toolroll 0.9.91 → 0.9.93

package/dist/server/guards.js

@@ -176,6 +176,7 @@ export function createSharedGuards(runtime) {
                 const task = matchTaskPath(url.pathname, '(?:/[a-z-]+)?$');
                 return task === null ? null : runtime.store.lookupRef(task.taskId)?.repo ?? null;
             }
+            case 'task-ref': return Number.isSafeInteger(id) && id > 0 ? runtime.store.refForId(id)?.repo ?? null : null;
             case 'run': return runRepo(id);
             case 'decision': return runRepo(runtime.store.getDecision(id)?.run);
             case 'incident': return runRepo(runtime.store.openIncidents().find(one => one.id === id)?.run);

package/dist/server/pages-assets.js

@@ -39,7 +39,7 @@ const PWA_MANIFEST = JSON.stringify({
 // paths — the payload URL is data, revalidated, never handed raw to the
 // browser (arc 3 finding 5).
 const PWA_WORKER = `// Toolroll — push only; deliberately NO fetch handler (no offline cache of an authenticated console).
-const SHAPES = [/^\\/next$/, /^\\/review$/, /^\\/system$/, /^\\/routines$/, /^\\/routines\\/[0-9]+$/, /^\\/d\\/[0-9]+$/, /^\\/r\\/[0-9]+$/];
+const SHAPES = [/^\\/next$/, /^\\/review$/, /^\\/system$/, /^\\/routines$/, /^\\/routines\\/[0-9]+$/, /^\\/d\\/[0-9]+$/, /^\\/r\\/[0-9]+$/, /^\\/approve\\/[0-9]+$/];
 self.addEventListener("push", function (event) {
   var data = {};
   try { data = event.data ? event.data.json() : {}; } catch (e) {}

package/dist/server/render-chat.js

@@ -34,7 +34,7 @@ import { chatMoney, oneLineOf, relativeAge, safePrUrl, screen, sentenceCase, str
 import { chatResultHref, projectChatHref, taskChatHref, taskHref } from "./http.js";
 import {} from "./render-pages.js";
 import { completionReceiptCard } from "./render-results.js";
-import { agentsAvailabilityHtml, agentsBadgesHtml, agentsStripHtml, agentsSummaryWords, agentsWhyHtml, approvalSheetHtml, checkProgressHtml, consentClosedHtml, consentDoorOf, decisionAnswerCard, dispatchHeadline, milestoneProgressHtml, planRevisionLedgerHtml, profileWords, sizeConsequence, taskControlDetailsHtml, taskStatusCard, taskViewSwitch } from "./render-tasks.js";
+import { routeEvidenceHtml, agentsAvailabilityHtml, agentsBadgesHtml, agentsStripHtml, agentsSummaryWords, agentsWhyHtml, approvalSheetHtml, checkProgressHtml, consentClosedHtml, consentDoorOf, decisionAnswerCard, dispatchHeadline, milestoneProgressHtml, planRevisionLedgerHtml, profileWords, sizeConsequence, taskControlDetailsHtml, taskStatusCard, taskViewSwitch } from "./render-tasks.js";
 /** The installation fact that the lead was turned on by default, once (its value: the provider). */
 export const LEAD_BY_DEFAULT_FACT = "lead-on-by-default";
 /** The installation fact that the phone card was put away. */
@@ -51,7 +51,7 @@ export function taskChatContext(focus) {
     // conversation never hides which agent runs.
     focus.route === null
         ? ""
-        : html `<div class="task-chat-agents-aside"><span class="eyebrow">agents</span><p class="agents-summary">${agentsSummaryWords(focus.route)}</p><div class="agents-badges">${agentsBadgesHtml(focus.route)}</div>${focus.route.projection === null ? "" : html `${agentsAvailabilityHtml(focus.route.projection)}${agentsWhyHtml(focus.route.projection)}`}<p class="meta"><a href="${taskHref(focus.id)}#agents">Change agents on the task →</a></p></div>`}<div class="task-chat-overview-actions"><a class="task-chat-overview-link" href="${taskHref(focus.id)}">Open full overview →</a></div></aside>`;
+        : html `<div class="task-chat-agents-aside"><span class="eyebrow">agents</span><p class="agents-summary">${agentsSummaryWords(focus.route)}</p>${routeEvidenceHtml(focus.route)}<div class="agents-badges">${agentsBadgesHtml(focus.route)}</div>${focus.route.projection === null ? "" : html `${agentsAvailabilityHtml(focus.route.projection)}${agentsWhyHtml(focus.route.projection)}`}<p class="meta"><a href="${taskHref(focus.id)}#agents">Change agents on the task →</a></p></div>`}<div class="task-chat-overview-actions"><a class="task-chat-overview-link" href="${taskHref(focus.id)}">Open full overview →</a></div></aside>`;
 }
 export function taskChatApproval(focus, csrf) {
     const approval = focus.approval;

package/dist/server/render-release.d.ts

@@ -0,0 +1,17 @@
+import type { ApprovalFacts } from "../design/kit.js";
+import { type ReleaseApprovalCard } from "../release-approval.js";
+import { type Chrome, type Screen } from "./chrome.js";
+export type ReleaseSheetData = {
+    card: ReleaseApprovalCard;
+    /** The single-use approval nonce for this person, task and card digest ("" when nothing can be approved here). */
+    nonce: string;
+    facts: ApprovalFacts;
+    /** This computer's local owner: releases need a full sign-in first (scope.ts localApprovalEligible). */
+    local: {
+        message: string;
+        action: string;
+        href: string;
+    } | null;
+    problem: string | null;
+};
+export declare function releaseSheetPage(chrome: Chrome, data: ReleaseSheetData): Screen;

package/dist/server/render-release.js

@@ -0,0 +1,84 @@
+/**
+ * The release approval sheet (docs/plans/trusted-release-reports.md, slice A, A7): one screen with what the person is
+ * approving, GitHub CI now, what approving does, what changed and every term, then one Approve release button. The
+ * page only shows: the approval POST (`/t/<id>/approve`, `sheet=release`) proves the person, the card and the scope
+ * again (release-approval.ts approveReleaseCard).
+ */
+import { html, joinHtml } from "../html.js";
+import { ciWords, releaseConsequence } from "../release-approval.js";
+import { checkAccessWords } from "../check-access.js";
+import { projectName } from "../project.js";
+import { screen } from "./chrome.js";
+import { approvalTerms, approveForm, chip, disclose, doc, docHeader, facts, infoLine, note, notice, slots, btn } from "./kit.js";
+import { taskHref } from "./http.js";
+/** The change list, folded: every commit when it is whole, or why it isn't. */
+function changesHtml(card) {
+    const changes = card.card.changes;
+    const id = card.seal.identity;
+    if (changes.commits === null) {
+        return note(changes.baselineUnreadable === true ? "What changed couldn't be read: the last verified release's commit can't be read."
+            : `What changed couldn't be read${changes.why === undefined ? "" : ` (${changes.why})`}. See pull request #${id.pr} on GitHub.`);
+    }
+    const head = changes.baseline === null ? `Pull request #${id.pr}'s commits` : `Since the last verified release (${changes.baseline.slice(0, 7)})`;
+    const list = changes.commits.length === 0 ? note("No commits.")
+        : html `<ul class="k-list">${changes.commits.map(one => html `<li><code class="k-mono">${one.sha.slice(0, 7)}</code> ${one.subject}</li>`)}</ul>`;
+    return disclose(`What changed: ${changes.commits.length} commit${changes.commits.length === 1 ? "" : "s"}`, html `<p class="k-note">${head}</p>${list}`);
+}
+/** Every signed term, before the button. */
+function termsHtml(card) {
+    return disclose("Every term", facts(card.terms.map(line => [line.label, html `<span class="k-mono">${line.value}</span>`])), true);
+}
+export function releaseSheetPage(chrome, data) {
+    const card = data.card;
+    const id = card.seal.identity;
+    const title = `Release ${id.packageVersion}`;
+    const summary = facts([
+        ["Pull request", `#${id.pr}`],
+        ["Branch", html `<code class="k-mono">${id.branch}</code>`],
+        ["Commit", html `<code class="k-mono">${id.approvedSha}</code>`],
+        ["Project", projectName(id.repo)],
+        ["Checks", checkAccessWords(id.access)],
+    ]);
+    const consequence = releaseConsequence(card);
+    const ci = ciWords(card.ci, id.approvedSha);
+    const notRunning = card.stopped === null ? "" : infoLine(html `The release isn't running (it stopped at ${card.stopped.step}). After you approve, run <code class="k-mono">toolroll release ${id.branch}</code>.`);
+    let status, text, acts, terms, wait = false;
+    if (card.approved !== null) {
+        status = html `${chip("Approved", "done")}<h2>Release approved</h2>`;
+        text = `Approved by ${card.approved.by}. ${ci}`;
+        acts = btn("Open the task", { variant: "outline", href: taskHref(card.taskId) });
+        terms = "";
+    }
+    else if (card.refusal !== null) {
+        status = html `${chip("Can't approve", "failed")}<h2>Can't approve this release now</h2>`;
+        text = card.refusal;
+        acts = btn("Open the task", { variant: "outline", href: taskHref(card.taskId) });
+        terms = "";
+    }
+    else if (data.local !== null) {
+        wait = true;
+        status = html `${chip("Needs you", "needs")}<h2>Ready for your approval</h2>`;
+        text = `${ci} Releases need a full sign-in on this computer.`;
+        acts = btn(data.local.action, { variant: "primary", href: data.local.href });
+        terms = data.local.message;
+    }
+    else {
+        wait = true;
+        status = html `${chip("Needs you", "needs")}<h2>Ready for your approval</h2>`;
+        text = ci;
+        acts = data.nonce === "" ? "" : approveForm({
+            action: `${taskHref(card.taskId)}/approve`, kind: "standard", facts: data.facts, label: "Approve release", primary: true,
+            before: html `<section class="k-sec"><h3>What approving does</h3>${joinHtml(consequence.map(line => html `<p class="k-note">${line}</p>`))}${termsHtml(card)}</section>`,
+            form: { hidden: { nonce: data.nonce, digest: card.digest, sheet: "release" }, attrs: { class: "k-form", "data-release-approve": card.digest } },
+        });
+        terms = approvalTerms("standard", data.facts);
+    }
+    // What, then what changed, then the one decision: its status, CI now, what approving does, every term, the button.
+    const formShown = acts !== "" && data.nonce !== "" && card.approved === null && card.refusal === null && data.local === null;
+    const body = doc(docHeader({ title, back: [taskHref(card.taskId), "Task"], meta: `${projectName(id.repo)} · pull request #${id.pr}` }), 
+    // A refused approval says why first, above the card it now shows.
+    data.problem === null ? "" : notice(data.problem), summary, changesHtml(card), slots({ wait, attrs: { "data-release-sheet": card.taskId }, status, text, acts, terms }), notRunning, 
+    // When the form isn't shown, the consequence and the terms are still on the page.
+    formShown ? "" : html `<section class="k-sec"><h3>What approving does</h3>${joinHtml(consequence.map(line => html `<p class="k-note">${line}</p>`))}</section>${termsHtml(card)}`);
+    return screen(title, body, { chrome });
+}

package/dist/server/render-results.d.ts

@@ -707,8 +707,6 @@ export declare function needActionOf(assignment: AssignmentSnapshot | null, stat
     rebuildable?: boolean;
     refuted?: boolean;
 }): BrowserNeedAction | null;
-/** A build Toolroll can't check at all: the approver ticks that they checked before confirming. */
-export declare const needsCheck: (assignment: AssignmentSnapshot) => boolean;
 /** The server page's form of the same: the need's action first, Request changes as the quiet second. */
 export declare function resultNeedAction(need: BrowserNeedAction, o: ResultPanelOptions, canRequest: boolean): Html;
 /** The outcome in one bounded sentence (repair 2026-09-14): the handoff's

package/dist/server/render-results.js

@@ -731,7 +731,7 @@ export function reviewCockpitDetailParts(view, csrf, noted, canRetryReview, tab,
             checksRunning,
             blocked,
             canRequest: panel.panel.canRequest && panel.panel.request !== null,
-            need: need === null || need.accept != null ? null : need.rebuild != null ? "rebuild" : need.confirm !== null ? "confirm-stopped" : null,
+            need: need === null || need.accept != null ? null : need.rebuild != null ? "rebuild" : need.confirm !== null ? "recheck-stopped" : null,
             next: nextKind === "revise" || nextKind === "draft-repair" ? nextKind : null,
             unanswered: settled === null ? 0 : unanswered.length,
             notRight: 0,
@@ -2009,12 +2009,10 @@ export function needActionOf(assignment, status, csrf, returnTo, result) {
         if (status.need.key === "review-result" || here)
             return null;
     }
-    const confirm = action?.code === "confirm-stopped" && action.target.runId !== null && csrf !== ""
-        ? { action: `${taskHref(assignment.rootId)}/confirm-stopped`, run: action.target.runId, returnTo, checked: needsCheck(assignment) } : null;
+    const confirm = action?.code === "recheck-stopped" && action.target.runId !== null && csrf !== ""
+        ? { action: `${taskHref(assignment.rootId)}/recheck-stopped`, run: action.target.runId, returnTo } : null;
     return { label: status.need.action.label, href: assignmentActionHref(assignment) ?? taskHref(assignment.rootId), confirm };
 }
-/** A build Toolroll can't check at all: the approver ticks that they checked before confirming. */
-export const needsCheck = (assignment) => assignment.need != null && "key" in assignment.need && assignment.need.key === "check-stopped";
 /** The server page's form of the same: the need's action first, Request changes as the quiet second. */
 export function resultNeedAction(need, o, canRequest) {
     const control = need.accept != null
@@ -2022,7 +2020,7 @@ export function resultNeedAction(need, o, canRequest) {
         : need.rebuild != null
             ? postForm(need.rebuild.action, html `<button type="submit" data-primary-action data-rebuild style="min-height:44px">${need.label}</button>`, { attrs: { class: "rebuild" } })
             : need.confirm !== null
-                ? postForm(need.confirm.action, html `${need.confirm.checked === true ? html `<label><input type="checkbox" name="checked" value="yes" required> Nothing from build #${need.confirm.run} is running</label>` : ""}${reauth(html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`)}<button type="submit" style="min-height:44px">${need.label}</button>`, { attrs: { id: "confirm-stopped", class: "confirm-stopped" }, returnTo: need.confirm.returnTo, hidden: { run: need.confirm.run } })
+                ? postForm(need.confirm.action, html `<button type="submit" data-primary-action style="min-height:44px">${need.label}</button>`, { attrs: { id: "recheck-stopped", class: "recheck-stopped" }, returnTo: need.confirm.returnTo, hidden: { run: need.confirm.run } })
                 : html `<a class="button-link" href="${need.href ?? "#"}" data-primary-action>${need.label}</a>`;
     return html `<div class="result-action" data-result-action="need">${control}${canRequest && o.csrf !== "" ? html `<a class="result-feedback-link" href="#request-changes">Request changes</a>` : ""}</div>`;
 }

package/dist/server/render-tasks.d.ts

@@ -220,7 +220,12 @@ export type RouteView = {
      * every option an exact pair the operator named once in configuration.
      * The form offers these and nothing else. */
     choices: Record<Phase, AgentChoice[]>;
+    /** Results routing (slice 2): "Why this model: …" when an earned rule selected the build leg (route-rules.ts
+     * selectionEvidenceWords), else absent. The selection is sealed; the counts read "so far". */
+    evidence?: string | null;
 };
+/** The evidence line beside the agents, only when an earned rule chose the builder. */
+export declare function routeEvidenceHtml(view: RouteView | null | undefined, className?: string): Html;
 export declare const ROLE_NOUN: Record<RouteProjection["legs"][number]["phase"], string>;
 export declare function agentsStandingWords(view: RouteView): string;
 /** The size line an approval leads its agents with — "Small change: fast
@@ -609,6 +614,8 @@ export declare function taskBodyParts(data: {
     qualityMode?: QualityMode | null;
     /** The phase route (v47) and whether this session may edit it. */
     route?: RouteView | null;
+    /** Results routing (slice 1): this task family's result record in words; null when it has none yet. */
+    resultRecord?: string | null;
     canEditRoute?: boolean;
     runs: Run[];
     /** Proof produced by the newest finished attempt. The two booleans are

package/dist/server/render-tasks.js

@@ -50,7 +50,7 @@ import { isOverdue, oneLineOf, projectChip, regionScript, safePrUrl, screen, SEN
 import { steerDestinationWords, steerStandingParts } from "../steer-status.js";
 import { reviewHref, taskChatHref, taskHref } from "./http.js";
 import { coordinatorProposalsSection } from "./render-chat.js";
-import { completionReceiptCard, criterionMatrixHtml, evidenceWords, homePhaseWords, incidentWords, needsCheck, pullRequestCardHtml, reasonWords, receiptStatusOf, repairChainHtml, reportItemsHtml, reviewRetryPanel, runNoun, runOutcomeBadge, semanticCoverageHtml, verificationExplanation, verificationRecovered } from "./render-results.js";
+import { completionReceiptCard, criterionMatrixHtml, evidenceWords, homePhaseWords, incidentWords, pullRequestCardHtml, reasonWords, receiptStatusOf, repairChainHtml, reportItemsHtml, reviewRetryPanel, runNoun, runOutcomeBadge, semanticCoverageHtml, verificationExplanation, verificationRecovered } from "./render-results.js";
 import {} from "./session.js";
 import { linkWords, originNote, requestName, requestWords } from "../task-source.js";
 export function contractChangeHtml(change) {
@@ -439,6 +439,7 @@ export function approvalSheetParts(input) {
         // The size, said once and plainly beside who builds: "Small change: fast model, no plan".
         projection === null ? "" : sizeLineHtml(projection),
         who.length === 0 ? "" : html `<p class="approval-who">${who.join(" · ")}</p>`,
+        routeEvidenceHtml(route, "approval-evidence"),
         consent,
     ]);
     return { lead, rows, editor, editorForm, details, submit, label: rebuild !== null ? "Approve and build again" : "Approve and start", after, allowing, passwordNote };
@@ -565,6 +566,14 @@ export function profileWords(scope) {
     const terms = sandboxTermsWords(profile);
     return html `${base}<p class="meta" data-scope-network>${networkWords(profile.network ?? null)}</p><p class="meta" data-scope-writes>Writes: ${writesWords(profile.writes)}.</p>${profile.checkAccess === undefined ? "" : html `<p class="meta" data-scope-checks>Checks: ${checkAccessWords(profile.checkAccess)}.</p>`}<p class="meta" data-scope-reads>Reads: ${terms.reads}.</p>${terms.mach === null ? "" : html `<p class="meta" data-scope-mach>${terms.mach.charAt(0).toUpperCase()}${terms.mach.slice(1)}.</p>`}`;
 }
+/** The evidence line beside the agents, only when an earned rule chose the builder. */
+export function routeEvidenceHtml(view, className = "meta") {
+    const words = view?.evidence ?? null;
+    if (words === null)
+        return html ``;
+    const split = words.indexOf(": ");
+    return html `<p class="${className} route-evidence" data-route-evidence><strong>${words.slice(0, split + 1)}</strong>${words.slice(split + 1)}</p>`;
+}
 export const ROLE_NOUN = { plan: "Planner", build: "Builder", repair: "Repair", review: "Reviewer" };
 export function agentsStandingWords(view) {
     return view.kind === "legacy"
@@ -658,6 +667,7 @@ export function agentsCeremonyHtml(view) {
         html `<div class="agents-ceremony"><p class="approval-label">agents</p>`,
         sizeLineHtml(view.projection),
         html `<p class="agents-summary">${view.projection.summary}</p>`,
+        routeEvidenceHtml(view),
         html `<div class="agents-badges">${riskBadgeHtml(view.projection)}<span class="badge">${sentenceCase(view.projection.postureWords)}</span></div>`,
         agentsWhyHtml(view.projection),
         html `<p class="meta">These exact agents are part of what you approve; changing any of them asks for a fresh approval.</p></div>`,
@@ -735,6 +745,7 @@ export function agentsCardHtml(taskId, view, canEdit) {
         html `<section class="card agents-card" id="agents" aria-label="agents">`,
         html `<div class="agents-head"><h3>Agents</h3><div class="agents-badges">${agentsBadgesHtml(view)}</div></div>`,
         html `<p class="agents-summary">${agentsSummaryWords(view)}</p>`,
+        routeEvidenceHtml(view),
         p === null
             ? view.kind === "unreadable"
                 ? html `<p class="agents-halted">Nothing runs for this task until its scope is filed again and approved.</p>`
@@ -2280,6 +2291,8 @@ export function taskBodyParts(data) {
         review.push({ ...approvedScope, label: approvedScope.label === "Approved scope" ? "Approvals" : "Scope" });
     review.push({ label: "Who reviews", parts: [facts.find(one => one.label === "Approval rules")?.parts[0] ?? "Any approver in this project"] });
     review.push({ label: "Publishes as", parts: [publishesAs] });
+    if (data.resultRecord != null)
+        review.push({ label: "Result record", parts: [data.resultRecord] });
     const about = [];
     const filedFact = facts.find(one => one.label === "Filed by");
     about.push(filedFact ?? { label: "Filed by", parts: [filedBy ?? (data.origin != null ? "An automation" : data.filedVia == null ? "Not recorded" : `via ${data.filedVia}`)] });
@@ -2395,8 +2408,8 @@ export function taskBodyParts(data) {
         approve: data.archived != null || sheetInput === null || dependencyChoiceNeeded || data.csrf === "" ? null : approveKitOf(sheetInput, data.approvalFresh ?? null),
         approved: scope !== null && approval.approved ? approvedKitOf(scope, approval, data.approvalProof ?? null) : null,
         more,
-        confirmStopped: data.csrf !== "" && data.assignment?.primaryAction?.code === "confirm-stopped" && data.assignment.primaryAction.target.runId !== null
-            ? { action: `${taskHref(data.assignment.rootId)}/confirm-stopped`, run: data.assignment.primaryAction.target.runId, checked: needsCheck(data.assignment) } : null,
+        recheckStopped: data.csrf !== "" && data.assignment?.primaryAction?.code === "recheck-stopped" && data.assignment.primaryAction.target.runId !== null
+            ? { action: `${taskHref(data.assignment.rootId)}/recheck-stopped`, run: data.assignment.primaryAction.target.runId } : null,
         rebuild,
         // The plan, progress and plan changes are thread entries now; the rest still needs a person here.
         lead: [

package/dist/server/route-table.d.ts

@@ -22,7 +22,7 @@ export type Caller = "anonymous" | "service" | "cookie" | "bearer" | "oauth" | "
 /** What the caller must hold: nothing, read, act (an approver or an `act` token), or a fresh password/provider check on top. */
 export type RouteScope = "none" | "read" | "act" | "step-up";
 /** Where the request's project comes from. */
-export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "run" | "decision" | "incident" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
+export type ProjectResolver = "none" | "session" | "form" | "form-path" | "task" | "task-ref" | "run" | "decision" | "incident" | "flow" | "proposal" | "conversation" | "coding" | "adapter";
 /**
  * What a project-limited account may do here:
  * - `deny`: instance access only.

package/dist/server/route-table.js

@@ -91,6 +91,11 @@ const LOCAL_POSTS = Object.freeze({
     "settings.lead-on": "choose-default-agent",
     // Choosing which open project the pages show: a view filter, never authorization.
     "projects.select": "read",
+    // Results routing: lowering only.
+    "settings.models-turn-off": "routing-turn-off",
+    "settings.models-not-now": "dismiss-suggestion",
+    "settings.models-suggest-off": "dismiss-suggestion",
+    "settings.models-stop": "trial-stop",
     "agents.seen": "mark-seen",
     "agents.watch": "watch-agent",
 });
@@ -281,6 +286,10 @@ get("tasks", "welcome", "/welcome", { limited: "collection", ...free });
 post("tasks", "welcome.sample", "/welcome/sample", { callers: ["cookie"], project: "none", ...approver("An approver adds projects.", "/welcome") });
 get("tasks", "task.page", `^\\/t\\/${TASK}$`, { project: "task", limited: "resource", ...free, sample: "/t/one" });
 get("tasks", "task.evidence", `^\\/t\\/${TASK}\\/evidence$`, { project: "task", limited: "resource", ...free, sample: "/t/one/evidence" });
+// One-tap release approval (trusted-release-reports.md A6/A7): the sheet, and the push's opaque locator, which only
+// redirects to it once the plane's own state says the task ref is a release in the person's projects.
+get("tasks", "task.release", `^\\/t\\/${TASK}\\/release$`, { project: "task", limited: "resource", ...free, sample: "/t/one/release" });
+get("tasks", "release.locate", `^\\/approve\\/${ID}$`, { project: "task-ref", limited: "resource", ...free, sample: "/approve/1" });
 get("pages", "ledger.export", "/ledger/export", { limited: "unscoped", ...free });
 get("tasks", "runs", "/runs", { limited: "collection", ...free }); // a redirect to /agents now
 get("pages", "menu", "/menu", { limited: "collection", ...free });
@@ -483,6 +492,13 @@ for (const one of ["check", "watch", "update"])
 // Passwordless session; model-choices.ts re-proves the session and standing inside its one transaction).
 for (const one of ["agent", "apply"])
     post("settings", `settings.models-${one}`, `/settings/models/${one}`, { scope: "step-up", ...operator("An instance operator changes models.", "/settings/models") });
+// Earned rules (results routing): accepting, keeping a paused rule and switching suggestions on are an instance
+// operator's browser step-up; turning a rule off, Not now and switching suggestions off only take authority away (a
+// signed-in operator, or the local owner in exactly that act: route-store.ts proveRuleDoor re-checks it in the write).
+for (const one of ["accept", "keep", "suggest-on", "try"])
+    post("settings", `settings.models-${one}`, `/settings/models/${one}`, { scope: "step-up", ...operator("An instance operator changes which models run.", "/settings/models") });
+for (const one of ["turn-off", "not-now", "suggest-off", "stop"])
+    post("settings", `settings.models-${one}`, `/settings/models/${one}`, operator("An instance operator changes which models run.", "/settings/models"));
 // Any other models action answers the models area's own refusal.
 post("settings", "settings.models-act", "^\\/settings\\/models\\/.*$", { sample: "/settings/models/unknown", ...MODELS });
 post("settings", "settings.knowledge-refresh", "/settings/knowledge/refresh", { project: "form", limited: "unscoped", ...approver("Sign in as an approver to refresh project context.", "/settings/knowledge") });
@@ -544,7 +560,9 @@ post("tasks", "task.act.route", `^\\/t\\/${TASK}\\/route$`, { project: "task", l
 post("tasks", "task.act.retry-review", `^\\/t\\/${TASK}\\/retry-review$`, { project: "task", limited: "resource", sample: "/t/one/retry-review" });
 post("tasks", "task.act.complete", `^\\/t\\/${TASK}\\/complete$`, { project: "task", limited: "resource", sample: "/t/one/complete", ...approver("Only an approver can mark a result complete.") });
 post("tasks", "task.act.merge", `^\\/t\\/${TASK}\\/merge$`, { project: "task", limited: "resource", sample: "/t/one/merge", ...approver("Only an approver can merge.") });
-post("tasks", "task.act.confirm-stopped", `^\\/t\\/${TASK}\\/confirm-stopped$`, { scope: "step-up", project: "task", limited: "resource", sample: "/t/one/confirm-stopped", ...approver("Only an approver can confirm a build stopped.") });
+// Check again: Toolroll looks at this computer's processes for a finished build once more (stop-proof.ts). Nobody
+// vouches that a build stopped, so no password: it only asks for the look the worker makes on its own anyway.
+post("tasks", "task.act.recheck-stopped", `^\\/t\\/${TASK}\\/recheck-stopped$`, { project: "task", limited: "resource", sample: "/t/one/recheck-stopped", ...approver("Only an approver can have Toolroll check a build again.") });
 post("tasks", "task.act.stop-carrying", `^\\/t\\/${TASK}\\/stop-carrying$`, { project: "task", limited: "resource", sample: "/t/one/stop-carrying", ...approver("Only an approver can stop carrying a release.") });
 post("tasks", "task.act.stop", `^\\/t\\/${TASK}\\/stop$`, { project: "task", limited: "resource", sample: "/t/one/stop" });
 // Putting one task away and bringing it back (task-tidy.md): a person's act, so only a browser session.

package/dist/server/settings.d.ts

@@ -1,5 +1,5 @@
 import type { ServerRuntime } from './runtime.js';
-import { type RoleView } from "../models-ui.js";
+import { type RoleView, type SuggestedView } from "../models-ui.js";
 export declare function createSettingsHandlers(runtime: ServerRuntime): {
     registrations: import("./handler-registry.js").Registration[];
     modelsView: (canManage: boolean, csrf: string, now: Date, said: string | null, problem: string | null, query?: URLSearchParams) => {
@@ -71,5 +71,6 @@ export declare function createSettingsHandlers(runtime: ServerRuntime): {
             taskId: string;
             title: string;
         }[];
+        suggested: SuggestedView;
     };
 };

package/dist/server/settings.js

@@ -76,6 +76,7 @@ import { startConnect } from "../mcp-connect.js";
 import { decideProposal, listProposals, memoryStatus } from "../memory-pass.js";
 import { checkModels, isNewModel, modelOptions, modelWords, RUNTIME_TOOLS, runtimeStates, seenModels, setWatch, updateRuntime, watchState } from "../model-catalog.js";
 import { modelsHtml, modelsScript } from "../models-ui.js";
+import { acceptSuggestion, dismissSuggestion, grantWords, keepRule, modelName, ruleWords, rulesOf, setSuggestModels, startTrial, stopTrial, suggestionsFor, suggestionWords, suggestModelsOn, trialOffersFor, trialOfferWords, trialsOf, trialWords, turnOffRule } from "../route-rules.js";
 import { ALL_SLOTS, applyModelChoices, browserWords, checkScope, DEFAULT_PRESET, defaultAgentOf, fillDefaultRouting, isPresetName, newerModels, PRESETS, presetChange, presetInUse, previewModelChange, recentRuns, rowAt, slotKey, SLOTS, slotWords, stateDigest, switchChange } from "../model-choices.js";
 import { HEADROOM_FIVE_HOUR_LIMIT, HEADROOM_WEEKLY_LIMIT, exactModelId } from "../phase-routing.js";
 import { RISKY_MEANS, SIZE_MEANS, SIZING_CLAUDE_MODEL } from "../task-sizing.js";
@@ -118,6 +119,7 @@ import { slackSettingsHtml } from "../slack-settings.js";
 import { spendHtml, spendScript } from "../spend-ui.js";
 import { approvalFactsNow } from "./kit.js";
 import { spendReport, spendReportCsv, spendRows } from "../spend-report.js";
+import { savingsReportOrError } from "../route-savings.js";
 import { limitsView } from "../limits-ui.js";
 import { budgetStates, monthNamed, spendItems, usd as spendUsd, subagentNames as subagentNamesOf } from "../spend.js";
 import { removeSsoSettings, saveSsoSettings, SSO_CALLBACK, ssoChangeWords } from "../sso-settings.js";
@@ -185,7 +187,9 @@ export function createSettingsHandlers(runtime) {
         };
         const windows = limitsView(store.providerLimits(), [], { project: projectName, subagent: id => subagentNames.get(id) ?? `Subagent ${id}` }, now);
         const view = { month: month.name, previous: shift(-1), next: month.name === current.name ? null : shift(1), current: current.name, report: spendReport(rows),
-            budgets, unlimited, targets, windows, subagentNames, edit, facts: approvalFactsNow() };
+            budgets, unlimited, targets, windows, subagentNames, edit, facts: approvalFactsNow(),
+            // Suggestions and rules (results-routing slice 4): read-only, for every project this console shows.
+            savings: savingsReportOrError(store, consoleProjects(), now) };
         // A refusal for the open form shows in the form; anything else under the limits' heading.
         const said = { said: url.searchParams.get("said"), problem: edit === null ? url.searchParams.get("problem") : null };
         return sendScreen(response, 200, screen("Spend", spendHtml(view, said), { chrome: chromeFor(null, "spend"), functional: { script: spendScript() } }));
@@ -2565,6 +2569,7 @@ ${postForm("/settings/chat-approval/save", html `\
                 chosen: one.chosen === null ? "its default" : /^(opus|sonnet|haiku|fable)$/.test(one.chosen) ? `floating ${one.chosen}` : one.chosen,
                 ranOn: one.ranOn ?? "not reported" })),
             waiting: canManage ? store.scopesAwaitingApproval(null, 10, admissionList()).map(one => ({ taskId: one.taskId, title: one.title })) : [],
+            suggested: suggestedView(repo, projects, query.get("suggestion"), now),
         };
     }
     /** Google's redirect back: the code becomes a saved refresh token, and a page sends the person back to Settings. */
@@ -2739,6 +2744,14 @@ ${postForm("/settings/chat-approval/save", html `\
         "settings.models-agent": modelsSave,
         "settings.models-apply": modelsApply,
         "settings.models-act": modelsAct("other"),
+        "settings.models-accept": modelsRuleAct("accept"),
+        "settings.models-keep": modelsRuleAct("keep"),
+        "settings.models-suggest-on": modelsRuleAct("suggest-on"),
+        "settings.models-turn-off": modelsRuleAct("turn-off"),
+        "settings.models-not-now": modelsRuleAct("not-now"),
+        "settings.models-suggest-off": modelsRuleAct("suggest-off"),
+        "settings.models-try": modelsRuleAct("try"),
+        "settings.models-stop": modelsRuleAct("stop"),
         "settings.knowledge-refresh": knowledgeRefresh,
         "settings.knowledge-proposal": knowledgeProposal,
         "settings.knowledge-decision": knowledgeDecision,
@@ -3005,5 +3018,78 @@ ${postForm("/settings/chat-approval/save", html `\
             return back("problem", turned.reason === "not-on" ? "Local mode is already off." : "Only an instance operator can turn off local mode.");
         return back("said", "Local mode is off. This computer's browser signs in with your password now.");
     }
+    /** Settings → Models → Suggested: one project's offers, rules and switch; on the installation scope, every
+     * project's offers and rules, each reviewed on its own project's page. */
+    function suggestedView(repo, projects, asked, now) {
+        const repos = repo === null ? projects : [repo];
+        const offers = repos.flatMap(one => suggestionsFor(store, one, now));
+        const sizeTitle = (size, name) => `${name} for ${size === "small" ? "small" : "routine"} tasks`;
+        const reviewed = asked === null || repo === null ? null : offers.find(one => one.id === asked && one.repo === repo) ?? null;
+        return {
+            repo,
+            offers: offers.map(one => ({ id: one.id, repo: one.repo, project: projectName(one.repo), title: sizeTitle(one.cohortSize, one.name), words: suggestionWords(one) })),
+            review: asked === null || repo === null ? null : reviewed === null ? { stale: true, repo } : {
+                id: reviewed.id, repo: reviewed.repo, title: `${sizeTitle(reviewed.cohortSize, reviewed.name)} instead of ${reviewed.configured.name}`,
+                evidence: [suggestionWords(reviewed), reviewed.configuredEvidence.decided === 0 ? `${reviewed.configured.name}: no decided similar tasks here in the last 90 days.` : `${reviewed.configured.name}: ${reviewed.configuredEvidence.mature} of its last ${reviewed.configuredEvidence.decided} decided similar tasks accepted with checks passing.`],
+                prices: `${reviewed.name} $${reviewed.prices.model.in} / $${reviewed.prices.model.out}, ${reviewed.configured.name} $${reviewed.prices.configured.in} / $${reviewed.prices.configured.out} per 1M tokens (listed now)`,
+                terms: grantWords(reviewed.grant), save: `Use ${reviewed.name} for ${reviewed.cohortSize === "small" ? "small" : "routine"} tasks`,
+            },
+            rules: repos.flatMap(one => rulesOf(store, one, now)).map(one => ({ id: one.id, repo: one.repo, project: projectName(one.repo), title: sizeTitle(one.cohortSize, modelName(store, one.model)), words: ruleWords(store, one),
+                state: one.state === "active" ? "active" : one.state === "paused" ? "paused" : "ended" })),
+            suggest: repo === null ? null : { on: suggestModelsOn(store, repo) },
+            trialOffers: repos.flatMap(one => trialOffersFor(store, one, now)).map(one => ({ id: one.id, repo: one.repo, project: projectName(one.repo),
+                title: `Try ${sizeTitle(one.cohortSize, one.name)}`, words: trialOfferWords(one), save: `Try it on the next ${one.places}` })),
+            trials: repos.flatMap(one => trialsOf(store, one, now)).map(one => ({ id: one.id, repo: one.repo, project: projectName(one.repo),
+                title: `Trying ${sizeTitle(one.cohortSize, modelName(store, one.model))}`, words: trialWords(store, one), live: one.state === "trialling" || one.state === "paused" })),
+        };
+    }
+    /**
+     * Settings → Models → Suggested (results routing, slice 2): the earned-rule doors (route-rules.ts), re-proved inside
+     * their own transaction. Accepting, keeping a paused rule and switching suggestions on are an instance operator's
+     * step-up (the password, or a Passwordless session); turning a rule off or dropping it, Not now, and switching
+     * suggestions off only take authority away, so a signed-in session does — or this computer's local owner, whose
+     * route row narrows it to exactly that act.
+     */
+    function modelsRuleAct(kind) {
+        return async (ctx) => {
+            const { response, now, posted } = ctx;
+            const who = browserCaller(ctx.who);
+            const body = readForm(posted, CONSOLE_FORMS.modelsRules);
+            const repo = body.get("scope") ?? "";
+            const back = (key, words) => redirect(response, `/settings/models?scope=${encodeURIComponent(repo)}&${key}=${encodeURIComponent(words)}#models-suggested`);
+            if (["scope", "password", "id", "rule"].some(field => body.sent.getAll(field).length > 1))
+                return back("problem", "That form was sent twice over. Nothing changed.");
+            if (!consoleProjects().includes(repo) || !store.accountCanAccess(who.name, repo))
+                return refuse(response, who, 403, "That project is outside your access.", "/settings/models");
+            let door;
+            if (kind === "accept" || kind === "keep" || kind === "suggest-on" || kind === "try") {
+                const proved = authenticateApprover(who, body.get("password") ?? "");
+                if (!proved.ok)
+                    return back("problem", "Enter your Toolroll password to change which models run.");
+                door = { kind: "person", person: modelsAuthority(who, proved.method) };
+            }
+            else {
+                door = who.authority === "local-owner" ? { kind: "local-owner", actor: who.name } : { kind: "person", person: modelsAuthority(who, "session") };
+            }
+            const ruleId = /^[1-9][0-9]{0,9}$/.test(body.get("rule") ?? "") ? Number(body.get("rule")) : -1;
+            const id = body.get("id") ?? "";
+            const result = kind === "accept" ? acceptSuggestion(store, { repo, id }, door, now)
+                : kind === "try" ? startTrial(store, { repo, id }, door, now)
+                    : kind === "stop" ? stopTrial(store, ruleId, door, now)
+                        : kind === "keep" ? keepRule(store, ruleId, door, now)
+                            : kind === "turn-off" ? turnOffRule(store, ruleId, door, now)
+                                : kind === "not-now" ? dismissSuggestion(store, { repo, id }, door, now)
+                                    : setSuggestModels(store, repo, kind === "suggest-on", door);
+            if (!result.ok)
+                return back("problem", result.problem);
+            return back("said", kind === "try" ? "Trial started. The next tasks of that size try the cheaper model; each waits for your approval."
+                : kind === "stop" ? "Trial stopped. New tasks build on the configured model; tasks already approved keep their model."
+                    : kind === "accept" ? "Saved. New tasks of that size build on the suggested model; each is still approved by a person."
+                        : kind === "keep" ? "Kept. The rule is on again with its original terms."
+                            : kind === "turn-off" ? "Turned off. New tasks build on the configured model; tasks already approved keep their model."
+                                : kind === "not-now" ? "Not now. This suggestion stays quiet for 30 days."
+                                    : kind === "suggest-on" ? "Suggestions are on for this project." : "Suggestions are off for this project.");
+        };
+    }
     return { registrations, modelsView };
 }

package/dist/server/task-views.js

@@ -1,3 +1,5 @@
+import { resultRecordWordsOf } from "../route-results.js";
+import { selectionEvidenceWords } from "../route-rules.js";
 import { feedbackImageProblem } from "../result-actions.js";
 import { parseFeedbackImage } from "../result-review.js";
 import { releaseViewOf } from "../release-view.js";
@@ -473,6 +475,8 @@ export function createTaskViews(runtime) {
             // and the focused chat, with the readiness this task's runners report.
             route: routeView,
             canEditRoute: who.role === "approver",
+            // Results routing (slice 1): the family's saved record, or the one its rows give now; never a reason to fail the page.
+            resultRecord: resultRecordWordsOf(runtime.store, taskId, runtime.evidenceRoot, now),
             spendDefaults: runtime.store.getSpendDefaults(),
             permissionDefault: runtime.store.permissionDefault().mode,
             permissionMode: ref?.permissionMode ?? null,
@@ -571,6 +575,8 @@ export function createTaskViews(runtime) {
             replanOnPlanChange: ref.plan === "drafted" && scope !== null && !approvalOf(scope).approved,
             digest: scope?.digest ?? null,
             choices: agentChoicesFor(runtime.store, ref.repo, routed.kind === "route" ? routed.route : null),
+            // Results routing: why an earned rule's model builds it, from the records as they stand now.
+            evidence: routed.kind === "route" ? selectionEvidenceWords(runtime.store, routed.route, now) : null,
         };
         if (routed.kind === "route") {
             return { kind: "route", source: routed.source, projection: projectRoute(routed.route, runtime.store.readinessLookupFor(ref.repo, ref.assignedRunner, now)), legacy: null, problem: null, ...shared };

package/dist/server/tasks.d.ts

@@ -64,3 +64,18 @@ export declare function createAgentSignalHandlers(runtime: ServerRuntime): {
     "agents.seen": (ctx: HandlerContext) => Promise<void>;
     "agents.watch": (ctx: HandlerContext) => Promise<void>;
 };
+/**
+ * One-tap release approval (docs/plans/trusted-release-reports.md, slice A): the sheet (`/t/<id>/release`), the push's
+ * opaque locator (`/approve/<task ref>`, a GET that only redirects to the sheet) and the sheet's approval, which the
+ * task approval POST hands here once its shared checks (cookie session, CSRF and the browser key at admission, the
+ * single-use nonce, a password or a standing proof) passed. The approval itself is the shared card wrapper around the
+ * unchanged approve() (release-approval.ts approveReleaseCard).
+ */
+export declare function createReleaseSheetHandlers(runtime: ServerRuntime): {
+    routes: {
+        "task.release": (ctx: HandlerContext) => Promise<void>;
+        "release.locate": (ctx: HandlerContext) => Promise<void>;
+    };
+    sheetScreen: (ctx: Pick<HandlerContext, "who" | "response" | "project">, taskId: string, problem: string | null, status: number) => void;
+    approveFromSheet: (ctx: Pick<HandlerContext, "who" | "response" | "project">, taskId: string, cardDigest: string, token: string) => void;
+};