Trusted sources fold in by themselves, in real time; everyone else waits for review #8984

Trusted sources now fold in by themselves, and everyone else still waits for review. This push only brings the branch up to date with main and adds one test; the feature code is unchanged from the earlier pull (#8954).

What changed

• I merged main into the branch instead of rebasing. Rebasing would have needed a force push, which isn't allowed. The history is a merge commit, so it shows as one extra commit.
• bun scripts/openapi-routes.ts reports the route index is current after the merge, so the first failure from #8954 should be gone.
• I did not touch the repository, issues and pulls page weights or tab strips. test/repo-head-quiet.test.ts and test/ui-sweep.test.ts pass after the merge, and I haven't seen the forge's own check on this push yet.
• A new test in test/trusted-sources.test.ts says that folding runs inside the forge process, not a crew sandbox. It uses git.open-platform.sh as the source host. It checks that a trusted pull from that host lands on its own and that the decision makes no outbound fetch call.

What I ran

• scripts/gate.ts was clean before the merge, and I didn't re-run it afterwards.
• tsc --noEmit was clean on the branch after the merge.
• Tests covering trusted sources, the page weights and tab strips, the OpenAPI routes and migrations pass (469 tests). After the merge I re-ran only trusted-sources, repo-head-quiet and ui-sweep (36 tests), which also pass.
• scripts/fast.ts said the diff was too broad to name tests, so I picked those by hand.

What I didn't do

• I can't reach git.open-platform.sh from here, so nothing was tried against a real remote forge. The offline test is the only evidence that folding works from inside the forge process. If the forge's own network can't reach other forges, that still needs checking on the preview.

To try it

• Open /settings/trusted on the preview. An admin can add or remove sources there, and a stranger is refused.
• A pull from a trusted source lands on its own. A pull from anyone else waits for review.

Closes #8937

Trusted sources now fold in by themselves, and everyone else still waits for review. This push only brings the branch up to date with main and adds one test; the feature code is unchanged from the earlier pull (#8954).

What changed

• I merged main into the branch instead of rebasing. Rebasing would have needed a force push, which isn't allowed. The history is a merge commit, so it shows as one extra commit.
• bun scripts/openapi-routes.ts reports the route index is current after the merge, so the first failure from #8954 should be gone.
• I did not touch the repository, issues and pulls page weights or tab strips. test/repo-head-quiet.test.ts and test/ui-sweep.test.ts pass after the merge, and I haven't seen the forge's own check on this push yet.
• A new test in test/trusted-sources.test.ts says that folding runs inside the forge process, not a crew sandbox. It uses git.open-platform.sh as the source host. It checks that a trusted pull from that host lands on its own and that the decision makes no outbound fetch call.

What I ran

• scripts/gate.ts was clean before the merge, and I didn't re-run it afterwards.
• tsc --noEmit was clean on the branch after the merge.
• Tests covering trusted sources, the page weights and tab strips, the OpenAPI routes and migrations pass (469 tests). After the merge I re-ran only trusted-sources, repo-head-quiet and ui-sweep (36 tests), which also pass.
• scripts/fast.ts said the diff was too broad to name tests, so I picked those by hand.

What I didn't do

• I can't reach git.open-platform.sh from here, so nothing was tried against a real remote forge. The offline test is the only evidence that folding works from inside the forge process. If the forge's own network can't reach other forges, that still needs checking on the preview.

To try it

• Open /settings/trusted on the preview. An admin can add or remove sources there, and a stranger is refused.
• A pull from a trusted source lands on its own. A pull from anyone else waits for review.

This round addresses all eleven points except two partials: the terminal door has no screen test, and landingStrategy still reads the clock itself. tsc, scripts/gate.ts and scripts/design-lint.ts are clean. The new and affected tests pass: trusted sources, the fold-in end to end, autonomy, merge queue, palette, the TUI and settings suites, schema migrations and the event audience. I did not run the full suite, because scripts/fast.ts named 1,558 files. The forge's check runs it on this push.

HIGH

1. Walls (src/crew/fold_walls.ts): this is now an allowlist. A trusted pull may change only src/, test/, docs/, examples/ and README.md. Any other path waits for a person.

- It is also walled inside src/: fold-in, autonomy, crew/direct and crew/finishing, actions/trusted_sources, actions/pulls and upstream_follow, the trusted page and TUI screen, event_audience, settings_routes, admin_gate, every http/auth, every migration and its pin, and scripts/pin-migrations.ts.

1. takeIncoming: deleted, with its types. The upstream follow is the only intake and sweepGreen is the only way a pull lands. The fold_in.ts header and the doc say so.
2. Stamping (upstream_follow.ts): only a pull this follow opened, or its own pending pull, is stamped. A pull found by branch name is not. recordPullSource is now INSERT OR IGNORE, so a source is never rewritten.
3. Both doors: there is a new src/tui/screens/trusted.ts, offered in the palette to admin persons.

- a trusts, x removes, s is the kill switch, v reverts by source. Each asks first and goes through actions/trusted_sources.ts. - The palette-roster test lists it. The screen itself has no test.

1. Visibility: the changelog row now reads "folded in from account@host", and that list already swaps live on pull.merged. The landing still carries the Landed-from trailer, and the pull.merged event still carries source. I did not build a separate stream.
2. Tests (new test/trusted-fold.test.ts): these run the real sweepGreen.

- A green trusted pull lands by true merge, with fetch made to throw, the boot-proof gate run once and the trailers present. - A pull with no check, a red one, a walled one and a path nobody listed all go back. The wall leaves a land/wall decision with its reason. - A stranger's pull and the kill switch each hold a green pull back. A lapsed trust is not honoured at the tick's own time. - The ring is three real apps, each landing the work and reading Landed-via back. The first forge then refuses it. - A non-admin gets 404 on every /settings/trusted/* POST. An unconfirmed revert opens nothing. The review page shows Approve and Decline for a guest's pull and plain Merge for a walled trusted one.

MEDIUM

1. The doc and sourceOfUrl now say the account is the owner of the followed repository, not a verified commit author. I did not add the author binding.
2. The migration seeds nothing and its pin is regenerated. The tests fill the list with addTrust, an owner action.
3. The review-page label is Approve and Decline only when the pull has a source that is not trusted.
4. The revert needs an "Open reverts" tick, and the server refuses without confirm=1.

- now is threaded from sweepGreen through admit, reviewed, landsOnItsOwn and foldWall. landingStrategy still reads the clock itself. It only chooses merge or squash after the pull is admitted, so I left it.

1. docs/features/trusted-sources.md names the terminal door, the stamping rule and the visibility.

To try it, sign in as an admin, open Settings → Trusted sources and add an account. In the terminal, open "Trusted sources" in the palette.

Of the two failing tests, I fixed one and could not reproduce the other. I pushed the fix and a merge of main to the branch.

• Snapshot destination test: this test (tui-backups) also fails on a clean origin/main, so it was not caused by this pull. main made the Resilience dialog taller. The prompt for a bad endpoint now opened over the middle of it and covered the refusal sentence ("The endpoint must be an http(s) URL without credentials in it."). I moved that sentence to the top of the Resilience dialog (src/tui/screens/resilience.ts), above where the prompt opens, and the test passes.
• Repo-head test: repo-head-quiet (the byte-size budget test) passed on every run I did, before and after merging main, so I could not reproduce the failure. Its budgets are only about 130 bytes above the measured sizes, so it is probably sensitive to what is on main or to the check environment. I changed nothing for it.
• Local runs: tsc and the gate script are clean, and the trusted-sources, fold-in, palette-roster, repo-head and backup tests pass. I did not run the full suite; the forge's check does.

Trusted sources fold in by themselves, in real time; everyone else waits for review (#8937). This round answers @sentinel's review: the trusted-sources terminal screen now has its own test, and the landing strategy takes the clock as an argument.

test/tui-trusted.test.ts (new) drives trustedScreen in a headless terminal, the same way tui-boards-rename.test.ts does:

• Non-admin: the palette does not offer trusted. If the screen is pushed anyway it says only an admin may change trust, does not show the list, and the a, x, s and v keys change nothing. The list is unchanged, nothing is stopped, and there are no trust. or foldin. events.
• Admin: the palette offers the screen.

- a trusts a source until a date: the row is drawn and a trust.set event is written. A past date is refused with "That date has passed." and nobody is added. - s stops folding in, recorded under the admin's name, and writes foldin.stopped. Pressing s again resumes it and writes foldin.resumed. - v writes trust.reverted naming the source under the cursor (no pulls, so opened: 0). - x removes the source and writes trust.removed. - Each confirm opens on Cancel, so Enter alone does nothing; the test checks that for s, v and x.

The clock (the non-blocking ask): landingStrategy in src/crew/autonomy.ts now takes now: Date = new Date() and passes it to foldsIn. landGated still uses the default. A new case in test/trusted-fold.test.ts gives one trusted pull two dates: before the trust ends it lands as a merge, after it lapses it squashes. That case would fail without the change, because before it the date was ignored.

Both changes went out in one commit, 28185755. The commit message only names the terminal test because everything was already staged, and force pushes are refused, so the history stays as it is. Nothing else in the code changed.

Checks run: bun scripts/gate.ts and bun x tsc --noEmit pass. scripts/fast.ts named 1,564 test files for the whole branch, over its budget, so I picked the covering tests myself: tui-trusted, trusted-fold, trusted-sources, upstream_follow, palette-roster and autonomy*. All of them pass.

To try it: bun test test/tui-trusted.test.ts test/trusted-fold.test.ts. Or open the terminal as a forge admin, press ctrl+k, choose "Trusted sources", and use a, s, v and x.

🤖 Generated with Claude Code

Left #8937 open: 1 unticked item remain (New work from a trusted source flows in as it appears, by event with a sweep for anything missed: its branch becomes a pull, resolved against main by the crew if needed, then lands by true merge when its checks pass, with no person's review. Each one is visible in the changelog and a live stream, credited to its author.).