toolroll 0.9.68 → 0.9.69

package/dist/operate.js

@@ -112,6 +112,8 @@ import { claimActor, currentActor, withActor } from "./actor.js";
 import { parseLeadToken } from "./api-tokens.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { CHECK_ACCESS_WARNINGS, checkAccessRunsAs, checkAccessWords, isCheckAccess, signInHostsMissing, signInsUnavailableWords, widerThan } from "./check-access.js";
 import { CLI_PASSWORD_SOURCE, withPasswordSource } from "./sign-in-guard.js";
 import { admissionRecorded, admitProject, commandLineActor } from "./project-admission.js";
 import { leadClaim, leadSay, noteLeadWork } from "./lead-voice.js";
@@ -265,6 +267,9 @@ export const OPERATE_HELP = `toolroll — operating the queue
                                         where the project's builds may write: only their checkout, caches and temp
                                         (workspace, the default), or anywhere outside Toolroll's fenced folders;
                                         an approver changes it (new scopes seal it; approved ones keep theirs)
+  toolroll project check-access --repo <p> [sandboxed|sign-ins|unsandboxed]
+                                        how far the project's checks reach: sandboxed (the default), with model
+                                        and GitHub sign-ins, or not sandboxed; an instance operator widens it
   toolroll config unconfined-agents [allow|refuse]
                                         whether builds run where this machine can't confine them (instance operator)
   toolroll project concurrency [<n>] --repo <p>
@@ -916,6 +921,8 @@ async function dispatchOn(command, positional, flags, repoList, base, options, e
             ...(options.flowTriggerIo === undefined ? {} : { flowTriggerIo: options.flowTriggerIo }),
             ...(options.flowStepIo === undefined ? {} : { flowStepIo: options.flowStepIo }),
             ...(options.flowEveryMs === undefined ? {} : { flowEveryMs: options.flowEveryMs }),
+            ...(options.platform === undefined ? {} : { platform: options.platform }),
+            ...(options.fenceAvailable === undefined ? {} : { fenceAvailable: options.fenceAvailable }),
             ...(options.flowFetch === undefined ? {} : { flowFetch: options.flowFetch }),
             ...(options.integrationIo === undefined ? {} : { integrationIo: options.integrationIo }),
             ...(options.shouldStop === undefined ? {} : { shouldStop: options.shouldStop }),
@@ -1171,6 +1178,8 @@ async function dispatch(command, positional, flags, context) {
                 return projectNetworkCommand(positional, flags, context);
             if (positional[0] === "writes")
                 return projectWritesCommand(positional, flags, context);
+            if (positional[0] === "check-access")
+                return projectCheckAccessCommand(positional, flags, context);
             if (positional[0] === "checks")
                 return projectChecksCommand(positional, flags, context);
             if (positional[0] === "demo")
@@ -11567,3 +11576,67 @@ export function ownValueFlags(command, argv) {
         return PROJECT_NETWORK_VALUE_FLAGS;
     return undefined;
 }
+// Last in the file, so the password tripwire's function positions (password-freshness.test.ts) stay as reviewed.
+/**
+ * `project check-access --repo <p> [sandboxed|sign-ins|unsandboxed]` (check-access.ts): how far the project's setup
+ * and check commands reach beyond the check fence. Widening is an instance operator's act with a password typed now
+ * (never a remembered sign-in or a single sign-on recheck); any approver for the project may narrow it back to
+ * sandboxed. New scopes seal it; approved ones keep theirs. The ledger keeps before → after.
+ */
+async function projectCheckAccessCommand(positional, flags, context) {
+    const command = "project check-access";
+    const allowed = new Set(["repo", "as", "token", "token-file", "token-env", "db", "json"]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(context.write, context.json, command, "usage", `--${name} is not a project check-access option.`, EXIT.usage);
+    const repoFlag = text(flags, "repo");
+    const wanted = positional[1];
+    if (positional.length > 2 || repoFlag === undefined || (wanted !== undefined && !isCheckAccess(wanted)))
+        return fail(context.write, context.json, command, "usage", "Use project check-access --repo <project path> [sandboxed | sign-ins | unsandboxed].", EXIT.usage);
+    const repo = await knownProject(context, repoFlag, { listed: true, canonical: true });
+    if (repo === undefined)
+        return fail(context.write, context.json, command, "not-found", "That isn't a project Toolroll knows.", EXIT.refused);
+    const current = context.store.projectCheckAccess(repo);
+    const platform = context.platform ?? process.platform;
+    // How it actually runs here: with no OS fence and unconfined running allowed, without a sandbox whatever is saved; on
+    // a saved sign-ins level (off for now) runs sandboxed. Said, never hidden.
+    const fenced = context.fenceAvailable?.() ?? (macosFenceAvailable() || linuxFenceAvailable());
+    const runsAs = (one) => checkAccessRunsAs(one, { platform, fenced, unconfinedAllowed: context.store.unfencedAgentsAllowed() });
+    const here = runsAs(current);
+    const words = (one) => {
+        if (runsAs(one) === "unsandboxed" && one !== "unsandboxed")
+            return [`${repo}: saved as ${checkAccessWords(one)}, but this machine can't sandbox checks, so they run without a sandbox.`];
+        if (runsAs(one) !== one)
+            return [`${repo}: saved with model and GitHub sign-ins, but its checks run sandboxed: sign-ins can't be shared with checks safely yet.`];
+        const missing = one === "sign-ins" ? signInHostsMissing(context.store.projectNetwork(repo)) : [];
+        return [`${repo}: checks run ${checkAccessWords(one)}.`, ...(one === "sandboxed" ? [] : [CHECK_ACCESS_WARNINGS[one]]),
+            // Never added for it: the operator widens the network separately, with their own password.
+            ...(missing.length === 0 ? [] : [`Model sign-ins need these hosts in this project's network allowlist: ${missing.join(", ")}. Add them with: toolroll project network --repo ${repo} --allow ${missing.join(",")}`])];
+    };
+    if (wanted === undefined)
+        return succeed(context.write, context.json, command, { repo, checkAccess: current, ...(here === current ? {} : { runsAs: here }), ...(here === "sign-ins" ? { missingHosts: signInHostsMissing(context.store.projectNetwork(repo)) } : {}) }, () => words(current));
+    // Not available yet (check-access.ts signInsAvailable): refused before any password is asked for, nothing written.
+    const unavailable = wanted === "sign-ins" ? signInsUnavailableWords(platform) : null;
+    if (unavailable !== null)
+        return fail(context.write, context.json, command, "refused", unavailable, EXIT.refused);
+    const widening = widerThan(wanted, current);
+    const acting = await askCredentials(flags, context);
+    const proved = acting === null ? null : authenticateApprover(context.store, acting.name, acting.token, repo);
+    if (widening) {
+        // Wider reach exposes the operator's own sign-ins or machine: an instance operator, with a password typed for this.
+        if (acting === null || proved === null || !proved.ok || proved.method !== "password-now" || !context.store.isInstanceOperator(acting.name)) {
+            return fail(context.write, context.json, command, "refused", "An instance operator widens what a project's checks reach, with their password typed now: pass --as and --token.", EXIT.refused);
+        }
+    }
+    else if (acting === null || proved === null || !proved.ok || !credentialProof(proved.method) || !context.store.accountCanAccess(acting.name, repo)) {
+        return fail(context.write, context.json, command, "refused", "An approver for this project narrows what its checks reach, with their password: pass --as and --token.", EXIT.refused);
+    }
+    // The level is compared again inside the write: a change made while the password was asked for can't widen it here.
+    const changed = context.store.setProjectCheckAccess(repo, wanted, acting.name, context.clock(), { may: widening ? "widen" : "narrow" });
+    if (changed === null)
+        return fail(context.write, context.json, command, "refused", "The project's check access changed meanwhile, and this would now widen it: an instance operator widens it, with their password typed now.", EXIT.refused);
+    return succeed(context.write, context.json, command, { repo, before: changed.before, checkAccess: changed.after }, () => [
+        ...words(changed.after),
+        "Scopes written from now on use this; scopes already approved keep what they were approved with.",
+    ]);
+}

package/dist/project-delete-ui.d.ts

@@ -6,6 +6,7 @@
  */
 import type { ProjectNetwork } from "./egress.js";
 import type { WritesMode } from "./writes-mode.js";
+import { type CheckAccess } from "./check-access.js";
 import { type Html } from "./html.js";
 import { type ProjectHoldings } from "./project-delete.js";
 export declare const PROJECT_DELETE_CSS: string;
@@ -50,6 +51,21 @@ export type ProjectSettingsView = {
         setting: WritesMode;
         canChange: boolean;
     };
+    /** How far its checks reach (check-access.ts): the level, who changed it last, and whether this person may narrow it
+     * (an approver for the project) or also widen it (an instance operator). */
+    checkAccess?: {
+        setting: CheckAccess;
+        changed: {
+            by: string;
+            at: string;
+        } | null;
+        canNarrow: boolean;
+        canWiden: boolean;
+        /** This machine can't sandbox checks at all, and an operator allowed them to run anyway: every level runs unsandboxed. */
+        unconfinedHere?: boolean;
+        /** Why sign-ins can't be chosen (off for now), or null: they can. */
+        signInsUnavailable?: string | null;
+    };
 };
 /** The project's page: its path, what Toolroll holds for it, and (for an instance operator) Delete project. */
 export declare function projectSettingsHtml(view: ProjectSettingsView, notice: {

package/dist/project-delete-ui.js

@@ -1,3 +1,4 @@
+import { CHECK_ACCESS_WARNINGS, signInHostsMissing } from "./check-access.js";
 import { html, postForm, reauth } from "./html.js";
 import { holdingsWords } from "./project-delete.js";
 export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:720px;min-width:0}.project-settings .path,.project-delete .path{font-family:var(--font-mono);font-size:.8125rem;overflow-wrap:anywhere;word-break:break-all}` +
@@ -13,6 +14,21 @@ export const PROJECT_DELETE_CSS = `.project-settings,.project-delete{max-width:7
     `.project-settings .build-access .tool-name{font:var(--so-typography-mono)}.project-settings .build-access details{margin:4px 0 0}.project-settings .build-access summary{min-height:44px;display:inline-flex;align-items:center;cursor:pointer;color:var(--so-muted);font:var(--so-typography-label)}` +
     `.project-settings .build-access ul{margin:0 0 4px;padding-left:20px;font:var(--so-typography-body);color:var(--so-ink)}.project-settings .build-access li{margin:2px 0}.project-settings .build-access li .meta{color:var(--so-muted)}` +
     `.project-settings .build-access a.manage-tools{display:inline-flex;align-items:center;justify-content:center;min-height:44px;margin-top:4px;padding:0 14px;white-space:nowrap;background:var(--so-paper);color:var(--so-ink);border:1px solid var(--so-input-line);border-radius:var(--so-radius-md);font:var(--so-typography-label);text-decoration:none}` +
+    // A radio or checkbox choice sits beside its words, at its natural size, not as a full-width grid row.
+    `.project-settings .build-access label.check{display:flex;align-items:center;gap:8px;min-height:44px;font:var(--so-typography-body);font-weight:500}` +
+    `.project-settings .build-access label.check input{width:auto;min-height:0;margin:0;flex:none}.project-settings .build-access form .meta{margin:-8px 0 0 26px}` +
+    // Check access: a warning shows only under the option chosen; the folds draw the console's own chevron (as a diff's).
+    `.project-settings .check-access-setting .option .warning{display:none;color:var(--so-ink)}.project-settings .check-access-setting .option:has(input:checked) .warning{display:block}` +
+    `.project-settings .check-access-setting form{margin-top:0;gap:10px}.project-settings .check-access-setting .option{display:grid;gap:2px}` +
+    `.project-settings .check-access-setting .option .meta{margin:0 0 0 26px}.project-settings .check-access-setting label.check{min-height:36px}` +
+    `.project-settings .check-access-setting details > summary{list-style:none;display:flex;align-items:center;gap:10px;min-height:40px;padding:0}` +
+    `.project-settings .check-access-setting details > summary::-webkit-details-marker{display:none}.project-settings .check-access-setting details > summary::marker{content:""}` +
+    `.project-settings .check-access-setting details > summary::before{content:"";flex:none;width:.35rem;height:.35rem;border-right:1.5px solid var(--so-muted);border-bottom:1.5px solid var(--so-muted);transform:rotate(-45deg);transition:transform .15s ease}` +
+    `.project-settings .check-access-setting details[open] > summary::before{transform:rotate(45deg) translateY(-.1rem)}` +
+    // Show hosts: a quiet fold in the line, not a card.
+    `.project-settings .check-access-setting details.hosts{border:0;background:none;padding:0;margin:0}.project-settings .check-access-setting details.hosts > summary{min-height:32px;font-size:.8125rem}` +
+    `.project-settings .check-access-setting details.hosts .tool-name{margin:0 0 4px;font-size:.75rem}` +
+    `.project-settings .check-access-setting button.primary{background:var(--so-signal);color:var(--so-on-signal);border-color:var(--so-signal)}` +
     `.project-settings .build-access a.manage-tools:hover{background:var(--so-raised)}.project-settings .build-access a.manage-tools:focus-visible,.project-settings .build-access summary:focus-visible{outline:2px solid var(--so-ink);outline-offset:2px}`;
 /** Where builds may write, said plainly; an approver changes it with their password. */
 function writesHtml(view) {
@@ -33,6 +49,49 @@ function writesHtml(view) {
     <button type="submit">Save</button>`, { hidden: { repo: view.repo } });
     return html `<section class="build-access writes-setting" id="writes" aria-labelledby="writes-title"><h2 id="writes-title">Where builds write</h2>${said}<details><summary>Change</summary>${form}</details></section>`;
 }
+/** Check access (check-access.ts): how far the project's checks reach, said once. Collapsed: the level, what it means
+ * when it isn't the default, and who changed it. Inside Change: a line per level, and each wider level's warning under it
+ * only while it is chosen. An instance operator widens it with a password typed now; an approver narrows it. */
+function checkAccessHtml(view) {
+    const access = view.checkAccess;
+    if (access === undefined)
+        return "";
+    const saved = access.setting;
+    // Sign-ins aren't available (off for now): a saved sign-ins level runs sandboxed, and the page says so.
+    const unavailable = access.signInsUnavailable ?? null;
+    const setting = unavailable !== null && saved === "sign-ins" ? "sandboxed" : saved;
+    const network = view.network?.setting ?? null;
+    const names = { sandboxed: "Sandboxed", "sign-ins": "Sandboxed, with model and GitHub sign-ins", unsandboxed: "Not sandboxed" };
+    const meaning = { sandboxed: null, "sign-ins": "Checks can read your Claude, Codex and GitHub sign-ins.", unsandboxed: "Checks run with your full access to this machine and to Toolroll." };
+    // The sign-ins never widen the network: how many hosts they'd still need, and where to add them (a change of its own).
+    const missing = setting === "sign-ins" && network !== null ? signInHostsMissing(network) : [];
+    const hosts = missing.length === 0 ? "" : html `<p class="meta" data-sign-in-hosts>${missing.length} sign-in ${missing.length === 1 ? "host isn't" : "hosts aren't"} allowed yet · <a href="#network">Add them</a></p><details class="hosts"><summary>Show hosts</summary><p class="tool-name">${missing.join(", ")}</p></details>`;
+    const changed = access.changed === null ? "" : html `<p class="meta">Changed by ${access.changed.by}, ${new Date(access.changed.at).toLocaleDateString("en-GB", { day: "numeric", month: "short", timeZone: "UTC" })}</p>`;
+    // Said before anything else: on a machine with no OS sandbox, every level runs without one.
+    const unconfined = access.unconfinedHere === true ? html `<p class="meta warning-line" data-unconfined-here>This machine can't sandbox checks, so they run without a sandbox whatever is chosen here.</p>` : "";
+    const runsSandboxed = setting !== saved && access.unconfinedHere !== true ? html `<p class="meta warning-line" data-sign-ins-unavailable>Saved with model and GitHub sign-ins, but checks run sandboxed: sign-ins can't be shared with checks safely yet.</p>` : "";
+    // No OS sandbox here, and unconfined running allowed: checks run without a sandbox whatever is saved, and that is
+    // what the page says first (never "sandboxed"); the saved level is named under it.
+    const head = access.unconfinedHere === true
+        ? html `<h2 id="check-access-title">Check access</h2><p><strong>${names.unsandboxed}</strong></p>${saved === "unsandboxed" ? "" : html `<p class="meta" data-saved-level>Saved as ${names[saved]}.</p>`}${unconfined}${changed}`
+        : html `<h2 id="check-access-title">Check access</h2><p><strong>${names[setting]}</strong></p>${meaning[setting] === null ? "" : html `<p class="meta">${meaning[setting]}</p>`}${runsSandboxed}${hosts}${changed}`;
+    if (!access.canNarrow && !access.canWiden)
+        return html `<section class="build-access check-access-setting" id="check-access" aria-labelledby="check-access-title">${head}</section>`;
+    const option = (value, detail, warning) => {
+        const allowed = (value === setting || access.canWiden || value === "sandboxed") && !(value === "sign-ins" && unavailable !== null);
+        return html `<div class="option"><label class="check"><input type="radio" name="level" value="${value}"${setting === value ? html ` checked` : ""}${allowed ? "" : html ` disabled`}> ${names[value]}</label><p class="meta">${detail}</p>${warning === null ? "" : html `<p class="meta warning" data-check-access-warning="${value}">${warning}</p>`}</div>`;
+    };
+    const open = network?.mode === "open";
+    const form = postForm("/settings/project/check-access", html `
+    ${option("sandboxed", "Can't read the files your sign-ins and credentials are kept in, Toolroll's folders or other projects.", null)}
+    ${unavailable !== null ? option("sign-ins", unavailable, null) : option("sign-ins", `Also reads the files your Claude, Codex and GitHub sign-ins are kept in, on this project's network (${open ? "any host" : network === null || network.hosts.length === 0 ? "registries only" : `registries and ${network.hosts.length} ${network.hosts.length === 1 ? "host" : "hosts"}`}).`, CHECK_ACCESS_WARNINGS["sign-ins"])}
+    ${option("unsandboxed", "For projects whose checks create sandboxes themselves, such as Toolroll's own.", CHECK_ACCESS_WARNINGS.unsandboxed)}
+    ${open && unavailable === null ? html `<label class="check"><input type="checkbox" name="confirm-open" value="yes"> The network is open: with sign-ins, checks could send them to any host</label>` : ""}
+    ${reauth(html `<label>Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>`)}
+    <button type="submit" class="primary">Save</button>
+    <p class="meta">${access.canWiden ? "" : "Only an instance operator can widen this. "}Flow script steps always run sandboxed. Tasks already approved keep their level.</p>`, { hidden: { repo: view.repo } });
+    return html `<section class="build-access check-access-setting" id="check-access" aria-labelledby="check-access-title">${head}<details class="change"><summary>Change</summary>${form}</details></section>`;
+}
 /** Network: what the project's builds may reach, said plainly; an approver changes it with their password. */
 function networkHtml(view) {
     const network = view.network;
@@ -111,7 +170,7 @@ export function projectSettingsHtml(view, notice) {
     const remote = html `<section class="build-access recorded-remote" aria-labelledby="recorded-remote-title"><h2 id="recorded-remote-title">Recorded remote</h2>${view.remoteUrl
         ? html `<p class="path">${view.remoteUrl}</p>`
         : html `<p>No remote recorded. Landed work waits for your review.</p>`}<details><summary>Change remote</summary><p>An owner or instance operator can run:</p><p class="path">toolroll repos add &lt;project&gt; --remote &lt;url&gt;</p></details></section>`;
-    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}${networkHtml(view)}${writesHtml(view)}${liveViewHtml(view)}`;
+    const head = html `${note(notice)}<p class="path">${view.repo}</p>${held}${remote}${buildsHtml(view)}${accessHtml(view)}${networkHtml(view)}${writesHtml(view)}${checkAccessHtml(view)}${liveViewHtml(view)}`;
     if (!view.canDelete)
         return html `<section class="project-settings">${head}<p class="meta">An instance operator can delete a project.</p></section>`;
     const body = view.running.length > 0

package/dist/result-follow-ups.js

@@ -1,15 +1,4 @@
-/** Follow-ups on any result: "Run checks" and "Add tests".
- *
- * Run checks runs the project's quick or full check on the result's exact
- * commit, in a fresh checkout, after the build has finished. A person (or a
- * pull request opening) asks; the ask is a ledger entry; a worker runs it
- * once and seals its log and a receipt beside the result. A pass upgrades
- * what the result's Checks row says; a failure stays visible. Nothing here
- * rewrites the build's own check or reruns crew work.
- *
- * Add tests files a small task, unapproved like any other filing, to write
- * tests for that change. */
-import { fencedCheckoutCommands } from "./invoke.js";
+import { checkoutRunner, ranAtLine, widestRan } from "./invoke.js";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -188,6 +177,8 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
     const folder = mkdtempSync(join(deps.scratch ?? tmpdir(), "toolroll-checks-"));
     const checkout = join(folder, "checkout");
     const log = [];
+    // How each command actually ran (check-access.ts): the widest is on the receipt and in the log.
+    const ranAt = [];
     const bound = (text) => { const hits = scanForSecrets(text); return boundStreamHeadTail(hits.length > 0 ? redactSecretLines(text, hits) : text, 24 * 1024); };
     const note = (label, command, result) => log.push(`=== ${label} ===\n$ ${command}\n(exit ${result.code}${result.notFound ? ", could not start" : ""}${result.timedOut ? ", timed out" : ""})\n\n--- stdout ---\n${bound(result.stdout)}\n\n--- stderr ---\n${bound(result.stderr)}`);
     let result;
@@ -199,10 +190,11 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
         }
         else {
             const setup = store.liveWorktreeSetup(target.repo);
+            // Worked out again right before each command (check-access.ts): a narrowing meanwhile applies to the next one.
             let ready = true;
             if (setup !== null) {
                 const shell = approvedCommandShell(setup.command);
-                const prepared = await runWithIsolatedDatabase(fencedCheckoutCommands(store, target.repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: setup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                const prepared = await runWithIsolatedDatabase(checkoutRunner(store, target.repo, checkout, runner, [runId], level => ranAt.push(level)), shell.file, shell.args, { cwd: checkout, timeoutMs: setup.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                 note("Approved project setup", setup.command, prepared);
                 if (prepared.code !== 0 || prepared.timedOut || prepared.notFound) {
                     ready = false;
@@ -217,7 +209,7 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
                 }
                 else {
                     const shell = approvedCommandShell(live.command);
-                    const ran = await runWithIsolatedDatabase(fencedCheckoutCommands(store, target.repo, checkout, runner), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
+                    const ran = await runWithIsolatedDatabase(checkoutRunner(store, target.repo, checkout, runner, [runId], level => ranAt.push(level)), shell.file, shell.args, { cwd: checkout, timeoutMs: live.timeoutMs, processGroup: true, envAllowlist: SETUP_ENV_ALLOWLIST, omitEnv: SETUP_ENV_DENYLIST });
                     note(`${CHECK_LEVEL_WORDS[target.level]} check`, live.command, ran);
                     result = ran.timedOut ? { ran: false, failure: "The check ran out of time." } : ran.notFound ? { ran: false, failure: "The check couldn't start." } : { ran: true, exitCode: ran.code };
                 }
@@ -231,10 +223,13 @@ export async function runFollowUpCheck(store, root, request, deps = {}) {
         rmSync(folder, { recursive: true, force: true });
     }
     const at = now();
+    const ranLine = ranAtLine(widestRan(ranAt));
+    if (ranLine !== null)
+        log.push(ranLine);
     const text = log.length === 0 ? "No command started." : log.join("\n\n");
     const logId = storeEvidence(store, root, runId, "structured-output", `follow-up-check-${request}.log`, Buffer.from(text, "utf8"), FOLLOW_UP_LOG, at, { captureStatus: "ok" });
     const logArtifact = store.getArtifact(logId);
-    const receipt = JSON.stringify({ version: 1, request, run: runId, head: target.head, tested: target.head, level: target.level,
+    const receipt = JSON.stringify({ version: 1, request, run: runId, head: target.head, tested: target.head, level: target.level, checkAccess: widestRan(ranAt),
         command: { repo: target.command.repo, command: target.command.command, digest: target.command.digest, approvedBy: target.command.approvedBy },
         result, log: { artifactId: logArtifact.id, sha256: logArtifact.sha256, bytesStored: logArtifact.bytesStored, truncated: logArtifact.truncated } }, null, 1);
     storeEvidence(store, root, runId, "structured-output", `follow-up-check-${request}.json`, Buffer.from(receipt, "utf8"), FOLLOW_UP_RECEIPT, at, { captureStatus: "ok" });

package/dist/scope.d.ts

@@ -4,6 +4,7 @@ import { isAcpProfile, type AcpProviderId } from "./acp-agents.js";
 export { isAcpProfile };
 import { type NetworkProfile } from "./egress.js";
 import { type WritesMode } from "./writes-mode.js";
+import { type CheckAccess } from "./check-access.js";
 import { type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { type AcceptanceCriterion, type AcceptanceProblem, type ScopeTerms } from "./contracts/scope.js";
 import type { Store, Mutation } from "./store.js";
@@ -78,6 +79,8 @@ export type ClaudeProfile = {
     /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
      * write allowlists, which keep writing anywhere their fence allows. */
     writes?: WritesMode;
+    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
+    checkAccess?: Exclude<CheckAccess, "sandboxed">;
 };
 export type CodexShapedProfile = {
     provider: "codex" | "openrouter";
@@ -98,6 +101,8 @@ export type CodexShapedProfile = {
     /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
      * write allowlists, which keep writing anywhere their fence allows. */
     writes?: WritesMode;
+    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
+    checkAccess?: Exclude<CheckAccess, "sandboxed">;
 };
 export type GeminiProfile = {
     provider: "gemini";
@@ -120,6 +125,8 @@ export type GeminiProfile = {
     /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
      * write allowlists, which keep writing anywhere their fence allows. */
     writes?: WritesMode;
+    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
+    checkAccess?: Exclude<CheckAccess, "sandboxed">;
 };
 /**
  * An agent over the Agent Client Protocol (acp-agents.ts, docs/plans/acp-adapter.md).
@@ -143,6 +150,8 @@ export type AcpProfile = {
     /** Where the build may write (writes-mode.ts), resolved when the scope was written; absent on approvals sealed before
      * write allowlists, which keep writing anywhere their fence allows. */
     writes?: WritesMode;
+    /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
+    checkAccess?: Exclude<CheckAccess, "sandboxed">;
 };
 export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile | AcpProfile;
 /** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */

package/dist/scope.js

@@ -41,6 +41,7 @@ export { isAcpProfile };
 import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { networkFromValue, networkWords } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
+import { checkAccessWords, isCheckAccess } from "./check-access.js";
 import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
@@ -354,9 +355,14 @@ export function profileFromJson(json) {
     const writes = p["writes"];
     if (writes !== undefined && !isWritesMode(writes))
         return null;
-    const withNetwork = { ...(network === undefined ? {} : { network }), ...(writes === undefined ? {} : { writes }) };
+    // Check access is sealed only when wider than sandboxed: an explicit "sandboxed", or any other word, is not this code's.
+    const sealedAccess = p["checkAccess"];
+    if (sealedAccess !== undefined && (sealedAccess === "sandboxed" || !isCheckAccess(sealedAccess)))
+        return null;
+    const checkAccess = sealedAccess;
+    const withNetwork = { ...(network === undefined ? {} : { network }), ...(writes === undefined ? {} : { writes }), ...(checkAccess === undefined ? {} : { checkAccess }) };
     if (p["provider"] === "claude") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network", "writes"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network", "writes", "checkAccess"]) &&
             str(p["model"]) &&
             (p["permissionArgv"] === "auto" || p["permissionArgv"] === "acceptEdits" || p["permissionArgv"] === "bypassPermissions") &&
             num(p["maxTurns"]) && num(p["repairMaxTurns"]) &&
@@ -378,7 +384,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "codex" || p["provider"] === "openrouter") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network", "writes"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network", "writes", "checkAccess"]) &&
             str(p["model"]) &&
             (p["sandboxMode"] === "workspace-write" || p["sandboxMode"] === "danger-full-access") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -400,7 +406,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "gemini") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network", "writes"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network", "writes", "checkAccess"]) &&
             str(p["model"]) &&
             (p["approvalArgv"] === "auto_edit" || p["approvalArgv"] === "yolo") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -422,7 +428,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (typeof p["provider"] === "string" && isAcpProvider(p["provider"])) {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network", "writes"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network", "writes", "checkAccess"]) &&
             str(p["model"]) &&
             p["permission"] === "full" &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -1271,6 +1277,7 @@ export function describeScope(scope, readiness = NO_READINESS) {
         // What the build may reach (egress.ts), part of what the yes agrees to.
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  network      ${networkWords(scope.profile.network ?? null).replace(/^Network: /, "")}`]),
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  writes       ${writesWords(scope.profile.writes)}`]),
+        ...(scope.profile?.checkAccess === undefined ? [] : [`  checks       ${checkAccessWords(scope.profile.checkAccess)}`]),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];

package/dist/serve.js

@@ -1,4 +1,6 @@
 import { taskMovedSince } from "./chat-ask.js";
+import { linuxFenceAvailable, macosFenceAvailable } from "./agent-fence.js";
+import { signInsUnavailableWords } from "./check-access.js";
 import { LIVE_VIEW_CONSENT, liveCommandsShown, liveViewConsentDigest } from "./live-detail.js";
 import { html, htmlString, jsonScript, textHtml } from "./html.js";
 import { browserAssetsAvailable, browserWorkspaceDocument } from './browser-shell.js';
@@ -448,6 +450,13 @@ export function createDecisionServer(options) {
         access: projectAccessOf(repo),
         network: { setting: store.projectNetwork(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
         writes: { setting: store.projectWrites(repo), canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo) },
+        checkAccess: {
+            setting: store.projectCheckAccess(repo), changed: store.projectCheckAccessChange(repo),
+            canNarrow: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo),
+            canWiden: who.via === "cookie" && !store.isDemo() && store.isInstanceOperator(who.name),
+            unconfinedHere: !(options.fenceAvailable?.() ?? (macosFenceAvailable() || linuxFenceAvailable())) && store.unfencedAgentsAllowed(),
+            signInsUnavailable: signInsUnavailableWords(options.platform ?? process.platform),
+        },
         liveView: (() => {
             const commands = liveCommandsShown(store, repo);
             const canChange = who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, repo);

package/dist/server/http.d.ts

@@ -62,6 +62,8 @@ export type ServeOptions = {
     leadByDefault?: boolean;
     /** Test seam: the operating system the sign-in command is written for. */
     platform?: NodeJS.Platform;
+    /** Test seam: whether this machine has an OS fence (macOS sandbox or bubblewrap) for checks. */
+    fenceAvailable?: () => boolean;
     /** Extra Host values this server answers as (a Tailscale name, a LAN ip:port). */
     allowedHosts?: readonly string[];
     /**

package/dist/server/render-results.d.ts

@@ -1,4 +1,5 @@
 /** Results and runs: the review cockpit, evidence, receipts, diffs and the result panel. */
+import type { CheckAccess } from "../check-access.js";
 import type { RunNetworkRecord } from "../egress.js";
 import { type AssignmentSnapshot } from "../assignment.js";
 import { type BrowserCheckItem, type BrowserNeedAction, type BrowserResultPanel, type BrowserResultView } from "../browser-workspace.js";
@@ -184,6 +185,8 @@ export type ReviewCockpitView = {
     efficiency?: RunEfficiency | null;
     /** What the run's network was and what its proxy saw (egress.ts): display only. */
     network?: RunNetworkRecord | null;
+    /** How far its checks reached (check-access.ts): shown only when wider than sandboxed. */
+    checkAccess?: CheckAccess;
     taskId: string;
     title: string;
     repo: string | null;

package/dist/server/render-results.js

@@ -629,6 +629,7 @@ export function reviewCockpitDetailParts(view, csrf, noted, canRetryReview, tab,
         record: run === null ? null : { build: run.id, href: `/r/${run.id}?record=1`, facts: [
                 { label: "Agent", value: [run.provider, run.model].filter(Boolean).join(" · ") },
                 { label: "Worker", value: run.runner },
+                ...(view.checkAccess === undefined || view.checkAccess === "sandboxed" ? [] : [{ label: "Checks", value: view.checkAccess === "unsandboxed" ? "Checks ran without a sandbox" : "Checks ran with model and GitHub sign-ins" }]),
                 ...(run.branch === null ? [] : [{ label: "Branch", value: run.branch }]),
                 ...(run.finishedAt === null ? [] : [{ label: "Finished", value: when(run.finishedAt) }]),
                 ...(run.ranMinutes === null ? [] : [{ label: "Ran", value: `${run.ranMinutes} min` }]),

package/dist/server/render-tasks.js

@@ -1,6 +1,7 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { networkWords } from "../egress.js";
 import { writesWords } from "../writes-mode.js";
+import { checkAccessWords } from "../check-access.js";
 import { ACP_AGENTS, isAcpProfile } from "../acp-agents.js";
 import { html, htmlString, joinHtml, postForm, replaceMarkup, reauth } from "../html.js";
 import { closedQuestionReason, closedQuestionWords } from "../decision.js";
@@ -541,7 +542,7 @@ export function profileWords(scope) {
                 ? html `<p class="meta">Runs on <span class="mono">${ACP_AGENTS[profile.provider].name} (via ACP) · ${profile.model}</span> — full access inside the OS fence; the agent runs any tool it chooses and nothing asks. No turn limit: stops after ${Math.round(profile.timeoutSeconds / 60)} min, or ${Math.round(profile.idleTimeoutSeconds / 60)} min silent; repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min, or ${Math.round(profile.repairIdleTimeoutSeconds / 60)} min silent.</p>`
                 : html `<p class="meta">Runs on <span class="mono">${profile.provider} · ${profile.model}</span> — ${profile.sandboxMode === "danger-full-access" ? "FULL permissions via --dangerously-bypass-approvals-and-sandbox; nothing asks" : "workspace-write sandbox"}, no turn limit (${Math.round(profile.timeoutSeconds / 60)} min ${profile.timeoutKind === "idle" ? "without progress" : "per attempt"}); repairs on ${repair}, ${Math.round(profile.repairTimeoutSeconds / 60)} min</p>`;
     // What the build may reach is part of what is approved (egress.ts): said on every approval form.
-    return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p><p class="meta" data-scope-writes>Writes: ${writesWords(profile.writes)}.</p>`;
+    return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p><p class="meta" data-scope-writes>Writes: ${writesWords(profile.writes)}.</p>${profile.checkAccess === undefined ? "" : html `<p class="meta" data-scope-checks>Checks: ${checkAccessWords(profile.checkAccess)}.</p>`}`;
 }
 export const ROLE_NOUN = { plan: "Planner", build: "Builder", repair: "Repair", review: "Reviewer" };
 export function agentsStandingWords(view) {

package/dist/server/route-table.js

@@ -284,6 +284,7 @@ post("settings", "settings.project-concurrency", "/settings/project/concurrency"
 post("settings", "settings.project-live-view", "/settings/project/live-view", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-network", "/settings/project/network", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-writes", "/settings/project/writes", { scope: "step-up", callers: ["cookie"] });
+post("settings", "settings.project-check-access", "/settings/project/check-access", { scope: "step-up", callers: ["cookie"] });
 post("settings", "settings.project-delete", "/settings/project/delete", { scope: "step-up", ...operator("An instance operator deletes projects.", "/settings/project") });
 // Lead sweeps (docs/plans/lead-fan-out.md): the table, and cancelling what isn't ready. The handler shows a sweep only in
 // a project the reader can see, and acts only for an approver.

package/dist/server/settings.js

@@ -81,6 +81,7 @@ import { checkPolicy, parseList, policyParts } from "../policy.js";
 import { parseProjectConcurrency, saveProjectConcurrency } from "../project-concurrency.js";
 import { MAX_NETWORK_HOSTS, normalizeHost } from "../egress.js";
 import { isWritesMode } from "../writes-mode.js";
+import { isCheckAccess, signInsUnavailableWords, widerThan } from "../check-access.js";
 import { projectDeleteConfirmHtml, projectSettingsHtml } from "../project-delete-ui.js";
 import { deleteProject, holdingsWords } from "../project-delete.js";
 import { applySavedKnowledge, changeKnowledge, knowledgeVersion, knowledgeView } from "../project-knowledge.js";
@@ -2485,6 +2486,7 @@ ${modeWords(terms)
         "settings.project-live-view": projectLiveView,
         "settings.project-network": projectNetwork,
         "settings.project-writes": projectWrites,
+        "settings.project-check-access": projectCheckAccess,
         "settings.project-delete": projectDelete,
         "settings.policy-send": policySave,
         "settings.approval-send": approvalSave,
@@ -2587,5 +2589,40 @@ ${modeWords(terms)
         const changed = store.setProjectWrites(repo, wanted, who.name, now);
         return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
+    // Settings → Project → Check access (check-access.ts). Widening is an instance operator's act with a password typed now
+    // (an identity-provider re-check doesn't count); any approver for the project narrows it. The level is compared again
+    // inside the write, so a change made meanwhile can't turn a narrowing into a widening. The ledger keeps before → after.
+    async function projectCheckAccess(ctx) {
+        const { who, response, now, posted } = ctx;
+        const body = readForm(posted, CONSOLE_FORMS.projectCheckAccess);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/project");
+        if (who.via !== "cookie" || who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return refuse(response, who, 403, "An approver for this project changes how far its checks reach.", "/settings/project");
+        const back = sayTo(response, `/settings/project?repo=${encodeURIComponent(repo)}`, "#check-access");
+        const wanted = body.get("level");
+        if (!isCheckAccess(wanted))
+            return back("problem", "Choose how far checks reach. Nothing changed.");
+        // Not available yet (check-access.ts signInsAvailable): refused before the password, whatever the form sent.
+        const unavailable = wanted === "sign-ins" ? signInsUnavailableWords(options.platform ?? process.platform) : null;
+        if (unavailable !== null)
+            return back("problem", `${unavailable} Nothing changed.`);
+        const widening = widerThan(wanted, store.projectCheckAccess(repo));
+        // Sign-ins with an open network: a second, explicit yes, said before the password.
+        if (wanted === "sign-ins" && widening && store.projectNetwork(repo).mode === "open" && body.get("confirm-open") !== "yes") {
+            return back("problem", "This project's network is open: confirm that its checks could send your sign-ins to any host. Nothing changed.");
+        }
+        const proved = authenticateCredential(who, body.get("password") ?? "");
+        if (!proved.ok)
+            return back("problem", "Enter your Toolroll password to change how far checks reach.");
+        if (widening && (proved.method !== "password-now" || !store.isInstanceOperator(who.name))) {
+            return back("problem", "Only an instance operator widens how far checks reach, with their password typed now. Nothing changed.");
+        }
+        const changed = store.setProjectCheckAccess(repo, wanted, who.name, now, { may: widening ? "widen" : "narrow" });
+        if (changed === null)
+            return back("problem", "Check access changed meanwhile, and this would now widen it. Nothing changed.");
+        return back("said", changed.before === changed.after ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/tasks.js

@@ -2846,6 +2846,8 @@ export function createTasksHandlers(runtime) {
             } })(),
             // What its network was and what its proxy saw (egress.ts), display only.
             network: store.runNetwork(run.id),
+            // How far its checks reached (check-access.ts), display only.
+            checkAccess: store.runCheckAccess(run.id),
             reviewRetry: store.reviewRetryStateOf(run.id),
             review: reviewFactsFor(run.id),
             notes: store.notesForRun(run.id),

package/dist/store.d.ts

@@ -1,5 +1,6 @@
 import { type WritesMode } from "./writes-mode.js";
-import { type ProjectNetwork, type RunNetworkRecord } from "./egress.js";
+import { type CheckAccess } from "./check-access.js";
+import { type NetworkProfile, type ProjectNetwork, type RunNetworkRecord } from "./egress.js";
 import { type AcpLaunch } from "./acp-attest.js";
 import { type ChatBinding } from "./chat-core.js";
 import { ChatMessages, TELEGRAM_HOLD_REASONS, TELEGRAM_SKIPPED_ELSEWHERE, TELEGRAM_SKIPPED_OTHER_CHAT, TELEGRAM_SKIPPED_QUIET } from "./chat-messages.js";
@@ -179,7 +180,7 @@ export type SealedLedgerEntry = LedgerEntry & {
         hash: string;
     } | null;
 };
-export declare const SCHEMA_VERSION = 131;
+export declare const SCHEMA_VERSION = 132;
 /** v118: the tables merged into `credential`, in the order they move (a person's API tokens keep their ids first). */
 export declare const V118_MERGED_TABLES: Readonly<Record<string, CredentialKind>>;
 /**
@@ -318,6 +319,8 @@ export declare const V129_ADDED_COLUMNS: Readonly<Record<string, Readonly<Record
 export declare const CONFINEMENT_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_network (\n  repo          TEXT PRIMARY KEY,\n  network_json  TEXT NOT NULL CHECK (length(network_json) <= 16384),\n  updated_at    TEXT NOT NULL,\n  updated_by    TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS confinement_setting (\n  id               INTEGER PRIMARY KEY CHECK (id = 1),\n  unfenced_allowed INTEGER NOT NULL DEFAULT 0 CHECK (unfenced_allowed IN (0, 1)),\n  updated_at       TEXT,\n  updated_by       TEXT\n);\nINSERT OR IGNORE INTO confinement_setting (id, unfenced_allowed) VALUES (1, 0);\n";
 /** v131: where a project's builds may write (an approver's setting, agent-fence.ts WritesMode). */
 export declare const PROJECT_WRITES_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_writes (\n  repo        TEXT PRIMARY KEY,\n  mode        TEXT NOT NULL CHECK (mode IN ('workspace', 'anywhere')),\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL\n);\n";
+/** v132: how far a project's checks reach beyond the check fence (check-access.ts CheckAccess). */
+export declare const PROJECT_CHECK_ACCESS_SCHEMA = "\nCREATE TABLE IF NOT EXISTS project_check_access (\n  repo        TEXT PRIMARY KEY,\n  level       TEXT NOT NULL CHECK (level IN ('sandboxed', 'sign-ins', 'unsandboxed')),\n  updated_at  TEXT NOT NULL,\n  updated_by  TEXT NOT NULL\n);\n";
 /** v129: a finished run's How it ran, derived from its own records on first view (display only: never a verdict). Its
  * parser version says when to derive again; `steps` says how complete the step detail was, and why not. */
 export declare const RUN_EFFICIENCY_SCHEMA = "\nCREATE TABLE IF NOT EXISTS run_efficiency (\n  run             INTEGER PRIMARY KEY REFERENCES run(id) ON DELETE CASCADE,\n  parser_version  INTEGER NOT NULL,\n  steps           TEXT NOT NULL CHECK (steps IN ('complete','truncated','expired','absent')),\n  steps_reason    TEXT,\n  payload_json    TEXT NOT NULL CHECK (length(payload_json) <= 16384),\n  derived_at      TEXT NOT NULL\n);\n";
@@ -7174,6 +7177,30 @@ export declare class Store {
      * removed or expired — any of those means the composer's draft was accepted and must not be sent again). */
     leadRequestReceived(session: number, request: string): boolean;
     forgetQueuedLeadMessage(message: number): void;
+    /** How far a project's checks reach beyond the check fence: its saved level, or sandboxed. */
+    projectCheckAccess(repo: string): CheckAccess;
+    /** Who last changed a project's check access, and when (null: never changed). */
+    projectCheckAccessChange(repo: string): {
+        by: string;
+        at: string;
+    } | null;
+    /** The level a run's setup and checks ran at (its sealed approval's, or unsandboxed where no OS fence exists). Its
+     * follow-up and batch checks never run wider than this. */
+    stampRunCheckAccess(runId: number, level: CheckAccess, network?: NetworkProfile | null): void;
+    /** The network a run's sign-ins checks ran under (null: none sealed; such a run's later checks run sandboxed). */
+    runCheckNetwork(runId: number): NetworkProfile | null;
+    /** The level a run's checks ran at: missing or unreadable reads as sandboxed. */
+    runCheckAccess(runId: number): CheckAccess;
+    /** A project's check access changed: saved, and in the ledger as before → after. `may` is what the caller proved:
+     * "widen" only after an instance operator's password typed now; anything else may only narrow. The level is read again
+     * and compared in the same transaction as the write, so a change made while the caller was proving itself can't turn
+     * a narrowing into a widening. Refused: null, nothing written. */
+    setProjectCheckAccess(repo: string, level: CheckAccess, by: string, now: Date, authority: {
+        may: "narrow" | "widen";
+    }): {
+        before: CheckAccess;
+        after: CheckAccess;
+    } | null;
 }
 /** The receipt a bot's first pairing writes over pre-pairing history: an
  * explicit skip, with no delivered timestamp and no attempt, so suppressed