toolroll 0.9.63 → 0.9.65

package/dist/scope.d.ts

@@ -1,5 +1,8 @@
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS, type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { isAcpProfile, type AcpProviderId } from "./acp-agents.js";
+export { isAcpProfile };
+import { type NetworkProfile } from "./egress.js";
 import { type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { type AcceptanceCriterion, type AcceptanceProblem, type ScopeTerms } from "./contracts/scope.js";
 import type { Store, Mutation } from "./store.js";
@@ -42,6 +45,13 @@ export declare const GEMINI_LIMITS: {
     readonly timeoutSeconds: 1200;
     readonly repairTimeoutSeconds: 300;
 };
+/** An ACP agent runs under two clocks at once: the whole attempt, and silence (no line from the agent). */
+export declare const ACP_LIMITS: {
+    readonly timeoutSeconds: 3600;
+    readonly idleTimeoutSeconds: 900;
+    readonly repairTimeoutSeconds: 900;
+    readonly repairIdleTimeoutSeconds: 300;
+};
 export type ClaudeProfile = {
     provider: "claude";
     /** The exact model string the argv carries. Never empty, never "default". */
@@ -61,6 +71,9 @@ export type ClaudeProfile = {
     /** Exact model for repairs, or the stable literal "inherit" (= the
      * build model, which is itself exact). */
     repairModel: string;
+    /** What the build may reach (egress.ts), resolved when the scope was written; absent on approvals sealed before
+     * network policies, which run narrowed (egress.ts legacyNetwork). */
+    network?: NetworkProfile;
 };
 export type CodexShapedProfile = {
     provider: "codex" | "openrouter";
@@ -77,6 +90,7 @@ export type CodexShapedProfile = {
     timeoutKind?: "idle";
     repairTimeoutSeconds: number;
     repairModel: string;
+    network?: NetworkProfile;
 };
 export type GeminiProfile = {
     provider: "gemini";
@@ -95,8 +109,40 @@ export type GeminiProfile = {
     timeoutKind?: "idle";
     repairTimeoutSeconds: number;
     repairModel: string;
+    network?: NetworkProfile;
+};
+/**
+ * An agent over the Agent Client Protocol (acp-agents.ts, docs/plans/acp-adapter.md).
+ * Full access inside the OS fence is the only posture: nothing else could be
+ * made true (an agent may run commands without asking). There is no turn
+ * limit; both clocks bound every attempt, and a repair has its own pair.
+ */
+export type AcpProfile = {
+    provider: AcpProviderId;
+    /** Exact, and one the agent offered when it was checked. */
+    model: string;
+    permission: "full";
+    maxTurns: "unsupported";
+    repairMaxTurns: "unsupported";
+    timeoutSeconds: number;
+    idleTimeoutSeconds: number;
+    repairTimeoutSeconds: number;
+    repairIdleTimeoutSeconds: number;
+    repairModel: string;
+    network?: NetworkProfile;
+};
+export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile | AcpProfile;
+/** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */
+export declare function idleClock(profile: ExecutionProfile): boolean;
+/**
+ * The watchdogs an attempt runs under, from its sealed profile and the overall bound the caller resolved: an ACP
+ * profile gets both clocks at once (the deadline and its silence window — a repair its own pair); the others one,
+ * a no-progress window when the profile says idle, else a deadline.
+ */
+export declare function watchdogsOf(profile: ExecutionProfile, timeoutMs: number, repair?: boolean): {
+    timeoutMs?: number;
+    idleTimeoutMs?: number;
 };
-export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile;
 /** The durable unattended permission choices exposed by the console. The
  * provider-specific argv is still what gets sealed into an approval; this
  * small cross-provider type is only the operator-facing policy. */
@@ -461,6 +507,11 @@ export type ApproveResult = {
     ok: false;
     reason: "policy";
     message: string;
+}
+/** Cockpit B2: a remembered password can't approve these terms (protected, escalated, or a quarantined filing). */
+ | {
+    ok: false;
+    reason: "password-now";
 };
 /**
  * Whether this name-and-token pair is a person the store knows. Shared by
@@ -494,12 +545,114 @@ export declare function authenticateAccount(store: Store, by: string, secret: st
  * approval, chat-action review, the console's own ceremonies). A typed
  * password is always checked, and nothing else stands in.
  */
-export declare const freshIdentitySignIn: AsyncLocalStorage<{
-    actor: string | null;
+/**
+ * PASSWORD FRESHNESS (docs/plans/agents-cockpit.md B2), and the one place an empty password field is ever honoured.
+ *
+ * - An identity-provider re-check made **on request** (a step-up's re-authentication, never an ordinary sign-in) stands
+ *   in for one password typed now, for ONE step-up of any kind, within five minutes: it is consumed by the act it
+ *   proves (`sso-now`). Never reused across acts.
+ * - A password verified on this session, or that explicit re-check, stands in for fifteen minutes — but only inside an
+ *   allowlisted act (`withFreshness`), only for this person, only on a direct local request (`fresh-password`,
+ *   `fresh-sso`). Never extended by use.
+ * Every fact is read at the moment of the act (`FreshFacts` are live readers, not a snapshot), so a sign-out, a session
+ * revoked or rotated, a credential change or Forget made while a request was in flight is seen by it.
+ */
+export type FreshOp = "approve-standard" | "chat-send" | "reply-question";
+/** "session": Passwordless is on and this is the person's own live browser session (docs/plans/passwordless.md). */
+/** "remote-token" / "lead-token": a machine credential stood in for the person (a remote run's API token, a lead's
+ * token) — fine for ordinary acts it is allowed, never for a credential act (it would mint a way in with no password). */
+export type AuthMethod = "password-now" | "sso-now" | "fresh-password" | "fresh-sso" | "session" | "cli-login" | "remote-token" | "lead-token";
+/**
+ * The local CLI's remembered login, marked for the one command that read it (operate.ts credentialsFrom): with
+ * Passwordless on, a proof made with it records "cli-login" — never a typed password — and no credential act accepts it.
+ * Scoped to that command's async chain; a browser request in the console's own process never carries it.
+ */
+export declare const rememberedLogin: AsyncLocalStorage<{
+    login: {
+        name: string;
+        token: string;
+    } | null;
 }>;
-export declare const hasFreshIdentitySignIn: (by: string) => boolean;
-export declare function authenticateApprover(store: Store, by: string, token: string, repo?: string | null): {
+export declare const FRESH_WINDOW_MS: number;
+/** How long an explicit provider re-check stands in for one password typed now. */
+export declare const SSO_NOW_MS: number;
+export type FreshFacts = {
+    actor: string;
+    /** Straight from this computer: a loopback peer naming a loopback host, with no forwarding headers of any kind. */
+    local: boolean;
+    /** The request's route is on the freshness allowlist (route-table.ts `freshness: "allowlist"`): the table decides. */
+    allowlisted: boolean;
+    /** The session is still signed in, under the account's current credential generation, not revoked. */
+    live: () => boolean;
+    /** When a password was last verified on this session; when the provider last re-checked on request (window start);
+     * and an unconsumed re-check for one step-up. */
+    passwordAt: () => number | null;
+    ssoReauthAt: () => number | null;
+    ssoNow: () => number | null;
+    /** Spend the re-check; the answer puts it back (a refund) when the act it proved doesn't happen. */
+    consumeSsoNow: () => () => void;
+    /** Nothing before this counts (Forget). */
+    floor: () => number;
+    /** Record a verified password entry on this session (the console decides whether this request may start one). */
+    stamp: (at: number) => void;
+};
+export declare const freshFacts: AsyncLocalStorage<FreshFacts | null>;
+/**
+ * Run an act a re-check may prove, spending the re-check only if the act happens: when it throws (a rolled-back
+ * transaction) or `failed` says it was refused, every re-check it spent is put back. ONLY for acts whose every effect
+ * is in one database transaction (an approval, a chat approval proposal, a chat turn opening): there, "refused" and
+ * "thrown" prove nothing happened. Every other step-up spends its re-check whatever comes of it (fail-closed: at worst
+ * the person confirms with their provider again). Synchronous acts only.
+ */
+export declare function spendingOnlyOnSuccess<T>(act: () => T, failed: (result: T) => boolean): T;
+/** Run an allowlisted act: within it, a fresh password or re-check may stand in for one typed now. */
+export declare function withFreshness<T>(op: FreshOp, act: () => T): T;
+/** The freshness this act may stand on now, or null: only inside an allowlisted act on an allowlisted route, for this
+ * person, on a direct local request, on a live session, within the window, after any Forget. `preview` asks it from a
+ * page (a GET) about the allowlisted act its form posts to — for words only, never to authorise. */
+export declare function freshnessFor(by: string, now?: number, preview?: boolean): {
+    method: "fresh-password" | "fresh-sso";
+    at: number;
+} | null;
+/** Whether an explicit provider re-check is waiting to stand in for one step-up (the page says "Confirmed with …"). */
+export declare function ssoNowAvailable(by: string, now?: number): boolean;
+/**
+ * Proof that this person is here now, for any account step-up (an approver's or not): a password typed now, or an
+ * explicit provider re-check (consumed). The core of every console step-up; `authenticateApprover` adds standing.
+ */
+export declare function proveAccountNow(store: Store, by: string, token: string, options?: {
+    credential?: boolean;
+}): {
+    ok: true;
+    method: AuthMethod;
+    at: number;
+} | {
+    ok: false;
+    reason: "no-approvers" | "not-an-approver";
+};
+/**
+ * A credential act (docs/plans/passwordless.md, the closed list: one that creates or widens a way in): only a password
+ * typed now, or a one-use identity-provider re-check, proves it — never a session, never a remembered password.
+ */
+/** Whether an empty password would pass for `by` right now because Passwordless is on and this is their live browser
+ * session. Read only — the act itself proves it again inside `proveAccountNow`. */
+export declare function passwordlessSessionFor(store: Store, by: string): boolean;
+/** Whether a proof is one a credential act accepts: a password typed now, or a one-use identity-provider re-check. */
+export declare const credentialProof: (method: AuthMethod) => boolean;
+export declare function proveCredential(store: Store, by: string, token: string, repo?: string | null): {
     ok: true;
+    method: AuthMethod;
+    at: number;
+} | {
+    ok: false;
+    reason: "no-approvers" | "not-an-approver";
+};
+export declare function authenticateApprover(store: Store, by: string, token: string, repo?: string | null, options?: {
+    credential?: boolean;
+}): {
+    ok: true;
+    method: AuthMethod;
+    at: number;
 } | {
     ok: false;
     reason: "no-approvers" | "not-an-approver";
@@ -548,6 +701,18 @@ export declare function fileAndSealUnderMode(store: Store, input: ScopeInput & {
     detail?: string;
 };
 export declare function approve(store: Store, taskId: string, by: string, now: Date, sawDigest: string, token: string, mutation?: Mutation): ApproveResult;
+/** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
+export declare const APPROVAL_PROOF = "approval proved";
+/** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
+export declare const approvalProofDetail: (at: number, generation: number, digest: string) => string;
+/** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
+export declare function approvalProofOf(store: Store, taskId: string, by: string, digest: string): {
+    method: string;
+    at: string;
+} | null;
+/** Whether a remembered password may approve these terms: one approver (no protected work), standard permissions
+ * (never escalated), and not filed by a coordinator, a lead or a scout (those keep their own password ceremony). */
+export declare function freshlyApprovable(store: Store, taskId: string, scope: Scope, singleApprover: boolean): boolean;
 /**
  * Whether this task may be built.
  *

package/dist/scope.js

@@ -1,5 +1,6 @@
 // The rubric's vocabulary loads before anything that reaches the plan contract (see contracts/acceptance-terms.ts).
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
+import { passwordlessOn } from "./passwordless.js";
 import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
 import { contractChangesOf } from "./contract-changes.js";
@@ -8,6 +9,9 @@ import { projectAuthority } from "./project-access.js";
 import { activeRemote } from "./remote-run.js";
 import { claimActor, currentActor } from "./actor.js";
 import { parseLeadToken } from "./api-tokens.js";
+import { isAcpProfile, isAcpProvider } from "./acp-agents.js";
+import { levelOfProfile } from "./policy.js";
+export { isAcpProfile };
 /**
  * What a task is allowed to become, agreed before anything builds it.
  *
@@ -34,6 +38,7 @@ import { parseLeadToken } from "./api-tokens.js";
  * glance is the whole safety property.
  */
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { networkFromValue, networkWords } from "./egress.js";
 import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
@@ -105,6 +110,27 @@ export const GEMINI_LIMITS = {
     timeoutSeconds: 1200,
     repairTimeoutSeconds: 300,
 };
+/** An ACP agent runs under two clocks at once: the whole attempt, and silence (no line from the agent). */
+export const ACP_LIMITS = {
+    timeoutSeconds: 3600,
+    idleTimeoutSeconds: 900,
+    repairTimeoutSeconds: 900,
+    repairIdleTimeoutSeconds: 300,
+};
+/** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */
+export function idleClock(profile) {
+    return !isAcpProfile(profile) && profile.timeoutKind === "idle";
+}
+/**
+ * The watchdogs an attempt runs under, from its sealed profile and the overall bound the caller resolved: an ACP
+ * profile gets both clocks at once (the deadline and its silence window — a repair its own pair); the others one,
+ * a no-progress window when the profile says idle, else a deadline.
+ */
+export function watchdogsOf(profile, timeoutMs, repair = false) {
+    if (isAcpProfile(profile))
+        return { timeoutMs, idleTimeoutMs: (repair ? profile.repairIdleTimeoutSeconds : profile.idleTimeoutSeconds) * 1000 };
+    return profile.timeoutKind === "idle" ? { idleTimeoutMs: timeoutMs } : { timeoutMs };
+}
 export const PROFILE_DIGEST_VERSION = 2;
 /** Deterministic JSON: object keys sorted recursively, arrays in order. */
 function canonicalJson(value) {
@@ -332,8 +358,13 @@ export function profileFromJson(json) {
     const num = (v) => safePositiveInteger(v);
     const clock = (v) => timerSafeSeconds(v);
     const PROVIDER_KEYS = ["provider", "model", "maxTurns", "repairMaxTurns", "timeoutSeconds", "repairTimeoutSeconds", "repairModel"];
+    // The network a scope was written with: present and exact, or absent (an approval from before network policies).
+    const network = p["network"] === undefined ? undefined : networkFromValue(p["network"]);
+    if (network === null)
+        return null;
+    const withNetwork = network === undefined ? {} : { network };
     if (p["provider"] === "claude") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network"]) &&
             str(p["model"]) &&
             (p["permissionArgv"] === "auto" || p["permissionArgv"] === "acceptEdits" || p["permissionArgv"] === "bypassPermissions") &&
             num(p["maxTurns"]) && num(p["repairMaxTurns"]) &&
@@ -349,12 +380,13 @@ export function profileFromJson(json) {
                 ...(p["timeoutKind"] === "idle" ? { timeoutKind: "idle" } : {}),
                 repairTimeoutSeconds: p["repairTimeoutSeconds"],
                 repairModel: p["repairModel"],
+                ...withNetwork,
             };
         }
         return null;
     }
     if (p["provider"] === "codex" || p["provider"] === "openrouter") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network"]) &&
             str(p["model"]) &&
             (p["sandboxMode"] === "workspace-write" || p["sandboxMode"] === "danger-full-access") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -370,12 +402,13 @@ export function profileFromJson(json) {
                 ...(p["timeoutKind"] === "idle" ? { timeoutKind: "idle" } : {}),
                 repairTimeoutSeconds: p["repairTimeoutSeconds"],
                 repairModel: p["repairModel"],
+                ...withNetwork,
             };
         }
         return null;
     }
     if (p["provider"] === "gemini") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network"]) &&
             str(p["model"]) &&
             (p["approvalArgv"] === "auto_edit" || p["approvalArgv"] === "yolo") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -391,6 +424,30 @@ export function profileFromJson(json) {
                 ...(p["timeoutKind"] === "idle" ? { timeoutKind: "idle" } : {}),
                 repairTimeoutSeconds: p["repairTimeoutSeconds"],
                 repairModel: p["repairModel"],
+                ...withNetwork,
+            };
+        }
+        return null;
+    }
+    if (typeof p["provider"] === "string" && isAcpProvider(p["provider"])) {
+        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network"]) &&
+            str(p["model"]) &&
+            p["permission"] === "full" &&
+            p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
+            clock(p["timeoutSeconds"]) && clock(p["idleTimeoutSeconds"]) && clock(p["repairTimeoutSeconds"]) && clock(p["repairIdleTimeoutSeconds"]) &&
+            repairRef(p["repairModel"])) {
+            return {
+                provider: p["provider"],
+                model: p["model"],
+                permission: "full",
+                maxTurns: "unsupported",
+                repairMaxTurns: "unsupported",
+                timeoutSeconds: p["timeoutSeconds"],
+                idleTimeoutSeconds: p["idleTimeoutSeconds"],
+                repairTimeoutSeconds: p["repairTimeoutSeconds"],
+                repairIdleTimeoutSeconds: p["repairIdleTimeoutSeconds"],
+                repairModel: p["repairModel"],
+                ...withNetwork,
             };
         }
         return null;
@@ -678,7 +735,9 @@ password) {
             // 1, finding 1): a viewer's or a revoked person's credential is real
             // and still vouches for nothing — the CLI is a ceremony site like any
             // other, and this was the one road that forgot.
-            const vouching = by === undefined ? { ok: false } : authenticateApprover(store, by.name, by.token);
+            // Creating an approver is a credential act (docs/plans/passwordless.md): a password typed now, never a session or
+            // the CLI's remembered login under Passwordless.
+            const vouching = by === undefined ? { ok: false } : proveCredential(store, by.name, by.token);
             if (!vouching.ok) {
                 return { ok: false, reason: "not-an-approver" };
             }
@@ -754,24 +813,129 @@ export function authenticateAccount(store, by, secret) {
     return { ok: true, role: account.role, generation: account.generation };
 }
 /**
- * v100: someone who signed in with the identity provider moments ago has no
- * password to type again. The console marks such a request with this, for
- * that person only, and an EMPTY password then stands for the fresh sign-in
- * at every step-up that reaches `authenticateApprover` (scope
- * approval, chat-action review, the console's own ceremonies). A typed
- * password is always checked, and nothing else stands in.
+ * The local CLI's remembered login, marked for the one command that read it (operate.ts credentialsFrom): with
+ * Passwordless on, a proof made with it records "cli-login" — never a typed password — and no credential act accepts it.
+ * Scoped to that command's async chain; a browser request in the console's own process never carries it.
+ */
+export const rememberedLogin = new AsyncLocalStorage();
+export const FRESH_WINDOW_MS = 15 * 60_000;
+/** How long an explicit provider re-check stands in for one password typed now. */
+export const SSO_NOW_MS = 5 * 60_000;
+export const freshFacts = new AsyncLocalStorage();
+const refunds = new AsyncLocalStorage();
+/**
+ * Run an act a re-check may prove, spending the re-check only if the act happens: when it throws (a rolled-back
+ * transaction) or `failed` says it was refused, every re-check it spent is put back. ONLY for acts whose every effect
+ * is in one database transaction (an approval, a chat approval proposal, a chat turn opening): there, "refused" and
+ * "thrown" prove nothing happened. Every other step-up spends its re-check whatever comes of it (fail-closed: at worst
+ * the person confirms with their provider again). Synchronous acts only.
+ */
+export function spendingOnlyOnSuccess(act, failed) {
+    const spent = [];
+    let result;
+    try {
+        result = refunds.run(spent, act);
+    }
+    catch (error) {
+        for (const refund of spent)
+            refund();
+        throw error;
+    }
+    if (failed(result))
+        for (const refund of spent)
+            refund();
+    // Succeeded here, but an enclosing act (an outer transaction, the request itself) may still fail: it owns them now.
+    else
+        refunds.getStore()?.push(...spent);
+    return result;
+}
+const freshScope = new AsyncLocalStorage();
+/** Run an allowlisted act: within it, a fresh password or re-check may stand in for one typed now. */
+export function withFreshness(op, act) { return freshScope.run(op, act); }
+const within = (at, floor, spanMs, now) => at !== null && at > 0 && at > floor && at <= now + 60_000 && now - at < spanMs;
+/** The freshness this act may stand on now, or null: only inside an allowlisted act on an allowlisted route, for this
+ * person, on a direct local request, on a live session, within the window, after any Forget. `preview` asks it from a
+ * page (a GET) about the allowlisted act its form posts to — for words only, never to authorise. */
+export function freshnessFor(by, now = Date.now(), preview = false) {
+    const op = freshScope.getStore(), facts = freshFacts.getStore();
+    if (op === undefined || facts == null || facts.actor !== by || !(facts.allowlisted || preview) || !facts.local || !facts.live())
+        return null;
+    const floor = facts.floor(), password = facts.passwordAt(), sso = facts.ssoReauthAt();
+    if (within(password, floor, FRESH_WINDOW_MS, now))
+        return { method: "fresh-password", at: password };
+    if (within(sso, floor, FRESH_WINDOW_MS, now))
+        return { method: "fresh-sso", at: sso };
+    return null;
+}
+/** Whether an explicit provider re-check is waiting to stand in for one step-up (the page says "Confirmed with …"). */
+export function ssoNowAvailable(by, now = Date.now()) {
+    const facts = freshFacts.getStore();
+    return facts != null && facts.actor === by && facts.live() && within(facts.ssoNow(), facts.floor(), SSO_NOW_MS, now);
+}
+/**
+ * Proof that this person is here now, for any account step-up (an approver's or not): a password typed now, or an
+ * explicit provider re-check (consumed). The core of every console step-up; `authenticateApprover` adds standing.
  */
-export const freshIdentitySignIn = new AsyncLocalStorage();
-export const hasFreshIdentitySignIn = (by) => freshIdentitySignIn.getStore()?.actor === by;
-export function authenticateApprover(store, by, token, repo) {
+export function proveAccountNow(store, by, token, options = {}) {
+    const now = Date.now();
+    const facts = freshFacts.getStore();
+    if (facts != null && facts.actor === by && !facts.live())
+        return { ok: false, reason: "not-an-approver" };
     // An empty password is never checked as a password (and never counts toward a lockout).
-    if (token === "")
-        return hasFreshIdentitySignIn(by) ? approverStanding(store, by, repo) : { ok: false, reason: "not-an-approver" };
+    if (token === "") {
+        // Passwordless (read live): the person's own live browser session is the proof. Only a browser request carries facts;
+        // a CLI, a token, a chat bridge or detached work has none, and falls through to the rules below.
+        // A credential act never takes this road, so its own proofs (a one-use provider re-check) are reached and spent.
+        if (options.credential !== true && facts != null && facts.actor === by && facts.live() && passwordlessOn(store))
+            return { ok: true, method: "session", at: now };
+        if (ssoNowAvailable(by, now)) {
+            const at = facts.ssoNow();
+            const refund = facts.consumeSsoNow();
+            refunds.getStore()?.push(refund);
+            return { ok: true, method: "sso-now", at };
+        }
+        const fresh = freshnessFor(by, now);
+        return fresh === null ? { ok: false, reason: "not-an-approver" } : { ok: true, method: fresh.method, at: fresh.at };
+    }
     const account = authenticateAccount(store, by, token);
-    if (!account.ok) {
+    if (!account.ok)
         return { ok: false, reason: account.reason === "no-approvers" ? "no-approvers" : "not-an-approver" };
-    }
-    return approverStanding(store, by, repo);
+    // A machine credential named the person (authenticateAccount takes it as them): say so, never "a password typed now".
+    if (activeRemote() !== null)
+        return { ok: true, method: "remote-token", at: now };
+    if (currentActor()?.lead === true && parseLeadToken(token) !== null)
+        return { ok: true, method: "lead-token", at: now };
+    const remembered = rememberedLogin.getStore()?.login;
+    if (remembered != null && remembered.name === by && remembered.token === token && passwordlessOn(store))
+        return { ok: true, method: "cli-login", at: now };
+    if (facts != null && facts.actor === by)
+        facts.stamp(now);
+    return { ok: true, method: "password-now", at: now };
+}
+/**
+ * A credential act (docs/plans/passwordless.md, the closed list: one that creates or widens a way in): only a password
+ * typed now, or a one-use identity-provider re-check, proves it — never a session, never a remembered password.
+ */
+/** Whether an empty password would pass for `by` right now because Passwordless is on and this is their live browser
+ * session. Read only — the act itself proves it again inside `proveAccountNow`. */
+export function passwordlessSessionFor(store, by) {
+    const facts = freshFacts.getStore();
+    return facts != null && facts.actor === by && facts.live() && passwordlessOn(store);
+}
+/** Whether a proof is one a credential act accepts: a password typed now, or a one-use identity-provider re-check. */
+export const credentialProof = (method) => method === "password-now" || method === "sso-now";
+export function proveCredential(store, by, token, repo) {
+    const proved = authenticateApprover(store, by, token, repo, { credential: true });
+    if (!proved.ok)
+        return proved;
+    return credentialProof(proved.method) ? proved : { ok: false, reason: "not-an-approver" };
+}
+export function authenticateApprover(store, by, token, repo, options = {}) {
+    const proved = proveAccountNow(store, by, token, options);
+    if (!proved.ok)
+        return proved;
+    const standing = approverStanding(store, by, repo);
+    return standing.ok ? proved : standing;
 }
 /**
  * What an approval needs besides the password (v100: an identity-provider
@@ -910,25 +1074,79 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const gate = store.approvalGate(taskId, by, "person");
         if (gate.verdict === "refuse")
             return { ok: false, reason: gate.reason };
+        // A remembered password (cockpit B2) approves only everyday work: one approver, standard permissions, terms a
+        // person filed. Protected work, escalated terms and quarantined filings take a password typed now.
+        if ((authenticated.method === "fresh-password" || authenticated.method === "fresh-sso") && !freshlyApprovable(store, taskId, scope, gate.verdict === "seal" && !gate.protectedWork)) {
+            return { ok: false, reason: "password-now" };
+        }
+        // How the person was proved, beside every yes they give (a vote kept for protected work, or the seal): a password
+        // typed now, a re-check now, or a remembered one — with when, the credential generation and the exact digest.
+        const proved = () => store.recordAction({ at: now.toISOString(), actor: by, repo: store.lookupRef(taskId)?.repo ?? null, taskId, runId: null, action: APPROVAL_PROOF,
+            outcome: authenticated.method, source: "work", detail: approvalProofDetail(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest) });
         if (gate.verdict === "vote") {
+            // The same person again adds nothing: no new vote, no proof row (and the approval roads refund a re-check).
+            if (gate.already)
+                return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: true };
             store.recordApprovalVote(taskId, scope.digest, by, now);
+            proved();
             return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: gate.already };
         }
-        if (gate.protectedWork)
-            store.recordApprovalVote(taskId, scope.digest, by, now);
-        // SEAL, never re-resolve: the approval snapshots the stored working
-        // profile — the exact bytes the digest the approver signed was bound
-        // to. Routing saveScope here would re-run resolution and could sign a
-        // profile nobody saw.
-        const sealed = store.sealScopeApproval(taskId, by, now, mutation);
-        if (!sealed)
-            return { ok: false, reason: "changed" };
-        const approved = store.getScope(taskId);
-        if (approved === null)
-            return { ok: false, reason: "no-scope" };
-        return { ok: true, scope: approved };
+        // The vote, the seal and its proof stand or fall together: a seal that is refused takes this yes back with it
+        // (savepoint rolled back), so a refusal leaves nothing written — the approval roads may then refund a re-check.
+        const refused = {};
+        try {
+            return store.savepoint(() => {
+                if (gate.protectedWork)
+                    store.recordApprovalVote(taskId, scope.digest, by, now);
+                // SEAL, never re-resolve: the approval snapshots the stored working
+                // profile — the exact bytes the digest the approver signed was bound
+                // to. Routing saveScope here would re-run resolution and could sign a
+                // profile nobody saw.
+                const sealed = store.sealScopeApproval(taskId, by, now, mutation);
+                const approved = sealed ? store.getScope(taskId) : null;
+                if (!sealed || approved === null) {
+                    refused.result = { ok: false, reason: sealed ? "no-scope" : "changed" };
+                    throw refused;
+                }
+                proved();
+                return { ok: true, scope: approved };
+            });
+        }
+        catch (error) {
+            if (error === refused && refused.result !== undefined)
+                return refused.result;
+            throw error;
+        }
     });
 }
+/** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
+export const APPROVAL_PROOF = "approval proved";
+/** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
+export const approvalProofDetail = (at, generation, digest) => `${new Date(at).toISOString()} · generation ${generation} · digest ${digest}`;
+/** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
+export function approvalProofOf(store, taskId, by, digest) {
+    const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);
+    for (const row of rows) {
+        const parts = typeof row["detail"] === "string" ? row["detail"].split(" · ") : [];
+        if (parts.length !== 3 || parts[2] !== `digest ${digest}` || Number.isNaN(Date.parse(parts[0])))
+            continue;
+        return { method: String(row["outcome"]), at: parts[0] };
+    }
+    return null;
+}
+/** Whether a remembered password may approve these terms: one approver (no protected work), standard permissions
+ * (never escalated), and not filed by a coordinator, a lead or a scout (those keep their own password ceremony). */
+export function freshlyApprovable(store, taskId, scope, singleApprover) {
+    if (!singleApprover)
+        return false;
+    if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
+        return false;
+    const ref = store.handle.prepare("SELECT coordinator_cid FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
+    if (ref === undefined || ref["coordinator_cid"] != null)
+        return false;
+    const via = store.handle.prepare("SELECT proposed_via FROM task_scope WHERE task_id = ?").get(taskId)?.["proposed_via"];
+    return !(via === "mate" || via === "coordinator" || via === "scout");
+}
 /**
  * Whether this task may be built.
  *
@@ -1058,6 +1276,8 @@ export function describeScope(scope, readiness = NO_READINESS) {
         // The ROUTE, in the words the yes agrees to (v47): posture and every
         // leg with its reason and readiness — before anyone signs.
         ...scopeRouteWords(scope, readiness),
+        // What the build may reach (egress.ts), part of what the yes agrees to.
+        ...(scope.profile === null || scope.profile === undefined ? [] : [`  network      ${networkWords(scope.profile.network ?? null).replace(/^Network: /, "")}`]),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];

package/dist/scout-net.d.ts

@@ -1,5 +1,8 @@
 import { type Socket } from "node:net";
-/** Whether an IP literal is a public internet address. IPv4 inside IPv6 (mapped, compatible or NAT64) is judged as IPv4. */
+/**
+ * Whether an IP literal is a public internet address. IPv4 inside IPv6 (mapped, translated, compatible or NAT64) is
+ * judged as IPv4, read from the address's groups so every way of writing it is caught (an expanded NAT64 form too).
+ */
 export declare function isPublicAddress(address: string): boolean;
 export type Lookup = (host: string) => Promise<readonly string[]>;
 /**