toolroll 0.9.70 → 0.9.72

package/dist/contracts/verification-receipt.d.ts

@@ -5,12 +5,15 @@
  * command, the retained log and a reused gate's source — are checked in plain code after parsing.
  *
  * Version 1 is a gate executed in its own run. Version 2 added `reusedFrom` and `executedHere: false` for a gate
- * reused by an unchanged observation follow-up. A direct receipt is still sealed as version 1, so its bytes (and the
- * digests bound to them) read the same in every Toolroll that reads receipts.
+ * reused by an unchanged observation follow-up. Version 3 (docs/plans/release-once.md) is a release check: it keeps
+ * the raw exit (`result`) apart from `coverage` — `full`, `composed` (a targeted run composed with the full check A),
+ * `partial` (never passes) or `identity-removed` (a required test went away; asks again) — names the sealed check
+ * artifacts, and for a composed check every link its reader proves again. A direct receipt is still sealed as version 1,
+ * so its bytes (and the digests bound to them) read the same in every Toolroll that reads receipts.
  */
 import { z } from "zod";
 import { type ContractResult } from "./contract.js";
-export declare const VERIFICATION_FAILURES: readonly ["spawn-failed", "timed-out", "dependency-missing", "setup-stale", "setup-failed", "own-install-failed", "tracked-files-changed", "setup-changed-files", "checkout-moved", "cleanliness-unavailable", "dependency-still-missing", "retry-spawn-failed", "retry-timed-out", "custody-lost"];
+export declare const VERIFICATION_FAILURES: readonly ["spawn-failed", "timed-out", "dependency-missing", "setup-stale", "setup-failed", "own-install-failed", "tracked-files-changed", "setup-changed-files", "checkout-moved", "cleanliness-unavailable", "dependency-still-missing", "retry-spawn-failed", "retry-timed-out", "custody-lost", "coverage-incomplete"];
 /**
  * What the repository's approved verification command did: not configured; configured but the run could not attempt
  * it (`attemptFailed`, which downgrades to `short` rather than `refuted`: "we could not check" is not "the claim is
@@ -25,6 +28,7 @@ export declare const verifyCommandFactsSchema: z.ZodUnion<readonly [z.ZodObject<
     failure: z.ZodOptional<z.ZodEnum<{
         "checkout-moved": "checkout-moved";
         "cleanliness-unavailable": "cleanliness-unavailable";
+        "coverage-incomplete": "coverage-incomplete";
         "custody-lost": "custody-lost";
         "dependency-missing": "dependency-missing";
         "dependency-still-missing": "dependency-still-missing";
@@ -71,10 +75,12 @@ export declare const receiptLogSchema: z.ZodObject<{
         ok: "ok";
     }>>;
 }, z.core.$strict>;
-export declare const RECEIPT_VERSION = 2;
+export declare const RECEIPT_VERSION = 3;
+export declare const RECEIPT_COVERAGES: readonly ["full", "composed", "partial", "identity-removed"];
+export type ReceiptCoverage = typeof RECEIPT_COVERAGES[number];
 /** The receipt as read: a reused gate names its source run and digest; a direct one names neither. */
 export declare const verificationReceiptSchema: z.ZodObject<{
-    version: z.ZodLiteral<2>;
+    version: z.ZodLiteral<3>;
     run: z.ZodInt;
     head: z.ZodString;
     base: z.ZodNullable<z.ZodString>;
@@ -105,6 +111,7 @@ export declare const verificationReceiptSchema: z.ZodObject<{
         failure: z.ZodOptional<z.ZodEnum<{
             "checkout-moved": "checkout-moved";
             "cleanliness-unavailable": "cleanliness-unavailable";
+            "coverage-incomplete": "coverage-incomplete";
             "custody-lost": "custody-lost";
             "dependency-missing": "dependency-missing";
             "dependency-still-missing": "dependency-still-missing";
@@ -136,13 +143,40 @@ export declare const verificationReceiptSchema: z.ZodObject<{
             ok: "ok";
         }>>;
     }, z.core.$strict>;
+    coverage: z.ZodOptional<z.ZodEnum<{
+        composed: "composed";
+        full: "full";
+        "identity-removed": "identity-removed";
+        partial: "partial";
+    }>>;
+    check: z.ZodOptional<z.ZodObject<{
+        attempt: z.ZodEnum<{
+            full: "full";
+            targeted: "targeted";
+        }>;
+        report: z.ZodNullable<z.ZodString>;
+        inventory: z.ZodNullable<z.ZodString>;
+        exitCode: z.ZodOptional<z.ZodNullable<z.ZodInt>>;
+    }, z.core.$strict>>;
+    composed: z.ZodOptional<z.ZodObject<{
+        base: z.ZodInt;
+        baseReceipt: z.ZodString;
+        baseReport: z.ZodString;
+        authority: z.ZodInt;
+        carries: z.ZodArray<z.ZodInt>;
+        artifacts: z.ZodString;
+        plan: z.ZodString;
+        snapshot: z.ZodString;
+        report: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type VerificationReceipt = z.infer<typeof verificationReceiptSchema>;
-/** A version 1 receipt read as version 2: the same fields. Reuse is a version 2 field; a version 1 receipt naming it
- * is refused by its reader, which still knows the version it was sealed as. */
+/** A version 1 or 2 receipt read as version 3: the same fields. Reuse is a version 2 field and coverage a version 3
+ * one; a receipt naming a field newer than it was sealed as is refused by its reader, which still knows the version. */
 export declare function upgradeDirectReceipt(body: Record<string, unknown>): Record<string, unknown>;
 export declare const RECEIPT_UPGRADES: {
     readonly 1: typeof upgradeDirectReceipt;
+    readonly 2: typeof upgradeDirectReceipt;
 };
-/** Read a receipt: version 2 as itself, version 1 as a direct gate, a newer one refused plainly. */
+/** Read a receipt: version 3 as itself, 1 and 2 upgraded, a newer one refused plainly. */
 export declare function readVerificationReceipt(input: unknown): ContractResult<VerificationReceipt>;

package/dist/contracts/verification-receipt.js

@@ -5,8 +5,11 @@
  * command, the retained log and a reused gate's source — are checked in plain code after parsing.
  *
  * Version 1 is a gate executed in its own run. Version 2 added `reusedFrom` and `executedHere: false` for a gate
- * reused by an unchanged observation follow-up. A direct receipt is still sealed as version 1, so its bytes (and the
- * digests bound to them) read the same in every Toolroll that reads receipts.
+ * reused by an unchanged observation follow-up. Version 3 (docs/plans/release-once.md) is a release check: it keeps
+ * the raw exit (`result`) apart from `coverage` — `full`, `composed` (a targeted run composed with the full check A),
+ * `partial` (never passes) or `identity-removed` (a required test went away; asks again) — names the sealed check
+ * artifacts, and for a composed check every link its reader proves again. A direct receipt is still sealed as version 1,
+ * so its bytes (and the digests bound to them) read the same in every Toolroll that reads receipts.
  */
 import { z } from "zod";
 import { readVersioned, versioned } from "./contract.js";
@@ -25,6 +28,8 @@ export const VERIFICATION_FAILURES = [
     "retry-spawn-failed",
     "retry-timed-out",
     "custody-lost",
+    // A release check that didn't cover what it owed, or lost a required test (release-once.md): never a pass.
+    "coverage-incomplete",
 ];
 /**
  * What the repository's approved verification command did: not configured; configured but the run could not attempt
@@ -59,7 +64,8 @@ export const receiptLogSchema = z.strictObject({
     redacted: z.boolean(),
     captureStatus: z.enum(["ok", "failed"]).nullable(),
 });
-export const RECEIPT_VERSION = 2;
+export const RECEIPT_VERSION = 3;
+export const RECEIPT_COVERAGES = ["full", "composed", "partial", "identity-removed"];
 const receiptFields = {
     run: z.int(),
     head: z.string(),
@@ -74,14 +80,25 @@ export const verificationReceiptSchema = versioned(RECEIPT_VERSION, {
     command: receiptCommandSchema,
     result: verifyCommandFactsSchema,
     log: receiptLogSchema,
+    /** Version 3: what the check covered, apart from its exit. */
+    coverage: z.enum(RECEIPT_COVERAGES).optional(),
+    /** Version 3: the attempt sealed before the check ran, and its sealed report (null: it gave none). */
+    check: z.strictObject({ attempt: z.enum(["full", "targeted"]), report: z.string().nullable(), inventory: z.string().nullable(),
+        /** The command's own exit, kept here when `result` reads a failed attempt because the coverage fell short. */
+        exitCode: z.int().min(0).max(255).nullable().optional() }).optional(),
+    /** Version 3, composed: the full check A and every link the reader proves again. */
+    composed: z.strictObject({
+        base: z.int().min(1), baseReceipt: z.string(), baseReport: z.string(), authority: z.int().min(1), carries: z.array(z.int()),
+        artifacts: z.string(), plan: z.string(), snapshot: z.string(), report: z.string(),
+    }).optional(),
 });
-/** A version 1 receipt read as version 2: the same fields. Reuse is a version 2 field; a version 1 receipt naming it
- * is refused by its reader, which still knows the version it was sealed as. */
+/** A version 1 or 2 receipt read as version 3: the same fields. Reuse is a version 2 field and coverage a version 3
+ * one; a receipt naming a field newer than it was sealed as is refused by its reader, which still knows the version. */
 export function upgradeDirectReceipt(body) {
     return { ...body, version: RECEIPT_VERSION };
 }
-export const RECEIPT_UPGRADES = { 1: upgradeDirectReceipt };
-/** Read a receipt: version 2 as itself, version 1 as a direct gate, a newer one refused plainly. */
+export const RECEIPT_UPGRADES = { 1: upgradeDirectReceipt, 2: upgradeDirectReceipt };
+/** Read a receipt: version 3 as itself, 1 and 2 upgraded, a newer one refused plainly. */
 export function readVerificationReceipt(input) {
     return readVersioned(verificationReceiptSchema, input, RECEIPT_UPGRADES);
 }

package/dist/contracts/verification-view.d.ts

@@ -39,6 +39,7 @@ export declare const legacyGateViewSchema: z.ZodObject<{
         failure: z.ZodOptional<z.ZodEnum<{
             "checkout-moved": "checkout-moved";
             "cleanliness-unavailable": "cleanliness-unavailable";
+            "coverage-incomplete": "coverage-incomplete";
             "custody-lost": "custody-lost";
             "dependency-missing": "dependency-missing";
             "dependency-still-missing": "dependency-still-missing";

package/dist/deploy-gate.d.ts

@@ -0,0 +1,17 @@
+import type { Store } from "./store.js";
+export type DeploymentGate = {
+    ok: true;
+    taskId: string;
+    head: string;
+    repo: string;
+    approvedBy: string;
+} | {
+    ok: false;
+    message: string;
+};
+/** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
+export declare function deploymentGate(store: Store, input: {
+    runId: number;
+    evidenceRoot: string;
+    now: Date;
+}): DeploymentGate;

package/dist/deploy-gate.js

@@ -0,0 +1,68 @@
+/**
+ * The deployment gate, in the runtime that is releasing (docs/plans/approval-policy.md §1.7): whether a candidate run
+ * may be deployed at all — a person approved its scope, its exact result passed the approved check and was marked
+ * complete, and nothing still blocks it. `toolroll release` asks this BEFORE it starts anything from the candidate's
+ * checkout, so the candidate's own scripts never decide their own deployment. (scripts/deploy-candidate.mjs keeps the
+ * same checks for the deployment script, proven again there with the installed runtime's modules.)
+ */
+import { assignmentOf } from "./assignment.js";
+import { liveReleaseOf, personApprovalOf } from "./scope.js";
+import { verificationEvidence } from "./verification-evidence.js";
+/** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
+export function deploymentGate(store, input) {
+    const refuse = (message) => ({ ok: false, message });
+    const run = store.getRun(input.runId);
+    const ref = run === null ? null : store.refById(run.taskRef);
+    const scope = ref === null ? null : store.getScope(ref.externalId);
+    const head = run?.headRevision ?? null;
+    if (run === null || ref === null || head === null)
+        return refuse(`Run ${input.runId} is not a built candidate.`);
+    // `task regate` reruns the approved check on the last built commit and records no-change: a candidate only for that commit.
+    const regated = run.outcome === "no-change" && scope?.candidate === head &&
+        store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built")?.headRevision === head;
+    if (run.role !== "builder" || !(run.outcome === "built" || regated))
+        return refuse(`Run ${input.runId} is not a built candidate at ${head.slice(0, 7)}.`);
+    if (scope === null || scope.approvedDigest !== scope.digest || scope.digest !== run.scopeDigest)
+        return refuse("The run's signed scope is no longer the approved one.");
+    // One approval per release (release-once.md): a release's task deploys only while its authority stands for it — the
+    // live predicate proves the anchor's person approval (a carried commit's own seal is never a person's). Any other task
+    // needs a person's approval of its own.
+    const release = liveReleaseOf(store, ref.externalId, "deploy", input.now);
+    if (release.applies && !release.ok)
+        return refuse(`This release can't deploy: ${release.why}.`);
+    const anchorPerson = release.applies && release.ok ? personApprovalOf(store, release.authority.anchorTask) : null;
+    const person = anchorPerson ?? personApprovalOf(store, ref.externalId);
+    if (!person.ok)
+        return refuse(`A person has to approve this candidate's scope: ${person.why}.`);
+    const evidence = verificationEvidence(store, input.evidenceRoot, input.runId);
+    if (!evidence.ok || evidence.bytes === null)
+        return refuse(`Native check unavailable: ${evidence.ok ? "no receipt" : evidence.problem}.`);
+    let gate;
+    try {
+        gate = JSON.parse(evidence.bytes.toString());
+    }
+    catch {
+        return refuse("The native check's receipt can't be read.");
+    }
+    const live = ref.repo === null ? null : store.liveVerifyCommand(ref.repo);
+    const result = gate["result"];
+    // A release check's coverage (receipt version 3): partial or identity-removed never deploys, whatever the exit.
+    if (gate["coverage"] !== undefined && gate["coverage"] !== "full" && gate["coverage"] !== "composed")
+        return refuse(`The release check didn't cover this candidate (${String(gate["coverage"])}).`);
+    const command = gate["command"];
+    if (gate["run"] !== input.runId || gate["head"] !== head || gate["scopeDigest"] !== scope.digest || result?.ran !== true || result.exitCode !== 0
+        || live === null || command?.command !== live.command)
+        return refuse("The native check did not pass this candidate under the currently approved command.");
+    const assignment = assignmentOf(store, ref.externalId, input.now, { principal: "operator", repos: null, includeUnplaced: true }, input.evidenceRoot);
+    if (assignment?.state !== "complete" || assignment.receipt?.runId !== input.runId || assignment.receipt.head !== head
+        || assignment.receipt.scopeDigest !== scope.digest || assignment.completion?.digest !== assignment.receipt.digest)
+        return refuse("The lead or user has not marked this exact result complete.");
+    const blockers = assignment.readiness?.blockers;
+    if (!Array.isArray(blockers))
+        return refuse("The result's readiness could not be read.");
+    if (blockers.length > 0)
+        return refuse(`This result isn't ready to deploy: ${blockers.map(one => one.message).join(" ")}`);
+    if (ref.repo === null)
+        return refuse("The candidate's task is in no project.");
+    return { ok: true, taskId: ref.externalId, head, repo: ref.repo, approvedBy: person.by };
+}

package/dist/dispatch.js

@@ -6,6 +6,7 @@
  * fleet observations on top for people and agents reading the queue. A
  * diagnosis can go stale; it can never grant a lease.
  */
+import { authorityStandsSql } from "./approval-authority.js";
 import { isAlive } from "./runner.js";
 import { updateAdmissionPaused, UPDATE_PAUSED } from "./desktop-update-gate.js";
 import { approvalOf } from "./scope.js";
@@ -15,8 +16,6 @@ import { REVIEW_TOKENS, resultStatusOf, reviewFactsOf } from "./workspace-ui.js"
 import { replacedWords } from "./task-status.js";
 import { failedAttemptSentence, latestFinishedAttempt } from "./needs-you.js";
 import { buildReviewOf } from "./review-switch.js";
-import { grantStandsSql } from "./flow-unattended.js";
-import { accountReachesSql } from "./project-access.js";
 import { BUILT_IN, parseCapabilityKey } from "./store.js";
 export const DEFAULT_MAX_OPEN_DECISIONS = 5;
 /**
@@ -77,14 +76,8 @@ export function scopeApprovedForDispatch(store, taskRef, now) {
         .prepare(`SELECT 1 AS hit FROM task_scope
        JOIN task_ref ON task_ref.id = ? AND task_scope.task_id = task_ref.external_id
        WHERE task_scope.approved_digest = task_scope.digest AND task_scope.approved_at IS NOT NULL
-         AND (COALESCE(task_scope.approval_basis, 'password') NOT IN ('mode', 'grant')
-           OR (task_scope.approval_basis = 'mode' AND EXISTS (SELECT 1 FROM operating_mode om
-                      JOIN approver signer ON signer.name = om.signed_by
-                     WHERE om.repo = task_ref.repo AND om.revoked_at IS NULL
-                       AND om.absolute_expiry > ? AND om.digest = task_scope.mode_digest
-                       AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", "task_ref.repo")}))
-           OR (task_scope.approval_basis = 'grant' AND ${grantStandsSql("task_scope.mode_digest", "?", "task_ref.repo")}))`)
-        .get(taskRef, now.toISOString(), now.toISOString());
+         AND ${authorityStandsSql("task_scope", "task_ref.repo", "?")}`)
+        .get(taskRef, now.toISOString(), now.toISOString(), now.toISOString());
     return row !== undefined;
 }
 /** The phase the ordinary dispatch loop would choose before it resolves an

package/dist/dispose.js

@@ -19,6 +19,7 @@ import { modeTermsFromJson } from "./modes.js";
 import { evidenceRoot, readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
 import { queueBuildReview } from "./build-review.js";
 import { homedir } from "node:os";
+import { nightlyTaskRef, releaseTaskRef } from "./store.js";
 import {} from "./proof.js";
 import { verificationEvidence, failedVerificationEvidence } from "./verification-evidence.js";
 import { classifyGateFailure, describeGateFailure, gateFailureSummary } from "./gate-failure.js";
@@ -162,7 +163,9 @@ function disposeBuildOutcomeLocked(context, result) {
                     grant.publishOn !== "complete" &&
                     headSha !== null &&
                     headWithin(branch, grant.headPrefix) &&
-                    (grant.selector === "all" || origin === "ours")) {
+                    (grant.selector === "all" || origin === "ours") &&
+                    // A nightly check or a release's task is never published (store.createPublicationIntent refuses both).
+                    !nightlyTaskRef(store, taskRef) && !releaseTaskRef(store, taskRef)) {
                     const intentId = store.createPublicationIntent({
                         run: runId,
                         taskRef,

package/dist/evidence-pack.d.ts

@@ -49,7 +49,7 @@ export type EvidencePack = {
                 by: string;
                 at: string;
                 digest: string;
-                basis: "person" | "mode" | "flow";
+                basis: "person" | "lead" | "mode" | "flow" | "schedule" | "carried" | "unknown";
                 current: boolean;
             } | null;
             writtenBy: {

package/dist/evidence-pack.js

@@ -15,6 +15,7 @@ import { rulesWords } from "./approval-policy.js";
 import { assignmentOf } from "./assignment.js";
 import { projectName } from "./project.js";
 import { changedFilesOf } from "./result-completion.js";
+import { approvalProofOf, personProof } from "./scope.js";
 import { html, htmlString, joinHtml, styleElement } from "./html.js";
 export const EVIDENCE_PACK_FORMAT = "standing-orders/evidence-pack/v1";
 /** How to recheck one entry's seal, for whoever reads the JSON. */
@@ -55,7 +56,7 @@ export function evidencePack(store, taskId, access, who, now, evidenceRoot, chec
                 goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, acceptance: scope.acceptance.map(one => ({ id: one.id, statement: one.statement })),
                 budgetUsd: scope.budgetMicrousd === null ? null : scope.budgetMicrousd / 1_000_000, digest: scope.digest,
                 approved: scope.approvedBy === null || scope.approvedAt === null || scope.approvedDigest === null ? null
-                    : { by: scope.approvedBy, at: scope.approvedAt, digest: scope.approvedDigest, basis: scope.approvalBasis === "mode" ? "mode" : scope.approvalBasis === "grant" ? "flow" : "person", current: scope.approvedDigest === scope.digest },
+                    : { by: scope.approvedBy, at: scope.approvedAt, digest: scope.approvedDigest, basis: approvalBasisWord(store, version.id, scope.approvalBasis ?? null, scope.approvedBy, scope.approvedDigest), current: scope.approvedDigest === scope.digest },
                 writtenBy: history.authors,
                 approvals: history.votes,
             },
@@ -206,7 +207,7 @@ export function evidencePackHtml(pack) {
                 ...(scope.touches.length ? [["Touches", joinHtml(scope.touches, ", ")]] : []),
                 ...(scope.acceptance.length ? [["Acceptance", html `<ol class="criteria">${scope.acceptance.map(one => html `<li>${one.statement}</li>`)}</ol>`]] : []),
                 ...(scope.writtenBy.length ? [["Scope written by", joinHtml([...new Set(scope.writtenBy.map(one => one.author))], ", ")]] : []),
-                ["Approved", approved === null ? html `Not approved` : html `${approved.by}${approved.basis === "mode" ? " (operating mode)" : approved.basis === "flow" ? " (flow runs on its own)" : ""} · ${when(approved.at)}${approved.current ? "" : " · the scope changed after this"}`],
+                ["Approved", approved === null ? html `Not approved` : html `${approved.by}${approved.basis === "mode" ? " (operating mode)" : approved.basis === "flow" ? " (flow runs on its own)" : approved.basis === "lead" ? " (the lead, not a person)" : approved.basis === "schedule" ? " (standing order)" : approved.basis === "carried" ? " (carried from their release approval)" : approved.basis === "unknown" ? " (no person's proof on record)" : ""} · ${when(approved.at)}${approved.current ? "" : " · the scope changed after this"}`],
                 ...(approvals.length > 1 ? [["Approvals", joinHtml(approvals.map(one => html `${one.approver} · ${when(one.at)}`), html `<br>`)]] : []),
                 ["Scope digest", short(scope.digest)],
             ]),
@@ -252,3 +253,20 @@ export function standaloneEvidenceHtml(pack) {
     return htmlString(html `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Evidence pack · ${pack.task.id}</title>${styleElement(css)}</head><body>${evidencePackHtml(pack)}</body></html>
 `);
 }
+/** Who approved, in the pack's words (approval policy §1.5): `person` only when a person's proof stands behind it. */
+function approvalBasisWord(store, taskId, basis, by, digest) {
+    if (basis === "mode")
+        return "mode";
+    if (basis === "grant")
+        return "flow";
+    if (basis === "schedule")
+        return "schedule";
+    // A later release commit carried under a person's release approval (release-once.md): never a person's own yes.
+    if (basis === "carried")
+        return "carried";
+    if (basis === "lead")
+        return "lead";
+    if (basis === "password" || basis === "chat")
+        return personProof(approvalProofOf(store, taskId, by, digest)?.method) ? "person" : "unknown";
+    return "unknown";
+}

package/dist/evidence.d.ts

@@ -201,6 +201,7 @@ export declare function storeEvidence(store: Store, root: string, runId: number,
     redacted?: boolean;
     captureStatus?: "ok" | "failed";
     sourceBytesOriginal?: number;
+    cap?: number;
 }): number;
 /**
  * Read an artifact's bytes back, believing nothing until it is proved on the

package/dist/evidence.js

@@ -397,7 +397,8 @@ export function imageDimensions(bytes, kind) {
  * store the caller passed — inside whatever transaction the caller holds.
  */
 export function storeEvidence(store, root, runId, kind, name, content, capture, now, options = {}) {
-    const cap = EVIDENCE_CAPS[kind];
+    // `cap`: a sealed structured payload with its own documented bound (a release check's report: 256 KiB), never above 1 MiB.
+    const cap = options.cap === undefined ? EVIDENCE_CAPS[kind] : Math.min(options.cap, 1024 * 1024);
     const stored = content.subarray(0, cap);
     // Some callers that deliberately summarize/bound a source before storage
     // may still report its true original size. This keeps `truncated` honest

package/dist/flow-engine.js

@@ -6,6 +6,8 @@
  * waits for people. See flows.ts for what each zone does.
  */
 import { assignmentOf } from "./assignment.js";
+import { currentActor } from "./actor.js";
+import { activeRemote } from "./remote-run.js";
 import { diagnoseTaskDispatch } from "./dispatch.js";
 import { passOn, TEXT_LIMITS } from "./text-limits.js";
 import { deciderOf, durationWords, fillFlowText, flowGoal, flowValueLabel, flowWorkTemplate, validateFlowDefinition, withinHours } from "./flows.js";
@@ -528,7 +530,9 @@ export function decideFlowCard(store, input, now) {
             ledger("approved");
             return { ok: true, said: "Approved. The card is done." };
         }
-        if (!store.moveFlowCard(card.id, { to: stage.next, outcome: "approved", actor: input.actor, note: input.note, expectEntry: card.entry }, now))
+        // Who decided, from trusted context (approval policy §1.7): only a person's approval lets a Pull request zone merge.
+        const authority = input.subagent !== undefined ? "subagent" : currentActor()?.lead === true ? "lead" : activeRemote() !== null ? "remote" : "person";
+        if (!store.moveFlowCard(card.id, { to: stage.next, outcome: "approved", actor: input.actor, note: input.note, expectEntry: card.entry, authority }, now))
             return { ok: false, message: "That card has moved on since; nothing was changed." };
         ledger("approved");
         const title = definition.stages.find(one => one.id === stage.next)?.title ?? stage.next;

package/dist/flow-pull-request.d.ts

@@ -5,7 +5,10 @@ export type PullRequestIo = {
     gh: Runner;
     evidenceRoot?: string;
 };
-/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so. */
-export declare function approvedSinceBuild(store: Store, definition: FlowDefinition, card: FlowCardRow): string | null;
+/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so.
+ * The MOST RECENT decision governs (approval policy §1.7): it must be a person's recorded decision, after the card's
+ * last build by the current definition AND after the exact build being merged finished (`builtAt`), so editing the
+ * flow can't let an older person decision stand behind a newer machine one. */
+export declare function approvedSinceBuild(store: Store, definition: FlowDefinition, card: FlowCardRow, builtAt?: string | null): string | null;
 /** One pass of a Pull request zone for one card. Returns whether it changed anything. */
 export declare function pullRequestStep(store: Store, flow: FlowRow, definition: FlowDefinition, stage: FlowStage, card: FlowCardRow, now: Date, io: PullRequestIo): Promise<boolean>;

package/dist/flow-pull-request.js

@@ -19,15 +19,24 @@ import { adoptPublishedPullRequest } from "./publish.js";
 import { failingCheckOf, mergePullRequest, owePullRequest, pullRequestBlocker, pullRequestFollowOf } from "./pull-request-flow.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
-/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so. */
-export function approvedSinceBuild(store, definition, card) {
+/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so.
+ * The MOST RECENT decision governs (approval policy §1.7): it must be a person's recorded decision, after the card's
+ * last build by the current definition AND after the exact build being merged finished (`builtAt`), so editing the
+ * flow can't let an older person decision stand behind a newer machine one. */
+export function approvedSinceBuild(store, definition, card, builtAt = null) {
     const kindOf = (id) => definition.stages.find(one => one.id === id)?.kind ?? null;
     const events = store.flowEvents(card.id);
     let built = -1;
     events.forEach((event, index) => { if (kindOf(event.fromStage) === "task" || kindOf(event.toStage) === "task")
         built = index; });
-    const approval = events.slice(built + 1).reverse().find(event => event.outcome === "approved" && kindOf(event.fromStage) === "approval");
-    return approval === undefined ? null : approval.actor;
+    // The latest DECISION of any kind governs: only decideFlowCard writes `approved` or `sent-back` (from a decision
+    // zone), whatever the zones are called now, so a send-back after a yes takes that yes back.
+    const latest = events.slice(built + 1).reverse().find(event => event.outcome === "approved" || event.outcome === "sent-back");
+    if (latest === undefined || latest.authority !== "person")
+        return null;
+    if (builtAt !== null && latest.at < builtAt)
+        return null;
+    return latest.actor;
 }
 /** One pass of a Pull request zone for one card. Returns whether it changed anything. */
 export async function pullRequestStep(store, flow, definition, stage, card, now, io) {
@@ -134,7 +143,7 @@ export async function pullRequestStep(store, flow, definition, stage, card, now,
     // Checks pass.
     if (stage.merge === undefined)
         return passed(`${pr} passed its checks.`, `Pull request: ${link} (checks passed)`);
-    const approver = approvedSinceBuild(store, definition, card);
+    const approver = approvedSinceBuild(store, definition, card, store.getRun(runId)?.finishedAt ?? null);
     if (approver === null)
         return waiting(`Checks passed on ${pr}, but no person approved this card since it was built, so it wasn't merged. Merge it from its task, or send it through a decision.`);
     const merged = await mergePullRequest(store, { runId, by: `${approver} (approved in ${flow.name})`, exec: io.gh, method: stage.merge, clock: () => now });

package/dist/flow-schedule.js

@@ -14,6 +14,7 @@ import { legOf, routeDigestOf, routeFromJson, routeProblems } from "./phase-rout
 import { canonicalAcceptance, digestOf, parseAcceptanceCriteria, profileDigestOf, profileFromJson } from "./scope.js";
 import { hasDisguisedText, hasForbiddenControls } from "./decision.js";
 import { BUILT_IN, parseCapabilityKey } from "./store.js";
+import { fileNightlyCheck } from "./nightly-check.js";
 export const WEEKDAYS = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
 export function validTimezone(value) {
     if (value.trim() !== value)
@@ -195,10 +196,22 @@ export class StandingOrderRefused extends Error {
  */
 export function fileStandingOrder(store, input, now) {
     const { order, repo } = input;
+    // The nightly full check on main files a check-only task of its own (nightly-check.ts).
+    if (order.check !== undefined)
+        return fileNightlyCheck(store, input, now);
     const blocker = store.standingOrderBlocker(input.trigger, order.routine, now);
     if (blocker !== null)
         return { made: "skipped", note: `Skipped: the last one (${blocker.taskId}, ${blocker.state}) hasn't finished.` };
-    const approval = standingApproval(order, repo, input.schedule);
+    const standing = standingApproval(order, repo, input.schedule);
+    // The carried approval stands only while its approver still can approve here (approval policy §1.6): a demoted
+    // person, one off the project, or an approval that names nobody files an ordinary proposal instead.
+    const approverStands = standing.live && standing.by !== null && (() => {
+        const account = store.accountOf(standing.by);
+        return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(standing.by, repo);
+    })();
+    const approval = standing.live && !approverStands
+        ? { live: false, problem: standing.by === null ? "it names no approver" : "its approver can no longer approve in this project", acceptance: standing.acceptance }
+        : standing;
     if (approval.acceptance === null)
         return { made: "skipped", note: "Skipped: its success checks can't be read. Set the flow up again." };
     if (order.costCeilingUsd !== null) {
@@ -238,11 +251,17 @@ export function fileStandingOrder(store, input, now) {
         store.setRequirements(ref.id, order.requirements);
     const draft = { goal: order.goal, outOfScope: order.outOfScope, touches: [...order.touches], acceptance: approval.acceptance, ...(order.budgetPerRunMicrousd == null ? {} : { budgetMicrousd: order.budgetPerRunMicrousd }) };
     const digest = digestOf(draft, approval.profile, approval.route);
-    store.saveScope({ taskId, ...draft, proposedAt: now.toISOString(), digest, budgetMicrousd: order.budgetPerRunMicrousd ?? null, approvedAt: order.approval.at, approvedBy: approval.by, approvedDigest: digest }, {}, { profile: approval.profile, route: approval.route });
-    const sealed = store.sealScopeApproval(taskId, approval.by ?? "schedule", now, {}, undefined, "automation");
-    const sealedRoute = sealed ? store.sealedRouteOf(taskId) : null;
-    if (!sealed || sealedRoute === null || !sealedRoute.ok || routeDigestOf(sealedRoute.route) !== routeDigestOf(approval.route)) {
-        throw new StandingOrderRefused(!sealed ? "the approval couldn't be sealed" : sealedRoute !== null && !sealedRoute.ok ? sealedRoute.detail : "the sealed agents aren't the approved ones");
+    // Filed unapproved; only the seal below approves it (no approval fields are written beside it).
+    store.saveScope({ taskId, ...draft, proposedAt: now.toISOString(), digest, budgetMicrousd: order.budgetPerRunMicrousd ?? null, approvedAt: null, approvedBy: null, approvedDigest: null }, {}, { profile: approval.profile, route: approval.route });
+    // Its own authority (approval policy §1.6): the standing order's carried approval, never a person's ceremony. A seal
+    // the project's rules refuse to an automatic approval (checks beyond the sandbox, protected work, policy) leaves the
+    // task filed and waiting for a person, as any unapproved firing does — never a dropped firing.
+    const sealed = store.sealScopeApproval(taskId, approval.by, now, {}, { kind: "schedule", modeDigest: order.approval.digest }, "automation");
+    if (!sealed)
+        return { made: "filed", taskId, approved: false, note: "Its approval can't stand on its own here (its checks reach beyond the sandbox, or the project's rules need a person), so this one waits for approval." };
+    const sealedRoute = store.sealedRouteOf(taskId);
+    if (sealedRoute === null || !sealedRoute.ok || routeDigestOf(sealedRoute.route) !== routeDigestOf(approval.route)) {
+        throw new StandingOrderRefused(sealedRoute !== null && !sealedRoute.ok ? sealedRoute.detail : "the sealed agents aren't the approved ones");
     }
     return { made: "filed", taskId, approved: true, note: null };
 }

package/dist/flows-ui.js

@@ -8,6 +8,7 @@ import { SENDER_WORDS } from "./webhook-signing.js";
 import { READER_CAPTURED } from "./webhook-readers.js";
 import { hostOf, linkWords, provedWords, snapshotOf } from "./task-source.js";
 import { deciderOf, FLOW_COLORS, FLOW_KIND_WORDS, FLOW_STAGE_KINDS } from "./flows.js";
+import { nightlyHealthWords } from "./nightly-check.js";
 import { flowInsights, troubleWords } from "./flow-insights.js";
 import { parseSortDecision, sortChip } from "./flow-sort.js";
 import { flowSecretNames, readEmailSettings, sendingReady } from "./flow-actions.js";
@@ -68,7 +69,7 @@ export function flowsListHtml(store, flows, projects, canCreate, problem) {
         const definition = flowDefinitionOf(flow);
         const waiting = cards.filter(card => ["approval", "choose"].includes(definition?.stages.find(one => one.id === card.stage)?.kind ?? "")).length;
         const buttons = store.flowTriggers(flow.id).filter(one => one.state === "active").flatMap(one => { const config = triggerConfigOf(one); return config?.kind === "button" ? [{ id: one.id, label: config.label }] : []; });
-        const trouble = troubleWords(flowInsights(store, flow, new Date(), 7));
+        const trouble = troubleWords(flowInsights(store, flow, new Date(), 7)) ?? nightlyHealthOf(store, flow);
         return html `<article class="card"><div class="flow-row"><h2><a href="/flows/${flow.id}">${flow.name}</a></h2><span class="flow-counts">${projectName(flow.repo)} · ${cards.length} card${cards.length === 1 ? "" : "s"} in progress${waiting > 0 ? ` · ${waiting} waiting for a decision` : ""}${trouble === null ? "" : ` · ${trouble}`}</span></div>${buttons.length > 0 && html `<p class="flow-buttons">${joinHtml(buttons.map(one => html `<a class="button-link" href="/flows/${flow.id}?start=${one.id}">${one.label}</a>`), " ")}</p>`}</article>`;
     });
     const projectField = projects.length === 1 ? html `<input type="hidden" name="repo" value="${projects[0]}">` : html `<label>Project<select name="repo">${projects.map(repo => html `<option value="${repo}">${projectName(repo)}</option>`)}</select></label>`;
@@ -275,3 +276,8 @@ export function flowFallbackHtml(view) {
         return html `<li><strong>${stage.title}</strong> · ${FLOW_KIND_WORDS[stage.kind].label}${cards.length > 0 && html `<ul>${cards.map(card => html `<li>${card.title}${card.waiting !== null && ` — ${card.waiting}`}</li>`)}</ul>`}</li>`;
     })}</ol></section>`;
 }
+/** The nightly check's own health on its flow (release-once.md, part 3): nothing since the last firing for 26 hours. */
+function nightlyHealthOf(store, flow) {
+    const nightly = store.flowTriggers(flow.id).find(one => one.state === "active" && triggerConfigOf(one)?.kind === "schedule" && triggerConfigOf(one).order?.check !== undefined);
+    return nightly === undefined ? null : nightlyHealthWords(store, flow.repo, nightly.updatedAt, new Date());
+}

package/dist/invoke.d.ts

@@ -135,7 +135,25 @@ export declare function fencedCheckoutCommands(store: Store, repo: string, check
  * under: open, or its allowlist through a proxy of its own (on Linux, relayed in by the sandbox runtime). Nothing about it is
  * started unless all of it is.
  */
-export declare function signInsLaunch(store: Store, own: string, temp: string, checkout: string, policy: NetworkProfile, gitPaths: readonly string[], platform?: NodeJS.Platform): Promise<{
+/**
+ * macOS: the sign-ins a check with sign-ins needs that live in the keychain, not in files: Claude Code's
+ * ("Claude Code-credentials", its current access token as CLAUDE_CODE_OAUTH_TOKEN) and gh's ("gh:github.com", as
+ * GH_TOKEN). Read here, by Toolroll, outside the sandbox, and handed to the check in its environment, so the check never
+ * reaches securityd (sandbox-runtime.ts SEATBELT_NO_KEYCHAIN) and nothing else in the keychain. The check can't renew
+ * Claude's token: one that has expired fails its sign-in. A value that isn't a plain token is left out.
+ */
+export declare const KEYCHAIN_SIGN_INS: readonly {
+    service: string;
+    env: string;
+    token(secret: string): string | null;
+}[];
+/** One keychain item's secret by its service, read with the system's `security` (null: none, or it can't be read). A
+ * keychain file may be named (tests: a throwaway one); never the item's value in an argument. */
+export declare function readKeychainSecret(service: string, keychain?: string): string | null;
+/** The keychain's sign-ins as a check's environment (macOS only; elsewhere, for anything missing, and where Toolroll
+ * keeps nothing in the keychain (TOOLROLL_SECRET_STORE=files: the test suite), nothing). */
+export declare function keychainSignIns(platform?: NodeJS.Platform, read?: (service: string) => string | null): Record<string, string>;
+export declare function signInsLaunch(store: Store, own: string, temp: string, checkout: string, policy: NetworkProfile, gitPaths: readonly string[], platform?: NodeJS.Platform, keychain?: () => Record<string, string>): Promise<{
     grants: SignInGrants;
     network: NetworkFence;
     env: Record<string, string>;