toolroll 0.9.72 → 0.9.73

package/dist/release-card.d.ts

@@ -0,0 +1,76 @@
+import { type ReleaseTerms } from "./contracts/release-terms.js";
+import type { Scope } from "./scope.js";
+import type { Store } from "./store.js";
+/** One signed term as the card says it. `key` names the scope field or the release term's path. */
+export type TermLine = {
+    key: string;
+    label: string;
+    value: string;
+};
+/** The scope's own terms the card names, in order. A contract test holds `goal`, `outOfScope`, `touches` and
+ * `acceptance` (contracts/scope.ts) and the scope's other signed fields to this list; the agent profile and the phase
+ * route follow as one line per signed setting (`profile.…`, `route.…`). */
+export declare const SCOPE_TERM_LABELS: {
+    readonly title: "Title";
+    readonly project: "Project";
+    readonly filedBy: "Filed by";
+    readonly goal: "Goal";
+    readonly outOfScope: "Not in scope";
+    readonly touches: "Paths it may touch";
+    readonly acceptance: "Done when";
+    readonly qualityMode: "Evidence standard";
+    readonly agents: "Agents and model";
+    readonly permission: "Agents may";
+    readonly checks: "Checks";
+    readonly checkAccess: "Check access";
+    readonly budgetMicrousd: "Budget per attempt";
+    readonly candidate: "Candidate commit";
+};
+/** Every field of the release terms, by its path in the terms (contracts/release-terms.ts), against the schema's
+ * own leaves: the contract test checks every one has a label. */
+export declare const RELEASE_TERM_LABELS: Readonly<Record<string, string>>;
+/** The leaf paths of a zod object schema (nested objects joined with dots). */
+export declare function schemaLeaves(schema: unknown, prefix?: string): string[];
+/** Every signed term of `scope`, its release terms included, one line each. Reads only. */
+export declare function approvalTermsOf(store: Store, scope: Scope, words: {
+    profile: (profile: Scope["profile"]) => string | null;
+}): TermLine[];
+export declare const termsText: (lines: readonly TermLine[]) => string;
+export type ChangeList = {
+    /** The merge commit of the last verified release, or null when none is recorded. */
+    baseline: string | null;
+    /** Newest first; null when it couldn't be read. */
+    commits: {
+        sha: string;
+        subject: string;
+    }[] | null;
+    source: "recorded" | "pull-request" | "unread";
+    digest: string;
+};
+/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
+export declare function releaseBaseline(store: Store, repo: string): string | null;
+/** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
+ * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
+ * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
+ * history). Null when they can't be read, so a card never shows a shortened list. */
+export declare function commitsBetween(repo: string, from: string, to: string): {
+    sha: string;
+    subject: string;
+}[] | null;
+/** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
+export declare function releaseChangeList(store: Store, terms: ReleaseTerms): ChangeList;
+export type ReleaseCard = {
+    /** Binds the scope digest, the plan form's digest, the baseline and the change list. */
+    digest: string;
+    short: string;
+    full: string;
+    fileName: string;
+    changes: ChangeList;
+};
+/** The card digest: everything the person is shown that can change under them. */
+export declare function cardDigestOf(scopeDigest: string, formDigest: string, changes: Pick<ChangeList, "baseline" | "digest">): string;
+/** The release card for a deploy gate, against the live records now. */
+export declare function releaseCardOf(store: Store, scope: Scope, formDigest: string, words: {
+    profile: (profile: Scope["profile"]) => string | null;
+}): ReleaseCard;

package/dist/release-card.js

@@ -0,0 +1,252 @@
+/**
+ * The release card (docs/plans/chat-management.md §0a.5): how a deploy gate is approved from chat until the
+ * authenticator ships. Alex's decision (2026-10-25): chat keeps approving releases by tap, so the tap is made to mean
+ * exactly what was shown.
+ *
+ * - `approvalTermsOf`: every signed term of the scope (its agent profile and phase route setting by setting) and every
+ *   field of its release terms, one line each, "none" for an empty one and "any file in the project" for unnamed paths
+ *   (a contract test changes each input of the approval digest in turn and holds the text to change with it).
+ * - `releaseChangeList`: what changed since the last verified release, from the plane's own record of it (the merge
+ *   commit of the newest merged release whose merge operation succeeded), read as verified Git objects from the
+ *   project's recorded Git directory: never a tag or a ref, so moving one changes nothing, and history rewritten around
+ *   the objects (a shallow boundary, grafts, replacement refs) refuses the list rather than shortening it.
+ *   With no earlier release on record, the pull request's own commits from GitHub, for the recorded owner/name.
+ * - `releaseCardOf`: the short card, the full terms (sent as a file where the chat app limits a message), and
+ *   `cardDigest`, which binds the scope digest, the plan form's digest, the baseline and the change list: Continue and
+ *   Approve carry it, and anything different at the tap refuses.
+ */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { lstatSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { checkAccessWords } from "./check-access.js";
+import { CHECK_LEVEL_WORDS, effectiveCheckLevel } from "./check-levels.js";
+import { verifiedRange } from "./commit-extract.js";
+import { releaseTermsSchema } from "./contracts/release-terms.js";
+import { routeFromJson } from "./phase-routing.js";
+import { projectName } from "./project.js";
+import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
+const NONE = "none";
+/** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
+const money = (micro) => {
+    const exact = BigInt(micro), whole = exact / 1000000n, rest = (exact < 0n ? -exact : exact) % 1000000n;
+    const fraction = rest.toString().padStart(6, "0");
+    return `${exact < 0n && whole === 0n ? "-" : ""}$${whole}.${rest % 10000n === 0n ? fraction.slice(0, 2) : fraction}`;
+};
+/** Words the card itself says in place of a value: a signed string spelled the same is quoted, never mistaken for one. */
+const RESERVED = new Set([NONE, "yes", "no", "null", "empty", "not set", "any file in the project", "the whole project", "unreadable"]);
+/** Text that reads the same plain as quoted: ASCII letters, digits and ordinary punctuation only (no lookalike letters
+ * from other scripts, no direction marks), never a comma, semicolon, parenthesis, quote, backslash, line break or
+ * control character, nor a trailing space. */
+const PLAIN = /^[A-Za-z0-9~/.#$@][A-Za-z0-9 ._/@~+#=!?&%$*:<>|^-]*$/;
+/** JSON-quoted with everything outside printable ASCII \u-escaped (JSON.stringify leaves non-ASCII as it is). */
+const quoted = (value) => JSON.stringify(value).replace(/[^\x20-\x7e]/g, one => `\\u${one.charCodeAt(0).toString(16).padStart(4, "0")}`);
+/** One signed string, unambiguous: as it is when plain, else quoted; an empty, number-like or colon-bearing string, or
+ * one of the card's own words, is quoted too. */
+const text = (value) => PLAIN.test(value) && !value.endsWith(" ") && !RESERVED.has(value.toLowerCase()) && !/^-?\d+(\.\d+)?$/.test(value) ? value : quoted(value);
+/** One signed value as the card says it, every shape distinct: "none" for null, "not set" for absent, "empty" for an
+ * empty list, `""` for an empty string; a list's entries each said the same way, so a comma never joins two into one. */
+const said = (value) => {
+    if (value === undefined)
+        return "not set";
+    if (value === null)
+        return NONE;
+    if (typeof value === "boolean")
+        return value ? "yes" : "no";
+    if (typeof value === "number")
+        return String(value);
+    if (Array.isArray(value))
+        return value.length === 0 ? "empty" : value.map(one => typeof one === "string" ? text(one) : one === null ? "null" : said(one)).join(", ");
+    return text(String(value));
+};
+/** The scope's own terms the card names, in order. A contract test holds `goal`, `outOfScope`, `touches` and
+ * `acceptance` (contracts/scope.ts) and the scope's other signed fields to this list; the agent profile and the phase
+ * route follow as one line per signed setting (`profile.…`, `route.…`). */
+export const SCOPE_TERM_LABELS = {
+    title: "Title", project: "Project", filedBy: "Filed by", goal: "Goal", outOfScope: "Not in scope", touches: "Paths it may touch",
+    acceptance: "Done when", qualityMode: "Evidence standard", agents: "Agents and model", permission: "Agents may", checks: "Checks", checkAccess: "Check access",
+    budgetMicrousd: "Budget per attempt", candidate: "Candidate commit",
+};
+/** Every leaf of a signed value, at its path (`a.b`, `legs.0.model`), as the card says it. */
+function leavesOf(value, path) {
+    if (Array.isArray(value))
+        return value.every(one => one === null || typeof one !== "object") ? [{ path, value: said(value) }]
+            : value.flatMap((one, index) => leavesOf(one, `${path}.${index}`));
+    if (value !== null && typeof value === "object") {
+        const keys = Object.keys(value).sort();
+        return keys.length === 0 ? [{ path, value: "no settings" }] : keys.flatMap(key => leavesOf(value[key], `${path}.${key}`));
+    }
+    return [{ path, value: said(value) }];
+}
+/** Every field of the release terms, by its path in the terms (contracts/release-terms.ts), against the schema's
+ * own leaves: the contract test checks every one has a label. */
+export const RELEASE_TERM_LABELS = {
+    version: "Release terms version", repo: "Repository", packageVersion: "Package version", branch: "Branch", pr: "Pull request", base: "Base",
+    approvedSha: "Approved commit", approvedTree: "Approved tree",
+    "policy.version": "Carry policy version", "policy.rules": "Carry rules", "policy.carry": "Carry later commits",
+    "policy.protectProject": "Protected: the whole project", "policy.protectedPaths": "Protected paths",
+    "policy.limits.lines": "Carry limit: lines", "policy.limits.files": "Carry limit: files", "policy.limits.churn": "Carry limit: churn",
+    "policy.unsandboxedCarry": "Carry when checks aren't sandboxed",
+    "grant.id": "Release check grant", "grant.digest": "Release check grant digest", access: "Release check access", expiresAt: "Expires",
+};
+/** The leaf paths of a zod object schema (nested objects joined with dots). */
+export function schemaLeaves(schema, prefix = "") {
+    const shape = schema.shape;
+    if (shape === undefined || shape === null)
+        return [prefix];
+    return Object.entries(shape).flatMap(([key, child]) => schemaLeaves(child, prefix === "" ? key : `${prefix}.${key}`));
+}
+const valueAt = (terms, path) => path.split(".").reduce((at, key) => at !== null && typeof at === "object" ? at[key] : undefined, terms);
+/** Every signed term of `scope`, its release terms included, one line each. Reads only. */
+export function approvalTermsOf(store, scope, words) {
+    const ref = store.lookupRef(scope.taskId);
+    const repo = ref?.repo ?? null;
+    const filer = store.taskFiler(scope.taskId);
+    const profile = scope.profile ?? null;
+    const scopeValues = {
+        title: said(store.getTask(scope.taskId)?.title),
+        project: repo === null ? NONE : `${text(projectName(repo))} (${text(repo)})`,
+        filedBy: filer === null ? NONE : filer.name === null ? filer.kind : `${text(filer.name)}${filer.kind === "person" ? "" : ` (${filer.kind})`}`,
+        goal: said(scope.goal),
+        // null (nothing excluded) and an empty exclusion are signed apart, and read apart.
+        outOfScope: said(scope.outOfScope),
+        // No paths named is no limit: the work may touch any file in the project.
+        touches: scope.touches.length === 0 ? "any file in the project" : said(scope.touches),
+        // Each criterion's fields quoted, always: a colon or a parenthesis in one never moves the boundary to the next.
+        acceptance: scope.acceptance.length === 0 ? NONE : scope.acceptance.map(one => `${quoted(one.id)}: ${quoted(one.statement)} (evidence: ${said(one.evidence)})`).join("; "),
+        qualityMode: scope.qualityMode === "strict" ? "strict" : "standard",
+        agents: profile === null ? NONE : `${profile.provider} · ${text(profile.model)}`,
+        permission: said(words.profile(profile)),
+        checks: CHECK_LEVEL_WORDS[effectiveCheckLevel(store, repo, scope.taskId).level],
+        checkAccess: checkAccessWords(profile?.checkAccess ?? "sandboxed"),
+        budgetMicrousd: scope.budgetMicrousd === null ? NONE : money(scope.budgetMicrousd),
+        candidate: said(scope.candidate),
+    };
+    const lines = Object.keys(SCOPE_TERM_LABELS).map(key => ({ key, label: SCOPE_TERM_LABELS[key], value: scopeValues[key] }));
+    // Every signed setting of the agent profile (what it may read, reach and write, its limits) and the phase route the
+    // digest binds, one line each: the summary lines above never stand in for them.
+    if (profile !== null)
+        for (const leaf of leavesOf(profile, "profile"))
+            lines.push({ key: leaf.path, label: `Agent setting ${leaf.path.slice("profile.".length)}`, value: leaf.value });
+    if (scope.proposedRouteJson != null) {
+        const route = routeFromJson(scope.proposedRouteJson);
+        // Unreadable (it then never seals): its stored text, exactly, so two different ones never read alike.
+        if (route === null)
+            lines.push({ key: "route", label: "Phase route (unreadable)", value: quoted(scope.proposedRouteJson) });
+        else
+            for (const leaf of leavesOf(route, "route"))
+                lines.push({ key: leaf.path, label: `Phase route ${leaf.path.slice("route.".length)}`, value: leaf.value });
+    }
+    const terms = scope.releaseTerms ?? null;
+    for (const path of schemaLeaves(releaseTermsSchema)) {
+        const label = RELEASE_TERM_LABELS[path] ?? path;
+        const value = terms === null ? NONE : path === "pr" ? `#${terms.pr}`
+            // The whole project is protected, and the signed list is said too (it is part of what was signed).
+            : path === "policy.protectedPaths" && terms.policy.protectProject ? `the whole project (listed: ${said(terms.policy.protectedPaths)})`
+                // Absent (sealed before the setting existed) is off, said apart from a signed "no".
+                : path === "policy.unsandboxedCarry" && terms.policy.unsandboxedCarry === undefined ? "no (not set when sealed)" : said(valueAt(terms, path));
+        lines.push({ key: `release.${path}`, label, value });
+    }
+    return lines;
+}
+export const termsText = (lines) => lines.map(line => `${line.label}: ${line.value}`).join("\n");
+const SHA = /^[0-9a-f]{40}$/;
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
+export function releaseBaseline(store, repo) {
+    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a JOIN release_operation o ON o.authority = a.id
+    WHERE a.repo = ? AND a.state = 'merged' AND o.kind = 'merge' AND o.state = 'succeeded' AND o.external_ref IS NOT NULL ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
+    const ref = row === undefined ? null : String(row["external_ref"]);
+    return ref !== null && SHA.test(ref) ? ref : null;
+}
+/** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
+ * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
+ * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
+ * history). Null when they can't be read, so a card never shows a shortened list. */
+export function commitsBetween(repo, from, to) {
+    if (!SHA.test(from) || !SHA.test(to))
+        return null;
+    let gitDir;
+    try {
+        const named = join(realpathSync(repo), ".git");
+        if (!lstatSync(named).isDirectory())
+            return null;
+        gitDir = realpathSync(named);
+    }
+    catch {
+        return null;
+    }
+    const tools = releaseTools();
+    const env = { ...releaseGitEnv(), PATH: RELEASE_PATH };
+    const listing = spawnSync(tools.git, [`--git-dir=${gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env, encoding: "utf8", timeout: 15_000 });
+    if (listing.status !== 0 || releaseConfigProblem(listing.stdout) !== null)
+        return null;
+    const range = verifiedRange(gitDir, from, to, { git: tools.git, env });
+    if (!range.ok)
+        return null;
+    return range.value.map(one => ({ sha: one.id, subject: one.message.split("\n")[0].trim() }));
+}
+/** A pull request's own commits from GitHub, for the recorded owner/name. Null when GitHub can't be read. */
+function pullRequestCommits(slug, pr) {
+    const tools = releaseTools();
+    const read = spawnSync(tools.gh, ["api", `repos/${slug}/pulls/${pr}/commits?per_page=100`, "--jq", '.[] | .sha + "\\t" + (.commit.message | split("\\n")[0])'], { cwd: "/", env: releaseGitEnv(), encoding: "utf8", timeout: 15_000 });
+    if (read.status !== 0)
+        return null;
+    return read.stdout.split("\n").filter(line => line !== "").map(line => { const tab = line.indexOf("\t"); return { sha: line.slice(0, tab), subject: line.slice(tab + 1) }; })
+        .filter(one => SHA.test(one.sha)).reverse();
+}
+/** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
+export function releaseChangeList(store, terms) {
+    const baseline = releaseBaseline(store, terms.repo);
+    let commits;
+    let source;
+    if (baseline !== null) {
+        commits = commitsBetween(terms.repo, baseline, terms.approvedSha);
+        source = commits === null ? "unread" : "recorded";
+    }
+    else {
+        const remote = store.projectRemote(terms.repo);
+        const parsed = remote === null ? null : releaseRemote(remote);
+        commits = parsed === null ? null : pullRequestCommits(parsed.slug, terms.pr);
+        source = commits === null ? "unread" : "pull-request";
+    }
+    return { baseline, commits, source, digest: sha256(`release-changes:${JSON.stringify({ baseline, source, commits })}`) };
+}
+/** The card digest: everything the person is shown that can change under them. */
+export function cardDigestOf(scopeDigest, formDigest, changes) {
+    return sha256(`release-card:v1:${JSON.stringify([scopeDigest, formDigest, changes.baseline, changes.digest])}`);
+}
+function changeWords(changes, terms, cap) {
+    const head = changes.baseline === null ? `No earlier verified release is recorded. ${changes.source === "pull-request" ? `Pull request #${terms?.pr ?? "?"}'s commits:` : ""}`.trim()
+        : `Changes since the last verified release (${changes.baseline.slice(0, 7)}):`;
+    if (changes.commits === null)
+        return [head, changes.baseline === null ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
+    if (changes.commits.length === 0)
+        return [head, "No commits."];
+    return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
+}
+/** The release card for a deploy gate, against the live records now. */
+export function releaseCardOf(store, scope, formDigest, words) {
+    const terms = scope.releaseTerms ?? null;
+    const lines = approvalTermsOf(store, scope, words);
+    const value = (key) => lines.find(line => line.key === key)?.value ?? NONE;
+    const changes = terms === null
+        ? { baseline: null, commits: null, source: "unread", digest: sha256("release-changes:none") }
+        : releaseChangeList(store, terms);
+    const version = terms?.packageVersion ?? null;
+    const fileName = `release-${version ?? scope.taskId.replace(/[^A-Za-z0-9._-]/g, "-")}-terms.txt`;
+    const short = [
+        version === null ? `Deploy gate: ${value("title")}` : `Release ${version}: ${value("title")}`,
+        terms === null ? `Candidate ${said(scope.candidate).slice(0, 12)} · ${value("project")}` : `${projectName(terms.repo)} · ${terms.branch} · pull request #${terms.pr} · commit ${terms.approvedSha.slice(0, 7)}`,
+        terms === null ? `Checks: ${value("checks")} · check access: ${value("checkAccess")}` : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
+        // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
+        ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
+        "",
+        ...changeWords(changes, terms, 5),
+        "",
+        `Every term is in ${fileName}.`,
+    ].join("\n");
+    const full = [`${version === null ? "Deploy gate" : `Release ${version}`}: every term`, "", termsText(lines), "", ...changeWords(changes, terms, 200)].join("\n");
+    return { digest: cardDigestOf(scope.digest, formDigest, changes), short, full, fileName, changes };
+}

package/dist/release-carry.d.ts

@@ -27,6 +27,9 @@ export declare const CARRY_LIMITS: Readonly<{
 /** "Ask for every release commit": a project setting, newest choice wins (a ledger row each); off by default. */
 export declare const ASK_EVERY_COMMIT_ACTION = "release carrying changed";
 export declare function asksEveryReleaseCommit(store: Store, repo: string): boolean;
+/** Set "Carry release approvals when checks aren't sandboxed". `by` is who set it; turning it on is only ever called
+ * after a person's own proof (release-cli.ts). */
+export declare function setUnsandboxedCarry(store: Store, repo: string, on: boolean, by: string, now: Date): void;
 export declare function setAskEveryReleaseCommit(store: Store, repo: string, ask: boolean, by: string, now: Date): void;
 /** The effective policy now: the runtime rules, the project's protected paths and the limits. */
 export declare function effectivePolicy(store: Store, repo: string, options?: {

package/dist/release-carry.js

@@ -32,6 +32,7 @@ import { CARRY_RULES_VERSION, readReleasePolicy, releasePolicyDigest } from "./c
 import { run } from "./exec.js";
 import { proxyEnv, startEgressProxy } from "./egress.js";
 import { liveReleaseOf } from "./scope.js";
+import { UNSANDBOXED_CARRY_ACTION, carriesUnsandboxed } from "./release-authority.js";
 import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, } from "./store.js";
 // ------------------------------------------------------------------ the rules
 /** The journey scripts: tests, by Alex's decision (they carry). */
@@ -70,6 +71,12 @@ export function asksEveryReleaseCommit(store, repo) {
     const row = store.handle.prepare("SELECT outcome FROM action_ledger WHERE repo = ? AND action = ? ORDER BY id DESC LIMIT 1").get(repo, ASK_EVERY_COMMIT_ACTION);
     return row !== undefined && row["outcome"] === "ask";
 }
+/** Set "Carry release approvals when checks aren't sandboxed". `by` is who set it; turning it on is only ever called
+ * after a person's own proof (release-cli.ts). */
+export function setUnsandboxedCarry(store, repo, on, by, now) {
+    store.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null, action: UNSANDBOXED_CARRY_ACTION, outcome: on ? "on" : "off", source: "request",
+        detail: on ? "Carry release approvals when checks aren't sandboxed: later test-only commits run outside the sandbox without being shown first" : "Release approvals carry only when checks are sandboxed" });
+}
 export function setAskEveryReleaseCommit(store, repo, ask, by, now) {
     store.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null, action: ASK_EVERY_COMMIT_ACTION, outcome: ask ? "ask" : "carry", source: "request",
         detail: ask ? "Ask for every release commit" : "Later test-only commits ship under the release approval" });
@@ -80,6 +87,7 @@ export function effectivePolicy(store, repo, options = {}) {
     return {
         version: 1, rules: CARRY_RULES_VERSION, carry: options.noCarry !== true && !asksEveryReleaseCommit(store, repo),
         protectProject: rules.protectProject, protectedPaths: [...new Set(rules.protectedPaths)].sort(), limits: { ...CARRY_LIMITS },
+        unsandboxedCarry: carriesUnsandboxed(store, repo),
     };
 }
 /** The stricter of two policies: what either protects asks again, the lower limit wins, either one's "ask" asks. Null
@@ -91,6 +99,8 @@ export function stricterOf(a, b) {
         version: 1, rules: CARRY_RULES_VERSION, carry: a.carry && b.carry, protectProject: a.protectProject || b.protectProject,
         protectedPaths: [...new Set([...a.protectedPaths, ...b.protectedPaths])].sort(),
         limits: { lines: Math.min(a.limits.lines, b.limits.lines), files: Math.min(a.limits.files, b.limits.files), churn: Math.min(a.limits.churn, b.limits.churn) },
+        // Carrying when checks aren't sandboxed only while both allow it: turning it on later never widens an approval.
+        unsandboxedCarry: a.unsandboxedCarry === true && b.unsandboxedCarry === true,
     };
 }
 /**
@@ -141,12 +151,17 @@ export function releaseTermsFor(store, input) {
     const grant = store.liveVerifyCommand(input.repo);
     if (grant === null)
         return { ok: false, why: "the project has no approved release check" };
-    if (store.projectCheckAccess(input.repo) !== "sandboxed")
-        return { ok: false, why: "the project's checks run outside the sandbox, so later commits always ask again" };
+    const access = store.projectCheckAccess(input.repo);
+    const policy = effectivePolicy(store, input.repo, { noCarry: input.noCarry ?? false });
+    // Checks outside the sandbox carry only with the project's "Carry release approvals when checks aren't sandboxed" on,
+    // sealed here: turning it on after this approval never carries for it.
+    if (access !== "sandboxed" && policy.unsandboxedCarry !== true) {
+        return { ok: false, why: "the project's checks run outside the sandbox, so later commits always ask again (unless “Carry release approvals when checks aren't sandboxed” is on)" };
+    }
     return { ok: true, terms: {
             version: 1, repo: input.repo, packageVersion: input.version, branch: input.branch, pr: input.pr, base: "main",
-            approvedSha: input.candidate, approvedTree: commit.value.tree, policy: effectivePolicy(store, input.repo, { noCarry: input.noCarry ?? false }),
-            grant: { id: grant.id, digest: grant.digest }, access: "sandboxed",
+            approvedSha: input.candidate, approvedTree: commit.value.tree, policy,
+            grant: { id: grant.id, digest: grant.digest }, access,
             expiresAt: new Date(input.now.getTime() + 3 * 24 * 60 * 60_000).toISOString(),
         } };
 }
@@ -170,6 +185,10 @@ export function preflightCarry(store, input) {
         return refuse("authority", "This Toolroll doesn't know the release's carry rules; update Toolroll first.");
     if (!policy.carry)
         return refuse("rules", "This project asks for every release commit.");
+    // Checks outside the sandbox (at the approval or now): only when the sealed setting and the current one both allow it.
+    if ((a.accessDigest !== "sandboxed" || store.projectCheckAccess(a.repo) !== "sandboxed") && policy.unsandboxedCarry !== true) {
+        return refuse("rules", "This project's checks run outside the sandbox, and carrying release approvals then wasn't on when this release was approved, or is off now.");
+    }
     if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(input.to))
         return refuse("ancestry", `${input.to} isn't a full commit id.`);
     if (input.to === a.tipSha)

package/dist/release-cli.js

@@ -16,13 +16,16 @@ import { RELEASE_LIMITS, runRelease } from "./release.js";
 import { processes, releaseAdapters } from "./release-adapters.js";
 import { releaseGate } from "./release-gate.js";
 import { databasePath, openStore, revokeRelease } from "./store.js";
-import { carryRefusalWords, proveCarry, setAskEveryReleaseCommit } from "./release-carry.js";
+import { carryRefusalWords, proveCarry, setAskEveryReleaseCommit, setUnsandboxedCarry } from "./release-carry.js";
 import { authenticateApprover, machineActing, personProof } from "./scope.js";
 import { createNightlyCheckFlow } from "./nightly-check.js";
 import { parseSchedule } from "./flow-schedule.js";
 export const RELEASE_HELP = `toolroll release <branch> — release Toolroll itself, from a pushed branch with an open pull request
 
-  Requires an active approver's scope approval (the only human step) and a passing Full check on the exact commit.
+  First looks at the pull request's checks: a required check that failed stops before anything is filed or sent for
+  approval, and checks not started or still running are named and waited for (stopping if they don't finish within
+  the gate's limit). Then requires an active approver's scope approval (the only human step) and a passing Full check
+  on the exact commit.
   Completes that result, drains, backs up, deploys and relinks both CLI names to that commit. After PR checks pass,
   squash-merges, deletes the matching remote branch, verifies the merged tree and tags. Both macOS legs gate npm
   publication; Homebrew waits for its checks to register and all pass before merging.
@@ -49,6 +52,11 @@ toolroll release nightly --repo <path> --as <you> --token <password> [--schedule
 toolroll release ask-every-commit on|off --repo <path> [--as <you> --token <password>] — this project's releases ask
   for every later commit (on), or carry test-only commits again (off: your password, never the lead's token)
 
+toolroll release unsandboxed-carry on|off --repo <path> [--as <you> --token <password>] — carry release approvals
+  when this project's checks aren't sandboxed (on: your password, never the lead's token). With it on, later
+  test-only commits of a release run outside the sandbox without being shown to you first. Off by default; it counts
+  only for releases approved while it is on.
+
 Options
   --no-carry             every later commit of this release asks for approval again
   --to <commit>          with carry: the later commit
@@ -126,7 +134,7 @@ export async function runReleaseCommand(args, write, deps = {}) {
         return refuse("usage", "--yes goes with --release-gate <id>; a release needs no confirmation beyond the owner's approval.", 2);
     if (positional[0] === "nightly" && positional.length === 1)
         return runNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, schedule: scheduleFlag, start: args.includes("--start") }, write, json, deps);
-    if (["carry", "revoke", "ask-every-commit"].includes(positional[0] ?? "") && positional.length === 2) {
+    if (["carry", "revoke", "ask-every-commit", "unsandboxed-carry"].includes(positional[0] ?? "") && positional.length === 2) {
         return runAuthorityCommand(positional[0], positional[1], { to, request, as, token, repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo) }, write, json, deps);
     }
     if (positional.length !== 1)
@@ -255,6 +263,31 @@ async function runAuthorityCommand(command, target, flags, write, json, deps) {
             const words = target === "on" ? "Every later release commit in this project asks for approval." : "Later test-only release commits ship under the release approval.";
             return answer(true, { repo: flags.repo, ask: target === "on" }, words, 0);
         }
+        if (command === "unsandboxed-carry") {
+            if (target !== "on" && target !== "off")
+                return answer(false, { reason: "usage", message: "unsandboxed-carry takes on or off." }, "unsandboxed-carry takes on or off.", 2);
+            if (flags.repo === undefined)
+                return answer(false, { reason: "usage", message: "Name the project with --repo <path>." }, "Name the project with --repo <path>.", 2);
+            // Turning it on relaxes a release's rules: a person's own ceremony, as an approval needs, never a lead or remote
+            // token. Turning it off is only stricter.
+            let actor = "cli";
+            if (target === "on") {
+                const refused = (message) => answer(false, { reason: "person-only", message }, message, 1);
+                if (machineActing() || process.env["TOOLROLL_LEAD_TOKEN"] !== undefined || process.env["TOOLROLL_REMOTE_TOKEN"] !== undefined)
+                    return refused("Only a person turns this on, never the lead or a remote token.");
+                if (flags.as === undefined || flags.token === undefined)
+                    return refused("Turning this on needs your password: add --as <you> --token <password>.");
+                const proved = authenticateApprover(store, flags.as, flags.token, flags.repo);
+                if (!proved.ok || !personProof(proved.method))
+                    return refused("Only an approver of this project, proved as a person, turns this on.");
+                actor = flags.as;
+            }
+            setUnsandboxedCarry(store, flags.repo, target === "on", actor, now);
+            const words = target === "on"
+                ? "Release approvals approved from now on carry when this project's checks aren't sandboxed: later test-only commits will run outside the sandbox without being shown to you first."
+                : "Release approvals carry only when this project's checks are sandboxed.";
+            return answer(true, { repo: flags.repo, unsandboxedCarry: target === "on" }, words, 0);
+        }
         const id = Number(target);
         if (!Number.isSafeInteger(id) || id < 1)
             return answer(false, { reason: "usage", message: `${target} isn't a release id.` }, `${target} isn't a release id.`, 2);

package/dist/release-git.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The release's repository as Toolroll records it (docs/plans/chat-management.md §0a.2), never as the gate checkout
+ * says: the checkout is one of the plane's recorded projects (by real path), its Git directory is that project's own
+ * plain `.git` folder, and its GitHub `owner/name` and the URL fetched from come from the recorded remote
+ * (`project.remote_url`), not the checkout's `origin`. The checkout is where the release check ran the build's own code,
+ * so its `.git/config` is treated as build-written.
+ */
+export type ReleaseRepo = {
+    checkout: string;
+    gitDir: string;
+    remote: string;
+    slug: string;
+    ssh: boolean;
+};
+/** The programs the coordinator runs, by absolute path, found once when it starts. */
+export type ReleaseTools = {
+    git: string;
+    gh: string;
+    ssh: string;
+};
+/** owner/name and transport of a recorded GitHub remote, read strictly (https or ssh to github.com, nothing else). */
+export declare function releaseRemote(url: string): {
+    slug: string;
+    ssh: boolean;
+} | null;
+/** Fixed system folders: the only PATH the coordinator's Git and gh run with. */
+export declare const RELEASE_PATH = "/usr/bin:/bin:/usr/sbin:/sbin";
+/** Git, gh and ssh by absolute path: the system's Git (or the first in the fixed system folders), the installed gh as
+ * this process's PATH finds it now, and the system ssh. Resolved once; never looked up again. */
+export declare function releaseTools(path?: string): ReleaseTools;
+/** The coordinator's Git and gh environment: an allowlist, a fixed PATH, no system or global Git config, no prompts. */
+export declare function releaseGitEnv(base?: Readonly<NodeJS.ProcessEnv>): NodeJS.ProcessEnv;
+/** Every coordinator Git command's fixed settings, ahead of its own arguments: the recorded Git directory and checkout,
+ * no hooks, fsmonitor, replacement objects, pager or submodule recursion, only https (and ssh for an ssh remote), the
+ * system ssh, and gh as the only credential helper. */
+export declare function releaseGitArgs(repo: ReleaseRepo, tools: ReleaseTools): string[];
+/** The named remote the coordinator fetches, looks and pushes through: defined only on its own command line (`-c`), so
+ * no checkout setting names or rewrites it. */
+export declare const RELEASE_REMOTE = "toolroll-release";
+/** The first local or worktree setting a gate checkout's config holds that a release won't run with, or null: one
+ * outside the allowlist (an include, a command, a proxy, TLS or header setting, a credential helper, a URL rewrite, a
+ * hooks folder), a remote named like a URL or after the coordinator's own, or a remote over a transport helper. */
+export declare function releaseConfigProblem(listing: string): string | null;