@ashlr/hub 3.11.5 → 3.13.0

package/CHANGELOG.md

@@ -339,6 +339,159 @@ superseded, not a setup procedure. Use [runtime activation authority](docs/RUNTI
 and the [current architecture boundary](docs/ARCHITECTURE.md#legacy-fleet-activation-boundary).
 Neither the historical record nor a successful test activates a resident fleet.
 
+## [3.13.0] — 2026-09-26 UTC — autonomy you can actually turn on
+
+3.12.0 compiled in the operator's custody key. 3.13.0 closes the gaps that kept a signed grant from doing anything:
+G7 could never pass on a repo without CI, cloud and self-improvement PRs never entered the merge gates, and the
+resident daemon could not be installed at all. Autonomy still starts only when Mason signs a standing grant (Touch
+ID), sets the switch, and runs `ashlr authority resident start` himself; `ashlr authority setup` walks every step.
+
+### A host-verified `ashlr/verify` check (G7 can pass without CI)
+
+- The ashlr-fleet App posts `ashlr/verify` on each fleet PR head from the G3 result: `success` only when G3 passed,
+  commands ran, and GitHub's head carries exactly the verified tree on the verified base; anything else is `failure`
+  (#511). The run lists the verify digest, tree, base and the commands that ran.
+- G7 on local-enforcement repos requires the App's own green `ashlr/verify`; a deploy-only green (a Vercel preview)
+  or a same-named run from any other App no longer passes. `ashlr authority protect` pins `ashlr/verify` to the App
+  even when master has no check runs. The App manifest asks for Checks: write; setup links the settings page when an
+  existing App lacks it.
+
+### Cloud and self-improvement PRs land through the standing gates
+
+- Each standing tick ingests `pr-open` cloud tasks whose repo is in the grant: identity-checked against the pinned PR
+  (head `ashlr-cloud/<task>`, unchanged base, pinned head SHA), size-capped, filed as a pending proposal with the
+  session report marked UNVERIFIED, and host-signed over the diff hash (#514). Correctness still comes from G3–G7;
+  G6 needs a non-Claude judge. Once the fleet PR opens, the cloud PR is closed as superseded and the task follows the
+  fleet PR to `merged`.
+- Needs-you can Land, Close or Update a cloud PR, with an inline gate preview (G1/G1b/G2/G4 on the pinned diff,
+  GitHub mergeability and checks), multi-select and "Land all clean" (#508).
+- Self-improvement waits for review: at `selfImprove.maxOpenPrs` (default 3) open PRs it stops launching
+  (`ashlr cloud budget --self-improve-max-open <n>`) (#508).
+- Every cloud task has an evidence timeline — objective, session, worker, report (a claim), PR, diff, checks, gates,
+  merge, release, health, cost (an estimate) — each step marked verified, claim or unknown (#507).
+
+### Rerun-safe autonomy setup, and a live setup checklist in Verse
+
+- `ashlr authority setup` is safe to rerun. The provenance key is rotated
+  only once; the rotation is recorded, so a rerun with `--yes` no longer
+  invalidates pending proposals. A ruleset GitHub already holds with the same
+  content is reported `already` and is not applied again, and
+  `protect --apply` skips it too. The GitHub App counts as done only once it
+  is installed on the enrolled repos; until then setup prints the install
+  page.
+- A failure in the App flow, the Claude token prompt, key creation or the
+  grant draft is recorded as a failed step, and the run still ends with its
+  summary.
+- The `--dry-run --json` checklist now gives each open step the command
+  that moves it on, plus a `link` where there is one (the install page or the
+  trust-root PR). Both fields are additive to `ashlr.authority-setup.v1`.
+- New read-only route `GET /api/verse/authority/setup` serves the dry run's
+  checklist, cached for 30 s. It never prompts, signs or opens a browser, and
+  it runs only bounded `gh api` reads.
+- Verse's "Autonomy is off" state and onboarding step 4 show that checklist:
+  the next step with what it needs and the command to copy for it, plus
+  every step. Verse no longer asks the server for a grant draft on load (a
+  dormant fleet used to log a 409 there on every launch). It drafts only
+  when you open the Touch ID sheet.
+
+### Resident runtime under the standing grant
+
+- Adds `ashlr authority resident start|stop|status`. `start` installs or
+  restarts `ai.ashlr.daemon` only under an active Touch-ID-signed standing
+  grant, from a clean compiled release, with Stop off. You run it yourself in a
+  terminal: agent, daemon or swarm environments, a redirected HOME, no TTY and
+  `--yes` are all refused. It claims a single-use capability before any launchd
+  effect and records the start in the authority ledger.
+- Regenerates the launchd plist (budget, interval, parallelism) from config on
+  every start. `status` and setup report drift after a config change.
+- `ashlr authority setup` now reports the resident step as already in place,
+  waiting on you with the exact command, or blocked on a missing prerequisite,
+  instead of a permanent build block.
+- The legacy install, reinstall, repair and restart paths stay denied, and the
+  permit-based compiled roots stay empty.
+- See [docs/RESIDENT-RUNTIME.md](docs/RESIDENT-RUNTIME.md).
+
+### Verse's own improvements
+
+- A spent seat reports when it actually reopens (the latest reset among its spent windows) (#499).
+- Budget, decisions, capacity, session-meta and activity read failures return a 503 with a plain sentence instead of
+  defaults or empty lists, and the UI says so (#501).
+- Lane and seat reasons are written in plain words on the server; older journal wording is still rewritten (#504).
+- A regression test pins Pulse's local-day labels outside UTC (#505).
+
+Released with `npm run gate -- --base v3.12.0`: GATE PASS in 43m29s (854 backend files, 19,846/19,924 tests with
+known failures; 190 web files, 3,335/3,335).
+
+## [3.12.0] — 2026-09-26 UTC — your key is the trust root, and Verse says one clear next step
+
+**Your custody key is compiled in.** `src/core/authority/trust-roots.ts` now carries Mason's Secure Enclave key
+`se-p256-9c1330e3bd72cf3e` (#506, opened by `ashlr authority setup`), so a Touch ID–signed standing grant verifies on
+this build. Resident activation stays blocked in this release (see `ashlr authority setup`); the resident runtime,
+the host-verified `ashlr/verify` check and cloud-PR intake are the 3.13 work.
+
+The 3.11.5 package already contained the changes below; its notes described only the account-freshness repair. They
+are recorded here. 3.11.4 shipped a crash — Command and Fleet failed to load in the browser because a shared secret
+scrubber read `process.platform` at import time — fixed in #498 (and in 3.11.5). A new test walks everything the
+web UI loads and fails on any Node-only global touched at import.
+
+### Autonomy is off → one clear next step
+
+- Command, Fleet, Growth and Mind no longer show grids of empty cards while the fleet is dormant. One shared
+  "Autonomy is off" state says what is off and offers the single next action: **Approve grant** (opens the Touch ID
+  sheet) or the exact setup command with Copy (#490).
+- `ashlr authority setup --dry-run --json` prints the setup checklist for a UI: each step's status and what it
+  needs from you (sudo, Touch ID, browser, GitHub, terminal) (#492).
+- `ashlr authority setup` is safer to rerun: it finds a trust-root PR it already opened (or a key already merged),
+  creates the canary repo before protecting it, and ends with the daemon service's real launchd state (#492).
+- ⌘K gains the actions that matter: Autonomy Off / Propose / Autonomous, Approve grant…, Budget mode, Copy the
+  setup command, Run in cloud… — all through the same guarded paths as the Command bar (#494).
+
+### A calmer Command
+
+- One compact **Seats** strip replaces the tall burn-down cards; the full charts moved to Usage → Seat windows.
+  Seat status comes from the same model as the rail, and says "Status unknown" when sources disagree (#493).
+- The grid no longer leaves half-empty rows at medium widths; card menus sit in the card header (#493).
+- The first-run tour is a one-line "Getting started" chip, with a new "Turn on autonomy" step (#494).
+- About 85 strings rewritten: plain facts instead of defensive "X, not Y" sentences; route paths moved out of error
+  copy into a details disclosure; the double-period bug fixed (#489).
+
+### Accurate numbers
+
+- Charts keep their size at any window width: line, bar and burn-down charts measure their container and draw at a
+  fixed pixel height with 12 px labels (the 1900 px tokens chart used to stand 573 px tall) (#497).
+- Days are local: usage rollups, fleet history and "dark since" bucket by your local day, not UTC (#497).
+- Claude usage is no longer double-counted (one transcript line per content block repeated the full usage); this
+  also corrects the Claude capacity reader that feeds the budget gate (#498).
+- Local Ollama `name:tag` models cost $0 (#498). One context-window unit everywhere (64k, not 66k) and clean model
+  names ("gpt-oss 20B", "Qwen3.8 27B (64k)") (#500).
+- The cloud lane says "Not set up · ~$250 credits (estimate)" instead of showing unspent credits as live headroom (#500).
+- The rail tooltip says "resets" once (#495).
+
+### Fleet engine
+
+- The runtime probe no longer blocks the event loop: no `which llama-server` per poll, and `ps` output is parsed in
+  yielding slices (#481).
+- Adopted harness effort and sampling now reach every engine at dispatch (Claude `--effort` only on builds that accept
+  it) (#484). The seat router uses its λ cost/headroom/latency weights; default weights reproduce the previous order
+  exactly (#486).
+
+### Operations
+
+- Comms: requests older than 48 h (`comms.requestTtlHours`) expire, so one unanswered Telegram question no longer
+  blocks every later message and fails the nightly oversight job (#492).
+- `/api/verse/apps` is warmed at `ashlr verse` start; ⌘. during a running turn only stops the turn (#498, #500).
+- Test flakes fixed: fleet-live "mergedToday" near midnight, m142 under parallel load (#500).
+
+### Faster first paint
+
+- Chat's first-paint JavaScript fell from 351.8 KB to 333.1 KB under the unchanged 352 KB budget: the shell's
+  first-paint code ships as one chunk, and the ⌘K catalog, onboarding flow and delete dialog load on demand (#502).
+
+Released with `npm run gate -- --base v3.11.5`: build, typechecks, eslint, real-io lane, docs, first-paint and web tests
+passed; the backend run (757 files, 17,896/17,995 tests) failed 14 files on a machine at load ~200. Rerun alone with
+longer timeouts, 12 pass; `universe-hub-marker-campaign` and `universe-capacity-wait-integration` fail the same way on
+v3.11.5 and are pre-existing.
+
 ## [3.11.5] — 2026-09-26 UTC — keep account evidence honest through probe faults
 
 - Keep a verified account's last observed usage visible only for its original

package/README.md

@@ -168,23 +168,26 @@ ID).
    `ashlr cloud launch "<task>" --repo owner/name` ([cloud lane](#the-cloud-lane)).
 7. **Inspect autonomy preparation** with `ashlr authority setup --dry-run --json`
    and `ashlr authority status`. Guided setup can prepare prerequisites after
-   your explicit actions; this build cannot activate resident fleet work.
+   your explicit actions; once your standing grant is active,
+   `ashlr authority resident start` runs the resident fleet under it.
 
 ---
 
-## Autonomy commissioning path (currently unavailable)
+## Autonomy commissioning path
 
 **Current release status:** `ashlr authority setup` is a resumable preparation
 workflow. Its dry run is read-only; a live run can create custody, GitHub and
-grant state after your explicit actions. It never installs or restarts the
-daemon. Service install, repair and restart authority is withheld, compiled
-daemon and conductor trust roots are empty, and the native resident-start broker
-is absent. Non-dry resident work remains dormant. The setup checklist reports
-this runtime block even if every preparatory step is complete.
-
-Autonomy ships **dormant**. Guided setup can help prepare a standing grant, but
-that grant alone does not admit resident activation. The compiled execution
-roots and native release boundary must be provisioned through reviewed releases.
+grant state after your explicit actions. Setup itself never installs or restarts
+the daemon. The legacy service paths (`ashlr daemon install`, `ashlr setup`,
+`worker setup`, `update`) remain temporarily unavailable for install, reinstall, repair and restart and support status and uninstall only; the permit-based compiled daemon and conductor trust roots are empty.
+The resident runtime instead runs under your **standing grant**
+([docs/RESIDENT-RUNTIME.md](docs/RESIDENT-RUNTIME.md)): with a Touch-ID-signed
+grant active, `ashlr authority resident start`, typed by you in your own
+terminal, installs `ai.ashlr.daemon` from a clean release with its plist
+regenerated from config. Every tick re-verifies the grant, Stop and the switch.
+
+Autonomy ships **dormant**: nothing runs until your custody key is compiled in,
+you sign a grant, and you start the resident service yourself.
 
 ```sh
 ashlr authority setup --dry-run   # print every step and what it would do
@@ -193,8 +196,12 @@ ashlr authority setup --dry-run --json  # machine-readable checklist and runtime
 ashlr authority status            # grant, switch, Stop, rollout stage, ledger, custody
 ```
 
-`setup` performs each available step and pauses for the steps marked ✋. It
-cannot complete resident commissioning in the current build.
+`setup` performs each available step and pauses for the steps marked ✋. Its
+last step reports the resident runtime: in place, waiting on the exact command,
+or blocked on a missing prerequisite. Rerunning it is safe: whatever is already
+in place is reported `already` and left alone (the provenance key is rotated
+only once). Verse shows the same checklist, with the next step's command to
+copy.
 
 1. ✋ **Install the custody helper:** `sudo scripts/install-custody.sh`
    (root-owned, in `/usr/local/libexec/`).
@@ -218,9 +225,15 @@ cannot complete resident commissioning in the current build.
 9. **Rotate the provenance HMAC key** (`ashlr authority rotate-provenance`).
 10. ✋ **Sign the first grant** (Touch ID) and, optionally, set the switch to
     Autonomous. The grant starts on the shadow stage of its rollout ladder.
+11. ✋ **Start the resident daemon** in your own terminal:
+    `ashlr authority resident start`. It refuses agents, a dirty build, Stop,
+    the switch at Off and an inactive grant, shows the release, plist and daily
+    budget, and asks you to confirm. `ashlr authority resident status` shows
+    drift after a config change; `ashlr authority resident stop` removes the
+    service.
 
-After a future reviewed resident activation release, standing grants require
-Touch ID reapproval every 30 days or after authority code changes.
+Standing grants require Touch ID reapproval every 30 days or after authority
+code changes; until then the resident daemon parks without working.
 
 **What a grant allows.** A standing grant names the repositories, engines, risk
 and size caps, spend ceiling and Leader classes, and is valid for at most 30
@@ -398,7 +411,7 @@ runtime authority.
 | Judge-free evidence merge | **Off** | Base- and diff-bound deterministic verification, signed provenance/evidence, strict scope/risk policy, and live protected-branch checks | Protected remote PR handoff only; no local fallback, self-target merge, partial capture, or build/CI/manifest change |
 | Cloud task | Operator-invoked, or self-improvement under its budget | The cloud budget gates and a signed-in `claude-a` seat | A draft PR on `ashlr-cloud/<taskId>`; never merges |
 | Deploy | Never performed by the daemon | Explicit `ashlr ship --deploy <target> --confirm` after pre-ship checks | Runs the selected production deploy command |
-| OS service mutation | **Temporarily unavailable** | No production install/reinstall/repair/restart authority is currently issued | Existing services expose status and uninstall only; no live one-shot or resident start is admitted |
+| OS service mutation | **Temporarily unavailable** on legacy paths | No install/reinstall/repair/restart authority on `daemon install` / `setup` / `update`; the resident service installs only through `ashlr authority resident start` under an active standing grant | Legacy paths expose status and uninstall only; `resident start` installs `ai.ashlr.daemon` after your confirmation |
 
 No successful test, model verdict, or proposal record grants deployment or service-install authority. Those are separate operator commands.
 

package/dist/authority-surface.json

@@ -11,6 +11,7 @@
     "dist/core/fleet/merge-gates.js",
     "dist/core/fleet/standing-merge-pass.js",
     "dist/core/fleet/fleet-merge-state.js",
+    "dist/core/fleet/verify-check-run.js",
     "dist/core/fleet/host-merge.js",
     "dist/core/fleet/post-merge-watch.js",
     "dist/core/fleet/quarantine.js",
@@ -49,6 +50,11 @@
   ],
   "missingRoots": [],
   "files": [
+    {
+      "path": "dist/cli/authority.js",
+      "sha256": "24f5ee90a11fab066467106c61562e77899d48dd3829320019949e73bc4a4eb9",
+      "bytes": 112602
+    },
     {
       "path": "dist/cli/daemon.js",
       "sha256": "4535afe4df37bc82b3accb221ff001b912488e7e8a9de12c99863b5183db919c",
@@ -101,14 +107,19 @@
     },
     {
       "path": "dist/core/authority/protected-paths.js",
-      "sha256": "f3298afb1bfcd916d410c6af891866a2ade040855dd550b6996af1bd3cb08585",
-      "bytes": 34989
+      "sha256": "533c11a102bd4022abf4919541d38f2062ee48dde82cb59e4ca344f168ed0e05",
+      "bytes": 35668
     },
     {
       "path": "dist/core/authority/reserve-breach.js",
       "sha256": "6c70516eca9327f4b90c5b46c7c082ac5545107f46ef9f1f296905296db97135",
       "bytes": 15225
     },
+    {
+      "path": "dist/core/authority/resident.js",
+      "sha256": "11b1dcf4b5d7ab46551af99564776f6fd5cb4132c2e9f8bf4abafdd8edd9a9ee",
+      "bytes": 11749
+    },
     {
       "path": "dist/core/authority/rollout.js",
       "sha256": "470e0c0045489b22144cdcfc18b352de330891b1fcca3bace01a4a00f33728ad",
@@ -126,13 +137,13 @@
     },
     {
       "path": "dist/core/authority/trust-roots.js",
-      "sha256": "7ff5ca2601de703ea78bbbfbd27689ea78c54be2384537897acd7cf48f6e05c4",
-      "bytes": 466
+      "sha256": "96d0bdba94eede3935111e3afc8d6386d939114debb4cd246e99b0e4a8df8242",
+      "bytes": 768
     },
     {
       "path": "dist/core/authority/types.js",
-      "sha256": "ff273f1efb5099ce43fbbcecb488e272b2fdc9be2801d493c7104f0aa359c4e7",
-      "bytes": 6969
+      "sha256": "685df24a247b66d132960212b4f9175368a2dc0afa87d3ccf04ca98e2dfd85dc",
+      "bytes": 7242
     },
     {
       "path": "dist/core/autonomy/attempt-records.js",
@@ -201,8 +212,8 @@
     },
     {
       "path": "dist/core/cloud/budget.js",
-      "sha256": "68362ee6c3d7c8bbdce41d2e51383e76fd604b8a29e3a8d333eb9cce5c103e2d",
-      "bytes": 5034
+      "sha256": "4d875d850ec586cf8796cd48a608d1fa8d12bdafdcda41f3f7f1853217755d8f",
+      "bytes": 5760
     },
     {
       "path": "dist/core/cloud/checkout.js",
@@ -211,8 +222,8 @@
     },
     {
       "path": "dist/core/cloud/cloud-api.js",
-      "sha256": "5dbe8640930d6f8c81d9baafe62d15247f9b99db905e533ba5da3e62e678ce07",
-      "bytes": 25661
+      "sha256": "aa6a6080538c4d9039ff74160c43e9943816ffcefe7e6f9f74a105ec6a65c4a5",
+      "bytes": 31881
     },
     {
       "path": "dist/core/cloud/delivery-contract.js",
@@ -229,6 +240,16 @@
       "sha256": "a8949f1b3e5d5ebdad5e56929abda2034c4c17dd0f8ddf825fd17d2d5b3296de",
       "bytes": 15055
     },
+    {
+      "path": "dist/core/cloud/pr-actions.js",
+      "sha256": "1367463b2044696260f117cf4403f85d21f01624a94c82b730fda4374dfd9dba",
+      "bytes": 20028
+    },
+    {
+      "path": "dist/core/cloud/pr-preview.js",
+      "sha256": "041840be5e80e691e6d656515063020cf7ff3edc612a08a2e1acf314ce576ce5",
+      "bytes": 11391
+    },
     {
       "path": "dist/core/cloud/service.js",
       "sha256": "d07028772d97533de87b6042ae9a5a60176e13538416236b84f70c93a7248e7e",
@@ -236,18 +257,33 @@
     },
     {
       "path": "dist/core/cloud/store.js",
-      "sha256": "9693dbf79a420cbeceed0f65eadfebce739178ee8132d951ae73e799557d7f9e",
-      "bytes": 13916
+      "sha256": "4870f24a34ca613376c3aa469c6bcc59ad52a52112cbdffcb306db13970c5e84",
+      "bytes": 15697
+    },
+    {
+      "path": "dist/core/cloud/timeline-api.js",
+      "sha256": "da36a6ccb144430eda526048cbf4c71c105f6fbd7b09f5834a797cc4f4729f0c",
+      "bytes": 1673
+    },
+    {
+      "path": "dist/core/cloud/timeline-types.js",
+      "sha256": "f73d2db1b41afe424fea6f7170b1d466accd6007aacf856b8c7875014d58b3ad",
+      "bytes": 1821
+    },
+    {
+      "path": "dist/core/cloud/timeline.js",
+      "sha256": "05021b751b762a48618088386ba2dff58d9ce4a0c77eca855b7cc2e4c91c5505",
+      "bytes": 40775
     },
     {
       "path": "dist/core/cloud/tracker.js",
-      "sha256": "ed69dbec010d931e3f39f3abd73032c3ca882da44993bc99609b950028a94bbf",
-      "bytes": 12760
+      "sha256": "7fc3a7ea69b823c6b7b0c8e5e960828886938c49f97a4161ab38b109f0622aaf",
+      "bytes": 15651
     },
     {
       "path": "dist/core/cloud/types.js",
-      "sha256": "30b3823fea97bce3f40e28aac35bd4d9915d0eae26bfb73509a901b440adcfaa",
-      "bytes": 4202
+      "sha256": "4b48f06d0e8c76dd7f78291ead7a2fc9c5d4f2d7228354a50cc5664e47e8704a",
+      "bytes": 4217
     },
     {
       "path": "dist/core/comms/director-context.js",
@@ -421,8 +457,8 @@
     },
     {
       "path": "dist/core/daemon/service-install-authority.js",
-      "sha256": "5eebdd793a94b93a20d2266030da252882fa9ec00419e3ea0733b15296897602",
-      "bytes": 873
+      "sha256": "615b75bb4332da46a170f9dedc9c3ca67c1f4e2d8c19a9f2869e3e58684206df",
+      "bytes": 1482
     },
     {
       "path": "dist/core/daemon/service-lifecycle-fence.js",
@@ -431,8 +467,8 @@
     },
     {
       "path": "dist/core/daemon/service.js",
-      "sha256": "a90d868d9686314525e89c5ebadb3ea8f9523dc080fad6f64e4dd35eff5acd02",
-      "bytes": 83119
+      "sha256": "8673ff486a43f987c6d318accb40d5c8d4233096239afb9a7ba84f2f5df5c2c2",
+      "bytes": 84810
     },
     {
       "path": "dist/core/daemon/state-recovery.js",
@@ -614,6 +650,11 @@
       "sha256": "cbff4e5e27860aeaef5b79b734d1d2fc6345586228f960a29b7ed8e6a3354070",
       "bytes": 35193
     },
+    {
+      "path": "dist/core/fleet/cloud-intake.js",
+      "sha256": "fdd2e18807a16ee6f32ff47a60b5e0030c34e0a1a21e4f309f5ce742b7b64bcf",
+      "bytes": 28887
+    },
     {
       "path": "dist/core/fleet/context-efficiency.js",
       "sha256": "b97dc793c97e4875f1777715c39ec8f40197d752624166124223c5a127016ef0",
@@ -671,8 +712,8 @@
     },
     {
       "path": "dist/core/fleet/dispatch-router.js",
-      "sha256": "b429b31ea773b5e0dab7b86254f263cc25b4067549a1215c33710a1cef5c48c7",
-      "bytes": 31223
+      "sha256": "33fc3cb2259289ee215308ea0f6a9187a149db144295422bbefac058b0dabd02",
+      "bytes": 32304
     },
     {
       "path": "dist/core/fleet/engine-readiness.js",
@@ -726,8 +767,8 @@
     },
     {
       "path": "dist/core/fleet/host-merge.js",
-      "sha256": "5da77df3e5ca40e731a2b0b69fe90e8c86791fe48a6c04a3982b2e1946ceac5f",
-      "bytes": 81018
+      "sha256": "e6b6b001db862bb715323ea64a23a2fd819e78f91994e4cf39de11a4866d43cc",
+      "bytes": 81909
     },
     {
       "path": "dist/core/fleet/judge-decision-metadata.js",
@@ -761,8 +802,8 @@
     },
     {
       "path": "dist/core/fleet/merge-gates.js",
-      "sha256": "80140d996f1a4c3c85ed458232dc2eabd4934c8ff8ce3135425ad719bf940f39",
-      "bytes": 34649
+      "sha256": "d71f987036694381d51d19989fbf9bad96e7d90aea467af03132a6fa1d7c3311",
+      "bytes": 36252
     },
     {
       "path": "dist/core/fleet/mirrors.js",
@@ -991,8 +1032,8 @@
     },
     {
       "path": "dist/core/fleet/standing-merge-pass.js",
-      "sha256": "479f8998ffa4f440a561ea456600621b64a18d9aeca2fc7823b39c8d86b0aabe",
-      "bytes": 81011
+      "sha256": "774055ee60cb92148ae1b3bbb2549e99674e25053da6aa2c46f2ccefb0b2eb45",
+      "bytes": 82522
     },
     {
       "path": "dist/core/fleet/status.js",
@@ -1016,14 +1057,19 @@
     },
     {
       "path": "dist/core/fleet/tick-hooks-live.js",
-      "sha256": "c47026f6d148f8fca585273bb1e7d161c40cff5bc5c591d9bc75202d6f9f3b2d",
-      "bytes": 89482
+      "sha256": "677a6f4b123f98f044ae8c5b50ff62d1acc3e2a6597cdce9a0b54cd1ff860c0b",
+      "bytes": 92567
     },
     {
       "path": "dist/core/fleet/verdict-score.js",
       "sha256": "2af25981ae1fe0609dc71763236d221192b8620d495825dc38068e594aa73720",
       "bytes": 2197
     },
+    {
+      "path": "dist/core/fleet/verify-check-run.js",
+      "sha256": "0654f02326227ad08f4c63dc6b204d37bfe1a54b73f971fe256cbeb7d2da2352",
+      "bytes": 13549
+    },
     {
       "path": "dist/core/fleet/work-item-objective.js",
       "sha256": "3a0766ccc948c12ee0789a8842901580715768a29a9b9f71df641ab421e89a23",
@@ -1761,13 +1807,13 @@
     },
     {
       "path": "dist/core/routing/budget-api.js",
-      "sha256": "03a203b5334a2bde7be4fbe53f65b9e8a5035ffe9dfd87a405e722761553c9a9",
-      "bytes": 13577
+      "sha256": "6ae4f921d0f5692b5c748f7695573365d3cb0208938e9f7ab6b5c2c5aaa0cd28",
+      "bytes": 16178
     },
     {
       "path": "dist/core/routing/budget-store.js",
-      "sha256": "c2ac73005d36406fd82b4b6feefdd9695760051efdc14c707c0a56898ea7b66c",
-      "bytes": 22419
+      "sha256": "b830423e5aa7eda3d33b6d19df581cdd815a57c28a28bcac8a6a55127dffa46a",
+      "bytes": 23413
     },
     {
       "path": "dist/core/routing/capacity-history-api.js",
@@ -2611,8 +2657,8 @@
     },
     {
       "path": "dist/core/verse/account-health.js",
-      "sha256": "f64eb9396b5bb8a3b1ce4418141a88009bad2f3afd1d3e0d452646698b5c07dc",
-      "bytes": 39562
+      "sha256": "b99c1626ed212e53a7fdc8027c686dead3095281ddf1c9af8f3932e9b3fdac98",
+      "bytes": 39999
     },
     {
       "path": "dist/core/verse/accounts.js",
@@ -2621,8 +2667,8 @@
     },
     {
       "path": "dist/core/verse/activity-api.js",
-      "sha256": "812524849c0215f29cb60365cb5320197deaf7f47b797009805980e02443f77c",
-      "bytes": 14046
+      "sha256": "05fed6d024b89d56bbf78e6b63310aba7d9283c142aebdd91b87603f0ca9ec9c",
+      "bytes": 15976
     },
     {
       "path": "dist/core/verse/activity.js",
@@ -2676,8 +2722,8 @@
     },
     {
       "path": "dist/core/verse/authority-api.js",
-      "sha256": "30083c6953626040c17595830a7bed754af44a8c21c1e3ec2fd76e4f133bf123",
-      "bytes": 35470
+      "sha256": "971013e410ef0897e3280ac582d6558eb2b0b84c2136a97f4dada5243a2f68d3",
+      "bytes": 38899
     },
     {
       "path": "dist/core/verse/codex-rollout.js",
@@ -2871,8 +2917,8 @@
     },
     {
       "path": "dist/core/verse/seat-readiness.js",
-      "sha256": "2eb39c406991cd17a058ee83dd2c75df899cbde479fee06a9794076ffb768610",
-      "bytes": 6241
+      "sha256": "ef0c5b93fab81139ab5cbbe2e0ac8462fe4940b531352b7df74810142ff8fc7b",
+      "bytes": 8155
     },
     {
       "path": "dist/core/verse/seats.js",
@@ -2941,8 +2987,8 @@
     },
     {
       "path": "dist/core/verse/verse-api.js",
-      "sha256": "830541b9a742edaf8ce9ee78a0ed8c528f22726d0117e3bec74340f3bfa4b394",
-      "bytes": 89520
+      "sha256": "09d6103adb2b6b43e8d3010afa8f58fc923117d5cb530315917402b715e3f0f0",
+      "bytes": 90025
     },
     {
       "path": "dist/core/verse/verse-log.js",
@@ -3171,5 +3217,5 @@
     "dist/core/swarm/runner.js -> import(<computed>) x3",
     "dist/core/verse/session-engine.js -> import(<computed>) x1"
   ],
-  "digest": "16118607455cb6f0dc415f28aaa522c126e4f040582a7965f41e2bfdef2251f8"
+  "digest": "e526201f9774f05ec81aa84a1c9924b87b473c0356d7bfd6348b25410fc1093e"
 }

package/dist/build-identity.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "3.11.5",
-  "revision": "13f8f7885cd6c1b22ea616b2cc7ef17a4d28e62b",
+  "packageVersion": "3.13.0",
+  "revision": "2d748fec0e41c3e05a5a4e19847f2418ed08e37b",
   "dirty": false,
   "provenance": "git"
 }