toolroll 0.9.7 → 0.9.8

package/dist/dispose.js

@@ -17,7 +17,9 @@ import { createHash } from "node:crypto";
 import { completeFenced, finalizeFailureFenced, finalizeHandBackFenced, finalizeMalformedFenced, finalizeParkFenced, interruptIfStopped, release, } from "./claim.js";
 import { bodyHashOf, publicationBody } from "./publish.js";
 import { modeTermsFromJson } from "./modes.js";
-import { readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
+import { evidenceRoot, readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
+import { queueBuildReview } from "./build-review.js";
+import { homedir } from "node:os";
 import {} from "./proof.js";
 import { verificationEvidence, failedVerificationEvidence } from "./verification-evidence.js";
 import { classifyGateFailure, describeGateFailure, gateFailureSummary } from "./gate-failure.js";
@@ -55,9 +57,14 @@ const STANDALONE_BROKE_REASONS = new Set([
     "timeout",
     "git",
 ]);
-/** Compatibility for historical integrations: finished work is handed to the
- * lead. No model review is requested and no signed history is rewritten. */
-export function maybeRequestAutoReview(_store, _repo, _runId, _committed, _noChange, _now) { }
+/** A committed build whose approved check passed gets the project's one
+ * automatic review when its review switch is on (build-review.ts). No-change
+ * results and failed checks go straight to the person, as before. */
+export function maybeRequestAutoReview(store, repo, runId, committed, noChange, now, root = evidenceRoot(homedir())) {
+    if (!committed || noChange)
+        return;
+    queueBuildReview(store, repo, runId, root, now);
+}
 export function disposeBuildOutcome(context, result) {
     // Stop and every terminal side effect compete under the same SQLite
     // write lock. A separate preliminary transaction leaves a completion gap.
@@ -238,6 +245,7 @@ function disposeBuildOutcomeLocked(context, result) {
             // proves the credential, clearing any quota stamp.
             store.resetStrikes(taskRef);
             store.clearQuota(runner, provider, model ?? "");
+            maybeRequestAutoReview(store, repo, runId, result.committed, result.noChange === true, clock(), context.evidenceRoot);
             return { kind: "built", committed: result.committed, noChange: result.noChange === true };
         }
         store.transact(() => {

package/dist/exec.d.ts

@@ -113,6 +113,11 @@ export type RunOptions = ProcessTreeObserver & {
     /** Fires once the child exists, with its pid (the process-group id when
      * processGroup is set) — the slot ledger records it (v14 finding 26). */
     onSpawn?: (pid: number) => void;
+    /** Fires instead of onSpawn when a spawn that beforeSpawn admitted made no
+     * process at all (the OS call threw — ENOENT, EAGAIN — returned no pid, or
+     * its OS object could not be made), so its reserved witness can be settled
+     * as never started in the same step. Never fires once a child exists. */
+    onSpawnFailed?: () => void;
     /** Fires before any target spawn, so a crash cannot lose its OS object. */
     onContainer?: (info: {
         backend: ContainmentBackendId;

package/dist/exec.js

@@ -84,9 +84,24 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
         throw new ContainmentRefusal(effective.refusal);
     if (bag.beforeSpawn?.() === false)
         throw new Error("the attempt stopped before this process could spawn");
-    const made = effective === null ? { container: null } : createContainer(effective, label);
-    if ("refused" in made)
+    // From here a witness may be reserved: every road that makes no process
+    // says so through onSpawnFailed before it returns or throws.
+    const neverStarted = () => { try {
+        bag.onSpawnFailed?.();
+    }
+    catch { /* the reservation stays unproven */ } };
+    let made;
+    try {
+        made = effective === null ? { container: null } : createContainer(effective, label);
+    }
+    catch (error) {
+        neverStarted();
+        throw error;
+    }
+    if ("refused" in made) {
+        neverStarted();
         throw new ContainmentRefusal(made.refused);
+    }
     const container = made.container;
     try {
         if (container !== null)
@@ -94,6 +109,7 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
     }
     catch (error) {
         container?.release();
+        neverStarted();
         throw error;
     }
     let launch;
@@ -102,6 +118,7 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
     }
     catch (error) {
         container?.release();
+        neverStarted();
         throw error;
     }
     let child;
@@ -123,6 +140,7 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
         }
         catch { }
         container?.release();
+        neverStarted();
         throw error;
     }
     if (container !== null) {
@@ -143,6 +161,12 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
         if (child.pid !== undefined) {
             bag.onSpawn?.(child.pid);
         }
+        else if (container === null) {
+            // No pid: the OS refused the spawn (ENOENT, EACCES) and only an
+            // 'error' event follows. A contained spawn settles once its object is
+            // proven empty, and its transport's return finishes the witness.
+            neverStarted();
+        }
     }
     catch (error) {
         throw new SpawnCustodyFailure(child, error);
@@ -201,7 +225,7 @@ function containmentOf(container, empty, attachFailure) {
 }
 /** The streaming transports' spawn: contained when the spawn is a provider (process group), plain otherwise. */
 function spawnStream(file, args, options, stdio, childEnv) {
-    return spawnContained(file, args, { cwd: options.cwd, env: childEnv, stdio, detached: options.processGroup === true && process.platform !== "win32" }, options.owner ?? "stream", { beforeSpawn: options.beforeSpawn, onSpawn: options.onSpawn, onContainer: options.onContainer, onContainerEmpty: options.onContainerEmpty, onUnknown: options.onUnknown, fence: options.fence }, options.processGroup === true);
+    return spawnContained(file, args, { cwd: options.cwd, env: childEnv, stdio, detached: options.processGroup === true && process.platform !== "win32" }, options.owner ?? "stream", { beforeSpawn: options.beforeSpawn, onSpawn: options.onSpawn, onSpawnFailed: options.onSpawnFailed, onContainer: options.onContainer, onContainerEmpty: options.onContainerEmpty, onUnknown: options.onUnknown, fence: options.fence }, options.processGroup === true);
 }
 /** The refusal-before-spawn shape shared by every containable transport. */
 function refusedResult(error) {
@@ -506,6 +530,7 @@ export function run(file, args, options = {}) {
             ...(cwd === undefined ? {} : { cwd }),
             ...(childEnv === undefined ? {} : { childEnv }),
             ...(options.onSpawn === undefined ? {} : { onSpawn: options.onSpawn }),
+            ...(options.onSpawnFailed === undefined ? {} : { onSpawnFailed: options.onSpawnFailed }),
             ...(options.owner === undefined ? {} : { owner: options.owner }),
             ...(options.beforeSpawn === undefined ? {} : { beforeSpawn: options.beforeSpawn }),
             ...(options.onStdout === undefined ? {} : { onStdout: options.onStdout }),
@@ -553,7 +578,7 @@ function runBufferedGroup(file, args, bag) {
         let container = null;
         let attached;
         try {
-            const spawned = spawnContained(file, args, { cwd: bag.cwd, env: bag.childEnv, stdio: [bag.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"], detached: process.platform !== "win32" }, bag.owner ?? "buffered", { beforeSpawn: bag.beforeSpawn, onSpawn: bag.onSpawn, onContainer: bag.onContainer, onContainerEmpty: bag.onContainerEmpty, onUnknown: bag.onUnknown, fence: bag.fence });
+            const spawned = spawnContained(file, args, { cwd: bag.cwd, env: bag.childEnv, stdio: [bag.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"], detached: process.platform !== "win32" }, bag.owner ?? "buffered", { beforeSpawn: bag.beforeSpawn, onSpawn: bag.onSpawn, onSpawnFailed: bag.onSpawnFailed, onContainer: bag.onContainer, onContainerEmpty: bag.onContainerEmpty, onUnknown: bag.onUnknown, fence: bag.fence });
             child = spawned.child;
             container = spawned.container;
             attached = spawned.attached;
@@ -1578,6 +1603,7 @@ export function startClaudeHeldSession(file, args, options) {
             }, options.owner ?? "held", {
                 beforeSpawn: options.beforeSpawn,
                 onSpawn: options.onSpawn,
+                onSpawnFailed: options.onSpawnFailed,
                 onContainer: options.onContainer,
                 onContainerEmpty: options.onContainerEmpty,
                 onUnknown: options.onUnknown,

package/dist/first-run.d.ts

@@ -88,7 +88,7 @@ export type JourneyStep = {
  * the build finished with a result.
  */
 export declare function firstTaskJourney(read: {
-    stage: "queued" | "planning" | "needs-you" | "building" | "checking" | "finished" | "complete" | "failed" | "stopped";
+    stage: "queued" | "planning" | "needs-you" | "building" | "checking" | "reviewing" | "finished" | "complete" | "failed" | "stopped";
     need?: string | undefined;
 }, approved: boolean, built?: boolean): JourneyStep[];
 export {};

package/dist/first-run.js

@@ -129,7 +129,7 @@ export const JOURNEY_STEPS = [["plan", "Plan"], ["approve", "You approve"], ["bu
  */
 export function firstTaskJourney(read, approved, built = false) {
     const at = read.stage === "finished" || read.stage === "complete" ? { index: 5, stuck: false }
-        : read.stage === "checking" ? { index: 3, stuck: false }
+        : read.stage === "checking" || read.stage === "reviewing" ? { index: 3, stuck: false }
             : read.stage === "building" ? { index: 2, stuck: false }
                 : read.stage === "needs-you" && read.need === "approval" ? { index: 1, stuck: false }
                     : read.stage === "planning" ? { index: 0, stuck: false }

package/dist/invoke.js

@@ -646,6 +646,11 @@ export async function invokeHeldAgent(store, runId, spec, argv, options) {
                 store.recordRunProcess(runId, pid, clock(), false, heldWitness);
                 runOptions.onSpawn?.(pid);
             },
+            onSpawnFailed: () => {
+                if (heldWitness !== undefined)
+                    store.finishUnspawnedProcess(heldWitness, clock());
+                runOptions.onSpawnFailed?.();
+            },
             onContainer: info => {
                 nativeHeld = true;
                 if (heldWitness !== undefined)

package/dist/modes.d.ts

@@ -29,7 +29,9 @@ export type ModeTerms = {
     planAuto: boolean;
     /** Attended mint without the per-mint password — signer only (D8). */
     quickMint: boolean;
-    /** Historical signed field; new modes leave it false and no worker consumes it. */
+    /** Historical signed field; new modes leave it false and no worker consumes
+     * it. Automatic review is the project's review switch (review-switch.ts),
+     * on by default while a hands-off mode is active. */
     reviewAuto: boolean;
     /** Historical signed retry term, retained for digest and audit compatibility. */
     reviewRetryAuto: boolean;

package/dist/modes.js

@@ -157,7 +157,9 @@ export function modeWords(terms) {
         terms.planAuto
             ? "plans for your pre-authorized filings auto-approve only when the goal, exclusions, paths, acceptance criteria, risk, budget, and agent route remain exactly unchanged; provide a goal, paths and acceptance criteria upfront; amendments and unresolved questions still wait for you"
             : "planner-generated plans wait for your approval",
-        "finished work and saved checks go to the lead or user; no separate model review runs",
+        terms.name === "hands-off"
+            ? "automatic review is on for this project unless you turn it off (`toolroll review off --repo <path>`): each finished build whose check passes (or that finishes, with checks Off) gets one read-only review by the project's review agent; a HIGH finding sends it back once as a revision filed under this mode, a HIGH on that revision comes to you, MEDIUM and LOW findings come to you as suggested follow-ups, and a review that fails or times out never holds the work — it reaches you marked not reviewed"
+            : "finished work and saved checks go to the lead or user; automatic review runs only where a project turns it on (`toolroll review on --repo <path>`)",
         ...(terms.reviewAuto || terms.reviewRetryAuto
             ? ["historical review grants are retained on record but no longer schedule work"] : []),
         terms.perAttemptBudgetMicrousd === null

package/dist/operate.js

@@ -1,13 +1,15 @@
 import { maybeTriggerRepair } from "./dispose.js";
 import { CHECK_LEVEL_HINTS, CHECK_LEVEL_WORDS, isCheckLevel, liveQuickCommand, projectCheckLevel, quickVerifyKey, setProjectCheckLevel, setTaskCheckLevel, suggestQuickCommand } from "./check-levels.js";
 import { fileAddTestsTask, followUpChecksOf, requestFollowUpChecks, runFollowUpCheck, runWaitingChecks } from "./result-follow-ups.js";
+import { buildReviewPass } from "./build-review.js";
+import { buildReviewLines, buildReviewOf } from "./review-switch.js";
 import { parseProtectedPaths } from "./approval-policy.js";
 import { rulesSummary } from "./approval-rules-ui.js";
 import { evidencePack, exportDay, ledgerExportChunks, standaloneEvidenceHtml } from "./evidence-pack.js";
 import { matchesOutsideCheckpoint } from "./ledger-chain.js";
 import { CLEANUP_CHOICES, bytesWords, cleanupWords, parseCleanup, storageReport } from "./storage.js";
 import { checkoutPlan, cleanCheckouts, discardCheckout, whyWords } from "./checkout-cleanup.js";
-import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodWords, retentionPlan, sweepWords } from "./retention.js";
+import { MIN_DAYS, RETENTION_KINDS, countWords, dailyRetention, isRetentionKind, lastSweepAt, parsePeriod, periodLabel, periodWords, retentionPlan, sweepWords } from "./retention.js";
 import { checkPolicy, parseList, policyParts } from "./policy.js";
 import { billingOf, budgetHoldWords, budgetLabel, budgetStates, monthNamed, monthOf, spendItems, teammateNames, usd as spendUsd } from "./spend.js";
 import { spendCsv } from "./spend-ui.js";
@@ -239,9 +241,10 @@ export const OPERATE_HELP = `toolroll — operating the queue
   toolroll notifications digest <HH:MM>|off   one evening message: what finished, what waits, what failed
   toolroll notifications mute|unmute --repo <p>   no pings for a project; the console and digest keep it
   toolroll retention show|preview    how long evidence, checkout records, chat and notifications are kept; what the daily sweep would remove
-  toolroll retention set <kind> <period>   evidence|checkouts|chat|notifications, 30d|1y|forever (instance operator)
+  toolroll retention set <kind> <period>   evidence|checkouts|chat|notifications, 1d|30d|1y|forever (instance operator)
   toolroll backup now|list          back the database up now; list backups and how the last ones went
   toolroll restore <file> [--dry-run]  put a backup back (Toolroll stopped; the current database is kept)
+  toolroll review show|on|off --repo <path>  one automatic review of each finished build; only HIGH findings send it back
   toolroll policy show|set          the organisation policy; an instance operator sets it with --providers claude,codex|any,
                                         --models <m,…>|any, --tools <t,…>|any, --ceiling safe|standard|escalated
   toolroll ledger verify             check the action ledger's hash chain (--checkpoint <n:hash> to compare a copied head)
@@ -932,6 +935,8 @@ async function dispatch(command, positional, flags, context) {
             return storageCommand(positional, flags, context);
         case "integrations":
             return integrationsCommand(positional, flags, context);
+        case "review":
+            return reviewSwitchCommand(positional, flags, context);
         case "monitoring": {
             // Where the audit stream and traces go, and how each destination is doing. Settings → Monitoring changes it.
             const settings = readMonitoring(dirname(context.databaseFile));
@@ -992,6 +997,8 @@ async function dispatch(command, positional, flags, context) {
             return tickCommand(flags, context);
         case "reconcile":
             return reconcileCommand(flags, context);
+        case "run":
+            return runCommand(positional, flags, context);
         case "cap":
             return capCommand(positional, flags, context);
         case "gaps":
@@ -4277,19 +4284,20 @@ async function tickCommand(flags, context) {
                 broke++;
         }
     }
-    // Retire queued model-review work without creating a run or a passing verdict.
-    // Reauthenticate inside the write transaction and touch only admitted projects.
-    if (!buildsOnly)
-        store.transact(() => {
-            const current = authenticate(store, runner, token);
-            if (!current.ok)
-                return;
-            for (const request of store.openReviewRequests()) {
-                if (request.repo !== null && current.runner.repos.includes(request.repo)) {
-                    store.consumeReviewRequest(request.id, "model-review-retired", clock());
-                }
-            }
+    // The one automatic review each finished build gets when its project's
+    // switch is on, before the result is handed on below. Other queued review
+    // asks close unrun. Reauthenticated first; only admitted projects.
+    if (!buildsOnly && authenticate(store, runner, token).ok) {
+        const reviewed = await buildReviewPass(store, {
+            runner, token, repos: auth.runner.repos, clock,
+            root: context.evidenceRoot,
+            ...(text(flags, "incarnation") === undefined ? {} : { watchIncarnation: text(flags, "incarnation") }),
+            ...(context.agentRunner === undefined ? {} : { agent: context.agentRunner }),
+            shouldStop: () => context.shouldStop?.() === true || context.shouldPauseAdmission?.() === true,
         });
+        for (const one of reviewed)
+            dispatched.push({ id: `review of run ${one.run}`, outcome: one.outcome === "not-reviewed" ? "not-reviewed" : "reviewed", reason: one.detail });
+    }
     // Existing worker pass owns durable lead handoffs; reads never create events.
     if (!buildsOnly)
         syncAssignmentHandoffs(store, clock(), auth.runner.repos, context.evidenceRoot);
@@ -4327,7 +4335,7 @@ async function tickCommand(flags, context) {
             routines,
         });
     }
-    if (built > 0 || parked > 0 || dispatched.some(one => one.outcome === "planned" || one.outcome === "reported" || one.outcome === "held")) {
+    if (built > 0 || parked > 0 || dispatched.some(one => one.outcome === "planned" || one.outcome === "reported" || one.outcome === "held" || one.outcome === "reviewed" || one.outcome === "not-reviewed")) {
         return succeed(write, json, "tick", { considered, dispatched, routines, ...flows }, summary);
     }
     if (considered === 0) {
@@ -4389,6 +4397,9 @@ async function reconcileCommand(flags, context) {
         }
     }
     const recovered = recoverDead(store, clock());
+    // A witness reserved for a spawn that never made a process (a crash or a
+    // thrown spawn) settles once its run's process groups are proven gone.
+    store.settleUnspawnedWitnesses(clock());
     store.settleQuiescentStops(clock());
     for (const one of recovered) {
         for (const leaseId of one.claims) {
@@ -5045,13 +5056,18 @@ async function planTaskCommand(positional, flags, context) {
 }
 /** The retired command is a typed refusal, never a new provider request. */
 async function reviewTaskCommand(positional, flags, context) {
-    const { store, write, json, clock } = context;
+    const { store, write, json } = context;
     const [runText] = positional;
     const runId = Number(runText ?? "");
     if (runText === undefined || !Number.isInteger(runId) || runId < 1) {
         return fail(write, json, "task review", "usage", "`toolroll task review <run-id>`", EXIT.usage);
     }
-    return fail(write, json, "task review", "model-review-retired", `Separate model review has been removed. Inspect run ${runId}'s saved work and checks, then give feedback or request a revision.`, EXIT.refused);
+    // Read-only: the run's one automatic review, when it had one.
+    const review = buildReviewOf(store, runId);
+    if (review !== null) {
+        return succeed(write, json, "task review", { run: runId, review }, () => [`Run ${runId}`, ...buildReviewLines(review)]);
+    }
+    return fail(write, json, "task review", "model-review-retired", `Run ${runId} has no automatic review. Manual review requests have been removed; a project's builds are reviewed automatically when its switch is on (\`toolroll review on --repo <path>\`). Inspect the saved work and checks, then give feedback or request a revision.`, EXIT.refused);
 }
 /**
  * `toolroll incident list|resolve <id>` — the parks that never became
@@ -10147,6 +10163,9 @@ function showTask(positional, context) {
         // v50: the latest build's bounded review history — every root attempt
         // in order, the open request, and the one state they add up to.
         review: latestFinished === null ? null : store.reviewRetryStateOf(latestFinished.id),
+        // The one automatic review of the latest build: HIGH findings, suggested
+        // follow-ups (MEDIUM/LOW), or why it was not reviewed.
+        automaticReview: latestFinished === null ? null : buildReviewOf(store, latestFinished.id),
         dispatch: diagnoseTaskDispatch(store, id, now),
         // v52: the exact-run control the console shows — Stop, Stopping,
         // Paused (resume), or the review-retry door — and every stop on record.
@@ -10199,7 +10218,7 @@ function showTask(positional, context) {
                     : detail.control.kind === "paused"
                         ? [`  control: paused — run #${detail.control.run} was stopped by ${detail.control.stop.requestedBy} (${detail.control.stop.settlement ?? "?"})${detail.control.committed ? "; its commit is on the branch" : ""}; work preserved${detail.control.worktree === null ? "" : ` in ${detail.control.worktree}`} — \`task resume ${task.id} --run ${detail.control.run} --as <you> --token <t>\``]
                         : [`  control: review #${detail.control.run} was stopped by ${detail.control.stop.requestedBy} — inspect its saved result and give feedback; separate model review has been removed`]),
-        ...reviewStatusLines(detail.review, latestFinished?.id ?? null),
+        ...(detail.automaticReview === null ? reviewStatusLines(detail.review, latestFinished?.id ?? null) : buildReviewLines(detail.automaticReview)),
         ...(scope === null
             ? ["  no scope — nothing will build this until one is written and approved"]
             : describeScope(scope, readiness)),
@@ -11662,6 +11681,48 @@ async function resumeTaskCommand(positional, flags, context) {
             : `  Not starting yet — ${resumed.gate.summary}: ${resumed.gate.detail}`,
     ]);
 }
+/**
+ * `toolroll run settle <id> --why "<text>" --as <you> --token <t>`: an
+ * approver's last resort for a finished run whose process witnesses can be
+ * proven neither exited nor alive (a spawn interrupted before its pid was
+ * written). Refuses while anything of the run is alive; the reason is kept
+ * in the ledger against the approver's name. Signals nothing.
+ */
+async function runCommand(positional, flags, context) {
+    const { store, write, json, clock } = context;
+    const [action, id, ...extra] = positional;
+    const command = "run settle";
+    const usage = "`toolroll run settle <run-id> --why \"<reason>\" --as <you> --token <t>`";
+    if (action !== "settle")
+        return fail(write, json, "run", "usage", usage, EXIT.usage);
+    const runId = Number(id ?? "");
+    const why = text(flags, "why")?.trim();
+    if (id === undefined || extra.length > 0 || !/^[1-9]\d*$/.test(id) || !Number.isSafeInteger(runId))
+        return fail(write, json, command, "usage", usage, EXIT.usage);
+    if (why === undefined || why === "" || why.length > 300 || /[\x00-\x1f\x7f]/.test(why)) {
+        return fail(write, json, command, "usage", "say why in one line with --why (at most 300 characters) — it is kept in the ledger", EXIT.usage);
+    }
+    const run = store.getRun(runId);
+    if (run === null)
+        return fail(write, json, command, "unknown-run", `no run #${runId}`, EXIT.refused);
+    const acting = await askCredentials(flags, context);
+    if (acting === null) {
+        return fail(write, json, command, "usage", "settling takes `--as <you> --token <t>` — it is an approver's act and is recorded against your name", EXIT.usage);
+    }
+    const authenticated = authenticateApprover(store, acting.name, acting.token);
+    const repo = store.refById(run.taskRef)?.repo ?? null;
+    if (!authenticated.ok || !store.accountCanAccess(acting.name, repo)) {
+        return fail(write, json, command, "not-an-approver", "that is not an approver for this run's project, or the token does not match", EXIT.refused);
+    }
+    const settled = store.settleRunWitnessesByApprover({ runId, by: acting.name, why }, clock());
+    if (!settled.ok)
+        return fail(write, json, command, settled.reason, settled.detail, EXIT.refused, { run: runId });
+    return succeed(write, json, command, { run: runId, witnesses: settled.witnesses, repeated: settled.repeated }, () => [
+        settled.repeated
+            ? `Run #${runId} has no unsettled process witness; nothing changed.`
+            : `Settled run #${runId}: ${settled.witnesses.length} process witness${settled.witnesses.length === 1 ? "" : "es"} recorded as ended, with your reason in the ledger.`,
+    ]);
+}
 // ---- shared ---------------------------------------------------------------
 /**
  * `project rules --repo <path>` shows a project's approval rules (v102);
@@ -12026,9 +12087,11 @@ async function retentionCommand(positional, flags, context) {
     const label = (kind) => RETENTION_KINDS.find(one => one.kind === kind).label;
     if (action === undefined || action === "show") {
         const periods = store.retentionPeriods();
+        const chosen = store.retentionChosen();
+        const defaulted = RETENTION_KINDS.map(one => one.kind).filter(kind => !(kind in chosen));
         const last = lastSweepAt(store);
-        return succeed(context.write, context.json, command, { periods, lastSweep: last }, () => [
-            ...RETENTION_KINDS.map(one => `  ${one.kind.padEnd(14)} ${periodWords(periods[one.kind]).padEnd(9)} ${one.label}`),
+        return succeed(context.write, context.json, command, { periods, defaulted, lastSweep: last }, () => [
+            ...RETENTION_KINDS.map(one => `  ${one.kind.padEnd(14)} ${periodLabel(one.kind, periods[one.kind], one.kind in chosen).toLowerCase().padEnd(18)} ${one.label}`),
             last === null ? "No sweep yet; the worker runs one a day." : `Last sweep ${last.slice(0, 16).replace("T", " ")} UTC.`,
         ]);
     }
@@ -12044,11 +12107,11 @@ async function retentionCommand(positional, flags, context) {
         return fail(context.write, context.json, command, "usage", "Use retention show, retention preview or retention set <kind> <period>.", EXIT.usage);
     const [kind, period, ...extra] = rest;
     if (kind === undefined || !isRetentionKind(kind) || period === undefined || extra.length > 0) {
-        return fail(context.write, context.json, command, "usage", `Use retention set <${RETENTION_KINDS.map(one => one.kind).join("|")}> <days, like 90d or 1y, or forever>.`, EXIT.usage);
+        return fail(context.write, context.json, command, "usage", `Use retention set <${RETENTION_KINDS.map(one => one.kind).join("|")}> <days, like 1d, 90d or 1y, or forever>.`, EXIT.usage);
     }
     const days = parsePeriod(period);
     if (days === undefined)
-        return fail(context.write, context.json, command, "usage", `A period is forever, or ${MIN_DAYS} days to 10 years (90d, 12w, 1y).`, EXIT.usage);
+        return fail(context.write, context.json, command, "usage", `A period is forever, or ${MIN_DAYS} day to 10 years (1d, 90d, 12w, 1y).`, EXIT.usage);
     const acting = await askCredentials(flags, context);
     const verified = acting === null ? null : authenticateApprover(store, acting.name, acting.token);
     if (acting === null || verified === null || !verified.ok || !store.isInstanceOperator(acting.name)) {
@@ -12148,6 +12211,40 @@ async function storageCommand(positional, flags, context) {
 function checkoutSummary(plan) {
     return { count: plan.count, totalBytes: plan.totalBytes, waitingReview: plan.waitingReview, withChanges: plan.withChanges, cleanBytes: plan.freeBytes, cleanCount: plan.go.length, cleanup: plan.cleanup };
 }
+/** `review [show] | on | off --repo <path>`: the project's one automatic review
+ * of finished builds. Changing it takes an approver of that project; the
+ * policy log keeps before → after. */
+async function reviewSwitchCommand(positional, flags, context) {
+    const { store, write, json } = context;
+    const [action = "show", ...extra] = positional;
+    const command = `review ${action}`;
+    if (extra.length > 0 || !["show", "on", "off"].includes(action))
+        return fail(write, json, command, "usage", "Use toolroll review show|on|off --repo <path>.", EXIT.usage);
+    const allowed = new Set(["repo", "db", "json", ...(action === "show" ? [] : ["as", "token", "token-file", "token-env"])]);
+    for (const name of flags.keys())
+        if (!allowed.has(name))
+            return fail(write, json, command, "usage", `--${name} is not a ${command} option.`, EXIT.usage);
+    const given = text(flags, "repo");
+    if (given === undefined)
+        return fail(write, json, command, "usage", "Name the project: toolroll review " + action + " --repo <path>.", EXIT.usage);
+    const repo = canonicalProject(given) ?? resolve(given);
+    const words = (on, source) => `${projectName(repo)}: automatic review is ${on ? "on" : "off"}${source === "hands-off" ? " (on while the hands-off mode lasts)" : source === "default" ? " (the default)" : ""}.`;
+    if (action === "show") {
+        const state = store.reviewSwitch(repo, context.clock());
+        return succeed(write, json, command, { repo, ...state }, () => [words(state.on, state.source)]);
+    }
+    const acting = await askCredentials(flags, context);
+    if (acting === null)
+        return fail(write, json, command, "usage", `Sign in first, or pass --as <you> --token <t>: toolroll review ${action} --repo <path>.`, EXIT.usage);
+    const verified = authenticateApprover(store, acting.name, acting.token, repo);
+    if (!verified.ok)
+        return fail(write, json, command, verified.reason, `Only an approver of ${projectName(repo)} can change its review switch.`, EXIT.refused);
+    const changed = store.setReviewSwitch(repo, action === "on", acting.name, context.clock());
+    return succeed(write, json, command, { repo, ...changed.after, before: changed.before }, () => [
+        words(changed.after.on, changed.after.source),
+        changed.after.on ? "Each finished build whose check passes gets one read-only review; only HIGH findings send it back, once." : "Finished builds go straight to you.",
+    ]);
+}
 /** `policy show | set` (sprint 8): the organisation policy. Setting it takes an instance operator's credentials; each rule
  * that changed is in the ledger, before → after. A flag left out keeps its rule; "any" lifts it. */
 async function policyCommand(positional, flags, context) {

package/dist/process-custody.js

@@ -69,6 +69,14 @@ export function witnessedRunner(store, runId, clock, runner) {
                 store.recordRunProcess(runId, pid, clock(), options.processGroup === true, witnesses.at(-1));
                 options.onSpawn?.(pid);
             },
+            // The spawn made no process (ENOENT, EAGAIN, a throw): its reservation
+            // settles as never started now, not only if the transport returns.
+            onSpawnFailed: () => {
+                const witness = witnesses.at(-1);
+                if (witness !== undefined)
+                    store.finishUnspawnedProcess(witness, clock());
+                options.onSpawnFailed?.();
+            },
             onContainer: info => {
                 native = true;
                 const witness = witnesses.at(-1);

package/dist/provider.js

@@ -169,6 +169,22 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
                 additionalProperties: false,
             },
         },
+        // The automatic build review's reply (build-review.ts). Shape only;
+        // parseBuildFindings is the validator.
+        findings: {
+            type: "array",
+            items: {
+                type: "object",
+                properties: {
+                    severity: { type: "string", enum: ["HIGH", "MEDIUM", "LOW"] },
+                    file: { type: "string" },
+                    line: { type: "integer", minimum: 1 },
+                    scenario: { type: "string" },
+                },
+                required: ["severity", "file", "line", "scenario"],
+                additionalProperties: false,
+            },
+        },
         // The read request rides the same structured reply channel and
         // session. The machine validates the exact allowlist/hash/range
         // before supplying bytes; this only shapes the request.

package/dist/retention-ui.d.ts

@@ -1,7 +1,9 @@
-import { type RetentionCount, type RetentionPeriods } from "./retention.js";
+import { type RetentionCount, type RetentionKind, type RetentionPeriods } from "./retention.js";
 export declare const RETENTION_CSS: string;
+/** `chosen`: the kinds someone chose a period for; the rest keep their default. */
 export type RetentionView = {
     periods: RetentionPeriods;
+    chosen: readonly RetentionKind[];
     next: RetentionCount[];
     lastSweep: string | null;
     csrf: string;

package/dist/retention-ui.js

@@ -4,7 +4,7 @@
  * take a step-up.
  */
 import { bytesWords } from "./storage.js";
-import { PERIOD_CHOICES, RETENTION_KINDS, countWords, periodWords } from "./retention.js";
+import { RETENTION_KINDS, countWords, periodChoices, periodLabel } from "./retention.js";
 const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 export const RETENTION_CSS = `.retention{max-width:720px;min-width:0}.retention-next{margin:0 0 16px}` +
     `.retention form{display:grid;gap:0}.retention .kind{display:grid;grid-template-columns:minmax(0,1fr) 11rem;gap:4px 16px;align-items:center;padding:12px 0;border-bottom:1px solid var(--border)}` +
@@ -26,8 +26,8 @@ export function retentionHtml(view, notice) {
     const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
     const rows = RETENTION_KINDS.map(({ kind, label, detail }) => {
         const current = view.periods[kind];
-        const choices = PERIOD_CHOICES.includes(current) ? PERIOD_CHOICES : [...PERIOD_CHOICES.slice(0, -1), current, null].sort((a, b) => (a ?? Infinity) - (b ?? Infinity));
-        const options = choices.map(days => `<option value="${days === null ? "forever" : days}"${days === current ? " selected" : ""}>${days === null ? "Forever" : `${periodWords(days)[0].toUpperCase()}${periodWords(days).slice(1)}`}</option>`).join("");
+        const chosen = view.chosen.includes(kind);
+        const options = periodChoices(kind, current).map(days => `<option value="${days === null ? "forever" : days}"${days === current ? " selected" : ""}>${e(periodLabel(kind, days, chosen || days !== current))}</option>`).join("");
         return `<div class="kind" data-kind="${kind}"><label class="name" for="keep-${kind}">${e(label)}</label><p class="meta">${e(detail)}</p><select id="keep-${kind}" name="${kind}">${options}</select></div>`;
     }).join("");
     const last = view.lastSweep === null ? "" : ` Last sweep ${e(view.lastSweep.slice(0, 10))}.`;
@@ -35,5 +35,5 @@ export function retentionHtml(view, notice) {
         `<form method="post" action="/settings/retention"><input type="hidden" name="csrf" value="${e(view.csrf)}">${rows}` +
         `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
         `<button type="submit">Save</button></form>` +
-        `<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results not yet completed, anything on hold).</p></article>`;
+        `<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
 }

package/dist/retention.d.ts

@@ -1,5 +1,8 @@
-import type { Store } from "./store.js";
-export declare const RETENTION_SCHEMA = "\nCREATE TABLE IF NOT EXISTS retention_setting (\n  kind       TEXT PRIMARY KEY CHECK (kind IN ('evidence', 'checkouts', 'chat', 'notifications')),\n  -- NULL is forever; a row only exists once someone chose.\n  days       INTEGER CHECK (days IS NULL OR (days >= 7 AND days <= 3650)),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n";
+import type { Database, Store } from "./store.js";
+export declare const RETENTION_SCHEMA: string;
+/** A file from before 1-day evidence keeps `days >= 7` in its CHECK: rebuild the table with the wider one, keeping
+ * every row, in one transaction. A file already widened is untouched. */
+export declare function widenRetentionSchema(db: Database): void;
 export type RetentionKind = "evidence" | "checkouts" | "chat" | "notifications";
 export type RetentionPeriods = Record<RetentionKind, number | null>;
 export declare const RETENTION_KINDS: readonly {
@@ -7,19 +10,23 @@ export declare const RETENTION_KINDS: readonly {
     label: string;
     detail: string;
 }[];
-/** The periods the page offers; the command line takes any number of days from 7 to 3650. */
-export declare const PERIOD_CHOICES: readonly (number | null)[];
-export declare const MIN_DAYS = 7;
+export declare const PERIOD_CHOICES: Readonly<Record<RetentionKind, readonly (number | null)[]>>;
+export declare const MIN_DAYS = 1;
 export declare const MAX_DAYS = 3650;
 /** A sweep is due once a day. */
 export declare const SWEEP_EVERY_MS = 86400000;
 /** At most this many runs, messages, notifications or records go per kind per sweep; the next sweep takes the rest. */
 export declare const SWEEP_BATCH = 2000;
-export declare const FOREVER: RetentionPeriods;
+/** What each kind keeps until someone chooses: evidence 28 days, everything else forever. */
+export declare const DEFAULT_PERIODS: RetentionPeriods;
 export declare function isRetentionKind(value: string): value is RetentionKind;
 /** "forever", or a number of days ("90", "90d"), weeks ("12w") or years ("1y"); undefined when it's none of those or out of range. */
 export declare function parsePeriod(text: string): number | null | undefined;
 export declare function periodWords(days: number | null): string;
+/** What the page offers for `kind`, with `current` among them (in order) when it was set some other way. */
+export declare function periodChoices(kind: RetentionKind, current: number | null): readonly (number | null)[];
+/** A period as the page and `retention show` say it: "28 days (default)" when nobody chose, "30 days (custom)" when it's not one the page offers. */
+export declare function periodLabel(kind: RetentionKind, days: number | null, chosen: boolean): string;
 export type RetentionCount = {
     kind: RetentionKind;
     days: number | null;