toolroll 0.9.92 → 0.9.94

package/dist/route-change.js

@@ -0,0 +1,89 @@
+/**
+ * One step to approve a new route (docs/plans/plain-toolroll.md P2.5). There are no route classes: an approval stays
+ * bound to its exact route, and dispatch runs on no other bytes. When the route a task would dispatch on differs from the
+ * sealed one, Toolroll files the same words again on today's route (nothing is sealed) and keeps one "what changed" line,
+ * bound to that route's digest, for the one Approve. A legacy row with no route gets the same.
+ *
+ * approve() reads routeChangeProblem: a line that doesn't describe the route being approved refuses "changed".
+ */
+import { providerName } from "./provider-auth.js";
+import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
+import { deployGateScope, releaseCheckScope } from "./scope.js";
+import { BUILT_IN } from "./store.js";
+const ROLE = { plan: "planner", build: "builder", repair: "repair agent", review: "reviewer" };
+const named = (one) => `${providerName(one.provider)} ${one.model ?? "(its default model)"}`;
+const billing = (mode) => mode === "api-key" ? "API key" : mode === "subscription" ? "subscription" : null;
+/** The sentence for what changed between the seal and the proposal. */
+export function routeChangeWords(sealed, next) {
+    const changes = [];
+    for (const phase of ["build", "plan", "repair", "review"]) {
+        const now = legOf(next.route, phase);
+        const was = sealed.route !== null ? legOf(sealed.route, phase) : phase === "build" && sealed.profile != null ? { provider: sealed.profile.provider, model: "model" in sealed.profile ? (sealed.profile.model ?? null) : null } : null;
+        if (was === null) {
+            if (phase === "build")
+                changes.push(`The builder is ${named(now)}`);
+            continue;
+        }
+        if (was.provider === now.provider && was.model === now.model)
+            continue;
+        const line = `changes from ${named(was)} to ${named(now)}`;
+        // The repair agent is the builder's usual twin: one change is one sentence.
+        if (changes.some(one => one.endsWith(line)))
+            continue;
+        changes.push(`${changes.length === 0 ? "The" : "the"} ${ROLE[phase]} ${line}`);
+    }
+    const from = billing(sealed.authMode), to = billing(next.authMode);
+    const paid = from !== null && to !== null && from !== to ? ` (${from} → ${to})` : "";
+    if (changes.length === 0)
+        return "The agents' settings changed since you approved this. Approve to continue.";
+    return `${changes.join("; ")}${paid}. Approve to continue.`;
+}
+/** File the same words on today's route, and keep the line. Null: nothing to propose (a release, nothing changed, or no
+ * route Toolroll can name), and the task stays as it is. It seals nothing. */
+export function proposeNewRoute(store, taskRef, taskId, now) {
+    return store.transact(() => {
+        const before = store.getScope(taskId);
+        if (before === null || deployGateScope(before) || releaseCheckScope(before))
+            return null;
+        const sealedRoute = routeFromJson(before.approvedRouteJson ?? null);
+        const refiled = store.refileScope(taskId, now);
+        if (refiled === null || refiled.profileState === "unresolved")
+            return null;
+        const route = routeFromJson(refiled.proposedRouteJson ?? null);
+        if (route === null)
+            return null;
+        if (refiled.approvedDigest === refiled.digest)
+            return null;
+        // How the last attempt billed, against how the new builder would: said when they differ.
+        const lastBilled = store.runsFor(taskRef).find(one => one.role === "builder")?.authMode ?? null;
+        const billed = store.agentsFor([legOf(route, "build").provider])[0]?.billing ?? null;
+        const words = routeChangeWords({ route: sealedRoute, profile: before.approvedProfile ?? null, authMode: lastBilled }, { route, authMode: billed });
+        store.handle.prepare(`INSERT INTO route_change (task_ref, scope_digest, to_route_digest, words, created_at) VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT (task_ref) DO UPDATE SET scope_digest = excluded.scope_digest, to_route_digest = excluded.to_route_digest, words = excluded.words, created_at = excluded.created_at`)
+            .run(taskRef, refiled.digest, routeDigestOf(route), words, now.toISOString());
+        return { words };
+    });
+}
+/** The line for this task's waiting plan, or null. Only while it describes exactly the plan up for approval. */
+export function routeChangeOf(store, taskId) {
+    const ref = store.lookupRef(taskId);
+    if (ref === null)
+        return null;
+    const row = store.handle.prepare("SELECT scope_digest, to_route_digest, words FROM route_change WHERE task_ref = ?").get(ref.id);
+    const scope = store.getScope(taskId);
+    if (row === undefined || scope === null || scope.digest !== row["scope_digest"] || scope.approvedDigest === scope.digest)
+        return null;
+    const route = routeFromJson(scope.proposedRouteJson ?? null);
+    return route !== null && routeDigestOf(route) === row["to_route_digest"] ? String(row["words"]) : null;
+}
+/** Each sweep: an unapproved row from before routing gets its route, and the same one Approve. A standing old approval
+ * is left alone (the stale check reaches it if its route ever differs). */
+export function routeLegacyPlans(store, now) {
+    const rows = store.handle.prepare(`SELECT r.id AS ref, r.external_id AS task FROM task_scope s JOIN task_ref r ON r.external_id = s.task_id AND r.backend = ? JOIN task t ON t.id = r.external_id
+    WHERE s.route_era IS NULL AND t.state = 'queued' AND (s.approved_digest IS NULL OR s.approved_digest <> s.digest) LIMIT 20`).all(BUILT_IN);
+    let routed = 0;
+    for (const row of rows)
+        if (proposeNewRoute(store, Number(row["ref"]), String(row["task"]), now) !== null)
+            routed++;
+    return routed;
+}

package/dist/route-hooks.js

@@ -80,8 +80,9 @@ const VERB = String.raw `(?:INSERT(?:\s+OR\s+\w+)?\s+INTO|REPLACE\s+INTO|UPDATE(
 const writes = (tables) => new RegExp(String.raw `\b${VERB}\s+(?:main\s*\.\s*)?["\`\[]?(?:${tables.join("|")})["\`\]]?(?![\w])`, "i");
 const ROUTING_WRITE = writes([...ROUTING_TABLES, "route_rule_one_winner"]);
 const MODELS_WRITE = writes(MODELS_TABLES);
-/** The two columns only route-store.ts writes: any write statement that names one. */
-const COLUMN_WRITE = /\b(?:INSERT|REPLACE|UPDATE)\b[^]*\b(?:exec_class|revision_origin)\b/i;
+/** The two columns only route-store.ts writes: any write statement that names one. A lesson note keeps its own copy of
+ * how a revision was asked for: that one INSERT into its own table is not this column, and only it is left out. */
+const COLUMN_WRITE = /\b(?:INSERT(?!\s+INTO\s+lesson_note\b)|REPLACE|UPDATE)\b[^]*\b(?:exec_class|revision_origin)\b/i;
 /** Each string or template text in the file that writes a protected row, with the function it's in ("" at the top
  * level): `Class#method`, or the top-level function. */
 export function protectedWrites(file, source) {

package/dist/route-results.d.ts

@@ -1,5 +1,5 @@
 import { INELIGIBLE_REASONS, type RecordReason, type RecordState, type ResultRecordView, type Selection } from "./contracts/route-results.js";
-import { type Store } from "./store.js";
+import { type Run, type Store } from "./store.js";
 export { cohortOf, EXEC_CLASS_OF_REASON, execClassOf, type CohortInput, type CohortRow } from "./route-store.js";
 /** How long an accepted result waits before it counts, and how long a result may wait for an answer. */
 export declare const MATURE_AFTER_MS: number;
@@ -39,6 +39,11 @@ export type RecordValue = {
     /** The family is quiet, or past ACCUMULATE_FOR_MS: with a final verdict, the record closes. */
     accumulationEnded: boolean;
 };
+/** Whether the first built run among `runs` passed its own check; null when none is recorded. The code map's report reads
+ * this too, so the two never disagree on what a first check is. */
+export declare function firstCheckPassedOf(store: Store, runs: readonly Pick<Run, "id" | "outcome">[]): boolean | null;
+/** How many of these task versions are a person's revision. */
+export declare function personRevisionsOf(store: Store, refs: readonly number[]): number;
 /**
  * A task family's record, evaluated now from its rows (null: no code-writing run, or a family whose lineage can't be
  * proved). The order is the plan's: what can't be attributed to one model and one cohort first, then a live attempt

package/dist/route-results.js

@@ -54,6 +54,17 @@ function classOfRun(run, kept) {
     return "model";
 }
 const FAILED_OUTCOMES = new Set(["failed", "interrupted"]);
+/** Whether the first built run among `runs` passed its own check; null when none is recorded. The code map's report reads
+ * this too, so the two never disagree on what a first check is. */
+export function firstCheckPassedOf(store, runs) {
+    const first = runs.find(run => run.outcome === "built");
+    const status = first === undefined ? null : store.runCheckFor(first.id)?.status ?? null;
+    return status === "passed" ? true : status === "failed" ? false : null;
+}
+/** How many of these task versions are a person's revision. */
+export function personRevisionsOf(store, refs) {
+    return Number(store.handle.prepare("SELECT COUNT(*) AS n FROM task_ref WHERE id IN (SELECT value FROM json_each(?)) AND revision_origin = 'person'").get(JSON.stringify(refs))?.["n"] ?? 0);
+}
 /**
  * A task family's record, evaluated now from its rows (null: no code-writing run, or a family whose lineage can't be
  * proved). The order is the plan's: what can't be attributed to one model and one cohort first, then a live attempt
@@ -106,10 +117,8 @@ export function evaluateFamily(store, rootTaskId, evidenceRoot, now) {
         else
             agentTurns += run.agentTurns;
     }
-    const firstBuilt = runs.find(run => run.outcome === "built");
-    const firstCheck = firstBuilt === undefined ? null : store.runCheckFor(firstBuilt.id)?.status ?? null;
-    const personRevisions = store.handle.prepare("SELECT COUNT(*) AS n FROM task_ref WHERE id IN (SELECT value FROM json_each(?)) AND revision_origin = 'person'")
-        .get(JSON.stringify(family.versions.filter(one => one.id !== family.root.id).map(one => one.refId)))?.["n"];
+    const firstCheck = firstCheckPassedOf(store, runs);
+    const personRevisions = personRevisionsOf(store, family.versions.filter(one => one.id !== family.root.id).map(one => one.refId));
     const quiet = family.versions.every(one => one.state === "done" || one.state === "cancelled" || one.state === "failed") && runs.every(run => run.outcome !== null);
     let modelFailures = 0, infraFailures = 0;
     for (const run of runs) {
@@ -129,7 +138,7 @@ export function evaluateFamily(store, rootTaskId, evidenceRoot, now) {
         firstStartedAt: first?.startedAt ?? runs[0].startedAt, acceptedAt: null, decidedAt: null, modelFailures, infraFailures,
         apiMicrousd, subscriptionRuns, subscriptionTokens, unknownRuns, remediationRuns,
         selections: attributed.map(one => one.selection).filter((one) => one !== null), settled: false,
-        personRevisions: Number(personRevisions ?? 0), firstCheckPassed: firstCheck === "passed" ? true : firstCheck === "failed" ? false : null,
+        personRevisions, firstCheckPassed: firstCheck,
         agentTurns, turnsUnknownRuns,
         accumulationEnded: quiet || now.getTime() >= Date.parse(first?.startedAt ?? runs[0].startedAt) + ACCUMULATE_FOR_MS,
     };

package/dist/run-closeout.d.ts

@@ -1,4 +1,4 @@
-import type { Store, WorktreeRow } from "./store.js";
+import { type Store, type WorktreeRow } from "./store.js";
 /** How long a process has after SIGTERM before SIGKILL. */
 export declare const STOP_GRACE_MS = 10000;
 export type ProcessRow = {

package/dist/run-closeout.js

@@ -15,9 +15,9 @@
  */
 import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readlinkSync, realpathSync } from "node:fs";
-import { hostname } from "node:os";
 import { basename, sep } from "node:path";
 import { ownedProcessCount, runOwnerTag } from "./exec.js";
+import { localWitnessSql } from "./store.js";
 import { sleep as defaultSleep } from "./sleep.js";
 /** How long a process has after SIGTERM before SIGKILL. */
 export const STOP_GRACE_MS = 10_000;
@@ -138,10 +138,11 @@ export async function closeOutRuns(store, clock, options = {}) {
     if (process.platform === "win32")
         return [];
     const db = store.handle;
+    const local = localWitnessSql(db, "p"), mine = localWitnessSql(db);
     const runs = db.prepare(`SELECT DISTINCT p.run AS run FROM run_process p JOIN run r ON r.id = p.run JOIN task_ref t ON t.id = r.task_ref
-    WHERE p.exited_at IS NULL AND p.pid IS NOT NULL AND p.containment IS NULL AND p.container IS NULL AND p.host = ?
+    WHERE p.exited_at IS NULL AND p.pid IS NOT NULL AND p.containment IS NULL AND p.container IS NULL AND ${local.sql}
       AND r.outcome IS NOT NULL${options.repo === undefined ? "" : " AND t.repo = ?"} ORDER BY p.run`)
-        .all(...[hostname(), ...(options.repo === undefined ? [] : [options.repo])]).map(row => Number(row["run"]));
+        .all(...[...local.params, ...(options.repo === undefined ? [] : [options.repo])]).map(row => Number(row["run"]));
     const out = [];
     if (runs.length === 0)
         return out;
@@ -151,7 +152,7 @@ export async function closeOutRuns(store, clock, options = {}) {
         if (ownedProcessCount(runOwnerTag(store, runId)) > 0)
             continue;
         const witnesses = db.prepare(`SELECT pid, process_group, observed_at FROM run_process
-      WHERE run = ? AND exited_at IS NULL AND pid IS NOT NULL AND containment IS NULL AND container IS NULL AND host = ?`).all(runId, hostname())
+      WHERE run = ? AND exited_at IS NULL AND pid IS NOT NULL AND containment IS NULL AND container IS NULL AND ${mine.sql}`).all(runId, ...mine.params)
             .map(row => ({ pid: Number(row["pid"]), group: Number(row["process_group"]) === 1, observedAt: Date.parse(String(row["observed_at"])) }))
             .filter(one => Number.isFinite(one.observedAt));
         if (witnesses.length === 0)
@@ -252,8 +253,9 @@ export function checkoutTargets(census, inside, roots, guard) {
 function finishedRunProcesses(store, census) {
     const byPid = new Map(census.map(row => [row.pid, row]));
     const roots = new Set();
+    const local = localWitnessSql(store.handle, "p");
     const rows = store.handle.prepare(`SELECT p.pid AS pid, p.observed_at AS observed_at FROM run_process p JOIN run r ON r.id = p.run
-    WHERE p.exited_at IS NULL AND p.pid IS NOT NULL AND p.host = ? AND r.outcome IS NOT NULL`).all(hostname());
+    WHERE p.exited_at IS NULL AND p.pid IS NOT NULL AND ${local.sql} AND r.outcome IS NOT NULL`).all(...local.params);
     for (const row of rows) {
         const now = byPid.get(Number(row["pid"]));
         const observedAt = Date.parse(String(row["observed_at"]));

package/dist/runner-process.js

@@ -13,6 +13,7 @@
  * The record is the plane's own state (the folder that holds the database). It grants nothing by itself: it can
  * only let a name whose every recorded holder has exited be taken over early.
  */
+import { sameMachineHost } from "./machine-identity.js";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { closeSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, realpathSync, renameSync, rmSync, writeFileSync, fsyncSync, constants } from "node:fs";
@@ -195,7 +196,7 @@ export function holderProvedGone(record, holder, host, probe = realProcessProbe)
     if (typeof record.signature !== "string" || !/^[a-f0-9]{64}$/.test(record.signature)
         || !timingSafeEqual(Buffer.from(record.signature, "hex"), Buffer.from(expected, "hex")))
         return { gone: false, why: "its process record is not authenticated" };
-    if (record.runner !== holder.runner.name || record.host !== holder.runner.host || record.host !== host)
+    if (record.runner !== holder.runner.name || record.host !== holder.runner.host || !sameMachineHost(record.host, host))
         return { gone: false, why: "its record is for another worker or machine" };
     if (record.registeredAt !== holder.runner.registeredAt || record.credential !== credentialDigest(holder.credentialHash))
         return { gone: false, why: "its record is from an earlier start" };
@@ -229,7 +230,7 @@ export function recordStandsFor(record, holder, host) {
     if (typeof record.signature !== "string" || !/^[a-f0-9]{64}$/.test(record.signature)
         || !timingSafeEqual(Buffer.from(record.signature, "hex"), Buffer.from(expected, "hex")))
         return "its process record is not authenticated";
-    if (record.runner !== holder.runner.name || record.host !== holder.runner.host || record.host !== host)
+    if (record.runner !== holder.runner.name || record.host !== holder.runner.host || !sameMachineHost(record.host, host))
         return "its record is for another worker or machine";
     if (record.registeredAt !== holder.runner.registeredAt || record.credential !== credentialDigest(holder.credentialHash))
         return "its record is from an earlier start";

package/dist/runner.js

@@ -380,7 +380,8 @@ export function recoverDead(store, now, livenessMs = DEFAULT_LIVENESS_MS) {
             const claims = store.releaseClaimsOf(candidate.name, now, requeued);
             const worktrees = store.releaseWorktreesOf(candidate.name, now);
             const settled = store.recoverRunnerWork(candidate.name, now);
-            return { runner: candidate.name, claims, worktrees, runs: settled.runs, requeued: [...new Set([...requeued, ...settled.requeued])] };
+            // Only what recovery left in the queue: a vanished build it stopped for a person isn't requeued (vanished-retry.ts).
+            return { runner: candidate.name, claims, worktrees, runs: settled.runs, requeued: [...new Set([...requeued, ...settled.requeued])].filter(id => store.getTask(id)?.state === "queued") };
         });
         if (recovery !== null)
             recovered.push(recovery);

package/dist/scope.d.ts

@@ -793,7 +793,12 @@ export declare function fileAndSealUnderMode(store: Store, input: ScopeInput & {
     reason: "no-mode" | "not-signer" | "not-covered" | "coordinator-filed" | "acceptance-required" | "profile-unresolved";
     detail?: string;
 };
-export declare function approve(store: Store, taskId: string, by: string, now: Date, sawDigest: string, token: string, mutation?: Mutation): ApproveResult;
+export declare function approve(store: Store, taskId: string, by: string, now: Date, sawDigest: string, token: string, mutation?: Mutation, 
+/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it. */
+fastStart?: {
+    rule: string;
+    at: string;
+}): ApproveResult;
 /** The ledger act that records how an approval's person was proved (password-now, sso-now, fresh-password, fresh-sso). */
 export declare const APPROVAL_PROOF = "approval proved";
 /** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */

package/dist/scope.js

@@ -2,6 +2,8 @@
 export { ACCEPTANCE_LIMITS, EVIDENCE_KINDS } from "./contracts/acceptance-terms.js";
 import { mintSecret } from "./secret-mint.js";
 import { passwordlessOn } from "./passwordless.js";
+import { routeChangeProblem } from "./route-change-check.js";
+import { issueImported } from "./task-source.js";
 import { currentPasswordSource, passwordGuardOf, provenPasswordAccount } from "./sign-in-guard.js";
 import { validateScopeText } from "./task-text.js";
 import { contractChangesOf } from "./contract-changes.js";
@@ -1070,7 +1072,9 @@ export function fileAndSealUnderMode(store, input) {
         return { ok: true, scope: store.getScope(input.taskId), basis: "mode" };
     });
 }
-export function approve(store, taskId, by, now, sawDigest, token, mutation = {}) {
+export function approve(store, taskId, by, now, sawDigest, token, mutation = {}, 
+/** A fast start (fast-start.ts): Build is this same yes, with its marker in the proof. Only that road passes it. */
+fastStart) {
     // Read and write in one transaction, re-reading inside it — the credential
     // check included, so a token rotated between authentication and the write
     // cannot leave an approval signed by an authority that no longer exists.
@@ -1089,7 +1093,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         // localApprovalEligible, read again here inside the seal's transaction).
         const local = authenticated.method === "local-owner" ? currentLocalOwner() : null;
         if (authenticated.method === "local-owner") {
-            if (local === null || local.act !== "approve-plan")
+            if (local === null || (local.act !== "approve-plan" && !(local.act === "build-now" && fastStart !== undefined)))
                 return { ok: false, reason: "policy", message: localOwnerRefusal(store.accountOf(by)?.passwordSet === true, "/").message };
             const eligible = localApprovalEligible(store, by, taskId);
             if (!eligible.ok)
@@ -1106,6 +1110,12 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         // the new one in silence — which is the whole failure this guards.
         if (sawDigest !== scope.digest)
             return { ok: false, reason: "changed" };
+        // The "what changed" line a person read describes this exact route, or this yes isn't to what they read (route-change.ts).
+        if (routeChangeProblem(store, taskId, scope))
+            return { ok: false, reason: "changed" };
+        // A fast start is never a task from outside (github-import.ts): that takes the ordinary ceremony.
+        if (fastStart !== undefined && issueImported(store, taskId))
+            return { ok: false, reason: "policy", message: "A task from outside takes the ordinary approval." };
         // An unresolved scope cannot say exactly what would run, so nobody can
         // agree to it (foundations finding 16) — restatement is the road.
         if (scope.profileState === "unresolved") {
@@ -1144,7 +1154,7 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
         // How the person was proved, beside every yes they give (a vote kept for protected work, or the seal): a password
         // typed now, a re-check now, or a remembered one — with when, the credential generation and the exact digest.
         const proved = () => store.recordAction({ at: now.toISOString(), actor: by, repo: store.lookupRef(taskId)?.repo ?? null, taskId, runId: null, action: APPROVAL_PROOF,
-            outcome: authenticated.method, source: "work", detail: approvalProofDetail(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest, local === null ? undefined : { generation: local.localGeneration, transport: local.transport }) });
+            outcome: authenticated.method, source: "work", detail: (fastStart === undefined ? approvalProofDetail : fastProofDetail(fastStart))(authenticated.at, store.accountOf(by)?.generation ?? 0, scope.digest, local === null ? undefined : { generation: local.localGeneration, transport: local.transport }) });
         if (gate.verdict === "vote") {
             // The same person again adds nothing: no new vote, no proof row (and the approval roads refund a re-check).
             if (gate.already)
@@ -1185,6 +1195,9 @@ export function approve(store, taskId, by, now, sawDigest, token, mutation = {})
 export const APPROVAL_PROOF = "approval proved";
 /** The proof row's detail: when the person was proved, the generation, and the exact digest they said yes to. */
 export const approvalProofDetail = (at, generation, digest, local) => `${new Date(at).toISOString()} · generation ${generation}${local === undefined ? "" : ` · local ${local.generation} ${local.transport}`} · digest ${digest}`;
+/** A fast start's proof: the v1 record proofDetailOf reads, with the marker. `local` keeps the legacy words
+ * localSealStandsSql reads, so a local owner's seal stands on the same rule. */
+const fastProofDetail = (fastStart) => (at, generation, digest, local) => JSON.stringify({ v: 1, at: new Date(at).toISOString(), generation, digest, fastStart, ...(local === undefined ? {} : { local: `proof · local ${local.generation} ${local.transport} · seal` }) });
 /** The proof of THIS approval: the approver's own row for these exact bytes (never another approval's words). */
 export function approvalProofOf(store, taskId, by, digest) {
     const rows = store.handle.prepare("SELECT outcome, detail FROM action_ledger WHERE task_id = ? AND action = ? AND actor = ? ORDER BY id DESC LIMIT 50").all(taskId, APPROVAL_PROOF, by);
@@ -1321,8 +1334,8 @@ export function acceptanceWords(criteria) {
     if (criteria.length === 0)
         return [];
     return [
-        `  acceptance   ${criteria[0].id}: ${criteria[0].statement} [requires: ${criteria[0].evidence.join(", ")}]`,
-        ...criteria.slice(1).map(c => `               ${c.id}: ${c.statement} [requires: ${c.evidence.join(", ")}]`),
+        `  done when    ${criteria[0].id}: ${criteria[0].statement} [shown by: ${criteria[0].evidence.join(", ")}]`,
+        ...criteria.slice(1).map(c => `               ${c.id}: ${c.statement} [shown by: ${c.evidence.join(", ")}]`),
     ];
 }
 /** The route's approval-card lines (v47): the WORKING route the digest
@@ -1340,8 +1353,8 @@ evidence = null) {
     return [
         `  goal         ${scope.goal}`,
         ...(scope.outOfScope === null ? [] : [`  not this     ${scope.outOfScope}`]),
-        ...(scope.candidate ? [`  candidate    ${scope.candidate} — checked out by the machine, no agent runs`] : []),
-        ...(scope.touches.length === 0 ? [] : [`  touches      ${scope.touches.join(", ")}`]),
+        ...(scope.candidate ? [`  commit       ${scope.candidate.slice(0, 7)} — checked out by Toolroll, no agent runs`] : []),
+        ...(scope.touches.length === 0 ? [] : [`  files        ${scope.touches.join(", ")}`]),
         ...acceptanceWords(scope.acceptance),
         ...(scope.budgetMicrousd === null
             ? []
@@ -1358,7 +1371,7 @@ evidence = null) {
         ...(scope.profile === null || scope.profile === undefined ? [] : ((terms) => [`  reads        ${terms.reads}`, ...(terms.mach === null ? [] : [`  services     ${terms.mach}`])])(sandboxTermsWords(scope.profile))),
         ...releaseTermsWords(scope.releaseTerms ?? null),
         ...(scope.releaseCheck == null ? [] : [`  release      ${releaseCheckSentence(scope.releaseCheck)}`]),
-        `  reference    ${scope.digest}`,
+        `  version      ${scope.digest.slice(0, 8)} (the full plan version is in --json)`,
         `  approved     ${describeApproval(approval)}`,
     ];
 }
@@ -1394,7 +1407,7 @@ function describeApproval(approval) {
     if (approval.approved)
         return `yes, by ${approval.by} at ${approval.at}`;
     if (approval.reason === "changed") {
-        return "no — it was approved, then the scope was rewritten; approve it again";
+        return "no — edited after approval; approve it again";
     }
     return "no — nothing will build this until somebody agrees to it";
 }

package/dist/serve.d.ts

@@ -4,7 +4,7 @@ export declare function createDecisionServer(options: ServeOptions): DecisionSer
 export { PAGE_CSS, pinnedTheme, SENSITIVE_INPUT } from "./server/chrome.js";
 export { redactedPath, SHUTDOWN_WAIT_MS, type ServeOptions } from "./server/http.js";
 export { TASK_COMPOSER_MODES, type TaskComposerMode } from "./server/render-chat.js";
-export { inboxFingerprints, parseInboxTab, queueScript, type InboxTab } from "./server/render-pages.js";
+export { queueScript } from "./server/render-pages.js";
 export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
 export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches, type ReviewFileRow, type ReviewPriority, type ReviewQueueFacts } from "./server/render-results.js";
 export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords, type RouteView } from "./server/render-tasks.js";

package/dist/serve.js

@@ -108,6 +108,7 @@ import { keepSlowRequest, Timeline } from "./latency-timeline.js";
 import { readFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { homedir, hostname } from "node:os";
+import { sameMachineHost } from "./machine-identity.js";
 import { dirname, join } from "node:path";
 import { pinnedAccent } from "./accent-colors.js";
 import { CHAT_KEY_ENV, credentialKeyOf, fetchOpenRouterCatalog, isSubscriptionChatProvider, priceForConfig, subscriptionCredentialKey } from "./converse.js";
@@ -1109,7 +1110,7 @@ export function createDecisionServer(options) {
         // A project link is a read context, not a session-changing operation.
         // Prove it against both admission and the known project catalog before
         // collection queries; unknown/foreign paths reveal no work.
-        if ((route.id === 'work' || route.id === 'system') && url.searchParams.has('project')) {
+        if ((route.id === 'tasks' || route.id === 'work' || route.id === 'system') && url.searchParams.has('project')) {
             const wanted = url.searchParams.get('project') ?? '';
             if (url.searchParams.getAll('project').length !== 1 || !visible(wanted) ||
                 ![...managedRepos(), ...store.listProjects().map(one => one.path)].includes(wanted)) {
@@ -1128,7 +1129,9 @@ export function createDecisionServer(options) {
             project = wanted;
         }
         // All projects, asked for by name on Tasks (its project filter): the rolled-up list, admission-bound as ever.
-        if (route.id === 'work' && url.searchParams.get('all') === '1' && !url.searchParams.has('project') && url.searchParams.getAll('all').length === 1)
+        // Tasks (P1.4) says every project as scope=all; an old link's all=1 still reads so.
+        if (route.id === 'tasks' && !url.searchParams.has('project') && ((url.searchParams.get('scope') === 'all' && url.searchParams.getAll('scope').length === 1)
+            || (url.searchParams.get('all') === '1' && url.searchParams.getAll('all').length === 1)))
             project = null;
         // Every page's Tasks count covers this one project view, whatever project the page itself shows.
         const facts = requestContext.getStore();
@@ -1145,7 +1148,7 @@ export function createDecisionServer(options) {
             const namedProject = url.searchParams.get("project");
             if (url.searchParams.getAll("result").length !== 1 || url.searchParams.getAll("run").length > 1 || url.searchParams.getAll("project").length > 1 ||
                 (namedProject !== null && (ref === null || !visible(ref.repo) || namedProject !== ref.repo))) {
-                return refuse(response, who, 404, "No such result in your projects.", "/work");
+                return refuse(response, who, 404, "No such result in your projects.", "/tasks");
             }
             if (who.via === "cookie" && ref !== null && visible(ref.repo))
                 project = ref.repo;
@@ -1171,7 +1174,7 @@ export function createDecisionServer(options) {
         const needsProject = who.via === "cookie" && project === null && !unscopedMode &&
             route.needsProject &&
             !(route.id === "review" && url.searchParams.has("result")) &&
-            !(route.id === "board" && url.searchParams.get("scope") === "all");
+            !(route.id === "board" && url.searchParams.get("scope") === "all") && !(route.id === "tasks" && url.searchParams.get("scope") === "all");
         if (needsProject)
             return redirect(response, `/projects?return=${encodeURIComponent(safeReturn(url.pathname + url.search))}`);
         return dispatchConsole(route, { url, who, request, response, route, now, project, chosenProject, posted: new URLSearchParams() });
@@ -1201,9 +1204,10 @@ export function createDecisionServer(options) {
         const here = hostname();
         const registered = store.listRunners().filter(one => one.retiredAt === null);
         const workers = registered.filter(one => runnerAlive(one, now));
-        if (workers.some(one => one.host !== here && store.providerReadiness(one.name).some(seen => seen.state === "ready")))
+        // This machine under any of its own names (machine-identity.ts): a hostname that moved with the network is still here.
+        if (workers.some(one => !sameMachineHost(one.host, here) && store.providerReadiness(one.name).some(seen => seen.state === "ready")))
             return true;
-        return options.localRunner !== undefined || registered.length === 0 || workers.some(one => one.host === here) ? localAgentSignedIn() : false;
+        return options.localRunner !== undefined || registered.length === 0 || workers.some(one => sameMachineHost(one.host, here)) ? localAgentSignedIn() : false;
     }
     let localSignIn = null;
     let localSignInChecking = null;
@@ -1495,15 +1499,15 @@ export function createDecisionServer(options) {
     function paletteIndexTag(project) {
         const admitted = project === null ? admissionList() : null;
         const entries = [
-            { label: "tasks", href: "/work" },
-            { label: "needs you", href: "/work?view=needs-you" },
-            { label: "inbox", href: "/" },
-            { label: "board", href: "/board?scope=all" },
+            { label: "tasks", href: "/tasks" },
+            { label: "needs you", href: "/tasks?view=needs-you" },
+            { label: "home", href: "/" },
+            { label: "board", href: "/tasks?view=board&scope=all" },
             { label: "queue", href: QUEUE_VIEW },
-            { label: "workbench", href: "/workbench" },
+            { label: "every project", href: "/tasks?scope=all" },
             { label: "flows", href: "/flows" },
-            { label: "done", href: "/done" },
-            { label: "review cockpit", href: "/review" },
+            { label: "finished", href: "/tasks?view=done" },
+            { label: "ready for review", href: "/tasks?view=ready" },
             { label: "fleet", href: "/fleet" },
             { label: "activity", href: "/activity" },
             { label: "action ledger", href: "/ledger" },
@@ -1518,8 +1522,8 @@ export function createDecisionServer(options) {
             entries.push({ label: `${one.id} — ${one.title}`, href: `/t/${encodeURIComponent(one.id)}` });
         }
         const saturated = open.length > 200;
-        const safeEntries = restricted() ? entries.filter(one => ["/work", "/work?view=needs-you", "/", "/board", "/flows", "/done", "/review", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
-        return jsonScript(saturated ? [...safeEntries, { label: "… more in Tasks", href: "/work" }] : safeEntries, { id: "palette-index" });
+        const safeEntries = restricted() ? entries.filter(one => ["/tasks", "/tasks?view=needs-you", "/", "/tasks?view=board", "/flows", "/tasks?view=done", "/tasks?view=ready", "/runs", "/projects", "/ledger"].includes(one.href) || one.href.startsWith("/t/")) : entries;
+        return jsonScript(saturated ? [...safeEntries, { label: "… more in Tasks", href: "/tasks" }] : safeEntries, { id: "palette-index" });
     }
     /**
      * The palette cache (arc 4, finding 6), and its honest contract: a
@@ -1710,7 +1714,7 @@ export function createDecisionServer(options) {
                 needsYou: { count: needsYou, saturated: s.chrome.inboxSaturated === true, scope: tasksProject ?? null,
                     label: s.chrome.inboxLabel ?? `${needsYou} ${needsYou === 1 ? 'needs' : 'need'} you`,
                     // Every project, said by name (all=1), so a session's own open project never narrows the list the count opens.
-                    href: tasksProject === null ? '/work?all=1&view=needs-you' : `/work?project=${encodeURIComponent(tasksProject)}&view=needs-you` },
+                    href: tasksProject === null ? '/tasks?scope=all&view=needs-you' : `/tasks?project=${encodeURIComponent(tasksProject)}&view=needs-you` },
                 chats,
                 // The same count per project (the rail's project rows), read from the same work index totals.
                 ...(() => { if (sensitive)
@@ -1753,7 +1757,9 @@ export function createDecisionServer(options) {
             // A page with its own view keeps its script; the chat page runs the result script.
             const functional = conversation === null || extras.view ? (s.functional?.script ?? '') : RESULT_REVIEW_SCRIPT;
             const document = shell(s.title, s.body, { chrome: s.chrome, sensitive });
-            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT + keyFill), nonce, true);
+            // The keys and their list (keymap.ts) work here as on every chromed page; the list sits beside the app React owns.
+            // A sensitive page keeps to its own script.
+            return page(response, status, browserWorkspaceDocument(document, workspace, nonce, functional + MOBILE_VIEWPORT_SCRIPT + keyFill + (sensitive ? '' : chromeScript()), sensitive ? html `` : KBD_HELP), nonce, true);
         }
         // A one-time secret on screen (a token, an invite link, a pairing code): the
         // page carries no script of any kind, so it leaves the workspace for a
@@ -2485,7 +2491,7 @@ export function createDecisionServer(options) {
 export { PAGE_CSS, pinnedTheme, SENSITIVE_INPUT } from "./server/chrome.js";
 export { redactedPath, SHUTDOWN_WAIT_MS } from "./server/http.js";
 export { TASK_COMPOSER_MODES } from "./server/render-chat.js";
-export { inboxFingerprints, parseInboxTab, queueScript } from "./server/render-pages.js";
+export { queueScript } from "./server/render-pages.js";
 export { ssoStepUps, wrongHostPage } from "./server/render-people.js";
 export { diffFileAnchor, editorFileHref, needActionOf, orderChangedFiles, plainConclusionOf, rankReviewQueue, reviewFilePriority, reviewPriorityOf, runFactsFragment, withinSignedTouches } from "./server/render-results.js";
 export { decisionAnswerScript, earlierVersionsWords, revisionLineageWords } from "./server/render-tasks.js";

package/dist/server/chat.js

@@ -1,6 +1,6 @@
-import { freshFacts, freshlyApprovable, freshnessFor, spendingOnlyOnSuccess, withFreshness } from "../scope.js";
+import { freshFacts, freshnessFor, spendingOnlyOnSuccess, withFreshness } from "../scope.js";
+import { approvalPasswordField } from "../approval-password.js";
 import { CHAT_ACTION_LOCAL_ACTS, localOwnerRefusal } from "../local-owner.js";
-import { localApprovalEligible } from "../scope.js";
 import { handlersOf } from './handler-registry.js';
 import { DEPRECATED_PAGE } from "../deprecations.js";
 /** chat handlers, moved without changing their route bodies. */
@@ -170,7 +170,7 @@ export function createChatHandlers(runtime) {
         const requestedRevision = url.searchParams.get("revision");
         if (requestedRevision !== null) {
             if (focusTask === null || !focusTask.family.versions.some(one => one.id === requestedRevision) || url.searchParams.has("result")) {
-                return refuse(response, who, 404, "That revision is not available for this task.", "/work");
+                return refuse(response, who, 404, "That revision is not available for this task.", "/tasks");
             }
             if (requestedRevision !== focusTask.executionId)
                 return redirect(response, `${taskHref(focusTask.id)}?version=${encodeURIComponent(requestedRevision)}`);
@@ -402,20 +402,22 @@ export function createChatHandlers(runtime) {
             const evidenceLink = action.operation === 'result_accept' ? html `<a href="/r/${Number(action.request['run'])}">Inspect this result</a>` : '';
             // Cockpit B2: approving standard work may stand on a password remembered on this session, exactly as on the task
             // page (the same rule approve() applies when the form comes back); the field then may be left empty.
+            // The one password rule every approve form reads (approval-password.ts).
             const freshSince = (() => {
                 const task = typeof action.request['task'] === 'string' ? action.request['task'] : null;
                 if (action.operation !== 'scope_approve' || task === null)
                     return null;
                 const scope = store.getScope(task), fresh = withFreshness('approve-standard', () => freshnessFor(who.name, Date.now(), true));
-                if (scope === null || fresh === null)
+                if (scope === null)
                     return null;
-                const gate = store.approvalGate(task, who.name, 'person');
-                return freshlyApprovable(store, task, scope, gate.verdict === 'seal' && !gate.protectedWork) ? new Date(fresh.at) : null;
+                const field = approvalPasswordField(store, { name: who.name, taskId: task, scope, passwordless: false, localOwner: false, freshAt: fresh?.at ?? null, returnTo: '/chat' });
+                return field.field === 'remembered' ? new Date(field.since) : null;
             })();
             // Easy-start C5: a laptop's local owner confirms its own acts without a password (an approval only when it is
             // eligible: localApprovalEligible, the rule the seal applies again); anything else says how to get a password.
             const reviewTask = typeof action.request['task'] === 'string' ? action.request['task'] : null;
-            const localOk = who.authority === 'local-owner' && CHAT_ACTION_LOCAL_ACTS[action.operation] !== null && (action.operation !== 'scope_approve' || (reviewTask !== null && localApprovalEligible(store, who.name, reviewTask).ok));
+            const localScope = reviewTask === null ? null : store.getScope(reviewTask);
+            const localOk = who.authority === 'local-owner' && CHAT_ACTION_LOCAL_ACTS[action.operation] !== null && (action.operation !== 'scope_approve' || (reviewTask !== null && localScope !== null && approvalPasswordField(store, { name: who.name, taskId: reviewTask, scope: localScope, passwordless: false, localOwner: true, freshAt: null, returnTo: '/chat' }).field === 'none'));
             const localWords = who.authority === 'local-owner' && !localOk ? localOwnerRefusal(store.accountOf(who.name)?.passwordSet === true, '/chat') : null;
             const passwordField = !CHAT_ACTIONS[action.operation].password || localOk ? '' : localWords !== null ? html `<p class="approval-password-note">${localWords.message} <a href="${localWords.href}">${localWords.action}</a></p>` : reauth(freshSince === null
                 ? html `<label>Your password<input type="password" name="token" autocomplete="current-password" required></label>`
@@ -1471,11 +1473,11 @@ export function createChatHandlers(runtime) {
         const all = view("all"), needs = view("needs-you"), done = view("completed");
         const weekAgo = new Date(now.getTime() - 7 * 86_400_000).toISOString();
         const counts = [
-            { key: "working", label: "Working now", value: agents.length, href: "/work?view=running" },
+            { key: "working", label: "Working now", value: agents.length, href: "/tasks?view=running" },
             // Each by its shared headline, as the Tasks list words it: a result whose checks failed waits on you, it isn't ready.
-            { key: "waiting", label: "Waiting on you", value: needs.items.filter(one => one.status.label !== "Ready for review").length, href: "/work?view=needs-you" },
-            { key: "ready", label: "Ready to review", value: needs.items.filter(one => one.status.label === "Ready for review").length, href: "/work?view=needs-you" },
-            { key: "done", label: "Done this week", value: done.items.filter(one => (one.completion?.at ?? one.updatedAt) >= weekAgo).length, href: "/work?view=completed" },
+            { key: "waiting", label: "Waiting on you", value: needs.items.filter(one => one.status.label !== "Ready for review").length, href: "/tasks?view=needs-you" },
+            { key: "ready", label: "Ready to review", value: needs.items.filter(one => one.status.label === "Ready for review").length, href: "/tasks?view=needs-you" },
+            { key: "done", label: "Done this week", value: done.items.filter(one => (one.completion?.at ?? one.updatedAt) >= weekAgo).length, href: "/tasks?view=completed" },
         ];
         const tabOf = (one) => one.assignmentState === "ready-to-check" ? one.status.label === "Ready for review" ? "ready" : "needs-you"
             : one.assignmentState === "needs-decision" ? "needs-you" : one.assignmentState === "working" || one.assignmentState === "checking" ? "running" : "finished";
@@ -1494,7 +1496,7 @@ export function createChatHandlers(runtime) {
         const lead = activity === null ? null : { name: activity.name, doing: activity.doing, at: activity.at,
             href: leadTask == null || !admitted(leadTask.repo) ? null : taskHref(familyOf(activity.taskId)?.root.id ?? activity.taskId) };
         return {
-            agents, counts, catchUp, allHref: "/work", ...(lead === null ? {} : { lead }),
+            agents, counts, catchUp, allHref: "/tasks", ...(lead === null ? {} : { lead }),
             planUse: (windows?.tiles ?? []).map(one => ({ name: one.name, window: one.window, percent: one.percent, detail: one.detail, tone: one.tone })),
         };
     }

package/dist/server/chrome.d.ts

@@ -264,7 +264,7 @@ export declare const TO_FRONT_ICON: Html;
  * wear an icon each; the foot's list stays text, the way Linear's does. */
 export declare const strokeIcon: (paths: Html | string) => Html;
 /** Where the queue lives now: the board, flipped to dispatch order. */
-export declare const QUEUE_VIEW = "/board?view=order";
+export declare const QUEUE_VIEW = "/tasks?view=order";
 export declare const FOLDER_PATHS: Html;
 export declare const CHAT_PATHS: Html;
 export declare const WORK_PATHS: Html;