toolroll 0.9.71 → 0.9.73

package/dist/contracts/verification-receipt.d.ts

@@ -5,12 +5,15 @@
  * command, the retained log and a reused gate's source — are checked in plain code after parsing.
  *
  * Version 1 is a gate executed in its own run. Version 2 added `reusedFrom` and `executedHere: false` for a gate
- * reused by an unchanged observation follow-up. A direct receipt is still sealed as version 1, so its bytes (and the
- * digests bound to them) read the same in every Toolroll that reads receipts.
+ * reused by an unchanged observation follow-up. Version 3 (docs/plans/release-once.md) is a release check: it keeps
+ * the raw exit (`result`) apart from `coverage` — `full`, `composed` (a targeted run composed with the full check A),
+ * `partial` (never passes) or `identity-removed` (a required test went away; asks again) — names the sealed check
+ * artifacts, and for a composed check every link its reader proves again. A direct receipt is still sealed as version 1,
+ * so its bytes (and the digests bound to them) read the same in every Toolroll that reads receipts.
  */
 import { z } from "zod";
 import { type ContractResult } from "./contract.js";
-export declare const VERIFICATION_FAILURES: readonly ["spawn-failed", "timed-out", "dependency-missing", "setup-stale", "setup-failed", "own-install-failed", "tracked-files-changed", "setup-changed-files", "checkout-moved", "cleanliness-unavailable", "dependency-still-missing", "retry-spawn-failed", "retry-timed-out", "custody-lost"];
+export declare const VERIFICATION_FAILURES: readonly ["spawn-failed", "timed-out", "dependency-missing", "setup-stale", "setup-failed", "own-install-failed", "tracked-files-changed", "setup-changed-files", "checkout-moved", "cleanliness-unavailable", "dependency-still-missing", "retry-spawn-failed", "retry-timed-out", "custody-lost", "coverage-incomplete"];
 /**
  * What the repository's approved verification command did: not configured; configured but the run could not attempt
  * it (`attemptFailed`, which downgrades to `short` rather than `refuted`: "we could not check" is not "the claim is
@@ -25,6 +28,7 @@ export declare const verifyCommandFactsSchema: z.ZodUnion<readonly [z.ZodObject<
     failure: z.ZodOptional<z.ZodEnum<{
         "checkout-moved": "checkout-moved";
         "cleanliness-unavailable": "cleanliness-unavailable";
+        "coverage-incomplete": "coverage-incomplete";
         "custody-lost": "custody-lost";
         "dependency-missing": "dependency-missing";
         "dependency-still-missing": "dependency-still-missing";
@@ -71,10 +75,12 @@ export declare const receiptLogSchema: z.ZodObject<{
         ok: "ok";
     }>>;
 }, z.core.$strict>;
-export declare const RECEIPT_VERSION = 2;
+export declare const RECEIPT_VERSION = 3;
+export declare const RECEIPT_COVERAGES: readonly ["full", "composed", "partial", "identity-removed"];
+export type ReceiptCoverage = typeof RECEIPT_COVERAGES[number];
 /** The receipt as read: a reused gate names its source run and digest; a direct one names neither. */
 export declare const verificationReceiptSchema: z.ZodObject<{
-    version: z.ZodLiteral<2>;
+    version: z.ZodLiteral<3>;
     run: z.ZodInt;
     head: z.ZodString;
     base: z.ZodNullable<z.ZodString>;
@@ -105,6 +111,7 @@ export declare const verificationReceiptSchema: z.ZodObject<{
         failure: z.ZodOptional<z.ZodEnum<{
             "checkout-moved": "checkout-moved";
             "cleanliness-unavailable": "cleanliness-unavailable";
+            "coverage-incomplete": "coverage-incomplete";
             "custody-lost": "custody-lost";
             "dependency-missing": "dependency-missing";
             "dependency-still-missing": "dependency-still-missing";
@@ -136,13 +143,40 @@ export declare const verificationReceiptSchema: z.ZodObject<{
             ok: "ok";
         }>>;
     }, z.core.$strict>;
+    coverage: z.ZodOptional<z.ZodEnum<{
+        composed: "composed";
+        full: "full";
+        "identity-removed": "identity-removed";
+        partial: "partial";
+    }>>;
+    check: z.ZodOptional<z.ZodObject<{
+        attempt: z.ZodEnum<{
+            full: "full";
+            targeted: "targeted";
+        }>;
+        report: z.ZodNullable<z.ZodString>;
+        inventory: z.ZodNullable<z.ZodString>;
+        exitCode: z.ZodOptional<z.ZodNullable<z.ZodInt>>;
+    }, z.core.$strict>>;
+    composed: z.ZodOptional<z.ZodObject<{
+        base: z.ZodInt;
+        baseReceipt: z.ZodString;
+        baseReport: z.ZodString;
+        authority: z.ZodInt;
+        carries: z.ZodArray<z.ZodInt>;
+        artifacts: z.ZodString;
+        plan: z.ZodString;
+        snapshot: z.ZodString;
+        report: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type VerificationReceipt = z.infer<typeof verificationReceiptSchema>;
-/** A version 1 receipt read as version 2: the same fields. Reuse is a version 2 field; a version 1 receipt naming it
- * is refused by its reader, which still knows the version it was sealed as. */
+/** A version 1 or 2 receipt read as version 3: the same fields. Reuse is a version 2 field and coverage a version 3
+ * one; a receipt naming a field newer than it was sealed as is refused by its reader, which still knows the version. */
 export declare function upgradeDirectReceipt(body: Record<string, unknown>): Record<string, unknown>;
 export declare const RECEIPT_UPGRADES: {
     readonly 1: typeof upgradeDirectReceipt;
+    readonly 2: typeof upgradeDirectReceipt;
 };
-/** Read a receipt: version 2 as itself, version 1 as a direct gate, a newer one refused plainly. */
+/** Read a receipt: version 3 as itself, 1 and 2 upgraded, a newer one refused plainly. */
 export declare function readVerificationReceipt(input: unknown): ContractResult<VerificationReceipt>;

package/dist/contracts/verification-receipt.js

@@ -5,8 +5,11 @@
  * command, the retained log and a reused gate's source — are checked in plain code after parsing.
  *
  * Version 1 is a gate executed in its own run. Version 2 added `reusedFrom` and `executedHere: false` for a gate
- * reused by an unchanged observation follow-up. A direct receipt is still sealed as version 1, so its bytes (and the
- * digests bound to them) read the same in every Toolroll that reads receipts.
+ * reused by an unchanged observation follow-up. Version 3 (docs/plans/release-once.md) is a release check: it keeps
+ * the raw exit (`result`) apart from `coverage` — `full`, `composed` (a targeted run composed with the full check A),
+ * `partial` (never passes) or `identity-removed` (a required test went away; asks again) — names the sealed check
+ * artifacts, and for a composed check every link its reader proves again. A direct receipt is still sealed as version 1,
+ * so its bytes (and the digests bound to them) read the same in every Toolroll that reads receipts.
  */
 import { z } from "zod";
 import { readVersioned, versioned } from "./contract.js";
@@ -25,6 +28,8 @@ export const VERIFICATION_FAILURES = [
     "retry-spawn-failed",
     "retry-timed-out",
     "custody-lost",
+    // A release check that didn't cover what it owed, or lost a required test (release-once.md): never a pass.
+    "coverage-incomplete",
 ];
 /**
  * What the repository's approved verification command did: not configured; configured but the run could not attempt
@@ -59,7 +64,8 @@ export const receiptLogSchema = z.strictObject({
     redacted: z.boolean(),
     captureStatus: z.enum(["ok", "failed"]).nullable(),
 });
-export const RECEIPT_VERSION = 2;
+export const RECEIPT_VERSION = 3;
+export const RECEIPT_COVERAGES = ["full", "composed", "partial", "identity-removed"];
 const receiptFields = {
     run: z.int(),
     head: z.string(),
@@ -74,14 +80,25 @@ export const verificationReceiptSchema = versioned(RECEIPT_VERSION, {
     command: receiptCommandSchema,
     result: verifyCommandFactsSchema,
     log: receiptLogSchema,
+    /** Version 3: what the check covered, apart from its exit. */
+    coverage: z.enum(RECEIPT_COVERAGES).optional(),
+    /** Version 3: the attempt sealed before the check ran, and its sealed report (null: it gave none). */
+    check: z.strictObject({ attempt: z.enum(["full", "targeted"]), report: z.string().nullable(), inventory: z.string().nullable(),
+        /** The command's own exit, kept here when `result` reads a failed attempt because the coverage fell short. */
+        exitCode: z.int().min(0).max(255).nullable().optional() }).optional(),
+    /** Version 3, composed: the full check A and every link the reader proves again. */
+    composed: z.strictObject({
+        base: z.int().min(1), baseReceipt: z.string(), baseReport: z.string(), authority: z.int().min(1), carries: z.array(z.int()),
+        artifacts: z.string(), plan: z.string(), snapshot: z.string(), report: z.string(),
+    }).optional(),
 });
-/** A version 1 receipt read as version 2: the same fields. Reuse is a version 2 field; a version 1 receipt naming it
- * is refused by its reader, which still knows the version it was sealed as. */
+/** A version 1 or 2 receipt read as version 3: the same fields. Reuse is a version 2 field and coverage a version 3
+ * one; a receipt naming a field newer than it was sealed as is refused by its reader, which still knows the version. */
 export function upgradeDirectReceipt(body) {
     return { ...body, version: RECEIPT_VERSION };
 }
-export const RECEIPT_UPGRADES = { 1: upgradeDirectReceipt };
-/** Read a receipt: version 2 as itself, version 1 as a direct gate, a newer one refused plainly. */
+export const RECEIPT_UPGRADES = { 1: upgradeDirectReceipt, 2: upgradeDirectReceipt };
+/** Read a receipt: version 3 as itself, 1 and 2 upgraded, a newer one refused plainly. */
 export function readVerificationReceipt(input) {
     return readVersioned(verificationReceiptSchema, input, RECEIPT_UPGRADES);
 }

package/dist/contracts/verification-view.d.ts

@@ -39,6 +39,7 @@ export declare const legacyGateViewSchema: z.ZodObject<{
         failure: z.ZodOptional<z.ZodEnum<{
             "checkout-moved": "checkout-moved";
             "cleanliness-unavailable": "cleanliness-unavailable";
+            "coverage-incomplete": "coverage-incomplete";
             "custody-lost": "custody-lost";
             "dependency-missing": "dependency-missing";
             "dependency-still-missing": "dependency-still-missing";

package/dist/deploy-gate.d.ts

@@ -0,0 +1,17 @@
+import type { Store } from "./store.js";
+export type DeploymentGate = {
+    ok: true;
+    taskId: string;
+    head: string;
+    repo: string;
+    approvedBy: string;
+} | {
+    ok: false;
+    message: string;
+};
+/** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
+export declare function deploymentGate(store: Store, input: {
+    runId: number;
+    evidenceRoot: string;
+    now: Date;
+}): DeploymentGate;

package/dist/deploy-gate.js

@@ -0,0 +1,68 @@
+/**
+ * The deployment gate, in the runtime that is releasing (docs/plans/approval-policy.md §1.7): whether a candidate run
+ * may be deployed at all — a person approved its scope, its exact result passed the approved check and was marked
+ * complete, and nothing still blocks it. `toolroll release` asks this BEFORE it starts anything from the candidate's
+ * checkout, so the candidate's own scripts never decide their own deployment. (scripts/deploy-candidate.mjs keeps the
+ * same checks for the deployment script, proven again there with the installed runtime's modules.)
+ */
+import { assignmentOf } from "./assignment.js";
+import { liveReleaseOf, personApprovalOf } from "./scope.js";
+import { verificationEvidence } from "./verification-evidence.js";
+/** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
+export function deploymentGate(store, input) {
+    const refuse = (message) => ({ ok: false, message });
+    const run = store.getRun(input.runId);
+    const ref = run === null ? null : store.refById(run.taskRef);
+    const scope = ref === null ? null : store.getScope(ref.externalId);
+    const head = run?.headRevision ?? null;
+    if (run === null || ref === null || head === null)
+        return refuse(`Run ${input.runId} is not a built candidate.`);
+    // `task regate` reruns the approved check on the last built commit and records no-change: a candidate only for that commit.
+    const regated = run.outcome === "no-change" && scope?.candidate === head &&
+        store.runsFor(run.taskRef).find(one => one.id < input.runId && one.role === "builder" && one.outcome === "built")?.headRevision === head;
+    if (run.role !== "builder" || !(run.outcome === "built" || regated))
+        return refuse(`Run ${input.runId} is not a built candidate at ${head.slice(0, 7)}.`);
+    if (scope === null || scope.approvedDigest !== scope.digest || scope.digest !== run.scopeDigest)
+        return refuse("The run's signed scope is no longer the approved one.");
+    // One approval per release (release-once.md): a release's task deploys only while its authority stands for it — the
+    // live predicate proves the anchor's person approval (a carried commit's own seal is never a person's). Any other task
+    // needs a person's approval of its own.
+    const release = liveReleaseOf(store, ref.externalId, "deploy", input.now);
+    if (release.applies && !release.ok)
+        return refuse(`This release can't deploy: ${release.why}.`);
+    const anchorPerson = release.applies && release.ok ? personApprovalOf(store, release.authority.anchorTask) : null;
+    const person = anchorPerson ?? personApprovalOf(store, ref.externalId);
+    if (!person.ok)
+        return refuse(`A person has to approve this candidate's scope: ${person.why}.`);
+    const evidence = verificationEvidence(store, input.evidenceRoot, input.runId);
+    if (!evidence.ok || evidence.bytes === null)
+        return refuse(`Native check unavailable: ${evidence.ok ? "no receipt" : evidence.problem}.`);
+    let gate;
+    try {
+        gate = JSON.parse(evidence.bytes.toString());
+    }
+    catch {
+        return refuse("The native check's receipt can't be read.");
+    }
+    const live = ref.repo === null ? null : store.liveVerifyCommand(ref.repo);
+    const result = gate["result"];
+    // A release check's coverage (receipt version 3): partial or identity-removed never deploys, whatever the exit.
+    if (gate["coverage"] !== undefined && gate["coverage"] !== "full" && gate["coverage"] !== "composed")
+        return refuse(`The release check didn't cover this candidate (${String(gate["coverage"])}).`);
+    const command = gate["command"];
+    if (gate["run"] !== input.runId || gate["head"] !== head || gate["scopeDigest"] !== scope.digest || result?.ran !== true || result.exitCode !== 0
+        || live === null || command?.command !== live.command)
+        return refuse("The native check did not pass this candidate under the currently approved command.");
+    const assignment = assignmentOf(store, ref.externalId, input.now, { principal: "operator", repos: null, includeUnplaced: true }, input.evidenceRoot);
+    if (assignment?.state !== "complete" || assignment.receipt?.runId !== input.runId || assignment.receipt.head !== head
+        || assignment.receipt.scopeDigest !== scope.digest || assignment.completion?.digest !== assignment.receipt.digest)
+        return refuse("The lead or user has not marked this exact result complete.");
+    const blockers = assignment.readiness?.blockers;
+    if (!Array.isArray(blockers))
+        return refuse("The result's readiness could not be read.");
+    if (blockers.length > 0)
+        return refuse(`This result isn't ready to deploy: ${blockers.map(one => one.message).join(" ")}`);
+    if (ref.repo === null)
+        return refuse("The candidate's task is in no project.");
+    return { ok: true, taskId: ref.externalId, head, repo: ref.repo, approvedBy: person.by };
+}

package/dist/dispatch.js

@@ -6,6 +6,7 @@
  * fleet observations on top for people and agents reading the queue. A
  * diagnosis can go stale; it can never grant a lease.
  */
+import { authorityStandsSql } from "./approval-authority.js";
 import { isAlive } from "./runner.js";
 import { updateAdmissionPaused, UPDATE_PAUSED } from "./desktop-update-gate.js";
 import { approvalOf } from "./scope.js";
@@ -15,8 +16,6 @@ import { REVIEW_TOKENS, resultStatusOf, reviewFactsOf } from "./workspace-ui.js"
 import { replacedWords } from "./task-status.js";
 import { failedAttemptSentence, latestFinishedAttempt } from "./needs-you.js";
 import { buildReviewOf } from "./review-switch.js";
-import { grantStandsSql } from "./flow-unattended.js";
-import { accountReachesSql } from "./project-access.js";
 import { BUILT_IN, parseCapabilityKey } from "./store.js";
 export const DEFAULT_MAX_OPEN_DECISIONS = 5;
 /**
@@ -77,14 +76,8 @@ export function scopeApprovedForDispatch(store, taskRef, now) {
         .prepare(`SELECT 1 AS hit FROM task_scope
        JOIN task_ref ON task_ref.id = ? AND task_scope.task_id = task_ref.external_id
        WHERE task_scope.approved_digest = task_scope.digest AND task_scope.approved_at IS NOT NULL
-         AND (COALESCE(task_scope.approval_basis, 'password') NOT IN ('mode', 'grant')
-           OR (task_scope.approval_basis = 'mode' AND EXISTS (SELECT 1 FROM operating_mode om
-                      JOIN approver signer ON signer.name = om.signed_by
-                     WHERE om.repo = task_ref.repo AND om.revoked_at IS NULL
-                       AND om.absolute_expiry > ? AND om.digest = task_scope.mode_digest
-                       AND signer.revoked_at IS NULL AND signer.role = 'approver' AND ${accountReachesSql("signer", "task_ref.repo")}))
-           OR (task_scope.approval_basis = 'grant' AND ${grantStandsSql("task_scope.mode_digest", "?", "task_ref.repo")}))`)
-        .get(taskRef, now.toISOString(), now.toISOString());
+         AND ${authorityStandsSql("task_scope", "task_ref.repo", "?")}`)
+        .get(taskRef, now.toISOString(), now.toISOString(), now.toISOString());
     return row !== undefined;
 }
 /** The phase the ordinary dispatch loop would choose before it resolves an

package/dist/dispose.js

@@ -19,6 +19,7 @@ import { modeTermsFromJson } from "./modes.js";
 import { evidenceRoot, readVerifiedArtifact, writeEvidenceFile } from "./evidence.js";
 import { queueBuildReview } from "./build-review.js";
 import { homedir } from "node:os";
+import { nightlyTaskRef, releaseTaskRef } from "./store.js";
 import {} from "./proof.js";
 import { verificationEvidence, failedVerificationEvidence } from "./verification-evidence.js";
 import { classifyGateFailure, describeGateFailure, gateFailureSummary } from "./gate-failure.js";
@@ -162,7 +163,9 @@ function disposeBuildOutcomeLocked(context, result) {
                     grant.publishOn !== "complete" &&
                     headSha !== null &&
                     headWithin(branch, grant.headPrefix) &&
-                    (grant.selector === "all" || origin === "ours")) {
+                    (grant.selector === "all" || origin === "ours") &&
+                    // A nightly check or a release's task is never published (store.createPublicationIntent refuses both).
+                    !nightlyTaskRef(store, taskRef) && !releaseTaskRef(store, taskRef)) {
                     const intentId = store.createPublicationIntent({
                         run: runId,
                         taskRef,

package/dist/evidence-pack.d.ts

@@ -49,7 +49,7 @@ export type EvidencePack = {
                 by: string;
                 at: string;
                 digest: string;
-                basis: "person" | "mode" | "flow";
+                basis: "person" | "lead" | "mode" | "flow" | "schedule" | "carried" | "unknown";
                 current: boolean;
             } | null;
             writtenBy: {

package/dist/evidence-pack.js

@@ -15,6 +15,7 @@ import { rulesWords } from "./approval-policy.js";
 import { assignmentOf } from "./assignment.js";
 import { projectName } from "./project.js";
 import { changedFilesOf } from "./result-completion.js";
+import { approvalProofOf, personProof } from "./scope.js";
 import { html, htmlString, joinHtml, styleElement } from "./html.js";
 export const EVIDENCE_PACK_FORMAT = "standing-orders/evidence-pack/v1";
 /** How to recheck one entry's seal, for whoever reads the JSON. */
@@ -55,7 +56,7 @@ export function evidencePack(store, taskId, access, who, now, evidenceRoot, chec
                 goal: scope.goal, outOfScope: scope.outOfScope, touches: scope.touches, acceptance: scope.acceptance.map(one => ({ id: one.id, statement: one.statement })),
                 budgetUsd: scope.budgetMicrousd === null ? null : scope.budgetMicrousd / 1_000_000, digest: scope.digest,
                 approved: scope.approvedBy === null || scope.approvedAt === null || scope.approvedDigest === null ? null
-                    : { by: scope.approvedBy, at: scope.approvedAt, digest: scope.approvedDigest, basis: scope.approvalBasis === "mode" ? "mode" : scope.approvalBasis === "grant" ? "flow" : "person", current: scope.approvedDigest === scope.digest },
+                    : { by: scope.approvedBy, at: scope.approvedAt, digest: scope.approvedDigest, basis: approvalBasisWord(store, version.id, scope.approvalBasis ?? null, scope.approvedBy, scope.approvedDigest), current: scope.approvedDigest === scope.digest },
                 writtenBy: history.authors,
                 approvals: history.votes,
             },
@@ -206,7 +207,7 @@ export function evidencePackHtml(pack) {
                 ...(scope.touches.length ? [["Touches", joinHtml(scope.touches, ", ")]] : []),
                 ...(scope.acceptance.length ? [["Acceptance", html `<ol class="criteria">${scope.acceptance.map(one => html `<li>${one.statement}</li>`)}</ol>`]] : []),
                 ...(scope.writtenBy.length ? [["Scope written by", joinHtml([...new Set(scope.writtenBy.map(one => one.author))], ", ")]] : []),
-                ["Approved", approved === null ? html `Not approved` : html `${approved.by}${approved.basis === "mode" ? " (operating mode)" : approved.basis === "flow" ? " (flow runs on its own)" : ""} · ${when(approved.at)}${approved.current ? "" : " · the scope changed after this"}`],
+                ["Approved", approved === null ? html `Not approved` : html `${approved.by}${approved.basis === "mode" ? " (operating mode)" : approved.basis === "flow" ? " (flow runs on its own)" : approved.basis === "lead" ? " (the lead, not a person)" : approved.basis === "schedule" ? " (standing order)" : approved.basis === "carried" ? " (carried from their release approval)" : approved.basis === "unknown" ? " (no person's proof on record)" : ""} · ${when(approved.at)}${approved.current ? "" : " · the scope changed after this"}`],
                 ...(approvals.length > 1 ? [["Approvals", joinHtml(approvals.map(one => html `${one.approver} · ${when(one.at)}`), html `<br>`)]] : []),
                 ["Scope digest", short(scope.digest)],
             ]),
@@ -252,3 +253,20 @@ export function standaloneEvidenceHtml(pack) {
     return htmlString(html `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>Evidence pack · ${pack.task.id}</title>${styleElement(css)}</head><body>${evidencePackHtml(pack)}</body></html>
 `);
 }
+/** Who approved, in the pack's words (approval policy §1.5): `person` only when a person's proof stands behind it. */
+function approvalBasisWord(store, taskId, basis, by, digest) {
+    if (basis === "mode")
+        return "mode";
+    if (basis === "grant")
+        return "flow";
+    if (basis === "schedule")
+        return "schedule";
+    // A later release commit carried under a person's release approval (release-once.md): never a person's own yes.
+    if (basis === "carried")
+        return "carried";
+    if (basis === "lead")
+        return "lead";
+    if (basis === "password" || basis === "chat")
+        return personProof(approvalProofOf(store, taskId, by, digest)?.method) ? "person" : "unknown";
+    return "unknown";
+}

package/dist/evidence.d.ts

@@ -201,6 +201,7 @@ export declare function storeEvidence(store: Store, root: string, runId: number,
     redacted?: boolean;
     captureStatus?: "ok" | "failed";
     sourceBytesOriginal?: number;
+    cap?: number;
 }): number;
 /**
  * Read an artifact's bytes back, believing nothing until it is proved on the

package/dist/evidence.js

@@ -397,7 +397,8 @@ export function imageDimensions(bytes, kind) {
  * store the caller passed — inside whatever transaction the caller holds.
  */
 export function storeEvidence(store, root, runId, kind, name, content, capture, now, options = {}) {
-    const cap = EVIDENCE_CAPS[kind];
+    // `cap`: a sealed structured payload with its own documented bound (a release check's report: 256 KiB), never above 1 MiB.
+    const cap = options.cap === undefined ? EVIDENCE_CAPS[kind] : Math.min(options.cap, 1024 * 1024);
     const stored = content.subarray(0, cap);
     // Some callers that deliberately summarize/bound a source before storage
     // may still report its true original size. This keeps `truncated` honest

package/dist/exec.d.ts

@@ -200,7 +200,7 @@ export declare function confined(file: string, args: readonly string[], bag: {
     env: Record<string, string>;
 };
 /** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
-export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>): T | Record<string, string | undefined> | undefined;
+export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>, fenced?: boolean): T | Record<string, string | undefined> | undefined;
 /** Run IDs are local to a database. Connections to the same file share
  * custody; separate files and separate in-memory databases never do. */
 export declare function runOwnerTag(store: Store, runId: number): string;

package/dist/exec.js

@@ -8,6 +8,7 @@
  */
 import { ACP_LINE_CAP, createAcpConversation } from "./acp-client.js";
 import { linuxFenceAvailable, macosFenceAvailable, sandboxedSpawn } from "./agent-fence.js";
+import { withoutProtectedEnv } from "./protected-storage.js";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { readlinkSync, realpathSync } from "node:fs";
 import { observeProcessTree, stopProcessTree } from "./process-tree.js";
@@ -75,7 +76,10 @@ export function confined(file, args, bag) {
     return { file, args: [...args], env: {} };
 }
 /** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
-export function withSandboxEnv(env, added) {
+export function withSandboxEnv(env, added, fenced = false) {
+    // A fenced launch never gets a chat or vault variable (protected-storage.ts), whoever made its environment.
+    if (fenced)
+        return withoutProtectedEnv({ ...(env ?? process.env), ...added });
     return Object.keys(added).length === 0 ? env : { ...(env ?? process.env), ...added };
 }
 /** A spawn callback refused custody AFTER the child existed: the caller
@@ -107,7 +111,7 @@ function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
     // The agent fence wraps the target itself (sandbox-exec then execs it, same pid).
     const sandboxed = confined(file, args, { ...bag, cwd: spawnOptions.cwd, temp: spawnOptions.env?.["TMPDIR"] });
     ({ file, args } = sandboxed);
-    spawnOptions = { ...spawnOptions, env: withSandboxEnv(spawnOptions.env, sandboxed.env) };
+    spawnOptions = { ...spawnOptions, env: withSandboxEnv(spawnOptions.env, sandboxed.env, (bag.fence?.length ?? 0) > 0) };
     // The policy refusal comes first: nothing is reserved, recorded or
     // spawned for a spawn that cannot be contained as required.
     const effective = contain ? currentContainment() : null;
@@ -583,7 +587,7 @@ export function run(file, args, options = {}) {
             encoding: "utf8",
             shell: false,
             windowsHide: true,
-            ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env)),
+            ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env, (options.fence?.length ?? 0) > 0)),
         }, (error, stdout, stderr) => {
             if (error === null) {
                 resolve({ result: { code: 0, stdout, stderr, timedOut: false, notFound: false }, transient: false });

package/dist/flow-engine.js

@@ -6,6 +6,8 @@
  * waits for people. See flows.ts for what each zone does.
  */
 import { assignmentOf } from "./assignment.js";
+import { currentActor } from "./actor.js";
+import { activeRemote } from "./remote-run.js";
 import { diagnoseTaskDispatch } from "./dispatch.js";
 import { passOn, TEXT_LIMITS } from "./text-limits.js";
 import { deciderOf, durationWords, fillFlowText, flowGoal, flowValueLabel, flowWorkTemplate, validateFlowDefinition, withinHours } from "./flows.js";
@@ -528,7 +530,9 @@ export function decideFlowCard(store, input, now) {
             ledger("approved");
             return { ok: true, said: "Approved. The card is done." };
         }
-        if (!store.moveFlowCard(card.id, { to: stage.next, outcome: "approved", actor: input.actor, note: input.note, expectEntry: card.entry }, now))
+        // Who decided, from trusted context (approval policy §1.7): only a person's approval lets a Pull request zone merge.
+        const authority = input.subagent !== undefined ? "subagent" : currentActor()?.lead === true ? "lead" : activeRemote() !== null ? "remote" : "person";
+        if (!store.moveFlowCard(card.id, { to: stage.next, outcome: "approved", actor: input.actor, note: input.note, expectEntry: card.entry, authority }, now))
             return { ok: false, message: "That card has moved on since; nothing was changed." };
         ledger("approved");
         const title = definition.stages.find(one => one.id === stage.next)?.title ?? stage.next;

package/dist/flow-gallery-ui.js

@@ -5,7 +5,7 @@
  * A template's tools show their marks and whether the project has them; one it lacks offers Connect first.
  */
 import { brandMarkHtml } from "./brand-mark.js";
-import { BLANK, GALLERY, GALLERY_GROUPS, galleryDiagram, galleryToolsOf, OUTDATED_COMMANDS, SEND_RESULT, sendsAlready } from "./flow-gallery.js";
+import { BLANK, GALLERY, GALLERY_GROUPS, galleryAdmitsAnyone, galleryDiagram, galleryToolsOf, OUTDATED_COMMANDS, SEND_RESULT, sendsAlready } from "./flow-gallery.js";
 import { choiceTargets } from "./flows.js";
 import { html, joinHtml, postForm, reauth } from "./html.js";
 export const GALLERY_CSS = `.gallery{max-width:1120px;min-width:0}.gallery h2{margin:28px 0 10px;font-size:.9375rem}.gallery h2:first-of-type{margin-top:8px}` +
@@ -107,7 +107,9 @@ export function galleryUseHtml(input) {
         : html `<input type="hidden" name="repo" value="${input.repo}">`;
     const preview = input.preview === null ? "" : html `<section class="gallery-preview" aria-labelledby="gallery-will"><h2 id="gallery-will">What it will do</h2><ul>${input.preview.built.does.map(one => html `<li>${one}</li>`)}</ul><p class="gallery-never">${input.preview.built.never}</p>${needing}${input.preview.startsFrom.length === 0 ? html `<p class="meta">Cards start when you add them.</p>` : input.preview.startsFrom.map(one => html `<p class="meta">Starts from: ${one}</p>`)}<details><summary>Every step</summary><ol>${input.preview.steps.map(one => html `<li>${one.replace(/^\d+\.\s/, "")}</li>`)}</ol></details></section>`;
     const sendResult = !sendsAlready(template) && html `<label class="gallery-check"><input type="checkbox" name="${SEND_RESULT.key}" value="yes"${input.answers[SEND_RESULT.key] === "yes" && html ` checked`} data-send-result><span>${SEND_RESULT.title}<small>When a card finishes, what was done comes to you in your chat apps.</small></span></label>`;
-    const actions = html `<p class="gallery-actions">${input.preview !== null && html `<button type="submit" name="intent" value="create"${missing.length > 0 && html ` class="secondary" data-without-tools`}>Create flow</button>`}<button type="submit" name="intent" value="preview" class="secondary">${input.preview === null ? "Preview" : "Update preview"}</button></p>`;
+    // A flow that brings in items from anyone takes the password to make (chat-management.md §0a.3).
+    const step = input.preview !== null && galleryAdmitsAnyone(template) ? reauth(html `<label>Your password <span class="meta">(it brings in items from anyone)</span><input type="password" name="password" autocomplete="current-password"></label>`) : "";
+    const actions = html `${step}<p class="gallery-actions">${input.preview !== null && html `<button type="submit" name="intent" value="create"${missing.length > 0 && html ` class="secondary" data-without-tools`}>Create flow</button>`}<button type="submit" name="intent" value="preview" class="secondary">${input.preview === null ? "Preview" : "Update preview"}</button></p>`;
     const form = postForm(`/flows/new/${template.id}`, html `${project}${template.asks.map(field)}<label>Name<input name="name" value="${input.name}" maxlength="80"></label>${sendResult}${preview}${actions}`, { attrs: { "data-gallery-use": true }, hidden: { previewed: input.preview?.digest ?? "" } });
     return html `<section class="gallery-use" data-gallery-template="${template.id}">${input.problem !== null && html `<p class="problem" role="alert">${input.problem}</p>`}${input.said ? html `<p role="status">${input.said}</p>` : ""}<p>${template.promise}</p>${input.diagram !== null && stepStrip(input.diagram)}${needsList(template)}${toolsBlock}${form}<p class="meta"><a href="/flows/new">All templates</a></p></section>`;
 }

package/dist/flow-gallery.d.ts

@@ -136,9 +136,12 @@ export type GalleryUsed = {
     said: string;
 };
 /** Use a template in a project: its scripts, its flow and its triggers, together or not at all. */
+/** Whether a template's triggers bring in items from anyone: making it takes the person's password. */
+export declare function galleryAdmitsAnyone(template: GalleryTemplate): boolean;
 export declare function useGalleryTemplate(store: Store, template: GalleryTemplate, repo: string, given: GalleryAnswers, input: {
     name?: string | null;
     by: string;
     now: Date;
     dir: string | null;
+    widening?: "proved";
 }): GalleryUsed;

package/dist/flow-gallery.js

@@ -20,7 +20,7 @@ import { scanForSecrets } from "./evidence.js";
 import { flowDefinitionOf } from "./flow-engine.js";
 import { saveScript, validateScript } from "./flow-scripts.js";
 import { isToolrollRepo, planeReviewSteps } from "./flow-starters.js";
-import { addFlowTriggerTo, describeTrigger, githubRepoOf, scheduleFromWords, validateTriggerConfig } from "./flow-triggers.js";
+import { addFlowTriggerTo, describeTrigger, githubRepoOf, rawAdmitsAnyone, scheduleFromWords, validateTriggerConfig } from "./flow-triggers.js";
 import { choiceTargets, clockTime, flowFromSteps, flowTerms, FLOW_TEMPLATES, ISSUE_LABEL } from "./flows.js";
 import { connectionsOf, localConnectOf, oneClickOf } from "./mcp-connect.js";
 import { publishingOf } from "./pull-request-flow.js";
@@ -640,6 +640,10 @@ export function galleryDigest(id, repo, answers) {
     return createHash("sha256").update(JSON.stringify([id, repo, Object.entries(answers).sort(([a], [b]) => a.localeCompare(b))])).digest("hex").slice(0, 24);
 }
 /** Use a template in a project: its scripts, its flow and its triggers, together or not at all. */
+/** Whether a template's triggers bring in items from anyone: making it takes the person's password. */
+export function galleryAdmitsAnyone(template) {
+    return template.triggers.some(one => rawAdmitsAnyone(one));
+}
 export function useGalleryTemplate(store, template, repo, given, input) {
     try {
         const built = buildFromGallery(store, template, repo, given);
@@ -656,7 +660,7 @@ export function useGalleryTemplate(store, template, repo, given, input) {
             const made = store.getFlow(id);
             for (const trigger of built.triggers) {
                 // No one is shown the gallery's addresses: a webhook is made with none until its panel makes one (v126).
-                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir, { shown: false });
+                const added = addFlowTriggerTo(store, made, { ...trigger, zone: trigger["zone"] ?? flowDefinitionOf(made).start }, input.by, input.now, input.dir, { shown: false, ...(input.widening === undefined ? {} : { widening: input.widening }) });
                 if (!added.ok)
                     throw new Error(added.message);
                 if (added.reveal !== null)

package/dist/flow-pull-request.d.ts

@@ -5,7 +5,10 @@ export type PullRequestIo = {
     gh: Runner;
     evidenceRoot?: string;
 };
-/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so. */
-export declare function approvedSinceBuild(store: Store, definition: FlowDefinition, card: FlowCardRow): string | null;
+/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so.
+ * The MOST RECENT decision governs (approval policy §1.7): it must be a person's recorded decision, after the card's
+ * last build by the current definition AND after the exact build being merged finished (`builtAt`), so editing the
+ * flow can't let an older person decision stand behind a newer machine one. */
+export declare function approvedSinceBuild(store: Store, definition: FlowDefinition, card: FlowCardRow, builtAt?: string | null): string | null;
 /** One pass of a Pull request zone for one card. Returns whether it changed anything. */
 export declare function pullRequestStep(store: Store, flow: FlowRow, definition: FlowDefinition, stage: FlowStage, card: FlowCardRow, now: Date, io: PullRequestIo): Promise<boolean>;

package/dist/flow-pull-request.js

@@ -19,15 +19,24 @@ import { adoptPublishedPullRequest } from "./publish.js";
 import { failingCheckOf, mergePullRequest, owePullRequest, pullRequestBlocker, pullRequestFollowOf } from "./pull-request-flow.js";
 import { requestResultChanges } from "./result-actions.js";
 import { revisionSourceOf } from "./result-review.js";
-/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so. */
-export function approvedSinceBuild(store, definition, card) {
+/** Whether a person approved this card at a "Person decides" zone since it was last built; their name when so.
+ * The MOST RECENT decision governs (approval policy §1.7): it must be a person's recorded decision, after the card's
+ * last build by the current definition AND after the exact build being merged finished (`builtAt`), so editing the
+ * flow can't let an older person decision stand behind a newer machine one. */
+export function approvedSinceBuild(store, definition, card, builtAt = null) {
     const kindOf = (id) => definition.stages.find(one => one.id === id)?.kind ?? null;
     const events = store.flowEvents(card.id);
     let built = -1;
     events.forEach((event, index) => { if (kindOf(event.fromStage) === "task" || kindOf(event.toStage) === "task")
         built = index; });
-    const approval = events.slice(built + 1).reverse().find(event => event.outcome === "approved" && kindOf(event.fromStage) === "approval");
-    return approval === undefined ? null : approval.actor;
+    // The latest DECISION of any kind governs: only decideFlowCard writes `approved` or `sent-back` (from a decision
+    // zone), whatever the zones are called now, so a send-back after a yes takes that yes back.
+    const latest = events.slice(built + 1).reverse().find(event => event.outcome === "approved" || event.outcome === "sent-back");
+    if (latest === undefined || latest.authority !== "person")
+        return null;
+    if (builtAt !== null && latest.at < builtAt)
+        return null;
+    return latest.actor;
 }
 /** One pass of a Pull request zone for one card. Returns whether it changed anything. */
 export async function pullRequestStep(store, flow, definition, stage, card, now, io) {
@@ -134,7 +143,7 @@ export async function pullRequestStep(store, flow, definition, stage, card, now,
     // Checks pass.
     if (stage.merge === undefined)
         return passed(`${pr} passed its checks.`, `Pull request: ${link} (checks passed)`);
-    const approver = approvedSinceBuild(store, definition, card);
+    const approver = approvedSinceBuild(store, definition, card, store.getRun(runId)?.finishedAt ?? null);
     if (approver === null)
         return waiting(`Checks passed on ${pr}, but no person approved this card since it was built, so it wasn't merged. Merge it from its task, or send it through a decision.`);
     const merged = await mergePullRequest(store, { runId, by: `${approver} (approved in ${flow.name})`, exec: io.gh, method: stage.merge, clock: () => now });