(who.name, current.repo))
             return { ok: false, reason: "not-found", message: "No assignment is available in your projects." };
         return acknowledgeCurrent(store, current, receiptDigest, `operator:${who.name}`, now, root, access);
-    });
+    }));
 }
 function noteAssignmentHandoff(store, assignment, now) {
     if (!assignment.owner?.active || assignment.handoff === null || assignment.handoff.acknowledged)