toolroll 0.9.7 → 0.9.9

package/dist/project-learning.js

@@ -44,12 +44,21 @@ CREATE TRIGGER IF NOT EXISTS learning_capture_no_delete BEFORE DELETE ON learnin
 export const learningSha = (text) => createHash('sha256').update(text).digest('hex');
 const text = (x, max) => typeof x === 'string' && x.trim().length > 0 && Buffer.byteLength(x) <= max && !/[\x00-\x1f\x7f]/.test(x);
 const pathOk = (x) => text(x, 300) && !x.startsWith('/') && !x.includes('\\') && !/^[A-Za-z]:/.test(x) && x.split('/').every(p => p !== '.' && p !== '..' && p !== '') && !/[\*?\[\]:]/.test(x);
-const git = (repo, args) => execFileSync('git', ['--no-optional-locks', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+/** One read per distinct command within a single selection pass (`seen`), so a pass over many lessons reads the repository once. */
+const git = (repo, args, seen) => {
+    const key = JSON.stringify([repo, args]);
+    const known = seen?.get(key);
+    if (known !== undefined)
+        return known;
+    const out = execFileSync('git', ['--no-optional-locks', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+    seen?.set(key, out);
+    return out;
+};
 /** Path plus the physical shared Git database: replacing a repository does not inherit its lessons. */
-export function learningIdentity(repo) {
+export function learningIdentity(repo, seen) {
     if (canonicalProject(repo) !== repo)
         throw new Error('Project identity changed.');
-    const common = realpathSync(resolve(repo, git(repo, ['rev-parse', '--git-common-dir'])));
+    const common = realpathSync(resolve(repo, git(repo, ['rev-parse', '--git-common-dir'], seen)));
     const st = statSync(common);
     return learningSha(JSON.stringify([repo, common, st.dev, st.ino, st.birthtimeMs]));
 }
@@ -59,10 +68,10 @@ function environmentFingerprint(store, repo) {
 }
 const configPath = (p) => /(^|\/)(AGENTS\.md|package(-lock)?\.json|[^/]*lock[^/]*|[^/]*config[^/]*|Cargo\.toml|go\.mod|pyproject\.toml|\.tool-versions|\.nvmrc)$/.test(p);
 /** Compare the applicable code and configuration, not model confidence or a claimed passing command. */
-export function learningFingerprint(repo, head, paths) {
+export function learningFingerprint(repo, head, paths, seen) {
     if (!/^[a-f0-9]{40,64}$/.test(head))
         throw new Error('No exact source revision.');
-    const entries = git(repo, ['ls-tree', '-r', head]).split('\n').filter(line => {
+    const entries = git(repo, ['ls-tree', '-r', head], seen).split('\n').filter(line => {
         const p = line.slice(line.indexOf('\t') + 1);
         return paths.includes(p) || configPath(p);
     });
@@ -198,7 +207,7 @@ function verifyEvidence(store, root, source, evidence, catalog) {
 // missing work, so newer reviews cannot starve an older recovery.
 const recoveryCursors = new WeakMap();
 /** Validate after core commit; both suggestions commit or neither. */
-export function recoverLearning(store, root, repo, now = new Date()) {
+export function recoverLearning(store, root, repo, now = new Date(), seen = new Map()) {
     let projects = recoveryCursors.get(store);
     if (!projects)
         recoveryCursors.set(store, projects = new Map());
@@ -225,7 +234,7 @@ export function recoverLearning(store, root, repo, now = new Date()) {
             if (!source || !reviewer || source.taskRef !== reviewer.taskRef)
                 continue;
             const snapshot = reviewSnapshot(store, reviewer.id);
-            if (!snapshot || snapshot['identity'] !== learningIdentity(repo))
+            if (!snapshot || snapshot['identity'] !== learningIdentity(repo, seen))
                 continue;
             const response = store.artifactsFor(reviewer.id).find(a => a.kind === 'structured-output' && a.captureStatus === 'ok');
             const read = response && readVerifiedArtifact(root, response);
@@ -260,7 +269,7 @@ export function recoverLearning(store, root, repo, now = new Date()) {
                 if (!run || !reviewed || reviewed.outcome !== 'no-change' || reviewed.taskRef !== run.taskRef || reviewed.role !== 'reviewer' || reviewedSource(store, reviewer) !== source || store.refForId(run.taskRef)?.repo !== repo)
                     throw new Error('Learning review provenance is unavailable.');
                 const candidates = parseLearning(JSON.parse(String(row['payload'])));
-                const identity = learningIdentity(repo);
+                const identity = learningIdentity(repo, seen);
                 if (identity !== row['identity'])
                     throw new Error('Learning project identity changed.');
                 const head = run.headRevision ?? run.baseRevision ?? '';
@@ -273,7 +282,7 @@ export function recoverLearning(store, root, repo, now = new Date()) {
                     verifyEvidence(store, root, source, c.evidence, JSON.parse(String(row['catalog'])));
                     if (c.paths.some(p => !patch.split('\n').some(l => l === `+++ b/${p}` || l === `--- a/${p}`)))
                         throw new Error('Learning applicability must name reviewed files.');
-                    const payload = JSON.stringify({ ...c, environment: String(row['environment']), fingerprint: learningFingerprint(repo, head, c.paths), platform: process.platform, head });
+                    const payload = JSON.stringify({ ...c, environment: String(row['environment']), fingerprint: learningFingerprint(repo, head, c.paths, seen), platform: process.platform, head });
                     const finding = learningSha(JSON.stringify(c));
                     store.handle.prepare("INSERT OR IGNORE INTO project_lesson(repo,identity,source,reviewer,finding,payload,sha,status) VALUES (?,?,?,?,?,?,?,'proposed')").run(repo, identity, source, reviewer, finding, payload, learningSha(payload));
                     const id = Number(store.handle.prepare('SELECT id FROM project_lesson WHERE source=? AND finding=?').get(source, finding)['id']);
@@ -302,15 +311,15 @@ function lessonOf(row) {
     parseLearning([payload]);
     return { id: Number(row['id']), repo: String(row['repo']), source: Number(row['source']), reviewer: Number(row['reviewer']), status: String(row['status']), version: Number(row['version']), payload, sha: String(row['sha']), identity: String(row['identity']), adoptedBy: row['adopted_by'] == null ? null : String(row['adopted_by']) };
 }
-function supported(store, root, lesson) {
-    if (lesson.identity !== learningIdentity(lesson.repo))
+function supported(store, root, lesson, seen) {
+    if (lesson.identity !== learningIdentity(lesson.repo, seen))
         throw new Error('Project identity changed.');
     const capture = store.handle.prepare('SELECT catalog FROM learning_capture WHERE source=? AND reviewer=? AND repo=?').get(lesson.source, lesson.reviewer, lesson.repo);
     if (!capture || reviewedSource(store, lesson.reviewer) !== lesson.source)
         throw new Error('Learning source is unavailable.');
     verifyEvidence(store, root, lesson.source, lesson.payload.evidence, JSON.parse(String(capture['catalog'])));
     const run = store.getRun(lesson.source);
-    if ((run?.headRevision ?? run?.baseRevision) !== lesson.payload.head || learningFingerprint(lesson.repo, lesson.payload.head, lesson.payload.paths) !== lesson.payload.fingerprint)
+    if ((run?.headRevision ?? run?.baseRevision) !== lesson.payload.head || learningFingerprint(lesson.repo, lesson.payload.head, lesson.payload.paths, seen) !== lesson.payload.fingerprint)
         throw new Error('Learning source changed.');
 }
 export function learningView(store, root, repo, actor, before = 0) {
@@ -377,15 +386,17 @@ export function learningContext(store, root, runId, phase, now = new Date(), val
     const run = store.getRun(runId), ref = run && store.refForId(run.taskRef), repo = ref?.repo;
     if (!run || !repo)
         return '';
+    // One read of the repository per command for this whole pass, recovery included.
+    const seen = new Map();
     try {
-        recoverLearning(store, root, repo, now);
+        recoverLearning(store, root, repo, now, seen);
         return store.transact(() => {
             if (!store.schemaCurrent() || run.outcome !== null || !['planner', 'builder', 'repair', 'reviewer'].includes(run.role))
                 return '';
             const runner = store.getRunner(run.runner)?.runner;
             if (!runner || runner.retiredAt !== null || !runner.repos.includes(repo) || (phase === 'review') !== (run.role === 'reviewer') || (phase === 'plan') !== (run.role === 'planner'))
                 return '';
-            const identity = learningIdentity(repo);
+            const identity = learningIdentity(repo, seen);
             const existing = store.handle.prepare('SELECT * FROM learning_snapshot WHERE run=?').get(runId);
             if (existing) {
                 if (existing['repo'] !== repo || existing['identity'] !== identity || learningSha(String(existing['payload'])) !== existing['sha'])
@@ -409,11 +420,11 @@ export function learningContext(store, root, runId, phase, now = new Date(), val
                         const l = lessonOf(row);
                         if (!store.handle.prepare("SELECT 1 FROM learning_event WHERE lesson=? AND action='adopt' AND actor=?").get(l.id, l.adoptedBy ?? '') || l.source === source?.id || l.payload.kind !== 'project' || !l.adoptedBy || !store.accountCanAccess(l.adoptedBy, repo) || store.accountOf(l.adoptedBy)?.role !== 'approver' || !l.payload.phases.includes(phase) || l.payload.platform !== process.platform || (!unscopedPlan && !l.payload.paths.some(p => paths.some(t => p === t || p.startsWith(t.replace(/\/$/, '') + '/')))))
                             continue;
-                        supported(store, root, l);
-                        if (l.payload.environment !== environmentFingerprint(store, repo) || learningFingerprint(repo, head, l.payload.paths) !== l.payload.fingerprint)
+                        supported(store, root, l, seen);
+                        if (l.payload.environment !== environmentFingerprint(store, repo) || learningFingerprint(repo, head, l.payload.paths, seen) !== l.payload.fingerprint)
                             continue;
                         const cwd = run.worktree ?? repo;
-                        const dirty = git(cwd, ['status', '--porcelain', '--untracked-files=all']).split('\n').some(line => { const p = line.slice(3); return configPath(p) || l.payload.paths.includes(p); });
+                        const dirty = git(cwd, ['status', '--porcelain', '--untracked-files=all'], seen).split('\n').some(line => { const p = line.slice(3); return configPath(p) || l.payload.paths.includes(p); });
                         if (!dirty)
                             eligible.push(l);
                     }

package/dist/proof.d.ts

@@ -266,7 +266,7 @@ export type VerifyCommandFacts = {
     configured: true;
     ran: false;
     attemptFailed: true;
-    failure?: "spawn-failed" | "timed-out" | "dependency-missing" | "setup-stale" | "setup-failed" | "tracked-files-changed" | "setup-changed-files" | "checkout-moved" | "cleanliness-unavailable" | "dependency-still-missing" | "retry-spawn-failed" | "retry-timed-out" | "custody-lost";
+    failure?: "spawn-failed" | "timed-out" | "dependency-missing" | "setup-stale" | "setup-failed" | "own-install-failed" | "tracked-files-changed" | "setup-changed-files" | "checkout-moved" | "cleanliness-unavailable" | "dependency-still-missing" | "retry-spawn-failed" | "retry-timed-out" | "custody-lost";
 } | {
     configured: true;
     ran: true;
@@ -390,6 +390,8 @@ export type CriterionCoverage = {
      * context: eligible only with the same text, verified ancestry, and
      * byte-identical relevant code. Never a judgement on this run. */
     priorSupport: "eligible" | "invalid" | "none";
+    /** The change's images and other binary files in one line, when it has any. */
+    assets?: string;
 };
 /** v40: the three words an evidence reviewer can say about one signed
  * criterion, and nothing else — `cannot-tell` is a CORRECT answer whenever

package/dist/proof.js

@@ -722,7 +722,7 @@ function assessCapturedEvidence(input) {
             id: criterion.id, statement: criterion.statement, requiredEvidence: criterion.evidence,
             assessment: { evidenceState, detail }, state: evidenceState === "pass" ? "missing" : evidenceState,
             detail: [...detail, `criterion "${criterion.id}" awaits independent goal assessment`], answered, review: null,
-            ...(coverage === undefined ? {} : { coverage: { state: coverage.state, inherited: coverage.inherited, items: [...coverage.items], gaps: [...coverage.gaps], priorSupport: coverage.priorSupport } }),
+            ...(coverage === undefined ? {} : { coverage: { state: coverage.state, inherited: coverage.inherited, items: [...coverage.items], gaps: [...coverage.gaps], priorSupport: coverage.priorSupport, ...(coverage.assets === undefined ? {} : { assets: coverage.assets }) } }),
         };
     });
     return { machineVerdict, verdict: machineVerdict === "refuted" ? "refuted" : "short", matrix,
@@ -761,6 +761,8 @@ function verificationFailureWords(failure) {
                 return "automatic recovery stopped because the project setup or check changed";
             case "setup-failed":
                 return "the approved setup command failed during automatic recovery";
+            case "own-install-failed":
+                return "the checkout's own dependency install failed after its package.json or lockfile changed";
             case "tracked-files-changed":
                 return "automatic recovery stopped because tracked files no longer matched the built result";
             case "setup-changed-files":
@@ -828,7 +830,7 @@ export function adjudicate(input) {
         // must show, never a silent "judged from the patch".
         const coverage = found === undefined
             ? { state: "gap", inherited: false, items: [], gaps: ["the sealed review context carries no coverage entry for this criterion"], priorSupport: "none" }
-            : { state: found.state, inherited: found.inherited, items: [...found.items], gaps: [...found.gaps], priorSupport: found.priorSupport };
+            : { state: found.state, inherited: found.inherited, items: [...found.items], gaps: [...found.gaps], priorSupport: found.priorSupport, ...(found.assets === undefined ? {} : { assets: found.assets }) };
         return { ...row, coverage };
     });
     if (!input.proofArtifactPresent) {

package/dist/provider.js

@@ -169,6 +169,22 @@ const CLAUDE_REVIEW_JSON_SCHEMA = {
                 additionalProperties: false,
             },
         },
+        // The automatic build review's reply (build-review.ts). Shape only;
+        // parseBuildFindings is the validator.
+        findings: {
+            type: "array",
+            items: {
+                type: "object",
+                properties: {
+                    severity: { type: "string", enum: ["HIGH", "MEDIUM", "LOW"] },
+                    file: { type: "string" },
+                    line: { type: "integer", minimum: 1 },
+                    scenario: { type: "string" },
+                },
+                required: ["severity", "file", "line", "scenario"],
+                additionalProperties: false,
+            },
+        },
         // The read request rides the same structured reply channel and
         // session. The machine validates the exact allowlist/hash/range
         // before supplying bytes; this only shapes the request.

package/dist/result-completion.d.ts

@@ -6,6 +6,10 @@
 import type { Store } from "./store.js";
 /** The ledger action a person's (or lead's) completion of a result writes. */
 export declare const COMPLETION_ACTION = "assignment handoff checked";
+/** Whether a task's family is marked complete. Completion is recorded on the
+ * family's root against its current version's latest result, so the root, a
+ * superseded revision and the current version all read Complete together. */
+export declare function familyCompleted(store: Store, taskId: string): boolean;
 /** The files a build changed, renames on both sides; null when the inventory can't be read whole. */
 export declare function changedFilesOf(store: Store, runId: number, root: string): string[] | null;
 /** Everything a result's branch carries: this build's changes and every build of every task it revises (a

package/dist/result-completion.js

@@ -1,6 +1,17 @@
 import { readVerifiedArtifact } from "./evidence.js";
 /** The ledger action a person's (or lead's) completion of a result writes. */
 export const COMPLETION_ACTION = "assignment handoff checked";
+/** Whether a task's family is marked complete. Completion is recorded on the
+ * family's root against its current version's latest result, so the root, a
+ * superseded revision and the current version all read Complete together. */
+export function familyCompleted(store, taskId) {
+    const family = store.taskFamilyOf(taskId, null, true);
+    return store.handle.prepare(`SELECT 1 AS hit FROM action_ledger INDEXED BY work_completion
+    WHERE task_id IN (?, ?) AND action = ? AND source = 'work'
+      AND run_id = (SELECT run.id FROM run INDEXED BY work_result WHERE run.task_ref = ?
+        AND run.finished_at IS NOT NULL AND run.role IN ('builder','scout') ORDER BY run.id DESC LIMIT 1) LIMIT 1`)
+        .get(taskId, family?.root.id ?? taskId, COMPLETION_ACTION, family?.current.refId ?? store.lookupRef(taskId)?.id ?? -1) !== undefined;
+}
 /** The files a build changed, renames on both sides; null when the inventory can't be read whole. */
 export function changedFilesOf(store, runId, root) {
     const stat = store.artifactsFor(runId).find(one => one.kind === "diff-stat");

package/dist/retention-ui.d.ts

@@ -1,7 +1,9 @@
-import { type RetentionCount, type RetentionPeriods } from "./retention.js";
+import { type RetentionCount, type RetentionKind, type RetentionPeriods } from "./retention.js";
 export declare const RETENTION_CSS: string;
+/** `chosen`: the kinds someone chose a period for; the rest keep their default. */
 export type RetentionView = {
     periods: RetentionPeriods;
+    chosen: readonly RetentionKind[];
     next: RetentionCount[];
     lastSweep: string | null;
     csrf: string;

package/dist/retention-ui.js

@@ -4,7 +4,7 @@
  * take a step-up.
  */
 import { bytesWords } from "./storage.js";
-import { PERIOD_CHOICES, RETENTION_KINDS, countWords, periodWords } from "./retention.js";
+import { RETENTION_KINDS, countWords, periodChoices, periodLabel } from "./retention.js";
 const e = (value) => String(value ?? "").replace(/[&<>"']/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
 export const RETENTION_CSS = `.retention{max-width:720px;min-width:0}.retention-next{margin:0 0 16px}` +
     `.retention form{display:grid;gap:0}.retention .kind{display:grid;grid-template-columns:minmax(0,1fr) 11rem;gap:4px 16px;align-items:center;padding:12px 0;border-bottom:1px solid var(--border)}` +
@@ -26,8 +26,8 @@ export function retentionHtml(view, notice) {
     const note = notice.problem ? `<p class="problem" role="alert">${e(notice.problem)}</p>` : notice.said ? `<p role="status">${e(notice.said)}</p>` : "";
     const rows = RETENTION_KINDS.map(({ kind, label, detail }) => {
         const current = view.periods[kind];
-        const choices = PERIOD_CHOICES.includes(current) ? PERIOD_CHOICES : [...PERIOD_CHOICES.slice(0, -1), current, null].sort((a, b) => (a ?? Infinity) - (b ?? Infinity));
-        const options = choices.map(days => `<option value="${days === null ? "forever" : days}"${days === current ? " selected" : ""}>${days === null ? "Forever" : `${periodWords(days)[0].toUpperCase()}${periodWords(days).slice(1)}`}</option>`).join("");
+        const chosen = view.chosen.includes(kind);
+        const options = periodChoices(kind, current).map(days => `<option value="${days === null ? "forever" : days}"${days === current ? " selected" : ""}>${e(periodLabel(kind, days, chosen || days !== current))}</option>`).join("");
         return `<div class="kind" data-kind="${kind}"><label class="name" for="keep-${kind}">${e(label)}</label><p class="meta">${e(detail)}</p><select id="keep-${kind}" name="${kind}">${options}</select></div>`;
     }).join("");
     const last = view.lastSweep === null ? "" : ` Last sweep ${e(view.lastSweep.slice(0, 10))}.`;
@@ -35,5 +35,5 @@ export function retentionHtml(view, notice) {
         `<form method="post" action="/settings/retention"><input type="hidden" name="csrf" value="${e(view.csrf)}">${rows}` +
         `<label class="step-up">Your Toolroll password<input type="password" name="password" autocomplete="current-password" required></label>` +
         `<button type="submit">Save</button></form>` +
-        `<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results not yet completed, anything on hold).</p></article>`;
+        `<p class="meta">Never removed: the action ledger, and anything a task still needs (unfinished tasks, results Ready for review, anything on hold).</p></article>`;
 }

package/dist/retention.d.ts

@@ -1,5 +1,8 @@
-import type { Store } from "./store.js";
-export declare const RETENTION_SCHEMA = "\nCREATE TABLE IF NOT EXISTS retention_setting (\n  kind       TEXT PRIMARY KEY CHECK (kind IN ('evidence', 'checkouts', 'chat', 'notifications')),\n  -- NULL is forever; a row only exists once someone chose.\n  days       INTEGER CHECK (days IS NULL OR (days >= 7 AND days <= 3650)),\n  updated_by TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n";
+import type { Database, Store } from "./store.js";
+export declare const RETENTION_SCHEMA: string;
+/** A file from before 1-day evidence keeps `days >= 7` in its CHECK: rebuild the table with the wider one, keeping
+ * every row, in one transaction. A file already widened is untouched. */
+export declare function widenRetentionSchema(db: Database): void;
 export type RetentionKind = "evidence" | "checkouts" | "chat" | "notifications";
 export type RetentionPeriods = Record<RetentionKind, number | null>;
 export declare const RETENTION_KINDS: readonly {
@@ -7,19 +10,23 @@ export declare const RETENTION_KINDS: readonly {
     label: string;
     detail: string;
 }[];
-/** The periods the page offers; the command line takes any number of days from 7 to 3650. */
-export declare const PERIOD_CHOICES: readonly (number | null)[];
-export declare const MIN_DAYS = 7;
+export declare const PERIOD_CHOICES: Readonly<Record<RetentionKind, readonly (number | null)[]>>;
+export declare const MIN_DAYS = 1;
 export declare const MAX_DAYS = 3650;
 /** A sweep is due once a day. */
 export declare const SWEEP_EVERY_MS = 86400000;
 /** At most this many runs, messages, notifications or records go per kind per sweep; the next sweep takes the rest. */
 export declare const SWEEP_BATCH = 2000;
-export declare const FOREVER: RetentionPeriods;
+/** What each kind keeps until someone chooses: evidence 28 days, everything else forever. */
+export declare const DEFAULT_PERIODS: RetentionPeriods;
 export declare function isRetentionKind(value: string): value is RetentionKind;
 /** "forever", or a number of days ("90", "90d"), weeks ("12w") or years ("1y"); undefined when it's none of those or out of range. */
 export declare function parsePeriod(text: string): number | null | undefined;
 export declare function periodWords(days: number | null): string;
+/** What the page offers for `kind`, with `current` among them (in order) when it was set some other way. */
+export declare function periodChoices(kind: RetentionKind, current: number | null): readonly (number | null)[];
+/** A period as the page and `retention show` say it: "28 days (default)" when nobody chose, "30 days (custom)" when it's not one the page offers. */
+export declare function periodLabel(kind: RetentionKind, days: number | null, chosen: boolean): string;
 export type RetentionCount = {
     kind: RetentionKind;
     days: number | null;

package/dist/retention.js

@@ -1,9 +1,10 @@
 /**
  * Retention (v105): how long Toolroll keeps run evidence and logs,
- * finished checkouts' records, chat messages and notifications. Each kind
- * keeps everything ("forever") until an instance operator chooses a period;
- * a daily sweep then deletes what is older than it and writes one action
- * ledger entry saying what went and about how much space it freed.
+ * finished checkouts' records, chat messages and notifications. Until an
+ * instance operator chooses a period, evidence is kept 28 days and every
+ * other kind forever; a daily sweep deletes what is older than its period
+ * and writes one action ledger entry saying what went and about how much
+ * space it freed.
  *
  * Never deleted, whatever the settings: the action ledger (it is append-only),
  * and anything a task still needs. A task still needs its things until it is
@@ -21,24 +22,47 @@ import { join } from "node:path";
 import { RETENTION_NOTE } from "./evidence.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
 import { bytesWords, treeBytes } from "./storage.js";
-export const RETENTION_SCHEMA = `
-CREATE TABLE IF NOT EXISTS retention_setting (
+const RETENTION_TABLE = (name) => `
+CREATE TABLE IF NOT EXISTS ${name} (
   kind       TEXT PRIMARY KEY CHECK (kind IN ('evidence', 'checkouts', 'chat', 'notifications')),
   -- NULL is forever; a row only exists once someone chose.
-  days       INTEGER CHECK (days IS NULL OR (days >= 7 AND days <= 3650)),
+  days       INTEGER CHECK (days IS NULL OR (days >= 1 AND days <= 3650)),
   updated_by TEXT NOT NULL,
   updated_at TEXT NOT NULL
 );
 `;
+export const RETENTION_SCHEMA = RETENTION_TABLE("retention_setting");
+/** A file from before 1-day evidence keeps `days >= 7` in its CHECK: rebuild the table with the wider one, keeping
+ * every row, in one transaction. A file already widened is untouched. */
+export function widenRetentionSchema(db) {
+    const row = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'retention_setting'").get();
+    if (row === undefined || !/days\s*>=\s*7\b/.test(String(row["sql"])))
+        return;
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        db.exec(RETENTION_TABLE("retention_setting_next"));
+        db.exec("INSERT INTO retention_setting_next (kind, days, updated_by, updated_at) SELECT kind, days, updated_by, updated_at FROM retention_setting");
+        db.exec("DROP TABLE retention_setting");
+        db.exec("ALTER TABLE retention_setting_next RENAME TO retention_setting");
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}
 export const RETENTION_KINDS = [
     { kind: "evidence", label: "Run evidence and logs", detail: "Diffs, check logs, screenshots and reports saved for each run" },
     { kind: "checkouts", label: "Finished checkout records", detail: "Records of build checkouts that were let go and are no longer on disk" },
     { kind: "chat", label: "Chat messages", detail: "Messages in lead and team chats" },
     { kind: "notifications", label: "Notifications", detail: "Delivered or dismissed notifications" },
 ];
-/** The periods the page offers; the command line takes any number of days from 7 to 3650. */
-export const PERIOD_CHOICES = [30, 90, 180, 365, 730, null];
-export const MIN_DAYS = 7;
+/** The periods the page offers for each kind; the command line takes any number of days from 1 to 3650. */
+const LONG_CHOICES = [30, 90, 180, 365, 730, null];
+export const PERIOD_CHOICES = {
+    evidence: [1, 7, 14, 28, null], checkouts: LONG_CHOICES, chat: LONG_CHOICES, notifications: LONG_CHOICES,
+};
+export const MIN_DAYS = 1;
 export const MAX_DAYS = 3650;
 const DAY_MS = 86_400_000;
 /** A sweep is due once a day. */
@@ -46,7 +70,8 @@ export const SWEEP_EVERY_MS = DAY_MS;
 /** At most this many runs, messages, notifications or records go per kind per sweep; the next sweep takes the rest. */
 export const SWEEP_BATCH = 2000;
 const SWEEP_CURSOR = "retention:last-sweep";
-export const FOREVER = { evidence: null, checkouts: null, chat: null, notifications: null };
+/** What each kind keeps until someone chooses: evidence 28 days, everything else forever. */
+export const DEFAULT_PERIODS = { evidence: 28, checkouts: null, chat: null, notifications: null };
 export function isRetentionKind(value) {
     return RETENTION_KINDS.some(one => one.kind === value);
 }
@@ -67,7 +92,20 @@ export function periodWords(days) {
         return "forever";
     if (days % 365 === 0)
         return days === 365 ? "1 year" : `${days / 365} years`;
-    return `${days} days`;
+    return days === 1 ? "1 day" : `${days} days`;
+}
+/** What the page offers for `kind`, with `current` among them (in order) when it was set some other way. */
+export function periodChoices(kind, current) {
+    const offered = PERIOD_CHOICES[kind];
+    return offered.includes(current) ? offered : [...offered, current].sort((a, b) => (a ?? Infinity) - (b ?? Infinity));
+}
+/** A period as the page and `retention show` say it: "28 days (default)" when nobody chose, "30 days (custom)" when it's not one the page offers. */
+export function periodLabel(kind, days, chosen) {
+    const words = periodWords(days);
+    const label = `${words[0].toUpperCase()}${words.slice(1)}`;
+    if (!chosen)
+        return `${label} (default)`;
+    return PERIOD_CHOICES[kind].includes(days) ? label : `${label} (custom)`;
 }
 /** Tasks that no longer need anything kept: cancelled, or done with their result marked complete; not on hold, not
  * running, not a release candidate, and no revision below it (at any depth) still unfinished — cancelled or completed,

package/dist/review-context.d.ts

@@ -121,6 +121,9 @@ export type CriterionContextCoverage = {
     items: string[];
     gaps: string[];
     priorSupport: "eligible" | "invalid" | "none";
+    /** One line for the change's images and other binary files, which are
+     * never read as text and so are neither items nor gaps. */
+    assets?: string;
 };
 export type ReviewContextInventory = {
     schema: 1 | 2 | 3;

package/dist/review-context.js

@@ -43,7 +43,7 @@ import { isVerificationReceipt } from "./verification-evidence.js";
  */
 import { createHash } from "node:crypto";
 import { hasForbiddenControls } from "./decision.js";
-import { EVIDENCE_CAPS, readVerifiedArtifact, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
+import { EVIDENCE_CAPS, isBinaryAssetPath, isImagePath, readVerifiedArtifact, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
 import { parseProof } from "./proof.js";
 /** Explicit bounds. Content bytes are UTF-8 of the stored (possibly
  * redacted) text; the aggregate is the sum over every stored item. */
@@ -420,7 +420,8 @@ export function parseReviewContext(raw) {
         const c = one;
         if (!str(c["id"], 64) || coverageIds.has(c["id"]) || (c["state"] !== "patch" && c["state"] !== "context" && c["state"] !== "gap") ||
             typeof c["inherited"] !== "boolean" || !strList(c["paths"], 200) || !strList(c["items"], r["schema"] === 3 ? contentLimits.items : 64) || !strList(c["gaps"], r["schema"] === 3 ? 400 : 64) ||
-            (c["priorSupport"] !== "eligible" && c["priorSupport"] !== "invalid" && c["priorSupport"] !== "none")) {
+            (c["priorSupport"] !== "eligible" && c["priorSupport"] !== "invalid" && c["priorSupport"] !== "none") ||
+            (c["assets"] !== undefined && !str(c["assets"], 300))) {
             return { ok: false, problem: `coverage ${index}: malformed` };
         }
         if (c["items"].some(id => !ids.has(id) || !items.find(item => item.id === id)?.criteria.includes(String(c["id"]))))
@@ -431,6 +432,7 @@ export function parseReviewContext(raw) {
         coverage.push({
             id: c["id"], state: c["state"], inherited: c["inherited"], paths: [...c["paths"]],
             items: [...c["items"]], gaps: [...c["gaps"]], priorSupport: c["priorSupport"],
+            ...(c["assets"] === undefined ? {} : { assets: c["assets"] }),
         });
     }
     return {
@@ -499,6 +501,32 @@ async function treeEntries(git, cwd, revision, paths) {
     }
     return entries;
 }
+/** "12 images, 3.4 MB, in the run's evidence": every binary file at the head
+ * in one line. Files deleted by the change are not counted. */
+async function assetSummary(git, cwd, head, assets) {
+    const sizes = new Map();
+    const paths = [...assets].filter(safeContextPath);
+    for (let at = 0; at < paths.length; at += 500) {
+        const listed = await treeEntries(git, cwd, head, paths.slice(at, at + 500));
+        for (const [path, entry] of listed ?? [])
+            if (regular(entry))
+                sizes.set(path, entry.size);
+    }
+    if (sizes.size === 0)
+        return null;
+    const images = [...sizes.keys()].filter(isImagePath).length;
+    const others = sizes.size - images;
+    const plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
+    const counted = [...(images > 0 ? [plural(images, "image")] : []), ...(others > 0 ? [plural(others, images > 0 ? "other binary file" : "binary file")] : [])].join(", ");
+    return `${counted}, ${assetBytesWords([...sizes.values()].reduce((sum, one) => sum + one, 0))}, in the run's evidence`;
+}
+function assetBytesWords(bytes) {
+    if (bytes >= 1024 * 1024)
+        return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+    if (bytes >= 1024)
+        return `${Math.round(bytes / 1024)} KB`;
+    return `${bytes} bytes`;
+}
 function regular(entry) {
     return entry !== undefined && entry.type === "blob" && ["100644", "100755"].includes(entry.mode) && SHA1.test(entry.object) && Number.isSafeInteger(entry.size) && entry.size >= 0;
 }
@@ -822,11 +850,22 @@ export async function deriveReviewContext(store, git, args, lineage) {
                 gapAll("capture-failed", "the committed source paths in the approved scope could not be listed");
         }
     }
+    // Files named as images or other binaries are never text context: they are
+    // counted in one summary line, never listed as gaps or held against the
+    // bounds. A text-named file that turns out not to be text stays a gap.
+    const assets = new Set();
+    const textOnly = (paths) => paths.filter(path => {
+        if (!isBinaryAssetPath(path))
+            return true;
+        assets.add(path);
+        return false;
+    });
+    generalPaths.splice(0, generalPaths.length, ...textOnly(generalPaths));
     const specificFor = new Map();
     for (const criterion of sourceProof?.criteria ?? []) {
         const cited = [...new Set(criterion.evidence.filter(one => one.kind === "changed-path").map(one => one.ref))].filter(safeContextPath).sort();
         const inherited = parentContext?.coverage.find(one => one.id === criterion.id)?.paths ?? [];
-        const combined = [...new Set([...cited, ...inherited])].filter(safeContextPath).sort();
+        const combined = textOnly([...new Set([...cited, ...inherited])].filter(safeContextPath).sort());
         if (combined.length > 0)
             specificFor.set(criterion.id, combined);
     }
@@ -852,7 +891,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
     // A proof's path citations are relevance hints, not permission to omit other
     // changed files. Deliver new revision files and tests in full as supplemental
     // context without inventing criterion ownership or inheriting a judgement.
-    for (const path of args.patchPaths) {
+    for (const path of textOnly([...args.patchPaths])) {
         if (safeContextPath(path) && !relevance.has(path))
             relevance.set(path, { criteria: new Set(), why: new Set(["candidate-changed-path"]) });
     }
@@ -965,6 +1004,7 @@ export async function deriveReviewContext(store, git, args, lineage) {
         }
     }
     inventory.items = [...itemsByPath.values()];
+    const assetLine = await assetSummary(git, args.worktree, args.head, assets);
     // 6. Prior review provenance — context, proved per criterion, never a verdict.
     const sourceDiff = sourceArtifacts.find(one => one.kind === "terminal-diff") ?? null;
     const sourceProofArtifact = sourceArtifacts.find(one => one.kind === "proof") ?? null;
@@ -1039,5 +1079,5 @@ export async function deriveReviewContext(store, git, args, lineage) {
         const gapsFor = state === "gap" && relevantGaps.length === 0 ? [plan.paths.length === 0 ? "no relevant source paths are known" : "inherited context is incomplete"] : relevantGaps;
         return { id: plan.id, state, inherited: plan.inherited && lineage.sourceRun !== args.runId, paths: plan.paths, items, gaps: gapsFor, priorSupport };
     });
-    return finish(coverage);
+    return finish(assetLine === null ? coverage : coverage.map(one => ({ ...one, assets: assetLine })));
 }

package/dist/review-switch.d.ts

@@ -0,0 +1,41 @@
+/** The per-project automatic review switch and the one review each finished
+ * build gets (build-review.ts runs it): tables, and the read-only views every
+ * surface shows. No schema version bump. Kept free of heavy imports so the
+ * status readers can use it without an import cycle. */
+import type { Store } from "./store.js";
+export type FindingSeverity = "HIGH" | "MEDIUM" | "LOW";
+/** One automatic-review finding: how bad, where, and how it fails. */
+export type BuildFinding = {
+    severity: FindingSeverity;
+    file: string;
+    line: number;
+    scenario: string;
+};
+export declare const REVIEW_SCHEMA = "\n-- A project's explicit review switch. No row: on while the project is under a hands-off mode, off otherwise.\nCREATE TABLE IF NOT EXISTS review_switch (\n  repo        TEXT PRIMARY KEY,\n  enabled     INTEGER NOT NULL CHECK (enabled IN (0, 1)),\n  changed_by  TEXT NOT NULL,\n  changed_at  TEXT NOT NULL\n);\n-- One row per reviewed build run: pending until its one reviewer run settles it.\nCREATE TABLE IF NOT EXISTS build_review (\n  run           INTEGER PRIMARY KEY,\n  task_id       TEXT NOT NULL,\n  repo          TEXT NOT NULL,\n  state         TEXT NOT NULL CHECK (state IN ('pending', 'reviewed', 'not-reviewed')),\n  request       INTEGER,\n  reviewer_run  INTEGER,\n  findings_json TEXT,\n  reason        TEXT,\n  sent_back_as  TEXT,\n  queued_at     TEXT NOT NULL,\n  finished_at   TEXT\n);\nCREATE INDEX IF NOT EXISTS build_review_pending ON build_review (repo) WHERE state = 'pending';\nCREATE INDEX IF NOT EXISTS build_review_sent_back ON build_review (sent_back_as) WHERE sent_back_as IS NOT NULL;\n";
+export type ReviewSwitch = {
+    on: boolean;
+    source: "project" | "hands-off" | "default";
+    changedBy: string | null;
+    changedAt: string | null;
+};
+/** How the policy log words a switch state. */
+export declare function reviewSwitchWords(state: ReviewSwitch): string;
+export type BuildReviewView = {
+    run: number;
+    state: "pending" | "reviewed" | "not-reviewed";
+    reviewerRun: number | null;
+    /** Why it was not reviewed, in words. */
+    reason: string | null;
+    /** HIGH findings; they sent the task back when `sentBackAs` is set. */
+    high: BuildFinding[];
+    /** MEDIUM and LOW findings: suggested follow-ups, never blocking. */
+    followUps: BuildFinding[];
+    sentBackAs: string | null;
+    finishedAt: string | null;
+};
+export declare function buildReviewOf(store: Pick<Store, "handle">, runId: number): BuildReviewView | null;
+export declare const findingWords: (finding: BuildFinding) => string;
+/** The review's standing in one line, or null while nothing was asked. */
+export declare function buildReviewHeadline(view: BuildReviewView | null): string | null;
+/** Plain lines for `task show` and `assignment show`. */
+export declare function buildReviewLines(view: BuildReviewView | null): string[];