5523e2d · 538ad4f · 41cd73b · 51e735a · 7b68838 · 4b0ed5b
@@ -40,6 +40,8 @@
when). The terminal's palette has the same as "Crew hand-overs", a read-only
list of the same rows (repo#number, title, reasons; it does not open the
issue — use the link on the page). Both are a forge admin's only.
A hold can be set "until green" (a checkbox on the hold form, `until: "green"` on the hold API and the MCP `hold` tool): when a check passes on the pull's current head the forge releases it and the pull's timeline says `hold released: green on <short oid>`. A plain hold is never released by a check.
A hand-over card on `/asks` (an agent's pull the reviewer stopped on after three rounds) has "Give back to the crew": one press assigns the pull, and the open issue it closes if a person holds it, to the agent that opened it, writes "Given back to the crew by @who", and the card leaves; the next tick starts its run. It is for a writer of the repository, and a pull a person opened, or by an agent gone from the crew, gets no button. In the terminal, `b` on a handed-over row of the On you pane does the same (`src/actions/give_back.ts`). The repository's planner can do it by comment: one that starts "Planner, one more round" on a handed-over crew pull emits the assignment to its builder, which starts the run (the pull is already the builder's, so nothing changes hands). It is the planner's alone; a reader's, the reviewer's or any other agent's does nothing. It is an agent's word, not a director's, so it does not end the hand-over: the card stays on `/asks` and the pull still counts as handed over during the round.
Home opens with "Since you were here · 2 days": the pulls that landed in public repositories since you last loaded `/` (1 hour to 7 days back, a day on a first visit); the terminal's home shows the same lines, and MCP `feed` answers them as `digest`. See `docs/features/since-you-were-here.md`.
@@ -80,7 +80,7 @@
for a tunnel and a forge that sleeps.
| `forges` | an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity |  |
| `front_page` | `{ pinned?, hidden?, weights?, dryRun? }`: the front page as a stranger sees it, ranked, with numbers; a site admin sets what is pinned (first public one featured), hidden, and what counts (weights of forks, ships, use, fresh, 0 to 10) | yes |
| `health` | how this forge is: the version and commit it runs, draining or not, the rollout and its incidents |  |
| `hold` | `{ app, pull | path, why?, release?, dryRun? }`: hold a pull so no rule reviews or lands it, or let it go; a person who can write, never an agent; or with `path` (no `pull`) hold new work on a file so the picker starts no build whose issue names it, or list the holds and who set each; an admin of the app; plans unless `dryRun: false` | yes |
| `hold` | `{ app, pull | path, why?, until?, release?, dryRun? }`: hold a pull so no rule reviews or lands it, or let it go; a person who can write, never an agent; or with `path` (no `pull`) hold new work on a file so the picker starts no build whose issue names it, or list the holds and who set each; an admin of the app; plans unless `dryRun: false` | yes |
| `hooks` | `{ repo, action, url, secret, kinds, id }`: `list`, `add` (`secret`, 16–200 characters, is required) or `remove` the repository's webhooks, as `…/hooks`; an admin-scope token on a repository you administer, and a secret is never shown | yes |
| `invites` | `{ action, id? }`: `list` the outstanding invites (state and expiry, never a link) or `revoke` one by `id`; a person admin with an admin token, stricter than the API's list, which an `ro` token may read | yes |
| `issue` | `{ repo, number }`: one issue's title, state, closeReason, body, labels, assignee, comments (author, authorIsAgent, body, at) and blockedBy/blocks, as `GET …/issues/:number`; a sealed one you cannot see is not found; draws the `ui://forge/issue` card: title, state, assignee, labels and what it waits for, never the body or comments |  |
@@ -15,11 +15,14 @@
import type { App } from "../app.ts";
import {
  cleanWhy,
  getHold,
  releaseGreenHold,
  releaseHold,
  setHold,
  type Hold,
} from "../core/holds.ts";
import type { Pull } from "../core/pulls.ts";
import { getIssueById } from "../core/issues.ts";
import { getPull, type Pull } from "../core/pulls.ts";
import type { Run } from "../core/runs.ts";
import { canRead, canWrite, type Repo } from "../core/repos.ts";
import type { User } from "../core/users.ts";
import { err, ok, type Result } from "../kernel/result.ts";
@@ -54,6 +57,7 @@
export function holdPull(
  pull: Pull,
  why: string,
  dry = false,
  until?: "green",
): Result<Hold, HoldError> {
  const holder = requireHolder(app, actor, repo, pull);
  if (!holder.ok) return holder;
@@ -67,8 +71,9 @@
export function holdPull(
      heldByName: holder.value.username,
      why: reason.value,
      heldAt: getHold(app.db, pull.id)?.heldAt ?? new Date().toISOString(),
      ...(until ? { until } : {}),
    });
  const hold = setHold(app.db, pull.id, holder.value.id, reason.value);
  const hold = setHold(app.db, pull.id, holder.value.id, reason.value, until);
  app.bus.append({
    kind: "pull.held",
    repoId: repo.id,
@@ -102,3 +107,29 @@
export function releasePull(
    });
  return ok(released);
}
/**
 * A check finished green: a hold set "until green" on that pull is let go
 * when the check was of the pull's current head. The pull's timeline gets
 * the one line. A plain hold, a red check and a check of an older head
 * change nothing.
 */
export function releaseOnGreen(app: App, run: Run): boolean {
      
        sentinelcrew
        18d ago
        
      
      This only runs when a check finishes. A hold set until green on a head that already passed stands until the next push's check, while the card says "Releases on green." Tracked in #6529.
    
  if (run.kind !== "check" || run.state !== "ok" || run.issueId === null)
    return false;
  const issue = getIssueById(app.db, run.issueId);
  if (!issue || issue.kind !== "pull") return false;
  const pull = getPull(app.db, issue.repoId, issue.number);
  if (!pull || pull.state !== "open" || pull.headOid !== run.commitOid)
    return false;
  if (!releaseGreenHold(app.db, pull.id)) return false;
  app.bus.append({
    kind: "pull.released",
    repoId: pull.repoId,
    payload: {
      number: pull.number,
      note: `hold released: green on ${run.commitOid.slice(0, 7)}`,
      
        sentinelcrew
        18d ago
        
      
      High: this note lives only in the event payload. thread.ts EVENT_LOOK has no pull.released, so the pull timeline never shows it. With no actorId, the activity feed reads "someone released a pull request". Render it on the timeline as the forge's line, and test that it appears on the pull page.
    
    },
  });
  return true;
}
@@ -16,6 +16,7 @@
import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import type { App } from "../app.ts";
import { releaseOnGreen } from "../actions/holds.ts";
import { announceRun } from "../actions/runs.ts";
import { announceShard } from "./shard_event.ts";
import type { ForgeEvent } from "../core/events.ts";
@@ -669,6 +670,7 @@
export function startChecks(app: App, options: ChecksOptions): ChecksHandle {
      });
      write(outcome.ok ? `passed in ${seconds}s` : `failed: ${outcome.error}`);
      if (done) announceRun(app, done);
      if (done && outcome.ok) releaseOnGreen(app, done);
      if (!outcome.ok && run.issueId === null && run.env === repo.defaultBranch)
        proposeRevert(app, repo.id).catch((error) =>
          log.error("revert proposal failed", { error: String(error) }),
@@ -4,13 +4,14 @@
export const route: Route = {
  method: "put",
  path: `${REPO}/pulls/{number}/hold`,
  summary:
    "Hold an open pull with one line that says why, so no rule reviews or lands it until it is released; a person who writes the repository holds, never an agent (rw scope); answers `{ held: true, hold }`",
    "Hold an open pull (with until green, the forge releases it when a check passes on the pull's head) with one line that says why, so no rule reviews or lands it until it is released; a person who writes the repository holds, never an agent (rw scope); answers `{ held: true, hold }`",
  auth: true,
  body: { why: "string" },
  body: { why: "string", until: "string" },
  refusals: {
    forbidden: "you are an agent, or you cannot write the repository (403)",
    not_open: "the pull is closed or merged (409)",
    empty_why: "`why` is empty (422)",
    bad_until: "`until` is given and is not `green` (422)",
    why_too_long: "`why` is longer than 200 characters (422)",
  },
};
@@ -26,6 +26,8 @@
export interface Hold {
  /** Why, in one line. */
  readonly why: string;
  readonly heldAt: string;
  /** "green": the forge lets it go when a check passes on the pull's head. */
  readonly until?: "green";
}
interface Row {
@@ -34,6 +36,7 @@
interface Row {
  username: string;
  why: string;
  held_at: string;
  until_green: number;
}
const fromRow = (row: Row): Hold => ({
@@ -42,10 +45,11 @@
const fromRow = (row: Row): Hold => ({
  heldByName: row.username,
  why: row.why,
  heldAt: row.held_at,
  ...(row.until_green === 1 ? { until: "green" as const } : {}),
});
const STANDING = `SELECT pull_hold.issue_id, pull_hold.held_by, user.username,
    pull_hold.why, pull_hold.held_at
    pull_hold.why, pull_hold.held_at, pull_hold.until_green
  FROM pull_hold JOIN user ON user.id = pull_hold.held_by
  WHERE pull_hold.released_at IS NULL`;
@@ -94,17 +98,19 @@
export function setHold(
  pullId: string,
  by: string,
  why: string,
  until?: "green",
): Hold {
  const green = until === "green" ? 1 : 0;
  const changed = db
    .query(
      `UPDATE pull_hold SET held_by = ?2, why = ?3
      `UPDATE pull_hold SET held_by = ?2, why = ?3, until_green = ?4
        WHERE issue_id = ?1 AND released_at IS NULL`,
    )
    .run(pullId, by, why).changes;
    .run(pullId, by, why, green).changes;
  if (changed === 0)
    db.query(
      "INSERT INTO pull_hold (id, issue_id, held_by, why) VALUES (?1, ?2, ?3, ?4)",
    ).run(id(), pullId, by, why);
      "INSERT INTO pull_hold (id, issue_id, held_by, why, until_green) VALUES (?1, ?2, ?3, ?4, ?5)",
    ).run(id(), pullId, by, why, green);
  return getHold(db, pullId)!;
}
@@ -121,6 +127,21 @@
export function releaseHold(db: Database, pullId: string, by: string): boolean {
  );
}
/**
 * The forge lets go of a hold set "until green". False when none stands or
 * the hold is a plain one: a green check never lifts those.
 */
export function releaseGreenHold(db: Database, pullId: string): boolean {
  return (
    db
      .query(
        `UPDATE pull_hold SET released_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
          WHERE issue_id = ?1 AND released_at IS NULL AND until_green = 1`,
      )
      .run(pullId).changes > 0
  );
}
/** When a hold on this pull was last released, if one ever was. */
export function lastRelease(db: Database, pullId: string): string | undefined {
  return (
@@ -121,5 +121,6 @@
  "20261019130000-run-model-prompt": "ce2e94f439649fc042c0a951f1af4a740b91f674dc94521e865ec517f68994f5",
      
        sentinelcrew
        18d ago
        outdated
      
      Low: these 26 pins are for migrations this pull doesn't touch, and they will conflict with any parallel pull that adds a migration. Keep only the hold-until-green pin.
    
  "20261019140000-route-timing": "0fd7cfa4e0a50c4b2b36162601f9ddc3318e7fa445559732364b2b52a06de011",
  "20261019150000-page-vitals": "63fe647d95733a5194a99ae955181f2456d5c2e8c9c38d37bbf1bad395b72bdf",
  "20261020120000-app-vitals-five": "6c75f4137e5592bf728ffe05d42d33bc158c9dabab3c666c58bc7b6dceb57576"
  "20261020120000-app-vitals-five": "6c75f4137e5592bf728ffe05d42d33bc158c9dabab3c666c58bc7b6dceb57576",
  "20261026190000-hold-until-green": "2be50f3a7ee590b05ae1048f3adbe7040452501a9c684d981e2efbaf88256c58"
}
@@ -0,0 +1,6 @@
// A hold set "until green" (#6495, core/holds.ts): the forge lets it go when
// a check passes on the pull's head. 0 is a plain hold, which is every hold
// there is today. Additive.
export default `
  ALTER TABLE pull_hold ADD COLUMN until_green INTEGER NOT NULL DEFAULT 0;
  `;
@@ -89,7 +89,8 @@
export function eventActor(
  if (actorName !== undefined) return actorName;
  return event.kind.startsWith("run.") ||
    event.kind.startsWith("app.") ||
    event.kind.startsWith("prompt.")
    event.kind.startsWith("prompt.") ||
    (event.kind === "pull.released" && event.actorId === null)
    ? "the forge"
    : "someone";
}
@@ -1223,6 +1223,7 @@
const holdJson = (hold: Hold) => ({
  by: hold.heldByName,
  why: hold.why,
  at: hold.heldAt,
  ...(hold.until ? { until: hold.until } : {}),
});
function loadPull(ctx: Ctx): Found<{ pull: Pull }> {
@@ -4290,12 +4291,16 @@
export function apiRoutes(router: Router<Handler>): void {
      const found = loadPull(ctx);
      
        sentinelcrew
        18d ago
        outdated
      
      Medium: only this JSON door takes until. The page's holdSubmit (studio/actions.ts) and the MCP hold tool call holdPull without it, and holdCard never shows that a hold is until-green. Wire both doors through and show it on the card.
    
      if ("error" in found) return found.error;
      const input = await body(ctx.request);
      if (input.until !== undefined && input.until !== "green")
        return respondAccess("bad_until", 422);
      const held = holdPull(
        ctx.app,
        ctx.auth.user,
        found.repo,
        found.pull,
        str(input.why),
        false,
        input.until === "green" ? "green" : undefined,
      );
      if (!held.ok)
        return respondAccess(held.error, held.error === "not_open" ? 409 : 422);
@@ -47,7 +47,7 @@
function fileHold(ctx: Ctx, user: User, repo: Repo, args: Args): Answer {
export const tool: Tool = {
  name: "hold",
  doc: "`{ app, pull | path, why?, release?, dryRun? }`: hold a pull so no rule reviews or lands it, or let it go; a person who can write, never an agent; or with `path` (no `pull`) hold new work on a file so the picker starts no build whose issue names it, or list the holds and who set each; an admin of the app; plans unless `dryRun: false`",
  doc: "`{ app, pull | path, why?, until?, release?, dryRun? }`: hold a pull so no rule reviews or lands it, or let it go; a person who can write, never an agent; or with `path` (no `pull`) hold new work on a file so the picker starts no build whose issue names it, or list the holds and who set each; an admin of the app; plans unless `dryRun: false`",
  description:
    "Hold a pull (`why`) or `release` it; or `path`: hold new work on a file. Neither: list file holds.",
  inputSchema: {
@@ -60,6 +60,11 @@
export const tool: Tool = {
        type: "string",
        description: "Why, one line.",
      },
      until: {
        type: "string",
        enum: ["green"],
        description: "green: released when a check passes.",
      },
      release: {
        type: "boolean",
      },
      
        sentinelcrew
        18d ago
        outdated
      
      An until other than "green" is silently dropped, so the caller gets a plain hold that never releases. The API answers 422 bad_until for the same input. MCP does not enforce enum, so refuse it here before calling holdPull, and add a test.
    
@@ -100,7 +105,17 @@
export const tool: Tool = {
        dryRun: dry,
      });
    }
    const held = holdPull(ctx.app, user, repo, pull, str(args["why"]), dry);
    if (args["until"] !== undefined && args["until"] !== "green")
      return bad("bad_until", 'until, when given, is "green"');
    const held = holdPull(
      ctx.app,
      user,
      repo,
      pull,
      str(args["why"]),
      dry,
      args["until"] === "green" ? "green" : undefined,
    );
    if (!held.ok)
      return bad(
        held.error,
@@ -168,6 +168,11 @@
const EVENT_LOOK: Record<string, { icon: IconName; tone: Tone; verb: string }> =
      verb: "let this head run",
    },
    "pull.edited": { icon: "pencil", tone: "default", verb: "edited this" },
    "pull.released": {
      icon: "check",
      tone: "success",
      verb: "released the hold",
    },
  };
/**
@@ -199,12 +204,22 @@
function stateEvents(ctx: Ctx, repo: Repo, issue: Issue): Entry[] {
    const look = EVENT_LOOK[event.kind]!;
    const actor =
      event.actorId !== null ? actors.get(event.actorId) : undefined;
    // The forge's own release of an until-green hold carries its line and no actor.
    const note =
      event.kind === "pull.released" && typeof event.payload.note === "string"
        ? event.payload.note
        : undefined;
    entries.push({
      at: event.createdAt,
      node: tlEvent({
        icon: look.icon,
        tone: look.tone,
        body: html`${actor
        body:
          note !== undefined && !actor
            ? html`<span>the forge</span> <span>${note}</span> ${time(
                event.createdAt,
              )}`
            : html`${actor
            ? userLink(actor.username, { mark: markOf(actor) })
            : html`<span>someone</span>`} <span>${look.verb}</span> ${time(
            event.createdAt,
@@ -346,6 +346,8 @@
export async function holdSubmit(ctx: Ctx): Promise<Response> {
    repo,
    found.pull,
    field(form, "why"),
    false,
    field(form, "until") === "green" ? "green" : undefined,
  );
  if (!held.ok && (held.error === "not_found" || held.error === "forbidden"))
    return notFoundPage(ctx);
@@ -41,6 +41,10 @@
export function holdCard(
          })}
          holds this, ${time(hold.heldAt)}: ${hold.why}
        </p>
        ${when(
          hold.until === "green",
          () => html`<p class="muted small">Releases on green.</p>`,
        )}
        <p class="muted small">
          No rule sends it to review or lands it until it is released. A person
          can still ship it.
@@ -71,6 +75,10 @@
export function holdCard(
        placeholder="Why, in one line"
        aria-label="Why it is held, in one line"
      />
      <label class="check"
      
        sentinelcrew
        18d ago
        outdated
      
      Hand-rolled checkbox. The design system's checkbox component is .check (§5 components). Use <label class="check"><input type="checkbox" name="until" value="green" /> <span>until green</span></label>, as settings.ts does.
    
        ><input type="checkbox" name="until" value="green" />
        <span>until green</span></label
      >
      ${btn("Hold", { size: "sm" })}
    </form>
    <p class="muted small">
@@ -9,7 +9,7 @@
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { holdPull, releasePull } from "../src/actions/holds.ts";
import { holdPull, releaseOnGreen, releasePull } from "../src/actions/holds.ts";
import { openIssue } from "../src/actions/issues.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
@@ -781,6 +781,56 @@
describe("a hold is set, shown and lifted", () => {
    // She said "not yet"; dana is still asked.
    expect([how(f.alice), how(dana)]).toEqual([["acted"], [null]]);
  });
  test("until green: the form sets it, the card says it, and the release shows on the pull page as the forge's line", async () => {
    const cookie = await signIn("alice");
    const mine = await f.pullOn("until-green-page");
    const change = `/alice/garden/pulls/${mine.number}`;
    expect(await page(change, cookie)).toContain('name="until"');
    const sent = await form(`${change}/hold`, cookie, {
      why: "red alone",
      until: "green",
    });
    expect(sent.status).toBe(303);
    expect(getHold(f.app.db, mine.id)?.until).toBe("green");
    expect(await page(change, cookie)).toContain("Releases on green.");
    // The MCP door sets it too.
    releaseHold(f.app.db, mine.id, f.alice.id);
    const planned = await mcp("hold", {
      app: "alice/garden",
      pull: mine.number,
      why: "red alone",
      until: "green",
      dryRun: false,
    });
    expect(planned.error).toBeUndefined();
    expect(getHold(f.app.db, mine.id)?.until).toBe("green");
    releaseHold(f.app.db, mine.id, f.alice.id);
    const typo = await mcp("hold", {
      app: "alice/garden",
      pull: mine.number,
      why: "red alone",
      until: "red",
      dryRun: false,
    });
    expect(typo.error).toContain("bad_until");
    expect(getHold(f.app.db, mine.id)).toBeUndefined();
    holdPull(f.app, f.alice, f.repo, mine, "red alone", false, "green");
    const check = createRun(f.app.db, {
      repoId: f.repo.id,
      kind: "check",
      issueId: mine.id,
      env: `pull-${mine.number}`,
      commitOid: mine.headOid,
      reason: "pull",
    });
    claimRun(f.app.db, check.id);
    const done = finishRun(f.app.db, check.id, { state: "ok", summary: "ok" })!;
    expect(releaseOnGreen(f.app, done)).toBe(true);
    const text = await page(change, cookie);
    expect(text).toContain(`hold released: green on ${mine.headOid.slice(0, 7)}`);
    expect(text).toContain("the forge");
  });
});
describe("a hold, as it is kept", () => {
@@ -851,3 +901,77 @@
describe("a hold, as it is kept", () => {
    expect(lastRelease(app.db, pull.id)).toBe(released);
  });
});
describe("a hold set until green", () => {
  let f: Awaited<ReturnType<typeof forge>>;
  let app: App;
  beforeAll(async () => {
    f = await forge("forge-holds-green-", "private");
    app = f.app;
  }, 30_000);
  afterAll(() => f.close());
  /** A finished check on the pull's head, as the verdict leaves it. */
  const verdict = (pull: Pull, state: "ok" | "failed", oid = pull.headOid) => {
    const check = createRun(app.db, {
      repoId: f.repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: oid,
      reason: "pull",
    });
    claimRun(app.db, check.id);
    return finishRun(app.db, check.id, { state, summary: state })!;
  };
  const notes = (pull: Pull) =>
    (
      app.db
        .query("SELECT payload FROM event WHERE kind = 'pull.released'")
        .all() as { payload: string }[]
    )
      .map((r) => JSON.parse(r.payload))
      .filter((p) => p.number === pull.number)
      .map((p) => p.note);
  test("a green check on the head releases it, with one line saying so", async () => {
    const pull = await f.pullOn("green-one");
    const held = setHold(app.db, pull.id, f.alice.id, "red alone", "green");
    expect(held.until).toBe("green");
    expect(releaseOnGreen(app, verdict(pull, "failed"))).toBe(false);
    expect(getHold(app.db, pull.id)).toBeDefined();
    expect(releaseOnGreen(app, verdict(pull, "ok", "0".repeat(40)))).toBe(false);
    expect(getHold(app.db, pull.id)).toBeDefined();
    expect(releaseOnGreen(app, verdict(pull, "ok"))).toBe(true);
    expect(getHold(app.db, pull.id)).toBeUndefined();
    expect(lastRelease(app.db, pull.id)).toBeDefined();
    expect(notes(pull)).toEqual([
      `hold released: green on ${pull.headOid.slice(0, 7)}`,
    ]);
  });
  test("a plain hold stays through a green check", async () => {
    const pull = await f.pullOn("green-two");
    setHold(app.db, pull.id, f.alice.id, "waiting");
    expect(getHold(app.db, pull.id)?.until).toBeUndefined();
    expect(releaseOnGreen(app, verdict(pull, "ok"))).toBe(false);
    expect(getHold(app.db, pull.id)?.why).toBe("waiting");
    expect(notes(pull)).toEqual([]);
  });
  test("holding a held pull again sets whether it waits for green", async () => {
    const pull = await f.pullOn("green-three");
    setHold(app.db, pull.id, f.alice.id, "waiting", "green");
    expect(setHold(app.db, pull.id, f.alice.id, "waiting").until).toBeUndefined();
    expect(releaseOnGreen(app, verdict(pull, "ok"))).toBe(false);
  });
  test("holdPull takes until: green", async () => {
    const pull = await f.pullOn("green-four");
    const held = holdPull(app, f.alice, f.repo, pull, "red alone", false, "green");
    expect(held.ok && held.value.until).toBe("green");
    expect(releaseOnGreen(app, verdict(pull, "ok"))).toBe(true);
  });
});
		@@ -40,6 +40,8 @@ when). The terminal's palette has the same as "Crew hand-overs", a read-only
40	40	list of the same rows (repo#number, title, reasons; it does not open the
41	41	issue — use the link on the page). Both are a forge admin's only.
42	42
	43	A hold can be set "until green" (a checkbox on the hold form, `until: "green"` on the hold API and the MCP `hold` tool): when a check passes on the pull's current head the forge releases it and the pull's timeline says `hold released: green on <short oid>`. A plain hold is never released by a check.
	44
43	45	A hand-over card on `/asks` (an agent's pull the reviewer stopped on after three rounds) has "Give back to the crew": one press assigns the pull, and the open issue it closes if a person holds it, to the agent that opened it, writes "Given back to the crew by @who", and the card leaves; the next tick starts its run. It is for a writer of the repository, and a pull a person opened, or by an agent gone from the crew, gets no button. In the terminal, `b` on a handed-over row of the On you pane does the same (`src/actions/give_back.ts`). The repository's planner can do it by comment: one that starts "Planner, one more round" on a handed-over crew pull emits the assignment to its builder, which starts the run (the pull is already the builder's, so nothing changes hands). It is the planner's alone; a reader's, the reviewer's or any other agent's does nothing. It is an agent's word, not a director's, so it does not end the hand-over: the card stays on `/asks` and the pull still counts as handed over during the round.
44	46
45	47	Home opens with "Since you were here · 2 days": the pulls that landed in public repositories since you last loaded `/` (1 hour to 7 days back, a day on a first visit); the terminal's home shows the same lines, and MCP `feed` answers them as `digest`. See `docs/features/since-you-were-here.md`.
		@@ -80,7 +80,7 @@ for a tunnel and a forge that sleeps.
80	80	\| `forges` \| an admin's list of the forges sent from here: name, address, whom for, apps, claimed or not, last activity \| \|
81	81	\| `front_page` \| `{ pinned?, hidden?, weights?, dryRun? }`: the front page as a stranger sees it, ranked, with numbers; a site admin sets what is pinned (first public one featured), hidden, and what counts (weights of forks, ships, use, fresh, 0 to 10) \| yes \|
82	82	\| `health` \| how this forge is: the version and commit it runs, draining or not, the rollout and its incidents \| \|
83		\| `hold` \| `{ app, pull \| path, why?, release?, dryRun? }`: hold a pull so no rule reviews or lands it, or let it go; a person who can write, never an agent; or with `path` (no `pull`) hold new work on a file so the picker starts no build whose issue names it, or list the holds and who set each; an admin of the app; plans unless `dryRun: false` \| yes \|
	83	\| `hold` \| `{ app, pull \| path, why?, until?, release?, dryRun? }`: hold a pull so no rule reviews or lands it, or let it go; a person who can write, never an agent; or with `path` (no `pull`) hold new work on a file so the picker starts no build whose issue names it, or list the holds and who set each; an admin of the app; plans unless `dryRun: false` \| yes \|
84	84	\| `hooks` \| `{ repo, action, url, secret, kinds, id }`: `list`, `add` (`secret`, 16–200 characters, is required) or `remove` the repository's webhooks, as `…/hooks`; an admin-scope token on a repository you administer, and a secret is never shown \| yes \|
85	85	\| `invites` \| `{ action, id? }`: `list` the outstanding invites (state and expiry, never a link) or `revoke` one by `id`; a person admin with an admin token, stricter than the API's list, which an `ro` token may read \| yes \|
86	86	\| `issue` \| `{ repo, number }`: one issue's title, state, closeReason, body, labels, assignee, comments (author, authorIsAgent, body, at) and blockedBy/blocks, as `GET …/issues/:number`; a sealed one you cannot see is not found; draws the `ui://forge/issue` card: title, state, assignee, labels and what it waits for, never the body or comments \| \|
		@@ -15,11 +15,14 @@ import type { App } from "../app.ts";
15	15	import {
16	16	cleanWhy,
17	17	getHold,
	18	releaseGreenHold,
18	19	releaseHold,
19	20	setHold,
20	21	type Hold,
21	22	} from "../core/holds.ts";
22		import type { Pull } from "../core/pulls.ts";
	23	import { getIssueById } from "../core/issues.ts";
	24	import { getPull, type Pull } from "../core/pulls.ts";
	25	import type { Run } from "../core/runs.ts";
23	26	import { canRead, canWrite, type Repo } from "../core/repos.ts";
24	27	import type { User } from "../core/users.ts";
25	28	import { err, ok, type Result } from "../kernel/result.ts";
		@@ -54,6 +57,7 @@ export function holdPull(
54	57	pull: Pull,
55	58	why: string,
56	59	dry = false,
	60	until?: "green",
57	61	): Result<Hold, HoldError> {
58	62	const holder = requireHolder(app, actor, repo, pull);
59	63	if (!holder.ok) return holder;
		@@ -67,8 +71,9 @@ export function holdPull(
67	71	heldByName: holder.value.username,
68	72	why: reason.value,
69	73	heldAt: getHold(app.db, pull.id)?.heldAt ?? new Date().toISOString(),
	74	...(until ? { until } : {}),
70	75	});
71		const hold = setHold(app.db, pull.id, holder.value.id, reason.value);
	76	const hold = setHold(app.db, pull.id, holder.value.id, reason.value, until);
72	77	app.bus.append({
73	78	kind: "pull.held",
74	79	repoId: repo.id,
		@@ -102,3 +107,29 @@ export function releasePull(
102	107	});
103	108	return ok(released);
104	109	}
	110
	111	/**
	112	* A check finished green: a hold set "until green" on that pull is let go
	113	* when the check was of the pull's current head. The pull's timeline gets
	114	* the one line. A plain hold, a red check and a check of an older head
	115	* change nothing.
	116	*/
	117	export function releaseOnGreen(app: App, run: Run): boolean {
		sentinelcrew 18d ago This only runs when a check finishes. A hold set until green on a head that already passed stands until the next push's check, while the card says "Releases on green." Tracked in #6529.
	118	if (run.kind !== "check" \|\| run.state !== "ok" \|\| run.issueId === null)
	119	return false;
	120	const issue = getIssueById(app.db, run.issueId);
	121	if (!issue \|\| issue.kind !== "pull") return false;
	122	const pull = getPull(app.db, issue.repoId, issue.number);
	123	if (!pull \|\| pull.state !== "open" \|\| pull.headOid !== run.commitOid)
	124	return false;
	125	if (!releaseGreenHold(app.db, pull.id)) return false;
	126	app.bus.append({
	127	kind: "pull.released",
	128	repoId: pull.repoId,
	129	payload: {
	130	number: pull.number,
	131	note: `hold released: green on ${run.commitOid.slice(0, 7)}`,
		sentinelcrew 18d ago High: this note lives only in the event payload. `thread.ts` EVENT_LOOK has no `pull.released`, so the pull timeline never shows it. With no `actorId`, the activity feed reads "someone released a pull request". Render it on the timeline as the forge's line, and test that it appears on the pull page.
	132	},
	133	});
	134	return true;
	135	}
		@@ -16,6 +16,7 @@ import { existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
16	16	import { tmpdir } from "node:os";
17	17	import { join } from "node:path";
18	18	import type { App } from "../app.ts";
	19	import { releaseOnGreen } from "../actions/holds.ts";
19	20	import { announceRun } from "../actions/runs.ts";
20	21	import { announceShard } from "./shard_event.ts";
21	22	import type { ForgeEvent } from "../core/events.ts";
		@@ -669,6 +670,7 @@ export function startChecks(app: App, options: ChecksOptions): ChecksHandle {
669	670	});
670	671	write(outcome.ok ? `passed in ${seconds}s` : `failed: ${outcome.error}`);
671	672	if (done) announceRun(app, done);
	673	if (done && outcome.ok) releaseOnGreen(app, done);
672	674	if (!outcome.ok && run.issueId === null && run.env === repo.defaultBranch)
673	675	proposeRevert(app, repo.id).catch((error) =>
674	676	log.error("revert proposal failed", { error: String(error) }),
		@@ -4,13 +4,14 @@ export const route: Route = {
4	4	method: "put",
5	5	path: `${REPO}/pulls/{number}/hold`,
6	6	summary:
7		"Hold an open pull with one line that says why, so no rule reviews or lands it until it is released; a person who writes the repository holds, never an agent (rw scope); answers `{ held: true, hold }`",
	7	"Hold an open pull (with until green, the forge releases it when a check passes on the pull's head) with one line that says why, so no rule reviews or lands it until it is released; a person who writes the repository holds, never an agent (rw scope); answers `{ held: true, hold }`",
8	8	auth: true,
9		body: { why: "string" },
	9	body: { why: "string", until: "string" },
10	10	refusals: {
11	11	forbidden: "you are an agent, or you cannot write the repository (403)",
12	12	not_open: "the pull is closed or merged (409)",
13	13	empty_why: "`why` is empty (422)",
	14	bad_until: "`until` is given and is not `green` (422)",
14	15	why_too_long: "`why` is longer than 200 characters (422)",
15	16	},
16	17	};
		@@ -26,6 +26,8 @@ export interface Hold {
26	26	/** Why, in one line. */
27	27	readonly why: string;
28	28	readonly heldAt: string;
	29	/** "green": the forge lets it go when a check passes on the pull's head. */
	30	readonly until?: "green";
29	31	}
30	32
31	33	interface Row {
		@@ -34,6 +36,7 @@ interface Row {
34	36	username: string;
35	37	why: string;
36	38	held_at: string;
	39	until_green: number;
37	40	}
38	41
39	42	const fromRow = (row: Row): Hold => ({
		@@ -42,10 +45,11 @@ const fromRow = (row: Row): Hold => ({
42	45	heldByName: row.username,
43	46	why: row.why,
44	47	heldAt: row.held_at,
	48	...(row.until_green === 1 ? { until: "green" as const } : {}),
45	49	});
46	50
47	51	const STANDING = `SELECT pull_hold.issue_id, pull_hold.held_by, user.username,
48		pull_hold.why, pull_hold.held_at
	52	pull_hold.why, pull_hold.held_at, pull_hold.until_green
49	53	FROM pull_hold JOIN user ON user.id = pull_hold.held_by
50	54	WHERE pull_hold.released_at IS NULL`;
51	55
		@@ -94,17 +98,19 @@ export function setHold(
94	98	pullId: string,
95	99	by: string,
96	100	why: string,
	101	until?: "green",
97	102	): Hold {
	103	const green = until === "green" ? 1 : 0;
98	104	const changed = db
99	105	.query(
100		`UPDATE pull_hold SET held_by = ?2, why = ?3
	106	`UPDATE pull_hold SET held_by = ?2, why = ?3, until_green = ?4
101	107	WHERE issue_id = ?1 AND released_at IS NULL`,
102	108	)
103		.run(pullId, by, why).changes;
	109	.run(pullId, by, why, green).changes;
104	110	if (changed === 0)
105	111	db.query(
106		"INSERT INTO pull_hold (id, issue_id, held_by, why) VALUES (?1, ?2, ?3, ?4)",
107		).run(id(), pullId, by, why);
	112	"INSERT INTO pull_hold (id, issue_id, held_by, why, until_green) VALUES (?1, ?2, ?3, ?4, ?5)",
	113	).run(id(), pullId, by, why, green);
108	114	return getHold(db, pullId)!;
109	115	}
110	116
		@@ -121,6 +127,21 @@ export function releaseHold(db: Database, pullId: string, by: string): boolean {
121	127	);
122	128	}
123	129
	130	/**
	131	* The forge lets go of a hold set "until green". False when none stands or
	132	* the hold is a plain one: a green check never lifts those.
	133	*/
	134	export function releaseGreenHold(db: Database, pullId: string): boolean {
	135	return (
	136	db
	137	.query(
	138	`UPDATE pull_hold SET released_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
	139	WHERE issue_id = ?1 AND released_at IS NULL AND until_green = 1`,
	140	)
	141	.run(pullId).changes > 0
	142	);
	143	}
	144
124	145	/** When a hold on this pull was last released, if one ever was. */
125	146	export function lastRelease(db: Database, pullId: string): string \| undefined {
126	147	return (
		@@ -121,5 +121,6 @@
121	121	"20261019130000-run-model-prompt": "ce2e94f439649fc042c0a951f1af4a740b91f674dc94521e865ec517f68994f5",
		sentinelcrew 18d ago outdated Low: these 26 pins are for migrations this pull doesn't touch, and they will conflict with any parallel pull that adds a migration. Keep only the `hold-until-green` pin.
122	122	"20261019140000-route-timing": "0fd7cfa4e0a50c4b2b36162601f9ddc3318e7fa445559732364b2b52a06de011",
123	123	"20261019150000-page-vitals": "63fe647d95733a5194a99ae955181f2456d5c2e8c9c38d37bbf1bad395b72bdf",
124		"20261020120000-app-vitals-five": "6c75f4137e5592bf728ffe05d42d33bc158c9dabab3c666c58bc7b6dceb57576"
	124	"20261020120000-app-vitals-five": "6c75f4137e5592bf728ffe05d42d33bc158c9dabab3c666c58bc7b6dceb57576",
	125	"20261026190000-hold-until-green": "2be50f3a7ee590b05ae1048f3adbe7040452501a9c684d981e2efbaf88256c58"
125	126	}
		@@ -0,0 +1,6 @@
	1	// A hold set "until green" (#6495, core/holds.ts): the forge lets it go when
	2	// a check passes on the pull's head. 0 is a plain hold, which is every hold
	3	// there is today. Additive.
	4	export default `
	5	ALTER TABLE pull_hold ADD COLUMN until_green INTEGER NOT NULL DEFAULT 0;
	6	`;
		@@ -89,7 +89,8 @@ export function eventActor(
89	89	if (actorName !== undefined) return actorName;
90	90	return event.kind.startsWith("run.") \|\|
91	91	event.kind.startsWith("app.") \|\|
92		event.kind.startsWith("prompt.")
	92	event.kind.startsWith("prompt.") \|\|
	93	(event.kind === "pull.released" && event.actorId === null)
93	94	? "the forge"
94	95	: "someone";
95	96	}
		@@ -1223,6 +1223,7 @@ const holdJson = (hold: Hold) => ({
1223	1223	by: hold.heldByName,
1224	1224	why: hold.why,
1225	1225	at: hold.heldAt,
	1226	...(hold.until ? { until: hold.until } : {}),
1226	1227	});
1227	1228
1228	1229	function loadPull(ctx: Ctx): Found<{ pull: Pull }> {
		@@ -4290,12 +4291,16 @@ export function apiRoutes(router: Router<Handler>): void {
4290	4291	const found = loadPull(ctx);
		sentinelcrew 18d ago outdated Medium: only this JSON door takes `until`. The page's `holdSubmit` (studio/actions.ts) and the MCP `hold` tool call `holdPull` without it, and `holdCard` never shows that a hold is until-green. Wire both doors through and show it on the card.
4291	4292	if ("error" in found) return found.error;
4292	4293	const input = await body(ctx.request);
	4294	if (input.until !== undefined && input.until !== "green")
	4295	return respondAccess("bad_until", 422);
4293	4296	const held = holdPull(
4294	4297	ctx.app,
4295	4298	ctx.auth.user,
4296	4299	found.repo,
4297	4300	found.pull,
4298	4301	str(input.why),
	4302	false,
	4303	input.until === "green" ? "green" : undefined,
4299	4304	);
4300	4305	if (!held.ok)
4301	4306	return respondAccess(held.error, held.error === "not_open" ? 409 : 422);