toolroll 0.9.71 → 0.9.73

package/dist/builder.js

@@ -8,6 +8,9 @@ import { queueBatchCheck } from "./batch-checks.js";
 import { batchesFullCheck } from "./batch-policy.js";
 import { skillsContext } from "./project-skills.js";
 import { failedVerificationEvidence, sealVerificationReceipt, verificationEvidence, reuseObservationVerification } from "./verification-evidence.js";
+import { CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, prepareCheckAttempt, sealCheckOutcome } from "./check-report.js";
+import { planTargetedRecheck, settleCoverage } from "./release-recheck.js";
+import { effectiveCheckFacts } from "./verification-evidence.js";
 import { learningContext } from "./project-learning.js";
 import { knowledgeContext } from "./project-knowledge.js";
 import { flowGoalCuts } from "./flow-engine.js";
@@ -322,12 +325,13 @@ export function proveApprovedProfile(scope, given) {
                 budgetMicrousd: scope.budgetMicrousd,
                 acceptance: scope.acceptance, candidate: scope.candidate ?? null,
                 qualityMode: scope.qualityMode ?? "default",
+                releaseTerms: scope.releaseTerms ?? null,
             }, snapshot, 
             // v47: the SEALED route is part of the signed bytes whenever it
             // says more than the legacy resolution — re-derived here from
             // the seal's own snapshot, never from mutable configuration.
             routeFromJson(scope.approvedRouteJson ?? null))
-            : digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null });
+            : digestOf({ goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, budgetMicrousd: scope.budgetMicrousd, acceptance: scope.acceptance, candidate: scope.candidate ?? null, releaseTerms: scope.releaseTerms ?? null });
         if (rederived !== scope.approvedDigest) {
             return { ok: false, message: "the approval record does not verify against the stored terms — re-approve (stale-approval)" };
         }
@@ -416,7 +420,7 @@ export async function build(store, request) {
         return {
             ok: false,
             reason: "mode-ended",
-            message: `${taskId}'s approval was signed by an operating mode that has ended — the approval falls back to a person`,
+            message: `${taskId}'s approval no longer stands (an ended mode or flow grant, or an approval that wasn't a person's) — a person approves it again`,
         };
     }
     // v24 DISPATCH PROOF (foundations rulings 10/12, findings 6/17): what is
@@ -2251,6 +2255,9 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     const batched = repo !== null && chosenCheck !== null && batchesFullCheck(store, repo, chosenCheck.level, configured);
     const gateCommand = batched ? null : configured;
     let verifyCommand;
+    let checkAttempt = null;
+    let releaseFacts = null;
+    const verification = { last: null };
     const checkLog = [];
     const checkOutcomes = [];
     const checkSuites = [];
@@ -2296,6 +2303,20 @@ async function settleProof(captured, statArtifactId, sealedHead) {
     else {
         const verifyRunner = request.verify ?? run;
         const verifyShell = approvedCommandShell(configured.command);
+        // A Full check of a prepared candidate (a release gate, the nightly check): its attempt is sealed before the command
+        // runs — intended mode, nonce, inventory, context — and the handshake goes on its stdin (check-report.ts).
+        // A release task's check is targeted when the release's last full check allows it (release-recheck.ts): its plan and
+        // obligation snapshot are sealed with the attempt; otherwise it runs in full, told which tests it must still report.
+        if (repo !== null && chosenCheck?.level === "full" && (store.getScope(request.taskId)?.candidate ?? null) !== null) {
+            const access = checkLaunchOf(store, runId, captured.effective.profile).access;
+            const decision = planTargetedRecheck(store, root, { runId, taskId: request.taskId, repo, head: sealedHead, command: configured, access, now: now() });
+            checkAttempt = prepareCheckAttempt(store, root, { runId, repo, head: sealedHead, command: configured, access, authority: decision.authority,
+                ...(decision.mode === "targeted" ? { plan: decision.plan, snapshot: decision.snapshot } : {}), watch: decision.watch }, now());
+            if (checkAttempt !== null && decision.mode === "targeted")
+                store.addRunNote(runId, "Toolroll", `Re-running only what failed at run #${decision.plan.base}: ${decision.plan.units.length} unit files, ${decision.plan.groups.reduce((n, one) => n + one.groups.length, 0)} journey groups, ${decision.plan.versions.length} upgrade versions${decision.plan.parts.length > 0 ? `, and in full: ${decision.plan.parts.join(", ")}` : ""}.`, now());
+        }
+        else
+            checkAttempt = null;
         const checkProgress = new CheckProgressTracker(snapshot => {
             store.saveCheckProgress(runId, snapshot, now());
         });
@@ -2315,6 +2336,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
                 },
                 envAllowlist: SETUP_ENV_ALLOWLIST,
                 omitEnv: SETUP_ENV_DENYLIST,
+                ...(checkAttempt === null ? {} : { stdin: checkAttempt.stdin }),
                 onStdout: chunk => { streamed.stdout = true; checkProgress.feed(chunk, "stdout"); },
                 onStderr: chunk => { streamed.stderr = true; checkProgress.feed(chunk, "stderr"); },
             }));
@@ -2327,6 +2349,7 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             checkOutcomes.push(attemptOutcome(label, result));
             noteCheckSuite(label, result);
             checkLog.push(attemptLog(label, configured.command, result));
+            verification.last = result;
             return result;
         };
         const ownInstallIfChanged = async () => {
@@ -2497,6 +2520,22 @@ async function settleProof(captured, statArtifactId, sealedHead) {
             }
         }
         checkProgress.finish();
+        // The check's own report (the last line carrying the nonce), sealed beside what was sealed before it ran.
+        const last = verification.last;
+        if (checkAttempt !== null && last !== null && !last.notFound) {
+            sealCheckOutcome(store, root, checkAttempt, { stdout: last.stdout, exitCode: last.timedOut ? null : last.code }, now());
+        }
+        // What the check covered (receipt version 3): full, composed from the release's last full check, partial, or
+        // identity-removed (which stops the release carrying).
+        if (checkAttempt !== null) {
+            const settled = settleCoverage(store, root, { runId, taskId: request.taskId, exitCode: last === null || last.notFound || last.timedOut ? null : last.code, now: now() }, run => { const gate = verificationEvidence(store, root, run); return gate.ok ? gate.digest : null; });
+            const sha = (capture) => { const found = store.artifactsFor(runId).filter(a => a.kind === "structured-output" && a.capture === capture); return found.length === 1 ? found[0].sha256 : null; };
+            // The one place coverage meets the outcome: a partial or identity-removed check is a failed attempt for every
+            // reader from here on (the verdict, the run's check, the receipt, reuse, the deploy gates).
+            const effective = effectiveCheckFacts(verifyCommand, { coverage: settled.coverage, check: { attempt: checkAttempt.mode, report: sha(CHECK_REPORT_CAPTURE), inventory: sha(CHECK_INVENTORY_CAPTURE) }, composed: settled.composed });
+            verifyCommand = effective.result;
+            releaseFacts = effective.facts;
+        }
     }
     if (configured !== null && checkLog.length > 0) {
         const summary = `=== Attempt summary ===\n${checkOutcomes.length === 0 ? "No command started." : checkOutcomes.map(one => `- ${one}`).join("\n")}`;
@@ -2513,14 +2552,17 @@ async function settleProof(captured, statArtifactId, sealedHead) {
         });
     }
     if (configured !== null && checkLog.length > 0)
-        sealVerificationReceipt(store, root, runId, sealedHead, configured, verifyCommand, now());
+        sealVerificationReceipt(store, root, runId, sealedHead, configured, verifyCommand, now(), undefined, releaseFacts ?? undefined);
     // The receipt above remains the evidence. This compact projection is what
     // `status` and `task wait` can read without opening logs. A reused gate did
     // not execute here, so its label says so instead of implying a fresh run.
+    // A release check that didn't cover what it owed (partial) or lost a required test reads failed, whatever its exit.
+    const uncovered = releaseFacts !== null && releaseFacts.coverage !== "full" && releaseFacts.coverage !== "composed";
     const checkStatus = verifyCommand.configured === false ? "not-run"
-        : verifyCommand.ran ? verifyCommand.exitCode === 0 ? "passed" : "failed"
-            : checkSuites.some(one => one.status === "failed") ? "failed"
-                : "not-run";
+        : uncovered ? "failed"
+            : verifyCommand.ran ? verifyCommand.exitCode === 0 ? "passed" : "failed"
+                : checkSuites.some(one => one.status === "failed") ? "failed"
+                    : "not-run";
     const suites = checkSuites.length > 0 ? checkSuites : verifyCommand.configured === false ? [] : [{
             name: reused === null ? chosenCheck?.level === "quick" ? "Quick check" : "Project check" : "Project check (reused)",
             status: checkStatus,

package/dist/chat-actions.js

@@ -36,7 +36,7 @@ import { requestUndo, undoFor } from "./subagent-week.js";
 import { kitInstalled, kitOf, KITS, setUpKitNow } from "./kits.js";
 import { starterFlowOf, starterOf, startersFor, starterTerms, STARTER_FLOWS, switchOnStarter } from "./flow-starters.js";
 import { answerSubagentQuestion } from "./subagent-work.js";
-import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleWords, setToolRules } from "./subagent-tools.js";
+import { callWords, checkRule, defaultRule, grantListed, revokeTool, ruleLoosens, ruleWords, setToolRules } from "./subagent-tools.js";
 import { aboutYouOf, checkAboutYouLine, saveAboutYou, withAboutYouLine } from "./lead-about.js";
 import { CHAT_ACTION_FIELDS, readChatActionRequest, readSharedAction, SHARED_ACTION_VERSION } from "./contracts/chat-actions.js";
 export { CHAT_ACTION_FIELDS };
@@ -441,12 +441,10 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
                     throw Error(`${project} has no tool called ${tool}.${named.length === 0 ? " Add it on the Tools page first." : ` Its tools: ${named.join(", ")}.`}${uses}`);
                 if (grant !== null)
                     throw Error(`${name} can already use ${tool}.`);
-                const actions = found.lastTest?.tools ?? [];
-                if (actions.length === 0)
+                if ((found.lastTest?.tools ?? []).length === 0)
                     throw Error(`${tool} hasn't said what it can do yet. Test it on the Tools page first.`);
-                state = { rules: "" };
-                title = `Let ${name} use ${tool}`;
-                terms.push(...actions.map(one => `${one}: ${defaultRule({ name: one, readOnly: false }).use === "free" ? "does it" : "asks you first"}`), `${name} asks for each call on its turn; Toolroll makes it by these rules, and every call is kept on the card. Change a rule any time.`);
+                // Giving a subagent a tool takes the person's password (chat-management.md §0a.3), which never goes in chat.
+                throw Error(`Giving ${name} a tool takes your password. Open ${name}'s page in Toolroll, then Tools → Let ${name} use ${tool}.`);
             }
             else if (change === "revoke") {
                 if (grant === null)
@@ -463,6 +461,10 @@ export function prepareSharedAction(store, who, operation, input, root, now = ne
                 const checked = checkRule(grant, action, { use: input["use"], limit, undo: input["undoWith"] ?? grant.rules[action]?.undo ?? "" });
                 if (!checked.ok)
                     throw Error(checked.said);
+                // Letting it do more on its own takes the person's password (chat-management.md §0a.3), never a card.
+                const info = grant.actions.find(one => one.name === action);
+                if (ruleLoosens(grant.rules[action] ?? defaultRule(info), checked.rule))
+                    throw Error(`Letting ${name} do more with ${action} on its own takes your password. Change the rule on ${name}'s page in Toolroll.`);
                 state = { rules: JSON.stringify(grant.rules) };
                 title = `${name}: ${action} — ${ruleWords(checked.rule)}`;
                 terms.push(`${tool} → ${action}: ${ruleWords(checked.rule)}.`, `Was: ${ruleWords(grant.rules[action] ?? { use: "ask" })}.`, ...(checked.rule.undo === undefined ? [] : [`A person can undo it with ${checked.rule.undo}, called with the same input.`]));
@@ -1168,7 +1170,7 @@ export function executeSharedAction(store, who, id, payload, now, options) {
             }
             else if (payload.operation === "kit_setup") {
                 const kit = kitOf(String(req["kit"]));
-                const made = setUpKitNow(store, kit, repo, actor, now, null, true);
+                const made = setUpKitNow(store, kit, repo, actor, now, null);
                 if (!made.ok)
                     throw Error(made.said);
                 return { ok: true, taskId: null, said: `${made.said} Try it with a sample card from its page.`, href: `/kits/${kit.id}?repo=${encodeURIComponent(repo)}` };
@@ -1431,7 +1433,10 @@ function runSubagentAction(store, payload, actor, now) {
         if ((grant === null ? "" : JSON.stringify(grant.rules)) !== payload.state["rules"])
             throw Error("Someone changed its tools since. Ask for a fresh proposal.");
         const found = projectToolsOf(store, mate.repo).find(one => one.name === tool);
-        const done = req["change"] === "grant" ? found === undefined ? { ok: false, said: `There's no tool called ${tool} any more.` } : grantListed(store, mate, found, null, actor, now)
+        // A grant takes the person's password on the subagent's page (chat-management.md §0a.3): never from a card.
+        if (req["change"] === "grant")
+            throw Error("Giving a subagent a tool takes your password. Do it on its page in Toolroll.");
+        const done = req["change"] === "grant" ? found === undefined ? { ok: false, said: `There's no tool called ${tool} any more.` } : grantListed(store, mate, found, null, actor, now, {})
             : req["change"] === "revoke" ? revokeTool(store, mate, tool, actor, now)
                 : setToolRules(store, mate, tool, { [String(req["action"])]: { use: req["use"], limit: req["limitField"] === undefined || req["limitField"] === null || req["limitField"] === "" ? null : { field: req["limitField"], over: req["limitOver"] },
                         undo: req["undoWith"] ?? grant?.rules[String(req["action"])]?.undo ?? "" } }, actor, now);

package/dist/chat-decide.d.ts

@@ -2,6 +2,7 @@ import { DECIDE_ACTS } from "./contracts/chat-callback-rows.js";
 import { type ChatApprovalLimits } from "./chat-approval.js";
 import { type VerifiedApprover } from "./principal.js";
 import type { Scope } from "./scope.js";
+import { type ReleaseCard } from "./release-card.js";
 import type { Store } from "./store.js";
 /** The tokens live in chat_decide_action and the open "What should change?" in chat_decide_prompt (store.ts). */
 export type DecideAct = (typeof DECIDE_ACTS)[number];
@@ -59,11 +60,17 @@ type ActSpec = {
     act: DecideAct;
     run: number | null;
     digest: string;
+    label?: string;
 };
-/** What a card offers: an optional replacement text (the plan card) and rows of acts and links. */
+/** What a card offers: an optional replacement text (the plan card) and rows of acts and links; a release card also
+ * sends its full terms as a file with it (`file`), where the chat app can. */
 export type DecideOffer = {
     text: string | null;
     rows: Array<Array<ActSpec | DecideLink>>;
+    file?: {
+        name: string;
+        text: string;
+    };
 };
 /** What lets this person's chat on `channel` approve on this repository now: their lasting chat-approval setting
  * (chat-approval.ts), or else a live signed mode carrying the chatApprove term, signed by them, that names this chat
@@ -127,12 +134,24 @@ export declare function hasLiveDecideTokens(store: Store, channel: DecideChannel
 export declare function isDecideToken(store: Store, token: string): boolean;
 export type DecideTapOutcome = {
     ack: string;
+    /** A release card's full terms, sent as a file before its Approve is offered (chat apps that limit a message). */
+    file?: {
+        name: string;
+        text: string;
+    };
     /** The card repainted: its text and buttons now. */
     edit?: {
         text: string;
         rows: DecideButton[][];
         tokens: string[];
     };
+    /** With `file`, where the chat app carries the terms only as a file: the card instead of `edit` when the file didn't
+     * arrive. No Approve, a fresh Continue to send it again; the channel drops whichever set it doesn't show. */
+    unsent?: {
+        text: string;
+        rows: DecideButton[][];
+        tokens: string[];
+    };
     /** Ask "What should change?": the person's next message is the feedback. `id` names the prompt, so the channel can
      * record the message it sent (a reply to anything else is not the feedback). */
     prompt?: {
@@ -152,6 +171,33 @@ export type ChatMerge = {
     repo: string;
     via: string;
 };
+/** Where a release card is tapped: the person's binding and the chat the tap came from. */
+export type ReleaseSeat = Pick<DecideSeat, "channel" | "binding" | "chat" | "approver">;
+/**
+ * Whether a release card's tap comes from the person's own private chat with Toolroll (chat-management.md §0a.5), from
+ * the binding's own record, failing closed: Telegram, a private chat (a positive id, which Telegram makes equal to the
+ * user's own id) that is the binding's chat and its user's; Slack, a direct-message channel (D…) that is the binding's.
+ * Any other chat app, a missing chat or binding, or another person's binding is not.
+ */
+export declare function privateReleaseChat(store: Store, seat: ReleaseSeat): boolean;
+/**
+ * A deploy gate this person may approve from this chat now, through its release card: every plain-plan rule
+ * (planInChat: their Approve from chat setting and limits, no coordinator-, lead- or scout-written text, organisation
+ * policy, protected work), never a nightly check, only in their private chat, and the card as the live records say
+ * it now (chat-management.md §0a.5).
+ */
+export declare function releaseInChat(store: Store, taskId: string, approver: string, now: Date, channel: DecideChannel, 
+/** The seat a tap came from, checked strictly; "offer" only where the card is drawn for the binding's own chat (no act). */
+seat: ReleaseSeat | "offer", root?: string): {
+    ok: true;
+    card: ReleaseCard;
+    modeDigest: string;
+    source: "setting" | "mode";
+    scope: Scope;
+} | {
+    ok: false;
+    why: string;
+};
 /** The links a card keeps once its acts are spent or stale: where to look, never a token. */
 export declare function linksFor(target: DecideTarget): DecideButton[][];
 /** Where a plan card's task is now, for a card whose buttons no longer act: the family's current version, named only

package/dist/chat-decide.js

@@ -12,6 +12,7 @@
  * The same in every chat app: Telegram's bridge and the shared engine Slack, Discord and Teams run on (chat-delivery.ts)
  * offer, mint and answer these through the same tokens (the `channel` column). Every act runs through the door the
  * console uses. */
+import { NIGHTLY_CHECK_ONLY, RELEASE_MERGES_ONLY, nightlyTaskRef, releaseTaskRef } from "./store.js";
 import { isAcpProfile } from "./acp-agents.js";
 import { DECIDE_ACTS, readDecideActionRow } from "./contracts/chat-callback-rows.js";
 import { createHash, randomBytes } from "node:crypto";
@@ -27,6 +28,8 @@ import { verifyApproverStanding } from "./principal.js";
 import { pullRequestFollowOf } from "./pull-request-flow.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
+import { APPROVAL_PROOF, approvalOf, approvalProofDetail, deployGateScope, quarantinedAuthor } from "./scope.js";
+import { releaseCardOf } from "./release-card.js";
 import { phoneText } from "./telegram-status.js";
 /** The words, said once. */
 export const DECIDE_LABELS = {
@@ -42,6 +45,7 @@ export const DECIDE_LABELS = {
     cancel: "Cancel",
 };
 const OFFER_TTL_MS = 7 * 86_400_000;
+const CHANNEL_NAMES = { telegram: "Telegram", slack: "Slack", discord: "Discord", teams: "Teams" };
 const CONFIRM_TTL_MS = 10 * 60_000;
 const PROMPT_TTL_MS = 30 * 60_000;
 export const WHAT_SHOULD_CHANGE = "What should change?";
@@ -100,7 +104,9 @@ export function planInChat(store, taskId, approver, now, channel, root) {
     const scope = store.getScope(taskId);
     if (ref === null || ref.repo === null || scope === null)
         return { ok: false, why: "This plan isn't available now." };
-    if (scope.approvedDigest != null && scope.approvedDigest === scope.digest)
+    // Approved only as dispatch reads it (approval policy): an old seal a lead token made, or one whose authority has
+    // ended, is no approval, so the person can approve it here.
+    if (approvalOf(scope).approved && store.modeApprovalLive(ref.id, now))
         return { ok: false, why: "This plan is already approved." };
     if (ref.plan === "requested")
         return { ok: false, why: "The plan is still being written." };
@@ -113,7 +119,7 @@ export function planInChat(store, taskId, approver, now, channel, root) {
     if (family === null || family.problem !== null || family.current.id !== taskId)
         return { ok: false, why: "A newer version of this task is current." };
     // What the mode's seal refuses anyway, said first: model- or coordinator-written terms, an unreadable route.
-    if (ref.coordinatorCid !== null || (scope.proposedVia ?? null) !== null)
+    if (ref.coordinatorCid !== null || quarantinedAuthor(scope.proposedVia ?? null))
         return { ok: false, why: "This plan was written for you, so you approve it in Toolroll." };
     if (scope.profileState === "unresolved" || scope.routeEra == null || (scope.termsProblem ?? null) !== null)
         return { ok: false, why: "This plan can't say exactly which agents run, so you approve it in Toolroll." };
@@ -158,6 +164,12 @@ export function planInChat(store, taskId, approver, now, channel, root) {
 /** A ready pull request this person's chat may merge now, bound to the exact commit. */
 export function mergeInChat(store, taskId, run, approver, now, channel) {
     const ref = store.lookupRef(taskId);
+    // The nightly check of main never merges (release-once.md, part 3).
+    if (ref !== null && nightlyTaskRef(store, ref.id))
+        return { ok: false, why: NIGHTLY_CHECK_ONLY };
+    // A release's result merges only through its coordinator.
+    if (ref !== null && releaseTaskRef(store, ref.id))
+        return { ok: false, why: RELEASE_MERGES_ONLY };
     const publication = store.publicationForRun(run);
     const follow = publication === null ? null : pullRequestFollowOf(store, publication.id);
     if (ref === null || ref.repo === null || publication === null || follow === null || publication.prNumber === null)
@@ -252,6 +264,30 @@ export function decideOffer(store, target, who, now, channel, root) {
             const plan = planInChat(store, target.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return null;
+            const release = deployGateScope(plan.scope);
+            // Checks beyond the sandbox seal only on the person's password (store.ts sealScopeApproval): the card says so and
+            // links to the approval in Toolroll, and offers no Continue or Approve that would dead-end. A release or a plan.
+            if (passwordOnlySeal(plan.scope)) {
+                let head;
+                try {
+                    head = release ? releaseCardOf(store, plan.scope, plan.digest, { profile: permissionPlainWords }).short.split("\n").slice(0, 3)
+                        : planCardText(store, target.taskId, plan.scope, root, channel).split("\n").slice(0, 1);
+                }
+                catch {
+                    head = [title(store, target.taskId)];
+                }
+                return { text: [...head, "", needsPassword(plan.scope)].join("\n"), rows: [[{ label: "Approve in Toolroll", path: chatControlHref("approval", target.taskId) }]] };
+            }
+            // A deploy gate is approved from chat only through its release card (chat-management.md §0a.5).
+            if (release) {
+                const release = releaseInChat(store, target.taskId, who.name, now, channel, "offer", root);
+                if (!release.ok)
+                    return null;
+                const card = release.card;
+                return { text: channel === "telegram" ? card.short : `${card.short}\n\n${card.full}`,
+                    rows: [[{ act: "approve", run: null, digest: releaseDigest(card), label: "Continue" }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: releaseDigest(card) }]],
+                    ...(channel === "telegram" ? { file: { name: card.fileName, text: card.full } } : {}) };
+            }
             return { text: planCardText(store, target.taskId, plan.scope, root, channel),
                 rows: [[{ act: "approve", run: null, digest: plan.digest }], [{ label: DECIDE_LABELS.edit, path: chatControlHref("approval", target.taskId) }, { act: "not-now", run: null, digest: plan.digest }]] };
         }
@@ -310,7 +346,7 @@ export function mintDecideButtons(store, seat, target, offer, now, message = nul
             return { label: one.label, link: one };
         const token = mint(store, seat, message, one, target.taskId, "offer", now);
         tokens.push(token);
-        return { label: DECIDE_LABELS[one.act], token };
+        return { label: one.label ?? DECIDE_LABELS[one.act], token };
     }));
     return { rows, tokens };
 }
@@ -340,6 +376,66 @@ export function hasLiveDecideTokens(store, channel, chat, message, now) {
 export function isDecideToken(store, token) {
     return token.startsWith("d:") && store.handle.prepare("SELECT 1 FROM chat_decide_action WHERE token = ?").get(token) !== undefined;
 }
+/** A release card's acts carry its card digest (release-card.ts), never a plan's. */
+const RELEASE_DIGEST = "release:";
+/** Why a password-only scope (passwordOnlySeal) isn't approved from chat, for a release or a plan. */
+const needsPassword = (scope) => `This ${deployGateScope(scope) ? "release" : "plan"}'s checks run outside the sandbox, so it's approved in Toolroll with your password.`;
+/** Whether only a person's password ceremony seals this scope (store.ts sealScopeApproval): checks that reach beyond the
+ * sandbox (sign-ins, or none at all) or extra macOS services, sealed into its profile. */
+const passwordOnlySeal = (scope) => {
+    const profile = scope.profile;
+    return profile != null && (profile["checkAccess"] !== undefined || profile["machLookup"] !== undefined);
+};
+const releaseDigest = (card) => `${RELEASE_DIGEST}${card.digest}`;
+/**
+ * Whether a release card's tap comes from the person's own private chat with Toolroll (chat-management.md §0a.5), from
+ * the binding's own record, failing closed: Telegram, a private chat (a positive id, which Telegram makes equal to the
+ * user's own id) that is the binding's chat and its user's; Slack, a direct-message channel (D…) that is the binding's.
+ * Any other chat app, a missing chat or binding, or another person's binding is not.
+ */
+export function privateReleaseChat(store, seat) {
+    const row = store.handle.prepare("SELECT member, channel, approver FROM chat_binding WHERE provider = ? AND id = ? AND revoked IS NULL").get(seat.channel, seat.binding);
+    if (row === undefined || String(row["approver"]) !== seat.approver || seat.chat !== String(row["channel"]))
+        return false;
+    if (seat.channel === "telegram")
+        return /^[1-9][0-9]*$/.test(seat.chat) && seat.chat === String(row["member"]);
+    if (seat.channel === "slack")
+        return /^D[A-Z0-9]+$/.test(seat.chat);
+    return false;
+}
+/**
+ * A deploy gate this person may approve from this chat now, through its release card: every plain-plan rule
+ * (planInChat: their Approve from chat setting and limits, no coordinator-, lead- or scout-written text, organisation
+ * policy, protected work), never a nightly check, only in their private chat, and the card as the live records say
+ * it now (chat-management.md §0a.5).
+ */
+export function releaseInChat(store, taskId, approver, now, channel, 
+/** The seat a tap came from, checked strictly; "offer" only where the card is drawn for the binding's own chat (no act). */
+seat, root) {
+    const plan = planInChat(store, taskId, approver, now, channel, root);
+    if (!plan.ok)
+        return plan;
+    if (!deployGateScope(plan.scope))
+        return { ok: false, why: "This plan isn't a release." };
+    if (passwordOnlySeal(plan.scope))
+        return { ok: false, why: needsPassword(plan.scope) };
+    const ref = store.lookupRef(taskId);
+    if (ref === null || nightlyTaskRef(store, ref.id))
+        return { ok: false, why: NIGHTLY_CHECK_ONLY };
+    if (seat !== "offer" && (seat.channel !== channel || !privateReleaseChat(store, seat)))
+        return { ok: false, why: "A release is approved only in your private chat with Toolroll." };
+    let card;
+    try {
+        card = releaseCardOf(store, plan.scope, plan.digest, { profile: permissionPlainWords });
+    }
+    catch {
+        return { ok: false, why: "This release's terms can't be shown here, so you approve it in Toolroll." };
+    }
+    // What changed is part of what's approved: a list that couldn't be read (or was refused as rewritten history) is no card.
+    if (plan.scope.releaseTerms != null && card.changes.commits === null)
+        return { ok: false, why: "This release's list of changes couldn't be read, so you approve it in Toolroll." };
+    return { ok: true, card, modeDigest: plan.modeDigest, source: plan.source, scope: plan.scope };
+}
 const QUESTIONS = {
     accept: name => `Accept and finish "${name}"?`,
     retry: name => `Retry "${name}"? It queues another attempt.`,
@@ -356,6 +452,24 @@ function targetOf(row) {
     }
 }
 /** Why the card's act no longer applies, or null while it still does — checked at the offer and again at the yes. */
+/**
+ * A release card's terms, then its Approve (Continue, and a release card refreshed after it changed): the full terms
+ * (a file on Telegram, where a message is limited; inline elsewhere), Approve and Cancel bound to this card's digest,
+ * and on Telegram the card to show instead when the file didn't arrive: no Approve, a Continue to send it again.
+ */
+function releaseContinue(store, seat, message, taskId, name, card, now, ack, lead) {
+    const spec = { act: "approve", run: null, digest: releaseDigest(card) };
+    const yes = mint(store, seat, message, spec, taskId, "yes", now);
+    const cancel = mint(store, seat, message, spec, taskId, "cancel", now);
+    const text = `${seat.channel === "telegram" ? card.short : `${card.short}\n\n${card.full}`}${lead === null ? "" : `\n\n${lead}`}`;
+    // Telegram carries the terms only as the file: Approve shows only once that file has arrived (telegram.ts).
+    const again = seat.channel === "telegram" ? mint(store, seat, message, spec, taskId, "offer", now) : null;
+    return { ack, file: { name: card.fileName, text: card.full },
+        edit: { text: `${text}\n\nApprove release "${name}"? This approves exactly these terms${seat.channel === "telegram" ? `, every one in ${card.fileName}` : ""}.`,
+            rows: [[{ label: "Approve", token: yes }, { label: DECIDE_LABELS.cancel, token: cancel }]], tokens: [yes, cancel] },
+        ...(again === null ? {} : { unsent: { text: `${text}\n\nThe terms file didn't arrive, so Approve isn't shown. Tap Continue to send it again.`,
+                rows: [[{ label: "Continue", token: again }]], tokens: [again] } }) };
+}
 function staleWhy(store, row, who, now, channel, root) {
     switch (row.act) {
         case "accept":
@@ -374,9 +488,21 @@ function staleWhy(store, row, who, now, channel, root) {
         }
         case "approve":
         case "not-now": {
+            if (row.digest.startsWith(RELEASE_DIGEST)) {
+                // The button's own seat as it was minted: its binding's chat, checked against the binding's record.
+                const release = releaseInChat(store, row.taskId, who.name, now, channel, { channel, binding: row.binding ?? -1, chat: row.chat ?? "", approver: who.name }, root);
+                if (!release.ok)
+                    return release.why;
+                return releaseDigest(release.card) === row.digest ? null : "This release changed while you were reading.";
+            }
             const plan = planInChat(store, row.taskId, who.name, now, channel, root);
             if (!plan.ok)
                 return plan.why;
+            // A deploy gate's plain plan card never approves it: only its release card does.
+            if (deployGateScope(plan.scope))
+                return "This is a release: approve it from its release card.";
+            if (passwordOnlySeal(plan.scope))
+                return needsPassword(plan.scope);
             return plan.digest === row.digest ? null : "The plan changed since this card was sent.";
         }
         case "merge": {
@@ -417,7 +543,7 @@ export function planWhereNow(store, taskId, who, now, root) {
     }
     return { said: `"${name}" is under way.`, rows: [] };
 }
-const QUESTION_STARTS = ["Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \""];
+const QUESTION_STARTS = ["Accept and finish \"", "Retry \"", "Approve and start \"", "Merge \"", "Approve release "];
 /** The card's words without a question this module appended. */
 function cardBody(shown) {
     const at = shown.lastIndexOf("\n\n");
@@ -474,8 +600,24 @@ export function applyDecideTap(store, seat, input) {
         return { ack: "Cancelled.", edit: { text: offer.text ?? body, ...minted } };
     }
     const why = staleWhy(store, row, who, now, seat.channel, input.root);
-    if (why !== null)
+    if (why !== null) {
+        // A release that changed while it was read: the new card, with fresh buttons, so the person reads it again.
+        // Through the same gate as Continue: the new terms go first (as a file where the chat app limits a message), and
+        // Approve shows only once they arrived; else a Continue to send them again. A release that is now password-only
+        // gets its card with the link to Toolroll.
+        if (row.digest.startsWith(RELEASE_DIGEST) && row.act === "approve" && why === "This release changed while you were reading.") {
+            spend();
+            const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+            if (release.ok)
+                return releaseContinue(store, seat, input.message, row.taskId, name, release.card, now, why, `${why} Here it is now.`);
+            const offer = decideOffer(store, target, who, now, seat.channel, input.root);
+            if (offer !== null && offer.file === undefined) {
+                const minted = mintDecideButtons(store, seat, target, offer, now, input.message);
+                return { ack: why, edit: { text: `${offer.text ?? body}\n\n${why} Here it is now.`, ...minted } };
+            }
+        }
         return stale(why);
+    }
     if (row.phase === "offer") {
         if (row.act === "changes") {
             const id = openDecidePrompt(store, seat, row.taskId, row.run ?? 0, row.digest, now);
@@ -486,6 +628,14 @@ export function applyDecideTap(store, seat, input) {
             return { ack: "Okay, it waits.", edit: { text: `${body}\n\nNot now. It waits for you in Tasks.`,
                     rows: [[{ label: DECIDE_LABELS.edit, link: { label: DECIDE_LABELS.edit, path: chatControlHref("approval", row.taskId) } }]], tokens: [] } };
         }
+        // A release card's Continue: the card again from the live records, its full terms as a file, then Approve.
+        if (row.act === "approve" && row.digest.startsWith(RELEASE_DIGEST)) {
+            const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+            if (!release.ok)
+                return stale(release.why);
+            spend();
+            return releaseContinue(store, seat, input.message, row.taskId, name, release.card, now, "Read the terms, then approve.", null);
+        }
         // The first tap asks; only the yes acts, bound to exactly what this button was.
         spend();
         const spec = { act: row.act, run: row.run, digest: row.digest };
@@ -511,12 +661,43 @@ export function applyDecideTap(store, seat, input) {
             return retried.ok ? done("✓ Queued again. Existing approvals and holds still apply.") : notDone(retried.message);
         }
         case "approve": {
+            if (row.digest.startsWith(RELEASE_DIGEST)) {
+                const release = releaseInChat(store, row.taskId, who.name, now, seat.channel, seat, input.root);
+                if (!release.ok)
+                    return notDone(release.why);
+                const cardDigest = release.card.digest;
+                // The seal knows which card it came from: a chat seal of a deploy gate needs this evidence (store.ts).
+                if (!store.sealScopeApproval(row.taskId, who.name, now, {}, { kind: "chat", modeDigest: release.modeDigest, card: "release", cardDigest }))
+                    return notDone("the release couldn't be approved from chat. Open it in Toolroll.");
+                const sealedDigest = store.getScope(row.taskId)?.approvedDigest ?? "";
+                store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: APPROVAL_PROOF, outcome: "chat", source: "request",
+                    detail: JSON.stringify({ v: 1, at: now.toISOString(), generation: store.accountOf(who.name)?.generation ?? 0, digest: sealedDigest, card: "release", cardDigest }) });
+                const where = `${CHANNEL_NAMES[seat.channel]} · chat binding #${seat.binding}`;
+                store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: "release approved in chat", outcome: "approved",
+                    source: "request", detail: `via ${where} · ${release.source} ${release.modeDigest} · card ${cardDigest}` });
+                // Said everywhere the person hears from Toolroll (their other chats and push), naming the chat it came from.
+                const terms = release.scope.releaseTerms ?? null;
+                store.enqueueNotification({ dedupeKey: `release-approved-chat:${row.taskId}:${cardDigest}`, kind: "release-approved", recipient: who.name, pushClass: "attention",
+                    subject: `Release${terms === null ? "" : ` ${terms.packageVersion}`} approved from ${CHANNEL_NAMES[seat.channel]}`,
+                    body: `You approved "${name}"${terms === null ? "" : ` (${terms.approvedSha.slice(0, 7)}, pull request #${terms.pr})`} from ${CHANNEL_NAMES[seat.channel]}. If that wasn't you, stop it in Toolroll now.`,
+                    link: chatControlHref("task", row.taskId), source: { taskRef: ref.id } }, now);
+                return done("✓ Release approved. It deploys when its check passes and someone runs the release.");
+            }
             const plan = planInChat(store, row.taskId, who.name, now, seat.channel, input.root);
             if (!plan.ok)
                 return notDone(plan.why);
+            if (deployGateScope(plan.scope))
+                return notDone("This is a release: approve it from its release card.");
+            if (passwordOnlySeal(plan.scope))
+                return notDone(needsPassword(plan.scope));
             // The owner's own yes, sealed as theirs ("chat"), never as a mode's: it stands like the console's after the mode or setting ends.
             if (!store.sealScopeApproval(row.taskId, who.name, now, {}, { kind: "chat", modeDigest: plan.modeDigest }))
                 return notDone("the plan couldn't be approved from chat. Open it in Toolroll.");
+            // The person's proof beside the seal, bound to these exact words (approval policy §1.2): a paired-chat tap, never a
+            // password. Release, deploy and the protected counters read it as a person's.
+            const sealedDigest = store.getScope(row.taskId)?.approvedDigest ?? "";
+            store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: APPROVAL_PROOF, outcome: "chat",
+                source: "request", detail: approvalProofDetail(now.getTime(), store.accountOf(who.name)?.generation ?? 0, sealedDigest) });
             store.recordAction({ at: now.toISOString(), actor: who.name, repo: ref.repo, taskId: row.taskId, runId: null, action: "plan approved in chat", outcome: "approved",
                 source: "request", detail: `via ${seat.channel} · chat binding #${seat.binding} · ${plan.source} ${plan.modeDigest}` });
             return done("✓ Approved. Work starts when a worker is free.");

package/dist/check-access.js

@@ -17,11 +17,11 @@ export const widerThan = (a, b) => RANK[a] > RANK[b];
 export const narrowestAccess = (levels) => levels.reduce((low, one) => RANK[one] < RANK[low] ? one : low, levels.length === 0 ? CHECK_ACCESS_DEFAULT : "unsandboxed");
 /** The level as a person reads it, in a sentence's middle ("Checks: …"). */
 export function checkAccessWords(level) {
-    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins and, on a Mac, Keychain access" : "not sandboxed";
+    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins" : "not sandboxed";
 }
 /** What each wider level means, said before anyone chooses it. */
 export const CHECK_ACCESS_WARNINGS = {
-    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins, even where the project hides your home folder's files from builds. On a Mac that includes Keychain access: they can read any keychain item that lets every program read it, not only those sign-ins. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
+    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins, even where the project hides your home folder's files from builds. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
     unsandboxed: "This project's checks get your full access to this machine and to Toolroll itself, including its database and every sign-in. Only for a project whose checks must create sandboxes themselves, such as Toolroll's own.",
 };
 /** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */