toolroll 0.9.75 → 0.9.77

package/dist/release-card.js

@@ -25,6 +25,7 @@ import { verifiedRange } from "./commit-extract.js";
 import { releaseTermsSchema } from "./contracts/release-terms.js";
 import { routeFromJson } from "./phase-routing.js";
 import { projectName } from "./project.js";
+import { RELEASE_CI_RUNNING_WORDS, releaseCiRunningOf } from "./release-ci-hold.js";
 import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
 const NONE = "none";
 /** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
@@ -152,13 +153,21 @@ export function approvalTermsOf(store, scope, words) {
 export const termsText = (lines) => lines.map(line => `${line.label}: ${line.value}`).join("\n");
 const SHA = /^[0-9a-f]{40}$/;
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
-/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
- * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
-export function releaseBaseline(store, repo) {
-    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a JOIN release_operation o ON o.authority = a.id
-    WHERE a.repo = ? AND a.state = 'merged' AND o.kind = 'merge' AND o.state = 'succeeded' AND o.external_ref IS NOT NULL ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
-    const ref = row === undefined ? null : String(row["external_ref"]);
-    return ref !== null && SHA.test(ref) ? ref : null;
+/**
+ * The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag.
+ * Whether the plane recorded one, and its merge commit (eval-harness review 2, finding 4):
+ * `recorded: false` only when no merged release is on the record at all; a recorded one whose commit isn't a full id is
+ * `recorded: true` with `sha: null` — something to refuse on, never "no previous release".
+ */
+export function releaseBaselineRecord(store, repo) {
+    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a LEFT JOIN release_operation o
+    ON o.authority = a.id AND o.kind = 'merge' AND o.state = 'succeeded'
+    WHERE a.repo = ? AND a.state = 'merged' ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
+    if (row === undefined)
+        return { recorded: false };
+    const ref = row["external_ref"];
+    return { recorded: true, sha: typeof ref === "string" && SHA.test(ref) ? ref : null };
 }
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
@@ -198,7 +207,12 @@ function pullRequestCommits(slug, pr) {
 }
 /** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
 export function releaseChangeList(store, terms) {
-    const baseline = releaseBaseline(store, terms.repo);
+    const record = releaseBaselineRecord(store, terms.repo);
+    // A release recorded with a merge commit that can't be read: the list couldn't be read (eval-harness review 2,
+    // finding 4) — never the pull request's commits, as if there were no previous release.
+    if (record.recorded && record.sha === null)
+        return { baseline: null, commits: null, source: "unread", baselineUnreadable: true, digest: sha256(`release-changes:${JSON.stringify({ baseline: null, source: "unread", commits: null, recorded: true })}`) };
+    const baseline = record.recorded ? record.sha : null;
     let commits;
     let source;
     if (baseline !== null) {
@@ -221,7 +235,7 @@ function changeWords(changes, terms, cap) {
     const head = changes.baseline === null ? `No earlier verified release is recorded. ${changes.source === "pull-request" ? `Pull request #${terms?.pr ?? "?"}'s commits:` : ""}`.trim()
         : `Changes since the last verified release (${changes.baseline.slice(0, 7)}):`;
     if (changes.commits === null)
-        return [head, changes.baseline === null ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
+        return [head, changes.baseline === null && changes.baselineUnreadable !== true ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
     if (changes.commits.length === 0)
         return [head, "No commits."];
     return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
@@ -242,6 +256,8 @@ export function releaseCardOf(store, scope, formDigest, words) {
         terms === null ? `Checks: ${value("checks")} · check access: ${value("checkAccess")}` : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
         // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
         ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
+        // Filed while CI runs (Alex, 2026-10-29): a person may approve now, and is told plainly what still waits.
+        ...(releaseCiRunningOf(store, scope.taskId) === null ? [] : [RELEASE_CI_RUNNING_WORDS]),
         "",
         ...changeWords(changes, terms, 5),
         "",

package/dist/release-ci-hold.d.ts

@@ -0,0 +1,41 @@
+/** A release's approval held for its pull request's CI (Codex review round 1, finding 4). A leaf module: the seal
+ * primitive (store.ts), the person's ceremony (scope.ts), chat and release-auto.ts all read the same row. */
+import type { Store } from "./store.js";
+/**
+ * A release filed while its pull request's CI was still running (pipeline-speed.md D2) waits for CI before anyone but
+ * the automatic road may approve it (Codex review round 1, finding 4): `release-auto.ts holdApprovalForCi` records the
+ * hold before the task is filed, and only the plane's own reading of exact-head CI passing lifts it
+ * (`liftCiHold`). The newest row for the task wins; the hold names the candidate commit it waits on.
+ * Since Alex's decision of 2026-10-29 (a person may approve during CI) the coordinator records a "CI still running"
+ * note instead (below); a hold an older coordinator placed still holds until lifted.
+ */
+export declare const RELEASE_CI_HELD_ACTION = "release approval waits for CI";
+export declare const RELEASE_CI_PASSED_ACTION = "release approval CI passed";
+/** The candidate whose CI a release task's approval waits for, or null when nothing holds it. Fail closed: a hold row
+ * whose candidate can't be read still holds. */
+export declare function releaseCiHoldOf(store: Store, taskId: string): {
+    candidate: string | null;
+} | null;
+/** Why a person can't approve a release waiting for CI yet, in words. */
+export declare function releaseCiHoldWords(hold: {
+    candidate: string | null;
+}): string;
+/**
+ * A person's release asks for approval while its pull request's CI still runs (Alex, 2026-10-29; pipeline-speed.md,
+ * "Decision: a person's release asks during CI"). This row never holds approval: it lets the approval card say so, until
+ * the plane reads exact-head CI passing (`liftCiHold` records RELEASE_CI_PASSED_ACTION, which ends it as it ends a
+ * hold). Deployment gates and operation issuance also refuse while it remains, so a direct deploy cannot bypass
+ * the coordinator's CI wait. Its absence is not a CI pass: the coordinator still reads exact-head checks itself.
+ */
+export declare const RELEASE_CI_RUNNING_ACTION = "release asked while CI runs";
+export declare const RELEASE_CI_RUNNING_WORDS = "GitHub's checks are still running; nothing deploys until they pass.";
+/** The candidate whose CI was still running when the release task was filed, or null once the plane read it passing. */
+export declare function releaseCiRunningOf(store: Store, taskId: string): {
+    candidate: string | null;
+} | null;
+/** Record that the release task is filed while CI runs on `candidate` (before the task exists). Idempotent. */
+export declare function noteCiRunning(store: Store, input: {
+    taskId: string;
+    candidate: string;
+    now: Date;
+}): void;

package/dist/release-ci-hold.js

@@ -0,0 +1,53 @@
+/**
+ * A release filed while its pull request's CI was still running (pipeline-speed.md D2) waits for CI before anyone but
+ * the automatic road may approve it (Codex review round 1, finding 4): `release-auto.ts holdApprovalForCi` records the
+ * hold before the task is filed, and only the plane's own reading of exact-head CI passing lifts it
+ * (`liftCiHold`). The newest row for the task wins; the hold names the candidate commit it waits on.
+ * Since Alex's decision of 2026-10-29 (a person may approve during CI) the coordinator records a "CI still running"
+ * note instead (below); a hold an older coordinator placed still holds until lifted.
+ */
+export const RELEASE_CI_HELD_ACTION = "release approval waits for CI";
+export const RELEASE_CI_PASSED_ACTION = "release approval CI passed";
+/** The candidate whose CI a release task's approval waits for, or null when nothing holds it. Fail closed: a hold row
+ * whose candidate can't be read still holds. */
+export function releaseCiHoldOf(store, taskId) {
+    const row = store.handle.prepare("SELECT action, detail FROM action_ledger WHERE task_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(taskId, RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION);
+    if (row === undefined || row["action"] !== RELEASE_CI_HELD_ACTION)
+        return null;
+    const detail = typeof row["detail"] === "string" ? row["detail"] : "";
+    return { candidate: /^[0-9a-f]{40}$/.test(detail) ? detail : null };
+}
+/** Why a person can't approve a release waiting for CI yet, in words. */
+export function releaseCiHoldWords(hold) {
+    const commit = hold.candidate === null ? "this release's commit" : hold.candidate.slice(0, 7);
+    return `GitHub CI is still running on ${commit}. This release can be approved once every pull request check passes; \`toolroll release\` asks you then.`;
+}
+/**
+ * A person's release asks for approval while its pull request's CI still runs (Alex, 2026-10-29; pipeline-speed.md,
+ * "Decision: a person's release asks during CI"). This row never holds approval: it lets the approval card say so, until
+ * the plane reads exact-head CI passing (`liftCiHold` records RELEASE_CI_PASSED_ACTION, which ends it as it ends a
+ * hold). Deployment gates and operation issuance also refuse while it remains, so a direct deploy cannot bypass
+ * the coordinator's CI wait. Its absence is not a CI pass: the coordinator still reads exact-head checks itself.
+ */
+export const RELEASE_CI_RUNNING_ACTION = "release asked while CI runs";
+export const RELEASE_CI_RUNNING_WORDS = "GitHub's checks are still running; nothing deploys until they pass.";
+/** The candidate whose CI was still running when the release task was filed, or null once the plane read it passing. */
+export function releaseCiRunningOf(store, taskId) {
+    const row = store.handle.prepare("SELECT action, detail FROM action_ledger WHERE task_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(taskId, RELEASE_CI_RUNNING_ACTION, RELEASE_CI_PASSED_ACTION);
+    if (row === undefined || row["action"] !== RELEASE_CI_RUNNING_ACTION)
+        return null;
+    const detail = typeof row["detail"] === "string" ? row["detail"] : "";
+    return { candidate: /^[0-9a-f]{40}$/.test(detail) ? detail : null };
+}
+/** Record that the release task is filed while CI runs on `candidate` (before the task exists). Idempotent. */
+export function noteCiRunning(store, input) {
+    if (!/^[0-9a-f]{40}$/.test(input.candidate))
+        throw new Error("a CI note needs the exact candidate commit");
+    const running = releaseCiRunningOf(store, input.taskId);
+    if (running !== null && running.candidate === input.candidate)
+        return;
+    store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo: store.lookupRef(input.taskId)?.repo ?? null, taskId: input.taskId, runId: null,
+        action: RELEASE_CI_RUNNING_ACTION, outcome: "running", source: "work", detail: input.candidate });
+}

package/dist/release-cli.js

@@ -17,7 +17,8 @@ import { processes, releaseAdapters } from "./release-adapters.js";
 import { releaseGate } from "./release-gate.js";
 import { databasePath, openStore, revokeRelease } from "./store.js";
 import { carryRefusalWords, proveCarry, setAskEveryReleaseCommit, setUnsandboxedCarry } from "./release-carry.js";
-import { authenticateApprover, machineActing, personProof } from "./scope.js";
+import { authenticateApprover, machineActing, personProof, proveCredential } from "./scope.js";
+import { allowAutoPublish, setReleaseApproval } from "./release-auto.js";
 import { createNightlyCheckFlow } from "./nightly-check.js";
 import { parseSchedule } from "./flow-schedule.js";
 export const RELEASE_HELP = `toolroll release <branch> — release Toolroll itself, from a pushed branch with an open pull request
@@ -52,6 +53,13 @@ toolroll release nightly --repo <path> --as <you> --token <password> [--schedule
 toolroll release ask-every-commit on|off --repo <path> [--as <you> --token <password>] — this project's releases ask
   for every later commit (on), or carry test-only commits again (off: your password, never the lead's token)
 
+toolroll release auto-approve on|off --repo <path> [--as <you> --token <password>] — this project's release approval:
+  on approves a release automatically once its pull request's CI and the release check pass on the exact commit
+  (your password typed now, never the lead's token or a remembered login); off asks you again (no password).
+
+toolroll release publish-ok <task> --as <you> --token <password> — let an automatically approved release that was held
+  after its merge (its checks stopped passing) go on to its tag, publication and Homebrew (a person only)
+
 toolroll release unsandboxed-carry on|off --repo <path> [--as <you> --token <password>] — carry release approvals
   when this project's checks aren't sandboxed (on: your password, never the lead's token). With it on, later
   test-only commits of a release run outside the sandbox without being shown to you first. Off by default; it counts
@@ -76,7 +84,10 @@ export const LEASE_DEPRECATION = "`toolroll release <lease>` is now `toolroll wo
 const VALUE_FLAGS = new Set(["--repo", "--limit", "--tap", "--release-gate", "--to", "--request", "--as", "--token", "--schedule"]);
 const BARE_FLAGS = new Set(["--new", "--json", "--help", "--yes", "--no-carry", "--start"]);
 export async function runReleaseCommand(args, write, deps = {}) {
-    const json = args.includes("--json");
+    // The flag, not a secret's value that happens to read "--json".
+    // A secret is never exactly one of these names (the loop below refuses that as a missing value).
+    const bare = new Set(args.filter(one => BARE_FLAGS.has(one)));
+    const json = bare.has("--json");
     const refuse = (reason, message, code) => {
         write(json ? checkedEnvelopeJson({ ok: false, command: "release", reason, message }) : message);
         return code;
@@ -85,14 +96,20 @@ export async function runReleaseCommand(args, write, deps = {}) {
     const limits = {};
     let repo, tap, gate, to, request, as, token, scheduleFlag;
     for (let i = 0; i < args.length; i += 1) {
-        const arg = args[i];
-        if (BARE_FLAGS.has(arg))
+        const raw = args[i];
+        if (BARE_FLAGS.has(raw))
             continue;
+        // `--flag=value` for every value flag; a secret (--token) is also the next argument even when it starts with "--".
+        const equals = raw.startsWith("--") ? raw.indexOf("=") : -1;
+        const arg = equals === -1 ? raw : raw.slice(0, equals);
         if (VALUE_FLAGS.has(arg)) {
-            const value = args[i + 1];
-            if (value === undefined || value.startsWith("--"))
+            const value = equals === -1 ? args[i + 1] : raw.slice(equals + 1);
+            // A secret may start with "--"; it is the value unless it is exactly one of this command's flags (never swallowed).
+            const namesFlag = value !== undefined && (BARE_FLAGS.has(value) || VALUE_FLAGS.has(value.split("=")[0]));
+            if (value === undefined || (equals === -1 && value.startsWith("--") && (arg !== "--token" || namesFlag)))
                 return refuse("usage", `${arg} takes a value.`, 2);
-            i += 1;
+            if (equals === -1)
+                i += 1;
             if (arg === "--repo")
                 repo = value;
             else if (arg === "--to")
@@ -117,24 +134,24 @@ export async function runReleaseCommand(args, write, deps = {}) {
             }
             continue;
         }
-        if (arg.startsWith("--"))
+        if (raw.startsWith("--"))
             return refuse("usage", `Unknown option ${arg}.\n${RELEASE_HELP}`, 2);
         positional.push(arg);
     }
-    if (args.includes("--help")) {
+    if (bare.has("--help")) {
         write(RELEASE_HELP);
         return 0;
     }
     if (gate !== undefined) {
         if (positional.length > 0 || args.some(arg => ["--repo", "--limit", "--tap", "--new"].includes(arg)))
             return refuse("usage", "--release-gate <id> takes no branch or release options.", 2);
-        return runGateRelease(gate, args.includes("--yes"), write, json, deps.gateWorld ?? installedGateWorld());
+        return runGateRelease(gate, bare.has("--yes"), write, json, deps.gateWorld ?? installedGateWorld());
     }
-    if (args.includes("--yes"))
+    if (bare.has("--yes"))
         return refuse("usage", "--yes goes with --release-gate <id>; a release needs no confirmation beyond the owner's approval.", 2);
     if (positional[0] === "nightly" && positional.length === 1)
-        return runNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, schedule: scheduleFlag, start: args.includes("--start") }, write, json, deps);
-    if (["carry", "revoke", "ask-every-commit", "unsandboxed-carry"].includes(positional[0] ?? "") && positional.length === 2) {
+        return runNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, schedule: scheduleFlag, start: bare.has("--start") }, write, json, deps);
+    if (["carry", "revoke", "ask-every-commit", "unsandboxed-carry", "auto-approve", "publish-ok"].includes(positional[0] ?? "") && positional.length === 2) {
         return runAuthorityCommand(positional[0], positional[1], { to, request, as, token, repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo) }, write, json, deps);
     }
     if (positional.length !== 1)
@@ -161,7 +178,7 @@ export async function runReleaseCommand(args, write, deps = {}) {
     const adapters = deps.adapters === undefined
         ? releaseAdapters({ checkout, say, ...(tap === undefined ? {} : { tap }), ...(limits["deploy"] === undefined ? {} : { deployMinutes: limits["deploy"] }) })
         : { ...deps.adapters, say };
-    const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: args.includes("--new"), noCarry: args.includes("--no-carry") }, adapters);
+    const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: bare.has("--new"), noCarry: bare.has("--no-carry") }, adapters);
     return report(outcome, write, json, lines);
 }
 function report(outcome, write, json, lines) {
@@ -263,6 +280,52 @@ async function runAuthorityCommand(command, target, flags, write, json, deps) {
             const words = target === "on" ? "Every later release commit in this project asks for approval." : "Later test-only release commits ship under the release approval.";
             return answer(true, { repo: flags.repo, ask: target === "on" }, words, 0);
         }
+        if (command === "publish-ok") {
+            // A person's own decision to go on after an automatic release's checks stopped passing past its merge: never the
+            // lead, a remote token or a mode.
+            const refused = (message) => answer(false, { reason: "person-only", message }, message, 1);
+            if (machineActing() || process.env["TOOLROLL_LEAD_TOKEN"] !== undefined || process.env["TOOLROLL_REMOTE_TOKEN"] !== undefined)
+                return refused("Only a person lets a held release go on, never the lead or a remote token.");
+            if (flags.as === undefined || flags.token === undefined || flags.token === "")
+                return refused("Letting a held release go on needs your password: add --as <you> --token <password>.");
+            const repo = store.lookupRef(target)?.repo ?? null;
+            if (repo === null)
+                return answer(false, { reason: "not-found", message: `No release task ${target}.` }, `No release task ${target}.`, 1);
+            const proved = authenticateApprover(store, flags.as, flags.token, repo);
+            if (!proved.ok || !personProof(proved.method))
+                return refused("Only an approver of this project, proved as a person, lets a held release go on.");
+            const allowed = allowAutoPublish(store, { taskId: target, by: flags.as, now });
+            return allowed.ok ? answer(true, { task: target }, `Release task ${target} may be tagged and published: rerun \`toolroll release\` to go on.`, 0) : answer(false, { reason: "refused", message: allowed.why }, allowed.why, 1);
+        }
+        if (command === "auto-approve") {
+            if (target !== "on" && target !== "off")
+                return answer(false, { reason: "usage", message: "auto-approve takes on or off." }, "auto-approve takes on or off.", 2);
+            if (flags.repo === undefined)
+                return answer(false, { reason: "usage", message: "Name the project with --repo <path>." }, "Name the project with --repo <path>.", 2);
+            const repo = store.listProjects().map(one => one.path).find(path => path === flags.repo) ?? null;
+            if (repo === null)
+                return answer(false, { reason: "not-found", message: "That isn't a project Toolroll knows." }, "That isn't a project Toolroll knows.", 1);
+            // Turning it on lets releases approve themselves: a credential act (docs/plans/passwordless.md), only a password
+            // typed now by an approver of this project — never the lead's token, an API token, a remembered login or a session.
+            // Turning it off only asks a person again, so it needs no password.
+            let actor = flags.as ?? "cli";
+            if (target === "on") {
+                const refused = (message) => answer(false, { reason: "person-only", message }, message, 1);
+                if (machineActing() || process.env["TOOLROLL_LEAD_TOKEN"] !== undefined || process.env["TOOLROLL_REMOTE_TOKEN"] !== undefined)
+                    return refused("Only a person turns on automatic release approval, never the lead or a remote token.");
+                if (flags.as === undefined || flags.token === undefined || flags.token === "")
+                    return refused("Turning on automatic release approval needs your password: add --as <you> --token <password>.");
+                const proved = proveCredential(store, flags.as, flags.token, repo);
+                if (!proved.ok)
+                    return refused("Only an approver of this project, with their password typed now, turns on automatic release approval.");
+                actor = flags.as;
+            }
+            const changed = setReleaseApproval(store, repo, target === "on", actor, now);
+            const words = target === "on"
+                ? "Releases in this project approve themselves once the pull request's CI and the release check pass on the exact commit. You're told when one does; anything red still asks you."
+                : `Releases in this project ask you again.${changed.withdrawn.length === 0 ? "" : ` ${changed.withdrawn.length} automatic approval${changed.withdrawn.length === 1 ? " was" : "s were"} taken back.`}`;
+            return answer(true, { repo, autoApprove: target === "on", changed: changed.changed, withdrawn: changed.withdrawn }, words, 0);
+        }
         if (command === "unsandboxed-carry") {
             if (target !== "on" && target !== "off")
                 return answer(false, { reason: "usage", message: "unsandboxed-carry takes on or off." }, "unsandboxed-carry takes on or off.", 2);

package/dist/release-coverage.js

@@ -4,7 +4,7 @@
  * existing records and Git; nothing is written back, so no proof, receipt,
  * scope digest or schema changes. Fails closed: a receipt that can't be read,
  * a missing commit or any Git error leaves the result uncovered. */
-import { execFileSync } from "node:child_process";
+import { viewedGitSync } from "./teardown-git.js";
 import { verificationEvidence } from "./verification-evidence.js";
 import { runCheckLevel } from "./check-levels.js";
 /** How many of the newest passing release checks one read considers. */
@@ -25,7 +25,10 @@ export const gitIsAncestor = (repo, ancestor, descendant) => {
         return known;
     let answer;
     try {
-        execFileSync("git", ["-C", repo, "merge-base", "--is-ancestor", ancestor, descendant], { stdio: "ignore", timeout: 5_000 });
+        // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7).
+        const status = viewedGitSync(repo, ["merge-base", "--is-ancestor", ancestor, descendant], { timeoutMs: 5_000 }).status;
+        if (status !== 0)
+            throw Object.assign(new Error("git merge-base"), { status });
         answer = true;
     }
     catch (error) {

package/dist/release-recheck.d.ts

@@ -72,7 +72,7 @@ export declare function planTargetedRecheck(store: Store, root: string, input: {
     now: Date;
 }): RecheckDecision;
 /** Coverage of a check: full, composed from A, partial (never passes), or identity-removed (asks again). */
-export type Coverage = "full" | "composed" | "partial" | "identity-removed";
+export type Coverage = "full" | "composed" | "partial" | "identity-removed" | "no-result";
 /**
  * Whether a targeted run B, with A's sealed evidence, its plan and snapshot, covers every item of B's inventory
  * (coverage conservation), and every required identity passed — re-derived from sealed values only.

package/dist/release-recheck.js

@@ -20,7 +20,7 @@
  * Coverage trusts test code (Alex, 2026-10-25): these results protect against accidental damage, not a hostile test.
  * Authority never reads them; the release's own records do.
  */
-import { CHECK_CONTEXT_CAPTURE, CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, OBLIGATION_SNAPSHOT_CAPTURE, TARGETED_PLAN_CAPTURE, checkContextOf, isUnitFile, payloadDigest, projectGitDir, readSealedJson, treeFactsOf } from "./check-report.js";
+import { CHECK_CONTEXT_CAPTURE, CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, OBLIGATION_SNAPSHOT_CAPTURE, TARGETED_PLAN_CAPTURE, checkContextOf, fullCheckProblem, isUnitFile, payloadDigest, projectGitDir, readSealedJson, treeFactsOf } from "./check-report.js";
 import { readVerifiedCommit, verifiedTreeDiff } from "./commit-extract.js";
 import { checkContextSchema, fileIdentity, groupIdentity, journeyIdentity, obligationSnapshotSchema, readCheckReport, sealedInventorySchema, targetedPlanSchema, unitIdentity, versionIdentity, } from "./contracts/release-check.js";
 import { parseContract } from "./contracts/contract.js";
@@ -483,6 +483,11 @@ export function settleCoverage(store, root, input, gateOf) {
             if (removedProtected(b.report, b.inventory, protectedIdentities(store, root, b.attempt.authority, input.runId)))
                 return removed();
         }
+        // A release's Full check (its task carries signed release terms, before or after its authority opens — an automatic
+        // approval's check runs before) counts only with a complete, valid result (check-report.ts): anything less is no result.
+        const release = b.attempt.authority !== null || (store.getScope(input.taskId)?.releaseTerms ?? null) !== null;
+        if (release && fullCheckProblem({ report: b.report, inventory: b.inventory, exitCode: input.exitCode }) !== null)
+            return { coverage: "no-result", composed: null };
         return { coverage: "full", composed: null };
     }
     if (b.plan === null || b.snapshot === null || b.attempt.baseRun === null || b.attempt.authority === null)