toolroll 0.9.81 → 0.9.83

package/dist/learning-child.js

@@ -0,0 +1,34 @@
+/**
+ * Started only by learning-look.ts: one project's learning recovery (project-learning.ts acceptedIdentities and
+ * recoverLearning) in a process of its own, so its synchronous reads of the project's Git folder can never hold the
+ * console's thread. It opens the database without migrating, does that one project, and ends; the console kills it
+ * at its deadline. Its one argument is JSON naming the database, the evidence folder and the project.
+ */
+import { acceptedIdentities, recoverLearning } from "./project-learning.js";
+import { openStoreNoMigrate } from "./store.js";
+const input = JSON.parse(process.argv[2] ?? "null");
+const text = (value) => typeof value === "string" && value !== "" && !value.includes("\0");
+if (input === null || !text(input.databaseFile) || !text(input.evidenceRoot) || !text(input.repo))
+    process.exit(2);
+const opened = openStoreNoMigrate(input.databaseFile);
+if (!opened.ok)
+    process.exit(3);
+let code = 0;
+try {
+    try {
+        acceptedIdentities(opened.store, input.repo);
+    }
+    catch {
+        code = 1;
+    }
+    try {
+        recoverLearning(opened.store, input.evidenceRoot, input.repo);
+    }
+    catch {
+        code = 1;
+    }
+}
+finally {
+    opened.store.close();
+}
+process.exit(code);

package/dist/learning-look.d.ts

@@ -0,0 +1,25 @@
+import { type FirstTaskSuggestion } from "./first-run.js";
+/** How long one project's recovery may take before it is stopped (the next pass tries again). */
+export declare const LEARNING_LOOK_MS = 60000;
+/** How long reading one project's first-task suggestions may take. */
+export declare const FIRST_TASKS_LOOK_MS = 20000;
+export type LearningOutcome = "done" | "failed" | "no-answer";
+export type LearningRunner = (input: {
+    databaseFile: string;
+    evidenceRoot: string;
+    repo: string;
+}, deadlineMs: number) => Promise<LearningOutcome>;
+/** The production learning runner: learning-child in its own process. */
+export declare const learningChild: LearningRunner;
+/** Recover learning for each project in turn, each in its own bounded process. */
+export declare function recoverLearningOffThread(input: {
+    databaseFile: string;
+    evidenceRoot: string;
+    repos: readonly string[];
+}, options?: {
+    runner?: LearningRunner;
+    deadlineMs?: number;
+}): Promise<Map<string, LearningOutcome>>;
+/** One project's first-task suggestions (first-run.ts findFirstTasks: its issues through gh, its TODOs through the
+ * hardened git) read in a process of its own. Rejects when it failed or didn't answer: the caller keeps the generic ones. */
+export declare function firstTasksOffThread(repo: string, deadlineMs?: number): Promise<FirstTaskSuggestion[]>;

package/dist/learning-look.js

@@ -0,0 +1,72 @@
+/**
+ * Work that reads a project's own folder synchronously, run in a process of its own and killed at a deadline, so a
+ * folder that doesn't answer (a disconnected drive, an iCloud folder macOS is holding) costs that one piece of work,
+ * never the console's thread: learning recovery (learning-child.ts) and Chat's first-task suggestions
+ * (first-tasks-child.ts).
+ */
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {} from "./first-run.js";
+/** How long one project's recovery may take before it is stopped (the next pass tries again). */
+export const LEARNING_LOOK_MS = 60_000;
+/** How long reading one project's first-task suggestions may take. */
+export const FIRST_TASKS_LOOK_MS = 20_000;
+/** Only what git and gh need from the environment (no NODE_OPTIONS, no other secrets). */
+const CHILD_ENV = ["PATH", "HOME", "TMPDIR", "LANG", "USER", "XDG_CONFIG_HOME", "GH_TOKEN", "GITHUB_TOKEN", "GH_HOST", "GH_CONFIG_DIR"];
+/** One of this build's own child entries, given `input` as JSON, killed at the deadline. Its stdout, bounded. */
+function ownChild(name, input, deadlineMs) {
+    return new Promise(resolveOutcome => {
+        const source = import.meta.url.endsWith(".ts");
+        const entry = fileURLToPath(new URL(source ? `./${name}.ts` : `./${name}.js`, import.meta.url));
+        const env = { ELECTRON_RUN_AS_NODE: "1" };
+        for (const one of CHILD_ENV)
+            if (process.env[one] !== undefined)
+                env[one] = process.env[one];
+        const child = spawn(process.execPath, [...(source ? ["--import", import.meta.resolve("tsx")] : []), entry, JSON.stringify(input)], {
+            stdio: ["ignore", "pipe", "ignore"], env, killSignal: "SIGKILL",
+        });
+        child.unref();
+        const chunks = [];
+        let size = 0;
+        let settled = false;
+        const settle = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            child.stdout.destroy();
+            resolveOutcome({ outcome, stdout: Buffer.concat(chunks).toString("utf8") });
+        };
+        const timer = setTimeout(() => { child.kill("SIGKILL"); settle("no-answer"); }, deadlineMs);
+        timer.unref();
+        child.stdout.on("data", (chunk) => { size += chunk.length; if (size <= 1024 * 1024)
+            chunks.push(chunk); });
+        child.once("error", () => settle("failed"));
+        child.once("close", code => settle(code === 0 ? "done" : "failed"));
+    });
+}
+/** The production learning runner: learning-child in its own process. */
+export const learningChild = async (input, deadlineMs) => (await ownChild("learning-child", input, deadlineMs)).outcome;
+/** Recover learning for each project in turn, each in its own bounded process. */
+export async function recoverLearningOffThread(input, options = {}) {
+    const outcomes = new Map();
+    for (const repo of input.repos) {
+        outcomes.set(repo, await (options.runner ?? learningChild)({ databaseFile: input.databaseFile, evidenceRoot: input.evidenceRoot, repo }, options.deadlineMs ?? LEARNING_LOOK_MS));
+    }
+    return outcomes;
+}
+/** One project's first-task suggestions (first-run.ts findFirstTasks: its issues through gh, its TODOs through the
+ * hardened git) read in a process of its own. Rejects when it failed or didn't answer: the caller keeps the generic ones. */
+export async function firstTasksOffThread(repo, deadlineMs = FIRST_TASKS_LOOK_MS) {
+    const ran = await ownChild("first-tasks-child", { repo }, deadlineMs);
+    if (ran.outcome !== "done")
+        throw new Error(`the first-task read ${ran.outcome === "no-answer" ? "didn't answer" : "failed"}`);
+    const parsed = JSON.parse(ran.stdout);
+    if (!Array.isArray(parsed))
+        throw new Error("the first-task read answered something else");
+    return parsed.flatMap((one) => {
+        const row = one;
+        return row !== null && typeof row === "object" && (row.source === "issue" || row.source === "todo" || row.source === "generic") && typeof row.label === "string" && typeof row.draft === "string"
+            ? [{ source: row.source, label: row.label.slice(0, 500), draft: row.draft.slice(0, 4000) }] : [];
+    });
+}

package/dist/memory-pass.js

@@ -10,6 +10,7 @@
  * is the one writer, and it writes through the ordinary knowledge and
  * decision stores so every edit keeps its revision.
  */
+import { inEvalWorld } from './eval-gate.js';
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -188,6 +189,9 @@ export function analysisPrompt(surface, openGaps) {
 /** The production analyser: one call through the configured chat provider, no tools, no history. */
 export function defaultAnalyzer(store, options) {
     return async (input) => {
+        // An eval world makes no provider call it can't record (eval-gate.ts, Codex round 1 #3): the backward pass waits.
+        if (inEvalWorld())
+            return { ok: false, problem: 'The backward pass makes no provider call in an eval world.' };
         const config = store.getChatConfig();
         if (config === null)
             return { ok: false, problem: 'Chat is not configured; the backward pass uses the chat model.' };

package/dist/nightly-check.d.ts

@@ -18,6 +18,8 @@ export declare const NIGHTLY_ACCEPTANCE: readonly {
 }[];
 /** The ledger act that records a person's approval of a nightly check, keyed by its trigger. */
 export declare const NIGHTLY_APPROVED = "nightly check approved";
+/** The ledger act that records a person turning GitHub's nightly into release debt for a project (nightly-github.ts). */
+export declare const GITHUB_NIGHTLY_ON = "github nightly debt on";
 /** The digest a person's approval of the nightly signs: the trigger, the project, the schedule, the check-only terms
  * and the fixed words each firing files. */
 export declare function nightlyDigestOf(trigger: number, repo: string, schedule: string, check: MainCheck): string;
@@ -44,7 +46,8 @@ export declare const TRUSTED_MAIN_CLEAR_MS: number;
  * last read failed, or when the read was of another remote than the one recorded now (review round 2).
  */
 export declare function trustedMainOf(store: Store, repo: string, now: Date, maxAgeMs: number): string | null;
-/** The watch loop's read of each project's recorded remote main that the nightly check or main's debt needs, at most
+/** The watch loop's read of each project's recorded remote main that the nightly check, GitHub's nightly (its runs count
+ * only at commits on main's history) or main's debt needs, at most
  * every 30 minutes. Each read is a fresh fetch into a private directory. A failed read forgets the last one. A good
  * one hands its verified objects to the project's Git store (hardened git, content-addressed: git checks every object
  * against its hash, and filing verifies the commit again), so the nightly can check a merge the checkout never pulled. */

package/dist/nightly-check.js

@@ -36,6 +36,8 @@ export const NIGHTLY_NOT = "Changing anything: this is a check only.";
 export const NIGHTLY_ACCEPTANCE = Object.freeze([{ id: "c1", statement: "The full release check passes on main", how: null, evidence: ["check"] }]);
 /** The ledger act that records a person's approval of a nightly check, keyed by its trigger. */
 export const NIGHTLY_APPROVED = "nightly check approved";
+/** The ledger act that records a person turning GitHub's nightly into release debt for a project (nightly-github.ts). */
+export const GITHUB_NIGHTLY_ON = "github nightly debt on";
 /** The digest a person's approval of the nightly signs: the trigger, the project, the schedule, the check-only terms
  * and the fixed words each firing files. */
 export function nightlyDigestOf(trigger, repo, schedule, check) {
@@ -91,14 +93,15 @@ export function trustedMainOf(store, repo, now, maxAgeMs) {
     }
     return sha;
 }
-/** The watch loop's read of each project's recorded remote main that the nightly check or main's debt needs, at most
+/** The watch loop's read of each project's recorded remote main that the nightly check, GitHub's nightly (its runs count
+ * only at commits on main's history) or main's debt needs, at most
  * every 30 minutes. Each read is a fresh fetch into a private directory. A failed read forgets the last one. A good
  * one hands its verified objects to the project's Git store (hardened git, content-addressed: git checks every object
  * against its hash, and filing verifies the commit again), so the nightly can check a merge the checkout never pulled. */
 export async function refreshTrustedMains(store, root, now, runner = run) {
     const repos = new Set([
         ...store.handle.prepare("SELECT DISTINCT repo FROM main_check_failure WHERE cleared_at IS NULL").all().map(row => String(row["repo"])),
-        ...store.handle.prepare("SELECT DISTINCT repo FROM action_ledger WHERE action = ?").all(NIGHTLY_APPROVED).map(row => String(row["repo"])),
+        ...store.handle.prepare("SELECT DISTINCT repo FROM action_ledger WHERE action IN (?, ?) AND repo IS NOT NULL").all(NIGHTLY_APPROVED, GITHUB_NIGHTLY_ON).map(row => String(row["repo"])),
     ]);
     let read = 0;
     const remotes = new RemoteMains(store, runner, root);

package/dist/nightly-github.d.ts

@@ -0,0 +1,316 @@
+import { GITHUB_NIGHTLY_ON } from "./nightly-check.js";
+import { type Store } from "./store.js";
+export { GITHUB_NIGHTLY_ON };
+/** The one workflow file whose runs count: exactly this path, never one with an `@` suffix or another folder's. */
+export declare const NIGHTLY_WORKFLOW_PATH = ".github/workflows/nightly.yml";
+/** GitHub's re-run horizon: a counted run is read again for new attempts for this long. */
+export declare const NIGHTLY_WATCH_MS: number;
+/** Listing never goes further back than this: no run older than it can still be unfinished. */
+export declare const NIGHTLY_LIST_HORIZON_MS: number;
+/** Pages of runs one read lists at most; a longer backlog resumes on the next read. */
+export declare const NIGHTLY_PAGES_PER_READ = 10;
+/** A boundary's one bounded read (deploy, merge, pre-tag), and the background read's overall deadline. */
+export declare const NIGHTLY_BOUNDARY_READ_MS = 20000;
+export declare const NIGHTLY_BACKGROUND_READ_MS = 60000;
+/** How often the watch loop reads each opted-in project's nightly. */
+export declare const NIGHTLY_BACKGROUND_EVERY_MS: number;
+export declare const SHARDS_PASSED_STEP = "Every shard passed";
+export declare const SHARDS_COVERED_STEP = "Every shard ran the whole suite";
+/** One GitHub REST read through the plane's own gh (release-adapters.ts githubReads), bounded by `timeoutMs`. */
+export type GhRead = (path: string, timeoutMs: number) => Promise<{
+    ok: true;
+    body: unknown;
+} | {
+    ok: false;
+    why: string;
+}>;
+/** Main as the plane read it from the recorded remote: whether a commit is on its first-parent history ("unknown" when
+ * main hasn't been read lately, the commit isn't here yet, or the read of main is older than `since` — a run created
+ * after main was read may be on a main that read hasn't seen), and whether one main commit contains another. */
+export type MainHistory = {
+    /** `deadline`: wall-clock milliseconds by which the local history work stops ("unknown" then). */
+    onMain(sha: string, since: string, deadline: number): "yes" | "no" | "unknown";
+    /** Three-state, like onMain: "unknown" when history couldn't be read whole or the deadline passed. */
+    mainContains(sha: string, ancestor: string, deadline: number): "yes" | "no" | "unknown";
+};
+export type NightlyDeps = MainHistory & {
+    gh: GhRead;
+    now: () => Date;
+};
+/** One read inside a read's deadline. */
+type Get = (path: string) => Promise<{
+    ok: true;
+    body: unknown;
+} | {
+    ok: false;
+    why: string;
+}>;
+/** Whether a project opted in, as the plane recorded a person's step: the newest such ledger row, read strictly. */
+export declare function githubNightlyOf(store: Store, repo: string): {
+    slug: string;
+    url: string;
+    record: number;
+    by: string;
+    at: string;
+} | null;
+/** Every project that ever opted in (a broken or superseded record still counts here: its debt still holds). */
+export declare function githubNightlyRepos(store: Store): string[];
+/** A lane's stable id: its workflow file and the required check's name when it was seeded. */
+export declare const laneIdOf: (workflow: string, name: string) => string;
+/** One lane per required check whose name no lane (by its name or an alias) answers to yet. A retired lane whose name
+ * is required again opens again. */
+export declare function seedLanes(store: Store, repo: string, now: Date): void;
+/** The live lane a job of `workflow` named `name` belongs to: a person's alias first (the newest for that name), then
+ * the lane seeded under it. Never a guess: anything else is no lane. */
+export declare function resolveLane(store: Store, repo: string, workflow: string, name: string): string | null;
+/** The name a lane is shown by: its newest alias, else the name it was seeded under. */
+export declare function laneName(store: Store, repo: string, laneId: string): string;
+/** `toolroll release nightly --github`: a person turns GitHub's nightly into release debt for this project. The
+ * repository is the project's recorded remote's, never the checkout's. */
+export declare function optInGithubNightly(store: Store, input: {
+    repo: string;
+    as: string;
+    token: string;
+}, now: Date): {
+    ok: true;
+    slug: string;
+    lanes: number;
+} | {
+    ok: false;
+    message: string;
+};
+/** `--lane-alias <old-id> <new name>`: a person says a renamed job is the same lane. Open debt goes with the lane. */
+export declare function aliasNightlyLane(store: Store, input: {
+    repo: string;
+    laneId: string;
+    name: string;
+    as: string;
+    token: string;
+}, now: Date): {
+    ok: true;
+} | {
+    ok: false;
+    message: string;
+};
+/** `--lane-retire <lane-id>`: a person retires a lane no required check names any more; its open debt closes,
+ * recorded as theirs. */
+export declare function retireNightlyLane(store: Store, input: {
+    repo: string;
+    laneId: string;
+    as: string;
+    token: string;
+}, now: Date): {
+    ok: true;
+    closed: number;
+} | {
+    ok: false;
+    message: string;
+};
+type GhRun = {
+    id: number;
+    path: string;
+    repository: string | null;
+    headRepository: string | null;
+    headBranch: string | null;
+    headSha: string;
+    event: string;
+    status: string;
+    runAttempt: number;
+    createdAt: string;
+};
+type GhStep = {
+    number: number;
+    name: string;
+    status: string;
+    conclusion: string | null;
+};
+export type GhJob = {
+    id: number;
+    name: string;
+    status: string;
+    conclusion: string | null;
+    startedAt: string | null;
+    completedAt: string | null;
+    headSha: string;
+    runId: number;
+    runAttempt: number | null;
+    steps: GhStep[] | null;
+};
+/** Whether a run is one of the project's own nightly runs on main (everything but main's history, checked apart). */
+export declare function nightlyRunBinds(run: Pick<GhRun, "path" | "repository" | "headRepository" | "headBranch" | "event" | "headSha">, slug: string): boolean;
+export type Cause = "passed" | "test-failure" | "runner-failure" | "not-run";
+/**
+ * Why a completed lane job ended as it did, from GitHub's own job and step records in the same attempt
+ * (evals-nightly.md, "Cause of a failure"). Fails closed: anything not positively the runner's is a test failure.
+ */
+export declare function causeOf(job: GhJob, attempt: readonly GhJob[]): Cause;
+export type NightlyRead = {
+    ok: true;
+    listed: number;
+    checked: number;
+    complete: boolean;
+} | {
+    ok: false;
+    why: string;
+};
+/**
+ * One read of the project's GitHub nightly within `budgetMs`: list runs from the cursor, re-read the watch list (new
+ * and unfinished runs first, then the oldest-checked), record every completed lane job, open and clear failures. A
+ * failed call stops where it is; what was recorded stays, and the cursor never moves past a page it couldn't read.
+ */
+export declare function readGithubNightly(store: Store, repo: string, deps: NightlyDeps, budgetMs: number): Promise<NightlyRead>;
+/** Every job of one exact attempt of one run, every page, each GitHub's record of that run, attempt and commit. Null
+ * when any page can't be read whole. */
+export declare function readAttemptJobs(get: Get, slug: string, run: number, attempt: number, sha: string): Promise<GhJob[] | null>;
+/** A recorded open failure of a lane. */
+export type LaneFailure = {
+    id: number;
+    repo: string;
+    laneId: string;
+    ghRun: number;
+    attempt: number;
+    jobId: number;
+    sha: string;
+    completedAt: string;
+    openedAt: string;
+};
+export declare function openFailures(store: Store, repo: string): LaneFailure[];
+/**
+ * Clear each open failure that a later counted nightly run passed: a run created after the failed run (a rerun of an
+ * older run never clears newer debt; Codex round 1, finding 2), the same lane, a job started after the failed one
+ * completed, on a commit that contains the failed one. A re-run inside the same run never clears. Local history work
+ * stops at `wall` (wall-clock ms); what is left is settled on a later read.
+ */
+export declare function settleGithubNightly(store: Store, repo: string, history: Pick<MainHistory, "mainContains">, now: Date, wall?: number): {
+    cleared: number;
+    complete: boolean;
+    unresolved: string | null;
+};
+/** Main's history as the plane read it from the project's recorded remote (nightly-check.ts trustedMainOf), from the
+ * verified objects in the project's own Git store; never a ref a build could move. */
+export declare function mainHistoryOf(store: Store, repo: string, now: Date): MainHistory;
+/**
+ * The watch loop's background read (operate.ts refreshGithubNightlies): each opted-in project at most every
+ * NIGHTLY_BACKGROUND_EVERY_MS, claimed in the store so two processes don't both read, within one overall deadline.
+ */
+export declare function readGithubNightlies(store: Store, deps: {
+    gh: GhRead;
+    now: () => Date;
+    history?: (repo: string, now: Date) => MainHistory;
+}, budgetMs?: number): Promise<number>;
+/** What a hold stops: a deploy, the merge, the tag (pre-tag authorization), or an automatic approval (sealAutoGreen). */
+export type NightlyPhase = "deploy" | "merge" | "tag" | "auto";
+/** How long a boundary's re-read of a candidate's exemption stands for the stored checks inside the reservation, the
+ * deployment gate and the installed runtime's deploy check after it. */
+export declare const EXEMPTION_FRESH_MS: number;
+/** "Oct 30, 06:17 UTC". */
+export declare const nightlyStamp: (iso: string) => string;
+/** The words of a nightly hold: the first open failure, how many more, and the way out at this point. */
+export declare function nightlyDebtWords(store: Store, held: readonly LaneFailure[], phase: NightlyPhase, release: boolean): string;
+/**
+ * The stored check every boundary makes, inside the caller's own transaction where it has one (the deployment gate, the
+ * deploy and merge reservations, the pre-tag step, an automatic approval): the project's open lane failures, less those
+ * this exact task and candidate hold a fresh exemption for. Null when nothing holds. A project that never opted in has
+ * no lane failures.
+ */
+export declare function nightlyDebtHold(store: Store, input: {
+    repo: string;
+    taskId: string | null;
+    candidate: string | null;
+    phase: NightlyPhase;
+    release: boolean;
+    now: Date;
+}): {
+    why: string;
+    failures: LaneFailure[];
+} | null;
+/** How the project's GitHub nightly stands: whether it is on, when it was last read (and why not), when it last ran. */
+export type NightlyStatus = {
+    on: boolean;
+    lastOkAt: string | null;
+    lastWhy: string | null;
+    lastRunAt: string | null;
+    stale: boolean;
+};
+/** No nightly run seen for this long reads "hasn't run since". */
+export declare const NIGHTLY_STALE_MS: number;
+export declare function githubNightlyStatus(store: Store, repo: string, now: Date): NightlyStatus;
+/** A warning that never holds anything (Decision 1): GitHub couldn't be read, or the nightly hasn't run lately. */
+export declare function nightlyWarning(status: NightlyStatus, now: Date): string | null;
+/** One workflow's newest pull-request run on a candidate head, as an exemption reads it. */
+export type LaneJobs = {
+    run: number;
+    attempt: number;
+    status: string;
+    jobs: GhJob[];
+};
+/**
+ * A release candidate's own pull-request CI, as an exemption needs it (modelled on scripts/release-proof.mjs): for each
+ * workflow, the newest run on `head` from that pull request's `pull_request` event, that run's latest attempt's jobs
+ * with their times, then the run read again. The newest run is chosen first: one that doesn't bind to this pull
+ * request never lets an older run stand. `null` for a workflow with no such run; "unreadable" when anything can't be
+ * read whole or changed during the read.
+ */
+export declare function readLaneJobs(get: Get, slug: string, pr: number, head: string, workflows: readonly string[]): Promise<Map<string, LaneJobs | null> | "unreadable">;
+/** The files a lane's job runs that the candidate could otherwise rewrite to make a job of that name pass: its workflow
+ * file and the CI scripts the workflows call. An exemption stands only when each is byte-identical (the same Git
+ * blob) on the candidate and at the failed commit. The tests themselves are the candidate's, as for every required
+ * check (the trust the required-checks gate already places in them). */
+export declare const LANE_PINNED_FILES: readonly ["scripts/ci-shards.mjs", "scripts/ci-scope.mjs", "scripts/ci-git.sh", "scripts/ci-no-skips.mjs"];
+export type NightlyBoundary = {
+    ok: true;
+    warning: string | null;
+} | {
+    ok: false;
+    why: string;
+    warning: string | null;
+};
+/**
+ * A boundary (the coordinator's deploy, merge and pre-tag steps): one bounded read of GitHub's nightly, then this
+ * candidate's exemptions read again from its own pull-request CI — minted only before the merge (`deploy`, `merge`);
+ * at the tag an exemption obtained before the merge is re-read, never made — then the stored debt. A read that fails is
+ * a warning and the stored debt still holds; an exemption that can't be re-read is no exemption here.
+ */
+export declare function nightlyBoundary(store: Store, input: {
+    repo: string;
+    taskId: string;
+    candidate: string;
+    pr: number;
+    phase: Exclude<NightlyPhase, "auto">;
+}, deps: NightlyDeps, budgetMs?: number): Promise<NightlyBoundary>;
+/** One project-level Needs-you item: an open GitHub nightly lane failure, or a nightly check of main that failed. */
+export type NightlyNeed = {
+    key: string;
+    repo: string;
+    title: string;
+    reason: string;
+    href: string;
+    since: string;
+};
+/**
+ * Needs you, for the projects `shown` admits: one item per open GitHub nightly lane failure (linking to its job on
+ * GitHub, under the opted-in repository the plane recorded), and one per nightly check of main with open failures
+ * (linking to its task). Oldest first.
+ */
+export declare function nightlyNeedsYou(store: Store, shown: (repo: string) => boolean): NightlyNeed[];
+/** The release card's GitHub nightly lines: each open lane failure (held, or exempted for this candidate), then a
+ * warning when GitHub couldn't be read or the nightly hasn't run lately. Empty when there is nothing to say. */
+export declare function nightlyReleaseLines(store: Store, input: {
+    repo: string;
+    taskId: string;
+    candidate: string | null;
+    now: Date;
+}): string[];
+/**
+ * A deploy run's own boundary (scripts/deploy-browser.mjs, through the installed runtime; Codex round 1, finding 3):
+ * the same bounded read as the coordinator's — GitHub's nightly, then this candidate's exemptions re-read — before the
+ * stored check, so a deploy started by hand neither misses a new failure nor rides an exemption its CI no longer
+ * supports. A task no release covers has no exemption to re-read; its nightly is still read. Anything that fails here
+ * takes away the candidate's stored exemptions; the stored check that follows decides.
+ */
+export declare function refreshNightlyForDeploy(store: Store, input: {
+    runId: number;
+    now: () => Date;
+    gh?: GhRead;
+    budgetMs?: number;
+}): Promise<NightlyBoundary | null>;