toolroll 0.9.75 → 0.9.77

package/dist/server/chat.js

@@ -44,7 +44,7 @@ import {} from "./render-pages.js";
 import { completionForm, hardBlockerOf, homePhaseWords, owedAcceptanceOf, resultPanelHtml } from "./render-results.js";
 import { browserCaller, oneLineUa } from "./session.js";
 export function createChatHandlers(runtime) {
-    const { firstRunStepsNow, managedRepos, leadWords, store, options, phoneSetup, visible, liveTurns, leadSaid, evidenceRoot, clock, sessions, CHAT_CANDIDATE_TTL_MS, chatFetcher, CHAT_CANDIDATES_PER_APPROVER, chatCeilingDigest, workAccess, familyOf, firstTasks, leadPrincipal, taskChatFocus, chatScopeOf, leadConversationRows, demoLeadHere, sendScreen, chromeFor, teamBrowserReply, team, teamChatProvider, runVisible, runIsLive, resultDetailOf, pullRequestTargetOf, chatEnablement, startLeadConversation, projectFamilyPeek, needsYouBadge, liveRefreshSeconds, chatKeyFor, chatCatalog, chatCatalogKnown, providerHome, mintApprovalNonce, checkLocalAgents, agentSignInCommand, bustBadge, authenticateApprover, revisionDestination, armTaskResume, consumeApprovalNonce } = runtime;
+    const { firstRunStepsNow, managedRepos, leadWords, store, options, phoneSetup, visible, liveTurns, leadSaid, evidenceRoot, clock, sessions, CHAT_CANDIDATE_TTL_MS, chatFetcher, CHAT_CANDIDATES_PER_APPROVER, chatCeilingDigest, workAccess, familyOf, firstTasks, leadPrincipal, taskChatFocus, chatScopeOf, leadConversationRows, demoLeadHere, sendScreen, chromeFor, teamBrowserReply, team, teamChatProvider, runVisible, runIsLive, resultDetailOf, pullRequestTargetOf, chatEnablement, sharedIndexPage, startLeadConversation, projectFamilyPeek, needsYouBadge, liveRefreshSeconds, chatKeyFor, chatCatalog, chatCatalogKnown, providerHome, mintApprovalNonce, checkLocalAgents, agentSignInCommand, bustBadge, authenticateApprover, revisionDestination, armTaskResume, consumeApprovalNonce } = runtime;
     // The read-only refresh (package 2): the same JSON status as before —
     // session binding, the send receipt, the live turn — plus a version
     // of the DISPLAYED facts and, only when the caller's version differs,
@@ -273,7 +273,7 @@ export function createChatHandlers(runtime) {
         if (repos.length > 0) {
             try {
                 fleetSnapshot = store.chatSnapshot(repos, now);
-                const summaries = workIndexPage(store, now, { principal: 'operator', repos, includeUnplaced: false, viewer: who.name }, { limit: 100, root: evidenceRoot }).items;
+                const summaries = sharedIndexPage({ principal: 'operator', repos, includeUnplaced: false, viewer: who.name }, { limit: 100, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) }).items;
                 fleetSnapshot.assignmentStates = Object.fromEntries(summaries.flatMap(value => [value.rootId, value.activeTaskId].map(id => [id, { state: value.assignmentState, label: value.status.label, detail: value.status.detail }])));
                 fleetSnapshot.attentionCount = needsYouBadge(null);
             }
@@ -1452,9 +1452,9 @@ export function createChatHandlers(runtime) {
                 agent: `${providerName(run.provider)} on ${run.runner}`, phase: homePhaseWords(run), project: run.repo === null ? null : projectName(run.repo), since: run.startedAt,
                 activity: runActivityOf(store, run, now) };
         });
-        const all = workIndexPage(store, now, access, { view: "all", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
-        const needs = workIndexPage(store, now, access, { view: "needs-you", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
-        const done = workIndexPage(store, now, access, { view: "completed", limit: WORK_INDEX_MAX_LIMIT, root: evidenceRoot });
+        // The three whole views, read at most once per workspace revision (and on a read worker first when one is attached).
+        const view = (name) => sharedIndexPage(access, { view: name, limit: WORK_INDEX_MAX_LIMIT, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) });
+        const all = view("all"), needs = view("needs-you"), done = view("completed");
         const weekAgo = new Date(now.getTime() - 7 * 86_400_000).toISOString();
         const counts = [
             { key: "working", label: "Working now", value: agents.length, href: "/work?view=running" },

package/dist/server/render-tasks.d.ts

@@ -232,6 +232,11 @@ export declare function agentsStripHtml(view: RouteView | null, taskId: string):
 /** A ceremony nonce as stored: the sha256 hex of the value the form carried. */
 export declare function nonceHashOf(value: string): string;
 /** The approve POST's refusal, in words a person can act on. */
+/** A release task's automatic approval, in words (docs/plans/auto-approve-green.md). */
+export declare function autoReleaseWords(auto: {
+    kind: "checking" | "approved";
+    candidate: string;
+}): string;
 /** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
 export declare function approvalProofWords(proof: {
     method: string;
@@ -523,6 +528,13 @@ export declare function taskBodyParts(data: {
         method: string;
         at: string;
     } | null;
+    /** A release task the plane approved (or is checking) itself (docs/plans/auto-approve-green.md): its candidate. */
+    autoRelease?: {
+        kind: "checking" | "approved";
+        candidate: string;
+    } | null;
+    /** A release task filed while its pull request's CI still runs (a person may approve now; nothing deploys before CI passes). */
+    releaseCiRunning?: boolean;
     /** One approval per release (release-once.md): the release this task belongs to, and whether this reader may stop it. */
     release?: ReleaseView | null;
     canStopRelease?: boolean;

package/dist/server/render-tasks.js

@@ -1,6 +1,7 @@
 /** Task pages: approval, agents, plans, controls, decisions and the task body. */
 import { networkWords } from "../egress.js";
 import { releaseAsksAgainWords, releaseTermsSentence } from "../scope.js";
+import { RELEASE_CI_RUNNING_WORDS } from "../release-ci-hold.js";
 import { writesWords } from "../writes-mode.js";
 import { checkAccessWords } from "../check-access.js";
 import { sandboxTermsWords } from "../project-sandbox.js";
@@ -746,6 +747,11 @@ export function nonceHashOf(value) {
     return createHash("sha256").update(value).digest("hex");
 }
 /** The approve POST's refusal, in words a person can act on. */
+/** A release task's automatic approval, in words (docs/plans/auto-approve-green.md). */
+export function autoReleaseWords(auto) {
+    return auto.kind === "approved" ? `Approved automatically: CI and release check passed on ${auto.candidate.slice(0, 7)}`
+        : `Checking automatically: approves itself once CI and the release check pass on ${auto.candidate.slice(0, 7)}`;
+}
 /** " (password remembered from 10:42)" when the approval stood on a remembered password or sign-in; nothing otherwise. */
 export function approvalProofWords(proof) {
     if (proof == null)
@@ -1496,12 +1502,14 @@ export function taskBodyParts(data) {
             scope.touches.length === 0 ? "" : html `<p class="scope-paths"><strong>Touches</strong> ${scope.touches.join(", ")}</p>`,
             html `<p><strong>Quality</strong> ${qualityModeTitle(scope.qualityMode ?? "default")}</p>`,
             acceptanceCeremonyHtml(scope.acceptance),
-            scope.releaseTerms == null ? "" : html `<p><strong>Release</strong></p><p class="recap">${releaseTermsSentence(scope.releaseTerms)}</p>${scope.releaseTerms.policy.carry ? html `<details><summary>What asks again</summary><ul>${joinHtml(releaseAsksAgainWords(scope.releaseTerms).map(line => html `<li>${line}</li>`), "")}</ul></details>` : ""}`,
-            approval.approved && data.release?.kind === "carried"
-                ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
-                : approval.approved
-                    ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
-                    : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
+            scope.releaseTerms == null ? "" : html `<p><strong>Release</strong></p><p class="recap">${releaseTermsSentence(scope.releaseTerms)}</p>${data.releaseCiRunning === true ? html `<p class="meta">${RELEASE_CI_RUNNING_WORDS}</p>` : ""}${scope.releaseTerms.policy.carry ? html `<details><summary>What asks again</summary><ul>${joinHtml(releaseAsksAgainWords(scope.releaseTerms).map(line => html `<li>${line}</li>`), "")}</ul></details>` : ""}`,
+            approval.approved && data.autoRelease != null
+                ? html `<p class="meta scope-seal">${autoReleaseWords(data.autoRelease)} · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                : approval.approved && data.release?.kind === "carried"
+                    ? html `<p class="meta scope-seal">Carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a> · <span class="seal">signs ${shortDigest(scope.digest)}</span></p>`
+                    : approval.approved
+                        ? html `<p class="meta scope-seal">Approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)} · <span class="seal">signs ${shortDigest(scope.digest)}</span><span class="so-sr-only"> — approval binds to this exact wording</span></p>`
+                        : html `<p class="meta"><span class="seal">signs ${shortDigest(scope.digest)}</span> — approval binds to this exact wording</p><p class="meta">Not approved${approval.reason === "changed" ? " — approved once, then rewritten" : ""}</p>`,
             html `</div>`,
         ], "\n");
     // The scout's report (mate arc §10): title, summary, the document inert,
@@ -1792,11 +1800,13 @@ export function taskBodyParts(data) {
         : "";
     const scopeRow = scope === null
         ? prop("scope", "none yet")
-        : approval.approved && data.release?.kind === "carried"
-            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
-            : approval.approved
-                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
-                : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
+        : approval.approved && data.autoRelease != null
+            ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${autoReleaseWords(data.autoRelease)}`)
+            : approval.approved && data.release?.kind === "carried"
+                ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · carried from ${data.release.approver ?? "a person"}'s release approval · <a href="${taskHref(data.release.anchorTask)}">Release ${data.release.version}</a>`)
+                : approval.approved
+                    ? prop("approved scope", html `<span class="seal">signs ${shortDigest(scope.digest)}</span> · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)} · ${whenTime(approval.at)}`)
+                    : prop("scope", approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved");
     const strikesRow = data.strikes > 0 ? prop("strikes", `${data.strikes} failed attempt(s)`) : "";
     const propsCard = html `<div class="card props">${workerRow}${queueRow}${scopeRow}${publishesRow}${economics}${strikesRow}</div>`;
     // The same facts for the rebuilt page, row for row.
@@ -1811,9 +1821,10 @@ export function taskBodyParts(data) {
         facts.push({ label: "Queue", parts: [`${data.position.position} of ${data.position.total}${data.position.column === null ? " in the shared queue" : ` in ${data.position.column}'s queue`} · `, { label: "Reorder", href: "/board?view=order" }] });
     }
     facts.push(scope === null ? { label: "Scope", parts: ["none yet"] }
-        : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
-            : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
-                : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
+        : approval.approved && data.autoRelease != null ? { label: "Approved scope", parts: [autoReleaseWords(data.autoRelease)] }
+            : approval.approved && data.release?.kind === "carried" ? { label: "Approved scope", parts: [`Carried from ${data.release.approver ?? "a person"}'s release approval · `, { label: `Release ${data.release.version}`, href: taskHref(data.release.anchorTask) }] }
+                : approval.approved ? { label: "Approved scope", parts: [{ seal: `signs ${scope.digest.length <= 12 ? scope.digest : `${scope.digest.slice(0, 12)}…`}` }, ` · ${qualityModeTitle(scope.qualityMode ?? "default")} · approved by ${approval.by}${approvalProofWords(data.approvalProof)}`, ...(approval.at === null ? [] : [" · ", { at: approval.at }])] }
+                    : { label: "Scope", parts: [approval.reason === "changed" ? "rewritten since its approval — needs a new yes" : "not approved"] });
     if (data.release?.kind === "anchor")
         facts.push({ label: "Release", parts: [`Approved for release ${data.release.version}`, ...(data.release.landed.length === 0 ? [] : [` · later commits: ${data.release.landed.map(one => one.sha.slice(0, 7)).join(", ")}`]), ...(data.release.carrying ? [] : [` · later commits ask again`])] });
     facts.push({ label: "Publishes as", parts: [publishesAs] });

package/dist/server/request-context.d.ts

@@ -20,12 +20,18 @@ export type RequestFacts = {
     createdTask?: string;
     browser?: boolean;
     workspaceRead?: boolean;
+    /** Receipt reconciliation, task and result reads (`request`, `task`, `result`): work is read afresh, never cached. */
+    freshWork?: boolean;
+    /** A workspace re-read's If-None-Match: the content validator it holds from its last read. */
+    workspaceIfNoneMatch?: string;
     workspaceRequest?: string | null;
     workCounts?: ReturnType<typeof workCountsByProject>;
     workCrew?: {
         project: string | null;
         page: WorkIndexPage;
     };
+    /** The chrome this request already read (console-chrome.ts keys): one snapshot per request, however often it asks. */
+    chromeReads?: Map<string, unknown>;
     lens?: string | null;
     workspaceValidator?: {
         key: string;

package/dist/server/route-table.js

@@ -303,6 +303,9 @@ post("tasks", "sweep.cancel-rest", "^\\/sweeps\\/[1-9][0-9]{0,9}\\/cancel-rest$"
 // (the handler proves it as a credential act); turning it off is one click, so the row itself is not a step-up.
 get("settings", "settings.passwordless", "/settings/passwordless", { ...free, ...operator("An instance operator sets Passwordless.", "/settings") });
 post("settings", "settings.passwordless-send", "/settings/passwordless", { callers: ["cookie"], ...operator("An instance operator sets Passwordless.", "/settings") });
+// Release approval (docs/plans/auto-approve-green.md): an approver of the project, from a browser. Approving releases
+// automatically takes a typed password (the handler proves it as a credential act); asking again is one click.
+post("settings", "settings.release-approval-send", "/settings/release-approval", { callers: ["cookie"], ...approver("An approver sets how releases are approved.", "/settings/approval") });
 post("pages", "ledger.checkpoint", "/ledger/checkpoint", operator("An instance operator makes ledger checkpoints.", "/ledger"));
 const SETTINGS_ACT_ROLES = {
     policy: operator("An instance operator sets the policy.", "/settings/policy"),

package/dist/server/runtime.d.ts

@@ -153,6 +153,8 @@ export interface ServerRuntime {
         saturated: boolean;
     };
     liveRefreshSeconds: () => number;
+    /** One work index page for an already-admitted reader, read at most once per workspace revision (console-chrome.ts). */
+    sharedIndexPage: (access: import("../work-summary.js").WorkSummaryAccess, options: import("../work-index.js").WorkIndexOptions) => import("../work-index.js").WorkIndexPage;
     chatKeyFor: (provider: DirectChatProviderId) => {
         key: string;
         source: "environment" | "stored";

package/dist/server/settings.js

@@ -39,7 +39,8 @@ import { browserCaller } from "./session.js";
 import { DEFAULT_ACCENT, normalHex } from "../accent-colors.js";
 import { resolvePhaseAgent } from "../agentconfig.js";
 import { parseProtectedPaths } from "../approval-policy.js";
-import { approvalRulesHtml } from "../approval-rules-ui.js";
+import { approvalRulesHtml, releaseApprovalHtml } from "../approval-rules-ui.js";
+import { releaseApprovalSetting, setReleaseApproval } from "../release-auto.js";
 import { backupHtml } from "../backup-ui.js";
 import { BACKUP_EVERY_HOURS, backupFolderOf, backupNow, checkBackupFolder, defaultBackupFolder, MAX_KEEP } from "../backup.js";
 import { projectBatchChecks, setProjectBatchChecks } from '../batch-policy.js';
@@ -366,7 +367,8 @@ ${connectionHtml(asked, connection, task)}${command === null ? "" : html `<p>On
             return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
         const selector = projects.length > 1 ? html `<form class="approval-project" method="get" action="/settings/approval"><label>Project<select name="repo">${projects.map(p => html `<option value="${p}"${p === chosen ? " selected" : ""}>${projectName(p)}</option>`)}</select></label><button>Show</button></form>` : "";
         const approvers = chosen === "" ? 0 : store.listApprovers().filter(one => { const account = store.accountOf(one.name); return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(one.name, chosen); }).length;
-        const content = chosen === "" ? html `<p>Add a project to set its approval rules.</p>` : (approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") }));
+        const release = chosen === "" ? null : releaseApprovalSetting(store, chosen);
+        const content = chosen === "" ? html `<p>Add a project to set its approval rules.</p>` : html `${approvalRulesHtml({ repo: chosen, name: projectName(chosen), rules: store.approvalRules(chosen), canChange: who.via === "cookie" && store.isInstanceOperator(who.name), approvers }, { said: url.searchParams.get("said"), problem: url.searchParams.get("problem") })}${releaseApprovalHtml({ repo: chosen, auto: release.auto, setBy: release.setBy, at: release.at, canChange: who.via === "cookie" && who.role === "approver" && !store.isDemo() && store.accountCanAccess(who.name, chosen) })}`;
         return sendScreen(response, 200, screen("Approval rules", html `<p><a href="/settings">Settings</a></p><h1>Approval rules</h1>${selector}${content}`, { chrome: chromeFor(chosen || project, "settings") }));
     }
     // Sprint 8: Settings → Policy, the organisation policy and its history. Anyone signed in reads it; an instance operator changes it.
@@ -2538,6 +2540,7 @@ ${modeWords(terms)
         "settings.sign-in": signInPage,
         "settings.passwordless": passwordlessPage,
         "settings.passwordless-send": passwordlessSave,
+        "settings.release-approval-send": releaseApprovalSave,
         "settings.lead": leadPage,
         "settings.teams": teamsPage,
         "settings.discord": discordPage,
@@ -2725,5 +2728,29 @@ ${modeWords(terms)
             return back("problem", "An approver for this project changes its sandbox. Nothing changed.");
         return back("said", JSON.stringify(changed.before) === JSON.stringify(changed.after) ? "Nothing changed." : "Saved. Tasks scoped from now on use it; tasks already approved keep what they were approved with.");
     }
+    // Release approval (docs/plans/auto-approve-green.md): an approver of the project. Approving automatically is a
+    // credential act (a password typed now, never a session); asking again is one click and takes back automatic seals.
+    async function releaseApprovalSave(ctx) {
+        const { response, now, posted } = ctx;
+        const who = browserCaller(ctx.who);
+        const body = readForm(posted, CONSOLE_FORMS.releaseApproval);
+        const repo = body.get("repo") ?? "";
+        if (!consoleProjects().includes(repo) || !visible(repo))
+            return refuse(response, who, 403, "That project is outside your access.", "/settings/approval");
+        const back = sayTo(response, `/settings/approval?repo=${encodeURIComponent(repo)}`);
+        if (who.role !== "approver" || store.isDemo() || !store.accountCanAccess(who.name, repo))
+            return back("problem", "An approver of this project sets how its releases are approved.");
+        const action = body.get("action");
+        if (action === "ask") {
+            const changed = setReleaseApproval(store, repo, false, who.name, now);
+            return back("said", !changed.changed ? "Saved." : `Releases ask you again.${changed.withdrawn.length === 0 ? "" : ` ${changed.withdrawn.length} automatic approval${changed.withdrawn.length === 1 ? " was" : "s were"} taken back.`}`);
+        }
+        if (action !== "auto")
+            return back("problem", "Choose Ask me or Approve automatically when checks pass.");
+        if (!authenticateCredential(who, body.get("password") ?? "", repo).ok)
+            return back("problem", "Enter your Toolroll password to approve releases automatically.");
+        const changed = setReleaseApproval(store, repo, true, who.name, now);
+        return back("said", changed.changed ? "Releases approve themselves once CI and the release check pass." : "Saved.");
+    }
     return { registrations, modelsView };
 }

package/dist/server/task-views.js

@@ -1,9 +1,10 @@
 import { releaseViewOf } from "../release-view.js";
+import { releaseCiRunningOf } from "../release-ci-hold.js";
 import { releaseObligationsOf } from "../release-recheck.js";
 import { approvalProofOf, freshlyApprovable, freshnessFor, withFreshness } from "../scope.js";
 import { liveAttemptOf, steerControlsFor } from "../steer-controls.js";
 import { originOf } from "../task-source.js";
-import { taskBaseOf } from "../task-base.js";
+import { recentGitReads, taskBaseOf } from "../task-base.js";
 import { assignmentPresentationOf, historicalAssessmentReason } from '../assignment-presentation.js';
 import { html, joinHtml } from "../html.js";
 import { assignmentStatusOf, assignmentWithEvidence } from '../assignment-ui.js';
@@ -53,6 +54,9 @@ import {} from "../store.js";
 import { taskControlOf } from "../task-control.js";
 import { lastErrorLineOf, missedRequirementOf, workStatusOf } from "../workspace-ui.js";
 export function createTaskViews(runtime) {
+    // The task page's base line reads Git through a frozen view of the project (~0.2-0.5 s on a large repository) and
+    // the page renders it twice per view and again on every live refresh: its answers are kept for a moment.
+    const baseGit = recentGitReads();
     /** The first task's way to Ready shows until the first Ready result, and stays on the installation's first task. */
     function guided(rootId, now) {
         if (runtime.store.isDemo())
@@ -491,11 +495,13 @@ export function createTaskViews(runtime) {
                 return { rows, decisions: decisionsFor(runtime.store, rows), now };
             })(),
             steering: ref === null ? [] : runtime.store.listSteerNotes(ref.id),
-            base: taskBaseOf(runtime.store, taskId),
+            base: taskBaseOf(runtime.store, taskId, baseGit),
             steeringLive: ref !== null && runtime.store.steeringLiveBuild(ref.id, now) !== null,
             steeringRun: ref === null ? null : runtime.store.steeringLiveBuild(ref.id, now),
             release: ref === null ? null : releaseViewOf(runtime.store, ref.externalId, now, authority => releaseObligationsOf(runtime.store, runtime.evidenceRoot, authority)),
             canStopRelease: who.role === "approver" && who.via === "cookie",
+            autoRelease: ref === null ? null : autoReleaseOf(runtime.store.getScope(ref.externalId)),
+            releaseCiRunning: ref !== null && releaseCiRunningOf(runtime.store, ref.externalId) !== null,
             approvalProof: (() => {
                 // The proof of the approval shown: its approver, its exact sealed digest (approvedDigest === digest when approved).
                 const scope = ref === null ? null : runtime.store.getScope(ref.externalId);
@@ -1139,3 +1145,10 @@ export function createTaskViews(runtime) {
     }
     return { guided, projectFamilyPeek, familiesInView, familyTasksInView, revisionDestination, earlierLiveVersions, familyHistory, freshAssignment, workRowOf, taskListPane, runIsLive, runIsTaskResult, revisionViewOf, taskViewData, routeViewOf, taskChatFocus, pullRequestTargetOf, taskPullRequestOf, failureOf, explainAttempt, runChecksHere, taskScreen, armTaskResume, planViewOf, planContractViewOf, revisionDocOf, revisionLedgerOf, progressOf, resultDetailOf };
 }
+/** A release task the plane approved (or is checking) itself, for the task page (docs/plans/auto-approve-green.md). */
+function autoReleaseOf(scope) {
+    if (scope === null || scope.approvedDigest !== scope.digest || (scope.candidate ?? null) === null)
+        return null;
+    return scope.approvalBasis === "auto-green" ? { kind: "approved", candidate: scope.candidate }
+        : scope.approvalBasis === "auto-check" ? { kind: "checking", candidate: scope.candidate } : null;
+}

package/dist/setup-guide.d.ts

@@ -15,10 +15,10 @@ export declare function detectPreparation(repo: string): {
 } | null;
 /** Browser installation may write only this known file inside its project. */
 export declare function previewProjectInstructions(repo: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
+    content?: never;
     fingerprint?: never;
     installed?: never;
 } | {
@@ -30,10 +30,10 @@ export declare function previewProjectInstructions(repo: string): {
     installed: boolean;
 };
 export declare function addProjectInstructions(repo: string, fingerprint: string): {
-    content?: never;
     ok: false;
     message: string;
     plan?: never;
+    content?: never;
     fingerprint?: never;
     installed?: never;
 } | import("./skills.js").InstallResult;

package/dist/storage.d.ts

@@ -36,3 +36,8 @@ export declare function storageReport(store: Store, databaseFile: string, checko
     lines: StorageLine[];
 };
 export declare function bytesWords(bytes: number): string;
+/** diskBytes without holding the event loop: the same one `du` per 200 paths and the same bounds, awaited. A console
+ * measuring its checkouts (tens of GB) used to stall every page for as long as `du` took. */
+export declare function diskBytesAsync(paths: readonly string[], run?: typeof duOnce): Promise<Map<string, number>>;
+/** `du -sk` over a batch, its output whatever it managed (a slow disk or a failure answers what it has, or nothing). */
+declare function duOnce(batch: readonly string[]): Promise<string>;

package/dist/storage.js

@@ -7,7 +7,7 @@
  * what slips through: stale test temp folders, leftover processes, extra
  * staged runtimes and dependency installs unused for a week.
  */
-import { spawnSync } from "node:child_process";
+import { execFile, spawnSync } from "node:child_process";
 import { lstatSync, readdirSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { DEPS_FOLDER, sharedCopies } from "./shared-deps.js";
@@ -190,3 +190,30 @@ export function bytesWords(bytes) {
         return `${Math.round(bytes / 1024 ** 2)} MB`;
     return `${Math.round(bytes / 1024)} KB`;
 }
+/** diskBytes without holding the event loop: the same one `du` per 200 paths and the same bounds, awaited. A console
+ * measuring its checkouts (tens of GB) used to stall every page for as long as `du` took. */
+export async function diskBytesAsync(paths, run = duOnce) {
+    const sizes = new Map();
+    if (paths.length === 0)
+        return sizes;
+    if (process.platform !== "win32") {
+        for (let at = 0; at < paths.length; at += 200) {
+            const batch = paths.slice(at, at + 200);
+            for (const line of (await run(batch)).split("\n")) {
+                const match = /^(\d+)\t(.+)$/.exec(line);
+                if (match !== null && batch.includes(match[2]))
+                    sizes.set(match[2], Number(match[1]) * 1024);
+            }
+        }
+    }
+    for (const path of paths)
+        if (!sizes.has(path))
+            sizes.set(path, treeBytes(path));
+    return sizes;
+}
+/** `du -sk` over a batch, its output whatever it managed (a slow disk or a failure answers what it has, or nothing). */
+function duOnce(batch) {
+    return new Promise(resolve => {
+        execFile("du", ["-sk", ...batch], { encoding: "utf8", maxBuffer: 16 * 1024 * 1024, timeout: 60_000 }, (_error, stdout) => resolve(typeof stdout === "string" ? stdout : ""));
+    });
+}

package/dist/store.d.ts

@@ -2355,7 +2355,7 @@ export declare class Store {
      * exactly what the signed digest was bound to. Returns false when the
      * scope vanished mid-ceremony. */
     sealScopeApproval(taskId: string, by: string, now: Date, mutation?: Mutation, basis?: {
-        kind: "mode" | "chat" | "grant" | "schedule";
+        kind: "mode" | "chat" | "grant" | "schedule" | "auto-check" | "auto-green";
         modeDigest: string;
         /** A chat seal of a deploy gate: the release card it came from (chat-management.md §0a.5). */
         card?: "release";
@@ -7780,3 +7780,13 @@ export type AgentsLiveRun = Run & {
  * Visibility is the caller's: it filters each by the console's ceiling and the viewer's access.
  */
 export declare function agentsLiveRuns(store: Store, endedSince: Date): AgentsLiveRun[];
+/**
+ * This runner's watches a predecessor left needing recovery (Codex review round 1, finding 2): a watch lease still
+ * live, or one whose holder left a claim open (or a run open under a claim a reaper already released). A replacement
+ * worker takes each over — recovering the holder's incarnation in the same transaction — before it admits new work,
+ * whichever projects its start names (a project being removed when the predecessor died is in none of them).
+ */
+export declare function predecessorWatches(store: Store, runner: string, now: Date): {
+    repo: string;
+    owner: string;
+}[];

package/dist/store.js

@@ -1,3 +1,4 @@
+import { mintSecret } from "./secret-mint.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessOf, widerThan } from "./check-access.js";
 import { PROJECT_SANDBOX_DEFAULT, sandboxOf } from "./project-sandbox.js";
@@ -72,6 +73,7 @@ import { hasDisguisedText, hasForbiddenControls, validateNote } from "./decision
 import { parseReviewContext, reviewContextCustodyProblem } from "./review-context.js";
 import { foldReview, manualReviewOnly } from "./proof.js";
 import { liveReleaseOf } from "./scope.js";
+import { releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { APPROVAL_BASES, approvalOf, machineActing, personProof, proofDetailOf, quarantinedAuthor, sealOriginOf, digestOf, canonicalProfileJson, chainFromJson, profileDigestOf, profileFromJson, scopeAuthorityOf, routeParityProblem, parseAcceptanceCriteria, exactAcceptance, exactStringList, exactSafeIntegerOrNull } from "./scope.js";
 import { resolveScopeProfile, resolveRouteCandidates, exactPinOf, routeOfTask, agentChoicesFor } from "./agentconfig.js";
 import { canonicalOverridesJson, canonicalRouteJson, isRiskLevel, isTaskSize, headroomFrom, makesNoPlan, legOf, overridesFromJson, phaseOfRole, recommendRoute, routeDigestOf, routeFromJson, routeProblems, routeStampProblem, ROUTE_ERA, PROVIDER_ID_LIST, } from "./phase-routing.js";
@@ -6932,6 +6934,10 @@ export class Store {
             // road it came by.
             if (basis === undefined && machineActing())
                 return false;
+            // A RELEASE WAITING FOR CI (Codex review round 1, finding 4): filed while its pull request's checks still ran,
+            // only the automatic road (which proves CI itself) seals it until the plane read exact-head CI passing.
+            if (basis?.kind !== "auto-check" && basis?.kind !== "auto-green" && releaseCiHoldOf(this, taskId) !== null)
+                return false;
             // `carried` is written by the carry transaction alone (carryReleaseApproval), never through a seal.
             if (basis?.kind === "carried")
                 return false;
@@ -7014,7 +7020,17 @@ export class Store {
             const deployGate = (typeof working["candidate"] === "string" && working["candidate"] !== "") || working["release_terms_json"] != null;
             if (deployGate && basis?.kind === "chat" && !(basis.card === "release" && typeof basis.cardDigest === "string" && /^[0-9a-f]{64}$/.test(basis.cardDigest)))
                 return false;
-            if (terms.terms !== null && basis !== undefined && basis.kind !== "chat")
+            // AUTOMATIC RELEASE SEALS (auto-approve-green.md): only on a release task (a candidate and release terms signed
+            // in), only naming the evidence row the plane wrote for exactly this task, kind, digest and candidate.
+            const automatic = basis?.kind === "auto-check" || basis?.kind === "auto-green";
+            if (automatic) {
+                if (terms.terms === null || typeof working["candidate"] !== "string" || working["candidate"] === "")
+                    return false;
+                const evidence = autoEvidenceOf(this, taskId, basis.modeDigest, basis.kind);
+                if (evidence === null || evidence.digest !== String(working["digest"]) || evidence.candidate !== working["candidate"] || evidence.by !== by)
+                    return false;
+            }
+            if (terms.terms !== null && basis !== undefined && basis.kind !== "chat" && !automatic)
                 return false;
             if (terms.terms !== null && releaseSealProblem(this, terms.terms) !== null)
                 return false;
@@ -7033,7 +7049,8 @@ export class Store {
                     approved_route_json = proposed_route_json
               WHERE task_id = ?`)
                 .run(now.toISOString(), by, basis === undefined ? "password" : basis.kind, basis === undefined ? null : basis.modeDigest, taskId);
-            if (changed.changes > 0 && terms.ok && terms.terms !== null) {
+            // `auto-check` only lets the check run: it opens no release authority (only `auto-green` and a person's yes do).
+            if (changed.changes > 0 && terms.ok && terms.terms !== null && basis?.kind !== "auto-check") {
                 if (openReleaseAuthority(this, { taskId, digest: String(working["digest"]), terms: terms.terms, by, now }) === null)
                     throw new ReleaseSealRefused();
             }
@@ -7066,7 +7083,11 @@ export class Store {
                                         ? "Approved automatically: its flow runs on its own. A connected worker can take it next."
                                         : basis.kind === "schedule"
                                             ? "Approved by its standing order. A connected worker can take it next."
-                                            : "Approved automatically under the operating mode. A connected worker can take it next.",
+                                            : basis.kind === "auto-check"
+                                                ? "Checking automatically: it approves itself once CI and the release check pass."
+                                                : basis.kind === "auto-green"
+                                                    ? "Approved automatically: CI and the release check passed."
+                                                    : "Approved automatically under the operating mode. A connected worker can take it next.",
                             link: chatControlHref("task", taskId),
                         }, now);
                     }
@@ -8003,7 +8024,7 @@ export class Store {
     /** A single-use door into the instance (U2): 128-bit token, sha256
      * stored, role pinned at mint, 72 hours. Only the caller's own
      * authentication gates this — an approver mints; a viewer cannot. */
-    mintInvite(role, mintedBy, now, token = () => randomBytes(16).toString("base64url"), projects = null) {
+    mintInvite(role, mintedBy, now, token = () => mintSecret(16), projects = null) {
         const access = normalizeProjectAccess(projects);
         return this.transact(() => {
             if (!this.isInstanceOperator(mintedBy))
@@ -20422,7 +20443,7 @@ export function serializeReleaseTerms(terms) {
 }
 // ---- one approval per release: the authority record (release-once.md, part 1) --------------------------------------
 export { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseAuthorityOfTask, releaseCarries, releaseCarryTo, releaseOperation, releaseOperations, releaseSealProblem, } from "./release-authority.js";
-import { LIVE_RELEASE_STATES, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
+import { LIVE_RELEASE_STATES, autoEvidenceOf, belongsToRelease, newestReleaseGeneration, outstandingReleaseOperations, releaseAuthority, releaseCarryTo, releaseOperation, releaseSealProblem, } from "./release-authority.js";
 /**
  * Open a release's authority for a person's seal of its terms (inside the seal's transaction): the next generation,
  * superseding the live one. False when it can't (releaseSealProblem), which refuses the seal.
@@ -20492,6 +20513,9 @@ export function reserveRelease(store, input) {
         const a = releaseAuthority(store, input.authority);
         if (a === null)
             return { ok: false, why: `No release ${input.authority}.` };
+        // Early approval authorizes the check, never an irreversible operation before the plane confirms exact-head CI.
+        if (releaseCiRunningOf(store, input.taskId) !== null)
+            return { ok: false, why: "This release still waits for GitHub CI. Resume it with `toolroll release`." };
         const at = input.now.toISOString();
         // Expiry stops every live state; an operation already reserved settles only through reconciliation.
         if (a.expiresAt <= at)
@@ -20533,6 +20557,8 @@ export function runReleaseOperation(store, id, epoch, now, issuer = currentRelea
         const a = op === null ? null : releaseAuthority(store, op.authority);
         if (op === null || a === null || op.state !== "reserved" || op.epoch !== epoch || a.leaseEpoch !== epoch)
             return false;
+        if (releaseCiRunningOf(store, op.taskId) !== null)
+            return false;
         // Past the expiry nothing new starts; the reserved operation is settled by reconciliation instead.
         if (a.expiresAt <= now.toISOString())
             return false;
@@ -20843,3 +20869,16 @@ export function agentsLiveRuns(store, endedSince) {
         repo: row["live_task_repo"] === null || row["live_task_repo"] === undefined ? null : String(row["live_task_repo"]),
     }));
 }
+/**
+ * This runner's watches a predecessor left needing recovery (Codex review round 1, finding 2): a watch lease still
+ * live, or one whose holder left a claim open (or a run open under a claim a reaper already released). A replacement
+ * worker takes each over — recovering the holder's incarnation in the same transaction — before it admits new work,
+ * whichever projects its start names (a project being removed when the predecessor died is in none of them).
+ */
+export function predecessorWatches(store, runner, now) {
+    return store.handle.prepare(`SELECT w.repo AS repo, w.owner AS owner FROM watch_lease w
+      WHERE w.runner = ? AND (w.expires_at > ? OR EXISTS (
+        SELECT 1 FROM claim c WHERE c.runner = w.runner AND c.incarnation = w.owner
+          AND (c.released_at IS NULL OR EXISTS (SELECT 1 FROM run r WHERE r.lease_id = c.lease_id AND r.outcome IS NULL))))
+      ORDER BY w.repo`).all(runner, now.toISOString()).map(row => ({ repo: String(row["repo"]), owner: String(row["owner"]) }));
+}

package/dist/task-base.d.ts

@@ -33,3 +33,7 @@ export declare function freshBaseFor(store: Store, taskId: string, branch: strin
     };
 } | Record<string, never>;
 export declare function taskBaseOf(store: Store, taskId: string, git?: GitRead): TaskBaseView | null;
+/** `git`'s answers kept for `ttlMs` (at most `entries` of them), for a page that shows the base line on every refresh:
+ * each read still goes through the same frozen view when it runs; only its answer is reused for a moment. Display only —
+ * never for a decision. */
+export declare function recentGitReads(git?: GitRead, ttlMs?: number, entries?: number, now?: () => number): GitRead;

package/dist/task-base.js

@@ -4,10 +4,13 @@
  * branch's pinned origin, or the newest plan's base — and the behind count is
  * read from Git now. Reads only.
  */
-import { execFileSync } from "node:child_process";
+import { viewedGitSync } from "./teardown-git.js";
 export const readGit = (cwd, args) => {
     try {
-        return execFileSync("git", ["--no-optional-locks", ...args], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5_000, maxBuffer: 65_536 }).trim();
+        // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7): a partial clone, an
+        // include or a command-naming key is refused from the config git then runs with.
+        const ran = viewedGitSync(cwd, args, { timeoutMs: 5_000, maxBuffer: 65_536 });
+        return ran.status === 0 ? ran.stdout.trim() : null;
     }
     catch {
         return null;
@@ -49,3 +52,20 @@ export function taskBaseOf(store, taskId, git = readGit) {
     const view = { base, branch, main: behind === null ? null : main, behind };
     return { ...view, words: `Base ${baseStandingWords(view)}` };
 }
+/** `git`'s answers kept for `ttlMs` (at most `entries` of them), for a page that shows the base line on every refresh:
+ * each read still goes through the same frozen view when it runs; only its answer is reused for a moment. Display only —
+ * never for a decision. */
+export function recentGitReads(git = readGit, ttlMs = 15_000, entries = 64, now = Date.now) {
+    const kept = new Map();
+    return (cwd, args) => {
+        const key = JSON.stringify([cwd, args]), at = now(), hit = kept.get(key);
+        if (hit !== undefined && at - hit.at < ttlMs && at >= hit.at)
+            return hit.value;
+        const value = git(cwd, args);
+        kept.delete(key);
+        if (kept.size >= entries)
+            kept.delete(kept.keys().next().value);
+        kept.set(key, { at, value });
+        return value;
+    };
+}