@agent-native/core 0.136.5 → 0.137.1

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
+        message?: undefined;
         id?: undefined;
-        provider?: undefined;
-        deleted?: undefined;
         found?: undefined;
         providers: {
             id: string;
@@ -325,45 +324,46 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        provider?: undefined;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        message?: undefined;
         id?: undefined;
-        deleted?: undefined;
         count?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
-        provider?: undefined;
-        deleted?: undefined;
+        message?: undefined;
         count?: undefined;
         providers?: undefined;
+        provider?: undefined;
         found: boolean;
         id: string;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
-        provider?: undefined;
+        message?: undefined;
         found?: undefined;
         count?: undefined;
         providers?: undefined;
+        provider?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
-        provider?: undefined;
-        deleted?: undefined;
         found?: undefined;
         count?: undefined;
         providers?: undefined;
+        provider?: undefined;
+        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;
     status: string;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/auth.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import { defineEventHandler, getMethod, getQuery, getRequestIP, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, getHeader, } from "h3";
 import { EMBED_START_PATH } from "../shared/embed-auth.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
+import { FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_MAX_AGE, } from "../shared/first-run-onboarding.js";
 import { EMBED_TRANSPLANT_HEADER, isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
 import { isEmbedCapabilityScope, requestHasEmbedAuthMarker, resolveEmbedSessionFromRequest, } from "./embed-session.js";
 // In h3 v2, `event.req` IS the web Request — but in Nitro's dev server (srvx
@@ -1880,6 +1881,14 @@ function crossSiteCookieAttrs(event) {
         ? { sameSite: "none", secure: true, partitioned: true }
         : { sameSite: "lax", secure: false };
 }
+function setFirstRunOnboardingCookie(event) {
+    setCookie(event, FIRST_RUN_ONBOARDING_COOKIE, "1", {
+        ...crossSiteCookieAttrs(event),
+        httpOnly: false,
+        path: "/",
+        maxAge: FIRST_RUN_ONBOARDING_MAX_AGE,
+    });
+}
 export function setFrameworkSessionCookie(event, token) {
     clearFrameworkSessionCookies(event);
     setCookie(event, COOKIE_NAME, token, {
@@ -2293,11 +2302,14 @@ async function mountBetterAuthRoutes(app, options) {
                 if (!googleAccountId) {
                     throw new Error("Could not get Google account id");
                 }
-                await ensureGoogleAuthIdentity({
+                const isNewGoogleUser = await ensureGoogleAuthIdentity({
                     email,
                     accountId: googleAccountId,
                     name: typeof user.name === "string" ? user.name : undefined,
                 });
+                if (isNewGoogleUser === true) {
+                    setFirstRunOnboardingCookie(event);
+                }
                 if (typeof user.picture === "string" && user.picture.trim()) {
                     await putSetting(`avatar:${email}`, {
                         image: user.picture,
@@ -2633,6 +2645,12 @@ async function mountBetterAuthRoutes(app, options) {
                 // Best-effort — don't block the response
             }
         }
+        if (reqPath.includes("/sign-up/email") &&
+            isResponse &&
+            response.status >= 200 &&
+            response.status < 300) {
+            setFirstRunOnboardingCookie(event);
+        }
         return response;
     }));
     // Backward-compat: POST /_agent-native/auth/login
@@ -2721,6 +2739,7 @@ async function mountBetterAuthRoutes(app, options) {
                 body: { email, password, name: email.split("@")[0], callbackURL },
                 headers: event.headers,
             });
+            setFirstRunOnboardingCookie(event);
             return { ok: true };
         }
         catch (e) {
@@ -2939,6 +2958,7 @@ function mountAuthFallbackRoutes(app) {
                 body: { email, password, name: email.split("@")[0] },
                 headers: event.headers,
             });
+            setFirstRunOnboardingCookie(event);
             return { ok: true };
         }
         catch (e) {

package/dist/server/better-auth-instance.d.ts

@@ -193,9 +193,10 @@ export interface GoogleAuthIdentity {
  * Ensure a verified Google identity has a canonical Better Auth user/account
  * before the legacy email-keyed session is issued. This prevents a later
  * password signup from becoming the first canonical identity for that email.
+ * Returns whether this call created the canonical user.
  */
-export declare function ensureGoogleAuthIdentity(identity: GoogleAuthIdentity): Promise<void>;
-export declare function ensureGoogleAuthIdentityWithAdapter(adapter: BetterAuthInternalAdapter, identity: GoogleAuthIdentity): Promise<void>;
+export declare function ensureGoogleAuthIdentity(identity: GoogleAuthIdentity): Promise<boolean>;
+export declare function ensureGoogleAuthIdentityWithAdapter(adapter: BetterAuthInternalAdapter, identity: GoogleAuthIdentity): Promise<boolean>;
 /** Reset for testing */
 export declare function resetBetterAuth(): Promise<void>;
 /**

package/dist/server/better-auth-instance.js

@@ -709,13 +709,14 @@ export async function getBetterAuthInternalAdapter(config) {
  * Ensure a verified Google identity has a canonical Better Auth user/account
  * before the legacy email-keyed session is issued. This prevents a later
  * password signup from becoming the first canonical identity for that email.
+ * Returns whether this call created the canonical user.
  */
 export async function ensureGoogleAuthIdentity(identity) {
     const adapter = await getBetterAuthInternalAdapter();
     if (!adapter) {
         throw new Error("Better Auth internal adapter is unavailable");
     }
-    await ensureGoogleAuthIdentityWithAdapter(adapter, identity);
+    return ensureGoogleAuthIdentityWithAdapter(adapter, identity);
 }
 export async function ensureGoogleAuthIdentityWithAdapter(adapter, identity) {
     const email = identity.email.trim().toLowerCase();
@@ -731,13 +732,13 @@ export async function ensureGoogleAuthIdentityWithAdapter(adapter, identity) {
         if (!existing || linkedAccount.userId !== existing.user.id) {
             throw new Error("Google account is already linked to another user");
         }
-        return;
+        return false;
     }
     if (!existing) {
         if (adapter.createOAuthUser) {
             try {
                 await adapter.createOAuthUser({ email, name, emailVerified: true }, { providerId: "google", accountId });
-                return;
+                return true;
             }
             catch (error) {
                 // A concurrent first sign-in may have won the unique-email race. Only
@@ -754,7 +755,7 @@ export async function ensureGoogleAuthIdentityWithAdapter(adapter, identity) {
                     if (linkedAccount.userId !== existing.user.id) {
                         throw new Error("Google account is already linked to another user");
                     }
-                    return;
+                    return false;
                 }
             }
         }
@@ -769,7 +770,7 @@ export async function ensureGoogleAuthIdentityWithAdapter(adapter, identity) {
                 providerId: "google",
                 accountId,
             });
-            return;
+            return true;
         }
     }
     if (!existing) {
@@ -777,7 +778,7 @@ export async function ensureGoogleAuthIdentityWithAdapter(adapter, identity) {
     }
     const alreadyLinked = existing.accounts.some((account) => account.providerId === "google" && account.accountId === accountId);
     if (alreadyLinked)
-        return;
+        return false;
     // A password signup reserves the email before verification. If that row is
     // credential-only, remove the unverified credential and promote the same
     // canonical user to the verified Google identity. Any other linked account
@@ -793,13 +794,14 @@ export async function ensureGoogleAuthIdentityWithAdapter(adapter, identity) {
             email,
             accountId,
         });
-        return;
+        return false;
     }
     await adapter.linkAccount({
         userId: existing.user.id,
         providerId: "google",
         accountId,
     });
+    return false;
 }
 /** Reset for testing */
 export async function resetBetterAuth() {

package/dist/server/email-markdown.js

@@ -25,14 +25,9 @@ function inlineMarkdown(value) {
             trailing = url.slice(-1) + trailing;
             url = url.slice(0, -1);
         }
-        let label = "Open link";
-        const normalizedUrl = url.replace(/&/g, "&");
-        if (URL.canParse(normalizedUrl)) {
-            const host = new URL(normalizedUrl).hostname.replace(/^www\./, "");
-            if (host)
-                label = `Open ${host}`;
-        }
-        return `${prefix}<a href="${url}" style="color:${EMAIL_TEXT};text-decoration:underline;">${label}</a>${trailing}`;
+        // A bare URL stays its own link text: a recipient who cannot read the
+        // destination cannot tell a digest link from a phishing one.
+        return `${prefix}<a href="${url}" style="color:${EMAIL_TEXT};text-decoration:underline;">${url}</a>${trailing}`;
     });
     html = html
         .replace(/`([^`]+)`/g, `<code style="background:${EMAIL_CODE};padding:2px 5px;border-radius:4px;font-size:0.92em;">$1</code>`)

package/dist/shared/first-run-onboarding.d.ts

@@ -0,0 +1,3 @@
+export declare const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
+export declare const FIRST_RUN_ONBOARDING_MAX_AGE: number;
+//# sourceMappingURL=first-run-onboarding.d.ts.map

package/dist/shared/first-run-onboarding.js

@@ -0,0 +1,3 @@
+export const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
+export const FIRST_RUN_ONBOARDING_MAX_AGE = 24 * 60 * 60;
+//# sourceMappingURL=first-run-onboarding.js.map

package/dist/templates/workspace-core/.agents/skills/address-feedback/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: address-feedback
 description: >-
-  Triage feedback docs or pasted feedback into bugs to fix, UX suggestions to
-  propose, unclear questions, and skipped noise; verify bugs, check Sentry when
-  relevant, and keep UI changes minimal.
+  Triage feedback from docs, issues, Slack threads, or pasted notes into
+  verified bugs, UX proposals, unclear questions, and skipped noise. Use when a
+  user asks you to address product feedback or investigate a reported workflow.
 scope: dev
 metadata:
   internal: true
@@ -20,6 +20,7 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
 - If no link or feedback text is provided, ask for it.
 - Read the repo `AGENTS.md` before touching code.
 - Use the relevant connector/plugin/skill for the source when available, instead of scraping authenticated pages.
+- Before starting work, search available task history and local Git/PR metadata for the exact feedback link or issue identifiers. Reuse existing work instead of creating a duplicate fix.
 
 ## Steps
 
@@ -35,16 +36,28 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
    | Public URL | Web browsing |
    | Pasted text | Read directly |
 
-   Use web browsing only for public URLs. Auth-gated docs usually need their matching connector.
+   Use web browsing only for public URLs. Auth-gated docs usually need their matching connector. For threads, read the parent and all replies; note when there are no replies, and inspect linked files or newer follow-ups when the source refers to them.
 
-2. Categorize every actionable item.
+2. Decompose and categorize every actionable item.
+
+   Build a compact checklist before changing code. For each item, record the
+   symptom, expected behavior, evidence, and owning surface: UI, action/tool,
+   data model, provider/runtime, or product policy.
 
    - **Bug**: Broken behavior, crash, wrong data, dead link, package/API mismatch, or captured exception. Verify and fix when you agree.
    - **UX suggestion**: Design, discoverability, workflow, or feature feedback. Propose the cleanest version first unless the user explicitly asked you to implement UX changes.
    - **Question or unclear**: Missing detail, contradictory feedback, or behavior you cannot inspect. Ask or flag it.
    - **Out of scope**: Outside this repo, already shipped, intentionally unsupported, or too low-signal. Note briefly and skip.
 
-3. Check Sentry when the feedback smells like an error.
+3. For data, permissions, or resource-lifecycle feedback, verify the whole capability boundary before calling it UX.
+
+   - Check the supported create/read/update/delete lifecycle, including whether the backend/action exists when a UI control is missing.
+   - Inspect both the UI and the shared action/tool surface so agent and UI behavior stay in parity.
+   - Verify scope semantics such as owner/private, organization, shared, and public access. Test owner and non-owner paths with safe fixtures or read-only checks; never use another user's production data to test access.
+   - Treat possible cross-user or cross-organization exposure as a security/correctness bug and verify it before proposing polish.
+   - Keep undefined product policy separate from implementation bugs. If supported source types or scope semantics are not defined, flag the contract question instead of inventing behavior.
+
+4. Check Sentry when the feedback smells like an error.
 
    - Use the Sentry skill/plugin if available, or the repo's Sentry scripts if documented.
    - Search by route, stack symbol, error text, and symptom keywords.
@@ -52,7 +65,7 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
    - Cite issue IDs or links when you find a match.
    - If nothing matches, say that plainly.
 
-4. Fix only the clear bugs you agree with.
+5. Fix only the clear bugs you agree with.
 
    - Verify before fixing: reproduce locally, read the relevant code, inspect logs, or confirm with a stack trace.
    - Keep each fix narrow and mapped to a feedback item.
@@ -60,7 +73,7 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
    - Do not switch branches, stash, reset, force-push, or open a PR unless the user asks.
    - Add or update focused tests when the bug risk warrants it.
 
-5. Treat UX feedback with restraint.
+6. Treat UX feedback with restraint.
 
    Do not solve UX problems by adding more visible controls, helper text, banners, top-level nav, or always-open panels by default. Prefer cleaner interaction models:
 
@@ -72,11 +85,14 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
 
    When proposing a UX change, write it as: what to change, why it helps, and the tradeoff. Keep each proposal short.
 
-6. Verify changed behavior.
+7. Verify changed behavior.
 
    - Run the smallest relevant test or typecheck command.
    - For UI fixes, inspect the actual screen with a browser tool you already
      have. Do not write a browser-automation script to check a small fix.
+   - For resource visibility or lifecycle changes, verify both the screen and
+     shared action/tool behavior, including owner versus non-owner access when
+     relevant.
    - If you cannot run a useful verification, say why.
 
 ## Report Format

package/dist/triggers/index.d.ts

@@ -2,4 +2,7 @@ export type { TriggerFrontmatter, TriggerDispatchContext } from "./types.js";
 export { initTriggerDispatcher, refreshEventSubscriptions, parseTriggerFrontmatter, buildTriggerContent, type TriggerDispatcherDeps, } from "./dispatcher.js";
 export { evaluateCondition, __clearConditionCache, } from "./condition-evaluator.js";
 export { createAutomationToolEntries } from "./actions.js";
+export { defineAutomation, listAutomationDefinitions, updateAutomation, type AutomationActor, type AutomationDefinition, } from "../automations/service.js";
+export { queueAutomationRunNow } from "../jobs/run-now.js";
+export { listAutomationRuns } from "../jobs/run-history.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/triggers/index.js

@@ -1,4 +1,9 @@
 export { initTriggerDispatcher, refreshEventSubscriptions, parseTriggerFrontmatter, buildTriggerContent, } from "./dispatcher.js";
 export { evaluateCondition, __clearConditionCache, } from "./condition-evaluator.js";
 export { createAutomationToolEntries } from "./actions.js";
+// Template-native automation surfaces use the same organization-scoped
+// service and run history as the framework Agent page.
+export { defineAutomation, listAutomationDefinitions, updateAutomation, } from "../automations/service.js";
+export { queueAutomationRunNow } from "../jobs/run-now.js";
+export { listAutomationRuns } from "../jobs/run-history.js";
 //# sourceMappingURL=index.js.map

package/docs/content/cross-app-sso.mdx

@@ -15,6 +15,32 @@ This is the same trust primitive [A2A](/docs/a2a-protocol) and [External Agents]
 
 </Callout>
 
+## What the user sees {#user-flow}
+
+Cross-App SSO should feel like moving between products in one workspace, not
+creating a second account. For example:
+
+1. Sign in to [Dispatch](https://dispatch.agent-native.com), or to any app
+   that already uses the workspace identity.
+2. Open [Mail](https://mail.agent-native.com), [Calendar](https://calendar.agent-native.com),
+   or another enabled app in a new tab.
+3. The app sends the browser to Dispatch only if it does not already have a
+   Dispatch session. If the session exists, the redirect is effectively
+   invisible.
+4. Return to the app already signed in, with the same email, records, and org
+   context as before.
+
+The important distinction is that this is **one sign-in, not one shared
+cookie**. Each separately hosted app still creates and owns its own local
+session. Dispatch proves the user's identity at the app's front door, and the
+app then continues with its normal local auth and access checks.
+
+For a product walkthrough, record this exact sequence: sign in once in
+Dispatch, open two other hosted apps, show that neither asks for credentials,
+then sign out of one app and show that the other app's session is independent.
+That last step makes the security boundary visible: SSO removes repeated
+logins without turning every app into one shared session store.
+
 ## What & why {#what-why}
 
 Per-app user stores mean there is no single place a browser cookie could live that every app trusts. The federation model instead names one app — **Dispatch** — as the identity authority. Any other app can delegate "who is this person?" to Dispatch, get back a short-lived signed assertion of the user's verified email, and then **link that to its own local account by email**.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.136.5",
+  "version": "0.137.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/workspace-core/.agents/skills/address-feedback/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: address-feedback
 description: >-
-  Triage feedback docs or pasted feedback into bugs to fix, UX suggestions to
-  propose, unclear questions, and skipped noise; verify bugs, check Sentry when
-  relevant, and keep UI changes minimal.
+  Triage feedback from docs, issues, Slack threads, or pasted notes into
+  verified bugs, UX proposals, unclear questions, and skipped noise. Use when a
+  user asks you to address product feedback or investigate a reported workflow.
 scope: dev
 metadata:
   internal: true
@@ -20,6 +20,7 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
 - If no link or feedback text is provided, ask for it.
 - Read the repo `AGENTS.md` before touching code.
 - Use the relevant connector/plugin/skill for the source when available, instead of scraping authenticated pages.
+- Before starting work, search available task history and local Git/PR metadata for the exact feedback link or issue identifiers. Reuse existing work instead of creating a duplicate fix.
 
 ## Steps
 
@@ -35,16 +36,28 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
    | Public URL | Web browsing |
    | Pasted text | Read directly |
 
-   Use web browsing only for public URLs. Auth-gated docs usually need their matching connector.
+   Use web browsing only for public URLs. Auth-gated docs usually need their matching connector. For threads, read the parent and all replies; note when there are no replies, and inspect linked files or newer follow-ups when the source refers to them.
 
-2. Categorize every actionable item.
+2. Decompose and categorize every actionable item.
+
+   Build a compact checklist before changing code. For each item, record the
+   symptom, expected behavior, evidence, and owning surface: UI, action/tool,
+   data model, provider/runtime, or product policy.
 
    - **Bug**: Broken behavior, crash, wrong data, dead link, package/API mismatch, or captured exception. Verify and fix when you agree.
    - **UX suggestion**: Design, discoverability, workflow, or feature feedback. Propose the cleanest version first unless the user explicitly asked you to implement UX changes.
    - **Question or unclear**: Missing detail, contradictory feedback, or behavior you cannot inspect. Ask or flag it.
    - **Out of scope**: Outside this repo, already shipped, intentionally unsupported, or too low-signal. Note briefly and skip.
 
-3. Check Sentry when the feedback smells like an error.
+3. For data, permissions, or resource-lifecycle feedback, verify the whole capability boundary before calling it UX.
+
+   - Check the supported create/read/update/delete lifecycle, including whether the backend/action exists when a UI control is missing.
+   - Inspect both the UI and the shared action/tool surface so agent and UI behavior stay in parity.
+   - Verify scope semantics such as owner/private, organization, shared, and public access. Test owner and non-owner paths with safe fixtures or read-only checks; never use another user's production data to test access.
+   - Treat possible cross-user or cross-organization exposure as a security/correctness bug and verify it before proposing polish.
+   - Keep undefined product policy separate from implementation bugs. If supported source types or scope semantics are not defined, flag the contract question instead of inventing behavior.
+
+4. Check Sentry when the feedback smells like an error.
 
    - Use the Sentry skill/plugin if available, or the repo's Sentry scripts if documented.
    - Search by route, stack symbol, error text, and symptom keywords.
@@ -52,7 +65,7 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
    - Cite issue IDs or links when you find a match.
    - If nothing matches, say that plainly.
 
-4. Fix only the clear bugs you agree with.
+5. Fix only the clear bugs you agree with.
 
    - Verify before fixing: reproduce locally, read the relevant code, inspect logs, or confirm with a stack trace.
    - Keep each fix narrow and mapped to a feedback item.
@@ -60,7 +73,7 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
    - Do not switch branches, stash, reset, force-push, or open a PR unless the user asks.
    - Add or update focused tests when the bug risk warrants it.
 
-5. Treat UX feedback with restraint.
+6. Treat UX feedback with restraint.
 
    Do not solve UX problems by adding more visible controls, helper text, banners, top-level nav, or always-open panels by default. Prefer cleaner interaction models:
 
@@ -72,11 +85,14 @@ The default posture is judgment plus action: fix clear, verified bugs you agree
 
    When proposing a UX change, write it as: what to change, why it helps, and the tradeoff. Keep each proposal short.
 
-6. Verify changed behavior.
+7. Verify changed behavior.
 
    - Run the smallest relevant test or typecheck command.
    - For UI fixes, inspect the actual screen with a browser tool you already
      have. Do not write a browser-automation script to check a small fix.
+   - For resource visibility or lifecycle changes, verify both the screen and
+     shared action/tool behavior, including owner versus non-owner access when
+     relevant.
    - If you cannot run a useful verification, say why.
 
 ## Report Format