toolroll 0.9.91 → 0.9.93

package/dist/eval-hooks.d.ts

@@ -1,3 +1,4 @@
+import type ts from "typescript-parser";
 /** One required call: in this file, inside this top-level function, a call to this name, the name bound as `from`
  * says (a module specifier its un-renamed named import comes from; `self`: the file's own top-level function; `local`:
  * declared inside `inside`). `args`: the call's arguments, as text, must stay as the base has them. */
@@ -9,12 +10,17 @@ export type EvalHook = {
     args?: true;
     why: string;
 };
+/** `fn` may also be `outer>inner` (docs/plans/learning-loops.md, Protection 3): a `const inner = (…) => …` (or function
+ * expression) or `function inner`, bound once in the file and never reassigned, inside the top-level function `outer`
+ * and in no other function between them. `strict`: a base that holds the file but can't resolve the pin is a problem,
+ * never skipped (a base without the file at all is a project that isn't Toolroll, and holds none). */
 /** One function whose body (its text, as the candidate has it) must stay as the base has it: a top-level function, or
  * `Class#method`, a method of a top-level class. */
 export type EvalPinned = {
     file: string;
     fn: string;
     why: string;
+    strict?: true;
 };
 export declare const EVAL_HOOKS: readonly EvalHook[];
 export declare const EVAL_PINNED: readonly EvalPinned[];
@@ -37,3 +43,52 @@ export declare const EVAL_HOOK_FILES: readonly string[];
  * files the verified diff says exist at the candidate, so no bytes is a failed read, never a deletion.
  */
 export declare function storeRewriteProblem(paths: readonly string[], candidate: ((file: string) => Buffer | null) | null, base: ((file: string) => Buffer | null) | null, pinned?: readonly string[]): string | null;
+/** The calls that record a check's facts: at disposition, and as the check's command starts. */
+export declare const LEARNING_HOOKS: readonly EvalHook[];
+/** The bodies a release can't change by itself, every one strict: what a run is told from project memory, how a memory
+ * proposal and a decision are written, and where a check's conditions are captured. */
+export declare const LEARNING_PINNED: readonly EvalPinned[];
+/** Every file the learning manifest reads. */
+export declare const LEARNING_HOOK_FILES: readonly string[];
+/** Each protected table and its only writer modules (the v149 migration in store.ts aside). The decision tables'
+ * existing writers stay theirs: project-memory.ts records and retires, project-delete.ts deletes a whole project. */
+export declare const LEARNING_WRITERS: Readonly<Record<string, readonly string[]>>;
+/** One SQL-shaped construct in a file: its static text (a placeholder `${}` where an expression sits), the protected
+ * tables it writes, and the top-level declaration it's in ("" for none). `unreadable`: a write whose table name is
+ * split around an expression; `bare`: a string that is only a protected table's name (SQL assembled elsewhere). */
+type LearningConstruct = {
+    text: string;
+    tables: string[];
+    inside: string;
+    unreadable: boolean;
+    bare: boolean;
+};
+/**
+ * Every construct in the file that could write a protected table: each string literal, template (its static parts)
+ * and `+` concatenation (its literal operands), whatever it's passed to — `prepare`, `exec`, a renamed `prepare`, a
+ * helper. A write verb next to a protected table's name, a table name split around an expression next to a write
+ * word, and a string that is only a protected table's name are each found.
+ */
+export declare function learningConstructs(source: ts.SourceFile): LearningConstruct[];
+/**
+ * Why a changed file writes a learning-loops table (or a decision merge or restore) from a place that may not, or null
+ * (docs/plans/learning-loops.md, Protection 4). Every changed JavaScript or TypeScript file but tests is parsed; a
+ * construct its writer module doesn't own is new unless the base's copy of that file already had exactly that text
+ * (counted by its sha256, as storeRewriteProblem does). A file that can't be read or parsed needs a person. It reads
+ * text the candidate wrote, never runs it: it raises the bar for review; a person reviewing these files is the backstop.
+ */
+export declare function learningWriteProblem(paths: readonly string[], candidate: ((file: string) => Buffer | null) | null, base: ((file: string) => Buffer | null) | null): string | null;
+/**
+ * Why a candidate needs a person for learning loops, or null: a required call dropped, a pinned body changed (strict
+ * pins included), or a changed file writing a protected table from outside its writers. With `manifest.base`, only what
+ * the base holds is required, as evalHookProblem does — except a strict pin whose file the base holds.
+ */
+export declare function learningHookProblem(manifest: {
+    candidate: (file: string) => Buffer | null;
+    base?: (file: string) => Buffer | null;
+}, changed: {
+    paths: readonly string[];
+    candidate: ((file: string) => Buffer | null) | null;
+    base: ((file: string) => Buffer | null) | null;
+}): string | null;
+export {};

package/dist/eval-hooks.js

@@ -36,6 +36,7 @@ export const EVAL_HOOKS = Object.freeze([
     { file: "src/release-auto.ts", inside: "changeProblem", calls: "evalHookProblem", from: "./eval-hooks.js", why: "this check itself" },
     { file: "src/release-auto.ts", inside: "changeProblem", calls: "autoPathProblem", from: "self", why: "policy paths need a person" },
     { file: "src/release-auto.ts", inside: "changeProblem", calls: "storeRewriteProblem", from: "./eval-hooks.js", why: "no changed file rewrites a pinned Store method" },
+    { file: "src/release-auto.ts", inside: "changeProblem", calls: "learningHookProblem", from: "./eval-hooks.js", why: "learning loops' hooks, pins and writers (docs/plans/learning-loops.md)" },
     // The invocation gateway (invoke.ts): every agent run an eval world spawns takes a slot.
     { file: "src/invoke.ts", inside: "invokeAgent", calls: "takeEvalDispatch", from: "./eval-gate.js", why: "every agent dispatch in an eval world takes a slot" },
     // PR #263 review: what the run's billing basis and its unknown cost are computed from is held too, not only the call.
@@ -227,7 +228,7 @@ function boundAs(source, name, from, inside) {
     if (from === "self")
         return compiler.isFunctionDeclaration(only) && only.parent === source ? null : `${name} isn't its own top-level function`;
     if (from === "local")
-        return only.pos >= inside.pos && only.end <= inside.end && !compiler.isParameter(only) ? null : `${name} isn't declared inside ${inside.name?.text ?? "it"}`;
+        return only.pos >= inside.pos && only.end <= inside.end && !compiler.isParameter(only) ? null : `${name} isn't declared inside its function`;
     if (!compiler.isImportSpecifier(only) || only.propertyName !== undefined || only.isTypeOnly)
         return `${name} isn't imported by its own name`;
     const clause = only.parent.parent;
@@ -254,6 +255,46 @@ function heldFunction(source, name) {
     const fn = topFunction(source, name);
     return fn === null || boundAs(source, name, "self", fn) !== null ? null : fn;
 }
+/** `outer>inner`: the one function-like `inner` declared inside the held top-level `outer` (no other function between
+ * them), bound once in the file and never reassigned — a `function inner` or a `const inner =` arrow or function
+ * expression. Null otherwise. */
+function nestedFunction(source, spec) {
+    const compiler = typescript();
+    const [outerName, innerName, ...rest] = spec.split(">");
+    if (outerName === undefined || innerName === undefined || rest.length > 0 || outerName === "" || innerName === "")
+        return null;
+    const outer = heldFunction(source, outerName);
+    if (outer === null || outer.body === undefined)
+        return null;
+    const all = bindingsOf(source, innerName);
+    if (all.length !== 1)
+        return null;
+    const only = all[0];
+    let fn = null;
+    if (compiler.isFunctionDeclaration(only) && only.body !== undefined)
+        fn = only;
+    else if (compiler.isVariableDeclaration(only) && only.initializer !== undefined && (compiler.isArrowFunction(only.initializer) || compiler.isFunctionExpression(only.initializer))
+        && compiler.isVariableDeclarationList(only.parent) && (only.parent.flags & compiler.NodeFlags.Const) !== 0)
+        fn = only.initializer;
+    if (fn === null)
+        return null;
+    // Directly inside `outer`: the first function-like ancestor of the declaration is `outer` itself.
+    for (let at = only.parent; at !== undefined; at = at.parent) {
+        if (at === outer)
+            return fn;
+        if (compiler.isFunctionLike(at) || compiler.isClassLike(at))
+            return null;
+    }
+    return null;
+}
+/** A held function by its manifest name: top-level, `Class#method` or `outer>inner`. */
+function heldNode(source, spec) {
+    if (spec.includes(">"))
+        return nestedFunction(source, spec);
+    if (spec.includes("#"))
+        return classMethod(source, spec);
+    return heldFunction(source, spec);
+}
 /** A reader that parses each file once. */
 function parser(read) {
     const seen = new Map();
@@ -265,7 +306,7 @@ function hookIn(tree, hook) {
     const parsed = tree(hook.file);
     if ("problem" in parsed)
         return { missing: `${parsed.problem}, and it holds a required call (${hook.why})` };
-    const fn = heldFunction(parsed.source, hook.inside);
+    const fn = (hook.inside.includes(">") ? nestedFunction(parsed.source, hook.inside) : heldFunction(parsed.source, hook.inside));
     if (fn === null || fn.body === undefined)
         return { missing: `${hook.file} no longer has ${hook.inside} as one function, which must call ${hook.calls} (${hook.why})` };
     const found = callsOf(fn.body, hook.calls);
@@ -281,7 +322,7 @@ function pinnedText(tree, pin) {
     const parsed = tree(pin.file);
     if ("problem" in parsed)
         return null;
-    const fn = pin.fn.includes("#") ? classMethod(parsed.source, pin.fn) : heldFunction(parsed.source, pin.fn);
+    const fn = heldNode(parsed.source, pin.fn);
     if (fn === null)
         return null;
     // The static block's pin holds the class header too: its name, modifiers and heritage, as the base has them.
@@ -308,8 +349,12 @@ export function evalHookProblem(candidate, base, hooks = EVAL_HOOKS, pinned = EV
     }
     for (const pin of pinned) {
         const before = was === null ? null : pinnedText(was, pin);
-        if (was !== null && before === null)
+        if (was !== null && before === null) {
+            // A strict pin the base holds the file of but can't resolve is a problem (learning loops, Protection 2), never a skip.
+            if (pin.strict === true && base(pin.file) !== null)
+                return `${pin.file} at the base has no ${pin.fn} as one function, which is pinned strictly (${pin.why})`;
             continue;
+        }
         const after = pinnedText(now, pin);
         if (after === null)
             return `${pin.file} no longer has ${pin.fn} as one function (${pin.why})`;
@@ -475,3 +520,181 @@ export function storeRewriteProblem(paths, candidate, base, pinned = PINNED_STOR
     }
     return null;
 }
+// ---- learning loops (docs/plans/learning-loops.md, "Safety", Protection 2-4) ----------------------------------------
+/** The calls that record a check's facts: at disposition, and as the check's command starts. */
+export const LEARNING_HOOKS = Object.freeze([
+    { file: "src/builder.ts", inside: "settleProof", calls: "recordCheckFacts", from: "./check-facts.js", why: "every settled check records its facts" },
+    { file: "src/builder.ts", inside: "settleProof>runVerification", calls: "captureCheckConditions", from: "./check-facts.js", why: "a check's conditions are captured as its command starts" },
+]);
+/** The bodies a release can't change by itself, every one strict: what a run is told from project memory, how a memory
+ * proposal and a decision are written, and where a check's conditions are captured. */
+export const LEARNING_PINNED = Object.freeze([
+    { file: "src/project-knowledge.ts", fn: "knowledgeContext", strict: true, why: "the decisions and references a run is given, and their snapshot" },
+    { file: "src/project-learning.ts", fn: "learningContext", strict: true, why: "the lessons a run is given, and their snapshot" },
+    { file: "src/memory-pass.ts", fn: "decideProposal", strict: true, why: "a memory proposal's one writer" },
+    { file: "src/project-memory.ts", fn: "recordDecision", strict: true, why: "how a decision is recorded and what it supersedes" },
+    { file: "src/project-memory.ts", fn: "retireDecision", strict: true, why: "how a decision is retired" },
+    { file: "src/builder.ts", fn: "settleProof>runVerification", strict: true, why: "the check's command and the conditions it starts under" },
+]);
+/** Every file the learning manifest reads. */
+export const LEARNING_HOOK_FILES = Object.freeze([...new Set([...LEARNING_HOOKS.map(hook => hook.file), ...LEARNING_PINNED.map(pin => pin.file)])]);
+/** Each protected table and its only writer modules (the v149 migration in store.ts aside). The decision tables'
+ * existing writers stay theirs: project-memory.ts records and retires, project-delete.ts deletes a whole project. */
+export const LEARNING_WRITERS = Object.freeze({
+    check_fact: ["src/check-facts.ts"], check_result: ["src/check-facts.ts"],
+    local_observation: ["src/flaky.ts"], ci_flaky_observation: ["src/flaky-ci.ts"], ci_pairing_rejected: ["src/flaky-ci.ts"],
+    learning_watch: ["src/flaky.ts", "src/lesson-notes.ts"],
+    lesson_note: ["src/lesson-notes.ts"], lesson_note_tally: ["src/lesson-notes.ts"],
+    memory_use: ["src/memory-use.ts"],
+    memory_tidy_proposal: ["src/memory-tidy.ts"], decision_merge: ["src/memory-tidy.ts"],
+    project_decision: ["src/memory-tidy.ts", "src/project-memory.ts", "src/project-delete.ts"],
+    decision_change: ["src/memory-tidy.ts", "src/project-memory.ts", "src/project-delete.ts"],
+});
+/** store.ts's v149 migration: the only place outside the writers that may name these tables in SQL. */
+const LEARNING_MIGRATION = Object.freeze({ "src/store.ts": ["V149_SCHEMA", "V149_TABLES", "V149_REPO_TABLES"] });
+const PROTECTED = Object.keys(LEARNING_WRITERS);
+const tableWrite = (table) => new RegExp(String.raw `(?:\b(?:(?:INSERT(?:\s+OR\s+\w+)?|REPLACE)\s+INTO|UPDATE(?:\s+OR\s+\w+)?|DELETE\s+FROM)\s+(?:main\s*\.\s*)?["\`\[]?${table}["\`\]]?(?!\w)`
+    + String.raw `|\b(?:DROP\s+(?:TABLE|TRIGGER|INDEX|VIEW)(?:\s+IF\s+EXISTS)?|ALTER\s+TABLE)\s+(?:main\s*\.\s*)?["\`\[]?${table})`, "i");
+const TABLE_WRITES = PROTECTED.map(table => ({ table, write: tableWrite(table) }));
+const WRITE_WORD = /\b(?:INSERT|UPDATE|DELETE|REPLACE|DROP|ALTER)\b/i;
+const BARE_NAME = new RegExp(String.raw `^\s*(?:main\s*\.\s*)?["\`\[]?(?:${PROTECTED.join("|")})["\`\]]?\s*$`, "i");
+/**
+ * Every construct in the file that could write a protected table: each string literal, template (its static parts)
+ * and `+` concatenation (its literal operands), whatever it's passed to — `prepare`, `exec`, a renamed `prepare`, a
+ * helper. A write verb next to a protected table's name, a table name split around an expression next to a write
+ * word, and a string that is only a protected table's name are each found.
+ */
+export function learningConstructs(source) {
+    const compiler = typescript();
+    const found = [];
+    const topOf = (node) => {
+        let at = node;
+        while (at.parent !== undefined && !compiler.isSourceFile(at.parent))
+            at = at.parent;
+        if (compiler.isFunctionDeclaration(at) || compiler.isClassDeclaration(at))
+            return at.name?.text ?? "";
+        if (compiler.isVariableStatement(at))
+            return at.declarationList.declarations.map(one => compiler.isIdentifier(one.name) ? one.name.text : "").join(",");
+        return "";
+    };
+    const fragmentRisk = (parts) => {
+        // Around each placeholder: the identifier characters just before and just after it.
+        for (let i = 0; i < parts.length - 1; i++) {
+            const before = /[A-Za-z0-9_]*$/.exec(parts[i])[0].toLowerCase(), after = /^[A-Za-z0-9_]*/.exec(parts[i + 1])[0].toLowerCase();
+            if (before === "" && after === "")
+                continue;
+            if (PROTECTED.some(table => (before !== "" && table.startsWith(before) && table !== before) || (after !== "" && table.endsWith(after) && table !== after)
+                || (before !== "" && after !== "" && table.startsWith(before) && table.endsWith(after))))
+                return true;
+        }
+        return false;
+    };
+    const consider = (node, parts) => {
+        const text = parts.join("${}");
+        const tables = TABLE_WRITES.filter(one => one.write.test(text)).map(one => one.table);
+        const unreadable = parts.length > 1 && WRITE_WORD.test(text) && fragmentRisk(parts);
+        const bare = parts.length === 1 && BARE_NAME.test(text);
+        if (tables.length > 0 || unreadable || bare)
+            found.push({ text: text.replace(/\s+/g, " ").trim(), tables, inside: topOf(node), unreadable, bare });
+    };
+    const isPlus = (node) => compiler.isBinaryExpression(node) && node.operatorToken.kind === compiler.SyntaxKind.PlusToken;
+    const flatten = (node, into) => {
+        let at = node;
+        while (compiler.isParenthesizedExpression(at))
+            at = at.expression;
+        if (isPlus(at)) {
+            flatten(at.left, into);
+            flatten(at.right, into);
+        }
+        else
+            into.push(at);
+    };
+    const visit = (node) => {
+        if (isPlus(node) && !(node.parent !== undefined && (isPlus(node.parent) || (compiler.isParenthesizedExpression(node.parent) && node.parent.parent !== undefined && isPlus(node.parent.parent))))) {
+            const operands = [];
+            flatten(node, operands);
+            if (operands.some(one => compiler.isStringLiteralLike(one) || compiler.isTemplateExpression(one))) {
+                const parts = [""];
+                for (const one of operands) {
+                    if (compiler.isStringLiteralLike(one))
+                        parts[parts.length - 1] += one.text;
+                    else if (compiler.isTemplateExpression(one)) {
+                        parts[parts.length - 1] += one.head.text;
+                        for (const span of one.templateSpans)
+                            parts.push(span.literal.text);
+                    }
+                    else
+                        parts.push("");
+                }
+                if (parts.length > 1 || operands.length > 1)
+                    consider(node, parts);
+            }
+        }
+        if (compiler.isStringLiteralLike(node))
+            consider(node, [node.text]);
+        else if (compiler.isTemplateExpression(node))
+            consider(node, [node.head.text, ...node.templateSpans.map(span => span.literal.text)]);
+        compiler.forEachChild(node, visit);
+    };
+    visit(source);
+    return found;
+}
+/** Whether this construct may stand in this file: its writer module for every table it writes, or the migration's own
+ * declarations in store.ts. An unreadable or bare construct stands only in a writer of some protected table. */
+function learningAllowed(file, one) {
+    if ((LEARNING_MIGRATION[file] ?? []).some(name => one.inside.split(",").includes(name)))
+        return true;
+    if (one.tables.length > 0)
+        return one.tables.every(table => LEARNING_WRITERS[table].includes(file));
+    return Object.values(LEARNING_WRITERS).some(writers => writers.includes(file));
+}
+/**
+ * Why a changed file writes a learning-loops table (or a decision merge or restore) from a place that may not, or null
+ * (docs/plans/learning-loops.md, Protection 4). Every changed JavaScript or TypeScript file but tests is parsed; a
+ * construct its writer module doesn't own is new unless the base's copy of that file already had exactly that text
+ * (counted by its sha256, as storeRewriteProblem does). A file that can't be read or parsed needs a person. It reads
+ * text the candidate wrote, never runs it: it raises the bar for review; a person reviewing these files is the backstop.
+ */
+export function learningWriteProblem(paths, candidate, base) {
+    const scanned = paths.filter(path => /\.(?:[cm]?[jt]sx?)$/.test(path) && !/\.test\.[cm]?[jt]sx?$/.test(path) && !path.startsWith("test/")
+        && !path.startsWith("node_modules/") && !path.includes("/node_modules/"));
+    if (scanned.length === 0)
+        return null;
+    if (candidate === null || base === null)
+        return "the changed files can't be read";
+    const key = (text) => createHash("sha256").update(text).digest("hex");
+    for (const path of scanned) {
+        const bytes = candidate(path);
+        if (bytes === null)
+            return `${path} can't be read`;
+        const now = parse(path, bytes);
+        if ("problem" in now)
+            return now.problem;
+        const before = base(path);
+        const was = before === null ? null : parse(path, before);
+        const kept = new Map();
+        if (was !== null && !("problem" in was))
+            for (const one of learningConstructs(was.source))
+                kept.set(key(one.text), (kept.get(key(one.text)) ?? 0) + 1);
+        for (const one of learningConstructs(now.source)) {
+            if (learningAllowed(path, one))
+                continue;
+            const left = kept.get(key(one.text)) ?? 0;
+            if (left > 0) {
+                kept.set(key(one.text), left - 1);
+                continue;
+            }
+            const what = one.unreadable ? "builds a learning-loops table's name around an expression in SQL" : one.bare ? "names a learning-loops table outside its writers" : "writes learning-loops rows outside their writers";
+            return `${path} ${what} (\`${one.text.slice(0, 80)}\`)`;
+        }
+    }
+    return null;
+}
+/**
+ * Why a candidate needs a person for learning loops, or null: a required call dropped, a pinned body changed (strict
+ * pins included), or a changed file writing a protected table from outside its writers. With `manifest.base`, only what
+ * the base holds is required, as evalHookProblem does — except a strict pin whose file the base holds.
+ */
+export function learningHookProblem(manifest, changed) {
+    return evalHookProblem(manifest.candidate, manifest.base, LEARNING_HOOKS, LEARNING_PINNED) ?? learningWriteProblem(changed.paths, changed.candidate, changed.base);
+}

package/dist/flaky.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Mixed outcomes under recorded conditions (docs/plans/learning-loops.md, "Flaky tests"): advisory only. Nothing here
+ * changes a check's outcome, a verdict, an approval or a rerun; rerunning stays a person's `task regate`.
+ *
+ * Slice 1 holds the tracked identities an observation adds (`learning_watch`, reason `observation`): every Full check
+ * with a handshake asks about them for 90 days (check-facts.ts learnRequestFor). Lesson notes (lesson-notes.ts) add
+ * their own. This module and lesson-notes.ts are the only writers of `learning_watch`; release-auto's learning scan
+ * (eval-hooks.ts learningWriteProblem) needs a person for any other. A policy path (release-auto.ts EVAL_POLICY).
+ */
+import type { Store } from "./store.js";
+/** Track an identity a local observation named (one row per observation; first write wins, never rewritten). */
+export declare function watchObservation(store: Store, input: {
+    repo: string;
+    identity: string;
+    observation: number;
+    now: Date;
+}): boolean;

package/dist/flaky.js

@@ -0,0 +1,9 @@
+/** Track an identity a local observation named (one row per observation; first write wins, never rewritten). */
+export function watchObservation(store, input) {
+    if (input.repo.trim() === "" || input.identity.length < 1 || input.identity.length > 2600 || !Number.isSafeInteger(input.observation) || input.observation < 1) {
+        throw new Error("a tracked identity needs its project, a bounded identity and the observation that named it");
+    }
+    const added = store.handle.prepare(`INSERT INTO learning_watch (repo, identity, reason, source_ref, since, until) VALUES (?, ?, 'observation', ?, ?, NULL)
+    ON CONFLICT (repo, identity, reason, source_ref) DO NOTHING`).run(input.repo, input.identity, `observation:${input.observation}`, input.now.toISOString());
+    return Number(added.changes) === 1;
+}

package/dist/flow-engine.js

@@ -507,7 +507,7 @@ export function revisionWithNote(store, card, target, note, actor, repos, eviden
         return null;
     const revised = requestResultChanges(store, evidenceRoot, {
         run: runId, source: revisionSourceOf(store.getScope(runTask)?.digest ?? null), actor, repos,
-        batch: "", note, path: "", line: "", request: `flow-${card.id}-${card.entry}`, allowMode: true,
+        batch: "", note, path: "", line: "", request: `flow-${card.id}-${card.entry}`, allowMode: true, origin: "flow",
     }, now);
     return revised.ok ? revised.id : null;
 }

package/dist/flow-pull-request.js

@@ -140,7 +140,7 @@ export async function pullRequestStep(store, flow, definition, stage, card, now,
             const runTask = store.externalIdFor(store.getRun(runId)?.taskRef ?? -1);
             const revised = runTask === null ? null : requestResultChanges(store, io.evidenceRoot, {
                 run: runId, source: revisionSourceOf(store.getScope(runTask)?.digest ?? null), actor: "toolroll", repos: [flow.repo], batch: "",
-                note: found?.note ?? said, path: "", line: "", allowMode: true,
+                note: found?.note ?? said, path: "", line: "", allowMode: true, origin: "flow",
                 request: createHash("sha256").update(`flow-ci ${card.id} ${card.entry} ${publication.id}`).digest("hex").slice(0, 32),
             }, now);
             if (revised?.ok === true)

package/dist/lead-doors.js

@@ -25,7 +25,7 @@ import { teamChatAuthorization, subscriptionTeamChatProvider } from './team-chat
 import { readProjectAccess } from "./project-access.js";
 import { TeamLeads } from './team-leads.js';
 import { fileTaskProposal } from "./proposal.js";
-import { proposeGuarded } from "./scope.js";
+import { machineActing, proposeGuarded } from "./scope.js";
 import { isTaskSize, PHASES, specWords } from "./phase-routing.js";
 import { isProviderId } from "./provider.js";
 import { applyChatReview } from "./chat-review.js";
@@ -377,7 +377,9 @@ function executeProposal(store, actor, kind, payload, now, options) {
         const request = payload;
         if (request.snapshot == null || request.snapshot.task !== taskId || (request.operation !== "note" && request.operation !== "revise"))
             return refuse("refused", "This feedback card is incomplete. Ask again.");
-        const result = applyChatReview(store, actor, options.evidenceRoot, request, now, options.via !== "cli");
+        // A review card is the lead's (or a coordinator's) proposal; a person confirming it here decided the result needs
+        // these changes, so the revision is theirs. Under the lead's own chain or a remote run nobody confirmed it: lead.
+        const result = applyChatReview(store, actor, options.evidenceRoot, request, now, options.via !== "cli", machineActing() ? "lead" : "person");
         return result.ok ? { ok: true, kind, taskId: result.taskId, said: result.said } : refuse("stale", result.message);
     }
     // The place the proposer saw must be the place the task holds now

package/dist/lead-tools.js

@@ -1,3 +1,4 @@
+import { rulesOf, ruleWords as earnedRuleWords, suggestionsFor, suggestionWords, trialOffersFor, trialOfferWords, trialsOf, trialWords } from "./route-rules.js";
 import { sameFeedbackImage } from "./result-review.js";
 import { sweepLine, sweepTable } from "./lead-sweep.js";
 import { connectionsOf, oneClickOf } from "./mcp-connect.js";
@@ -1602,7 +1603,7 @@ const LEAD_TOOL_HANDLERS = {
         },
     },
     get_models: {
-        description: "Default agent per role with the exact model each name runs now, installed CLI versions and updates, and models released in the last two weeks. Read-only; changes happen in Settings → Models.",
+        description: "Default agent per role with the exact model each name runs now, installed CLI versions and updates, models released in the last two weeks, and cheaper models your projects' own results suggest (with their earned rules), cheaper models to try and the trials in use. Read-only; accepting and starting a trial happen in Settings → Models; Not now is propose_action suggestion_not_now; stopping a trial is propose_action trial_stop.",
         handle: (ctx) => {
             const roles = ["plan", "build", "review", "repair"].map(phase => {
                 const row = ctx.store.phaseConfig(INSTALLATION_SCOPE, phase);
@@ -1610,7 +1611,14 @@ const LEAD_TOOL_HANDLERS = {
             });
             const tools = runtimeStates(ctx.store).map(one => ({ name: one.name, installed: one.installed, latest: one.latest, updateAvailable: one.behind }));
             const newModels = ["claude", "codex", "gemini"].flatMap(source => seenModels(ctx.store, source)).filter(model => isNewModel(model, ctx.now)).map(model => ({ name: model.name, id: model.id, price: priceWords(model), released: model.releasedAt }));
-            return { ok: true, body: { roles, tools, newModels, change: "/settings/models" } };
+            // Results routing: the same suggestions and rules Settings → Models and `toolroll models suggestions` show.
+            const suggestions = ctx.who.repos.flatMap(repo => suggestionsFor(ctx.store, repo, ctx.now)).map(one => ({ id: one.id, repo: one.repo, words: suggestionWords(one),
+                review: `/settings/models?scope=${encodeURIComponent(one.repo)}&suggestion=${encodeURIComponent(one.id)}#models-suggested` }));
+            const rules = ctx.who.repos.flatMap(repo => rulesOf(ctx.store, repo, ctx.now)).map(one => ({ id: one.id, repo: one.repo, state: one.state, words: earnedRuleWords(ctx.store, one) }));
+            const trialOffers = ctx.who.repos.flatMap(repo => trialOffersFor(ctx.store, repo, ctx.now)).map(one => ({ id: one.id, repo: one.repo, words: trialOfferWords(one),
+                start: `/settings/models?scope=${encodeURIComponent(one.repo)}#models-suggested` }));
+            const trials = ctx.who.repos.flatMap(repo => trialsOf(ctx.store, repo, ctx.now)).map(one => ({ id: one.id, repo: one.repo, state: one.state, words: trialWords(ctx.store, one) }));
+            return { ok: true, body: { roles, tools, newModels, suggestions, rules, trialOffers, trials, change: "/settings/models" } };
         },
     },
     list_tasks: {

package/dist/local-owner.d.ts

@@ -10,7 +10,7 @@ export declare function authorityOf(value: unknown): Authority | null;
  * The acts a local owner may do (plan C1). Ids only: each surface (a route row, a chat action, a CLI command) names
  * the act it is, and an act not in this list is refused to a local owner.
  */
-export declare const LOCAL_OWNER_ACTS: readonly ["file-task", "lead-send", "approve-plan", "answer-question", "stop-run", "pause-run", "resume-run", "complete-task", "request-revision", "archive-task", "add-project", "choose-default-agent", "mark-seen", "watch-agent", "read"];
+export declare const LOCAL_OWNER_ACTS: readonly ["file-task", "lead-send", "approve-plan", "answer-question", "stop-run", "pause-run", "resume-run", "complete-task", "request-revision", "archive-task", "add-project", "choose-default-agent", "mark-seen", "watch-agent", "read", "routing-turn-off", "dismiss-suggestion", "trial-stop"];
 export type LocalOwnerAct = (typeof LOCAL_OWNER_ACTS)[number];
 /** Whether a runtime string names an act a local owner may do. */
 export declare function localOwnerAct(value: unknown): value is LocalOwnerAct;

package/dist/local-owner.js

@@ -32,6 +32,13 @@ export const LOCAL_OWNER_ACTS = Object.freeze([
     "mark-seen",
     "watch-agent",
     "read",
+    // Results routing (docs/plans/results-routing.md, Authority): lowering only — turning an earned rule off (or
+    // dropping a paused one), and saying Not now to a suggestion (or switching suggestions off). The writer
+    // (route-store.ts proveRuleDoor) checks the in-flight act is exactly the one it needs.
+    "routing-turn-off",
+    "dismiss-suggestion",
+    // Slice 3: stopping a trial of a cheaper model only lowers (proveRuleDoor checks this exact act).
+    "trial-stop",
 ]);
 const ACT_SET = new Set(LOCAL_OWNER_ACTS);
 /** Whether a runtime string names an act a local owner may do. */
@@ -150,6 +157,10 @@ export const CHAT_ACTION_LOCAL_ACTS = Object.freeze({
     subagent_create: null, subagent_soul: null, subagent_state: null, subagent_note: null, subagent_ask: null,
     subagent_answer: null, subagent_tools: null, subagent_memory: null, subagent_routine: null, subagent_undo: null,
     kit_setup: null, decision_record: null, decision_retire: null, lead_about_you: null,
+    // Results routing: Not now only lowers (the rule door checks this exact act).
+    suggestion_not_now: "dismiss-suggestion",
+    // Stopping a trial only lowers (the rule door checks this exact act).
+    trial_stop: "trial-stop",
     scope_approve: "approve-plan",
     result_accept: "complete-task",
     task_cancel: "stop-run",

package/dist/memory-cli.d.ts

@@ -200,6 +200,7 @@ export declare const MEMORY_DESCRIPTORS: readonly [{
         readonly takesValue: false;
         readonly meaning: 'read only the plane\'s own transcripts, not local Claude Code or Codex session files';
     }];
+    readonly audience: 'operator';
 }, {
     readonly action: 'retire';
     readonly synopsis: 'retire a decision that no longer holds: memory retire <id> --reason "<why>"';
@@ -250,6 +251,7 @@ export declare const MEMORY_DESCRIPTORS: readonly [{
         readonly takesValue: false;
         readonly meaning: 'read only the plane\'s own transcripts, not local Claude Code or Codex session files';
     }];
+    readonly audience: 'operator';
 }, {
     readonly action: 'propose';
     readonly synopsis: 'the backward pass: read recent sessions, keep a ledger of evidenced gaps, propose a few edits (writes nothing to memory)';
@@ -400,6 +402,7 @@ export declare const MEMORY_DESCRIPTORS: readonly [{
         readonly takesValue: false;
         readonly meaning: 'read only the plane\'s own transcripts, not local Claude Code or Codex session files';
     }];
+    readonly audience: 'operator';
 }, {
     readonly action: 'status';
     readonly synopsis: 'surface version, instruction budget, sessions analysed, open gaps and pending proposals';

package/dist/memory-cli.js

@@ -21,11 +21,11 @@ export const MEMORY_DESCRIPTORS = [
     { action: 'search', synopsis: 'search decisions, instructions, references, lessons and your conversations', mutation: 'none', takesQuery: true, flags },
     { action: 'decisions', synopsis: "list a project's active decisions (--all for history)", mutation: 'none', takesQuery: false, flags },
     { action: 'show', synopsis: 'read one decision with its reason and history', mutation: 'none', takesQuery: true, flags },
-    { action: 'decide', synopsis: 'record a settled choice: memory decide "<choice>" --why "<reason>" --repo PATH', mutation: 'unkeyed', takesQuery: true, flags },
-    { action: 'retire', synopsis: 'retire a decision that no longer holds: memory retire <id> --reason "<why>"', mutation: 'unkeyed', takesQuery: true, flags },
+    { action: 'decide', synopsis: 'record a settled choice: memory decide "<choice>" --why "<reason>" --repo PATH', mutation: 'unkeyed', takesQuery: true, flags, audience: 'operator' },
+    { action: 'retire', synopsis: 'retire a decision that no longer holds: memory retire <id> --reason "<why>"', mutation: 'unkeyed', takesQuery: true, flags, audience: 'operator' },
     { action: 'propose', synopsis: 'the backward pass: read recent sessions, keep a ledger of evidenced gaps, propose a few edits (writes nothing to memory)', mutation: 'unkeyed', takesQuery: false, flags },
     { action: 'review', synopsis: 'list pending memory proposals with their evidence', mutation: 'none', takesQuery: false, flags },
-    { action: 'apply', synopsis: 'decide one proposal: memory apply <id> --decision accept|reject — the only writer', mutation: 'unkeyed', takesQuery: true, flags },
+    { action: 'apply', synopsis: 'decide one proposal: memory apply <id> --decision accept|reject — the only writer', mutation: 'unkeyed', takesQuery: true, flags, audience: 'operator' },
     { action: 'status', synopsis: 'surface version, instruction budget, sessions analysed, open gaps and pending proposals', mutation: 'none', takesQuery: false, flags },
 ];
 const line = (d) => `#${d.id} ${d.claim} — ${d.decidedBy}, ${d.decidedAt.slice(0, 10)}${d.status === 'active' ? '' : ` (${d.status})`}`;

package/dist/memory-pass.js

@@ -17,7 +17,7 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { scanForSecrets, readVerifiedArtifact } from './evidence.js';
 import { changeKnowledge, knowledgeView } from './project-knowledge.js';
-import { listDecisions, recordDecision } from './project-memory.js';
+import { listDecisions, recordDecision, refuseLeadMemoryWrite } from './project-memory.js';
 import { composeLeadRequest, performLeadRequest, isDirectChatProvider, CHAT_KEY_ENV } from './converse.js';
 import { performSubscriptionLeadRequest } from './subscription-chat.js';
 import { TEXT_LIMITS } from './text-limits.js';
@@ -399,7 +399,11 @@ export function listProposals(store, repo, status = 'pending') {
 }
 /** The one writer: accept applies the edit through the knowledge or decision store as the person; reject remembers the fingerprint and its corroboration. */
 export function decideProposal(store, args, now = new Date()) {
+    refuseLeadMemoryWrite();
     return store.transact(() => {
+        // A person who may change this project's memory, read inside the write (a revoked account or lost access refuses).
+        if (!store.accountCanAccess(args.actor, args.repo) || store.accountOf(args.actor)?.role !== 'approver')
+            throw Error('Project memory is outside your access.');
         const row = store.handle.prepare('SELECT * FROM memory_proposal WHERE id=? AND repo=?').get(args.id, args.repo);
         if (!row)
             throw Error('That proposal is unavailable.');

package/dist/model-choices.d.ts

@@ -1,5 +1,5 @@
 import { type SeenModel } from "./model-catalog.js";
-import { type PhaseRoute } from "./phase-routing.js";
+import { type EarnedRule, type PhaseRoute } from "./phase-routing.js";
 import type { Store } from "./store.js";
 export type SlotPhase = "plan" | "build" | "repair" | "review";
 export type SlotTier = "routine" | "light" | "strong";
@@ -76,7 +76,9 @@ export declare const ROUTE_CASES: readonly {
     risky: boolean;
     strict: boolean;
 }[];
-export declare function effectiveRoutes(store: Store, repo: string | null): {
+export declare function effectiveRoutes(store: Store, repo: string | null, options?: {
+    rules?: readonly EarnedRule[] | false;
+}): {
     ok: true;
     routes: {
         label: string;
@@ -164,7 +166,9 @@ export type ScopeCheck = {
  * or a route of any size or demand (small, routine, large, risky, strict) whose repair can't resume its builder,
  * inherited rows included. An invalid result is never saved.
  */
-export declare function checkScope(store: Store, repo: string | null): ScopeCheck;
+export declare function checkScope(store: Store, repo: string | null, options?: {
+    rules?: readonly EarnedRule[];
+}): ScopeCheck;
 /** A resolver's words for a browser: what is wrong, never a terminal command to fix it. */
 export declare function browserWords(problem: string): string;
 /** The problem alone, or null when tasks can be filed. */