toolroll 0.9.89 → 0.9.91

package/dist/person-proof.js

@@ -3,6 +3,9 @@
 const METHOD_IS_PERSON = {
     "password-now": true, "sso-now": true, "fresh-password": true, "fresh-sso": true, "session": true, "cli-login": true,
     "remote-token": false, "lead-token": false,
+    // Easy-start C1: the laptop's own owner in an allowlisted act — a person, standing only while local mode stays on at
+    // the generation it was given under (approval-authority.ts localSealStandsSql).
+    "local-owner": true,
 };
 /** Proofs that aren't credential methods: the paired-chat tap, and the phone plan's passkey ceremony. */
 const OTHER_PERSON_PROOFS = new Set(["chat", "passkey"]);

package/dist/project-knowledge.d.ts

@@ -22,19 +22,18 @@ export type KnowledgeView = ReturnType<typeof knowledgeView>;
 export declare function knowledgeVersion(store: Store, repo: string, actor: string, revision: number): Knowledge;
 /** Chat reads only an admitted project. Keep the full source in the project UI. */
 export declare function conversationKnowledge(store: Store, repo: string, actor: string, reference?: string, decision?: number): {
-    history?: never;
+    content?: never;
     revision: number;
     stale: boolean;
     notice: string;
     decision?: never;
     title?: never;
-    content?: never;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    revision?: never;
-    history?: never;
+    content?: never;
     stale?: never;
     decision: {
         repo: string;
@@ -52,26 +51,27 @@ export declare function conversationKnowledge(store: Store, repo: string, actor:
     };
     notice: string;
     title?: never;
-    content?: never;
+    revision?: never;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
-    history?: never;
     stale?: never;
     decision?: never;
     revision: number;
     title: string;
     content: string;
     notice: string;
+    history?: never;
     instructions?: never;
     references?: never;
     decisions?: never;
 } | {
+    content?: never;
     stale?: never;
     decision?: never;
     title?: never;
-    content?: never;
     revision: number;
     history: {
         revision: number;

package/dist/quick-start.d.ts

@@ -1,4 +1,4 @@
-import { type AttachSeams } from "./console-instance.js";
+import { type AttachProof, type AttachSeams } from "./console-instance.js";
 export type QuickStartSeams = {
     databaseFile: string;
     cwd: string;
@@ -20,5 +20,7 @@ export type QuickStartSeams = {
 };
 /** Whether argv is a bare `toolroll` (nothing, or only --json). */
 export declare const isBareInvocation: (argv: readonly string[]) => boolean;
+/** This database's console, proved live without creating, migrating or changing anything (also easy-start.ts's). */
+export declare function proveConsoleReadOnly(databaseFile: string, build: string, attach?: AttachSeams): Promise<AttachProof>;
 /** null: not this command (outside a repository) — the caller scans as before. */
 export declare function runQuickStart(argv: readonly string[], write: (line: string) => void, seams: QuickStartSeams): Promise<number | null>;

package/dist/quick-start.js

@@ -45,7 +45,12 @@ function databasePresence(file) {
         return error.code === "ENOENT" ? "absent" : "unknown";
     }
 }
-async function prove(seams) {
+function prove(seams) {
+    return proveConsoleReadOnly(seams.databaseFile, seams.build, seams.attach ?? {});
+}
+/** This database's console, proved live without creating, migrating or changing anything (also easy-start.ts's). */
+export async function proveConsoleReadOnly(databaseFile, build, attach = {}) {
+    const seams = { databaseFile, build, attach };
     // Read only, never created or migrated, never cleaned up: proving changes nothing. "None" only when nothing of this
     // build can be running on it (no database yet, or one older than this build, which `up` brings up to date); a
     // database that can't be read, is mid-upgrade or is newer than this build can't be checked, so it is refused.

package/dist/release-adapters.d.ts

@@ -62,6 +62,8 @@ export type AdapterOptions = {
     formula?: string;
     /** How long the deployment itself may run, in minutes. */
     deployMinutes?: number;
+    /** The Toolroll CLI the release calls, as [program, ...leading args]; by default this runtime's own bin.js. */
+    cli?: readonly string[];
     run?: Exec;
     fetch?: typeof fetch;
     say?: (line: string) => void;

package/dist/release-adapters.js

@@ -10,6 +10,7 @@ import { existsSync, lstatSync, mkdtempSync, readdirSync, readFileSync, realpath
 import { homedir, tmpdir } from "node:os";
 import { basename, delimiter, dirname, join } from "node:path";
 import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
 import { parse as parseYaml } from "yaml";
 import { sleep } from "./sleep.js";
 import { callLabel, readOnlyCall, retryCall, retryingExec, writeWithRecheck } from "./release-net.js";
@@ -50,6 +51,13 @@ export const exec = (command, args, options = {}) => new Promise(done => {
         child.stdin?.end();
 });
 /** Without NODE_OPTIONS, which a test runner or debugger may have left for this process. */
+/** This runtime's own CLI (dist/bin.js beside this module) when it has one; from source, `toolroll` as installed. */
+const ownCli = () => {
+    const bin = join(dirname(fileURLToPath(import.meta.url)), "bin.js");
+    return existsSync(bin) ? [process.execPath, bin] : ["toolroll"];
+};
+/** Journal phases the deployment's finish accepts (scripts/deploy-phases.mjs finish): the new service runs, unproven. */
+const FINISHES_FORWARD = Object.freeze(["started", "healthy"]);
 const cleanEnv = (extra = {}) => {
     const env = { ...process.env, ...extra };
     delete env["NODE_OPTIONS"];
@@ -244,8 +252,11 @@ export function releaseAdapters(options) {
     /** A write by gh, never retried by itself. */
     const ghWrite = (remainingMs, ...args) => run(tools.gh, args, { cwd: "/", env: gitEnv, timeoutMs: Math.min(120_000, remainingMs) });
     const ghJson = async (what, ...args) => JSON.parse(await must(gh(...args), what));
+    // The build running this release, never a PATH lookup: until the link step, `toolroll` on PATH is still the previous
+    // build, which refuses a database the deployment migrated, so a release resumed after its deploy couldn't read its task.
+    const cli = options.cli ?? ownCli();
     const toolroll = async (...args) => {
-        const result = await run("toolroll", [...args, "--json"], { env: cleanEnv(), timeoutMs: 120_000 });
+        const result = await run(cli[0], [...cli.slice(1), ...args, "--json"], { env: cleanEnv(), timeoutMs: 120_000 });
         try {
             return object(JSON.parse(result.stdout));
         }
@@ -562,6 +573,24 @@ export function releaseAdapters(options) {
                 const running = (options.processes ?? processes)().filter(one => one.command.includes("deploy-browser.mjs") && one.command.includes(stage));
                 if (running.length > 0)
                     return { ok: false, message: `the deployment is still running (process ${running.map(one => one.pid).join(", ")}); let it finish, then rerun` };
+                // The new service started (deploy-rescue.ts FORWARD_ONLY): recovery refuses to roll it back, so the release
+                // resumes it forward with the deployment's own finish (health, both consoles, leases, then the pause lifted).
+                // Finishing deploys, so the candidate is proven first, as for a deploy.
+                const phase = (() => { try {
+                    return object(JSON.parse(readFileSync(join(stage, "deployment.json"), "utf8")))["phase"];
+                }
+                catch {
+                    return undefined;
+                } })();
+                if (FINISHES_FORWARD.includes(String(phase))) {
+                    const proven = proveCandidate(runId);
+                    if (!proven.ok)
+                        return stopped(stage, proven.message);
+                    const finished = await deployScript(worktree, stage, runId, proven, ["--yes", "--phase", "finish"]);
+                    if (finished.code === 0)
+                        return { ok: true };
+                    return stopped(stage, `${tail(finished)} (the deployment journal is at ${String(phase)}; finishing it forward stopped; ${join(stage, "deployment.json")})`);
+                }
                 // Recovery needs no approval, but it runs only the recorded commit's own script, extracted by this runtime.
                 const recorded = recordedCommit(runId);
                 if (recorded === null)

package/dist/release-cli.js

@@ -297,7 +297,8 @@ function installedGateWorld() {
             db.exec("PRAGMA busy_timeout=5000");
             return db;
         },
-        servicePlists: () => ["com.toolroll.browser", "com.standing-orders.browser"].map(label => join(agents, `${label}.plist`))
+        // The laptop service too: two services on one database is a conflict the gate names, never one it skips.
+        servicePlists: () => ["com.toolroll.browser", "com.standing-orders.browser", "com.toolroll.up"].map(label => join(agents, `${label}.plist`))
             .filter(path => existsSync(path)).map(path => ({ path, text: readFileSync(path, "utf8") })),
     };
 }

package/dist/runner-process.d.ts

@@ -65,3 +65,12 @@ export declare function recordedHolderProvedGone(file: string, holder: {
     gone: false;
     why: string;
 };
+/**
+ * Whether a record is authentic for exactly this registration on this host (the checks holderProvedGone makes before
+ * it looks at any process): sealed with the stored credential hash, for this runner, host, registration and
+ * credential. Null when it stands; otherwise why not. It says nothing about which processes still run.
+ */
+export declare function recordStandsFor(record: RunnerProcessRecord | null, holder: {
+    runner: Runner;
+    credentialHash: string;
+}, host: string): string | null;

package/dist/runner-process.js

@@ -217,3 +217,21 @@ export function recordedHolderProvedGone(file, holder, host, probe = realProcess
         return { gone: false, why: "its process record changed during the exit proof" };
     return proof;
 }
+/**
+ * Whether a record is authentic for exactly this registration on this host (the checks holderProvedGone makes before
+ * it looks at any process): sealed with the stored credential hash, for this runner, host, registration and
+ * credential. Null when it stands; otherwise why not. It says nothing about which processes still run.
+ */
+export function recordStandsFor(record, holder, host) {
+    if (record === null)
+        return "no readable record of its processes";
+    const expected = sealRunnerProcessRecord(record, holder.credentialHash).signature;
+    if (typeof record.signature !== "string" || !/^[a-f0-9]{64}$/.test(record.signature)
+        || !timingSafeEqual(Buffer.from(record.signature, "hex"), Buffer.from(expected, "hex")))
+        return "its process record is not authenticated";
+    if (record.runner !== holder.runner.name || record.host !== holder.runner.host || record.host !== host)
+        return "its record is for another worker or machine";
+    if (record.registeredAt !== holder.runner.registeredAt || record.credential !== credentialDigest(holder.credentialHash))
+        return "its record is from an earlier start";
+    return null;
+}

package/dist/sample-project.d.ts

@@ -0,0 +1,31 @@
+import { type ExecResult, type RunOptions } from "./exec.js";
+import type { Store } from "./store.js";
+export type GitRun = (file: string, args: readonly string[], options: RunOptions) => Promise<ExecResult>;
+export type SampleOutcome = {
+    ok: true;
+    path: string;
+    created: boolean;
+} | {
+    ok: false;
+    reason: "no-root" | "exists" | "failed";
+    message: string;
+};
+/** Make (or find again) the sample project in `root`, the folder projects go in. */
+export declare function createSampleProject(root: string | null, git?: GitRun): Promise<SampleOutcome>;
+/** The sample's own check: its one test file, run by Node's test runner. Fixed here; never anyone's input. */
+export declare const SAMPLE_CHECK_COMMAND = "node --test";
+/** Who the sample's check is recorded as approved by: Toolroll itself, never the person who clicked (no step-up). */
+export declare const SAMPLE_CHECK_ACTOR = "toolroll";
+/**
+ * The sample project's check, set as part of making it, so its first result reads checked: the fixed command above,
+ * recorded as Toolroll's (SAMPLE_CHECK_ACTOR), with the person who added the sample named in the ledger line. Only
+ * for a sample this request just made (the caller passes createSampleProject's `created: true`; a folder found again
+ * is never armed), only for the folder this made (our marker in its .git), and only while the project has never had
+ * a check at all (no verify_command row, live or revoked, for it or its quick check): a check someone cleared stays
+ * cleared, and one someone approved is never replaced. It takes no command: this is not a way to set a project's
+ * check. True when it set one now.
+ */
+export declare function registerSampleCheck(store: Pick<Store, "transact" | "handle" | "setVerifyCommand" | "recordAction">, made: {
+    path: string;
+    created: boolean;
+}, repo: string, addedBy: string, now: Date): boolean;

package/dist/sample-project.js

@@ -0,0 +1,141 @@
+/**
+ * The sample project the welcome offers ("Try a sample project"): a small real git repository — a README, one function
+ * and its test — made in the project folder, so a first task has something true to change. It is registered like any
+ * other project by its caller (project-admission.ts).
+ *
+ * The folder is claimed with an exclusive mkdir; a folder already there is used again only when it is ours (a real
+ * directory, not a link, holding our marker inside its .git), and refused otherwise: nothing in someone else's folder
+ * is touched. Git runs hardened (no system or global config, no hooks or hook templates, no fsmonitor, no signing, no
+ * prompts, an allowlisted environment), and a folder this call made is removed again when making it fails.
+ */
+import { lstatSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { run } from "./exec.js";
+import { SAMPLE_PROJECT_NAME } from "./first-run.js";
+import { ENV, ENV_ALLOWLIST } from "./remote-main.js";
+import { TEARDOWN_FLAGS } from "./teardown-git.js";
+/** Inside the sample's .git: says the folder is the one this made (never tracked, so the work tree stays clean). */
+const MARKER = "toolroll-sample";
+const MARKER_TEXT = "Made by Toolroll's welcome as the sample project.\n";
+const FILES = {
+    "README.md": `# Toolroll sample
+
+A tiny project to try Toolroll on. \`src/price.js\` has one function, and \`test/price.test.js\` checks it.
+
+Run the tests with \`npm test\` (Node.js 22 or newer, nothing to install).
+
+Things to ask for:
+
+- Round prices to whole cents and add a test for it.
+- Refuse a negative discount with a clear error.
+- Add a short usage example to this README.
+`,
+    "package.json": `${JSON.stringify({ name: "toolroll-sample", version: "1.0.0", private: true, type: "module", scripts: { test: "node --test" } }, null, 2)}\n`,
+    "src/price.js": `/** The price after a percentage discount: priceWithDiscount(80, 25) is 60. */
+export function priceWithDiscount(price, percent) {
+  return price - (price * percent) / 100;
+}
+`,
+    "test/price.test.js": `import assert from "node:assert/strict";
+import { test } from "node:test";
+import { priceWithDiscount } from "../src/price.js";
+
+test("takes the discount off the price", () => {
+  assert.equal(priceWithDiscount(80, 25), 60);
+});
+`,
+    ".gitignore": "node_modules/\n",
+};
+/** Git for the sample: fixed settings first, an allowlisted environment with no system or global config. */
+const SAMPLE_FLAGS = [
+    ...TEARDOWN_FLAGS, "-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false", "-c", "init.templateDir=",
+    "-c", "user.name=Toolroll", "-c", "user.email=sample@toolroll.invalid", "-c", "core.autocrlf=false",
+];
+function kindOf(path) {
+    try {
+        const seen = lstatSync(path);
+        return seen.isDirectory() && !seen.isSymbolicLink() ? "dir" : "other";
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? "missing" : "other";
+    }
+}
+/** Ours: a real folder whose .git is a real folder holding our marker, a regular file with our words. */
+function isOurs(target) {
+    if (kindOf(target) !== "dir" || kindOf(join(target, ".git")) !== "dir")
+        return false;
+    const marker = join(target, ".git", MARKER);
+    try {
+        const seen = lstatSync(marker);
+        return seen.isFile() && seen.size === Buffer.byteLength(MARKER_TEXT) && readFileSync(marker, "utf8") === MARKER_TEXT;
+    }
+    catch {
+        return false;
+    }
+}
+/** Make (or find again) the sample project in `root`, the folder projects go in. */
+export async function createSampleProject(root, git = run) {
+    if (root === null || root === "" || !isAbsolute(root) || kindOf(root) !== "dir") {
+        return { ok: false, reason: "no-root", message: "There's no project folder to put the sample in." };
+    }
+    const target = join(root, SAMPLE_PROJECT_NAME);
+    if (isOurs(target))
+        return { ok: true, path: target, created: false };
+    try {
+        mkdirSync(target); // the claim: exclusive, and never through a link
+    }
+    catch {
+        return { ok: false, reason: "exists", message: `A folder named ${SAMPLE_PROJECT_NAME} is already there, so nothing was changed.` };
+    }
+    const fail = () => {
+        try {
+            rmSync(target, { recursive: true, force: true });
+        }
+        catch { /* left for a person to remove */ }
+        return { ok: false, reason: "failed", message: "The sample project couldn't be made. Nothing was added." };
+    };
+    try {
+        for (const [file, body] of Object.entries(FILES)) {
+            const path = join(target, file);
+            mkdirSync(join(path, ".."), { recursive: true });
+            writeFileSync(path, body, { flag: "wx" });
+        }
+        const options = { cwd: target, env: ENV, envAllowlist: ENV_ALLOWLIST, timeoutMs: 30_000 };
+        for (const args of [["init", "-q", "--template=", "-b", "main"], ["add", "--", "."], ["commit", "-q", "--no-verify", "-m", "Sample project"]]) {
+            const ran = await git("git", [...SAMPLE_FLAGS, ...args], options);
+            if (ran.code !== 0)
+                return fail();
+        }
+        writeFileSync(join(target, ".git", MARKER), MARKER_TEXT, { flag: "wx", mode: 0o600 });
+    }
+    catch {
+        return fail();
+    }
+    return { ok: true, path: target, created: true };
+}
+/** The sample's own check: its one test file, run by Node's test runner. Fixed here; never anyone's input. */
+export const SAMPLE_CHECK_COMMAND = "node --test";
+const SAMPLE_CHECK_TIMEOUT_MS = 60_000;
+/** Who the sample's check is recorded as approved by: Toolroll itself, never the person who clicked (no step-up). */
+export const SAMPLE_CHECK_ACTOR = "toolroll";
+/**
+ * The sample project's check, set as part of making it, so its first result reads checked: the fixed command above,
+ * recorded as Toolroll's (SAMPLE_CHECK_ACTOR), with the person who added the sample named in the ledger line. Only
+ * for a sample this request just made (the caller passes createSampleProject's `created: true`; a folder found again
+ * is never armed), only for the folder this made (our marker in its .git), and only while the project has never had
+ * a check at all (no verify_command row, live or revoked, for it or its quick check): a check someone cleared stays
+ * cleared, and one someone approved is never replaced. It takes no command: this is not a way to set a project's
+ * check. True when it set one now.
+ */
+export function registerSampleCheck(store, made, repo, addedBy, now) {
+    if (!made.created || !isAbsolute(repo) || !isOurs(repo))
+        return false;
+    return store.transact(() => {
+        if (store.handle.prepare("SELECT 1 FROM verify_command WHERE repo IN (?, ?) LIMIT 1").get(repo, `quick:${repo}`) !== undefined)
+            return false;
+        store.setVerifyCommand({ repo, command: SAMPLE_CHECK_COMMAND, timeoutMs: SAMPLE_CHECK_TIMEOUT_MS, approvedBy: SAMPLE_CHECK_ACTOR }, now);
+        store.recordAction({ at: now.toISOString(), actor: SAMPLE_CHECK_ACTOR, repo, taskId: null, runId: null, action: "check approved", outcome: "approved", source: "policy",
+            detail: `the sample project's own test (${SAMPLE_CHECK_COMMAND}), set by Toolroll when ${addedBy} added the sample` });
+        return true;
+    });
+}

package/dist/scope.d.ts

@@ -1,5 +1,6 @@
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS, type EvidenceKind } from "./contracts/acceptance-terms.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { type LocalTransport } from "./local-owner.js";
 import { isAcpProfile, type AcpProviderId } from "./acp-agents.js";
 export { isAcpProfile };
 import { type NetworkProfile } from "./egress.js";
@@ -651,7 +652,9 @@ export type FreshOp = "approve-standard" | "chat-send" | "reply-question";
 /** "session": Passwordless is on and this is the person's own live browser session (docs/plans/passwordless.md). */
 /** "remote-token" / "lead-token": a machine credential stood in for the person (a remote run's API token, a lead's
  * token) — fine for ordinary acts it is allowed, never for a credential act (it would mint a way in with no password). */
-export type AuthMethod = "password-now" | "sso-now" | "fresh-password" | "fresh-sso" | "session" | "cli-login" | "remote-token" | "lead-token";
+/** "local-owner" (easy-start C1): the local owner of a laptop install, in an allowlisted act (local-owner.ts) — a person,
+ * never a credential act, and its approvals stand only while local mode stays on at their generation. */
+export type AuthMethod = "password-now" | "sso-now" | "fresh-password" | "fresh-sso" | "session" | "cli-login" | "remote-token" | "lead-token" | "local-owner";
 /**
  * The local CLI's remembered login, marked for the one command that read it (operate.ts credentialsFrom): with
  * Passwordless on, a proof made with it records "cli-login" — never a typed password — and no credential act accepts it.
@@ -794,7 +797,10 @@ export declare function approve(store: Store, taskId: string, by: string, now: D
 /** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
 export declare const APPROVAL_PROOF = "approval proved";
 /** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
-export declare const approvalProofDetail: (at: number, generation: number, digest: string) => string;
+export declare const approvalProofDetail: (at: number, generation: number, digest: string, local?: {
+    generation: number;
+    transport: LocalTransport;
+}) => string;
 /** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
 export declare function approvalProofOf(store: Store, taskId: string, by: string, digest: string): {
     method: string;
@@ -1007,3 +1013,19 @@ export declare function releaseApprovalOf(store: Store, taskId: string, _now?: D
 /** When a password typed at `at` (ISO) stops standing in, for a page's words (ISO); null when `at` isn't a time. Words
  * only: freshnessFor decides whether it stands in, at the moment of use. */
 export declare function freshUntil(at: string): string | null;
+export type LocalApprovalRefusal = "local-mode-off" | "not-owner" | "no-scope" | "release" | "protected" | "escalated" | "coordinator" | "unsandboxed";
+/**
+ * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
+ * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
+ * precheck (an empty field passes) and the seal itself (approve(), inside its transaction). Refused: local mode off or
+ * another person; no plan; release or deploy terms; protected or two-person work; an escalated profile; work a
+ * coordinator filed; a project whose checks are stored as unsandboxed (or a plan that sealed that). Plans a lead or
+ * a scout proposed are allowed.
+ */
+export declare function localApprovalEligible(store: Store, by: string, taskId: string): {
+    ok: true;
+} | {
+    ok: false;
+    reason: LocalApprovalRefusal;
+    message: string;
+};

package/dist/scope.js

@@ -6,6 +6,7 @@ import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from ".
 import { validateScopeText } from "./task-text.js";
 import { contractChangesOf } from "./contract-changes.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { currentLocalOwner, localModeOn, localOwnerInFlight, localOwnerRefusal, localOwnerStandsNow } from "./local-owner.js";
 import { projectAuthority } from "./project-access.js";
 import { activeRemote } from "./remote-run.js";
 import { claimActor, currentActor } from "./actor.js";
@@ -824,7 +825,9 @@ export function authenticateAccount(store, by, secret) {
     const hash = account?.credentialHash ?? dummy;
     if (!hash.startsWith("scrypt$"))
         verifyCredential(dummy, secret);
-    const matches = verifyCredential(hash, secret);
+    // v147: an account with no password set (a local-mode owner) has a random hash; the KDF still runs (same timing), and
+    // nothing it is given ever matches.
+    const matches = verifyCredential(hash, secret) && account !== null && account.passwordSet;
     if (account === null || !matches) {
         guard.failed(by, now, source, account !== null);
         return { ok: false, reason: "unknown" };
@@ -902,6 +905,16 @@ export function ssoNowAvailable(by, now = Date.now()) {
  */
 export function proveAccountNow(store, by, token, options = {}) {
     const now = Date.now();
+    // Easy-start C1: a local owner is decided FIRST, before Passwordless and freshness, whatever was typed. An allowlisted
+    // act of its own, still standing (re-read here, inside the caller's transaction), is "local-owner"; anything else —
+    // a credential act, a read, another person, local mode moved — proves nothing. It never upgrades to a typed password.
+    // A lead's token or a remote API token in that chain is never the local owner (it stays a machine's proof below).
+    const local = activeRemote() === null && currentActor()?.lead !== true ? currentLocalOwner() : null;
+    if (local !== null) {
+        if (options.credential === true || local.account !== by || local.act === "read" || !localOwnerInFlight(local) || !localOwnerStandsNow(store, local))
+            return { ok: false, reason: "not-an-approver" };
+        return { ok: true, method: "local-owner", at: now };
+    }
     const facts = freshFacts.getStore();
     if (facts != null && facts.actor === by && !facts.live())
         return { ok: false, reason: "not-an-approver" };
@@ -1072,6 +1085,16 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         // credential, not a person at a ceremony. Refused before any vote or proof row is written.
         if (!personProof(authenticated.method))
             return { ok: false, reason: "machine-proof" };
+        // Easy-start C5: a local owner approves only as the approve-plan act, and only eligible work (one shared rule:
+        // localApprovalEligible, read again here inside the seal's transaction).
+        const local = authenticated.method === "local-owner" ? currentLocalOwner() : null;
+        if (authenticated.method === "local-owner") {
+            if (local === null || local.act !== "approve-plan")
+                return { ok: false, reason: "policy", message: localOwnerRefusal(store.accountOf(by)?.passwordSet === true, "/").message };
+            const eligible = localApprovalEligible(store, by, taskId);
+            if (!eligible.ok)
+                return { ok: false, reason: "policy", message: eligible.message };
+        }
         const scope = store.getScope(taskId);
         if (scope === null)
             return { ok: false, reason: "no-scope" };
@@ -1121,7 +1144,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         // How the person was proved, beside every yes they give (a vote kept for protected work, or the seal): a password
         // typed now, a re-check now, or a remembered one — with when, the credential generation and the exact digest.
         const proved = () => store.recordAction({ at: now.toISOString(), actor: by, repo: store.lookupRef(taskId)?.repo ?? null, taskId, runId: null, action: APPROVAL_PROOF,
-            outcome: authenticated.method, source: "work", detail: approvalProofDetail(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest) });
+            outcome: authenticated.method, source: "work", detail: approvalProofDetail(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest, local === null ? undefined : { generation: local.localGeneration, transport: local.transport }) });
         if (gate.verdict === "vote") {
             // The same person again adds nothing: no new vote, no proof row (and the approval roads refund a re-check).
             if (gate.already)
@@ -1161,7 +1184,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
 /** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
 export const APPROVAL_PROOF = "approval proved";
 /** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
-export const approvalProofDetail = (at, generation, digest) => `${new Date(at).toISOString()} · generation ${generation} · digest ${digest}`;
+export const approvalProofDetail = (at, generation, digest, local) => `${new Date(at).toISOString()} · generation ${generation}${local === undefined ? "" : ` · local ${local.generation} ${local.transport}`} · digest ${digest}`;
 /** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
 export function approvalProofOf(store, taskId, by, digest) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);
@@ -1398,6 +1421,10 @@ export function proofDetailOf(detail) {
         }
     }
     const parts = detail.split(" · ");
+    // Easy-start C5: a local owner's proof names its local generation and transport between the two (approvalProofDetail).
+    const local = parts.length === 4 ? parts.splice(2, 1)[0] : null;
+    if (local !== null && !/^local \d+ (browser|terminal)$/.test(local))
+        return null;
     if (parts.length !== 3 || !parts[2].startsWith("digest ") || !/^generation \d+$/.test(parts[1]) || Number.isNaN(Date.parse(parts[0])))
         return null;
     return { at: parts[0], digest: parts[2].slice("digest ".length) };
@@ -1616,3 +1643,47 @@ export function freshUntil(at) {
     const ms = Date.parse(at);
     return Number.isFinite(ms) ? new Date(ms + FRESH_WINDOW_MS).toISOString() : null;
 }
+const LOCAL_APPROVAL_WORDS = {
+    "local-mode-off": "Local mode is off: approve with your password.",
+    "not-owner": "Only this computer's owner approves here without a password.",
+    "no-scope": "This task has no plan to approve yet.",
+    release: "Releases and deploys need your password.",
+    protected: "Protected work needs your password and a second approver.",
+    escalated: "Work with wider permissions needs your password.",
+    coordinator: "Work a coordinator filed needs your password.",
+    unsandboxed: "This project's checks run without a sandbox, so approving needs your password.",
+};
+/**
+ * Whether the local owner may approve this task without a password (easy-start plan C5). ONE rule, read by the
+ * preview (the task page's approve form and the chat review render no password field when it is ok), the chat
+ * precheck (an empty field passes) and the seal itself (approve(), inside its transaction). Refused: local mode off or
+ * another person; no plan; release or deploy terms; protected or two-person work; an escalated profile; work a
+ * coordinator filed; a project whose checks are stored as unsandboxed (or a plan that sealed that). Plans a lead or
+ * a scout proposed are allowed.
+ */
+export function localApprovalEligible(store, by, taskId) {
+    const no = (reason) => ({ ok: false, reason, message: LOCAL_APPROVAL_WORDS[reason] });
+    if (!localModeOn(store))
+        return no("local-mode-off");
+    const owner = store.handle.prepare("SELECT owner FROM local_mode WHERE id = 1").get()?.["owner"];
+    if (owner !== by)
+        return no("not-owner");
+    const scope = store.getScope(taskId);
+    if (scope === null)
+        return no("no-scope");
+    if (deployGateScope(scope) || releaseCheckScope(scope))
+        return no("release");
+    const gate = store.approvalGate(taskId, by, "person");
+    if (gate.verdict !== "seal" || gate.protectedWork)
+        return no("protected");
+    if (scope.profile == null || levelOfProfile(scope.profile) === "escalated")
+        return no("escalated");
+    const ref = store.handle.prepare("SELECT repo, coordinator_cid FROM task_ref WHERE backend = 'built-in' AND external_id = ?").get(taskId);
+    if (ref === undefined || ref["coordinator_cid"] != null)
+        return no("coordinator");
+    // The stored level, never the launch cap: a project saved as unsandboxed is refused even though local mode confines it.
+    const stored = ref["repo"] == null ? undefined : store.handle.prepare("SELECT level FROM project_check_access WHERE repo = ?").get(ref["repo"])?.["level"];
+    if (stored === "unsandboxed" || scope.profile.checkAccess === "unsandboxed")
+        return no("unsandboxed");
+    return { ok: true };
+}