toolroll 0.9.72 → 0.9.74

package/dist/release-adapters.js

@@ -24,6 +24,9 @@ import { proveCarry } from "./release-carry.js";
 import { randomBytes, randomUUID } from "node:crypto";
 import { deploymentGate } from "./deploy-gate.js";
 import { extractCommit } from "./commit-extract.js";
+import { checkoutIncludes } from "./teardown-git.js";
+import { RELEASE_REMOTE, releaseConfigProblem, releaseGitArgs, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
+export { RELEASE_PATH, RELEASE_REMOTE, releaseConfigProblem, releaseGitArgs, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
 /** A child process, its output kept whole; a missing program or a time limit is exit 127 or 124, never a throw. */
 export const exec = (command, args, options = {}) => new Promise(done => {
     const child = execFile(command, [...args], { cwd: options.cwd, env: options.env ?? process.env, timeout: options.timeoutMs ?? 120_000, maxBuffer: 64 * 1024 * 1024, encoding: "utf8" }, (error, stdout, stderr) => {
@@ -112,6 +115,9 @@ export function gateStateOf(answer, accounts = []) {
     const failed = newest !== undefined && newest["finishedAt"] != null && newest["outcome"] !== "built" && newest["outcome"] !== "no-change" && Number(newest["id"]) !== resultRun
         ? `run ${String(newest["id"])} ended ${String(newest["outcome"] ?? "without an outcome")}` : null;
     const worktree = runs.find(run => run["id"] === resultRun)?.["worktree"];
+    // Queued again or still building past the result shown (a regate): that result is the one before the rerun.
+    const state = object(answer["task"])["state"];
+    const pending = resultRun !== null && (state === "queued" || state === "running" || (newest !== undefined && newest["finishedAt"] == null && Number(newest["id"]) > resultRun));
     return {
         exists: true,
         candidate: textOr(scope["candidate"]),
@@ -128,6 +134,7 @@ export function gateStateOf(answer, accounts = []) {
                 : checks["status"] === "passed" && checks["level"] !== "full" ? "not-full" : String(checks["status"] ?? "not-run"),
         },
         failed,
+        pending,
         completion: textOr(completion["digest"]) === null ? null : { actor: String(completion["actor"]), at: String(completion["at"]), digest: String(completion["digest"]) },
     };
 }
@@ -162,6 +169,48 @@ export function stageGate(stage, owner) {
     const id = textOr(journal["id"]), phase = textOr(journal["phase"]);
     return id !== null && phase !== null && BEFORE_SWAP.includes(phase) && owner() === id ? { id, phase } : null;
 }
+/** The recorded repository for a gate checkout, from the plane's database; throws in plain words when there is none. */
+export function recordedReleaseRepo(database, checkout) {
+    const real = (path) => { try {
+        return realpathSync(path);
+    }
+    catch {
+        return null;
+    } };
+    const at = real(checkout);
+    if (at === null)
+        throw new Error(`${checkout} isn't there.`);
+    if (!existsSync(database))
+        throw new Error("The plane's database isn't here, so the release's repository can't be read from its records.");
+    const db = new (sqlite().DatabaseSync)(database, { readOnly: true });
+    let project = null, remote = null;
+    try {
+        const store = new Store(db);
+        project = store.listProjects().map(one => one.path).find(path => real(path) === at) ?? null;
+        remote = project === null ? null : store.projectRemote(project);
+    }
+    finally {
+        db.close();
+    }
+    if (project === null)
+        throw new Error(`${checkout} isn't one of the projects Toolroll records, so it can't be released from here.`);
+    if (remote === null)
+        throw new Error(`${project} has no recorded remote. Record it with \`toolroll repos add ${project} --remote <url>\` first.`);
+    const parsed = releaseRemote(remote);
+    if (parsed === null)
+        throw new Error(`${project}'s recorded remote (${remote}) isn't a GitHub repository over https or ssh.`);
+    const named = join(at, ".git");
+    let gitDir;
+    try {
+        if (!lstatSync(named).isDirectory())
+            throw new Error("not a folder");
+        gitDir = realpathSync(named);
+    }
+    catch {
+        throw new Error(`${project}'s Git directory isn't a plain folder, so the release won't read it.`);
+    }
+    return { checkout: at, gitDir, remote, ...parsed };
+}
 /** How many times, and how far apart, a merged branch's deletion is looked for after the push lost a race. */
 export const BRANCH_GONE_LOOKS = 5;
 export const BRANCH_GONE_PAUSE_MS = 2_000;
@@ -171,9 +220,11 @@ export function releaseAdapters(options) {
     const { checkout } = options;
     const tap = options.tap ?? "ap9000/homebrew-toolroll";
     const formula = options.formula ?? "Formula/toolroll.rb";
-    const git = (...args) => run("git", ["-C", checkout, ...args]);
     const pause = options.sleep ?? ((ms) => new Promise(done => setTimeout(done, ms)));
-    const gh = (...args) => run("gh", args);
+    const tools = options.tools ?? releaseTools();
+    const gitEnv = releaseGitEnv();
+    // Never a PATH lookup or the checkout's Git config: gh by its absolute path, from a neutral folder, naming the repo.
+    const gh = (...args) => run(tools.gh, args, { cwd: "/", env: gitEnv });
     const ghJson = async (what, ...args) => JSON.parse(await must(gh(...args), what));
     const toolroll = async (...args) => {
         const result = await run("toolroll", [...args, "--json"], { env: cleanEnv(), timeoutMs: 120_000 });
@@ -186,6 +237,29 @@ export function releaseAdapters(options) {
     };
     const refused = (answer) => `${String(answer["message"] ?? answer["reason"] ?? "refused")}`;
     const database = options.database ?? databasePath(process.env, homedir());
+    let recorded = options.releaseRepo ?? null;
+    /** The recorded repository, read once (chat-management.md §0a.2). */
+    const releaseRepo = () => recorded ??= recordedReleaseRepo(database, checkout);
+    /**
+     * The coordinator's one way to run Git (§0a.2): on the recorded Git directory, hardened, with an allowlisted
+     * environment and the absolute Git. Before every command the checkout's own config is read with includes off and
+     * as plain files; one that includes a file, names a command or redirects a remote stops the release, naming it.
+     */
+    const git = async (...args) => {
+        const repo = releaseRepo();
+        const stop = (why) => new Error(`Toolroll won't run Git in ${repo.checkout} for a release: ${why}. Remove it from the project's Git config, then rerun.`);
+        if (options.releaseRepo === undefined && checkoutIncludes(repo.checkout))
+            throw stop("its Git config includes another file, or couldn't be read as a plain file");
+        const listing = await run(tools.git, [`--git-dir=${repo.gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env: gitEnv });
+        if (listing.code !== 0)
+            throw stop("its Git config couldn't be read");
+        const setting = releaseConfigProblem(listing.stdout);
+        if (setting !== null)
+            throw stop(`its Git config sets ${setting}, which a release doesn't run with (it could run a command, or change where Git connects or what it sends)`);
+        return run(tools.git, [...releaseGitArgs(repo, tools), ...args], { cwd: repo.checkout, env: gitEnv });
+    };
+    /** The remote every fetch, look and push names: the recorded URL, defined only on the command line. */
+    const remoteUrl = () => RELEASE_REMOTE;
     const liveOwner = () => {
         if (!existsSync(database))
             return null;
@@ -293,16 +367,12 @@ export function releaseAdapters(options) {
         sleep: options.sleep ?? sleep,
         say: options.say ?? (line => process.stdout.write(`${line}\n`)),
         repo: {
-            async github() {
-                const slug = githubSlug(await must(git("remote", "get-url", "origin"), "git remote get-url origin"));
-                if (slug === null)
-                    throw new Error(`${checkout}'s origin is not a GitHub repository`);
-                return slug;
-            },
+            // The recorded owner/name, never the checkout's origin.
+            async github() { return releaseRepo().slug; },
             async sync(branch) {
-                await must(git("fetch", "--quiet", "origin", "+refs/heads/main:refs/remotes/origin/main"), "git fetch origin main");
+                await must(git("fetch", "--quiet", "--no-tags", remoteUrl(), "+refs/heads/main:refs/remotes/origin/main"), "git fetch main");
                 // A merged branch may be gone from GitHub; its commit is already here.
-                await git("fetch", "--quiet", "origin", `+refs/heads/${branch}:refs/remotes/origin/${branch}`);
+                await git("fetch", "--quiet", "--no-tags", remoteUrl(), `+refs/heads/${branch}:refs/remotes/origin/${branch}`);
                 const current = (await git("symbolic-ref", "--quiet", "--short", "HEAD")).stdout.trim();
                 if (current === "main") {
                     await must(git("merge", "--ff-only", "--quiet", "origin/main"), "git merge --ff-only origin/main");
@@ -316,17 +386,17 @@ export function releaseAdapters(options) {
                     throw new Error(`${checkout}'s local main has commits origin/main doesn't; the gate diffs from it, so fix it first`);
             },
             async remoteHead(branch) {
-                const out = await must(git("ls-remote", "origin", `refs/heads/${branch}`), "git ls-remote");
+                const out = await must(git("ls-remote", remoteUrl(), `refs/heads/${branch}`), "git ls-remote");
                 return out.trim().split(/\s+/)[0] || null;
             },
             async deleteBranch(branch, head) {
                 const ref = `refs/heads/${branch}`;
-                const current = (await must(git("ls-remote", "origin", ref), "git ls-remote")).trim().split(/\s+/)[0] || null;
+                const current = (await must(git("ls-remote", remoteUrl(), ref), "git ls-remote")).trim().split(/\s+/)[0] || null;
                 if (current === null)
                     return;
                 if (current !== head)
                     throw new Error(`${branch} moved after merging; its new head was not deleted.`);
-                const pushed = await git("push", `--force-with-lease=${ref}:${head}`, "origin", `:${ref}`);
+                const pushed = await git("push", "--no-verify", `--force-with-lease=${ref}:${head}`, remoteUrl(), `:${ref}`);
                 if (pushed.code === 0)
                     return;
                 // GitHub may delete a merged branch itself between the look and the push; gone is what was wanted. Its refs can
@@ -334,7 +404,7 @@ export function releaseAdapters(options) {
                 for (let look = 0; look < BRANCH_GONE_LOOKS; look++) {
                     if (look > 0)
                         await pause(BRANCH_GONE_PAUSE_MS);
-                    const after = (await must(git("ls-remote", "origin", ref), "git ls-remote")).trim().split(/\s+/)[0] || null;
+                    const after = (await must(git("ls-remote", remoteUrl(), ref), "git ls-remote")).trim().split(/\s+/)[0] || null;
                     if (after === null)
                         return;
                 }

package/dist/release-authority.d.ts

@@ -98,6 +98,12 @@ export declare function releaseAuthorityOfTask(store: Store, taskId: string): {
     carry: ReleaseCarry | null;
 } | null;
 /** Whether a task belongs to any release authority (anchor or carried), from the records alone. */
+/** "Carry release approvals when checks aren't sandboxed": a project setting, newest choice wins (a ledger row each);
+ * off by default. Turning it on is a person's own proven act (release-cli.ts); turning it off is anyone's. */
+export declare const UNSANDBOXED_CARRY_ACTION = "release unsandboxed carrying changed";
+export declare function carriesUnsandboxed(store: Store, repo: string): boolean;
+/** How far a check reaches, narrowest first. */
+export declare const CHECK_ACCESS_WIDTH: Readonly<Record<string, number>>;
 export declare function belongsToRelease(store: Store, taskId: string): boolean;
 export declare function releaseCarries(store: Store, authority: number): ReleaseCarry[];
 export declare function releaseCarryTo(store: Store, authority: number, toSha: string): ReleaseCarry | null;

package/dist/release-authority.js

@@ -86,6 +86,15 @@ export function releaseAuthorityOfTask(store, taskId) {
     return row === undefined ? null : { authority: readReleaseAuthority(row), carry: null };
 }
 /** Whether a task belongs to any release authority (anchor or carried), from the records alone. */
+/** "Carry release approvals when checks aren't sandboxed": a project setting, newest choice wins (a ledger row each);
+ * off by default. Turning it on is a person's own proven act (release-cli.ts); turning it off is anyone's. */
+export const UNSANDBOXED_CARRY_ACTION = "release unsandboxed carrying changed";
+export function carriesUnsandboxed(store, repo) {
+    const row = store.handle.prepare("SELECT outcome FROM action_ledger WHERE repo = ? AND action = ? ORDER BY id DESC LIMIT 1").get(repo, UNSANDBOXED_CARRY_ACTION);
+    return row !== undefined && row["outcome"] === "on";
+}
+/** How far a check reaches, narrowest first. */
+export const CHECK_ACCESS_WIDTH = Object.freeze({ sandboxed: 0, "sign-ins": 1, unsandboxed: 2 });
 export function belongsToRelease(store, taskId) {
     return store.handle.prepare("SELECT 1 AS hit FROM release_authority WHERE anchor_task = ? UNION ALL SELECT 1 FROM release_carry WHERE task_id = ? LIMIT 1").get(taskId, taskId) !== undefined;
 }

package/dist/release-card.d.ts

@@ -0,0 +1,76 @@
+import { type ReleaseTerms } from "./contracts/release-terms.js";
+import type { Scope } from "./scope.js";
+import type { Store } from "./store.js";
+/** One signed term as the card says it. `key` names the scope field or the release term's path. */
+export type TermLine = {
+    key: string;
+    label: string;
+    value: string;
+};
+/** The scope's own terms the card names, in order. A contract test holds `goal`, `outOfScope`, `touches` and
+ * `acceptance` (contracts/scope.ts) and the scope's other signed fields to this list; the agent profile and the phase
+ * route follow as one line per signed setting (`profile.…`, `route.…`). */
+export declare const SCOPE_TERM_LABELS: {
+    readonly title: "Title";
+    readonly project: "Project";
+    readonly filedBy: "Filed by";
+    readonly goal: "Goal";
+    readonly outOfScope: "Not in scope";
+    readonly touches: "Paths it may touch";
+    readonly acceptance: "Done when";
+    readonly qualityMode: "Evidence standard";
+    readonly agents: "Agents and model";
+    readonly permission: "Agents may";
+    readonly checks: "Checks";
+    readonly checkAccess: "Check access";
+    readonly budgetMicrousd: "Budget per attempt";
+    readonly candidate: "Candidate commit";
+};
+/** Every field of the release terms, by its path in the terms (contracts/release-terms.ts), against the schema's
+ * own leaves: the contract test checks every one has a label. */
+export declare const RELEASE_TERM_LABELS: Readonly<Record<string, string>>;
+/** The leaf paths of a zod object schema (nested objects joined with dots). */
+export declare function schemaLeaves(schema: unknown, prefix?: string): string[];
+/** Every signed term of `scope`, its release terms included, one line each. Reads only. */
+export declare function approvalTermsOf(store: Store, scope: Scope, words: {
+    profile: (profile: Scope["profile"]) => string | null;
+}): TermLine[];
+export declare const termsText: (lines: readonly TermLine[]) => string;
+export type ChangeList = {
+    /** The merge commit of the last verified release, or null when none is recorded. */
+    baseline: string | null;
+    /** Newest first; null when it couldn't be read. */
+    commits: {
+        sha: string;
+        subject: string;
+    }[] | null;
+    source: "recorded" | "pull-request" | "unread";
+    digest: string;
+};
+/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
+export declare function releaseBaseline(store: Store, repo: string): string | null;
+/** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
+ * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
+ * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
+ * history). Null when they can't be read, so a card never shows a shortened list. */
+export declare function commitsBetween(repo: string, from: string, to: string): {
+    sha: string;
+    subject: string;
+}[] | null;
+/** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
+export declare function releaseChangeList(store: Store, terms: ReleaseTerms): ChangeList;
+export type ReleaseCard = {
+    /** Binds the scope digest, the plan form's digest, the baseline and the change list. */
+    digest: string;
+    short: string;
+    full: string;
+    fileName: string;
+    changes: ChangeList;
+};
+/** The card digest: everything the person is shown that can change under them. */
+export declare function cardDigestOf(scopeDigest: string, formDigest: string, changes: Pick<ChangeList, "baseline" | "digest">): string;
+/** The release card for a deploy gate, against the live records now. */
+export declare function releaseCardOf(store: Store, scope: Scope, formDigest: string, words: {
+    profile: (profile: Scope["profile"]) => string | null;
+}): ReleaseCard;

package/dist/release-card.js

@@ -0,0 +1,252 @@
+/**
+ * The release card (docs/plans/chat-management.md §0a.5): how a deploy gate is approved from chat until the
+ * authenticator ships. Alex's decision (2026-10-25): chat keeps approving releases by tap, so the tap is made to mean
+ * exactly what was shown.
+ *
+ * - `approvalTermsOf`: every signed term of the scope (its agent profile and phase route setting by setting) and every
+ *   field of its release terms, one line each, "none" for an empty one and "any file in the project" for unnamed paths
+ *   (a contract test changes each input of the approval digest in turn and holds the text to change with it).
+ * - `releaseChangeList`: what changed since the last verified release, from the plane's own record of it (the merge
+ *   commit of the newest merged release whose merge operation succeeded), read as verified Git objects from the
+ *   project's recorded Git directory: never a tag or a ref, so moving one changes nothing, and history rewritten around
+ *   the objects (a shallow boundary, grafts, replacement refs) refuses the list rather than shortening it.
+ *   With no earlier release on record, the pull request's own commits from GitHub, for the recorded owner/name.
+ * - `releaseCardOf`: the short card, the full terms (sent as a file where the chat app limits a message), and
+ *   `cardDigest`, which binds the scope digest, the plan form's digest, the baseline and the change list: Continue and
+ *   Approve carry it, and anything different at the tap refuses.
+ */
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { lstatSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { checkAccessWords } from "./check-access.js";
+import { CHECK_LEVEL_WORDS, effectiveCheckLevel } from "./check-levels.js";
+import { verifiedRange } from "./commit-extract.js";
+import { releaseTermsSchema } from "./contracts/release-terms.js";
+import { routeFromJson } from "./phase-routing.js";
+import { projectName } from "./project.js";
+import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
+const NONE = "none";
+/** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
+const money = (micro) => {
+    const exact = BigInt(micro), whole = exact / 1000000n, rest = (exact < 0n ? -exact : exact) % 1000000n;
+    const fraction = rest.toString().padStart(6, "0");
+    return `${exact < 0n && whole === 0n ? "-" : ""}$${whole}.${rest % 10000n === 0n ? fraction.slice(0, 2) : fraction}`;
+};
+/** Words the card itself says in place of a value: a signed string spelled the same is quoted, never mistaken for one. */
+const RESERVED = new Set([NONE, "yes", "no", "null", "empty", "not set", "any file in the project", "the whole project", "unreadable"]);
+/** Text that reads the same plain as quoted: ASCII letters, digits and ordinary punctuation only (no lookalike letters
+ * from other scripts, no direction marks), never a comma, semicolon, parenthesis, quote, backslash, line break or
+ * control character, nor a trailing space. */
+const PLAIN = /^[A-Za-z0-9~/.#$@][A-Za-z0-9 ._/@~+#=!?&%$*:<>|^-]*$/;
+/** JSON-quoted with everything outside printable ASCII \u-escaped (JSON.stringify leaves non-ASCII as it is). */
+const quoted = (value) => JSON.stringify(value).replace(/[^\x20-\x7e]/g, one => `\\u${one.charCodeAt(0).toString(16).padStart(4, "0")}`);
+/** One signed string, unambiguous: as it is when plain, else quoted; an empty, number-like or colon-bearing string, or
+ * one of the card's own words, is quoted too. */
+const text = (value) => PLAIN.test(value) && !value.endsWith(" ") && !RESERVED.has(value.toLowerCase()) && !/^-?\d+(\.\d+)?$/.test(value) ? value : quoted(value);
+/** One signed value as the card says it, every shape distinct: "none" for null, "not set" for absent, "empty" for an
+ * empty list, `""` for an empty string; a list's entries each said the same way, so a comma never joins two into one. */
+const said = (value) => {
+    if (value === undefined)
+        return "not set";
+    if (value === null)
+        return NONE;
+    if (typeof value === "boolean")
+        return value ? "yes" : "no";
+    if (typeof value === "number")
+        return String(value);
+    if (Array.isArray(value))
+        return value.length === 0 ? "empty" : value.map(one => typeof one === "string" ? text(one) : one === null ? "null" : said(one)).join(", ");
+    return text(String(value));
+};
+/** The scope's own terms the card names, in order. A contract test holds `goal`, `outOfScope`, `touches` and
+ * `acceptance` (contracts/scope.ts) and the scope's other signed fields to this list; the agent profile and the phase
+ * route follow as one line per signed setting (`profile.…`, `route.…`). */
+export const SCOPE_TERM_LABELS = {
+    title: "Title", project: "Project", filedBy: "Filed by", goal: "Goal", outOfScope: "Not in scope", touches: "Paths it may touch",
+    acceptance: "Done when", qualityMode: "Evidence standard", agents: "Agents and model", permission: "Agents may", checks: "Checks", checkAccess: "Check access",
+    budgetMicrousd: "Budget per attempt", candidate: "Candidate commit",
+};
+/** Every leaf of a signed value, at its path (`a.b`, `legs.0.model`), as the card says it. */
+function leavesOf(value, path) {
+    if (Array.isArray(value))
+        return value.every(one => one === null || typeof one !== "object") ? [{ path, value: said(value) }]
+            : value.flatMap((one, index) => leavesOf(one, `${path}.${index}`));
+    if (value !== null && typeof value === "object") {
+        const keys = Object.keys(value).sort();
+        return keys.length === 0 ? [{ path, value: "no settings" }] : keys.flatMap(key => leavesOf(value[key], `${path}.${key}`));
+    }
+    return [{ path, value: said(value) }];
+}
+/** Every field of the release terms, by its path in the terms (contracts/release-terms.ts), against the schema's
+ * own leaves: the contract test checks every one has a label. */
+export const RELEASE_TERM_LABELS = {
+    version: "Release terms version", repo: "Repository", packageVersion: "Package version", branch: "Branch", pr: "Pull request", base: "Base",
+    approvedSha: "Approved commit", approvedTree: "Approved tree",
+    "policy.version": "Carry policy version", "policy.rules": "Carry rules", "policy.carry": "Carry later commits",
+    "policy.protectProject": "Protected: the whole project", "policy.protectedPaths": "Protected paths",
+    "policy.limits.lines": "Carry limit: lines", "policy.limits.files": "Carry limit: files", "policy.limits.churn": "Carry limit: churn",
+    "policy.unsandboxedCarry": "Carry when checks aren't sandboxed",
+    "grant.id": "Release check grant", "grant.digest": "Release check grant digest", access: "Release check access", expiresAt: "Expires",
+};
+/** The leaf paths of a zod object schema (nested objects joined with dots). */
+export function schemaLeaves(schema, prefix = "") {
+    const shape = schema.shape;
+    if (shape === undefined || shape === null)
+        return [prefix];
+    return Object.entries(shape).flatMap(([key, child]) => schemaLeaves(child, prefix === "" ? key : `${prefix}.${key}`));
+}
+const valueAt = (terms, path) => path.split(".").reduce((at, key) => at !== null && typeof at === "object" ? at[key] : undefined, terms);
+/** Every signed term of `scope`, its release terms included, one line each. Reads only. */
+export function approvalTermsOf(store, scope, words) {
+    const ref = store.lookupRef(scope.taskId);
+    const repo = ref?.repo ?? null;
+    const filer = store.taskFiler(scope.taskId);
+    const profile = scope.profile ?? null;
+    const scopeValues = {
+        title: said(store.getTask(scope.taskId)?.title),
+        project: repo === null ? NONE : `${text(projectName(repo))} (${text(repo)})`,
+        filedBy: filer === null ? NONE : filer.name === null ? filer.kind : `${text(filer.name)}${filer.kind === "person" ? "" : ` (${filer.kind})`}`,
+        goal: said(scope.goal),
+        // null (nothing excluded) and an empty exclusion are signed apart, and read apart.
+        outOfScope: said(scope.outOfScope),
+        // No paths named is no limit: the work may touch any file in the project.
+        touches: scope.touches.length === 0 ? "any file in the project" : said(scope.touches),
+        // Each criterion's fields quoted, always: a colon or a parenthesis in one never moves the boundary to the next.
+        acceptance: scope.acceptance.length === 0 ? NONE : scope.acceptance.map(one => `${quoted(one.id)}: ${quoted(one.statement)} (evidence: ${said(one.evidence)})`).join("; "),
+        qualityMode: scope.qualityMode === "strict" ? "strict" : "standard",
+        agents: profile === null ? NONE : `${profile.provider} · ${text(profile.model)}`,
+        permission: said(words.profile(profile)),
+        checks: CHECK_LEVEL_WORDS[effectiveCheckLevel(store, repo, scope.taskId).level],
+        checkAccess: checkAccessWords(profile?.checkAccess ?? "sandboxed"),
+        budgetMicrousd: scope.budgetMicrousd === null ? NONE : money(scope.budgetMicrousd),
+        candidate: said(scope.candidate),
+    };
+    const lines = Object.keys(SCOPE_TERM_LABELS).map(key => ({ key, label: SCOPE_TERM_LABELS[key], value: scopeValues[key] }));
+    // Every signed setting of the agent profile (what it may read, reach and write, its limits) and the phase route the
+    // digest binds, one line each: the summary lines above never stand in for them.
+    if (profile !== null)
+        for (const leaf of leavesOf(profile, "profile"))
+            lines.push({ key: leaf.path, label: `Agent setting ${leaf.path.slice("profile.".length)}`, value: leaf.value });
+    if (scope.proposedRouteJson != null) {
+        const route = routeFromJson(scope.proposedRouteJson);
+        // Unreadable (it then never seals): its stored text, exactly, so two different ones never read alike.
+        if (route === null)
+            lines.push({ key: "route", label: "Phase route (unreadable)", value: quoted(scope.proposedRouteJson) });
+        else
+            for (const leaf of leavesOf(route, "route"))
+                lines.push({ key: leaf.path, label: `Phase route ${leaf.path.slice("route.".length)}`, value: leaf.value });
+    }
+    const terms = scope.releaseTerms ?? null;
+    for (const path of schemaLeaves(releaseTermsSchema)) {
+        const label = RELEASE_TERM_LABELS[path] ?? path;
+        const value = terms === null ? NONE : path === "pr" ? `#${terms.pr}`
+            // The whole project is protected, and the signed list is said too (it is part of what was signed).
+            : path === "policy.protectedPaths" && terms.policy.protectProject ? `the whole project (listed: ${said(terms.policy.protectedPaths)})`
+                // Absent (sealed before the setting existed) is off, said apart from a signed "no".
+                : path === "policy.unsandboxedCarry" && terms.policy.unsandboxedCarry === undefined ? "no (not set when sealed)" : said(valueAt(terms, path));
+        lines.push({ key: `release.${path}`, label, value });
+    }
+    return lines;
+}
+export const termsText = (lines) => lines.map(line => `${line.label}: ${line.value}`).join("\n");
+const SHA = /^[0-9a-f]{40}$/;
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
+export function releaseBaseline(store, repo) {
+    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a JOIN release_operation o ON o.authority = a.id
+    WHERE a.repo = ? AND a.state = 'merged' AND o.kind = 'merge' AND o.state = 'succeeded' AND o.external_ref IS NOT NULL ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
+    const ref = row === undefined ? null : String(row["external_ref"]);
+    return ref !== null && SHA.test(ref) ? ref : null;
+}
+/** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
+ * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
+ * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own
+ * history). Null when they can't be read, so a card never shows a shortened list. */
+export function commitsBetween(repo, from, to) {
+    if (!SHA.test(from) || !SHA.test(to))
+        return null;
+    let gitDir;
+    try {
+        const named = join(realpathSync(repo), ".git");
+        if (!lstatSync(named).isDirectory())
+            return null;
+        gitDir = realpathSync(named);
+    }
+    catch {
+        return null;
+    }
+    const tools = releaseTools();
+    const env = { ...releaseGitEnv(), PATH: RELEASE_PATH };
+    const listing = spawnSync(tools.git, [`--git-dir=${gitDir}`, "--no-optional-locks", "config", "--list", "--no-includes", "--show-scope", "-z"], { cwd: "/", env, encoding: "utf8", timeout: 15_000 });
+    if (listing.status !== 0 || releaseConfigProblem(listing.stdout) !== null)
+        return null;
+    const range = verifiedRange(gitDir, from, to, { git: tools.git, env });
+    if (!range.ok)
+        return null;
+    return range.value.map(one => ({ sha: one.id, subject: one.message.split("\n")[0].trim() }));
+}
+/** A pull request's own commits from GitHub, for the recorded owner/name. Null when GitHub can't be read. */
+function pullRequestCommits(slug, pr) {
+    const tools = releaseTools();
+    const read = spawnSync(tools.gh, ["api", `repos/${slug}/pulls/${pr}/commits?per_page=100`, "--jq", '.[] | .sha + "\\t" + (.commit.message | split("\\n")[0])'], { cwd: "/", env: releaseGitEnv(), encoding: "utf8", timeout: 15_000 });
+    if (read.status !== 0)
+        return null;
+    return read.stdout.split("\n").filter(line => line !== "").map(line => { const tab = line.indexOf("\t"); return { sha: line.slice(0, tab), subject: line.slice(tab + 1) }; })
+        .filter(one => SHA.test(one.sha)).reverse();
+}
+/** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
+export function releaseChangeList(store, terms) {
+    const baseline = releaseBaseline(store, terms.repo);
+    let commits;
+    let source;
+    if (baseline !== null) {
+        commits = commitsBetween(terms.repo, baseline, terms.approvedSha);
+        source = commits === null ? "unread" : "recorded";
+    }
+    else {
+        const remote = store.projectRemote(terms.repo);
+        const parsed = remote === null ? null : releaseRemote(remote);
+        commits = parsed === null ? null : pullRequestCommits(parsed.slug, terms.pr);
+        source = commits === null ? "unread" : "pull-request";
+    }
+    return { baseline, commits, source, digest: sha256(`release-changes:${JSON.stringify({ baseline, source, commits })}`) };
+}
+/** The card digest: everything the person is shown that can change under them. */
+export function cardDigestOf(scopeDigest, formDigest, changes) {
+    return sha256(`release-card:v1:${JSON.stringify([scopeDigest, formDigest, changes.baseline, changes.digest])}`);
+}
+function changeWords(changes, terms, cap) {
+    const head = changes.baseline === null ? `No earlier verified release is recorded. ${changes.source === "pull-request" ? `Pull request #${terms?.pr ?? "?"}'s commits:` : ""}`.trim()
+        : `Changes since the last verified release (${changes.baseline.slice(0, 7)}):`;
+    if (changes.commits === null)
+        return [head, changes.baseline === null ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
+    if (changes.commits.length === 0)
+        return [head, "No commits."];
+    return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
+}
+/** The release card for a deploy gate, against the live records now. */
+export function releaseCardOf(store, scope, formDigest, words) {
+    const terms = scope.releaseTerms ?? null;
+    const lines = approvalTermsOf(store, scope, words);
+    const value = (key) => lines.find(line => line.key === key)?.value ?? NONE;
+    const changes = terms === null
+        ? { baseline: null, commits: null, source: "unread", digest: sha256("release-changes:none") }
+        : releaseChangeList(store, terms);
+    const version = terms?.packageVersion ?? null;
+    const fileName = `release-${version ?? scope.taskId.replace(/[^A-Za-z0-9._-]/g, "-")}-terms.txt`;
+    const short = [
+        version === null ? `Deploy gate: ${value("title")}` : `Release ${version}: ${value("title")}`,
+        terms === null ? `Candidate ${said(scope.candidate).slice(0, 12)} · ${value("project")}` : `${projectName(terms.repo)} · ${terms.branch} · pull request #${terms.pr} · commit ${terms.approvedSha.slice(0, 7)}`,
+        terms === null ? `Checks: ${value("checks")} · check access: ${value("checkAccess")}` : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
+        // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
+        ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
+        "",
+        ...changeWords(changes, terms, 5),
+        "",
+        `Every term is in ${fileName}.`,
+    ].join("\n");
+    const full = [`${version === null ? "Deploy gate" : `Release ${version}`}: every term`, "", termsText(lines), "", ...changeWords(changes, terms, 200)].join("\n");
+    return { digest: cardDigestOf(scope.digest, formDigest, changes), short, full, fileName, changes };
+}

package/dist/release-carry.d.ts

@@ -27,6 +27,9 @@ export declare const CARRY_LIMITS: Readonly<{
 /** "Ask for every release commit": a project setting, newest choice wins (a ledger row each); off by default. */
 export declare const ASK_EVERY_COMMIT_ACTION = "release carrying changed";
 export declare function asksEveryReleaseCommit(store: Store, repo: string): boolean;
+/** Set "Carry release approvals when checks aren't sandboxed". `by` is who set it; turning it on is only ever called
+ * after a person's own proof (release-cli.ts). */
+export declare function setUnsandboxedCarry(store: Store, repo: string, on: boolean, by: string, now: Date): void;
 export declare function setAskEveryReleaseCommit(store: Store, repo: string, ask: boolean, by: string, now: Date): void;
 /** The effective policy now: the runtime rules, the project's protected paths and the limits. */
 export declare function effectivePolicy(store: Store, repo: string, options?: {

package/dist/release-carry.js

@@ -32,6 +32,7 @@ import { CARRY_RULES_VERSION, readReleasePolicy, releasePolicyDigest } from "./c
 import { run } from "./exec.js";
 import { proxyEnv, startEgressProxy } from "./egress.js";
 import { liveReleaseOf } from "./scope.js";
+import { UNSANDBOXED_CARRY_ACTION, carriesUnsandboxed } from "./release-authority.js";
 import { carryReleaseApproval, releaseAuthority, releaseCarryTo, sealAnchorArtifact, } from "./store.js";
 // ------------------------------------------------------------------ the rules
 /** The journey scripts: tests, by Alex's decision (they carry). */
@@ -70,6 +71,12 @@ export function asksEveryReleaseCommit(store, repo) {
     const row = store.handle.prepare("SELECT outcome FROM action_ledger WHERE repo = ? AND action = ? ORDER BY id DESC LIMIT 1").get(repo, ASK_EVERY_COMMIT_ACTION);
     return row !== undefined && row["outcome"] === "ask";
 }
+/** Set "Carry release approvals when checks aren't sandboxed". `by` is who set it; turning it on is only ever called
+ * after a person's own proof (release-cli.ts). */
+export function setUnsandboxedCarry(store, repo, on, by, now) {
+    store.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null, action: UNSANDBOXED_CARRY_ACTION, outcome: on ? "on" : "off", source: "request",
+        detail: on ? "Carry release approvals when checks aren't sandboxed: later test-only commits run outside the sandbox without being shown first" : "Release approvals carry only when checks are sandboxed" });
+}
 export function setAskEveryReleaseCommit(store, repo, ask, by, now) {
     store.recordAction({ at: now.toISOString(), actor: by, repo, taskId: null, runId: null, action: ASK_EVERY_COMMIT_ACTION, outcome: ask ? "ask" : "carry", source: "request",
         detail: ask ? "Ask for every release commit" : "Later test-only commits ship under the release approval" });
@@ -80,6 +87,7 @@ export function effectivePolicy(store, repo, options = {}) {
     return {
         version: 1, rules: CARRY_RULES_VERSION, carry: options.noCarry !== true && !asksEveryReleaseCommit(store, repo),
         protectProject: rules.protectProject, protectedPaths: [...new Set(rules.protectedPaths)].sort(), limits: { ...CARRY_LIMITS },
+        unsandboxedCarry: carriesUnsandboxed(store, repo),
     };
 }
 /** The stricter of two policies: what either protects asks again, the lower limit wins, either one's "ask" asks. Null
@@ -91,6 +99,8 @@ export function stricterOf(a, b) {
         version: 1, rules: CARRY_RULES_VERSION, carry: a.carry && b.carry, protectProject: a.protectProject || b.protectProject,
         protectedPaths: [...new Set([...a.protectedPaths, ...b.protectedPaths])].sort(),
         limits: { lines: Math.min(a.limits.lines, b.limits.lines), files: Math.min(a.limits.files, b.limits.files), churn: Math.min(a.limits.churn, b.limits.churn) },
+        // Carrying when checks aren't sandboxed only while both allow it: turning it on later never widens an approval.
+        unsandboxedCarry: a.unsandboxedCarry === true && b.unsandboxedCarry === true,
     };
 }
 /**
@@ -141,12 +151,17 @@ export function releaseTermsFor(store, input) {
     const grant = store.liveVerifyCommand(input.repo);
     if (grant === null)
         return { ok: false, why: "the project has no approved release check" };
-    if (store.projectCheckAccess(input.repo) !== "sandboxed")
-        return { ok: false, why: "the project's checks run outside the sandbox, so later commits always ask again" };
+    const access = store.projectCheckAccess(input.repo);
+    const policy = effectivePolicy(store, input.repo, { noCarry: input.noCarry ?? false });
+    // Checks outside the sandbox carry only with the project's "Carry release approvals when checks aren't sandboxed" on,
+    // sealed here: turning it on after this approval never carries for it.
+    if (access !== "sandboxed" && policy.unsandboxedCarry !== true) {
+        return { ok: false, why: "the project's checks run outside the sandbox, so later commits always ask again (unless “Carry release approvals when checks aren't sandboxed” is on)" };
+    }
     return { ok: true, terms: {
             version: 1, repo: input.repo, packageVersion: input.version, branch: input.branch, pr: input.pr, base: "main",
-            approvedSha: input.candidate, approvedTree: commit.value.tree, policy: effectivePolicy(store, input.repo, { noCarry: input.noCarry ?? false }),
-            grant: { id: grant.id, digest: grant.digest }, access: "sandboxed",
+            approvedSha: input.candidate, approvedTree: commit.value.tree, policy,
+            grant: { id: grant.id, digest: grant.digest }, access,
             expiresAt: new Date(input.now.getTime() + 3 * 24 * 60 * 60_000).toISOString(),
         } };
 }
@@ -170,6 +185,10 @@ export function preflightCarry(store, input) {
         return refuse("authority", "This Toolroll doesn't know the release's carry rules; update Toolroll first.");
     if (!policy.carry)
         return refuse("rules", "This project asks for every release commit.");
+    // Checks outside the sandbox (at the approval or now): only when the sealed setting and the current one both allow it.
+    if ((a.accessDigest !== "sandboxed" || store.projectCheckAccess(a.repo) !== "sandboxed") && policy.unsandboxedCarry !== true) {
+        return refuse("rules", "This project's checks run outside the sandbox, and carrying release approvals then wasn't on when this release was approved, or is off now.");
+    }
     if (!/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(input.to))
         return refuse("ancestry", `${input.to} isn't a full commit id.`);
     if (input.to === a.tipSha)