toolroll 0.9.71 → 0.9.73

package/CHANGELOG.md

@@ -1,5 +1,160 @@
 # Changelog
 
+## 0.9.73 — 2026-10-25
+
+- **Carry release approvals when checks aren't sandboxed.** A project whose
+  checks run outside the sandbox (like Toolroll's own release project) can
+  let later test-only commits carry a release approval:
+  `toolroll release unsandboxed-carry on --repo <path> --as <you> --token
+  <password>`. It is off by default; only a person turns it on, and it counts
+  only for releases approved while it is on. The approval sheet says plainly
+  that those later commits will run outside the sandbox without being shown
+  to you first. Every other carry rule stays: tests and docs only, the
+  400-line, 20-file and 800-line-churn limits, an identical production build,
+  and main's open nightly failures. Turning it off, or checks that reach
+  further than at the approval, stops carrying.
+- **`toolroll release` stops at the gate when the pull request's checks
+  fail.** Before it files the release task or asks for your approval, it
+  reads the required checks on the exact commit. One that failed or was
+  cancelled stops the release with the failing job names, so you aren't
+  asked to approve a commit that can't merge. Checks not started or still
+  running are named and waited for; if they don't finish within the gate's
+  limit (60 minutes, `--limit gate=<min>`), it stops there too. The ci step
+  still checks every one again before merging.
+- **Chat apps, browsers and password managers are off limits to every
+  launch.** Builds, checks, flows, tool servers and coding sessions can't
+  read or write where Slack, Telegram, Discord, Teams, WhatsApp, 1Password,
+  Bitwarden, or the Chrome, Chromium, Brave, Edge, Arc, Firefox, Zen,
+  Vivaldi, Opera, Orion and Safari profiles keep their data, on macOS and
+  Linux, under both sandbox versions and in Codex's sandbox. This covers the
+  folders by name and by real path, links inside them, and a moved profile
+  or config folder named in the environment. No project setting reopens
+  them, and those apps' variables (SLACK_, TELEGRAM_, DISCORD_, TEAMS_, OP_,
+  BW_, BITWARDENCLI_) are removed from every launch; a tool server keeps the
+  secrets it names.
+- **`toolroll release` runs Git safely on the release checkout.** The release
+  used to run plain Git there, so a setting planted in the checkout's Git
+  config (an include, a hook folder, an ssh command, a proxy, a URL rewrite
+  and the like) could run a command or send the gh token elsewhere. Now it
+  uses the repository and GitHub URL from Toolroll's own records, runs Git,
+  gh and ssh by absolute path with a fixed environment, pins HTTPS settings
+  on the command line, and allows only the plain settings Git writes itself.
+  Any other setting stops the release and names it. The checkout must be a
+  project Toolroll records, with a recorded remote.
+- **Widening actions take your password.** Setting the permission default to
+  Full access, giving a subagent a tool, loosening a tool rule, accepting a
+  subagent's suggested looser rule, and adding a trigger that brings in work
+  from anyone (GitHub from anyone, mail from any sender, from the Triggers
+  panel, a gallery template or a starter kit) now ask for your password (a
+  signed-in session does under Passwordless). Narrowing needs none. A chat
+  card, import or template can no longer do any of these; it points to the
+  page that can.
+- **Approving a release from chat shows the whole release first.** A tap
+  approves a deploy only through the release card: every signed term and
+  release term, one line each (it says so when later test-only commits
+  will run outside the sandbox), and the commits since the last release
+  Toolroll recorded as merged. Continue sends the terms (as a file where the
+  chat app allows), and Approve is bound to exactly what was shown;
+  anything changed in between refuses with the new card. It works only in
+  your own private chat (Telegram or a Slack direct message); a group,
+  someone else's chat, Discord and Teams are refused. Each such approval is
+  announced to you, naming the chat app.
+- **Network, writes, check access and sandbox settings stay on the typed
+  password under Passwordless,** and a test now fails if one moves to the
+  ordinary signed-in step-up.
+- **Launches don't wait on macOS's "access data from other apps" prompt.**
+  Toolroll looks inside other apps' containers only after a 3-second look in
+  a separate process shows macOS lets it, so a service run by launchd no
+  longer hangs every fenced launch. While macOS is still asking, the
+  containers stay denied by name and real path, and the links found by the
+  last full look stay denied; a look that fails for any other reason refuses
+  the launch.
+- **The release check ends itself before its time limit,** stopping the
+  parts still running and keeping every log and its report, and a failed
+  part's log reaches the run's output as soon as it fails.
+- **`toolroll release` rides out short GitHub network timeouts** while a
+  step waits, asking again until that step's own limit.
+- No database change: the schema stays at v135.
+
+## 0.9.72 — 2026-10-25
+
+- **One approval per release.** A person approves a release once. Later
+  commits on the same pull request carry that approval only when every change
+  since is unit tests, journey scripts, Markdown under docs/, the README or
+  the changelog, within 400 changed lines, 20 files and 800 lines of churn,
+  and the production build is byte-for-byte the approved one. Anything else
+  asks again, and so does any change after the deploy has started. The
+  approval sheet states the release and what asks again; the release summary
+  and the squash message list every commit that landed after the approval.
+  **Stop carrying later commits** on the task page (or `toolroll release
+  revoke`) ends it, and `toolroll release ask-every-commit on` makes a
+  project's releases ask for every commit. A release approval expires after
+  3 days.
+- **Re-checks of a release re-run only what failed.** On the second and later
+  release checks, only the failed unit files, journey groups and upgrade
+  versions run again, with every test changed since and a short sanity pass.
+  A check that can't prove it covered everything counts as failed, and a
+  test that disappears or is newly skipped stops carrying.
+- **A nightly full check of main.** `toolroll release nightly --repo <path>`
+  sets up a daily full check of main (03:00 local by default). A failure
+  becomes an attention notice naming what failed, holds re-checks that run
+  only part of the suite until a full check passes it again, and a nightly
+  that hasn't run for 26 hours says so.
+- **Sandboxed checks can start Chromium on macOS.** Playwright's default
+  browser (its Chromium headless shell) now starts inside the check sandbox:
+  the sandbox may register and look up Chromium's port rendezvous service,
+  `org.chromium.Chromium.MachPortRendezvousServer.<pid>`, and nothing else.
+  Builds, flows and tool servers don't get this; SECURITY.md says what a
+  hostile check could do with it. A project set to **Not sandboxed** only for
+  a headless browser check can go back to **Sandboxed** in Settings → Project
+  → Check access. Chrome for Testing (`channel: "chromium"`, headed runs)
+  still needs **Not sandboxed**.
+- **Checks with sign-ins no longer reach your keychain.** Toolroll reads
+  Claude Code's and gh's sign-ins from the keychain itself, outside the
+  sandbox, and hands the check just those tokens in its environment. A check
+  gets Claude's current access token and can't renew it.
+- **A wrong password on an approval says "That password didn't match."**
+  instead of "not approved: not-an-approver". Someone who isn't an approver
+  gets the same answer.
+- **Closing a live terminal signals only its own processes.** It stops them
+  before it kills them, so a child one starts at that moment can't slip out
+  from under the close; each signal goes only to a process still the one it
+  saw (same pid, same start); and after the program ends, its terminal's
+  name no longer counts as proof, since the device may already be someone
+  else's. A process it can't prove is its own is never signalled, and the
+  close says it's uncertain (the worktree stays).
+- **Only a person approves work.** The lead's token used to approve a task's
+  scope and be recorded as its owner's password approval, including on a
+  release. Now `task approve` (and `task repair --yes`) with a lead token, or
+  any approval made with a remote API token, is refused: "Only a person can
+  approve this." Approve on the task page or from your paired chat
+  (docs/plans/approval-policy.md, phase 1; the setting that lets the lead
+  approve, recorded as the lead's, comes next).
+- **Only a person merges by hand.** `task merge` (including `--anyway`) and
+  the merge button refuse a lead or API token. A flow's Pull request zone
+  merges only after a person's recorded decision; a subagent's approval, or
+  a decision from before decisions recorded who made them, waits.
+- **Protected work counts only people.** A vote a machine credential left, or
+  one with no proof on record, doesn't count as one of the two people, and a
+  lead or API token's completion is never the second person. A person can
+  mark an already-complete result complete again to release a held push.
+- **Releases and deployments need a person's approval with its proof on
+  record.** The release gate and `deploy-browser.mjs` (every phase, resumed
+  ones included) refuse an approval a lead token made, a mode, a flow, a
+  standing order, or an approval with no recorded proof. `toolroll release` proves the
+  candidate in its own runtime, and that the checkout is exactly that commit,
+  before it runs anything from the candidate's checkout. Paired-chat
+  approvals now record their own proof, so they still count. Update the
+  plane before running `toolroll release`: an older plane can't say who
+  approved, and the release waits.
+- Approvals a lead token made before this change are read for what they were:
+  they no longer dispatch, and the task asks for a person's approval. Seals
+  with no recorded authority stand on nothing. A standing order's firing is
+  approved by its own authority (`schedule`), which stands only while its
+  approver can still approve in the project.
+- Schema v134 and v135 only add columns and tables; `toolroll update` runs
+  them in place.
+
 ## 0.9.71 — 2026-10-25
 
 - **Sandboxed launches can open a terminal of their own on macOS.** A check

package/dist/agent-fence.d.ts

@@ -29,6 +29,8 @@ export declare function agentFence(options: {
     boundary?: TaskBoundary | null;
     binding?: WorktreeBinding | null;
     runFolders?: RunFolders;
+    /** Protected storage as this launch resolved it (protected-storage.ts); resolved here when not given. */
+    protectedStorage?: readonly string[];
 }): string[];
 /** The task's boundary: `shell` joins the OS fence; `fileTools` only Claude's file-tool deny rules; `readOnly` and
  * `lookup` are other tasks' git metadata and checkout roots (see FenceGrants). */
@@ -93,13 +95,19 @@ export type FenceGrants = {
     /** macOS: the project's sealed mach services beyond the runtime's baseline (its `allowMachLookup`). */
     machLookup?: string[];
     /** macOS: the keychain's services (securityd), denied to every launch without it (sandbox-runtime.ts
-     * SEATBELT_NO_KEYCHAIN). Only fenceFor gives it, to a build's agent; a check with sign-ins is given it at its launch
-     * (invoke.ts). Never a tool server's (serverGrantsOf). */
+     * SEATBELT_NO_KEYCHAIN). Only fenceFor gives it, to a build's agent. Never a check's (one with sign-ins gets those in
+     * its environment, invoke.ts keychainSignIns), never a tool server's (serverGrantsOf). */
     keychain?: true;
+    /** macOS: a project check's launch, whose Chromium may start (sandbox-runtime.ts SEATBELT_CHROMIUM). Only fenceFor
+     * sets it, only for kind "check". */
+    browser?: true;
     /** A `sign-ins` check's exact sign-in files, read again inside the home denies (check-access.ts, signInGrants). */
     signIns?: SignInGrants;
     /** Never written, wherever the launch writes (homeWriteDenies): what runs for the operator next or signs them in. */
     writeDenies?: string[];
+    /** Protected storage (protected-storage.ts): denied to read and write by every backend, and no grant equal to or
+     * inside one survives (a sandbox that lets the more specific path win can't reopen it). */
+    protectedStorage?: string[];
 };
 export { isWritesMode, WRITES_DEFAULT, type WritesMode } from "./writes-mode.js";
 /**

package/dist/agent-fence.js

@@ -12,7 +12,7 @@
  * checkout writable; other tasks' checkouts read, never written; the project's read-deny list; under policy v1 (an
  * approval sealed before 0.9.70) the home configuration denied by name; a sign-ins check's exact files read again; the
  * run's proxy as its only way out when its network is confined. On macOS every launch also gets a pseudo-terminal of its
- * own and no other terminal, and only a build's agent (and a check with sign-ins) reaches the keychain
+ * own and no other terminal, a project check's launch Chromium's own service, and only a build's agent the keychain
  * (sandbox-runtime.ts seatbeltRulesFor, static rules).
  *
  * Codex (every platform) fences its own agent's commands with its own sandbox: a permission profile with the same
@@ -34,6 +34,7 @@ import { readMonitoring } from "./monitoring-settings.js";
 import { existingFolders } from "./names.js";
 import { DEPS_FOLDER, linkedKey, readyCopy, sharedCopies } from "./shared-deps.js";
 import { SEATBELT_PROBE, sandboxRuntimeProblem, srtSpawn } from "./sandbox-runtime.js";
+import { protectedStorageDenies, protectedStorageNames } from "./protected-storage.js";
 import { getDefaultWritePaths } from "@anthropic-ai/sandbox-runtime";
 /** Names that are secrets wherever the database lives (used when its folder is shared with other things). */
 const SENSITIVE_NAME = /(^up-login\.txt$|token|secret|login|password|credential|vapid|keys?\b|\.pem$|\.key$|^backups$|^evidence$|^remote$|^sign-in\.json$|^monitoring\.json$)/i;
@@ -188,11 +189,18 @@ export function agentFence(options) {
     for (const path of options.boundary?.protectedShell ?? [])
         fence.add(real(path));
     const protectedPaths = new Set([...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]));
+    // Protected storage (chat apps, browser profiles, password managers): every launch, every policy, never exemptible,
+    // kept by the name it was resolved under as well as where it leads.
+    const storage = options.protectedStorage ?? protectedStorageDenies(home);
+    for (const path of storage) {
+        protectedPaths.add(path);
+        protectedPaths.add(real(path));
+    }
     for (const path of options.boundary?.shell ?? [])
         fence.add(path);
     const binding = options.binding;
     const needed = binding === undefined || binding === null ? [] : [binding.gitdir, real(join(binding.main, ".git"))];
-    return [...new Set([...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]))].filter(path => {
+    return [...new Set([...[...fence].flatMap(path => path === runFolder ? [path, real(path)] : [real(path)]), ...storage.flatMap(path => [path, real(path)])])].filter(path => {
         if (protectedPaths.has(path) || !needed.some(target => target === path || inside(target, path)))
             return true;
         console.warn(`Dropped build fence entry covering this checkout's own Git data: ${path}`);
@@ -237,10 +245,12 @@ export function taskBoundary(options) {
     const present = (names) => names.map(name => join(home, name)).filter(path => existsSync(path)).map(real);
     // Policy v2 (docs/plans/sandbox-parity.md §1.2): the home folder, the repositories beside this one and the project's
     // primary checkout are read as Anthropic's sandbox runtime reads them; only writes to the primary checkout stay denied.
+    // Protected storage by name, under both policies (protected-storage.ts): never part of the v1-only home configuration.
+    const storage = protectedStorageNames(home);
     if ((options.policy ?? 1) === 2)
-        return v2Boundary(worktree, main, gitdir);
+        return v2Boundary(worktree, main, gitdir, storage);
     const shell = new Set(present(HOME_CONFIGURATION.filter(name => !own.has(name))));
-    const protectedShell = [...shell];
+    const protectedShell = [...shell, ...storage];
     const repository = (path) => existsSync(join(path, ".git"));
     for (const parent of new Set([dirname(worktree), ...(main === null ? [] : [dirname(main)])])) {
         // Home contains toolchain clones such as .nvm and .oh-my-zsh. The
@@ -290,7 +300,7 @@ export function taskBoundary(options) {
 /** A v2 boundary: nothing of the home folder, the repositories beside this one or the primary checkout is denied to
  * read; the primary checkout (all but its `.git`, which this worktree's Git needs) is never written; other tasks' Git
  * metadata is read, never written, as under v1. */
-function v2Boundary(worktree, main, gitdir) {
+function v2Boundary(worktree, main, gitdir, storage) {
     const noWrite = new Set();
     if (main !== null && main !== worktree) {
         let entries = [];
@@ -309,7 +319,7 @@ function v2Boundary(worktree, main, gitdir) {
     const { readOnly, lookup } = siblingGitData(main, gitdir);
     for (const path of noWrite)
         readOnly.add(path);
-    return { protectedShell: [], shell: [], fileTools: [], readOnly: [...readOnly].sort(), lookup: [...lookup].sort(), homeNames: [] };
+    return { protectedShell: [...storage], shell: [], fileTools: [], readOnly: [...readOnly].sort(), lookup: [...lookup].sort(), homeNames: [] };
 }
 /**
  * Git needs this worktree's metadata and the shared objects/refs, but must not prune or rewrite the metadata of another
@@ -765,6 +775,18 @@ function codexFilesystem(fence, fullAccess, grants) {
         if (basename(path) === INSTANCE_DIR)
             access.set(path, "deny");
     }
+    // Protected storage: denied by name and real path, and nothing granted inside it (Codex lets the more specific path
+    // win, so a grant there would reopen it).
+    const storage = grants.protectedStorage ?? [];
+    if (storage.length > 0) {
+        for (const [path, mode] of [...access])
+            if (mode !== "deny" && storage.some(one => path === one || inside(path, one)))
+                access.delete(path);
+        for (const path of storage) {
+            access.set(path, "deny");
+            access.set(real(path), "deny");
+        }
+    }
     return access;
 }
 /**
@@ -971,6 +993,16 @@ export function srtTermsOf(fence, grants = NO_GRANTS) {
                 denyWrite.add(sealed);
         }
     }
+    // Protected storage last: denied to read and write by name and real path, and no read grant inside it survives.
+    const storage = grants.protectedStorage ?? [];
+    const isProtected = (path) => storage.some(one => path === one || inside(path, one) || real(path) === one || inside(real(path), one));
+    for (const path of storage) {
+        denyRead.add(path);
+        denyWrite.add(path);
+    }
+    for (const path of [...allowRead])
+        if (isProtected(path))
+            allowRead.delete(path);
     const readConfig = { denyOnly: [...denyRead].sort(), allowWithinDeny: [...allowRead].sort() };
     const writes = grants.writes;
     // A sign-ins check also writes Codex's session and log folders and its own Claude transcripts (never inside a
@@ -983,8 +1015,9 @@ export function srtTermsOf(fence, grants = NO_GRANTS) {
     const network = grants.network;
     return {
         readConfig,
-        writeConfig: { allowOnly: [...new Set(allowOnly)].sort(), denyWithinAllow: [...denyWrite].sort() },
+        writeConfig: { allowOnly: [...new Set(allowOnly)].filter(path => path === "/" || !isProtected(path.replace(/\*$/, ""))).sort(), denyWithinAllow: [...denyWrite].sort() },
         allowMachLookup: [...grants.machLookup ?? [], ...grants.signIns?.mach ?? []],
+        ...(grants.browser === true ? { browser: true } : {}),
         ...(grants.keychain === true ? { keychain: true } : {}),
         network: network === undefined || network.mode === "open" ? { kind: "open" } : {
             kind: "proxy", httpPort: network.proxyPort, ...(network.brokerPorts[0] === undefined ? {} : { socksPort: network.brokerPorts[0] }),
@@ -1077,7 +1110,9 @@ export function launchSandboxOf(profile) {
 export function fenceFor(kind, ctx) {
     const home = ctx.home === undefined ? {} : { home: ctx.home };
     // The project's read denies join the fence by name, there or not (the runtime denies a path that isn't there yet).
-    const fence = agentFence({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, ...home, boundary: ctx.boundary, binding: ctx.binding, runFolders: ctx.runFolders, extra: [...ctx.extra ?? [], ...ctx.readDeny ?? []] });
+    // Protected storage, resolved once for this launch, from the plane's own environment (protected-storage.ts).
+    const storage = protectedStorageDenies(ctx.home ?? homedir());
+    const fence = agentFence({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, ...home, boundary: ctx.boundary, binding: ctx.binding, runFolders: ctx.runFolders, extra: [...ctx.extra ?? [], ...ctx.readDeny ?? []], protectedStorage: storage });
     const found = fenceGrants({ databaseFile: ctx.databaseFile, worktree: ctx.worktree, boundary: ctx.boundary, runFolders: ctx.runFolders, linked: ctx.linked ?? null, binding: ctx.binding, ...home, poolRoots: ctx.poolRoots });
     // Toolroll's own install, the sandbox runtime's package and the Node running them, never written by anything it
     // launches: rewriting the code that fences a build would switch the fence off.
@@ -1088,10 +1123,13 @@ export function fenceFor(kind, ctx) {
         ...(written === null ? {} : { writes: written.writes, readOnly: [...new Set([...made.readOnly, ...written.readOnly])].sort() }),
         ...(ctx.network === undefined ? {} : { network: ctx.network }),
         ...(ctx.machLookup === undefined || ctx.machLookup.length === 0 ? {} : { machLookup: [...ctx.machLookup] }),
+        // A project's checks may drive a browser (Playwright's Chromium); builds, flows and tool servers don't get it.
+        ...(kind === "check" ? { browser: true } : {}),
         // A build's agent signs in from the keychain (Claude Code does); nothing else it launches reaches it.
         ...(kind === "build" ? { keychain: true } : {}),
         // Under a write allowlist these are out of reach already; where the launch writes anywhere, they are denied by name.
         writeDenies: homeWriteDenies(ctx.home ?? homedir(), ctx.binding, ctx.provider ?? null),
+        protectedStorage: storage,
         ...(made.pool === undefined ? {} : { pool: { ...made.pool, ...(ctx.policy === 2 ? { readable: true } : {}),
                 // Flows' scratch folders in the pool (and any the caller names) stay denied whole, at every policy version.
                 sealed: sealedScratch(ctx.poolRoots, ctx.scratchRoots ?? []) } }),
@@ -1232,7 +1270,7 @@ export function homeWriteDenies(home, binding, provider, platform = process.plat
  * where it always has), and never the build's own checkout or launch folder read back (nothing a build wrote loads in a
  * process that holds a tool's secrets). */
 export function serverGrantsOf(grants) {
-    const { network: _agentOnly, writes: _agentWrites, keychain: _agentKeychain, ...rest } = grants;
+    const { network: _agentOnly, writes: _agentWrites, keychain: _agentKeychain, browser: _checkOnly, ...rest } = grants;
     return {
         ...rest,
         ...(rest.pool === undefined ? {} : { pool: { ...rest.pool, own: null } }),

package/dist/approval-authority.d.ts

@@ -0,0 +1,20 @@
+/** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
+ * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
+ * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
+export declare const authorityStandsSql: (scope: string, repo: string, now: string) => string;
+/** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
+ * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */
+export declare const carrySealSql: (scope: string) => string;
+/**
+ * SQL: a task that belongs to a release authority (its anchor, or a carried commit) dispatches only as the current
+ * generation's tip while the release is open and unexpired, with the anchor's approver still an active approver who
+ * can reach the project and the anchor's approval on its exact sealed digest. A task that belongs to no release passes.
+ * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides.
+ */
+export declare const releaseStandsSql: (scope: string, now: string) => string;
+/** SQL: a machine made this seal — any proof at the seal's instant that isn't a person's (whatever its detail says,
+ * parsed or not: fail closed), or the lead's own approval act then. */
+export declare const machineSealSql: (scope: string) => string;
+/** SQL: a person's proof at the seal's instant for these exact bytes, its detail parsed (the versioned JSON record,
+ * whitespace and all, or the legacy text). */
+export declare const personSealSql: (scope: string) => string;

package/dist/approval-authority.js

@@ -0,0 +1,67 @@
+/**
+ * Which approval authorities stand, as ONE SQL predicate every dispatch belt shares (docs/plans/approval-policy.md
+ * §1.5): the queue's dispatch query, the work index, and the claim and build belts (`Store.modeApprovalLive`).
+ *
+ * An allowlist, never a deny-list: a person's yes (`password`, `chat`) stands unless a machine made that seal; a mode
+ * or a flow grant stands while its signature does; a standing order's firing (`schedule`, or an old firing stored as
+ * `password`) stands while its approver can still approve in the project. Everything else — the lead (`lead`, which
+ * phase 1 never lets stand), a null basis, a word this code doesn't write — stands on nothing.
+ *
+ * The seal's origin is read from the acts recorded AT the seal's own instant, exactly as scope.ts sealOriginOf reads
+ * it: an older proof for the same bytes never vouches for a later seal.
+ */
+import { grantStandsSql } from "./flow-unattended.js";
+import { accountReachesSql } from "./project-access.js";
+/** The proofs a person gives (src/person-proof.ts), as an SQL list. */
+const PERSON_PROOFS = "('password-now', 'sso-now', 'fresh-password', 'fresh-sso', 'session', 'cli-login', 'chat', 'passkey')";
+/** SQL over a `task_scope` alias and a repo expression: whether that row's approval authority stands at `now` (an SQL
+ * expression, used exactly three times: the mode and grant clauses, and the release's expiry). It never asks whether the row is approved.
+ * COALESCE: a NULL basis would make the OR chain NULL, and NOT NULL reads as "not dead"; NULL stands on nothing. */
+export const authorityStandsSql = (scope, repo, now) => `COALESCE((((COALESCE(${scope}.approval_basis, '') IN ('password', 'chat') AND NOT ${machineSealSql(scope)}
+        AND (${personSealSql(scope)} OR NOT ${automationSql(scope)} OR ${approverStandsSql(scope, repo)}))
+    OR (${scope}.approval_basis = 'carried' AND ${carrySealSql(scope)})
+    OR (${scope}.approval_basis = 'mode' AND EXISTS (SELECT 1 FROM operating_mode om
+          JOIN approver signer ON signer.name = om.signed_by
+         WHERE om.repo = ${repo} AND om.revoked_at IS NULL AND om.absolute_expiry > ${now} AND om.digest = ${scope}.mode_digest
+           AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", repo)}))
+    OR (${scope}.approval_basis = 'grant' AND ${grantStandsSql(`${scope}.mode_digest`, now, repo)})
+    OR (${scope}.approval_basis = 'schedule' AND ${approverStandsSql(scope, repo)}))
+    AND ${releaseStandsSql(scope, now)}), 0)`;
+/** SQL: a `carried` seal stands only on its own carry row — this task, this approved digest, this candidate, and the
+ * reference `<authority>:<carry>` the carry transaction wrote (release-once.md). */
+export const carrySealSql = (scope) => `EXISTS (SELECT 1 FROM release_carry rc2 JOIN release_authority ra2 ON ra2.id = rc2.authority
+      WHERE rc2.task_id = ${scope}.task_id AND rc2.scope_digest = ${scope}.approved_digest AND rc2.to_sha = ${scope}.candidate
+        AND ${scope}.mode_digest = ra2.id || ':' || rc2.id)`;
+/**
+ * SQL: a task that belongs to a release authority (its anchor, or a carried commit) dispatches only as the current
+ * generation's tip while the release is open and unexpired, with the anchor's approver still an active approver who
+ * can reach the project and the anchor's approval on its exact sealed digest. A task that belongs to no release passes.
+ * The claim and build belts read the whole predicate (scope.ts liveReleaseOf) besides.
+ */
+export const releaseStandsSql = (scope, now) => `((NOT EXISTS (SELECT 1 FROM release_authority rx WHERE rx.anchor_task = ${scope}.task_id)
+      AND NOT EXISTS (SELECT 1 FROM release_carry cx WHERE cx.task_id = ${scope}.task_id))
+    OR EXISTS (SELECT 1 FROM release_authority ra WHERE ra.tip_task = ${scope}.task_id AND ra.state = 'open' AND ra.expires_at > ${now}
+        AND (ra.anchor_task = ${scope}.task_id OR EXISTS (SELECT 1 FROM release_carry rc WHERE rc.authority = ra.id AND rc.task_id = ${scope}.task_id))
+        AND NOT EXISTS (SELECT 1 FROM release_authority rn WHERE rn.repo = ra.repo AND rn.version = ra.version AND rn.pr = ra.pr AND rn.generation > ra.generation)
+        AND EXISTS (SELECT 1 FROM task_scope an JOIN approver ap ON ap.name = an.approved_by
+            WHERE an.task_id = ra.anchor_task AND an.approved_digest = ra.anchor_digest AND an.digest = ra.anchor_digest
+              AND ap.revoked_at IS NULL AND ap.role = 'approver' AND ${accountReachesSql("ap", "ra.repo")})))`;
+/** SQL: a machine made this seal — any proof at the seal's instant that isn't a person's (whatever its detail says,
+ * parsed or not: fail closed), or the lead's own approval act then. */
+export const machineSealSql = (scope) => `(EXISTS (SELECT 1 FROM action_ledger mp WHERE mp.task_id = ${scope}.task_id AND mp.action = 'approval proved'
+       AND mp.actor = ${scope}.approved_by AND mp.at = ${scope}.approved_at AND mp.outcome NOT IN ${PERSON_PROOFS})
+    OR EXISTS (SELECT 1 FROM task_act la JOIN task_ref lr ON lr.id = la.task_ref AND lr.backend = 'built-in'
+       WHERE lr.external_id = ${scope}.task_id AND la.act = 'approved' AND la.lead = 1
+         AND la.account = ${scope}.approved_by AND la.at = ${scope}.approved_at))`;
+/** SQL: a person's proof at the seal's instant for these exact bytes, its detail parsed (the versioned JSON record,
+ * whitespace and all, or the legacy text). */
+export const personSealSql = (scope) => `EXISTS (SELECT 1 FROM action_ledger pp WHERE pp.task_id = ${scope}.task_id AND pp.action = 'approval proved'
+      AND pp.actor = ${scope}.approved_by AND pp.at = ${scope}.approved_at AND pp.outcome IN ${PERSON_PROOFS}
+      AND CASE WHEN json_valid(pp.detail) THEN json_extract(pp.detail, '$.v') = 1 AND json_type(pp.detail, '$.digest') = 'text'
+                                            AND json_extract(pp.detail, '$.digest') = ${scope}.approved_digest
+               ELSE pp.detail LIKE '% · generation % · digest ' || ${scope}.approved_digest END)`;
+/** SQL: the task a standing order's firing filed (its own record of the firing). */
+const automationSql = (scope) => `EXISTS (SELECT 1 FROM flow_trigger_event fe WHERE fe.task = ${scope}.task_id)`;
+/** SQL: the seal's approver can still approve in the project. */
+const approverStandsSql = (scope, repo) => `EXISTS (SELECT 1 FROM approver sched WHERE sched.name = ${scope}.approved_by AND sched.revoked_at IS NULL AND sched.role = 'approver'
+      AND ${accountReachesSql("sched", repo)})`;

package/dist/assignment.js

@@ -4,10 +4,10 @@
 import { createHash } from "node:crypto";
 import { currentActor, withActor } from "./actor.js";
 import { replacedWords } from "./task-status.js";
-import { COMPLETER_ACTOR, COMPLETION_ACTION, familyChangedFiles, landedReasonOf } from "./result-completion.js";
+import { COMPLETER_ACTOR, COMPLETION_ACTION, COMPLETION_BY_MACHINE, COMPLETION_BY_PERSON, familyChangedFiles, landedReasonOf, personCompletionOwed } from "./result-completion.js";
 import { homedir } from "node:os";
 import { readSchemaVersion, stopFactOf } from "./store.js";
-import { approvalOf } from "./scope.js";
+import { approvalOf, liveReleaseOf, machineActing } from "./scope.js";
 import { openWorkDecisionOf, taskWorkSummaryOf, workDecisionAction } from "./work-summary.js";
 import { evidenceRoot, readVerifiedArtifact, readVerifiedReport, verifyArtifact } from "./evidence.js";
 import { sweepIfMoved } from "./sweep-gate.js";
@@ -119,6 +119,10 @@ function buildChecks(store, root, runId) {
         if (receipt === null)
             return { ...unavailable(level === "off" ? "Checks were off for this build." : "No machine check is recorded."), status: "not-run" };
         const ran = receipt.result.ran === true, exitCode = ran ? receipt.result.exitCode : null;
+        // A release check whose coverage fell short (release-once.md) failed, whatever its command exited with.
+        if (receipt.result.failure === "coverage-incomplete")
+            return { status: "failed", exitCode: null, command: receipt.command.command, logArtifactId: receipt.log.artifactId, level,
+                detail: "Checks didn't cover everything this release owed, or a required test went missing." };
         // The sealed receipt names the grant that ran: the quick one, or the full one.
         const sealedLevel = typeof receipt.command?.repo === "string" && receipt.command.repo.startsWith("quick:") ? "quick" : "full";
         const words = sealedLevel === "quick" ? "Quick checks" : "Checks";
@@ -450,8 +454,19 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
     if (!/^[a-f0-9]{64}$/.test(receiptDigest) || current.receipt?.digest !== receiptDigest)
         return { ok: false, reason: "stale", message: "The result changed. Read the current assignment before checking it." };
     const receipt = current.receipt;
+    // The nightly check of main is a check only (release-once.md, part 3): nobody completes it.
+    if (store.handle.prepare("SELECT 1 AS hit FROM nightly_check WHERE task = ?").get(current.receipt.taskId) !== undefined)
+        return { ok: false, reason: "check-only", message: "The nightly check of main is only a check; it isn't completed." };
     if (current.state !== "ready-to-check" && current.state !== "complete")
         return { ok: false, reason: "not-ready", message: "This assignment still has unresolved execution, scope or decisions." };
+    // A release task completes only while its release approval stands for it (release-once.md, liveReleaseOf).
+    const release = liveReleaseOf(store, current.receipt.taskId, "complete", now);
+    if (release.applies && !release.ok)
+        return { ok: false, reason: "release", message: `This release can't be completed: ${release.why}.` };
+    // Who is completing, from trusted context (approval policy §1.7a): a person, or a machine credential (the lead's
+    // token, a remote API run) that may complete ordinary work but is never the second person on protected work.
+    const person = actor.startsWith("operator:") && !machineActing() ? actor.slice("operator:".length) : null;
+    const marked = actor.startsWith("operator:") ? (person === null ? COMPLETION_BY_MACHINE : COMPLETION_BY_PERSON) : null;
     if (current.state !== "complete") {
         // The one readiness guard: a failed or missing required check, an unresolved requirement or HIGH finding refuses.
         const blockers = current.readiness?.blockers ?? [];
@@ -459,11 +474,11 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
             return { ok: false, reason: "not-ready", message: blockers.map(one => one.message).join(" ") };
         // v102: declared paths are only a promise. A result whose actual diff reaches protected files, on a
         // scope one person approved, completes only by someone else — two people have then seen the work.
-        const problem = store.protectedResultProblem(receipt.taskId, familyChangedFiles(store, receipt.taskId, receipt.runId, root), actor.startsWith("operator:") ? actor.slice("operator:".length) : null);
+        const problem = store.protectedResultProblem(receipt.taskId, familyChangedFiles(store, receipt.taskId, receipt.runId, root), person);
         if (problem !== null)
             return { ok: false, reason: "approval-rules", message: problem };
         store.recordAction({ at: now.toISOString(), actor, repo: current.repo,
-            taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work" });
+            taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work", detail: marked });
         const ref = store.lookupRef(current.rootId);
         // Whose act this is, even outside a command that named its person: the operator who marked it.
         const by = currentActor() ?? (actor.startsWith("operator:") ? { account: actor.slice("operator:".length), lead: false } : null);
@@ -471,6 +486,13 @@ function acknowledgeCurrent(store, current, receiptDigest, actor, now, root, acc
             store.noteTaskAct(ref.id, "completed", now, undefined, by);
         store.bumpWake();
     }
+    else if (person !== null && personCompletionOwed(store, receipt.taskId, receipt.runId, receiptDigest, person, root)) {
+        // Already complete, but no person's completion is on record that lets protected work publish (a machine's, or one
+        // from before completions said who made them): this person's completion is recorded now (approval policy §1.7a).
+        store.recordAction({ at: now.toISOString(), actor, repo: current.repo,
+            taskId: current.rootId, runId: receipt.runId, action: CHECK_ACTION, outcome: receiptDigest, source: "work", detail: COMPLETION_BY_PERSON });
+        store.bumpWake();
+    }
     const assignment = assignmentOf(store, current.rootId, now, access, root);
     noteAssignmentStatus(store, assignment, now);
     return { ok: true, assignment };