toolroll 0.9.75 → 0.9.77

package/dist/console-chrome.js

@@ -0,0 +1,166 @@
+/**
+ * The console's shared chrome (the sidebar's project states, the Tasks count, the crew list): computed at most once
+ * per workspace revision for one reader's exact access, and readable on a read worker (read-executor.ts) as well as on
+ * the request thread. Cache metadata only: nothing here grants access. Every entry's key carries every authorization
+ * input its computation reads (the reader, their admitted projects, whether they see unplaced work, the projects their
+ * sidebar may list), so a value read for one scope is never served to another.
+ */
+import { createHash } from "node:crypto";
+import { NO_COUNTS, projectStates, STATE_WORDS } from "./agent-state.js";
+import { boundProjectSummary } from "./browser-workspace.js";
+import { WORK_INDEX_MAX_LIMIT, workIndexPage } from "./work-index.js";
+/** Tasks the rail lists under a project; the rest are a count that links to the project's tasks. */
+const RAIL_TASKS = 6;
+/** Asks a project names for the chime (its count is complete beyond them). */
+const ASKS_PER_PROJECT = 100;
+/** The sidebar's projects with their states (agent-state.ts) for one reader: the page's first read and the summary
+ * room's snapshots are this one function, so the two never disagree. Never marks anything seen. Work with no project
+ * yet is its own entry when this reader may see it and something counts there. */
+export function projectSummaryOf(store, now, access, actor, projects, evidenceRoot) {
+    const states = new Map(projectStates(store, access, actor, now, evidenceRoot, projects.map(one => one.path)).map(one => [one.repo, one]));
+    // A row that needs a person or failed says what the Tasks list says it needs (its own next step); a row at work says
+    // what its agent did last; a finished one says Done.
+    const asking = [...states.values()].flatMap(one => one.families.slice(0, RAIL_TASKS)).filter(one => one.state === "needs-you" || one.state === "failed").map(one => one.rootId);
+    const needWords = new Map();
+    if (asking.length > 0) {
+        try {
+            // Every row the rail may list, in pages the index allows.
+            for (let at = 0; at < asking.length; at += WORK_INDEX_MAX_LIMIT)
+                for (const item of workIndexPage(store, now, access, { roots: asking.slice(at, at + WORK_INDEX_MAX_LIMIT), limit: WORK_INDEX_MAX_LIMIT, ...(evidenceRoot === undefined ? {} : { root: evidenceRoot }) }).items)
+                    needWords.set(item.rootId, item.status.detail !== "" ? item.status.detail : item.status.label);
+        }
+        catch { /* the rows keep their state's words */ }
+    }
+    // The chime's subjects: an opaque key per obligation and version, scoped to this reader (no words, no ids in it).
+    const keyOf = (...parts) => createHash("sha256").update([actor, ...parts].join("\u0000")).digest("base64url").slice(0, 22);
+    // Newest first, so a new ask always has a key however many older ones wait (those were heard when they were new).
+    const asksOf = (state) => [
+        ...(state?.families ?? []).flatMap(one => one.ask === undefined ? [] : [{ at: one.ask.at, ask: { key: keyOf("task", one.rootId, one.ask.version), task: one.rootId, run: one.ask.run, at: one.ask.at } }]),
+        ...(state?.flowAsks ?? []).map(one => ({ at: one.at, ask: { key: keyOf("flow", one.card, one.stage, one.entry), task: null, run: null, at: one.at } })),
+    ].sort((a, b) => b.at.localeCompare(a.at)).slice(0, ASKS_PER_PROJECT).map(one => one.ask);
+    const railOf = (state) => {
+        const families = state?.families ?? [];
+        const tasks = families.slice(0, RAIL_TASKS).flatMap((one) => {
+            const task = store.getTask(one.rootId);
+            const line = one.state === "needs-you" || one.state === "failed" ? needWords.get(one.rootId) ?? null : one.line;
+            return task === null ? [] : [{ id: one.rootId, title: task.title, href: `/t/${encodeURIComponent(one.rootId)}`, state: one.state, line: line ?? STATE_WORDS[one.state] }];
+        });
+        return { tasks, more: Math.max(0, families.length - RAIL_TASKS), asks: asksOf(state) };
+    };
+    const rows = projects.map(one => {
+        const state = states.get(one.path);
+        return { path: one.path, name: one.name, href: `/work?project=${encodeURIComponent(one.path)}`, state: state?.state ?? "idle", counts: state?.counts ?? { ...NO_COUNTS }, ...railOf(state) };
+    });
+    const unplaced = states.get(null);
+    if (unplaced !== undefined && unplaced.state !== "idle")
+        rows.push({ path: null, name: "No project", href: "/work", state: unplaced.state, counts: unplaced.counts, ...railOf(unplaced) });
+    return boundProjectSummary(rows);
+}
+/** One access, canonically and in full (every field it has, so a field added later keys too): the same reader and
+ * scope always spell the same key, whatever order its projects came in. */
+export function accessKey(access) {
+    const record = access;
+    return JSON.stringify(Object.keys(record).sort().map(name => {
+        const value = record[name];
+        return [name, Array.isArray(value) ? [...new Set(value.map(String))].sort() : value === undefined ? null : value];
+    }));
+}
+/**
+ * Values read from the database, each kept while the workspace revision (workspace-revision.ts: every meaningful
+ * commit, from any process, moves it) is the one it was read at, and never past the revision's own clock boundary
+ * (a lease or liveness window ending) or `maxAgeMs`, whichever is first — time alone (an agent going quiet) shows
+ * within that bound. A value is stored under the revision read before it was computed, so a commit that lands while it
+ * is computed only makes it miss sooner. Callers must not change a value they were handed.
+ */
+export class RevisionCache {
+    #entries = new Map();
+    #revision;
+    #clock;
+    #maxEntries;
+    #maxAgeMs;
+    constructor(revision, clock, options = {}) {
+        this.#revision = revision;
+        this.#clock = clock;
+        this.#maxEntries = options.maxEntries ?? 128;
+        this.#maxAgeMs = options.maxAgeMs ?? 30_000;
+    }
+    /** The value for `key` at the current revision, or undefined. */
+    peek(key) {
+        const entry = this.#entries.get(key);
+        if (entry === undefined)
+            return undefined;
+        let revision;
+        try {
+            revision = this.#revision.current();
+        }
+        catch {
+            return undefined;
+        }
+        if (entry.revision !== revision || this.#clock().getTime() >= entry.expiresAt) {
+            this.#entries.delete(key);
+            return undefined;
+        }
+        return entry.value;
+    }
+    /** The cached value, or `compute()` now (stored for the next reader). Errors are never cached. */
+    read(key, compute) {
+        const hit = this.peek(key);
+        if (hit !== undefined)
+            return hit;
+        const started = this.#started();
+        const value = compute();
+        if (started !== null)
+            this.#store(key, started, value);
+        return value;
+    }
+    /** The cached value, or one read asynchronously (a read worker) and stored. A failure answers undefined and leaves
+     * the key empty, so the request thread computes it as before. */
+    async fill(key, compute) {
+        const hit = this.peek(key);
+        if (hit !== undefined)
+            return hit;
+        const started = this.#started();
+        if (started === null)
+            return undefined;
+        let value;
+        try {
+            value = await compute();
+        }
+        catch {
+            return undefined;
+        }
+        // A worker can finish after an approval changed or a lease expired. Its caller must not pin that old answer
+        // into a request even though the shared cache would reject it on the next lookup.
+        try {
+            if (this.#revision.current() !== started.revision || this.#clock().getTime() >= started.expiresAt)
+                return undefined;
+        }
+        catch {
+            return undefined;
+        }
+        this.#store(key, started, value);
+        return value;
+    }
+    #started() {
+        try {
+            const now = this.#clock();
+            return { revision: this.#revision.current(), expiresAt: Math.min(this.#revision.expiresAt(now), now.getTime() + this.#maxAgeMs) };
+        }
+        catch {
+            return null;
+        }
+    }
+    #store(key, started, value) {
+        this.#entries.delete(key);
+        if (this.#entries.size >= this.#maxEntries)
+            this.#entries.delete(this.#entries.keys().next().value);
+        this.#entries.set(key, { ...started, value });
+    }
+}
+/** The keys the console's chrome reads are kept under (serve.ts and its read-worker prefetch spell them the same). */
+export const countsKey = (access) => `counts\u0000${accessKey(access)}`;
+export const summaryKey = (actor, access, projects) => `summary\u0000${actor}\u0000${accessKey(access)}\u0000${JSON.stringify(projects.map(one => [one.path, one.name]))}`;
+export const indexKey = (access, options) => {
+    const record = options;
+    return `index\u0000${accessKey(access)}\u0000${JSON.stringify(Object.keys(record).sort().map(name => [name, record[name] ?? null]))}`;
+};

package/dist/contracts/console-api.d.ts

@@ -72,6 +72,7 @@ export declare const CONSOLE_FORMS: {
     readonly code: FormContract<"acceptance" | "answers" | "base" | "candidate" | "decision" | "goal" | "model" | "password" | "prompt" | "repo" | "requestId" | "title" | "visual" | `question:${string}`>;
     readonly sweep: FormContract<"confirm" | "snapshot">;
     readonly passwordless: FormContract<"action" | "password">;
+    readonly releaseApproval: FormContract<"action" | "password" | "repo">;
     readonly term: FormContract<"password" | "program" | "repo">;
     readonly skillsRevise: FormContract<"feedback" | "nonce" | "repo" | "run">;
     readonly skillsChange: FormContract<"action" | "content" | "files" | "identity" | "method" | "nonce" | "repo" | "restore" | "revision" | "sample" | "sha" | "url">;

package/dist/contracts/console-api.js

@@ -81,6 +81,7 @@ export const CONSOLE_FORMS = {
     code: formContract("POST /code, /code/start, /code/<session>/<act>, /code/<anything else>", ["repo", "password", "title", "model", "prompt", "requestId", "base", "candidate", "goal", "acceptance", "visual", "decision", "answers"], { prefixes: ["question:"] }),
     sweep: formContract("POST /sweeps/<sweep>/cancel-rest", ["confirm", "snapshot"]),
     passwordless: formContract("POST /settings/passwordless", ["action", "password"]),
+    releaseApproval: formContract("POST /settings/release-approval", ["repo", "action", "password"]),
     term: formContract("POST /term/start, /term/<terminal>/close, /term/<terminal>/remove", ["repo", "program", "password"]),
     skillsRevise: formContract("POST /settings/skills/revise", ["run", "repo", "feedback", "nonce"]),
     skillsChange: formContract("POST /settings/skills/import, /settings/skills/change", ["repo", "identity", "revision", "method", "content", "files", "url", "action", "sha", "sample", "nonce", "restore"]),

package/dist/contracts/release-check.d.ts

@@ -43,6 +43,10 @@ export declare const checkReportSchema: z.ZodObject<{
         ran: z.ZodBoolean;
         code: z.ZodNullable<z.ZodInt>;
         timedOut: z.ZodBoolean;
+        startedAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        signal: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        stopped: z.ZodOptional<z.ZodBoolean>;
+        spawnFailed: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     units: z.ZodNullable<z.ZodObject<{
         reusedFromCI: z.ZodBoolean;
@@ -81,6 +85,7 @@ export declare const checkReportSchema: z.ZodObject<{
             scripted: "scripted";
         }>;
         finished: z.ZodBoolean;
+        inventoried: z.ZodOptional<z.ZodBoolean>;
         groups: z.ZodArray<z.ZodObject<{
             group: z.ZodString;
             state: z.ZodEnum<{
@@ -102,6 +107,7 @@ export declare const checkReportSchema: z.ZodObject<{
     }, z.core.$strict>>;
     upgrades: z.ZodNullable<z.ZodObject<{
         finished: z.ZodBoolean;
+        inventoried: z.ZodOptional<z.ZodBoolean>;
         versions: z.ZodArray<z.ZodObject<{
             version: z.ZodString;
             state: z.ZodEnum<{
@@ -130,6 +136,8 @@ export declare const checkInventorySchema: z.ZodObject<{
         unit: "unit";
         upgrade: "upgrade";
     }>>;
+    ciSubstitute: z.ZodOptional<z.ZodBoolean>;
+    release: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export type CheckInventory = z.infer<typeof checkInventorySchema>;
 /** The sealed inventory artifact: what was sealed before the run, and what the run declared. */
@@ -148,6 +156,8 @@ export declare const sealedInventorySchema: z.ZodObject<{
             unit: "unit";
             upgrade: "upgrade";
         }>>;
+        ciSubstitute: z.ZodOptional<z.ZodBoolean>;
+        release: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>;
     declared: z.ZodObject<{
         groups: z.ZodArray<z.ZodObject<{
@@ -229,6 +239,8 @@ export type CheckHandshake = {
     mode: "full" | "targeted";
     plan: TargetedPlan | null;
     watch: string[];
+    owed?: CheckPart[];
+    ciSubstitute?: boolean;
 };
 /** A unit test: its file and full name. */
 export declare const unitIdentity: (file: string, testName: string) => string;

package/dist/contracts/release-check.js

@@ -38,6 +38,12 @@ export const checkReportSchema = versioned(1, {
         ran: z.boolean(),
         code: z.int().min(0).max(255).nullable(),
         timedOut: z.boolean(),
+        /** When it started, the signal that ended it, whether the check stopped it (another part's failure or the check's
+         * own limit) and whether it could start at all — each apart from its code. Absent from an older orchestrator. */
+        startedAt: z.string().max(40).nullable().optional(),
+        signal: z.string().max(20).nullable().optional(),
+        stopped: z.boolean().optional(),
+        spawnFailed: z.boolean().optional(),
     })).max(CHECK_PARTS.length),
     /** The unit suite, from the Vitest main process's fd-3 lines: every file's outcome, and the identities that failed,
      * were skipped, passed on a retry or were asked about. Null when the unit part didn't run. */
@@ -65,6 +71,9 @@ export const checkReportSchema = versioned(1, {
         script: z.enum(JOURNEY_SCRIPTS),
         kind: z.enum(["scripted", "real"]),
         finished: z.boolean(),
+        /** The runner listed its groups before any started (an empty list is an explicit "none of this kind"); absent or
+         * false, the run has no inventory and nothing it lacks can be told from nothing it owed. */
+        inventoried: z.boolean().optional(),
         groups: z.array(z.strictObject({
             group: groupName,
             state: z.enum(["passed", "failed", "not-run"]),
@@ -77,6 +86,8 @@ export const checkReportSchema = versioned(1, {
     })).max(4),
     upgrades: z.strictObject({
         finished: z.boolean(),
+        /** The upgrade path listed its versions before any ran. */
+        inventoried: z.boolean().optional(),
         versions: z.array(z.strictObject({ version: versionName, state: z.enum(["passed", "failed", "not-run"]) })).max(500),
     }).nullable(),
 });
@@ -88,7 +99,13 @@ export function readCheckReport(input) {
  * sealed beside these after it ran. */
 export const checkInventorySchema = versioned(1, {
     units: z.array(repoPath).max(20_000),
+    /** The parts the check owes. For a full check the plane decides them before it runs (check-report.ts
+     * fullObligationsOf) and they ride on the handshake; every one needs an outcome. */
     parts: z.array(z.enum(CHECK_PARTS)).max(CHECK_PARTS.length),
+    /** Whether CI's run of the exact commit may stand in for the local unit suite. Absent is no. */
+    ciSubstitute: z.boolean().optional(),
+    /** Whether the plane prepared it as a release's check (sealed with the attempt; absent on older inventories). */
+    release: z.boolean().optional(),
 });
 /** The sealed inventory artifact: what was sealed before the run, and what the run declared. */
 export const sealedInventorySchema = versioned(1, {

package/dist/contracts/verification-receipt.d.ts

@@ -13,7 +13,7 @@
  */
 import { z } from "zod";
 import { type ContractResult } from "./contract.js";
-export declare const VERIFICATION_FAILURES: readonly ["spawn-failed", "timed-out", "dependency-missing", "setup-stale", "setup-failed", "own-install-failed", "tracked-files-changed", "setup-changed-files", "checkout-moved", "cleanliness-unavailable", "dependency-still-missing", "retry-spawn-failed", "retry-timed-out", "custody-lost", "coverage-incomplete"];
+export declare const VERIFICATION_FAILURES: readonly ["spawn-failed", "timed-out", "dependency-missing", "setup-stale", "setup-failed", "own-install-failed", "tracked-files-changed", "setup-changed-files", "checkout-moved", "cleanliness-unavailable", "dependency-still-missing", "retry-spawn-failed", "retry-timed-out", "custody-lost", "coverage-incomplete", "no-result", "stopped-by-toolroll", "baseline-unverifiable"];
 /**
  * What the repository's approved verification command did: not configured; configured but the run could not attempt
  * it (`attemptFailed`, which downgrades to `short` rather than `refuted`: "we could not check" is not "the claim is
@@ -26,12 +26,14 @@ export declare const verifyCommandFactsSchema: z.ZodUnion<readonly [z.ZodObject<
     ran: z.ZodLiteral<false>;
     attemptFailed: z.ZodLiteral<true>;
     failure: z.ZodOptional<z.ZodEnum<{
+        "baseline-unverifiable": "baseline-unverifiable";
         "checkout-moved": "checkout-moved";
         "cleanliness-unavailable": "cleanliness-unavailable";
         "coverage-incomplete": "coverage-incomplete";
         "custody-lost": "custody-lost";
         "dependency-missing": "dependency-missing";
         "dependency-still-missing": "dependency-still-missing";
+        "no-result": "no-result";
         "own-install-failed": "own-install-failed";
         "retry-spawn-failed": "retry-spawn-failed";
         "retry-timed-out": "retry-timed-out";
@@ -39,6 +41,7 @@ export declare const verifyCommandFactsSchema: z.ZodUnion<readonly [z.ZodObject<
         "setup-failed": "setup-failed";
         "setup-stale": "setup-stale";
         "spawn-failed": "spawn-failed";
+        "stopped-by-toolroll": "stopped-by-toolroll";
         "timed-out": "timed-out";
         "tracked-files-changed": "tracked-files-changed";
     }>>;
@@ -47,6 +50,11 @@ export declare const verifyCommandFactsSchema: z.ZodUnion<readonly [z.ZodObject<
     ran: z.ZodLiteral<true>;
     exitCode: z.ZodInt;
     setupReplayed: z.ZodOptional<z.ZodLiteral<true>>;
+    firstAttempt: z.ZodOptional<z.ZodObject<{
+        class: z.ZodLiteral<"launch">;
+        program: z.ZodString;
+        exitCode: z.ZodInt;
+    }, z.core.$strict>>;
 }, z.core.$strict>]>;
 export type VerifyCommandFacts = z.infer<typeof verifyCommandFactsSchema>;
 /** The approved verification grant the gate ran, exactly as the store held it. */
@@ -76,7 +84,7 @@ export declare const receiptLogSchema: z.ZodObject<{
     }>>;
 }, z.core.$strict>;
 export declare const RECEIPT_VERSION = 3;
-export declare const RECEIPT_COVERAGES: readonly ["full", "composed", "partial", "identity-removed"];
+export declare const RECEIPT_COVERAGES: readonly ["full", "composed", "partial", "identity-removed", "no-result"];
 export type ReceiptCoverage = typeof RECEIPT_COVERAGES[number];
 /** The receipt as read: a reused gate names its source run and digest; a direct one names neither. */
 export declare const verificationReceiptSchema: z.ZodObject<{
@@ -109,12 +117,14 @@ export declare const verificationReceiptSchema: z.ZodObject<{
         ran: z.ZodLiteral<false>;
         attemptFailed: z.ZodLiteral<true>;
         failure: z.ZodOptional<z.ZodEnum<{
+            "baseline-unverifiable": "baseline-unverifiable";
             "checkout-moved": "checkout-moved";
             "cleanliness-unavailable": "cleanliness-unavailable";
             "coverage-incomplete": "coverage-incomplete";
             "custody-lost": "custody-lost";
             "dependency-missing": "dependency-missing";
             "dependency-still-missing": "dependency-still-missing";
+            "no-result": "no-result";
             "own-install-failed": "own-install-failed";
             "retry-spawn-failed": "retry-spawn-failed";
             "retry-timed-out": "retry-timed-out";
@@ -122,6 +132,7 @@ export declare const verificationReceiptSchema: z.ZodObject<{
             "setup-failed": "setup-failed";
             "setup-stale": "setup-stale";
             "spawn-failed": "spawn-failed";
+            "stopped-by-toolroll": "stopped-by-toolroll";
             "timed-out": "timed-out";
             "tracked-files-changed": "tracked-files-changed";
         }>>;
@@ -130,6 +141,11 @@ export declare const verificationReceiptSchema: z.ZodObject<{
         ran: z.ZodLiteral<true>;
         exitCode: z.ZodInt;
         setupReplayed: z.ZodOptional<z.ZodLiteral<true>>;
+        firstAttempt: z.ZodOptional<z.ZodObject<{
+            class: z.ZodLiteral<"launch">;
+            program: z.ZodString;
+            exitCode: z.ZodInt;
+        }, z.core.$strict>>;
     }, z.core.$strict>]>;
     log: z.ZodObject<{
         artifactId: z.ZodInt;
@@ -147,6 +163,7 @@ export declare const verificationReceiptSchema: z.ZodObject<{
         composed: "composed";
         full: "full";
         "identity-removed": "identity-removed";
+        "no-result": "no-result";
         partial: "partial";
     }>>;
     check: z.ZodOptional<z.ZodObject<{
@@ -157,6 +174,7 @@ export declare const verificationReceiptSchema: z.ZodObject<{
         report: z.ZodNullable<z.ZodString>;
         inventory: z.ZodNullable<z.ZodString>;
         exitCode: z.ZodOptional<z.ZodNullable<z.ZodInt>>;
+        retried: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
     }, z.core.$strict>>;
     composed: z.ZodOptional<z.ZodObject<{
         base: z.ZodInt;

package/dist/contracts/verification-receipt.js

@@ -30,6 +30,12 @@ export const VERIFICATION_FAILURES = [
     "custody-lost",
     // A release check that didn't cover what it owed, or lost a required test (release-once.md): never a pass.
     "coverage-incomplete",
+    // A Full release check with no complete, valid result (check-report.ts fullCheckProblem): an error, never a pass.
+    "no-result",
+    // Toolroll's own shutdown stopped the check (its hard stop): it never finished.
+    "stopped-by-toolroll",
+    // A Full check whose recorded last release couldn't be verified: what it owed is unknown, so it never ran.
+    "baseline-unverifiable",
 ];
 /**
  * What the repository's approved verification command did: not configured; configured but the run could not attempt
@@ -39,7 +45,10 @@ export const VERIFICATION_FAILURES = [
 export const verifyCommandFactsSchema = z.union([
     z.strictObject({ configured: z.literal(false) }),
     z.strictObject({ configured: z.literal(true), ran: z.literal(false), attemptFailed: z.literal(true), failure: z.enum(VERIFICATION_FAILURES).optional() }),
-    z.strictObject({ configured: z.literal(true), ran: z.literal(true), exitCode: z.int().min(0).max(255), setupReplayed: z.literal(true).optional() }),
+    z.strictObject({ configured: z.literal(true), ran: z.literal(true), exitCode: z.int().min(0).max(255), setupReplayed: z.literal(true).optional(),
+        // The first attempt of a check rerun after the approved setup, classified on its own (eval-harness review 2,
+        // finding 5): only a launch failure — its program missing — is ever replayed.
+        firstAttempt: z.strictObject({ class: z.literal("launch"), program: z.string().min(1).max(200), exitCode: z.int().min(0).max(255) }).optional() }),
 ]);
 /** The approved verification grant the gate ran, exactly as the store held it. */
 export const receiptCommandSchema = z.strictObject({
@@ -65,7 +74,7 @@ export const receiptLogSchema = z.strictObject({
     captureStatus: z.enum(["ok", "failed"]).nullable(),
 });
 export const RECEIPT_VERSION = 3;
-export const RECEIPT_COVERAGES = ["full", "composed", "partial", "identity-removed"];
+export const RECEIPT_COVERAGES = ["full", "composed", "partial", "identity-removed", "no-result"];
 const receiptFields = {
     run: z.int(),
     head: z.string(),
@@ -85,7 +94,10 @@ export const verificationReceiptSchema = versioned(RECEIPT_VERSION, {
     /** Version 3: the attempt sealed before the check ran, and its sealed report (null: it gave none). */
     check: z.strictObject({ attempt: z.enum(["full", "targeted"]), report: z.string().nullable(), inventory: z.string().nullable(),
         /** The command's own exit, kept here when `result` reads a failed attempt because the coverage fell short. */
-        exitCode: z.int().min(0).max(255).nullable().optional() }).optional(),
+        exitCode: z.int().min(0).max(255).nullable().optional(),
+        /** What passed only on a retry inside the check (check-failure.ts retriedInside), sealed here from its report: null
+         * when it gave no valid report, so nobody can tell (unknown, never "no retries"). Absent on older receipts. */
+        retried: z.array(z.string().min(1).max(800)).max(6000).nullable().optional() }).optional(),
     /** Version 3, composed: the full check A and every link the reader proves again. */
     composed: z.strictObject({
         base: z.int().min(1), baseReceipt: z.string(), baseReport: z.string(), authority: z.int().min(1), carries: z.array(z.int()),

package/dist/contracts/verification-view.d.ts

@@ -37,12 +37,14 @@ export declare const legacyGateViewSchema: z.ZodObject<{
         ran: z.ZodLiteral<false>;
         attemptFailed: z.ZodLiteral<true>;
         failure: z.ZodOptional<z.ZodEnum<{
+            "baseline-unverifiable": "baseline-unverifiable";
             "checkout-moved": "checkout-moved";
             "cleanliness-unavailable": "cleanliness-unavailable";
             "coverage-incomplete": "coverage-incomplete";
             "custody-lost": "custody-lost";
             "dependency-missing": "dependency-missing";
             "dependency-still-missing": "dependency-still-missing";
+            "no-result": "no-result";
             "own-install-failed": "own-install-failed";
             "retry-spawn-failed": "retry-spawn-failed";
             "retry-timed-out": "retry-timed-out";
@@ -50,6 +52,7 @@ export declare const legacyGateViewSchema: z.ZodObject<{
             "setup-failed": "setup-failed";
             "setup-stale": "setup-stale";
             "spawn-failed": "spawn-failed";
+            "stopped-by-toolroll": "stopped-by-toolroll";
             "timed-out": "timed-out";
             "tracked-files-changed": "tracked-files-changed";
         }>>;
@@ -58,6 +61,11 @@ export declare const legacyGateViewSchema: z.ZodObject<{
         ran: z.ZodLiteral<true>;
         exitCode: z.ZodInt;
         setupReplayed: z.ZodOptional<z.ZodLiteral<true>>;
+        firstAttempt: z.ZodOptional<z.ZodObject<{
+            class: z.ZodLiteral<"launch">;
+            program: z.ZodString;
+            exitCode: z.ZodInt;
+        }, z.core.$strict>>;
     }, z.core.$strict>]>;
     log: z.ZodObject<{
         artifactId: z.ZodInt;

package/dist/controller-supervisor.d.ts

@@ -1,3 +1,4 @@
+import { type ChildProcess } from "node:child_process";
 export type ControllerState = {
     phase: "starting" | "running" | "backoff" | "stopped";
     generation: number;
@@ -27,4 +28,11 @@ export declare function superviseController(args: {
     maxRetryMs?: number;
     stableMs?: number;
     shutdownMs?: number;
+    /** An IPC channel to each controller (fd 3), for a parent that speaks to it (`toolroll up`'s console and worker). */
+    ipc?: boolean;
+    /** Prefix every line the controller writes, sent to this process's stderr: two controllers' logs stay apart. An
+     * empty label sends its lines there unprefixed (a JSON log keeps one object a line). */
+    label?: string;
+    /** Each spawned controller's handle, before it runs: the caller listens to its messages and may signal it. */
+    onSpawn?: (child: ChildProcess, generation: number) => void;
 }): Promise<void>;

package/dist/controller-supervisor.js

@@ -56,13 +56,23 @@ export async function superviseController(args) {
             if (args.signal.aborted)
                 break;
             const exited = await new Promise(done => {
+                const output = args.label === undefined ? "inherit" : "pipe";
                 const owned = spawn(args.file, [...args.argv], {
                     ...(args.cwd === undefined ? {} : { cwd: args.cwd }),
                     ...(args.env === undefined ? {} : { env: args.env }),
-                    stdio: "inherit",
+                    stdio: args.ipc === true ? ["ignore", output, output, "ipc"] : args.label === undefined ? "inherit" : ["ignore", "pipe", "pipe"],
                     windowsHide: true,
                 });
                 child = owned;
+                if (args.label !== undefined)
+                    for (const stream of [owned.stdout, owned.stderr])
+                        labelLines(stream, args.label);
+                try {
+                    args.onSpawn?.(owned, generation);
+                }
+                catch {
+                    process.stderr.write("Controller supervisor could not attach to its controller.\n");
+                }
                 owned.once("spawn", () => {
                     emit({ phase: "running", generation, controllerPid: owned.pid ?? null });
                     if (args.signal.aborted)
@@ -102,3 +112,25 @@ export async function superviseController(args) {
         emit({ phase: "stopped", generation, controllerPid: null });
     }
 }
+/** Each whole line of a controller's output, prefixed with its label, on this process's stderr. */
+function labelLines(stream, label) {
+    if (stream === null)
+        return;
+    const prefix = label === "" ? "" : `${label} `;
+    let pending = "";
+    stream.setEncoding("utf8");
+    stream.on("data", (chunk) => {
+        const lines = (pending + chunk).split("\n");
+        pending = lines.pop() ?? "";
+        // Bounded: a controller that never ends a line still reaches the log.
+        if (pending.length > 64 * 1024) {
+            lines.push(pending);
+            pending = "";
+        }
+        for (const line of lines)
+            process.stderr.write(`${prefix}${line}\n`);
+    });
+    stream.on("end", () => { if (pending !== "")
+        process.stderr.write(`${prefix}${pending}\n`); pending = ""; });
+    stream.on("error", () => { });
+}

package/dist/demo.js

@@ -989,11 +989,12 @@ export function makeDemoRepos(root) {
             writeFileSync(join(dir, file), content);
         }
         try {
-            execFileSync("git", ["init", "-q", "-b", "main"], { cwd: dir, stdio: "ignore" });
-            execFileSync("git", ["add", "-A"], { cwd: dir, stdio: "ignore" });
+            execFileSync("git", ["init", "-q", "-b", "main"], { cwd: dir, stdio: "ignore", timeout: 30_000 });
+            execFileSync("git", ["add", "-A"], { cwd: dir, stdio: "ignore", timeout: 30_000 });
             execFileSync("git", ["-c", "user.email=demo@localhost", "-c", "user.name=demo", "commit", "-q", "-m", "seed"], {
                 cwd: dir,
                 stdio: "ignore",
+                timeout: 30_000,
             });
         }
         catch {

package/dist/deploy-gate.d.ts

@@ -14,4 +14,7 @@ export declare function deploymentGate(store: Store, input: {
     runId: number;
     evidenceRoot: string;
     now: Date;
+    /** Inside `toolroll release` (its own reserved deploy): a release's own automatic approval also stands
+     * (docs/plans/auto-approve-green.md). Anywhere else only a person's approval deploys. */
+    releaseFlow?: boolean;
 }): DeploymentGate;

package/dist/deploy-gate.js

@@ -6,8 +6,9 @@
  * same checks for the deployment script, proven again there with the installed runtime's modules.)
  */
 import { assignmentOf } from "./assignment.js";
-import { liveReleaseOf, personApprovalOf } from "./scope.js";
+import { liveReleaseOf, personApprovalOf, releaseApprovalOf } from "./scope.js";
 import { verificationEvidence } from "./verification-evidence.js";
+import { releaseCiRunningOf } from "./release-ci-hold.js";
 /** Whether run `runId` is a deployable candidate now, read only from the plane's records and this runtime's code. */
 export function deploymentGate(store, input) {
     const refuse = (message) => ({ ok: false, message });
@@ -27,13 +28,18 @@ export function deploymentGate(store, input) {
         return refuse(`Run ${input.runId} is not a built candidate at ${head.slice(0, 7)}.`);
     if (scope === null || scope.approvedDigest !== scope.digest || scope.digest !== run.scopeDigest)
         return refuse("The run's signed scope is no longer the approved one.");
+    // A person may approve during CI, including a release without carry terms. Every deployment road must wait
+    // for the plane's exact-head observation, not only the release coordinator's polling loop.
+    if (releaseCiRunningOf(store, ref.externalId) !== null)
+        return refuse("This release still waits for GitHub CI. Resume it with `toolroll release`.");
     // One approval per release (release-once.md): a release's task deploys only while its authority stands for it — the
     // live predicate proves the anchor's person approval (a carried commit's own seal is never a person's). Any other task
     // needs a person's approval of its own.
     const release = liveReleaseOf(store, ref.externalId, "deploy", input.now);
     if (release.applies && !release.ok)
         return refuse(`This release can't deploy: ${release.why}.`);
-    const anchorPerson = release.applies && release.ok ? personApprovalOf(store, release.authority.anchorTask) : null;
+    const anchorPerson = release.applies && release.ok
+        ? (input.releaseFlow === true ? releaseApprovalOf(store, release.authority.anchorTask, input.now) : personApprovalOf(store, release.authority.anchorTask)) : null;
     const person = anchorPerson ?? personApprovalOf(store, ref.externalId);
     if (!person.ok)
         return refuse(`A person has to approve this candidate's scope: ${person.why}.`);

package/dist/desktop-update.d.ts

@@ -97,7 +97,6 @@ export declare function sqliteLock(file: string, busyTimeoutMs?: number): Databa
 export declare function lockHeld(file: string): boolean;
 export declare const installationLock: (j: UpdateJournal) => DatabaseSync | null;
 export declare function desktopUpdateStatus(stateDir: string): {
-    version?: never;
     active: boolean;
     phase: string;
     detail: string;
@@ -111,6 +110,7 @@ export declare function desktopUpdateStatus(stateDir: string): {
     wasRunning?: never;
     backupPath?: never;
     updateId?: never;
+    version?: never;
     buildId?: never;
     workDir?: never;
 } | {

package/dist/discover.js

@@ -19,6 +19,7 @@
  */
 import { basename } from "node:path";
 import { run } from "./exec.js";
+import { checkoutGit } from "./teardown-git.js";
 import { parseWorktrees, parseBranches } from "./git.js";
 import { findRepos } from "./scan.js";
 /** Enough to keep git busy without turning a laptop fan on. */
@@ -43,7 +44,11 @@ const BRANCH_FORMAT = "--format=%(refname:short)%09%(upstream:track)%09%(committ
 const BRANCH_FORMAT_CHEAP = "--format=%(refname:short)%09%09%(committerdate:iso8601-strict)";
 export async function inspectRepo(path, options = {}) {
     const { runner = run, dirty = false } = options;
-    const git = (args, timeoutMs = REF_TIMEOUT_MS) => runner(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs });
+    // Scanned and enrolled projects share their repository with every build, which can write its config, info and hooks
+    // (`--dirty`'s status would run a planted fsmonitor or filter): the hardened git, against a frozen view of the
+    // repository (teardown-git.ts checkoutGit). An injected runner (tests) is used as given.
+    const hardened = runner === run ? checkoutGit(run, "build") : runner;
+    const git = (args, timeoutMs = REF_TIMEOUT_MS) => hardened(GIT, [...READ_ONLY, ...args], { cwd: path, timeoutMs });
     const [worktrees, branchRead, head, remote, status] = await Promise.all([
         git(["worktree", "list", "--porcelain"]),
         readBranches(git),

package/dist/dispose.d.ts

@@ -132,6 +132,9 @@ export declare function regateTask(store: Store, taskId: string, now: Date, appr
     kind: "mode";
     name: string;
     modeDigest: string;
+} | {
+    kind: "release";
+    name: string;
 }): {
     ok: true;
     run: number;