toolroll 0.9.61 → 0.9.63

package/dist/operate.js

@@ -19,9 +19,11 @@ import { matchesOutsideCheckpoint } from "./ledger-chain.js";
 import { CLEANUP_CHOICES, bytesWords, cleanupWords, diskBytes, parseCleanup, storageReport } from "./storage.js";
 import { removeStaleTestTemp, tempRoots, testTempFolders } from "./test-temp.js";
 import { storageSweepSupervisor } from "./storage-sweep-process.js";
-import { dailyStorageSweep, lastSweep, nextSweepAt, saveSweep, storageSweepOff as storageSweepOffNow, sweepDetails, sweepWords as storageSweepWords } from "./storage-sweep.js";
+import { idleStorageSweep, sweepSchedule, sweepScheduleWords } from "./storage-sweep-schedule.js";
+import { lastSweep, saveSweep, sweepDetails, sweepWords as storageSweepWords } from "./storage-sweep.js";
 import { removeShared, sharedDepsRoot, sharedUse, unusedShared } from "./shared-deps.js";
 import { cleanLandedBacklog, gitOf, landedBacklog, reconcileLanded, BACKLOG_DAYS } from "./landed-cleanup.js";
+import { RemoteMains } from "./remote-main.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, finishedCheckouts, slimKeptCheckouts, whyWords } from "./checkout-cleanup.js";
 import { closeOutCheckouts, closeOutRuns, stoppedWords } from "./run-closeout.js";
 import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodLabel, periodWords, retentionPlan, sweepWords } from "./retention.js";
@@ -50,6 +52,7 @@ import { readHooksBase, scheduleFromWords } from "./flow-triggers.js";
 import { sendSubagentSummaries } from "./subagent-admin.js";
 import { runRequestedUndos, sendSubagentWeeklies } from "./subagent-week.js";
 import { refreshConnections } from "./mcp-connect.js";
+import { SECRETS_FIRST, startToolSecrets, toolSecretStorage } from "./project-tools.js";
 import { followDiscord } from "./discord.js";
 import { followTeams } from "./teams.js";
 import { followSlack } from "./slack.js";
@@ -182,6 +185,7 @@ import { createInterface } from "node:readline";
 import { propose, approve, addApprover, authenticateAccount, authenticateApprover as passwordApprover, describeScope, approvalOf, hashToken as hashApproverToken, fileAndSealUnderMode, modeFilingCoverage, acceptanceLinesToInput, parseAcceptanceCriteria, splitAcceptanceRubric, rubricIsPlaceholder, isCommitSha } from "./scope.js";
 import { CHAT_APPROVE_ALL, presetTerms, modeTermsJson, modeDigestOf, modeTermsFromJson, modeWords, MODE_MAX_DAYS } from "./modes.js";
 import { WorktreePool } from "./worktree.js";
+import { baseStandingWords, freshBaseFor, taskBaseOf } from "./task-base.js";
 import { requestTaskStop, resumeTaskStop, taskControlOf } from "./task-control.js";
 import { worktreeAdoptionNotice } from "./worktree-notices.js";
 import { workIndexPage, workIndexTask, WorkIndexCursorError } from "./work-index.js";
@@ -812,6 +816,9 @@ async function runOperateLocal(command, argv, write, options = {}) {
     catch (error) {
         return databaseFailure(write, json, command, file, error);
     }
+    // Toolroll's folder for the secrets it holds, beside this database: made before any build can run.
+    if (file !== ":memory:")
+        startToolSecrets(store, file, () => new Date(), { eager: SECRETS_FIRST.has(command) });
     // The lead (a lead token, as --token or TOOLROLL_LEAD_TOKEN) acts for its owner in single commands; its work
     // pings nobody. Anyone else who signs in inside one of these commands is who acted. Services name nobody.
     const presentedFlag = text(flags, "token");
@@ -1052,6 +1059,19 @@ function telegramConversation(context, options = {}) {
         phoneOrigin: () => phoneOrigin(process.env, dirname(context.databaseFile), { serverOrigin: options.serverOrigin ?? null }),
     };
 }
+/** The attempt's history says where it started when that is news: moved to current main, or kept on an older one. */
+function noteBaseStanding(store, runId, standing, main, now) {
+    if (standing == null)
+        return;
+    const commits = (count) => `${count} commit${count === 1 ? "" : "s"}`;
+    if (standing.moved !== null) {
+        store.addRunNote(runId, "Toolroll", `Started from current ${main} (${standing.main.slice(0, 8)}). The branch had no commits or changes of its own and was ${commits(standing.moved.behind)} behind at ${standing.moved.from.slice(0, 8)}.`, now);
+    }
+    else if (standing.kept !== null && standing.behind > 0) {
+        const why = standing.kept === "has commits" ? "it has commits of its own" : standing.kept === "has changes" ? "it has uncommitted changes" : "its checkout is not on the task branch";
+        store.addRunNote(runId, "Toolroll", `Based on an older ${main}: ${standing.head.slice(0, 8)} is ${commits(standing.behind)} behind. It was not moved because ${why}.`, now);
+    }
+}
 /** A revision's verified start: its source build's sealed head, while the revision brief still binds that head and scope. */
 function revisionSourceHead(store, evidenceRoot, taskRef, revisionOf) {
     const source = store.revisionSourceOf(taskRef);
@@ -1924,6 +1944,7 @@ async function mcpCommand(file, flags, write, json) {
     if (!door.ok)
         return said(door.message);
     const store = door.store;
+    startToolSecrets(store, file, () => new Date(), { eager: false });
     for (const suffix of ["", "-wal", "-shm"]) {
         try {
             chmodSync(`${file}${suffix}`, 0o600);
@@ -2728,6 +2749,8 @@ async function tickCommand(flags, context) {
                 // A plan branch from an earlier plan (its checkout removed by storage retention) is reused, as its kept checkout was.
                 reuseBranch: true,
                 reclaim: { evidenceRoot: context.evidenceRoot },
+                // Each plan starts from current main unless it revises earlier work, which keeps that work's head.
+                ...freshBaseFor(store, id, planBranch, base),
             });
             if (!planLeased.ok) {
                 release(store, lease, clock());
@@ -2751,6 +2774,7 @@ async function tickCommand(flags, context) {
                 now: clock(),
                 ...(planStamp === null ? {} : { route: planStamp }),
             });
+            noteBaseStanding(store, planRunId, planLeased.base, base, clock());
             // The source is RECORDED on the attempt before the brief is even
             // composed: the exact bytes the planner reads, sealed as evidence,
             // and the filed scope's digest stamped as what this run was proved
@@ -3054,6 +3078,7 @@ async function tickCommand(flags, context) {
                 continue;
             }
         }
+        // An existing branch with no commits of its own starts from current main (a new one already does).
         const leased = await worktrees.lease({
             repo,
             branch,
@@ -3062,6 +3087,7 @@ async function tickCommand(flags, context) {
             now: clock(),
             ...(exists.code === 0 ? {} : { base: buildBase }),
             reclaim: { evidenceRoot: context.evidenceRoot },
+            ...(exists.code === 0 ? freshBaseFor(store, id, branch, base) : {}),
         });
         if (!leased.ok) {
             // The task is fine; this machine's pool is not. Hand the claim back so
@@ -3122,6 +3148,7 @@ async function tickCommand(flags, context) {
             dispatched.push({ id, outcome: "skipped", reason: "admission-refused", detail: error instanceof Error ? error.message : String(error) });
             continue;
         }
+        noteBaseStanding(store, runId, leased.base, base, clock());
         if (leased.resumedFromRun !== undefined) {
             store.addRunNote(runId, "Toolroll", `Recovered the ${leased.recoveryKind === "completed" ? "completed source draft" : "work-in-progress draft"} from interrupted attempt #${leased.resumedFromRun}. This fresh attempt is reviewing and verifying it; the safety patch is retained.`, clock());
         }
@@ -3448,10 +3475,15 @@ async function reconcileCommand(flags, context) {
     // Landed work (landed-cleanup.ts): finish teardowns a crash cut short, then mark newly landed results complete (a
     // ledger entry says why) and remove their clean checkouts and local build and plan branches.
     let landed = { completed: [], steps: [] };
+    // Completion trusts only the recorded remote's main, fetched by this process into a private folder it removes after.
+    const remotes = new RemoteMains(store, context.gitRunner, context.evidenceRoot);
     try {
-        landed = await reconcileLanded(store, worktrees, gitOf(context.gitRunner), repo, context.evidenceRoot, clock);
+        landed = await reconcileLanded(store, worktrees, gitOf(context.gitRunner), remotes, repo, context.evidenceRoot, clock);
     }
     catch { /* the next pass tries again */ }
+    finally {
+        remotes.close();
+    }
     const landedGone = landed.steps.filter(one => one.outcome === "removed");
     // Checkout cleanup (Settings → Storage): finished work's clean checkouts go as the setting says (by default when
     // the task is complete or cancelled); their branches stay. Each removal is in the ledger.
@@ -3469,15 +3501,19 @@ async function reconcileCommand(flags, context) {
         retention = null; /* the next pass tries again */
     }
     const retained = retention === null ? [] : retention.counts.filter(one => one.count > 0);
-    // The daily storage sweep (storage-sweep.ts): stale test temp folders, orphans Toolroll left running, finished
+    // The storage sweep (storage-sweep.ts): stale test temp folders, orphans Toolroll left running, finished
     // checkouts, extra staged runtimes and dependency installs unused for a week; saved for Settings → Storage.
+    // Only the long-lived service (its watch passes `sweepOwner`) starts one, once due and while nothing is running or
+    // waiting (storage-sweep-schedule.ts). A one-shot reconcile would exit and lose the claimed sweep, so it leaves it.
     // Launch only: report a result here only if it already completed. Later results save independently.
     let storageSwept = null;
-    try {
-        storageSwept = dailyStorageSweep(store, { databaseFile: context.databaseFile, pool: worktrees, tempRoots: context.tempRoots ?? tempRoots(), ...(context.sweepOwner === undefined ? {} : { owner: context.sweepOwner }) }, clock);
-    }
-    catch {
-        storageSwept = null; /* the next pass tries again */
+    if (context.sweepOwner !== undefined) {
+        try {
+            storageSwept = idleStorageSweep(store, { databaseFile: context.databaseFile, pool: worktrees, tempRoots: context.tempRoots ?? tempRoots(), owner: context.sweepOwner }, clock);
+        }
+        catch {
+            storageSwept = null; /* the next pass tries again */
+        }
     }
     const swept = storageSwept === null ? [] : storageSwept.parts.filter(one => one.count > 0);
     const nothing = retained.length === 0 &&
@@ -6023,7 +6059,8 @@ async function runWatchLoop(args) {
     if (!Number.isSafeInteger(reconcileEveryMs) || reconcileEveryMs < 1 || reconcileEveryMs > 2_147_483_647) {
         throw new Error("--reconcile-every must be an integer from 1 to 2147483647 milliseconds");
     }
-    const incarnation = randomUUID();
+    // The owner carries lifetime without changing the lease schema. Bounded watches cannot host automatic sweeps.
+    const incarnation = `${runFor === null ? "toolroll-service:" : ""}${randomUUID()}`;
     const lease = acquireWatchLeaseAuthed(store, { runner, token, repo, owner: incarnation, ttlMs: WATCH_LEASE_MS }, new Date());
     if (!lease.ok) {
         return {
@@ -6158,7 +6195,9 @@ async function runWatchLoop(args) {
         },
         run: async () => {
             const maintenanceLines = [];
-            const maintenanceContext = { ...quietContext, sweepOwner, write: line => maintenanceLines.push(line) };
+            const maintenanceContext = { ...quietContext, ...(runFor === null ? { sweepOwner } : {}), write: line => maintenanceLines.push(line) };
+            if (runFor !== null)
+                delete maintenanceContext.sweepOwner;
             const code = await reconcileCommand(passFlags(), maintenanceContext);
             if (code !== EXIT.ok)
                 throw new Error(maintenanceLines.join(" "));
@@ -7212,6 +7251,9 @@ async function upCommand(flags, context) {
     }
     const loopFlagsFor = (repo) => {
         const copy = new Map();
+        // A bounded `up` must not advertise its child watches as an unbounded sweep service either.
+        if (forGiven !== undefined)
+            copy.set("for", forGiven);
         copy.set("runner", runnerName);
         copy.set("token", runnerToken);
         copy.set("repo", repo);
@@ -8443,7 +8485,8 @@ async function integrationsCommand(positional, flags, context) {
     const counts = { connected: 0, "not-set-up": 0, broken: 0 };
     for (const one of list)
         counts[one.state] += 1;
-    return succeed(context.write, context.json, command, { integrations: list, counts }, () => renderIntegrations(list));
+    const secrets = toolSecretStorage();
+    return succeed(context.write, context.json, command, { integrations: list, counts, secrets: { kind: secrets.kind, words: secrets.words, ...(secrets.problem === undefined ? {} : { problem: secrets.problem }) } }, () => renderIntegrations(list, secrets));
 }
 async function waitTask(positional, flags, context) {
     const command = "task wait";
@@ -9054,6 +9097,7 @@ function showTask(positional, context) {
     const shared = listed === null ? null : { headline: listed.status.label, sentence: listed.status.detail };
     const primaryAction = listed === null ? work?.primaryAction ?? null : listed.primaryAction;
     const steeringLive = store.steeringLiveBuild(ref.id, now) !== null;
+    const base = taskBaseOf(store, id);
     const detail = {
         task,
         work: work === null || listed === null ? work : { ...work, status: { ...work.status, label: listed.status.label, detail: listed.status.detail, tone: listed.status.tone }, primaryAction },
@@ -9069,6 +9113,8 @@ function showTask(positional, context) {
         scope,
         approval: approvalOf(scope),
         route: taskRouteView(routed, readiness),
+        // Fresh base: the commit this task's work starts from, and how far current main has moved past it.
+        base,
         runs: runs.map(one => ({ ...one, route: store.runRoute(one.id) })),
         deliverable: ref.deliverable,
         report: readVerifiedReport(store, context.evidenceRoot, ref.id),
@@ -9125,6 +9171,7 @@ function showTask(positional, context) {
                 ]
                 : [`  report: ${detail.report.problem} (run ${detail.report.run})`]),
         ...pullRequestLines(detail.pullRequest),
+        ...(base === null ? [] : [`  base: ${baseStandingWords(base)}`]),
         ...(detail.blockedBy.length > 0 ? [`  waits for ${detail.blockedBy.join(", ")}`] : []),
         ...(detail.position === null
             ? []
@@ -11165,15 +11212,15 @@ async function storageCommand(positional, flags, context) {
     const sweepFacts = () => {
         const last = lastSweep(store);
         const automatic = last?.source === "automatic" ? last : lastSweep(store, "automatic");
-        return { last, lastAutomatic: automatic, next: nextSweepAt(store) };
+        return { last, lastAutomatic: automatic, schedule: sweepSchedule(store, context.clock()) };
     };
     const sweepLines = (facts) => {
         const when = (at) => new Date(at).toLocaleString("en-US", { month: "short", day: "numeric", hour: "numeric", minute: "2-digit" });
         const one = facts.last;
-        const head = one === null ? (facts.next === null && storageSweepOffNow() ? "Automatic sweep: off." : "Automatic sweep: not run yet; it runs once a day.")
+        const head = one === null ? "Not swept yet."
             : `Last swept ${when(one.at)}${one.source === "manual" ? ` by ${one.actor}` : " automatically"}: ${storageSweepWords(one.parts)}`;
         const auto = one !== null && one.source === "manual" && facts.lastAutomatic !== null ? [`Last automatic sweep ${when(facts.lastAutomatic.at)}: ${storageSweepWords(facts.lastAutomatic.parts)}`] : [];
-        return [head, ...auto, ...(one === null ? [] : sweepDetails(one.parts).slice(0, 8).map(line => `  ${line}`))];
+        return [head, ...auto, `Automatic sweep: ${sweepScheduleWords(facts.schedule, when)}`, ...(one === null ? [] : sweepDetails(one.parts).slice(0, 8).map(line => `  ${line}`))];
     };
     if (action === undefined) {
         const plan = await checkoutPlan(store, pool, context.clock(), { manual: true });
@@ -11289,6 +11336,16 @@ async function storageCommand(positional, flags, context) {
  * checkouts and local branches go; so do Toolroll's own branches no task uses whose work landed. A preview changes
  * nothing; --yes takes an instance operator, records every teardown first, then carries it out. */
 async function landedCommand(yes, operator, refused, pool, context) {
+    // Completion trusts only the recorded remote's main, fetched by this process into a private folder it removes after.
+    const remotes = new RemoteMains(context.store, context.gitRunner, context.evidenceRoot);
+    try {
+        return await landedCommandWith(remotes, yes, operator, refused, pool, context);
+    }
+    finally {
+        remotes.close();
+    }
+}
+async function landedCommandWith(remotes, yes, operator, refused, pool, context) {
     const command = "storage clean --landed";
     const git = gitOf(context.gitRunner);
     const plurals = (count, one, many = `${one}s`) => `${count} ${count === 1 ? one : many}`;
@@ -11300,7 +11357,7 @@ async function landedCommand(yes, operator, refused, pool, context) {
         branches: plan.results.reduce((sum, one) => sum + one.targets.filter(target => target.kind === "branch").length, 0) + plan.branches.length,
     });
     if (!yes) {
-        const plan = await landedBacklog(context.store, git, context.evidenceRoot, context.clock());
+        const plan = await landedBacklog(context.store, git, remotes, context.evidenceRoot, context.clock());
         const n = counts(plan);
         const anything = n.results + plan.branches.length + plan.pending > 0;
         return succeed(context.write, context.json, command, { preview: true, cutoff: plan.cutoff, results: plan.results, branches: plan.branches, kept: plan.kept, pending: plan.pending }, () => [
@@ -11315,8 +11372,8 @@ async function landedCommand(yes, operator, refused, pool, context) {
     const actor = await operator();
     if (actor === null)
         return refused("cleans up landed work");
-    const plan = await landedBacklog(context.store, git, context.evidenceRoot, context.clock());
-    const done = await cleanLandedBacklog(context.store, pool, git, context.evidenceRoot, context.clock, plan, actor);
+    const plan = await landedBacklog(context.store, git, remotes, context.evidenceRoot, context.clock());
+    const done = await cleanLandedBacklog(context.store, pool, git, remotes, context.evidenceRoot, context.clock, plan, actor);
     const gone = done.steps.filter(one => one.outcome === "removed" || one.outcome === "already gone");
     const stays = done.steps.filter(one => one.outcome === "waits" || one.outcome === "kept");
     return succeed(context.write, context.json, command, { completed: done.completed, steps: done.steps, refused: done.refused, kept: plan.kept }, () => [

package/dist/plan-auto.d.ts

@@ -1,4 +1,5 @@
 import type { Store } from "./store.js";
+import { type UnattendedGrant } from "./flow-unattended.js";
 export declare const PLAN_AUTO_SCHEMA = "CREATE TABLE IF NOT EXISTS plan_authorization (\n  task_id TEXT PRIMARY KEY REFERENCES task(id),\n  source_digest TEXT NOT NULL,\n  scope_digest TEXT NOT NULL,\n  mode_digest TEXT NOT NULL,\n  signed_by TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);";
 /** Join the console's authority-free proposal to the authenticated filing
  * road in one transaction. Planning defers the seal until verified ingestion. */
@@ -7,6 +8,16 @@ export declare function applyModeToNewFiling(store: Store, taskId: string, actor
  * code. This authorizes the exact filed contract, not arbitrary future
  * planner text. Rewrites, mode renewal, expiry and revocation fail closed. */
 export declare function authorizePlanUnderMode(store: Store, taskId: string, actor: string, now: Date): boolean;
+/**
+ * A flow card's new filing under its flow's "runs on its own" grant (flow-unattended.ts), inside the engine's filing
+ * transaction, which has just proved the grant covers this card. A plain build that plans is pre-authorized for an
+ * unchanged plan only; anything else is sealed now, under a distinct `grant` basis. False (the filing then waits for a
+ * person, as it always did) when the filed terms aren't the safe, fixed ones the grant was signed for.
+ */
+export declare function sealFlowFilingUnderGrant(store: Store, taskId: string, grant: UnattendedGrant, card: {
+    flow: number;
+    id: number;
+}, now: Date): boolean;
 /** Read-side status only; finalization still proves the authority anew. */
 export declare function planAutoPending(store: Store, taskId: string, now: Date): boolean;
 /** Inside the verified planner finalization transaction, after the source,

package/dist/plan-auto.js

@@ -1,3 +1,4 @@
+import { releaseUnattendedRun, reserveUnattendedRun, unattendedGrantStands } from "./flow-unattended.js";
 import { modeTermsFromJson } from "./modes.js";
 import { plannerContractOf, plannerSourceDigest } from "./planner-source.js";
 import { modeFilingCoverage, propose } from "./scope.js";
@@ -49,13 +50,68 @@ export function authorizePlanUnderMode(store, taskId, actor, now) {
         const scope = source.contract.scope;
         if (scope.proposedVia !== null || scope.acceptance.length === 0 || scope.touches.length === 0 || scope.terms.profileState !== "resolved" || store.scopeSealed(taskId))
             return false;
-        store.raw().prepare(`INSERT INTO plan_authorization(task_id,source_digest,scope_digest,mode_digest,signed_by,created_at) VALUES (?,?,?,?,?,?)
-      ON CONFLICT(task_id) DO UPDATE SET source_digest=excluded.source_digest,scope_digest=excluded.scope_digest,mode_digest=excluded.mode_digest,signed_by=excluded.signed_by,created_at=excluded.created_at`)
+        store.raw().prepare(`INSERT INTO plan_authorization(task_id,source_digest,scope_digest,mode_digest,signed_by,created_at,basis) VALUES (?,?,?,?,?,?,'mode')
+      ON CONFLICT(task_id) DO UPDATE SET source_digest=excluded.source_digest,scope_digest=excluded.scope_digest,mode_digest=excluded.mode_digest,signed_by=excluded.signed_by,created_at=excluded.created_at,basis='mode'`)
             .run(taskId, plannerSourceDigest(source.contract), scope.digest, mode.digest, actor, now.toISOString());
         store.recordAction({ at: now.toISOString(), actor, repo: ref.repo, taskId, runId: null, action: "unchanged plan pre-authorized", outcome: "authorized", source: "work" });
         return true;
     });
 }
+/** A scope whose resolved profile or route runs with full permissions: a flow grant never seals one. */
+function escalatedPosture(store, taskId) {
+    const row = store.raw().prepare("SELECT profile_json, proposed_route_json FROM task_scope WHERE task_id = ?").get(taskId);
+    const text = `${row?.["profile_json"] ?? ""} ${row?.["proposed_route_json"] ?? ""}`;
+    return /"(?:bypassPermissions|danger-full-access|yolo)"/.test(text);
+}
+/**
+ * A flow card's new filing under its flow's "runs on its own" grant (flow-unattended.ts), inside the engine's filing
+ * transaction, which has just proved the grant covers this card. A plain build that plans is pre-authorized for an
+ * unchanged plan only; anything else is sealed now, under a distinct `grant` basis. False (the filing then waits for a
+ * person, as it always did) when the filed terms aren't the safe, fixed ones the grant was signed for.
+ */
+export function sealFlowFilingUnderGrant(store, taskId, grant, card, now) {
+    const ref = store.lookupRef(taskId);
+    const scope = store.getScope(taskId);
+    if (ref === null || scope === null || scope.proposedVia != null || scope.profileState !== "resolved" || escalatedPosture(store, taskId))
+        return false;
+    if (!unattendedGrantStands(store, grant.digest, grant.signedBy, ref.repo, scope.touches, now))
+        return false;
+    // The day's run is taken first, in one capped statement; a filing that then can't be sealed gives it back.
+    if (!reserveUnattendedRun(store, grant, taskId, now))
+        return false;
+    let done = false;
+    if (ref.plan === "requested") {
+        const source = plannerContractOf(store, taskId);
+        if (plainPlan(store, taskId) && source.ok && source.contract.scope !== null && source.contract.revision === null && source.contract.scope.acceptance.length > 0) {
+            store.raw().prepare(`INSERT INTO plan_authorization(task_id,source_digest,scope_digest,mode_digest,signed_by,created_at,basis) VALUES (?,?,?,?,?,?,'grant')
+        ON CONFLICT(task_id) DO UPDATE SET source_digest=excluded.source_digest,scope_digest=excluded.scope_digest,mode_digest=excluded.mode_digest,signed_by=excluded.signed_by,created_at=excluded.created_at,basis='grant'`)
+                .run(taskId, plannerSourceDigest(source.contract), source.contract.scope.digest, grant.digest, grant.signedBy, now.toISOString());
+            done = true;
+        }
+    }
+    else {
+        done = store.sealScopeApproval(taskId, grant.signedBy, now, {}, { kind: "grant", modeDigest: grant.digest });
+    }
+    if (!done) {
+        releaseUnattendedRun(store, grant, taskId);
+        return false;
+    }
+    store.recordAction({ at: now.toISOString(), actor: grant.signedBy, repo: ref.repo, taskId, runId: null, source: "work",
+        action: ref.plan === "requested" ? "flow ran on its own: unchanged plan pre-authorized" : "flow ran on its own: approved", outcome: "authorized", detail: `flow #${card.flow} · card ${card.id}` });
+    return true;
+}
+/** Whether the authority that armed this plan authorization still stands (read side and finalization alike). */
+function armedAuthorityStands(store, row, repo, now) {
+    const by = String(row["signed_by"]), digest = String(row["mode_digest"]);
+    if (row["basis"] === "grant") {
+        const scope = store.getScope(String(row["task_id"]));
+        return unattendedGrantStands(store, digest, by, repo, scope?.touches ?? [], now) ? { basis: "grant", digest } : null;
+    }
+    const mode = store.activeMode(repo, now);
+    const terms = mode === null ? null : modeTermsFromJson(mode.termsJson);
+    return mode !== null && terms?.planAuto === true && terms.autoApproveFiling && mode.digest === digest && mode.signedBy === by && store.accountCanAccess(by, repo)
+        ? { basis: "mode", digest } : null;
+}
 /** Read-side status only; finalization still proves the authority anew. */
 export function planAutoPending(store, taskId, now) {
     const ref = store.lookupRef(taskId);
@@ -64,11 +120,8 @@ export function planAutoPending(store, taskId, now) {
     const row = store.raw().prepare("SELECT * FROM plan_authorization WHERE task_id=?").get(taskId);
     if (row === undefined)
         return false;
-    const mode = store.activeMode(ref.repo, now);
-    const terms = mode === null ? null : modeTermsFromJson(mode.termsJson);
     const source = plannerContractOf(store, taskId);
-    return mode !== null && terms?.planAuto === true && terms.autoApproveFiling && mode.digest === row["mode_digest"] && mode.signedBy === row["signed_by"] &&
-        store.accountCanAccess(mode.signedBy, ref.repo) && source.ok && plannerSourceDigest(source.contract) === row["source_digest"];
+    return armedAuthorityStands(store, row, ref.repo, now) !== null && source.ok && plannerSourceDigest(source.contract) === row["source_digest"];
 }
 /** Inside the verified planner finalization transaction, after the source,
  * artifact, contract changes and lease fence have all been checked. */
@@ -80,13 +133,11 @@ export function sealUnchangedPlanUnderMode(store, taskId, sourceDigest, runId, e
     store.raw().prepare("DELETE FROM plan_authorization WHERE task_id = ?").run(taskId);
     const ref = store.lookupRef(taskId);
     const scope = store.getScope(taskId);
-    const mode = ref?.repo == null ? null : store.activeMode(ref.repo, now);
-    const terms = mode === null ? null : modeTermsFromJson(mode.termsJson);
     const by = String(authorization["signed_by"]);
+    const authority = ref?.repo == null ? null : armedAuthorityStands(store, authorization, ref.repo, now);
     const covered = eligible && plainPlan(store, taskId) && sourceDigest === authorization["source_digest"] && scope?.digest === authorization["scope_digest"] &&
-        mode !== null && mode.digest === authorization["mode_digest"] && mode.signedBy === by &&
-        terms?.planAuto === true && terms.autoApproveFiling && store.accountCanAccess(by, ref?.repo ?? null);
-    const approved = covered && store.sealScopeApproval(taskId, by, now, {}, { kind: "mode", modeDigest: mode.digest });
+        authority !== null && (authority.basis === "mode" || !escalatedPosture(store, taskId));
+    const approved = covered && store.sealScopeApproval(taskId, by, now, {}, { kind: authority.basis, modeDigest: authority.digest });
     store.recordAction({ at: now.toISOString(), actor: by, repo: ref?.repo ?? null, taskId, runId, action: "plan auto-approval", outcome: approved ? "approved" : "needs approval", source: "work" });
     return approved;
 }

package/dist/process-recovery-eligibility.d.ts

@@ -50,7 +50,7 @@ export declare function preparedCandidateObserverGapEligibility(store: Store, in
             digest: string;
             approvedAt: string;
             approvedBy: string;
-            approvalBasis: "chat" | "mode" | "password";
+            approvalBasis: "chat" | "grant" | "mode" | "password";
             modeDigest: string | null;
         };
         readonly command: {

package/dist/project-access.d.ts

@@ -5,6 +5,9 @@ export declare function normalizeProjectAccess(value: unknown): string[] | null;
 /** Corrupt or missing authority never falls back to instance access. */
 export declare function readProjectAccess(value: unknown): ProjectAccess;
 export declare function projectAccessAllows(access: ProjectAccess, repo: string | null): boolean;
+/** SQL: projectAccessAllows for an `approver` row (`alias`) and a project path expression, for the dispatch belts. A
+ * null list reaches every project; an unreadable one reaches none. */
+export declare const accountReachesSql: (alias: string, repo: string) => string;
 /** A server-proved resource, never an unchecked header or submitted path.
  * CLI ceremonies must pass their resource explicitly; global ceremonies
  * without a project refuse project-scoped credentials. */

package/dist/project-access.js

@@ -28,6 +28,9 @@ export function readProjectAccess(value) {
 export function projectAccessAllows(access, repo) {
     return access === null || (repo !== null && access.includes(canonicalProject(repo) ?? resolve(repo)));
 }
+/** SQL: projectAccessAllows for an `approver` row (`alias`) and a project path expression, for the dispatch belts. A
+ * null list reaches every project; an unreadable one reaches none. */
+export const accountReachesSql = (alias, repo) => `(${alias}.projects_json IS NULL OR (json_valid(${alias}.projects_json) AND EXISTS (SELECT 1 FROM json_each(${alias}.projects_json) WHERE json_each.value = ${repo})))`;
 /** A server-proved resource, never an unchecked header or submitted path.
  * CLI ceremonies must pass their resource explicitly; global ceremonies
  * without a project refuse project-scoped credentials. */

package/dist/project-admission.d.ts

@@ -24,11 +24,16 @@ export type AdmissionFailure = {
     reason: "unavailable" | "not-git" | "locked" | "registry" | "abandoned" | "failed";
     message: string;
 };
+/** `remote`: the origin URL this add recorded as the project's trusted remote (null: none), and why one wasn't. */
 export type Admitted = {
     ok: true;
     repo: string;
     name: string;
     added: boolean;
+    remote: {
+        url: string | null;
+        why: string | null;
+    };
 };
 export type Released = {
     ok: true;
@@ -43,12 +48,7 @@ export declare function proveProjectRoot(path: string, exec?: ProjectExec): Prom
     ok: true;
     repo: string;
 } | AdmissionFailure>;
-/**
- * Admit one project. Idempotent: adding a saved project again changes
- * nothing and writes no ledger row. The registry is written first, under
- * its lock; the project row and its ledger row then commit together, so a
- * retry after a failure finishes the job and records it exactly once.
- */
+/** Registry first, then the project and its audit records in one transaction. Re-adds preserve trust. */
 export declare function admitProject(store: Store, input: {
     /** null: a console with no machine registry (a bare `serve`) keeps only the project list. */
     registryFile: string | null;
@@ -56,6 +56,10 @@ export declare function admitProject(store: Store, input: {
     actor: AdmissionActor;
     now: Date;
     exec?: ProjectExec;
+    /** Only the authorized CLI add opts in; console/open/onboarding never discover a remote. */
+    captureOrigin?: boolean;
+    /** Explicit value from the owner/instance-operator CLI boundary. */
+    remoteUrl?: string;
 }): Promise<Admitted | AdmissionFailure>;
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-admission.js

@@ -15,7 +15,12 @@ import { userInfo } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { run } from "./exec.js";
 import { canonicalProject, projectName, sameRepo } from "./project.js";
+import { remoteUrlProblem } from "./remote-main.js";
 import { addRepos, loadProjectRegistry, removeRepos, updateRepos } from "./repos.js";
+const ADMISSION_GIT = {
+    envAllowlist: ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL"],
+    env: { GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1" },
+};
 export const PROJECT_ADDED = "project added";
 export const PROJECT_REMOVED = "project removed";
 /** The checkout root a folder belongs to, canonical; never a shell. */
@@ -26,40 +31,57 @@ export async function proveProjectRoot(path, exec = run) {
     const canonical = canonicalProject(path);
     if (canonical === null)
         return { ok: false, reason: "unavailable", message: `${path} isn't a folder on this computer.` };
-    const top = await exec("git", ["rev-parse", "--show-toplevel"], { cwd: canonical, timeoutMs: 5_000 });
+    const top = await exec("git", ["rev-parse", "--show-toplevel"], { cwd: canonical, timeoutMs: 5_000, ...ADMISSION_GIT });
     const repo = top.code === 0 ? canonicalProject(top.stdout.trim()) : null;
     if (repo === null)
         return { ok: false, reason: "not-git", message: `${path} isn't a Git repository. Run git init there first, or choose a folder inside one.` };
     return { ok: true, repo };
 }
-/**
- * Admit one project. Idempotent: adding a saved project again changes
- * nothing and writes no ledger row. The registry is written first, under
- * its lock; the project row and its ledger row then commit together, so a
- * retry after a failure finishes the job and records it exactly once.
- */
+/** Read only on first CLI admission; never rediscover trust from an existing project's config. */
+async function originOf(repo, exec) {
+    const read = await exec("git", ["config", "--local", "--no-includes", "--get", "remote.origin.url"], { cwd: repo, timeoutMs: 5_000, ...ADMISSION_GIT });
+    const url = read.code === 0 ? read.stdout.trim() : "";
+    if (url === "")
+        return { url: null, why: "it has no origin remote" };
+    const problem = remoteUrlProblem(url);
+    return problem === null ? { url, why: null } : { url: null, why: problem };
+}
+/** Registry first, then the project and its audit records in one transaction. Re-adds preserve trust. */
 export async function admitProject(store, input) {
     const proved = await proveProjectRoot(input.path, input.exec);
     if (!proved.ok)
         return proved;
     const { repo } = proved;
+    if (input.remoteUrl !== undefined && (input.actor.origin === "console" || remoteUrlProblem(input.remoteUrl) !== null)) {
+        return { ok: false, reason: "failed", message: "Only an owner or instance operator can record a network remote with repos add --remote <url>. Use an HTTPS or SSH URL without credentials." };
+    }
+    const before = input.registryFile === null ? null : await loadProjectRegistry(input.registryFile);
+    const known = store.projectAdmissionKnown(repo) || (before !== null && !("error" in before) && before.repos.includes(repo));
+    const discovered = !known && input.captureOrigin === true && input.actor.origin !== "console"
+        ? await originOf(repo, input.exec ?? run) : null;
+    let remote = { url: store.projectRemote(repo), why: null };
     let registryHad = true;
     if (input.registryFile !== null) {
-        const before = await loadProjectRegistry(input.registryFile);
         const enrolled = await updateRepos(input.registryFile, repos => addRepos(repos, [repo]));
         if (!enrolled.ok)
             return { ok: false, reason: enrolled.reason, message: `${projectName(repo)} wasn't added: ${enrolled.message}` };
-        registryHad = !("error" in before) && before.repos.includes(repo);
+        registryHad = before !== null && !("error" in before) && before.repos.includes(repo);
     }
     const added = store.transact(() => {
         const rowHad = store.listProjects().some(one => one.path === repo);
-        store.upsertProject(repo, projectName(repo), input.now);
+        const previous = store.projectRemote(repo);
+        const first = !known && !store.projectAdmissionKnown(repo);
+        remote = input.remoteUrl !== undefined ? { url: input.remoteUrl, why: null }
+            : first && discovered !== null ? discovered : { url: previous, why: previous === null ? "no remote recorded; use repos add --remote <url>" : null };
+        store.upsertProject(repo, projectName(repo), input.now, { remoteUrl: remote.url });
+        if (input.remoteUrl !== undefined)
+            store.recordProjectRemote(input.actor.label, repo, previous, input.remoteUrl, input.now);
         if (rowHad && registryHad)
             return false;
         store.recordAction({ at: input.now.toISOString(), actor: input.actor.label, repo, taskId: null, runId: null, action: PROJECT_ADDED, outcome: "added", source: "access", detail: `from ${input.actor.origin}` });
         return true;
     });
-    return { ok: true, repo, name: projectName(repo), added };
+    return { ok: true, repo, name: projectName(repo), added, remote };
 }
 /**
  * Remove one project from the lists and the builder. Its tasks, results and

package/dist/project-delete-ui.d.ts

@@ -8,6 +8,7 @@ import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
 export type ProjectSettingsView = {
+    remoteUrl?: string | null;
     repo: string;
     name: string;
     holdings: ProjectHoldings;

package/dist/project-delete-ui.js

@@ -57,7 +57,10 @@ const note = (notice) => notice.problem ? html `<p class="problem" role="alert">
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
 export function projectSettingsHtml(view, notice) {
     const held = html `<p>Toolroll holds ${holdingsWords(view.holdings)} for <strong>${view.name}</strong>.</p>`;
-    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${buildsHtml(view)}${accessHtml(view)}`;
+    const remote = html `<section class="build-access recorded-remote" aria-labelledby="recorded-remote-title"><h2 id="recorded-remote-title">Recorded remote</h2>${view.remoteUrl
+        ? html `<p class="path">${view.remoteUrl}</p>`
+        : html `<p>No remote recorded. Landed work waits for your review.</p>`}<details><summary>Change remote</summary><p>An owner or instance operator can run:</p><p class="path">toolroll repos add &lt;project&gt; --remote &lt;url&gt;</p></details></section>`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}`;
     if (!view.canDelete)
         return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0

package/dist/project-delete.d.ts

@@ -1,4 +1,5 @@
-import { type ExecResult } from "./exec.js";
+import type { ExecResult } from "./exec.js";
+import type { Runner } from "./worktree.js";
 import { type Store } from "./store.js";
 /** What Toolroll names the branches it makes: toolroll/…, and standing-orders/… from before the rename. */
 export declare const OWN_BRANCH = "toolroll/";
@@ -52,4 +53,5 @@ export declare function deleteProject(store: Store, repo: string, options: {
     evidenceRoot: string | null;
     poolRoot: string | null;
     git?: GitRunner;
+    runner?: Runner;
 }): Promise<ProjectDeleteResult>;