toolroll 0.9.71 → 0.9.73

package/dist/scope.js

@@ -571,6 +571,7 @@ export function canonicalAcceptance(criteria) {
         .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
         .map(c => ({ id: c.id, statement: c.statement.trim(), evidence: [...c.evidence].sort() }));
 }
+export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried"];
 /**
  * The exact bytes an operator agreed to.
  *
@@ -615,6 +616,7 @@ route) {
         // like an absent v41 field. Strict is an explicit signed promise.
         ...(scope.qualityMode === "strict" ? { qualityMode: "strict" } : {}),
         ...(scope.candidate ? { candidate: scope.candidate } : {}),
+        ...(scope.releaseTerms == null ? {} : { releaseTerms: releaseTermsDigest(scope.releaseTerms) }),
         // The single outer key, whichever target produced its inner value:
         // absent => the golden and every profileless approval are untouched;
         // a legacy profile => its exact profileDigestOf; an explicit chain
@@ -667,6 +669,7 @@ function proposeLocked(store, input) {
         ...(permissionMode === undefined ? {} : { permissionMode }),
         ...(input.qualityMode === undefined ? {} : { qualityMode: input.qualityMode }),
         ...(posture === undefined ? {} : { posture }),
+        ...(input.releaseTerms === undefined ? {} : { releaseTerms: input.releaseTerms }),
         proposedVia,
     });
     // The store may have RECOMPUTED the digest to bind the resolved profile
@@ -1060,6 +1063,10 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const authenticated = authenticateApprover(store, by, token, store.lookupRef(taskId)?.repo ?? null);
         if (!authenticated.ok)
             return authenticated;
+        // ONLY A PERSON APPROVES (docs/plans/approval-policy.md, phase 1): a lead token or a remote API token proves the
+        // credential, not a person at a ceremony. Refused before any vote or proof row is written.
+        if (!personProof(authenticated.method))
+            return { ok: false, reason: "machine-proof" };
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
@@ -1087,6 +1094,10 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         const policy = store.scopePolicyRefusal(taskId);
         if (policy !== null)
             return { ok: false, reason: "policy", message: policy };
+        // A release scope's yes opens its authority record (release-once.md); say first why it can't.
+        const releaseProblem = scope.releaseTerms == null ? null : releaseSealProblem(store, scope.releaseTerms);
+        if (releaseProblem !== null)
+            return { ok: false, reason: "policy", message: releaseProblem };
         const gate = store.approvalGate(taskId, by, "person");
         if (gate.verdict === "refuse")
             return { ok: false, reason: gate.reason };
@@ -1103,7 +1114,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
             // The same person again adds nothing: no new vote, no proof row (and the approval roads refund a re-check).
             if (gate.already)
                 return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: true };
-            store.recordApprovalVote(taskId, scope.digest, by, now);
+            store.recordApprovalVote(taskId, scope.digest, by, now, authenticated.method);
             proved();
             return { ok: false, reason: "second-approver", have: gate.have, need: gate.need, already: gate.already };
         }
@@ -1113,7 +1124,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         try {
             return store.savepoint(() => {
                 if (gate.protectedWork)
-                    store.recordApprovalVote(taskId, scope.digest, by, now);
+                    store.recordApprovalVote(taskId, scope.digest, by, now, authenticated.method);
                 // SEAL, never re-resolve: the approval snapshots the stored working
                 // profile — the exact bytes the digest the approver signed was bound
                 // to. Routing saveScope here would re-run resolution and could sign a
@@ -1143,10 +1154,10 @@ export const approvalProofDetail = (at, generation, digest) => `${new Date(at).t
 export function approvalProofOf(store, taskId, by, digest) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);
     for (const row of rows) {
-        const parts = typeof row["detail"] === "string" ? row["detail"].split(" · ") : [];
-        if (parts.length !== 3 || parts[2] !== `digest ${digest}` || Number.isNaN(Date.parse(parts[0])))
+        const read = proofDetailOf(row["detail"]);
+        if (read === null || read.digest !== digest)
             continue;
-        return { method: String(row["outcome"]), at: parts[0] };
+        return { method: String(row["outcome"]), at: read.at };
     }
     return null;
 }
@@ -1161,7 +1172,7 @@ export function freshlyApprovable(store, taskId, scope, singleApprover) {
     if (ref === undefined || ref["coordinator_cid"] != null)
         return false;
     const via = store.handle.prepare("SELECT proposed_via FROM task_scope WHERE task_id = ?").get(taskId)?.["proposed_via"];
-    return !(via === "mate" || via === "coordinator" || via === "scout");
+    return !quarantinedAuthor(typeof via === "string" ? via : null);
 }
 /**
  * Whether this task may be built.
@@ -1179,6 +1190,15 @@ export function approvalOf(scope) {
     }
     if (scope.approvedDigest !== scope.digest)
         return { approved: false, reason: "changed" };
+    // A seal stands on a known authority (approval-policy plan §1.5): one left out or undefined, null (a row from before
+    // the basis column) or a word this code doesn't write is no approval.
+    if (scope.approvalBasis === undefined || scope.approvalBasis === null || !APPROVAL_BASES.includes(scope.approvalBasis)) {
+        return { approved: false, reason: "none" };
+    }
+    // Phase 1: only people approve, so a lead's seal (including an old one a lead token made through the person's road,
+    // which Store.getScope reads as `lead`) is no approval, and the person sees the Approve control again.
+    if (scope.approvalBasis === "lead")
+        return { approved: false, reason: "none" };
     return { approved: true, at: scope.approvedAt, by: scope.approvedBy };
 }
 /**
@@ -1239,7 +1259,7 @@ export function scopeAuthorityOf(scope, env = {}) {
     const parity = routeParityProblem(route, profile, { riskLevel: scope.riskLevel ?? "routine", qualityMode: scope.qualityMode ?? "default" });
     if (parity !== null)
         return { ok: false, reason: "parity", problem: parity };
-    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default" }, profile, route);
+    const digest = digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, qualityMode: scope.qualityMode ?? "default", releaseTerms: scope.releaseTerms ?? null }, profile, route);
     if (digest !== scope.digest) {
         return { ok: false, reason: "digest", problem: "the scope's reference does not re-derive from its own terms, agents, and route — file it again" };
     }
@@ -1298,10 +1318,35 @@ export function describeScope(scope, readiness = NO_READINESS) {
         ...(scope.profile?.checkAccess === undefined ? [] : [`  checks       ${checkAccessWords(scope.profile.checkAccess)}`]),
         // Its sandbox terms (project-sandbox.ts), part of what the yes agrees to: what it reads, and any widening.
         ...(scope.profile === null || scope.profile === undefined ? [] : ((terms) => [`  reads        ${terms.reads}`, ...(terms.mach === null ? [] : [`  services     ${terms.mach}`])])(sandboxTermsWords(scope.profile))),
+        ...releaseTermsWords(scope.releaseTerms ?? null),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];
 }
+/** The approval sheet's release lines (release-once.md): the release in one sentence, then what asks again. */
+export function releaseTermsSentence(terms) {
+    if (!terms.policy.carry)
+        return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Every later commit asks for your approval again.`;
+    const outside = terms.access === "sandboxed" ? "" : " This project's checks don't run in the sandbox: those later test-only commits will run outside the sandbox without being shown to you first.";
+    return `Release ${terms.packageVersion} from pull request #${terms.pr} at ${terms.approvedSha.slice(0, 7)}. Later commits on this pull request that only change tests, docs or the changelog ship without asking you again, until it merges or for 3 days. You'll see each one in the release summary.${outside}`;
+}
+/** What asks again, in full: the terms behind the sentence. */
+export function releaseAsksAgainWords(terms) {
+    const p = terms.policy;
+    return [
+        "A later commit asks again when it changes anything but unit tests, the journey scripts, docs under docs/, the README or the changelog;",
+        "when it touches AGENTS.md, CLAUDE.md, SECURITY.md, agent or CI settings, the test harness, helpers or fixtures;",
+        `when it deletes, renames or changes the mode of a file, adds a binary, a symlink or a submodule; when it changes the production build;`,
+        `when more than ${p.limits.lines} lines or ${p.limits.files} files change after this approval, or ${p.limits.churn} lines of churn;`,
+        ...(p.protectProject ? ["when it changes anything: this project is protected;"] : p.protectedPaths.length === 0 ? [] : [`when it changes a protected path: ${p.protectedPaths.join(", ")};`]),
+        `and always once the deploy starts. Repository ${terms.repo}, branch ${terms.branch} into ${terms.base}, check grant ${terms.grant.id}, ${terms.access === "sandboxed" ? "checks in the sandbox" : `checks outside the sandbox (${terms.access}), carried because the project allows it`}, until ${terms.expiresAt}.`,
+    ];
+}
+function releaseTermsWords(terms) {
+    if (terms === null)
+        return [];
+    return [`  release      ${releaseTermsSentence(terms)}`, ...(terms.policy.carry ? releaseAsksAgainWords(terms).map(line => `               ${line}`) : [])];
+}
 function describeApproval(approval) {
     if (approval.approved)
         return `yes, by ${approval.by} at ${approval.at}`;
@@ -1310,3 +1355,187 @@ function describeApproval(approval) {
     }
     return "no — nothing will build this until somebody agrees to it";
 }
+// ---- Only a person approves (docs/plans/approval-policy.md, phase 1). Kept last: the freshness tripwire pins places.
+export { personProof } from "./person-proof.js";
+import { personProof } from "./person-proof.js";
+import { releaseTermsDigest } from "./contracts/release-terms.js";
+import { CHECK_ACCESS_WIDTH, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseSealProblem } from "./release-authority.js";
+/** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
+export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
+/** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
+ * (`{"v":1,"at":…,"digest":…}`, more fields allowed). Any other shape is no proof. */
+export function proofDetailOf(detail) {
+    if (typeof detail !== "string")
+        return null;
+    if (detail.startsWith("{")) {
+        try {
+            const parsed = JSON.parse(detail);
+            if (parsed === null || typeof parsed !== "object" || parsed["v"] !== 1 || typeof parsed["at"] !== "string" || typeof parsed["digest"] !== "string")
+                return null;
+            if (Number.isNaN(Date.parse(parsed["at"])) || parsed["digest"] === "")
+                return null;
+            return { at: parsed["at"], digest: parsed["digest"] };
+        }
+        catch {
+            return null;
+        }
+    }
+    const parts = detail.split(" · ");
+    if (parts.length !== 3 || !parts[2].startsWith("digest ") || !/^generation \d+$/.test(parts[1]) || Number.isNaN(Date.parse(parts[0])))
+        return null;
+    return { at: parts[0], digest: parts[2].slice("digest ".length) };
+}
+/**
+ * A person's approval of this task as it stands: approved, on the current digest, by the ceremony (`password`) or a
+ * paired-chat tap (`chat`), with a person's proof recorded for that approver and those exact bytes. Release, deploy
+ * and the protected-work counters ask this; a lead, a mode, a grant, a schedule or an approval with no proof is not
+ * a person's.
+ */
+export function personApprovalOf(store, taskId) {
+    const scope = store.getScope(taskId);
+    if (scope === null || scope.approvedAt === null || scope.approvedBy === null || scope.approvedDigest === null)
+        return { ok: false, why: "not approved yet" };
+    if (scope.approvedDigest !== scope.digest)
+        return { ok: false, why: "the approval is for different scope text" };
+    const basis = scope.approvalBasis ?? null;
+    if (basis === "lead")
+        return { ok: false, why: "approved by the lead, not by a person" };
+    if (basis !== "password" && basis !== "chat")
+        return { ok: false, why: `approved by ${basis === null ? "an unknown road" : basis === "grant" ? "a flow" : basis}, not by a person` };
+    const origin = sealOriginOf(store, taskId, scope.approvedBy, scope.approvedDigest, scope.approvedAt);
+    if (origin.origin === "machine")
+        return { ok: false, why: origin.lead ? "approved by the lead, not by a person" : "approved with a machine credential, not by a person" };
+    if (origin.origin !== "person")
+        return { ok: false, why: "no record shows a person approved these exact words; approve it again" };
+    return { ok: true, by: scope.approvedBy, at: scope.approvedAt, method: origin.method };
+}
+/**
+ * Who made a seal that says it came through a person's road (`password`, `chat`), from the acts recorded AT THAT SEAL
+ * (approval policy §1.5): the proof rows its approver left at the seal's own instant, and the lead's task act then.
+ * - `machine`: any proof there that isn't a person's (a lead or remote token, or a word this code doesn't know), or the
+ *   lead's act — fail closed, whatever its digest says;
+ * - `person`: a person's proof there for these exact bytes (parsed, either form);
+ * - `automation`: a standing order's firing that no person's proof stands behind;
+ * - `unproven`: none of these (a seal from before proof rows): it dispatches as before, and is never a person's yes.
+ * An older proof for the same bytes never vouches for a later seal. The dispatch belts ask the same in SQL
+ * (approval-authority.ts).
+ */
+export function sealOriginOf(store, taskId, by, digest, at) {
+    const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? AND at = ? ORDER BY id DESC").all(taskId, APPROVAL_PROOF, by, at);
+    const leadAct = store.handle.prepare(`SELECT 1 AS hit FROM task_act a JOIN task_ref r ON r.id = a.task_ref AND r.backend = 'built-in'
+      WHERE r.external_id = ? AND a.act = 'approved' AND a.lead = 1 AND a.account = ? AND a.at = ?`).get(taskId, by, at) !== undefined;
+    const machine = rows.filter(row => !personProof(String(row["outcome"])));
+    if (leadAct || machine.length > 0)
+        return { origin: "machine", lead: leadAct || machine.some(row => row["outcome"] === "lead-token") };
+    const person = rows.find(row => proofDetailOf(row["detail"])?.digest === digest);
+    if (person !== undefined)
+        return { origin: "person", method: String(person["outcome"]) };
+    if (store.handle.prepare("SELECT 1 AS hit FROM flow_trigger_event WHERE task = ? LIMIT 1").get(taskId) !== undefined)
+        return { origin: "automation" };
+    return { origin: "unproven" };
+}
+/** Text another machine wrote (a confirmed chat proposal, a coordinator, a scout): no mode, grant, remembered password
+ * or chat tap seals it. The lead's own CLI text (`lead`) is not quarantined. */
+export const quarantinedAuthor = (via) => via === "mate" || via === "coordinator" || via === "scout";
+/** Which states each action may start from (deploy and merge also resume their own reservation). */
+const RELEASE_ACTION_STATES = {
+    dispatch: ["open"], complete: ["open"], deploy: ["open", "deploying"], merge: ["deploying", "merge-reserved"],
+};
+/**
+ * Whether a task that belongs to a release authority may do `action` now. It applies to EVERY such task, whether its
+ * seal is the person's own or `carried`, and requires all of: the authority's current generation (never superseded,
+ * revoked or expired before it started); a state that fits the action; the task is the authority's current tip; the
+ * anchor's seal is a person's (personApprovalOf, unchanged) on the exact sealed anchor digest; the anchor's approver is
+ * still an active approver with access to the project; for a carried task, a carry row for exactly this task, scope
+ * digest, candidate and generation; the release check grant and check access as sealed (access only ever the fence);
+ * a sealed policy this runtime knows; and, for deploy and merge, no open main-check failure blocking a composed check.
+ * A task that belongs to no release reads `applies: false` — the ordinary rules decide it.
+ */
+export function liveReleaseOf(store, taskId, action, now = new Date()) {
+    const found = releaseAuthorityOfTask(store, taskId);
+    if (found === null)
+        return { applies: false };
+    const { authority: a, carry } = found;
+    const refuse = (why) => ({ applies: true, ok: false, why, authority: a });
+    const newest = newestReleaseGeneration(store, a.repo, a.version, a.pr);
+    if (newest === null || newest.id !== a.id)
+        return refuse("a newer approval of this release replaced this one");
+    if (a.state === "superseded")
+        return refuse("a newer approval of this release replaced this one");
+    if (a.state === "revoked")
+        return refuse(`${a.endedBy ?? "an approver"} stopped carrying commits for this release`);
+    // Expiry stops every live state (security review): an operation already reserved finishes only through reconciliation.
+    if (a.state === "expired" || ((a.state === "open" || a.state === "deploying" || a.state === "merge-reserved") && a.expiresAt <= now.toISOString()))
+        return refuse("the release approval expired");
+    if (a.state === "merged")
+        return refuse("the release was already merged");
+    if (!RELEASE_ACTION_STATES[action].includes(a.state))
+        return refuse(a.state === "open" ? "the release hasn't started deploying" : `the release is already ${a.state === "deploying" ? "deploying" : "merging"}`);
+    if (a.tipTask !== taskId)
+        return refuse("this is not the release's current commit");
+    const anchor = store.getScope(a.anchorTask);
+    const person = personApprovalOf(store, a.anchorTask);
+    if (!person.ok)
+        return refuse(`the release approval no longer stands: ${person.why}`);
+    if (anchor === null || anchor.approvedDigest !== a.anchorDigest || anchor.digest !== a.anchorDigest)
+        return refuse("the release approval is for different words");
+    const account = store.accountOf(person.by);
+    if (account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(person.by, a.repo))
+        return refuse(`${person.by} can no longer approve in this project`);
+    const scope = store.getScope(taskId);
+    if (scope === null || scope.approvedDigest !== scope.digest)
+        return refuse("this task's approved words changed");
+    if (carry !== null) {
+        if (carry.authority !== a.id || scope.approvalBasis !== "carried" || carry.scopeDigest !== scope.digest || carry.toSha !== scope.candidate || scope.modeDigest !== `${a.id}:${carry.id}`) {
+            return refuse("this commit's carry doesn't match its record");
+        }
+    }
+    else if (scope.candidate !== a.approvedSha)
+        return refuse("this task isn't the approved commit");
+    const grant = store.liveVerifyCommand(a.repo);
+    if (grant === null || grant.id !== a.verifyCommand || grant.digest !== a.verifyDigest)
+        return refuse("the release check command changed since the approval");
+    // The checks reach no further than at the approval. Wider than the sandbox, a carried commit stands only while both
+    // the sealed and the current "Carry release approvals when checks aren't sandboxed" allow it (the stricter of the two).
+    const access = store.projectCheckAccess(a.repo);
+    const sealedWidth = CHECK_ACCESS_WIDTH[a.accessDigest], nowWidth = CHECK_ACCESS_WIDTH[access];
+    if (sealedWidth === undefined || nowWidth === undefined || nowWidth > sealedWidth)
+        return refuse(a.accessDigest === "sandboxed" ? "the project's checks no longer run in the sandbox" : "the project's checks reach further than when the release was approved");
+    if (carry !== null && (a.accessDigest !== "sandboxed" || access !== "sandboxed") && (a.policy?.unsandboxedCarry !== true || !carriesUnsandboxed(store, a.repo))) {
+        return refuse("carrying release approvals when checks aren't sandboxed is off");
+    }
+    if (a.policy === null)
+        return refuse("this Toolroll doesn't know the release's carry rules; update Toolroll first");
+    if (action === "deploy" || action === "merge") {
+        const debt = mainDebtProblem(store, a.repo, taskId);
+        if (debt !== null)
+            return refuse(debt);
+    }
+    return { applies: true, ok: true, authority: a, carry };
+}
+/**
+ * Open main-check failures (the nightly full check, part 3) block the deploy and the merge of a release whose gate
+ * check was composed from a targeted run: a full pass is needed first. Null when nothing blocks.
+ */
+export function mainDebtProblem(store, repo, taskId) {
+    const open = Number(store.handle.prepare("SELECT COUNT(*) AS n FROM main_check_failure WHERE repo = ? AND cleared_at IS NULL").get(repo)?.["n"] ?? 0);
+    if (open === 0)
+        return null;
+    const ref = store.lookupRef(taskId);
+    if (ref === null)
+        return null;
+    const newest = store.handle.prepare(`SELECT a.mode FROM run r JOIN release_check_attempt a ON a.run = r.id
+      WHERE r.task_ref = ? AND r.role = 'builder' ORDER BY r.id DESC LIMIT 1`).get(ref.id);
+    if (newest === undefined || newest["mode"] !== "targeted")
+        return null;
+    return `the nightly full check on main has ${open} open failure${open === 1 ? "" : "s"}, so a check made from a re-run of what failed can't deploy; a full check has to pass first`;
+}
+/**
+ * A deploy gate (docs/plans/chat-management.md §0a.5): a scope whose signed terms name a prepared candidate or carry
+ * release terms. Both are in the scope digest and written at filing, before any release authority exists, so this is
+ * read from the scope alone: a first approval and a fallback gate filed without --release are deploy gates too. From
+ * chat it is approved only through the release card.
+ */
+export function deployGateScope(scope) {
+    return (scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null;
+}

package/dist/server/flows.js

@@ -12,13 +12,13 @@ import { run as execRun } from "../exec.js";
 import { setFlowSecret } from "../flow-actions.js";
 import { addCardToFlow, advanceFlows, cancelFlowCard, crossProjectProblem, decideFlowCard, flowDefinitionOf, moveCardInFlow } from "../flow-engine.js";
 import { galleryHtml, galleryUseHtml } from "../flow-gallery-ui.js";
-import { galleryDefaults, galleryDiagram, galleryTemplateOf, galleryToolsOf, previewGallery, useGalleryTemplate } from "../flow-gallery.js";
+import { galleryAdmitsAnyone, galleryDefaults, galleryDiagram, galleryTemplateOf, galleryToolsOf, previewGallery, useGalleryTemplate } from "../flow-gallery.js";
 import { flowInsights } from "../flow-insights.js";
 import { assignFlowCard, commentOnFlowCard, watchFlowCard } from "../flow-people.js";
 import { saveScript } from "../flow-scripts.js";
 import { chooseFlowCard } from "../flow-send.js";
 import { exportFlow, fetchFlowFile, FlowFileError, importFlow, parseFlowFile, planFlowImport } from "../flow-share.js";
-import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveSigningSecret, setUpFlowHook, changeFlowHookSender, setFlowHookScope, shareFlowButton, stopSharingFlowButton, rawTakesDeliveries } from "../flow-triggers.js";
+import { addFlowTriggerTo, checkFlowTriggerNow, pressFlowButton, removeFlowTrigger, removeLinearKey, setFlowTriggerOn, renewFlowHook, saveHooksBase, saveLinearKey, saveSigningSecret, setUpFlowHook, changeFlowHookSender, setFlowHookScope, shareFlowButton, stopSharingFlowButton, rawTakesDeliveries, rawAdmitsAnyone } from "../flow-triggers.js";
 import { FLOW_IMPORT_SCRIPT, flowFallbackHtml, flowImportHtml, flowsListHtml, flowView } from "../flows-ui.js";
 import { FLOW_TEMPLATES, FlowContractError, validateFlowDefinition, withZoneNames } from "../flows.js";
 import { prepareUnattendedCandidates, parseUnattendedAsk, revokeUnattended, signUnattended, untilWords } from "../flow-unattended.js";
@@ -32,7 +32,7 @@ import { createWorkflowPreview, exportRecipe, findRecipe, importRecipe, launchWo
 import { isAlive as runnerAlive } from "../runner.js";
 import { createSubagentFrom, labelOf, nameOf, saveSoul, sendSubagentSummaries, setSubagentState, subagentSettings } from "../subagent-admin.js";
 import { addRoutine, removeRoutine, runRoutine } from "../subagent-desk.js";
-import { editMemory, forgetMemory, tellSubagent } from "../subagent-memory.js";
+import { ACCEPT as ACCEPT_SUGGESTION, editMemory, forgetMemory, tellSubagent } from "../subagent-memory.js";
 import { grantTool, revokeTool, rulesFromForm, setToolRules } from "../subagent-tools.js";
 import { sendSubagentWeeklies, undoCall } from "../subagent-week.js";
 import { answerSubagentQuestion } from "../subagent-work.js";
@@ -301,11 +301,16 @@ export function createFlowsHandlers(runtime) {
             return redirect(response, `/kits?problem=${encodeURIComponent("Choose one of your projects.")}`);
         const page = (key, words) => redirect(response, `/kits/${kit.id}?repo=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}`);
         if (step === "setup") {
-            const made = await setUpKit(store, kit, repo, who.name, now, options.configDir ?? null, { toolHome });
+            // Its tools come with it only on the person's proof (a password, or the session under Passwordless): a grant widens.
+            const proved = authenticateApprover(who, body.get("password") ?? "", repo).ok;
+            const made = await setUpKit(store, kit, repo, who.name, now, options.configDir ?? null, { toolHome }, proved ? { widening: "proved" } : {});
             return page(made.ok ? "said" : "problem", made.said);
         }
         if (step === "github") {
-            const made = addKitGithubTrigger(store, kit, repo, who.name, now, options.configDir ?? null);
+            // Issues from anyone on GitHub come into a flow: a widening, so it takes a password (chat-management.md §0a.3).
+            if (!authenticateApprover(who, body.get("password") ?? "", repo).ok)
+                return page("problem", "Enter your Toolroll password to bring in GitHub issues. Nothing changed.");
+            const made = addKitGithubTrigger(store, kit, repo, who.name, now, options.configDir ?? null, "proved");
             return page(made.ok ? "said" : "problem", made.said);
         }
         const tried = addKitSample(store, kit, repo, who.name, now);
@@ -330,7 +335,10 @@ export function createFlowsHandlers(runtime) {
         const card = question === null ? null : store.getFlowCard(question.card);
         const flow = card === null ? null : store.getFlow(card.flow);
         const done = question === null || flow === null || !visible(flow.repo) ? { ok: false, said: "No such question." }
-            : answerSubagentQuestion(store, question.id, { choice: body.get("choice"), text: body.get("text"), by: who.name, via: "web" }, now);
+            // Accepting a looser rule it suggested takes the password (chat-management.md §0a.3); every other answer doesn't.
+            : question.suggestion !== null && body.get("choice") === ACCEPT_SUGGESTION && !authenticateApprover(who, body.get("password") ?? "").ok
+                ? { ok: false, said: "Enter your Toolroll password to change the rule." }
+                : answerSubagentQuestion(store, question.id, { choice: body.get("choice"), text: body.get("text"), by: who.name, via: "web", ...(question.suggestion !== null ? { widening: "proved" } : {}) }, now);
         if (wantsJson)
             return respond(response, done.ok ? 200 : 409, "application/json; charset=utf-8", JSON.stringify(done));
         const back = question === null ? "/settings/lead/subagents" : `/settings/lead/subagents/${question.subagent}`;
@@ -403,9 +411,23 @@ export function createFlowsHandlers(runtime) {
             // v94: which project tools it may use, and its rule for each action.
             const tool = body.get("tool") ?? "", op = body.get("op");
             const grant = store.subagentGrant(mate.id, tool);
-            const changed = op === "grant" ? await grantTool(store, mate, tool, who.name, now, { toolHome })
+            // Giving a subagent a tool widens what it does unasked: a password (chat-management.md §0a.3). Revoking and
+            // tightening a rule don't need one.
+            if (op === "grant" && !authenticateApprover(who, body.get("password") ?? "", mate.repo).ok) {
+                return redirect(response, `${back}?problem=${encodeURIComponent(`Enter your Toolroll password to let ${nameOf(mate)} use ${tool}. Nothing changed.`)}#tools`);
+            }
+            const changed = op === "grant" ? await grantTool(store, mate, tool, who.name, now, { toolHome }, { widening: "proved" })
                 : op === "revoke" ? revokeTool(store, mate, tool, who.name, now)
-                    : grant === null ? { ok: false, said: `${nameOf(mate)} doesn't use ${tool}.` } : setToolRules(store, mate, tool, rulesFromForm(grant, key => body.sent.get(key)), who.name, now);
+                    : grant === null ? { ok: false, said: `${nameOf(mate)} doesn't use ${tool}.` } : (() => {
+                        // Loosening a rule widens what it does unasked: a password (chat-management.md §0a.3); tightening needs none.
+                        const changes = rulesFromForm(grant, key => body.sent.get(key));
+                        const tried = setToolRules(store, mate, tool, changes, who.name, now);
+                        if (tried.ok || !/takes your password/.test(tried.said))
+                            return tried;
+                        if (!authenticateApprover(who, body.get("password") ?? "", mate.repo).ok)
+                            return { ok: false, said: `Enter your Toolroll password to let ${nameOf(mate)} do more on its own. Nothing changed.` };
+                        return setToolRules(store, mate, tool, changes, who.name, now, { widening: "proved" });
+                    })();
             return redirect(response, `${back}?${changed.ok ? "said" : "problem"}=${encodeURIComponent(changed.said)}#tools`);
         }
         const done = part === "state" ? setSubagentState(store, mate, body.get("state") === "removed" ? "removed" : body.get("state") === "paused" ? "paused" : "active", who.name, now)
@@ -445,7 +467,11 @@ export function createFlowsHandlers(runtime) {
         }
         if (digest === null || digest !== body.get("previewed"))
             return sendGalleryUse(response, who, template, projects, repo, answers, name, digest === null ? null : "Your answers changed. Check the preview, then create the flow.");
-        const used = useGalleryTemplate(store, template, repo, answers, { name, by: who.name, now: clock(), dir: options.configDir ?? null });
+        // A template whose trigger brings in items from anyone takes the password (chat-management.md §0a.3).
+        const anyone = galleryAdmitsAnyone(template);
+        if (anyone && !authenticateApprover(who, body.get("password") ?? "", repo).ok)
+            return sendGalleryUse(response, who, template, projects, repo, answers, name, "Enter your Toolroll password: this flow brings in items from anyone.");
+        const used = useGalleryTemplate(store, template, repo, answers, { name, by: who.name, now: clock(), dir: options.configDir ?? null, ...(anyone ? { widening: "proved" } : {}) });
         if (!used.ok)
             return sendGalleryUse(response, who, template, projects, repo, answers, name, used.said);
         return redirect(response, `/flows/${used.flow}`);
@@ -576,7 +602,11 @@ export function createFlowsHandlers(runtime) {
             const ingress = rawTakesDeliveries(raw);
             if (ingress && !authenticateCredential(who, body.get("password") ?? "").ok)
                 return answer(403, { ok: false, said: "Enter your Toolroll password to make a webhook address." });
-            const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir, ingress ? { ingress: "proved" } : {});
+            // Items from anyone: a widening, an ordinary step-up (chat-management.md §0a.3).
+            const anyone = !ingress && rawAdmitsAnyone(raw);
+            if (anyone && !authenticateApprover(who, body.get("password") ?? "", flow.repo).ok)
+                return answer(403, { ok: false, said: "Enter your Toolroll password to bring in items from anyone." });
+            const made = addFlowTriggerTo(store, flow, raw, who.name, now, dir, ingress ? { ingress: "proved" } : anyone ? { widening: "proved" } : {});
             if (made.ok)
                 await prepareUnattendedCandidates(store, flow.id);
             return made.ok ? settle(made.said, made.reveal === null ? {} : { reveal: made.reveal }) : answer(400, { ok: false, said: made.message });

package/dist/server/render-settings.js

@@ -170,7 +170,7 @@ export function settingsPage(chrome, existing, hasEnv, csrf, problem, messaging
         : joinHtml([
             html `<h2>Unattended permissions</h2>`,
             permissionDefault.canManage && csrf !== ""
-                ? postForm("/settings/permission-default", html `${permissionModeChoices("permission-mode", permissionDefault.mode)}<button type="submit">Save default</button>`, { attrs: { class: "card permission-policy", "data-autosave": true } })
+                ? postForm("/settings/permission-default", html `${permissionModeChoices("permission-mode", permissionDefault.mode)}${permissionDefault.mode === "bypassPermissions" ? "" : reauth(html `<label>Your password <span class="meta">(needed for Full access)</span><input type="password" name="password" autocomplete="current-password"></label>`)}<button type="submit">Save default</button>`, { attrs: { class: "card permission-policy" } })
                 : html `<div class="card"><p><strong>${permissionDefault.mode === "bypassPermissions" ? "Full access" : "Auto"}</strong></p><p class="meta">An approver can change this default</p></div>`,
             permissionDefault.updatedAt === null
                 ? ""

package/dist/server/render-tasks.d.ts

@@ -1,3 +1,4 @@
+import type { ReleaseView } from "../release-view.js";
 import { type Html } from "../html.js";
 import { type RunActivity } from "../activity-line.js";
 import { type AgentChoice } from "../agentconfig.js";
@@ -522,6 +523,9 @@ export declare function taskBodyParts(data: {
         method: string;
         at: string;
     } | null;
+    /** One approval per release (release-once.md): the release this task belongs to, and whether this reader may stop it. */
+    release?: ReleaseView | null;
+    canStopRelease?: boolean;
     /** Workers that are both alive and authorized for this task's project. */
     worker?: {
         answering: number;
@@ -670,3 +674,7 @@ export declare function qualityModeChoices(name: string, selected: QualityMode):
 export declare function decisionOptionForms(decision: Decision, returnTo: string | null): Html;
 export declare function decisionPage(chrome: Chrome, decision: Decision, taskId: string, artifacts: Artifact[], who: Who, now: Date, returnTo?: string | null): Screen;
 export declare function taskOf(store: Store, decision: Decision): string;
+/** A release task's own card (release-once.md, "What people see"): the release it's approved for, the later commits
+ * carried under it (on demand), what a later check must run again, the last nightly check of main, and one action to
+ * stop carrying. A carried task says whose approval it was carried from. */
+export declare function releaseCardHtml(taskId: string, release: ReleaseView | null, canStop: boolean): Html;

package/dist/server/render-tasks.js

@@ -1,5 +1,6 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { networkWords } from "../egress.js";
+import { releaseAsksAgainWords, releaseTermsSentence } from "../scope.js";
 import { writesWords } from "../writes-mode.js";
 import { checkAccessWords } from "../check-access.js";
 import { sandboxTermsWords } from "../project-sandbox.js";
@@ -757,18 +758,28 @@ export function approvalProofWords(proof) {
         return " (passwordless: your signed-in session)";
     if (proof.method === "cli-login")
         return " (passwordless: this computer's remembered login)";
+    if (proof.method === "chat")
+        return " (from your paired chat)";
+    if (proof.method === "carried")
+        return " (carried from the release approval)";
     return "";
 }
 const whenText = (iso) => new Intl.DateTimeFormat("en-US", { hour: "numeric", minute: "2-digit" }).format(new Date(iso));
 export function approveRefusalWords(reason) {
     if (reason === "requester" || reason === "person-required")
         return gateWords({ verdict: "refuse", reason });
+    if (reason === "machine-proof")
+        return "not approved: only a person can approve this. Approve it on the task page or from your paired chat";
     if (reason === "unrouted")
         return "not approved: this scope predates agent routing and its old approval no longer stands — edit and re-file the scope so it is routed under today’s agents, then approve it";
     if (reason === "profile-unresolved")
         return "not approved: the scope cannot name an exact agent for every role — fix the agent setup and re-file it";
     if (reason === "password-now")
         return "not approved: this needs your password typed now — protected work, raised permissions, or a plan an agent wrote can't use a remembered one";
+    // A wrong password, someone who isn't an approver (or not for this project), a revoked login: one answer for all, so
+    // the refusal never tells a guesser which it was.
+    if (reason === "not-an-approver")
+        return "That password didn't match.";
     return `not approved: ${reason}`;
 }
 /** The browser's one-click approval binds not only the signed scope but the
@@ -1480,9 +1491,12 @@ export function taskBodyParts(data) {
             scope.touches.length === 0 ? "" : html `<p class="scope-paths"><strong>Touches</strong> ${scope.touches.join(", ")}</p>`,
             html `<p><strong>Quality</strong> ${qualityModeTitle(scope.qualityMode ?? "default")}</p>`,
             acceptanceCeremonyHtml(scope.acceptance),
-            approval.approved
-                ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
-                : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
+            scope.releaseTerms == null ? "" : html `<p><strong>Release</strong></p><p class="recap">${releaseTermsSentence(scope.releaseTerms)}</p>${scope.releaseTerms.policy.carry ? html `<details><summary>What asks again</summary><ul>${joinHtml(releaseAsksAgainWords(scope.releaseTerms).map(line => html `<li>${line}</li>`), "")}</ul></details>` : ""}`,
+            approval.approved && data.release?.kind === "carried"
+                ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                : approval.approved
+                    ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
+                    : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
             html `</div>`,
         ], "\n");
     // The scout's report (mate arc §10): title, summary, the document inert,
@@ -1773,9 +1787,11 @@ export function taskBodyParts(data) {
         : "";
     const scopeRow = scope === null
         ? prop("scope", "none yet")
-        : approval.approved
-            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
-            : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
+        : approval.approved && data.release?.kind === "carried"
+            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
+            : approval.approved
+                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
+                : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
     const strikesRow = data.strikes > 0 ? prop("strikes", `${data.strikes} failed attempt(s)`) : "";
     const propsCard = html `<div class="card props">${workerRow}${queueRow}${scopeRow}${publishesRow}${economics}${strikesRow}</div>`;
     // The same facts for the rebuilt page, row for row.
@@ -1790,8 +1806,11 @@ export function taskBodyParts(data) {
         facts.push({ label: "Queue", parts: [`${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : ` in ${data.position.column}'s queue`} · `, { label: "Reorder", href: "/board?view=order" }] });
     }
     facts.push(scope === null ? { label: "Scope", parts: ["none yet"] }
-        : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
-            : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
+        : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
+            : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
+                : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
+    if (data.release?.kind === "anchor")
+        facts.push({ label: "Release", parts: [`Approved for release ${data.release.version}`, ...(data.release.landed.length === 0 ? [] : [` · later commits: ${data.release.landed.map(one => one.sha.slice(0, 7)).join(", ")}`]), ...(data.release.carrying ? [] : [` · later commits ask again`])] });
     facts.push({ label: "Publishes as", parts: [publishesAs] });
     // v102: who asked for it, and what the project's approval rules need.
     if (data.filer != null)
@@ -2068,7 +2087,7 @@ export function taskBodyParts(data) {
         section("scope", 
         // The recipe road rides with the scope it reuses (UI polish
         // 2026-09-13), off the title-to-action path.
-        joinHtml([html `<h2>Scope</h2>`, scopeCard, data.repo !== null && data.scope !== null ? html `<p class="meta"><a href="/recipes/from-task?task=${encodeURIComponent(task.id)}">Reuse this scope as a recipe →</a></p>` : "", agentsCardHtml(task.id, data.route, data.canEditRoute === true), revisionInApproval ? "" : revisionCard, data.completion != null ? "" : repairChainHtml(data.repairChain ?? null), scopeForm], "\n"), scopeDraft !== undefined || (data.plan !== "requested" && approveForm === "" && !(scope === null && canPlan))),
+        joinHtml([html `<h2>Scope</h2>`, scopeCard, releaseCardHtml(task.id, data.release ?? null, data.canStopRelease === true), data.repo !== null && data.scope !== null ? html `<p class="meta"><a href="/recipes/from-task?task=${encodeURIComponent(task.id)}">Reuse this scope as a recipe →</a></p>` : "", agentsCardHtml(task.id, data.route, data.canEditRoute === true), revisionInApproval ? "" : revisionCard, data.completion != null ? "" : repairChainHtml(data.repairChain ?? null), scopeForm], "\n"), scopeDraft !== undefined || (data.plan !== "requested" && approveForm === "" && !(scope === null && canPlan))),
         dependencyChoiceNeeded ? "" : section("waits for", waitsForCard, (data.waitsFor ?? []).length > 0, (data.waitsFor ?? []).length),
         section("holds", holds, true, data.holds.length),
         cancelAct,
@@ -2461,3 +2480,25 @@ export function taskOf(store, decision) {
     const run = store.getRun(decision.run);
     return run === null ? "?" : store.externalIdFor(run.taskRef) ?? "?";
 }
+/** A release task's own card (release-once.md, "What people see"): the release it's approved for, the later commits
+ * carried under it (on demand), what a later check must run again, the last nightly check of main, and one action to
+ * stop carrying. A carried task says whose approval it was carried from. */
+export function releaseCardHtml(taskId, release, canStop) {
+    if (release === null)
+        return html ``;
+    if (release.kind === "carried")
+        return html `<div class="card" id="release"><p><strong>Carried from ${release.approver ?? "a person"}'s release approval</strong></p><p class="meta"><a href="${taskHref(release.anchorTask)}">Release ${release.version}</a> · pull request #${release.pr}</p></div>`;
+    const until = new Intl.DateTimeFormat("en-US", { weekday: "short", hour: "numeric", minute: "2-digit" }).format(new Date(release.expiresAt));
+    const landed = release.landed.length === 0 ? html `<p class="meta">No later commits yet.</p>`
+        : html `<ul>${joinHtml(release.landed.map(one => html `<li><a href="${taskHref(one.task)}">${one.sha.slice(0, 7)}</a> · ${one.files.map(file => `${file.path} (+${file.added} −${file.deleted})`).join(", ")}</li>`), "")}</ul>`;
+    return joinHtml([
+        html `<div class="card" id="release">`,
+        html `<p><strong>Approved for release ${release.version}</strong></p>`,
+        html `<p class="meta">${release.carrying ? `Later commits on pull request #${release.pr} that only change tests, docs or the changelog ship without asking again, until it merges or ${until}.` : `Later commits ask for approval again: ${release.why ?? `the release is ${release.state}`}.`}</p>`,
+        html `<details><summary>Later commits (${release.landed.length})</summary>${landed}</details>`,
+        release.obligations.length === 0 ? "" : html `<details><summary>Still to pass (${release.obligations.length})</summary><ul>${joinHtml(release.obligations.map(one => html `<li>${one}</li>`), "")}</ul></details>`,
+        release.nightly === null ? "" : html `<p class="meta">Nightly check of main: ${release.nightly.outcome ?? "running"} at ${release.nightly.sha.slice(0, 7)}${release.openMainFailures > 0 ? ` · ${release.openMainFailures} open failure${release.openMainFailures === 1 ? "" : "s"}` : ""}</p>`,
+        release.carrying && canStop ? postForm(`${taskHref(taskId)}/stop-carrying`, html `<button type="submit" class="secondary">Stop carrying later commits</button>`, { attrs: { class: "inline" } }) : "",
+        html `</div>`,
+    ], "\n");
+}