toolroll 0.9.75 → 0.9.77

package/dist/check-report.js

@@ -9,7 +9,11 @@
  * After the check, the report is the last `TOOLROLL_CHECK_REPORT <json>` line of its output that carries that nonce
  * (a line a test prints, or one a leftover process writes, has no nonce and is ignored). It is read strictly and sealed
  * as `check-report.json`, beside `check-inventory.json` (what was sealed, and the groups and versions the check
- * declared). A run with no valid report still passes or fails as before; it just can't be the base of a targeted check.
+ * declared). A Full release check qualifies only with all of it (fullCheckProblem): a valid report carrying this run's
+ * nonce, a complete inventory, a terminal result for every part, file, journey group and upgrade version it owed, and a
+ * successful exit. Anything less — no report, a malformed or cut-short one, one whose exit disagrees, a part that never
+ * finished, a file with no result — is an error, "no result", and never a pass. A failed check's report only has to be
+ * valid: what it failed on is its result.
  *
  * Coverage trusts test code (the trust decision in the plan). Nothing here decides who may release or deploy.
  */
@@ -19,6 +23,7 @@ import { join } from "node:path";
 import { readVerifiedCommit, verifiedTreeEntries } from "./commit-extract.js";
 import { CHECK_PARTS, CHECK_REPORT_MAX_BYTES, CHECK_REPORT_PREFIX, readCheckReport, } from "./contracts/release-check.js";
 import { readVerifiedArtifact, storeEvidence } from "./evidence.js";
+import { releaseBaselineRecord } from "./release-card.js";
 import { checkAttemptOf, recordCheckAttempt } from "./store.js";
 /** The sealed artifacts' capture labels: what a reader looks for, by exact name. */
 export const CHECK_REPORT_CAPTURE = "release check report v1";
@@ -91,17 +96,82 @@ export function treeFactsOf(gitDir, sha) {
 export function checkContextOf(facts, command, access) {
     return { version: 1, node: process.version, platform: process.platform, arch: process.arch, lockfile: facts.lockfile, harness: facts.harnessDigest, grant: { id: command.id, digest: command.digest }, access };
 }
-/** The parts a full check selects, as far as the plane knows them before it runs. */
+/** Every part a check can have. */
 export const FULL_PARTS = CHECK_PARTS;
+/** Changes no test reads: the plane's copy of scripts/release-check.mjs NOTHING (check-report.test.ts holds them equal). */
+export const NOTHING_PATHS = Object.freeze([/\.md$/, /^docs\//, /^evidence\//, /^design\//, /^output\//, /^LICENSE$/, /\.png$/]);
+/** Model-facing code, whose change runs the real-model journeys: the plane's copy of scripts/release-check.mjs MODEL. */
+export const MODEL_PATHS = Object.freeze([
+    /^src\/(lead|converse|subscription-chat|chat-[a-z-]+|lead-[a-z-]+|memory-pass)\.ts$/,
+    /^src\/(planner|planner-[a-z-]+|plan|builder|build-review|reviewer|scout|scout-[a-z-]+|decision|evidence)\.ts$/,
+    /^src\/(subagents|subagent-work|task-sizing|flow-sort|flow-draft)\.ts$/,
+    /^src\/(provider|provider-[a-z-]+|invoke|exec|attest|coding-provider|assignment-adapters|subscription-[a-z-]+)\.ts$/,
+]);
+/** Whether a changed path can affect an upgrade: the plane's copy of scripts/release-check.mjs needsUpgrade, without its
+ * version-only exception (the plane counts a version bump as a change, so it owes more, never less). */
+export function upgradeRelevant(file) {
+    if (/^(docs|evidence|design|output)\//.test(file) || /\.md$/.test(file) || file === "LICENSE")
+        return false;
+    if (/\.test\.[cm]?[jt]sx?$/.test(file) || /^test\//.test(file))
+        return false;
+    if (/^src\/(browser|design)\//.test(file) || /\.css$/.test(file))
+        return false;
+    if (/^scripts\/(app-e2e|flows-e2e|e2e-parallel)\.mjs$/.test(file))
+        return false;
+    return true;
+}
+/** The paths that differ between two verified trees: added, removed, or with another mode or blob. */
+export function changedPaths(facts, base) {
+    const before = new Map(base.entries.map(one => [one.path, `${one.mode} ${one.id}`]));
+    const after = new Map(facts.entries.map(one => [one.path, `${one.mode} ${one.id}`]));
+    return [...new Set([...before.keys(), ...after.keys()])].filter(path => before.get(path) !== after.get(path)).sort();
+}
+/**
+ * The parts a Full check owes, decided by the plane before it runs (eval-harness review 1, finding 2), never by the
+ * check's own report: the typecheck and the build always; the unit suite when anything a test reads changed since
+ * `base` (the plane's own record of the last release, both trees verified here) and the tree has unit files; the
+ * scripted journeys likewise when the tree has the journey scripts; the real-model journeys when model-facing code
+ * changed; the upgrade path when a change can affect an upgrade and the tree has it. With no base every one the tree
+ * can run is owed. The check is told these on its handshake and runs at least them.
+ */
+export function fullObligationsOf(facts, base) {
+    // What the tree can run is read from the candidate AND the last release (security scan): a candidate that deletes a
+    // journey script, the upgrade path or its unit files doesn't take away what was owed at the base — the part stays
+    // owed, and a check that can't run it has no result. Any entry counts, a symlink included, never only a regular file.
+    const trees = [facts, ...(base === null ? [] : [base])];
+    const has = (path) => trees.some(tree => tree.entries.some(one => one.path === path));
+    const units = trees.some(tree => tree.units.length > 0 || tree.entries.some(one => isUnitFile(one.path)));
+    const journeys = has("scripts/flows-e2e.mjs") || has("scripts/app-e2e.mjs");
+    const changed = base === null ? null : changedPaths(facts, base);
+    const code = changed?.filter(path => !NOTHING_PATHS.some(re => re.test(path))) ?? null;
+    const checks = code === null || code.length > 0;
+    const real = code === null || code.some(path => !/\.test\.[cm]?[jt]s$/.test(path) && MODEL_PATHS.some(re => re.test(path)));
+    const upgrade = has("scripts/upgrade-path.mjs") && (changed === null || changed.some(upgradeRelevant));
+    return [
+        "typecheck", "build",
+        ...(checks && units ? ["unit"] : []),
+        ...(checks && journeys ? ["flows", "app"] : []),
+        ...(real && journeys ? ["flows-real", "app-real"] : []),
+        ...(upgrade ? ["upgrade"] : []),
+    ];
+}
 /** What a check must account for, sealed before it runs: every unit file of the tree, whatever runs (a targeted
- * check accounts for the rest through its base), and the parts it selects. */
-export function inventoryOf(facts, plan) {
-    return { version: 1, units: facts.units, parts: plan === null ? [...FULL_PARTS] : ["typecheck", "build", ...plan.parts.filter(one => one !== "typecheck" && one !== "build")] };
+ * check accounts for the rest through its base), and the parts it owes (a full check's from fullObligationsOf), and
+ * whether CI may stand in for its unit suite. */
+export function inventoryOf(facts, plan, full = { owed: FULL_PARTS, release: true }) {
+    if (plan !== null)
+        return { version: 1, units: facts.units, parts: ["typecheck", "build", ...plan.parts.filter(one => one !== "typecheck" && one !== "build")] };
+    return { version: 1, units: facts.units, parts: [...full.owed], ciSubstitute: !full.release, release: full.release };
+}
+/** A Full check's preparation refused (eval-harness review 2, finding 4): the plane recorded a release whose commit it
+ * can't verify now, so the check's obligations can't be decided. The check isn't run (builder.ts: `baseline-unverifiable`). */
+export class CheckBaselineUnverifiable extends Error {
 }
 /**
  * Seal a check's attempt row before its command is spawned: intended mode, nonce hash, inventory and context (and for a
  * targeted check its plan and obligation snapshot, sealed as artifacts first). Null when the plane can't read the
- * commit, which leaves the check running exactly as it always has, with no handshake.
+ * commit, which leaves the check running exactly as it always has, with no handshake. Throws CheckBaselineUnverifiable,
+ * having sealed nothing, when a recorded last release can't be verified.
  */
 export function prepareCheckAttempt(store, root, input, now) {
     if (checkAttemptOf(store, input.runId) !== null)
@@ -113,7 +183,22 @@ export function prepareCheckAttempt(store, root, input, now) {
     if (!read.ok)
         return null;
     const plan = input.plan ?? null, snapshot = input.snapshot ?? null;
-    const inventory = inventoryOf(read.facts, plan);
+    // A full check owes what the plane decides here, from the last release it recorded (never a tag the checkout holds).
+    // No release recorded owes everything the candidate can run; a recorded one that can't be verified refuses the
+    // preparation (eval-harness review 2, finding 4): read as "no release", it would drop what the last release could run.
+    const baseline = plan === null ? releaseBaselineRecord(store, input.repo) : { recorded: false };
+    let baseFacts = null;
+    if (baseline.recorded) {
+        const baseRead = baseline.sha === null ? null : treeFactsOf(gitDir, baseline.sha);
+        if (baseRead === null || !baseRead.ok) {
+            throw new CheckBaselineUnverifiable(`The last release Toolroll recorded (${baseline.sha === null ? "its merge commit isn't a full id" : baseline.sha.slice(0, 7)}) couldn't be verified${baseRead !== null && !baseRead.ok ? ` (${baseRead.problem})` : ""}, so what this check owes is unknown; it wasn't run.`);
+        }
+        baseFacts = baseRead.facts;
+    }
+    const owed = fullObligationsOf(read.facts, baseFacts);
+    const release = input.release !== false;
+    const ciSubstitute = !release;
+    const inventory = inventoryOf(read.facts, plan, { owed, release });
     const context = checkContextOf(read.facts, input.command, input.access);
     const nonce = randomBytes(32).toString("hex");
     const mode = plan === null ? "full" : "targeted";
@@ -128,7 +213,7 @@ export function prepareCheckAttempt(store, root, input, now) {
         inventoryDigest: payloadDigest(inventory), contextDigest: payloadDigest(context), nonceHash: sha256(nonce),
     }, now);
     // The command's own limit rides along, so the check ends itself (logs and report printed) before the plane stops it.
-    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])], limitMs: input.command.timeoutMs });
+    const stdin = JSON.stringify({ nonce, mode, plan, watch: [...(input.watch ?? [])], limitMs: input.command.timeoutMs, ...(plan === null ? { owed, ciSubstitute } : {}) });
     return { runId: input.runId, nonce, stdin, mode, inventory, context, plan, snapshot, watch: [...(input.watch ?? [])] };
 }
 /** Seal one JSON payload as a structured-output artifact under its capture label. */
@@ -203,3 +288,103 @@ export function readSealedJson(store, root, runId, capture) {
         return null;
     }
 }
+/**
+ * Why a Full release check has no result it can count — or null when it qualifies as one. The plane's own facts are the
+ * exit it saw (`exitCode`, null when the check didn't exit on its own: timed out or stopped) and the inventory it sealed
+ * before the check ran; the report must agree with both. A failed check (a nonzero exit) needs only a valid report: what
+ * it failed on is its result. A passing exit needs every obligation the plane sealed (the inventory's parts, never the
+ * report's own "selected") to have an outcome, and every part the report ran too: every part once, each run to its
+ * end; the unit suite finished with a result for every sealed unit file (CI stands in only when the sealed plan allowed
+ * it); every journey run finished, its groups listed before they ran, each passed group with a journey result; and the
+ * upgrade path finished, its versions listed, every one run. An explicitly empty inventory (no groups of that kind) is
+ * an outcome; a missing one is not. Missing, malformed, truncated or skipped-required results never read as a pass.
+ */
+export function fullCheckProblem(input) {
+    const { report, inventory, exitCode } = input;
+    if (exitCode === null)
+        return "the check didn't end on its own (it timed out or was stopped), so it has no result";
+    if (report === null)
+        return "the check gave no valid report for this run (none, a malformed or cut-short one, or one without this run's nonce)";
+    if (report.mode !== "full")
+        return "the check reported a targeted run, not the full one it was asked for";
+    if (report.exitCode !== exitCode)
+        return `the check's report says exit ${report.exitCode}, but it exited ${exitCode}`;
+    if (inventory === null)
+        return "the check's sealed inventory can't be read";
+    // Sealed before it ran as a release's check, or it isn't one this can count (security scan: the decision is recorded
+    // with the attempt and a mismatch is no result).
+    if (inventory.sealed.release !== true)
+        return "the check wasn't sealed as a release's check before it ran";
+    if (exitCode !== 0)
+        return null;
+    const parts = new Map(report.parts.map(one => [one.part, one]));
+    if (parts.size !== report.parts.length || CHECK_PARTS.some(part => !parts.has(part)))
+        return "the report doesn't account for every part of the check exactly once";
+    // The obligations are the plane's, sealed before the run: the typecheck and build always, and every part it owed.
+    const owed = new Set(["typecheck", "build", ...inventory.sealed.parts]);
+    for (const part of CHECK_PARTS)
+        if (owed.has(part) && parts.get(part).selected !== true)
+            return `the report says the ${part} wasn't selected, but the check owed it`;
+    for (const part of report.parts) {
+        if (!part.selected)
+            continue;
+        if (!part.ran || part.code === null)
+            return `${part.part} has no result: it was selected and never ran`;
+        if (part.timedOut || part.stopped === true || part.signal != null)
+            return `${part.part} has no result: it was stopped before it finished`;
+        if (part.code !== 0)
+            return `${part.part} exited ${part.code}, yet the check exited 0`;
+    }
+    if (parts.get("unit").selected) {
+        const units = report.units;
+        if (units === null)
+            return "the unit suite reported nothing";
+        if (!units.finished)
+            return "the unit suite didn't reach its end";
+        if (units.runErrors > 0)
+            return `the unit suite had ${units.runErrors} errors no test owned`;
+        if (units.files.some(one => one.state === "failed"))
+            return "a unit file failed, yet the check exited 0";
+        // A release's check runs its own units, whatever was sealed (security scan): CI never stands in here.
+        if (units.reusedFromCI)
+            return "CI's run stood in for the unit suite, which a release's check never allows";
+        if (!units.reusedFromCI) {
+            const reported = new Set(units.files.map(one => one.file));
+            const missing = inventory.sealed.units.filter(file => !reported.has(file));
+            if (missing.length > 0)
+                return `${missing.length} unit file${missing.length === 1 ? " has" : "s have"} no result (${missing.slice(0, 3).join(", ")}${missing.length > 3 ? ", …" : ""})`;
+        }
+    }
+    for (const label of ["flows", "app", "flows-real", "app-real"]) {
+        if (!parts.get(label).selected)
+            continue;
+        const script = label.replace(/-real$/, ""), kind = label.endsWith("-real") ? "real" : "scripted";
+        const runs = report.journeys.filter(one => one.script === script && one.kind === kind);
+        if (runs.length === 0)
+            return `the ${label} journeys reported nothing`;
+        if (runs.length > 1)
+            return `the ${label} journeys reported more than one run`;
+        const run = runs[0];
+        if (!run.finished)
+            return `the ${label} journeys didn't reach their end`;
+        if (run.inventoried !== true)
+            return `the ${label} journeys never listed their groups, so what they owed can't be told`;
+        const open = run.groups.filter(group => group.state !== "passed");
+        if (open.length > 0)
+            return `the ${label} journey group ${open[0].group} ${open[0].state === "not-run" ? "never ran" : "failed"}, yet the check exited 0`;
+        const unread = run.groups.find(group => group.unattributed || !group.journeys.some(one => one.state === "passed"));
+        if (unread !== undefined)
+            return `the ${label} journey group ${unread.group} reported no journey's result`;
+    }
+    if (parts.get("upgrade").selected) {
+        const upgrades = report.upgrades;
+        if (upgrades === null || !upgrades.finished)
+            return "the upgrade path didn't reach its end";
+        if (upgrades.inventoried !== true)
+            return "the upgrade path never listed its versions, so what it owed can't be told";
+        const open = upgrades.versions.filter(one => one.state !== "passed");
+        if (open.length > 0)
+            return `the upgrade from ${open[0].version} ${open[0].state === "not-run" ? "never ran" : "failed"}, yet the check exited 0`;
+    }
+    return null;
+}

package/dist/checkout-cleanup.js

@@ -21,7 +21,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { taskBranches } from "./names.js";
 import { COMPLETION_ACTION } from "./result-completion.js";
-import { CLEANUP_CHOICES, bytesWords, diskBytes } from "./storage.js";
+import { CLEANUP_CHOICES, bytesWords, diskBytes, diskBytesAsync } from "./storage.js";
 import { worktreePath } from "./worktree.js";
 const DAY_MS = 86_400_000;
 /** A release candidate's checkout holds the build a deploy installs: the newest complete one waits at most a week for it. */
@@ -264,7 +264,7 @@ async function eachAtMost(items, limit, work) {
 export async function checkoutPlan(store, pool, now, options) {
     const cleanup = store.checkoutCleanup();
     const rows = store.listWorktrees().filter(row => existsSync(row.path) && (options.repo === undefined || row.repo === options.repo));
-    const sizes = diskBytes(rows.map(row => row.path));
+    const sizes = await diskBytesAsync(rows.map(row => row.path));
     const statuses = taskStatuses(store, now);
     const items = await eachAtMost(rows, INSPECT_AT_ONCE, async (row) => {
         const kept = keptFor(pool, row, statuses, now, options.manual ? "manual" : cleanup);

package/dist/cli.js

@@ -514,11 +514,13 @@ function renderMissingJson(roots, missingRoots, now) {
 async function runReposCommand(argv, write, onboard) {
     // `repos` honors the machine contract like everything else (audit TG-3):
     // --json answers with one envelope, whatever the outcome.
+    // The lead adds with its token (--token <t>, --token=<t> or TOOLROLL_LEAD_TOKEN); the owner needs none. A token is
+    // random base64url and may start with "--": it is the next argument, whatever it looks like.
+    const tokenAt = argv.findIndex(argument => argument === "--token" || argument.startsWith("--token="));
+    const tokenInline = tokenAt !== -1 && argv[tokenAt] !== "--token";
+    const tokenFlag = tokenAt === -1 ? undefined : tokenInline ? argv[tokenAt].slice("--token=".length) : argv[tokenAt + 1];
     const json = argv.includes("--json");
-    // The lead adds with its token (--token or TOOLROLL_LEAD_TOKEN); the owner needs none.
-    const tokenAt = argv.indexOf("--token");
-    const tokenFlag = tokenAt === -1 ? undefined : argv[tokenAt + 1];
-    const bare = argv.filter((argument, index) => argument !== "--json" && (tokenAt === -1 || (index !== tokenAt && index !== tokenAt + 1)));
+    const bare = argv.filter((argument, index) => argument !== "--json" && (tokenAt === -1 || (index !== tokenAt && (tokenInline || index !== tokenAt + 1))));
     const remoteAt = bare.indexOf("--remote");
     const remoteUrl = remoteAt === -1 ? undefined : bare[remoteAt + 1];
     const [action, ...paths] = bare.filter((_, i) => remoteAt === -1 || (i !== remoteAt && i !== remoteAt + 1));
@@ -529,7 +531,8 @@ async function runReposCommand(argv, write, onboard) {
     }
     const databaseFile = databasePath(process.env, homedir());
     const file = registryBeside(databaseFile);
-    if (tokenAt !== -1 && (tokenFlag === undefined || tokenFlag.startsWith("-"))) {
+    // A dash-led token is the token, unless it is exactly one of this command's flags (never swallowed).
+    if (tokenAt !== -1 && (tokenFlag === undefined || tokenFlag === "" || (!tokenInline && ["--json", "--remote", "--token"].includes(tokenFlag)))) {
         const message = "--token needs the lead token";
         write(json ? envelopeJson({ ok: false, command: `repos ${action ?? ""}`.trim(), reason: "usage", message }) : message);
         return USAGE_EXIT;

package/dist/coding-handoff.d.ts

@@ -17,6 +17,7 @@ type Handoff = {
     scopeDigest: string;
     receipt: CodingHandoffReceipt;
 };
+export declare function branchHead(repo: string, branch: string): string | null;
 export declare function codingHandoffPreview(store: Store, input: {
     sessionId: string;
     actor: string;

package/dist/coding-handoff.js

@@ -1,6 +1,5 @@
 /** A committed native session enters the existing review flow, never another executor. */
-import { checkoutGitSync } from './teardown-git.js';
-import { execFileSync } from 'node:child_process';
+import { checkoutGitSync, noLazyFetch, viewedGitSync } from './teardown-git.js';
 import { lstatSync, realpathSync } from 'node:fs';
 import { sqliteRuntime } from './sqlite-runtime.js';
 import { codingCatalogPath } from './coding-update.js';
@@ -57,21 +56,28 @@ function catalog(store, readOnly) {
 // checkout git, which the code page's GET preview also uses (docs/plans/get-side-effects.md).
 function git(repo, args) {
     try {
-        return checkoutGitSync(repo, ['--no-replace-objects', '--no-lazy-fetch', ...args]).trimEnd();
+        return checkoutGitSync(repo, ['--no-replace-objects', ...noLazyFetch(), ...args]).trimEnd();
     }
     catch {
         throw Error('The committed coding result could not be verified in Git. Check the project and try again.');
     }
 }
-function branchHead(repo, branch) {
+// The project's repository is shared with every build (its config, includes): read through the frozen, bounded view
+// (eval-harness review 2, finding 6), and never inside a database transaction.
+export function branchHead(repo, branch) {
+    let ran;
     try {
-        return execFileSync('git', ['--no-optional-locks', '--no-replace-objects', '-C', repo, 'rev-parse', '--verify', '--quiet', `refs/heads/${branch}`], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+        ran = viewedGitSync(repo, ['--no-replace-objects', ...noLazyFetch(), 'rev-parse', '--verify', '--quiet', `refs/heads/${branch}`], { timeoutMs: 30_000 });
     }
-    catch (error) {
-        if (error.status === 1)
-            return null;
+    catch {
         throw Error('The review branch could not be inspected.');
     }
+    if (ran.status === 1)
+        return null;
+    const head = ran.stdout.trim();
+    if (ran.status !== 0 || !/^[0-9a-f]{40}([0-9a-f]{24})?$/.test(head))
+        throw Error('The review branch could not be inspected.');
+    return head;
 }
 function actorGeneration(store, actor, repo) {
     const account = store.accountOf(actor);
@@ -200,6 +206,8 @@ export function createCodingHandoff(store, input) {
         const receipt = makeReceipt({ ...shown, version: 1, identity: learningIdentity(input.repo), actor: input.actor,
             generation: actorGeneration(store, input.actor, input.repo), title: input.title.trim(), goal: input.goal.trim(), acceptance: parsed.criteria, outOfScope: EXCLUSIONS });
         const payload = JSON.stringify(receipt), sha = learningSha(payload);
+        // Git is read before the reservation's transaction, never inside it (review 2, finding 6).
+        const before = branchHead(input.repo, receipt.branch);
         db.exec('BEGIN IMMEDIATE');
         let reserved = false;
         try {
@@ -210,7 +218,7 @@ export function createCodingHandoff(store, input) {
                 reserved = true;
             }
             else {
-                if (store.lookupRef(receipt.taskId) || branchHead(input.repo, receipt.branch) !== null)
+                if (store.lookupRef(receipt.taskId) || before !== null)
                     throw Error('The review task or branch already exists. It has been preserved.');
                 db.prepare('INSERT INTO coding_handoff VALUES(?,?,?,?)').run(receipt.id, payload, sha, new Date().toISOString());
             }
@@ -239,11 +247,12 @@ export function createCodingHandoff(store, input) {
         // No checked-out/leased branch is adopted, even if its HEAD happens to match.
         if (git(input.repo, ['worktree', 'list', '--porcelain']).split('\n').includes(`branch refs/heads/${receipt.branch}`))
             throw Error('The review branch is already checked out. Its work has been preserved.');
+        // The branch, read last before filing and outside the transaction: a database transaction never holds a git ref still.
+        if (branchHead(input.repo, receipt.branch) !== receipt.base)
+            throw Error('The review branch moved before filing. Its work has been preserved.');
         return store.transact(() => {
             if (actorGeneration(store, input.actor, input.repo) !== receipt.generation)
                 throw Error('Your account changed. Sign in again.');
-            if (branchHead(input.repo, receipt.branch) !== receipt.base)
-                throw Error('The review branch moved before filing. Its work has been preserved.');
             const made = fileTaskProposal(store, { id: receipt.taskId, title: receipt.title, repo: receipt.repo, goal: receipt.goal,
                 outOfScope: receipt.outOfScope, acceptance: receipt.acceptance, filedVia: PREFIX + receipt.id, filedBy: { name: input.actor, kind: "person" }, planning: 'skip', admittedRepos: [receipt.repo] }, new Date());
             if (!made.ok)

package/dist/coding-workspace.js

@@ -400,8 +400,10 @@ export class CodingWorkspace {
                 }, 50);
         }
     }
-    async git(repo, args) {
-        const result = await run('git', ['--no-optional-locks', '-c', 'core.hooksPath=/dev/null', ...args], { cwd: repo, timeoutMs: 60_000, maxBuffer: 1_048_576 });
+    async git(repo, args, project = repo) {
+        // The project's repository and the session's checkout are agent-written: the hardened git, against a frozen view of
+        // the repository's config and info (teardown-git.ts checkoutGit).
+        const result = await checkoutGit(run, 'build', { repo: project })('git', ['--no-optional-locks', ...args], { cwd: repo, timeoutMs: 60_000, maxBuffer: 1_048_576 });
         if (result.code !== 0)
             throw Error('Git could not complete this workspace operation. Check the repository and try again.');
         return result.stdout;
@@ -520,13 +522,13 @@ export class CodingWorkspace {
     }
     async verifyWorktree(session) {
         const [branch, common, original] = await Promise.all([
-            this.git(session.worktree, ['symbolic-ref', '--short', 'HEAD']),
-            this.git(session.worktree, ['rev-parse', '--path-format=absolute', '--git-common-dir']),
+            this.git(session.worktree, ['symbolic-ref', '--short', 'HEAD'], session.repo),
+            this.git(session.worktree, ['rev-parse', '--path-format=absolute', '--git-common-dir'], session.repo),
             this.git(session.repo, ['rev-parse', '--path-format=absolute', '--git-common-dir']),
         ]);
         if (branch.trim() !== session.branch || realpathSync(common.trim()) !== realpathSync(original.trim()))
             throw Error('This checkout no longer matches the saved project and branch. Restore that checkout before resuming.');
-        await this.git(session.worktree, ['merge-base', '--is-ancestor', session.base, 'HEAD']);
+        await this.git(session.worktree, ['merge-base', '--is-ancestor', session.base, 'HEAD'], session.repo);
     }
     priorProcessesGone() {
         const row = this.db.prepare('SELECT payload FROM coding_custody WHERE singleton=1').get();

package/dist/commit-extract.d.ts

@@ -25,6 +25,12 @@ type TreeEntry = {
 };
 /** A tree object's entries, parsed from its verified bytes: `<mode> <name>\0<raw id>` each. Null when malformed. */
 export declare function parseTree(bytes: Buffer, idBytes: number): TreeEntry[] | null;
+/**
+ * Why a commit's file paths can't all be written as separate regular files, or null: a `.git` part, a path twice, two
+ * paths that are one on a case-insensitive or Unicode-normalizing file system (macOS), or a path that is both a file
+ * and a folder. scripts/deploy-git.mjs writtenPathsProblem keeps the same rules (held equal by test).
+ */
+export declare function writtenPathsProblem(paths: readonly string[]): string | null;
 /** Write commit `sha` of the repository whose Git directory is `gitDir` (a realpath Toolroll took from its own
  * records) into `dest`, an empty folder this process made. Every object on the way — the commit, each tree, each
  * blob — is hashed here and must be the id that names it: Git's own answer about an id is never taken on trust, so a

package/dist/commit-extract.js

@@ -10,12 +10,10 @@
  * files are written (mode 644, or 755 when the tree says executable), each at a normalized path inside the folder;
  * symlinks, submodules and any other entry refuse the whole extraction.
  */
-import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, realpathSync, writeFileSync } from "node:fs";
-import { join, sep } from "node:path";
-import { checkoutGitEnv, HARDENED_GIT_ARGS } from "./agent-fence.js";
-import { commandSetting } from "./teardown-git.js";
+import { basename, dirname, join, sep } from "node:path";
+import { commandSetting, viewedGitSync } from "./teardown-git.js";
 const MAX_BYTES = 1024 * 1024 * 1024;
 export const EXTRACTION_LIMITS = Object.freeze({ bytes: MAX_BYTES, files: 50_000, entries: 200_000, depth: 64 });
 /** A tree path that stays where it says: relative, no empty, `.` or `..` part, no backslash or control character. */
@@ -39,16 +37,45 @@ export function parseTree(bytes, idBytes) {
     }
     return entries;
 }
+/**
+ * Why a commit's file paths can't all be written as separate regular files, or null: a `.git` part, a path twice, two
+ * paths that are one on a case-insensitive or Unicode-normalizing file system (macOS), or a path that is both a file
+ * and a folder. scripts/deploy-git.mjs writtenPathsProblem keeps the same rules (held equal by test).
+ */
+export function writtenPathsProblem(paths) {
+    const folded = new Map();
+    for (const path of paths) {
+        if (!normalizedTreePath(path))
+            return `${JSON.stringify(path)} isn't a plain relative path`;
+        if (path.split("/").some(part => part.toLowerCase() === ".git"))
+            return `${path} names a .git folder`;
+        const key = path.normalize("NFC").toLowerCase();
+        const known = folded.get(key);
+        if (known !== undefined)
+            return known === path ? `${path} is listed twice` : `${path} and ${known} are the same file on this computer`;
+        folded.set(key, path);
+    }
+    for (const key of folded.keys()) {
+        const parts = key.split("/");
+        for (let at = 1; at < parts.length; at++) {
+            const folder = parts.slice(0, at).join("/");
+            if (folded.has(folder))
+                return `${folded.get(folder)} is both a file and a folder`;
+        }
+    }
+    return null;
+}
 /** Write commit `sha` of the repository whose Git directory is `gitDir` (a realpath Toolroll took from its own
  * records) into `dest`, an empty folder this process made. Every object on the way — the commit, each tree, each
  * blob — is hashed here and must be the id that names it: Git's own answer about an id is never taken on trust, so a
  * corrupted or replaced object in a store a build could write to refuses the extraction. */
 export function extractCommit(gitDir, sha, dest, limits = EXTRACTION_LIMITS) {
     const refuse = (message) => ({ ok: false, message });
-    const env = { ...checkoutGitEnv(), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
-    const git = (args, input) => spawnSync("git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, ...args], { env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
+    const git = protectedGit(gitDir, {}, []);
     // The repository's own config, read without includes, must name no command and include nothing.
     const config = git(["config", "--list", "--no-includes", "--show-scope", "-z"]);
+    if (config.refused !== null)
+        return refuse(`The project's Git directory can't be read safely: ${config.refused}.`);
     if (config.status !== 0)
         return refuse("The project's Git config couldn't be read.");
     const listing = config.stdout.toString("utf8");
@@ -137,6 +164,9 @@ export function extractCommit(gitDir, sha, dest, limits = EXTRACTION_LIMITS) {
     }
     if (files.length === 0)
         return refuse(`The commit ${sha.slice(0, 7)} holds no files.`);
+    const clash = writtenPathsProblem(files.map(one => one.path));
+    if (clash !== null)
+        return refuse(`The commit's files can't be written: ${clash}.`);
     const blobs = read([...new Set(files.map(one => one.id))]);
     if (typeof blobs === "string")
         return refuse(`The approved commit couldn't be verified: ${blobs}.`);
@@ -166,12 +196,35 @@ export function extractCommit(gitDir, sha, dest, limits = EXTRACTION_LIMITS) {
     }
     return { ok: true, files: files.length };
 }
+/**
+ * How the protected readers run git on the project's Git directory (eval-harness review 1, finding 5): never a fetch.
+ * Every command, on every git version, runs through a frozen view of the repository (teardown-git.ts viewedGitSync,
+ * findings 5 and 7): its config read once into a folder of the plane's own and inspected there — an include, a key that
+ * names a command, every `protocol.*` key and (on a git without `--no-lazy-fetch`) a partial clone refused — which is
+ * the config git then runs with, bounded in time. Every run also denies every transport (`protocol.allow=never`) and,
+ * on git 2.45+, takes `--no-lazy-fetch`; nothing leans on GIT_NO_LAZY_FETCH, which 2.41.0 ignores.
+ */
+function protectedGit(gitDir, runner, extra) {
+    const base = ["--no-replace-objects", "-c", "protocol.allow=never", ...extra];
+    // The view is of a checkout: the project's own `.git` folder, as Toolroll records it.
+    const checkout = basename(gitDir) === ".git" ? dirname(gitDir) : null;
+    return (args, input) => {
+        if (checkout === null)
+            return { status: null, stdout: Buffer.alloc(0), refused: "it isn't a checkout's .git folder, which this git can only read through a view" };
+        try {
+            const ran = viewedGitSync(checkout, [...base, ...args], { buffer: true, timeoutMs: 300_000, maxBuffer: MAX_BYTES, ...(input === undefined ? {} : { input }), ...(runner.git === undefined ? {} : { git: runner.git }) });
+            return { status: ran.status, stdout: ran.stdout, refused: null };
+        }
+        catch (error) {
+            return { status: null, stdout: Buffer.alloc(0), refused: error instanceof Error ? error.message : "it couldn't be read" };
+        }
+    };
+}
 /** A reader over the project's object store that hashes every object it hands back, or why it can't be one. */
 function verifiedReader(gitDir, runner = {}) {
     const refuse = (message) => ({ ok: false, message });
-    const env = { ...(runner.env ?? checkoutGitEnv()), GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_GLOBAL: "/dev/null", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_ATTR_NOSYSTEM: "1" };
     // The commit-graph file is a cache a build can write: parents come from the objects themselves, never from it.
-    const git = (args, input) => spawnSync(runner.git ?? "git", ["--git-dir", gitDir, "--no-replace-objects", ...HARDENED_GIT_ARGS, "-c", "core.commitGraph=false", ...args], { cwd: "/", env, input, maxBuffer: MAX_BYTES, timeout: 300_000 });
+    const git = protectedGit(gitDir, runner, ["-c", "core.commitGraph=false"]);
     // History a build could have rewritten around the objects: a shallow boundary, grafts, or replacement refs. Each is
     // refused outright, so no reader here ever has to decide whether to believe one.
     if (existsSync(join(gitDir, "shallow")))
@@ -179,6 +232,8 @@ function verifiedReader(gitDir, runner = {}) {
     if (existsSync(join(gitDir, "info", "grafts")))
         return refuse("The project's Git directory has grafts, which rewrite history; they are refused.");
     const replaced = git(["for-each-ref", "--format=%(refname)", "refs/replace/"]);
+    if (replaced.refused !== null)
+        return refuse(`The project's Git directory can't be read safely: ${replaced.refused}.`);
     if (replaced.status !== 0)
         return refuse("The project's refs couldn't be read.");
     if (replaced.stdout.toString("utf8").trim() !== "")

package/dist/console-chrome.d.ts

@@ -0,0 +1,41 @@
+import { type BrowserProjectState } from "./browser-workspace.js";
+import type { Store } from "./store.js";
+import { type WorkIndexOptions } from "./work-index.js";
+import type { WorkSummaryAccess } from "./work-summary.js";
+import type { WorkspaceRevision } from "./workspace-revision.js";
+export type SidebarProject = {
+    path: string;
+    name: string;
+};
+/** The sidebar's projects with their states (agent-state.ts) for one reader: the page's first read and the summary
+ * room's snapshots are this one function, so the two never disagree. Never marks anything seen. Work with no project
+ * yet is its own entry when this reader may see it and something counts there. */
+export declare function projectSummaryOf(store: Store, now: Date, access: WorkSummaryAccess, actor: string, projects: readonly SidebarProject[], evidenceRoot: string | undefined): BrowserProjectState[];
+/** One access, canonically and in full (every field it has, so a field added later keys too): the same reader and
+ * scope always spell the same key, whatever order its projects came in. */
+export declare function accessKey(access: WorkSummaryAccess): string;
+/**
+ * Values read from the database, each kept while the workspace revision (workspace-revision.ts: every meaningful
+ * commit, from any process, moves it) is the one it was read at, and never past the revision's own clock boundary
+ * (a lease or liveness window ending) or `maxAgeMs`, whichever is first — time alone (an agent going quiet) shows
+ * within that bound. A value is stored under the revision read before it was computed, so a commit that lands while it
+ * is computed only makes it miss sooner. Callers must not change a value they were handed.
+ */
+export declare class RevisionCache {
+    #private;
+    constructor(revision: WorkspaceRevision, clock: () => Date, options?: {
+        maxEntries?: number;
+        maxAgeMs?: number;
+    });
+    /** The value for `key` at the current revision, or undefined. */
+    peek<T>(key: string): T | undefined;
+    /** The cached value, or `compute()` now (stored for the next reader). Errors are never cached. */
+    read<T>(key: string, compute: () => T): T;
+    /** The cached value, or one read asynchronously (a read worker) and stored. A failure answers undefined and leaves
+     * the key empty, so the request thread computes it as before. */
+    fill<T>(key: string, compute: () => Promise<T>): Promise<T | undefined>;
+}
+/** The keys the console's chrome reads are kept under (serve.ts and its read-worker prefetch spell them the same). */
+export declare const countsKey: (access: WorkSummaryAccess) => string;
+export declare const summaryKey: (actor: string, access: WorkSummaryAccess, projects: readonly SidebarProject[]) => string;
+export declare const indexKey: (access: WorkSummaryAccess, options: WorkIndexOptions) => string;