@brainervirus/workit-claude-code 4.0.0 → 5.0.0

package/dist/workit.js

@@ -65,7 +65,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@brainervirus/workit-cli",
-    version: "3.0.0",
+    version: "4.0.0",
     private: false,
     description: "Workit CLI — setup wizard, doctor, and task control for agentic coding workflows",
     keywords: [
@@ -15598,13 +15598,13 @@ var METHODS, methodMatches = (definition, requirement) => definition.dimensions?
 };
 var init_methods = __esm(() => {
   METHODS = {
-    "workit-challenge": { dimensions: ["challenge", "decisions"] },
-    "workit-behavioral-tdd": { dimensions: ["testing"], ruleIds: ["mechanical-existing-checks"] },
+    "workit-shape": { dimensions: ["challenge", "decisions", "artifacts", "continuity"] },
+    "workit-bdd": { dimensions: ["testing"] },
     "workit-review": { dimensions: ["review"], ruleIds: ["fresh-context-review", "self-review"] },
-    "workit-plan": { dimensions: ["artifacts", "continuity"] },
-    "workit-implement": { dimensions: ["delegation"] },
+    "workit-implement": { ruleIds: ["mechanical-existing-checks"] },
+    "workit-fanout": { dimensions: ["delegation"] },
     "workit-debug": {},
-    "workit-handoff": {},
+    "workit-continue": {},
     "workit-deslop": { ruleIds: ["pre-pr-cleanup"] }
   };
 });
@@ -21627,10 +21627,15 @@ function recordVerdict(context, input) {
   if (key.dirty === true)
     return err("blocked", `dirty_worktree: ${branch} has uncommitted changes, so its head is not what was judged`, "commit or stash the changes, re-check, then record the verdict");
   const session = context.actor.session;
-  const selfReason = input.self === true ? "flag" : session ? null : "no_session";
+  const selfReason = input.self === true ? "flag" : session && input.derivedFrom !== null ? null : "no_session";
   const self2 = selfReason !== null;
-  if (!self2 && session && authorSessions(context.cwd, ledger.value.rows, branch, { base: key.base, head: key.head }).has(session))
-    return err("blocked", `author_verdict: session ${session} authored ${branch}; a verdict must come from a different session`, 'have a non-author session record the verdict, or pass --self (a self verdict is never accepted by merge:"verified")');
+  const authors = authorSessions(context.cwd, ledger.value.rows, branch, {
+    base: key.base,
+    head: key.head
+  });
+  const authoring = [session, input.derivedFrom].find((candidate) => typeof candidate === "string" && authors.has(candidate));
+  if (!self2 && authoring)
+    return err("blocked", `author_verdict: session ${authoring} authored ${branch}; a verdict must come from a different session`, input.derivedFrom === undefined ? 'have a non-author session record the verdict, or pass --self (a self verdict is never accepted by merge:"verified")' : "run the verifier as a separate session: the lead spawns it with its own WORKIT_SESSION_ID (Claude Code: subagents get one from the SubagentStart hook)");
   const link = checkSupersede(context, "verdict", self2);
   if (!link.ok)
     return link;
@@ -23602,7 +23607,7 @@ var run3 = (root, args) => {
       cwd: target.data
     }
   });
-}, prBabysitNext = (output) => `PR ready: ${output}. Babysitting was explicitly requested. Follow workit-babysit to resolve conflicts, review threads, and get checks green. Stop at PR-ready; a PR or babysit request does not authorize merge or release.`, executeConcreteExternalAction = async (request, root, marker, dateMs, step, workText, caller, approvedBeforeDigest, approvedBeforeExists, coordinationRoot = root, approvedTip, approvedRemote, approvedAccount, approvedApiHost, approvedSourceCommit, approvedCommit, approvedRemoteBase, approvedLocalBase, writerActionLease, approvedSourceBranch, approvedMergeBaseCommit, expectedWorkspaceRevision) => {
+}, prBabysitNext = (output) => `PR ready: ${output}. Babysitting was explicitly requested. Follow workit-ship to resolve conflicts, review threads, and get checks green. Stop at PR-ready; a PR or babysit request does not authorize merge or release.`, executeConcreteExternalAction = async (request, root, marker, dateMs, step, workText, caller, approvedBeforeDigest, approvedBeforeExists, coordinationRoot = root, approvedTip, approvedRemote, approvedAccount, approvedApiHost, approvedSourceCommit, approvedCommit, approvedRemoteBase, approvedLocalBase, writerActionLease, approvedSourceBranch, approvedMergeBaseCommit, expectedWorkspaceRevision) => {
   if (localAction(request.operation)) {
     if (!caller)
       return failure2("capability_unavailable", "local external action writer authority is unavailable", { outcome: "not_started" });
@@ -23717,7 +23722,7 @@ var run3 = (root, args) => {
         ...result,
         ...request.payload.babysit !== undefined ? { babysit: request.payload.babysit } : {},
         ...babysit ? {
-          babysitSkill: "workit-babysit",
+          babysitSkill: "workit-ship",
           next: prBabysitNext(String(result.output ?? ""))
         } : {}
       });
@@ -68239,22 +68244,17 @@ var WORKIT_METHOD_SKILLS, skillManifestNames = (root) => existsSync12(root) ? re
 };
 var init_skill_manifests = __esm(() => {
   WORKIT_METHOD_SKILLS = [
-    "workit-challenge",
-    "workit-behavioral-tdd",
-    "workit-review",
-    "workit-plan",
+    "workit-shape",
     "workit-implement",
+    "workit-review",
     "workit-debug",
-    "workit-handoff",
-    "workit-babysit",
-    "workit-blast-radius",
-    "workit-deslop",
-    "workit-diagram",
-    "workit-mockup",
-    "workit-green-run",
-    "workit-steer",
+    "workit-ship",
+    "workit-continue",
     "workit-bdd",
-    "workit-test-audit"
+    "workit-test-audit",
+    "workit-deslop",
+    "workit-fanout",
+    "workit-verify-app"
   ];
   if (false) {}
 });
@@ -68531,8 +68531,11 @@ var TOKEN_PLACEHOLDER2 = "YOUR_TOKEN_HERE", findDevFromCwd = (cwd) => {
 }, assetPathsFor = (host, dev) => {
   const pkg = path32.join(dev, "packages", `workit-${host}`);
   switch (host) {
-    case "opencode":
-      return WORKIT_METHOD_SKILLS.map((skill) => path32.join(pkg, "assets", "skills", skill, "SKILL.md"));
+    case "opencode": {
+      const packaged = path32.join(pkg, "assets", "skills");
+      const root = existsSync13(packaged) ? packaged : path32.join(dev, "packages", "workit-core", "skills");
+      return WORKIT_METHOD_SKILLS.map((skill) => path32.join(root, skill, "SKILL.md"));
+    }
     case "cursor":
       return [
         path32.join(pkg, "assets", "templates", "workit-contract.md"),
@@ -79819,6 +79822,7 @@ var exports_ledger = {};
 __export(exports_ledger, {
   run: () => run18
 });
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { parseArgs } from "node:util";
 function targetBranch(io, rows, branch, pr) {
   if (pr !== undefined) {
@@ -79901,9 +79905,13 @@ async function run18(argv, io) {
   const target = targetBranch(io, rows, values.branch, pr);
   if (!target.ok)
     return failed(io, target);
+  const acting = actorFor(io, values);
+  if (acting instanceof Error)
+    return usage3(io, acting.message);
+  const { actor } = acting;
   const context = {
     cwd: io.cwd,
-    actor: actorFromEnv(io.env),
+    actor,
     branch: target.value,
     base: values.base ?? null,
     ...pr === undefined ? {} : { pr },
@@ -79931,10 +79939,30 @@ async function run18(argv, io) {
     how: values.how,
     surface: values.surface ?? null,
     self: values.self === true,
-    evidenceRefs: values.evidence
-  })), (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
+    evidenceRefs: values.evidence,
+    ..."derivedFrom" in acting ? { derivedFrom: acting.derivedFrom } : {}
+  })), (row) => `recorded verdict ${row.id}: ${row.result} [${row.kind}] for ${row.branch} @ ${(row.head ?? "").slice(0, 12)} as ${actor.session ?? "no session"}${row.self ? ` (self${row.selfReason === "no_session" ? ": WORKIT_SESSION_ID unset" : ""}; never accepted)` : ""}`);
 }
-var USAGE7 = "workit ledger decision|ruling|verdict|list|check ... (workit help ledger for the grammar)", OPTIONS, positiveInt2 = (value, flag) => {
+var USAGE7 = "workit ledger decision|ruling|verdict|list|check ... (workit help ledger for the grammar)", OPTIONS, SESSION_SAFE2, ROLE_SAFE, actorFor = (io, values) => {
+  const actor = actorFromEnv(io.env);
+  if (values.session !== undefined && values.as !== undefined)
+    return new Error("pass --session or --as, not both");
+  if (values.session !== undefined) {
+    if (!SESSION_SAFE2.test(values.session))
+      return new Error("--session must be 1-128 characters of [A-Za-z0-9_.:@/+-]");
+    return { actor: { ...actor, session: values.session } };
+  }
+  if (values.as !== undefined) {
+    if (!ROLE_SAFE.test(values.as))
+      return new Error("--as takes a lowercase role, e.g. verifier");
+    const prefix = (actor.session ?? actor.host).slice(0, 96);
+    return {
+      actor: { ...actor, session: `${prefix}:${values.as}:${randomBytes4(4).toString("hex")}` },
+      derivedFrom: actor.session
+    };
+  }
+  return { actor };
+}, positiveInt2 = (value, flag) => {
   if (value === undefined)
     return;
   const parsed = Number(value);
@@ -79967,8 +79995,12 @@ var init_ledger2 = __esm(() => {
     type: { type: "string" },
     last: { type: "string" },
     supersedes: { type: "string" },
+    session: { type: "string" },
+    as: { type: "string" },
     json: { type: "boolean" }
   };
+  SESSION_SAFE2 = /^[A-Za-z0-9_.:@/+-]{1,128}$/;
+  ROLE_SAFE = /^[a-z][a-z0-9-]{0,31}$/;
 });
 
 // node_modules/@babel/parser/lib/index.js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brainervirus/workit-claude-code",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "private": false,
   "description": "Workit Claude Code plugin — session and per-turn task context, branch policy on git shell commands, workit method skills, and verifier/reviewer/implementer agents",
   "keywords": [
@@ -39,8 +39,8 @@
     "build": "bun scripts/build.ts"
   },
   "devDependencies": {
-    "@brainervirus/workit-cli": "^4.0.0",
-    "@brainervirus/workit-core": "^4.0.0"
+    "@brainervirus/workit-cli": "^5.0.0",
+    "@brainervirus/workit-core": "^5.0.0"
   },
   "engines": {
     "node": ">=24"

package/skills/bdd/SKILL.md

@@ -1,51 +1,48 @@
 ---
 name: bdd
-description: Use when turning a requirement, issue or acceptance criterion into tests, or when tests should read as behavior (Given/When/Then, BDD, scenarios, acceptance tests, test names and seams)
+description: Turn requirements into Given/When/Then scenarios, agree the test seam, and work test-first in vertical RED/GREEN slices. Use for BDD, TDD, acceptance criteria, scenarios, Given/When/Then, write a test first.
 ---
 
 # Behavior first: Given/When/Then
 
-Write each acceptance criterion as Given/When/Then before any code, then let
-it name the test and pick the seam. This skill shapes the scenarios; the
-RED/GREEN loop itself is workit-behavioral-tdd.
-
-## Method
-
-1. Write the scenarios. One behavior per scenario, in the user's or caller's
-   words: `Given <state>, When <action>, Then <observable result>`. Include the
-   unhappy paths a caller depends on (denied, empty, invalid, timeout).
-2. Agree the seams. Pick the highest stable interface the scenario can be
-   observed through: a CLI verb, a public function, an HTTP route. Ideally one
-   seam per feature. Write the seams down; do not test at an unagreed seam.
-3. Name the tests after the scenarios. The test name is the Given/When/Then
-   sentence; the body is arrange (Given), act (When), assert (Then). Expected
-   values come from the scenario (a literal from a worked example or the
-   spec), never from the code.
-4. Use Gherkin only where the repo already does (`.feature` files with
-   playwright-bdd, cucumber, jest-cucumber). Otherwise plain test names carry
-   the scenario; do not add a BDD framework.
-5. Build in vertical slices, one scenario at a time, with
-   workit-behavioral-tdd: run `workit check test` RED for the new scenario,
-   make the smallest change, run `workit check test` GREEN, then the next.
-6. Mock only at system boundaries: network, clock, randomness, other
-   processes, sometimes the filesystem. Never the unit or its internal
+1. **Write the scenarios.** One behavior each, in the caller's words:
+   `Given <state>, When <action>, Then <observable result>`. Include the
+   unhappy paths callers depend on (denied, empty, invalid, timeout).
+2. **Agree the seam.** The highest stable interface the scenario can be
+   observed through: a CLI verb, a public function, an HTTP route; ideally one
+   per feature. Do not test at a seam nobody agreed to.
+3. **Name tests after scenarios.** The name is the Given/When/Then sentence;
+   the body is arrange, act, assert. Expected values come from the scenario (a
+   literal from a worked example, the spec, an external contract), never from
+   the code under test.
+4. **Build in vertical slices.** Write one vertical RED slice that fails for
+   the missing behavior and run it through the CLI so the failure is observed:
+   `workit check test`. Make the smallest change, run the same check GREEN,
+   then take the next scenario. Any edit makes the observation stale; re-run
+   before you claim it. A recorded "tests pass" is a note, and an ad-hoc
+   `workit check -- <cmd>` never satisfies the gate: only the configured
+   `test` check does. No `test` detected? Create `workit.checks.json`, copying
+   in every check the repo already runs: once it exists it replaces the
+   detected defaults.
+5. **Mock only at system boundaries:** network, clock, randomness, other
+   processes, sometimes the filesystem. Never the unit or its own
    collaborators; use the real thing or an in-memory adapter behind a port.
+6. **Gherkin only where the repo already uses it** (`.feature` files with
+   playwright-bdd, cucumber, jest-cucumber). Otherwise test names carry it.
 
-## Completion
+Reject noise: version-pin assertions, tests that mirror private structure,
+assertions inside a possibly-empty loop, smoke-only renders, duplicates. If a
+test still passes when every imported function returns `undefined`, rewrite it
+(workit-test-audit finds these).
 
-Every acceptance criterion maps to a named test at an agreed seam, each was
-seen RED then GREEN through `workit check test`, and the new tests have no
-tautologies:
+## Example
 
-```sh
-workit test-audit --diff && workit check test
-```
+Bad: `test("calculateTotal works", () => expect(calculateTotal(items)).toBe(items.reduce((s, i) => s + i.price, 0)))`
 
+Good: `test("Given two items of 5 and 10, When totalled, Then the total is 15", () => expect(calculateTotal([{ price: 5 }, { price: 10 }])).toBe(15))`
 
-## In Claude Code
+## Check
 
-Workit operations (`task`, `evidence`, `policy`, `decision`, …) run through
-the `workit` CLI on the Bash tool: `workit <family> <action> --json`
-(`workit --help` lists the verbs). The plugin's `verifier`, `reviewer`
-and `implementer` agents take independent verification, fresh-context
-review and isolated implementation.
+```sh
+workit test-audit --diff && workit check test
+```

package/skills/continue/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: continue
+description: Keep work on track across interruptions and sessions - sort new input, checkpoint, hand off with a resume brief, and pick up by verifying inherited claims. Use for resume, pick up, handoff, new session, interruption, change of direction.
+---
+
+# Continue without losing the thread
+
+## New input mid-task
+
+- **Quick question:** answer it; change nothing else.
+- **Same-task adjustment:** update the affected constraint and next step, then
+  keep going.
+- **Separate request:** do not silently resume an old objective, and do not
+  drop the current one. Checkpoint it (below) if it must continue later, then
+  start the new work. Held items stay parked with their resume condition until
+  the user resumes them.
+
+## Checkpoint and hand off
+
+```sh
+workit git commit -m "wip: <state>" --all   # nothing lives only in your context
+workit handoff --note "<state in one line>" --next "<next command>" --record
+```
+
+The brief carries the branch, HEAD, dirty state, check freshness, verdict,
+rulings and the next command. Add only what it cannot know: choices still
+open, approaches that failed and why. Work spanning repos gets one brief per
+checkout, each with its branch and delivery endpoint.
+
+## Pick up
+
+1. In the checkout: `workit handoff`, then `workit ledger list` and
+   `git log --oneline -10`.
+2. Trust the trail, verify the claims: re-run the checks the brief calls
+   stale, and confirm each "done" item against the goal on the real artifact
+   (a pushed SHA, a PR state, a running feature). Do not re-derive settled
+   decisions.
+3. Continue to the recorded endpoint with the brief's next command.
+
+## Example
+
+Bad: a new session re-reads the whole codebase, re-asks the user which
+approach to take, and redoes a finished slice.
+
+Good: "`workit handoff`: feature/usage at 4be1, `test` stale, verdict none,
+next `workit check test`. Re-ran it: exit 0. The brief says PR #42 is open:
+`workit pr status` confirms, CI pending. Continuing with workit-ship."
+
+## Check
+
+```sh
+workit handoff   # read: "next command" is set and no check is listed as stale
+```

package/skills/debug/SKILL.md

@@ -1,49 +1,45 @@
 ---
 name: debug
-description: Use when behavior is failing, surprising, contradictory, or regressed and the root cause is not established
+description: Find a root cause before patching - start from a red-capable deterministic repro, rank hypotheses, bisect regressions, fix at the root with a regression test. Use for bug, broken, failing, flaky, regression, error, why does.
 ---
 
-# Debug the root cause
-
-Debugging is investigation, not a fast symptom patch. Use this method when
-assessment selects `root-cause-investigation` or behavior is failing without an
-established root cause.
-
-
-## Method
-
-1. Inspect task scope, caller authority, candidate identity, existing evidence,
-   findings, and worker/writer state with shared `task`, `policy`, `evidence`, and
-   `finding` operations.
-2. Reproduce the failure at a stable behavioral boundary. Record observed facts,
-   inferences, and unknowns with references; trace the failing value and all
-   relevant callers before editing.
-3. State the root-cause hypothesis and the smallest in-scope fix. Write a focused
-   regression at the boundary when practical, then run RED and GREEN through
-   `workit check <name>` so the results are observed, not reported.
-4. Acquire writer authority through `writer` before mutation. Reconcile the
-   candidate, evidence, and findings after the change; investigate sibling paths
-   and stale conclusions rather than assuming the first patch worked.
-
-Respect the user's scope and native authority. For a deterministic failure, make
-one focused reproduction that exercises the affected boundary and add a
-regression check when practical. If no direct reproduction exists, gather the
-available evidence and state what remains uncertain instead of inventing a red
-loop or blocking unrelated work.
-
-## Common mistakes
-
-| Mistake                               | Correction                                             |
-| ------------------------------------- | ------------------------------------------------------ |
-| Patching the nearest stack frame      | Trace the input, callers, and shared cause.            |
-| Reproducing only after editing        | Capture the failure before mutation.                   |
-| Treating one passing command as proof | Verify the affected behavior and record real evidence. |
-
-
-## In Claude Code
-
-Workit operations (`task`, `evidence`, `policy`, `decision`, …) run through
-the `workit` CLI on the Bash tool: `workit <family> <action> --json`
-(`workit --help` lists the verbs). The plugin's `verifier`, `reviewer`
-and `implementer` agents take independent verification, fresh-context
-review and isolated implementation.
+# Debug from a red loop
+
+## Steps
+
+1. **Build the loop before any hypothesis.** One command that is red for the
+   user's exact symptom, deterministic, fast and runnable by you:
+   `workit check -- <repro>`. Shrink it until it fails in seconds. If the
+   symptom only shows on the running app, drive it with the project's
+   verify-<app> skill. No loop yet? Building it is the task; do not guess-patch.
+2. **Read the failure, not the summary:** the full error, the failing value,
+   and every caller on its path.
+3. **Rank three to five falsifiable hypotheses**, likeliest first. Test one at
+   a time with the loop or a tagged log line (`[DEBUG-<id>]`, removed at the
+   end with one grep). Keep a short hypothesis log so a dead idea stays dead.
+4. **Regression? Bisect it:** `git bisect start <bad> <good>` then
+   `git bisect run <repro>`. The first bad commit names the cause.
+5. **Fix at the root**, the one place every failing caller passes through.
+   Add a regression test at a seam that exercises the real bug pattern; if no
+   such seam exists, report that as a finding.
+6. **Stop rule:** after three dead hypotheses, write down what is measured and
+   what is inferred, widen the loop, or ask for the one fact only the user has.
+
+Every shipped line traces to evidence from the loop. A "might help" retry or
+guard is a hypothesis, not a fix.
+
+## Example
+
+Bad: "Probably a race; added a retry." (no repro, nothing measured)
+
+Good: "Repro: `workit check -- bun test lock.test.ts -t stale` red 10/10.
+H1 dead pid not reclaimed - confirmed: `kill(pid, 0)` throws EPERM for another
+user's pid and we treated it as dead. Fix: EPERM means alive. Loop green 10/10;
+regression test pins the EPERM case."
+
+## Check
+
+```sh
+workit check -- <repro>   # red before the fix, green after
+workit check test
+```

package/skills/deslop/SKILL.md

@@ -1,40 +1,41 @@
 ---
 name: deslop
-description: Use before opening a PR or after implementation to remove AI slop from code and prose
+description: Remove AI slop before a PR - dead code, comments that restate the code, filler prose - with a minimal diff and identical behavior. Use for deslop, clean up, slop, tidy before PR, remove dead code, trim the PR body.
 ---
 
 # Deslop code and prose
 
-Throughput without quality is slop. Clean it with a minimal diff — deslop
-never refactors behavior.
-
-
-## Method
-
-1. Code: delete dead helpers, redundant validators, stub references, and
-   comments that restate the code. Comments die by default; keep one only
-   with proof of an unchangeable constraint, encoded structurally if cheap.
-2. Prose (PR body, spec, docs): cut filler, keep real symbol names and
-   before→after numbers. One doc, one purpose.
-3. Keep the diff minimal: deslop removes lines, never moves logic. If a
-   cleanup wants behavior change, it becomes its own tasked change.
-
-## Completion
-
-A smaller diff with identical behavior and green checks. Report lines
-removed, not lines written.
-
-Record passing check evidence linked to the `pre-pr-cleanup` requirement id
-from the current policy (`kind: check`, `result: passed`, summary naming what
-was removed). That requirement gates `hosting.pull_request` and close. If the
-change genuinely has nothing to clean, ask for an approved limitation
-decision instead of recording evidence that did not happen.
-
-
-## In Claude Code
-
-Workit operations (`task`, `evidence`, `policy`, `decision`, …) run through
-the `workit` CLI on the Bash tool: `workit <family> <action> --json`
-(`workit --help` lists the verbs). The plugin's `verifier`, `reviewer`
-and `implementer` agents take independent verification, fresh-context
-review and isolated implementation.
+Throughput without quality is slop. Deslop only removes; it never changes
+behavior. A change that wants new behavior is its own change.
+
+1. **Find it with tools first.** The repo's dead-code and lint tools on the
+   branch diff (for example `knip`, `ts-prune`, `vulture`, `cargo udeps`, or
+   the linter's unused rules), then read the diff:
+   `git diff <base>...HEAD`.
+2. **Code.** Delete unused helpers and exports, stub references, debug
+   leftovers (`[DEBUG-` tags, stray logs), and comments that restate the next
+   line. Keep comments that say *why* (a constraint, a workaround with its
+   link), license headers and tool directives.
+3. **Prose** (PR body, spec, docs): cut filler and hedging, keep real symbol
+   names and before-to-after numbers. One doc, one purpose.
+4. **Minimal diff.** Deslop removes lines; it never moves logic. A removed
+   validator that changes behavior is not deslop.
+5. **Re-run the checks** and report lines removed, not lines written. Nothing
+   to clean is a valid result: say what you checked ("0 removals; ran knip and
+   read the diff"). When a tracked task lists a `pre-pr-cleanup` requirement,
+   record this result as its evidence.
+
+## Example
+
+Bad: deleting `// retry: the gateway drops the first request after idle (#412)`
+because "comments die".
+
+Good: deleting `// increment the counter` above `count += 1`, an unused
+`formatLegacyDate` export reported by knip, and two hedging paragraphs from the
+PR body: "-34 lines, behavior unchanged, `workit check test` exit 0".
+
+## Check
+
+```sh
+workit check test && git diff --stat <base>...HEAD
+```

package/skills/fanout/SKILL.md

@@ -0,0 +1,62 @@
+---
+name: fanout
+description: Run independent slices in parallel - one worker per isolated worktree with a fixed brief and file-scope manifest, a non-author verifier per slice, results in the ledger. Use for fan out, parallelize, parallel agents, split the work, delegate, swarm.
+---
+
+# Fan out parallel workers
+
+Fan out only independent slices: disjoint files, no shared mutable state, each
+verifiable alone. Code-coupled work stays with one owner, who fans out after
+the blocking part lands. A worker whose whole job is re-running one command is
+ceremony; do it yourself.
+
+1. **Slice** (workit-shape): each slice gets a branch, a file-scope manifest
+   (the globs it may write) and, if it depends on another, its stack parent.
+2. **Check disjointness.** No two manifests overlap. Shared files (lockfile,
+   registry, barrel exports) belong to one slice, or to you after fan-in.
+3. **Brief each worker** with the fixed template and refuse to spawn while a
+   field is empty: GOAL, SCOPE (the manifest), CONTEXT (pointers, not pasted
+   text), ACCEPTANCE (Given/When/Then), VERIFY (exact commands), TIMEBOX,
+   FORBIDDEN, REPORT, STANDING. STANDING is every standing order and user
+   directive so far, pasted verbatim into each spawn and respawn, because
+   directives decay across resumes. Template: `references/brief.md`.
+4. **Spawn all workers in one message**, in the background, each in its own
+   worktree (Claude Code: the `implementer` agent; elsewhere
+   `git worktree add --detach ../<repo>-wt/<slug> origin/<base>`). The first
+   command a worker runs is `workit git branch <branch> --base <base>`.
+5. **Judge liveness by side effects only:** new commits and pushes
+   (`git log <branch>`), PR and check changes (`workit pr status --branch <b>`).
+   No progress past the timebox means stuck. Stop the old worker and observe
+   that it exited (a timeout is not proof). `git worktree remove --force`
+   drops its uncommitted changes, so first record `git -C <wt> status --short`
+   in the ledger or your report; only then remove the worktree. Respawn with the brief in
+   `MODE: resume` (consolidated: original, later directives, its last report):
+   the new worker runs `git switch <branch>` in its fresh worktree instead of
+   `workit git branch`. Never two live workers on one branch. Replace at most
+   twice, then re-slice or report the gap. Never chain resumes.
+6. **Verify each slice independently.** A fresh agent that did not write it
+   (Claude Code: the `verifier` agent) runs VERIFY and verify-<app>, then
+   `workit ledger verdict <result> --branch <b> --how "<evidence>"` under the
+   session you started it with (`WORKIT_SESSION_ID=<lead>-v<n>`, set by you,
+   never chosen by the author; Claude Code: the hook names one).
+   A worker's report is a pointer, never evidence.
+7. **Fan in.** Compare `git diff --name-only <base>...<b>` with the slice's
+   SCOPE: any file outside it stops the fan-in with a report. Then
+   `workit ledger check --branch <b>` for each slice; restack
+   stacked slices with `workit stack sync`. Only you touch topology: workers
+   never rebase, retarget or merge. Then workit-ship.
+
+## Example
+
+Bad brief: "Do the API part and add tests." (no scope, no acceptance, no
+verify command, so nobody can tell when it is done)
+
+Good brief: `references/brief.md` (GOAL: `GET /v1/usage` returns daily run
+counts; SCOPE: `src/routes/usage.ts`, `test/usage.test.ts`; VERIFY:
+`workit check test`; ...).
+
+## Check
+
+```sh
+workit ledger check --branch <b>   # per slice: accepted (current, passing, independent)
+```