toolroll 0.9.71 → 0.9.72

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## 0.9.72 — 2026-10-25
+
+- **One approval per release.** A person approves a release once. Later
+  commits on the same pull request carry that approval only when every change
+  since is unit tests, journey scripts, Markdown under docs/, the README or
+  the changelog, within 400 changed lines, 20 files and 800 lines of churn,
+  and the production build is byte-for-byte the approved one. Anything else
+  asks again, and so does any change after the deploy has started. The
+  approval sheet states the release and what asks again; the release summary
+  and the squash message list every commit that landed after the approval.
+  **Stop carrying later commits** on the task page (or `toolroll release
+  revoke`) ends it, and `toolroll release ask-every-commit on` makes a
+  project's releases ask for every commit. A release approval expires after
+  3 days.
+- **Re-checks of a release re-run only what failed.** On the second and later
+  release checks, only the failed unit files, journey groups and upgrade
+  versions run again, with every test changed since and a short sanity pass.
+  A check that can't prove it covered everything counts as failed, and a
+  test that disappears or is newly skipped stops carrying.
+- **A nightly full check of main.** `toolroll release nightly --repo <path>`
+  sets up a daily full check of main (03:00 local by default). A failure
+  becomes an attention notice naming what failed, holds re-checks that run
+  only part of the suite until a full check passes it again, and a nightly
+  that hasn't run for 26 hours says so.
+- **Sandboxed checks can start Chromium on macOS.** Playwright's default
+  browser (its Chromium headless shell) now starts inside the check sandbox:
+  the sandbox may register and look up Chromium's port rendezvous service,
+  `org.chromium.Chromium.MachPortRendezvousServer.<pid>`, and nothing else.
+  Builds, flows and tool servers don't get this; SECURITY.md says what a
+  hostile check could do with it. A project set to **Not sandboxed** only for
+  a headless browser check can go back to **Sandboxed** in Settings → Project
+  → Check access. Chrome for Testing (`channel: "chromium"`, headed runs)
+  still needs **Not sandboxed**.
+- **Checks with sign-ins no longer reach your keychain.** Toolroll reads
+  Claude Code's and gh's sign-ins from the keychain itself, outside the
+  sandbox, and hands the check just those tokens in its environment. A check
+  gets Claude's current access token and can't renew it.
+- **A wrong password on an approval says "That password didn't match."**
+  instead of "not approved: not-an-approver". Someone who isn't an approver
+  gets the same answer.
+- **Closing a live terminal signals only its own processes.** It stops them
+  before it kills them, so a child one starts at that moment can't slip out
+  from under the close; each signal goes only to a process still the one it
+  saw (same pid, same start); and after the program ends, its terminal's
+  name no longer counts as proof, since the device may already be someone
+  else's. A process it can't prove is its own is never signalled, and the
+  close says it's uncertain (the worktree stays).
+- **Only a person approves work.** The lead's token used to approve a task's
+  scope and be recorded as its owner's password approval, including on a
+  release. Now `task approve` (and `task repair --yes`) with a lead token, or
+  any approval made with a remote API token, is refused: "Only a person can
+  approve this." Approve on the task page or from your paired chat
+  (docs/plans/approval-policy.md, phase 1; the setting that lets the lead
+  approve, recorded as the lead's, comes next).
+- **Only a person merges by hand.** `task merge` (including `--anyway`) and
+  the merge button refuse a lead or API token. A flow's Pull request zone
+  merges only after a person's recorded decision; a subagent's approval, or
+  a decision from before decisions recorded who made them, waits.
+- **Protected work counts only people.** A vote a machine credential left, or
+  one with no proof on record, doesn't count as one of the two people, and a
+  lead or API token's completion is never the second person. A person can
+  mark an already-complete result complete again to release a held push.
+- **Releases and deployments need a person's approval with its proof on
+  record.** The release gate and `deploy-browser.mjs` (every phase, resumed
+  ones included) refuse an approval a lead token made, a mode, a flow, a
+  standing order, or an approval with no recorded proof. `toolroll release` proves the
+  candidate in its own runtime, and that the checkout is exactly that commit,
+  before it runs anything from the candidate's checkout. Paired-chat
+  approvals now record their own proof, so they still count. Update the
+  plane before running `toolroll release`: an older plane can't say who
+  approved, and the release waits.
+- Approvals a lead token made before this change are read for what they were:
+  they no longer dispatch, and the task asks for a person's approval. Seals
+  with no recorded authority stand on nothing. A standing order's firing is
+  approved by its own authority (`schedule`), which stands only while its
+  approver can still approve in the project.
+- Schema v134 and v135 only add columns and tables; `toolroll update` runs
+  them in place.
+
 ## 0.9.71 — 2026-10-25
 
 - **Sandboxed launches can open a terminal of their own on macOS.** A check

package/dist/agent-fence.d.ts

@@ -93,9 +93,12 @@ export type FenceGrants = {
     /** macOS: the project's sealed mach services beyond the runtime's baseline (its `allowMachLookup`). */
     machLookup?: string[];
     /** macOS: the keychain's services (securityd), denied to every launch without it (sandbox-runtime.ts
-     * SEATBELT_NO_KEYCHAIN). Only fenceFor gives it, to a build's agent; a check with sign-ins is given it at its launch
-     * (invoke.ts). Never a tool server's (serverGrantsOf). */
+     * SEATBELT_NO_KEYCHAIN). Only fenceFor gives it, to a build's agent. Never a check's (one with sign-ins gets those in
+     * its environment, invoke.ts keychainSignIns), never a tool server's (serverGrantsOf). */
     keychain?: true;
+    /** macOS: a project check's launch, whose Chromium may start (sandbox-runtime.ts SEATBELT_CHROMIUM). Only fenceFor
+     * sets it, only for kind "check". */
+    browser?: true;
     /** A `sign-ins` check's exact sign-in files, read again inside the home denies (check-access.ts, signInGrants). */
     signIns?: SignInGrants;
     /** Never written, wherever the launch writes (homeWriteDenies): what runs for the operator next or signs them in. */

package/dist/agent-fence.js

@@ -12,7 +12,7 @@
  * checkout writable; other tasks' checkouts read, never written; the project's read-deny list; under policy v1 (an
  * approval sealed before 0.9.70) the home configuration denied by name; a sign-ins check's exact files read again; the
  * run's proxy as its only way out when its network is confined. On macOS every launch also gets a pseudo-terminal of its
- * own and no other terminal, and only a build's agent (and a check with sign-ins) reaches the keychain
+ * own and no other terminal, a project check's launch Chromium's own service, and only a build's agent the keychain
  * (sandbox-runtime.ts seatbeltRulesFor, static rules).
  *
  * Codex (every platform) fences its own agent's commands with its own sandbox: a permission profile with the same
@@ -985,6 +985,7 @@ export function srtTermsOf(fence, grants = NO_GRANTS) {
         readConfig,
         writeConfig: { allowOnly: [...new Set(allowOnly)].sort(), denyWithinAllow: [...denyWrite].sort() },
         allowMachLookup: [...grants.machLookup ?? [], ...grants.signIns?.mach ?? []],
+        ...(grants.browser === true ? { browser: true } : {}),
         ...(grants.keychain === true ? { keychain: true } : {}),
         network: network === undefined || network.mode === "open" ? { kind: "open" } : {
             kind: "proxy", httpPort: network.proxyPort, ...(network.brokerPorts[0] === undefined ? {} : { socksPort: network.brokerPorts[0] }),
@@ -1088,6 +1089,8 @@ export function fenceFor(kind, ctx) {
         ...(written === null ? {} : { writes: written.writes, readOnly: [...new Set([...made.readOnly, ...written.readOnly])].sort() }),
         ...(ctx.network === undefined ? {} : { network: ctx.network }),
         ...(ctx.machLookup === undefined || ctx.machLookup.length === 0 ? {} : { machLookup: [...ctx.machLookup] }),
+        // A project's checks may drive a browser (Playwright's Chromium); builds, flows and tool servers don't get it.
+        ...(kind === "check" ? { browser: true } : {}),
         // A build's agent signs in from the keychain (Claude Code does); nothing else it launches reaches it.
         ...(kind === "build" ? { keychain: true } : {}),
         // Under a write allowlist these are out of reach already; where the launch writes anywhere, they are denied by name.
@@ -1232,7 +1235,7 @@ export function homeWriteDenies(home, binding, provider, platform = process.plat
  * where it always has), and never the build's own checkout or launch folder read back (nothing a build wrote loads in a
  * process that holds a tool's secrets). */
 export function serverGrantsOf(grants) {
-    const { network: _agentOnly, writes: _agentWrites, keychain: _agentKeychain, ...rest } = grants;
+    const { network: _agentOnly, writes: _agentWrites, keychain: _agentKeychain, browser: _checkOnly, ...rest } = grants;
     return {
         ...rest,
         ...(rest.pool === undefined ? {} : { pool: { ...rest.pool, own: null } }),

package/dist/approval-authority.d.ts

@@ -0,0 +1,20 @@
+/** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
+ * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
+ * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
+export declare const authorityStandsSql: (scope: string, repo: string, now: string) => string;
+/** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
+ * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */
+export declare const carrySealSql: (scope: string) => string;
+/**
+ * SQL: a task that belongs to a release authority (its anchor, or a carried commit) dispatches only as the current
+ * generation's tip while the release is open and unexpired, with the anchor's approver still an active approver who
+ * can reach the project and the anchor's approval on its exact sealed digest. A task that belongs to no release passes.
+ * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides.
+ */
+export declare const releaseStandsSql: (scope: string, now: string) => string;
+/** SQL: a machine made this seal — any proof at the seal's instant that isn't a person's (whatever its detail says,
+ * parsed or not: fail closed), or the lead's own approval act then. */
+export declare const machineSealSql: (scope: string) => string;
+/** SQL: a person's proof at the seal's instant for these exact bytes, its detail parsed (the versioned JSON record,
+ * whitespace and all, or the legacy text). */
+export declare const personSealSql: (scope: string) => string;

package/dist/approval-authority.js

@@ -0,0 +1,67 @@
+/**
+ * Which approval authorities stand, as ONE SQL predicate every dispatch belt shares (docs/plans/approval-policy.md
+ * §1.5): the queue's dispatch query, the work index, and the claim and build belts (`Store.modeApprovalLive`).
+ *
+ * An allowlist, never a deny-list: a person's yes (`password`, `chat`) stands unless a machine made that seal; a mode
+ * or a flow grant stands while its signature does; a standing order's firing (`schedule`, or an old firing stored as
+ * `password`) stands while its approver can still approve in the project. Everything else — the lead (`lead`, which
+ * phase 1 never lets stand), a null basis, a word this code doesn't write — stands on nothing.
+ *
+ * The seal's origin is read from the acts recorded AT the seal's own instant, exactly as scope.ts sealOriginOf reads
+ * it: an older proof for the same bytes never vouches for a later seal.
+ */
+import { grantStandsSql } from "./flow-unattended.js";
+import { accountReachesSql } from "./project-access.js";
+/** The proofs a person gives (src/person-proof.ts), as an SQL list. */
+const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey')";
+/** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
+ * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
+ * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
+export const authorityStandsSql = (scope, repo, now) => `COALESCE((((COALESCE(${scope}.approval_basis, '') IN ('password', 'chat') AND NOT ${machineSealSql(scope)}
+        AND (${personSealSql(scope)} OR NOT ${automationSql(scope)} OR ${approverStandsSql(scope, repo)}))
+    OR (${scope}.approval_basis = 'carried' AND ${carrySealSql(scope)})
+    OR (${scope}.approval_basis = 'mode' AND EXISTS (SELECT 1 FROM operating_mode om
+          JOIN approver signer ON signer.name = om.signed_by
+         WHERE om.repo = ${repo} AND om.revoked_at IS NULL AND om.absolute_expiry > ${now} AND om.digest = ${scope}.mode_digest
+           AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", repo)}))
+    OR (${scope}.approval_basis = 'grant' AND ${grantStandsSql(`${scope}.mode_digest`, now, repo)})
+    OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)}))
+    AND ${releaseStandsSql(scope, now)}), 0)`;
+/** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
+ * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */
+export const carrySealSql = (scope) => `EXISTS (SELECT 1 FROM release_carry rc2 JOIN release_authority ra2 ON ra2.id = rc2.authority
+      WHERE rc2.task_id = ${scope}.task_id AND rc2.scope_digest = ${scope}.approved_digest AND rc2.to_sha = ${scope}.candidate
+        AND ${scope}.mode_digest = ra2.id || ':' || rc2.id)`;
+/**
+ * SQL: a task that belongs to a release authority (its anchor, or a carried commit) dispatches only as the current
+ * generation's tip while the release is open and unexpired, with the anchor's approver still an active approver who
+ * can reach the project and the anchor's approval on its exact sealed digest. A task that belongs to no release passes.
+ * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides.
+ */
+export const releaseStandsSql = (scope, now) => `((NOT EXISTS (SELECT 1 FROM release_authority rx WHERE rx.anchor_task = ${scope}.task_id)
+      AND NOT EXISTS (SELECT 1 FROM release_carry cx WHERE cx.task_id = ${scope}.task_id))
+    OR EXISTS (SELECT 1 FROM release_authority ra WHERE ra.tip_task = ${scope}.task_id AND ra.state = 'open' AND ra.expires_at > ${now}
+        AND (ra.anchor_task = ${scope}.task_id OR EXISTS (SELECT 1 FROM release_carry rc WHERE rc.authority = ra.id AND rc.task_id = ${scope}.task_id))
+        AND NOT EXISTS (SELECT 1 FROM release_authority rn WHERE rn.repo = ra.repo AND rn.version = ra.version AND rn.pr = ra.pr AND rn.generation > ra.generation)
+        AND EXISTS (SELECT 1 FROM task_scope an JOIN approver ap ON ap.name = an.approved_by
+            WHERE an.task_id = ra.anchor_task AND an.approved_digest = ra.anchor_digest AND an.digest = ra.anchor_digest
+              AND ap.revoked_at IS NULL AND ap.role = 'approver' AND ${accountReachesSql("ap", "ra.repo")})))`;
+/** SQL: a machine made this seal — any proof at the seal's instant that isn't a person's (whatever its detail says,
+ * parsed or not: fail closed), or the lead's own approval act then. */
+export const machineSealSql = (scope) => `(EXISTS (SELECT 1 FROM action_ledger mp WHERE mp.task_id = ${scope}.task_id AND mp.action = 'approval proved'
+       AND mp.actor = ${scope}.approved_by AND mp.at = ${scope}.approved_at AND mp.outcome NOT IN ${PERSON_PROOFS})
+    OR EXISTS (SELECT 1 FROM task_act la JOIN task_ref lr ON lr.id = la.task_ref AND lr.backend = 'built-in'
+       WHERE lr.external_id = ${scope}.task_id AND la.act = 'approved' AND la.lead = 1
+         AND la.account = ${scope}.approved_by AND la.at = ${scope}.approved_at))`;
+/** SQL: a person's proof at the seal's instant for these exact bytes, its detail parsed (the versioned JSON record,
+ * whitespace and all, or the legacy text). */
+export const personSealSql = (scope) => `EXISTS (SELECT 1 FROM action_ledger pp WHERE pp.task_id = ${scope}.task_id AND pp.action = 'approval proved'
+      AND pp.actor = ${scope}.approved_by AND pp.at = ${scope}.approved_at AND pp.outcome IN ${PERSON_PROOFS}
+      AND CASE WHEN json_valid(pp.detail) THEN json_extract(pp.detail, '$.v') = 1 AND json_type(pp.detail, '$.digest') = 'text'
+                                            AND json_extract(pp.detail, '$.digest') = ${scope}.approved_digest
+               ELSE pp.detail LIKE '% · generation % · digest ' || ${scope}.approved_digest END)`;
+/** SQL: the task a standing order's firing filed (its own record of the firing). */
+const automationSql = (scope) => `EXISTS (SELECT 1 FROM flow_trigger_event fe WHERE fe.task = ${scope}.task_id)`;
+/** SQL: the seal's approver can still approve in the project. */
+const approverStandsSql = (scope, repo) => `EXISTS (SELECT 1 FROM approver sched WHERE sched.name = ${scope}.approved_by AND sched.revoked_at IS NULL AND sched.role = 'approver'
+      AND ${accountReachesSql("sched", repo)})`;

package/dist/assignment.js

@@ -4,10 +4,10 @@
 import { createHash } from "node:crypto";
 import { currentActor, withActor } from "./actor.js";
 import { replacedWords } from "./task-status.js";
-import { COMPLETER_ACTOR, COMPLETION_ACTION, familyChangedFiles, landedReasonOf } from "./result-completion.js";
+import { COMPLETER_ACTOR, COMPLETION_ACTION, COMPLETION_BY_MACHINE, COMPLETION_BY_PERSON, familyChangedFiles, landedReasonOf, personCompletionOwed } from "./result-completion.js";
 import { homedir } from "node:os";
 import { readSchemaVersion, stopFactOf } from "./store.js";
-import { approvalOf } from "./scope.js";
+import { approvalOf, liveReleaseOf, machineActing } from "./scope.js";
 import { openWorkDecisionOf, taskWorkSummaryOf, workDecisionAction } from "./work-summary.js";
 import { evidenceRoot, readVerifiedArtifact, readVerifiedReport, verifyArtifact } from "./evidence.js";
 import { sweepIfMoved } from "./sweep-gate.js";
@@ -119,6 +119,10 @@ function buildChecks(store, root, runId) {
         if (receipt === null)
             return { ...unavailable(level === "off" ? "Checks were off for this build." : "No machine check is recorded."), status: "not-run" };
         const ran = receipt.result.ran === true, exitCode = ran ? receipt.result.exitCode : null;
+        // A release check whose coverage fell short (release-once.md) failed, whatever its command exited with.
+        if (receipt.result.failure === "coverage-incomplete")
+            return { status: "failed", exitCode: null, command: receipt.command.command, logArtifactId: receipt.log.artifactId, level,
+                detail: "Checks didn't cover everything this release owed, or a required test went missing." };
         // The sealed receipt names the grant that ran: the quick one, or the full one.
         const sealedLevel = typeof receipt.command?.repo === "string" && receipt.command.repo.startsWith("quick:") ? "quick" : "full";
         const words = sealedLevel === "quick" ? "Quick checks" : "Checks";
@@ -450,8 +454,19 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
     if (!/^[a-f0-9]{64}$/.test(receiptDigest) || current.receipt?.digest !== receiptDigest)
         return { ok: false, reason: "stale", message: "The result changed. Read the current assignment before checking it." };
     const receipt = current.receipt;
+    // The nightly check of main is a check only (release-once.md, part 3): nobody completes it.
+    if (store.handle.prepare("SELECT 1 AS hit FROM nightly_check WHERE task = ?").get(current.receipt.taskId) !== undefined)
+        return { ok: false, reason: "check-only", message: "The nightly check of main is only a check; it isn't completed." };
     if (current.state !== "ready-to-check" && current.state !== "complete")
         return { ok: false, reason: "not-ready", message: "This assignment still has unresolved execution, scope or decisions." };
+    // A release task completes only while its release approval stands for it (release-once.md, liveReleaseOf).
+    const release = liveReleaseOf(store, current.receipt.taskId, "complete", now);
+    if (release.applies && !release.ok)
+        return { ok: false, reason: "release", message: `This release can't be completed: ${release.why}.` };
+    // Who is completing, from trusted context (approval policy §1.7a): a person, or a machine credential (the lead's
+    // token, a remote API run) that may complete ordinary work but is never the second person on protected work.
+    const person = actor.startsWith("operator:") && !machineActing() ? actor.slice("operator:".length) : null;
+    const marked = actor.startsWith("operator:") ? (person === null ? COMPLETION_BY_MACHINE : COMPLETION_BY_PERSON) : null;
     if (current.state !== "complete") {
         // The one readiness guard: a failed or missing required check, an unresolved requirement or HIGH finding refuses.
         const blockers = current.readiness?.blockers ?? [];
@@ -459,11 +474,11 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
             return { ok: false, reason: "not-ready", message: blockers.map(one => one.message).join(" ") };
         // v102: declared paths are only a promise. A result whose actual diff reaches protected files, on a
         // scope one person approved, completes only by someone else — two people have then seen the work.
-        const problem = store.protectedResultProblem(receipt.taskId, familyChangedFiles(store, receipt.taskId, receipt.runId, root), actor.startsWith("operator:") ? actor.slice("operator:".length) : null);
+        const problem = store.protectedResultProblem(receipt.taskId, familyChangedFiles(store, receipt.taskId, receipt.runId, root), person);
         if (problem !== null)
             return { ok: false, reason: "approval-rules", message: problem };
         store.recordAction({ at: now.toISOString(), actor, repo: current.repo,
-            taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work" });
+            taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work", detail: marked });
         const ref = store.lookupRef(current.rootId);
         // Whose act this is, even outside a command that named its person: the operator who marked it.
         const by = currentActor() ?? (actor.startsWith("operator:") ? { account: actor.slice("operator:".length), lead: false } : null);
@@ -471,6 +486,13 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
             store.noteTaskAct(ref.id, "completed", now, undefined, by);
         store.bumpWake();
     }
+    else if (person !== null && personCompletionOwed(store, receipt.taskId, receipt.runId, receiptDigest, person, root)) {
+        // Already complete, but no person's completion is on record that lets protected work publish (a machine's, or one
+        // from before completions said who made them): this person's completion is recorded now (approval policy §1.7a).
+        store.recordAction({ at: now.toISOString(), actor, repo: current.repo,
+            taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work", detail: COMPLETION_BY_PERSON });
+        store.bumpWake();
+    }
     const assignment = assignmentOf(store, current.rootId, now, access, root);
     noteAssignmentStatus(store, assignment, now);
     return { ok: true, assignment };