toolroll 0.9.65 → 0.9.67

package/dist/scope.d.ts

@@ -3,6 +3,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { isAcpProfile, type AcpProviderId } from "./acp-agents.js";
 export { isAcpProfile };
 import { type NetworkProfile } from "./egress.js";
+import { type WritesMode } from "./writes-mode.js";
 import { type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { type AcceptanceCriterion, type AcceptanceProblem, type ScopeTerms } from "./contracts/scope.js";
 import type { Store, Mutation } from "./store.js";
@@ -74,6 +75,9 @@ export type ClaudeProfile = {
     /** What the build may reach (egress.ts), resolved when the scope was written; absent on approvals sealed before
      * network policies, which run narrowed (egress.ts legacyNetwork). */
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 export type CodexShapedProfile = {
     provider: "codex" | "openrouter";
@@ -91,6 +95,9 @@ export type CodexShapedProfile = {
     repairTimeoutSeconds: number;
     repairModel: string;
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 export type GeminiProfile = {
     provider: "gemini";
@@ -110,6 +117,9 @@ export type GeminiProfile = {
     repairTimeoutSeconds: number;
     repairModel: string;
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 /**
  * An agent over the Agent Client Protocol (acp-agents.ts, docs/plans/acp-adapter.md).
@@ -130,6 +140,9 @@ export type AcpProfile = {
     repairIdleTimeoutSeconds: number;
     repairModel: string;
     network?: NetworkProfile;
+    /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
+     * write allowlists, which keep writing anywhere their fence allows. */
+    writes?: WritesMode;
 };
 export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile | AcpProfile;
 /** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */

package/dist/scope.js

@@ -39,6 +39,7 @@ export { isAcpProfile };
  */
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { networkFromValue, networkWords } from "./egress.js";
+import { isWritesMode, writesWords } from "./writes-mode.js";
 import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
@@ -362,9 +363,12 @@ export function profileFromJson(json) {
     const network = p["network"] === undefined ? undefined : networkFromValue(p["network"]);
     if (network === null)
         return null;
-    const withNetwork = network === undefined ? {} : { network };
+    const writes = p["writes"];
+    if (writes !== undefined && !isWritesMode(writes))
+        return null;
+    const withNetwork = { ...(network === undefined ? {} : { network }), ...(writes === undefined ? {} : { writes }) };
     if (p["provider"] === "claude") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network", "writes"]) &&
             str(p["model"]) &&
             (p["permissionArgv"] === "auto" || p["permissionArgv"] === "acceptEdits" || p["permissionArgv"] === "bypassPermissions") &&
             num(p["maxTurns"]) && num(p["repairMaxTurns"]) &&
@@ -386,7 +390,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "codex" || p["provider"] === "openrouter") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network", "writes"]) &&
             str(p["model"]) &&
             (p["sandboxMode"] === "workspace-write" || p["sandboxMode"] === "danger-full-access") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -408,7 +412,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "gemini") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network", "writes"]) &&
             str(p["model"]) &&
             (p["approvalArgv"] === "auto_edit" || p["approvalArgv"] === "yolo") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -430,7 +434,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (typeof p["provider"] === "string" && isAcpProvider(p["provider"])) {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network", "writes"]) &&
             str(p["model"]) &&
             p["permission"] === "full" &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -1278,6 +1282,7 @@ export function describeScope(scope, readiness = NO_READINESS) {
         ...scopeRouteWords(scope, readiness),
         // What the build may reach (egress.ts), part of what the yes agrees to.
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  network      ${networkWords(scope.profile.network ?? null).replace(/^Network: /, "")}`]),
+        ...(scope.profile === null || scope.profile === undefined ? [] : [`  writes       ${writesWords(scope.profile.writes)}`]),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];

package/dist/serve.js

@@ -447,6 +447,7 @@ export function createDecisionServer(options) {
         builds: projectBuildsOf(repo, who),
         access: projectAccessOf(repo),
         network: { setting: store.projectNetwork(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
+        writes: { setting: store.projectWrites(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
         liveView: (() => {
             const commands = liveCommandsShown(store, repo);
             const canChange = who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo);

package/dist/server/chrome.d.ts

@@ -128,7 +128,9 @@ export type Chrome = {
  * at the sink like every page, fetched same-origin — and the nonce'd CSP
  * refuses to execute anything the region could smuggle. Nothing reads on a timer.
  */
-export declare function regionScript(regionId: string, fragmentName: string, path?: string): string;
+export declare function regionScript(regionId: string, fragmentName: string, path?: string, options?: {
+    animate?: boolean;
+}): string;
 /**
  * The live transcript's DEDICATED poller (arc 1 §4): a JSON byte-offset
  * protocol, not an HTML fragment — the response is raw sanitized text and
@@ -297,3 +299,10 @@ export declare function safePrUrl(url: string | null): string | null;
 export declare function shortDigest(digest: string): Html;
 /** One display line, bounded — turn text is data, never layout. */
 export declare function oneLineOf(text: string, cap: number): string;
+/**
+ * The board's clocks tick in the page: each <time data-tick> counts up from
+ * its datetime, measured against the server's own now (the board's data-now)
+ * so a skewed device clock cannot run them backwards. The server-rendered
+ * minutes are the answer without script.
+ */
+export declare function boardTickScript(regionId?: string): string;

package/dist/server/chrome.js

@@ -161,7 +161,7 @@ export const WORKSPACE_STYLE = styleAsset(STYLE + BRAND_MARK_CSS + INBOX_TABS_CS
  * at the sink like every page, fetched same-origin — and the nonce'd CSP
  * refuses to execute anything the region could smuggle. Nothing reads on a timer.
  */
-export function regionScript(regionId, fragmentName, path) {
+export function regionScript(regionId, fragmentName, path, options = {}) {
     // Where the fragment lives: the page's own URL by default; an explicit
     // path when a page embeds another entity's region (the task page embeds
     // the live run's peek, slice 1c — no proxy route exists for it).
@@ -184,7 +184,7 @@ export function regionScript(regionId, fragmentName, path) {
         `function keep(){var data={lanes:[],focus:null,pager:-1,fold:{}};` +
         `region.querySelectorAll("details.lane").forEach(function(d){var k=laneKey(d);if(k)data.fold[k]=d.open;});` +
         `var act=document.activeElement;` +
-        `if(act&&region.contains(act)&&act.matches&&act.matches("a.row, a.lane-card"))data.focus=act.getAttribute("href");` +
+        `if(act&&region.contains(act)&&act.matches&&act.matches("a.row, a.lane-card, a.worker-job")){data.focus=act.getAttribute("href");data.focusKind=act.matches("a.worker-job")?"a.worker-job":"a.row, a.lane-card";}` +
         `var board=region.querySelector(".board");` +
         `if(board&&board.scrollLeft>0){var lanes=board.querySelectorAll(".lane");` +
         `var bc=board.getBoundingClientRect();var mid=bc.left+bc.width/2;var best=-1,bd=1e9;` +
@@ -208,17 +208,41 @@ export function regionScript(regionId, fragmentName, path) {
         `if(board){var lanes=board.querySelectorAll(".lane");var at=Math.min(data.pager,lanes.length-1);` +
         `if(at>=0){var br=board.getBoundingClientRect();var lr=lanes[at].getBoundingClientRect();` +
         `board.scrollLeft=board.scrollLeft+(lr.left+lr.width/2)-(br.left+br.width/2);}}}` +
-        `if(data.focus!==null){var links=region.querySelectorAll("a.row, a.lane-card");` +
+        `if(data.focus!==null){var links=region.querySelectorAll(data.focusKind);` +
         `for(var i=0;i<links.length;i++){if(links[i].getAttribute("href")===data.focus){links[i].focus({preventScroll:true});break;}}}}` +
         `function tell(){if(!stamp||stopped)return;var s=Math.round((Date.now()-last)/1000);` +
         `stamp.textContent=failed?"stale — retrying ("+s+"s old)":"updated "+s+"s ago";}` +
         `setInterval(tell,1000);` +
+        // The animated swap (the live board): a card that changed lane slides there and a new one drops in, through one
+        // same-document view transition keyed by each card's data-vt; a worker whose builds changed flashes once
+        // (data-flash). Never under reduced motion, in a hidden tab, or where the browser lacks view transitions — there
+        // the swap is the plain instant one. Names are set only for the swap and cleared after it.
+        `var animate=${options.animate === true ? "true" : "false"};` +
+        // A name spells the whole key in hex — two tasks can never share one, so a card's identity never jumps to another.
+        `function vtName(v){var n="so-c";for(var i=0;i<v.length;i++){n+=("000"+v.charCodeAt(i).toString(16)).slice(-4);}return n;}` +
+        `function nameAll(){var seen={};region.querySelectorAll("[data-vt]").forEach(function(e){var n=vtName(e.getAttribute("data-vt"));if(seen[n])return;seen[n]=1;e.style.setProperty("view-transition-name",n);});}` +
+        `function flashes(){var m={};region.querySelectorAll("[data-flash]").forEach(function(e){m[e.getAttribute("data-flash")]=e.getAttribute("data-flash-value");});return m;}` +
+        `function apply(t){var before=animate?flashes():{};var kept=keep();region.innerHTML=t;restore(kept);` +
+        `if(animate)region.querySelectorAll("[data-flash]").forEach(function(e){var k=e.getAttribute("data-flash"),v=e.getAttribute("data-flash-value");if(k in before&&before[k]!==v&&v!=="")e.classList.add("flash");});}` +
+        // The swap resolves when its transition has finished, and the next fetch waits for it (refresh holds busy), so
+        // one transition runs at a time; each cleans up only its own (the generation), never a later one's.
+        `var generation=0;` +
+        `function swap(t){var calm=!window.matchMedia||matchMedia("(prefers-reduced-motion: reduce)").matches;` +
+        `if(!animate||calm||document.hidden||typeof document.startViewTransition!=="function"){apply(t);return Promise.resolve();}` +
+        // Bounded: a transition that never settles (or never runs its update) is let go after 1.5 s — the fragment is
+        // applied exactly once either way, so the board can never stop refreshing behind an animation.
+        `var root=document.documentElement;var mine=++generation;var applied=false;var settled=false;nameAll();root.classList.add("so-swap");` +
+        `var once=function(){if(applied)return false;applied=true;apply(t);return true;};` +
+        `var end=function(){if(settled)return;settled=true;once();if(mine!==generation)return;root.classList.remove("so-swap");region.querySelectorAll("[data-vt]").forEach(function(e){e.style.removeProperty("view-transition-name");});};` +
+        `var vt;try{vt=document.startViewTransition(function(){if(once())nameAll();});}catch(e){end();return Promise.resolve();}` +
+        `return new Promise(function(done){var timer=setTimeout(function(){end();done();},1500);` +
+        `var fin=function(){clearTimeout(timer);end();done();};try{Promise.resolve(vt&&vt.finished).then(fin,fin);}catch(e){fin();}});}` +
         `function refresh(){if(stopped)return;if(busy){again=true;return;}busy=true;again=false;` +
         `var q=location.search?location.search+"&fragment="+${JSON.stringify(fragmentName)}:"?fragment="+${JSON.stringify(fragmentName)};` +
         `fetch(${target},{redirect:"manual",cache:"no-store"})` +
         `.then(function(r){if(r.type==="opaqueredirect"||r.status===401||r.status===403){location.href="/login";return null;}` +
         `return r.ok?r.text():null;})` +
-        `.then(function(t){if(t){var kept=keep();region.innerHTML=t;restore(kept);last=Date.now();failed=false;}else{failed=true;}})` +
+        `.then(function(t){if(t){return swap(t).then(function(){last=Date.now();failed=false;});}failed=true;})` +
         `.catch(function(){failed=true;})` +
         // A fragment that marks itself final stops: a finished or abandoned build is not fetched again.
         `.then(function(){busy=false;tell();if(region.querySelector("[data-region-stop]")){stopped=true;if(stamp)stamp.textContent="";return;}if(again)refresh();});}` +
@@ -760,3 +784,20 @@ export function oneLineOf(text, cap) {
     const flat = text.replace(/\s+/g, " ").trim();
     return flat.length <= cap ? flat : `${flat.slice(0, cap - 1)}…`;
 }
+/**
+ * The board's clocks tick in the page: each <time data-tick> counts up from
+ * its datetime, measured against the server's own now (the board's data-now)
+ * so a skewed device clock cannot run them backwards. The server-rendered
+ * minutes are the answer without script.
+ */
+export function boardTickScript(regionId = "board-region") {
+    return (`(function(){var seen=null,offset=0;var region=document.getElementById(${JSON.stringify(regionId)});` +
+        `function fmt(s){if(s<0)s=0;var h=Math.floor(s/3600),m=Math.floor(s%3600/60),x=s%60;return h>0?h+"h "+(m<10?"0":"")+m+"m":m+":"+(x<10?"0":"")+x;}` +
+        `function run(){var scope=region||document;var anchor=scope.querySelector("[data-now]");var v=anchor?anchor.getAttribute("data-now"):null;` +
+        `if(v!==null&&v!==seen){seen=v;var n=Number(v);offset=isFinite(n)?n-Date.now():0;}` +
+        `var now=Date.now()+offset;scope.querySelectorAll("time[data-tick]").forEach(function(t){var at=Date.parse(t.getAttribute("datetime")||"");if(isNaN(at))return;var text=fmt(Math.floor((now-at)/1000));if(t.textContent!==text)t.textContent=text;});}` +
+        // A swapped region brings back the server's minutes, so a swap (the region's children replaced — never a clock's
+        // own text) ticks at once and no clock flickers back to them. Hidden tabs do not tick.
+        `run();setInterval(function(){if(!document.hidden)run();},1000);document.addEventListener("visibilitychange",function(){if(!document.hidden)run();});` +
+        `if(region&&typeof MutationObserver==="function")new MutationObserver(run).observe(region,{childList:true});})();`);
+}

package/dist/server/console.css

@@ -1825,7 +1825,7 @@
      building, then the rest. A header is a 2.75rem tap; a drawn chevron
      says which way it folds. */
   @media (max-width: 760px) {
-    .board { display: flex; flex-direction: column; gap: .5rem; padding-bottom: 0; }
+    .board { display: flex; flex-direction: column; align-items: stretch; gap: .5rem; padding-bottom: 0; }
     .board .lane { min-height: 0; padding: 0 .625rem .125rem; }
     .board .lane > summary {
       cursor: pointer; display: flex; align-items: center; min-height: 2.75rem; margin: 0;
@@ -1864,7 +1864,7 @@
   }
   .lane-attention h2::before { background: var(--brand); opacity: 1; }
   .lane-building h2::before { background: var(--running); opacity: 1; }
-  .lane-done h2::before { background: var(--success); opacity: 1; }
+  .lane-done h2::before { background: var(--muted-foreground); opacity: 1; }
   .lane-card {
     display: block; text-decoration: none; color: inherit;
     background: var(--card); border: 1px solid var(--border);
@@ -1891,6 +1891,37 @@
     font-family: var(--font-mono); font-size: .6875rem; color: var(--running); font-variant-numeric: tabular-nums;
   }
   .lane-card .live-line .clock { color: var(--muted-foreground); }
+  /* The build's steps — set up, writing, checking and committing: three quiet
+     ticks, the current one in the running hue. A stage, never a percent. */
+  .lane-card .steps { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: .1875rem; margin-top: .5rem; }
+  .lane-card .steps i { height: .1875rem; border-radius: 999px; background: var(--border); }
+  .lane-card .steps i.on { background: color-mix(in srgb, var(--running) 45%, var(--border)); }
+  .lane-card .steps i.now { background: var(--running); }
+
+  /* The worker strip: one quiet tile per worker above the lanes — what it is
+     building here, the stage, the clock. Ink and lines only; the running dot
+     is the one hue. */
+  .crew { display: grid; grid-template-columns: repeat(auto-fill, minmax(15rem, 1fr)); gap: .625rem; margin: .25rem 0 .875rem; }
+  .crew-empty { margin: .25rem 0 .875rem; }
+  .worker {
+    border: 1px solid var(--border); border-radius: var(--radius); background: var(--card);
+    padding: .625rem .75rem; min-width: 0; display: flex; flex-direction: column; gap: .375rem;
+  }
+  .worker-busy { border-color: color-mix(in srgb, var(--running) 30%, var(--border)); }
+  .worker-offline { opacity: .6; }
+  .worker-head { display: flex; align-items: center; gap: .5rem; min-width: 0; }
+  .worker-head .name { font-family: var(--font-mono); font-size: .75rem; font-weight: 500; }
+  .worker-head .kind { font-size: .6875rem; color: var(--muted-foreground); white-space: nowrap; overflow: hidden; text-overflow: ellipsis; flex: 1; min-width: 0; }
+  .worker-head .slots { font-family: var(--font-mono); font-size: .6875rem; color: var(--muted-foreground); font-variant-numeric: tabular-nums; }
+  .worker-job { display: flex; flex-direction: column; gap: .0625rem; text-decoration: none; color: inherit; min-width: 0; margin: 0; }
+  .worker-job .t { font-size: .8125rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+  .worker-job .sub { display: flex; justify-content: space-between; gap: .5rem; font-family: var(--font-mono); font-size: .6875rem; color: var(--muted-foreground); font-variant-numeric: tabular-nums; }
+  .worker-job.idle { font-size: .75rem; color: var(--muted-foreground); }
+  @media (hover: hover) and (pointer: fine) { a.worker-job:hover .t { text-decoration: underline; } }
+  @media (max-width: 760px) {
+    .crew { grid-template-columns: minmax(0, 1fr); gap: .375rem; }
+    .worker { padding: .5rem .625rem; }
+  }
   .lane-empty { margin: .75rem 0 .25rem; }
   .plan-doc { white-space: pre-wrap; overflow-wrap: anywhere; font-size: .8125rem; max-height: 24rem; overflow-y: auto; }
   .lane-more { display: block; margin-top: .5rem; font-size: .75rem; }
@@ -2674,8 +2705,10 @@ button { min-height: 44px; }
 @media (hover: hover) and (pointer: fine) { .next-pager .skip:hover { border-color: color-mix(in srgb, var(--border) 60%, var(--muted-foreground)); } }
 
 /* Motion: only where a human caused the change — navigation, presses,
-   overlays. Liveness swaps stay instant; the pulse dot is the one "alive"
-   signal. Everything dies under prefers-reduced-motion; auto-refresh pages
+   overlays — and one exception, the live board: a card that changes lane
+   slides there and a worker that picks up work flashes once (the board's
+   swap, html.so-swap, below). Every other liveness swap stays instant; the
+   pulse dot is the one "alive" signal. Everything dies under prefers-reduced-motion; auto-refresh pages
    opt out of the navigation cross-fade separately (see shell()). */
 @view-transition { navigation: auto; }
 /* A page change fades THROUGH, not across: the old page leaves before the new
@@ -2776,3 +2809,21 @@ button.pick-file { min-height: 1.75rem; padding: 0 .55rem; font-size: .75rem; }
   .meta, .hint { line-height: 1.35; }
   details { margin: var(--so-phone-row) 0; }
 }
+
+/* The live board's swap (regionScript animate): only cards move — the page
+   itself does not fade — a short slide for a card that changed lane, a drop
+   for a new one, a fade for one that left. Transform and opacity only, and
+   the reduce block kills it with everything else (the script also skips the
+   transition under reduced motion). */
+html.so-swap::view-transition-old(root), html.so-swap::view-transition-new(root) { animation: none; }
+html.so-swap::view-transition-group(*) { animation-duration: 320ms; animation-timing-function: cubic-bezier(.2, .8, .2, 1); }
+html.so-swap::view-transition-new(*):only-child { animation: so-card-in 240ms ease-out both; }
+html.so-swap::view-transition-old(*):only-child { animation: so-card-out 160ms ease-in both; }
+@keyframes so-card-in { from { opacity: 0; transform: translateY(-.375rem); } }
+@keyframes so-card-out { to { opacity: 0; } }
+.worker.flash { animation: so-worker-claim 900ms ease-out; }
+@keyframes so-worker-claim { from { background: color-mix(in srgb, var(--running) 14%, var(--card)); } }
+@media (prefers-reduced-motion: reduce) {
+  html.so-swap::view-transition-group(*), html.so-swap::view-transition-new(*), html.so-swap::view-transition-old(*) { animation: none !important; }
+  .worker.flash { animation: none; }
+}

package/dist/server/render-pages.d.ts

@@ -146,14 +146,39 @@ export declare function systemPage(chrome: Chrome, data: {
     }[];
     now: Date;
 }): Screen;
+/**
+ * A build's stage as one of three steps — set up, writing, checking and
+ * committing — read from the machine's own phase, never a percent. The
+ * steps only move forward: evidence and proof checks run both before and
+ * after the commit (builder.ts), so everything after the agent's turn is
+ * one step, and the stage words say which part. Null for runs that are not
+ * builds (planning, review, investigation): those have no honest steps.
+ */
+export declare const BUILD_STEPS: readonly ["setting up", "writing", "checking and committing"];
+export declare function buildStepOf(claim: NonNullable<BoardCard["claim"]>): number | null;
+/**
+ * The workers a board's strip may show: not retired, bound to at least one
+ * project the server's ceiling admits (never a runner serving only projects
+ * this server must not speak about), and — on a one-project board — bound to
+ * that project.
+ */
+export declare function boardWorkers(runners: readonly Runner[], scope: {
+    all: boolean;
+    project: string | null;
+    visible: (repo: string) => boolean;
+}): Runner[];
 /**
  * The board: the pipeline as lanes, position as meaning — attention, then
- * queued, then waiting, then building, then recently done. Read-only by
- * construction (every card is a link, no forms, no nonces), which is what
- * makes it safe to re-render itself while somebody watches.
+ * queued, then waiting, then building, then recently done — under a strip
+ * of the workers doing it. Read-only by construction (every card is a link,
+ * no forms, no nonces), which is what makes it safe to re-render itself
+ * while somebody watches; a card that changes lane slides there
+ * (regionScript's animate swap, keyed by data-vt).
  */
 export declare function boardBody(data: {
     cards: BoardCard[];
+    /** The workers this board's work can go to (retired ones left out). */
+    workers: readonly Runner[];
     done: ReturnType<Store["listCompletedWorkScoped"]>;
     saturated: boolean;
     now: Date;

package/dist/server/render-pages.js

@@ -207,11 +207,74 @@ export function systemPage(chrome, data) {
                     : html `<span class="meta">syncing normally</span>`}</p>`), "\n")}`,
     ], "\n"), { chrome, refreshSeconds: data.building.length > 0 ? 10 : 60 });
 }
+/**
+ * A build's stage as one of three steps — set up, writing, checking and
+ * committing — read from the machine's own phase, never a percent. The
+ * steps only move forward: evidence and proof checks run both before and
+ * after the commit (builder.ts), so everything after the agent's turn is
+ * one step, and the stage words say which part. Null for runs that are not
+ * builds (planning, review, investigation): those have no honest steps.
+ */
+export const BUILD_STEPS = ["setting up", "writing", "checking and committing"];
+export function buildStepOf(claim) {
+    if (claim.role === "planner" || claim.role === "reviewer" || claim.role === "scout")
+        return null;
+    if (claim.model === null)
+        return 0;
+    if (claim.phase === null || claim.phase === "agent-running")
+        return 1;
+    return 2;
+}
+/** A clock that ticks in the page (boardTickScript) from the server's own start time; the text is the no-script answer. */
+function tickingClock(startedIso, now) {
+    const minutes = Math.max(0, Math.round((now.getTime() - new Date(startedIso).getTime()) / 60_000));
+    return html `<time class="clock" datetime="${startedIso}" data-tick>${minutes}m</time>`;
+}
+/**
+ * The workers a board's strip may show: not retired, bound to at least one
+ * project the server's ceiling admits (never a runner serving only projects
+ * this server must not speak about), and — on a one-project board — bound to
+ * that project.
+ */
+export function boardWorkers(runners, scope) {
+    return runners.filter(runner => runner.retiredAt === null &&
+        runner.repos.some(repo => scope.visible(repo)) &&
+        (scope.all || scope.project === null || runner.repos.includes(scope.project)));
+}
+/**
+ * The worker strip across the top of the board: every worker this board's
+ * work can go to, what it is building here, and its stage and clock. Only
+ * builds the board already shows are named — a worker busy in a project
+ * this reader cannot see reads "no build on this board", never "free".
+ */
+function workerStrip(runners, cards, now) {
+    if (runners.length === 0)
+        return html `<p class="meta crew-empty">No workers yet — work waits in the queue until one joins.</p>`;
+    const tiles = runners.map(runner => {
+        const builds = cards
+            .filter(card => card.lane === "building" && card.claim !== null && card.claim.runner === runner.name)
+            .sort((a, b) => a.claim.claimedAt.localeCompare(b.claim.claimedAt));
+        const online = runnerAlive(runner, now);
+        const state = !online ? "offline" : builds.length > 0 ? "busy" : "idle";
+        const dot = state === "busy" ? html `<span class="dot dot-ok pulse"></span>` : html `<span class="dot dot-off"></span>`;
+        const jobs = builds.length > 0
+            ? builds.map(card => {
+                const claim = card.claim;
+                const words = claim.model === null ? "preparing workspace" : claim.phase === null ? "the agent is working" : phaseWords(claim.phase);
+                return html `<a class="worker-job" href="${card.href}"><span class="t">${card.title}</span><span class="sub"><span>${words}</span>${tickingClock(claim.claimedAt, now)}</span></a>`;
+            })
+            : html `<p class="worker-job idle">${online ? "no build on this board" : html `offline since ${whenTime(runner.heartbeatAt)}`}</p>`;
+        return html `<div class="worker worker-${state}" data-flash="${runner.name}" data-flash-value="${builds.map(card => card.taskId).join(" ")}"><div class="worker-head">${dot}<span class="name">${runner.name}</span><span class="kind">${runner.agents.join(" · ")}</span>${runner.capacity > 1 ? html `<span class="slots">${builds.length}/${runner.capacity}</span>` : null}</div>${jobs}</div>`;
+    });
+    return html `<section class="crew" aria-label="Workers">${tiles}</section>`;
+}
 /**
  * The board: the pipeline as lanes, position as meaning — attention, then
- * queued, then waiting, then building, then recently done. Read-only by
- * construction (every card is a link, no forms, no nonces), which is what
- * makes it safe to re-render itself while somebody watches.
+ * queued, then waiting, then building, then recently done — under a strip
+ * of the workers doing it. Read-only by construction (every card is a link,
+ * no forms, no nonces), which is what makes it safe to re-render itself
+ * while somebody watches; a card that changes lane slides there
+ * (regionScript's animate swap, keyed by data-vt).
  */
 export function boardBody(data, ciRed) {
     const chip = (repo) => !data.all || repo === null ? null : html `<span class="badge">${projectName(repo)}</span>`;
@@ -261,7 +324,7 @@ export function boardBody(data, ciRed) {
         const kept = parts.filter((one) => one !== null);
         return kept.length === 0 ? null : html `<span class="chips">${joinHtml(kept, " ")}</span>`;
     };
-    const plain = (card) => html `<a class="lane-card" href="${card.href}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
+    const plain = (card) => html `<a class="lane-card" href="${card.href}" data-vt="${card.taskId}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
         ...(card.stalledSince === null ? [] : [["waiting", age(card.stalledSince)]]),
     ])}${chips([
         chip(card.repo),
@@ -279,7 +342,7 @@ export function boardBody(data, ciRed) {
         }
         return heads;
     })();
-    const queuedCard = (card) => html `<a class="lane-card" href="${card.href}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
+    const queuedCard = (card) => html `<a class="lane-card" href="${card.href}" data-vt="${card.taskId}"><span class="id">${card.taskId}</span><span class="t">${card.title}</span><span class="why">${card.reason}</span>${facts([
         ["worker", card.assignedRunner === null ? "any free worker" : card.assignedRunner],
     ])}${chips([
         queuedHeads.get(`${card.assignedRunner ?? ""}|${card.repo ?? ""}`) === card.taskId
@@ -292,14 +355,19 @@ export function boardBody(data, ciRed) {
         const claim = card.claim;
         if (claim === null)
             return plain(card);
-        const minutes = Math.max(1, Math.round((data.now.getTime() - new Date(claim.claimedAt).getTime()) / 60_000));
         const workspace = claim.worktree === null ? null : (claim.worktree.split("/").pop() ?? claim.worktree);
         // Chip copy: unknown phases show nothing rather than raw tokens.
         const phase = claim.phase === null ? undefined : PHASE_WORDS[claim.phase];
         // The live strip is the run's own phase and clock — never a percent:
         // a build has no honest progress figure, only a stage and an elapsed.
         const live = claim.model === null ? "preparing workspace" : (phase ?? "the agent is working");
-        return html `<a class="lane-card building" href="${card.href}"><span class="id">${card.taskId}</span><span class="t"><span class="dot dot-ok pulse"></span>${card.title}</span><span class="live-line"><span class="stage">${live}</span><span class="clock">${minutes}m</span></span>${facts([
+        // The steps: where the build is among set up → writing → checking →
+        // committing, from its phase — a stage, never a percent.
+        const step = buildStepOf(claim);
+        const steps = step === null
+            ? null
+            : html `<span class="steps" role="img" aria-label="${`step ${step + 1} of ${BUILD_STEPS.length}: ${BUILD_STEPS[step]}`}">${BUILD_STEPS.map((_, index) => html `<i class="${index < step ? "on" : index === step ? "now" : ""}"></i>`)}</span>`;
+        return html `<a class="lane-card building" href="${card.href}" data-vt="${card.taskId}"><span class="id">${card.taskId}</span><span class="t"><span class="dot dot-ok pulse"></span>${card.title}</span>${steps}<span class="live-line"><span class="stage">${live}</span>${tickingClock(claim.claimedAt, data.now)}</span>${facts([
             ["worker", claim.runner],
             ...(claim.model === null
                 ? []
@@ -316,7 +384,7 @@ export function boardBody(data, ciRed) {
             const pr = row.prNumber === null
                 ? null
                 : html `<span class="badge badge-open">PR #${row.prNumber}</span>${ciRed(row.prNumber) ? html ` <span class="badge badge-failed">CI failing</span>` : null}`;
-            return html `<a class="lane-card" href="${taskHref(row.taskId)}"><span class="id">${row.taskId}</span><span class="t">${row.title}</span>${row.handoff === null ? null : html `<span class="why">${row.handoff.length > 120 ? row.handoff.slice(0, 120) + "…" : row.handoff}</span>`}${facts([
+            return html `<a class="lane-card" href="${taskHref(row.taskId)}" data-vt="${row.taskId}"><span class="id">${row.taskId}</span><span class="t">${row.title}</span>${row.handoff === null ? null : html `<span class="why">${row.handoff.length > 120 ? row.handoff.slice(0, 120) + "…" : row.handoff}</span>`}${facts([
                 ...(row.ranMinutes === null ? [] : [["ran", `${row.ranMinutes}m`]]),
                 ["usage", runCostWords({ authMode: row.authMode, costUsd: row.costUsd, tokensIn: null, tokensOut: null })],
             ])}${chips([
@@ -347,7 +415,8 @@ export function boardBody(data, ciRed) {
         data.all ? null : html `<p class="meta board-view"><strong>State</strong> · <a href="/board?view=order">order →</a> <span class="meta">drag to reorder, or to reserve a task for one worker</span></p>`,
         deltaLine,
         toggle,
-        html `<div class="board">`,
+        workerStrip(data.workers, data.cards, data.now),
+        html `<div class="board" data-now="${String(data.now.getTime())}">`,
         lane("attention", "needs you", "these wait for a person", plain),
         lane("queued", "queued", "starts when a worker is free", queuedCard),
         lane("waiting", "waiting", "paused until a time, another task, or a requirement is ready", plain),

package/dist/server/render-tasks.js

@@ -1,5 +1,6 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { networkWords } from "../egress.js";
+import { writesWords } from "../writes-mode.js";
 import { ACP_AGENTS, isAcpProfile } from "../acp-agents.js";
 import { html, htmlString, joinHtml, postForm, replaceMarkup, reauth } from "../html.js";
 import { closedQuestionReason, closedQuestionWords } from "../decision.js";
@@ -541,7 +542,7 @@ export function profileWords(scope) {
                 ? html `<p class="meta">Runs on <span class="mono">${ACP_AGENTS[profile.provider].name} (via ACP) · ${profile.model}</span> — full access inside the OS fence; the agent runs any tool it chooses and nothing asks. No turn limit: stops after ${Math.round(profile.timeoutSeconds / 60)} min, or ${Math.round(profile.idleTimeoutSeconds / 60)} min silent; repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min, or ${Math.round(profile.repairIdleTimeoutSeconds / 60)} min silent.</p>`
                 : html `<p class="meta">Runs on <span class="mono">${profile.provider} · ${profile.model}</span> — ${profile.sandboxMode === "danger-full-access" ? "FULL permissions via --dangerously-bypass-approvals-and-sandbox; nothing asks" : "workspace-write sandbox"}, no turn limit (${Math.round(profile.timeoutSeconds / 60)} min ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}); repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min</p>`;
     // What the build may reach is part of what is approved (egress.ts): said on every approval form.
-    return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p>`;
+    return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p><p class="meta" data-scope-writes>Writes: ${writesWords(profile.writes)}.</p>`;
 }
 export const ROLE_NOUN = { plan: "Planner", build: "Builder", repair: "Repair", review: "Reviewer" };
 export function agentsStandingWords(view) {

package/dist/server/route-table.js

@@ -283,6 +283,7 @@ post("settings", "spend.budget", "/spend/budget", { scope: "step-up", ...operato
 post("settings", "settings.project-concurrency", "/settings/project/concurrency");
 post("settings", "settings.project-live-view", "/settings/project/live-view", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-network", "/settings/project/network", { scope: "step-up", callers: ["cookie"] });
+post("settings", "settings.project-writes", "/settings/project/writes", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-delete", "/settings/project/delete", { scope: "step-up", ...operator("An instance operator deletes projects.", "/settings/project") });
 // Lead sweeps (docs/plans/lead-fan-out.md): the table, and cancelling what isn't ready. The handler shows a sweep only in
 // a project the reader can see, and acts only for an approver.

package/dist/server/settings.js

@@ -80,6 +80,7 @@ import { policyHtml } from "../policy-ui.js";
 import { checkPolicy, parseList, policyParts } from "../policy.js";
 import { parseProjectConcurrency, saveProjectConcurrency } from "../project-concurrency.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
+import { isWritesMode } from "../writes-mode.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { deleteProject, holdingsWords } from "../project-delete.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView } from "../project-knowledge.js";
@@ -2483,6 +2484,7 @@ ${modeWords(terms)
         "settings.project-concurrency": projectConcurrency,
         "settings.project-live-view": projectLiveView,
         "settings.project-network": projectNetwork,
+        "settings.project-writes": projectWrites,
         "settings.project-delete": projectDelete,
         "settings.policy-send": policySave,
         "settings.approval-send": approvalSave,
@@ -2566,5 +2568,24 @@ ${modeWords(terms)
         "edge.google-callback": googleCallback,
         "edge.connect-callback": connectCallback,
     });
+    // Settings → Project → Where builds write (writes-mode.ts). An approver for the project changes it with their password
+    // typed now; the ledger keeps before → after. New scopes use it; approved ones keep theirs.
+    async function projectWrites(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectWrites);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes where its builds may write.", "/settings/project");
+        const back = (key, words) => redirect(response, `/settings/project?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}#writes`);
+        const wanted = body.get("writes");
+        if (!isWritesMode(wanted))
+            return back("problem", "Choose where builds may write. Nothing changed.");
+        if (!authenticateCredential(who, body.get("password") ?? "").ok)
+            return back("problem", "Enter your Toolroll password to change where builds may write.");
+        const changed = store.setProjectWrites(repo, wanted, who.name, now);
+        return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/tasks.js

@@ -61,9 +61,9 @@ import { agentQuestion, answerAgentQuestion, markAgentSeen } from "../agent-boar
 import { WorkIndexCursorError, workIndexPage } from "../work-index.js";
 import { buildProgressOf, parseWorkView } from "../workspace-ui.js";
 import { requestContext } from "./request-context.js";
-import { oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
+import { boardTickScript, oneLineOf, QUEUE_VIEW, refuse, regionScript, screen, transcriptScript, whenTime } from "./chrome.js";
 import { chatReturnWithSaid, matchTaskPath, redirect, respond, reviewHref, safeChatReturn, safeReturn, SAFETY, taskChatHref, taskHref } from "./http.js";
-import { boardBody, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
+import { boardBody, boardWorkers, donePage, inboxFingerprints, inboxPage, newTaskPage, nextPage, parseInboxTab, QUEUE_FRONT, queueBody, queueScript, TASK_STATES, tasksPage, workPage } from "./render-pages.js";
 import { runEfficiencyOf } from "../run-efficiency.js";
 import { ACCEPT_ANYWAY_NEEDS_REASON, editorFileHref, proofBundleView, rankReviewQueue, RESULT_REFUSALS, REVIEW_QUEUE_CAP, reviewCockpitDetailParts, reviewCockpitPage, reviewPriorityOf, runFactsFragment, runOutcomeBadge, runPage, RUNS_PAGE, runsPage, withRefusal } from "./render-results.js";
 import { approvalFormDigest, approveRefusalWords, checkProgressHtml, consentDoorOf, decisionPage, nonceHashOf, PermissionsWouldChange, requirementsFromEditor, resumeDigestOf, taskOf } from "./render-tasks.js";
@@ -399,7 +399,10 @@ export function createTasksHandlers(runtime) {
             });
         });
         const laneCards = [...cards, ...unverifiedCards];
-        const body = boardBody({ cards: laneCards, done: verifiedDone, saturated: snapshot.saturated, now, all, project, delta }, pr => store.ciFailureObserved(pr));
+        // The worker strip: the workers this board's work can go to — bound to
+        // this project, or (rolled up) to any project the ceiling admits.
+        const workers = boardWorkers(store.listRunners(), { all, project, visible });
+        const body = boardBody({ cards: laneCards, workers, done: verifiedDone, saturated: snapshot.saturated, now, all, project, delta }, pr => store.ciFailureObserved(pr));
         if (url.searchParams.get("fragment") === "1") {
             // The live region alone — the in-page swapper's diet. Same auth,
             // same ceiling, no shell, no scripts (finding 2).
@@ -423,7 +426,7 @@ export function createTasksHandlers(runtime) {
         const regionBody = html `<div id="board-region">${body}</div><p class="meta" id="board-region-stamp"></p>`;
         return sendScreen(response, 200, screen("board", regionBody, {
             chrome: chromeFor(project, "board", undefined, all ? "board-all" : undefined),
-            functional: { script: regionScript("board-region", "1"), fetches: true },
+            functional: { script: regionScript("board-region", "1", undefined, { animate: true }) + boardTickScript(), fetches: true },
         }));
     }
     /** A completed (or attempted) row as the review list ranks it: its proof reasons, CI standing, and the assignment