toolroll 0.9.71 → 0.9.72

package/dist/scope.js

@@ -571,6 +571,7 @@ export function canonicalAcceptance(criteria) {
         .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
         .map(c => ({ id: c.id, statement: c.statement.trim(), evidence: [...c.evidence].sort() }));
 }
+export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried"];
 /**
  * The exact bytes an operator agreed to.
  *
@@ -615,6 +616,7 @@ route) {
         // like an absent v41 field. Strict is an explicit signed promise.
         ...(scope.qualityMode === "strict" ? { qualityMode: "strict" } : {}),
         ...(scope.candidate ? { candidate: scope.candidate } : {}),
+        ...(scope.releaseTerms == null ? {} : { releaseTerms: releaseTermsDigest(scope.releaseTerms) }),
         // The single outer key, whichever target produced its inner value:
         // absent => the golden and every profileless approval are untouched;
         // a legacy profile => its exact profileDigestOf; an explicit chain
@@ -667,6 +669,7 @@ function proposeLocked(store, input) {
         ...(permissionMode === undefined ? {} : { permissionMode }),
         ...(input.qualityMode === undefined ? {} : { qualityMode: input.qualityMode }),
         ...(posture === undefined ? {} : { posture }),
+        ...(input.releaseTerms === undefined ? {} : { releaseTerms: input.releaseTerms }),
         proposedVia,
     });
     // The store may have RECOMPUTED the digest to bind the resolved profile
@@ -1060,6 +1063,10 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const authenticated = authenticateApprover(store, by, token, store.lookupRef(taskId)?.repo ?? null);
         if (!authenticated.ok)
             return authenticated;
+        // ONLY A PERSON APPROVES (docs/plans/approval-policy.md, phase 1): a lead token or a remote API token proves the
+        // credential, not a person at a ceremony. Refused before any vote or proof row is written.
+        if (!personProof(authenticated.method))
+            return { ok: false, reason: "machine-proof" };
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
@@ -1087,6 +1094,10 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const policy = store.scopePolicyRefusal(taskId);
         if (policy !== null)
             return { ok: false, reason: "policy", message: policy };
+        // A release scope's yes opens its authority record (release-once.md); say first why it can't.
+        const releaseProblem = scope.releaseTerms == null ? null : releaseSealProblem(store, scope.releaseTerms);
+        if (releaseProblem !== null)
+            return { ok: false, reason: "policy", message: releaseProblem };
         const gate = store.approvalGate(taskId, by, "person");
         if (gate.verdict === "refuse")
             return { ok: false, reason: gate.reason };
@@ -1103,7 +1114,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
             // The same person again adds nothing: no new vote, no proof row (and the approval roads refund a re-check).
             if (gate.already)
                 return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: true };
-            store.recordApprovalVote(taskId, scope.digest, by, now);
+            store.recordApprovalVote(taskId, scope.digest, by, now, authenticated.method);
             proved();
             return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: gate.already };
         }
@@ -1113,7 +1124,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         try {
             return store.savepoint(() => {
                 if (gate.protectedWork)
-                    store.recordApprovalVote(taskId, scope.digest, by, now);
+                    store.recordApprovalVote(taskId, scope.digest, by, now, authenticated.method);
                 // SEAL, never re-resolve: the approval snapshots the stored working
                 // profile — the exact bytes the digest the approver signed was bound
                 // to. Routing saveScope here would re-run resolution and could sign a
@@ -1143,10 +1154,10 @@ export const approvalProofDetail = (at, generation, digest) => `${new Date(at).t
 export function approvalProofOf(store, taskId, by, digest) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);
     for (const row of rows) {
-        const parts = typeof row["detail"] === "string" ? row["detail"].split(" · ") : [];
-        if (parts.length !== 3 || parts[2] !== `digest ${digest}` || Number.isNaN(Date.parse(parts[0])))
+        const read = proofDetailOf(row["detail"]);
+        if (read === null || read.digest !== digest)
             continue;
-        return { method: String(row["outcome"]), at: parts[0] };
+        return { method: String(row["outcome"]), at: read.at };
     }
     return null;
 }
@@ -1161,7 +1172,7 @@ export function freshlyApprovable(store, taskId, scope, singleApprover) {
     if (ref === undefined || ref["coordinator_cid"] != null)
         return false;
     const via = store.handle.prepare("SELECT proposed_via FROM task_scope WHERE task_id = ?").get(taskId)?.["proposed_via"];
-    return !(via === "mate" || via === "coordinator" || via === "scout");
+    return !quarantinedAuthor(typeof via === "string" ? via : null);
 }
 /**
  * Whether this task may be built.
@@ -1179,6 +1190,15 @@ export function approvalOf(scope) {
     }
     if (scope.approvedDigest !== scope.digest)
         return { approved: false, reason: "changed" };
+    // A seal stands on a known authority (approval-policy plan §1.5): one left out or undefined, null (a row from before
+    // the basis column) or a word this code doesn't write is no approval.
+    if (scope.approvalBasis === undefined || scope.approvalBasis === null || !APPROVAL_BASES.includes(scope.approvalBasis)) {
+        return { approved: false, reason: "none" };
+    }
+    // Phase 1: only people approve, so a lead's seal (including an old one a lead token made through the person's road,
+    // which Store.getScope reads as `lead`) is no approval, and the person sees the Approve control again.
+    if (scope.approvalBasis === "lead")
+        return { approved: false, reason: "none" };
     return { approved: true, at: scope.approvedAt, by: scope.approvedBy };
 }
 /**
@@ -1239,7 +1259,7 @@ export function scopeAuthorityOf(scope, env = {}) {
     const parity = routeParityProblem(route, profile, { riskLevel: scope.riskLevel ?? "routine", qualityMode: scope.qualityMode ?? "default" });
     if (parity !== null)
         return { ok: false, reason: "parity", problem: parity };
-    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" }, profile, route);
+    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null }, profile, route);
     if (digest !== scope.digest) {
         return { ok: false, reason: "digest", problem: "the scope's reference does not re-derive from its own terms, agents, and route — file it again" };
     }
@@ -1298,10 +1318,34 @@ export function describeScope(scope, readiness = NO_READINESS) {
         ...(scope.profile?.checkAccess === undefined ? [] : [`  checks       ${checkAccessWords(scope.profile.checkAccess)}`]),
         // Its sandbox terms (project-sandbox.ts), part of what the yes agrees to: what it reads, and any widening.
         ...(scope.profile === null || scope.profile === undefined ? [] : ((terms) => [`  reads        ${terms.reads}`, ...(terms.mach === null ? [] : [`  services     ${terms.mach}`])])(sandboxTermsWords(scope.profile))),
+        ...releaseTermsWords(scope.releaseTerms ?? null),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];
 }
+/** The approval sheet's release lines (release-once.md): the release in one sentence, then what asks again. */
+export function releaseTermsSentence(terms) {
+    if (!terms.policy.carry)
+        return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Every later commit asks for your approval again.`;
+    return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Later commits on this pull request that only change tests, docs or the changelog ship without asking you again, until it merges or for 3 days. You'll see each one in the release summary.`;
+}
+/** What asks again, in full: the terms behind the sentence. */
+export function releaseAsksAgainWords(terms) {
+    const p = terms.policy;
+    return [
+        "A later commit asks again when it changes anything but unit tests, the journey scripts, docs under docs/, the README or the changelog;",
+        "when it touches AGENTS.md, CLAUDE.md, SECURITY.md, agent or CI settings, the test harness, helpers or fixtures;",
+        `when it deletes, renames or changes the mode of a file, adds a binary, a symlink or a submodule; when it changes the production build;`,
+        `when more than ${p.limits.lines} lines or ${p.limits.files} files change after this approval, or ${p.limits.churn} lines of churn;`,
+        ...(p.protectProject ? ["when it changes anything: this project is protected;"] : p.protectedPaths.length === 0 ? [] : [`when it changes a protected path: ${p.protectedPaths.join(", ")};`]),
+        `and always once the deploy starts. Repository ${terms.repo}, branch ${terms.branch} into ${terms.base}, check grant ${terms.grant.id}, checks in the sandbox, until ${terms.expiresAt}.`,
+    ];
+}
+function releaseTermsWords(terms) {
+    if (terms === null)
+        return [];
+    return [`  release      ${releaseTermsSentence(terms)}`, ...(terms.policy.carry ? releaseAsksAgainWords(terms).map(line => `               ${line}`) : [])];
+}
 function describeApproval(approval) {
     if (approval.approved)
         return `yes, by ${approval.by} at ${approval.at}`;
@@ -1310,3 +1354,171 @@ function describeApproval(approval) {
     }
     return "no — nothing will build this until somebody agrees to it";
 }
+// ---- Only a person approves (docs/plans/approval-policy.md, phase 1). Kept last: the freshness tripwire pins places.
+export { personProof } from "./person-proof.js";
+import { personProof } from "./person-proof.js";
+import { releaseTermsDigest } from "./contracts/release-terms.js";
+import { newestReleaseGeneration, releaseAuthorityOfTask, releaseSealProblem } from "./release-authority.js";
+/** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
+export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
+/** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
+ * (`{"v":1,"at":…,"digest":…}`, more fields allowed). Any other shape is no proof. */
+export function proofDetailOf(detail) {
+    if (typeof detail !== "string")
+        return null;
+    if (detail.startsWith("{")) {
+        try {
+            const parsed = JSON.parse(detail);
+            if (parsed === null || typeof parsed !== "object" || parsed["v"] !== 1 || typeof parsed["at"] !== "string" || typeof parsed["digest"] !== "string")
+                return null;
+            if (Number.isNaN(Date.parse(parsed["at"])) || parsed["digest"] === "")
+                return null;
+            return { at: parsed["at"], digest: parsed["digest"] };
+        }
+        catch {
+            return null;
+        }
+    }
+    const parts = detail.split(" · ");
+    if (parts.length !== 3 || !parts[2].startsWith("digest ") || !/^generation \d+$/.test(parts[1]) || Number.isNaN(Date.parse(parts[0])))
+        return null;
+    return { at: parts[0], digest: parts[2].slice("digest ".length) };
+}
+/**
+ * A person's approval of this task as it stands: approved, on the current digest, by the ceremony (`password`) or a
+ * paired-chat tap (`chat`), with a person's proof recorded for that approver and those exact bytes. Release, deploy
+ * and the protected-work counters ask this; a lead, a mode, a grant, a schedule or an approval with no proof is not
+ * a person's.
+ */
+export function personApprovalOf(store, taskId) {
+    const scope = store.getScope(taskId);
+    if (scope === null || scope.approvedAt === null || scope.approvedBy === null || scope.approvedDigest === null)
+        return { ok: false, why: "not approved yet" };
+    if (scope.approvedDigest !== scope.digest)
+        return { ok: false, why: "the approval is for different scope text" };
+    const basis = scope.approvalBasis ?? null;
+    if (basis === "lead")
+        return { ok: false, why: "approved by the lead, not by a person" };
+    if (basis !== "password" && basis !== "chat")
+        return { ok: false, why: `approved by ${basis === null ? "an unknown road" : basis === "grant" ? "a flow" : basis}, not by a person` };
+    const origin = sealOriginOf(store, taskId, scope.approvedBy, scope.approvedDigest, scope.approvedAt);
+    if (origin.origin === "machine")
+        return { ok: false, why: origin.lead ? "approved by the lead, not by a person" : "approved with a machine credential, not by a person" };
+    if (origin.origin !== "person")
+        return { ok: false, why: "no record shows a person approved these exact words; approve it again" };
+    return { ok: true, by: scope.approvedBy, at: scope.approvedAt, method: origin.method };
+}
+/**
+ * Who made a seal that says it came through a person's road (`password`, `chat`), from the acts recorded AT THAT SEAL
+ * (approval policy §1.5): the proof rows its approver left at the seal's own instant, and the lead's task act then.
+ * - `machine`: any proof there that isn't a person's (a lead or remote token, or a word this code doesn't know), or the
+ *   lead's act — fail closed, whatever its digest says;
+ * - `person`: a person's proof there for these exact bytes (parsed, either form);
+ * - `automation`: a standing order's firing that no person's proof stands behind;
+ * - `unproven`: none of these (a seal from before proof rows): it dispatches as before, and is never a person's yes.
+ * An older proof for the same bytes never vouches for a later seal. The dispatch belts ask the same in SQL
+ * (approval-authority.ts).
+ */
+export function sealOriginOf(store, taskId, by, digest, at) {
+    const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? AND at = ? ORDER BY id DESC").all(taskId, APPROVAL_PROOF, by, at);
+    const leadAct = store.handle.prepare(`SELECT 1 AS hit FROM task_act a JOIN task_ref r ON r.id = a.task_ref AND r.backend = 'built-in'
+      WHERE r.external_id = ? AND a.act = 'approved' AND a.lead = 1 AND a.account = ? AND a.at = ?`).get(taskId, by, at) !== undefined;
+    const machine = rows.filter(row => !personProof(String(row["outcome"])));
+    if (leadAct || machine.length > 0)
+        return { origin: "machine", lead: leadAct || machine.some(row => row["outcome"] === "lead-token") };
+    const person = rows.find(row => proofDetailOf(row["detail"])?.digest === digest);
+    if (person !== undefined)
+        return { origin: "person", method: String(person["outcome"]) };
+    if (store.handle.prepare("SELECT 1 AS hit FROM flow_trigger_event WHERE task = ? LIMIT 1").get(taskId) !== undefined)
+        return { origin: "automation" };
+    return { origin: "unproven" };
+}
+/** Text another machine wrote (a confirmed chat proposal, a coordinator, a scout): no mode, grant, remembered password
+ * or chat tap seals it. The lead's own CLI text (`lead`) is not quarantined. */
+export const quarantinedAuthor = (via) => via === "mate" || via === "coordinator" || via === "scout";
+/** Which states each action may start from (deploy and merge also resume their own reservation). */
+const RELEASE_ACTION_STATES = {
+    dispatch: ["open"], complete: ["open"], deploy: ["open", "deploying"], merge: ["deploying", "merge-reserved"],
+};
+/**
+ * Whether a task that belongs to a release authority may do `action` now. It applies to EVERY such task, whether its
+ * seal is the person's own or `carried`, and requires all of: the authority's current generation (never superseded,
+ * revoked or expired before it started); a state that fits the action; the task is the authority's current tip; the
+ * anchor's seal is a person's (personApprovalOf, unchanged) on the exact sealed anchor digest; the anchor's approver is
+ * still an active approver with access to the project; for a carried task, a carry row for exactly this task, scope
+ * digest, candidate and generation; the release check grant and check access as sealed (access only ever the fence);
+ * a sealed policy this runtime knows; and, for deploy and merge, no open main-check failure blocking a composed check.
+ * A task that belongs to no release reads `applies: false` — the ordinary rules decide it.
+ */
+export function liveReleaseOf(store, taskId, action, now = new Date()) {
+    const found = releaseAuthorityOfTask(store, taskId);
+    if (found === null)
+        return { applies: false };
+    const { authority: a, carry } = found;
+    const refuse = (why) => ({ applies: true, ok: false, why, authority: a });
+    const newest = newestReleaseGeneration(store, a.repo, a.version, a.pr);
+    if (newest === null || newest.id !== a.id)
+        return refuse("a newer approval of this release replaced this one");
+    if (a.state === "superseded")
+        return refuse("a newer approval of this release replaced this one");
+    if (a.state === "revoked")
+        return refuse(`${a.endedBy ?? "an approver"} stopped carrying commits for this release`);
+    // Expiry stops every live state (security review): an operation already reserved finishes only through reconciliation.
+    if (a.state === "expired" || ((a.state === "open" || a.state === "deploying" || a.state === "merge-reserved") && a.expiresAt <= now.toISOString()))
+        return refuse("the release approval expired");
+    if (a.state === "merged")
+        return refuse("the release was already merged");
+    if (!RELEASE_ACTION_STATES[action].includes(a.state))
+        return refuse(a.state === "open" ? "the release hasn't started deploying" : `the release is already ${a.state === "deploying" ? "deploying" : "merging"}`);
+    if (a.tipTask !== taskId)
+        return refuse("this is not the release's current commit");
+    const anchor = store.getScope(a.anchorTask);
+    const person = personApprovalOf(store, a.anchorTask);
+    if (!person.ok)
+        return refuse(`the release approval no longer stands: ${person.why}`);
+    if (anchor === null || anchor.approvedDigest !== a.anchorDigest || anchor.digest !== a.anchorDigest)
+        return refuse("the release approval is for different words");
+    const account = store.accountOf(person.by);
+    if (account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(person.by, a.repo))
+        return refuse(`${person.by} can no longer approve in this project`);
+    const scope = store.getScope(taskId);
+    if (scope === null || scope.approvedDigest !== scope.digest)
+        return refuse("this task's approved words changed");
+    if (carry !== null) {
+        if (carry.authority !== a.id || scope.approvalBasis !== "carried" || carry.scopeDigest !== scope.digest || carry.toSha !== scope.candidate || scope.modeDigest !== `${a.id}:${carry.id}`) {
+            return refuse("this commit's carry doesn't match its record");
+        }
+    }
+    else if (scope.candidate !== a.approvedSha)
+        return refuse("this task isn't the approved commit");
+    const grant = store.liveVerifyCommand(a.repo);
+    if (grant === null || grant.id !== a.verifyCommand || grant.digest !== a.verifyDigest)
+        return refuse("the release check command changed since the approval");
+    if (a.accessDigest !== "sandboxed" || store.projectCheckAccess(a.repo) !== "sandboxed")
+        return refuse("the project's checks no longer run in the sandbox");
+    if (a.policy === null)
+        return refuse("this Toolroll doesn't know the release's carry rules; update Toolroll first");
+    if (action === "deploy" || action === "merge") {
+        const debt = mainDebtProblem(store, a.repo, taskId);
+        if (debt !== null)
+            return refuse(debt);
+    }
+    return { applies: true, ok: true, authority: a, carry };
+}
+/**
+ * Open main-check failures (the nightly full check, part 3) block the deploy and the merge of a release whose gate
+ * check was composed from a targeted run: a full pass is needed first. Null when nothing blocks.
+ */
+export function mainDebtProblem(store, repo, taskId) {
+    const open = Number(store.handle.prepare("SELECT COUNT(*) AS n FROM main_check_failure WHERE repo = ? AND cleared_at IS NULL").get(repo)?.["n"] ?? 0);
+    if (open === 0)
+        return null;
+    const ref = store.lookupRef(taskId);
+    if (ref === null)
+        return null;
+    const newest = store.handle.prepare(`SELECT a.mode FROM run r JOIN release_check_attempt a ON a.run = r.id
+      WHERE r.task_ref = ? AND r.role = 'builder' ORDER BY r.id DESC LIMIT 1`).get(ref.id);
+    if (newest === undefined || newest["mode"] !== "targeted")
+        return null;
+    return `the nightly full check on main has ${open} open failure${open === 1 ? "" : "s"}, so a check made from a re-run of what failed can't deploy; a full check has to pass first`;
+}

package/dist/server/render-tasks.d.ts

@@ -1,3 +1,4 @@
+import type { ReleaseView } from "../release-view.js";
 import { type Html } from "../html.js";
 import { type RunActivity } from "../activity-line.js";
 import { type AgentChoice } from "../agentconfig.js";
@@ -522,6 +523,9 @@ export declare function taskBodyParts(data: {
         method: string;
         at: string;
     } | null;
+    /** One approval per release (release-once.md): the release this task belongs to, and whether this reader may stop it. */
+    release?: ReleaseView | null;
+    canStopRelease?: boolean;
     /** Workers that are both alive and authorized for this task's project. */
     worker?: {
         answering: number;
@@ -670,3 +674,7 @@ export declare function qualityModeChoices(name: string, selected: QualityMode):
 export declare function decisionOptionForms(decision: Decision, returnTo: string | null): Html;
 export declare function decisionPage(chrome: Chrome, decision: Decision, taskId: string, artifacts: Artifact[], who: Who, now: Date, returnTo?: string | null): Screen;
 export declare function taskOf(store: Store, decision: Decision): string;
+/** A release task's own card (release-once.md, "What people see"): the release it's approved for, the later commits
+ * carried under it (on demand), what a later check must run again, the last nightly check of main, and one action to
+ * stop carrying. A carried task says whose approval it was carried from. */
+export declare function releaseCardHtml(taskId: string, release: ReleaseView | null, canStop: boolean): Html;

package/dist/server/render-tasks.js

@@ -1,5 +1,6 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { networkWords } from "../egress.js";
+import { releaseAsksAgainWords, releaseTermsSentence } from "../scope.js";
 import { writesWords } from "../writes-mode.js";
 import { checkAccessWords } from "../check-access.js";
 import { sandboxTermsWords } from "../project-sandbox.js";
@@ -757,18 +758,28 @@ export function approvalProofWords(proof) {
         return " (passwordless: your signed-in session)";
     if (proof.method === "cli-login")
         return " (passwordless: this computer's remembered login)";
+    if (proof.method === "chat")
+        return " (from your paired chat)";
+    if (proof.method === "carried")
+        return " (carried from the release approval)";
     return "";
 }
 const whenText = (iso) => new Intl.DateTimeFormat("en-US", { hour: "numeric", minute: "2-digit" }).format(new Date(iso));
 export function approveRefusalWords(reason) {
     if (reason === "requester" || reason === "person-required")
         return gateWords({ verdict: "refuse", reason });
+    if (reason === "machine-proof")
+        return "not approved: only a person can approve this. Approve it on the task page or from your paired chat";
     if (reason === "unrouted")
         return "not approved: this scope predates agent routing and its old approval no longer stands — edit and re-file the scope so it is routed under today’s agents, then approve it";
     if (reason === "profile-unresolved")
         return "not approved: the scope cannot name an exact agent for every role — fix the agent setup and re-file it";
     if (reason === "password-now")
         return "not approved: this needs your password typed now — protected work, raised permissions, or a plan an agent wrote can't use a remembered one";
+    // A wrong password, someone who isn't an approver (or not for this project), a revoked login: one answer for all, so
+    // the refusal never tells a guesser which it was.
+    if (reason === "not-an-approver")
+        return "That password didn't match.";
     return `not approved: ${reason}`;
 }
 /** The browser's one-click approval binds not only the signed scope but the
@@ -1480,9 +1491,12 @@ export function taskBodyParts(data) {
             scope.touches.length === 0 ? "" : html `<p class="scope-paths"><strong>Touches</strong> ${scope.touches.join(", ")}</p>`,
             html `<p><strong>Quality</strong> ${qualityModeTitle(scope.qualityMode ?? "default")}</p>`,
             acceptanceCeremonyHtml(scope.acceptance),
-            approval.approved
-                ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
-                : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
+            scope.releaseTerms == null ? "" : html `<p><strong>Release</strong></p><p class="recap">${releaseTermsSentence(scope.releaseTerms)}</p>${scope.releaseTerms.policy.carry ? html `<details><summary>What asks again</summary><ul>${joinHtml(releaseAsksAgainWords(scope.releaseTerms).map(line => html `<li>${line}</li>`), "")}</ul></details>` : ""}`,
+            approval.approved && data.release?.kind === "carried"
+                ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                : approval.approved
+                    ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
+                    : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
             html `</div>`,
         ], "\n");
     // The scout's report (mate arc §10): title, summary, the document inert,
@@ -1773,9 +1787,11 @@ export function taskBodyParts(data) {
         : "";
     const scopeRow = scope === null
         ? prop("scope", "none yet")
-        : approval.approved
-            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
-            : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
+        : approval.approved && data.release?.kind === "carried"
+            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
+            : approval.approved
+                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
+                : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
     const strikesRow = data.strikes > 0 ? prop("strikes", `${data.strikes} failed attempt(s)`) : "";
     const propsCard = html `<div class="card props">${workerRow}${queueRow}${scopeRow}${publishesRow}${economics}${strikesRow}</div>`;
     // The same facts for the rebuilt page, row for row.
@@ -1790,8 +1806,11 @@ export function taskBodyParts(data) {
         facts.push({ label: "Queue", parts: [`${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : ` in ${data.position.column}'s queue`} · `, { label: "Reorder", href: "/board?view=order" }] });
     }
     facts.push(scope === null ? { label: "Scope", parts: ["none yet"] }
-        : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
-            : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
+        : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
+            : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
+                : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
+    if (data.release?.kind === "anchor")
+        facts.push({ label: "Release", parts: [`Approved for release ${data.release.version}`, ...(data.release.landed.length === 0 ? [] : [` · later commits: ${data.release.landed.map(one => one.sha.slice(0, 7)).join(", ")}`]), ...(data.release.carrying ? [] : [` · later commits ask again`])] });
     facts.push({ label: "Publishes as", parts: [publishesAs] });
     // v102: who asked for it, and what the project's approval rules need.
     if (data.filer != null)
@@ -2068,7 +2087,7 @@ export function taskBodyParts(data) {
         section("scope", 
         // The recipe road rides with the scope it reuses (UI polish
         // 2026-09-13), off the title-to-action path.
-        joinHtml([html `<h2>Scope</h2>`, scopeCard, data.repo !== null && data.scope !== null ? html `<p class="meta"><a href="/recipes/from-task?task=${encodeURIComponent(task.id)}">Reuse this scope as a recipe →</a></p>` : "", agentsCardHtml(task.id, data.route, data.canEditRoute === true), revisionInApproval ? "" : revisionCard, data.completion != null ? "" : repairChainHtml(data.repairChain ?? null), scopeForm], "\n"), scopeDraft !== undefined || (data.plan !== "requested" && approveForm === "" && !(scope === null && canPlan))),
+        joinHtml([html `<h2>Scope</h2>`, scopeCard, releaseCardHtml(task.id, data.release ?? null, data.canStopRelease === true), data.repo !== null && data.scope !== null ? html `<p class="meta"><a href="/recipes/from-task?task=${encodeURIComponent(task.id)}">Reuse this scope as a recipe →</a></p>` : "", agentsCardHtml(task.id, data.route, data.canEditRoute === true), revisionInApproval ? "" : revisionCard, data.completion != null ? "" : repairChainHtml(data.repairChain ?? null), scopeForm], "\n"), scopeDraft !== undefined || (data.plan !== "requested" && approveForm === "" && !(scope === null && canPlan))),
         dependencyChoiceNeeded ? "" : section("waits for", waitsForCard, (data.waitsFor ?? []).length > 0, (data.waitsFor ?? []).length),
         section("holds", holds, true, data.holds.length),
         cancelAct,
@@ -2461,3 +2480,25 @@ export function taskOf(store, decision) {
     const run = store.getRun(decision.run);
     return run === null ? "?" : store.externalIdFor(run.taskRef) ?? "?";
 }
+/** A release task's own card (release-once.md, "What people see"): the release it's approved for, the later commits
+ * carried under it (on demand), what a later check must run again, the last nightly check of main, and one action to
+ * stop carrying. A carried task says whose approval it was carried from. */
+export function releaseCardHtml(taskId, release, canStop) {
+    if (release === null)
+        return html ``;
+    if (release.kind === "carried")
+        return html `<div class="card" id="release"><p><strong>Carried from ${release.approver ?? "a person"}'s release approval</strong></p><p class="meta"><a href="${taskHref(release.anchorTask)}">Release ${release.version}</a> · pull request #${release.pr}</p></div>`;
+    const until = new Intl.DateTimeFormat("en-US", { weekday: "short", hour: "numeric", minute: "2-digit" }).format(new Date(release.expiresAt));
+    const landed = release.landed.length === 0 ? html `<p class="meta">No later commits yet.</p>`
+        : html `<ul>${joinHtml(release.landed.map(one => html `<li><a href="${taskHref(one.task)}">${one.sha.slice(0, 7)}</a> · ${one.files.map(file => `${file.path} (+${file.added} −${file.deleted})`).join(", ")}</li>`), "")}</ul>`;
+    return joinHtml([
+        html `<div class="card" id="release">`,
+        html `<p><strong>Approved for release ${release.version}</strong></p>`,
+        html `<p class="meta">${release.carrying ? `Later commits on pull request #${release.pr} that only change tests, docs or the changelog ship without asking again, until it merges or ${until}.` : `Later commits ask for approval again: ${release.why ?? `the release is ${release.state}`}.`}</p>`,
+        html `<details><summary>Later commits (${release.landed.length})</summary>${landed}</details>`,
+        release.obligations.length === 0 ? "" : html `<details><summary>Still to pass (${release.obligations.length})</summary><ul>${joinHtml(release.obligations.map(one => html `<li>${one}</li>`), "")}</ul></details>`,
+        release.nightly === null ? "" : html `<p class="meta">Nightly check of main: ${release.nightly.outcome ?? "running"} at ${release.nightly.sha.slice(0, 7)}${release.openMainFailures > 0 ? ` · ${release.openMainFailures} open failure${release.openMainFailures === 1 ? "" : "s"}` : ""}</p>`,
+        release.carrying && canStop ? postForm(`${taskHref(taskId)}/stop-carrying`, html `<button type="submit" class="secondary">Stop carrying later commits</button>`, { attrs: { class: "inline" } }) : "",
+        html `</div>`,
+    ], "\n");
+}

package/dist/server/route-table.js

@@ -381,6 +381,7 @@ post("tasks", "task.act.retry-review", `^\\/t\\/${TASK}\\/retry-review$`, { proj
 post("tasks", "task.act.complete", `^\\/t\\/${TASK}\\/complete$`, { project: "task", limited: "resource", sample: "/t/one/complete", ...approver("Only an approver can mark a result complete.") });
 post("tasks", "task.act.merge", `^\\/t\\/${TASK}\\/merge$`, { project: "task", limited: "resource", sample: "/t/one/merge", ...approver("Only an approver can merge.") });
 post("tasks", "task.act.confirm-stopped", `^\\/t\\/${TASK}\\/confirm-stopped$`, { scope: "step-up", project: "task", limited: "resource", sample: "/t/one/confirm-stopped", ...approver("Only an approver can confirm a build stopped.") });
+post("tasks", "task.act.stop-carrying", `^\\/t\\/${TASK}\\/stop-carrying$`, { project: "task", limited: "resource", sample: "/t/one/stop-carrying", ...approver("Only an approver can stop carrying a release.") });
 post("tasks", "task.act.stop", `^\\/t\\/${TASK}\\/stop$`, { project: "task", limited: "resource", sample: "/t/one/stop" });
 post("tasks", "task.act.pause", `^\\/t\\/${TASK}\\/pause$`, { project: "task", limited: "resource", sample: "/t/one/pause" });
 post("tasks", "task.act.resume-arm", `^\\/t\\/${TASK}\\/resume-arm$`, { project: "task", limited: "resource", sample: "/t/one/resume-arm" });

package/dist/server/task-views.js

@@ -1,3 +1,5 @@
+import { releaseViewOf } from "../release-view.js";
+import { releaseObligationsOf } from "../release-recheck.js";
 import { approvalProofOf, freshlyApprovable, freshnessFor, withFreshness } from "../scope.js";
 import { liveAttemptOf, steerControlsFor } from "../steer-controls.js";
 import { originOf } from "../task-source.js";
@@ -493,6 +495,8 @@ export function createTaskViews(runtime) {
             base: taskBaseOf(runtime.store, taskId),
             steeringLive: ref !== null && runtime.store.steeringLiveBuild(ref.id, now) !== null,
             steeringRun: ref === null ? null : runtime.store.steeringLiveBuild(ref.id, now),
+            release: ref === null ? null : releaseViewOf(runtime.store, ref.externalId, now, authority => releaseObligationsOf(runtime.store, runtime.evidenceRoot, authority)),
+            canStopRelease: who.role === "approver" && who.via === "cookie",
             approvalProof: (() => {
                 // The proof of the approval shown: its approver, its exact sealed digest (approvedDigest === digest when approved).
                 const scope = ref === null ? null : runtime.store.getScope(ref.externalId);

package/dist/server/tasks.js

@@ -1,3 +1,4 @@
+import { releaseAuthorityOfTask, revokeRelease } from "../store.js";
 import { steerCapabilityOf } from "../steer-capabilities.js";
 import { canReveal, localCheckoutOf, revealInFinder } from "../checkout-proof.js";
 /** A form's way back to a flow card ("flow:<flow>:<card>"), read strictly: numbers only, never a path. */
@@ -1972,6 +1973,16 @@ export function createTasksHandlers(runtime) {
                 store.unhold(ref.id);
                 return redirect(response, taskHref(taskId));
             }
+            case "stop-carrying": {
+                // One click, any active approver (release-once.md): later commits of this release ask again. Only ever stricter.
+                const found = releaseAuthorityOfTask(store, taskId);
+                if (found === null)
+                    return taskScreen(response, who, taskId, "This task isn't part of a release.", 409);
+                const stopped = revokeRelease(store, found.authority.id, who.name, now);
+                if (!stopped.ok)
+                    return taskScreen(response, who, taskId, stopped.why, 409);
+                return redirect(response, `${taskHref(taskId)}#release`);
+            }
             case "requeue": {
                 const body = readForm(posted, CONSOLE_FORMS.taskRequeue);
                 // Retry may carry a note for the next attempt: the same steering note, checked before anything changes.
@@ -3036,6 +3047,7 @@ export function createTasksHandlers(runtime) {
         "task.act.merge": taskMerge,
         "task.act.confirm-stopped": taskConfirmStopped,
         "task.act.stop": taskAct("stop"),
+        "task.act.stop-carrying": taskAct("stop-carrying"),
         "task.act.pause": taskAct("pause"),
         "task.act.resume-arm": taskAct("resume-arm"),
         "task.act.resume": taskAct("resume"),