toolroll 0.9.75 → 0.9.76

package/dist/repository-context.js

@@ -1,10 +1,8 @@
 /** Optional repository context. Callers admit project access; this module grants no authority.
  * The index is disposable. Every read hashes the current bounded tracked source set;
  * a missing/changed/unreadable index falls back to ordinary text search, never a task gate. */
-import { inReadOnlyRequest } from './read-only-request.js';
 import { checkoutGitSync } from './teardown-git.js';
 import { createHash, randomUUID } from 'node:crypto';
-import { execFileSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { scanForSecrets } from './evidence.js';
@@ -14,10 +12,10 @@ const CODE = /\.(?:[cm]?[jt]sx?)$/i;
 const TEXT = /\.(?:[cm]?[jt]sx?|md|txt|css|html|json)$/i;
 const MAX_NODES = 16_000, MAX_EDGES = 12_000;
 const sha = (value) => createHash('sha256').update(value).digest('hex');
-// Read-only and bounded: no index refresh, no hooks, no fsmonitor program.
-// On a page read (Settings -> Knowledge's search), the hardened checkout git: no filter, hook, program or network.
-const git = (repo, args) => inReadOnlyRequest() ? checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000 }).trimEnd()
-    : execFileSync('git', ['--no-optional-locks', '-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-C', repo, ...args], { encoding: 'utf8', maxBuffer: 2_000_000, timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'] }).trimEnd();
+// Read-only and bounded, and always the hardened checkout git (a crew worktree is agent-written, and a page read or a
+// lead's refresh reads it alike): no filter, hook, program or network, its config and info frozen in a view of the
+// plane's own before they're inspected (teardown-git.ts checkoutGitSync).
+const git = (repo, args) => checkoutGitSync(repo, args, { timeoutMs: 10_000, maxBuffer: 2_000_000 }).trimEnd();
 const inside = (root, path) => { const r = relative(root, path); return r !== '..' && !r.startsWith('..' + sep) && !isAbsolute(r); };
 function capture(request) {
     const repo = realpathSync(request.repo);

package/dist/result-follow-ups.js

@@ -4,6 +4,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { belongsToRelease } from "./release-authority.js";
 import { run as execRun } from "./exec.js";
+import { hardenedGit } from "./teardown-git.js";
 import { approvedCommandShell, SETUP_ENV_ALLOWLIST, SETUP_ENV_DENYLIST } from "./builder.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { boundStreamHeadTail, readVerifiedArtifact, redactSecretLines, scanForSecrets, storeEvidence } from "./evidence.js";
@@ -161,7 +162,8 @@ export function waitingRequestsOfAnyKind(store, now) {
 export async function runFollowUpCheck(store, root, request, deps = {}) {
     const now = deps.now ?? (() => new Date());
     const runner = deps.runner ?? execRun;
-    const git = deps.git ?? execRun;
+    // The project's repository and a checkout of a build's commit, both agent-writable: the hardened git (teardown-git.ts).
+    const git = deps.git ?? hardenedGit(execRun);
     const asked = store.handle.prepare("SELECT run_id FROM action_ledger WHERE id = ? AND action = ?").get(request, CHECKS_REQUESTED);
     if (asked === undefined)
         return null;

package/dist/scope.d.ts

@@ -418,7 +418,10 @@ export type ScopeAuthor = "mate" | "coordinator" | "scout" | "lead";
 /** The authorities a seal can stand on (approval-policy plan §1.5). Anything else stands on nothing. */
 /** `carried`: a later commit of a release carried under a person's release approval (release-once.md); only the carry
  * transaction ever writes it. */
-export type ApprovalBasis = "password" | "mode" | "chat" | "grant" | "schedule" | "lead" | "carried";
+/** `auto-check` / `auto-green`: a release task the plane approved itself under the project's "Approve automatically when
+ * checks pass" (docs/plans/auto-approve-green.md) — `auto-check` lets its check run, `auto-green` is the release
+ * approval once CI and that check passed. Only release-auto.ts writes them; neither is ever a person's. */
+export type ApprovalBasis = "password" | "mode" | "chat" | "grant" | "schedule" | "lead" | "carried" | "auto-check" | "auto-green";
 export declare const APPROVAL_BASES: readonly ApprovalBasis[];
 export type Approval = {
     approved: true;
@@ -865,7 +868,7 @@ export declare function releaseTermsSentence(terms: ReleaseTerms): string;
 export declare function releaseAsksAgainWords(terms: ReleaseTerms): string[];
 export { personProof } from "./person-proof.js";
 import { type ReleaseTerms } from "./contracts/release-terms.js";
-import { type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
+import { type AutoEvidence, type ReleaseAuthority, type ReleaseCarry } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export declare const machineActing: () => boolean;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -952,3 +955,29 @@ export declare function mainDebtProblem(store: Store, repo: string, taskId: stri
  * chat it is approved only through the release card.
  */
 export declare function deployGateScope(scope: Pick<Scope, "candidate" | "releaseTerms">): boolean;
+/**
+ * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
+ * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
+ * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
+ * and the person who turned it on still an approver there. Never a person's approval.
+ */
+export declare function autoReleaseApprovalOf(store: Store, taskId: string, kind: "auto-check" | "auto-green"): {
+    ok: true;
+    by: string;
+    at: string;
+    evidence: AutoEvidence;
+} | {
+    ok: false;
+    why: string;
+};
+/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
+ * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
+export declare function releaseApprovalOf(store: Store, taskId: string, _now?: Date): {
+    ok: true;
+    by: string;
+    at: string;
+    method: string;
+} | {
+    ok: false;
+    why: string;
+};

package/dist/scope.js

@@ -571,7 +571,7 @@ export function canonicalAcceptance(criteria) {
         .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0))
         .map(c => ({ id: c.id, statement: c.statement.trim(), evidence: [...c.evidence].sort() }));
 }
-export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried"];
+export const APPROVAL_BASES = ["password", "mode", "chat", "grant", "schedule", "lead", "carried", "auto-check", "auto-green"];
 /**
  * The exact bytes an operator agreed to.
  *
@@ -1359,7 +1359,7 @@ function describeApproval(approval) {
 export { personProof } from "./person-proof.js";
 import { personProof } from "./person-proof.js";
 import { releaseTermsDigest } from "./contracts/release-terms.js";
-import { CHECK_ACCESS_WIDTH, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseSealProblem } from "./release-authority.js";
+import { CHECK_ACCESS_WIDTH, autoEvidenceOf, carriesUnsandboxed, newestReleaseGeneration, releaseAuthorityOfTask, releaseAutoApproves, releaseSealProblem } from "./release-authority.js";
 /** Whether the command running now is a machine's: the lead (its token) or a remote API run. Trusted context only. */
 export const machineActing = () => currentActor()?.lead === true || activeRemote() !== null;
 /** A proof row's detail, either form: the legacy text (`<at> · generation <n> · digest <d>`) or the versioned record
@@ -1400,6 +1400,8 @@ export function personApprovalOf(store, taskId) {
     const basis = scope.approvalBasis ?? null;
     if (basis === "lead")
         return { ok: false, why: "approved by the lead, not by a person" };
+    if (basis === "auto-check" || basis === "auto-green")
+        return { ok: false, why: "approved automatically, not by a person" };
     if (basis !== "password" && basis !== "chat")
         return { ok: false, why: `approved by ${basis === null ? "an unknown road" : basis === "grant" ? "a flow" : basis}, not by a person` };
     const origin = sealOriginOf(store, taskId, scope.approvedBy, scope.approvedDigest, scope.approvedAt);
@@ -1474,7 +1476,8 @@ export function liveReleaseOf(store, taskId, action, now = new Date()) {
     if (a.tipTask !== taskId)
         return refuse("this is not the release's current commit");
     const anchor = store.getScope(a.anchorTask);
-    const person = personApprovalOf(store, a.anchorTask);
+    // A person's yes, or the plane's own automatic one while the project still approves releases automatically.
+    const person = releaseApprovalOf(store, a.anchorTask, now);
     if (!person.ok)
         return refuse(`the release approval no longer stands: ${person.why}`);
     if (anchor === null || anchor.approvedDigest !== a.anchorDigest || anchor.digest !== a.anchorDigest)
@@ -1539,3 +1542,41 @@ export function mainDebtProblem(store, repo, taskId) {
 export function deployGateScope(scope) {
     return (scope.candidate ?? null) !== null || (scope.releaseTerms ?? null) !== null;
 }
+/**
+ * The plane's own automatic approval of a release task (docs/plans/auto-approve-green.md), read the way the dispatch
+ * belts read it (release-authority.ts autoSealSql): sealed `kind` on the current digest, its evidence row naming exactly
+ * this task, kind, digest and candidate, a release task (candidate and terms signed in), the project's setting on now,
+ * and the person who turned it on still an approver there. Never a person's approval.
+ */
+export function autoReleaseApprovalOf(store, taskId, kind) {
+    const scope = store.getScope(taskId);
+    const ref = store.lookupRef(taskId);
+    if (scope === null || scope.approvedAt === null || scope.approvedBy === null || scope.approvedDigest === null)
+        return { ok: false, why: "not approved yet" };
+    if (scope.approvedDigest !== scope.digest)
+        return { ok: false, why: "the approval is for different scope text" };
+    if (scope.approvalBasis !== kind)
+        return { ok: false, why: kind === "auto-green" ? "not approved automatically" : "not checking automatically" };
+    if ((scope.candidate ?? null) === null || (scope.releaseTerms ?? null) === null || ref === null || ref.repo === null)
+        return { ok: false, why: "only a release task is approved automatically" };
+    const evidence = autoEvidenceOf(store, taskId, scope.modeDigest, kind);
+    if (evidence === null || evidence.digest !== scope.approvedDigest || evidence.candidate !== scope.candidate || evidence.by !== scope.approvedBy)
+        return { ok: false, why: "no record shows what approved it automatically" };
+    if (!releaseAutoApproves(store, ref.repo))
+        return { ok: false, why: "approving releases automatically was turned off" };
+    const account = store.accountOf(scope.approvedBy);
+    if (account === null || account.revokedAt !== null || account.role !== "approver" || !store.accountCanAccess(scope.approvedBy, ref.repo))
+        return { ok: false, why: `${scope.approvedBy}, who turned on automatic release approval, can no longer approve in this project` };
+    return { ok: true, by: scope.approvedBy, at: scope.approvedAt, evidence };
+}
+/** A release's approval: a person's (personApprovalOf, unchanged), or the plane's own `auto-green`. Only release
+ * readers ask this (liveReleaseOf, and the deploy gates inside `toolroll release`); everything else asks for a person. */
+export function releaseApprovalOf(store, taskId, _now = new Date()) {
+    const person = personApprovalOf(store, taskId);
+    if (person.ok)
+        return person;
+    if (store.getScope(taskId)?.approvalBasis !== "auto-green")
+        return person;
+    const auto = autoReleaseApprovalOf(store, taskId, "auto-green");
+    return auto.ok ? { ok: true, by: auto.by, at: auto.at, method: "auto-green" } : auto;
+}

package/dist/scout.js

@@ -18,6 +18,7 @@ import { mkdtempSync, realpathSync, rmSync, unlinkSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { dirname, join, relative, isAbsolute } from "node:path";
 import { run } from "./exec.js";
+import { checkoutGit } from "./teardown-git.js";
 import { auditOf } from "./provider.js";
 import { currentClaim, heartbeat } from "./claim.js";
 import { heartbeat as runnerHeartbeat } from "./runner.js";
@@ -225,7 +226,10 @@ export async function scout(store, request) {
     }
 }
 async function scoutWith(store, request, outputDir) {
-    const { taskId, taskRef, runner, worktree, branch, now, agent, git = run, timeoutMs = DEFAULT_SCOUT_TIMEOUT_MS, maxTurns = DEFAULT_SCOUT_TURNS, } = request;
+    const { taskId, taskRef, runner, worktree, branch, now, agent, git: givenGit = run, timeoutMs = DEFAULT_SCOUT_TIMEOUT_MS, maxTurns = DEFAULT_SCOUT_TURNS, } = request;
+    // The plane's git on the scout's checkout (agent-written, and its repository shared with every build) runs hardened, against
+    // a frozen view of the repository's config and info (teardown-git.ts checkoutGit); an injected runner is used as given.
+    const git = givenGit === run ? checkoutGit(run, "build", { repo: store.getWorktree(worktree)?.repo ?? null }) : givenGit;
     const claim = currentClaim(store, taskRef, now);
     if (claim === null || claim.runner !== runner || claim.leaseId !== request.leaseId) {
         return { ok: false, kind: "failure", reason: "not-yours", message: `${taskId} is not held under ${request.leaseId}` };

package/dist/server/render-tasks.d.ts

@@ -232,6 +232,11 @@ export declare function agentsStripHtml(view: RouteView | null, taskId: string):
 /** A ceremony nonce as stored: the sha256 hex of the value the form carried. */
 export declare function nonceHashOf(value: string): string;
 /** The approve POST's refusal, in words a person can act on. */
+/** A release task's automatic approval, in words (docs/plans/auto-approve-green.md). */
+export declare function autoReleaseWords(auto: {
+    kind: "checking" | "approved";
+    candidate: string;
+}): string;
 /** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
 export declare function approvalProofWords(proof: {
     method: string;
@@ -523,6 +528,11 @@ export declare function taskBodyParts(data: {
         method: string;
         at: string;
     } | null;
+    /** A release task the plane approved (or is checking) itself (docs/plans/auto-approve-green.md): its candidate. */
+    autoRelease?: {
+        kind: "checking" | "approved";
+        candidate: string;
+    } | null;
     /** One approval per release (release-once.md): the release this task belongs to, and whether this reader may stop it. */
     release?: ReleaseView | null;
     canStopRelease?: boolean;

package/dist/server/render-tasks.js

@@ -746,6 +746,11 @@ export function nonceHashOf(value) {
     return createHash("sha256").update(value).digest("hex");
 }
 /** The approve POST's refusal, in words a person can act on. */
+/** A release task's automatic approval, in words (docs/plans/auto-approve-green.md). */
+export function autoReleaseWords(auto) {
+    return auto.kind === "approved" ? `Approved automatically: CI and release check passed on ${auto.candidate.slice(0, 7)}`
+        : `Checking automatically: approves itself once CI and the release check pass on ${auto.candidate.slice(0, 7)}`;
+}
 /** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
 export function approvalProofWords(proof) {
     if (proof == null)
@@ -1497,11 +1502,13 @@ export function taskBodyParts(data) {
             html `<p><strong>Quality</strong> ${qualityModeTitle(scope.qualityMode ?? "default")}</p>`,
             acceptanceCeremonyHtml(scope.acceptance),
             scope.releaseTerms == null ? "" : html `<p><strong>Release</strong></p><p class="recap">${releaseTermsSentence(scope.releaseTerms)}</p>${scope.releaseTerms.policy.carry ? html `<details><summary>What asks again</summary><ul>${joinHtml(releaseAsksAgainWords(scope.releaseTerms).map(line => html `<li>${line}</li>`), "")}</ul></details>` : ""}`,
-            approval.approved && data.release?.kind === "carried"
-                ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
-                : approval.approved
-                    ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
-                    : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
+            approval.approved && data.autoRelease != null
+                ? html `<p class="meta scope-seal">${autoReleaseWords(data.autoRelease)} · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                : approval.approved && data.release?.kind === "carried"
+                    ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                    : approval.approved
+                        ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
+                        : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
             html `</div>`,
         ], "\n");
     // The scout's report (mate arc §10): title, summary, the document inert,
@@ -1792,11 +1799,13 @@ export function taskBodyParts(data) {
         : "";
     const scopeRow = scope === null
         ? prop("scope", "none yet")
-        : approval.approved && data.release?.kind === "carried"
-            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
-            : approval.approved
-                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
-                : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
+        : approval.approved && data.autoRelease != null
+            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${autoReleaseWords(data.autoRelease)}`)
+            : approval.approved && data.release?.kind === "carried"
+                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
+                : approval.approved
+                    ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
+                    : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
     const strikesRow = data.strikes > 0 ? prop("strikes", `${data.strikes} failed attempt(s)`) : "";
     const propsCard = html `<div class="card props">${workerRow}${queueRow}${scopeRow}${publishesRow}${economics}${strikesRow}</div>`;
     // The same facts for the rebuilt page, row for row.
@@ -1811,9 +1820,10 @@ export function taskBodyParts(data) {
         facts.push({ label: "Queue", parts: [`${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : ` in ${data.position.column}'s queue`} · `, { label: "Reorder", href: "/board?view=order" }] });
     }
     facts.push(scope === null ? { label: "Scope", parts: ["none yet"] }
-        : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
-            : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
-                : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
+        : approval.approved && data.autoRelease != null ? { label: "Approved scope", parts: [autoReleaseWords(data.autoRelease)] }
+            : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
+                : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
+                    : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
     if (data.release?.kind === "anchor")
         facts.push({ label: "Release", parts: [`Approved for release ${data.release.version}`, ...(data.release.landed.length === 0 ? [] : [` · later commits: ${data.release.landed.map(one => one.sha.slice(0, 7)).join(", ")}`]), ...(data.release.carrying ? [] : [` · later commits ask again`])] });
     facts.push({ label: "Publishes as", parts: [publishesAs] });

package/dist/server/route-table.js

@@ -303,6 +303,9 @@ post("tasks", "sweep.cancel-rest", "^\\/sweeps\\/[1-9][0-9]{0,9}\\/cancel-rest$"
 // (the handler proves it as a credential act); turning it off is one click, so the row itself is not a step-up.
 get("settings", "settings.passwordless", "/settings/passwordless", { ...free, ...operator("An instance operator sets Passwordless.", "/settings") });
 post("settings", "settings.passwordless-send", "/settings/passwordless", { callers: ["cookie"], ...operator("An instance operator sets Passwordless.", "/settings") });
+// Release approval (docs/plans/auto-approve-green.md): an approver of the project, from a browser. Approving releases
+// automatically takes a typed password (the handler proves it as a credential act); asking again is one click.
+post("settings", "settings.release-approval-send", "/settings/release-approval", { callers: ["cookie"], ...approver("An approver sets how releases are approved.", "/settings/approval") });
 post("pages", "ledger.checkpoint", "/ledger/checkpoint", operator("An instance operator makes ledger checkpoints.", "/ledger"));
 const SETTINGS_ACT_ROLES = {
     policy: operator("An instance operator sets the policy.", "/settings/policy"),

package/dist/server/settings.js

@@ -39,7 +39,8 @@ import { browserCaller } from "./session.js";
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
 import { resolvePhaseAgent } from "../agentconfig.js";
 import { parseProtectedPaths } from "../approval-policy.js";
-import { approvalRulesHtml } from "../approval-rules-ui.js";
+import { approvalRulesHtml, releaseApprovalHtml } from "../approval-rules-ui.js";
+import { releaseApprovalSetting, setReleaseApproval } from "../release-auto.js";
 import { backupHtml } from "../backup-ui.js";
 import { BACKUP_EVERY_HOURS, backupFolderOf, backupNow, checkBackupFolder, defaultBackupFolder, MAX_KEEP } from "../backup.js";
 import { projectBatchChecks, setProjectBatchChecks } from '../batch-policy.js';
@@ -366,7 +367,8 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
         const selector = projects.length > 1 ? html `<form class="approval-project" method="get" action="/settings/approval"><label>Project<select name="repo">${projects.map(p => html `<option value="${p}"${p === chosen ? " selected" : ""}>${projectName(p)}</option>`)}</select></label><button>Show</button></form>` : "";
         const approvers = chosen === "" ? 0 : store.listApprovers().filter(one => { const account = store.accountOf(one.name); return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(one.name, chosen); }).length;
-        const content = chosen === "" ? html `<p>Add a project to set its approval rules.</p>` : (approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
+        const release = chosen === "" ? null : releaseApprovalSetting(store, chosen);
+        const content = chosen === "" ? html `<p>Add a project to set its approval rules.</p>` : html `${approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}${releaseApprovalHtml({ repo: chosen, auto: release.auto, setBy: release.setBy, at: release.at, canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, chosen) })}`;
         return sendScreen(response, 200, screen("Approval rules", html `<p><a href="/settings">Settings</a></p><h1>Approval rules</h1>${selector}${content}`, { chrome: chromeFor(chosen || project, "settings") }));
     }
     // Sprint 8: Settings → Policy, the organisation policy and its history. Anyone signed in reads it; an instance operator changes it.
@@ -2538,6 +2540,7 @@ ${modeWords(terms)
         "settings.sign-in": signInPage,
         "settings.passwordless": passwordlessPage,
         "settings.passwordless-send": passwordlessSave,
+        "settings.release-approval-send": releaseApprovalSave,
         "settings.lead": leadPage,
         "settings.teams": teamsPage,
         "settings.discord": discordPage,
@@ -2725,5 +2728,29 @@ ${modeWords(terms)
             return back("problem", "An approver for this project changes its sandbox. Nothing changed.");
         return back("said", JSON.stringify(changed.before) === JSON.stringify(changed.after) ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
+    // Release approval (docs/plans/auto-approve-green.md): an approver of the project. Approving automatically is a
+    // credential act (a password typed now, never a session); asking again is one click and takes back automatic seals.
+    async function releaseApprovalSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.releaseApproval);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
+        const back = sayTo(response, `/settings/approval?repo=${encodeURIComponent(repo)}`);
+        if (who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return back("problem", "An approver of this project sets how its releases are approved.");
+        const action = body.get("action");
+        if (action === "ask") {
+            const changed = setReleaseApproval(store, repo, false, who.name, now);
+            return back("said", !changed.changed ? "Saved." : `Releases ask you again.${changed.withdrawn.length === 0 ? "" : ` ${changed.withdrawn.length} automatic approval${changed.withdrawn.length === 1 ? " was" : "s were"} taken back.`}`);
+        }
+        if (action !== "auto")
+            return back("problem", "Choose Ask me or Approve automatically when checks pass.");
+        if (!authenticateCredential(who, body.get("password") ?? "", repo).ok)
+            return back("problem", "Enter your Toolroll password to approve releases automatically.");
+        const changed = setReleaseApproval(store, repo, true, who.name, now);
+        return back("said", changed.changed ? "Releases approve themselves once CI and the release check pass." : "Saved.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/task-views.js

@@ -496,6 +496,7 @@ export function createTaskViews(runtime) {
             steeringRun: ref === null ? null : runtime.store.steeringLiveBuild(ref.id, now),
             release: ref === null ? null : releaseViewOf(runtime.store, ref.externalId, now, authority => releaseObligationsOf(runtime.store, runtime.evidenceRoot, authority)),
             canStopRelease: who.role === "approver" && who.via === "cookie",
+            autoRelease: ref === null ? null : autoReleaseOf(runtime.store.getScope(ref.externalId)),
             approvalProof: (() => {
                 // The proof of the approval shown: its approver, its exact sealed digest (approvedDigest === digest when approved).
                 const scope = ref === null ? null : runtime.store.getScope(ref.externalId);
@@ -1139,3 +1140,10 @@ export function createTaskViews(runtime) {
     }
     return { guided, projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, earlierLiveVersions, familyHistory, freshAssignment, workRowOf, taskListPane, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, taskPullRequestOf, failureOf, explainAttempt, runChecksHere, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, progressOf, resultDetailOf };
 }
+/** A release task the plane approved (or is checking) itself, for the task page (docs/plans/auto-approve-green.md). */
+function autoReleaseOf(scope) {
+    if (scope === null || scope.approvedDigest !== scope.digest || (scope.candidate ?? null) === null)
+        return null;
+    return scope.approvalBasis === "auto-green" ? { kind: "approved", candidate: scope.candidate }
+        : scope.approvalBasis === "auto-check" ? { kind: "checking", candidate: scope.candidate } : null;
+}

package/dist/store.d.ts

@@ -2355,7 +2355,7 @@ export declare class Store {
      * exactly what the signed digest was bound to. Returns false when the
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
-        kind: "mode" | "chat" | "grant" | "schedule";
+        kind: "mode" | "chat" | "grant" | "schedule" | "auto-check" | "auto-green";
         modeDigest: string;
         /** A chat seal of a deploy gate: the release card it came from (chat-management.md §0a.5). */
         card?: "release";

package/dist/store.js

@@ -7014,7 +7014,17 @@ export class Store {
             const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null;
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
-            if (terms.terms !== null && basis !== undefined && basis.kind !== "chat")
+            // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
+            // in), only naming the evidence row the plane wrote for exactly this task, kind, digest and candidate.
+            const automatic = basis?.kind === "auto-check" || basis?.kind === "auto-green";
+            if (automatic) {
+                if (terms.terms === null || typeof working["candidate"] !== "string" || working["candidate"] === "")
+                    return false;
+                const evidence = autoEvidenceOf(this, taskId, basis.modeDigest, basis.kind);
+                if (evidence === null || evidence.digest !== String(working["digest"]) || evidence.candidate !== working["candidate"] || evidence.by !== by)
+                    return false;
+            }
+            if (terms.terms !== null && basis !== undefined && basis.kind !== "chat" && !automatic)
                 return false;
             if (terms.terms !== null && releaseSealProblem(this, terms.terms) !== null)
                 return false;
@@ -7033,7 +7043,8 @@ export class Store {
                     approved_route_json = proposed_route_json
               WHERE task_id = ?`)
                 .run(now.toISOString(), by, basis === undefined ? "password" : basis.kind, basis === undefined ? null : basis.modeDigest, taskId);
-            if (changed.changes > 0 && terms.ok && terms.terms !== null) {
+            // `auto-check` only lets the check run: it opens no release authority (only `auto-green` and a person's yes do).
+            if (changed.changes > 0 && terms.ok && terms.terms !== null && basis?.kind !== "auto-check") {
                 if (openReleaseAuthority(this, { taskId, digest: String(working["digest"]), terms: terms.terms, by, now }) === null)
                     throw new ReleaseSealRefused();
             }
@@ -7066,7 +7077,11 @@ export class Store {
                                         ? "Approved automatically: its flow runs on its own. A connected worker can take it next."
                                         : basis.kind === "schedule"
                                             ? "Approved by its standing order. A connected worker can take it next."
-                                            : "Approved automatically under the operating mode. A connected worker can take it next.",
+                                            : basis.kind === "auto-check"
+                                                ? "Checking automatically: it approves itself once CI and the release check pass."
+                                                : basis.kind === "auto-green"
+                                                    ? "Approved automatically: CI and the release check passed."
+                                                    : "Approved automatically under the operating mode. A connected worker can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
                     }
@@ -20422,7 +20437,7 @@ export function serializeReleaseTerms(terms) {
 }
 // ---- one approval per release: the authority record (release-once.md, part 1) --------------------------------------
 export { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseAuthorityOfTask, releaseCarries, releaseCarryTo, releaseOperation, releaseOperations, releaseSealProblem, } from "./release-authority.js";
-import { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
+import { LIVE_RELEASE_STATES, autoEvidenceOf, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
 /**
  * Open a release's authority for a person's seal of its terms (inside the seal's transaction): the next generation,
  * superseding the live one. False when it can't (releaseSealProblem), which refuses the seal.

package/dist/task-base.js

@@ -7,7 +7,7 @@
 import { execFileSync } from "node:child_process";
 export const readGit = (cwd, args) => {
     try {
-        return execFileSync("git", ["--no-optional-locks", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
+        return execFileSync("git", ["--no-optional-locks", "--no-lazy-fetch", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
     }
     catch {
         return null;

package/dist/teardown-git.d.ts

@@ -6,14 +6,24 @@ export declare const TEARDOWN_FLAGS: readonly string[];
 /** Exit code of a refused command (git's own fatal code, so no caller reads it as "not found" or "no"). */
 export declare const REFUSED_CODE = 128;
 /** The command-running setting a `git config --list --show-scope -z` listing sets, or null. Only local and worktree
- * scope count: teardown commands never read system or global config. */
-export declare function commandSetting(listing: string): string | null;
+ * scope count: teardown commands never read system or global config. `lfsChecked`: the caller refuses a checkout whose
+ * `.lfsconfig` names a git-lfs extension (lfsExtensionIn), so git-lfs's own exact filters may stand (runsCommand).
+ * Fails closed: a listing that can't be classified names a setting. */
+export declare function commandSetting(listing: string, options?: {
+    lfsChecked?: boolean;
+}): string | null;
 /** The `-c` settings that carry the operator's own values (CARRIED_VALUES, LFS_FILTER) from a global/system listing. */
 export declare function carriedSettings(listing: string): string[];
 /** Why a teardown command was refused, or null when `result` isn't a refusal. */
 export declare function refusal(result: ExecResult): string | null;
-/** The one way teardown runs git, including the target checkout immediately before removal. */
-export declare function teardownGit(runner?: Runner): Git;
+/** The one way teardown runs git, including the target checkout immediately before removal. Every command runs
+ * against a write view of its repository (gitView), whose config is the one inspected and whose info is a copy, so a
+ * setting or attributes file an agent adds after the inspection is never read (a build's process can outlive its turn:
+ * on macOS containment is observational, src/containment.ts, and a sibling build shares the repository). A removal's
+ * target is bound to the same repository as the folder it is removed from. A removal without --force runs under the
+ * target's own view (its own config.worktree folded in), so git's last check of whether it is clean reads it as the
+ * target itself would. `binding.repo`: the project's main checkout, from the plane's records, when the caller has it. */
+export declare function teardownGit(runner?: Runner, binding?: GitBinding): Git;
 /**
  * Git on a build's checkout, as the plane runs it outside every fence (staging, committing and inspecting the build's
  * work): the same fixed hardening as teardown (no hooks, fsmonitor, ext transport, credential helpers or automatic
@@ -29,14 +39,24 @@ export declare function teardownGit(runner?: Runner): Git;
  * that can't be read so counts as including.
  */
 export declare function checkoutIncludes(checkout: string): boolean;
+export type GitBinding = {
+    repo?: string | null;
+};
+/** Settings fixed on every write through a view: `worktree add` records absolute paths (relative ones would need a
+ * config write, which a view keeps); no transport at all (a caller that fetches allows its one protocol by name, as the
+ * nightly check's local fetch does with protocol.file.allow); and no split index (its shared index files would be
+ * written in the plane's GIT_DIR). */
+export declare const WRITE_VIEW_FLAGS: readonly string[];
 /** Whether the checkout's .lfsconfig (read as git parses it, that file only) sets any git-lfs key that could name a
  * program (anything but INERT_LFS). A file that
  * isn't a plain one, or doesn't parse, counts as naming one. */
 export declare function lfsExtensionIn(checkout: string): boolean;
-/** `mode` "read" is for reading a checkout an agent may still be writing (the code page): every command also takes
- * readFlags() and runs against the checkout's readView, so neither its config nor its info/attributes can change
- * between the inspection and the run. */
-export declare function checkoutGit(inner?: Runner, mode?: "build" | "read"): Runner;
+/** Every command runs against a view of the checkout's repository (gitView) whose config and info are copies the
+ * plane made, inspected there, so neither can change between the inspection and the run. `mode` "read" is for reading
+ * a checkout an agent may still be writing (the code page): every command also takes readFlags(), and the view holds
+ * no info/attributes. "build" is the plane's staging and committing of a build's work, which writes the repository
+ * through the view (gitView). */
+export declare function checkoutGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;
 /**
  * Flags for reading a checkout an agent writes while a page waits (docs/plans/get-side-effects.md). Command-line
  * settings win over anything the checkout's config says, even one changed after it was inspected: no fsmonitor, hooks,
@@ -47,16 +67,24 @@ export declare const PAGE_READ_FLAGS: readonly string[];
 /** The read flags, for every read of an agent-written checkout, whatever the HTTP method (security review of
  * 01bf3114): the worktree's attributes come from the empty tree. Git still reads the repository's info/attributes and
  * its config as it starts, so the flags alone don't stop a filter planted in both after the inspection: every read
- * also runs against the checkout's readView (checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
+ * also runs against a view of the checkout's repository (gitView; checkoutGitSync, checkoutGit "read"), whose config and info are the plane's. The cost is cosmetic: a checkout's line-ending or encoding rules are not applied, so
  * a file they would normalize can read as changed (fail closed: shipping then asks for a clean commit). */
 export declare function readFlags(): readonly string[];
 /**
  * checkoutGit, synchronously, for reads a page shows from a checkout an agent writes (docs/plans/get-side-effects.md):
  * the same refusals (an include, an .lfsconfig extension, a config key that can run a command), no system or global
- * config, the operator's own values carried, PAGE_READ_FLAGS and the checkout's readView (which hold even if its config
+ * config, the operator's own values carried, PAGE_READ_FLAGS and a view of the checkout's repository (gitView: they hold even if its config
  * or info/attributes change after they were read), submodules skipped, bounded. A refusal throws.
  */
 export declare function checkoutGitSync(cwd: string, args: readonly string[], options?: {
     timeoutMs?: number;
     maxBuffer?: number;
+    binding?: GitBinding;
 }): string;
+/**
+ * checkoutGit ("build": the repository written through its view) for callers that name the repository with a leading
+ * `git -C <dir>` instead of a cwd: worktree add and remove in a project's repository, a merge in a checkout of it.
+ * The project's repository is shared with every build, which can write its config, info and hooks; nothing here runs
+ * what they name. Anything but git goes to `inner` as given.
+ */
+export declare function hardenedGit(inner?: Runner, mode?: "build" | "read", binding?: GitBinding): Runner;