toolroll 0.9.76 → 0.9.77

package/dist/release-auto.js

@@ -13,16 +13,19 @@
  * adapter. Any refusal unseals `auto-check`, so the task asks a person, its passing check kept.
  */
 import { assignmentOf } from "./assignment.js";
-import { projectGitDir } from "./check-report.js";
+import { fullCheckProblem, projectGitDir } from "./check-report.js";
+import { sealedRun } from "./release-recheck.js";
 import { runCheckLevel } from "./check-levels.js";
 import { readVerifiedCommit, verifiedBlobs, verifiedTreeDiff, verifiedTreeEntries } from "./commit-extract.js";
 import { mightName, testInfrastructure } from "./test-infra.js";
 import { chatControlHref } from "./chat-controls.js";
-import { AUTO_FLAKE_CAP, REQUIRED_PR_CHECKS, prChecksVerdict } from "./release.js";
+import { INFRA_RERUNS_PER_CANDIDATE, REQUIRED_PR_CHECKS, REQUIRED_PR_CHECKS_WORKFLOW, prChecksVerdict } from "./release.js";
+import { releaseCheckStanding } from "./check-failure.js";
 import { CARRY_RULES, rulePath } from "./release-carry.js";
 import { AUTO_EVIDENCE_ACTION, AUTO_WITHDRAWN_ACTION, LIVE_RELEASE_STATES, RELEASE_APPROVAL_ACTION, releaseAuthorityOfTask, releaseAutoApproves, releaseApprovalSetting } from "./release-authority.js";
 import { autoReleaseApprovalOf, personApprovalOf } from "./scope.js";
 import { releaseOperations, revokeRelease } from "./store.js";
+import { RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION, RELEASE_CI_RUNNING_WORDS, releaseCiHoldOf, releaseCiRunningOf } from "./release-ci-hold.js";
 import { verificationEvidence } from "./verification-evidence.js";
 export { RELEASE_APPROVAL_ACTION, releaseApprovalSetting, releaseAutoApproves };
 /** The setting's words, one place. */
@@ -212,13 +215,12 @@ export function autoPathProblem(path) {
         return null;
     return "it's outside what a release approves itself for (product code, tests, docs, the changelog and a version bump)";
 }
-/** Flakes: how many failed attempts one CI job, and how many unsuccessful release-check runs, may have before a person
- * decides. The head and digest are pinned, so between attempts only nondeterminism differs. */
-export const MAX_FAILED_ATTEMPTS = AUTO_FLAKE_CAP;
 /**
  * GitHub CI on the exact head, as the plane read it (every attempt): fresh, every run GitHub Actions, and the same
  * verdict every later release boundary uses (release.ts prChecksVerdict: exact head, each job by its latest attempt,
- * every required check present), with the flake cap. The tolerated failures are returned for the evidence.
+ * every required check present), where an earlier failure stands only as confirmed infrastructure (GitHub's job record
+ * shows it ended before any workflow step ran), at most INFRA_RERUNS_PER_CANDIDATE of them. The tolerated failures are
+ * returned for the evidence.
  */
 export function ciVerdict(observation, candidate, now) {
     const no = (problem) => ({ ok: false, problem });
@@ -232,7 +234,7 @@ export function ciVerdict(observation, candidate, now) {
     const other = observation.runs.find(run => run.app !== "github-actions");
     if (other !== undefined)
         return no(`${other.name} was reported by ${other.app ?? "an unknown app"}, not GitHub Actions`);
-    const verdict = prChecksVerdict(observation.runs, candidate, REQUIRED_PR_CHECKS, { cap: MAX_FAILED_ATTEMPTS });
+    const verdict = prChecksVerdict(observation.runs, candidate, REQUIRED_PR_CHECKS, { auto: true, workflow: REQUIRED_PR_CHECKS_WORKFLOW });
     if (verdict.state === "failed")
         return no(verdict.failed.join(", "));
     if (verdict.state === "pending")
@@ -317,6 +319,19 @@ function changeProblem(repo, base, candidate) {
         // Taking a test away is never automatic, wherever it lives.
         if (change.kind === "deleted" && TEST_FILE.test(rulePath(change.path)))
             return `${change.path} was deleted (removing a test needs a person)`;
+        if (change.before !== null && TEST_FILE.test(rulePath(change.path))) {
+            // Counts cannot prove that an assertion survived: replacing it, commenting it out, or skipping its case can
+            // leave the counts unchanged. Only append-only additions preserve the existing code without interpretation.
+            // Both copies come from verified trees; no report or candidate-provided file list decides this permission.
+            const was = verifiedBlobs(gitDir, before.value.tree, [change.path]);
+            const now = verifiedBlobs(gitDir, after.value.tree, [change.path]);
+            if (!was.ok || !now.ok)
+                return `${change.path}'s existing test code couldn't be read (a person decides)`;
+            const original = was.value.get(change.path)?.bytes, revised = now.value.get(change.path)?.bytes;
+            if (original === undefined || revised === undefined || !revised.subarray(0, original.length).equals(original)) {
+                return `${change.path} changes existing test code (removing or rewriting tests needs a person)`;
+            }
+        }
         const why = autoPathProblem(change.path);
         if (why !== null)
             return `${change.path} changed (${why})`;
@@ -348,6 +363,12 @@ export function sealAutoGreen(store, input) {
         const facts = releaseTaskFacts(store, input);
         if (!facts.ok)
             return facts;
+        // Head-only CI is the merged tree only when GitHub itself refuses a branch behind main (eval-harness review 1,
+        // finding 4): without that setting nothing approves itself.
+        if (input.mainUpToDate !== true)
+            return refuse(input.mainUpToDate === null
+                ? "GitHub's branch protection for main couldn't be read, so whether it refuses a branch behind main is unknown"
+                : "main's branch protection doesn't hold for the account that merges: it must require branches to be up to date, require the release's checks, and allow no bypass (\"Do not allow bypassing the above settings\")");
         const checking = autoReleaseApprovalOf(store, input.taskId, "auto-check");
         if (!checking.ok)
             return refuse(`its check wasn't authorized automatically: ${checking.why}`);
@@ -362,15 +383,26 @@ export function sealAutoGreen(store, input) {
             return refuse(`run ${input.run} recorded no commit`);
         if (runCheckLevel(store, run.id) !== "full")
             return refuse("the release check wasn't Full");
-        // A flake: earlier builds of this task may have failed — every one that didn't finish built with a passed check
-        // counts (a failed check, a check that never ran, a build that failed or was interrupted) — but only re-runs of the
-        // same signed scope (the regate road keeps the candidate and digest), and at most MAX_FAILED_ATTEMPTS of them.
+        // Earlier builds of this task that didn't finish built with a passed check (a failed check, a check that never ran,
+        // a build that failed or was interrupted) stand only as confirmed infrastructure the release itself reran on the
+        // same signed scope, at most INFRA_RERUNS_PER_CANDIDATE (check-failure.ts): a failing test, an unexplained failure
+        // or a real-model journey before the pass means a person decides. So does anything that passed only on a retry.
         const failedRuns = store.handle.prepare(`SELECT r.id, r.scope_digest FROM run r LEFT JOIN run_check c ON c.run = r.id
         WHERE r.task_ref = ? AND r.role = 'builder' AND r.id <> ?
           AND NOT (COALESCE(r.outcome, '') IN ('built', 'no-change') AND COALESCE(c.status, '') = 'passed') ORDER BY r.id`).all(facts.taskRef, run.id);
         if (failedRuns.some(one => one["scope_digest"] !== input.digest))
             return refuse("an earlier check of this release ran on different scope text, so a person decides");
-        if (failedRuns.length > MAX_FAILED_ATTEMPTS)
+        if (failedRuns.some(one => Number(one["id"]) > run.id))
+            return refuse(`run ${input.run} isn't this task's newest build`);
+        const standing = releaseCheckStanding(store, input.evidenceRoot, { taskId: input.taskId, run: run.id });
+        if (!standing.ok)
+            return refuse(standing.why);
+        // Unknown is never "no retries" (eval-harness review 1, finding 3).
+        if (standing.retried === null)
+            return refuse("the release check's retry record can't be read (its report or receipt is missing or damaged), so whether anything passed only on a retry is unknown and a person decides");
+        if (standing.retried.length > 0)
+            return refuse(`the release check passed only on a retry (${standing.retried.slice(0, 3).join(", ")}${standing.retried.length > 3 ? ", …" : ""}), so a person decides`);
+        if (failedRuns.length > INFRA_RERUNS_PER_CANDIDATE)
             return refuse(`the release check failed ${failedRuns.length} times before it passed, so a person decides`);
         const checkFailures = failedRuns.map(one => Number(one["id"]));
         const newest = store.runsFor(facts.taskRef).find(one => one.role === "builder");
@@ -391,6 +423,22 @@ export function sealAutoGreen(store, input) {
         const command = gate["command"];
         if (gate["coverage"] !== undefined && gate["coverage"] !== "full")
             return refuse(`the release check didn't cover everything (${String(gate["coverage"])})`);
+        // A readable, valid report and inventory of a Full attempt, the receipt's own, every obligation accounted for, and
+        // the retry summary sealed in the receipt: an automatic approval never stands on evidence it can't read.
+        const check = gate["check"];
+        const sealed = sealedRun(store, input.evidenceRoot, run.id);
+        if (check === undefined || sealed === null || sealed.attempt.mode !== "full" || check.attempt !== "full" || sealed.report === null || sealed.inventory === null || sealed.reportDigest !== check.report) {
+            return refuse("the release check's sealed report or inventory can't be read, so what it ran and retried is unknown");
+        }
+        const incomplete = fullCheckProblem({ report: sealed.report, inventory: sealed.inventory, exitCode: typeof result?.exitCode === "number" ? result.exitCode : null });
+        if (incomplete !== null)
+            return refuse(`the release check has no complete result: ${incomplete}`);
+        if (!Array.isArray(check.retried))
+            return refuse("the release check's receipt has no sealed retry record, so a person decides");
+        // Belt to the retry record (finding 6): a check that passed only on a rerun after the recovery setup never approves
+        // itself — its first failure isn't confirmed infrastructure.
+        if (result?.setupReplayed === true)
+            return refuse("the release check passed only when it was run again after the approved setup, so a person decides");
         if (gate["run"] !== run.id || gate["head"] !== head || gate["scopeDigest"] !== input.digest || result?.ran !== true || result.exitCode !== 0 || live === null || command?.command !== live.command) {
             return refuse("the release check didn't pass this candidate under the approved command");
         }
@@ -442,14 +490,25 @@ export function giveUpAutoApproval(store, input) {
         unseal(store, input.taskId, input.now);
         const scope = store.getScope(input.taskId);
         const version = scope?.releaseTerms?.packageVersion ?? null;
+        // Still waiting for CI (round 1, finding 4): nobody is asked to approve yet; `liftCiHold` asks once CI passed.
+        const ciHold = releaseCiHoldOf(store, input.taskId);
+        if (ciHold !== null) {
+            store.enqueueNotification({ dedupeKey: `release-auto-stopped:${input.taskId}:${input.why.slice(0, 120)}`, kind: "release-auto",
+                subject: `Release${version === null ? "" : ` ${version}`} won't approve itself`,
+                body: `Not approved automatically: ${input.why}. GitHub CI is still running on ${ciHold.candidate?.slice(0, 7) ?? "its commit"}; you're asked to approve it once CI passes.`,
+                link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
+            return;
+        }
+        // Filed while CI runs (Alex, 2026-10-29): a person may approve now; nothing deploys until CI passes.
+        const running = releaseCiRunningOf(store, input.taskId) === null ? "" : ` ${RELEASE_CI_RUNNING_WORDS}`;
         store.enqueueNotification({ dedupeKey: `release-auto-stopped:${input.taskId}:${input.why.slice(0, 120)}`, kind: "release-auto", pushClass: "attention",
             subject: `Release${version === null ? "" : ` ${version}`} needs you`,
-            body: `Not approved automatically: ${input.why}. Approve it yourself, or fix the branch and release the new commit.`,
+            body: `Not approved automatically: ${input.why}. Approve it yourself, or fix the branch and release the new commit.${running}`,
             link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
     });
 }
-/** A release check failed while checking automatically: tell the owner. The `auto-check` stays, so a regate of the same
- * commit and digest (a flake) may still approve itself, within MAX_FAILED_ATTEMPTS failed runs. */
+/** A release check failed while checking automatically: tell the owner. The `auto-check` stays: a rerun the release
+ * itself made after confirmed infrastructure may still approve itself; any other failure means a person decides. */
 export function noteAutoCheckFailed(store, input) {
     const ref = store.lookupRef(input.taskId);
     if (ref === null)
@@ -457,7 +516,7 @@ export function noteAutoCheckFailed(store, input) {
     const version = store.getScope(input.taskId)?.releaseTerms?.packageVersion ?? null;
     store.enqueueNotification({ dedupeKey: `release-auto-check-failed:${input.taskId}:${input.why.slice(0, 120)}`, kind: "release-auto", pushClass: "attention",
         subject: `Release${version === null ? "" : ` ${version}`} check failed`,
-        body: `${input.why}. Rerun it on the same commit (a flake still approves itself, up to ${MAX_FAILED_ATTEMPTS} failed checks), or fix the branch and release the new commit.`,
+        body: `${input.why}. Only a failure Toolroll confirmed as its own infrastructure is checked again automatically; for anything else, approve it yourself or fix the branch and release the new commit.`,
         link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
 }
 /** "Released 0.9.x automatically": the release that approved itself finished. */
@@ -494,3 +553,60 @@ export function allowAutoPublish(store, input) {
         action: PUBLISH_ALLOWED_ACTION, outcome: "allowed", source: "request", detail: `${input.by} lets the release's tag, publication and Homebrew go on` });
     return { ok: true };
 }
+/**
+ * A release filed while its pull request's CI still ran (pipeline-speed.md D2): hold every approval but the automatic
+ * road's until the plane reads exact-head CI passing (Codex review round 1, finding 4). Recorded before the task is
+ * filed, so no moment exists where the filed task is approvable with CI pending. Idempotent.
+ */
+export function holdApprovalForCi(store, input) {
+    if (!/^[0-9a-f]{40}$/.test(input.candidate))
+        throw new Error("a CI hold needs the exact candidate commit");
+    const held = releaseCiHoldOf(store, input.taskId);
+    if (held !== null && held.candidate === input.candidate)
+        return;
+    store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo: store.lookupRef(input.taskId)?.repo ?? null, taskId: input.taskId, runId: null,
+        action: RELEASE_CI_HELD_ACTION, outcome: "held", source: "work", detail: input.candidate });
+}
+/**
+ * Lift a release's CI hold (an older coordinator's) or end its "CI still running" note on the plane's own reading of
+ * GitHub CI (never the coordinator's word): fresh, whole, every run GitHub Actions, on exactly the held candidate, and
+ * every required check passed (release.ts prChecksVerdict, as a person's road judges it: a person decides about earlier
+ * attempts). With `ask`, the owner of a held release is told it needs them now. Nothing held or noted is a pass.
+ */
+export function liftCiHold(store, input) {
+    return store.transact(() => {
+        const held = releaseCiHoldOf(store, input.taskId);
+        const waiting = held ?? releaseCiRunningOf(store, input.taskId);
+        if (waiting === null)
+            return { ok: true };
+        if (waiting.candidate !== input.candidate)
+            return refuse(`the release waits for CI on ${waiting.candidate?.slice(0, 7) ?? "an unreadable commit"}, not ${input.candidate.slice(0, 7)}`);
+        const ci = input.ci;
+        if (ci.head !== input.candidate)
+            return refuse(`CI was read for ${ci.head.slice(0, 7)}, not ${input.candidate.slice(0, 7)}`);
+        const at = Date.parse(ci.observedAt);
+        if (!Number.isFinite(at) || at > input.now.getTime() + 60_000 || input.now.getTime() - at > CI_OBSERVATION_MS)
+            return refuse("the CI reading isn't fresh");
+        if (ci.complete !== true)
+            return refuse("GitHub's check history of this commit can't be read whole");
+        const other = ci.runs.find(run => run.app !== "github-actions");
+        if (other !== undefined)
+            return refuse(`${other.name} was reported by ${other.app ?? "an unknown app"}, not GitHub Actions`);
+        const verdict = prChecksVerdict(ci.runs, input.candidate, REQUIRED_PR_CHECKS, { workflow: REQUIRED_PR_CHECKS_WORKFLOW });
+        if (verdict.state === "failed")
+            return refuse(`CI failed: ${verdict.failed.join(", ")}`);
+        if (verdict.state === "pending")
+            return refuse(`CI hasn't finished: ${verdict.waiting.join(", ")}`);
+        const ref = store.lookupRef(input.taskId);
+        store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo: ref?.repo ?? null, taskId: input.taskId, runId: null,
+            action: RELEASE_CI_PASSED_ACTION, outcome: "passed", source: "work", detail: input.candidate });
+        if (input.ask && held !== null && ref !== null) {
+            const version = store.getScope(input.taskId)?.releaseTerms?.packageVersion ?? null;
+            store.enqueueNotification({ dedupeKey: `release-ci-passed:${input.taskId}:${input.candidate}`, kind: "release-auto", pushClass: "attention",
+                subject: `Release${version === null ? "" : ` ${version}`} needs you`,
+                body: `GitHub CI passed on ${input.candidate.slice(0, 7)}. Approve it yourself, or fix the branch and release the new commit.`,
+                link: chatControlHref("task", input.taskId), source: { taskRef: ref.id } }, input.now);
+        }
+        return { ok: true };
+    });
+}

package/dist/release-card.d.ts

@@ -46,10 +46,22 @@ export type ChangeList = {
     }[] | null;
     source: "recorded" | "pull-request" | "unread";
     digest: string;
+    /** A release is on the record but its merge commit can't be read (eval-harness review 2, finding 4). */
+    baselineUnreadable?: true;
+};
+/**
+ * The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag.
+ * Whether the plane recorded one, and its merge commit (eval-harness review 2, finding 4):
+ * `recorded: false` only when no merged release is on the record at all; a recorded one whose commit isn't a full id is
+ * `recorded: true` with `sha: null` — something to refuse on, never "no previous release".
+ */
+export declare function releaseBaselineRecord(store: Store, repo: string): {
+    recorded: false;
+} | {
+    recorded: true;
+    sha: string | null;
 };
-/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
- * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
-export declare function releaseBaseline(store: Store, repo: string): string | null;
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
  * a shallow boundary, grafts or replacement refs refused, and the range proved to stop only in the last release's own

package/dist/release-card.js

@@ -25,6 +25,7 @@ import { verifiedRange } from "./commit-extract.js";
 import { releaseTermsSchema } from "./contracts/release-terms.js";
 import { routeFromJson } from "./phase-routing.js";
 import { projectName } from "./project.js";
+import { RELEASE_CI_RUNNING_WORDS, releaseCiRunningOf } from "./release-ci-hold.js";
 import { RELEASE_PATH, releaseConfigProblem, releaseGitEnv, releaseRemote, releaseTools } from "./release-git.js";
 const NONE = "none";
 /** A budget in dollars from integer micro-dollars, in integer arithmetic: cents when it is whole cents, else every digit. */
@@ -152,13 +153,21 @@ export function approvalTermsOf(store, scope, words) {
 export const termsText = (lines) => lines.map(line => `${line.label}: ${line.value}`).join("\n");
 const SHA = /^[0-9a-f]{40}$/;
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
-/** The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
- * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag. */
-export function releaseBaseline(store, repo) {
-    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a JOIN release_operation o ON o.authority = a.id
-    WHERE a.repo = ? AND a.state = 'merged' AND o.kind = 'merge' AND o.state = 'succeeded' AND o.external_ref IS NOT NULL ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
-    const ref = row === undefined ? null : String(row["external_ref"]);
-    return ref !== null && SHA.test(ref) ? ref : null;
+/**
+ * The plane's own record of the last verified release of `repo`: the merge commit GitHub answered with, recorded once
+ * the release verified the merged tree (the newest merged authority whose merge operation succeeded). Never a tag.
+ * Whether the plane recorded one, and its merge commit (eval-harness review 2, finding 4):
+ * `recorded: false` only when no merged release is on the record at all; a recorded one whose commit isn't a full id is
+ * `recorded: true` with `sha: null` — something to refuse on, never "no previous release".
+ */
+export function releaseBaselineRecord(store, repo) {
+    const row = store.handle.prepare(`SELECT o.external_ref FROM release_authority a LEFT JOIN release_operation o
+    ON o.authority = a.id AND o.kind = 'merge' AND o.state = 'succeeded'
+    WHERE a.repo = ? AND a.state = 'merged' ORDER BY a.id DESC, o.finished_at DESC LIMIT 1`).get(repo);
+    if (row === undefined)
+        return { recorded: false };
+    const ref = row["external_ref"];
+    return { recorded: true, sha: typeof ref === "string" && SHA.test(ref) ? ref : null };
 }
 /** The commits after `from` up to `to`, as verified Git objects only, from the project's recorded Git directory: the
  * release coordinator's checkout config allowlist first, then commit-extract's verified range (every commit hashed here,
@@ -198,7 +207,12 @@ function pullRequestCommits(slug, pr) {
 }
 /** What changed since the last verified release, for a release's terms, from Toolroll's records only. */
 export function releaseChangeList(store, terms) {
-    const baseline = releaseBaseline(store, terms.repo);
+    const record = releaseBaselineRecord(store, terms.repo);
+    // A release recorded with a merge commit that can't be read: the list couldn't be read (eval-harness review 2,
+    // finding 4) — never the pull request's commits, as if there were no previous release.
+    if (record.recorded && record.sha === null)
+        return { baseline: null, commits: null, source: "unread", baselineUnreadable: true, digest: sha256(`release-changes:${JSON.stringify({ baseline: null, source: "unread", commits: null, recorded: true })}`) };
+    const baseline = record.recorded ? record.sha : null;
     let commits;
     let source;
     if (baseline !== null) {
@@ -221,7 +235,7 @@ function changeWords(changes, terms, cap) {
     const head = changes.baseline === null ? `No earlier verified release is recorded. ${changes.source === "pull-request" ? `Pull request #${terms?.pr ?? "?"}'s commits:` : ""}`.trim()
         : `Changes since the last verified release (${changes.baseline.slice(0, 7)}):`;
     if (changes.commits === null)
-        return [head, changes.baseline === null ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
+        return [head, changes.baseline === null && changes.baselineUnreadable !== true ? `The pull request's commits couldn't be read; see #${terms?.pr ?? "?"} on GitHub.` : "The change list couldn't be read."];
     if (changes.commits.length === 0)
         return [head, "No commits."];
     return [head, ...changes.commits.slice(0, cap).map(one => `• ${one.sha.slice(0, 7)} ${one.subject.slice(0, 100)}`), ...(changes.commits.length > cap ? [`• and ${changes.commits.length - cap} more`] : [])];
@@ -242,6 +256,8 @@ export function releaseCardOf(store, scope, formDigest, words) {
         terms === null ? `Checks: ${value("checks")} · check access: ${value("checkAccess")}` : `Carry later commits: ${terms.policy.carry ? "yes" : "no"} · checks: ${value("checks")} · expires ${terms.expiresAt}`,
         // Option A's disclosure, on the card as on the approval sheet: never approved from chat without it.
         ...(terms !== null && terms.policy.carry && terms.access !== "sandboxed" ? ["This project's checks don't run in the sandbox: later test-only commits will run outside the sandbox without being shown to you first."] : []),
+        // Filed while CI runs (Alex, 2026-10-29): a person may approve now, and is told plainly what still waits.
+        ...(releaseCiRunningOf(store, scope.taskId) === null ? [] : [RELEASE_CI_RUNNING_WORDS]),
         "",
         ...changeWords(changes, terms, 5),
         "",

package/dist/release-ci-hold.d.ts

@@ -0,0 +1,41 @@
+/** A release's approval held for its pull request's CI (Codex review round 1, finding 4). A leaf module: the seal
+ * primitive (store.ts), the person's ceremony (scope.ts), chat and release-auto.ts all read the same row. */
+import type { Store } from "./store.js";
+/**
+ * A release filed while its pull request's CI was still running (pipeline-speed.md D2) waits for CI before anyone but
+ * the automatic road may approve it (Codex review round 1, finding 4): `release-auto.ts holdApprovalForCi` records the
+ * hold before the task is filed, and only the plane's own reading of exact-head CI passing lifts it
+ * (`liftCiHold`). The newest row for the task wins; the hold names the candidate commit it waits on.
+ * Since Alex's decision of 2026-10-29 (a person may approve during CI) the coordinator records a "CI still running"
+ * note instead (below); a hold an older coordinator placed still holds until lifted.
+ */
+export declare const RELEASE_CI_HELD_ACTION = "release approval waits for CI";
+export declare const RELEASE_CI_PASSED_ACTION = "release approval CI passed";
+/** The candidate whose CI a release task's approval waits for, or null when nothing holds it. Fail closed: a hold row
+ * whose candidate can't be read still holds. */
+export declare function releaseCiHoldOf(store: Store, taskId: string): {
+    candidate: string | null;
+} | null;
+/** Why a person can't approve a release waiting for CI yet, in words. */
+export declare function releaseCiHoldWords(hold: {
+    candidate: string | null;
+}): string;
+/**
+ * A person's release asks for approval while its pull request's CI still runs (Alex, 2026-10-29; pipeline-speed.md,
+ * "Decision: a person's release asks during CI"). This row never holds approval: it lets the approval card say so, until
+ * the plane reads exact-head CI passing (`liftCiHold` records RELEASE_CI_PASSED_ACTION, which ends it as it ends a
+ * hold). Deployment gates and operation issuance also refuse while it remains, so a direct deploy cannot bypass
+ * the coordinator's CI wait. Its absence is not a CI pass: the coordinator still reads exact-head checks itself.
+ */
+export declare const RELEASE_CI_RUNNING_ACTION = "release asked while CI runs";
+export declare const RELEASE_CI_RUNNING_WORDS = "GitHub's checks are still running; nothing deploys until they pass.";
+/** The candidate whose CI was still running when the release task was filed, or null once the plane read it passing. */
+export declare function releaseCiRunningOf(store: Store, taskId: string): {
+    candidate: string | null;
+} | null;
+/** Record that the release task is filed while CI runs on `candidate` (before the task exists). Idempotent. */
+export declare function noteCiRunning(store: Store, input: {
+    taskId: string;
+    candidate: string;
+    now: Date;
+}): void;

package/dist/release-ci-hold.js

@@ -0,0 +1,53 @@
+/**
+ * A release filed while its pull request's CI was still running (pipeline-speed.md D2) waits for CI before anyone but
+ * the automatic road may approve it (Codex review round 1, finding 4): `release-auto.ts holdApprovalForCi` records the
+ * hold before the task is filed, and only the plane's own reading of exact-head CI passing lifts it
+ * (`liftCiHold`). The newest row for the task wins; the hold names the candidate commit it waits on.
+ * Since Alex's decision of 2026-10-29 (a person may approve during CI) the coordinator records a "CI still running"
+ * note instead (below); a hold an older coordinator placed still holds until lifted.
+ */
+export const RELEASE_CI_HELD_ACTION = "release approval waits for CI";
+export const RELEASE_CI_PASSED_ACTION = "release approval CI passed";
+/** The candidate whose CI a release task's approval waits for, or null when nothing holds it. Fail closed: a hold row
+ * whose candidate can't be read still holds. */
+export function releaseCiHoldOf(store, taskId) {
+    const row = store.handle.prepare("SELECT action, detail FROM action_ledger WHERE task_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(taskId, RELEASE_CI_HELD_ACTION, RELEASE_CI_PASSED_ACTION);
+    if (row === undefined || row["action"] !== RELEASE_CI_HELD_ACTION)
+        return null;
+    const detail = typeof row["detail"] === "string" ? row["detail"] : "";
+    return { candidate: /^[0-9a-f]{40}$/.test(detail) ? detail : null };
+}
+/** Why a person can't approve a release waiting for CI yet, in words. */
+export function releaseCiHoldWords(hold) {
+    const commit = hold.candidate === null ? "this release's commit" : hold.candidate.slice(0, 7);
+    return `GitHub CI is still running on ${commit}. This release can be approved once every pull request check passes; \`toolroll release\` asks you then.`;
+}
+/**
+ * A person's release asks for approval while its pull request's CI still runs (Alex, 2026-10-29; pipeline-speed.md,
+ * "Decision: a person's release asks during CI"). This row never holds approval: it lets the approval card say so, until
+ * the plane reads exact-head CI passing (`liftCiHold` records RELEASE_CI_PASSED_ACTION, which ends it as it ends a
+ * hold). Deployment gates and operation issuance also refuse while it remains, so a direct deploy cannot bypass
+ * the coordinator's CI wait. Its absence is not a CI pass: the coordinator still reads exact-head checks itself.
+ */
+export const RELEASE_CI_RUNNING_ACTION = "release asked while CI runs";
+export const RELEASE_CI_RUNNING_WORDS = "GitHub's checks are still running; nothing deploys until they pass.";
+/** The candidate whose CI was still running when the release task was filed, or null once the plane read it passing. */
+export function releaseCiRunningOf(store, taskId) {
+    const row = store.handle.prepare("SELECT action, detail FROM action_ledger WHERE task_id = ? AND action IN (?, ?) ORDER BY id DESC LIMIT 1")
+        .get(taskId, RELEASE_CI_RUNNING_ACTION, RELEASE_CI_PASSED_ACTION);
+    if (row === undefined || row["action"] !== RELEASE_CI_RUNNING_ACTION)
+        return null;
+    const detail = typeof row["detail"] === "string" ? row["detail"] : "";
+    return { candidate: /^[0-9a-f]{40}$/.test(detail) ? detail : null };
+}
+/** Record that the release task is filed while CI runs on `candidate` (before the task exists). Idempotent. */
+export function noteCiRunning(store, input) {
+    if (!/^[0-9a-f]{40}$/.test(input.candidate))
+        throw new Error("a CI note needs the exact candidate commit");
+    const running = releaseCiRunningOf(store, input.taskId);
+    if (running !== null && running.candidate === input.candidate)
+        return;
+    store.recordAction({ at: input.now.toISOString(), actor: "toolroll", repo: store.lookupRef(input.taskId)?.repo ?? null, taskId: input.taskId, runId: null,
+        action: RELEASE_CI_RUNNING_ACTION, outcome: "running", source: "work", detail: input.candidate });
+}

package/dist/release-cli.js

@@ -84,7 +84,10 @@ export const LEASE_DEPRECATION = "`toolroll release <lease>` is now `toolroll wo
 const VALUE_FLAGS = new Set(["--repo", "--limit", "--tap", "--release-gate", "--to", "--request", "--as", "--token", "--schedule"]);
 const BARE_FLAGS = new Set(["--new", "--json", "--help", "--yes", "--no-carry", "--start"]);
 export async function runReleaseCommand(args, write, deps = {}) {
-    const json = args.includes("--json");
+    // The flag, not a secret's value that happens to read "--json".
+    // A secret is never exactly one of these names (the loop below refuses that as a missing value).
+    const bare = new Set(args.filter(one => BARE_FLAGS.has(one)));
+    const json = bare.has("--json");
     const refuse = (reason, message, code) => {
         write(json ? checkedEnvelopeJson({ ok: false, command: "release", reason, message }) : message);
         return code;
@@ -93,14 +96,20 @@ export async function runReleaseCommand(args, write, deps = {}) {
     const limits = {};
     let repo, tap, gate, to, request, as, token, scheduleFlag;
     for (let i = 0; i < args.length; i += 1) {
-        const arg = args[i];
-        if (BARE_FLAGS.has(arg))
+        const raw = args[i];
+        if (BARE_FLAGS.has(raw))
             continue;
+        // `--flag=value` for every value flag; a secret (--token) is also the next argument even when it starts with "--".
+        const equals = raw.startsWith("--") ? raw.indexOf("=") : -1;
+        const arg = equals === -1 ? raw : raw.slice(0, equals);
         if (VALUE_FLAGS.has(arg)) {
-            const value = args[i + 1];
-            if (value === undefined || value.startsWith("--"))
+            const value = equals === -1 ? args[i + 1] : raw.slice(equals + 1);
+            // A secret may start with "--"; it is the value unless it is exactly one of this command's flags (never swallowed).
+            const namesFlag = value !== undefined && (BARE_FLAGS.has(value) || VALUE_FLAGS.has(value.split("=")[0]));
+            if (value === undefined || (equals === -1 && value.startsWith("--") && (arg !== "--token" || namesFlag)))
                 return refuse("usage", `${arg} takes a value.`, 2);
-            i += 1;
+            if (equals === -1)
+                i += 1;
             if (arg === "--repo")
                 repo = value;
             else if (arg === "--to")
@@ -125,23 +134,23 @@ export async function runReleaseCommand(args, write, deps = {}) {
             }
             continue;
         }
-        if (arg.startsWith("--"))
+        if (raw.startsWith("--"))
             return refuse("usage", `Unknown option ${arg}.\n${RELEASE_HELP}`, 2);
         positional.push(arg);
     }
-    if (args.includes("--help")) {
+    if (bare.has("--help")) {
         write(RELEASE_HELP);
         return 0;
     }
     if (gate !== undefined) {
         if (positional.length > 0 || args.some(arg => ["--repo", "--limit", "--tap", "--new"].includes(arg)))
             return refuse("usage", "--release-gate <id> takes no branch or release options.", 2);
-        return runGateRelease(gate, args.includes("--yes"), write, json, deps.gateWorld ?? installedGateWorld());
+        return runGateRelease(gate, bare.has("--yes"), write, json, deps.gateWorld ?? installedGateWorld());
     }
-    if (args.includes("--yes"))
+    if (bare.has("--yes"))
         return refuse("usage", "--yes goes with --release-gate <id>; a release needs no confirmation beyond the owner's approval.", 2);
     if (positional[0] === "nightly" && positional.length === 1)
-        return runNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, schedule: scheduleFlag, start: args.includes("--start") }, write, json, deps);
+        return runNightlyCommand({ repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo), as, token, schedule: scheduleFlag, start: bare.has("--start") }, write, json, deps);
     if (["carry", "revoke", "ask-every-commit", "unsandboxed-carry", "auto-approve", "publish-ok"].includes(positional[0] ?? "") && positional.length === 2) {
         return runAuthorityCommand(positional[0], positional[1], { to, request, as, token, repo: repo === undefined ? undefined : resolve(deps.cwd ?? process.cwd(), repo) }, write, json, deps);
     }
@@ -169,7 +178,7 @@ export async function runReleaseCommand(args, write, deps = {}) {
     const adapters = deps.adapters === undefined
         ? releaseAdapters({ checkout, say, ...(tap === undefined ? {} : { tap }), ...(limits["deploy"] === undefined ? {} : { deployMinutes: limits["deploy"] }) })
         : { ...deps.adapters, say };
-    const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: args.includes("--new"), noCarry: args.includes("--no-carry") }, adapters);
+    const outcome = await runRelease({ branch, checkout, stateDir, limits, fresh: bare.has("--new"), noCarry: bare.has("--no-carry") }, adapters);
     return report(outcome, write, json, lines);
 }
 function report(outcome, write, json, lines) {

package/dist/release-coverage.js

@@ -4,7 +4,7 @@
  * existing records and Git; nothing is written back, so no proof, receipt,
  * scope digest or schema changes. Fails closed: a receipt that can't be read,
  * a missing commit or any Git error leaves the result uncovered. */
-import { execFileSync } from "node:child_process";
+import { viewedGitSync } from "./teardown-git.js";
 import { verificationEvidence } from "./verification-evidence.js";
 import { runCheckLevel } from "./check-levels.js";
 /** How many of the newest passing release checks one read considers. */
@@ -25,7 +25,10 @@ export const gitIsAncestor = (repo, ancestor, descendant) => {
         return known;
     let answer;
     try {
-        execFileSync("git", ["-C", repo, "--no-lazy-fetch", "--no-optional-locks", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "merge-base", "--is-ancestor", ancestor, descendant], { stdio: "ignore", timeout: 5_000 });
+        // Every git version through a frozen read view, bounded (eval-harness review 1, finding 7).
+        const status = viewedGitSync(repo, ["merge-base", "--is-ancestor", ancestor, descendant], { timeoutMs: 5_000 }).status;
+        if (status !== 0)
+            throw Object.assign(new Error("git merge-base"), { status });
         answer = true;
     }
     catch (error) {

package/dist/release-recheck.d.ts

@@ -72,7 +72,7 @@ export declare function planTargetedRecheck(store: Store, root: string, input: {
     now: Date;
 }): RecheckDecision;
 /** Coverage of a check: full, composed from A, partial (never passes), or identity-removed (asks again). */
-export type Coverage = "full" | "composed" | "partial" | "identity-removed";
+export type Coverage = "full" | "composed" | "partial" | "identity-removed" | "no-result";
 /**
  * Whether a targeted run B, with A's sealed evidence, its plan and snapshot, covers every item of B's inventory
  * (coverage conservation), and every required identity passed — re-derived from sealed values only.

package/dist/release-recheck.js

@@ -20,7 +20,7 @@
  * Coverage trusts test code (Alex, 2026-10-25): these results protect against accidental damage, not a hostile test.
  * Authority never reads them; the release's own records do.
  */
-import { CHECK_CONTEXT_CAPTURE, CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, OBLIGATION_SNAPSHOT_CAPTURE, TARGETED_PLAN_CAPTURE, checkContextOf, isUnitFile, payloadDigest, projectGitDir, readSealedJson, treeFactsOf } from "./check-report.js";
+import { CHECK_CONTEXT_CAPTURE, CHECK_INVENTORY_CAPTURE, CHECK_REPORT_CAPTURE, OBLIGATION_SNAPSHOT_CAPTURE, TARGETED_PLAN_CAPTURE, checkContextOf, fullCheckProblem, isUnitFile, payloadDigest, projectGitDir, readSealedJson, treeFactsOf } from "./check-report.js";
 import { readVerifiedCommit, verifiedTreeDiff } from "./commit-extract.js";
 import { checkContextSchema, fileIdentity, groupIdentity, journeyIdentity, obligationSnapshotSchema, readCheckReport, sealedInventorySchema, targetedPlanSchema, unitIdentity, versionIdentity, } from "./contracts/release-check.js";
 import { parseContract } from "./contracts/contract.js";
@@ -483,6 +483,11 @@ export function settleCoverage(store, root, input, gateOf) {
             if (removedProtected(b.report, b.inventory, protectedIdentities(store, root, b.attempt.authority, input.runId)))
                 return removed();
         }
+        // A release's Full check (its task carries signed release terms, before or after its authority opens — an automatic
+        // approval's check runs before) counts only with a complete, valid result (check-report.ts): anything less is no result.
+        const release = b.attempt.authority !== null || (store.getScope(input.taskId)?.releaseTerms ?? null) !== null;
+        if (release && fullCheckProblem({ report: b.report, inventory: b.inventory, exitCode: input.exitCode }) !== null)
+            return { coverage: "no-result", composed: null };
         return { coverage: "full", composed: null };
     }
     if (b.plan === null || b.snapshot === null || b.attempt.baseRun === null || b.attempt.authority === null)